@oneuptime/common 14.0.10 → 14.0.11

package/Tests/Server/Types/Database/Permissions/SsoScalePlanGate.test.ts

@@ -0,0 +1,418 @@
+import {
+  afterAll,
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+import BillingPermissions from "../../../../../Server/Types/Database/Permissions/BillingPermission";
+import ColumnPermissions from "../../../../../Server/Types/Database/Permissions/ColumnPermission";
+import TablePermission from "../../../../../Server/Types/Database/Permissions/TablePermission";
+import DatabaseRequestType from "../../../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import logger from "../../../../../Server/Utils/Logger";
+import BaseModel, {
+  DatabaseBaseModelType,
+} from "../../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import GlobalOIDC from "../../../../../Models/DatabaseModels/GlobalOidc";
+import GlobalOIDCProject from "../../../../../Models/DatabaseModels/GlobalOidcProject";
+import GlobalSSO from "../../../../../Models/DatabaseModels/GlobalSso";
+import GlobalSSOProject from "../../../../../Models/DatabaseModels/GlobalSsoProject";
+import Project from "../../../../../Models/DatabaseModels/Project";
+import ProjectOIDC from "../../../../../Models/DatabaseModels/ProjectOidc";
+import ProjectSCIM from "../../../../../Models/DatabaseModels/ProjectSCIM";
+import ProjectSSO from "../../../../../Models/DatabaseModels/ProjectSso";
+import StatusPageOIDC from "../../../../../Models/DatabaseModels/StatusPageOidc";
+import StatusPageSCIM from "../../../../../Models/DatabaseModels/StatusPageSCIM";
+import StatusPageSSO from "../../../../../Models/DatabaseModels/StatusPageSso";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { PlanType } from "../../../../../Types/Billing/SubscriptionPlan";
+import PaymentRequiredException from "../../../../../Types/Exception/PaymentRequiredException";
+import ObjectID from "../../../../../Types/ObjectID";
+import Permission, {
+  UserTenantAccessPermission,
+} from "../../../../../Types/Permission";
+import {
+  createEditionStateCases,
+  EditionStateCase,
+  uninstallEnterpriseModule,
+} from "../../../Enterprise/FakeEnterpriseModule";
+import { setTestBillingEnabled } from "../../../Enterprise/TestBillingFlag";
+
+/*
+ * OneUptime Cloud (billing on) sells single sign-on on the Scale plan, and
+ * that is decided by BillingPermission from each model's
+ * @TableBillingAccessControl(PlanType.Scale) - never by the edition or the
+ * license. For the project and status page SAML/OIDC providers (ProjectSSO,
+ * ProjectOIDC, StatusPageSSO, StatusPageOIDC):
+ *
+ *   - below Scale (Free, Growth): creating, reading, updating and deleting
+ *     them is refused with a 402 that names the plan;
+ *   - on Scale and above (Scale, Enterprise): allowed;
+ *   - whatever the edition and the license say, since on the Cloud the plan
+ *     is the only gate (EditionPermission never refuses with billing on).
+ *
+ * A project's own "Require SSO for login" switch is Scale-gated the same way
+ * (Project.requireSsoForLogin's @ColumnBillingAccessControl). Global SSO/OIDC
+ * (master admins only) has no plan gate. SCIM stays on Scale too. And with
+ * billing off - every self-hosted install, Community or Enterprise - no plan
+ * gate applies at all, whatever plan the props carry.
+ *
+ * The plans are read from SUBSCRIPTION_PLAN_* in the environment, which this
+ * suite sets itself (and restores), so it does not depend on the config file
+ * it runs with.
+ */
+jest.mock("../../../../../Server/EnvironmentConfig", () => {
+  const billingFlag: typeof import("../../../Enterprise/TestBillingFlag") =
+    jest.requireActual(
+      "../../../Enterprise/TestBillingFlag",
+    ) as typeof import("../../../Enterprise/TestBillingFlag");
+
+  return billingFlag.withLiveBillingFlag(
+    jest.requireActual("../../../../../Server/EnvironmentConfig") as Record<
+      string,
+      unknown
+    >,
+  );
+});
+
+type ModelType = DatabaseBaseModelType;
+
+const PLAN_ENVIRONMENT: Record<string, string> = {
+  SUBSCRIPTION_PLAN_BASIC: "Free,price_free_month,price_free_year,0,0,1,0",
+  SUBSCRIPTION_PLAN_GROWTH:
+    "Growth,price_growth_month,price_growth_year,22,20,2,14",
+  SUBSCRIPTION_PLAN_SCALE:
+    "Scale,price_scale_month,price_scale_year,99,84,3,14",
+  SUBSCRIPTION_PLAN_ENTERPRISE:
+    "Enterprise,price_enterprise_month,price_enterprise_year,-1,-1,4,14",
+};
+
+const SCALE_REFUSAL: string =
+  "Please upgrade your plan to Scale to access this feature";
+
+const PLANS_BELOW_SCALE: ReadonlyArray<PlanType> = [
+  PlanType.Free,
+  PlanType.Growth,
+];
+
+const PLANS_FROM_SCALE: ReadonlyArray<PlanType> = [
+  PlanType.Scale,
