@oneuptime/common 14.0.7 → 14.0.9

package/Tests/Models/DatabaseModels/KubernetesAiAgentModel.test.ts

@@ -0,0 +1,295 @@
+import AllModelTypes, {
+  getModelTypeByName,
+} from "../../../Models/DatabaseModels/Index";
+import KubernetesAiAgent from "../../../Models/DatabaseModels/KubernetesAiAgent";
+import KubernetesCluster from "../../../Models/DatabaseModels/KubernetesCluster";
+import RunnerJob from "../../../Models/DatabaseModels/RunnerJob";
+import DatabaseRequestType from "../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import ColumnPermissions from "../../../Server/Types/Database/Permissions/ColumnPermission";
+import TablePermission from "../../../Server/Types/Database/Permissions/TablePermission";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import type { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+
+/*
+ * The Kubernetes AI agent's row, as the permission layer sees it.
+ *
+ *  - It is server-owned: nobody creates, updates or deletes one through the
+ *    API, and there is no CRUD endpoint or API documentation for it (the
+ *    dashboard reads it through the cluster's AI access status).
+ *  - Whoever may read the cluster may read its agent — except the key hash,
+ *    which no role may read, write or create, a project owner included.
+ *  - One agent per cluster, enforced by a unique index.
+ *  - RunnerJob.targetKubernetesAiAgentId is read like targetAgentId and
+ *    written by nobody but the server.
+ *  - KubernetesCluster.isAiInvestigationEnabled is on by default.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+
+function propsWith(
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId: PROJECT_ID,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission) => {
+      return {
+        _type: "UserPermission",
+        permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId: ObjectID.generate(),
+    tenantId: PROJECT_ID,
+    userTenantAccessPermission: {
+      [PROJECT_ID.toString()]: tenantPermission,
+    },
+  };
+}
+
+function sorted(permissions: ReadonlyArray<Permission>): Array<Permission> {
+  return [...permissions].sort();
+}
+
+describe("KubernetesAiAgent model", () => {
+  const agent: KubernetesAiAgent = new KubernetesAiAgent();
+  const cluster: KubernetesCluster = new KubernetesCluster();
+  const accessControl: Record<string, ColumnAccessControl> =
+    agent.getColumnAccessControlForAllColumns();
+
+  it("is registered with the other database models", () => {
+    expect(AllModelTypes).toContain(KubernetesAiAgent);
+    expect(getModelTypeByName("KubernetesAiAgent")).toBe(KubernetesAiAgent);
+  });
+
+  it("names its table and itself as the design says", () => {
+    expect(agent.tableName).toBe("KubernetesAiAgent");
+    expect(agent.singularName).toBe("Kubernetes AI Agent");
+    expect(agent.pluralName).toBe("Kubernetes AI Agents");
+  });
+
+  it("is a project's row (tenant column projectId)", () => {
+    expect(agent.getTenantColumn()).toBe("projectId");
+  });
+
+  it("has no CRUD API, no API documentation and no MCP tools", () => {
+    expect(agent.crudApiPath).toBeFalsy();
+    expect(agent.enableDocumentation).toBeFalsy();
+    expect(agent.enableMCP).toBeFalsy();
+  });
+
+  it("nobody creates, updates or deletes a row through the API", () => {
+    expect(agent.getCreatePermissions()).toEqual([]);
+    expect(agent.getUpdatePermissions()).toEqual([]);
+    expect(agent.getDeletePermissions()).toEqual([]);
+  });
+
+  it("is readable by exactly the roles that may read the cluster", () => {
+    expect(sorted(agent.getReadPermissions())).toEqual(
+      sorted(cluster.getReadPermissions()),
+    );
+  });
+
+  it("every column is server-written: create and update ACLs are empty", () => {
+    for (const [column, acl] of Object.entries(accessControl)) {
+      expect({ column, create: acl.create }).toEqual({ column, create: [] });
+      expect({ column, update: acl.update }).toEqual({ column, update: [] });
