@oneuptime/common 13.0.8 → 14.0.1

package/Tests/Server/Utils/Monitor/RootCauseList.test.ts

@@ -0,0 +1,252 @@
+import RootCauseList, {
+  RootCauseListItem,
+} from "../../../../Server/Utils/Monitor/RootCauseList";
+import { marked, Tokens, Token } from "marked";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * RootCauseList is the numbered list both per-item breakdowns of a root
+ * cause render as — a platform monitor's Affected Resources and a metric
+ * monitor's Breaching Samples. Each has its own suite for its own content
+ * (AffectedResourceList.test.ts, MonitorCriteriaEvaluatorBreachingSamples
+ * .test.ts); this one pins the shape they share.
+ */
+
+function item(overrides: Partial<RootCauseListItem> = {}): RootCauseListItem {
+  return {
+    title: "`2026-08-14T10:30:00.000Z`",
+    value: "**1.07 GB**",
+    details: [
+      { label: "`a`", value: "537 MB" },
+      { label: "`k8s.pod.name`", value: "`web-1`" },
+    ],
+    ...overrides,
+  };
+}
+
+function items(count: number): Array<RootCauseListItem> {
+  const result: Array<RootCauseListItem> = [];
+
+  for (let i: number = 1; i <= count; i++) {
+    result.push(
+      item({
+        title: `\`item-${i}\``,
+        value: `**${i}**`,
+        details: [{ label: "Label", value: `\`detail-${i}\`` }],
+      }),
+    );
+  }
+
+  return result;
+}
+
+describe("RootCauseList.render", () => {
+  test("renders each item as a numbered line with its details as nested bullets", () => {
+    expect(RootCauseList.render([item()])).toBe(
+      [
+        "1. `2026-08-14T10:30:00.000Z` — **1.07 GB**",
+        "   - `a`: 537 MB",
+        "   - `k8s.pod.name`: `web-1`",
+      ].join("\n"),
+    );
+  });
+
+  test("returns just the list — no heading, and no leading or trailing blank lines", () => {
+    const markdown: string = RootCauseList.render(items(2));
+
+    expect(markdown.startsWith("1. ")).toBe(true);
+    expect(markdown.endsWith("`detail-2`")).toBe(true);
+  });
+
+  test("returns an empty string for no items", () => {
+    expect(RootCauseList.render([])).toBe("");
+  });
+
+  test("numbers the items from 1 in the order given", () => {
+    const markdown: string = RootCauseList.render(items(3));
+
+    expect(markdown.split("\n")).toEqual([
+      "1. `item-1` — **1**",
+      "   - Label: `detail-1`",
+      "2. `item-2` — **2**",
+      "   - Label: `detail-2`",
+      "3. `item-3` — **3**",
+      "   - Label: `detail-3`",
+    ]);
+  });
+
+  test("indents details to the content column: three spaces under 1-9, four under 10-99, five under 100", () => {
+    const markdown: string = RootCauseList.render(items(100));
+
+    expect(markdown).toContain("9. `item-9` — **9**\n   - Label: `detail-9`");
+    expect(markdown).toContain(
+      "10. `item-10` — **10**\n    - Label: `detail-10`",
+    );
+    expect(markdown).toContain(
+      "99. `item-99` — **99**\n    - Label: `detail-99`",
+    );
+    expect(markdown).toContain(
+      "100. `item-100` — **100**\n     - Label: `detail-100`",
+    );
+  });
+
+  test("a detail with an empty or blank value is left out", () => {
+    const markdown: string = RootCauseList.render([
+      item({
+        details: [
+          { label: "`a`", value: "537 MB" },
+          { label: "`b`", value: "" },
+          { label: "`c`", value: "   " },
+          { label: "`d`", value: "1.5 sec" },
+        ],
+      }),
+    ]);
+
+    expect(markdown.split("\n")).toEqual([
+      "1. `2026-08-14T10:30:00.000Z` — **1.07 GB**",
+      "   - `a`: 537 MB",
+      "   - `d`: 1.5 sec",
+    ]);
+  });
+
+  test("a detail with an empty label is just its value", () => {
+    const markdown: string = RootCauseList.render([
