@oneuptime/common 13.0.7 → 14.0.0

package/Tests/App/Dashboard/SecurityEventConnectionDiagnostics.test.tsx

@@ -36,6 +36,7 @@ import {
   readConnectorProviderDetails,
   validateConnectionRange,
 } from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventConnectionDiagnosticsUtil";
+import { readSecurityEventsTimeRange } from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventsTimeRange";
 import { RouteUtil } from "../../../../App/FeatureSet/Dashboard/src/Utils/RouteMap";
 import SecurityEventConnection from "../../../Models/DatabaseModels/SecurityEventConnection";
 import SecurityEventConnectionRun from "../../../Models/DatabaseModels/SecurityEventConnectionRun";
@@ -44,8 +45,9 @@ import HTTPResponse from "../../../Types/API/HTTPResponse";
 import Route from "../../../Types/API/Route";
 import InBetween from "../../../Types/BaseDatabase/InBetween";
 import ListResult from "../../../Types/BaseDatabase/ListResult";
+import RangeStartAndEndDateTime from "../../../Types/Time/RangeStartAndEndDateTime";
+import TimeRange from "../../../Types/Time/TimeRange";
 import { JSONObject } from "../../../Types/JSON";
-import JSONFunctions from "../../../Types/JSONFunctions";
 import ObjectID from "../../../Types/ObjectID";
 import {
   SecurityConnectorSample,
@@ -261,22 +263,57 @@ function scheduledPolling(): HTMLElement {
   return screen.getByRole("region", { name: "Scheduled polling" });
 }
 
-function eventsFilter(route: Route): JSONObject {
+function eventsParams(route: Route): URLSearchParams {
   const text: string = route.toString();
-  const params: URLSearchParams = new URLSearchParams(
-    text.slice(text.indexOf("?")),
-  );
-  return JSONFunctions.deserialize(
-    JSON.parse(params.get("security-events-table-filter")!) as JSONObject,
-  );
+  return new URLSearchParams(text.slice(text.indexOf("?")));
 }
 
-function filterRange(filter: JSONObject): [string, string] {
-  const range: InBetween<Date> = filter["time"] as InBetween<Date>;
-  expect(range).toBeInstanceOf(InBetween);
+/*
+ * The chips the link opens the events explorer with, re-shaped as
+ * `{ attributes: { key: value } }` — the reading these assertions have always
+ * used.
+ *
+ * The link's grammar is the explorers' own `filters` param
+ * (`[["attributes.<key>", "<value>"], ...]`); it used to be the model
+ * table's serialized column filter, which went away with the table. Anything
+ * the explorer does not express as an attribute chip is left out, so an
+ * assertion that a key is absent still means "the link does not filter on
+ * it".
+ */
+function eventsFilter(route: Route): JSONObject {
+  const raw: string | null = eventsParams(route).get("filters");
+
+  if (!raw) {
+    return {};
+  }
+
+  const attributes: JSONObject = {};
+
+  for (const pair of JSON.parse(raw) as Array<[string, string]>) {
+    if (!Array.isArray(pair) || !pair[0]?.startsWith("attributes.")) {
+      continue;
+    }
+
+    attributes[pair[0].substring("attributes.".length)] = pair[1];
+  }
+
+  return Object.keys(attributes).length > 0 ? { attributes } : {};
+}
+
+/*
+ * The window the link opens. It rides on the page's own range params (the
+ * window the Security Events range picker, volume chart and table share), and
+ * is read back here the way the page reads it.
+ */
+function eventsRange(route: Route): [string, string] {
+  const range: RangeStartAndEndDateTime = readSecurityEventsTimeRange(
+    `?${eventsParams(route).toString()}`,
+  );
+  expect(range.range).toBe(TimeRange.CUSTOM);
+  expect(range.startAndEndDate).toBeInstanceOf(InBetween);
   return [
-    new Date(range.startValue).toISOString(),
-    new Date(range.endValue).toISOString(),
+    new Date(range.startAndEndDate!.startValue).toISOString(),
+    new Date(range.startAndEndDate!.endValue).toISOString(),
   ];
 }
 
