@oneuptime/common 14.0.7 → 14.0.9

package/Tests/Server/API/AIChatRouteAuthorization.test.ts

@@ -17,6 +17,7 @@ import {
 import PositiveNumber from "../../../Types/PositiveNumber";
 import LlmProviderService from "../../../Server/Services/LlmProviderService";
 import ProjectService from "../../../Server/Services/ProjectService";
+import { AI_DISABLED_MESSAGE } from "../../../Server/Services/AIService";
 import {
   ExpressRequest,
   ExpressResponse,
@@ -1106,3 +1107,60 @@ describe("POST /ai-chat/send-message page context contract", () => {
     );
   });
 });
+
+/*
+ * Ask AI refuses a turn on a project with AI switched off using the SAME
+ * sentence as every other AI surface (AIService.AI_DISABLED_MESSAGE), so
+ * the chat, Slack, runbook steps and "Generate with AI" all name the one
+ * settings page that turns AI back on.
+ */
+describe("POST /ai-chat/send-message on a project with AI switched off", () => {
+  beforeEach(() => {
+    withProps(memberOfVictimProject());
+    jest
+      .spyOn(AIRunService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+    jest
+      .spyOn(AIRunService, "create")
+      .mockResolvedValue(new AIRun(ObjectID.generate()));
+    jest.spyOn(AIRunService, "findBy").mockResolvedValue([]);
+    jest
+      .spyOn(AIConversationService, "create")
+      .mockResolvedValue(new AIConversation(CONVERSATION_ID));
+    jest.spyOn(AIConversationService, "updateOneById").mockResolvedValue(1);
+    jest
+      .spyOn(AIConversationMessageService, "create")
+      .mockResolvedValue(new AIConversationMessage(MESSAGE_ID));
+    jest.spyOn(ChatAgentRunner, "runTurn").mockResolvedValue(undefined);
+    jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(projectWithAI(false));
+  });
+
+  test("refuses with the shared kill-switch sentence, before a conversation or run is created", async () => {
+    const call: RouteCall = await callRoute({
+      uri: "/ai-chat/send-message",
+      body: { content: "What changed?" },
+    });
+
+    expect(call.thrown).toBeInstanceOf(BadDataException);
+    expect((call.thrown as BadDataException).message).toBe(AI_DISABLED_MESSAGE);
+    expect(AIConversationService.create).not.toHaveBeenCalled();
+    expect(AIRunService.create).not.toHaveBeenCalled();
+    expect(ChatAgentRunner.runTurn).not.toHaveBeenCalled();
+  });
+
+  test("negative control: the same turn goes through with AI on", async () => {
+    jest
+      .spyOn(ProjectService, "findOneById")
+      .mockResolvedValue(projectWithAI(true));
+
+    const call: RouteCall = await callRoute({
+      uri: "/ai-chat/send-message",
+      body: { content: "What changed?" },
+    });
+
+    expect(call.thrown).toBeUndefined();
+    expect(ChatAgentRunner.runTurn).toHaveBeenCalledTimes(1);
+  });
+});

package/Tests/Server/API/AIGenerationProjectAIToggle.test.ts

@@ -95,7 +95,7 @@ jest.mock("../../../Server/Utils/Response", () => {
 });
 
 const AI_DISABLED_MESSAGE: string =
-  "AI features are disabled for this project. Enable them in Project Settings > AI Credits.";
+  "AI features are disabled for this project. Enable them in Project Settings → AI Features.";
 
 // The project that owns the incident / alert / maintenance being generated for.
 const PROJECT_ID: ObjectID = new ObjectID(

