@oneuptime/common 14.0.0 → 14.0.2

package/Tests/Server/Utils/SessionReplay/SessionReplayUserFlowReadService.test.ts

@@ -0,0 +1,304 @@
+import RumSessionService from "../../../../Server/Services/RumSessionService";
+import RumSessionChunkService from "../../../../Server/Services/RumSessionChunkService";
+import { Statement } from "../../../../Server/Utils/AnalyticsDatabase/Statement";
+import SessionReplayUserFlowReadService, {
+  clampUserFlowMaxSessions,
+  UserFlowJourneysRequest,
+} from "../../../../Server/Utils/SessionReplay/SessionReplayUserFlowReadService";
+import AnalyticsTableName from "../../../../Types/AnalyticsDatabase/AnalyticsTableName";
+import { JSONObject } from "../../../../Types/JSON";
+import ObjectID from "../../../../Types/ObjectID";
+import {
+  readUserFlowJourneysResponse,
+  USER_FLOW_DEFAULT_MAX_SESSIONS,
+  USER_FLOW_MAX_PAGES_PER_JOURNEY,
+  USER_FLOW_MAX_SESSIONS,
+  UserFlowJourneysResponseDto,
+} from "../../../../Types/Rum/UserFlow";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * The User Flows read, without a database: the statements it would run and
+ * the dictionary encoding of what comes back. The real-ClickHouse suite
+ * (App/Tests/Telemetry/SessionReplayUserFlowClickhouse.test.ts) proves the
+ * server accepts the SQL; this one pins the properties a later edit could
+ * quietly lose - the payload column is never named, the chunk read is
+ * keyed by the header read's session ids, and retried deliveries collapse.
+ */
+
+const REQUEST: UserFlowJourneysRequest = {
+  projectId: new ObjectID("6600000000000000000000d1"),
+  rumApplicationId: new ObjectID("6600000000000000000000d2"),
+  startTime: new Date("2026-09-20T00:00:00.000Z"),
+  endTime: new Date("2026-09-21T00:00:00.000Z"),
+};
+
+function fakeResultSet(rows: Array<JSONObject>): unknown {
+  return {
+    json: async (): Promise<JSONObject> => {
+      return { data: rows } as unknown as JSONObject;
+    },
+  };
+}
+
+function boundValues(statement: Statement): Array<unknown> {
+  return Object.values(statement.query_params);
+}
+
+function squash(query: string): string {
+  return query.replace(/\s+/g, " ");
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("clampUserFlowMaxSessions", () => {
+  test("defaults, floors and caps", () => {
+    expect(clampUserFlowMaxSessions(undefined)).toBe(
+      USER_FLOW_DEFAULT_MAX_SESSIONS,
+    );
+    expect(clampUserFlowMaxSessions(Number.NaN)).toBe(
+      USER_FLOW_DEFAULT_MAX_SESSIONS,
+    );
+    expect(clampUserFlowMaxSessions(0)).toBe(1);
+    expect(clampUserFlowMaxSessions(12.7)).toBe(12);
+    expect(clampUserFlowMaxSessions(10 ** 9)).toBe(USER_FLOW_MAX_SESSIONS);
+  });
+});
+
+describe("statements", () => {
+  test("the header read is the sort-key prefix plus retention, newest first, capped", () => {
+    const statement: Statement =
+      SessionReplayUserFlowReadService.buildHeaderStatement(REQUEST, 250);
+    const query: string = squash(statement.query);
+
+    expect(query).toContain("WHERE projectId = ");
+    expect(query).toContain("AND rumApplicationId = ");
+    expect(query).toContain("AND startTime >= ");
+    expect(query).toContain("AND startTime <= ");
+    expect(query).toContain("AND retentionDate >= now()");
+    expect(query).toContain("GROUP BY sessionId");
+    expect(query).toContain(
+      "ORDER BY flowStartUnixMs DESC, flowSessionId DESC",
+    );
+    /* Header columns are argMax'd: a provisional and a finalized row count once. */
+    expect(query).toContain("argMax(deviceType, version) AS flowDeviceType");
+    expect(boundValues(statement)).toContain(AnalyticsTableName.RumSession);
+    expect(boundValues(statement)).toContain(250);
+    expect(query).toContain("timeout_overflow_mode = 'throw'");
+  });
+
+  test("the chunk read never names the payload and is keyed by the newest sessions", () => {
