@oneuptime/common 14.0.3 → 14.0.5

package/Tests/Server/Services/ResourceUpdateLastSeenLivenessFallback.test.ts

@@ -20,6 +20,7 @@ jest.mock("../../../Server/Utils/PasswordHash", () => {
 
 import CephClusterService from "../../../Server/Services/CephClusterService";
 import CloudResourceService from "../../../Server/Services/CloudResourceService";
+import DatabaseServerService from "../../../Server/Services/DatabaseServerService";
 import DockerHostService from "../../../Server/Services/DockerHostService";
 import DockerSwarmClusterService from "../../../Server/Services/DockerSwarmClusterService";
 import GlobalCache from "../../../Server/Infrastructure/GlobalCache";
@@ -46,9 +47,10 @@ import {
 /*
  * Every resource type's liveness heartbeat, pinned together.
  *
- * Twelve services write the same two liveness columns (lastSeenAt +
- * otelCollectorStatus) alongside optional columns harvested from
- * OpenTelemetry resource attributes, and each has its own markDisconnected*
+ * Thirteen services write the same two liveness columns (lastSeenAt +
+ * otelCollectorStatus; a database adds collectorLastSeenAt) alongside
+ * optional columns harvested from OpenTelemetry resource attributes, and
+ * each has its own markDisconnected*
  * job that flips the resource to "disconnected" 15 minutes after lastSeenAt
  * stops advancing. They now share one implementation — ResourceHeartbeat —
  * because eleven hand-copied versions meant eleven copies of the same defect
@@ -109,11 +111,49 @@ type ServiceCase = {
    * These are what defeated the old throttle — see the header.
    */
   churningExtras?: Array<Record<string, unknown>>;
+  /**
+   * The columns every heartbeat writes, when not just lastSeenAt +
+   * otelCollectorStatus. A database also stamps collectorLastSeenAt: an
+   * application querying it moves lastSeenAt too, so only that column says
+   * the COLLECTOR is alive.
+   */
+  livenessColumns?: Array<string>;
 };
 
 /** Longer than any bounded column on any of these models. */
 const OVERSIZED: string = "x".repeat(5000);
 
+const DEFAULT_LIVENESS_COLUMNS: Array<string> = [
+  "lastSeenAt",
+  "otelCollectorStatus",
+];
+
+/*
+ * The database heartbeat is recordCollectorHeartbeat (a CLIENT span calling
+ * the database is a separate, sighting-only heartbeat). This view of the real
+ * service gives it the updateLastSeen shape the table drives - `this` stays
+ * the view, so the write spies below still see every UPDATE - and answers
+ * the one read the heartbeat makes afterwards (the auto-archive restore
+ * check) with "no row", so the suite still never reaches Postgres.
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const databaseServerHeartbeat: any = Object.assign(
+  Object.create(DatabaseServerService),
+  {
+    updateLastSeen: function (
+      this: typeof DatabaseServerService,
+      id: ObjectID,
+      extra?: { agentVersion?: string; dbVersion?: string },
+    ): Promise<void> {
+      return this.recordCollectorHeartbeat(id, extra);
+    },
+    findOneById: async (): Promise<null> => {
+      return null;
+    },
+  },
+);
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
 /* eslint-disable @typescript-eslint/no-explicit-any */
 const SERVICE_CASES: Array<ServiceCase> = [
   {
@@ -257,6 +297,19 @@ const SERVICE_CASES: Array<ServiceCase> = [
       { osType: "linux", processCount: 413, totalMemoryBytes: 17179869184 },
     ],
   },
+  {
+    name: "DatabaseServerService",
+    service: databaseServerHeartbeat,
+    namespace: "database-server-last-seen",
+    extra: { agentVersion: "0.118.0" },
+    otherExtra: { agentVersion: "0.119.0" },
+    oversizedExtra: { dbVersion: OVERSIZED },
+    livenessColumns: [
+      "collectorLastSeenAt",
+      "lastSeenAt",
+      "otelCollectorStatus",
+    ],
+  },
 ];
 /* eslint-enable @typescript-eslint/no-explicit-any */
 
