@oneuptime/common 13.0.8 → 14.0.1

package/Tests/Types/Database/CanonicalModelInstance.test.ts

@@ -0,0 +1,190 @@
+import AllModelTypes from "../../../Models/DatabaseModels/Index";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import ProjectSCIM from "../../../Models/DatabaseModels/ProjectSCIM";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import UserEmail from "../../../Models/DatabaseModels/UserEmail";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import ColumnBillingAccessControl from "../../../Types/BaseDatabase/ColumnBillingAccessControl";
+import { getColumnAccessControlForAllColumns } from "../../../Types/Database/AccessControl/ColumnAccessControl";
+import { getColumnBillingAccessControlForAllColumns } from "../../../Types/Database/AccessControl/ColumnBillingAccessControl";
+import { getOwnerOnlyColumns } from "../../../Types/Database/AccessControl/OwnerOnlyColumn";
+import Dictionary from "../../../Types/Dictionary";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, test } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+
+/*
+ * WHY THIS FILE EXISTS - do not delete these as "obvious" assertions.
+ *
+ * Every "which columns does this model have" lookup answers the question by
+ * enumerating an INSTANCE's own keys, and caches the answer per CLASS, for the
+ * whole process. So the FIRST instance to ask used to define what the class is
+ * for everybody after it.
+ *
+ * BaseAPI.createItem deleted `_id` off the live model instance it handed to
+ * the service, and DatabaseService.create asks that instance for its columns
+ * (generateDefaultValues) before any permission check runs. One POST - even a
+ * POST that was refused - could therefore teach the process that a model has
+ * no `_id` column, and DatabaseBaseModel.toJSONObject serializes a row by
+ * iterating exactly that cached list, so every response for that model lost
+ * its id from then on. To any caller, on any route, including plain reads as
+ * root: the row still carried its real `_id` in memory and the SQL projection
+ * still selected it. The id was dropped on the way out, and it stayed a 200
+ * because `_id` is in ColumnPermissions.getExcludedColumnNames().
+ *
+ * The tests below do the mutation on purpose. No caller in the tree does it
+ * any more, and that is not what is being protected: the invariant is that it
+ * CANNOT MATTER who asks first or what they did to their own instance. Each
+ * test uses a different model class, because these caches are per class and
+ * per process - a class another test has already asked about has a warm cache
+ * and would pass vacuously.
+ */
+
+describe("column metadata does not depend on which instance asked first", () => {
+  test("getTableColumns: a mutilated instance asking first cannot strip _id from the class", () => {
+    const mutilated: ProjectSCIM = new ProjectSCIM();
+
+    // exactly what BaseAPI.createItem used to do before calling the service
+    delete (mutilated as unknown as Record<string, unknown>)["_id"];
+    expect(Object.keys(mutilated)).not.toContain("_id");
+
+    // the mutilated instance is the FIRST to ask, on a cold cache
+    expect(mutilated.getTableColumns().columns).toContain("_id");
+
+    // ...and a fresh instance of the same class is unharmed
+    expect(new ProjectSCIM().getTableColumns().columns).toContain("_id");
+  });
+
+  test("getTableColumns: a row still serializes with its _id after such a create", () => {
+    /*
+     * The assertion that matches the reported symptom: POST /api/project-scim
+     * answered 200 with every column except "_id", and a get-list selecting
+     * {_id, name} came back as {name} alone.
+     */
+    const mutilated: Monitor = new Monitor();
+    delete (mutilated as unknown as Record<string, unknown>)["_id"];
+    mutilated.getTableColumns();
+
+    const row: Monitor = new Monitor();
+    row._id = "22222222-2222-4222-8222-222222222222";
+    row.name = "a monitor";
+
+    const json: JSONObject = BaseModel.toJSONObject(row, Monitor);
+
+    expect(json["_id"]).toBe("22222222-2222-4222-8222-222222222222");
+    expect(json["name"]).toBe("a monitor");
+  });
+
+  test("getColumnAccessControlForAllColumns is instance-independent", () => {
+    const mutilated: StatusPage = new StatusPage();
+    delete (mutilated as unknown as Record<string, unknown>)["name"];
+
+    const fromMutilated: Dictionary<ColumnAccessControl> =
+      getColumnAccessControlForAllColumns(mutilated);
+
+    expect(fromMutilated["name"]).toBeDefined();
+    expect(
+      getColumnAccessControlForAllColumns(new StatusPage())["name"],
+    ).toBeDefined();
+  });
+
+  test("getColumnBillingAccessControlForAllColumns is instance-independent", () => {
+    const mutilated: StatusPage = new StatusPage();
+    delete (mutilated as unknown as Record<string, unknown>)["customCSS"];
+
+    const fromMutilated: Dictionary<ColumnBillingAccessControl> =
+      getColumnBillingAccessControlForAllColumns(mutilated);
+
+    expect(fromMutilated["customCSS"]).toBeDefined();
+    expect(
+      getColumnBillingAccessControlForAllColumns(new StatusPage())["customCSS"],
+    ).toBeDefined();
+  });
+
+  test("getOwnerOnlyColumns is instance-independent", () => {
+    /*
+     * This one is a permission list, not a projection: a marked column that
+     * goes unreported is a column OwnerOnlyColumnPermission stops protecting.
