@oneuptime/common 14.0.6 → 14.0.8

package/Tests/Server/Services/ScheduledMaintenanceSubscriberTemplateFormats.test.ts

@@ -32,6 +32,9 @@ import Email from "../../../Types/Email";
 import Phone from "../../../Types/Phone";
 import ObjectID from "../../../Types/ObjectID";
 import StatusPageSubscriberNotificationMethod from "../../../Types/StatusPage/StatusPageSubscriberNotificationMethod";
+import StatusPageSubscriberNotificationEventType from "../../../Types/StatusPage/StatusPageSubscriberNotificationEventType";
+import SubscriberNotificationTemplateVariables from "../../../Types/StatusPage/SubscriberNotificationTemplateVariables";
+import SafeHtml from "../../../Types/SafeHtml";
 import {
   afterEach,
   beforeEach,
@@ -69,6 +72,12 @@ const MONITOR_ID: ObjectID = new ObjectID(
   "77777777-7777-4777-8777-777777777777",
 );
 
+// The secret in the subscriber's unsubscribe link, as its row carries it.
+const UNSUBSCRIBE_TOKEN: string = "5e".repeat(32);
+const STATUS_PAGE_URL: string = "https://status.example.com";
+const UNSUBSCRIBE_URL: string = `${STATUS_PAGE_URL}/unsubscribe/${SUBSCRIBER_ID.toString()}-${UNSUBSCRIBE_TOKEN}`;
+const MANAGE_URL: string = `${STATUS_PAGE_URL}/update-subscription/${SUBSCRIBER_ID.toString()}`;
+
 const STARTS_AT: Date = new Date("2024-03-04T06:08:00.000Z");
 const TITLE: string = "Quarterly database failover drill";
 const DESCRIPTION: string = "Failing over the **primary**.";
@@ -167,6 +176,7 @@ function subscriber(id: ObjectID = SUBSCRIBER_ID): StatusPageSubscriber {
   row.subscriberWebhook = URL.fromString(
     "https://hooks.example.com/subscriber",
   );
+  row.unsubscribeToken = UNSUBSCRIBE_TOKEN;
 
   return row;
 }
@@ -243,16 +253,40 @@ function sentWebhookData(): Record<string, string> {
     .data;
 }
 
-// The variables the service handed to compileTemplate for this template.
-function variablesCompiledInto(template: string): Record<string, string> {
-  const calls: Array<Array<unknown>> = mock(
-    StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate,
-  ).mock.calls.filter((call: Array<unknown>): boolean => {
+/*
+ * The variables the service handed to the compile of this template, as it
+ * passed them. The email body goes through compileEmailBodyTemplate, where
+ * HTML values are SafeHtml; everything else through compileTemplate.
+ */
+function rawVariablesCompiledInto(
+  template: string,
+): Record<string, string | SafeHtml> {
+  const calls: Array<Array<unknown>> = [
+    ...mock(
+      StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate,
+    ).mock.calls,
+    ...mock(
+      StatusPageSubscriberNotificationTemplateServiceClass.compileEmailBodyTemplate,
+    ).mock.calls,
+  ].filter((call: Array<unknown>): boolean => {
     return call[0] === template;
   });
 
   expect(calls).toHaveLength(1);
-  return calls[0]![1] as Record<string, string>;
+  return calls[0]![1] as Record<string, string | SafeHtml>;
+}
+
+// The same, with every SafeHtml value as its HTML.
+function variablesCompiledInto(template: string): Record<string, string> {
+  const variables: Record<string, string> = {};
+
+  for (const [name, value] of Object.entries(
+    rawVariablesCompiledInto(template),
+  )) {
+    variables[name] = SafeHtml.isSafeHtml(value) ? value.toHtml() : value;
+  }
+
+  return variables;
 }
 
 describe("scheduled maintenance subscriber notifications: template formats", () => {
@@ -297,6 +331,10 @@ describe("scheduled maintenance subscriber notifications: template formats", ()
       StatusPageSubscriberNotificationTemplateServiceClass,
       "compileTemplate",
     );
+    jest.spyOn(
+      StatusPageSubscriberNotificationTemplateServiceClass,
+      "compileEmailBodyTemplate",
+    );
 
