@oneuptime/common 13.0.8 → 14.0.0

package/Tests/Types/API/HostnameFromAuthority.test.ts

@@ -12,8 +12,10 @@ import { describe, expect, test } from "@jest/globals";
  * consumer, which is why a monitor on a non-443 port could never connect —
  * see https://github.com/OneUptime/oneuptime/issues/3225.
  *
- * fromString() is NOT a substitute: it splits on the FIRST colon, which
- * mangles every IPv6 literal.
+ * fromString() used not to be a substitute: it split on the FIRST colon,
+ * which mangled every IPv6 literal. It now delegates IPv6 authorities here
+ * instead, so the two agree on addresses; they still differ on a DNS host,
+ * where fromString keeps its own splitting and its own userinfo handling.
  */
 describe("Hostname.fromAuthority", () => {
   describe("host and port", () => {
@@ -141,18 +143,26 @@ describe("Hostname.fromAuthority", () => {
   });
 
   describe("contrast with fromString", () => {
-    test("fromString rejects an IPv6 literal that fromAuthority handles", () => {
+    test("fromString now agrees with fromAuthority on an IPv6 literal", () => {
       /*
-       * Pinned deliberately: it documents WHY fromAuthority exists, and
-       * guards against someone 'simplifying' one into the other.
+       * This case used to be pinned the other way round: fromString split on
+       * the FIRST colon, so "[::1]:8443" became a host of "[" and the setter
+       * threw. Worse, the unbracketed spelling did NOT throw -- it returned
+       * host "2001" / port 518 for "2001:518:2800:9::2" and a monitor was
+       * saved pointing at a host nobody typed.
        *
-       * fromString splits on the FIRST colon, so "[::1]:8443" becomes a
-       * host of "[" - which the Hostname setter rejects outright.
+       * fromString delegates IPv6 authorities to fromAuthority now, so the
+       * two agree. Kept as a contrast test so a future 'simplification' that
+       * reintroduces the split fails here.
        */
       expect(Hostname.fromAuthority("[::1]:8443").hostname).toBe("[::1]");
-      expect(() => {
-        return Hostname.fromString("[::1]:8443");
-      }).toThrow();
+      expect(Hostname.fromString("[::1]:8443").hostname).toBe("[::1]");
+      expect(Hostname.fromString("[::1]:8443").port?.toNumber()).toBe(8443);
+
+      expect(Hostname.fromString("2001:518:2800:9::2").hostname).toBe(
+        "2001:518:2800:9::2",
+      );
+      expect(Hostname.fromString("2001:518:2800:9::2").port).toBeUndefined();
     });
 
