@oneuptime/common 14.0.3 → 14.0.6

package/Tests/Server/Services/ResourceUpdateLastSeenLivenessFallback.test.ts

@@ -20,6 +20,7 @@ jest.mock("../../../Server/Utils/PasswordHash", () => {
 
 import CephClusterService from "../../../Server/Services/CephClusterService";
 import CloudResourceService from "../../../Server/Services/CloudResourceService";
+import DatabaseServerService from "../../../Server/Services/DatabaseServerService";
 import DockerHostService from "../../../Server/Services/DockerHostService";
 import DockerSwarmClusterService from "../../../Server/Services/DockerSwarmClusterService";
 import GlobalCache from "../../../Server/Infrastructure/GlobalCache";
@@ -46,9 +47,10 @@ import {
 /*
  * Every resource type's liveness heartbeat, pinned together.
  *
- * Twelve services write the same two liveness columns (lastSeenAt +
- * otelCollectorStatus) alongside optional columns harvested from
- * OpenTelemetry resource attributes, and each has its own markDisconnected*
+ * Thirteen services write the same two liveness columns (lastSeenAt +
+ * otelCollectorStatus; a database adds collectorLastSeenAt) alongside
+ * optional columns harvested from OpenTelemetry resource attributes, and
+ * each has its own markDisconnected*
  * job that flips the resource to "disconnected" 15 minutes after lastSeenAt
  * stops advancing. They now share one implementation — ResourceHeartbeat —
  * because eleven hand-copied versions meant eleven copies of the same defect
@@ -109,11 +111,49 @@ type ServiceCase = {
    * These are what defeated the old throttle — see the header.
    */
   churningExtras?: Array<Record<string, unknown>>;
+  /**
+   * The columns every heartbeat writes, when not just lastSeenAt +
+   * otelCollectorStatus. A database also stamps collectorLastSeenAt: an
+   * application querying it moves lastSeenAt too, so only that column says
+   * the COLLECTOR is alive.
+   */
+  livenessColumns?: Array<string>;
 };
 
 /** Longer than any bounded column on any of these models. */
 const OVERSIZED: string = "x".repeat(5000);
 
+const DEFAULT_LIVENESS_COLUMNS: Array<string> = [
+  "lastSeenAt",
+  "otelCollectorStatus",
+];
+
+/*
+ * The database heartbeat is recordCollectorHeartbeat (a CLIENT span calling
+ * the database is a separate, sighting-only heartbeat). This view of the real
+ * service gives it the updateLastSeen shape the table drives - `this` stays
+ * the view, so the write spies below still see every UPDATE - and answers
+ * the one read the heartbeat makes afterwards (the auto-archive restore
+ * check) with "no row", so the suite still never reaches Postgres.
+ */
+/* eslint-disable @typescript-eslint/no-explicit-any */
+const databaseServerHeartbeat: any = Object.assign(
+  Object.create(DatabaseServerService),
+  {
+    updateLastSeen: function (
+      this: typeof DatabaseServerService,
+      id: ObjectID,
+      extra?: { agentVersion?: string; dbVersion?: string },
+    ): Promise<void> {
+      return this.recordCollectorHeartbeat(id, extra);
+    },
+    findOneById: async (): Promise<null> => {
+      return null;
+    },
+  },
+);
+/* eslint-enable @typescript-eslint/no-explicit-any */
+
 /* eslint-disable @typescript-eslint/no-explicit-any */
 const SERVICE_CASES: Array<ServiceCase> = [
   {
@@ -257,6 +297,19 @@ const SERVICE_CASES: Array<ServiceCase> = [
       { osType: "linux", processCount: 413, totalMemoryBytes: 17179869184 },
     ],
   },
+  {
+    name: "DatabaseServerService",
+    service: databaseServerHeartbeat,
+    namespace: "database-server-last-seen",
+    extra: { agentVersion: "0.118.0" },
+    otherExtra: { agentVersion: "0.119.0" },
+    oversizedExtra: { dbVersion: OVERSIZED },
+    livenessColumns: [
+      "collectorLastSeenAt",
+      "lastSeenAt",
+      "otelCollectorStatus",
+    ],
+  },
 ];
 /* eslint-enable @typescript-eslint/no-explicit-any */
 
