@oneuptime/common 14.0.10 → 14.0.11

package/Tests/Models/DatabaseModels/StaticRuleCriteriaInheritance.test.ts

@@ -40,6 +40,8 @@ const STATIC_MATCH_CRITERIA_RULE_MODEL_NAMES: Array<string> = [
   "IoTFleetOwnerRule",
   "KubernetesClusterLabelRule",
   "KubernetesClusterOwnerRule",
+  "MessageQueueLabelRule",
+  "MessageQueueOwnerRule",
   "MonitorLabelRule",
   "MonitorOwnerRule",
   "NetworkDeviceLabelRule",
@@ -112,8 +114,8 @@ function getRegisteredModelType(modelName: string): ModelType {
 
 describe("static match-criteria rule model inheritance", () => {
   it("keeps the explicit model inventory complete and duplicate-free", () => {
-    expect(STATIC_MATCH_CRITERIA_RULE_MODEL_NAMES).toHaveLength(78);
-    expect(new Set(STATIC_MATCH_CRITERIA_RULE_MODEL_NAMES).size).toBe(78);
+    expect(STATIC_MATCH_CRITERIA_RULE_MODEL_NAMES).toHaveLength(80);
+    expect(new Set(STATIC_MATCH_CRITERIA_RULE_MODEL_NAMES).size).toBe(80);
   });
 
   it.each(STATIC_MATCH_CRITERIA_RULE_MODEL_NAMES)(

package/Tests/Models/DatabaseModels/TeamComplianceSettingModel.test.ts

@@ -9,7 +9,7 @@ import ColumnLength from "../../../Types/Database/ColumnLength";
 import ColumnType from "../../../Types/Database/ColumnType";
 import { TableColumnMetadata } from "../../../Types/Database/TableColumn";
 import TableColumnType from "../../../Types/Database/TableColumnType";
-import { JSONObject } from "../../../Types/JSON";
+import { JSONObject, JSONValue } from "../../../Types/JSON";
 import Permission from "../../../Types/Permission";
 import ComplianceNotificationChannel from "../../../Types/Team/ComplianceNotificationChannel";
 import ComplianceRuleType from "../../../Types/Team/ComplianceRuleType";
@@ -20,17 +20,20 @@ import type { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs"
 import type { RelationMetadataArgs } from "typeorm/metadata-args/RelationMetadataArgs";
 
 /*
- * Schema-level guarantees of TeamComplianceSetting after rules gained a
- * channel and a severity scope.
+ * Schema-level guarantees of TeamComplianceSetting after rules gained
+ * channels and a severity scope.
  *
  * None of this is visible to a service or server test - they pass just as
  * happily against a column the API cannot write, a scope a project viewer can
  * edit, or a rule table a lapsed licence can still change. So this pins the
- * three new columns (type, related model, nullability, who may read and
- * write them), that nothing about the table's gating changed (enterprise
- * only, the same table permissions, no workflow components), that the unique
- * (teamId, ruleType) index is gone, and that the API layer turns a posted
- * severity list into models.
+ * scope columns (type, related model, nullability, who may read and write
+ * them) - notificationChannels, the list of channels a member needs a rule
+ * on, and notificationChannel, the deprecated single channel kept beside it
+ * for older clients and builds - that nothing about the table's gating
+ * changed (enterprise only, the same table permissions, no workflow
+ * components), that the unique (teamId, ruleType) index is gone, and that the
+ * API layer turns a posted severity list into models and keeps a posted
+ * channel list a list.
  */
 
 type ModelType = { new (): BaseModel };
@@ -53,14 +56,23 @@ const READERS: Array<Permission> = [
   Permission.ReadProjectTeam,
 ];
 
-// The columns that together say what a rule checks.
+/*
+ * The columns that together say what a rule checks. notificationChannel is
+ * written with the list on every save (it holds the list's first channel), so
+ * it is as much a part of the scope as the list.
+ */
 const SCOPE_COLUMNS: Array<string> = [
   "ruleType",
+  "notificationChannels",
   "notificationChannel",
   "incidentSeverities",
   "alertSeverities",
 ];
 