     test("both agree on the simple host:port case", () => {

package/Tests/Types/API/HostnameIPv6.test.ts

@@ -0,0 +1,149 @@
+import Hostname from "../../../Types/API/Hostname";
+import URL from "../../../Types/API/URL";
+import { describe, expect, test } from "@jest/globals";
+import net from "net";
+
+/*
+ * Hostname's handling of IPv6 literals.
+ *
+ * fromString used to split on the FIRST colon, which is meaningless for an
+ * address made of colons. The damage was silent rather than loud: for the
+ * customer address reported below it
+ * returned host "2001" with port 518 — both legal — so nothing threw and the
+ * value the operator typed was simply gone.
+ */
+
+const CUSTOMER_ADDRESS: string = "2001:518:2800:9::2";
+
+describe("Hostname.fromString with an IPv6 literal", () => {
+  test("keeps the whole address instead of its first two groups", () => {
+    const hostname: Hostname = Hostname.fromString(CUSTOMER_ADDRESS);
+
+    expect(hostname.hostname).toBe(CUSTOMER_ADDRESS);
+    expect(hostname.port).toBeUndefined();
+    expect(hostname.toString()).toBe(CUSTOMER_ADDRESS);
+  });
+
+  test("specifically, it is not 2001 port 518", () => {
+    const hostname: Hostname = Hostname.fromString(CUSTOMER_ADDRESS);
+
+    expect(hostname.hostname).not.toBe("2001");
+    expect(hostname.port?.toNumber()).not.toBe(518);
+  });
+
+  test("trims, so a pasted address keeps working", () => {
+    expect(Hostname.fromString(`  ${CUSTOMER_ADDRESS}\n`).hostname).toBe(
+      CUSTOMER_ADDRESS,
+    );
+  });
+
+  test.each([
+    "::1",
+    "::",
+    "2001:db8::",
+    "::ffff:192.0.2.1",
+    "2001:0db8:85a3:0000:0000:8a2e:0370:7334",
+  ])("survives the compressed form %s", (address: string) => {
+    expect(Hostname.fromString(address).hostname).toBe(address);
+  });
+
+  test("a bracketed literal keeps its brackets and gives up its port", () => {
+    const hostname: Hostname = Hostname.fromString(`[${CUSTOMER_ADDRESS}]:179`);
+
+    expect(hostname.hostname).toBe(`[${CUSTOMER_ADDRESS}]`);
+    expect(hostname.port?.toNumber()).toBe(179);
+  });
+
+  test("a value with two colons that is NOT an address is rejected rather than silently split", () => {
+    expect(() => {
+      return Hostname.fromString("example.com:80:90");
+    }).toThrow();
+  });
+});
+
+describe("Hostname.fromString — IPv4 and DNS are unchanged", () => {
+  test.each([
+    ["example.com", "example.com", undefined],
+    ["example.com:8443", "example.com", 8443],
+    ["192.0.2.1", "192.0.2.1", undefined],
+    ["192.0.2.1:179", "192.0.2.1", 179],
+    ["localhost:3000", "localhost", 3000],
+  ])(
+    "%s parses to host %s",
+    (value: string, expectedHost: string, expectedPort?: number) => {
+      const hostname: Hostname = Hostname.fromString(value);
+
+      expect(hostname.hostname).toBe(expectedHost);
+      expect(hostname.port?.toNumber()).toBe(expectedPort);
+    },
+  );
+});
+
+describe("Hostname.toString with a port", () => {
+  test("brackets an IPv6 host, because the unbracketed form is a different address", () => {
+    const hostname: Hostname = new Hostname(CUSTOMER_ADDRESS, 179);
+
+    expect(hostname.toString()).toBe(`[${CUSTOMER_ADDRESS}]:179`);
+
+    // What it used to produce, and why that was not merely ugly:
+    expect(net.isIP(`${CUSTOMER_ADDRESS}:179`)).toBe(6);
+    expect(hostname.toString()).not.toBe(`${CUSTOMER_ADDRESS}:179`);
+  });
+
+  test("the bracketed form re-parses to the same host and port", () => {
+    const roundTripped: Hostname = Hostname.fromString(
+      new Hostname(CUSTOMER_ADDRESS, 179).toString(),
+    );
+
+    expect(roundTripped.hostname).toBe(`[${CUSTOMER_ADDRESS}]`);
+    expect(roundTripped.port?.toNumber()).toBe(179);
+  });
+
+  test("an IPv4 or DNS host keeps the conventional spelling", () => {
+    expect(new Hostname("192.0.2.1", 179).toString()).toBe("192.0.2.1:179");
+    expect(new Hostname("example.com", 8443).toString()).toBe(
+      "example.com:8443",
+    );
+  });
+
+  test("without a port the host is returned exactly as held", () => {
+    expect(new Hostname(CUSTOMER_ADDRESS).toString()).toBe(CUSTOMER_ADDRESS);
+    expect(Hostname.fromAuthority("[::1]").toString()).toBe("[::1]");
+  });
+});
+
+describe("Hostname.isValid validates the address, not just its characters", () => {
+  test.each([CUSTOMER_ADDRESS, "::1", "[::1]", "[::1]:8080", "2001:db8::"])(
+    "accepts %s",
+    (value: string) => {
+      expect(Hostname.isValid(value)).toBe(true);
+    },
+  );
+
+  test.each([
+    "::::",
+    "2001:db8:::1",
+    "[not-an-address]",
+    "gggg::1",
+    "2001:db8::1::2",
+  ])(
+    "rejects %s, which the old character allowlist let through",
+    (value: string) => {
+      expect(Hostname.isValid(value)).toBe(false);
+    },
+  );
+});
+
+describe("URL.toString still emits a valid authority for an IPv6 host", () => {
+  test("brackets survive a round trip", () => {
+    expect(
+      URL.fromString(`https://[${CUSTOMER_ADDRESS}]/health`).toString(),
+    ).toBe(`https://[${CUSTOMER_ADDRESS}]/health`);
+  });
+
+  test("a bracketed host with a port survives a round trip", () => {
+    expect(
+      URL.fromString(`https://[${CUSTOMER_ADDRESS}]:8443/x`).toString(),
+    ).toBe(`https://[${CUSTOMER_ADDRESS}]:8443/x`);
+  });
+});