+  PlanType.Enterprise,
+];
+
+const SSO_PROVIDER_MODELS: ReadonlyArray<[string, ModelType]> = [
+  ["ProjectSSO", ProjectSSO],
+  ["ProjectOIDC", ProjectOIDC],
+  ["StatusPageSSO", StatusPageSSO],
+  ["StatusPageOIDC", StatusPageOIDC],
+];
+
+const GLOBAL_SSO_MODELS: ReadonlyArray<[string, ModelType]> = [
+  ["GlobalSSO", GlobalSSO],
+  ["GlobalOIDC", GlobalOIDC],
+  ["GlobalSSOProject", GlobalSSOProject],
+  ["GlobalOIDCProject", GlobalOIDCProject],
+];
+
+const SCIM_MODELS: ReadonlyArray<[string, ModelType]> = [
+  ["ProjectSCIM", ProjectSCIM],
+  ["StatusPageSCIM", StatusPageSCIM],
+];
+
+// What TablePermission checks; updates are checked by the column-aware path.
+const TABLE_OPERATIONS: ReadonlyArray<DatabaseRequestType> = [
+  DatabaseRequestType.Create,
+  DatabaseRequestType.Read,
+  DatabaseRequestType.Delete,
+];
+
+const ALL_OPERATIONS: ReadonlyArray<DatabaseRequestType> = [
+  ...TABLE_OPERATIONS,
+  DatabaseRequestType.Update,
+];
+
+const EDITION_CASES: Array<EditionStateCase> = createEditionStateCases();
+
+const CLOUD_STATES: Array<[string, EditionStateCase]> = EDITION_CASES.filter(
+  (state: EditionStateCase): boolean => {
+    return state.billing;
+  },
+).map((state: EditionStateCase): [string, EditionStateCase] => {
+  return [state.label, state];
+});
+
+const SELF_HOSTED_STATES: Array<[string, EditionStateCase]> =
+  EDITION_CASES.filter((state: EditionStateCase): boolean => {
+    return !state.billing;
+  }).map((state: EditionStateCase): [string, EditionStateCase] => {
+    return [state.label, state];
+  });
+
+const projectId: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const userId: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+
+// A project owner on the given plan.
+const ownerOnPlan: (plan: PlanType) => DatabaseCommonInteractionProps = (
+  plan: PlanType,
+): DatabaseCommonInteractionProps => {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId,
+    _type: "UserTenantAccessPermission",
+    permissions: [
+      {
+        _type: "UserPermission",
+        permission: Permission.ProjectOwner,
+        labelIds: [],
+        isBlockPermission: false,
+      },
+    ],
+  } as UserTenantAccessPermission;
+
+  return {
+    userId,
+    tenantId: projectId,
+    currentPlan: plan,
+    isSubscriptionUnpaid: false,
+    userTenantAccessPermission: {
+      [projectId.toString()]: tenantPermission,
+    },
+  };
+};
+
+// The plan check an operation runs through, as the database layer runs it.
+const checkPlan: (input: {
+  modelType: ModelType;
+  operation: DatabaseRequestType;
+  plan: PlanType;
+}) => "allowed" | string = (input: {
+  modelType: ModelType;
+  operation: DatabaseRequestType;
+  plan: PlanType;
+}): "allowed" | string => {
+  try {
+    if (input.operation === DatabaseRequestType.Update) {
+      BillingPermissions.checkBillingPermissions(
+        input.modelType,
+        ownerOnPlan(input.plan),
+        input.operation,
+      );
+    } else {
+      TablePermission.checkTableLevelPermissions(
+        input.modelType,
+        ownerOnPlan(input.plan),
+        input.operation,
+      );
+    }
+
+    return "allowed";
+  } catch (err) {
+    if (err instanceof PaymentRequiredException) {
+      return err.message;
+    }
+
+    throw err;
+  }
+};
+
+describe("single sign-on on OneUptime Cloud: the Scale plan gate", () => {
+  const savedPlanEnvironment: Record<string, string | undefined> = {};
+
+  beforeAll(() => {
+    for (const key of Object.keys(process.env)) {
+      if (key.startsWith("SUBSCRIPTION_PLAN_")) {
+        savedPlanEnvironment[key] = process.env[key];
+        delete process.env[key];
+      }
+    }
+
+    Object.assign(process.env, PLAN_ENVIRONMENT);
+  });
+
+  afterAll(() => {
+    for (const key of Object.keys(PLAN_ENVIRONMENT)) {
+      delete process.env[key];
+    }
+
+    for (const [key, value] of Object.entries(savedPlanEnvironment)) {
+      if (value !== undefined) {
+        process.env[key] = value;
+      }
+    }
+  });
+
+  beforeEach(() => {
+    setTestBillingEnabled(true);
+    uninstallEnterpriseModule();
+    jest.spyOn(logger, "debug").mockImplementation((): void => {
+      return undefined;
+    });
+  });
+
+  afterEach(() => {
+    uninstallEnterpriseModule();
+    setTestBillingEnabled(false);
+    jest.restoreAllMocks();
+  });
+
+  test("the four provider models are Scale-gated for every operation, and carry no edition gate", () => {
+    for (const [, modelType] of SSO_PROVIDER_MODELS) {
+      const model: BaseModel = new modelType();
+
+      expect({
+        create: model.createBillingPlan,
+        read: model.readBillingPlan,