+const ALL_CHANNELS: Array<ComplianceNotificationChannel> = Object.values(
+  ComplianceNotificationChannel,
+);
+
 type AccessControlForFunction = (
   column: string,
 ) => ColumnAccessControl | undefined;
@@ -167,7 +179,47 @@ describe("TeamComplianceSetting - the table", () => {
 });
 
 describe("TeamComplianceSetting - the scope columns", () => {
-  test("notificationChannel is optional short text: null means any channel", () => {
+  test("notificationChannels is an optional JSON list, with no default: empty or null means any channel", () => {
+    const metadata: TableColumnMetadata = model.getTableColumnMetadata(
+      "notificationChannels",
+    );
+
+    expect(metadata.type).toBe(TableColumnType.JSON);
+    expect(metadata.required).toBe(false);
+    expect(metadata.title).toBe("Notification Channels");
+    expect(metadata.defaultValue).toBeUndefined();
+    expect(metadata.isDefaultValueColumn).toBeFalsy();
+    expect(columnArgs("notificationChannels")?.options).toMatchObject({
+      type: ColumnType.JSON,
+      nullable: true,
+    });
+    // Rows from before the column are backfilled by a migration, not a default.
+    expect(columnArgs("notificationChannels")?.options.default).toBeUndefined();
+    expect(ColumnType.JSON).toBe("jsonb");
+  });
+
+  test("notificationChannels is a column on the rule row, not a relation", () => {
+    expect(columnArgs("notificationChannels")).toBeDefined();
+    expect(relationArgs("notificationChannels")).toBeUndefined();
+    expect(
+      model.getTableColumnMetadata("notificationChannels").modelType,
+    ).toBeUndefined();
+  });
+
+  test("notificationChannels' API description names every channel it accepts, and says a member needs every one", () => {
+    const description: string =
+      model.getTableColumnMetadata("notificationChannels").description || "";
+
+    for (const channel of ALL_CHANNELS) {
+      expect(description).toContain(channel);
+    }
+
+    expect(description).toMatch(/On-call rules only/);
+    expect(description).toMatch(/\beach member needs a rule on every one\b/);
+    expect(description).toMatch(/Leave empty to accept any channel\.$/);
+  });
+
+  test("notificationChannel stays optional short text, and says it is deprecated in favour of the list", () => {
     const metadata: TableColumnMetadata = model.getTableColumnMetadata(
       "notificationChannel",
     );
@@ -175,6 +227,16 @@ describe("TeamComplianceSetting - the scope columns", () => {
     expect(metadata.type).toBe(TableColumnType.ShortText);
     expect(metadata.required).toBe(false);
     expect(metadata.title).toBe("Notification Channel");
+    expect(metadata.description).toMatch(
+      /^Deprecated: use notificationChannels\./,
+    );
+    // What a client that only knows this field needs to hear.
+    expect(metadata.description).toContain(
+      "first of the rule's notification channels",
+    );
+    expect(metadata.description).toContain(
+      "Sending this field without notificationChannels sets the rule to that one channel",
+    );
     expect(columnArgs("notificationChannel")?.options).toMatchObject({
       type: ColumnType.ShortText,
       length: ColumnLength.ShortText,
@@ -183,15 +245,38 @@ describe("TeamComplianceSetting - the scope columns", () => {
     expect(columnArgs("notificationChannel")?.options.default).toBeUndefined();
   });
 
-  test("notificationChannel's API description names every channel it accepts", () => {
+  test("notificationChannel's API description still names every channel it accepts", () => {
     const description: string =
       model.getTableColumnMetadata("notificationChannel").description || "";
 
-    for (const channel of Object.values(ComplianceNotificationChannel)) {
+    for (const channel of ALL_CHANNELS) {
       expect(description).toContain(channel);
     }
   });
 
+  test("both channel columns are documented for the API: a client of either finds its field", () => {
+    for (const column of ["notificationChannels", "notificationChannel"]) {
+      expect({
+        column,
+        hidden: Boolean(
+          model.getTableColumnMetadata(column).hideColumnInDocumentation,
+        ),
+        computed: Boolean(model.getTableColumnMetadata(column).computed),
+      }).toEqual({ column, hidden: false, computed: false });
+    }
+  });
+
+  test("the two channel columns have exactly the same access control, so writing one never refuses the other", () => {
+    /*
+     * The settings service writes BOTH columns whenever a payload sends
+     * either (the list, and its first channel beside it), under the caller's
+     * permissions.
+     */
+    expect(accessControlFor("notificationChannels")).toEqual(
+      accessControlFor("notificationChannel"),
+    );
+  });
+
   test.each([
     [
       "incidentSeverities",
@@ -245,8 +330,9 @@ describe("TeamComplianceSetting - the scope columns", () => {
 
   test("whoever may edit any part of a rule may edit all of it", () => {
     /*
-     * The settings service writes the channel and severity columns when a
-     * rule type changes (clearing what the new type does not use), under the
+     * The settings service writes both channel columns and the severity
+     * columns when a rule type changes (clearing what the new type does not
+     * use), and both channel columns whenever either is sent, under the
      * caller's permissions - so they must be exactly as editable as ruleType.
      */
     const ruleTypeAccess: ColumnAccessControl | undefined =
@@ -344,4 +430,94 @@ describe("TeamComplianceSetting - a rule as the API reads and writes it", () =>
 