+    }
+  });
+
+  it("every column but the key hash is readable by the cluster's readers", () => {
+    const readable: Array<string> = Object.keys(accessControl).filter(
+      (column: string): boolean => {
+        return column !== "keyHash";
+      },
+    );
+
+    expect(readable.length).toBeGreaterThan(5);
+
+    for (const column of readable) {
+      expect({ column, read: sorted(accessControl[column]!.read) }).toEqual({
+        column,
+        read: sorted(cluster.getReadPermissions()),
+      });
+    }
+  });
+
+  it("the key hash is readable, creatable and updatable by no role at all", () => {
+    expect(accessControl["keyHash"]).toEqual({
+      create: [],
+      read: [],
+      update: [],
+    });
+  });
+
+  it.each([DatabaseRequestType.Create, DatabaseRequestType.Update])(
+    "a project owner and admin cannot %s the key hash",
+    (requestType: DatabaseRequestType) => {
+      expect(() => {
+        ColumnPermissions.checkDataColumnPermissions(
+          KubernetesAiAgent,
+          { keyHash: "0".repeat(64) } as unknown as KubernetesAiAgent,
+          propsWith([Permission.ProjectOwner, Permission.ProjectAdmin]),
+          requestType,
+        );
+      }).toThrow(BadDataException);
+    },
+  );
+
+  it("a project owner may read the table but not create in it", () => {
+    expect(() => {
+      TablePermission.checkTableLevelPermissions(
+        KubernetesAiAgent,
+        propsWith([Permission.ProjectOwner]),
+        DatabaseRequestType.Read,
+      );
+    }).not.toThrow();
+
+    expect(() => {
+      TablePermission.checkTableLevelPermissions(
+        KubernetesAiAgent,
+        propsWith([Permission.ProjectOwner]),
+        DatabaseRequestType.Create,
+      );
+    }).toThrow();
+  });
+
+  it("a cluster's readers never select the key hash", () => {
+    const readableColumns: Array<string> =
+      ColumnPermissions.getModelColumnsByPermissions(
+        KubernetesAiAgent,
+        propsWith([Permission.ProjectOwner]).userTenantAccessPermission![
+          PROJECT_ID.toString()
+        ]!.permissions,
+        DatabaseRequestType.Read,
+      ).columns;
+
+    expect(readableColumns).toContain("connectionStatus");
+    expect(readableColumns).not.toContain("keyHash");
+  });
+
+  it("allows one agent per live cluster row, with a named unique index", () => {
+    const index: IndexMetadataArgs | undefined =
+      getMetadataArgsStorage().indices.find(
+        (candidate: IndexMetadataArgs): boolean => {
+          return (
+            candidate.target === KubernetesAiAgent &&
+            candidate.name === "IDX_KubernetesAiAgent_kubernetesClusterId"
+          );
+        },
+      );
+
+    expect(index).toBeDefined();
+    expect(index?.columns).toEqual(["kubernetesClusterId"]);
+    expect(index?.unique).toBe(true);
+    expect(index?.where).toBe('"deletedAt" IS NULL');
+  });
+
+  it("starts disconnected", () => {
+    const metadata: ReturnType<KubernetesAiAgent["getTableColumnMetadata"]> =
+      agent.getTableColumnMetadata("connectionStatus");
+
+    expect(metadata.defaultValue).toBe("disconnected");
+    expect(metadata.isDefaultValueColumn).toBe(true);
+  });
+
+  it("links to its cluster and project, and both relations cascade", () => {
+    for (const relation of ["project", "kubernetesCluster"]) {
+      const declared:
+        | ReturnType<typeof getMetadataArgsStorage>["relations"][number]
+        | undefined = getMetadataArgsStorage().relations.find(
+        (candidate: { target: unknown; propertyName: string }): boolean => {
+          return (
+            candidate.target === KubernetesAiAgent &&
+            candidate.propertyName === relation
+          );
+        },
+      );
+
+      expect(declared?.options.onDelete).toBe("CASCADE");
+    }
+  });
+});
+
+describe("RunnerJob.targetKubernetesAiAgentId", () => {
+  const job: RunnerJob = new RunnerJob();
