@oneuptime/common 14.0.0 → 14.0.2

package/Tests/Server/Utils/Monitor/RootCauseList.test.ts

@@ -0,0 +1,252 @@
+import RootCauseList, {
+  RootCauseListItem,
+} from "../../../../Server/Utils/Monitor/RootCauseList";
+import { marked, Tokens, Token } from "marked";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * RootCauseList is the numbered list both per-item breakdowns of a root
+ * cause render as — a platform monitor's Affected Resources and a metric
+ * monitor's Breaching Samples. Each has its own suite for its own content
+ * (AffectedResourceList.test.ts, MonitorCriteriaEvaluatorBreachingSamples
+ * .test.ts); this one pins the shape they share.
+ */
+
+function item(overrides: Partial<RootCauseListItem> = {}): RootCauseListItem {
+  return {
+    title: "`2026-08-14T10:30:00.000Z`",
+    value: "**1.07 GB**",
+    details: [
+      { label: "`a`", value: "537 MB" },
+      { label: "`k8s.pod.name`", value: "`web-1`" },
+    ],
+    ...overrides,
+  };
+}
+
+function items(count: number): Array<RootCauseListItem> {
+  const result: Array<RootCauseListItem> = [];
+
+  for (let i: number = 1; i <= count; i++) {
+    result.push(
+      item({
+        title: `\`item-${i}\``,
+        value: `**${i}**`,
+        details: [{ label: "Label", value: `\`detail-${i}\`` }],
+      }),
+    );
+  }
+
+  return result;
+}
+
+describe("RootCauseList.render", () => {
+  test("renders each item as a numbered line with its details as nested bullets", () => {
+    expect(RootCauseList.render([item()])).toBe(
+      [
+        "1. `2026-08-14T10:30:00.000Z` — **1.07 GB**",
+        "   - `a`: 537 MB",
+        "   - `k8s.pod.name`: `web-1`",
+      ].join("\n"),
+    );
+  });
+
+  test("returns just the list — no heading, and no leading or trailing blank lines", () => {
+    const markdown: string = RootCauseList.render(items(2));
+
+    expect(markdown.startsWith("1. ")).toBe(true);
+    expect(markdown.endsWith("`detail-2`")).toBe(true);
+  });
+
+  test("returns an empty string for no items", () => {
+    expect(RootCauseList.render([])).toBe("");
+  });
+
+  test("numbers the items from 1 in the order given", () => {
+    const markdown: string = RootCauseList.render(items(3));
+
+    expect(markdown.split("\n")).toEqual([
+      "1. `item-1` — **1**",
+      "   - Label: `detail-1`",
+      "2. `item-2` — **2**",
+      "   - Label: `detail-2`",
+      "3. `item-3` — **3**",
+      "   - Label: `detail-3`",
+    ]);
+  });
+
+  test("indents details to the content column: three spaces under 1-9, four under 10-99, five under 100", () => {
+    const markdown: string = RootCauseList.render(items(100));
+
+    expect(markdown).toContain("9. `item-9` — **9**\n   - Label: `detail-9`");
+    expect(markdown).toContain(
+      "10. `item-10` — **10**\n    - Label: `detail-10`",
+    );
+    expect(markdown).toContain(
+      "99. `item-99` — **99**\n    - Label: `detail-99`",
+    );
+    expect(markdown).toContain(
+      "100. `item-100` — **100**\n     - Label: `detail-100`",
+    );
+  });
+
+  test("a detail with an empty or blank value is left out", () => {
+    const markdown: string = RootCauseList.render([
+      item({
+        details: [
+          { label: "`a`", value: "537 MB" },
+          { label: "`b`", value: "" },
+          { label: "`c`", value: "   " },
+          { label: "`d`", value: "1.5 sec" },
+        ],
+      }),
+    ]);
+
+    expect(markdown.split("\n")).toEqual([
+      "1. `2026-08-14T10:30:00.000Z` — **1.07 GB**",
+      "   - `a`: 537 MB",
+      "   - `d`: 1.5 sec",
+    ]);
+  });
+
+  test("a detail with an empty label is just its value", () => {
+    const markdown: string = RootCauseList.render([
+      item({ details: [{ label: "", value: "`web-1`" }] }),
+    ]);
+
+    expect(markdown).toBe(
+      "1. `2026-08-14T10:30:00.000Z` — **1.07 GB**\n   - `web-1`",
+    );
+  });
+
+  test("an item without details is a single line", () => {
+    expect(RootCauseList.render([item({ details: [] })])).toBe(
+      "1. `2026-08-14T10:30:00.000Z` — **1.07 GB**",
+    );
+  });
+