@@ -269,7 +322,11 @@ describe.each(SERVICE_CASES)(
     otherExtra,
     oversizedExtra,
     churningExtras,
+    livenessColumns,
   }: ServiceCase) => {
+    const liveness: Array<string> = [
+      ...(livenessColumns || DEFAULT_LIVENESS_COLUMNS),
+    ].sort();
     let writes: Array<WriteCall>;
     let cache: Map<string, string>;
     let deletedCacheKeys: Array<string>;
@@ -329,8 +386,8 @@ describe.each(SERVICE_CASES)(
     }
 
     /**
-     * Fails any write carrying more than the two liveness columns — the
-     * shape of a Postgres rejection caused by one bad optional column.
+     * Fails any write carrying more than the liveness columns — the shape
+     * of a Postgres rejection caused by one bad optional column.
      */
     function mockEnrichedWriteFailing(): void {
       jest
@@ -340,7 +397,7 @@ describe.each(SERVICE_CASES)(
             ...(input.data as Record<string, unknown>),
           };
           writes.push({ id: input.id, data: data });
-          if (Object.keys(data).length > 2) {
+          if (Object.keys(data).length > liveness.length) {
             throw new Error("value too long for type character varying(100)");
           }
           return true;
@@ -505,10 +562,7 @@ describe.each(SERVICE_CASES)(
         await service.updateLastSeen(RESOURCE_ID, oversizedExtra as never);
 
         expect(writes).toHaveLength(2);
-        expect(Object.keys(lastWrite()).sort()).toEqual([
-          "lastSeenAt",
-          "otelCollectorStatus",
-        ]);
+        expect(Object.keys(lastWrite()).sort()).toEqual(liveness);
         expect(lastWrite()["otelCollectorStatus"]).toBe("connected");
         expect(lastWrite()["lastSeenAt"]).toBeInstanceOf(Date);
       });
@@ -553,10 +607,7 @@ describe.each(SERVICE_CASES)(
 
         await service.updateLastSeen(RESOURCE_ID, oversizedExtra as never);
 
-        expect(Object.keys(lastWrite()).sort()).toEqual([
-          "lastSeenAt",
-          "otelCollectorStatus",
-        ]);
+        expect(Object.keys(lastWrite()).sort()).toEqual(liveness);
       });
 
       test("surfaces a genuinely broken database instead of hiding it", async () => {
@@ -617,10 +668,7 @@ describe.each(SERVICE_CASES)(
         await service.updateLastSeen(RESOURCE_ID, extra as never);
 
         expect(writes).toHaveLength(1);
-        expect(Object.keys(lastWrite()).sort()).toEqual([
-          "lastSeenAt",
-          "otelCollectorStatus",
-        ]);
+        expect(Object.keys(lastWrite()).sort()).toEqual(liveness);
       });
     });
 
@@ -668,11 +716,11 @@ describe.each(SERVICE_CASES)(
 describe("liveness fallback coverage", () => {
   test("covers every service that writes liveness on the hook-free path", () => {
     /*
-     * If a thirteenth resource type grows an updateLastSeen, it belongs in
+     * If a fourteenth resource type grows an updateLastSeen, it belongs in
      * SERVICE_CASES — that is the whole point of this suite. Bumping this
      * number without adding the case defeats it.
      */
-    expect(SERVICE_CASES).toHaveLength(12);
+    expect(SERVICE_CASES).toHaveLength(13);
   });
 
   test("no service is listed twice", () => {

package/Tests/Server/Services/StaticRuleCriteriaRuntimeCoverage.test.ts

@@ -196,9 +196,9 @@ describe("static rule criteria runtime coverage", () => {
     discoverStaticRuleForms();
   const inheritedRuleModelNames: Array<string> = getInheritedRuleModelNames();
 
-  test("all 64 static match-criteria forms route their 76 rule models through ModelForm", () => {
-    expect(formFiles).toHaveLength(64);
-    expect(formsByModel.size).toBe(76);
+  test("all 66 static match-criteria forms route their 78 rule models through ModelForm", () => {
+    expect(formFiles).toHaveLength(66);
+    expect(formsByModel.size).toBe(78);
     expect([...formsByModel.keys()].sort()).toEqual(inheritedRuleModelNames);
     expect(Object.keys(RULE_CRITERIA_FIELDS_BY_MODEL).sort()).toEqual(
       inheritedRuleModelNames,

package/Tests/Server/Services/TelemetryResourceFacetCounting.test.ts

@@ -109,6 +109,15 @@ describe("resource facet counting covers the whole catalog", () => {
         );
       });
 