+    const statement: Statement =
+      SessionReplayUserFlowReadService.buildChunkStatement(REQUEST, 250);
+    const query: string = squash(statement.query);
+
+    expect(query).not.toMatch(/\bpayload\b/);
+    expect(boundValues(statement)).toContain(
+      AnalyticsTableName.RumSessionChunk,
+    );
+    expect(boundValues(statement)).toContain(AnalyticsTableName.RumSession);
+    expect(query).toContain("AND sessionId IN ( SELECT sessionId FROM (");
+    expect(query).toContain(
+      "ORDER BY flowNewestStart DESC, sessionId DESC LIMIT",
+    );
+    /* A retried delivery or a pinned copy collapses to one row per chunk. */
+    expect(query).toContain(
+      "ORDER BY version DESC LIMIT 1 BY sessionId, tabId, chunkIndex",
+    );
+    /* Chunks are ordered by wall clock across tabs, then by tab and index. */
+    expect(query).toContain(
+      "flowChunk -> (flowChunk.1, flowChunk.2, flowChunk.3)",
+    );
+    expect(query).toContain(
+      "groupArray((chunkStartTime, tabId, chunkIndex, routes))",
+    );
+    /* Back-to-back repeats are collapsed in the statement. */
+    expect(query).toContain(
+      "(flowRoute, flowAt) -> flowAt = 1 OR flowRoute != flowRawRoutes[flowAt - 1]",
+    );
+    expect(boundValues(statement)).toContain(USER_FLOW_MAX_PAGES_PER_JOURNEY);
+    expect(query).toContain("AND retentionDate >= now()");
+  });
+
+  test("the count reads the same window", () => {
+    const statement: Statement =
+      SessionReplayUserFlowReadService.buildCountStatement(REQUEST);
+    const query: string = squash(statement.query);
+
+    expect(query).toContain("uniqExact(sessionId)");
+    expect(query).toContain("AND startTime >= ");
+    expect(query).toContain("AND retentionDate >= now()");
+  });
+
+  test("every statement binds the tenant and the application", () => {
+    for (const statement of [
+      SessionReplayUserFlowReadService.buildHeaderStatement(REQUEST, 10),
+      SessionReplayUserFlowReadService.buildChunkStatement(REQUEST, 10),
+      SessionReplayUserFlowReadService.buildCountStatement(REQUEST),
+    ]) {
+      const values: Array<string> = boundValues(statement).map(
+        (value: unknown): string => {
+          return String(value);
+        },
+      );
+
+      expect(values).toContain(REQUEST.projectId.toString());
+      expect(values).toContain(REQUEST.rumApplicationId.toString());
+    }
+  });
+});
+
+describe("readJourneys", () => {
+  test("joins headers to chunk rollups and dictionary-encodes the pages", async () => {
+    jest
+      .spyOn(RumSessionService, "executeQuery")
+      .mockImplementation(
+        async (statement: string | Statement): Promise<never> => {
+          const query: string =
+            typeof statement === "string" ? statement : statement.query;
+
+          if (query.includes("uniqExact")) {
+            return fakeResultSet([{ flowSessionCount: "7" }]) as never;
+          }
+
+          return fakeResultSet([
+            {
+              flowSessionId: "s-new",
+              flowStartUnixMs: 2000,
+              flowDeviceType: "mobile",
+              flowBrowserName: "Safari",
+              flowCountryCode: "DK",
+              flowEntryUrl: "https://a.example.com/",
+            },
+            {
+              flowSessionId: "s-no-chunks",
+              flowStartUnixMs: 1000,
+              flowDeviceType: "desktop",
+              flowBrowserName: "Chrome",
+              flowCountryCode: "",
+              flowEntryUrl: "https://a.example.com/landing",
+            },
+            {
+              flowSessionId: "s-nothing",
+              flowStartUnixMs: 500,
+              flowDeviceType: "",
+              flowBrowserName: "",
+              flowCountryCode: "",
+              flowEntryUrl: "",
+            },
+          ]) as never;