+  test("an empty value leaves just the title, with no dangling dash", () => {
+    expect(RootCauseList.render([item({ value: "", details: [] })])).toBe(
+      "1. `2026-08-14T10:30:00.000Z`",
+    );
+  });
+
+  test("an empty title leaves just the value", () => {
+    expect(RootCauseList.render([item({ title: " ", details: [] })])).toBe(
+      "1. **1.07 GB**",
+    );
+  });
+
+  test("trims the whitespace around the title, value, labels and values", () => {
+    expect(
+      RootCauseList.render([
+        item({
+          title: "  `t`  ",
+          value: " **v** ",
+          details: [{ label: " `k` ", value: " `x` " }],
+        }),
+      ]),
+    ).toBe("1. `t` — **v**\n   - `k`: `x`");
+  });
+
+  test("renders labels, titles and values as markdown, unescaped", () => {
+    /*
+     * The caller decides: AffectedResourceList escapes its plain-text
+     * labels, the Breaching Samples block code-spans its attribute keys.
+     */
+    expect(
+      RootCauseList.render([
+        item({
+          title: "**Pod** `x`",
+          details: [{ label: "*Namespace*", value: "`y`" }],
+        }),
+      ]),
+    ).toBe("1. **Pod** `x` — **1.07 GB**\n   - *Namespace*: `y`");
+  });
+
+  test("parses as one ordered list whose every item owns a nested bullet list, with no code blocks", () => {
+    const tokens: Array<Token> = marked
+      .lexer(RootCauseList.render(items(12)))
+      .filter((token: Token): boolean => {
+        return token.type !== "space";
+      });
+
+    expect(tokens).toHaveLength(1);
+
+    const list: Tokens.List = tokens[0] as Tokens.List;
+
+    expect(list.type).toBe("list");
+    expect(list.ordered).toBe(true);
+    expect(list.items).toHaveLength(12);
+
+    list.items.forEach((listItem: Tokens.ListItem, index: number) => {
+      const nested: Tokens.List | undefined = listItem.tokens.find(
+        (token: Token): boolean => {
+          return token.type === "list";
+        },
+      ) as Tokens.List | undefined;
+
+      expect(nested).toBeDefined();
+      expect(nested!.ordered).toBe(false);
+      expect(
+        nested!.items.map((detail: Tokens.ListItem) => {
+          return detail.text;
+        }),
+      ).toEqual([`Label: \`detail-${index + 1}\``]);
+
+      expect(
+        listItem.tokens.some((token: Token): boolean => {
+          return token.type === "code";
+        }),
+      ).toBe(false);
+    });
+  });
+});
+
+describe("RootCauseList.code", () => {
+  test("wraps a value in single backticks", () => {
+    expect(RootCauseList.code("web-1")).toBe("`web-1`");
+  });
+
+  test("an ISO timestamp stays a bare single-backtick span, which the dashboard localizes", () => {
+    expect(RootCauseList.code("2026-08-14T10:30:00.000Z")).toBe(
+      "`2026-08-14T10:30:00.000Z`",
+    );
+  });
+
+  test.each([
+    ["undefined", undefined],
+    ["null", null],
+    ["an empty string", ""],
+    ["whitespace", "  \t "],
+    ["line breaks", "\r\n\n"],
+  ])("returns an empty string for %s", (_label: string, value: unknown) => {
+    expect(RootCauseList.code(value as string | undefined | null)).toBe("");
+  });
+
+  test("turns line breaks into single spaces", () => {
+    expect(RootCauseList.code("a\nb\r\nc \n\n d")).toBe("`a b c d`");
+  });
+
+  test("a value with backticks gets a fence one longer than its longest run, padded with spaces", () => {
+    expect(RootCauseList.code("a`b")).toBe("`` a`b ``");
+    expect(RootCauseList.code("a``b`c")).toBe("``` a``b`c ```");
+  });
+
+  test("the result parses back to exactly the value", () => {
+    for (const value of ["a`b", "`edge`", "x``y", "**not bold**", "a|b"]) {
+      const tokens: Array<Token> = marked.lexer(
+        `before ${RootCauseList.code(value)} after`,
+      );
+      const paragraph: Tokens.Paragraph = tokens[0] as Tokens.Paragraph;
+      const codespan: Tokens.Codespan | undefined = paragraph.tokens.find(
+        (token: Token): boolean => {
+          return token.type === "codespan";
+        },
+      ) as Tokens.Codespan | undefined;
+
+      expect(codespan).toBeDefined();
+      expect(codespan!.text).toBe(value);
+    }
+  });
+});