     jest.spyOn(MailService, "sendMail").mockResolvedValue(accepted());
     jest.spyOn(SmsService, "sendSms").mockResolvedValue(accepted());
@@ -368,19 +406,29 @@ describe("scheduled maintenance subscriber notifications: template formats", ()
         OneUptimeDate.getDateAsUserFriendlyFormattedString(STARTS_AT),
       scheduledEndTime: "",
       resourcesAffected: "Primary database, Replica",
-      unsubscribeUrl: expect.any(String),
     };
 
+    /*
+     * Every message links to the subscriber's unsubscribe page, token and
+     * all - except an SMS from this public page, which keeps the shorter
+     * manage link (see StatusPageSubscriberUnsubscribe.buildSmsLink).
+     */
     expect(sms).toEqual({
       ...shared,
       scheduledMaintenanceDescription: DESCRIPTION_TEXT,
+      unsubscribeUrl: MANAGE_URL,
     });
     expect(slack).toEqual({
       ...shared,
       scheduledMaintenanceDescription: DESCRIPTION,
+      unsubscribeUrl: UNSUBSCRIBE_URL,
     });
-    expect(emailBody).toEqual(expect.objectContaining(shared));
-    expect(emailSubject).toEqual(expect.objectContaining(shared));
+    expect(emailBody).toEqual(
+      expect.objectContaining({ ...shared, unsubscribeUrl: UNSUBSCRIBE_URL }),
+    );
+    expect(emailSubject).toEqual(
+      expect.objectContaining({ ...shared, unsubscribeUrl: UNSUBSCRIBE_URL }),
+    );
     expect(Object.keys(emailSubject).sort()).toEqual(
       Object.keys(emailBody).sort(),
     );
@@ -515,4 +563,236 @@ describe("scheduled maintenance subscriber notifications: template formats", ()
       }),
     );
   });
+  describe("the unsubscribe link", () => {
+    beforeEach(() => {
+      jest
+        .spyOn(
+          StatusPageSubscriberNotificationTemplateService,
+          "getTemplateForStatusPage",
+        )
+        .mockResolvedValue(null);
+    });
+
+    test("the default email, Slack and webhook carry the token link; a public page's SMS the manage link", async () => {
+      await ScheduledMaintenanceService.notififySubscribersOnEventScheduled([
+        scheduledEvent(),
+      ]);
+
+      expect(sentMail()[0]!.vars["unsubscribeUrl"]).toBe(UNSUBSCRIBE_URL);
+      expect(sentSlack()[0]).toContain(`[Unsubscribe](${UNSUBSCRIBE_URL})`);
+      expect(
+        (
+          mock(StatusPageSubscriberWebhookUtil.sendWebhookNotification).mock
+            .calls[0]![0] as { payload: { unsubscribeUrl: string } }
+        ).payload.unsubscribeUrl,
+      ).toBe(UNSUBSCRIBE_URL);
+      expect(sentSms()[0]).toContain(`Unsub: ${MANAGE_URL}`);
+      expect(sentSms()[0]).not.toContain(UNSUBSCRIBE_TOKEN);
+    });
+
+    test("a private page's SMS carries the token link: its manage page needs a signed-in visitor", async () => {
+      const privatePage: StatusPage = statusPage({ withCustomProviders: true });
+      privatePage.isPublicStatusPage = false;
+
+      jest
+        .spyOn(StatusPageSubscriberService, "getStatusPagesToSendNotification")
+        .mockResolvedValue([privatePage]);
+
+      await ScheduledMaintenanceService.notififySubscribersOnEventScheduled([
+        scheduledEvent(),
+      ]);
+
+      expect(sentSms()[0]).toContain(`Unsub: ${UNSUBSCRIBE_URL}`);
+      expect(sentMail()[0]!.vars["unsubscribeUrl"]).toBe(UNSUBSCRIBE_URL);
+    });
+
+    test("a private page's custom SMS template gets the token link as {{unsubscribeUrl}}", async () => {
+      const privatePage: StatusPage = statusPage({ withCustomProviders: true });
+      privatePage.isPublicStatusPage = false;
+
+      jest
+        .spyOn(StatusPageSubscriberService, "getStatusPagesToSendNotification")
+        .mockResolvedValue([privatePage]);
