@oneuptime/common 14.0.10 → 14.0.11

package/Tests/Server/Services/AIServiceDailyBudget.test.ts

@@ -30,7 +30,7 @@ import { describe, expect, test, afterEach } from "@jest/globals";
 
 /*
  * G4 daily budget: incident and alert work have independent per-UTC-day token
- * lanes; subjectless work retains Project.aiDailyAutonomousTokenLimit. The
+ * lanes; subjectless work has no daily token limit. The
  * engine skips new investigations quietly when its lane is exhausted (no Error
  * run created); AIService.executeWithLogging is the hard backstop mid-run.
  * Interactive chat is never blocked — its features are not autonomous.
@@ -42,10 +42,11 @@ import { describe, expect, test, afterEach } from "@jest/globals";
  *   (d) the engine skips run creation when the budget is exhausted.
  */
 
+// A project whose incident lane carries the given daily token limit.
 function fakeProject(limit: number | undefined): Project {
   return {
     id: ObjectID.generate(),
-    aiDailyAutonomousTokenLimit: limit,
+    incidentAiDailyAutonomousTokenLimit: limit,
   } as unknown as Project;
 }
 
@@ -56,6 +57,7 @@ function fakeProjectWithLaneLimits(data: {
 }): Project {
   return {
     id: ObjectID.generate(),
+    // The legacy column is ignored; set it to prove nothing reads it.
     aiDailyAutonomousTokenLimit: data.subjectless,
     incidentAiDailyAutonomousTokenLimit: data.incident,
     alertAiDailyAutonomousTokenLimit: data.alert,
@@ -175,6 +177,27 @@ describe("AIService.getAutonomousDailyBudgetStatus", () => {
     expect(findProject).not.toHaveBeenCalled();
   });
 
+  test("subjectless work has no limit and reads no project settings", async () => {
+    const findProject: jest.SpyInstance = jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(fakeProjectWithLaneLimits({ subjectless: 0 }));
+    const getTokens: jest.SpyInstance = jest.spyOn(
+      LlmLogService,
+      "getTotalTokensUsedSince",
+    );
+
+    const status: AutonomousBudgetStatus =
+      await AIService.getAutonomousDailyBudgetStatus(projectId);
+
+    expect(status).toEqual({
+      exhausted: false,
+      limitInTokens: null,
+      usedTokensToday: 0,
+    });
+    expect(findProject).not.toHaveBeenCalled();
+    expect(getTokens).not.toHaveBeenCalled();
+  });
+
   test("no configured limit means never exhausted and no usage query", async () => {
     jest
       .spyOn(ProjectService, "findOneById")
@@ -185,7 +208,9 @@ describe("AIService.getAutonomousDailyBudgetStatus", () => {
     );
 
     const status: AutonomousBudgetStatus =
-      await AIService.getAutonomousDailyBudgetStatus(projectId);
+      await AIService.getAutonomousDailyBudgetStatus(projectId, {
+        incidentId: ObjectID.generate(),
+      });
 
     expect(status.exhausted).toBe(false);
     expect(status.limitInTokens).toBeNull();
@@ -200,7 +225,9 @@ describe("AIService.getAutonomousDailyBudgetStatus", () => {
     );
 
     const status: AutonomousBudgetStatus =
-      await AIService.getAutonomousDailyBudgetStatus(projectId);
+      await AIService.getAutonomousDailyBudgetStatus(projectId, {
+        incidentId: ObjectID.generate(),
+      });
 
     expect(status.exhausted).toBe(true);
     expect(status.limitInTokens).toBe(0);
@@ -208,6 +235,7 @@ describe("AIService.getAutonomousDailyBudgetStatus", () => {
   });
 
   test("usage below the limit is not exhausted", async () => {
+    const incidentId: ObjectID = ObjectID.generate();
     jest
       .spyOn(ProjectService, "findOneById")
       .mockResolvedValue(fakeProject(100_000));
@@ -216,14 +244,14 @@ describe("AIService.getAutonomousDailyBudgetStatus", () => {
       .mockResolvedValue(99_999);
 
