@oneuptime/common 13.0.7 → 14.0.0

package/Tests/App/Dashboard/SecurityEventsNavTabs.test.tsx

@@ -0,0 +1,248 @@
+import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
+import "@testing-library/jest-dom";
+import { act, cleanup, render } from "@testing-library/react";
+import * as React from "react";
+import { MemoryRouter } from "react-router-dom";
+import SecurityEventsNavTabs from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventsNavTabs";
+import { getSecurityEventsBreadcrumbs } from "../../../../App/FeatureSet/Dashboard/src/Utils/Breadcrumbs/SecurityEventsBreadcrumbs";
+import PageMap from "../../../../App/FeatureSet/Dashboard/src/Utils/PageMap";
+import { RouteUtil } from "../../../../App/FeatureSet/Dashboard/src/Utils/RouteMap";
+import {
+  SecurityEventsTabKey,
+  getActiveSecurityEventsTab,
+} from "../../../../App/FeatureSet/Dashboard/src/Utils/SecurityEventsNavigation";
+import { writeTelemetryViewerUrlState } from "../../../../App/FeatureSet/Dashboard/src/Utils/TelemetryViewerUrlState";
+import Link from "../../../Types/Link";
+import { goTo, PROJECT_ID, routeFor } from "./SideMenuHarness";
+
+/*
+ * The Security Events destinations, as header tabs.
+ *
+ * They used to be a left side menu, which put this product out of step with
+ * every other telemetry signal — Logs, Traces, Metrics and Exceptions all
+ * carry theirs in the page header through the same shared TelemetryNavTabs.
+ * What is pinned here is what the move must not lose: every destination still
+ * reachable exactly once, the tab you are on highlighted, the labels still
+ * matching their breadcrumb leaves, and the Events tab carrying the slice the
+ * reader is looking at so switching away and back does not silently reset it.
+ */
+
+interface ExpectedTab {
+  label: string;
+  pageMapKey: string;
+  tab: SecurityEventsTabKey;
+}
+
+const EXPECTED_TABS: Array<ExpectedTab> = [
+  { label: "Events", pageMapKey: PageMap.SECURITY_EVENTS, tab: "events" },
+  {
+    label: "Correlate",
+    pageMapKey: PageMap.SECURITY_EVENTS_CORRELATE,
+    tab: "correlate",
+  },
+  {
+    label: "Detection Rules",
+    pageMapKey: PageMap.SECURITY_EVENTS_DETECTION_RULES,
+    tab: "detection-rules",
+  },
+  {
+    label: "Threat Intel",
+    pageMapKey: PageMap.SECURITY_EVENTS_THREAT_INTEL,
+    tab: "threat-intel",
+  },
+  {
+    label: "Monitors",
+    pageMapKey: PageMap.SECURITY_EVENTS_MONITORS,
+    tab: "monitors",
+  },
+  {
+    label: "Connections",
+    pageMapKey: PageMap.SECURITY_EVENTS_CONNECTIONS,
+    tab: "connections",
+  },
+  {
+    label: "Setup Guide",
+    pageMapKey: PageMap.SECURITY_EVENTS_DOCUMENTATION,
+    tab: "setup",
+  },
+];
+
+function renderTabs(active: SecurityEventsTabKey): void {
+  render(
+    <MemoryRouter>
+      <SecurityEventsNavTabs active={active} />
+    </MemoryRouter>,
+  );
+}
+
+function anchors(): Array<HTMLAnchorElement> {
+  return Array.from(document.querySelectorAll("a"));
+}
+
+function labels(): Array<string> {
+  return anchors().map((anchor: HTMLAnchorElement): string => {
+    return anchor.textContent?.trim() ?? "";
+  });
+}
+
+function hrefs(): Array<string> {
+  return anchors().map((anchor: HTMLAnchorElement): string => {
+    return anchor.getAttribute("href") ?? "";
+  });
+}
+
+function anchorFor(label: string): HTMLAnchorElement {
