@oneuptime/common 14.0.0 → 14.0.1

package/Tests/Server/Types/Markdown.test.ts

@@ -111,9 +111,10 @@ describe("Markdown.slugify", () => {
  * Until this suite existed there was no coverage of convertToHTML at all,
  * for any content type — and the email renderer was a bare `new Renderer()`,
  * so marked's stock output went straight into the message. That mattered
- * most for the alert and incident root cause, which carries a
+ * most for the alert and incident root cause, which then carried a
  * GitHub-flavoured table of breaching samples: it arrived as a naked
  * <table> with no borders and no padding, every row running into the next.
+ * (Those samples are a list now; tables typed into markdown remain.)
  *
  * Two properties are load-bearing and easy to break:
  *

package/Tests/Server/Types/Workflow/Components/ApiComponentSsrf.test.ts

@@ -213,3 +213,52 @@ describe.each(apiComponents)(
     });
   },
 );
+
+/*
+ * sanitizeArgs validates the raw URL and then dispatches URL.fromString(url).
+ * That parse refused any first path segment containing a ":", so every API
+ * component call to the Telegram Bot API (the token is that segment) failed
+ * before a request was made, quoting the token in the error.
+ */
+describe.each(apiComponents)(
+  "API %s workflow component with a token in the first path segment",
+  (
+    _label: string,
+    apiMethodName: ApiMethodName,
+    createComponent: () => ComponentCode,
+  ) => {
+    const telegramUrl: string =
+      "https://api.telegram.org/bot8000000001:AAFakeFakeFakeFakeFakeFakeFake_-12345/sendMessage";
+
+    test("dispatches the Telegram Bot API URL unchanged", async () => {
+      getApiMock(apiMethodName).mockResolvedValue(
+        new HTTPResponse<JSONObject>(200, { ok: true }, {}),
+      );
+
+      const result: { returnValues: JSONObject } = await createComponent().run(
+        { url: telegramUrl },
+        makeOptions(),
+      );
+
+      const request: { url: { toString: () => string } } = getApiMock(
+        apiMethodName,
+      ).mock.calls[0]![0] as { url: { toString: () => string } };
+
+      expect(request.url.toString()).toBe(telegramUrl);
+      expect(result.returnValues["response-status"]).toBe(200);
+    });
+
+    test("still refuses an internal host behind the same path", async () => {
+      await expect(
+        createComponent().run(
+          {
+            url: "http://169.254.169.254/bot8000000001:AAFake/sendMessage",
+          },
+          makeOptions(),
+        ),
+      ).rejects.toThrow();
+
+      expect(getApiMock(apiMethodName)).not.toHaveBeenCalled();
+    });
+  },
+);