package/Tests/Types/Database/CanonicalModelInstance.test.ts

@@ -0,0 +1,190 @@
+import AllModelTypes from "../../../Models/DatabaseModels/Index";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import ProjectSCIM from "../../../Models/DatabaseModels/ProjectSCIM";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import UserEmail from "../../../Models/DatabaseModels/UserEmail";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import ColumnBillingAccessControl from "../../../Types/BaseDatabase/ColumnBillingAccessControl";
+import { getColumnAccessControlForAllColumns } from "../../../Types/Database/AccessControl/ColumnAccessControl";
+import { getColumnBillingAccessControlForAllColumns } from "../../../Types/Database/AccessControl/ColumnBillingAccessControl";
+import { getOwnerOnlyColumns } from "../../../Types/Database/AccessControl/OwnerOnlyColumn";
+import Dictionary from "../../../Types/Dictionary";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, test } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+
+/*
+ * WHY THIS FILE EXISTS - do not delete these as "obvious" assertions.
+ *
+ * Every "which columns does this model have" lookup answers the question by
+ * enumerating an INSTANCE's own keys, and caches the answer per CLASS, for the
+ * whole process. So the FIRST instance to ask used to define what the class is
+ * for everybody after it.
+ *
+ * BaseAPI.createItem deleted `_id` off the live model instance it handed to
+ * the service, and DatabaseService.create asks that instance for its columns
+ * (generateDefaultValues) before any permission check runs. One POST - even a
+ * POST that was refused - could therefore teach the process that a model has
+ * no `_id` column, and DatabaseBaseModel.toJSONObject serializes a row by
+ * iterating exactly that cached list, so every response for that model lost
+ * its id from then on. To any caller, on any route, including plain reads as
+ * root: the row still carried its real `_id` in memory and the SQL projection
+ * still selected it. The id was dropped on the way out, and it stayed a 200
+ * because `_id` is in ColumnPermissions.getExcludedColumnNames().
+ *
+ * The tests below do the mutation on purpose. No caller in the tree does it
+ * any more, and that is not what is being protected: the invariant is that it
+ * CANNOT MATTER who asks first or what they did to their own instance. Each
+ * test uses a different model class, because these caches are per class and
+ * per process - a class another test has already asked about has a warm cache
+ * and would pass vacuously.
+ */
+
+describe("column metadata does not depend on which instance asked first", () => {
+  test("getTableColumns: a mutilated instance asking first cannot strip _id from the class", () => {
+    const mutilated: ProjectSCIM = new ProjectSCIM();
+
+    // exactly what BaseAPI.createItem used to do before calling the service
+    delete (mutilated as unknown as Record<string, unknown>)["_id"];
+    expect(Object.keys(mutilated)).not.toContain("_id");
+
+    // the mutilated instance is the FIRST to ask, on a cold cache
+    expect(mutilated.getTableColumns().columns).toContain("_id");
+
+    // ...and a fresh instance of the same class is unharmed
+    expect(new ProjectSCIM().getTableColumns().columns).toContain("_id");
+  });
+
+  test("getTableColumns: a row still serializes with its _id after such a create", () => {
+    /*
+     * The assertion that matches the reported symptom: POST /api/project-scim
+     * answered 200 with every column except "_id", and a get-list selecting
+     * {_id, name} came back as {name} alone.
+     */
+    const mutilated: Monitor = new Monitor();
+    delete (mutilated as unknown as Record<string, unknown>)["_id"];
+    mutilated.getTableColumns();
+
+    const row: Monitor = new Monitor();
+    row._id = "22222222-2222-4222-8222-222222222222";
+    row.name = "a monitor";
+
+    const json: JSONObject = BaseModel.toJSONObject(row, Monitor);
+
+    expect(json["_id"]).toBe("22222222-2222-4222-8222-222222222222");
+    expect(json["name"]).toBe("a monitor");
+  });
+
+  test("getColumnAccessControlForAllColumns is instance-independent", () => {
