@oneuptime/common 12.0.12 → 12.0.14

package/Tests/Server/Utils/Monitor/Criteria/SSLMonitorCriteria.test.ts

@@ -158,7 +158,9 @@ describe("SSLMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
         },
       );
 
-      expect(result).toBe("SSL certificate is not valid.");
+      // The reason is appended so the root cause reaches whoever is paged.
+      expect(result).toContain("SSL certificate is not valid");
+      expect(result).toContain("self signed");
     });
 
     test("valid cert + False → not met", async () => {
@@ -196,7 +198,7 @@ describe("SSLMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
         },
       );
 
-      expect(result).toBe("SSL certificate is not valid.");
+      expect(result).toContain("not reachable");
     });
   });
 
@@ -311,7 +313,8 @@ describe("SSLMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
         },
       );
 
-      expect(result).toBe("SSL certificate is not valid.");
+      expect(result).toContain("SSL certificate is not valid");
+      expect(result).toContain("expired");
     });
 
     test("healthy cert + False → met", async () => {
@@ -343,7 +346,7 @@ describe("SSLMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
         },
       );
 
-      expect(result).toBe("SSL certificate is not valid.");
+      expect(result).toContain("SSL certificate is not valid");
     });
   });
 
@@ -465,4 +468,371 @@ describe("SSLMonitorCriteria.isMonitorInstanceCriteriaFilterMet", () => {
 