+     */
+    const mutilated: UserEmail = new UserEmail();
+    delete (mutilated as unknown as Record<string, unknown>)["email"];
+
+    expect(getOwnerOnlyColumns(mutilated)).toContain("email");
+    expect(getOwnerOnlyColumns(new UserEmail())).toContain("email");
+  });
+
+  test("mutating an instance after the class has been read changes nothing either", () => {
+    const first: UserEmail = new UserEmail();
+    expect(first.getTableColumns().columns).toContain("_id");
+
+    delete (first as unknown as Record<string, unknown>)["_id"];
+
+    expect(first.getTableColumns().columns).toContain("_id");
+    expect(new UserEmail().getTableColumns().columns).toContain("_id");
+  });
+});
+
+/*
+ * The premise of the fix: metadata enumeration reads a freshly constructed
+ * instance of the caller's class, so every model must be no-arg constructible
+ * and must expose every column it declares on a fresh instance (the class
+ * bodies do that with `= undefined` initializers). If a model is ever added
+ * that breaks either half, it would silently lose columns everywhere -
+ * responses, selects, permissions - so assert it for all of them at once.
+ */
+describe("every database model supports canonical-instance enumeration", () => {
+  test("all models are no-arg constructible and declare no column that a fresh instance lacks", () => {
+    const columnsByTarget: Map<unknown, Array<string>> = new Map();
+
+    const record: (target: unknown, propertyName: string) => void = (
+      target: unknown,
+      propertyName: string,
+    ): void => {
+      const list: Array<string> = columnsByTarget.get(target) || [];
+      list.push(propertyName);
+      columnsByTarget.set(target, list);
+    };
+
+    for (const column of getMetadataArgsStorage().columns) {
+      record(column.target, column.propertyName);
+    }
+
+    for (const relation of getMetadataArgsStorage().relations) {
+      record(relation.target, relation.propertyName);
+    }
+
+    const constructFailures: Array<string> = [];
+    const missingKeys: Array<string> = [];
+
+    for (const modelType of AllModelTypes) {
+      let instance: BaseModel | null = null;
+
+      try {
+        instance = new modelType();
+      } catch (err) {
+        constructFailures.push(`${modelType.name}: ${(err as Error).message}`);
+        continue;
+      }
+
+      const ownKeys: Set<string> = new Set(Object.keys(instance));
+
+      // inherited columns count too, so walk the constructor chain
+      let ctor: unknown = modelType;
+
+      while (ctor && ctor !== Function.prototype) {
+        for (const propertyName of columnsByTarget.get(ctor) || []) {
+          if (!ownKeys.has(propertyName)) {
+            missingKeys.push(`${modelType.name}.${propertyName}`);
+          }
+        }
+
+        ctor = Object.getPrototypeOf(ctor);
+      }
+    }
+
+    expect(constructFailures).toEqual([]);
+    expect(missingKeys).toEqual([]);
+    expect(AllModelTypes.length).toBeGreaterThan(400);
+  });
+});

package/Tests/UI/Components/EditionLabelLapseCopy.ts

@@ -0,0 +1,104 @@
+/*
+ * What the edition dialog must say about an Enterprise license lapse. Shared
+ * by the core EditionLabel suite and ee/Tests/UI/License, which renders the
+ * same dialog with the Enterprise license manager.