+  const accessControl: Record<string, ColumnAccessControl> =
+    job.getColumnAccessControlForAllColumns();
+
+  it.each(["targetKubernetesAiAgent", "targetKubernetesAiAgentId"])(
+    "%s is read like targetAgentId and written by nobody but the server",
+    (column: string) => {
+      expect(accessControl[column]).toBeDefined();
+      expect(accessControl[column]!.create).toEqual([]);
+      expect(accessControl[column]!.update).toEqual([]);
+      expect(sorted(accessControl[column]!.read)).toEqual(
+        sorted(accessControl["targetAgentId"]!.read),
+      );
+    },
+  );
+
+  it("is an entity relation to KubernetesAiAgent, backed by the id column", () => {
+    const metadata: ReturnType<RunnerJob["getTableColumnMetadata"]> =
+      job.getTableColumnMetadata("targetKubernetesAiAgent");
+
+    expect(metadata.modelType).toBe(KubernetesAiAgent);
+    expect(metadata.manyToOneRelationColumn).toBe("targetKubernetesAiAgentId");
+    expect(
+      job.getTableColumnMetadata("targetKubernetesAiAgentId").required,
+    ).toBe(false);
+  });
+
+  it("is indexed, for the agent's claim query", () => {
+    expect(
+      getMetadataArgsStorage().indices.some(
+        (index: IndexMetadataArgs): boolean => {
+          return (
+            index.target === RunnerJob &&
+            Array.isArray(index.columns) &&
+            index.columns.length === 1 &&
+            index.columns[0] === "targetKubernetesAiAgentId"
+          );
+        },
+      ),
+    ).toBe(true);
+  });
+});
+
+describe("KubernetesCluster.isAiInvestigationEnabled", () => {
+  it("is on by default, in the API metadata and the column", () => {
+    const metadata: ReturnType<KubernetesCluster["getTableColumnMetadata"]> =
+      new KubernetesCluster().getTableColumnMetadata(
+        "isAiInvestigationEnabled",
+      );
+
+    expect(metadata.defaultValue).toBe(true);
+    expect(metadata.description).toContain("On by default");
+    expect(metadata.description).toContain("Nothing is ever changed");
+
+    const column: { options: { default?: unknown } } | undefined =
+      getMetadataArgsStorage().columns.find(
+        (candidate: { target: unknown; propertyName: string }): boolean => {
+          return (
+            candidate.target === KubernetesCluster &&
+            candidate.propertyName === "isAiInvestigationEnabled"
+          );
+        },
+      );
+
+    expect(column?.options.default).toBe(true);
+  });
+});

package/Tests/Models/DatabaseModels/TeamComplianceSettingModel.test.ts

@@ -0,0 +1,347 @@
+import Models from "../../../Models/DatabaseModels/Index";
+import AlertSeverity from "../../../Models/DatabaseModels/AlertSeverity";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
+import TeamComplianceSetting from "../../../Models/DatabaseModels/TeamComplianceSetting";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import { PlanType } from "../../../Types/Billing/SubscriptionPlan";
+import ColumnLength from "../../../Types/Database/ColumnLength";
+import ColumnType from "../../../Types/Database/ColumnType";
+import { TableColumnMetadata } from "../../../Types/Database/TableColumn";
+import TableColumnType from "../../../Types/Database/TableColumnType";
+import { JSONObject } from "../../../Types/JSON";
+import Permission from "../../../Types/Permission";
+import ComplianceNotificationChannel from "../../../Types/Team/ComplianceNotificationChannel";
+import ComplianceRuleType from "../../../Types/Team/ComplianceRuleType";
+import { describe, expect, test } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import type { ColumnMetadataArgs } from "typeorm/metadata-args/ColumnMetadataArgs";
+import type { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+import type { RelationMetadataArgs } from "typeorm/metadata-args/RelationMetadataArgs";
+
+/*
+ * Schema-level guarantees of TeamComplianceSetting after rules gained a
+ * channel and a severity scope.