     const status: AutonomousBudgetStatus =
-      await AIService.getAutonomousDailyBudgetStatus(projectId);
+      await AIService.getAutonomousDailyBudgetStatus(projectId, { incidentId });
 
     expect(status.exhausted).toBe(false);
     expect(status.limitInTokens).toBe(100_000);
     expect(status.usedTokensToday).toBe(99_999);
     expect(LlmLogService.getTotalTokensUsedSince).toHaveBeenCalledWith(
       expect.objectContaining({
-        incidentId: undefined,
+        incidentId,
         alertId: undefined,
       }),
     );
@@ -238,7 +266,9 @@ describe("AIService.getAutonomousDailyBudgetStatus", () => {
       .mockResolvedValue(100_000);
 
     const status: AutonomousBudgetStatus =
-      await AIService.getAutonomousDailyBudgetStatus(projectId);
+      await AIService.getAutonomousDailyBudgetStatus(projectId, {
+        incidentId: ObjectID.generate(),
+      });
 
     expect(status.exhausted).toBe(true);
     expect(getTokens).toHaveBeenCalledWith(
@@ -274,7 +304,6 @@ describe("AIService.getAutonomousDailyBudgetStatus", () => {
     expect(findProject).toHaveBeenCalledWith(
       expect.objectContaining({
         select: {
-          aiDailyAutonomousTokenLimit: true,
           incidentAiDailyAutonomousTokenLimit: true,
           alertAiDailyAutonomousTokenLimit: true,
         },