+  const anchor: HTMLAnchorElement | undefined = anchors().find(
+    (candidate: HTMLAnchorElement): boolean => {
+      return candidate.textContent?.trim() === label;
+    },
+  );
+
+  if (!anchor) {
+    throw new Error(
+      `No tab labelled "${label}". Tabs rendered: ${labels().join(", ")}`,
+    );
+  }
+
+  return anchor;
+}
+
+beforeEach(() => {
+  goTo(`/dashboard/${PROJECT_ID}/security-events`);
+});
+
+afterEach(() => {
+  cleanup();
+});
+
+describe("Security Events header tabs", () => {
+  test("every destination is a tab, in the intended order", () => {
+    renderTabs("events");
+
+    expect(labels()).toEqual(
+      EXPECTED_TABS.map((tab: ExpectedTab): string => {
+        return tab.label;
+      }),
+    );
+  });
+
+  test("keeps all seven routes reachable exactly once, with icons", () => {
+    renderTabs("events");
+
+    const expectedHrefs: Array<string> = EXPECTED_TABS.map(
+      (tab: ExpectedTab): string => {
+        return routeFor(tab.pageMapKey);
+      },
+    );
+
+    expect(anchors()).toHaveLength(7);
+    expect(hrefs()).toEqual(expectedHrefs);
+    expect(new Set(hrefs()).size).toBe(hrefs().length);
+    expect(new Set(labels()).size).toBe(labels().length);
+
+    for (const anchor of anchors()) {
+      expect(anchor.querySelector("svg")).not.toBeNull();
+    }
+  });
+
+  /*
+   * A ":projectId" left in an href is the classic failure of these menus: the
+   * link renders, reads correctly, and navigates to a page that cannot load.
+   */
+  test("every href is resolved against the current project", () => {
+    renderTabs("events");
+
+    for (const href of hrefs()) {
+      expect(href.startsWith(`/dashboard/${PROJECT_ID}/`)).toBe(true);
+      expect(href).not.toContain(":projectId");
+    }
+  });
+
+  test.each(EXPECTED_TABS)(
+    "$label is the highlighted tab when it is the active one",
+    (tab: ExpectedTab): void => {
+      renderTabs(tab.tab);
+
+      const anchor: HTMLAnchorElement = anchorFor(tab.label);
+
+      expect(anchor).toHaveClass("bg-indigo-50");
+      expect(anchor).toHaveClass("text-indigo-700");
+      expect(
+        Array.from(document.querySelectorAll("a.bg-indigo-50")),
+      ).toHaveLength(1);
+    },
+  );
+
+  test.each(EXPECTED_TABS)(
+    "the route of $label resolves back to its own tab",
+    (tab: ExpectedTab): void => {
+      expect(getActiveSecurityEventsTab(routeFor(tab.pageMapKey))).toBe(
+        tab.tab,
+      );
+    },
+  );
+
+  test("every tab label matches its breadcrumb leaf", () => {
+    for (const tab of EXPECTED_TABS) {
+      const trail: Array<Link> | undefined = getSecurityEventsBreadcrumbs(
+        RouteUtil.getRouteString(tab.pageMapKey as never),
+      );
+
+      expect(trail).toBeDefined();
+      expect(trail?.[trail.length - 1]?.title).toBe(
+        tab.pageMapKey === PageMap.SECURITY_EVENTS
+          ? "Security Events"
+          : tab.label,
+      );
+    }
+  });
+});
+
+describe("the Events tab carries the slice the reader is looking at", () => {
+  /*
+   * Only the Events tab is backed by an explorer, so it is the only tab whose
+   * link can describe a slice. Handing a `filters` payload to Detection Rules
+   * or Connections would put params on a URL nothing there reads — and
+   * re-emit them on the way back as if the user had set them there.