package/Tests/Server/Types/Workflow/Components/TelegramSendMessageToChat.test.ts

@@ -0,0 +1,331 @@
+import SendMessageToChat from "../../../../../Server/Types/Workflow/Components/Telegram/SendMessageToChat";
+import {
+  RunOptions,
+  RunReturnType,
+} from "../../../../../Server/Types/Workflow/ComponentCode";
+import HTTPErrorResponse from "../../../../../Types/API/HTTPErrorResponse";
+import HTTPResponse from "../../../../../Types/API/HTTPResponse";
+import URL from "../../../../../Types/API/URL";
+import Exception from "../../../../../Types/Exception/Exception";
+import { JSONObject } from "../../../../../Types/JSON";
+import ObjectID from "../../../../../Types/ObjectID";
+import API from "../../../../../Utils/API";
+import { beforeEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * "Send Message to Telegram" built its request URL with
+ * URL.fromString(`https://api.telegram.org/bot${token}/sendMessage`). Once
+ * Route began refusing scheme-like values, the bare path "bot<id>:<secret>/..."
+ * was refused, so EVERY run failed before a request was sent - with the error
+ * "Invalid route: bot<the whole token>/sendMessage", which put the credential
+ * into the run log even though the argument itself is shown as [REDACTED].
+ */
+
+jest.mock("../../../../../Utils/API", () => {
+  return {
+    __esModule: true,
+    default: { post: jest.fn() },
+  };
+});
+
+const apiPostMock: jest.Mock = API.post as unknown as jest.Mock;
+
+// Same shape as a real token: 10-digit bot id, 35-character secret.
+const BOT_TOKEN: string = "8000000001:AAFakeFakeFakeFakeFakeFakeFake_-12345";
+
+const HELP_MESSAGE: string =
+  " Note: For usernames, the user must have started a conversation with the bot first. For groups/channels, the bot must be added as a member or admin.";
+
+function makeOptions(): RunOptions {
+  return {
+    log: jest.fn() as RunOptions["log"],
+    workflowLogId: ObjectID.generate(),
+    workflowId: ObjectID.generate(),
+    projectId: ObjectID.generate(),
+    onError: ((exception: Exception): Exception => {
+      return exception;
+    }) as RunOptions["onError"],
+    executeWorkflow: async (): Promise<void> => {},
+  };
+}
+
+function makeArgs(overrides: JSONObject = {}): JSONObject {
+  return {
+    "bot-token": BOT_TOKEN,
+    "chat-id": "@mychannel",
+    text: "Deploy finished",
+    ...overrides,
+  };
+}
+
+interface PostRequest {
+  url: URL;
+  data: JSONObject;
+}
+
+function getPostRequest(): PostRequest {
+  return apiPostMock.mock.calls[0]![0] as PostRequest;
+}
+
+async function runAndGetError(args: JSONObject): Promise<Error> {
+  try {
+    await new SendMessageToChat().run(args, makeOptions());
+  } catch (err) {
+    return err as Error;
+  }
+
+  throw new Error("Expected the component to throw");
+}
+
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+describe("Telegram SendMessageToChat - sending", () => {
+  test("sends to the Bot API sendMessage URL instead of failing on Invalid route", async () => {
+    apiPostMock.mockResolvedValue(
+      new HTTPResponse<JSONObject>(200, { ok: true, result: {} }, {}),
+    );
+
+    const result: RunReturnType = await new SendMessageToChat().run(
+      makeArgs(),
+      makeOptions(),
+    );
+
+    expect(apiPostMock).toHaveBeenCalledTimes(1);
+    expect(getPostRequest().url.toString()).toBe(
+      `https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`,
+    );
+    expect(result.executePort?.id).toBe("success");
+    expect(result.returnValues).toEqual({});
+  });
+
+  test("sends the chat id and text as the request body", async () => {
+    apiPostMock.mockResolvedValue(
+      new HTTPResponse<JSONObject>(200, { ok: true }, {}),
+    );
+
+    await new SendMessageToChat().run(
+      makeArgs({ "chat-id": "-1001234567890", text: "Line 1\nLine 2" }),
+      makeOptions(),
+    );
+
+    expect(getPostRequest().data).toEqual({
+      chat_id: "-1001234567890",
+      text: "Line 1\nLine 2",
+    });
+  });
+
+  test("dials api.telegram.org over https with the token only in the path", async () => {
+    apiPostMock.mockResolvedValue(
+      new HTTPResponse<JSONObject>(200, { ok: true }, {}),
+    );
+
+    await new SendMessageToChat().run(makeArgs(), makeOptions());
+
+    const url: URL = getPostRequest().url;
+    expect(url.isHttps()).toBe(true);
+    expect(url.hostname.hostname).toBe("api.telegram.org");
+    expect(url.route.toString()).toBe(`/bot${BOT_TOKEN}/sendMessage`);
+    expect(Object.keys(url.params)).toHaveLength(0);
+  });
+
+  test("trims whitespace a pasted or stored token picked up", async () => {
+    apiPostMock.mockResolvedValue(
+      new HTTPResponse<JSONObject>(200, { ok: true }, {}),
+    );
+
+    const result: RunReturnType = await new SendMessageToChat().run(
+      makeArgs({ "bot-token": `  ${BOT_TOKEN}\n` }),
+      makeOptions(),
+    );
+
+    expect(getPostRequest().url.toString()).toBe(
+      `https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`,
+    );
+    expect(result.executePort?.id).toBe("success");
+  });
+
+  test.each([
+    ["a short secret", "1:A"],
+    ["a hyphen and underscore", "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11"],
+    ["a long bot id", "1234567890123:AAE_underscored-and-dashed"],
+  ])("accepts a token with %s", async (_label: string, token: string) => {
+    apiPostMock.mockResolvedValue(
+      new HTTPResponse<JSONObject>(200, { ok: true }, {}),
+    );
+
+    const result: RunReturnType = await new SendMessageToChat().run(