     expect(result).toBeNull();
   });
+
+  /*
+   * Regression suite for https://github.com/OneUptime/oneuptime/issues/3225.
+   *
+   * The reported monitor pointed at a host with an invalid certificate and
+   * sat Operational forever. Two things made that possible:
+   *
+   *  1. IsValidCertificate and IsNotAValidCertificate were computed
+   *     independently, so BOTH came out false whenever expiresAt was
+   *     missing or unparseable. No criterion matched, and a monitor already
+   *     at its default status writes no timeline entry when nothing
+   *     matches - so the check left no trace at all.
+   *
+   *  2. The verdict was inferred from !isSelfSigned, and the probe labelled
+   *     every validation failure "self signed". A certificate that failed
+   *     for any other reason could not be described.
+   */
+  describe("certificate validity (issue #3225)", () => {
+    const failureModes: Array<{ name: string; response: SslMonitorResponse }> =
+      [
+        {
+          name: "self-signed",
+          response: {
+            isValidCertificate: false,
+            isSelfSigned: true,
+            certificateValidationErrorCode: "DEPTH_ZERO_SELF_SIGNED_CERT",
+            certificateValidationError: "self signed certificate",
+            expiresAt: dateFromNow({ days: 100 }),
+          },
+        },
+        {
+          name: "hostname mismatch",
+          response: {
+            isValidCertificate: false,
+            isSelfSigned: false,
+            certificateValidationErrorCode: "ERR_TLS_CERT_ALTNAME_INVALID",
+            certificateValidationError: "Hostname/IP does not match",
+            expiresAt: dateFromNow({ days: 100 }),
+          },
+        },
+        {
+          name: "untrusted CA",
+          response: {
+            isValidCertificate: false,
+            isSelfSigned: false,
+            certificateValidationErrorCode: "SELF_SIGNED_CERT_IN_CHAIN",
+            certificateValidationError: "self signed certificate in chain",
+            expiresAt: dateFromNow({ days: 100 }),
+          },
+        },
+        {
+          name: "expired",
+          response: {
+            isValidCertificate: false,
+            isSelfSigned: false,
+            certificateValidationErrorCode: "CERT_HAS_EXPIRED",
+            certificateValidationError: "certificate has expired",
+            expiresAt: dateFromNow({ days: -5 }),
+          },
+        },
+        {
+          name: "incomplete chain",
+          response: {
+            isValidCertificate: false,
+            isSelfSigned: false,
+            certificateValidationErrorCode: "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+            certificateValidationError:
+              "unable to verify the first certificate",
+            expiresAt: dateFromNow({ days: 100 }),
+          },
+        },
+      ];
+
+    test.each(failureModes)(
+      "$name: IsNotAValidCertificate + True → met",
+      async ({ response }: { response: SslMonitorResponse }) => {
+        const result: string | null = await evaluate(
+          buildDataToProcess({ isOnline: true, sslResponse: response }),
+          {
+            checkOn: CheckOn.IsNotAValidCertificate,
+            filterType: FilterType.True,
+            value: undefined,
+          },
+        );
+
+        expect(result).toBeTruthy();
+      },
+    );
+
+    test.each(failureModes)(
+      "$name: IsValidCertificate + True → not met",
+      async ({ response }: { response: SslMonitorResponse }) => {
+        const result: string | null = await evaluate(
+          buildDataToProcess({ isOnline: true, sslResponse: response }),
+          {
+            checkOn: CheckOn.IsValidCertificate,
+            filterType: FilterType.True,
+            value: undefined,
+          },
+        );
+
+        expect(result).toBeNull();
+      },
+    );
+
+    test.each(failureModes)(
+      "$name: IsValidCertificate + False → met",
+      async ({ response }: { response: SslMonitorResponse }) => {
+        const result: string | null = await evaluate(
+          buildDataToProcess({ isOnline: true, sslResponse: response }),
+          {
+            checkOn: CheckOn.IsValidCertificate,
+            filterType: FilterType.False,
+            value: undefined,
+          },
+        );
+
+        expect(result).toBeTruthy();
+      },
+    );
+
+    test("the two predicates are exact complements, even with no expiry", async () => {
+      /*
+       * The silent-healthy case: a certificate the probe could not fully
+       * read. Before the fix BOTH of these returned null and the monitor
+       * recorded nothing.
+       */
+      const response: SslMonitorResponse = {
+        isValidCertificate: false,
+        isSelfSigned: false,
+        certificateValidationErrorCode: "UNABLE_TO_GET_ISSUER_CERT",
+        certificateValidationError: "unable to get issuer certificate",
+        // deliberately no expiresAt
+      };
+
+      const isValid: string | null = await evaluate(
+        buildDataToProcess({ isOnline: true, sslResponse: response }),
+        {
+          checkOn: CheckOn.IsValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      const isNotValid: string | null = await evaluate(
+        buildDataToProcess({ isOnline: true, sslResponse: response }),
+        {
+          checkOn: CheckOn.IsNotAValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      expect(isValid).toBeNull();
+      expect(isNotValid).toBeTruthy();
+    });
+
+    test("a valid certificate satisfies IsValidCertificate and not its negation", async () => {
+      const response: SslMonitorResponse = {
+        isValidCertificate: true,
+        isSelfSigned: false,
+        certificateValidationErrorCode: "",
