@oneuptime/common 14.0.7 → 14.0.8

package/Tests/Server/Services/CrossProjectRelationWriteGuard.test.ts

@@ -359,6 +359,7 @@ const INCIDENT_TEMPLATE_LISTS: Array<ResourceList> = [
   MONITOR_LIST,
   LABEL_LIST,
   POLICY_LIST,
+  STATUS_PAGE_LIST,
   ...TEMPLATE_RESOURCE_LISTS,
 ];
 
@@ -727,9 +728,73 @@ describe("cross-project relation guard on write", () => {
       expect(MonitorService.findBy).not.toHaveBeenCalled();
       expect(LabelService.findBy).not.toHaveBeenCalled();
       expect(OnCallDutyPolicyService.findBy).not.toHaveBeenCalled();
+      expect(StatusPageService.findBy).not.toHaveBeenCalled();
       expectNoResourceLookedUp();
     });
 
+    /*
+     * The status pages an incident is limited to. Another project's page
+     * would put that project's page name into this incident's feed and scope
+     * the incident to a page it can never show on.
+     */
+    test("rejects another project's status page", async () => {
+      await expect(
+        callHook(IncidentService, "onBeforeCreate", {
+          data: incidentWith({
+            statusPages: [stubOf(StatusPage, FOREIGN_STATUS_PAGE_ID)],
+          }),
+          props: { tenantId: PROJECT_ID },
+        }),
+      ).rejects.toThrow(foreignMessage("Status Page", FOREIGN_STATUS_PAGE_ID));
+
+      expect(counter).not.toHaveBeenCalled();
+    });
+
+    test("rejects a status page id that matches no record", async () => {
+      await expect(
+        callHook(IncidentService, "onBeforeCreate", {
+          data: incidentWith({
+            statusPages: [UNKNOWN_ID as unknown as StatusPage],
+          }),
+          props: { tenantId: PROJECT_ID },
+        }),
+      ).rejects.toThrow(`do not exist: Status Page "${UNKNOWN_ID}"`);
+    });
+
+    test("status pages copied from an incident template are checked too", async () => {
+      const template: IncidentTemplate = new IncidentTemplate();
+      template._id = TEMPLATE_ID;
+      template.statusPages = [stubOf(StatusPage, FOREIGN_STATUS_PAGE_ID)];
+
+      jest
+        .spyOn(IncidentTemplateService, "findOneBy")
+        .mockResolvedValue(template as never);
+
+      await expect(
+        callHook(IncidentService, "onBeforeCreate", {
+          data: incidentWith({
+            createdIncidentTemplateId: TEMPLATE_ID,
+          }),
+          props: { tenantId: PROJECT_ID },
+        }),
+      ).rejects.toThrow(foreignMessage("Status Page", FOREIGN_STATUS_PAGE_ID));
+
+      expect(counter).not.toHaveBeenCalled();
+    });
+
+    test("accepts this project's status page", async () => {
+      await expect(
+        callHook(IncidentService, "onBeforeCreate", {
+          data: incidentWith({
+            statusPages: [stubOf(StatusPage, OWN_STATUS_PAGE_ID)],
+          }),
+          props: { tenantId: PROJECT_ID },
+        }),
+      ).resolves.toBeDefined();
+
+      expect(counter).toHaveBeenCalledTimes(1);
+    });
+
     test.each(RESOURCE_LISTS)(
       "rejects another project's $modelName",
       async (list: ResourceList) => {
@@ -828,6 +893,7 @@ describe("cross-project relation guard on write", () => {
       monitorIds?: Array<string>;
       labelIds?: Array<string>;
       policyIds?: Array<string>;
+      statusPageIds?: Array<string>;
       resourceIds?: Dictionary<Array<string>>;
     }): Incident {
       const incident: Incident = new Incident();
@@ -836,6 +902,9 @@ describe("cross-project relation guard on write", () => {
       incident.monitors = (data.monitorIds || []).map((id: string) => {
         return stubOf(Monitor, id);
       });
+      incident.statusPages = (data.statusPageIds || []).map((id: string) => {
+        return stubOf(StatusPage, id);
+      });
       incident.labels = (data.labelIds || []).map((id: string) => {
         return stubOf(Label, id);
       });
@@ -1014,9 +1083,92 @@ describe("cross-project relation guard on write", () => {
 
       expect(IncidentService.findBy).not.toHaveBeenCalled();
       expect(MonitorService.findBy).not.toHaveBeenCalled();
+      expect(StatusPageService.findBy).not.toHaveBeenCalled();
       expectNoResourceLookedUp();
     });
 