package/Tests/Server/Utils/PushNotificationUtilCreators.test.ts

@@ -264,4 +264,83 @@ describe("PushNotificationUtil untested creators", () => {
       });
     });
   });
+
+  /*
+   * The grouped push sent once per probe transition (issue #2486), in place
+   * of one push per monitor. It names the probe and the direction in the
+   * title and carries the caller's one-sentence summary as the body.
+   */
+  describe("createProbeMonitorsStatusNotification - one push per probe transition", () => {
+    const summary: string =
+      "Probe eu-west is disconnected. 20 monitors in project Acme are not being monitored.";
+
+    test("titles the push with the direction and probe, and uses the summary as the body", () => {
+      const link: string = "https://dashboard/p1/monitors/probe-disconnected";
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeMonitorsStatusNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "Disconnected",
+          monitorCount: 20,
+          summary: summary,
+          clickAction: link,
+        });
+
+      expect(message.title).toBe("Probe Disconnected: eu-west");
+      expect(message.body).toBe(summary);
+      expect(message.tag).toBe("probe-monitors-status");
+      expect(message.requireInteraction).toBe(false);
+      expect(message.icon).toBe(PushNotificationUtil.DEFAULT_ICON);
+      expect(message.badge).toBe(PushNotificationUtil.DEFAULT_BADGE);
+      expect(message.clickAction).toBe(link);
+      expect(message.url).toBe(link);
+      expect(message.data).toEqual({
+        type: "probe-monitors-status",
+        probeName: "eu-west",
+        projectName: "Acme",
+        connectionStatus: "Disconnected",
+        monitorCount: "20",
+        url: link,
+      });
+    });
+
+    test("without a clickAction, no url/clickAction is wired", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeMonitorsStatusNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "Connected",
+          monitorCount: 1,
+          summary: summary,
+        });
+
+      expect(message.title).toBe("Probe Connected: eu-west");
+      expect(message.clickAction).toBeUndefined();
+      expect(message.url).toBeUndefined();
+      expect(message.data).not.toHaveProperty("url");
+      expect(message.data).toMatchObject({ monitorCount: "1" });
+    });
+
+    test("both directions share one tag, so on web push a reconnect replaces the disconnect", () => {
+      const disconnected: PushNotificationMessage =
+        PushNotificationUtil.createProbeMonitorsStatusNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "Disconnected",
+          monitorCount: 2,
+          summary: summary,
+        });
+      const connected: PushNotificationMessage =
+        PushNotificationUtil.createProbeMonitorsStatusNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "Connected",
+          monitorCount: 2,
+          summary: summary,
+        });
+
+      expect(connected.tag).toBe(disconnected.tag);
+      expect(connected.title).not.toBe(disconnected.title);
+    });
+  });
 });

package/Tests/Server/Utils/ResourceFeed/ResourceFeedUtil.test.ts

@@ -73,7 +73,15 @@ describe("ResourceFeedUtil.getUpdatedColumnsWorthRecording", () => {
     expect(ResourceFeedUtil.getUpdatedColumnsWorthRecording({})).toEqual([]);
   });
 
-  test("the whitelist covers every column the dashboard can edit", () => {
+  /*
+   * The whitelist is shared by ten resource types, so it covers the edits
+   * their settings pages have in common — not every column a dashboard can
+   * edit. A Kubernetes cluster's AI access settings are dashboard-editable
+   * too, but they get their own, more specific feed items
+   * (KubernetesClusterService), so they must stay out of the generic "was
+   * updated" one.
+   */
+  test("the whitelist covers the edits every resource's settings page has in common", () => {
     for (const column of [
       "name",
       "description",
@@ -85,6 +93,18 @@ describe("ResourceFeedUtil.getUpdatedColumnsWorthRecording", () => {
       expect(MEANINGFUL_UPDATE_COLUMNS).toContain(column);
     }
   });
+
+  test("leaves out the AI access settings, which record their own feed items", () => {
+    for (const column of [
+      "aiAccessRunnerId",
+      "aiAccessCredentialId",
+      "isAiInvestigationEnabled",
+      "aiRemediationMode",
+      "aiKubectlCommandAllowlist",
+    ]) {
+      expect(MEANINGFUL_UPDATE_COLUMNS).not.toContain(column);
+    }
+  });
 });
 
 describe("ResourceFeedUtil.isArchiveChange", () => {

package/Tests/Server/Utils/Rules/OwnerRuleAssignment.test.ts

@@ -7,7 +7,8 @@ import OwnerRuleAssignment, {
   OwnersToAssign,
 } from "../../../../Server/Utils/Rules/OwnerRuleAssignment";
 import PostgresErrorTranslator from "../../../../Server/Utils/Database/PostgresErrorTranslator";
-import { describe, expect, it } from "@jest/globals";
+import TeamMemberService from "../../../../Server/Services/TeamMemberService";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
 