+        certificateValidationError: "",
+        expiresAt: dateFromNow({ days: 90 }),
+      };
+
+      const isValid: string | null = await evaluate(
+        buildDataToProcess({ isOnline: true, sslResponse: response }),
+        {
+          checkOn: CheckOn.IsValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      const isNotValid: string | null = await evaluate(
+        buildDataToProcess({ isOnline: true, sslResponse: response }),
+        {
+          checkOn: CheckOn.IsNotAValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      expect(isValid).toBeTruthy();
+      expect(isNotValid).toBeNull();
+    });
+
+    test("the reason names the underlying validation error", async () => {
+      const result: string | null = await evaluate(
+        buildDataToProcess({
+          isOnline: true,
+          sslResponse: {
+            isValidCertificate: false,
+            isSelfSigned: false,
+            certificateValidationErrorCode: "ERR_TLS_CERT_ALTNAME_INVALID",
+            certificateValidationError: "Hostname/IP does not match",
+            expiresAt: dateFromNow({ days: 100 }),
+          },
+        }),
+        {
+          checkOn: CheckOn.IsNotAValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      // The root cause has to reach whoever gets paged.
+      expect(result).toContain("Hostname/IP does not match");
+    });
+
+    test("an unreachable endpoint is not a valid certificate", async () => {
+      const result: string | null = await evaluate(
+        buildDataToProcess({
+          isOnline: false,
+          sslResponse: { isValidCertificate: false },
+        }),
+        {
+          checkOn: CheckOn.IsNotAValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      expect(result).toBeTruthy();
+    });
+
+    test("only genuine self-signed responses satisfy IsSelfSignedCertificate", async () => {
+      const mismatch: string | null = await evaluate(
+        buildDataToProcess({
+          isOnline: true,
+          sslResponse: {
+            isValidCertificate: false,
+            isSelfSigned: false,
+            certificateValidationErrorCode: "ERR_TLS_CERT_ALTNAME_INVALID",
+            expiresAt: dateFromNow({ days: 100 }),
+          },
+        }),
+        {
+          checkOn: CheckOn.IsSelfSignedCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      /*
+       * Pre-fix the probe set isSelfSigned=true for a hostname mismatch, so
+       * this criterion fired on a certificate that was not self-signed at
+       * all.
+       */
+      expect(mismatch).toBeNull();
+    });
+  });
+
+  /*
+   * Payloads written by a probe running an older build carry no
+   * isValidCertificate field. They must keep evaluating exactly as before,
+   * or upgrading the server would flip healthy monitors to Down.
+   */
+  describe("legacy payloads without an explicit verdict", () => {
+    test("a healthy legacy response is still valid", async () => {
+      const result: string | null = await evaluate(
+        buildDataToProcess({
+          isOnline: true,
+          sslResponse: {
+            isSelfSigned: false,
+            expiresAt: dateFromNow({ days: 60 }),
+          },
+        }),
+        {
+          checkOn: CheckOn.IsValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      expect(result).toBeTruthy();
+    });
+
+    test("a legacy self-signed response is still not valid", async () => {
+      const result: string | null = await evaluate(
+        buildDataToProcess({
+          isOnline: true,
+          sslResponse: {
+            isSelfSigned: true,
+            expiresAt: dateFromNow({ days: 60 }),
+          },
+        }),
+        {
+          checkOn: CheckOn.IsNotAValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      expect(result).toBeTruthy();
+    });
+
+    test("a legacy expired response is still not valid", async () => {
+      const result: string | null = await evaluate(
+        buildDataToProcess({
+          isOnline: true,
+          sslResponse: {
+            isSelfSigned: false,
+            expiresAt: dateFromNow({ days: -1 }),
+          },
+        }),
+        {
+          checkOn: CheckOn.IsValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      expect(result).toBeNull();
+    });
+  });
+
+  /*
+   * The probe serialises Dates to ISO strings over the wire, so by the time
+   * criteria run, expiresAt is a string rather than a Date. Expiry maths
+   * must behave identically either way.
+   */
+  describe("expiresAt arriving as an ISO string", () => {
+    test("a future expiry read from a string is still valid", async () => {
+      const result: string | null = await evaluate(
+        buildDataToProcess({
+          isOnline: true,
+          sslResponse: {
+            isValidCertificate: true,
+            isSelfSigned: false,
+            expiresAt: dateFromNow({
+              days: 30,
+            }).toISOString() as unknown as Date,
+          },
+        }),
+        {
+          checkOn: CheckOn.IsValidCertificate,
+          filterType: FilterType.True,
+          value: undefined,
+        },
+      );
+
+      expect(result).toBeTruthy();
+    });
+
+    test("ExpiresInDays compares correctly against a string expiry", async () => {
+      const result: string | null = await evaluate(
+        buildDataToProcess({
+          isOnline: true,
+          sslResponse: {
+            isValidCertificate: true,
+            expiresAt: dateFromNow({
+              days: 10,
+            }).toISOString() as unknown as Date,
+          },
+        }),
+        {
+          checkOn: CheckOn.ExpiresInDays,
+          filterType: FilterType.LessThan,
+          value: 30,
+        },
+      );
+
+      expect(result).toBeTruthy();
+    });
+  });
 });