package/Tests/Server/Services/IncidentCreatedFeedTitle.test.ts

@@ -0,0 +1,212 @@
+import IncidentFeedService from "../../../Server/Services/IncidentFeedService";
+import IncidentService from "../../../Server/Services/IncidentService";
+import Markdown, { MarkdownContentType } from "../../../Server/Types/Markdown";
+import LinkedAffectedResources from "../../../Server/Utils/AffectedResources/LinkedAffectedResources";
+import IncidentWorkspaceMessages from "../../../Server/Utils/Workspace/WorkspaceMessages/Incident";
+import SlackUtil from "../../../Server/Utils/Workspace/Slack/Slack";
+import Incident from "../../../Models/DatabaseModels/Incident";
+import ObjectID from "../../../Types/ObjectID";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import { Token, Tokens, marked } from "marked";
+
+/*
+ * An incident's title is plain text, typed by whoever declared it - since
+ * incident forms, that is anyone holding a form's link - and the "Incident
+ * Created" feed item places it into Markdown that the dashboard renders
+ * without its safe mode, that is posted to Slack and Teams, and that owners
+ * read in email. So the title is escaped where it is placed, as MarkdownEscape
+ * says a title must be: a title cannot become a link, an image fetched when
+ * the feed is opened, raw HTML, or a Slack channel mention - and an ordinary
+ * title still reads exactly as typed.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "0194d4ba-0000-4000-8000-00000000f201",
+);
+const INCIDENT_ID: ObjectID = new ObjectID(
+  "0194d4ba-0000-4000-8000-00000000f202",
+);
+
+type CreateIncidentFeedAsyncFunction = (incident: Incident) => Promise<void>;
+
+let feedItem: ReturnType<typeof jest.spyOn>;
+
+beforeEach(() => {
+  feedItem = jest
+    .spyOn(IncidentFeedService, "createIncidentFeedItem")
+    .mockResolvedValue(undefined as never);
+  jest
+    .spyOn(LinkedAffectedResources, "readForIncident")
+    .mockResolvedValue([] as never);
+  jest
+    .spyOn(IncidentWorkspaceMessages, "getIncidentCreateMessageBlocks")
+    .mockResolvedValue([] as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+async function createdFeedFor(title: string): Promise<string> {
+  const incident: Incident = new Incident();
+  incident._id = INCIDENT_ID.toString();
+  incident.projectId = PROJECT_ID;
+  incident.incidentNumber = 7;
+  incident.incidentNumberWithPrefix = "INC-7";
+  incident.title = title;
+  incident.description = "Every order fails.";
+
+  await (
+    IncidentService as unknown as {
+      createIncidentFeedAsync: CreateIncidentFeedAsyncFunction;
+    }
+  ).createIncidentFeedAsync(incident);
+
+  expect(feedItem).toHaveBeenCalledTimes(1);
+
+  return (feedItem.mock.calls[0]![0] as { feedInfoInMarkdown: string })
+    .feedInfoInMarkdown;
+}
+
+function tokensOf(markdown: string): Array<Token> {
+  const tokens: Array<Token> = [];
+
+  marked.walkTokens(marked.lexer(markdown), (token: Token): void => {
+    tokens.push(token);
+  });
+
+  return tokens;
+}
+
+function typesOf(markdown: string): Array<string> {
+  return tokensOf(markdown).map((token: Token): string => {
+    return token.type;
+  });
+}
+
+// The title line of the feed item: the bold text right after the heading.
+function titleLine(markdown: string): string {
+  return markdown.split("\n").find((line: string): boolean => {
+    return line.startsWith("**");
+  })!;
+}
+
+function slackText(markdown: string): string {
+  return JSON.stringify(
+    SlackUtil.getMarkdownBlocks({
+      payloadMarkdownBlock: {