 /*
  * Contract under test - owner rules never create a second owner row for a user
@@ -19,7 +20,26 @@ import { describe, expect, it } from "@jest/globals";
  * owners on nearly every resource it touches. That is why this filter sits in
  * front of every owner rule engine, and why the inserts that follow it treat
  * "already an owner" as done rather than as a failure.
+ *
+ * The owner sets are saved configuration and can name a user who has left
+ * the project since; createOwner skips such a user (see the last block).
+ */
+
+/*
+ * Every owner user below is a project member unless a test says otherwise.
+ * The membership read is TeamMemberService's; no Postgres here.
  */
+let memberCheck: jest.SpyInstance;
+
+beforeEach(() => {
+  memberCheck = jest
+    .spyOn(TeamMemberService, "isUserMemberOfProject")
+    .mockResolvedValue(true);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
 
 const MONITOR_ID: ObjectID = new ObjectID(
   "cccccccc-cccc-4ccc-8ccc-cccccccccccc",
@@ -583,3 +603,137 @@ describe("OwnerRuleAssignment.addOwners", () => {
     expect(added).toEqual({ userIds: [], teamIds: [] });
   });
 });
+
+describe("OwnerRuleAssignment and project membership", () => {
+  const DEPARTED: ObjectID = USER_B;
+
+  function membersAre(userIds: Array<ObjectID>): void {
+    memberCheck.mockImplementation(
+      async (data: { projectId: ObjectID; userId: ObjectID }) => {
+        return userIds.some((id: ObjectID): boolean => {
+          return id.toString() === data.userId.toString();
+        });
+      },
+    );
+  }
+
+  it("does not make a user who left the project an owner", async () => {
+    membersAre([]);
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+    const owner: MonitorOwnerUser = ownerUser(DEPARTED);
+    owner.projectId = PROJECT_ID;
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: {
+          create,
+        } as unknown as DatabaseService<MonitorOwnerUser>,
+        owner: owner,
+        props: { isRoot: true },
+      }),
+    ).resolves.toBe(false);
+
+    expect(create).not.toHaveBeenCalled();
+    expect(memberCheck).toHaveBeenCalledTimes(1);
+    const asked: { projectId: ObjectID; userId: ObjectID } = memberCheck.mock
+      .calls[0]![0] as { projectId: ObjectID; userId: ObjectID };
+    expect(asked.projectId.toString()).toBe(PROJECT_ID.toString());
+    expect(asked.userId.toString()).toBe(DEPARTED.toString());
+  });
+
+  it("reads the project from the caller's tenant when the row has none", async () => {
+    membersAre([USER_A]);
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: {
+          create,
+        } as unknown as DatabaseService<MonitorOwnerUser>,
+        owner: ownerUser(USER_A),
+        props: { tenantId: PROJECT_ID },
+      }),
+    ).resolves.toBe(true);
+
+    const asked: { projectId: ObjectID } = memberCheck.mock.calls[0]![0] as {
+      projectId: ObjectID;
+    };
+    expect(asked.projectId.toString()).toBe(PROJECT_ID.toString());
+    expect(create).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not ask about team owners", async () => {
+    membersAre([]);
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+    const owner: MonitorOwnerTeam = ownerTeam(TEAM_A);
+    owner.projectId = PROJECT_ID;
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: {
+          create,
+        } as unknown as DatabaseService<MonitorOwnerTeam>,
+        owner: owner,
+        props: { isRoot: true },
+      }),
+    ).resolves.toBe(true);
+
+    expect(memberCheck).not.toHaveBeenCalled();
+  });
+
+  it("adds the rest of a saved owner set and reports only what it added", async () => {
+    membersAre([USER_A]);
+    const services: WritableServices = writableServices({});
+
+    const added: OwnersToAssign = await OwnerRuleAssignment.addOwners({
+      ownerUserService: services.ownerUserService,
+      ownerTeamService: services.ownerTeamService,
+      resourceIdColumn: "monitorId",
+      resourceId: MONITOR_ID,
+      projectId: PROJECT_ID,
+      userIds: [USER_A, DEPARTED],
+      teamIds: [TEAM_A],
+      props: { isRoot: true },
+    });
+
+    expect(
+      writtenRows<MonitorOwnerUser>(services.createUser).map(
+        (r: MonitorOwnerUser): string => {
+          return r.userId!.toString();
+        },
+      ),
+    ).toEqual([USER_A.toString()]);
+    expect(services.createTeam).toHaveBeenCalledTimes(1);
+
+    expect(ids(added.userIds)).toEqual([USER_A.toString()]);
+    expect(ids(added.teamIds)).toEqual([TEAM_A.toString()]);
+  });
+
+  it("a failing membership read fails the write, as any other read would", async () => {
+    const failure: Error = new Error("db down");
+    memberCheck.mockRejectedValue(failure);
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+    const owner: MonitorOwnerUser = ownerUser(USER_A);
+    owner.projectId = PROJECT_ID;
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: {
+          create,
+        } as unknown as DatabaseService<MonitorOwnerUser>,
+        owner: owner,
+        props: { isRoot: true },
+      }),
+    ).rejects.toBe(failure);
+
+    expect(create).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/Rules/RuleRun/RuleRunPermission.test.ts