package/Tests/Server/Utils/Monitor/MonitorAlertResourceLinking.test.ts

@@ -26,7 +26,8 @@ import ProxmoxClusterService from "../../../../Server/Services/ProxmoxClusterSer
 import ServiceService from "../../../../Server/Services/ServiceService";
 import ProjectScopedReferenceValidator from "../../../../Server/Utils/Database/ProjectScopedReferenceValidator";
 import MonitorAlert from "../../../../Server/Utils/Monitor/MonitorAlert";
-import MonitorClusterContextUtil from "../../../../Server/Utils/Monitor/MonitorClusterContext";
+import MonitorResourceContextUtil from "../../../../Server/Utils/Monitor/MonitorResourceContext";
+import { SeriesResolvedResourceIds } from "../../../../Server/Utils/Monitor/SeriesResourceLinker";
 import MonitorIncident from "../../../../Server/Utils/Monitor/MonitorIncident";
 import Dictionary from "../../../../Types/Dictionary";
 import { JSONObject } from "../../../../Types/JSON";
@@ -133,6 +134,25 @@ function idsOn(
   });
 }
 
+/*
+ * The nine-relation shape MonitorResourceContext resolves from the
+ * monitor's own step config. Tests stub the util and hand back one of
+ * these, spreading over it to name only the relations under test.
+ */
+function emptyResourceContext(): SeriesResolvedResourceIds {
+  return {
+    hostIds: [],
+    dockerHostIds: [],
+    podmanHostIds: [],
+    kubernetesClusterIds: [],
+    serviceIds: [],
+    proxmoxClusterIds: [],
+    cephClusterIds: [],
+    dockerSwarmClusterIds: [],
+    iotFleetIds: [],
+  };
+}
+
 describe("Alerts link the resources their series identifies", () => {
   let createdAlerts: Array<Alert> = [];
   let createdIncidents: Array<Incident> = [];
@@ -151,12 +171,7 @@ describe("Alerts link the resources their series identifies", () => {
   let dockerSwarmClusterRows: Array<{ _id: string }> = [];
   let iotFleetRows: Array<{ _id: string }> = [];
 
-  let clusterContext: {
-    proxmoxClusterIds: Array<string>;
-    cephClusterIds: Array<string>;
-    dockerSwarmClusterIds: Array<string>;
-    iotFleetIds: Array<string>;
-  };
+  let resourceContext: SeriesResolvedResourceIds;
 
   beforeEach(() => {
     createdAlerts = [];
@@ -172,12 +187,7 @@ describe("Alerts link the resources their series identifies", () => {
     dockerSwarmClusterRows = [];
     iotFleetRows = [];
 
-    clusterContext = {
-      proxmoxClusterIds: [],
-      cephClusterIds: [],
-      dockerSwarmClusterIds: [],
-      iotFleetIds: [],
-    };
+    resourceContext = emptyResourceContext();
 
     // No alert / incident is already open for this monitor.
     jest.spyOn(AlertService, "findBy").mockResolvedValue([]);
@@ -188,9 +198,9 @@ describe("Alerts link the resources their series identifies", () => {
       .mockResolvedValue(true);
 
     jest
-      .spyOn(MonitorClusterContextUtil, "resolveClusterContextForMonitor")
+      .spyOn(MonitorResourceContextUtil, "resolveResourceContextForMonitor")
       .mockImplementation(async () => {
-        return clusterContext;
+        return resourceContext;
       });
 
     jest
@@ -396,10 +406,13 @@ describe("Alerts link the resources their series identifies", () => {
     expect(idsOn(createdAlerts[1]!.hosts)).toEqual(["host-7"]);
   });
 
-  it("links nothing, and still opens the alert, for an ungrouped monitor", async () => {
+  it("links nothing from LABELS, and still opens the alert, for an ungrouped monitor", async () => {
     /*
-     * A whole-monitor alert has no series and therefore no resource
-     * identity. It must not inherit one, and it must still be created.
+     * A whole-monitor alert has no series, so the LABEL path has nothing
+     * to work with. It must not invent an identity from another
+     * series, and it must still be created. (The step-config path can
+     * still name a resource here — that is the test above; this one
+     * pins that the label path alone contributes nothing.)
      */
     hostRows = [{ _id: "host-1" }];
 
@@ -417,6 +430,131 @@ describe("Alerts link the resources their series identifies", () => {
     expect(HostService.findBy).not.toHaveBeenCalled();
   });
 