+    const mutilated: StatusPage = new StatusPage();
+    delete (mutilated as unknown as Record<string, unknown>)["name"];
+
+    const fromMutilated: Dictionary<ColumnAccessControl> =
+      getColumnAccessControlForAllColumns(mutilated);
+
+    expect(fromMutilated["name"]).toBeDefined();
+    expect(
+      getColumnAccessControlForAllColumns(new StatusPage())["name"],
+    ).toBeDefined();
+  });
+
+  test("getColumnBillingAccessControlForAllColumns is instance-independent", () => {
+    const mutilated: StatusPage = new StatusPage();
+    delete (mutilated as unknown as Record<string, unknown>)["customCSS"];
+
+    const fromMutilated: Dictionary<ColumnBillingAccessControl> =
+      getColumnBillingAccessControlForAllColumns(mutilated);
+
+    expect(fromMutilated["customCSS"]).toBeDefined();
+    expect(
+      getColumnBillingAccessControlForAllColumns(new StatusPage())["customCSS"],
+    ).toBeDefined();
+  });
+
+  test("getOwnerOnlyColumns is instance-independent", () => {
+    /*
+     * This one is a permission list, not a projection: a marked column that
+     * goes unreported is a column OwnerOnlyColumnPermission stops protecting.
+     */
+    const mutilated: UserEmail = new UserEmail();
+    delete (mutilated as unknown as Record<string, unknown>)["email"];
+
+    expect(getOwnerOnlyColumns(mutilated)).toContain("email");
+    expect(getOwnerOnlyColumns(new UserEmail())).toContain("email");
+  });
+
+  test("mutating an instance after the class has been read changes nothing either", () => {
+    const first: UserEmail = new UserEmail();
+    expect(first.getTableColumns().columns).toContain("_id");
+
+    delete (first as unknown as Record<string, unknown>)["_id"];
+
+    expect(first.getTableColumns().columns).toContain("_id");
+    expect(new UserEmail().getTableColumns().columns).toContain("_id");
+  });
+});
+
+/*
+ * The premise of the fix: metadata enumeration reads a freshly constructed
+ * instance of the caller's class, so every model must be no-arg constructible
+ * and must expose every column it declares on a fresh instance (the class
+ * bodies do that with `= undefined` initializers). If a model is ever added
+ * that breaks either half, it would silently lose columns everywhere -
+ * responses, selects, permissions - so assert it for all of them at once.
+ */
+describe("every database model supports canonical-instance enumeration", () => {
+  test("all models are no-arg constructible and declare no column that a fresh instance lacks", () => {
+    const columnsByTarget: Map<unknown, Array<string>> = new Map();
+
+    const record: (target: unknown, propertyName: string) => void = (
+      target: unknown,
+      propertyName: string,
+    ): void => {
+      const list: Array<string> = columnsByTarget.get(target) || [];
+      list.push(propertyName);
+      columnsByTarget.set(target, list);
+    };
+
+    for (const column of getMetadataArgsStorage().columns) {
+      record(column.target, column.propertyName);
+    }
+
+    for (const relation of getMetadataArgsStorage().relations) {
+      record(relation.target, relation.propertyName);
+    }
+
+    const constructFailures: Array<string> = [];
+    const missingKeys: Array<string> = [];
+
+    for (const modelType of AllModelTypes) {
+      let instance: BaseModel | null = null;
+
+      try {
+        instance = new modelType();
+      } catch (err) {
+        constructFailures.push(`${modelType.name}: ${(err as Error).message}`);
+        continue;
+      }
+
+      const ownKeys: Set<string> = new Set(Object.keys(instance));
+
+      // inherited columns count too, so walk the constructor chain
+      let ctor: unknown = modelType;
+
+      while (ctor && ctor !== Function.prototype) {
+        for (const propertyName of columnsByTarget.get(ctor) || []) {
+          if (!ownKeys.has(propertyName)) {
+            missingKeys.push(`${modelType.name}.${propertyName}`);
+          }
+        }
+
+        ctor = Object.getPrototypeOf(ctor);
+      }
+    }
+
+    expect(constructFailures).toEqual([]);
+    expect(missingKeys).toEqual([]);
+    expect(AllModelTypes.length).toBeGreaterThan(400);
+  });
+});