@@ -363,3 +363,157 @@ describe("RuleRunPermission.assertCanRun", () => {
     }).toThrow(new BadDataException("This rule cannot be run."));
   });
 });
+
+/*
+ * SLO label and owner rules walk every SLO in the project as root, so running
+ * one needs the rule's edit permission, EditServiceLevelObjective, and - for
+ * owner rules - create on both SLO owner tables. Read off the real models'
+ * @TableAccessControl, like everything above.
+ */
+describe("RuleRunPermission.assertCanRun - SLO label and owner rules", () => {
+  it("lets a caller who can edit the rule and every SLO run an SLO label rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjectiveLabelRule,
+            Permission.EditServiceLevelObjective,
+          ],
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  it("refuses a caller who can edit SLOs but not the rule", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjective,
+            // Another SLO rule's permission is not this one's.
+            Permission.EditServiceLevelObjectiveMonitorRule,
+          ],
+        }),
+      );
+    }).toThrow(
+      "You do not have permission to edit this rule, which running it requires.",
+    );
+  });
+
+  it("refuses a rule author who cannot edit SLOs, naming them", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [Permission.EditServiceLevelObjectiveLabelRule],
+        }),
+      );
+    }).toThrow(
+      "You do not have permission to edit every SLO in this project, which running this rule does.",
+    );
+  });
+
+  it("does not let read access to the rule stand in for edit", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            Permission.ReadServiceLevelObjectiveOwnerRule,
+            Permission.EditServiceLevelObjective,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+            Permission.CreateServiceLevelObjectiveOwnerTeam,
+          ],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  it("requires create on both SLO owner tables for an SLO owner rule", () => {
+    const ruleAndSlo: Array<Permission> = [
+      Permission.EditServiceLevelObjectiveOwnerRule,
+      Permission.EditServiceLevelObjective,
+    ];
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({ permissions: ruleAndSlo }),
+      );
+    }).toThrow(
+      "You do not have permission to add owners to SLOs, which running this rule does.",
+    );
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            ...ruleAndSlo,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+          ],
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveOwnerRule,
+        propsWith({
+          permissions: [
+            ...ruleAndSlo,
+            Permission.CreateServiceLevelObjectiveOwnerUser,
+            Permission.CreateServiceLevelObjectiveOwnerTeam,
+          ],
+        }),
+      );
+    }).not.toThrow();
+  });
+
+  /*
+   * A run reaches every SLO, so an edit grant limited to the SLOs a user owns
+   * cannot authorize one.
+   */
+  it("does not count an Owned-scoped SLO edit grant", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [
+            Permission.EditServiceLevelObjectiveLabelRule,
+            Permission.EditServiceLevelObjective,
+          ],
+          scope: PermissionScope.Owned,
+        }),
+      );
+    }).toThrow(NotAuthorizedException);
+  });
+
+  it("honours a team's block list on SLOs, even over an admin grant", () => {
+    expect(() => {
+      assertCanRun(
+        RuleRunType.ServiceLevelObjectiveLabelRule,
+        propsWith({
+          permissions: [Permission.ProjectAdmin],
+          blockedPermissions: [Permission.EditServiceLevelObjective],
+        }),
+      );
+    }).toThrow(/permission block list/);
+  });
+
+  it("lets a project admin run both", () => {
+    for (const ruleType of [
+      RuleRunType.ServiceLevelObjectiveLabelRule,
+      RuleRunType.ServiceLevelObjectiveOwnerRule,
+    ]) {
+      expect(() => {
+        assertCanRun(
+          ruleType,
+          propsWith({ permissions: [Permission.ProjectAdmin] }),
+        );
+      }).not.toThrow();
+    }
+  });
+});