+      makeArgs({ "bot-token": token }),
+      makeOptions(),
+    );
+
+    expect(getPostRequest().url.toString()).toBe(
+      `https://api.telegram.org/bot${token}/sendMessage`,
+    );
+    expect(result.executePort?.id).toBe("success");
+  });
+});
+
+describe("Telegram SendMessageToChat - Telegram errors go to the error port", () => {
+  test("an HTTP error returns Telegram's description", async () => {
+    apiPostMock.mockResolvedValue(
+      new HTTPErrorResponse(
+        400,
+        { ok: false, description: "Bad Request: chat not found" },
+        {},
+      ),
+    );
+
+    const result: RunReturnType = await new SendMessageToChat().run(
+      makeArgs(),
+      makeOptions(),
+    );
+
+    expect(result.executePort?.id).toBe("error");
+    expect(result.returnValues["error"]).toBe(
+      "Bad Request: chat not found" + HELP_MESSAGE,
+    );
+  });
+
+  test("an HTTP error with no description falls back to a generic message", async () => {
+    apiPostMock.mockResolvedValue(new HTTPErrorResponse(502, {}, {}));
+
+    const result: RunReturnType = await new SendMessageToChat().run(
+      makeArgs(),
+      makeOptions(),
+    );
+
+    expect(result.executePort?.id).toBe("error");
+    expect(result.returnValues["error"]).toBe("Server Error." + HELP_MESSAGE);
+  });
+
+  test("a 200 with ok:false is still an error", async () => {
+    apiPostMock.mockResolvedValue(
+      new HTTPResponse<JSONObject>(
+        200,
+        { ok: false, description: "Forbidden: bot was blocked by the user" },
+        {},
+      ),
+    );
+
+    const result: RunReturnType = await new SendMessageToChat().run(
+      makeArgs(),
+      makeOptions(),
+    );
+
+    expect(result.executePort?.id).toBe("error");
+    expect(result.returnValues["error"]).toBe(
+      "Forbidden: bot was blocked by the user" + HELP_MESSAGE,
+    );
+  });
+
+  test("a thrown HTTP error response returns its description", async () => {
+    apiPostMock.mockRejectedValue(
+      new HTTPErrorResponse(
+        401,
+        { ok: false, description: "Unauthorized" },
+        {},
+      ),
+    );
+
+    const result: RunReturnType = await new SendMessageToChat().run(
+      makeArgs(),
+      makeOptions(),
+    );
+
+    expect(result.executePort?.id).toBe("error");
+    expect(result.returnValues["error"]).toBe("Unauthorized" + HELP_MESSAGE);
+  });
+
+  test("any other thrown error fails the step without quoting the token", async () => {
+    apiPostMock.mockRejectedValue(
+      new Error(
+        `connect ECONNREFUSED https://api.telegram.org/bot${BOT_TOKEN}/sendMessage`,
+      ),
+    );
+
+    const error: Error = await runAndGetError(makeArgs());
+
+    expect(error.message).toBe("Something wrong happened.");
+    expect(error.message).not.toContain(BOT_TOKEN);
+  });
+});
+
+describe("Telegram SendMessageToChat - argument validation", () => {
+  test.each([
+    ["bot-token", "Telegram Bot Token not found"],
+    ["chat-id", "Telegram Chat ID not found"],
+    ["text", "Telegram message not found"],
+  ])(
+    "refuses a missing %s without sending",
+    async (argument: string, expectedMessage: string) => {
+      const args: JSONObject = makeArgs();
+      delete args[argument];
+
+      const error: Error = await runAndGetError(args);
+
+      expect(error.message).toBe(expectedMessage);
+      expect(apiPostMock).not.toHaveBeenCalled();
+    },
+  );
+
+  test.each([
+    ["only whitespace", "   "],
+    ["no colon", "8000000001AAFakeFakeFake"],
+    ["a non-numeric bot id", "bot8000000001:AAFakeFakeFake"],
+    ["an empty secret", "8000000001:"],
+    ["an empty bot id", ":AAFakeFakeFake"],
+    ["a space inside", "8000000001:AAFake Fake"],
+    ["a path separator", "8000000001:AAFake/../../getUpdates"],
+    ["a query", "8000000001:AAFake?offset=1"],
+    ["a fragment", "8000000001:AAFake#x"],
+    ["a second colon", "8000000001:AAFake:extra"],
+    ["an '@'", "8000000001:AAFake@evil.example"],
+    ["the '<BOT_TOKEN>' placeholder", "<BOT_TOKEN>"],
+  ])(
+    "refuses a token with %s, without sending and without quoting it",
+    async (_label: string, token: string) => {
+      const error: Error = await runAndGetError(
+        makeArgs({ "bot-token": token }),
+      );
+
+      expect(error.message).toMatch(
+        /^Telegram Bot Token is not in a valid format\./,
+      );
+      if (token.trim()) {
+        expect(error.message).not.toContain(token.trim());
+      }
+      expect(apiPostMock).not.toHaveBeenCalled();
+    },
+  );
+
+  test("a malformed token never reaches the error message, even partially", async () => {
+    const secret: string = "AAFakeFakeFakeFakeFakeFakeFake_-12345";
+
+    const error: Error = await runAndGetError(
+      makeArgs({ "bot-token": `8000000001:${secret} trailing` }),
+    );
+
+    expect(error.message).not.toContain(secret);
+    expect(error.message).not.toContain("8000000001");
+  });
+});
+
+describe("Telegram SendMessageToChat.isValidBotToken", () => {
+  test.each([
+    [BOT_TOKEN, true],
+    ["123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11", true],
+    ["1:a", true],
+    ["", false],
+    ["123456", false],
+    ["abc:def", false],
+    ["123456:", false],
+    [" 123456:abc", false],
+    ["123456:abc ", false],
+    ["123456:abc/def", false],
+    ["123456:abc%2Fdef", false],
+  ])("isValidBotToken(%j) is %s", (token: string, expected: boolean) => {
+    expect(SendMessageToChat.isValidBotToken(token)).toBe(expected);
+  });
+});