+      test("databaseServerId is counted under DatabaseServer — the receiver batches primary-keyed on the row", () => {
+        const statement: Statement = service.build({
+          facetKey: "databaseServerId",
+        });
+
+        expect(paramValues(statement)).toContain(ServiceType.DatabaseServer);
+        expect(statement.query).not.toContain("mapContains(attributes");
+      });
+
       test("iotFleetId is counted under IoTDevice — ingest stamps the fleet id with that type", () => {
         const statement: Statement = service.build({ facetKey: "iotFleetId" });
 

package/Tests/Server/Services/UserProjectSsoConsentPostgres.test.ts

@@ -0,0 +1,153 @@
+import Entities from "../../../Models/DatabaseModels/Index";
+import PostgresAppInstance from "../../../Server/Infrastructure/PostgresDatabase";
+import UserProjectSsoConsentService from "../../../Server/Services/UserProjectSsoConsentService";
+import ObjectID from "../../../Types/ObjectID";
+import { DataSource } from "typeorm";
+
+jest.mock("../../../Server/Middleware/UserAuthorization", () => {
+  return { getUserMiddleware: jest.fn() };
+});
+jest.mock("../../../Server/Services/ProjectService", () => {
+  return { getCurrentPlan: jest.fn() };
+});
+jest.mock("../../../Server/Infrastructure/Postgres/DataSourceOptions", () => {
+  return {};
+});
+
+/*
+ * The consent record against a real, migrated database.
+ *
+ * UserProjectSsoConsentService.test.ts pins the service's logic with the
+ * database faked. What only a database can show is the guarantee that logic
+ * leans on: the unique index turns a second, racing insert for the same
+ * (user, project) into an error rather than a duplicate row, so two clicks on
+ * one confirmation link -- or two links for one project -- end with exactly
+ * one consent, and the second click still succeeds.
+ *
+ * Opt in with RUN_POSTGRES_SSO_CONSENT_TESTS=true and config.env; point it at
+ * a migrated database with SSO_CONSENT_TEST_DATABASE_HOST/PORT/NAME
+ * (default localhost:5400; the Postgres Schema Drift job runs it). Only the table definition is copied from public, into an
+ * isolated schema that is dropped afterwards; every row is synthetic.
+ */
+const describePostgres: typeof describe =
+  process.env["RUN_POSTGRES_SSO_CONSENT_TESTS"] === "true"
+    ? describe
+    : describe.skip;
+
+describePostgres("UserProjectSsoConsent against Postgres", () => {
+  const schema: string = `sso_consent_test_${ObjectID.generate().toString().replace(/-/g, "")}`;
+  let database: DataSource;
+
+  const countRows: (
+    userId: ObjectID,
+    projectId: ObjectID,
+  ) => Promise<number> = async (
+    userId: ObjectID,
+    projectId: ObjectID,
+  ): Promise<number> => {
+    const rows: Array<{ count: string }> = await database.query(
+      `SELECT COUNT(*)::text AS count FROM "${schema}"."UserProjectSsoConsent" WHERE "userId" = $1 AND "projectId" = $2`,
+      [userId.toString(), projectId.toString()],
+    );
+
+    return Number(rows[0]!.count);
+  };
+
+  beforeAll(async () => {
+    database = new DataSource({
+      type: "postgres",
+      host: process.env["SSO_CONSENT_TEST_DATABASE_HOST"] || "localhost",
+      port: Number(process.env["SSO_CONSENT_TEST_DATABASE_PORT"] || "5400"),
+      username: process.env["DATABASE_USERNAME"] || "postgres",