+    test("rejects adding another project's status page", async () => {
+      matchedIncidents = [
+        storedIncident({
+          id: INCIDENT_ID,
+          projectId: PROJECT_ID,
+          statusPageIds: [OWN_STATUS_PAGE_ID],
+        }),
+      ];
+
+      await expect(
+        callHook(IncidentService, "onBeforeUpdate", {
+          // Bare uuid strings, as the dashboard's picker saves them.
+          data: { statusPages: [OWN_STATUS_PAGE_ID, FOREIGN_STATUS_PAGE_ID] },
+          query: { _id: INCIDENT_ID },
+          props: { tenantId: PROJECT_ID },
+        }),
+      ).rejects.toThrow(foreignMessage("Status Page", FOREIGN_STATUS_PAGE_ID));
+    });
+
+    test("re-saving a list keeps a status page the incident already holds", async () => {
+      matchedIncidents = [
+        storedIncident({
+          id: INCIDENT_ID,
+          projectId: PROJECT_ID,
+          statusPageIds: [FOREIGN_STATUS_PAGE_ID],
+        }),
+      ];
+
+      await expect(
+        callHook(IncidentService, "onBeforeUpdate", {
+          data: {
+            statusPages: [
+              FOREIGN_STATUS_PAGE_ID.toUpperCase(),
+              OWN_STATUS_PAGE_ID,
+            ],
+          },
+          query: { _id: INCIDENT_ID },
+          props: { tenantId: PROJECT_ID },
+        }),
+      ).resolves.toBeDefined();
+    });
+
+    test("updates without a tenant check status pages against the matched incident's project", async () => {
+      matchedIncidents = [
+        storedIncident({ id: INCIDENT_ID, projectId: PROJECT_ID }),
+      ];
+
+      await expect(
+        callHook(IncidentService, "onBeforeUpdate", {
+          data: { statusPages: [{ _id: FOREIGN_STATUS_PAGE_ID }] },
+          query: { _id: INCIDENT_ID },
+          props: { isRoot: true },
+        }),
+      ).rejects.toThrow(foreignMessage("Status Page", FOREIGN_STATUS_PAGE_ID));
+    });
+
+    test("accepts this project's status page and clearing the list", async () => {
+      matchedIncidents = [
+        storedIncident({
+          id: INCIDENT_ID,
+          projectId: PROJECT_ID,
+          statusPageIds: [OWN_STATUS_PAGE_ID],
+        }),
+      ];
+
+      await expect(
+        callHook(IncidentService, "onBeforeUpdate", {
+          data: { statusPages: [{ _id: OWN_STATUS_PAGE_ID }] },
+          query: { _id: INCIDENT_ID },
+          props: { tenantId: PROJECT_ID },
+        }),
+      ).resolves.toBeDefined();
+
+      await expect(
+        callHook(IncidentService, "onBeforeUpdate", {
+          data: { statusPages: [] },
+          query: { _id: INCIDENT_ID },
+          props: { tenantId: PROJECT_ID },
+        }),
+      ).resolves.toBeDefined();
+    });
+
     test.each(RESOURCE_LISTS)(
       "rejects adding another project's $modelName",
       async (list: ResourceList) => {
@@ -2346,52 +2498,85 @@ describe("cross-project relation guard on write", () => {
    */
   describe("every many-to-many list of project records is checked", () => {
     test.each([
+      {
+        name: "IncidentService",
+        service: IncidentService,
+        /*
+         * The SLOs an incident affects are checked on their own, by
+         * SloRecordReferenceValidator in both hooks, so they are not in the
+         * relation table.
+         */
+        checkedElsewhere: ["serviceLevelObjectives"],
+      },
       {
         name: "ScheduledMaintenanceService",
         service: ScheduledMaintenanceService,
+        checkedElsewhere: [],
+      },
+      {
+        name: "IncidentTemplateService",
+        service: IncidentTemplateService,
+        checkedElsewhere: [],
       },
-      { name: "IncidentTemplateService", service: IncidentTemplateService },
       {
         name: "ScheduledMaintenanceTemplateService",
         service: ScheduledMaintenanceTemplateService,
+        checkedElsewhere: [],
       },
-    ])("$name", ({ service }: { service: unknown }) => {
-      const model: DatabaseBaseModel = (
-        service as DatabaseService<DatabaseBaseModel>
-      ).getModel();
-
-      const projectScopedLists: Array<string> = model
-        .getTableColumns()
-        .columns.filter((column: string) => {
-          const metadata: TableColumnMetadata =
-            model.getTableColumnMetadata(column);
-
-          return (
-            metadata.type === TableColumnType.EntityArray &&
-            Boolean(metadata.modelType) &&
-            Boolean(new metadata.modelType!().getTenantColumn())
+    ])(
+      "$name",
+      ({
+        service,
+        checkedElsewhere,
+      }: {
+        service: unknown;
+        checkedElsewhere: Array<string>;
+      }) => {
+        const model: DatabaseBaseModel = (
+          service as DatabaseService<DatabaseBaseModel>
+        ).getModel();
+
+        const projectScopedLists: Array<string> = model
+          .getTableColumns()
+          .columns.filter((column: string) => {
+            const metadata: TableColumnMetadata =
+              model.getTableColumnMetadata(column);
+
+            return (
+              metadata.type === TableColumnType.EntityArray &&
+              Boolean(metadata.modelType) &&
+              Boolean(new metadata.modelType!().getTenantColumn()) &&
+              !checkedElsewhere.includes(column)
+            );
+          });
+
+        // Harness guard: a list named as checked elsewhere really exists.
+        for (const column of checkedElsewhere) {
+          expect(model.getTableColumnMetadata(column)?.type).toBe(
+            TableColumnType.EntityArray,
           );
-        });
+        }
 
