@oneuptime/common 14.0.8 → 14.0.10

package/Tests/App/StatusPage/StatusPageResourceExplorer.test.tsx

@@ -1063,6 +1063,104 @@ describe("Status Page > Resources", () => {
         screen.getByTestId("status-page-resource-panel-grid-badge"),
       ).toBeInTheDocument();
     });
+
+    /*
+     * A grid chip carries what a list row does - edit, and a ⋯ with the id and
+     * the removal - and the pane answers each the same way whichever of the two
+     * it came from.
+     */
+    describe("a grid chip's ⋯", () => {
+      type OpenGridChipMenuFunction = (name: string) => Promise<HTMLElement>;
+
+      const openGridChipMenu: OpenGridChipMenuFunction = async (
+        name: string,
+      ): Promise<HTMLElement> => {
+        const chip: HTMLElement = screen
+          .queryAllByTestId("status-page-resource-grid-cell-item")
+          .find((candidate: HTMLElement) => {
+            return (candidate.textContent || "").includes(name);
+          })!;
+
+        fireEvent.click(
+          within(chip).getByTestId("status-page-resource-grid-more"),
+        );
+        await flushEffects();
+
+        return screen.getByRole("menu");
+      };
+
+      type SetUpGridFunction = () => Promise<void>;
+
+      const setUpGrid: SetUpGridFunction = async (): Promise<void> => {
+        setUpApi({
+          groups: buildHierarchy(),
+          resources: [
+            makeResource({ id: "loose", monitorName: "Loose" }),
+            makeResource({
+              id: "grid-a",
+              groupId: GRID_ID,
+              monitorName: "Auth US",
+              rowAxisValue: "Auth",
+              columnAxisValue: "US-East",
+            }),
+            makeResource({
+              id: "grid-b",
+              groupId: GRID_ID,
+              monitorName: "API EU",
+              rowAxisValue: "API",
+              columnAxisValue: "EU-West",
+            }),
+          ],
+        });
+
+        renderPage();
+
+        await waitForExplorer();
+
+        await selectGroup("Grid Group");
+      };
+
+      test("shows the id of the chip it was opened from", async () => {
+        await setUpGrid();
+
+        const menu: HTMLElement = await openGridChipMenu("API EU");
+
+        fireEvent.click(
+          within(menu).getByRole("menuitem", { name: "Show ID" }),
+        );
+        await flushEffects();
+
+        expect(
+          screen.getByText("Status Page Resource ID: grid-b"),
+        ).toBeInTheDocument();
+      });
+
+      test("removing asks first, then deletes only that chip's resource", async () => {
+        await setUpGrid();
+
+        const menu: HTMLElement = await openGridChipMenu("API EU");
+
+        fireEvent.click(
+          within(menu).getByRole("menuitem", {
+            name: "Remove from status page",
+          }),
+        );
+        await flushEffects();
+
+        expect(
+          screen.getByText("Remove resource from status page"),
+        ).toBeInTheDocument();
+        expect(mockDeleteItem).not.toHaveBeenCalled();
+
+        fireEvent.click(screen.getByText("Remove"));
+
+        await waitFor(() => {
+          expect(mockDeleteItem).toHaveBeenCalledTimes(1);
+        });
+
+        expect(mockDeleteItem.mock.calls[0]![0].id.toString()).toBe("grid-b");
+      });
+    });
   });
 
   describe("changing a group", () => {

package/Tests/Models/DatabaseModels/DatabaseServerModels.test.ts

@@ -246,6 +246,18 @@ const DATABASE_SERVER_USER_UPDATE_COLUMNS: Array<string> = [
   "isArchived",
 ];
 
+/*
+ * OneUptime AI access settings (the Database AI agent's switches): never
+ * set on create, changed afterwards by the same roles as any other edit.
+ * Who may LOOSEN them is the service's check, not the column ACL's (see
+ * ResourceAiAccessColumns.test.ts).
+ */
+const DATABASE_SERVER_AI_ACCESS_SETTING_COLUMNS: Array<string> = [
+  "isAiInvestigationEnabled",
+  "aiRemediationMode",
+  "aiCommandAllowlist",
+];
+
 // Columns only the discovery / heartbeat / archive paths write, as root.
 const DATABASE_SERVER_ROOT_ONLY_COLUMNS: Array<string> = [
   "slug",
@@ -276,6 +288,10 @@ const DATABASE_SERVER_ROOT_ONLY_COLUMNS: Array<string> = [
   "archivedByUserId",
   "deletedByUser",
   "deletedByUserId",
+  // Written by the resource AI access service after each AI command.
+  "aiAccessLastVerifiedAt",
+  "aiAccessLastError",
+  "aiAccessConfiguredAt",
 ];
 
