@oneuptime/common 14.0.1 → 14.0.3

package/Tests/Server/Services/ProjectOwnersProjectMembership.test.ts

@@ -0,0 +1,221 @@
+import MailService from "../../../Server/Services/MailService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import TeamMemberService from "../../../Server/Services/TeamMemberService";
+import TeamPermissionService from "../../../Server/Services/TeamPermissionService";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import TeamPermission from "../../../Models/DatabaseModels/TeamPermission";
+import User from "../../../Models/DatabaseModels/User";
+import Email from "../../../Types/Email";
+import ObjectID from "../../../Types/ObjectID";
+import Permission from "../../../Types/Permission";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+
+/*
+ * ProjectService.getOwners is the recipient list of last resort. The owner
+ * jobs fall back to it when a resource has no owners of its own and then
+ * write "Owners have been notified ... Notified: <user>" to the resource's
+ * feed, and sendEmailToProjectOwners mails it directly (billing, undeliverable
+ * pages, the on-call readiness digest).
+ *
+ * An owner team's roster includes its pending invitations. A pending row grants
+ * none of the team's permissions and the invitee has no notification settings
+ * (those are added on accept), so listing them made the feed claim a
+ * notification that was silently dropped, and mailed project email to someone
+ * who never joined. Acceptance is per team row: a member of another team whose
+ * invitation to the owner team is still pending has not agreed to be an owner
+ * either.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID("project-1");
+const OWNER_TEAM: ObjectID = new ObjectID("team-owners");
+const OTHER_TEAM: ObjectID = new ObjectID("team-engineering");
+
+const OWNER: ObjectID = new ObjectID("user-owner");
+const PENDING_INVITEE: ObjectID = new ObjectID("user-pending-invitee");
+// Accepted in engineering, still pending in the owner team.
+const PENDING_OWNER: ObjectID = new ObjectID("user-pending-owner");
+
+interface MembershipRow {
+  teamId: ObjectID;
+  userId: ObjectID;
+  hasAcceptedInvitation: boolean;
+}
+
+const ROWS: Array<MembershipRow> = [
+  { teamId: OWNER_TEAM, userId: OWNER, hasAcceptedInvitation: true },
+  { teamId: OWNER_TEAM, userId: PENDING_INVITEE, hasAcceptedInvitation: false },
+  { teamId: OWNER_TEAM, userId: PENDING_OWNER, hasAcceptedInvitation: false },
+  { teamId: OTHER_TEAM, userId: PENDING_OWNER, hasAcceptedInvitation: true },
+];
+
+function anyValues(operator: any): Array<string> {
+  return Object.values(
+    operator.objectLiteralParameters as Record<string, Array<string>>,
+  )[0]!.map((value: string): string => {
+    return value.toString();
+  });
+}
+
+/*
+ * A TeamMember table that answers the two filters getUsersInTeams can send:
+ * the team ids, and hasAcceptedInvitation when it is present.
+ */
+function membershipTable(rows: Array<MembershipRow>): any {
+  return jest
+    .spyOn(TeamMemberService, "findBy")
+    .mockImplementation((findBy: any): any => {
+      const teamIds: Array<string> = anyValues(findBy.query.teamId);
+
+      return Promise.resolve(
+        rows
+          .filter((row: MembershipRow): boolean => {
+            return (
+              teamIds.includes(row.teamId.toString()) &&
+              (findBy.query.hasAcceptedInvitation === undefined ||
+                findBy.query.hasAcceptedInvitation ===
+                  row.hasAcceptedInvitation)
+            );
+          })
+          .map((row: MembershipRow): TeamMember => {
+            const member: TeamMember = new TeamMember();
+            member.teamId = row.teamId;
+            member.userId = row.userId;
+
+            const user: User = new User(row.userId);
+            user.email = new Email(`${row.userId.toString()}@acme.test`);
+            member.user = user;
+
+            return member;
+          }),
+      );
+    });
+}
+
+function ownerTeams(teamIds: Array<ObjectID>): any {