+        },
+      );
+
+    jest
+      .spyOn(RumSessionChunkService, "executeQuery")
+      .mockImplementation(async (): Promise<never> => {
+        return fakeResultSet([
+          {
+            flowSessionId: "s-new",
+            flowPages: [
+              "https://a.example.com/",
+              "https://a.example.com/cart",
+              "https://a.example.com/",
+            ],
+            flowSignals: [
+              ["https://a.example.com/cart", 1, 0],
+              ["https://a.example.com/cart", 2, 3],
+              ["", 9, 9],
+            ],
+            flowErrorTotal: "3",
+            flowFrustrationTotal: "3",
+            flowSpanMs: "45000",
+          },
+        ]) as never;
+      });
+
+    const response: UserFlowJourneysResponseDto =
+      await SessionReplayUserFlowReadService.readJourneys({
+        ...REQUEST,
+        maxSessions: 3,
+      });
+
+    expect(response.pages).toEqual([
+      "https://a.example.com/",
+      "https://a.example.com/cart",
+      "https://a.example.com/landing",
+    ]);
+    expect(response.sessions).toEqual([
+      {
+        sessionId: "s-new",
+        startUnixMs: 2000,
+        durationMs: 45000,
+        deviceType: "mobile",
+        browserName: "Safari",
+        countryCode: "DK",
+        errorCount: 3,
+        frustrationCount: 3,
+        pages: [0, 1, 0],
+        /* Two chunks flushed from /cart fold into one entry. */
+        pageSignals: [[1, 3, 3]],
+      },
+      {
+        sessionId: "s-no-chunks",
+        startUnixMs: 1000,
+        durationMs: 0,
+        deviceType: "desktop",
+        browserName: "Chrome",
+        countryCode: "",
+        errorCount: 0,
+        frustrationCount: 0,
+        pages: [2],
+        pageSignals: [],
+      },
+    ]);
+    expect(response.sessionsInWindow).toBe(7);
+    expect(response.isSampled).toBe(true);
+    expect(response.maxSessions).toBe(3);
+    expect(response.startUnixMs).toBe(REQUEST.startTime.getTime());
+
+    /* The wire shape survives the Dashboard's parser unchanged. */
+    expect(
+      readUserFlowJourneysResponse(JSON.parse(JSON.stringify(response))),
+    ).toEqual(response);
+  });
+});
+
+describe("readUserFlowJourneysResponse", () => {
+  test("drops what it cannot trust instead of rendering it", () => {
+    const parsed: UserFlowJourneysResponseDto = readUserFlowJourneysResponse({
+      pages: ["/a", "/b"],
+      sessions: [
+        {
+          sessionId: "x",
+          startUnixMs: "12",
+          pages: [0, 1, 7, -1, "1", 1.5],
+          pageSignals: [[1, "2", "nope"], [9, 1, 1], "bad", [0]],
+        },
+        { pages: [0] },
+        null,
+      ],
+      sessionsInWindow: "3",
+      isSampled: 1,
+    });
+
+    expect(parsed.sessions).toHaveLength(1);
+    expect(parsed.sessions[0]?.startUnixMs).toBe(12);
+    expect(parsed.sessions[0]?.pages).toEqual([0, 1, 1]);
+    expect(parsed.sessions[0]?.pageSignals).toEqual([[1, 2, 0]]);
+    expect(parsed.sessionsInWindow).toBe(3);
+    expect(parsed.isSampled).toBe(true);
+  });
+
+  test("anything that is not an object reads as empty", () => {
+    for (const value of [null, undefined, "x", 42]) {
+      const parsed: UserFlowJourneysResponseDto =
+        readUserFlowJourneysResponse(value);
+
+      expect(parsed.pages).toEqual([]);
+      expect(parsed.sessions).toEqual([]);
+      expect(parsed.isSampled).toBe(false);
+    }
+  });
+});

package/Tests/Server/Utils/Slo/SloRulePatternValidator.test.ts

@@ -0,0 +1,67 @@
+import SloRulePatternValidator from "../../../../Server/Utils/Slo/SloRulePatternValidator";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Write-time pattern validation for SLO label and owner rules: the engines
+ * take a case-insensitive regex or a '*' wildcard, and anything else could
+ * only ever match nothing.
