@oneuptime/common 13.0.8 → 14.0.1

package/Tests/App/Dashboard/ScheduledMaintenanceFeedRefresh.test.tsx

@@ -1,4 +1,11 @@
-import { afterEach, describe, expect, jest, test } from "@jest/globals";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
 import "@testing-library/jest-dom";
 import {
   act,
@@ -105,6 +112,7 @@ import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import { DEFAULT_LIMIT } from "../../../Types/Database/LimitMax";
 import IconProp from "../../../Types/Icon/IconProp";
 import ObjectID from "../../../Types/ObjectID";
+import { getSortOrderStorageKey } from "../../../UI/Components/Feed/useFeedOptions";
 
 interface RenderedFeedItem {
   key: string;
@@ -204,6 +212,15 @@ async function chooseAction(text: string): Promise<void> {
   await flush();
 }
 
+/*
+ * The feed opens in the sort order the reader last chose, read from
+ * localStorage on mount, so one test's choice must not reorder the next
+ * test's requests.
+ */
+beforeEach(() => {
+  window.localStorage.clear();
+});
+
 afterEach(() => {
   cleanup();
   getListMock.mockReset();
@@ -279,6 +296,40 @@ describe("ScheduledMaintenanceFeedElement refresh", () => {
     expect(lastRenderedItems()[0]!.icon).toBe(IconProp.ArrowCircleRight);
   });
 
+  /*
+   * The refresh after a state change re-reads the view the reader is looking
+   * at. A reader who keeps this feed oldest first must not see it flip back
+   * to newest first because the page asked for a refresh.
+   */
+  test("a new refreshToken re-reads the feed in the reader's remembered order", async () => {
+    window.localStorage.setItem(
+      getSortOrderStorageKey("scheduled-maintenance"),
+      SortOrder.Ascending,
+    );
+    getListMock.mockResolvedValue(listResult([]) as never);
+
+    const view: RenderResult = renderFeed(0);
+    await flush();
+
+    view.rerender(
+      <ScheduledMaintenanceFeedElement
+        scheduledMaintenanceId={new ObjectID(EVENT_ID)}
+        refreshToken={1}
+      />,
+    );
+    await flush();
+
+    expect(getListMock).toHaveBeenCalledTimes(2);
+
+    for (const call of getListMock.mock.calls) {
+      const request: FeedListRequest = call[0] as FeedListRequest;
+
+      expect(request.sort).toEqual({ postedAt: SortOrder.Ascending });
+      expect(request.skip).toBe(0);
+      expect(request.limit).toBe(DEFAULT_LIMIT);
+    }
+  });
+
   test("re-rendering with the same token, or a new ObjectID for the same event, does not refetch", async () => {
     getListMock.mockResolvedValue(listResult([]) as never);
 

package/Tests/App/Dashboard/SecurityEventConnectionDiagnostics.test.tsx

@@ -48,7 +48,6 @@ import ListResult from "../../../Types/BaseDatabase/ListResult";
 import RangeStartAndEndDateTime from "../../../Types/Time/RangeStartAndEndDateTime";
 import TimeRange from "../../../Types/Time/TimeRange";
 import { JSONObject } from "../../../Types/JSON";
-import JSONFunctions from "../../../Types/JSONFunctions";
 import ObjectID from "../../../Types/ObjectID";
 import {
   SecurityConnectorSample,
@@ -269,12 +268,36 @@ function eventsParams(route: Route): URLSearchParams {
   return new URLSearchParams(text.slice(text.indexOf("?")));
 }
 
