@oneuptime/common 14.0.6 → 14.0.8

package/Tests/Server/Services/IncidentTemplateCustomFieldsCopy.test.ts

@@ -0,0 +1,311 @@
+import Incident from "../../../Models/DatabaseModels/Incident";
+import IncidentCustomField from "../../../Models/DatabaseModels/IncidentCustomField";
+import IncidentState from "../../../Models/DatabaseModels/IncidentState";
+import IncidentTemplate from "../../../Models/DatabaseModels/IncidentTemplate";
+import CustomFieldMappingService from "../../../Server/Services/CustomFieldMappingService";
+import IncidentCustomFieldService from "../../../Server/Services/IncidentCustomFieldService";
+import IncidentService from "../../../Server/Services/IncidentService";
+import IncidentStateService from "../../../Server/Services/IncidentStateService";
+import IncidentTemplateService from "../../../Server/Services/IncidentTemplateService";
+import ProjectService from "../../../Server/Services/ProjectService";
+import UserService from "../../../Server/Services/UserService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import { OnCreate } from "../../../Server/Types/Database/Hooks";
+import ProjectScopedReferenceValidator from "../../../Server/Utils/Database/ProjectScopedReferenceValidator";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import CustomFieldType from "../../../Types/CustomField/CustomFieldType";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * An incident created with `createdIncidentTemplateId` (API callers that send
+ * only the template, and the root paths that declare from one) copies the
+ * template's custom field values - a MERGE into what the incident is given:
+ *
+ *   - the template fills in the fields the incident leaves out;
+ *   - a value the incident sets wins, 0, false and null included;
+ *   - the template's values are not checked as the caller's (the check sees
+ *     only what the caller sent), so a stale template value never refuses
+ *     the incident;
+ *   - the mapping from monitors still runs after the copy, and wins for a
+ *     mapped field.
+ */
+
+const projectId: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const templateId: string = "a1b2c3d4-0000-4000-8000-0000000000aa";
+
+const MEMBER_PROPS: DatabaseCommonInteractionProps = {
+  tenantId: projectId,
+  userId: new ObjectID("44444444-4444-4444-8444-444444444444"),
+};
+
+type OnBeforeCreate = (
+  createBy: CreateBy<Incident>,
+) => Promise<OnCreate<Incident>>;
+
+function definition(
+  name: string,
+  customFieldType: CustomFieldType,
+  dropdownOptions?: string,
+): IncidentCustomField {
+  const field: IncidentCustomField = new IncidentCustomField();
+  field.name = name;
+  field.customFieldType = customFieldType;
+
+  if (dropdownOptions) {
+    field.dropdownOptions = dropdownOptions;
+  }
+
+  return field;
+}
+
+let template: IncidentTemplate | null = null;
+let templateFindOneBy: MockFunction;
+let definitionFindBy: MockFunction;
+let applyMappingsToCreate: MockFunction;
+
+function templateWith(customFields: unknown): IncidentTemplate {
+  const incidentTemplate: IncidentTemplate = new IncidentTemplate();
+  incidentTemplate._id = templateId;
+  incidentTemplate.customFields = customFields as JSONObject;
+  return incidentTemplate;
+}
+
+function newIncident(customFields?: unknown): Incident {
+  const incident: Incident = new Incident();
+  incident.title = "Site outage";
+  incident.incidentSeverityId = new ObjectID(
+    "d0000000-0000-4000-8000-000000000001",
+  );
+  incident.createdIncidentTemplateId = templateId;
+
+  if (customFields !== undefined) {
+    incident.customFields = customFields as JSONObject;
+  }
+
+  return incident;
+}
+
+async function runBeforeCreate(
+  data: Incident,
+  props: DatabaseCommonInteractionProps = MEMBER_PROPS,
+): Promise<Incident> {
+  const onCreate: OnCreate<Incident> = await (
+    IncidentService as unknown as { onBeforeCreate: OnBeforeCreate }