     expect(setting.notificationChannel).toBeNull();
   });
+
+  test("a posted channel list stays a list of the channels posted, both ways", () => {
+    const json: JSONObject = {
+      ruleType: ComplianceRuleType.HasIncidentOnCallRules,
+      notificationChannels: [
+        ComplianceNotificationChannel.Call,
+        ComplianceNotificationChannel.Push,
+      ],
+      notificationChannel: ComplianceNotificationChannel.Call,
+    };
+
+    const setting: TeamComplianceSetting = BaseModel.fromJSONObject(
+      json,
+      TeamComplianceSetting,
+    );
+
+    /*
+     * A JSON column, not an entity list: the channels are not turned into
+     * models the way a severity list is.
+     */
+    expect(setting.notificationChannels).toEqual([
+      ComplianceNotificationChannel.Call,
+      ComplianceNotificationChannel.Push,
+    ]);
+    expect(setting.notificationChannel).toBe(
+      ComplianceNotificationChannel.Call,
+    );
+
+    const back: JSONObject = BaseModel.toJSONObject(
+      setting,
+      TeamComplianceSetting,
+    );
+
+    expect(back["notificationChannels"]).toEqual([
+      ComplianceNotificationChannel.Call,
+      ComplianceNotificationChannel.Push,
+    ]);
+    expect(back["notificationChannel"]).toBe(
+      ComplianceNotificationChannel.Call,
+    );
+    // And over the wire, as the API sends it.
+    expect(JSON.parse(JSON.stringify(back))["notificationChannels"]).toEqual([
+      "Call",
+      "Push",
+    ]);
+  });
+
+  test("every channel survives the trip in a list", () => {
+    const setting: TeamComplianceSetting = BaseModel.fromJSONObject(
+      {
+        ruleType: ComplianceRuleType.HasAlertEpisodeOnCallRules,
+        notificationChannels: ALL_CHANNELS,
+      },
+      TeamComplianceSetting,
+    );
+
+    expect(
+      BaseModel.toJSONObject(setting, TeamComplianceSetting)[
+        "notificationChannels"
+      ],
+    ).toEqual(ALL_CHANNELS);
+  });
+
+  test.each<[string, JSONValue]>([
+    ["an empty list", []],
+    ["null", null],
+  ])(
+    "a channel list cleared to %s arrives as it was sent - 'any channel'",
+    (_label: string, value: JSONValue) => {
+      const setting: TeamComplianceSetting = BaseModel.fromJSONObject(
+        {
+          ruleType: ComplianceRuleType.HasAlertOnCallRules,
+          notificationChannels: value,
+        },
+        TeamComplianceSetting,
+      );
+
+      expect(setting.notificationChannels).toEqual(value);
+    },
+  );
+
+  test("a rule posted with neither channel field has neither set", () => {
+    const setting: TeamComplianceSetting = BaseModel.fromJSONObject(
+      { ruleType: ComplianceRuleType.HasAlertOnCallRules },
+      TeamComplianceSetting,
+    );
+
+    expect(setting.notificationChannels).toBeUndefined();
+    expect(setting.notificationChannel).toBeUndefined();
+  });
 });