+        _type: "WorkspacePayloadMarkdown",
+        text: markdown,
+      },
+    }),
+  );
+}
+
+describe("the incident created feed item's title", () => {
+  test("an ordinary title reads exactly as typed", async () => {
+    const markdown: string = await createdFeedFor("Site 03 - payments (EU)");
+
+    expect(titleLine(markdown)).toBe("**Site 03 - payments (EU)**:");
+    expect(slackText(markdown)).toContain("Site 03 - payments (EU)");
+    expect(
+      await Markdown.convertToHTML(markdown, MarkdownContentType.Email),
+    ).toContain("Site 03 - payments (EU)");
+  });
+
+  test("an image in the title is not fetched: it arrives as the characters typed", async () => {
+    const markdown: string = await createdFeedFor(
+      "![x](https://tracker.example/p.png)",
+    );
+
+    expect(titleLine(markdown)).toBe(
+      "**!\\[x\\](https://tracker.example/p.png)**:",
+    );
+    expect(typesOf(titleLine(markdown))).not.toContain("image");
+
+    const html: string = await Markdown.convertToHTML(
+      markdown,
+      MarkdownContentType.Email,
+    );
+
+    expect(html).not.toContain("<img");
+    /*
+     * The bare address may still become a link, which shows where it goes;
+     * the text reads as typed.
+     */
+    expect(html.replace(/<[^>]+>/g, "")).toContain(
+      "![x](https://tracker.example/p.png)",
+    );
+  });
+
+  test("a link in the title is not a link that hides where it goes", async () => {
+    const markdown: string = await createdFeedFor(
+      "[Reset your password](https://evil.example/login)",
+    );
+
+    const links: Array<Tokens.Link> = tokensOf(titleLine(markdown)).filter(
+      (token: Token): boolean => {
+        return token.type === "link";
+      },
+    ) as Array<Tokens.Link>;
+
+    // Only the bare address stays a link, showing the address it goes to.
+    expect(
+      links.map((link: Tokens.Link): string => {
+        return link.text;
+      }),
+    ).not.toContain("Reset your password");
+    expect(
+      await Markdown.convertToHTML(markdown, MarkdownContentType.Email),
+    ).toContain("[Reset your password]");
+  });
+
+  test("raw HTML in the title reads as text", async () => {
+    const markdown: string = await createdFeedFor(
+      "<img src=x onerror=alert(1)>",
+    );
+
+    expect(typesOf(titleLine(markdown))).not.toContain("html");
+  });
+
+  test.each([
+    ["<!channel> Checkout is down"],
+    ["<!here> ping"],
+    ["<#C0123ABC>"],
+  ])("%j does not reach Slack as a mention", async (title: string) => {
+    const markdown: string = await createdFeedFor(title);
+
+    expect(slackText(markdown)).not.toMatch(/<(![a-z]|#C)/);
+    expect(slackText(markdown)).toContain("&lt;");
+  });
+
+  test("a backslash at the end of the title does not undo the bold around it", async () => {
+    const markdown: string = await createdFeedFor("C:\\temp\\");
+
+    expect(titleLine(markdown)).toBe("**C:\\\\temp\\\\**:");
+    expect(
+      await Markdown.convertToHTML(
+        titleLine(markdown),
+        MarkdownContentType.Email,
+      ),
+    ).toContain("<strong>C:\\temp\\</strong>");
+  });
+
+  test("a missing title still says so", async () => {
+    const markdown: string = await createdFeedFor("");
+
+    expect(titleLine(markdown)).toBe("**No title provided.**:");
+  });
+
+  test("the description stays Markdown", async () => {
+    const markdown: string = await createdFeedFor("Checkout is down");
+
+    expect(markdown).toContain("\n\nEvery order fails.\n\n");
+  });
+});