+      password: process.env["DATABASE_PASSWORD"] || "password",
+      database:
+        process.env["SSO_CONSENT_TEST_DATABASE_NAME"] ||
+        process.env["DATABASE_NAME"] ||
+        "oneuptimedb",
+      entities: Entities,
+      schema,
+      synchronize: false,
+      extra: { options: `-c search_path=${schema},public` },
+    });
+    await database.initialize();
+    await database.query(`CREATE SCHEMA "${schema}"`);
+    await database.query(
+      `CREATE TABLE "${schema}"."UserProjectSsoConsent" (LIKE public."UserProjectSsoConsent" INCLUDING ALL)`,
+    );
+
+    jest.spyOn(PostgresAppInstance, "isConnected").mockReturnValue(true);
+    jest.spyOn(PostgresAppInstance, "getDataSource").mockReturnValue(database);
+  });
+
+  afterAll(async () => {
+    if (database?.isInitialized) {
+      await database.query(`DROP SCHEMA IF EXISTS "${schema}" CASCADE`);
+      await database.destroy();
+    }
+
+    jest.restoreAllMocks();
+  });
+
+  test("records consent once, and finds it for that project only", async () => {
+    const userId: ObjectID = ObjectID.generate();
+    const projectId: ObjectID = ObjectID.generate();
+    const otherProjectId: ObjectID = ObjectID.generate();
+
+    expect(
+      await UserProjectSsoConsentService.hasConsent({ userId, projectId }),
+    ).toBe(false);
+
+    await UserProjectSsoConsentService.recordConsent({ userId, projectId });
+
+    expect(
+      await UserProjectSsoConsentService.hasConsent({ userId, projectId }),
+    ).toBe(true);
+    expect(
+      await UserProjectSsoConsentService.hasConsent({
+        userId,
+        projectId: otherProjectId,
+      }),
+    ).toBe(false);
+    expect(
+      await UserProjectSsoConsentService.hasConsent({
+        userId: ObjectID.generate(),
+        projectId,
+      }),
+    ).toBe(false);
+  });
+
+  test("a second confirmation neither fails nor duplicates the row", async () => {
+    const userId: ObjectID = ObjectID.generate();
+    const projectId: ObjectID = ObjectID.generate();
+
+    await UserProjectSsoConsentService.recordConsent({ userId, projectId });
+    await UserProjectSsoConsentService.recordConsent({ userId, projectId });
+
+    expect(await countRows(userId, projectId)).toBe(1);
+  });
+
+  test("two confirmations racing each other end with exactly one row", async () => {
+    const userId: ObjectID = ObjectID.generate();
+    const projectId: ObjectID = ObjectID.generate();
+
+    await Promise.all([
+      UserProjectSsoConsentService.recordConsent({ userId, projectId }),
+      UserProjectSsoConsentService.recordConsent({ userId, projectId }),
+      UserProjectSsoConsentService.recordConsent({ userId, projectId }),
+    ]);
+
+    expect(await countRows(userId, projectId)).toBe(1);
+  });
+
+  test("the database itself refuses a duplicate live consent", async () => {
+    const userId: ObjectID = ObjectID.generate();
+    const projectId: ObjectID = ObjectID.generate();
+    const insert: string = `INSERT INTO "${schema}"."UserProjectSsoConsent" ("userId", "projectId", "version") VALUES ($1, $2, 1)`;
+
+    await database.query(insert, [userId.toString(), projectId.toString()]);
+
+    await expect(
+      database.query(insert, [userId.toString(), projectId.toString()]),
+    ).rejects.toThrow(/duplicate key value/);
+  });
+});

