|
| 1 | +import { _INTERNAL_getSqlQuerySummary } from '@sentry/core'; |
| 2 | +import { describe, expect, it } from 'vitest'; |
| 3 | +import { targetsCloudflareInternalTable } from '../../src/utils/internalSqlQuery'; |
| 4 | + |
| 5 | +// Builds the summary the same way `instrumentSqlStorage` does, so the test exercises the real |
| 6 | +// operation -> summary -> detection path rather than hand-written summaries. |
| 7 | +const summarize = (query: string): string | undefined => _INTERNAL_getSqlQuerySummary(query); |
| 8 | + |
| 9 | +describe('targetsCloudflareInternalTable', () => { |
| 10 | + describe('internal queries (cf_ tables)', () => { |
| 11 | + it.each([ |
| 12 | + ['SELECT', 'SELECT * FROM cf_agents_state WHERE id = ?'], |
| 13 | + ['INSERT', 'INSERT INTO cf_agents_fibers (id, callback) VALUES (?, ?)'], |
| 14 | + ['DELETE', 'DELETE FROM cf_agents_schedules WHERE id = ?'], |
| 15 | + ['UPDATE', 'UPDATE cf_agent_tool_runs SET output_json = ? WHERE id = ?'], |
| 16 | + ['CREATE TABLE', 'CREATE TABLE IF NOT EXISTS cf_agents_workflows (id TEXT PRIMARY KEY NOT NULL)'], |
| 17 | + ['ALTER TABLE', 'ALTER TABLE cf_agents_queues ADD COLUMN retry_options TEXT'], |
| 18 | + ['DROP TABLE', 'DROP TABLE cf_agents_state'], |
| 19 | + ['cf_agent_ prefix', 'SELECT * FROM cf_agent_identity'], |
| 20 | + ['cf_ai_ prefix', 'INSERT INTO cf_ai_chat_stream_chunks (id) VALUES (?)'], |
| 21 | + ['cf_mcp_ prefix', 'SELECT * FROM cf_mcp_agent_event'], |
| 22 | + ['schema version', 'SELECT version FROM cf_schema_version'], |
| 23 | + ])('returns true for %s on internal tables', (_label, query) => { |
| 24 | + expect(targetsCloudflareInternalTable(summarize(query))).toBe(true); |
| 25 | + }); |
| 26 | + |
| 27 | + it('returns true for an internal JOIN', () => { |
| 28 | + const query = ` |
| 29 | + SELECT f.fiber_id, f.status |
| 30 | + FROM cf_agents_fibers f |
| 31 | + LEFT JOIN cf_agents_runs r ON r.id = f.fiber_id |
| 32 | + WHERE f.status IN ('pending', 'running') |
| 33 | + `; |
| 34 | + expect(targetsCloudflareInternalTable(summarize(query))).toBe(true); |
| 35 | + }); |
| 36 | + |
| 37 | + it('returns true when an internal table is joined with a user table', () => { |
| 38 | + // `.some()` — any internal table present means the query is framework-driven noise. |
| 39 | + expect( |
| 40 | + targetsCloudflareInternalTable(summarize('SELECT * FROM cf_agents_state s JOIN users u ON u.id = s.id')), |
| 41 | + ).toBe(true); |
| 42 | + }); |
| 43 | + |
| 44 | + it('handles case-insensitive keywords and prefixes', () => { |
| 45 | + expect(targetsCloudflareInternalTable(summarize('select * from CF_AGENTS_STATE'))).toBe(true); |
| 46 | + }); |
| 47 | + }); |
| 48 | + |
| 49 | + describe('user queries (must be instrumented)', () => { |
| 50 | + it.each([ |
| 51 | + ['SELECT', 'SELECT * FROM users WHERE id = ?'], |
| 52 | + ['INSERT', 'INSERT INTO orders (id, total) VALUES (?, ?)'], |
| 53 | + ['UPDATE', 'UPDATE products SET price = ? WHERE id = ?'], |
| 54 | + ['DELETE', 'DELETE FROM sessions WHERE expired = 1'], |
| 55 | + ['CREATE TABLE', 'CREATE TABLE users (id TEXT PRIMARY KEY)'], |
| 56 | + ['table with cf in the middle', 'SELECT * FROM my_cf_table'], |
| 57 | + ['table starting with cfg', 'SELECT * FROM cfg_settings'], |
| 58 | + ])('returns false for %s on user tables', (_label, query) => { |
| 59 | + expect(targetsCloudflareInternalTable(summarize(query))).toBe(false); |
| 60 | + }); |
| 61 | + }); |
| 62 | + |
| 63 | + describe('allowlist (opt a cf_ table back into instrumentation)', () => { |
| 64 | + it('returns false for an allowlisted table matched by exact string', () => { |
| 65 | + expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_my_table'), ['cf_my_table'])).toBe(false); |
| 66 | + }); |
| 67 | + |
| 68 | + it('returns false for an allowlisted table matched by regex', () => { |
| 69 | + expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_reports_daily'), [/^cf_reports_/])).toBe(false); |
| 70 | + }); |
| 71 | + |
| 72 | + it('requires an exact match for string entries', () => { |
| 73 | + // Substring matches must not opt a table back in, otherwise `cf_` would allowlist everything. |
| 74 | + expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_agents_state'), ['cf_agents'])).toBe(true); |
| 75 | + }); |
| 76 | + |
| 77 | + it('still skips genuine internal tables that are not allowlisted', () => { |
| 78 | + expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_agents_state'), ['cf_my_table'])).toBe(true); |
| 79 | + }); |
| 80 | + |
| 81 | + it('still skips when an internal table is joined with an allowlisted table', () => { |
| 82 | + expect( |
| 83 | + targetsCloudflareInternalTable(summarize('SELECT * FROM cf_my_table t JOIN cf_agents_state s ON s.id = t.id'), [ |
| 84 | + 'cf_my_table', |
| 85 | + ]), |
| 86 | + ).toBe(true); |
| 87 | + }); |
| 88 | + |
| 89 | + it('ignores an empty allowlist', () => { |
| 90 | + expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_agents_state'), [])).toBe(true); |
| 91 | + }); |
| 92 | + }); |
| 93 | + |
| 94 | + describe('summaries without a resolvable table target (safe default: instrument)', () => { |
| 95 | + it.each([ |
| 96 | + ['undefined', undefined], |
| 97 | + ['empty', ''], |
| 98 | + ['no-table SELECT', 'SELECT 1'], |
| 99 | + ['PRAGMA', 'PRAGMA foreign_keys = ON'], |
| 100 | + ['bare operation', 'BEGIN'], |
| 101 | + ])('returns false for %s', (_label, value) => { |
| 102 | + const summary = typeof value === 'string' ? summarize(value) : value; |
| 103 | + expect(targetsCloudflareInternalTable(summary)).toBe(false); |
| 104 | + }); |
| 105 | + }); |
| 106 | +}); |
0 commit comments