+  ).onBeforeCreate({ data, props });
+
+  return onCreate.createBy.data;
+}
+
+beforeEach(() => {
+  template = null;
+
+  const createdState: IncidentState = new IncidentState();
+  createdState._id = "c0000000-0000-4000-8000-000000000001";
+  jest
+    .spyOn(IncidentStateService, "findOneBy")
+    .mockResolvedValue(createdState as never);
+  jest
+    .spyOn(ProjectService, "incrementAndGetIncidentCounter")
+    .mockResolvedValue({ counter: 7, prefix: undefined } as never);
+  jest
+    .spyOn(ProjectScopedReferenceValidator, "validateReferencesBelongToProject")
+    .mockResolvedValue(undefined as never);
+  jest
+    .spyOn(UserService, "getUserMarkdownString")
+    .mockResolvedValue("Test User" as never);
+
+  templateFindOneBy = getJestMockFunction();
+  templateFindOneBy.mockImplementation(() => {
+    return Promise.resolve(template);
+  });
+  jest
+    .spyOn(IncidentTemplateService, "findOneBy")
+    .mockImplementation(templateFindOneBy as never);
+
+  definitionFindBy = getJestMockFunction();
+  definitionFindBy.mockResolvedValue([
+    definition("Impact", CustomFieldType.Dropdown, "Low\nMedium\nHigh"),
+    definition("Estimated Duration", CustomFieldType.Number),
+    definition("Acknowledgement", CustomFieldType.Boolean),
+  ] as never);
+  jest
+    .spyOn(IncidentCustomFieldService, "findBy")
+    .mockImplementation(definitionFindBy as never);
+
+  applyMappingsToCreate = getJestMockFunction();
+  applyMappingsToCreate.mockResolvedValue(undefined as never);
+  jest
+    .spyOn(CustomFieldMappingService, "applyMappingsToCreate")
+    .mockImplementation(applyMappingsToCreate as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("IncidentService.onBeforeCreate: a template's custom field values", () => {
+  test("are read with the template, as root and within the project", async () => {
+    template = templateWith({ Impact: "High" });
+
+    await runBeforeCreate(newIncident());
+
+    const findOneBy: {
+      query: JSONObject;
+      select: JSONObject;
+      props: DatabaseCommonInteractionProps;
+    } = templateFindOneBy.mock.calls[0]![0] as {
+      query: JSONObject;
+      select: JSONObject;
+      props: DatabaseCommonInteractionProps;
+    };
+
+    expect(findOneBy.select["customFields"]).toBe(true);
+    expect(findOneBy.query["projectId"]).toBe(projectId);
+    expect(findOneBy.query["_id"]).toBe(templateId);
+    expect(findOneBy.props).toEqual({ isRoot: true });
+  });
+
+  test("an incident created with none gets the template's", async () => {
+    template = templateWith({ Impact: "High", Category: "Network" });
+
+    const created: Incident = await runBeforeCreate(newIncident());
+
+    expect(created.customFields).toEqual({
+      Impact: "High",
+      Category: "Network",
+    });
+  });
+
+  test("merge into the incident's own values: the template fills only the gaps", async () => {
+    template = templateWith({ Impact: "High", Category: "Network" });
+
+    const created: Incident = await runBeforeCreate(
+      newIncident({ Impact: "Low", Ticket: "OPS-7" }),
+    );
+
+    expect(created.customFields).toEqual({
+      Impact: "Low",
+      Category: "Network",
+      Ticket: "OPS-7",
+    });
+  });
+
+  test("0, false and null from the caller are kept, not filled over", async () => {
+    template = templateWith({
+      "Estimated Duration": 5,
+      Acknowledgement: true,
+      Impact: "High",
+    });
+
+    const created: Incident = await runBeforeCreate(
+      newIncident({
+        "Estimated Duration": 0,
+        Acknowledgement: false,
+        Impact: null,
+      }),
+    );
+
+    expect(created.customFields).toEqual({
+      "Estimated Duration": 0,
+      Acknowledgement: false,
+      Impact: null,
+    });
+  });
+
+  test("a template value that no longer fits its field does not refuse the incident", async () => {
+    // "Critical" was removed from Impact after the template was saved.