+   */
+  test("carries the window and chips onto the Events link, and onto no other", () => {
+    goTo(`/dashboard/${PROJECT_ID}/security-events/correlate`);
+
+    act(() => {
+      writeTelemetryViewerUrlState({
+        range: "PAST_ONE_WEEK",
+        filters: JSON.stringify([["severityName", "Critical"]]),
+        search: "failed logon",
+      });
+    });
+
+    renderTabs("correlate");
+
+    const eventsHref: string = anchorFor("Events").getAttribute("href") ?? "";
+    const params: URLSearchParams = new URLSearchParams(
+      eventsHref.slice(eventsHref.indexOf("?")),
+    );
+
+    expect(params.get("range")).toBe("PAST_ONE_WEEK");
+    expect(JSON.parse(params.get("filters") as string)).toEqual([
+      ["severityName", "Critical"],
+    ]);
+    expect(params.get("search")).toBe("failed logon");
+
+    for (const label of ["Correlate", "Detection Rules", "Connections"]) {
+      expect(anchorFor(label).getAttribute("href")).not.toContain("?");
+    }
+  });
+
+  test("an unscoped page leaves every href bare", () => {
+    act(() => {
+      writeTelemetryViewerUrlState({});
+    });
+
+    renderTabs("events");
+
+    for (const href of hrefs()) {
+      expect(href).not.toContain("?");
+    }
+  });
+});

package/Tests/App/Dashboard/SecurityEventsNoResults.test.tsx

@@ -0,0 +1,222 @@
+/** @timezone UTC */
+
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { cleanup, fireEvent, render, screen } from "@testing-library/react";
+import React from "react";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import SecurityEventsNoResults, {
+  SECURITY_EVENTS_NO_RESULTS_ID,
+  getShowTimeRangeButtonTitle,
+} from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventsNoResults";
+import InBetween from "../../../Types/BaseDatabase/InBetween";
+import OneUptimeDate from "../../../Types/Date";
+import RangeStartAndEndDateTime from "../../../Types/Time/RangeStartAndEndDateTime";
+import TimeRange from "../../../Types/Time/TimeRange";
+
+/*
+ * An empty Security Events table in a project that DOES have events. The
+ * setup empty state (SecurityEventsEmptyState) is for a project that has
+ * never received one; this says why the table is empty instead, and offers
+ * the time range that would bring the newest event back.
+ */
+
+const NOW: Date = new Date("2026-09-18T12:00:00.000Z");
+const DAY_MS: number = 24 * 60 * 60 * 1000;
+const WINDOW_START: Date = new Date(NOW.getTime() - DAY_MS);
+
+function root(): HTMLElement {
+  return document.getElementById(SECURITY_EVENTS_NO_RESULTS_ID) as HTMLElement;
+}
+
+beforeEach(() => {
+  jest.spyOn(OneUptimeDate, "getCurrentDate").mockReturnValue(NOW);
+});
+
+afterEach(() => {
+  cleanup();
+  jest.restoreAllMocks();
+});
+
+describe("SecurityEventsNoResults", () => {
+  test("with nothing known about older events, says only what is certain", () => {
+    render(<SecurityEventsNoResults windowStartDate={WINDOW_START} />);
+
+    expect(
+      screen.getByRole("heading", {
+        name: "No security events in this time range",
+      }),
+    ).toBeInTheDocument();
+    expect(root()).toHaveTextContent(
+      "Try a wider time range, or clear the filters applied to the table.",
+    );
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  test("never sends someone who is already ingesting to the setup guide", () => {
+    render(
+      <SecurityEventsNoResults
+        windowStartDate={WINDOW_START}