package/Tests/UI/Components/EditionLabelLapseCopy.ts

@@ -0,0 +1,104 @@
+/*
+ * What the edition dialog must say about an Enterprise license lapse. Shared
+ * by the core EditionLabel suite and ee/Tests/UI/License, which renders the
+ * same dialog with the Enterprise license manager.
+ *
+ * When the license lapses (after the trial or the grace period), single
+ * sign-on (SAML and OIDC), SCIM provisioning and audit logging stop - the
+ * Community Edition's behaviour - and "Require SSO" stops being enforced at
+ * the same moment, so nobody is locked out: users sign in with their
+ * password. Everything resumes as soon as a license is activated. The trial
+ * and grace notices must say so BEFORE it happens, and the lapsed notice must
+ * say what is off.
+ *
+ * The dialog used to promise the opposite ("SSO, SCIM and audit logging never
+ * stop"), so the checks reject that copy too. Plain functions over text, with
+ * no jest dependency, so a test can prove each check fails on the wrong copy.
+ */
+
+// Before the lapse: the trial and grace notices, after "Without a valid license (...), ".
+export const LAPSE_WARNING_PHRASES: ReadonlyArray<string> = [
+  "single sign-on (SAML and OIDC) stops",
+  '"Require SSO" is no longer enforced, so users sign in with their password',
+  "SCIM provisioning stops",
+  "audit logging stops recording",
+  "enterprise configuration becomes read-only",
+  "the enterprise admin dashboards are locked",
+  "Everything resumes as soon as a license is activated",
+  "core monitoring is never affected",
+];
+
+// After the lapse: the license-required notice (expired, missing, invalid).
+export const LAPSED_STATE_PHRASES: ReadonlyArray<string> = [
+  "Single sign-on (SAML and OIDC) and SCIM provisioning are off",
+  '"Require SSO" is not enforced, so users sign in with their password',
+  "SCIM requests are refused",
+  "Audit logging is not recording",
+  "Enterprise configuration is read-only",
+  "Everything resumes, without a restart, as soon as a valid license is added",
+  "core monitoring is never affected",
+];
+
+// The soft-enforcement promises the dialog made before. None may come back.
+export const RETIRED_SOFT_ENFORCEMENT_COPY: ReadonlyArray<RegExp> = [
+  /never stop/i,
+  /already configured keeps working/i,
+  /configured stops working/i,
+  /keeps? working as configured/i,
+  /never (?:silently )?weakens?/i,
+];
+
+// The copy the dialog shipped before the owner's decision, verbatim.
+export const RETIRED_NOTICE_EXAMPLES: ReadonlyArray<string> = [
+  "Without a valid license (after the 14-day grace period), enterprise configuration becomes read-only and the enterprise admin dashboards are locked. Everything you already configured keeps working — SSO, SCIM and audit logging never stop — and core monitoring is never affected.",
+  "Without a valid license (after the 14-day trial), enterprise configuration becomes read-only and the enterprise admin dashboards are locked. Everything you already configured keeps working — SSO, SCIM and audit logging never stop — and core monitoring is never affected.",
+  "The Enterprise license expired and its grace period is over. Enterprise configuration is read-only and the enterprise admin dashboards are locked until a valid license is added. Everything you already configured keeps working — SSO, SCIM and audit logging never stop — and core monitoring is never affected.",
+];
+
+type CopyCheck = (text: string | null | undefined) => Array<string>;
+
+// Whitespace-normalized, so a check does not depend on how JSX wraps a line.
+const normalize: (text: string | null | undefined) => string = (
+  text: string | null | undefined,
+): string => {
+  return (text || "").replace(/\s+/g, " ").trim();
+};
+
+const copyProblems: (
+  text: string | null | undefined,
+  requiredPhrases: ReadonlyArray<string>,
+) => Array<string> = (
+  text: string | null | undefined,
+  requiredPhrases: ReadonlyArray<string>,
+): Array<string> => {
+  const flat: string = normalize(text);
+  const problems: Array<string> = [];
+
+  for (const phrase of requiredPhrases) {
+    if (!flat.includes(phrase)) {
+      problems.push(`missing: ${phrase}`);
+    }
+  }
+
+  for (const retired of RETIRED_SOFT_ENFORCEMENT_COPY) {
+    if (retired.test(flat)) {
+      problems.push(`retired: ${retired.source}`);
+    }
+  }
+
+  return problems;
+};
+
+// What is wrong with a trial or grace notice (empty when it is right).
+export const lapseWarningProblems: CopyCheck = (
+  text: string | null | undefined,
+): Array<string> => {
+  return copyProblems(text, LAPSE_WARNING_PHRASES);
+};
+
+// What is wrong with the notice shown once the license has lapsed.
+export const lapsedStateProblems: CopyCheck = (
+  text: string | null | undefined,
+): Array<string> => {
+  return copyProblems(text, LAPSED_STATE_PHRASES);
+};