@oneuptime/common 14.0.1 → 14.0.2

package/Tests/Server/Utils/PushNotificationUtilCreators.test.ts

@@ -264,4 +264,83 @@ describe("PushNotificationUtil untested creators", () => {
       });
     });
   });
+
+  /*
+   * The grouped push sent once per probe transition (issue #2486), in place
+   * of one push per monitor. It names the probe and the direction in the
+   * title and carries the caller's one-sentence summary as the body.
+   */
+  describe("createProbeMonitorsStatusNotification - one push per probe transition", () => {
+    const summary: string =
+      "Probe eu-west is disconnected. 20 monitors in project Acme are not being monitored.";
+
+    test("titles the push with the direction and probe, and uses the summary as the body", () => {
+      const link: string = "https://dashboard/p1/monitors/probe-disconnected";
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeMonitorsStatusNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "Disconnected",
+          monitorCount: 20,
+          summary: summary,
+          clickAction: link,
+        });
+
+      expect(message.title).toBe("Probe Disconnected: eu-west");
+      expect(message.body).toBe(summary);
+      expect(message.tag).toBe("probe-monitors-status");
+      expect(message.requireInteraction).toBe(false);
+      expect(message.icon).toBe(PushNotificationUtil.DEFAULT_ICON);
+      expect(message.badge).toBe(PushNotificationUtil.DEFAULT_BADGE);
+      expect(message.clickAction).toBe(link);
+      expect(message.url).toBe(link);
+      expect(message.data).toEqual({
+        type: "probe-monitors-status",
+        probeName: "eu-west",
+        projectName: "Acme",
+        connectionStatus: "Disconnected",
+        monitorCount: "20",
+        url: link,
+      });
+    });
+
+    test("without a clickAction, no url/clickAction is wired", () => {
+      const message: PushNotificationMessage =
+        PushNotificationUtil.createProbeMonitorsStatusNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "Connected",
+          monitorCount: 1,
+          summary: summary,
+        });
+
+      expect(message.title).toBe("Probe Connected: eu-west");
+      expect(message.clickAction).toBeUndefined();
+      expect(message.url).toBeUndefined();
+      expect(message.data).not.toHaveProperty("url");
+      expect(message.data).toMatchObject({ monitorCount: "1" });
+    });
+
+    test("both directions share one tag, so on web push a reconnect replaces the disconnect", () => {
+      const disconnected: PushNotificationMessage =
+        PushNotificationUtil.createProbeMonitorsStatusNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "Disconnected",
+          monitorCount: 2,
+          summary: summary,
+        });
+      const connected: PushNotificationMessage =
+        PushNotificationUtil.createProbeMonitorsStatusNotification({
+          probeName: "eu-west",
+          projectName: "Acme",
+          connectionStatus: "Connected",
+          monitorCount: 2,
+          summary: summary,
+        });
+
+      expect(connected.tag).toBe(disconnected.tag);
+      expect(connected.title).not.toBe(disconnected.title);
+    });
+  });
 });

package/Tests/Server/Utils/ResourceFeed/ResourceFeedUtil.test.ts

@@ -73,7 +73,15 @@ describe("ResourceFeedUtil.getUpdatedColumnsWorthRecording", () => {
     expect(ResourceFeedUtil.getUpdatedColumnsWorthRecording({})).toEqual([]);
   });
 
-  test("the whitelist covers every column the dashboard can edit", () => {
+  /*
+   * The whitelist is shared by ten resource types, so it covers the edits
+   * their settings pages have in common — not every column a dashboard can
+   * edit. A Kubernetes cluster's AI access settings are dashboard-editable
+   * too, but they get their own, more specific feed items
+   * (KubernetesClusterService), so they must stay out of the generic "was
+   * updated" one.
+   */
+  test("the whitelist covers the edits every resource's settings page has in common", () => {
     for (const column of [
       "name",
       "description",
@@ -85,6 +93,18 @@ describe("ResourceFeedUtil.getUpdatedColumnsWorthRecording", () => {
       expect(MEANINGFUL_UPDATE_COLUMNS).toContain(column);
     }
   });
+
+  test("leaves out the AI access settings, which record their own feed items", () => {
+    for (const column of [
+      "aiAccessRunnerId",
+      "aiAccessCredentialId",
+      "isAiInvestigationEnabled",
+      "aiRemediationMode",
+      "aiKubectlCommandAllowlist",
+    ]) {
+      expect(MEANINGFUL_UPDATE_COLUMNS).not.toContain(column);
+    }
+  });
 });
 