 const PERMISSION_PROPS: Array<PermissionProps> =
@@ -862,6 +878,7 @@ describe("Databases (DatabaseServer) models", () => {
        */
       const accounted: Set<string> = new Set([
         ...DATABASE_SERVER_USER_CREATE_COLUMNS,
+        ...DATABASE_SERVER_AI_ACCESS_SETTING_COLUMNS,
         ...DATABASE_SERVER_ROOT_ONLY_COLUMNS,
       ]);
       const unaccounted: Array<string> = ownColumns(model).filter(
@@ -1131,6 +1148,18 @@ describe("Databases (DatabaseServer) models", () => {
       },
     );
 
+    test.each(DATABASE_SERVER_AI_ACCESS_SETTING_COLUMNS)(
+      "%s is never set on create and is updatable by exactly the table's update roles",
+      (column: string) => {
+        const accessControl: ColumnAccessControl = columnAccess(model, column);
+
+        expect(accessControl.create || []).toEqual([]);
+        expect(sorted(accessControl.update || [])).toEqual(
+          sorted(model.getUpdatePermissions()),
+        );
+      },
+    );
+
     test.each(DATABASE_SERVER_ROOT_ONLY_COLUMNS)(
       "%s is root-only: nobody creates or updates it through the API",
       (column: string) => {
@@ -1180,7 +1209,10 @@ describe("Databases (DatabaseServer) models", () => {
       );
 
       expect(updatable.sort()).toEqual(
-        [...DATABASE_SERVER_USER_UPDATE_COLUMNS].sort(),
+        [
+          ...DATABASE_SERVER_USER_UPDATE_COLUMNS,
+          ...DATABASE_SERVER_AI_ACCESS_SETTING_COLUMNS,
+        ].sort(),
       );
     });
 