+ *
+ * None of this is visible to a service or server test - they pass just as
+ * happily against a column the API cannot write, a scope a project viewer can
+ * edit, or a rule table a lapsed licence can still change. So this pins the
+ * three new columns (type, related model, nullability, who may read and
+ * write them), that nothing about the table's gating changed (enterprise
+ * only, the same table permissions, no workflow components), that the unique
+ * (teamId, ruleType) index is gone, and that the API layer turns a posted
+ * severity list into models.
+ */
+
+type ModelType = { new (): BaseModel };
+
+const MODEL_TYPES: Array<ModelType> = Models as Array<ModelType>;
+
+const model: TeamComplianceSetting = new TeamComplianceSetting();
+
+const EDITORS: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.EditProjectTeam,
+];
+
+const READERS: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.ProjectMember,
+  Permission.Viewer,
+  Permission.ReadProjectTeam,
+];
+
+// The columns that together say what a rule checks.
+const SCOPE_COLUMNS: Array<string> = [
+  "ruleType",
+  "notificationChannel",
+  "incidentSeverities",
+  "alertSeverities",
+];
+
+type AccessControlForFunction = (
+  column: string,
+) => ColumnAccessControl | undefined;
+
+const accessControlFor: AccessControlForFunction = (
+  column: string,
+): ColumnAccessControl | undefined => {
+  return model.getColumnAccessControlForAllColumns()[column];
+};
+
+type ColumnArgsFunction = (
+  propertyName: string,
+) => ColumnMetadataArgs | undefined;
+
+const columnArgs: ColumnArgsFunction = (
+  propertyName: string,
+): ColumnMetadataArgs | undefined => {
+  return getMetadataArgsStorage().columns.find(
+    (column: ColumnMetadataArgs): boolean => {
+      return (
+        column.target === TeamComplianceSetting &&
+        column.propertyName === propertyName
+      );
+    },
+  );
+};
+
+type RelationArgsFunction = (
+  propertyName: string,
+) => RelationMetadataArgs | undefined;
+
+const relationArgs: RelationArgsFunction = (
+  propertyName: string,
+): RelationMetadataArgs | undefined => {
+  return getMetadataArgsStorage().relations.find(
+    (relation: RelationMetadataArgs): boolean => {
+      return (
+        relation.target === TeamComplianceSetting &&
+        relation.propertyName === propertyName
+      );
+    },
+  );
+};
+
+describe("TeamComplianceSetting - the table", () => {
+  test("is registered, routed and tenant-scoped as before", () => {
+    expect(MODEL_TYPES).toContain(TeamComplianceSetting);
+    expect(model.tableName).toBe("TeamComplianceSetting");
+    expect(model.getCrudApiPath()?.toString()).toBe("/team-compliance-setting");
+    expect(model.getTenantColumn()).toBe("projectId");
+  });
+
+  test("is still an Enterprise-only table", () => {
+    expect(model.requiresEnterprise).toBe(true);
+  });
+
+  test("keeps its billing plans", () => {
+    expect(model.createBillingPlan).toBe(PlanType.Scale);
+    expect(model.readBillingPlan).toBe(PlanType.Free);
+    expect(model.updateBillingPlan).toBe(PlanType.Scale);
+    expect(model.deleteBillingPlan).toBe(PlanType.Free);
+  });
+
+  test("is managed by team editors and readable by every project member", () => {
+    expect(model.getCreatePermissions()).toEqual(EDITORS);
+    expect(model.getUpdatePermissions()).toEqual(EDITORS);
+    expect(model.getDeletePermissions()).toEqual(EDITORS);
+    expect(model.getReadPermissions()).toEqual(READERS);
+  });
+
+  test("is still workflow-inert: annotated, with every trigger off", () => {
+    expect(model.enableWorkflowOn).toEqual({
+      create: false,
+      delete: false,
+      update: false,
+      read: false,
+    });
+  });
+
+  test("has no unique (teamId, ruleType) index any more, and keeps the plain team and project indexes", () => {