 describe("ResourceFeedUtil.isArchiveChange", () => {

package/Tests/Server/Utils/Rules/OwnerRuleAssignment.test.ts

@@ -7,7 +7,8 @@ import OwnerRuleAssignment, {
   OwnersToAssign,
 } from "../../../../Server/Utils/Rules/OwnerRuleAssignment";
 import PostgresErrorTranslator from "../../../../Server/Utils/Database/PostgresErrorTranslator";
-import { describe, expect, it } from "@jest/globals";
+import TeamMemberService from "../../../../Server/Services/TeamMemberService";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
 
 /*
  * Contract under test - owner rules never create a second owner row for a user
@@ -19,7 +20,26 @@ import { describe, expect, it } from "@jest/globals";
  * owners on nearly every resource it touches. That is why this filter sits in
  * front of every owner rule engine, and why the inserts that follow it treat
  * "already an owner" as done rather than as a failure.
+ *
+ * The owner sets are saved configuration and can name a user who has left
+ * the project since; createOwner skips such a user (see the last block).
+ */
+
+/*
+ * Every owner user below is a project member unless a test says otherwise.
+ * The membership read is TeamMemberService's; no Postgres here.
  */
+let memberCheck: jest.SpyInstance;
+
+beforeEach(() => {
+  memberCheck = jest
+    .spyOn(TeamMemberService, "isUserMemberOfProject")
+    .mockResolvedValue(true);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
 
 const MONITOR_ID: ObjectID = new ObjectID(
   "cccccccc-cccc-4ccc-8ccc-cccccccccccc",
@@ -583,3 +603,137 @@ describe("OwnerRuleAssignment.addOwners", () => {
     expect(added).toEqual({ userIds: [], teamIds: [] });
   });
 });
+
+describe("OwnerRuleAssignment and project membership", () => {
+  const DEPARTED: ObjectID = USER_B;
+
+  function membersAre(userIds: Array<ObjectID>): void {
+    memberCheck.mockImplementation(
+      async (data: { projectId: ObjectID; userId: ObjectID }) => {
+        return userIds.some((id: ObjectID): boolean => {
+          return id.toString() === data.userId.toString();
+        });
+      },
+    );
+  }
+
+  it("does not make a user who left the project an owner", async () => {
+    membersAre([]);
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+    const owner: MonitorOwnerUser = ownerUser(DEPARTED);
+    owner.projectId = PROJECT_ID;
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: {
+          create,
+        } as unknown as DatabaseService<MonitorOwnerUser>,
+        owner: owner,
+        props: { isRoot: true },
+      }),
+    ).resolves.toBe(false);
+
+    expect(create).not.toHaveBeenCalled();
+    expect(memberCheck).toHaveBeenCalledTimes(1);
+    const asked: { projectId: ObjectID; userId: ObjectID } = memberCheck.mock
+      .calls[0]![0] as { projectId: ObjectID; userId: ObjectID };
+    expect(asked.projectId.toString()).toBe(PROJECT_ID.toString());
+    expect(asked.userId.toString()).toBe(DEPARTED.toString());
+  });
+
+  it("reads the project from the caller's tenant when the row has none", async () => {
+    membersAre([USER_A]);
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: {
+          create,
+        } as unknown as DatabaseService<MonitorOwnerUser>,
+        owner: ownerUser(USER_A),
+        props: { tenantId: PROJECT_ID },
+      }),
+    ).resolves.toBe(true);
+
+    const asked: { projectId: ObjectID } = memberCheck.mock.calls[0]![0] as {
+      projectId: ObjectID;
+    };
+    expect(asked.projectId.toString()).toBe(PROJECT_ID.toString());
+    expect(create).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not ask about team owners", async () => {
+    membersAre([]);
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+    const owner: MonitorOwnerTeam = ownerTeam(TEAM_A);
+    owner.projectId = PROJECT_ID;
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: {
+          create,
+        } as unknown as DatabaseService<MonitorOwnerTeam>,
+        owner: owner,
+        props: { isRoot: true },
+      }),
+    ).resolves.toBe(true);
+
+    expect(memberCheck).not.toHaveBeenCalled();
+  });
+
+  it("adds the rest of a saved owner set and reports only what it added", async () => {
+    membersAre([USER_A]);
+    const services: WritableServices = writableServices({});
+
+    const added: OwnersToAssign = await OwnerRuleAssignment.addOwners({
+      ownerUserService: services.ownerUserService,
+      ownerTeamService: services.ownerTeamService,
+      resourceIdColumn: "monitorId",
+      resourceId: MONITOR_ID,
+      projectId: PROJECT_ID,
+      userIds: [USER_A, DEPARTED],
+      teamIds: [TEAM_A],
+      props: { isRoot: true },
+    });
+
+    expect(
+      writtenRows<MonitorOwnerUser>(services.createUser).map(
+        (r: MonitorOwnerUser): string => {
+          return r.userId!.toString();
+        },
+      ),
+    ).toEqual([USER_A.toString()]);
+    expect(services.createTeam).toHaveBeenCalledTimes(1);
+
+    expect(ids(added.userIds)).toEqual([USER_A.toString()]);
+    expect(ids(added.teamIds)).toEqual([TEAM_A.toString()]);
+  });
+
+  it("a failing membership read fails the write, as any other read would", async () => {
+    const failure: Error = new Error("db down");
+    memberCheck.mockRejectedValue(failure);
+    const create: jest.Mock = jest.fn(async () => {
+      return {};
+    });
+    const owner: MonitorOwnerUser = ownerUser(USER_A);
+    owner.projectId = PROJECT_ID;
+
+    await expect(
+      OwnerRuleAssignment.createOwner({
+        ownerService: {
+          create,
+        } as unknown as DatabaseService<MonitorOwnerUser>,
+        owner: owner,
+        props: { isRoot: true },
+      }),
+    ).rejects.toBe(failure);
+
+    expect(create).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/SessionReplay/SessionReplayReadServiceQueries.test.ts