package/Tests/Server/Services/UserProjectSsoConsentService.test.ts

@@ -0,0 +1,192 @@
+import UserProjectSsoConsent from "../../../Models/DatabaseModels/UserProjectSsoConsent";
+import UserProjectSsoConsentService from "../../../Server/Services/UserProjectSsoConsentService";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import { afterEach, describe, expect, jest, test } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+
+/*
+ * The record that an account's owner agreed, from their mailbox, that a
+ * project's single sign-on may sign them in. Read on every hosted project-SSO
+ * sign-in; written only by the confirmation link.
+ *
+ * What has to hold:
+ *
+ *  - consent is per (user, project): the query is scoped to both, so one
+ *    project's consent can never let another project's IdP in;
+ *  - recording is idempotent, because the same person can press the button
+ *    twice, or confirm two emails for the same project, and the second must
+ *    neither fail nor duplicate the row;
+ *  - a lost race with a concurrent insert is absorbed, but a real failure is
+ *    not swallowed.
+ */
+
+const USER_ID: ObjectID = new ObjectID("88888888-8888-4888-8888-888888888888");
+const PROJECT_ID: ObjectID = new ObjectID(
+  "99999999-9999-4999-8999-999999999999",
+);
+
+/*
+ * Spy handles are held through this rather than a SpiedFunction/SpyInstance
+ * type: two such declarations are in scope in this project (the global jest
+ * namespace's and @jest/globals'), jest.spyOn returns the latter, and naming
+ * the wrong one passes the jest run and fails only in compile-common. These
+ * tests read exactly one thing off a spy, so that is all this names.
+ */
+interface SpyCalls {
+  mock: { calls: Array<Array<unknown>> };
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("UserProjectSsoConsentService.hasConsent", () => {
+  test("asks about this user in this project, as root", async () => {
+    const countBy: SpyCalls = jest
+      .spyOn(UserProjectSsoConsentService, "countBy")
+      .mockResolvedValue(new PositiveNumber(1)) as unknown as SpyCalls;
+
+    await expect(
+      UserProjectSsoConsentService.hasConsent({
+        userId: USER_ID,
+        projectId: PROJECT_ID,
+      }),
+    ).resolves.toBe(true);
+
+    const call: Record<string, any> = countBy.mock.calls[0]![0] as Record<
+      string,
+      any
+    >;
+
+    expect(call["query"]["userId"].toString()).toBe(USER_ID.toString());
+    expect(call["query"]["projectId"].toString()).toBe(PROJECT_ID.toString());
+    expect(call["props"]["isRoot"]).toBe(true);
+  });
+
+  test("is false when there is no row", async () => {
+    jest
+      .spyOn(UserProjectSsoConsentService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+
+    await expect(
+      UserProjectSsoConsentService.hasConsent({
+        userId: USER_ID,
+        projectId: PROJECT_ID,
+      }),
+    ).resolves.toBe(false);
+  });
+});
+
+describe("UserProjectSsoConsentService.recordConsent", () => {
+  test("writes one row for this user and project", async () => {
+    jest
+      .spyOn(UserProjectSsoConsentService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+    const create: SpyCalls = jest
+      .spyOn(UserProjectSsoConsentService, "create")
+      .mockResolvedValue(new UserProjectSsoConsent()) as unknown as SpyCalls;
+
+    await UserProjectSsoConsentService.recordConsent({
+      userId: USER_ID,
+      projectId: PROJECT_ID,
+    });
+
+    expect(create.mock.calls).toHaveLength(1);
+
+    const call: Record<string, any> = create.mock.calls[0]![0] as Record<
+      string,
+      any
+    >;
+
+    expect(call["data"]).toBeInstanceOf(UserProjectSsoConsent);
+    expect(call["data"]["userId"].toString()).toBe(USER_ID.toString());
+    expect(call["data"]["projectId"].toString()).toBe(PROJECT_ID.toString());
+    expect(call["props"]["isRoot"]).toBe(true);
+  });
+
+  test("writes nothing when consent is already on record", async () => {
+    jest
+      .spyOn(UserProjectSsoConsentService, "countBy")
+      .mockResolvedValue(new PositiveNumber(1));
+    const create: SpyCalls = jest.spyOn(
+      UserProjectSsoConsentService,
+      "create",
+    ) as unknown as SpyCalls;
+
+    await UserProjectSsoConsentService.recordConsent({
+      userId: USER_ID,
+      projectId: PROJECT_ID,
+    });
+
+    expect(create.mock.calls).toHaveLength(0);
+  });
+
+  test("absorbs losing an insert race to a concurrent click", async () => {
+    // Absent when checked, present by the time the insert was turned away.
+    jest
+      .spyOn(UserProjectSsoConsentService, "countBy")
+      .mockResolvedValueOnce(new PositiveNumber(0))
+      .mockResolvedValueOnce(new PositiveNumber(1));
+    jest
+      .spyOn(UserProjectSsoConsentService, "create")
+      .mockRejectedValue(
+        new Error("duplicate key value violates unique constraint"),
+      );
+
+    await expect(
+      UserProjectSsoConsentService.recordConsent({
+        userId: USER_ID,
+        projectId: PROJECT_ID,
+      }),
+    ).resolves.toBeUndefined();
+  });
+
+  test("does not swallow a write that failed for any other reason", async () => {
+    jest
+      .spyOn(UserProjectSsoConsentService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+    jest
+      .spyOn(UserProjectSsoConsentService, "create")
+      .mockRejectedValue(new Error("connection terminated"));
+
+    await expect(
+      UserProjectSsoConsentService.recordConsent({
+        userId: USER_ID,
+        projectId: PROJECT_ID,
+      }),
+    ).rejects.toThrow("connection terminated");
+  });
+});
+
+describe("UserProjectSsoConsent model", () => {
+  test("has no API: nobody but the server reads or writes it", () => {
+    const model: UserProjectSsoConsent = new UserProjectSsoConsent();
+
+    expect(model.createRecordPermissions).toEqual([]);
+    expect(model.readRecordPermissions).toEqual([]);
+    expect(model.updateRecordPermissions).toEqual([]);
+    expect(model.deleteRecordPermissions).toEqual([]);
+    expect(model.crudApiPath).toBeFalsy();
+  });
+
+  test("is one live row per user and project, enforced by the database", () => {
+    /*
+     * The unique index is what turns a concurrent second insert into the
+     * error recordConsent absorbs, instead of a duplicate row.
+     */
+    const index: IndexMetadataArgs | undefined = getMetadataArgsStorage()
+      .indices.filter((candidate: IndexMetadataArgs) => {
+        return candidate.target === UserProjectSsoConsent;
+      })
+      .find((candidate: IndexMetadataArgs) => {
+        return candidate.name === "IDX_UserProjectSsoConsent_userId_projectId";
+      });
+
+    expect(index).toBeDefined();
+    expect(index!.unique).toBe(true);
+    expect(index!.columns).toEqual(["userId", "projectId"]);
+    expect(index!.where).toBe('"deletedAt" IS NULL');
+  });
+});