+    const indexes: Array<IndexMetadataArgs> =
+      getMetadataArgsStorage().indices.filter(
+        (index: IndexMetadataArgs): boolean => {
+          return index.target === TeamComplianceSetting;
+        },
+      );
+
+    expect(
+      indexes.filter((index: IndexMetadataArgs): boolean => {
+        return Boolean(index.unique);
+      }),
+    ).toEqual([]);
+
+    const indexedColumns: Array<string> = indexes
+      .map((index: IndexMetadataArgs): string => {
+        return JSON.stringify(index.columns);
+      })
+      .sort();
+
+    expect(indexedColumns).toEqual(
+      [JSON.stringify(["projectId"]), JSON.stringify(["teamId"])].sort(),
+    );
+  });
+});
+
+describe("TeamComplianceSetting - the scope columns", () => {
+  test("notificationChannel is optional short text: null means any channel", () => {
+    const metadata: TableColumnMetadata = model.getTableColumnMetadata(
+      "notificationChannel",
+    );
+
+    expect(metadata.type).toBe(TableColumnType.ShortText);
+    expect(metadata.required).toBe(false);
+    expect(metadata.title).toBe("Notification Channel");
+    expect(columnArgs("notificationChannel")?.options).toMatchObject({
+      type: ColumnType.ShortText,
+      length: ColumnLength.ShortText,
+      nullable: true,
+    });
+    expect(columnArgs("notificationChannel")?.options.default).toBeUndefined();
+  });
+
+  test("notificationChannel's API description names every channel it accepts", () => {
+    const description: string =
+      model.getTableColumnMetadata("notificationChannel").description || "";
+
+    for (const channel of Object.values(ComplianceNotificationChannel)) {
+      expect(description).toContain(channel);
+    }
+  });
+
+  test.each([
+    [
+      "incidentSeverities",
+      "IncidentSeverity",
+      IncidentSeverity,
+      "Incident Severities",
+    ],
+    ["alertSeverities", "AlertSeverity", AlertSeverity, "Alert Severities"],
+  ])(
+    "%s is an optional list of %s, stored as a many-to-many relation",
+    (
+      column: string,
+      _relatedName: string,
+      relatedModel: ModelType,
+      title: string,
+    ) => {
+      const metadata: TableColumnMetadata =
+        model.getTableColumnMetadata(column);
+
+      expect(metadata.type).toBe(TableColumnType.EntityArray);
+      expect(metadata.modelType).toBe(relatedModel);
+      expect(metadata.required).toBe(false);
+      expect(metadata.title).toBe(title);
+      expect(metadata.description).toMatch(/Leave empty to require every/);
+
+      const relation: RelationMetadataArgs | undefined = relationArgs(column);
+
+      expect(relation?.relationType).toBe("many-to-many");
+      expect((relation?.type as () => unknown)()).toBe(relatedModel);
+      // Never loaded by accident with every rule read.
+      expect(relation?.options.eager).toBe(false);
+    },
+  );
+
+  test("the severity lists are relations, not columns on the rule row", () => {
+    expect(columnArgs("incidentSeverities")).toBeUndefined();
+    expect(columnArgs("alertSeverities")).toBeUndefined();
+  });
+
+  test.each(SCOPE_COLUMNS)(
+    "%s is written by team editors and read by every project member",
+    (column: string) => {
+      const accessControl: ColumnAccessControl | undefined =
+        accessControlFor(column);
+
+      expect(accessControl?.create).toEqual(EDITORS);
+      expect(accessControl?.update).toEqual(EDITORS);
+      expect(accessControl?.read).toEqual(READERS);
+    },
+  );
+
+  test("whoever may edit any part of a rule may edit all of it", () => {
+    /*
+     * The settings service writes the channel and severity columns when a
+     * rule type changes (clearing what the new type does not use), under the
+     * caller's permissions - so they must be exactly as editable as ruleType.