+      useCustomTemplates(CUSTOM_SUBJECT);
+
+      await ScheduledMaintenanceService.notififySubscribersOnEventScheduled([
+        scheduledEvent(),
+      ]);
+
+      expect(
+        variablesCompiledInto(
+          CUSTOM_BODIES[StatusPageSubscriberNotificationMethod.SMS]!,
+        )["unsubscribeUrl"],
+      ).toBe(UNSUBSCRIBE_URL);
+    });
+  });
+
+  /*
+   * Escaping. The maintenance title, the status page's name and the names of
+   * its resources are plain text a project member typed. In an email body
+   * they must read as those characters; the description and the scheduled
+   * time are HTML the service rendered, and stay HTML. The subject, SMS,
+   * Slack and webhooks show text as written.
+   */
+  describe("escaping", () => {
+    const HOSTILE_TITLE: string = "<script>alert('x')</script> Failover";
+    const HOSTILE_TITLE_HTML: string =
+      "&lt;script&gt;alert(&#39;x&#39;)&lt;/script&gt; Failover";
+    const HOSTILE_PAGE_NAME: string = '<a href="https://evil.example">Acme</a>';
+    const HOSTILE_PAGE_NAME_HTML: string =
+      "&lt;a href=&quot;https://evil.example&quot;&gt;Acme&lt;/a&gt;";
+    const HOSTILE_RESOURCE: string = '<img src=x onerror="alert(1)"> & DB';
+    const HOSTILE_RESOURCE_HTML: string =
+      "&lt;img src=x onerror=&quot;alert(1)&quot;&gt; &amp; DB";
+
+    const ESCAPING_EMAIL_BODY: string =
+      "<h1>{{scheduledMaintenanceTitle}}</h1><p>{{statusPageName}}</p><div>{{resourcesAffected}}</div><div>{{scheduledMaintenanceDescription}}</div>";
+    const ESCAPING_TEXT: string =
+      "{{scheduledMaintenanceTitle}} on {{statusPageName}}: {{resourcesAffected}}";
+
+    function hostileEvent(): ScheduledMaintenance {
+      const event: ScheduledMaintenance = scheduledEvent();
+      event.title = HOSTILE_TITLE;
+      return event;
+    }
+
+    function hostilePage(withCustomProviders: boolean): StatusPage {
+      const page: StatusPage = statusPage({
+        withCustomProviders: withCustomProviders,
+      });
+      page.pageTitle = HOSTILE_PAGE_NAME;
+      return page;
+    }
+
+    beforeEach(() => {
+      // The service reads resources without their groups: a list of names.
+      jest
+        .spyOn(StatusPageResourceService, "findByMonitors")
+        .mockResolvedValue([resource(HOSTILE_RESOURCE), resource("Replica")]);
+    });
+
+    test("a custom email body escapes the title, the page name and the resource names", async () => {
+      jest
+        .spyOn(StatusPageSubscriberService, "getStatusPagesToSendNotification")
+        .mockResolvedValue([hostilePage(true)]);
+      jest
+        .spyOn(
+          StatusPageSubscriberNotificationTemplateService,
+          "getTemplateForStatusPage",
+        )
+        .mockImplementation(
+          async (data: {
+            notificationMethod: StatusPageSubscriberNotificationMethod;
+          }): Promise<StatusPageSubscriberNotificationTemplate | null> => {
+            const template: StatusPageSubscriberNotificationTemplate =
+              new StatusPageSubscriberNotificationTemplate();
+            template.notificationMethod = data.notificationMethod;
+            if (
+              data.notificationMethod ===
+              StatusPageSubscriberNotificationMethod.Email
+            ) {
+              template.templateBody = ESCAPING_EMAIL_BODY;
+              template.emailSubject = ESCAPING_TEXT;
+            } else {
+              template.templateBody = `${data.notificationMethod}: ${ESCAPING_TEXT}`;
+            }
+            return template;
+          },
+        );
+
+      await ScheduledMaintenanceService.notififySubscribersOnEventScheduled([