package/Tests/Server/Services/UserServiceFirstMasterAdminElection.test.ts

@@ -684,6 +684,77 @@ describe("UserService.createUserOnSignup -- first Master Admin election", () =>
     });
   });
 
+  describe("a signup that names an existing row", () => {
+    /*
+     * TypeORM's save() UPDATEs the row an entity's `_id` names, and this create
+     * runs as root, which DatabaseService.create exempts from its supplied-id
+     * check. A signup carrying a victim's id therefore rewrote the victim's
+     * email and password in place (UserSignupIdTakeoverPostgres.test.ts shows
+     * it against a real table). Refused before anything is read or written.
+     */
+    const VICTIM_ID: string = "33333333-3333-4333-8333-333333333333";
+
+    type BuildUserWithIdFunction = (modules: LoadedModules) => any;
+
+    const buildUserWithId: BuildUserWithIdFunction = (
+      modules: LoadedModules,
+    ): any => {
+      const user: any = buildUser({ modules, email: "attacker@example.com" });
+      user._id = VICTIM_ID;
+      return user;
+    };
+
+    test("self-hosted: refuses it without taking the lock or touching a row", async () => {
+      userRows.push({ email: "victim@example.com" });
+
+      await expect(
+        selfHosted.userService.createUserOnSignup({
+          user: buildUserWithId(selfHosted),
+          props: { isRoot: true },
+        }),
+      ).rejects.toThrow("An id cannot be supplied when signing up.");
+
+      expect(events).toEqual([]);
+      expect(selfHosted.userService.create).not.toHaveBeenCalled();
+      expect(selfHosted.semaphore.lock).not.toHaveBeenCalled();
+      expect(userRows).toHaveLength(1);
+    });
+
+    test("self-hosted: refuses it on an empty instance, so the id cannot win the election either", async () => {
+      await expect(
+        selfHosted.userService.createUserOnSignup({
+          user: buildUserWithId(selfHosted),
+          props: { isRoot: true },
+        }),
+      ).rejects.toThrow("An id cannot be supplied when signing up.");
+
+      expect(selfHosted.userService.create).not.toHaveBeenCalled();
+      expect(userRows).toHaveLength(0);
+    });
+
+    test("hosted: refuses it without touching a row", async () => {
+      await expect(
+        hosted.userService.createUserOnSignup({
+          user: buildUserWithId(hosted),
+          props: { isRoot: true },
+        }),
+      ).rejects.toThrow("An id cannot be supplied when signing up.");
+
+      expect(events).toEqual([]);
+      expect(hosted.userService.create).not.toHaveBeenCalled();
+    });
+
+    test("a user with no id is still created", async () => {
+      const created: any = await hosted.userService.createUserOnSignup({
+        user: buildUser({ modules: hosted, email: "new@example.com" }),
+        props: { isRoot: true },
+      });
+
+      expect(created).toBeTruthy();
+      expect(hosted.userService.create).toHaveBeenCalledTimes(1);
+    });
+  });
+
   describe("the race itself", () => {
     test("two simultaneous signups produce exactly one Master Admin", async () => {
       const [first, second]: Array<any> = await Promise.all([