-      const relations: Array<ProjectScopedRelation> = (
-        service as {
-          getProjectScopedRelations: () => Array<ProjectScopedRelation>;
+        const relations: Array<ProjectScopedRelation> = (
+          service as {
+            getProjectScopedRelations: () => Array<ProjectScopedRelation>;
+          }
+        ).getProjectScopedRelations();
+
+        expect(
+          relations
+            .map((relation: ProjectScopedRelation) => {
+              return relation.column;
+            })
+            .sort(),
+        ).toEqual([...projectScopedLists].sort());
+
+        for (const relation of relations) {
+          expect(relation.service.getModel()).toBeInstanceOf(
+            model.getTableColumnMetadata(relation.column).modelType!,
+          );
         }
-      ).getProjectScopedRelations();
-
-      expect(
-        relations
-          .map((relation: ProjectScopedRelation) => {
-            return relation.column;
-          })
-          .sort(),
-      ).toEqual([...projectScopedLists].sort());
-
-      for (const relation of relations) {
-        expect(relation.service.getModel()).toBeInstanceOf(
-          model.getTableColumnMetadata(relation.column).modelType!,
-        );
-      }
-    });
+      },
+    );
   });
 });

package/Tests/Server/Services/DatabaseServiceCompareAndSetColumns.test.ts

@@ -0,0 +1,191 @@
+import DatabaseService from "../../../Server/Services/DatabaseService";
+import IncidentPublicNote from "../../../Models/DatabaseModels/IncidentPublicNote";
+import ObjectID from "../../../Types/ObjectID";
+import { getJestSpyOn } from "../../Spy";
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+/*
+ * compareAndSetColumnsByIdWithoutHooks is updateColumnsByIdWithoutHooks'
+ * compare-and-set that says whether it wrote. The subscriber jobs claim a
+ * Pending notification with it, and the sweeper fails an interrupted one;
+ * both rely on the answer being right, so the SQL and the reading of its
+ * result are pinned here.
+ *
+ * The UPDATE sits in a CTE the statement SELECTs from: TypeORM's postgres
+ * query() answers a top-level UPDATE with [rows, rowCount], an array of two
+ * whether or not anything matched, so the result length could not tell a
+ * write from a miss.
+ */
+
+const NOTE_ID: ObjectID = new ObjectID("55555555-5555-4555-8555-555555555555");
+
+interface CapturedQuery {
+  sql: string;
+  params: Array<unknown>;
+}
+
+describe("DatabaseService.compareAndSetColumnsByIdWithoutHooks", () => {
+  let service: DatabaseService<IncidentPublicNote>;
+  let captured: Array<CapturedQuery>;
+  // What the database answers the statement with.
+  let answer: unknown;
+
+  beforeEach(() => {
+    jest.restoreAllMocks();
+    captured = [];
+    answer = [{ _id: NOTE_ID.toString() }];
+
+    service = new DatabaseService<IncidentPublicNote>(IncidentPublicNote);
+
+    const columns: Record<string, string> = {
+      subscriberNotificationStatusOnNoteCreated:
+        "subscriberNotificationStatusOnNoteCreated",
+      subscriberNotificationStatusMessage:
+        "subscriberNotificationStatusMessage",
+      version: "version",
+      _id: "_id",
+      updatedAt: "updatedAt",
+    };
+
+    getJestSpyOn(service, "getRepository").mockReturnValue({
+      metadata: {
+        tableName: "IncidentPublicNote",
+        findColumnWithPropertyName: (
+          propertyName: string,
+        ): { databaseName: string } | undefined => {
+          return columns[propertyName]
+            ? { databaseName: columns[propertyName]! }
+            : undefined;
+        },
+        updateDateColumn: { databaseName: "updatedAt" },
+        primaryColumns: [{ databaseName: "_id" }],
+      },
+      manager: {
+        connection: {
+          driver: {
+            preparePersistentValue: (value: unknown): unknown => {
+              return value;
+            },
+          },
+        },