+        hostileEvent(),
+      ]);
+
+      expect(sentMail()).toHaveLength(1);
+      expect(sentMail()[0]!.vars).toEqual({
+        body: `<h1>${HOSTILE_TITLE_HTML}</h1><p>${HOSTILE_PAGE_NAME_HTML}</p><div>${HOSTILE_RESOURCE_HTML}, Replica</div><div>${DESCRIPTION_HTML}</div>`,
+      });
+
+      const text: string = `${HOSTILE_TITLE} on ${HOSTILE_PAGE_NAME}: ${HOSTILE_RESOURCE}, Replica`;
+      expect(sentMail()[0]!.subject).toBe(text);
+      expect(sentSms()).toEqual([
+        `${StatusPageSubscriberNotificationMethod.SMS}: ${text}`,
+      ]);
+      expect(sentSlack()).toEqual([
+        `${StatusPageSubscriberNotificationMethod.Slack}: ${text}`,
+      ]);
+      expect(sentWebhookData()["scheduledMaintenanceTitle"]).toBe(
+        HOSTILE_TITLE,
+      );
+      expect(sentWebhookData()["resourcesAffected"]).toBe(
+        `${HOSTILE_RESOURCE}, Replica`,
+      );
+    });
+
+    /*
+     * Only the advertised HTML variables, and the email-only HTML ones the
+     * default template also receives (the multi-timezone time, the rendered
+     * description under its old name, and the footer the page's admins
+     * wrote), go into the body as HTML.
+     */
+    test("only HTML values reach the email body as HTML", async () => {
+      jest
+        .spyOn(StatusPageSubscriberService, "getStatusPagesToSendNotification")
+        .mockResolvedValue([hostilePage(true)]);
+
+      await ScheduledMaintenanceService.notififySubscribersOnEventScheduled([
+        hostileEvent(),
+      ]);
+
+      const variables: Record<string, string | SafeHtml> =
+        rawVariablesCompiledInto(
+          CUSTOM_BODIES[StatusPageSubscriberNotificationMethod.Email]!,
+        );
+      const html: Array<string> = Object.keys(variables)
+        .filter((name: string): boolean => {
+          return SafeHtml.isSafeHtml(variables[name]);
+        })
+        .sort();
+
+      expect(html).toEqual(
+        [
+          ...SubscriberNotificationTemplateVariables.getEmailBodyHtmlVariableNamesForEventType(
+            StatusPageSubscriberNotificationEventType.SubscriberScheduledMaintenanceCreated,
+          ),
+          "eventDescription",
+          "scheduledAt",
+          "subscriberEmailNotificationFooterText",
+        ].sort(),
+      );
+      expect(variables["scheduledMaintenanceTitle"]).toBe(HOSTILE_TITLE);
+      expect(variables["statusPageName"]).toBe(HOSTILE_PAGE_NAME);
+    });
+
+    test("the default email gets the resource names escaped, and SMS and Slack get them as written", async () => {
+      jest
+        .spyOn(StatusPageSubscriberService, "getStatusPagesToSendNotification")
+        .mockResolvedValue([hostilePage(false)]);
+      jest
+        .spyOn(
+          StatusPageSubscriberNotificationTemplateService,
+          "getTemplateForStatusPage",
+        )
+        .mockResolvedValue(null);
+
+      await ScheduledMaintenanceService.notififySubscribersOnEventScheduled([
+        hostileEvent(),
+      ]);
+
+      expect(sentMail()[0]!.templateType).toBe(
+        EmailTemplateType.SubscriberScheduledMaintenanceEventCreated,
+      );
+      expect(sentMail()[0]!.vars["resourcesAffected"]).toBe(
+        `${HOSTILE_RESOURCE_HTML}, Replica`,
+      );
+      expect(sentMail()[0]!.vars["eventTitle"]).toBe(HOSTILE_TITLE);
+      expect(sentSms()[0]).toContain(`Impact: ${HOSTILE_RESOURCE}, Replica.`);
+      expect(sentSlack()[0]).toContain(
+        `**Resources Affected:** ${HOSTILE_RESOURCE}, Replica`,
+      );
+      for (const message of [...sentSms(), ...sentSlack()]) {
+        expect(message).not.toMatch(/&(?:amp|lt|gt|quot|#39);/);
+      }
+    });
+  });
 });