-// The table's own filter on the link; {} when the link sets none.
+/*
+ * The chips the link opens the events explorer with, re-shaped as
+ * `{ attributes: { key: value } }` — the reading these assertions have always
+ * used.
+ *
+ * The link's grammar is the explorers' own `filters` param
+ * (`[["attributes.<key>", "<value>"], ...]`); it used to be the model
+ * table's serialized column filter, which went away with the table. Anything
+ * the explorer does not express as an attribute chip is left out, so an
+ * assertion that a key is absent still means "the link does not filter on
+ * it".
+ */
 function eventsFilter(route: Route): JSONObject {
-  const raw: string | null = eventsParams(route).get(
-    "security-events-table-filter",
-  );
-  return raw ? JSONFunctions.deserialize(JSON.parse(raw) as JSONObject) : {};
+  const raw: string | null = eventsParams(route).get("filters");
+
+  if (!raw) {
+    return {};
+  }
+
+  const attributes: JSONObject = {};
+
+  for (const pair of JSON.parse(raw) as Array<[string, string]>) {
+    if (!Array.isArray(pair) || !pair[0]?.startsWith("attributes.")) {
+      continue;
+    }
+
+    attributes[pair[0].substring("attributes.".length)] = pair[1];
+  }
+
+  return Object.keys(attributes).length > 0 ? { attributes } : {};
 }
 
 /*
@@ -1481,25 +1504,38 @@ describe("View events for a connection run", () => {
     expect(eventsFilter(route)["attributes"]).toBeUndefined();
   });
 
-  test("the window is the page's time range, not a table filter", (): void => {
+  test("the window is the page's time range, not a chip", (): void => {
     const route: Route = connectionEventsRoute(result(), CONNECTION_ID);
     const params: URLSearchParams = eventsParams(route);
 
     expect(params.get("range")).toBe(TimeRange.CUSTOM);
     expect(params.get("start")).toBe("2026-09-09T01:30:29.000Z");
     expect(params.get("end")).toBe("2026-09-09T01:30:31.000Z");
-    // The table no longer offers a Time filter, so none is written for it.
+    // The window is the explorer's own range, never one of its chips.
     expect(eventsFilter(route)["time"]).toBeUndefined();
     expect(eventsFilter(route)["attributes"]).toEqual({
       [SECURITY_CONNECTION_ID_ATTRIBUTE]: CONNECTION_ID,
     });
   });
 
-  test("a link with nothing to filter on sets no table filter at all", (): void => {
+  test("the connection chip is written in the explorer's filters grammar", (): void => {
+    const raw: string | null = eventsParams(
+      connectionEventsRoute(result(), CONNECTION_ID),
+    ).get("filters");
+
+    expect(raw).not.toBeNull();
+    expect(JSON.parse(raw as string)).toEqual([
+      [`attributes.${SECURITY_CONNECTION_ID_ATTRIBUTE}`, CONNECTION_ID],
+    ]);
+  });
+
+  test("a link with nothing to filter on sets no chips at all", (): void => {
     const params: URLSearchParams = eventsParams(
       connectionEventsRoute(result()),
     );
 
+    expect(params.get("filters")).toBeNull();
+    // The retired model table's own filter param is gone for good.
     expect(params.get("security-events-table-filter")).toBeNull();
     expect(params.get("range")).toBe(TimeRange.CUSTOM);
   });