package/Tests/Models/DatabaseModels/KubernetesAiAgentModel.test.ts

@@ -0,0 +1,295 @@
+import AllModelTypes, {
+  getModelTypeByName,
+} from "../../../Models/DatabaseModels/Index";
+import KubernetesAiAgent from "../../../Models/DatabaseModels/KubernetesAiAgent";
+import KubernetesCluster from "../../../Models/DatabaseModels/KubernetesCluster";
+import RunnerJob from "../../../Models/DatabaseModels/RunnerJob";
+import DatabaseRequestType from "../../../Server/Types/BaseDatabase/DatabaseRequestType";
+import ColumnPermissions from "../../../Server/Types/Database/Permissions/ColumnPermission";
+import TablePermission from "../../../Server/Types/Database/Permissions/TablePermission";
+import { ColumnAccessControl } from "../../../Types/BaseDatabase/AccessControl";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import Permission, {
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import { describe, expect, it } from "@jest/globals";
+import { getMetadataArgsStorage } from "typeorm";
+import type { IndexMetadataArgs } from "typeorm/metadata-args/IndexMetadataArgs";
+
+/*
+ * The Kubernetes AI agent's row, as the permission layer sees it.
+ *
+ *  - It is server-owned: nobody creates, updates or deletes one through the
+ *    API, and there is no CRUD endpoint or API documentation for it (the
+ *    dashboard reads it through the cluster's AI access status).
+ *  - Whoever may read the cluster may read its agent — except the key hash,
+ *    which no role may read, write or create, a project owner included.
+ *  - One agent per cluster, enforced by a unique index.
+ *  - RunnerJob.targetKubernetesAiAgentId is read like targetAgentId and
+ *    written by nobody but the server.
+ *  - KubernetesCluster.isAiInvestigationEnabled is on by default.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+
+function propsWith(
+  permissions: Array<Permission>,
+): DatabaseCommonInteractionProps {
+  const tenantPermission: UserTenantAccessPermission = {
+    projectId: PROJECT_ID,
+    _type: "UserTenantAccessPermission",
+    permissions: permissions.map((permission: Permission) => {
+      return {
+        _type: "UserPermission",
+        permission,
+        labelIds: [],
+        isBlockPermission: false,
+      };
+    }),
+  };
+
+  return {
+    userId: ObjectID.generate(),
+    tenantId: PROJECT_ID,
+    userTenantAccessPermission: {
+      [PROJECT_ID.toString()]: tenantPermission,
+    },
+  };
+}
+
+function sorted(permissions: ReadonlyArray<Permission>): Array<Permission> {
+  return [...permissions].sort();
+}
+
+describe("KubernetesAiAgent model", () => {
+  const agent: KubernetesAiAgent = new KubernetesAiAgent();
+  const cluster: KubernetesCluster = new KubernetesCluster();
+  const accessControl: Record<string, ColumnAccessControl> =
+    agent.getColumnAccessControlForAllColumns();
+
+  it("is registered with the other database models", () => {
+    expect(AllModelTypes).toContain(KubernetesAiAgent);
+    expect(getModelTypeByName("KubernetesAiAgent")).toBe(KubernetesAiAgent);
+  });
+
+  it("names its table and itself as the design says", () => {
+    expect(agent.tableName).toBe("KubernetesAiAgent");
+    expect(agent.singularName).toBe("Kubernetes AI Agent");
+    expect(agent.pluralName).toBe("Kubernetes AI Agents");
+  });
+
+  it("is a project's row (tenant column projectId)", () => {
+    expect(agent.getTenantColumn()).toBe("projectId");
+  });
+
+  it("has no CRUD API, no API documentation and no MCP tools", () => {
+    expect(agent.crudApiPath).toBeFalsy();
+    expect(agent.enableDocumentation).toBeFalsy();
+    expect(agent.enableMCP).toBeFalsy();
+  });
+
+  it("nobody creates, updates or deletes a row through the API", () => {
+    expect(agent.getCreatePermissions()).toEqual([]);
+    expect(agent.getUpdatePermissions()).toEqual([]);
+    expect(agent.getDeletePermissions()).toEqual([]);
+  });
+
+  it("is readable by exactly the roles that may read the cluster", () => {
+    expect(sorted(agent.getReadPermissions())).toEqual(
+      sorted(cluster.getReadPermissions()),
+    );
+  });
+
+  it("every column is server-written: create and update ACLs are empty", () => {
+    for (const [column, acl] of Object.entries(accessControl)) {
+      expect({ column, create: acl.create }).toEqual({ column, create: [] });
+      expect({ column, update: acl.update }).toEqual({ column, update: [] });
+    }
+  });
+
+  it("every column but the key hash is readable by the cluster's readers", () => {
+    const readable: Array<string> = Object.keys(accessControl).filter(
+      (column: string): boolean => {
+        return column !== "keyHash";
+      },
+    );
+
+    expect(readable.length).toBeGreaterThan(5);
+
+    for (const column of readable) {
+      expect({ column, read: sorted(accessControl[column]!.read) }).toEqual({
+        column,
+        read: sorted(cluster.getReadPermissions()),
+      });
+    }
+  });
+
+  it("the key hash is readable, creatable and updatable by no role at all", () => {
+    expect(accessControl["keyHash"]).toEqual({
+      create: [],
+      read: [],
+      update: [],
+    });
+  });
+
+  it.each([DatabaseRequestType.Create, DatabaseRequestType.Update])(
+    "a project owner and admin cannot %s the key hash",
+    (requestType: DatabaseRequestType) => {
+      expect(() => {
+        ColumnPermissions.checkDataColumnPermissions(