+    template = templateWith({ Impact: "Critical" });
+
+    const created: Incident = await runBeforeCreate(
+      newIncident({ Acknowledgement: true }),
+    );
+
+    expect(created.customFields).toEqual({
+      Impact: "Critical",
+      Acknowledgement: true,
+    });
+
+    // Only the caller's own values were checked.
+    expect(definitionFindBy).toHaveBeenCalledTimes(1);
+  });
+
+  test("the caller's values are still checked", async () => {
+    template = templateWith({ Impact: "High" });
+
+    await expect(
+      runBeforeCreate(newIncident({ Impact: "Critical" })),
+    ).rejects.toThrow('"Critical" is not one of the options for "Impact"');
+  });
+
+  test("a template without values leaves the incident's as they are", async () => {
+    for (const templateCustomFields of [undefined, null, {}]) {
+      template = templateWith(templateCustomFields);
+
+      const withValues: Incident = await runBeforeCreate(
+        newIncident({ Ticket: "OPS-7" }),
+      );
+      expect(withValues.customFields).toEqual({ Ticket: "OPS-7" });
+
+      const withoutValues: Incident = await runBeforeCreate(newIncident());
+      expect(withoutValues.customFields).toBeUndefined();
+    }
+  });
+
+  test("no template found, nothing copied", async () => {
+    template = null;
+
+    const created: Incident = await runBeforeCreate(newIncident());
+
+    expect(created.customFields).toBeUndefined();
+  });
+
+  test("the mapping from monitors runs after the copy, and wins for a mapped field", async () => {
+    template = templateWith({ Impact: "High", Category: "Network" });
+
+    let seenByMapping: JSONObject | undefined = undefined;
+
+    applyMappingsToCreate.mockImplementation(((data: {
+      createBy: CreateBy<Incident>;
+    }) => {
+      seenByMapping = { ...(data.createBy.data.customFields || {}) };
+      data.createBy.data.customFields = {
+        ...(data.createBy.data.customFields || {}),
+        Impact: "Copied From Monitor",
+      };
+      return Promise.resolve();
+    }) as never);
+
+    const created: Incident = await runBeforeCreate(newIncident());
+
+    expect(seenByMapping).toEqual({ Impact: "High", Category: "Network" });
+    expect(created.customFields).toEqual({
+      Impact: "Copied From Monitor",
+      Category: "Network",
+    });
+  });
+
+  test("a root create from a template copies them too", async () => {
+    template = templateWith({ Impact: "High" });
+
+    const incident: Incident = newIncident();
+    incident.projectId = projectId;
+
+    const created: Incident = await runBeforeCreate(incident, {
+      isRoot: true,
+    });
+
+    expect(created.customFields).toEqual({ Impact: "High" });
+  });
+});

package/Tests/Server/Services/IncidentTemplateStatusPageScope.test.ts

@@ -0,0 +1,363 @@
+import IncidentTemplate from "../../../Models/DatabaseModels/IncidentTemplate";
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import IncidentTemplateService from "../../../Server/Services/IncidentTemplateService";
+import StatusPageService from "../../../Server/Services/StatusPageService";
+import CreateBy from "../../../Server/Types/Database/CreateBy";
+import { OnCreate, OnUpdate } from "../../../Server/Types/Database/Hooks";
+import UpdateBy from "../../../Server/Types/Database/UpdateBy";
+import ProjectScopedReferenceValidator from "../../../Server/Utils/Database/ProjectScopedReferenceValidator";
+import StatusPageReadAccess from "../../../Server/Utils/StatusPage/StatusPageReadAccess";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Dictionary from "../../../Types/Dictionary";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../Types/ObjectID";
+import Permission from "../../../Types/Permission";
+import getJestMockFunction, { MockFunction } from "../../MockType";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  jest,
+  test,
+} from "@jest/globals";
+
+/*
+ * An incident template can limit the incidents declared from it to status
+ * pages (IncidentTemplate.statusPages). IncidentTemplateService owns two
+ * things about that list:
+ *
+ *   - isScopedToStatusPages follows writes to it and nothing else. It is how
+ *     a template whose pages were all deleted (the join rows cascade away)
+ *     still declares incidents limited - to nothing - instead of incidents
+ *     that reach every status page listing their monitors;
+ *   - the pages a non-root caller adds must be pages they can read. Incident
+ *     members may edit templates, and a template's pages are copied onto
+ *     every incident declared from it, so this is the same rule as picking an
+ *     incident's pages.