+ *
+ * When the license lapses (after the trial or the grace period), single
+ * sign-on (SAML and OIDC), SCIM provisioning and audit logging stop - the
+ * Community Edition's behaviour - and "Require SSO" stops being enforced at
+ * the same moment, so nobody is locked out: users sign in with their
+ * password. Everything resumes as soon as a license is activated. The trial
+ * and grace notices must say so BEFORE it happens, and the lapsed notice must
+ * say what is off.
+ *
+ * The dialog used to promise the opposite ("SSO, SCIM and audit logging never
+ * stop"), so the checks reject that copy too. Plain functions over text, with
+ * no jest dependency, so a test can prove each check fails on the wrong copy.
+ */
+
+// Before the lapse: the trial and grace notices, after "Without a valid license (...), ".
+export const LAPSE_WARNING_PHRASES: ReadonlyArray<string> = [
+  "single sign-on (SAML and OIDC) stops",
+  '"Require SSO" is no longer enforced, so users sign in with their password',
+  "SCIM provisioning stops",
+  "audit logging stops recording",
+  "enterprise configuration becomes read-only",
+  "the enterprise admin dashboards are locked",
+  "Everything resumes as soon as a license is activated",
+  "core monitoring is never affected",
+];
+
+// After the lapse: the license-required notice (expired, missing, invalid).
+export const LAPSED_STATE_PHRASES: ReadonlyArray<string> = [
+  "Single sign-on (SAML and OIDC) and SCIM provisioning are off",
+  '"Require SSO" is not enforced, so users sign in with their password',
+  "SCIM requests are refused",
+  "Audit logging is not recording",
+  "Enterprise configuration is read-only",
+  "Everything resumes, without a restart, as soon as a valid license is added",
+  "core monitoring is never affected",
+];
+
+// The soft-enforcement promises the dialog made before. None may come back.
+export const RETIRED_SOFT_ENFORCEMENT_COPY: ReadonlyArray<RegExp> = [
+  /never stop/i,
+  /already configured keeps working/i,
+  /configured stops working/i,
+  /keeps? working as configured/i,
+  /never (?:silently )?weakens?/i,
+];
+
+// The copy the dialog shipped before the owner's decision, verbatim.
+export const RETIRED_NOTICE_EXAMPLES: ReadonlyArray<string> = [
+  "Without a valid license (after the 14-day grace period), enterprise configuration becomes read-only and the enterprise admin dashboards are locked. Everything you already configured keeps working — SSO, SCIM and audit logging never stop — and core monitoring is never affected.",
+  "Without a valid license (after the 14-day trial), enterprise configuration becomes read-only and the enterprise admin dashboards are locked. Everything you already configured keeps working — SSO, SCIM and audit logging never stop — and core monitoring is never affected.",
+  "The Enterprise license expired and its grace period is over. Enterprise configuration is read-only and the enterprise admin dashboards are locked until a valid license is added. Everything you already configured keeps working — SSO, SCIM and audit logging never stop — and core monitoring is never affected.",
+];
+
+type CopyCheck = (text: string | null | undefined) => Array<string>;
+
+// Whitespace-normalized, so a check does not depend on how JSX wraps a line.
+const normalize: (text: string | null | undefined) => string = (
+  text: string | null | undefined,
+): string => {
+  return (text || "").replace(/\s+/g, " ").trim();
+};
+
+const copyProblems: (
+  text: string | null | undefined,
+  requiredPhrases: ReadonlyArray<string>,
+) => Array<string> = (
+  text: string | null | undefined,
+  requiredPhrases: ReadonlyArray<string>,
+): Array<string> => {
+  const flat: string = normalize(text);
+  const problems: Array<string> = [];
+
+  for (const phrase of requiredPhrases) {
+    if (!flat.includes(phrase)) {
+      problems.push(`missing: ${phrase}`);
+    }
+  }
+
+  for (const retired of RETIRED_SOFT_ENFORCEMENT_COPY) {
+    if (retired.test(flat)) {
+      problems.push(`retired: ${retired.source}`);
+    }
+  }
+
+  return problems;
+};
+
+// What is wrong with a trial or grace notice (empty when it is right).
+export const lapseWarningProblems: CopyCheck = (
+  text: string | null | undefined,
+): Array<string> => {
+  return copyProblems(text, LAPSE_WARNING_PHRASES);
+};
+
+// What is wrong with the notice shown once the license has lapsed.