+          KubernetesAiAgent,
+          { keyHash: "0".repeat(64) } as unknown as KubernetesAiAgent,
+          propsWith([Permission.ProjectOwner, Permission.ProjectAdmin]),
+          requestType,
+        );
+      }).toThrow(BadDataException);
+    },
+  );
+
+  it("a project owner may read the table but not create in it", () => {
+    expect(() => {
+      TablePermission.checkTableLevelPermissions(
+        KubernetesAiAgent,
+        propsWith([Permission.ProjectOwner]),
+        DatabaseRequestType.Read,
+      );
+    }).not.toThrow();
+
+    expect(() => {
+      TablePermission.checkTableLevelPermissions(
+        KubernetesAiAgent,
+        propsWith([Permission.ProjectOwner]),
+        DatabaseRequestType.Create,
+      );
+    }).toThrow();
+  });
+
+  it("a cluster's readers never select the key hash", () => {
+    const readableColumns: Array<string> =
+      ColumnPermissions.getModelColumnsByPermissions(
+        KubernetesAiAgent,
+        propsWith([Permission.ProjectOwner]).userTenantAccessPermission![
+          PROJECT_ID.toString()
+        ]!.permissions,
+        DatabaseRequestType.Read,
+      ).columns;
+
+    expect(readableColumns).toContain("connectionStatus");
+    expect(readableColumns).not.toContain("keyHash");
+  });
+
+  it("allows one agent per live cluster row, with a named unique index", () => {
+    const index: IndexMetadataArgs | undefined =
+      getMetadataArgsStorage().indices.find(
+        (candidate: IndexMetadataArgs): boolean => {
+          return (
+            candidate.target === KubernetesAiAgent &&
+            candidate.name === "IDX_KubernetesAiAgent_kubernetesClusterId"
+          );
+        },
+      );
+
+    expect(index).toBeDefined();
+    expect(index?.columns).toEqual(["kubernetesClusterId"]);
+    expect(index?.unique).toBe(true);
+    expect(index?.where).toBe('"deletedAt" IS NULL');
+  });
+
+  it("starts disconnected", () => {
+    const metadata: ReturnType<KubernetesAiAgent["getTableColumnMetadata"]> =
+      agent.getTableColumnMetadata("connectionStatus");
+
+    expect(metadata.defaultValue).toBe("disconnected");
+    expect(metadata.isDefaultValueColumn).toBe(true);
+  });
+
+  it("links to its cluster and project, and both relations cascade", () => {
+    for (const relation of ["project", "kubernetesCluster"]) {
+      const declared:
+        | ReturnType<typeof getMetadataArgsStorage>["relations"][number]
+        | undefined = getMetadataArgsStorage().relations.find(
+        (candidate: { target: unknown; propertyName: string }): boolean => {
+          return (
+            candidate.target === KubernetesAiAgent &&
+            candidate.propertyName === relation
+          );
+        },
+      );
+
+      expect(declared?.options.onDelete).toBe("CASCADE");
+    }
+  });
+});
+
+describe("RunnerJob.targetKubernetesAiAgentId", () => {
+  const job: RunnerJob = new RunnerJob();
+  const accessControl: Record<string, ColumnAccessControl> =
+    job.getColumnAccessControlForAllColumns();
+
+  it.each(["targetKubernetesAiAgent", "targetKubernetesAiAgentId"])(
+    "%s is read like targetAgentId and written by nobody but the server",
+    (column: string) => {
+      expect(accessControl[column]).toBeDefined();
+      expect(accessControl[column]!.create).toEqual([]);
+      expect(accessControl[column]!.update).toEqual([]);
+      expect(sorted(accessControl[column]!.read)).toEqual(
+        sorted(accessControl["targetAgentId"]!.read),
+      );
+    },
+  );
+
+  it("is an entity relation to KubernetesAiAgent, backed by the id column", () => {
+    const metadata: ReturnType<RunnerJob["getTableColumnMetadata"]> =
+      job.getTableColumnMetadata("targetKubernetesAiAgent");
+
+    expect(metadata.modelType).toBe(KubernetesAiAgent);
+    expect(metadata.manyToOneRelationColumn).toBe("targetKubernetesAiAgentId");
+    expect(
+      job.getTableColumnMetadata("targetKubernetesAiAgentId").required,
+    ).toBe(false);
+  });
+
+  it("is indexed, for the agent's claim query", () => {
+    expect(
+      getMetadataArgsStorage().indices.some(
+        (index: IndexMetadataArgs): boolean => {
+          return (
+            index.target === RunnerJob &&
+            Array.isArray(index.columns) &&
+            index.columns.length === 1 &&
+            index.columns[0] === "targetKubernetesAiAgentId"
+          );
+        },
+      ),
+    ).toBe(true);
+  });
+});
+
+describe("KubernetesCluster.isAiInvestigationEnabled", () => {
+  it("is on by default, in the API metadata and the column", () => {
+    const metadata: ReturnType<KubernetesCluster["getTableColumnMetadata"]> =
+      new KubernetesCluster().getTableColumnMetadata(
+        "isAiInvestigationEnabled",
+      );
+
+    expect(metadata.defaultValue).toBe(true);
+    expect(metadata.description).toContain("On by default");
+    expect(metadata.description).toContain("Nothing is ever changed");
+
+    const column: { options: { default?: unknown } } | undefined =
+      getMetadataArgsStorage().columns.find(
+        (candidate: { target: unknown; propertyName: string }): boolean => {
+          return (
+            candidate.target === KubernetesCluster &&
+            candidate.propertyName === "isAiInvestigationEnabled"
+          );
+        },
+      );
+
+    expect(column?.options.default).toBe(true);
+  });
+});