+ *
+ * The database is stubbed: stored templates by a stub of findBy, and which
+ * status pages the caller can read by a stub of the status page service.
+ */
+
+const projectId: ObjectID = new ObjectID(
+  "5d7f3c0a-4c55-4d3e-9a3e-2d4a7d1c9e01",
+);
+const templateId: string = "a1b2c3d4-0000-4000-8000-0000000000aa";
+
+const PAGE_A: string = "b0000000-0000-4000-8000-00000000000a";
+const PAGE_B: string = "b0000000-0000-4000-8000-00000000000b";
+const HIDDEN_PAGE_X: string = "b0000000-0000-4000-8000-0000000000f1";
+
+const MEMBER_PROPS: DatabaseCommonInteractionProps = {
+  userId: new ObjectID("5d7f3c0a-4c55-4d3e-9a3e-2d4a7d1c9e02"),
+  tenantId: projectId,
+};
+
+type OnBeforeCreate = (
+  createBy: CreateBy<IncidentTemplate>,
+) => Promise<OnCreate<IncidentTemplate>>;
+type OnBeforeUpdate = (
+  updateBy: UpdateBy<IncidentTemplate>,
+) => Promise<OnUpdate<IncidentTemplate>>;
+
+function statusPage(id: string): StatusPage {
+  const page: StatusPage = new StatusPage();
+  page._id = id;
+  return page;
+}
+
+let storedTemplates: Array<IncidentTemplate> = [];
+let readable: Array<string> | null = [];
+let templateFindBy: MockFunction;
+let statusPageFindBy: MockFunction;
+
+function storedTemplate(statusPageIds: Array<string>): IncidentTemplate {
+  const template: IncidentTemplate = new IncidentTemplate();
+  template._id = templateId;
+  template.projectId = projectId;
+  template.statusPages = statusPageIds.map(statusPage);
+  return template;
+}
+
+async function runBeforeCreate(
+  data: IncidentTemplate,
+  props: DatabaseCommonInteractionProps = MEMBER_PROPS,
+): Promise<IncidentTemplate> {
+  const onCreate: OnCreate<IncidentTemplate> = await (
+    IncidentTemplateService as unknown as { onBeforeCreate: OnBeforeCreate }
+  ).onBeforeCreate({ data, props });
+
+  return onCreate.createBy.data;
+}
+
+async function runBeforeUpdate(
+  data: Record<string, unknown>,
+  props: DatabaseCommonInteractionProps = MEMBER_PROPS,
+): Promise<Record<string, unknown>> {
+  const onUpdate: OnUpdate<IncidentTemplate> = await (
+    IncidentTemplateService as unknown as { onBeforeUpdate: OnBeforeUpdate }
+  ).onBeforeUpdate({
+    query: { _id: templateId },
+    data: data as UpdateBy<IncidentTemplate>["data"],
+    props: props,
+    limit: 1,
+    skip: 0,
+  });
+
+  return onUpdate.updateBy.data as unknown as Record<string, unknown>;
+}
+
+beforeEach(() => {
+  storedTemplates = [storedTemplate([])];
+  readable = [PAGE_A, PAGE_B];
+
+  templateFindBy = getJestMockFunction();
+  templateFindBy.mockImplementation(() => {
+    return Promise.resolve(storedTemplates);
+  });
+  jest
+    .spyOn(IncidentTemplateService, "findBy")
+    .mockImplementation(templateFindBy as never);
+
+  statusPageFindBy = getJestMockFunction();
+  statusPageFindBy.mockImplementation(
+    (findBy: { query: { _id: unknown } }): Promise<Array<StatusPage>> => {
+      if (readable === null) {
+        return Promise.reject(
+          new NotAuthorizedException(
+            "You do not have permissions to read Status Page.",
+          ),
+        );
+      }
+
+      const operator: { objectLiteralParameters?: Dictionary<unknown> } = findBy
+        .query._id as { objectLiteralParameters?: Dictionary<unknown> };
+
+      return Promise.resolve(
+        (
+          Object.values(operator.objectLiteralParameters || {}) as Array<
+            Array<string>
+          >
+        )