package/Tests/Models/IncidentTemplateCustomFieldSettingsColumn.test.ts

@@ -0,0 +1,291 @@
+import { describe, expect, test } from "@jest/globals";
+import {
+  OpenAPIRegistry,
+  OpenApiGeneratorV3,
+} from "@asteasolutions/zod-to-openapi";
+import IncidentTemplate from "../../Models/DatabaseModels/IncidentTemplate";
+import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import DatabaseRequestType from "../../Server/Types/BaseDatabase/DatabaseRequestType";
+import ColumnPermissions from "../../Server/Types/Database/Permissions/ColumnPermission";
+import { ColumnAccessControl } from "../../Types/BaseDatabase/AccessControl";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { validateCustomFieldCreateSettings } from "../../Types/CustomField/CustomFieldCreateSettings";
+import ColumnType from "../../Types/Database/ColumnType";
+import { TableColumnMetadata } from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import { JSONObject } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
+import Permission, { UserTenantAccessPermission } from "../../Types/Permission";
+import ModelImportExport from "../../Utils/ModelImportExport";
+import { ModelSchema, ModelSchemaType } from "../../Utils/Schema/ModelSchema";
+import fs from "fs";
+import path from "path";
+import { getMetadataArgsStorage } from "typeorm";
+import type { ColumnMetadataArgs } from "typeorm/metadata-args/ColumnMetadataArgs";
+
+/*
+ * IncidentTemplate.customFieldSettings in model metadata and in the
+ * published API, where the OpenAPI spec, the MCP tools and the Terraform
+ * provider all come from (see IncidentCustomFieldApiSchemaContract.test.ts
+ * for how the provider reads a schema).
+ *
+ * What is pinned: the column is documented and writable by whoever may
+ * edit a template - the same people who fill in its custom field values -
+ * its description says how it is keyed (by the field's template variable
+ * key, not its name) and that only the Declare Incident form applies it, it
+ * travels with a template's JSON export (the keys mean the same fields in
+ * the project it is imported into), and it is nullable with no default, so
+ * every existing template keeps asking exactly what it asked before.
+ */
+
+const model: IncidentTemplate = new IncidentTemplate();
+const projectId: ObjectID = ObjectID.generate();
+
+type SchemaGetter = (data: {
+  modelType: new () => BaseModel;
+}) => ModelSchemaType;
+
+function generated(getSchema: SchemaGetter): JSONObject {
+  const registry: OpenAPIRegistry = new OpenAPIRegistry();
+
+  registry.register("Schema", getSchema({ modelType: IncidentTemplate }));
+
+  const document: JSONObject = new OpenApiGeneratorV3(
+    registry.definitions,
+  ).generateComponents() as unknown as JSONObject;
+
+  return ((document["components"] as JSONObject)["schemas"] as JSONObject)[
+    "Schema"
+  ] as JSONObject;
+}
+
+function propertiesOf(schema: JSONObject): JSONObject {
+  return (schema["properties"] || {}) as JSONObject;
+}
+
+function requiredOf(schema: JSONObject): Array<string> {
+  return (schema["required"] as Array<string> | undefined) || [];
+}
+
+const getCreate: SchemaGetter = (data: {
+  modelType: new () => BaseModel;
+}): ModelSchemaType => {
+  return ModelSchema.getCreateModelSchema(data);
+};
+
+const getRead: SchemaGetter = (data: {
+  modelType: new () => BaseModel;
+}): ModelSchemaType => {
+  return ModelSchema.getReadModelSchema(data);
+};
+
+const getUpdate: SchemaGetter = (data: {
+  modelType: new () => BaseModel;
+}): ModelSchemaType => {
+  return ModelSchema.getUpdateModelSchema(data);
+};
+
+function props(permission: Permission): DatabaseCommonInteractionProps {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId,
+    _type: "UserTenantAccessPermission",
+    permissions: [
+      {
+        _type: "UserPermission",
+        permission: permission,
+        labelIds: [],
+        isBlockPermission: false,
+      },
+    ],
+  };
+
+  return {
+    userId: ObjectID.generate(),
+    tenantId: projectId,
+    userTenantAccessPermission: {
+      [projectId.toString()]: tenantPermission,
+    },
+  };
+}
+
+function withSettings(): IncidentTemplate {
+  const data: IncidentTemplate = new IncidentTemplate();
+  data.customFieldSettings = { impact: "Required" };
+  return data;
+}
+
+function metadata(): TableColumnMetadata {
+  return model.getTableColumnMetadata("customFieldSettings");
+}
+
+describe("IncidentTemplate.customFieldSettings in the model", () => {
+  test("has exactly the access of the template's custom field values", () => {
+    const settings: ColumnAccessControl | null =
+      model.getColumnAccessControlFor("customFieldSettings");
+    const values: ColumnAccessControl | null =
+      model.getColumnAccessControlFor("customFields");
+
+    expect(settings).not.toBeNull();
+    expect(settings).toEqual(values);
+  });
+
+  test("is an optional JSON object, nullable, with no default: existing templates are unchanged", () => {
+    expect(metadata().type).toBe(TableColumnType.JSON);
+    expect(metadata().required).toBe(false);
+    expect(metadata().defaultValue).toBeUndefined();
+    expect(model.isDefaultValueColumn("customFieldSettings")).toBe(false);
+
+    const column: ColumnMetadataArgs | undefined =
+      getMetadataArgsStorage().columns.find(