+     */
+    const ruleTypeAccess: ColumnAccessControl | undefined =
+      accessControlFor("ruleType");
+
+    for (const column of SCOPE_COLUMNS) {
+      expect(accessControlFor(column)).toEqual(ruleTypeAccess);
+    }
+  });
+
+  test("a rule cannot be moved to another team or project", () => {
+    for (const column of ["teamId", "team", "projectId", "project"]) {
+      expect({ column, update: accessControlFor(column)?.update }).toEqual({
+        column,
+        update: [],
+      });
+    }
+  });
+
+  test("ruleType is still required, and a rule is created switched off unless told otherwise", () => {
+    expect(model.getTableColumnMetadata("ruleType").required).toBe(true);
+    expect(columnArgs("ruleType")?.options.nullable).toBe(false);
+
+    expect(model.getTableColumnMetadata("enabled").defaultValue).toBe(false);
+    expect(columnArgs("enabled")?.options.default).toBe(false);
+  });
+});
+
+describe("TeamComplianceSetting - a rule as the API reads and writes it", () => {
+  test("a posted severity list becomes models, and survives the way back", () => {
+    const json: JSONObject = {
+      ruleType: ComplianceRuleType.HasIncidentOnCallRules,
+      notificationChannel: ComplianceNotificationChannel.Call,
+      enabled: true,
+      incidentSeverities: [
+        { _id: "c1c1c1c1-0000-4000-8000-000000000001" },
+        { _id: "c1c1c1c1-0000-4000-8000-000000000002" },
+      ],
+      alertSeverities: [],
+    };
+
+    const setting: TeamComplianceSetting = BaseModel.fromJSONObject(
+      json,
+      TeamComplianceSetting,
+    );
+
+    expect(setting.ruleType).toBe(ComplianceRuleType.HasIncidentOnCallRules);
+    expect(setting.notificationChannel).toBe(
+      ComplianceNotificationChannel.Call,
+    );
+    expect(setting.incidentSeverities).toHaveLength(2);
+    for (const severity of setting.incidentSeverities || []) {
+      expect(severity).toBeInstanceOf(IncidentSeverity);
+    }
+    expect(
+      (setting.incidentSeverities || []).map(
+        (severity: IncidentSeverity): string | undefined => {
+          return severity._id;
+        },
+      ),
+    ).toEqual([
+      "c1c1c1c1-0000-4000-8000-000000000001",
+      "c1c1c1c1-0000-4000-8000-000000000002",
+    ]);
+    expect(setting.alertSeverities).toEqual([]);
+
+    const back: JSONObject = BaseModel.toJSONObject(
+      setting,
+      TeamComplianceSetting,
+    );
+
+    expect(back["notificationChannel"]).toBe(
+      ComplianceNotificationChannel.Call,
+    );
+    expect(
+      (back["incidentSeverities"] as Array<JSONObject>).map(
+        (severity: JSONObject): unknown => {
+          return severity["_id"];
+        },
+      ),
+    ).toEqual([
+      "c1c1c1c1-0000-4000-8000-000000000001",
+      "c1c1c1c1-0000-4000-8000-000000000002",
+    ]);
+  });
+
+  test("a cleared channel is sent as null, and stays null", () => {
+    const setting: TeamComplianceSetting = BaseModel.fromJSONObject(
+      {
+        ruleType: ComplianceRuleType.HasAlertOnCallRules,
+        notificationChannel: null,
+      },
+      TeamComplianceSetting,
+    );
+
+    expect(setting.notificationChannel).toBeNull();
+  });
+});