+        latestEventTime={new Date(NOW.getTime() - 3 * DAY_MS)}
+        onShowTimeRange={getJestMockFunction()}
+      />,
+    );
+
+    expect(screen.queryByText("Read the setup guide")).toBeNull();
+    expect(screen.queryByText("Connect a security product")).toBeNull();
+    expect(screen.queryByText("No security events yet")).toBeNull();
+  });
+
+  test("when the newest event is older than the window, says when it arrived", () => {
+    const latest: Date = new Date(NOW.getTime() - 3 * DAY_MS);
+
+    render(
+      <SecurityEventsNoResults
+        windowStartDate={WINDOW_START}
+        latestEventTime={latest}
+      />,
+    );
+
+    expect(
+      screen.getByRole("heading", {
+        name: "No security events in this time range",
+      }),
+    ).toBeInTheDocument();
+    expect(root()).toHaveTextContent("The most recent security event arrived");
+    expect(root()).toHaveTextContent(
+      OneUptimeDate.getDateAsLocalFormattedString(latest),
+    );
+  });
+
+  test("offers the narrowest range that reaches the newest event", () => {
+    const onShowTimeRange: MockFunction = getJestMockFunction();
+
+    render(
+      <SecurityEventsNoResults
+        windowStartDate={WINDOW_START}
+        latestEventTime={new Date(NOW.getTime() - 3 * DAY_MS)}
+        onShowTimeRange={onShowTimeRange}
+      />,
+    );
+
+    fireEvent.click(screen.getByRole("button", { name: "Show past 1 week" }));
+
+    expect(onShowTimeRange).toHaveBeenCalledTimes(1);
+    expect(onShowTimeRange).toHaveBeenCalledWith({
+      range: TimeRange.PAST_ONE_WEEK,
+    });
+  });
+
+  test("for an event older than every preset, offers the window from just before it", () => {
+    const onShowTimeRange: MockFunction = getJestMockFunction();
+    const latest: Date = new Date(NOW.getTime() - 200 * DAY_MS);
+
+    render(
+      <SecurityEventsNoResults
+        windowStartDate={WINDOW_START}
+        latestEventTime={latest}
+        onShowTimeRange={onShowTimeRange}
+      />,
+    );
+
+    fireEvent.click(
+      screen.getByTestId(`${SECURITY_EVENTS_NO_RESULTS_ID}-show-range`),
+    );
+
+    const picked: RangeStartAndEndDateTime = onShowTimeRange.mock
+      .calls[0]![0] as RangeStartAndEndDateTime;
+    expect(picked.range).toBe(TimeRange.CUSTOM);
+    expect(new Date(picked.startAndEndDate!.startValue).getTime()).toBe(
+      latest.getTime() - DAY_MS,
+    );
+    expect(new Date(picked.startAndEndDate!.endValue).getTime()).toBe(
+      NOW.getTime(),
+    );
+  });
+
+  test("without a way to change the range, offers no button", () => {
+    render(
+      <SecurityEventsNoResults
+        windowStartDate={WINDOW_START}
+        latestEventTime={new Date(NOW.getTime() - 3 * DAY_MS)}
+      />,
+    );
+
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  test("when the newest event is inside the window, blames the filters instead", () => {
+    render(
+      <SecurityEventsNoResults
+        windowStartDate={WINDOW_START}
+        latestEventTime={new Date(NOW.getTime() - 60 * 1000)}
+        onShowTimeRange={getJestMockFunction()}
+      />,
+    );
+
+    expect(
+      screen.getByRole("heading", {
+        name: "No security events match these filters",
+      }),
+    ).toBeInTheDocument();
+    expect(root()).toHaveTextContent(
+      "Events have arrived in this time range, but none of them match the filters applied to the table.",
+    );
+    // Widening the window cannot help when the filters are what emptied it.