package/Tests/Server/Services/SloAffectedResourceCreatedFeed.test.ts

@@ -3,7 +3,6 @@ import AlertFeedService from "../../../Server/Services/AlertFeedService";
 import AlertService from "../../../Server/Services/AlertService";
 import IncidentFeedService from "../../../Server/Services/IncidentFeedService";
 import IncidentService from "../../../Server/Services/IncidentService";
-import MonitorService from "../../../Server/Services/MonitorService";
 import ProductAnalytics from "../../../Server/Utils/ProductAnalytics";
 import AlertWorkspaceMessages from "../../../Server/Utils/Workspace/WorkspaceMessages/Alert";
 import IncidentWorkspaceMessages from "../../../Server/Utils/Workspace/WorkspaceMessages/Incident";
@@ -26,6 +25,11 @@ import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
  *
  * The same markdown is posted to Slack and Teams, and the feed renders it
  * without safe mode, so a hostile SLO name is checked end to end here too.
+ *
+ * The feed builders read those relations themselves, one per query, through
+ * LinkedAffectedResources; the fixtures below answer each of those reads the
+ * way the database would. Every other relation the section now lists is
+ * covered in LinkedAffectedResourcesCreatedFeed.test.ts.
  */
 
 const DASHBOARD: string = "https://oneuptime.example/dashboard";
@@ -52,8 +56,40 @@ type OnCreateSuccessFunction = (
   createdItem: Incident,
 ) => Promise<Incident>;
 
+/*
+ * Answers the feed builder's per-relation reads from `record`: one row
+ * carrying only the relation that was selected, as the database would.
+ */
+function answerRelationReads(
+  service: { findAllBy: unknown },
+  record: Incident | Alert,
+): jest.SpyInstance {
+  return jest
+    .spyOn(service as typeof IncidentService, "findAllBy")
+    .mockImplementation((async (findAllBy: {
+      select: JSONObject;
+    }): Promise<Array<JSONObject>> => {
+      const row: JSONObject = {
+        _id: record._id!,
+        projectId: record.projectId as unknown as JSONObject,
+      };
+
+      for (const column of Object.keys(findAllBy.select)) {
+        if (column !== "_id" && column !== "projectId") {
+          row[column] = (record as unknown as JSONObject)[column]!;
+        }
+      }
+
+      return [row];
+    }) as never);
+}
+
+let incidentRelationReads: jest.SpyInstance | undefined;
+
 // The feed writers are private; they are reached the way the create hooks reach them.
 function createIncidentFeed(incident: Incident): Promise<void> {
+  incidentRelationReads = answerRelationReads(IncidentService, incident);
+
   return (
     IncidentService as unknown as {
       createIncidentFeedAsync: CreateIncidentFeedAsyncFunction;
@@ -97,6 +133,8 @@ function buildMonitor(id: string, name: string): Monitor {
   const monitor: Monitor = new Monitor();
   monitor._id = id;
   monitor.name = name;
+  // The relation reads select it; a monitor of no known project is not named.
+  monitor.projectId = PROJECT_ID;
   return monitor;
 }
 
@@ -163,7 +201,6 @@ function resourcesAffectedLines(markdown: string): Array<string> | null {
 
 let incidentFeedItem: jest.SpyInstance;
 let alertFeedItem: jest.SpyInstance;
-let dashboardUrlLookup: jest.SpyInstance;
 
 function postedMarkdown(spy: jest.SpyInstance): string {
   expect(spy).toHaveBeenCalledTimes(1);
@@ -177,22 +214,12 @@ beforeEach(() => {
    * A fresh URL per call: URL.addRoute mutates, so a shared instance would
    * hide a builder that forgot to copy it.
    */
-  dashboardUrlLookup = jest
+  jest
     .spyOn(DatabaseConfig, "getDashboardUrl")
     .mockImplementation(async (): Promise<URL> => {
       return URL.fromString(DASHBOARD);
     });
 