+  return jest.spyOn(TeamPermissionService, "findBy").mockResolvedValue(
+    teamIds.map((teamId: ObjectID): TeamPermission => {
+      const permission: TeamPermission = new TeamPermission();
+      permission.teamId = teamId;
+      return permission;
+    }) as never,
+  );
+}
+
+function ids(users: Array<User>): Array<string> {
+  return users.map((user: User): string => {
+    return user.id!.toString();
+  });
+}
+
+describe("TeamMemberService.getUsersInTeams", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("by default still returns the whole roster, pending invitations included, for the callers that expect it", async () => {
+    const read: any = membershipTable(ROWS);
+
+    const users: Array<User> = await TeamMemberService.getUsersInTeams([
+      OWNER_TEAM,
+    ]);
+
+    expect(ids(users)).toEqual([
+      OWNER.toString(),
+      PENDING_INVITEE.toString(),
+      PENDING_OWNER.toString(),
+    ]);
+    expect(read.mock.calls[0]![0].query).not.toHaveProperty(
+      "hasAcceptedInvitation",
+    );
+  });
+
+  test("acceptedOnly reads only the accepted rows of those teams", async () => {
+    const read: any = membershipTable(ROWS);
+
+    const users: Array<User> = await TeamMemberService.getUsersInTeams(
+      [OWNER_TEAM],
+      { acceptedOnly: true },
+    );
+
+    expect(ids(users)).toEqual([OWNER.toString()]);
+    expect(read.mock.calls[0]![0].query.hasAcceptedInvitation).toBe(true);
+    expect(anyValues(read.mock.calls[0]![0].query.teamId)).toEqual([
+      OWNER_TEAM.toString(),
+    ]);
+  });
+
+  test("a user accepted in two of the teams is returned once", async () => {
+    membershipTable([
+      { teamId: OWNER_TEAM, userId: OWNER, hasAcceptedInvitation: true },
+      { teamId: OTHER_TEAM, userId: OWNER, hasAcceptedInvitation: true },
+    ]);
+
+    const users: Array<User> = await TeamMemberService.getUsersInTeams(
+      [OWNER_TEAM, OTHER_TEAM],
+      { acceptedOnly: true },
+    );
+
+    expect(ids(users)).toEqual([OWNER.toString()]);
+  });
+});
+
+describe("ProjectService.getOwners", () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  test("lists only the accepted members of the teams that hold ProjectOwner", async () => {
+    const permissions: any = ownerTeams([OWNER_TEAM]);
+    membershipTable(ROWS);
+
+    const owners: Array<User> = await ProjectService.getOwners(PROJECT_ID);
+
+    expect(ids(owners)).toEqual([OWNER.toString()]);
+    expect(permissions.mock.calls[0]![0].query).toEqual({
+      projectId: PROJECT_ID,
+      permission: Permission.ProjectOwner,
+    });
+  });
+
+  test("an owner team whose only members are pending invitees has no owners, so callers see the empty case", async () => {
+    ownerTeams([OWNER_TEAM]);
+    membershipTable(
+      ROWS.filter((row: MembershipRow): boolean => {
+        return row.userId.toString() !== OWNER.toString();
+      }),
+    );
+
+    await expect(ProjectService.getOwners(PROJECT_ID)).resolves.toEqual([]);
+  });
+
+  test("no team holds ProjectOwner: no membership read", async () => {
+    ownerTeams([]);
+    const read: any = membershipTable(ROWS);
+
+    await expect(ProjectService.getOwners(PROJECT_ID)).resolves.toEqual([]);
+    expect(read).not.toHaveBeenCalled();
+  });
+
+  test("sendEmailToProjectOwners mails the accepted owner and nobody still pending", async () => {
+    ownerTeams([OWNER_TEAM]);
+    membershipTable(ROWS);
+    const sendMail: any = jest
+      .spyOn(MailService, "sendMail")
+      .mockResolvedValue(undefined as never);
+
+    await ProjectService.sendEmailToProjectOwners(
+      PROJECT_ID,
+      "Subscription overdue",
+      "Please update your payment method.",
+    );
+
+    expect(sendMail).toHaveBeenCalledTimes(1);
+    expect(sendMail.mock.calls[0]![0].toEmail.toString()).toBe(
+      `${OWNER.toString()}@acme.test`,
+    );
+    expect(sendMail.mock.calls[0]![1]).toEqual({
+      projectId: PROJECT_ID,
+      userId: OWNER,
+    });
+  });
+});