@@ -269,7 +322,11 @@ describe.each(SERVICE_CASES)(
     otherExtra,
     oversizedExtra,
     churningExtras,
+    livenessColumns,
   }: ServiceCase) => {
+    const liveness: Array<string> = [
+      ...(livenessColumns || DEFAULT_LIVENESS_COLUMNS),
+    ].sort();
     let writes: Array<WriteCall>;
     let cache: Map<string, string>;
     let deletedCacheKeys: Array<string>;
@@ -329,8 +386,8 @@ describe.each(SERVICE_CASES)(
     }
 
     /**
-     * Fails any write carrying more than the two liveness columns — the
-     * shape of a Postgres rejection caused by one bad optional column.
+     * Fails any write carrying more than the liveness columns — the shape
+     * of a Postgres rejection caused by one bad optional column.
      */
     function mockEnrichedWriteFailing(): void {
       jest
@@ -340,7 +397,7 @@ describe.each(SERVICE_CASES)(
             ...(input.data as Record<string, unknown>),
           };
           writes.push({ id: input.id, data: data });
-          if (Object.keys(data).length > 2) {
+          if (Object.keys(data).length > liveness.length) {
             throw new Error("value too long for type character varying(100)");
           }
           return true;
@@ -505,10 +562,7 @@ describe.each(SERVICE_CASES)(
         await service.updateLastSeen(RESOURCE_ID, oversizedExtra as never);
 
         expect(writes).toHaveLength(2);
-        expect(Object.keys(lastWrite()).sort()).toEqual([
-          "lastSeenAt",
-          "otelCollectorStatus",
-        ]);
+        expect(Object.keys(lastWrite()).sort()).toEqual(liveness);
         expect(lastWrite()["otelCollectorStatus"]).toBe("connected");
         expect(lastWrite()["lastSeenAt"]).toBeInstanceOf(Date);
       });
@@ -553,10 +607,7 @@ describe.each(SERVICE_CASES)(
 
         await service.updateLastSeen(RESOURCE_ID, oversizedExtra as never);
 
-        expect(Object.keys(lastWrite()).sort()).toEqual([
-          "lastSeenAt",
-          "otelCollectorStatus",
-        ]);
+        expect(Object.keys(lastWrite()).sort()).toEqual(liveness);
       });
 
       test("surfaces a genuinely broken database instead of hiding it", async () => {
@@ -617,10 +668,7 @@ describe.each(SERVICE_CASES)(
         await service.updateLastSeen(RESOURCE_ID, extra as never);
 
         expect(writes).toHaveLength(1);
-        expect(Object.keys(lastWrite()).sort()).toEqual([
-          "lastSeenAt",
-          "otelCollectorStatus",
-        ]);
+        expect(Object.keys(lastWrite()).sort()).toEqual(liveness);
       });
     });
 
@@ -668,11 +716,11 @@ describe.each(SERVICE_CASES)(
 describe("liveness fallback coverage", () => {
   test("covers every service that writes liveness on the hook-free path", () => {
     /*
-     * If a thirteenth resource type grows an updateLastSeen, it belongs in
+     * If a fourteenth resource type grows an updateLastSeen, it belongs in
      * SERVICE_CASES — that is the whole point of this suite. Bumping this
      * number without adding the case defeats it.
      */
-    expect(SERVICE_CASES).toHaveLength(12);
+    expect(SERVICE_CASES).toHaveLength(13);
   });
 