+  it("links the service an ungrouped metric monitor is scoped to", async () => {
+    /*
+     * THE REPORTED BUG. ALT-144 came from a Metrics monitor whose only
+     * resource identity was the attribute filter
+     * `oneuptime.service.name = app-plan-starship-online-production`.
+     * It is ungrouped, so there are no series labels and the label path
+     * links nothing — the alert's "Affected Resources" card read "No
+     * resources affected" even though the monitor named the service.
+     *
+     * `matchesPerSeries` is deliberately omitted: that is what makes
+     * this the ungrouped path.
+     */
+    resourceContext = {
+      ...emptyResourceContext(),
+      serviceIds: ["service-1"],
+    };
+
+    await MonitorAlert.criteriaMetCreateAlertsAndUpdateMonitorStatus({
+      criteriaInstance: criteriaInstance(),
+      monitor: monitor(),
+      dataToProcess: dataToProcess,
+      rootCause: "Memory is above 60%",
+      autoResolveCriteriaInstanceIdAlertIdsDictionary: NO_AUTO_RESOLVE,
+      props: {},
+    });
+
+    expect(createdAlerts).toHaveLength(1);
+    expect(idsOn(createdAlerts[0]!.services)).toEqual(["service-1"]);
+  });
+
+  it("links the host an ungrouped host monitor is scoped to", async () => {
+    // Same shape for the infra types: the step config names the host.
+    resourceContext = {
+      ...emptyResourceContext(),
+      hostIds: ["host-1"],
+    };
+
+    await MonitorAlert.criteriaMetCreateAlertsAndUpdateMonitorStatus({
+      criteriaInstance: criteriaInstance(),
+      monitor: monitor(),
+      dataToProcess: dataToProcess,
+      rootCause: "CPU is above 90%",
+      autoResolveCriteriaInstanceIdAlertIdsDictionary: NO_AUTO_RESOLVE,
+      props: {},
+    });
+
+    expect(idsOn(createdAlerts[0]!.hosts)).toEqual(["host-1"]);
+  });
+
+  it("merges the step-config service with the one the series names", async () => {
+    /*
+     * A grouped monitor can resolve a service from its labels while the
+     * step config names another. Neither may erase the other.
+     */
+    serviceRows = [{ _id: "service-from-label" }];
+    resourceContext = {
+      ...emptyResourceContext(),
+      serviceIds: ["service-from-step-config"],
+    };
+
+    await MonitorAlert.criteriaMetCreateAlertsAndUpdateMonitorStatus({
+      criteriaInstance: criteriaInstance(),
+      monitor: monitor(),
+      dataToProcess: dataToProcess,
+      rootCause: "CPU is above 90%",
+      autoResolveCriteriaInstanceIdAlertIdsDictionary: NO_AUTO_RESOLVE,
+      matchesPerSeries: [series({ "service.name": "checkout-api" }, "fp-1")],
+      props: {},
+    });
+
+    expect(idsOn(createdAlerts[0]!.services).sort()).toEqual([
+      "service-from-label",
+      "service-from-step-config",
+    ]);
+  });
+
+  it("dedupes a service both paths resolved", async () => {
+    serviceRows = [{ _id: "service-1" }];
+    resourceContext = {
+      ...emptyResourceContext(),
+      serviceIds: ["service-1"],
+    };
+
+    await MonitorAlert.criteriaMetCreateAlertsAndUpdateMonitorStatus({
+      criteriaInstance: criteriaInstance(),
+      monitor: monitor(),
+      dataToProcess: dataToProcess,
+      rootCause: "CPU is above 90%",
+      autoResolveCriteriaInstanceIdAlertIdsDictionary: NO_AUTO_RESOLVE,
+      matchesPerSeries: [series({ "service.name": "checkout-api" }, "fp-1")],
+      props: {},
+    });
+
+    expect(idsOn(createdAlerts[0]!.services)).toEqual(["service-1"]);
+  });
+
+  it("attaches the step-config resources to EVERY alert of a grouped monitor", async () => {
+    /*
+     * One evaluation, two breaching series, one shared monitor config.
+     * Both alerts are about the same service.
+     */
+    hostRows = [{ _id: "host-2" }];
+    resourceContext = {
+      ...emptyResourceContext(),
+      serviceIds: ["service-1"],
+    };
+
+    await MonitorAlert.criteriaMetCreateAlertsAndUpdateMonitorStatus({
+      criteriaInstance: criteriaInstance(),
+      monitor: monitor(),
+      dataToProcess: dataToProcess,
+      rootCause: "CPU is above 90%",
+      autoResolveCriteriaInstanceIdAlertIdsDictionary: NO_AUTO_RESOLVE,
+      matchesPerSeries: [
+        series({ "host.name": "node-a" }, "fp-1"),
+        series({ "host.name": "node-b" }, "fp-2"),
+      ],
+      props: {},
+    });
+
+    expect(createdAlerts).toHaveLength(2);
+    expect(idsOn(createdAlerts[0]!.services)).toEqual(["service-1"]);
+    expect(idsOn(createdAlerts[1]!.services)).toEqual(["service-1"]);
+  });
+
   it("merges the monitor's step-config cluster with the one the series names", async () => {
     /*
      * The alert path used to ASSIGN the step-config clusters over
@@ -424,7 +562,8 @@ describe("Alerts link the resources their series identifies", () => {
      * Proxmox cluster, an assignment would drop one of them.
      */
     proxmoxClusterRows = [{ _id: "pve-from-label" }];
-    clusterContext = {
+    resourceContext = {
+      ...emptyResourceContext(),
       proxmoxClusterIds: ["pve-from-step-config"],
       cephClusterIds: [],
       dockerSwarmClusterIds: [],
@@ -448,7 +587,8 @@ describe("Alerts link the resources their series identifies", () => {
   });
 
   it("still attaches the step-config cluster to an ungrouped alert", async () => {
-    clusterContext = {
+    resourceContext = {
+      ...emptyResourceContext(),
       proxmoxClusterIds: [],
       cephClusterIds: ["ceph-1"],
       dockerSwarmClusterIds: [],