+          .flat()
+          .map((id: string): string => {
+            return id.toLowerCase();
+          })
+          .filter((id: string): boolean => {
+            return readable!.includes(id);
+          })
+          .map(statusPage),
+      );
+    },
+  );
+  jest
+    .spyOn(StatusPageService, "findBy")
+    .mockImplementation(statusPageFindBy as never);
+
+  jest
+    .spyOn(ProjectScopedReferenceValidator, "validateReferencesBelongToProject")
+    .mockResolvedValue(undefined as never);
+  jest
+    .spyOn(ProjectScopedReferenceValidator, "getHeldRelationIds")
+    .mockResolvedValue(new Map() as never);
+});
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("IncidentTemplateService: isScopedToStatusPages follows the template's status pages", () => {
+  test("a template created with pages is scoped", async () => {
+    const created: IncidentTemplate = await runBeforeCreate(
+      Object.assign(new IncidentTemplate(), {
+        statusPages: [statusPage(PAGE_A)],
+      }),
+    );
+
+    expect(created.isScopedToStatusPages).toBe(true);
+  });
+
+  test("a template created without pages is not, whatever the client sent", async () => {
+    const created: IncidentTemplate = await runBeforeCreate(
+      Object.assign(new IncidentTemplate(), {
+        isScopedToStatusPages: true,
+      }),
+    );
+
+    expect(created.isScopedToStatusPages).toBe(false);
+
+    const empty: IncidentTemplate = await runBeforeCreate(
+      Object.assign(new IncidentTemplate(), {
+        statusPages: [],
+        isScopedToStatusPages: true,
+      }),
+    );
+
+    expect(empty.isScopedToStatusPages).toBe(false);
+  });
+
+  test("writing pages scopes it, and clearing them unscopes it", async () => {
+    expect(
+      (await runBeforeUpdate({ statusPages: [PAGE_A] }))[
+        "isScopedToStatusPages"
+      ],
+    ).toBe(true);
+
+    storedTemplates = [storedTemplate([PAGE_A])];
+
+    expect(
+      (await runBeforeUpdate({ statusPages: [] }))["isScopedToStatusPages"],
+    ).toBe(false);
+  });
+
+  test("a client's flag is dropped; an update that does not write the list leaves the flag alone", async () => {
+    const data: Record<string, unknown> = await runBeforeUpdate({
+      name: "Region East outage",
+      isScopedToStatusPages: false,
+    });
+
+    expect(data).not.toHaveProperty("isScopedToStatusPages");
+  });
+});
+
+describe("IncidentTemplateService: the status pages a caller adds must be pages they can read", () => {
+  test("creating a template with a page the caller cannot read is refused", async () => {
+    readable = [PAGE_A];
+
+    await expect(
+      runBeforeCreate(
+        Object.assign(new IncidentTemplate(), {
+          statusPages: [statusPage(PAGE_A), statusPage(PAGE_B)],
+        }),
+      ),
+    ).rejects.toThrow(
+      StatusPageReadAccess.getRefusalMessage("incident template"),
+    );
+  });
+
+  test("a caller without status page access cannot give a template pages", async () => {
+    readable = null;
+
+    await expect(
+      runBeforeCreate(
+        Object.assign(new IncidentTemplate(), {
+          statusPages: [statusPage(PAGE_A)],
+        }),
+        {
+          ...MEMBER_PROPS,
+          userTenantAccessPermission: {
+            [projectId.toString()]: {
+              projectId: projectId,
+              _type: "UserTenantAccessPermission",
+              permissions: [
+                {