   test("no service is listed twice", () => {

package/Tests/Server/Services/SavedViewDefaults.test.ts

@@ -0,0 +1,325 @@
+import LogSavedViewService from "../../../Server/Services/LogSavedViewService";
+import MetricSavedViewService from "../../../Server/Services/MetricSavedViewService";
+import TraceSavedViewService from "../../../Server/Services/TraceSavedViewService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../../../Server/Types/Database/Hooks";
+import LogSavedView from "../../../Models/DatabaseModels/LogSavedView";
+import MetricSavedView from "../../../Models/DatabaseModels/MetricSavedView";
+import TraceSavedView from "../../../Models/DatabaseModels/TraceSavedView";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import ObjectID from "../../../Types/ObjectID";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Telemetry saved views (logs, traces and metrics) each promise a project
+ * exactly one default: the first view a project saves becomes its default, and
+ * marking another one default clears whichever view held it. Three services
+ * carry the same hooks, so the suite runs against all three -- a change made
+ * to one of them and not the others shows up here rather than as a project
+ * whose telemetry page opens two default views, or none.
+ */
+
+type SavedViewModel = LogSavedView | MetricSavedView | TraceSavedView;
+
+/*
+ * The two hooks under test, reached past `protected`. Typed over the union of
+ * the three models so one set of cases can drive all three services.
+ */
+type SavedViewService = {
+  onBeforeCreate: (
+    createBy: CreateBy<SavedViewModel>,
+  ) => Promise<OnCreate<SavedViewModel>>;
+  onBeforeUpdate: (
+    updateBy: UpdateBy<SavedViewModel>,
+  ) => Promise<OnUpdate<SavedViewModel>>;
+};
+
+type ServiceCase = {
+  label: string;
+  service: SavedViewService;
+  buildModel: () => SavedViewModel;
+};
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const VIEW_ID: ObjectID = new ObjectID("22222222-2222-4222-8222-222222222222");
+
+const cases: Array<ServiceCase> = [
+  {
+    label: "LogSavedViewService",
+    service: LogSavedViewService as unknown as SavedViewService,
+    buildModel: (): SavedViewModel => {
+      return new LogSavedView();
+    },
+  },
+  {
+    label: "TraceSavedViewService",
+    service: TraceSavedViewService as unknown as SavedViewService,
+    buildModel: (): SavedViewModel => {
+      return new TraceSavedView();
+    },
+  },
+  {
+    label: "MetricSavedViewService",
+    service: MetricSavedViewService as unknown as SavedViewService,
+    buildModel: (): SavedViewModel => {
+      return new MetricSavedView();
+    },
+  },
+];
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe.each(cases)(
+  "$label default-view hooks",
+  ({ service, buildModel }: ServiceCase) => {
+    function mockFindOneBy(existing: SavedViewModel | null): jest.SpyInstance {
+      return jest
+        .spyOn(service as never, "findOneBy")
+        .mockResolvedValue(existing as never);
+    }
+
+    function mockFindBy(items: Array<SavedViewModel>): jest.SpyInstance {
+      return jest
+        .spyOn(service as never, "findBy")
+        .mockResolvedValue(items as never);
+    }
+
+    function mockUpdateBy(): jest.SpyInstance {
+      return jest
+        .spyOn(service as never, "updateBy")
+        .mockResolvedValue(undefined as never);
+    }
+
+    describe("onBeforeCreate", () => {
+      test("the first view a project saves becomes its default", async () => {
+        mockFindOneBy(null);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        const view: SavedViewModel = buildModel();
+        view.projectId = PROJECT_ID;
+
+        const result: OnCreate<SavedViewModel> = await service.onBeforeCreate({
+          data: view,
+        } as CreateBy<SavedViewModel>);
+
+        expect(result.createBy.data.isDefault).toBe(true);
+        /*
+         * Nothing else held the default, but the sweep still runs and is a no-op