-  jest
-    .spyOn(MonitorService, "getMonitorLinkInDashboard")
-    .mockImplementation(
-      async (projectId: ObjectID, monitorId: ObjectID): Promise<URL> => {
-        return URL.fromString(
-          `${DASHBOARD}/${projectId.toString()}/monitors/${monitorId.toString()}`,
-        );
-      },
-    );
-
   jest
     .spyOn(IncidentWorkspaceMessages, "getIncidentCreateMessageBlocks")
     .mockResolvedValue([] as never);
@@ -246,7 +273,7 @@ describe("incident created feed item", () => {
     ]);
   });
 
-  test("a monitors-only incident reads exactly as before, without a dashboard lookup for SLOs", async () => {
+  test("a monitors-only incident reads exactly as before", async () => {
     await createIncidentFeed(
       buildIncident({ monitors: [buildMonitor(MONITOR_ID, "checkout-web")] }),
     );
@@ -254,7 +281,6 @@ describe("incident created feed item", () => {
     expect(resourcesAffectedLines(postedMarkdown(incidentFeedItem))).toEqual([
       `- [checkout-web](${monitorLink(MONITOR_ID)})`,
     ]);
-    expect(dashboardUrlLookup).not.toHaveBeenCalled();
   });
 
   test("an incident with neither monitors nor SLOs has no Resources Affected section", async () => {
@@ -328,7 +354,31 @@ describe("incident created feed item", () => {
     expect(resourcesAffectedLines(postedMarkdown(incidentFeedItem))).toBeNull();
   });
 
-  test("onCreateSuccess reads the incident's SLOs for the feed item", async () => {
+  test("reads the incident's SLOs with their project, as root", async () => {
+    await createIncidentFeed(buildIncident({}));
+
+    const sloRead: JSONObject | undefined = incidentRelationReads!.mock.calls
+      .map((call: Array<unknown>): JSONObject => {
+        return call[0] as JSONObject;
+      })
+      .find((findAllBy: JSONObject): boolean => {
+        return Boolean(
+          (findAllBy["select"] as JSONObject)["serviceLevelObjectives"],
+        );
+      });
+
+    /*
+     * projectId too: the read runs as root, and the feed names only SLOs of
+     * the record's own project.
+     */
+    expect(
+      (sloRead!["select"] as JSONObject)["serviceLevelObjectives"],
+    ).toEqual({ _id: true, name: true, projectId: true });
+    expect(sloRead!["props"]).toEqual({ isRoot: true });
+    expect((sloRead!["query"] as JSONObject)["projectId"]).toBe(PROJECT_ID);
+  });
+
+  test("onCreateSuccess leaves the relations to the feed builder's own reads", async () => {
     jest.spyOn(ProductAnalytics, "captureForUser").mockImplementation((() => {
       // no analytics in tests
     }) as never);
@@ -362,45 +412,52 @@ describe("incident created feed item", () => {
     ).select;
 
     /*
-     * projectId too: the read runs as root, and the feed names only SLOs of
-     * the record's own project.
+     * Joining every many-to-many relation into this one read would return
+     * the product of their sizes; LinkedAffectedResources reads them one at
+     * a time instead.
      */
-    expect(select["serviceLevelObjectives"]).toEqual({
-      name: true,
-      _id: true,
-      projectId: true,
-    });
-    // The monitors the section already listed are still read.
-    expect(select["monitors"]).toEqual({ name: true, _id: true });
+    expect(select["monitors"]).toBeUndefined();
+    expect(select["serviceLevelObjectives"]).toBeUndefined();
+    expect(select["projectId"]).toBe(true);
   });
 });
 
 describe("alert created feed item", () => {
+  let alertRelationReads: jest.SpyInstance;
+
   function mockAlertRow(alert: Alert): jest.SpyInstance {
+    alertRelationReads = answerRelationReads(AlertService, alert);
+
     return jest
       .spyOn(AlertService, "findOneById")
       .mockResolvedValue(alert as never);
   }
 