+      item({ details: [{ label: "", value: "`web-1`" }] }),
+    ]);
+
+    expect(markdown).toBe(
+      "1. `2026-08-14T10:30:00.000Z` — **1.07 GB**\n   - `web-1`",
+    );
+  });
+
+  test("an item without details is a single line", () => {
+    expect(RootCauseList.render([item({ details: [] })])).toBe(
+      "1. `2026-08-14T10:30:00.000Z` — **1.07 GB**",
+    );
+  });
+
+  test("an empty value leaves just the title, with no dangling dash", () => {
+    expect(RootCauseList.render([item({ value: "", details: [] })])).toBe(
+      "1. `2026-08-14T10:30:00.000Z`",
+    );
+  });
+
+  test("an empty title leaves just the value", () => {
+    expect(RootCauseList.render([item({ title: " ", details: [] })])).toBe(
+      "1. **1.07 GB**",
+    );
+  });
+
+  test("trims the whitespace around the title, value, labels and values", () => {
+    expect(
+      RootCauseList.render([
+        item({
+          title: "  `t`  ",
+          value: " **v** ",
+          details: [{ label: " `k` ", value: " `x` " }],
+        }),
+      ]),
+    ).toBe("1. `t` — **v**\n   - `k`: `x`");
+  });
+
+  test("renders labels, titles and values as markdown, unescaped", () => {
+    /*
+     * The caller decides: AffectedResourceList escapes its plain-text
+     * labels, the Breaching Samples block code-spans its attribute keys.
+     */
+    expect(
+      RootCauseList.render([
+        item({
+          title: "**Pod** `x`",
+          details: [{ label: "*Namespace*", value: "`y`" }],
+        }),
+      ]),
+    ).toBe("1. **Pod** `x` — **1.07 GB**\n   - *Namespace*: `y`");
+  });
+
+  test("parses as one ordered list whose every item owns a nested bullet list, with no code blocks", () => {
+    const tokens: Array<Token> = marked
+      .lexer(RootCauseList.render(items(12)))
+      .filter((token: Token): boolean => {
+        return token.type !== "space";
+      });
+
+    expect(tokens).toHaveLength(1);
+
+    const list: Tokens.List = tokens[0] as Tokens.List;
+
+    expect(list.type).toBe("list");
+    expect(list.ordered).toBe(true);
+    expect(list.items).toHaveLength(12);
+
+    list.items.forEach((listItem: Tokens.ListItem, index: number) => {
+      const nested: Tokens.List | undefined = listItem.tokens.find(
+        (token: Token): boolean => {
+          return token.type === "list";
+        },
+      ) as Tokens.List | undefined;
+
+      expect(nested).toBeDefined();
+      expect(nested!.ordered).toBe(false);
+      expect(
+        nested!.items.map((detail: Tokens.ListItem) => {
+          return detail.text;
+        }),
+      ).toEqual([`Label: \`detail-${index + 1}\``]);
+
+      expect(
+        listItem.tokens.some((token: Token): boolean => {
+          return token.type === "code";
+        }),
+      ).toBe(false);
+    });
+  });
+});
+
+describe("RootCauseList.code", () => {
+  test("wraps a value in single backticks", () => {
+    expect(RootCauseList.code("web-1")).toBe("`web-1`");
+  });
+
+  test("an ISO timestamp stays a bare single-backtick span, which the dashboard localizes", () => {
+    expect(RootCauseList.code("2026-08-14T10:30:00.000Z")).toBe(
+      "`2026-08-14T10:30:00.000Z`",
+    );
+  });
+
+  test.each([
+    ["undefined", undefined],
+    ["null", null],
+    ["an empty string", ""],
+    ["whitespace", "  \t "],
+    ["line breaks", "\r\n\n"],
+  ])("returns an empty string for %s", (_label: string, value: unknown) => {
+    expect(RootCauseList.code(value as string | undefined | null)).toBe("");
+  });
+
+  test("turns line breaks into single spaces", () => {
+    expect(RootCauseList.code("a\nb\r\nc \n\n d")).toBe("`a b c d`");
+  });
+
+  test("a value with backticks gets a fence one longer than its longest run, padded with spaces", () => {