+         * against an empty project.
+         */
+        expect(updateSpy).toHaveBeenCalledTimes(1);
+      });
+
+      test("a later view is not made default while one already exists", async () => {
+        const existing: SavedViewModel = buildModel();
+        existing._id = VIEW_ID.toString();
+        mockFindOneBy(existing);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        const view: SavedViewModel = buildModel();
+        view.projectId = PROJECT_ID;
+
+        const result: OnCreate<SavedViewModel> = await service.onBeforeCreate({
+          data: view,
+        } as CreateBy<SavedViewModel>);
+
+        expect(result.createBy.data.isDefault).toBe(false);
+        // Not default, so nothing is unset.
+        expect(updateSpy).not.toHaveBeenCalled();
+      });
+
+      test("an explicit isDefault=true clears whichever view held it", async () => {
+        const findOneSpy: jest.SpyInstance = mockFindOneBy(null);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        const view: SavedViewModel = buildModel();
+        view.projectId = PROJECT_ID;
+        view.isDefault = true;
+
+        await service.onBeforeCreate({
+          data: view,
+        } as CreateBy<SavedViewModel>);
+
+        // The caller said so, so the service does not go looking.
+        expect(findOneSpy).not.toHaveBeenCalled();
+        expect(updateSpy).toHaveBeenCalledTimes(1);
+        const updateArgs: Record<string, unknown> = updateSpy.mock
+          .calls[0]?.[0] as Record<string, unknown>;
+        const query: Record<string, unknown> = updateArgs["query"] as Record<
+          string,
+          unknown
+        >;
+        expect(query["projectId"]).toBe(PROJECT_ID);
+        expect(query["isDefault"]).toBe(true);
+        expect(updateArgs["data"]).toEqual({ isDefault: false });
+        /*
+         * The sweep runs as root: a member may only see their own views, and
+         * leaving the others default would break the one-default promise.
+         */
+        expect(updateArgs["props"]).toEqual({ isRoot: true });
+      });
+
+      test("an explicit isDefault=false is kept, and unsets nothing", async () => {
+        const findOneSpy: jest.SpyInstance = mockFindOneBy(null);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        const view: SavedViewModel = buildModel();
+        view.projectId = PROJECT_ID;
+        view.isDefault = false;
+
+        const result: OnCreate<SavedViewModel> = await service.onBeforeCreate({
+          data: view,
+        } as CreateBy<SavedViewModel>);
+
+        expect(result.createBy.data.isDefault).toBe(false);
+        expect(findOneSpy).not.toHaveBeenCalled();
+        expect(updateSpy).not.toHaveBeenCalled();
+      });
+
+      test("a view with no project is left alone", async () => {
+        const findOneSpy: jest.SpyInstance = mockFindOneBy(null);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        const view: SavedViewModel = buildModel();
+
+        const result: OnCreate<SavedViewModel> = await service.onBeforeCreate({
+          data: view,
+        } as CreateBy<SavedViewModel>);
+
+        expect(result.createBy.data.isDefault).toBeUndefined();
+        expect(findOneSpy).not.toHaveBeenCalled();
+        expect(updateSpy).not.toHaveBeenCalled();
+      });
+
+      test("the lookup for an existing default is scoped to the same project", async () => {
+        const findOneSpy: jest.SpyInstance = mockFindOneBy(null);
+        mockUpdateBy();
+
+        const view: SavedViewModel = buildModel();
+        view.projectId = PROJECT_ID;
+
+        await service.onBeforeCreate({
+          data: view,
+        } as CreateBy<SavedViewModel>);
+
+        const findArgs: Record<string, unknown> = findOneSpy.mock
+          .calls[0]?.[0] as Record<string, unknown>;
+        expect(findArgs["query"]).toEqual({
+          projectId: PROJECT_ID,
+          isDefault: true,