package/Tests/App/Dashboard/SecurityEventDetailPanel.test.tsx

@@ -0,0 +1,399 @@
+/** @timezone UTC */
+
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import "@testing-library/jest-dom";
+import {
+  cleanup,
+  fireEvent,
+  render,
+  screen,
+  within,
+} from "@testing-library/react";
+import * as React from "react";
+import { MemoryRouter } from "react-router-dom";
+import SecurityEvent from "../../../Models/AnalyticsModels/SecurityEvent";
+import OcsfSeverity from "../../../Types/SecurityEvent/OcsfSeverity";
+import Navigation from "../../../UI/Utils/Navigation";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import SecurityEventDetailPanel, {
+  SECURITY_EVENT_DETAIL_ATTRIBUTES_TAB_ID,
+  SECURITY_EVENT_DETAIL_JSON_TAB_ID,
+  SECURITY_EVENT_DETAIL_OVERVIEW_TAB_ID,
+  SECURITY_EVENT_DETAIL_PANEL_TEST_ID,
+} from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventDetailPanel";
+import { SECURITY_EVENT_ATTRIBUTE_FACET_PREFIX } from "../../../../App/FeatureSet/Dashboard/src/Components/SecurityEvents/SecurityEventsFacets";
+
+/*
+ * One security event, opened from the list.
+ *
+ * Built on the shared TelemetryDetailPanel — the drawer the traces and
+ * exceptions explorers open — rather than a SideOver, so the list stays
+ * usable behind it. What is pinned here is what the drawer is FOR: reading
+ * the whole event (typed fields, every source attribute, the raw record) and
+ * turning anything in it into a filter on the list behind it without
+ * re-typing it into the search bar.
+ */
+
+const PROJECT_ID: string = "11111111-1111-4111-8111-111111111111";
+
+function event(fields: Partial<SecurityEvent> = {}): SecurityEvent {
+  return Object.assign(new SecurityEvent(), fields);
+}
+
+const FULL_EVENT: SecurityEvent = event({
+  time: new Date("2026-09-17T10:00:00.000Z"),
+  eventUid: "abc123",
+  severityName: OcsfSeverity.Critical,
+  className: "Authentication",
+  categoryName: "IAM",
+  activityName: "Logon",
+  statusName: "Failure",
+  message: "Failed logon for alice",
+  vendorName: "Acme",
+  productName: "Defender",
+  ruleName: "BruteForce",
+  principalUser: "alice",
+  principalHost: "web-01",
+  observables: ["alice", "10.0.0.4"],
+  attributes: {
+    "threat.matched": "true",
+    "device.hostname": "web-01",
+  },
+});
+
+function renderPanel(
+  securityEvent: SecurityEvent = FULL_EVENT,
+  props: {
+    onClose?: () => void;
+    onFilterBy?: (facetKey: string, value: string) => void;
+    onCorrelateObservable?: (observable: string) => void;
+  } = {},
+): void {
+  render(
+    <MemoryRouter>
+      <SecurityEventDetailPanel
+        securityEvent={securityEvent}
+        onClose={props.onClose || ((): void => {})}
+        {...(props.onFilterBy ? { onFilterBy: props.onFilterBy } : {})}
+        {...(props.onCorrelateObservable
+          ? { onCorrelateObservable: props.onCorrelateObservable }
+          : {})}
+      />
+    </MemoryRouter>,
+  );
+}
+
+function panel(): HTMLElement {
+  return screen.getByTestId(SECURITY_EVENT_DETAIL_PANEL_TEST_ID);
+}
+
+function tab(label: string): HTMLElement {
+  return screen.getByRole("tab", { name: new RegExp(`^${label}`) });
+}
+
+function filterButton(label: string): HTMLElement {
+  return screen.getByRole("button", { name: `Filter by ${label}` });
+}
+
+beforeEach(() => {
+  window.history.replaceState(
+    null,
+    "",
+    `/dashboard/${PROJECT_ID}/security-events`,
+  );
+});
+
+afterEach(() => {
+  cleanup();
+  jest.restoreAllMocks();
+});
+
+describe("the drawer", () => {
+  test("names the event and when it happened", () => {
+    renderPanel();
+
+    expect(panel()).toHaveTextContent("Failed logon for alice");
+    expect(panel().textContent).toContain("2026");
+  });
+
+  test("falls back to the event class when there is no message", () => {
+    renderPanel(event({ className: "Authentication" }));
+
+    expect(panel()).toHaveTextContent("Authentication");
+  });
+
+  test("offers Overview, Attributes and JSON, opening on Overview", () => {
+    renderPanel();
+
+    expect(
+      screen.getAllByRole("tab").map((node: HTMLElement): string => {