@@ -17,6 +17,8 @@ import SessionReplayReadService, {
   SessionReplayListRequest,
   SessionReplayListResult,
   SessionReplayManifest,
+  SessionReplayResolveRequest,
+  SessionReplayResolvedSession,
   SessionReplaySessionHeader,
   SessionReplaySessionIdentity,
   SessionReplaySummariesRequest,
@@ -315,6 +317,292 @@ describe("SessionReplayReadService statements", () => {
     );
   });
 
+  describe("resolveSessions", () => {
+    const otherApplicationId: ObjectID = ObjectID.generate();
+
+    function resolveRequest(
+      overrides: Partial<SessionReplayResolveRequest> = {},
+    ): SessionReplayResolveRequest {
+      return {
+        projectId: projectId,
+        sessionIds: ["session-a", "session-b"],
+        accessibleRumApplicationIds: null,
+        ...overrides,
+      };
+    }
+
+    function resolvedRow(data: {
+      sessionId: string;
+      applicationId: string;
+      aggStartTime?: number;
+      matchedApplicationCount?: number | string;
+    }): JSONObject {
+      return {
+        sessionId: data.sessionId,
+        applicationId: data.applicationId,
+        aggStartTime: data.aggStartTime ?? 1700000000000,
+        matchedApplicationCount: data.matchedApplicationCount ?? "1",
+      };
+    }
+
+    function qualifySection(query: string): string {
+      const index: number = query.indexOf("QUALIFY");
+
+      if (index < 0) {
+        throw new Error("Statement has no QUALIFY section");
+      }
+
+      return query.substring(index);
+    }
+
+    test("collapses ReplacingMergeTree rows with argMax, grouped per (application, session)", async () => {
+      await SessionReplayReadService.resolveSessions(resolveRequest());
+
+      expect(headerQuerySpy).toHaveBeenCalledTimes(1);
+      expect(chunkQuerySpy).not.toHaveBeenCalled();
+
+      const statement: Statement = statementOf(headerQuerySpy);
+      const query: string = statement.query;
+
+      expect(query).toMatch(/FROM \{p\d+:Identifier\}/);
+      /* The start time is the newest version's, never a raw row's. */
+      expect(query).toContain(
+        "toFloat64(toUnixTimestamp64Milli(argMax(startTime, version))) AS aggStartTime",
+      );
+      expect(query).toContain("toString(rumApplicationId) AS applicationId");
+      expect(query).toContain(
+        "GROUP BY projectId, rumApplicationId, sessionId",
+      );
+      expect(query).toContain(
+        "count() OVER (PARTITION BY sessionId) AS matchedApplicationCount",
+      );
+      expect(query).toContain("QUALIFY matchedApplicationCount = 1");
+      expect(query).toContain("retentionDate >= now()");
+      expect(query).toContain("timeout_overflow_mode = 'throw'");
+      expect(query).not.toContain(" FINAL");
+
+      /* The WHERE is (projectId, sessionId): the bloom-filtered lookup. */
+      const where: string = whereSection(query);
+
+      expect(where).toContain("projectId = ");
+      expect(where).toContain("sessionId IN (");
+      expect(where).not.toContain("rumApplicationId");
+
+      for (const forbiddenColumn of [
+        "identifiedUserKey",
+        "identifiedUserLabel",
+        "identifiedUserTraits",
+        "visitorId",
+        "payload",
+        "entryUrl",
+        "exitUrl",
+        "routes",
+      ]) {
+        expect(query).not.toContain(forbiddenColumn);
+      }
+
+      const values: Array<unknown> = boundValues(statement);
+
+      expect(values).toContain(AnalyticsTableName.RumSession);
+      expect(values).toContain(projectId.toString());