+    expect(RootCauseList.code("a`b")).toBe("`` a`b ``");
+    expect(RootCauseList.code("a``b`c")).toBe("``` a``b`c ```");
+  });
+
+  test("the result parses back to exactly the value", () => {
+    for (const value of ["a`b", "`edge`", "x``y", "**not bold**", "a|b"]) {
+      const tokens: Array<Token> = marked.lexer(
+        `before ${RootCauseList.code(value)} after`,
+      );
+      const paragraph: Tokens.Paragraph = tokens[0] as Tokens.Paragraph;
+      const codespan: Tokens.Codespan | undefined = paragraph.tokens.find(
+        (token: Token): boolean => {
+          return token.type === "codespan";
+        },
+      ) as Tokens.Codespan | undefined;
+
+      expect(codespan).toBeDefined();
+      expect(codespan!.text).toBe(value);
+    }
+  });
+});

package/Tests/Server/Utils/Rules/RuleRun/RuleRunPermission.test.ts

@@ -363,3 +363,157 @@ describe("RuleRunPermission.assertCanRun", () => {
     }).toThrow(new BadDataException("This rule cannot be run."));
   });
 });
+
+/*
+ * SLO label and owner rules walk every SLO in the project as root, so running
+ * one needs the rule's edit permission, EditServiceLevelObjective, and - for
+ * owner rules - create on both SLO owner tables. Read off the real models'
+ * @TableAccessControl, like everything above.
+ */
+describe("RuleRunPermission.assertCanRun - SLO label and owner rules", () => {
+  it("lets a caller who can edit the rule and every SLO run an SLO label rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjectiveLabelRule,
+            Permission.EditServiceLevelObjective,
+          ],
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  it("refuses a caller who can edit SLOs but not the rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjective,
+            // Another SLO rule's permission is not this one's.
+            Permission.EditServiceLevelObjectiveMonitorRule,
+          ],
+        }),
+      );
+    }).toThrow(
+      "You do not have permission to edit this rule, which running it requires.",
+    );
+  });
+
+  it("refuses a rule author who cannot edit SLOs, naming them", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [Permission.EditServiceLevelObjectiveLabelRule],
+        }),
+      );
+    }).toThrow(
+      "You do not have permission to edit every SLO in this project, which running this rule does.",
+    );
+  });
+
+  it("does not let read access to the rule stand in for edit", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            Permission.ReadServiceLevelObjectiveOwnerRule,
+            Permission.EditServiceLevelObjective,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+            Permission.CreateServiceLevelObjectiveOwnerTeam,
+          ],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  it("requires create on both SLO owner tables for an SLO owner rule", () => {
+    const ruleAndSlo: Array<Permission> = [
+      Permission.EditServiceLevelObjectiveOwnerRule,
+      Permission.EditServiceLevelObjective,
+    ];
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({ permissions: ruleAndSlo }),
+      );
+    }).toThrow(
+      "You do not have permission to add owners to SLOs, which running this rule does.",
+    );
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            ...ruleAndSlo,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+          ],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            ...ruleAndSlo,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+            Permission.CreateServiceLevelObjectiveOwnerTeam,
+          ],
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  /*
+   * A run reaches every SLO, so an edit grant limited to the SLOs a user owns
+   * cannot authorize one.