package/Tests/Server/Services/RuleRun/IncidentAlertMaintenanceRuleEnginesRun.test.ts

@@ -82,6 +82,7 @@ import RuleCriteria, {
   RuleCriteriaOperator,
 } from "../../../../Types/Rules/RuleCriteria";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../../../Utils/Rules/RuleEngineLimits";
+import TeamMemberService from "../../../../Server/Services/TeamMemberService";
 import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
 
 /*
@@ -862,6 +863,10 @@ beforeEach(() => {
   // Silence the logs the failure-path tests deliberately provoke.
   jest.spyOn(console, "error").mockImplementation(() => {});
   jest.spyOn(console, "warn").mockImplementation(() => {});
+  // Owner users here are project members; OwnerRuleAssignment.test.ts covers ones who left.
+  jest
+    .spyOn(TeamMemberService, "isUserMemberOfProject")
+    .mockResolvedValue(true);
 });
 
 afterEach(() => {

package/Tests/Server/Services/RuleRun/OwnerRuleEnginesGroupARun.test.ts

@@ -66,6 +66,7 @@ import OnCallDutyPolicyScheduleService from "../../../../Server/Services/OnCallD
 import OnCallDutyPolicyService from "../../../../Server/Services/OnCallDutyPolicyService";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import logger from "../../../../Server/Utils/Logger";
+import TeamMemberService from "../../../../Server/Services/TeamMemberService";
 import PostgresErrorTranslator from "../../../../Server/Utils/Database/PostgresErrorTranslator";
 import {
   RuleApplicationResult,
@@ -481,6 +482,7 @@ interface EngineMocks {
   createOwnerUser: jest.SpyInstance;
   createOwnerTeam: jest.SpyInstance;
   createFeedItem: jest.SpyInstance | null;
+  memberCheck: jest.SpyInstance;
 }
 
 function mockEngine(
@@ -491,6 +493,8 @@ function mockEngine(
     assignedUserIds?: Array<ObjectID> | undefined;
     assignedTeamIds?: Array<ObjectID> | undefined;
     ownerWriteError?: Error | undefined;
+    // Whether the rule's owner user is still a member of the project.
+    userIsProjectMember?: boolean | undefined;
   } = {},
 ): EngineMocks {
   const ruleRead: jest.SpyInstance = jest
@@ -539,6 +543,10 @@ function mockEngine(
       .mockResolvedValue(undefined);
   }
 
+  const memberCheck: jest.SpyInstance = jest
+    .spyOn(TeamMemberService, "isUserMemberOfProject")
+    .mockResolvedValue(data.userIsProjectMember !== false);
+
   return {
     ruleRead: ruleRead,
     resourceRead: resourceRead,
@@ -547,6 +555,7 @@ function mockEngine(
     createOwnerUser: createOwnerUser,
     createOwnerTeam: createOwnerTeam,
     createFeedItem: createFeedItem,
+    memberCheck: memberCheck,
   };
 }
 
@@ -736,6 +745,25 @@ describe.each(
       expect(mocks.createOwnerTeam).toHaveBeenCalledTimes(1);
     });
 
+    it("does not make a rule's owner user who has left the project an owner", async () => {
+      const mocks: EngineMocks = mockEngine(c, { userIsProjectMember: false });
+
+      const result: RuleApplicationResult = await runRules(
+        c,
+        [fakeRule(c)],
+        true,
+      );
+
+      // The rule's team is still added; the departed user is not.
+      expect(result).toEqual(RuleApplicationResultUtil.updated(1));
+      expect(mocks.createOwnerUser).not.toHaveBeenCalled();
+      expect(mocks.createOwnerTeam).toHaveBeenCalledTimes(1);
+
+      const asked: any = mocks.memberCheck.mock.calls[0]![0];
+      expect(asked.projectId.toString()).toBe(PROJECT_ID.toString());
+      expect(asked.userId.toString()).toBe(USER_ID.toString());
+    });
+
     it("reports already applied, and writes nothing, when every owner is assigned", async () => {
       const mocks: EngineMocks = mockEngine(c, {
         assignedUserIds: [USER_ID],

package/Tests/Server/Services/RuleRun/OwnerRuleEnginesGroupBRun.test.ts

@@ -99,7 +99,8 @@ import {
 } from "../../../../Server/Utils/Rules/RuleRun/RuleApplication";
 import ObjectID from "../../../../Types/ObjectID";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../../../Utils/Rules/RuleEngineLimits";
-import { afterEach, describe, expect, it } from "@jest/globals";
+import TeamMemberService from "../../../../Server/Services/TeamMemberService";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
 
 /*
  * Contract under test - "Run now" for the owner rule engines of the Podman,
@@ -728,6 +729,13 @@ function expectNotifying(testCase: EngineCase, write: OwnerWrite): void {
   }
 }
 