@@ -1458,13 +1495,49 @@ describe("View events for a connection run", () => {
   });
 
   test("View events targets detection time rather than creation or import time", (): void => {
-    const filter: JSONObject = eventsFilter(connectionEventsRoute(result()));
-    expect(filterRange(filter)).toEqual([
+    const route: Route = connectionEventsRoute(result());
+    expect(eventsRange(route)).toEqual([
       "2026-09-09T01:30:29.000Z",
       "2026-09-09T01:30:31.000Z",
     ]);
     // Without a connection id there is nothing to scope on.
-    expect(filter["attributes"]).toBeUndefined();
+    expect(eventsFilter(route)["attributes"]).toBeUndefined();
+  });
+
+  test("the window is the page's time range, not a chip", (): void => {
+    const route: Route = connectionEventsRoute(result(), CONNECTION_ID);
+    const params: URLSearchParams = eventsParams(route);
+
+    expect(params.get("range")).toBe(TimeRange.CUSTOM);
+    expect(params.get("start")).toBe("2026-09-09T01:30:29.000Z");
+    expect(params.get("end")).toBe("2026-09-09T01:30:31.000Z");
+    // The window is the explorer's own range, never one of its chips.
+    expect(eventsFilter(route)["time"]).toBeUndefined();
+    expect(eventsFilter(route)["attributes"]).toEqual({
+      [SECURITY_CONNECTION_ID_ATTRIBUTE]: CONNECTION_ID,
+    });
+  });
+
+  test("the connection chip is written in the explorer's filters grammar", (): void => {
+    const raw: string | null = eventsParams(
+      connectionEventsRoute(result(), CONNECTION_ID),
+    ).get("filters");
+
+    expect(raw).not.toBeNull();
+    expect(JSON.parse(raw as string)).toEqual([
+      [`attributes.${SECURITY_CONNECTION_ID_ATTRIBUTE}`, CONNECTION_ID],
+    ]);
+  });
+
+  test("a link with nothing to filter on sets no chips at all", (): void => {
+    const params: URLSearchParams = eventsParams(
+      connectionEventsRoute(result()),
+    );
+
+    expect(params.get("filters")).toBeNull();
+    // The retired model table's own filter param is gone for good.
+    expect(params.get("security-events-table-filter")).toBeNull();
+    expect(params.get("range")).toBe(TimeRange.CUSTOM);
   });
 
   /*
@@ -1474,22 +1547,20 @@ describe("View events for a connection run", () => {
    * which for a late-created detection is a day before its creation time.
    */
   test("duplicate-only links recover the detection-time range from samples", (): void => {
-    const filter: JSONObject = eventsFilter(
-      connectionEventsRoute(
-        result({
-          ingestedCount: 0,
-          duplicateCount: 1,
-          eventTimeStart: undefined,
-          eventTimeEnd: undefined,
-        }),
-        CONNECTION_ID,
-      ),
+    const route: Route = connectionEventsRoute(
+      result({
+        ingestedCount: 0,
+        duplicateCount: 1,
+        eventTimeStart: undefined,
+        eventTimeEnd: undefined,
+      }),
+      CONNECTION_ID,
     );
-    expect(filterRange(filter)).toEqual([
+    expect(eventsRange(route)).toEqual([
       "2026-09-09T01:30:29.000Z",
       "2026-09-09T01:30:31.000Z",
     ]);
-    expect(filter["attributes"]).toBeUndefined();
+    expect(eventsFilter(route)["attributes"]).toBeUndefined();
   });
 