+        query: async (
+          sql: string,
+          params: Array<unknown>,
+        ): Promise<unknown> => {
+          captured.push({ sql, params });
+          return answer;
+        },
+      },
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any);
+  });
+
+  function claim(): Promise<boolean> {
+    return service.compareAndSetColumnsByIdWithoutHooks({
+      id: NOTE_ID,
+      data: { subscriberNotificationStatusOnNoteCreated: "InProgress" },
+      expectedData: {
+        subscriberNotificationStatusOnNoteCreated: "Pending",
+        version: 4,
+      },
+    } as never);
+  }
+
+  it("is one statement: the guarded UPDATE, SELECTed from a CTE", async () => {
+    await claim();
+
+    expect(captured).toEqual([
+      {
+        sql:
+          `WITH "updated" AS (UPDATE "IncidentPublicNote" SET ` +
+          `"subscriberNotificationStatusOnNoteCreated" = $1, "updatedAt" = CURRENT_TIMESTAMP ` +
+          `WHERE "_id" = $2 ` +
+          `AND "subscriberNotificationStatusOnNoteCreated" IS NOT DISTINCT FROM $3 ` +
+          `AND "version" IS NOT DISTINCT FROM $4 ` +
+          `RETURNING "_id") SELECT "_id" FROM "updated"`,
+        params: ["InProgress", NOTE_ID.toString(), "Pending", 4],
+      },
+    ]);
+  });
+
+  it("never bumps the version it guards on", async () => {
+    await claim();
+
+    expect(captured[0]!.sql).not.toMatch(/"version" = /);
+  });
+
+  it("answers true when the row matched and was written", async () => {
+    await expect(claim()).resolves.toBe(true);
+  });
+
+  it("answers false when another writer changed the row first", async () => {
+    answer = [];
+
+    await expect(claim()).resolves.toBe(false);
+  });
+
+  it("answers false for anything that is not a list of written rows", async () => {
+    answer = undefined;
+
+    await expect(claim()).resolves.toBe(false);
+  });
+
+  it("leaves updatedAt alone when asked", async () => {
+    await service.compareAndSetColumnsByIdWithoutHooks({
+      id: NOTE_ID,
+      data: { subscriberNotificationStatusOnNoteCreated: "Failed" },
+      expectedData: { subscriberNotificationStatusOnNoteCreated: "InProgress" },
+      skipUpdateDateColumn: true,
+    } as never);
+
+    expect(captured[0]!.sql).not.toContain("updatedAt");
+  });
+
+  it("with nothing to set, writes nothing and answers false", async () => {
+    await expect(
+      service.compareAndSetColumnsByIdWithoutHooks({
+        id: NOTE_ID,
+        data: {},
+        expectedData: { version: 4 },
+      } as never),
+    ).resolves.toBe(false);
+
+    expect(captured).toEqual([]);
+  });
+
+  it("rejects unknown columns, under its own name, before issuing SQL", async () => {
+    await expect(
+      service.compareAndSetColumnsByIdWithoutHooks({
+        id: NOTE_ID,
+        data: { notAColumn: "x" },
+        expectedData: {},
+      } as never),
+    ).rejects.toThrow(
+      'compareAndSetColumnsByIdWithoutHooks: unknown column "notAColumn"',
+    );
+
+    await expect(
+      service.compareAndSetColumnsByIdWithoutHooks({
+        id: NOTE_ID,
+        data: { subscriberNotificationStatusOnNoteCreated: "InProgress" },
+        expectedData: { notAColumn: "x" },
+      } as never),
+    ).rejects.toThrow(
+      'compareAndSetColumnsByIdWithoutHooks: unknown expected column "notAColumn"',
+    );
+
+    expect(captured).toEqual([]);
+  });
+
+  it("the plain write it shares a builder with is unchanged: a bare UPDATE", async () => {
+    await service.updateColumnsByIdWithoutHooks({
+      id: NOTE_ID,
+      data: { subscriberNotificationStatusOnNoteCreated: "InProgress" },
+      expectedData: { version: 4 },
+    } as never);
+
+    expect(captured[0]!.sql).toBe(
+      `UPDATE "IncidentPublicNote" SET "subscriberNotificationStatusOnNoteCreated" = $1, "updatedAt" = CURRENT_TIMESTAMP WHERE "_id" = $2 AND "version" IS NOT DISTINCT FROM $3`,
+    );
+  });
+});