+beforeEach(() => {
+  // Owner users here are project members; OwnerRuleAssignment.test.ts covers ones who left.
+  jest
+    .spyOn(TeamMemberService, "isUserMemberOfProject")
+    .mockResolvedValue(true);
+});
+
 afterEach(() => {
   jest.restoreAllMocks();
 });

package/Tests/Server/Services/RunnerJobEnqueueAiCommandAgentRunner.test.ts

@@ -0,0 +1,230 @@
+import RunnerJobService from "../../../Server/Services/RunnerJobService";
+import RunnerService from "../../../Server/Services/RunnerService";
+import Runner from "../../../Models/DatabaseModels/Runner";
+import RunnerJob from "../../../Models/DatabaseModels/RunnerJob";
+import RunbookStepType from "../../../Types/Runbook/RunbookStepType";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import { afterEach, beforeEach, describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test — RunnerJobService.enqueueAiCommand, the chokepoint
+ * every AI-composed Bash or SSH command passes (FullAuto inline execution,
+ * approved plans, rollbacks), refuses a kubernetes-agent Runner as the
+ * target:
+ *
+ * - that Runner exists to run policy-tiered kubectl with its own
+ *   ServiceAccount; the claim path serves it kubectl only, so a Bash or SSH
+ *   job aimed at it would sit unclaimed until its deadline after a human
+ *   approved it;
+ * - its identity is minted with the project's telemetry ingestion key, so
+ *   it must never be handed AI-composed shell work or an SSH credential;
+ * - the decision is the one "is an agent row" rule
+ *   (RunnerService.isKubernetesAgentRunnerRow), failing closed on either
+ *   fact: the server-owned NAME marker (compared case-insensitively; a
+ *   non-root rename into or out of it is refused), which survives a
+ *   heartbeat that drops the posture, OR an agent posture, which only the
+ *   kubernetes-agent binary reports;
+ * - the target must be one of the project's Runners at all.
+ *
+ * Refusing here (not only in the tool that lists hosts) also stops a plan
+ * that was stored before the fix.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const RUN_ID: ObjectID = new ObjectID("88888888-8888-4888-8888-888888888888");
+const SUGGESTION_ID: ObjectID = new ObjectID(
+  "77777777-7777-4777-8777-777777777777",
+);
+const RUNNER_ID: ObjectID = new ObjectID(
+  "44444444-4444-4444-8444-444444444444",
+);
+const CREDENTIAL_ID: string = "55555555-5555-4555-8555-555555555555";
+
+type EnqueueArgs = Parameters<typeof RunnerJobService.enqueueAiCommand>[0];
+
+function args(overrides: Partial<EnqueueArgs> = {}): EnqueueArgs {
+  return {
+    projectId: PROJECT_ID,
+    aiRunId: RUN_ID,
+    autoRemediationSuggestionId: SUGGESTION_ID,
+    stepId: "ai-command-1",
+    stepType: RunbookStepType.Bash,
+    targetAgentId: RUNNER_ID,
+    command: "systemctl restart nginx",
+    timeoutInMs: 30000,
+    ...overrides,
+  };
+}
+
+function runner(overrides: Partial<Record<string, unknown>> = {}): Runner {
+  return {
+    id: RUNNER_ID,
+    _id: RUNNER_ID.toString(),
+    projectId: PROJECT_ID,
+    name: "office-runner",
+    ...overrides,
+  } as unknown as Runner;
+}
+
+describe("RunnerJobService.enqueueAiCommand never targets a kubernetes-agent Runner", () => {
+  let create: jest.SpyInstance;
+  let runnerLookup: jest.SpyInstance;
+  let countBy: jest.SpyInstance;
+
+  beforeEach(() => {
+    create = jest
+      .spyOn(RunnerJobService, "create")
+      .mockImplementation(async (data: unknown): Promise<RunnerJob> => {
+        return (data as { data: RunnerJob }).data;
+      });
+    countBy = jest
+      .spyOn(RunnerJobService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+    runnerLookup = jest
+      .spyOn(RunnerService, "findOneBy")
+      .mockResolvedValue(runner());
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("refuses a Bash job for an agent Runner and creates nothing", async () => {
+    runnerLookup.mockResolvedValue(
+      runner({
+        name: "kubernetes-agent/prod-us",
+        hostInfo: {
+          kubernetes: { inCluster: true, clusterIdentifier: "prod-us" },
+        },
+      }),
+    );
+
+    await expect(RunnerJobService.enqueueAiCommand(args())).rejects.toThrow(