package/Tests/Server/Utils/AI/SloTools.test.ts

@@ -10,6 +10,7 @@ import LabelService from "../../../../Server/Services/LabelService";
 import ServiceLevelObjectiveMonitorRule from "../../../../Models/DatabaseModels/ServiceLevelObjectiveMonitorRule";
 import Label from "../../../../Models/DatabaseModels/Label";
 import FilterCondition from "../../../../Types/Filter/FilterCondition";
+import MonitorType from "../../../../Types/Monitor/MonitorType";
 import {
   RULE_CRITERIA_SCHEMA_VERSION,
   RuleCriteriaOperator,
@@ -750,6 +751,7 @@ describe("query_slos — monitor rules", () => {
     legacy.isEnabled = true;
     legacy.monitorLabels = [buildLabel(PRODUCTION_LABEL_ID, "Production")];
     legacy.monitorNamePattern = "^api-";
+    legacy.monitorType = MonitorType.API;
 
     const configured: ServiceLevelObjectiveMonitorRule =
       new ServiceLevelObjectiveMonitorRule();
@@ -765,6 +767,11 @@ describe("query_slos — monitor rules", () => {
           operator: RuleCriteriaOperator.HasAnyOf,
           value: [TIER1_LABEL_ID.toString()],
         },
+        {
+          field: "monitorType",
+          operator: RuleCriteriaOperator.NotEquals,
+          value: MonitorType.Manual,
+        },
       ],
     };
 
@@ -795,6 +802,8 @@ describe("query_slos — monitor rules", () => {
     expect(result.dataForLlm).toContain("Production APIs");
     expect(result.dataForLlm).toContain("Labels has any of");
     expect(result.dataForLlm).toContain("Name matches pattern");
+    expect(result.dataForLlm).toContain("Type is");
+    expect(result.dataForLlm).toContain("Type is not");
     expect(result.dataForLlm).toContain("Tier one");
     // A criteria rule stores label ids; the name is looked up for the model.
     expect(result.dataForLlm).toContain("Tier 1");
@@ -805,6 +814,7 @@ describe("query_slos — monitor rules", () => {
     ).toBe(SLO_ID.toString());
     expect(call["props"]).toBe(ctx.props);
     expect((call["select"] as JSONObject)["criteria"]).toBe(true);
+    expect((call["select"] as JSONObject)["monitorType"]).toBe(true);
     expect((call["select"] as JSONObject)["monitorLabels"]).toEqual({
       _id: true,
       name: true,

package/Tests/Server/Utils/Monitor/Criteria/MetricMonitorCriteriaAnomalyUnits.test.ts

@@ -49,7 +49,7 @@ import { beforeEach, describe, expect, jest, test } from "@jest/globals";
  *   "container.memory.usage value 1073741824.000 By is 4.20σ above ..."
  *
  * The quantities in it are now rendered exactly as the Breaching Samples
- * table renders them. σ is NOT one of those quantities: it is a count of
+ * list renders them. σ is NOT one of those quantities: it is a count of
  * standard deviations, dimensionless by construction, and must stay a
  * bare number no matter what unit the metric carries.
  */