package/Tests/Server/Services/IncidentCustomFieldDeleteFormQuestions.test.ts

@@ -0,0 +1,297 @@
+jest.mock("../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+    },
+    getLogAttributesFromRequest: jest.fn().mockReturnValue({}),
+  };
+});
+
+import IncidentCustomField from "../../../Models/DatabaseModels/IncidentCustomField";
+import IncidentCustomFieldService from "../../../Server/Services/IncidentCustomFieldService";
+import IncidentFormService from "../../../Server/Services/IncidentFormService";
+import IncidentTemplateService from "../../../Server/Services/IncidentTemplateService";
+import DeleteBy from "../../../Server/Types/Database/DeleteBy";
+import { OnDelete } from "../../../Server/Types/Database/Hooks";
+import logger from "../../../Server/Utils/Logger";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../../Types/ObjectID";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * A public incident form asks custom fields by template key, and a field
+ * created later with the same name - or any name that gives the same key -
+ * gets that key back. Left on the form, a deleted field's key would put the
+ * new field, with its own description and dropdown options, straight onto
+ * the public form, which no admin chose. So deleting an incident custom
+ * field takes its key off every form of its project - one raw statement per
+ * field, so no form's "On Update" workflow runs - and leaves incident
+ * templates alone: a template keeps its setting for a field created again.
+ *
+ * The hooks are driven directly; the statement itself is pinned against a
+ * fake repository, and against a real Postgres in IncidentFormPostgres.test.ts.
+ */
+
+type MockedFn = ReturnType<typeof jest.fn>;
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "0194d4ba-0000-4000-8000-00000000f301",
+);
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "0194d4ba-0000-4000-8000-00000000f302",
+);
+const CUSTOMER_ID: string = "0194d4ba-0000-4000-8000-00000000f303";
+const REGION_ID: string = "0194d4ba-0000-4000-8000-00000000f304";
+
+const ADMIN_PROPS: DatabaseCommonInteractionProps = {
+  tenantId: PROJECT_ID,
+  userId: new ObjectID("0194d4ba-0000-4000-8000-00000000f305"),
+};
+
+type HookFunction = (...args: Array<unknown>) => Promise<unknown>;
+
+function callHook<T>(name: string, ...args: Array<unknown>): Promise<T> {
+  const hooks: Record<string, HookFunction> =
+    IncidentCustomFieldService as unknown as Record<string, HookFunction>;
+  return hooks[name]!.apply(IncidentCustomFieldService, args) as Promise<T>;
+}
+
+function field(data: {
+  id: string;
+  projectId: ObjectID;
+  variableKey: string;
+}): IncidentCustomField {
+  const row: IncidentCustomField = new IncidentCustomField();
+  row._id = data.id;
+  row.projectId = data.projectId;
+  row.variableKey = data.variableKey;
+  return row;
+}
+
+let fieldFindBy: MockedFn;
+let removeFromForms: MockedFn;
+
+beforeEach(() => {
+  fieldFindBy = jest
+    .spyOn(IncidentCustomFieldService, "findBy")
+    .mockResolvedValue([
+      field({
+        id: CUSTOMER_ID,
+        projectId: PROJECT_ID,
+        variableKey: "customer",
+      }),
+      field({
+        id: REGION_ID,
+        projectId: OTHER_PROJECT_ID,
+        variableKey: "region",
+      }),
+    ] as never) as unknown as MockedFn;
+
+  removeFromForms = jest
+    .spyOn(IncidentFormService, "removeCustomFieldFromQuestions")
+    .mockResolvedValue(1 as never) as unknown as MockedFn;
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+  jest.clearAllMocks();
+});
+
+async function deleteFields(
+  deletedIds: Array<string>,
+  props: DatabaseCommonInteractionProps = ADMIN_PROPS,
+): Promise<OnDelete<IncidentCustomField>> {
+  const deleteBy: DeleteBy<IncidentCustomField> = {
+    query: { _id: CUSTOMER_ID },
+    props: props,
+    limit: 1,
+    skip: 0,
+  };
+
+  const onDelete: OnDelete<IncidentCustomField> = await callHook<
+    OnDelete<IncidentCustomField>
+  >("onBeforeDelete", deleteBy);
+
+  return await callHook<OnDelete<IncidentCustomField>>(
+    "onDeleteSuccess",
+    onDelete,
+    deletedIds.map((id: string): ObjectID => {
+      return new ObjectID(id);
+    }),
+  );
+}
+
+describe("deleting an incident custom field takes it off the incident forms", () => {
+  test("reads the fields about to go before they are gone, as root, limited to the caller's project", async () => {
+    await deleteFields([CUSTOMER_ID]);
+
+    expect(fieldFindBy).toHaveBeenCalledTimes(1);
+
+    const findBy: {
+      query: Record<string, unknown>;
+      select: Record<string, unknown>;
+      props: DatabaseCommonInteractionProps;
+    } = fieldFindBy.mock.calls[0]![0] as never;
+
+    expect(findBy.query).toEqual({ _id: CUSTOMER_ID, projectId: PROJECT_ID });
+    expect(findBy.select).toEqual({
+      _id: true,
+      projectId: true,
+      variableKey: true,
+    });
+    expect(findBy.props).toEqual({ isRoot: true });