+      /in-cluster Runner: it runs kubectl through its cluster only, never Bash commands/,
+    );
+    expect(create).not.toHaveBeenCalled();
+    // Refused before the hourly brake spends a count on it.
+    expect(countBy).not.toHaveBeenCalled();
+  });
+
+  it("refuses an SSH job for an agent Runner too", async () => {
+    runnerLookup.mockResolvedValue(
+      runner({ name: "kubernetes-agent/prod-us" }),
+    );
+
+    await expect(
+      RunnerJobService.enqueueAiCommand(
+        args({
+          stepType: RunbookStepType.SSH,
+          credentialId: CREDENTIAL_ID,
+        }),
+      ),
+    ).rejects.toThrow(/never SSH commands/);
+    expect(create).not.toHaveBeenCalled();
+  });
+
+  it("keys on the server-owned name: an agent row whose heartbeat dropped its posture is still refused", async () => {
+    runnerLookup.mockResolvedValue(
+      runner({ name: "kubernetes-agent/prod-us", hostInfo: {} }),
+    );
+
+    await expect(RunnerJobService.enqueueAiCommand(args())).rejects.toThrow(
+      BadDataException,
+    );
+    expect(create).not.toHaveBeenCalled();
+  });
+
+  /*
+   * Round one keyed this refusal on the case-sensitive name alone, so an
+   * agent row renamed out of the marker (or to a case variant of it) was
+   * accepted as a Bash/SSH host.
+   */
+  it.each([
+    [
+      "a name without the marker but an agent posture",
+      {
+        name: "prod in-cluster runner",
+        hostInfo: {
+          kubernetes: { inCluster: true, clusterIdentifier: "prod-us" },
+        },
+      },
+    ],
+    ["a case variant of the marker", { name: "Kubernetes-Agent/prod-us" }],
+  ])(
+    "refuses a Bash job for a row with %s",
+    async (_label: string, row: Record<string, unknown>) => {
+      runnerLookup.mockResolvedValue(runner(row));
+
+      await expect(RunnerJobService.enqueueAiCommand(args())).rejects.toThrow(
+        /never Bash commands/,
+      );
+      expect(create).not.toHaveBeenCalled();
+    },
+  );
+
+  it("refuses a target Runner that is not in the project", async () => {
+    runnerLookup.mockResolvedValue(null);
+
+    await expect(RunnerJobService.enqueueAiCommand(args())).rejects.toThrow(
+      /Runner was not found or it does not belong to this project/,
+    );
+    expect(create).not.toHaveBeenCalled();
+
+    const query: Record<string, unknown> = (
+      runnerLookup.mock.calls[0]![0] as { query: Record<string, unknown> }
+    ).query;
+    expect(query["_id"]).toBe(RUNNER_ID.toString());
+    expect(query["projectId"]).toBe(PROJECT_ID);
+  });
+
+  /*
+   * Before round two this fixture also named a cluster — an agent posture,
+   * which only the kubernetes-agent binary reports and which now marks the
+   * row as an agent on its own (the case above). An ordinary Runner that
+   * lives in a pod reports no cluster identity.
+   */
+  it("negative control: an ordinary Runner in a pod (in-cluster, no cluster identity, own name) still gets its Bash job", async () => {
+    runnerLookup.mockResolvedValue(
+      runner({
+        name: "pod-runner",
+        hostInfo: {
+          kubernetes: { inCluster: true },
+        },
+      }),
+    );
+
+    const job: RunnerJob = await RunnerJobService.enqueueAiCommand(args());
+
+    expect(create).toHaveBeenCalledTimes(1);
+    expect(job.stepType).toBe(RunbookStepType.Bash);
+    expect(job.script).toBe("systemctl restart nginx");
+  });
+
+  it("negative control: an ordinary Runner gets its SSH job with the credential reference", async () => {
+    const job: RunnerJob = await RunnerJobService.enqueueAiCommand(
+      args({ stepType: RunbookStepType.SSH, credentialId: CREDENTIAL_ID }),
+    );
+
+    expect(create).toHaveBeenCalledTimes(1);
+    expect(job.payload).toEqual({
+      credentialId: CREDENTIAL_ID,
+      command: "systemctl restart nginx",
+    });
+  });
+
+  it("a Kubectl job is still turned away first, towards its own chokepoint", async () => {
+    await expect(
+      RunnerJobService.enqueueAiCommand(
+        args({
+          stepType: RunbookStepType.Kubectl,
+          command: "kubectl get pods",
+        }),
+      ),
+    ).rejects.toThrow(/enqueueAiKubectlCommand/);
+    expect(runnerLookup).not.toHaveBeenCalled();
+  });
+});