+export const lapsedStateProblems: CopyCheck = (
+  text: string | null | undefined,
+): Array<string> => {
+  return copyProblems(text, LAPSED_STATE_PHRASES);
+};

package/Tests/UI/Components/EditionLabelLicenseManagerWiring.test.tsx

@@ -0,0 +1,254 @@
+import "@testing-library/jest-dom";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { act, cleanup, render } from "@testing-library/react";
+import React, { ReactElement } from "react";
+import fs from "fs";
+import path from "path";
+
+/*
+ * The core Header (Admin Dashboard) and Footer (Dashboard) hand their edition
+ * pill the Enterprise plugin's LicenseManager, read from the plugin door
+ * inside render. With the Community stub - which is what this jest config
+ * resolves the plugin specifiers to - they hand it nothing, and the pill
+ * shows the license status only.
+ *
+ * EditionLabel is replaced with a probe that records the prop, and each door
+ * with one that returns whatever the test sets (the real Community stub by
+ * default). This is core, and must pass with ee/ deleted.
+ */
+
+const receivedManagers: Array<unknown> = [];
+
+jest.mock("../../../UI/Components/EditionLabel/EditionLabel", () => {
+  return {
+    __esModule: true,
+    default: (props: { licenseManager?: unknown }): ReactElement => {
+      receivedManagers.push(props.licenseManager);
+
+      return <span data-testid="edition-label" />;
+    },
+  };
+});
+
+jest.mock("../../../UI/Images/logos/OneUptimeSVG/3-transparent.svg", () => {
+  return "data:image/svg+xml;base64,bG9nbw==";
+});
+
+jest.mock("react-i18next", () => {
+  return {
+    useTranslation: () => {
+      return {
+        t: (key: string): string => {
+          return key;
+        },
+      };
+    },
+  };
+});
+
+jest.mock("../../../UI/Utils/User", () => {
+  return {
+    __esModule: true,
+    default: {
+      isMasterAdmin: (): boolean => {
+        return true;
+      },
+      isLoggedIn: (): boolean => {
+        return true;
+      },
+    },
+  };
+});
+
+jest.mock(
+  "../../../../App/FeatureSet/Dashboard/src/Components/LanguageSwitcher/LanguageSwitcher",
+  () => {
+    return {
+      __esModule: true,
+      default: (): ReactElement => {
+        return <span data-testid="language-switcher" />;
+      },
+    };
+  },
+);
+
+let mockAdminPlugins: Record<string, unknown> = {};
+let mockDashboardPlugins: Record<string, unknown> = {};
+let adminDoorReads: number = 0;
+let dashboardDoorReads: number = 0;
+
+jest.mock(
+  "../../../../App/FeatureSet/AdminDashboard/src/Enterprise/Plugins",
+  () => {
+    return {
+      getAdminDashboardPlugins: (): Record<string, unknown> => {
+        adminDoorReads += 1;
+        return mockAdminPlugins;
+      },
+    };
+  },
+);
+
+jest.mock("../../../../App/FeatureSet/Dashboard/src/Enterprise/Plugins", () => {
+  return {
+    getDashboardPlugins: (): Record<string, unknown> => {
+      dashboardDoorReads += 1;
+      return mockDashboardPlugins;
+    },
+  };
+});
+
+import AdminCommunityPlugins from "../../../../App/FeatureSet/AdminDashboard/src/Enterprise/CommunityPlugins";
+import DashboardCommunityPlugins from "../../../../App/FeatureSet/Dashboard/src/Enterprise/CommunityPlugins";
+import AdminDashboardHeader from "../../../../App/FeatureSet/AdminDashboard/src/Components/Header/Header";
+import DashboardFooter from "../../../../App/FeatureSet/Dashboard/src/Components/Footer/Footer";
+import { ADMIN_DASHBOARD_ENTERPRISE_PLUGIN_KEYS } from "../../../../App/FeatureSet/AdminDashboard/src/Enterprise/EnterprisePlugins";
+import { DASHBOARD_ENTERPRISE_PLUGIN_KEYS } from "../../../../App/FeatureSet/Dashboard/src/Enterprise/EnterprisePlugins";
+
+const FakeAdminLicenseManager: () => ReactElement = (): ReactElement => {
+  return <span />;
+};
+
+const FakeDashboardLicenseManager: () => ReactElement = (): ReactElement => {