+        });
+      });
+    });
+
+    describe("onBeforeUpdate", () => {
+      test("promoting a view to default demotes the others, but not itself", async () => {
+        const item: SavedViewModel = buildModel();
+        item._id = VIEW_ID.toString();
+        item.projectId = PROJECT_ID;
+        mockFindBy([item]);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        await service.onBeforeUpdate({
+          query: { _id: VIEW_ID.toString() },
+          data: { isDefault: true },
+        } as unknown as UpdateBy<SavedViewModel>);
+
+        expect(updateSpy).toHaveBeenCalledTimes(1);
+        const query: Record<string, unknown> = (
+          updateSpy.mock.calls[0]?.[0] as Record<string, unknown>
+        )["query"] as Record<string, unknown>;
+        expect(query["projectId"]).toBe(PROJECT_ID);
+        expect(query["isDefault"]).toBe(true);
+        /*
+         * The view being promoted is excluded, so the same statement cannot
+         * demote it again.
+         */
+        expect(query["_id"]).toBeDefined();
+      });
+
+      test("an update that does not set isDefault=true touches nothing", async () => {
+        const findSpy: jest.SpyInstance = mockFindBy([]);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        for (const data of [{ name: "Renamed" }, { isDefault: false }] as Array<
+          Partial<SavedViewModel>
+        >) {
+          await service.onBeforeUpdate({
+            query: { _id: VIEW_ID.toString() },
+            data: data,
+          } as unknown as UpdateBy<SavedViewModel>);
+        }
+
+        expect(findSpy).not.toHaveBeenCalled();
+        expect(updateSpy).not.toHaveBeenCalled();
+      });
+
+      test("a bulk promotion demotes the others in each affected project", async () => {
+        const otherProjectId: ObjectID = new ObjectID(
+          "33333333-3333-4333-8333-333333333333",
+        );
+        const first: SavedViewModel = buildModel();
+        first._id = VIEW_ID.toString();
+        first.projectId = PROJECT_ID;
+        const second: SavedViewModel = buildModel();
+        second._id = "44444444-4444-4444-8444-444444444444";
+        second.projectId = otherProjectId;
+        mockFindBy([first, second]);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        await service.onBeforeUpdate({
+          query: { isDefault: false },
+          data: { isDefault: true },
+        } as unknown as UpdateBy<SavedViewModel>);
+
+        expect(updateSpy).toHaveBeenCalledTimes(2);
+        const projectIds: Array<unknown> = updateSpy.mock.calls.map(
+          (call: Array<unknown>) => {
+            return (
+              (call[0] as Record<string, unknown>)["query"] as Record<
+                string,
+                unknown
+              >
+            )["projectId"];
+          },
+        );
+        expect(projectIds).toEqual([PROJECT_ID, otherProjectId]);
+      });
+
+      test("a matched view with no project is skipped rather than swept globally", async () => {
+        const orphan: SavedViewModel = buildModel();
+        orphan._id = VIEW_ID.toString();
+        mockFindBy([orphan]);
+        const updateSpy: jest.SpyInstance = mockUpdateBy();
+
+        await service.onBeforeUpdate({
+          query: { _id: VIEW_ID.toString() },
+          data: { isDefault: true },
+        } as unknown as UpdateBy<SavedViewModel>);
+
+        expect(updateSpy).not.toHaveBeenCalled();
+      });
+    });
+  },
+);
+
+describe("the three saved-view services", () => {
+  test("are distinct services over distinct models", () => {
+    const models: Array<string> = cases.map(({ buildModel }: ServiceCase) => {
+      return (buildModel() as BaseModel).tableName as string;
+    });
+    expect(new Set(models).size).toBe(3);
+    expect(
+      new Set([
+        LogSavedViewService,
+        TraceSavedViewService,
+        MetricSavedViewService,
+      ]).size,
+    ).toBe(3);
+  });
+});