+  });
+
+  test("a root delete reads by the delete's own query", async () => {
+    await deleteFields([CUSTOMER_ID], { isRoot: true });
+
+    expect(
+      (fieldFindBy.mock.calls[0]![0] as { query: Record<string, unknown> })
+        .query,
+    ).toEqual({ _id: CUSTOMER_ID });
+  });
+
+  test("removes each deleted field's key from the forms of its own project, once", async () => {
+    await deleteFields([CUSTOMER_ID, REGION_ID]);
+
+    expect(removeFromForms).toHaveBeenCalledTimes(2);
+    expect(
+      removeFromForms.mock.calls.map((call: Array<unknown>): string => {
+        const removed: { projectId: ObjectID; variableKey: string } =
+          call[0] as { projectId: ObjectID; variableKey: string };
+        return `${removed.projectId.toString()}:${removed.variableKey}`;
+      }),
+    ).toEqual([
+      `${PROJECT_ID.toString()}:customer`,
+      `${OTHER_PROJECT_ID.toString()}:region`,
+    ]);
+  });
+
+  test("leaves the forms alone for a field the delete did not remove", async () => {
+    await deleteFields([CUSTOMER_ID]);
+
+    expect(removeFromForms).toHaveBeenCalledTimes(1);
+    expect(
+      (removeFromForms.mock.calls[0]![0] as { variableKey: string })
+        .variableKey,
+    ).toBe("customer");
+
+    removeFromForms.mockClear();
+
+    await deleteFields([]);
+
+    expect(removeFromForms).not.toHaveBeenCalled();
+  });
+
+  test("never touches an incident template: a template keeps its setting for a field created again", async () => {
+    const templateWrites: Array<MockedFn> = [
+      "updateBy",
+      "updateOneById",
+      "updateOneBy",
+      "getRepository",
+    ].map((method: string): MockedFn => {
+      return jest
+        .spyOn(
+          IncidentTemplateService as unknown as Record<
+            string,
+            (...args: Array<unknown>) => unknown
+          >,
+          method,
+        )
+        .mockImplementation((() => {
+          throw new Error(`IncidentTemplateService.${method} was called`);
+        }) as never) as unknown as MockedFn;
+    });
+
+    await deleteFields([CUSTOMER_ID, REGION_ID]);
+
+    for (const write of templateWrites) {
+      expect(write).not.toHaveBeenCalled();
+    }
+  });
+
+  test("a failure is logged, the next field is still handled, and the delete stands", async () => {
+    removeFromForms.mockRejectedValueOnce(new Error("connection reset"));
+
+    await expect(deleteFields([CUSTOMER_ID, REGION_ID])).resolves.toBeDefined();
+
+    expect(removeFromForms).toHaveBeenCalledTimes(2);
+    expect(logger.error).toHaveBeenCalledWith(
+      expect.stringContaining(
+        'could not take the deleted incident custom field "customer" off the incident forms',
+      ),
+      expect.objectContaining({ projectId: PROJECT_ID.toString() }),
+    );
+  });
+});
+
+describe("IncidentFormService.removeCustomFieldFromQuestions", () => {
+  let query: MockedFn;
+
+  beforeEach(() => {
+    removeFromForms.mockRestore();
+
+    query = jest.fn(async (): Promise<unknown> => {
+      return [{ count: 3 }];
+    }) as unknown as MockedFn;
+
+    jest.spyOn(IncidentFormService, "getRepository").mockReturnValue({
+      metadata: {
+        tableName: "IncidentForm",
+        findColumnWithPropertyName: (
+          propertyName: string,
+        ): { databaseName: string } => {
+          return { databaseName: propertyName };
+        },
+      },
+      manager: { query: query },
+    } as never);
+  });
+
+  test("removes the key with one statement on the project's forms, bound, answering with how many asked it", async () => {
+    expect(
+      await IncidentFormService.removeCustomFieldFromQuestions({
+        projectId: PROJECT_ID,
+        variableKey: "customer",
+      }),
+    ).toBe(3);
+
+    expect(query).toHaveBeenCalledTimes(1);
+
+    const [sql, parameters] = query.mock.calls[0] as [string, Array<unknown>];
+
+    expect(parameters).toEqual([PROJECT_ID.toString(), "customer"]);
+    expect(sql.replace(/\s+/g, " ")).toContain(
+      'UPDATE "IncidentForm" SET "customFieldSettings" = "customFieldSettings" - $2::text WHERE "projectId" = $1 AND jsonb_typeof("customFieldSettings") = \'object\' AND jsonb_exists("customFieldSettings", $2::text)',
+    );
+    // No version bump and no updatedAt: nobody changed the form.
+    expect(sql).not.toContain("version");
+    expect(sql).not.toContain("updatedAt");
+    // The key is a bound value, never part of the statement.
+    expect(sql).not.toContain("customer");
+  });
+
+  test("starts no form's workflow", async () => {
+    const workflow: MockedFn = jest
+      .spyOn(IncidentFormService, "onTriggerWorkflow")
+      .mockResolvedValue(undefined as never) as unknown as MockedFn;
+
+    await IncidentFormService.removeCustomFieldFromQuestions({
+      projectId: PROJECT_ID,
+      variableKey: "customer",
+    });
+
+    expect(workflow).not.toHaveBeenCalled();
+  });
+});