+    expect(screen.queryByRole("button")).toBeNull();
+  });
+
+  test("an event exactly at the window's start counts as inside it", () => {
+    render(
+      <SecurityEventsNoResults
+        windowStartDate={WINDOW_START}
+        latestEventTime={WINDOW_START}
+      />,
+    );
+
+    expect(
+      screen.getByRole("heading", {
+        name: "No security events match these filters",
+      }),
+    ).toBeInTheDocument();
+  });
+
+  test("uses the compact table padding, like the setup empty state", () => {
+    render(<SecurityEventsNoResults windowStartDate={WINDOW_START} />);
+
+    expect(root()).toHaveClass("py-4");
+    expect(root()).not.toHaveClass("pt-52");
+  });
+});
+
+describe("getShowTimeRangeButtonTitle", () => {
+  test.each([
+    [TimeRange.PAST_ONE_HOUR, "Show past 1 hour"],
+    [TimeRange.PAST_ONE_DAY, "Show past 1 day"],
+    [TimeRange.PAST_ONE_WEEK, "Show past 1 week"],
+    [TimeRange.PAST_ONE_MONTH, "Show past 1 month"],
+    [TimeRange.PAST_THREE_MONTHS, "Show past 3 months"],
+  ])("names %s", (range: TimeRange, title: string) => {
+    expect(getShowTimeRangeButtonTitle({ range: range })).toBe(title);
+  });
+
+  test("names a custom window by the date it starts from", () => {
+    const start: Date = new Date("2026-02-01T00:00:00.000Z");
+
+    expect(
+      getShowTimeRangeButtonTitle({
+        range: TimeRange.CUSTOM,
+        startAndEndDate: new InBetween<Date>(start, NOW),
+      }),
+    ).toBe(
+      `Show events since ${OneUptimeDate.getDateAsLocalFormattedString(start, true)}`,
+    );
+  });
+});

package/Tests/App/Dashboard/SecurityEventsThreatIntelPage.test.tsx

@@ -0,0 +1,199 @@
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { cleanup, render, screen } from "@testing-library/react";
+import * as React from "react";
+import { MemoryRouter } from "react-router-dom";
+
+/*
+ * The Threat Intel page leads with the "how threat intel works" card, and
+ * its feeds table's help (?) modal shows the same guide, so the two cannot
+ * disagree. Both tables are mocked to capture their props and render a
+ * marker, so the page's own composition is what is under test.
+ */
+
+type CapturedFormField = {
+  field: Record<string, boolean>;
+  title: string;
+  validation?:
+    | { minValue?: number | undefined; maxValue?: number | undefined }
+    | undefined;
+};
+
+type CapturedTableProps = {
+  formFields?: Array<CapturedFormField>;
+  createInitialValues?: Record<string, unknown>;
+  helpContent?:
+    | {
+        title?: string | undefined;
+        description?: string | undefined;
+        markdown?: string | undefined;
+      }
+    | undefined;
+};
+
+let capturedFeedTableProps: CapturedTableProps | null = null;
+
+jest.mock("../../../UI/Components/ModelTable/ModelTable", () => {
+  return {
+    __esModule: true,
+    default: (props: CapturedTableProps) => {
+      capturedFeedTableProps = props;
+      return React.createElement("div", { "data-testid": "feeds-table" });
+    },
+  };
+});
+
+jest.mock("../../../UI/Components/ModelTable/AnalyticsModelTable", () => {
+  return {
+    __esModule: true,
+    default: () => {
+      return React.createElement("div", { "data-testid": "indicators-table" });
+    },
+  };
+});
+
+import ThreatIntelPage from "../../../../App/FeatureSet/Dashboard/src/Pages/SecurityEvents/ThreatIntel";
+import ThreatIntelGuide from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/HowItWorks/ThreatIntelGuide";
+import { guideToMarkdown } from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/HowItWorks/SecurityEventsGuide";
+import Project from "../../../Models/DatabaseModels/Project";
+import Reseller from "../../../Models/DatabaseModels/Reseller";
+import ProjectUtil from "../../../UI/Utils/Project";
+import PermissionGate from "../../../UI/Utils/PermissionGate";
+import ObjectID from "../../../Types/ObjectID";
+import Route from "../../../Types/API/Route";
+import {
+  THREAT_INTEL_DEFAULT_POLL_INTERVAL_IN_MINUTES,