+        update: model.updateBillingPlan,
+        delete: model.deleteBillingPlan,
+      }).toEqual({
+        create: PlanType.Scale,
+        read: PlanType.Scale,
+        update: PlanType.Scale,
+        delete: PlanType.Scale,
+      });
+      expect(model.requiresEnterprise).toBeFalsy();
+    }
+  });
+
+  describe.each(CLOUD_STATES)(
+    "%s",
+    (_label: string, state: EditionStateCase) => {
+      beforeEach(() => {
+        state.apply();
+      });
+
+      test.each(SSO_PROVIDER_MODELS)(
+        "%s is refused below Scale with a 402 that names the plan",
+        (_name: string, modelType: ModelType) => {
+          for (const plan of PLANS_BELOW_SCALE) {
+            for (const operation of ALL_OPERATIONS) {
+              expect(
+                `${plan} ${operation}: ${checkPlan({ modelType, operation, plan })}`,
+              ).toBe(`${plan} ${operation}: ${SCALE_REFUSAL}`);
+            }
+          }
+        },
+      );
+
+      test.each(SSO_PROVIDER_MODELS)(
+        "%s is allowed on Scale and above",
+        (_name: string, modelType: ModelType) => {
+          for (const plan of PLANS_FROM_SCALE) {
+            for (const operation of ALL_OPERATIONS) {
+              expect(
+                `${plan} ${operation}: ${checkPlan({ modelType, operation, plan })}`,
+              ).toBe(`${plan} ${operation}: allowed`);
+            }
+          }
+        },
+      );
+
+      test('a project\'s own "Require SSO for login" switch is Scale-gated too', () => {
+        const data: Project = new Project();
+        data.requireSsoForLogin = true;
+
+        for (const plan of PLANS_BELOW_SCALE) {
+          expect(() => {
+            ColumnPermissions.checkDataColumnPermissions(
+              Project,
+              data,
+              ownerOnPlan(plan),
+              DatabaseRequestType.Update,
+            );
+          }).toThrow(new PaymentRequiredException(SCALE_REFUSAL));
+        }
+
+        for (const plan of PLANS_FROM_SCALE) {
+          expect(() => {
+            ColumnPermissions.checkDataColumnPermissions(
+              Project,
+              data,
+              ownerOnPlan(plan),
+              DatabaseRequestType.Update,
+            );
+          }).not.toThrow();
+        }
+      });
+
+      test.each(GLOBAL_SSO_MODELS)(
+        "%s (global single sign-on, master admins only) has no plan gate",
+        (_name: string, modelType: ModelType) => {
+          const model: BaseModel = new modelType();
+
+          expect(model.createBillingPlan).toBeFalsy();
+          expect(model.updateBillingPlan).toBeFalsy();
+
+          for (const operation of ALL_OPERATIONS) {
+            expect(() => {
+              BillingPermissions.checkBillingPermissions(
+                modelType,
+                ownerOnPlan(PlanType.Free),
+                operation,
+              );
+            }).not.toThrow();
+          }
+        },
+      );
+
+      test.each(SCIM_MODELS)(
+        "%s stays on Scale as well",
+        (_name: string, modelType: ModelType) => {
+          expect(
+            checkPlan({
+              modelType,
+              operation: DatabaseRequestType.Create,
+              plan: PlanType.Growth,
+            }),
+          ).toBe(SCALE_REFUSAL);
+          expect(
+            checkPlan({
+              modelType,
+              operation: DatabaseRequestType.Create,
+              plan: PlanType.Scale,
+            }),
+          ).toBe("allowed");
+        },
+      );
+    },
+  );
+
+  describe.each(SELF_HOSTED_STATES)(
+    "self-hosted, %s: no plan gate at all",
+    (_label: string, state: EditionStateCase) => {
+      beforeEach(() => {
+        state.apply();
+      });
+
+      test.each(SSO_PROVIDER_MODELS)(
+        "%s is not refused whatever plan the props carry",
+        (_name: string, modelType: ModelType) => {
+          for (const plan of [...PLANS_BELOW_SCALE, ...PLANS_FROM_SCALE]) {
+            for (const operation of ALL_OPERATIONS) {
+              expect(
+                `${plan} ${operation}: ${checkPlan({ modelType, operation, plan })}`,
+              ).toBe(`${plan} ${operation}: allowed`);
+            }
+          }
+        },
+      );
+
+      test('a project\'s "Require SSO for login" switch is not plan-gated', () => {
+        const data: Project = new Project();
+        data.requireSsoForLogin = true;
+
+        expect(() => {
+          ColumnPermissions.checkDataColumnPermissions(
+            Project,
+            data,
+            ownerOnPlan(PlanType.Free),
+            DatabaseRequestType.Update,
+          );
+        }).not.toThrow();
+      });
+    },
+  );
+});