+        return node.getAttribute("id") || "";
+      }),
+    ).toEqual(
+      expect.arrayContaining([
+        expect.stringContaining(SECURITY_EVENT_DETAIL_OVERVIEW_TAB_ID),
+        expect.stringContaining(SECURITY_EVENT_DETAIL_ATTRIBUTES_TAB_ID),
+        expect.stringContaining(SECURITY_EVENT_DETAIL_JSON_TAB_ID),
+      ]),
+    );
+    expect(tab("Overview")).toHaveAttribute("aria-selected", "true");
+  });
+
+  test("the Attributes tab counts what it holds, so a reader knows before opening it", () => {
+    renderPanel();
+
+    expect(tab("Attributes")).toHaveTextContent("2");
+  });
+
+  test("closing it tells the page", () => {
+    const onClose: MockFunction = getJestMockFunction();
+
+    renderPanel(FULL_EVENT, { onClose: onClose as unknown as () => void });
+
+    fireEvent.click(screen.getByRole("button", { name: /close/i }));
+
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("Overview", () => {
+  test("shows the typed OCSF fields, severity as a pill", () => {
+    renderPanel();
+
+    expect(panel()).toHaveTextContent("Event Class");
+    expect(panel()).toHaveTextContent("Authentication");
+    expect(panel()).toHaveTextContent("Status");
+    expect(panel()).toHaveTextContent("Failure");
+    expect(panel()).toHaveTextContent(OcsfSeverity.Critical);
+  });
+
+  test("omits what the source did not say", () => {
+    renderPanel(event({ className: "Authentication" }));
+
+    expect(panel()).not.toHaveTextContent("Target Host");
+    expect(panel()).not.toHaveTextContent("MITRE Tactics");
+  });
+
+  test("lists observables as chips, and says so when there are none", () => {
+    renderPanel();
+
+    expect(
+      screen.getByTestId("security-event-panel-observable-chip-0"),
+    ).toHaveTextContent("alice");
+    expect(
+      screen.getByTestId("security-event-panel-observable-chip-1"),
+    ).toHaveTextContent("10.0.0.4");
+
+    cleanup();
+    renderPanel(event({ message: "no observables" }));
+
+    expect(panel()).toHaveTextContent(
+      "No observables extracted from this event.",
+    );
+  });
+});
+
+describe("filtering the list from the drawer", () => {
+  test("severity, and every typed field the sidebar also facets, offers a filter", () => {
+    const onFilterBy: MockFunction = getJestMockFunction();
+
+    renderPanel(FULL_EVENT, {
+      onFilterBy: onFilterBy as unknown as (
+        facetKey: string,
+        value: string,
+      ) => void,
+    });
+
+    fireEvent.click(filterButton("Severity"));
+    expect(onFilterBy).toHaveBeenLastCalledWith(
+      "severityName",
+      OcsfSeverity.Critical,
+    );
+
+    fireEvent.click(filterButton("Event Class"));
+    expect(onFilterBy).toHaveBeenLastCalledWith("className", "Authentication");
+
+    fireEvent.click(filterButton("Principal User"));
+    expect(onFilterBy).toHaveBeenLastCalledWith("principalUser", "alice");
+
+    fireEvent.click(filterButton("Detection Rule"));
+    expect(onFilterBy).toHaveBeenLastCalledWith("ruleName", "BruteForce");
+  });
+
+  /*
+   * Filtering on a value that is unique per row would return the one event
+   * already on screen, so those fields deliberately offer no action.
+   */
+  test("free-text and unique fields offer none", () => {
+    renderPanel(FULL_EVENT, {
+      onFilterBy: getJestMockFunction() as unknown as (
+        facetKey: string,
+        value: string,
+      ) => void,
+    });
+
+    expect(
+      screen.queryByRole("button", { name: "Filter by Message" }),
+    ).toBeNull();
+    expect(
+      screen.queryByRole("button", { name: "Filter by Event UID" }),
+    ).toBeNull();
+  });
+
+  test("an attribute filters under its own attributes.<key> chip", () => {
+    const onFilterBy: MockFunction = getJestMockFunction();
+
+    renderPanel(FULL_EVENT, {
+      onFilterBy: onFilterBy as unknown as (
+        facetKey: string,
+        value: string,
+      ) => void,
+    });
+
+    fireEvent.click(tab("Attributes"));
+    fireEvent.click(filterButton("threat.matched"));
+
+    expect(onFilterBy).toHaveBeenCalledWith(
+      `${SECURITY_EVENT_ATTRIBUTE_FACET_PREFIX}threat.matched`,