   test("a legacy sample's detection time is used the same way", (): void => {
@@ -1498,18 +1569,16 @@ describe("View events for a connection run", () => {
       detectionTime: "2026-09-08T22:00:00Z",
       createdTime: "2026-09-10T04:00:00Z",
     } as unknown as SecurityConnectorSample;
-    const filter: JSONObject = eventsFilter(
-      connectionEventsRoute(
-        result({
-          ingestedCount: 0,
-          duplicateCount: 1,
-          eventTimeStart: undefined,
-          eventTimeEnd: undefined,
-          samples: [legacySample],
-        }),
-      ),
+    const route: Route = connectionEventsRoute(
+      result({
+        ingestedCount: 0,
+        duplicateCount: 1,
+        eventTimeStart: undefined,
+        eventTimeEnd: undefined,
+        samples: [legacySample],
+      }),
     );
-    expect(filterRange(filter)).toEqual([
+    expect(eventsRange(route)).toEqual([
       "2026-09-08T21:59:59.000Z",
       "2026-09-08T22:00:01.000Z",
     ]);
@@ -1517,34 +1586,30 @@ describe("View events for a connection run", () => {
 
   test("creation time is the fallback for a sample without an event time, and the window for no samples", (): void => {
     expect(
-      filterRange(
-        eventsFilter(
-          connectionEventsRoute(
-            result({
-              eventTimeStart: undefined,
-              eventTimeEnd: undefined,
-              samples: [
-                sample({
-                  eventTime: undefined,
-                  createdTime: "2026-09-10T04:10:00Z",
-                }),
-              ],
-            }),
-          ),
+      eventsRange(
+        connectionEventsRoute(
+          result({
+            eventTimeStart: undefined,
+            eventTimeEnd: undefined,
+            samples: [
+              sample({
+                eventTime: undefined,
+                createdTime: "2026-09-10T04:10:00Z",
+              }),
+            ],
+          }),
         ),
       ),
     ).toEqual(["2026-09-10T04:09:59.000Z", "2026-09-10T04:10:01.000Z"]);
 
     expect(
-      filterRange(
-        eventsFilter(
-          connectionEventsRoute(
-            result({
-              eventTimeStart: undefined,
-              eventTimeEnd: undefined,
-              samples: [],
-            }),
-          ),
+      eventsRange(
+        connectionEventsRoute(
+          result({
+            eventTimeStart: undefined,
+            eventTimeEnd: undefined,
+            samples: [],
+          }),
         ),
       ),
     ).toEqual(["2026-09-10T03:59:59.000Z", "2026-09-10T05:00:01.000Z"]);
@@ -1552,14 +1617,12 @@ describe("View events for a connection run", () => {
 
   test("a stored event-time range wins over the samples", (): void => {
     expect(
-      filterRange(
-        eventsFilter(
-          connectionEventsRoute(
-            result({
-              eventTimeStart: "2026-09-01T00:00:00Z",
-              eventTimeEnd: "2026-09-02T00:00:00Z",
-            }),
-          ),
+      eventsRange(
+        connectionEventsRoute(
+          result({
+            eventTimeStart: "2026-09-01T00:00:00Z",
+            eventTimeEnd: "2026-09-02T00:00:00Z",
+          }),
         ),
       ),
     ).toEqual(["2026-08-31T23:59:59.000Z", "2026-09-02T00:00:01.000Z"]);