+  return <span />;
+};
+
+const APP_DIR: string = path.resolve(__dirname, "..", "..", "..", "..", "App");
+
+interface Caller {
+  name: string;
+  file: string;
+  render: () => void;
+  setPlugins: (plugins: Record<string, unknown>) => void;
+  communityStub: Record<string, unknown>;
+  fake: () => ReactElement;
+  doorReads: () => number;
+}
+
+const CALLERS: Array<Caller> = [
+  {
+    name: "the Admin Dashboard header",
+    file: path.join(
+      APP_DIR,
+      "FeatureSet/AdminDashboard/src/Components/Header/Header.tsx",
+    ),
+    render: (): void => {
+      render(<AdminDashboardHeader />);
+    },
+    setPlugins: (plugins: Record<string, unknown>): void => {
+      mockAdminPlugins = plugins;
+    },
+    communityStub: AdminCommunityPlugins as Record<string, unknown>,
+    fake: FakeAdminLicenseManager,
+    doorReads: (): number => {
+      return adminDoorReads;
+    },
+  },
+  {
+    name: "the Dashboard footer",
+    file: path.join(
+      APP_DIR,
+      "FeatureSet/Dashboard/src/Components/Footer/Footer.tsx",
+    ),
+    render: (): void => {
+      render(<DashboardFooter />);
+    },
+    setPlugins: (plugins: Record<string, unknown>): void => {
+      mockDashboardPlugins = plugins;
+    },
+    communityStub: DashboardCommunityPlugins as Record<string, unknown>,
+    fake: FakeDashboardLicenseManager,
+    doorReads: (): number => {
+      return dashboardDoorReads;
+    },
+  },
+];
+
+beforeEach(() => {
+  receivedManagers.length = 0;
+  adminDoorReads = 0;
+  dashboardDoorReads = 0;
+  mockAdminPlugins = AdminCommunityPlugins as Record<string, unknown>;
+  mockDashboardPlugins = DashboardCommunityPlugins as Record<string, unknown>;
+});
+
+afterEach(() => {
+  cleanup();
+});
+
+describe("LicenseManager is a key of both plugin contracts", () => {
+  test("the Admin Dashboard's", () => {
+    expect(ADMIN_DASHBOARD_ENTERPRISE_PLUGIN_KEYS).toContain("LicenseManager");
+  });
+
+  test("the Dashboard's", () => {
+    expect(DASHBOARD_ENTERPRISE_PLUGIN_KEYS).toContain("LicenseManager");
+  });
+
+  test("and neither Community stub provides it", () => {
+    expect(
+      (AdminCommunityPlugins as Record<string, unknown>)["LicenseManager"],
+    ).toBeUndefined();
+    expect(
+      (DashboardCommunityPlugins as Record<string, unknown>)["LicenseManager"],
+    ).toBeUndefined();
+  });
+});
+
+describe.each(CALLERS)("$name", (caller: Caller) => {
+  test("passes the plugin's LicenseManager to the edition pill", async () => {
+    caller.setPlugins({ LicenseManager: caller.fake });
+
+    await act(async () => {
+      caller.render();
+    });
+
+    expect(receivedManagers).toContain(caller.fake);
+    expect(
+      receivedManagers.every((value: unknown): boolean => {
+        return value === caller.fake;
+      }),
+    ).toBe(true);
+  });
+
+  test("passes nothing with the Community stub (negative control)", async () => {
+    caller.setPlugins(caller.communityStub);
+
+    await act(async () => {
+      caller.render();
+    });
+
+    expect(receivedManagers.length).toBeGreaterThan(0);
+    expect(
+      receivedManagers.every((value: unknown): boolean => {
+        return value === undefined;
+      }),
+    ).toBe(true);
+  });
+
+  test("reads the door while rendering, not when the module loads", async () => {
+    // The module was imported above; no render has happened yet.
+    expect(caller.doorReads()).toBe(0);
+
+    await act(async () => {
+      caller.render();
+    });
+
+    expect(caller.doorReads()).toBeGreaterThan(0);
+  });
+
+  test("names the prop in its source, so the wiring is not a coincidence", () => {
+    const source: string = fs.readFileSync(caller.file, "utf8");
+
+    expect(source).toMatch(
+      /licenseManager=\{get(AdminDashboard|Dashboard)Plugins\(\)\.LicenseManager\}/,
+    );
+  });
+});