package/Tests/Server/Utils/AI/AIAlertGating.test.ts

@@ -369,7 +369,6 @@ describe("AIInvestigationQueue concurrency cap", () => {
   test("an alert cap override of 1 blocks the second concurrent alert run", async () => {
     jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
       id: ObjectID.generate(),
-      aiMaxConcurrentInvestigations: 10,
       incidentAiMaxConcurrentInvestigations: 10,
       alertAiMaxConcurrentInvestigations: 1,
     } as unknown as Project);

package/Tests/Server/Utils/AI/AIInvestigationEngineRunLimits.test.ts

@@ -0,0 +1,136 @@
+import AIInvestigationEngine from "../../../../Server/Utils/AI/SRE/AIInvestigationEngine";
+import ProjectService from "../../../../Server/Services/ProjectService";
+import Project from "../../../../Models/DatabaseModels/Project";
+import {
+  AI_AGENT_RUNAWAY_MAX_LLM_CALLS,
+  AI_AGENT_RUNAWAY_MAX_TOOL_CALLS,
+  AIAgentRunLimits,
+} from "../../../../Types/AI/AIAgentRunLimits";
+import { JSONObject } from "../../../../Types/JSON";
+import ObjectID from "../../../../Types/ObjectID";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * How far an incident or alert investigation may run, as the runners ask
+ * it. The fix for "command did not run because of the time budget": no
+ * time limit unless the project set one for that lane, and a project that
+ * cannot be read runs unbounded rather than being cut short.
+ */
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+const PROJECT_ID: ObjectID = ObjectID.generate();
+
+function project(data: {
+  incident?: number | null;
+  alert?: number | null;
+}): Project {
+  const model: Project = new Project(PROJECT_ID);
+  if (data.incident !== undefined) {
+    model.incidentAiInvestigationTimeLimitInMinutes = data.incident as number;
+  }
+  if (data.alert !== undefined) {
+    model.alertAiInvestigationTimeLimitInMinutes = data.alert as number;
+  }
+  return model;
+}
+
+describe("AIInvestigationEngine.getRunLimitsForProject", () => {
+  test("no time limit when the project set none", async () => {
+    jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(project({}) as never);
+
+    const limits: AIAgentRunLimits =
+      await AIInvestigationEngine.getRunLimitsForProject(
+        PROJECT_ID,
+        "Incident",
+      );
+
+    expect(limits).toEqual({
+      maxWallClockMs: undefined,
+      maxLlmCalls: AI_AGENT_RUNAWAY_MAX_LLM_CALLS,
+      maxToolCalls: AI_AGENT_RUNAWAY_MAX_TOOL_CALLS,
+    });
+  });
+
+  test("each lane uses its own configured limit", async () => {
+    jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(project({ incident: 15, alert: 5 }) as never);
+
+    expect(
+      (
+        await AIInvestigationEngine.getRunLimitsForProject(
+          PROJECT_ID,
+          "Incident",
+        )
+      ).maxWallClockMs,
+    ).toBe(15 * 60 * 1000);
+    expect(
+      (await AIInvestigationEngine.getRunLimitsForProject(PROJECT_ID, "Alert"))
+        .maxWallClockMs,
+    ).toBe(5 * 60 * 1000);
+  });
+
+  test("a zero limit means none, not 'stop immediately'", async () => {
+    jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(project({ incident: 0 }) as never);
+
+    expect(
+      (
+        await AIInvestigationEngine.getRunLimitsForProject(
+          PROJECT_ID,
+          "Incident",
+        )
+      ).maxWallClockMs,
+    ).toBeUndefined();
+  });
+
+  test("reads both lanes' columns as root", async () => {
+    const find: jest.SpyInstance = jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(project({}) as never);
+
+    await AIInvestigationEngine.getRunLimitsForProject(PROJECT_ID, "Alert");
+
+    const args: { id: ObjectID; select: JSONObject; props: JSONObject } = find
+      .mock.calls[0]![0] as never;
+    expect(args.id).toBe(PROJECT_ID);
+    expect(args.select).toEqual({
+      incidentAiInvestigationTimeLimitInMinutes: true,
+      alertAiInvestigationTimeLimitInMinutes: true,
+    });
+    expect(args.props).toEqual({ isRoot: true });
+  });
+
+  test("a missing project runs without a limit", async () => {
+    jest.spyOn(ProjectService, "findOneById").mockResolvedValue(null as never);
+
+    expect(
+      (
+        await AIInvestigationEngine.getRunLimitsForProject(
+          PROJECT_ID,
+          "Incident",
+        )
+      ).maxWallClockMs,
+    ).toBeUndefined();
+  });
+
+  test("fails open: an unreadable project runs without a limit", async () => {
+    jest
+      .spyOn(ProjectService, "findOneById")
+      .mockRejectedValue(new Error("db down") as never);
+
+    await expect(
+      AIInvestigationEngine.getRunLimitsForProject(PROJECT_ID, "Incident"),
+    ).resolves.toEqual({
+      maxWallClockMs: undefined,
+      maxLlmCalls: AI_AGENT_RUNAWAY_MAX_LLM_CALLS,
+      maxToolCalls: AI_AGENT_RUNAWAY_MAX_TOOL_CALLS,
+    });
+  });
+});