package/Tests/Server/API/AIInvestigationAPI.test.ts

@@ -13,6 +13,10 @@ import {
   toPanelClusterAccess,
 } from "../../../Server/API/AIInvestigationAPI";
 import Runner from "../../../Models/DatabaseModels/Runner";
+import KubernetesAiAgent from "../../../Models/DatabaseModels/KubernetesAiAgent";
+import KubernetesAiAgentService from "../../../Server/Services/KubernetesAiAgentService";
+import RunnerService from "../../../Server/Services/RunnerService";
+import logger from "../../../Server/Utils/Logger";
 import KubernetesClusterService from "../../../Server/Services/KubernetesClusterService";
 import KubernetesCluster from "../../../Models/DatabaseModels/KubernetesCluster";
 import Permission, { UserPermission } from "../../../Types/Permission";
@@ -168,6 +172,8 @@ function clusterAccessStatus(): KubernetesClusterAiAccessStatus {
       key: RUNNER_KEY,
     } as KubernetesClusterAiAccessStatus["runner"],
     accessMethod: "credential",
+    aiAgent: null,
+    automaticInvestigation: { incidents: false, alerts: false },
     credentialId: CREDENTIAL_ID,
     credentialName: "prod-sa-token",
     kubectlAllowlist: ["kubectl rollout restart deployment/*"],
@@ -1375,6 +1381,8 @@ describe("AIInvestigationAPI latest-investigation cluster access", () => {
       runner: {
         id: RUNNER_ID,
         name: "kubernetes-agent/prod-us",
+        // A summary without a kind is a Runner (the documented default).
+        kind: "runner",
         isOnline: true,
         lastAliveAt: "2026-09-14T18:00:00.000Z",
         canRunAiCommands: true,
@@ -2320,61 +2328,131 @@ describe("toPanelClusterAccess gap next steps", () => {
   });
 
   /*
-   * A contract with the service rather than a fixture: the gap the real
-   * KubernetesClusterAiAccessService builds for a registered but unbound
-   * agent Runner never reaches a restricted viewer's row with the Runner's
-   * name in it.
+   * A contract with the service rather than a fixture: the gaps the real
+   * KubernetesClusterAiAccessService builds name details a viewer who may
+   * not read the cluster is not shown — the previous in-cluster Runner's
+   * name, the Kubernetes AI agent's namespace — and never reach such a
+   * viewer's row.
    */
-  it("strips the Runner name from the service's own no_runner_bound gap", async () => {
-    const service: {
-      findAgentRunnerForCluster: (
-        cluster: KubernetesCluster,
-      ) => Promise<Runner | null>;
-      getRunnerPresence: (runner: Runner) => { isOnline: boolean };
-      getNoRunnerBoundGap: (
-        cluster: KubernetesCluster,
-      ) => Promise<KubernetesAiAccessGap>;
-    } = KubernetesClusterAiAccessService as unknown as {
-      findAgentRunnerForCluster: (
-        cluster: KubernetesCluster,
-      ) => Promise<Runner | null>;
-      getRunnerPresence: (runner: Runner) => { isOnline: boolean };
-      getNoRunnerBoundGap: (
-        cluster: KubernetesCluster,
-      ) => Promise<KubernetesAiAccessGap>;
-    };
-    const agentRunner: Runner = new Runner(new ObjectID(RUNNER_ID));
-    agentRunner.name = "kubernetes-agent/prod-us-identifier";
-    const findAgentRunner: SpyInstance<
-      (cluster: KubernetesCluster) => Promise<Runner | null>
-    > = jest
-      .spyOn(service, "findAgentRunnerForCluster")
-      .mockResolvedValue(agentRunner);
-    const presence: SpyInstance<(runner: Runner) => { isOnline: boolean }> =
-      jest.spyOn(service, "getRunnerPresence").mockReturnValue({
-        isOnline: true,
-      });
+  it("strips what the service's own gaps name from a restricted row", async () => {
+    jest.spyOn(logger, "error").mockImplementation((): void => {
+      return undefined;
+    });
+    const agentLookup: SpyInstance<
+      typeof KubernetesAiAgentService.findForCluster
+    > = jest.spyOn(KubernetesAiAgentService, "findForCluster");
+    const runnerLookup: SpyInstance<typeof RunnerService.findOneBy> =
+      jest.spyOn(RunnerService, "findOneBy");
+
+    const cluster: KubernetesCluster = new KubernetesCluster(
+      new ObjectID(CLUSTER_ID),
+    );
+    cluster.projectId = new ObjectID(PROJECT_ID);
+    cluster.clusterIdentifier = "prod-us";
+    cluster.isAiInvestigationEnabled = true;
 