package/Tests/Server/Services/StaticRuleCriteriaRuntimeCoverage.test.ts

@@ -196,9 +196,9 @@ describe("static rule criteria runtime coverage", () => {
     discoverStaticRuleForms();
   const inheritedRuleModelNames: Array<string> = getInheritedRuleModelNames();
 
-  test("all 64 static match-criteria forms route their 76 rule models through ModelForm", () => {
-    expect(formFiles).toHaveLength(64);
-    expect(formsByModel.size).toBe(76);
+  test("all 66 static match-criteria forms route their 78 rule models through ModelForm", () => {
+    expect(formFiles).toHaveLength(66);
+    expect(formsByModel.size).toBe(78);
     expect([...formsByModel.keys()].sort()).toEqual(inheritedRuleModelNames);
     expect(Object.keys(RULE_CRITERIA_FIELDS_BY_MODEL).sort()).toEqual(
       inheritedRuleModelNames,

package/Tests/Server/Services/StatusPageCertificateService.test.ts

@@ -0,0 +1,169 @@
+import StatusPageCertificateService from "../../../Server/Services/StatusPageCertificateService";
+import DatabaseConfig from "../../../Server/DatabaseConfig";
+import { AppApiHostname } from "../../../Server/EnvironmentConfig";
+import API from "../../../Utils/API";
+import Protocol from "../../../Types/API/Protocol";
+import URL from "../../../Types/API/URL";
+import { afterEach, describe, expect, test } from "@jest/globals";
+
+/*
+ * Custom status page domains get their TLS certificate from the cert worker,
+ * and this service is the only caller. Nothing about it is visible until a
+ * customer's domain fails to serve HTTPS, so what these tests hold is the
+ * request itself: the verb, the worker route, the domain in the body, and the
+ * protocol taken from the instance's own configuration rather than assumed.
+ */
+
+const WORKER_ROUTE: string = "/api/workers/cert";
+const DOMAIN: string = "status.example.com";
+
+type ApiCall = { url: URL; data: Record<string, unknown> };
+
+function lastCall(spy: jest.SpyInstance): ApiCall {
+  return spy.mock.calls[spy.mock.calls.length - 1]?.[0] as ApiCall;
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe.each([
+  { label: "https", protocol: Protocol.HTTPS },
+  { label: "http", protocol: Protocol.HTTP },
+])(
+  "StatusPageCertificateService over $label",
+  ({ protocol }: { protocol: Protocol }) => {
+    function mockProtocol(): jest.SpyInstance {
+      return jest
+        .spyOn(DatabaseConfig, "getHttpProtocol")
+        .mockResolvedValue(protocol as never);
+    }
+
+    test("add posts the domain to the cert worker", async () => {
+      mockProtocol();
+      const postSpy: jest.SpyInstance = jest
+        .spyOn(API, "post")
+        .mockResolvedValue({} as never);
+
+      await StatusPageCertificateService.add(DOMAIN);
+
+      expect(postSpy).toHaveBeenCalledTimes(1);
+      const call: ApiCall = lastCall(postSpy);
+      expect(call.data).toEqual({ domain: DOMAIN });
+      expect(call.url.protocol).toBe(protocol);
+      expect(call.url.hostname.toString()).toBe(AppApiHostname.toString());
+      expect(call.url.route.toString()).toBe(WORKER_ROUTE);
+    });
+
+    test("remove deletes the domain at the same route", async () => {
+      mockProtocol();
+      const deleteSpy: jest.SpyInstance = jest
+        .spyOn(API, "delete")
+        .mockResolvedValue({} as never);
+
+      await StatusPageCertificateService.remove(DOMAIN);
+
+      expect(deleteSpy).toHaveBeenCalledTimes(1);
+      const call: ApiCall = lastCall(deleteSpy);