-  test("reads the alert's SLOs alongside its monitor", async () => {
-    const findOneById: jest.SpyInstance = mockAlertRow(buildAlert({}));
+  test("reads the alert's SLOs alongside its monitor, with their project", async () => {
+    mockAlertRow(buildAlert({}));
 
     await createAlertFeed(ALERT_ID);
 
-    const select: JSONObject = (
-      findOneById.mock.calls[0]![0] as { select: JSONObject }
-    ).select;
+    const selects: Array<JSONObject> = alertRelationReads.mock.calls.map(
+      (call: Array<unknown>): JSONObject => {
+        return (call[0] as { select: JSONObject }).select;
+      },
+    );
 
     /*
-     * projectId too: the read runs as root, and the feed names only SLOs of
-     * the record's own project.
+     * projectId too: the reads run as root, and the feed names only
+     * resources of the record's own project.
      */
-    expect(select["serviceLevelObjectives"]).toEqual({
-      name: true,
+    expect(selects).toContainEqual({
+      _id: true,
+      projectId: true,
+      serviceLevelObjectives: { _id: true, name: true, projectId: true },
+    });
+    expect(selects).toContainEqual({
       _id: true,
       projectId: true,
+      monitor: { _id: true, name: true, projectId: true },
     });
-    expect(select["monitor"]).toEqual({ name: true, _id: true });
   });
 
   test("a burn-rate alert with no monitor names its SLO under Resources Affected", async () => {
@@ -446,7 +503,6 @@ describe("alert created feed item", () => {
     expect(resourcesAffectedLines(postedMarkdown(alertFeedItem))).toEqual([
       `- [checkout-web](${monitorLink(MONITOR_ID)})`,
     ]);
-    expect(dashboardUrlLookup).not.toHaveBeenCalled();
   });
 
   test("an alert with neither monitor nor SLOs has no Resources Affected section", async () => {

package/Tests/Server/Services/SmsServiceFailIfNotSent.test.ts

@@ -0,0 +1,67 @@
+import SmsService from "../../../Server/Services/SmsService";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import Phone from "../../../Types/Phone";
+import API from "../../../Utils/API";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * Common's SmsService posts every SMS to the Notification service's
+ * /api/notification/sms/send. failIfNotSent asks that route to answer with an
+ * error, not success, for an SMS it deliberately does not send (SMS turned
+ * off, too little balance); the status page subscriber jobs set it so such an
+ * SMS counts as failed. It is sent only when asked for, so every other
+ * caller's request is unchanged.
+ */
+
+describe("SmsService.sendSms and failIfNotSent", () => {
+  let post: MockFunction;
+
+  beforeEach(() => {
+    post = getJestMockFunction();
+    post.mockResolvedValue({} as never);
+    jest.spyOn(API, "post").mockImplementation(post as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  function postedBody(): JSONObject {
+    return (post.mock.calls[0]![0] as { data: JSONObject }).data;
+  }
+
+  test("sends failIfNotSent when the caller asks", async () => {
+    await SmsService.sendSms(
+      { to: new Phone("+15555550123"), message: "Hello" },
+      { projectId: ObjectID.generate(), failIfNotSent: true },
+    );
+
+    expect(postedBody()["failIfNotSent"]).toBe(true);
+  });
+
+  test("leaves it out otherwise, so other callers' requests are unchanged", async () => {
+    await SmsService.sendSms(
+      { to: new Phone("+15555550123"), message: "Hello" },
+      { projectId: ObjectID.generate() },
+    );
+    await SmsService.sendSms(
+      { to: new Phone("+15555550123"), message: "Hello" },
+      { projectId: ObjectID.generate(), failIfNotSent: false },
+    );
+
+    for (const call of post.mock.calls) {
+      expect("failIfNotSent" in (call[0] as { data: JSONObject }).data).toBe(
+        false,
+      );
+    }
+  });
+});