+        (candidate: ColumnMetadataArgs): boolean => {
+          return (
+            candidate.target === IncidentTemplate &&
+            candidate.propertyName === "customFieldSettings"
+          );
+        },
+      );
+
+    expect(column?.options.type).toBe(ColumnType.JSON);
+    expect(column?.options.nullable).toBe(true);
+    expect(column?.options.default).toBeUndefined();
+  });
+
+  test.each([
+    Permission.ProjectMember,
+    Permission.IncidentMember,
+    Permission.IncidentAdmin,
+    Permission.ProjectAdmin,
+  ])(
+    "%s, who may edit templates, may set them on create and change them",
+    (permission: Permission) => {
+      expect(() => {
+        ColumnPermissions.checkDataColumnPermissions(
+          IncidentTemplate,
+          withSettings(),
+          props(permission),
+          DatabaseRequestType.Create,
+        );
+        ColumnPermissions.checkDataColumnPermissions(
+          IncidentTemplate,
+          withSettings(),
+          props(permission),
+          DatabaseRequestType.Update,
+        );
+      }).not.toThrow();
+    },
+  );
+
+  test("the granular template permissions reach it the way they reach the values", () => {
+    expect(() => {
+      ColumnPermissions.checkDataColumnPermissions(
+        IncidentTemplate,
+        withSettings(),
+        props(Permission.CreateIncidentTemplate),
+        DatabaseRequestType.Create,
+      );
+      ColumnPermissions.checkDataColumnPermissions(
+        IncidentTemplate,
+        withSettings(),
+        props(Permission.EditIncidentTemplate),
+        DatabaseRequestType.Update,
+      );
+    }).not.toThrow();
+  });
+
+  test.each([
+    Permission.Viewer,
+    Permission.IncidentViewer,
+    Permission.ReadIncidentTemplate,
+  ])(
+    "%s, who only reads templates, may not change them",
+    (permission: Permission) => {
+      expect(() => {
+        ColumnPermissions.checkDataColumnPermissions(
+          IncidentTemplate,
+          withSettings(),
+          props(permission),
+          DatabaseRequestType.Update,
+        );
+      }).toThrow("customFieldSettings");
+    },
+  );
+
+  test("travels with a template's JSON export, next to its values", () => {
+    const exported: Array<string> =
+      ModelImportExport.getImportExportableColumnNames(IncidentTemplate);
+
+    expect(exported).toContain("customFieldSettings");
+    expect(exported).toContain("customFields");
+  });
+});
+
+describe("IncidentTemplate.customFieldSettings in the published API", () => {
+  const create: JSONObject = generated(getCreate);
+  const read: JSONObject = generated(getRead);
+  const update: JSONObject = generated(getUpdate);
+
+  test("is documented, not hidden from the API reference", () => {
+    expect(metadata().hideColumnInDocumentation).toBeFalsy();
+  });
+
+  test("is writable on create and update, returned on read, and never required", () => {
+    expect(propertiesOf(create)["customFieldSettings"]).toBeDefined();
+    expect(propertiesOf(update)["customFieldSettings"]).toBeDefined();
+    expect(propertiesOf(read)["customFieldSettings"]).toBeDefined();
+    expect(requiredOf(create)).not.toContain("customFieldSettings");
+  });
+
+  test("is published as an object with no default for the provider to send", () => {
+    const property: JSONObject = propertiesOf(create)[
+      "customFieldSettings"
+    ] as JSONObject;
+
+    expect(property["type"]).toBe("object");
+    expect(property).not.toHaveProperty("default");
+  });
+
+  test("the description says how it is keyed, what each value does, and who applies it", () => {
+    const description: string = String(metadata().description);
+
+    // Keyed by the key that survives a rename, never by the name.
+    expect(description).toContain("template variable key (variableKey)");
+    for (const setting of ["Required", "Optional", "Hidden", "Default"]) {
+      expect(description).toContain(setting);
+    }
+    // What an unlisted field does.
+    expect(description).toContain("not listed");
+    expect(description).toContain("Show on Create and Required on Create");
+    // Dashboard only, like Required on Create itself.
+    expect(description).toContain(
+      "Only the dashboard's Declare Incident form applies these settings",
+    );
+    expect(description).toContain(
+      "incidents created through the API are not checked against them",
+    );
+  });
+
+  test("its example is a value the server accepts", () => {
+    expect(metadata().example).toEqual({
+      impact: "Required",
+      affected_location: "Optional",
+      additional_information: "Hidden",
+    });
+    expect(validateCustomFieldCreateSettings(metadata().example)).toBeNull();
+  });
+});
+
+describe("the API does not enforce a template's settings", () => {
+  /*
+   * The description promises the settings are the dashboard's alone, as the
+   * project-wide Required on Create is. If IncidentService ever starts
+   * reading them, that promise - and the docs - must change with it.
+   */
+  test("IncidentService never reads customFieldSettings", () => {
+    const source: string = fs.readFileSync(
+      path.join(__dirname, "../../Server/Services/IncidentService.ts"),
+      "utf8",
+    );
+
+    expect(source).not.toContain("customFieldSettings");
+  });
+});