+      expect(call.data).toEqual({ domain: DOMAIN });
+      expect(call.url.protocol).toBe(protocol);
+      expect(call.url.route.toString()).toBe(WORKER_ROUTE);
+    });
+
+    test("get reads the domain's certificate from the same route", async () => {
+      mockProtocol();
+      const getSpy: jest.SpyInstance = jest
+        .spyOn(API, "get")
+        .mockResolvedValue({} as never);
+
+      await StatusPageCertificateService.get(DOMAIN);
+
+      expect(getSpy).toHaveBeenCalledTimes(1);
+      const call: ApiCall = lastCall(getSpy);
+      expect(call.data).toEqual({ domain: DOMAIN });
+      expect(call.url.protocol).toBe(protocol);
+      expect(call.url.route.toString()).toBe(WORKER_ROUTE);
+    });
+  },
+);
+
+describe("StatusPageCertificateService", () => {
+  test("each verb reads the protocol fresh rather than caching the first answer", async () => {
+    const protocolSpy: jest.SpyInstance = jest
+      .spyOn(DatabaseConfig, "getHttpProtocol")
+      .mockResolvedValueOnce(Protocol.HTTP as never)
+      .mockResolvedValueOnce(Protocol.HTTPS as never);
+    const postSpy: jest.SpyInstance = jest
+      .spyOn(API, "post")
+      .mockResolvedValue({} as never);
+
+    await StatusPageCertificateService.add(DOMAIN);
+    await StatusPageCertificateService.add(DOMAIN);
+
+    expect(protocolSpy).toHaveBeenCalledTimes(2);
+    expect((postSpy.mock.calls[0]?.[0] as ApiCall).url.protocol).toBe(
+      Protocol.HTTP,
+    );
+    expect((postSpy.mock.calls[1]?.[0] as ApiCall).url.protocol).toBe(
+      Protocol.HTTPS,
+    );
+  });
+
+  test("the three verbs do not call one another", async () => {
+    jest
+      .spyOn(DatabaseConfig, "getHttpProtocol")
+      .mockResolvedValue(Protocol.HTTPS as never);
+    const postSpy: jest.SpyInstance = jest
+      .spyOn(API, "post")
+      .mockResolvedValue({} as never);
+    const deleteSpy: jest.SpyInstance = jest
+      .spyOn(API, "delete")
+      .mockResolvedValue({} as never);
+    const getSpy: jest.SpyInstance = jest
+      .spyOn(API, "get")
+      .mockResolvedValue({} as never);
+
+    await StatusPageCertificateService.get(DOMAIN);
+
+    expect(getSpy).toHaveBeenCalledTimes(1);
+    expect(postSpy).not.toHaveBeenCalled();
+    expect(deleteSpy).not.toHaveBeenCalled();
+
+    await StatusPageCertificateService.remove(DOMAIN);
+
+    expect(deleteSpy).toHaveBeenCalledTimes(1);
+    expect(postSpy).not.toHaveBeenCalled();
+  });
+
+  test("the domain is passed through untouched, punycode and all", async () => {
+    jest
+      .spyOn(DatabaseConfig, "getHttpProtocol")
+      .mockResolvedValue(Protocol.HTTPS as never);
+    const postSpy: jest.SpyInstance = jest
+      .spyOn(API, "post")
+      .mockResolvedValue({} as never);
+
+    for (const domain of [
+      "status.example.com",
+      "xn--80ak6aa92e.example.com",
+      "STATUS.EXAMPLE.COM",
+      "status.example.co.uk",
+    ]) {
+      await StatusPageCertificateService.add(domain);
+      expect(lastCall(postSpy).data).toEqual({ domain: domain });
+    }
+  });
+
+  test("a failing worker call is surfaced, not swallowed", async () => {
+    jest
+      .spyOn(DatabaseConfig, "getHttpProtocol")
+      .mockResolvedValue(Protocol.HTTPS as never);
+    jest
+      .spyOn(API, "post")
+      .mockRejectedValue(new Error("cert worker unreachable") as never);
+
+    await expect(StatusPageCertificateService.add(DOMAIN)).rejects.toThrow(
+      "cert worker unreachable",
+    );
+  });
+});