+      expect(values).toContainEqual(["session-a", "session-b"]);
+    });
+
+    test("an unrestricted caller adds no application predicate at all", async () => {
+      await SessionReplayReadService.resolveSessions(resolveRequest());
+
+      expect(statementOf(headerQuerySpy).query).not.toContain(
+        "rumApplicationId IN (",
+      );
+    });
+
+    test("a label restriction is applied after the per-id application count, never in WHERE", async () => {
+      await SessionReplayReadService.resolveSessions(
+        resolveRequest({
+          accessibleRumApplicationIds: [rumApplicationId, otherApplicationId],
+        }),
+      );
+
+      const statement: Statement = statementOf(headerQuerySpy);
+
+      expect(qualifySection(statement.query)).toContain(
+        "AND rumApplicationId IN (",
+      );
+      expect(whereSection(statement.query)).not.toContain("rumApplicationId");
+      expect(boundValues(statement)).toContainEqual([
+        rumApplicationId.toString(),
+        otherApplicationId.toString(),
+      ]);
+    });
+
+    test("a caller who reaches no application gets nothing and issues no query", async () => {
+      expect(
+        await SessionReplayReadService.resolveSessions(
+          resolveRequest({ accessibleRumApplicationIds: [] }),
+        ),
+      ).toEqual([]);
+      expect(headerQuerySpy).not.toHaveBeenCalled();
+    });
+
+    test("binds each id once and caps the rows at the number of distinct ids", async () => {
+      await SessionReplayReadService.resolveSessions(
+        resolveRequest({
+          sessionIds: ["session-a", "session-b", "session-a", "session-c"],
+        }),
+      );
+
+      const statement: Statement = statementOf(headerQuerySpy);
+
+      expect(boundValues(statement)).toContainEqual([
+        "session-a",
+        "session-b",
+        "session-c",
+      ]);
+      expect(statement.query).toMatch(/LIMIT \{p\d+:Int32\}/);
+      expect(boundValues(statement)).toContain(3);
+    });
+
+    test("answers in request order, omitting missing, unsolicited and malformed rows", async () => {
+      headerQuerySpy.mockResolvedValue(
+        fakeResultSet([
+          resolvedRow({
+            sessionId: "session-b",
+            applicationId: rumApplicationId.toString(),
+            aggStartTime: 1700000200000,
+          }),
+          resolvedRow({
+            sessionId: "not-requested",
+            applicationId: rumApplicationId.toString(),
+          }),
+          resolvedRow({
+            sessionId: "session-a",
+            applicationId: otherApplicationId.toString(),
+            aggStartTime: 1700000100000,
+          }),
+          /* An application id that is not one can never anchor a link. */
+          resolvedRow({ sessionId: "session-c", applicationId: "" }),
+        ]) as never,
+      );
+
+      const resolved: Array<SessionReplayResolvedSession> =
+        await SessionReplayReadService.resolveSessions(
+          resolveRequest({
+            sessionIds: ["session-a", "session-b", "session-c", "missing"],
+          }),
+        );
+
+      expect(resolved).toEqual([
+        {
+          sessionId: "session-a",
+          rumApplicationId: otherApplicationId.toString(),
+          startTime: new Date(1700000100000),
+          startTimeUnixMs: 1700000100000,
+        },
+        {
+          sessionId: "session-b",
+          rumApplicationId: rumApplicationId.toString(),
+          startTime: new Date(1700000200000),
+          startTimeUnixMs: 1700000200000,