package/Tests/App/Dashboard/SecurityEventDetailPanel.test.tsx

@@ -0,0 +1,399 @@
+/** @timezone UTC */
+
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import "@testing-library/jest-dom";
+import {
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  within,
+} from "@testing-library/react";
+import * as React from "react";
+import { MemoryRouter } from "react-router-dom";
+import SecurityEvent from "../../../Models/AnalyticsModels/SecurityEvent";
+import OcsfSeverity from "../../../Types/SecurityEvent/OcsfSeverity";
+import Navigation from "../../../UI/Utils/Navigation";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import SecurityEventDetailPanel, {
+  SECURITY_EVENT_DETAIL_ATTRIBUTES_TAB_ID,
+  SECURITY_EVENT_DETAIL_JSON_TAB_ID,
+  SECURITY_EVENT_DETAIL_OVERVIEW_TAB_ID,
+  SECURITY_EVENT_DETAIL_PANEL_TEST_ID,
+} from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventDetailPanel";
+import { SECURITY_EVENT_ATTRIBUTE_FACET_PREFIX } from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventsFacets";
+
+/*
+ * One security event, opened from the list.
+ *
+ * Built on the shared TelemetryDetailPanel — the drawer the traces and
+ * exceptions explorers open — rather than a SideOver, so the list stays
+ * usable behind it. What is pinned here is what the drawer is FOR: reading
+ * the whole event (typed fields, every source attribute, the raw record) and
+ * turning anything in it into a filter on the list behind it without
+ * re-typing it into the search bar.
+ */
+
+const PROJECT_ID: string = "11111111-1111-4111-8111-111111111111";
+
+function event(fields: Partial<SecurityEvent> = {}): SecurityEvent {
+  return Object.assign(new SecurityEvent(), fields);
+}
+
+const FULL_EVENT: SecurityEvent = event({
+  time: new Date("2026-09-17T10:00:00.000Z"),
+  eventUid: "abc123",
+  severityName: OcsfSeverity.Critical,
+  className: "Authentication",
+  categoryName: "IAM",
+  activityName: "Logon",
+  statusName: "Failure",
+  message: "Failed logon for alice",
+  vendorName: "Acme",
+  productName: "Defender",
+  ruleName: "BruteForce",
+  principalUser: "alice",
+  principalHost: "web-01",
+  observables: ["alice", "10.0.0.4"],
+  attributes: {
+    "threat.matched": "true",
+    "device.hostname": "web-01",
+  },
+});
+
+function renderPanel(
+  securityEvent: SecurityEvent = FULL_EVENT,
+  props: {
+    onClose?: () => void;
+    onFilterBy?: (facetKey: string, value: string) => void;
+    onCorrelateObservable?: (observable: string) => void;
+  } = {},
+): void {
+  render(
+    <MemoryRouter>
+      <SecurityEventDetailPanel
+        securityEvent={securityEvent}
+        onClose={props.onClose || ((): void => {})}
+        {...(props.onFilterBy ? { onFilterBy: props.onFilterBy } : {})}
+        {...(props.onCorrelateObservable
+          ? { onCorrelateObservable: props.onCorrelateObservable }
+          : {})}
+      />
+    </MemoryRouter>,
+  );
+}
+
+function panel(): HTMLElement {
+  return screen.getByTestId(SECURITY_EVENT_DETAIL_PANEL_TEST_ID);
+}
+
+function tab(label: string): HTMLElement {
+  return screen.getByRole("tab", { name: new RegExp(`^${label}`) });
+}
+
+function filterButton(label: string): HTMLElement {
+  return screen.getByRole("button", { name: `Filter by ${label}` });
+}
+
+beforeEach(() => {
+  window.history.replaceState(
+    null,
+    "",
+    `/dashboard/${PROJECT_ID}/security-events`,
+  );
+});
+
+afterEach(() => {
+  cleanup();
+  jest.restoreAllMocks();
+});
+
+describe("the drawer", () => {
+  test("names the event and when it happened", () => {
+    renderPanel();
+
+    expect(panel()).toHaveTextContent("Failed logon for alice");
+    expect(panel().textContent).toContain("2026");
+  });
+
+  test("falls back to the event class when there is no message", () => {
+    renderPanel(event({ className: "Authentication" }));
+
+    expect(panel()).toHaveTextContent("Authentication");
+  });
+
+  test("offers Overview, Attributes and JSON, opening on Overview", () => {
+    renderPanel();
+
+    expect(
+      screen.getAllByRole("tab").map((node: HTMLElement): string => {