+   */
+  it("does not count an Owned-scoped SLO edit grant", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjectiveLabelRule,
+            Permission.EditServiceLevelObjective,
+          ],
+          scope: PermissionScope.Owned,
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  it("honours a team's block list on SLOs, even over an admin grant", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [Permission.ProjectAdmin],
+          blockedPermissions: [Permission.EditServiceLevelObjective],
+        }),
+      );
+    }).toThrow(/permission block list/);
+  });
+
+  it("lets a project admin run both", () => {
+    for (const ruleType of [
+      RuleRunType.ServiceLevelObjectiveLabelRule,
+      RuleRunType.ServiceLevelObjectiveOwnerRule,
+    ]) {
+      expect(() => {
+        assertCanRun(
+          ruleType,
+          propsWith({ permissions: [Permission.ProjectAdmin] }),
+        );
+      }).not.toThrow();
+    }
+  });
+});

package/Tests/Server/Utils/SSRFProtection.test.ts

@@ -191,3 +191,114 @@ describe("SSRFProtection.validateWebhookTargetIsSafe", () => {
     });
   });
 });
+
+/*
+ * The guard parses the target with OneUptime's URL type as well as WHATWG, and
+ * turned any parse failure into "<label> is not a valid URL". That parser
+ * refused a first path segment containing a ":" - every Telegram Bot API URL,
+ * because the token is that segment - and any path containing "~". So the
+ * sandboxed axios bridge refused perfectly public requests as invalid URLs.
+ */
+describe("SSRFProtection with a ':' or '~' in the path", () => {
+  const BOT_TOKEN: string = "8000000001:AAFakeFakeFakeFakeFakeFakeFake_-12345";
+  const TELEGRAM_URL: string = `https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`;
+  let lookupSpy: LookupSpy;
+
+  beforeEach(() => {
+    lookupSpy = jest.spyOn(dns.promises, "lookup") as unknown as LookupSpy;
+    lookupSpy.mockResolvedValue([{ address: "149.154.167.220", family: 4 }]);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("validateWebhookTargetIsSafe accepts a Telegram Bot API URL", async () => {
+    await expect(
+      SSRFProtection.validateWebhookTargetIsSafe(TELEGRAM_URL, {
+        targetLabel: "Request URL",
+      }),
+    ).resolves.toBeUndefined();
+
+    expect(lookupSpy).toHaveBeenCalledWith("api.telegram.org", { all: true });
+  });
+
+  test("validateWebhookTargetIsSafe accepts the same URL as a URL object", async () => {
+    await expect(
+      SSRFProtection.validateWebhookTargetIsSafe(URL.fromString(TELEGRAM_URL)),
+    ).resolves.toBeUndefined();
+  });
+
+  test("validateAndResolveWebhookTarget keeps the token path and pins the address", async () => {
+    const target: Awaited<
+      ReturnType<typeof SSRFProtection.validateAndResolveWebhookTarget>
+    > = await SSRFProtection.validateAndResolveWebhookTarget(TELEGRAM_URL, {
+      targetLabel: "Request URL",
+    });
+
+    expect(target.url.toString()).toBe(TELEGRAM_URL);
+    expect(target.url.pathname).toBe(`/bot${BOT_TOKEN}/sendMessage`);
+    expect(target.addresses).toEqual([
+      { address: "149.154.167.220", family: 4 },
+    ]);
+  });
+
+  test.each([
+    "https://example.com/~user/hook",
+    "https://example.com/urn:uuid:6e8bc430-9c3a/x",
+    "https://example.com/abc:def",
+  ])("accepts the public URL %s", async (rawUrl: string) => {
+    await expect(
+      SSRFProtection.validateAndResolveWebhookTarget(rawUrl, {
+        targetLabel: "Request URL",
+      }),
+    ).resolves.toMatchObject({ url: new globalThis.URL(rawUrl) });
+  });
+
+  test.each([
+    [
+      "the metadata endpoint",
+      `http://169.254.169.254/bot${BOT_TOKEN}/sendMessage`,
+    ],