+  THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES,
+  THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES,
+} from "../../../Types/SecurityEvent/ThreatIntelConstants";
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+
+function renderPage(project?: Project): void {
+  const currentProject: Project = project || new Project();
+  currentProject.id = PROJECT_ID;
+
+  render(
+    <MemoryRouter>
+      <ThreatIntelPage
+        pageRoute={new Route("/dashboard/security-events/threat-intel")}
+        currentProject={currentProject}
+        hasPaymentMethod={true}
+      />
+    </MemoryRouter>,
+  );
+}
+
+function fieldTitled(title: string): CapturedFormField {
+  const field: CapturedFormField | undefined =
+    capturedFeedTableProps?.formFields?.find(
+      (formField: CapturedFormField): boolean => {
+        return formField.title === title;
+      },
+    );
+
+  expect(field).toBeDefined();
+
+  return field!;
+}
+
+function isBefore(first: HTMLElement, second: HTMLElement): boolean {
+  return Boolean(
+    first.compareDocumentPosition(second) & Node.DOCUMENT_POSITION_FOLLOWING,
+  );
+}
+
+describe("Threat Intel page", () => {
+  beforeEach(() => {
+    capturedFeedTableProps = null;
+    window.localStorage.clear();
+    jest.spyOn(ProjectUtil, "getCurrentProjectId").mockReturnValue(PROJECT_ID);
+    jest.spyOn(PermissionGate, "check").mockReturnValue({ isAllowed: true });
+  });
+
+  afterEach(() => {
+    cleanup();
+    jest.restoreAllMocks();
+    window.localStorage.clear();
+  });
+
+  test("leads with the how-it-works card, above the feeds and indicators tables", () => {
+    renderPage();
+
+    const card: HTMLElement = screen.getByTestId(
+      `how-it-works-${ThreatIntelGuide.id}`,
+    );
+
+    expect(card).toHaveTextContent(ThreatIntelGuide.title);
+    expect(isBefore(card, screen.getByTestId("feeds-table"))).toBe(true);
+    expect(
+      isBefore(
+        screen.getByTestId("feeds-table"),
+        screen.getByTestId("indicators-table"),
+      ),
+    ).toBe(true);
+  });
+
+  test("the card shows the threat levels, one chip per confidence band plus unscored", () => {
+    renderPage();
+
+    expect(screen.getAllByTestId("how-it-works-level")).toHaveLength(
+      ThreatIntelGuide.levels.items.length,
+    );
+    expect(screen.getByText("Threat levels")).toBeInTheDocument();
+  });
+
+  test("the feeds table's help (?) modal shows the same guide as the card", () => {
+    renderPage();
+
+    expect(capturedFeedTableProps?.helpContent).toEqual({
+      title: ThreatIntelGuide.guideTitle,
+      description: ThreatIntelGuide.guideDescription,
+      markdown: guideToMarkdown(ThreatIntelGuide),
+    });
+  });
+
+  test("the poll interval form bounds are the ones the guide states", () => {
+    renderPage();
+
+    const pollInterval: CapturedFormField = fieldTitled(
+      "Poll Interval (Minutes)",
+    );
+
+    expect(pollInterval.validation?.minValue).toBe(
+      THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES,
+    );
+    expect(pollInterval.validation?.maxValue).toBe(
+      THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES,
+    );
+    expect(capturedFeedTableProps?.createInitialValues).toMatchObject({
+      pollIntervalInMinutes: THREAT_INTEL_DEFAULT_POLL_INTERVAL_IN_MINUTES,
+    });
+  });
+
+  test("a reseller plan without telemetry sees neither the card nor the tables", () => {
+    const project: Project = new Project();
+    const reseller: Reseller = new Reseller();
+    reseller.enableTelemetryFeatures = false;
+    project.reseller = reseller;
+
+    renderPage(project);
+
+    expect(
+      screen.queryByTestId(`how-it-works-${ThreatIntelGuide.id}`),
+    ).not.toBeInTheDocument();
+    expect(screen.queryByTestId("feeds-table")).not.toBeInTheDocument();
+    expect(
+      screen.getByText(/did not include telemetry features/),
+    ).toBeInTheDocument();
+  });
+});