+        return node.getAttribute("id") || "";
+      }),
+    ).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining(SECURITY_EVENT_DETAIL_OVERVIEW_TAB_ID),
+        expect.stringContaining(SECURITY_EVENT_DETAIL_ATTRIBUTES_TAB_ID),
+        expect.stringContaining(SECURITY_EVENT_DETAIL_JSON_TAB_ID),
+      ]),
+    );
+    expect(tab("Overview")).toHaveAttribute("aria-selected", "true");
+  });
+
+  test("the Attributes tab counts what it holds, so a reader knows before opening it", () => {
+    renderPanel();
+
+    expect(tab("Attributes")).toHaveTextContent("2");
+  });
+
+  test("closing it tells the page", () => {
+    const onClose: MockFunction = getJestMockFunction();
+
+    renderPanel(FULL_EVENT, { onClose: onClose as unknown as () => void });
+
+    fireEvent.click(screen.getByRole("button", { name: /close/i }));
+
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("Overview", () => {
+  test("shows the typed OCSF fields, severity as a pill", () => {
+    renderPanel();
+
+    expect(panel()).toHaveTextContent("Event Class");
+    expect(panel()).toHaveTextContent("Authentication");
+    expect(panel()).toHaveTextContent("Status");
+    expect(panel()).toHaveTextContent("Failure");
+    expect(panel()).toHaveTextContent(OcsfSeverity.Critical);
+  });
+
+  test("omits what the source did not say", () => {
+    renderPanel(event({ className: "Authentication" }));
+
+    expect(panel()).not.toHaveTextContent("Target Host");
+    expect(panel()).not.toHaveTextContent("MITRE Tactics");
+  });
+
+  test("lists observables as chips, and says so when there are none", () => {
+    renderPanel();
+
+    expect(
+      screen.getByTestId("security-event-panel-observable-chip-0"),
+    ).toHaveTextContent("alice");
+    expect(
+      screen.getByTestId("security-event-panel-observable-chip-1"),
+    ).toHaveTextContent("10.0.0.4");
+
+    cleanup();
+    renderPanel(event({ message: "no observables" }));
+
+    expect(panel()).toHaveTextContent(
+      "No observables extracted from this event.",
+    );
+  });
+});
+
+describe("filtering the list from the drawer", () => {
+  test("severity, and every typed field the sidebar also facets, offers a filter", () => {
+    const onFilterBy: MockFunction = getJestMockFunction();
+
+    renderPanel(FULL_EVENT, {
+      onFilterBy: onFilterBy as unknown as (
+        facetKey: string,
+        value: string,
+      ) => void,
+    });
+
+    fireEvent.click(filterButton("Severity"));
+    expect(onFilterBy).toHaveBeenLastCalledWith(
+      "severityName",
+      OcsfSeverity.Critical,
+    );
+
+    fireEvent.click(filterButton("Event Class"));
+    expect(onFilterBy).toHaveBeenLastCalledWith("className", "Authentication");
+
+    fireEvent.click(filterButton("Principal User"));
+    expect(onFilterBy).toHaveBeenLastCalledWith("principalUser", "alice");
+
+    fireEvent.click(filterButton("Detection Rule"));
+    expect(onFilterBy).toHaveBeenLastCalledWith("ruleName", "BruteForce");
+  });
+
+  /*
+   * Filtering on a value that is unique per row would return the one event
+   * already on screen, so those fields deliberately offer no action.
+   */
+  test("free-text and unique fields offer none", () => {
+    renderPanel(FULL_EVENT, {
+      onFilterBy: getJestMockFunction() as unknown as (
+        facetKey: string,
+        value: string,
+      ) => void,
+    });
+
+    expect(
+      screen.queryByRole("button", { name: "Filter by Message" }),
+    ).toBeNull();
+    expect(
+      screen.queryByRole("button", { name: "Filter by Event UID" }),
+    ).toBeNull();
+  });
+
+  test("an attribute filters under its own attributes.<key> chip", () => {
+    const onFilterBy: MockFunction = getJestMockFunction();
+
+    renderPanel(FULL_EVENT, {
+      onFilterBy: onFilterBy as unknown as (
+        facetKey: string,
+        value: string,
+      ) => void,
+    });
+
+    fireEvent.click(tab("Attributes"));
+    fireEvent.click(filterButton("threat.matched"));
+
+    expect(onFilterBy).toHaveBeenCalledWith(
+      `${SECURITY_EVENT_ATTRIBUTE_FACET_PREFIX}threat.matched`,