+ */
+describe("SloRulePatternValidator", () => {
+  it.each([
+    ["an anchored regex", "^checkout-.*$"],
+    ["an alternation", "checkout|payments"],
+    ["a leading wildcard", "*checkout"],
+    ["a wildcard on both sides", "*checkout*"],
+    ["a plain word", "checkout"],
+    // Not a regex, but the '*' makes it a wildcard.
+    ["a wildcard that is not a valid regex", "*api-(01*"],
+  ])("accepts %s", (_: string, pattern: string) => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: pattern,
+        descriptionPattern: pattern,
+      });
+    }).not.toThrow();
+  });
+
+  it.each([undefined, null, ""])(
+    "treats %p as no pattern at all",
+    (pattern: string | null | undefined) => {
+      expect(() => {
+        SloRulePatternValidator.validate({
+          namePattern: pattern,
+          descriptionPattern: pattern,
+        });
+      }).not.toThrow();
+    },
+  );
+
+  it("refuses a name pattern that is neither a regex nor a wildcard", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({ namePattern: "checkout-(01" });
+    }).toThrow(
+      new BadDataException(
+        `SLO Name Pattern "checkout-(01" is not a valid regular expression, and contains no '*' wildcard to fall back on, so it would never match an SLO. Use a regex such as checkout-.* or a wildcard such as *checkout*.`,
+      ),
+    );
+  });
+
+  it("refuses a description pattern that is neither a regex nor a wildcard", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: "checkout",
+        descriptionPattern: "[unclosed",
+      });
+    }).toThrow('SLO Description Pattern "[unclosed"');
+  });
+
+  it("checks the name before the description", () => {
+    expect(() => {
+      SloRulePatternValidator.validate({
+        namePattern: "(",
+        descriptionPattern: "[",
+      });
+    }).toThrow("SLO Name Pattern");
+  });
+});

package/Tests/Server/Utils/Telemetry/TelemetryIngestionKeyGuard.test.ts

@@ -136,10 +136,47 @@ describe("TelemetryIngestionKeyGuard.getRefusal", () => {
       },
     );
 
-    test("covers all fourteen surfaces in the matrix above", () => {
-      expect(ALL_SURFACES).toHaveLength(14);
+    test("covers all fifteen surfaces in the matrix above", () => {
+      expect(ALL_SURFACES).toHaveLength(15);
       expect(BROWSER_ALLOWED).toHaveLength(4);
-      expect(BROWSER_FORBIDDEN).toHaveLength(10);
+      expect(BROWSER_FORBIDDEN).toHaveLength(11);
+    });
+
+    /*
+     * The Kubernetes agent Runner registration mints a Runner credential
+     * from an ingestion key. It is server-only, and pinned by name here so
+     * that moving it into the browser allowlist is a deliberate, failing
+     * change rather than a silent one.
+     */
+    test("keeps Kubernetes agent Runner registration off the browser allowlist", () => {
+      expect(BROWSER_FORBIDDEN).toContain(
+        TelemetryIngestSurface.KubernetesAgentRunner,
+      );
+      expect(BROWSER_ALLOWED).not.toContain(
+        TelemetryIngestSurface.KubernetesAgentRunner,
+      );
+
+      const refusal: TelemetryIngestionKeyRefusal | null = refusalFor({
+        policy: buildPolicy({
+          keyType: TelemetryIngestionKeyType.Browser,
+          allowedOrigins: [ALLOWED_ORIGIN],
+        }),
+        surface: TelemetryIngestSurface.KubernetesAgentRunner,
+      });
+
+      expect(refusal?.reason).toBe(
+        TelemetryIngestionKeyRefusalReason.SurfaceNotAllowedForBrowserKey,
+      );
+      expect(refusal?.message).toContain(
+        "Kubernetes agent Runner registration",
+      );
+
+      expect(
+        refusalFor({
+          policy: buildPolicy(),
+          surface: TelemetryIngestSurface.KubernetesAgentRunner,
+        }),
+      ).toBeNull();
     });
   });
 

package/Tests/Server/Utils/VM/VMRunnerSsrf.test.ts

@@ -1365,3 +1365,216 @@ describe("VMRunner sandbox axios bridge — URL absolutization", () => {
     },
   );
 });
+
+/*
+ * The SSRF guard parses the target with OneUptime's URL type as well as
+ * WHATWG. That parser refused any URL whose first path segment contained a
+ * ":" - which every Telegram Bot API URL has, because the token
+ * ("<id>:<secret>") is that segment - and any path containing "~". The guard
+ * turned the parse failure into "Request URL is not a valid URL", so sandboxed
+ * code could not call Telegram at all. These drive the real isolate against a
+ * loopback server to prove the request now reaches the wire unchanged.