+      "true",
+    );
+  });
+
+  test("a page that cannot filter gets no filter actions at all", () => {
+    renderPanel();
+
+    expect(screen.queryByRole("button", { name: /^Filter by/ })).toBeNull();
+  });
+});
+
+describe("Attributes", () => {
+  test("lists every source attribute, sorted, with its value", () => {
+    renderPanel();
+
+    fireEvent.click(tab("Attributes"));
+
+    const terms: Array<string> = Array.from(panel().querySelectorAll("dt")).map(
+      (node: Element): string => {
+        return node.textContent || "";
+      },
+    );
+
+    expect(terms).toEqual(["device.hostname", "threat.matched"]);
+    expect(panel()).toHaveTextContent("web-01");
+    expect(panel()).toHaveTextContent("true");
+  });
+
+  test("an event with none says so", () => {
+    renderPanel(event({ message: "bare" }));
+
+    fireEvent.click(tab("Attributes"));
+
+    expect(panel()).toHaveTextContent("No attributes recorded for this event.");
+  });
+});
+
+describe("JSON", () => {
+  test("prints the record, including what the source left empty", () => {
+    renderPanel();
+
+    fireEvent.click(tab("JSON"));
+
+    const json: Record<string, unknown> = JSON.parse(
+      screen.getByTestId("security-event-detail-json").textContent || "{}",
+    );
+
+    expect(json["message"]).toBe("Failed logon for alice");
+    expect(json["severityName"]).toBe(OcsfSeverity.Critical);
+    expect(json["targetHost"]).toBe("");
+    expect(json["attributes"]).toEqual({
+      "threat.matched": "true",
+      "device.hostname": "web-01",
+    });
+  });
+
+  /*
+   * An analytics model carries its whole table definition on the object;
+   * serializing that would bury twenty facts about the event under a few
+   * hundred about the table.
+   */
+  test("describes the event, not the table", () => {
+    renderPanel();
+
+    fireEvent.click(tab("JSON"));
+
+    const text: string =
+      screen.getByTestId("security-event-detail-json").textContent || "";
+
+    expect(text).not.toContain("tableColumns");
+    expect(text).not.toContain("accessControl");
+  });
+});
+
+describe("correlating an observable", () => {
+  test("deep-links to the Correlate tab seeded with the observable", () => {
+    const navigate: MockFunction = getJestMockFunction();
+    jest
+      .spyOn(Navigation, "navigate")
+      .mockImplementation(navigate as unknown as typeof Navigation.navigate);
+
+    renderPanel();
+
+    fireEvent.click(
+      screen.getByTestId("security-event-panel-observable-chip-1"),
+    );
+
+    expect(navigate).toHaveBeenCalledTimes(1);
+    const route: string = String((navigate.mock.calls[0] as Array<unknown>)[0]);
+
+    expect(route).toContain("/security-events/correlate");
+    expect(route).toContain(`observable=${encodeURIComponent("10.0.0.4")}`);
+  });
+
+  test("a host that already shows a graph pivots in place instead", () => {
+    const onCorrelateObservable: MockFunction = getJestMockFunction();
+    const navigate: MockFunction = getJestMockFunction();
+    jest
+      .spyOn(Navigation, "navigate")
+      .mockImplementation(navigate as unknown as typeof Navigation.navigate);
+
+    renderPanel(FULL_EVENT, {
+      onCorrelateObservable: onCorrelateObservable as unknown as (
+        observable: string,
+      ) => void,
+    });
+
+    fireEvent.click(
+      screen.getByTestId("security-event-panel-observable-chip-0"),
+    );
+
+    expect(onCorrelateObservable).toHaveBeenCalledWith("alice");
+    expect(navigate).not.toHaveBeenCalled();
+  });
+});
+
+describe("the drawer is a modal", () => {
+  test("Escape closes it", () => {
+    const onClose: MockFunction = getJestMockFunction();
+
+    renderPanel(FULL_EVENT, { onClose: onClose as unknown as () => void });
+
+    fireEvent.keyDown(document, { key: "Escape" });
+
+    expect(onClose).toHaveBeenCalledTimes(1);
+  });
+
+  test("its tabs are a real tablist", () => {
+    renderPanel();
+
+    const tablist: HTMLElement = screen.getByRole("tablist");
+
+    expect(within(tablist).getAllByRole("tab")).toHaveLength(3);
+  });
+});