+      "true",
+    );
+  });
+
+  test("a page that cannot filter gets no filter actions at all", () => {
+    renderPanel();
+
+    expect(screen.queryByRole("button", { name: /^Filter by/ })).toBeNull();
+  });
+});
+
+describe("Attributes", () => {
+  test("lists every source attribute, sorted, with its value", () => {
+    renderPanel();
+
+    fireEvent.click(tab("Attributes"));
+
+    const terms: Array<string> = Array.from(panel().querySelectorAll("dt")).map(
+      (node: Element): string => {
+        return node.textContent || "";
+      },
+    );
+
+    expect(terms).toEqual(["device.hostname", "threat.matched"]);
+    expect(panel()).toHaveTextContent("web-01");
+    expect(panel()).toHaveTextContent("true");
+  });
+
+  test("an event with none says so", () => {
+    renderPanel(event({ message: "bare" }));
+
+    fireEvent.click(tab("Attributes"));
+
+    expect(panel()).toHaveTextContent("No attributes recorded for this event.");
+  });
+});
+
+describe("JSON", () => {
+  test("prints the record, including what the source left empty", () => {
+    renderPanel();
+
+    fireEvent.click(tab("JSON"));
+
+    const json: Record<string, unknown> = JSON.parse(
+      screen.getByTestId("security-event-detail-json").textContent || "{}",
+    );
+
+    expect(json["message"]).toBe("Failed logon for alice");
+    expect(json["severityName"]).toBe(OcsfSeverity.Critical);
+    expect(json["targetHost"]).toBe("");
+    expect(json["attributes"]).toEqual({
+      "threat.matched": "true",
+      "device.hostname": "web-01",
+    });
+  });
+
+  /*
+   * An analytics model carries its whole table definition on the object;
+   * serializing that would bury twenty facts about the event under a few
+   * hundred about the table.
+   */
+  test("describes the event, not the table", () => {
+    renderPanel();
+
+    fireEvent.click(tab("JSON"));
+
+    const text: string =
+      screen.getByTestId("security-event-detail-json").textContent || "";
+
+    expect(text).not.toContain("tableColumns");
+    expect(text).not.toContain("accessControl");
+  });
+});
+
+describe("correlating an observable", () => {
+  test("deep-links to the Correlate tab seeded with the observable", () => {
+    const navigate: MockFunction = getJestMockFunction();
+    jest
+      .spyOn(Navigation, "navigate")
+      .mockImplementation(navigate as unknown as typeof Navigation.navigate);
+
+    renderPanel();
+
+    fireEvent.click(
+      screen.getByTestId("security-event-panel-observable-chip-1"),
+    );
+
+    expect(navigate).toHaveBeenCalledTimes(1);
+    const route: string = String((navigate.mock.calls[0] as Array<unknown>)[0]);
+
+    expect(route).toContain("/security-events/correlate");
+    expect(route).toContain(`observable=${encodeURIComponent("10.0.0.4")}`);
+  });
+
+  test("a host that already shows a graph pivots in place instead", () => {
+    const onCorrelateObservable: MockFunction = getJestMockFunction();
+    const navigate: MockFunction = getJestMockFunction();
+    jest
+      .spyOn(Navigation, "navigate")
+      .mockImplementation(navigate as unknown as typeof Navigation.navigate);
+
+    renderPanel(FULL_EVENT, {
+      onCorrelateObservable: onCorrelateObservable as unknown as (
+        observable: string,
+      ) => void,
+    });
+
+    fireEvent.click(
+      screen.getByTestId("security-event-panel-observable-chip-0"),
+    );
+
+    expect(onCorrelateObservable).toHaveBeenCalledWith("alice");
+    expect(navigate).not.toHaveBeenCalled();
+  });
+});
+
+describe("the drawer is a modal", () => {
+  test("Escape closes it", () => {
+    const onClose: MockFunction = getJestMockFunction();
+
+    renderPanel(FULL_EVENT, { onClose: onClose as unknown as () => void });
+
+    fireEvent.keyDown(document, { key: "Escape" });
+
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+
+  test("its tabs are a real tablist", () => {
+    renderPanel();
+
+    const tablist: HTMLElement = screen.getByRole("tablist");
+
+    expect(within(tablist).getAllByRole("tab")).toHaveLength(3);
+  });
+});