+ */
+describe("VMRunner sandbox axios bridge — paths with ':' or '~'", () => {
+  const BOT_TOKEN: string = "8000000001:AAFakeFakeFakeFakeFakeFakeFake_-12345";
+  const TELEGRAM_PATH: string = `/bot${BOT_TOKEN}/sendMessage`;
+
+  interface EchoedRequest {
+    method: string;
+    url: string;
+    host: string;
+    body: string;
+  }
+
+  async function startEchoServer(): Promise<RunningLoopbackServer> {
+    return startLoopbackServer(
+      (request: http.IncomingMessage, response: http.ServerResponse): void => {
+        let body: string = "";
+        request.on("data", (chunk: Buffer): void => {
+          body += chunk.toString("utf8");
+        });
+        request.on("end", (): void => {
+          const echoed: EchoedRequest = {
+            method: request.method || "",
+            url: request.url || "",
+            host: request.headers.host || "",
+            body: body,
+          };
+          response.setHeader("Content-Type", "application/json");
+          response.end(JSON.stringify(echoed));
+        });
+      },
+    );
+  }
+
+  async function runAgainstLoopback(code: string): Promise<EchoedRequest> {
+    const result: ReturnResult = await runInSandbox(code, {
+      allowPrivateNetworkRequests: true,
+    });
+
+    expect(result.scriptError).toBeUndefined();
+
+    return result.returnValue as EchoedRequest;
+  }
+
+  beforeEach(() => {
+    process.env[PRIVATE_NETWORK_WEBHOOK_ALLOWLIST_ENV] = "127.0.0.1";
+  });
+
+  test("axios.post reaches a Telegram /bot<id>:<secret>/sendMessage path", async () => {
+    const echoServer: RunningLoopbackServer = await startEchoServer();
+
+    try {
+      const echoed: EchoedRequest = await runAgainstLoopback(`
+        const response = await axios.post(
+          'http://127.0.0.1:${echoServer.port}${TELEGRAM_PATH}',
+          { chat_id: '@mychannel', text: 'Deploy finished' }
+        );
+        return response.data;
+      `);
+
+      expect(echoed.method).toBe("POST");
+      expect(echoed.url).toBe(TELEGRAM_PATH);
+      expect(JSON.parse(echoed.body)).toEqual({
+        chat_id: "@mychannel",
+        text: "Deploy finished",
+      });
+      expect(echoServer.requestCount()).toBe(1);
+    } finally {
+      await echoServer.close();
+    }
+  });
+
+  test.each([
+    ["get", "axios.get(URL)"],
+    ["put", "axios.put(URL, { a: 1 })"],
+    ["patch", "axios.patch(URL, { a: 1 })"],
+    ["delete", "axios.delete(URL)"],
+    ["post", "axios.request({ method: 'post', url: URL, data: { a: 1 } })"],
+    ["get", "axios(URL)"],
+  ])(
+    "axios.%s via %s reaches the same path",
+    async (method: string, call: string) => {
+      const echoServer: RunningLoopbackServer = await startEchoServer();
+
+      try {
+        const echoed: EchoedRequest = await runAgainstLoopback(`
+          const URL = 'http://127.0.0.1:${echoServer.port}${TELEGRAM_PATH}';
+          const response = await ${call};
+          return response.data;
+        `);
+
+        expect(echoed.method).toBe(method.toUpperCase());
+        expect(echoed.url).toBe(TELEGRAM_PATH);
+      } finally {
+        await echoServer.close();
+      }
+    },
+  );
+
+  test("keeps the query string on a Telegram path", async () => {
+    const echoServer: RunningLoopbackServer = await startEchoServer();
+
+    try {
+      const echoed: EchoedRequest = await runAgainstLoopback(`