+    ["loopback", `http://127.0.0.1:8080/bot${BOT_TOKEN}/sendMessage`],
+    ["an RFC-1918 address", `http://10.0.0.5/bot${BOT_TOKEN}/sendMessage`],
+    ["IPv6 loopback", `http://[::1]/bot${BOT_TOKEN}/sendMessage`],
+  ])(
+    "still refuses %s behind a token path, for its host",
+    async (_label: string, rawUrl: string) => {
+      const validation: Promise<unknown> =
+        SSRFProtection.validateAndResolveWebhookTarget(rawUrl, {
+          targetLabel: "Request URL",
+        });
+
+      await expect(validation).rejects.toThrow(/private|loopback|link-local/);
+      await expect(validation).rejects.not.toThrow(/not a valid URL/);
+    },
+  );
+
+  test("still refuses a public name that resolves internally behind a token path", async () => {
+    lookupSpy.mockResolvedValue([{ address: "169.254.169.254", family: 4 }]);
+
+    await expect(
+      SSRFProtection.validateAndResolveWebhookTarget(TELEGRAM_URL, {
+        targetLabel: "Request URL",
+      }),
+    ).rejects.toThrow(/resolves to a private, loopback, or link-local/);
+  });
+
+  test("a refusal does not quote the token", async () => {
+    let message: string = "";
+
+    try {
+      await SSRFProtection.validateAndResolveWebhookTarget(
+        `http://169.254.169.254/bot${BOT_TOKEN}/sendMessage`,
+        { targetLabel: "Request URL" },
+      );
+    } catch (err) {
+      message = (err as Error).message;
+    }
+
+    expect(message).not.toBe("");
+    expect(message).not.toContain(BOT_TOKEN);
+  });
+});

package/Tests/Server/Utils/Slo/SloRulePatternValidator.test.ts

@@ -0,0 +1,67 @@
+import SloRulePatternValidator from "../../../../Server/Utils/Slo/SloRulePatternValidator";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Write-time pattern validation for SLO label and owner rules: the engines
+ * take a case-insensitive regex or a '*' wildcard, and anything else could
+ * only ever match nothing.
+ */
+describe("SloRulePatternValidator", () => {
+  it.each([
+    ["an anchored regex", "^checkout-.*$"],
+    ["an alternation", "checkout|payments"],
+    ["a leading wildcard", "*checkout"],
+    ["a wildcard on both sides", "*checkout*"],
+    ["a plain word", "checkout"],
+    // Not a regex, but the '*' makes it a wildcard.
+    ["a wildcard that is not a valid regex", "*api-(01*"],
+  ])("accepts %s", (_: string, pattern: string) => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: pattern,
+        descriptionPattern: pattern,
+      });
+    }).not.toThrow();
+  });
+
+  it.each([undefined, null, ""])(
+    "treats %p as no pattern at all",
+    (pattern: string | null | undefined) => {
+      expect(() => {
+        SloRulePatternValidator.validate({
+          namePattern: pattern,
+          descriptionPattern: pattern,
+        });
+      }).not.toThrow();
+    },
+  );
+
+  it("refuses a name pattern that is neither a regex nor a wildcard", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({ namePattern: "checkout-(01" });
+    }).toThrow(
+      new BadDataException(
+        `SLO Name Pattern "checkout-(01" is not a valid regular expression, and contains no '*' wildcard to fall back on, so it would never match an SLO. Use a regex such as checkout-.* or a wildcard such as *checkout*.`,
+      ),
+    );
+  });
+
+  it("refuses a description pattern that is neither a regex nor a wildcard", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: "checkout",
+        descriptionPattern: "[unclosed",
+      });
+    }).toThrow('SLO Description Pattern "[unclosed"');
+  });
+
+  it("checks the name before the description", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: "(",
+        descriptionPattern: "[",
+      });
+    }).toThrow("SLO Name Pattern");
+  });
+});