package/Tests/Server/Utils/AI/AIInvestigationQueue.test.ts

@@ -349,7 +349,6 @@ describe("AIInvestigationQueue", () => {
   test("an incident at its cap does not consume the alert lane's slots", async () => {
     jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
       id: ObjectID.generate(),
-      aiMaxConcurrentInvestigations: 1,
       incidentAiMaxConcurrentInvestigations: 1,
       alertAiMaxConcurrentInvestigations: 2,
     } as unknown as Project);
@@ -397,20 +396,21 @@ describe("AIInvestigationQueue", () => {
     );
   });
 
-  test("subjectless insight work retains the legacy concurrency cap", async () => {
-    jest.spyOn(ProjectService, "findOneById").mockResolvedValue({
-      id: ObjectID.generate(),
-      aiMaxConcurrentInvestigations: 1,
-      incidentAiMaxConcurrentInvestigations: 10,
-      alertAiMaxConcurrentInvestigations: 10,
-    } as unknown as Project);
+  test("subjectless insight work uses the default cap and ignores the legacy project column", async () => {
+    const findProject: jest.SpyInstance = jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue({
+        id: ObjectID.generate(),
+        aiMaxConcurrentInvestigations: 1,
+      } as unknown as Project);
+    // Two running in the lane: over the legacy cap of 1, under the default 3.
     const count: jest.SpyInstance = jest
       .spyOn(AIRunService, "countBy")
-      .mockResolvedValue(new PositiveNumber(1));
-    const claim: jest.SpyInstance = jest.spyOn(
-      AIRunService,
-      "attemptStatusTransition",
-    );
+      .mockResolvedValueOnce(new PositiveNumber(2))
+      .mockResolvedValue(new PositiveNumber(0));
+    const claim: jest.SpyInstance = jest
+      .spyOn(AIRunService, "attemptStatusTransition")
+      .mockResolvedValue(0);
 
     await AIInvestigationQueue.processRun({
       id: ObjectID.generate(),
@@ -419,7 +419,8 @@ describe("AIInvestigationQueue", () => {
       triggeredByAiInsightId: ObjectID.generate(),
     });
 
-    expect(claim).not.toHaveBeenCalled();
+    expect(findProject).not.toHaveBeenCalled();
+    expect(claim).toHaveBeenCalledTimes(1);
     const query: Record<string, unknown> = (
       count.mock.calls[0]![0] as { query: Record<string, unknown> }
     ).query;