     try {
-      const gap: KubernetesAiAccessGap = await service.getNoRunnerBoundGap(
-        new KubernetesCluster(new ObjectID(CLUSTER_ID)),
-      );
+      // An offline agent whose namespace names the team that runs it.
+      agentLookup.mockResolvedValue({
+        id: new ObjectID(RUNNER_ID),
+        connectionStatus: "connected",
+        lastAliveAt: new Date("2026-01-01T00:00:00.000Z"),
+        posture: {
+          inCluster: true,
+          clusterIdentifier: "prod-us",
+          podNamespace: "payments-team-agent-namespace",
+        },
+      } as unknown as KubernetesAiAgent);
+
+      const agentStatus: KubernetesClusterAiAccessStatus =
+        await KubernetesClusterAiAccessService.getStatusForClusterModel({
+          cluster,
+          gates: {
+            isAiEnabled: true,
+            isAutoRemediationEnabled: true,
+            isAiCommandExecutionEnabled: true,
+            hasLlmProvider: true,
+          },
+        });
 
       // The service's text does name it...
-      expect(gap.nextStep).toContain("kubernetes-agent/prod-us-identifier");
-
-      const restricted: InvestigationPanelClusterAccess = toPanelClusterAccess(
-        statusWithGaps([gap]),
-        { canReadCluster: false, canReadCredentials: false },
+      expect(JSON.stringify(agentStatus.gaps)).toContain(
+        "payments-team-agent-namespace",
       );
-
       // ...and the restricted row does not.
-      expect(JSON.stringify(restricted)).not.toContain(
+      expect(
+        JSON.stringify(
+          toPanelClusterAccess(agentStatus, {
+            canReadCluster: false,
+            canReadCredentials: false,
+          }),
+        ),
+      ).not.toContain("payments-team-agent-namespace");
+
+      // The previous in-cluster Runner, bound and offline, by name.
+      agentLookup.mockResolvedValue(null);
+      const legacyRunner: Runner = new Runner(new ObjectID(RUNNER_ID));
+      legacyRunner.name = "kubernetes-agent/prod-us-identifier";
+      legacyRunner.hostInfo = {
+        kubernetes: {
+          inCluster: true,
+          clusterIdentifier: "prod-us-identifier",
+        },
+      };
+      runnerLookup.mockResolvedValue(legacyRunner);
+      cluster.aiAccessRunnerId = new ObjectID(RUNNER_ID);
+      cluster.clusterIdentifier = "prod-us-identifier";
+
+      const runnerStatus: KubernetesClusterAiAccessStatus =
+        await KubernetesClusterAiAccessService.getStatusForClusterModel({
+          cluster,
+          gates: {
+            isAiEnabled: true,
+            isAutoRemediationEnabled: true,
+            isAiCommandExecutionEnabled: true,
+            hasLlmProvider: true,
+          },
+        });
+
+      expect(JSON.stringify(runnerStatus.gaps)).toContain(
         "kubernetes-agent/prod-us-identifier",
       );
+      expect(
+        JSON.stringify(
+          toPanelClusterAccess(runnerStatus, {
+            canReadCluster: false,
+            canReadCredentials: false,
+          }),
+        ),
+      ).not.toContain("kubernetes-agent/prod-us-identifier");
     } finally {
-      findAgentRunner.mockRestore();
-      presence.mockRestore();
+      jest.restoreAllMocks();
     }
   });
+
+  it("carries the target's kind to the panel, so it can name the Kubernetes AI agent", () => {
+    const status: KubernetesClusterAiAccessStatus = clusterAccessStatus();
+    status.runner = {
+      ...status.runner!,
+      name: "Kubernetes AI agent",
+      kind: "ai_agent",
+    };
+
+    const row: InvestigationPanelClusterAccess = toPanelClusterAccess(status, {
+      canReadCluster: true,
+      canReadCredentials: true,
+    });
+
+    expect(row.runner?.kind).toBe("ai_agent");
+    expect(row.runner?.name).toBe("Kubernetes AI agent");
+  });
+
+  it("gives the out-of-credits gap the project-settings step", () => {
+    expect(getRestrictedGapNextStep("ai_balance_insufficient")).toBe(
+      RESTRICTED_PROJECT_GAP_NEXT_STEP,
+    );
+    expect(RESTRICTED_GAP_NEXT_STEP).toContain(
+      "the cluster's AI agent page (AI → Agent)",
+    );
+  });
 });