+        const response = await axios.get(
+          'http://127.0.0.1:${echoServer.port}${TELEGRAM_PATH}?chat_id=%40mychannel&text=hi'
+        );
+        return response.data;
+      `);
+
+      expect(echoed.url).toBe(`${TELEGRAM_PATH}?chat_id=%40mychannel&text=hi`);
+    } finally {
+      await echoServer.close();
+    }
+  });
+
+  test("joins a relative token path onto baseURL", async () => {
+    const echoServer: RunningLoopbackServer = await startEchoServer();
+
+    try {
+      const echoed: EchoedRequest = await runAgainstLoopback(`
+        const response = await axios.post(
+          'bot${BOT_TOKEN}/sendMessage',
+          { chat_id: 1, text: 'hi' },
+          { baseURL: 'http://127.0.0.1:${echoServer.port}' }
+        );
+        return response.data;
+      `);
+
+      expect(echoed.method).toBe("POST");
+      expect(echoed.url).toBe(TELEGRAM_PATH);
+    } finally {
+      await echoServer.close();
+    }
+  });
+
+  test("reaches api.telegram.org by name, dialling the address the guard approved", async () => {
+    const echoServer: RunningLoopbackServer = await startEchoServer();
+    const validationLookupSpy: ValidationLookupSpy = jest.spyOn(
+      dns.promises,
+      "lookup",
+    ) as unknown as ValidationLookupSpy;
+    validationLookupSpy.mockResolvedValue([
+      { address: "127.0.0.1", family: 4 },
+    ]);
+
+    try {
+      const echoed: EchoedRequest = await runAgainstLoopback(`
+        const response = await axios.post(
+          'http://api.telegram.org:${echoServer.port}${TELEGRAM_PATH}',
+          { chat_id: '@mychannel', text: 'hi' }
+        );
+        return response.data;
+      `);
+
+      expect(validationLookupSpy).toHaveBeenCalledWith("api.telegram.org", {
+        all: true,
+      });
+      expect(echoed.host).toBe(`api.telegram.org:${echoServer.port}`);
+      expect(echoed.url).toBe(TELEGRAM_PATH);
+    } finally {
+      await echoServer.close();
+    }
+  });
+
+  test.each(["/~user/hook", "/files/~backup/latest", "/urn:uuid:6e8bc430/x"])(
+    "reaches the path %s",
+    async (path: string) => {
+      const echoServer: RunningLoopbackServer = await startEchoServer();
+
+      try {
+        const echoed: EchoedRequest = await runAgainstLoopback(`
+          const response = await axios.get('http://127.0.0.1:${echoServer.port}${path}');
+          return response.data;
+        `);
+
+        expect(echoed.url).toBe(path);
+      } finally {
+        await echoServer.close();
+      }
+    },
+  );
+
+  test("a token path on an internal host is refused for its HOST, not as an invalid URL", async () => {
+    delete process.env[PRIVATE_NETWORK_WEBHOOK_ALLOWLIST_ENV];
+
+    const message: string = await errorFromSandbox(
+      `return await axios.post('http://169.254.169.254${TELEGRAM_PATH}', { a: 1 });`,
+    );
+
+    expect(message).toMatch(REFUSAL);
+    expect(message).not.toMatch(/not a valid URL/i);
+  });
+
+  test("a token path on a public host clears the guard and fails only at transport", async () => {
+    delete process.env[PRIVATE_NETWORK_WEBHOOK_ALLOWLIST_ENV];
+
+    const message: string = await errorFromSandbox(
+      `try { return await axios.post('http://8.8.8.8${TELEGRAM_PATH}', {}, { timeout: 1 }); } catch (e) { return 'threw: ' + e.message; }`,
+    );
+
+    expect(message).not.toMatch(REFUSAL);
+    expect(message).not.toMatch(/not a valid URL/i);
+  });
+});