+                  _type: "UserPermission",
+                  permission: Permission.IncidentMember,
+                  labelIds: [],
+                  isBlockPermission: false,
+                },
+              ],
+            },
+          },
+        },
+      ),
+    ).rejects.toBeInstanceOf(NotAuthorizedException);
+  });
+
+  test("adding a page the caller cannot read to a template is refused", async () => {
+    readable = [PAGE_A];
+
+    await expect(
+      runBeforeUpdate({ statusPages: [PAGE_A, PAGE_B] }),
+    ).rejects.toBeInstanceOf(NotAuthorizedException);
+  });
+
+  test("a page the template already holds is not added, so it is not checked", async () => {
+    readable = [PAGE_A];
+    storedTemplates = [storedTemplate([PAGE_A, HIDDEN_PAGE_X])];
+
+    const data: Record<string, unknown> = await runBeforeUpdate({
+      statusPages: [PAGE_A, HIDDEN_PAGE_X],
+    });
+
+    expect(data["isScopedToStatusPages"]).toBe(true);
+  });
+
+  test("reads the templates as root, limited to the caller's project", async () => {
+    await runBeforeUpdate({ statusPages: [PAGE_A] });
+
+    const findBy: {
+      query: Record<string, unknown>;
+      props: DatabaseCommonInteractionProps;
+    } = templateFindBy.mock.calls[0]![0];
+
+    expect(findBy.props).toEqual({ isRoot: true });
+    expect(findBy.query["projectId"]).toBe(projectId);
+    expect(findBy.query["_id"]).toBe(templateId);
+  });
+
+  test("a root caller adds any page", async () => {
+    readable = null;
+
+    const data: Record<string, unknown> = await runBeforeUpdate(
+      { statusPages: [PAGE_B] },
+      { isRoot: true },
+    );
+
+    expect(data["isScopedToStatusPages"]).toBe(true);
+    expect(statusPageFindBy).not.toHaveBeenCalled();
+    // Only the project lookup a root update without a tenant always makes.
+    for (const call of templateFindBy.mock.calls) {
+      expect(
+        (call[0] as { select: Record<string, unknown> }).select,
+      ).not.toHaveProperty("statusPages");
+    }
+  });
+
+  test("clearing the list checks nothing", async () => {
+    readable = null;
+    storedTemplates = [storedTemplate([PAGE_A])];
+
+    await runBeforeUpdate({ statusPages: [] });
+
+    expect(statusPageFindBy).not.toHaveBeenCalled();
+  });
+});
+
+describe("IncidentTemplate.isScopedToStatusPages column", () => {
+  function access(column: string): {
+    create: Array<Permission>;
+    read: Array<Permission>;
+    update: Array<Permission>;
+  } {
+    const columnAccess: {
+      create?: Array<Permission>;
+      read?: Array<Permission>;
+      update?: Array<Permission>;
+    } = new IncidentTemplate().getColumnAccessControlFor(column) || {};
+
+    return {
+      create: (columnAccess.create || []).slice(),
+      read: (columnAccess.read || []).slice(),
+      update: (columnAccess.update || []).slice(),
+    };
+  }
+
+  test("has the access control of the template's status pages", () => {
+    expect(access("isScopedToStatusPages")).toEqual(access("statusPages"));
+  });
+
+  test("is computed, required, false by default and hidden from the API docs", () => {
+    const template: IncidentTemplate = new IncidentTemplate();
+
+    expect(template.getTableColumnMetadata("isScopedToStatusPages")).toEqual(
+      expect.objectContaining({
+        computed: true,
+        required: true,
+        hideColumnInDocumentation: true,
+        defaultValue: false,
+      }),
+    );
+  });
+});