+        },
+      ]);
+    });
+
+    test("an id that more than one application recorded is refused, however it arrives", async () => {
+      headerQuerySpy.mockResolvedValue(
+        fakeResultSet([
+          resolvedRow({
+            sessionId: "session-a",
+            applicationId: rumApplicationId.toString(),
+          }),
+          /* The window said two applications: QUALIFY should have dropped it. */
+          resolvedRow({
+            sessionId: "session-b",
+            applicationId: rumApplicationId.toString(),
+            matchedApplicationCount: "2",
+          }),
+          /* Two grouped rows for one id is the same ambiguity. */
+          resolvedRow({
+            sessionId: "session-c",
+            applicationId: rumApplicationId.toString(),
+          }),
+          resolvedRow({
+            sessionId: "session-c",
+            applicationId: otherApplicationId.toString(),
+          }),
+        ]) as never,
+      );
+
+      const resolved: Array<SessionReplayResolvedSession> =
+        await SessionReplayReadService.resolveSessions(
+          resolveRequest({
+            sessionIds: ["session-a", "session-b", "session-c"],
+          }),
+        );
+
+      expect(
+        resolved.map((row: SessionReplayResolvedSession): string => {
+          return row.sessionId;
+        }),
+      ).toEqual(["session-a"]);
+    });
+
+    test("a row for an application outside the restriction never reaches the answer", async () => {
+      headerQuerySpy.mockResolvedValue(
+        fakeResultSet([
+          resolvedRow({
+            sessionId: "session-a",
+            /* ClickHouse's own casing must not defeat the membership test. */
+            applicationId: rumApplicationId.toString().toUpperCase(),
+          }),
+          resolvedRow({
+            sessionId: "session-b",
+            applicationId: otherApplicationId.toString(),
+          }),
+        ]) as never,
+      );
+
+      const resolved: Array<SessionReplayResolvedSession> =
+        await SessionReplayReadService.resolveSessions(
+          resolveRequest({ accessibleRumApplicationIds: [rumApplicationId] }),
+        );
+
+      expect(
+        resolved.map((row: SessionReplayResolvedSession): string => {
+          return row.sessionId;
+        }),
+      ).toEqual(["session-a"]);
+    });
+
+    test.each([
+      { name: "an empty batch", sessionIds: [] },
+      { name: "an empty id", sessionIds: [""] },
+      {
+        name: "an overlong id",
+        sessionIds: ["x".repeat(MAX_SESSION_REPLAY_SESSION_ID_LENGTH + 1)],
+      },
+      {
+        name: "an oversized batch",
+        sessionIds: Array.from(
+          { length: MAX_SESSION_REPLAY_SUMMARIES_BATCH_SIZE + 1 },
+          (_value: unknown, index: number): string => {
+            return `session-${index}`;
+          },
+        ),
+      },
+    ])(
+      "rejects $name before querying",
+      async ({ sessionIds }: { sessionIds: Array<string> }) => {
+        await expect(
+          SessionReplayReadService.resolveSessions(
+            resolveRequest({ sessionIds: sessionIds }),
+          ),
+        ).rejects.toBeInstanceOf(BadDataException);
+
+        expect(headerQuerySpy).not.toHaveBeenCalled();
+      },
+    );
+  });
+
   describe("list predicates are HAVING clauses over argMax aliases", () => {
     test("hasIdentifiedUser tests the digest alias, never the label", async () => {
       const positive: string = await listQuery({ hasIdentifiedUser: true });