@oneuptime/common 12.0.13 → 12.0.15

package/Server/Utils/GlobalSsoAuthorization.ts

@@ -0,0 +1,175 @@
+import ObjectID from "../../Types/ObjectID";
+import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+
+/*
+ * The stateful half of Global SSO enforcement.
+ *
+ * A Global SSO/OIDC token is a 30-day, self-contained JWT with no project
+ * binding, so on its own it answers only "this person authenticated against
+ * SOME instance-wide identity provider at some point in the last month". Two
+ * questions it cannot answer:
+ *
+ *   1. IS THE PROVIDER STILL TRUSTED? Turning a provider off, or deleting it,
+ *      has to actually cut off access. Without a check at request time the
+ *      "Enabled" toggle does nothing to anyone already signed in, for up to
+ *      thirty days. This check is UNCONDITIONAL - "disabled" has only one
+ *      possible meaning.
+ *
+ *   2. DOES THE PROVIDER GOVERN THIS PROJECT? Deliberately OPT-IN, per
+ *      provider, via `restrictToAttachedProjects`. The attachment rows
+ *      (GlobalSsoProject / GlobalOidcProject) were introduced as the
+ *      PROVISIONING allow-list - "a SAML assertion can only ever provision a
+ *      user into projects that a master admin has explicitly attached here",
+ *      per the model's own docstring - and the login routers gate a session on
+ *      membership of ANY project, not of an attached one. Reading attachments
+ *      as an access boundary by default would therefore lock existing users
+ *      out of projects they legitimately reach today, immediately on upgrade,
+ *      with no way to recover from inside the product. So it stays off unless
+ *      an admin asks for it.
+ *
+ * Both answers come from Postgres and run on every authenticated request
+ * against an SSO-enforced project, so both are cached in-process for 60
+ * seconds, and concurrent misses share one query.
+ */
+
+export const GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS: number = 60_000;
+
+/** What the enforcement path needs to know about a global provider. */
+export interface GlobalProviderTrust {
+  // The provider row exists and its "Enabled" toggle is on.
+  isUsable: boolean;
+  // The admin opted this provider into attachment-scoped access.
+  restrictToAttachedProjects: boolean;
+}
+
+/*
+ * Absence of an entry means "not yet looked up", which is why these are read
+ * with an explicit `undefined` check rather than a truthiness test: a cached
+ * "this provider is disabled" must not be mistaken for a cache miss and
+ * re-queried on every single request.
+ */
+export const globalSsoProviderTrustCache: InMemoryTTLCache<GlobalProviderTrust> =
+  new InMemoryTTLCache(10_000);
+
+/**
+ * A provider's attachment rows.
+ *
+ * `hasAnyAttachmentRows` distinguishes "this provider has no attachments at
+ * all" from "it has attachments but every one of them is disabled". Collapsing
+ * those two would mean an admin disabling the last attachment WIDENS the
+ * provider to every project - the exact opposite of the intent.
+ */
+export interface GlobalProviderAttachments {
+  hasAnyAttachmentRows: boolean;
+  enabledProjectIds: Array<string>;
+}
+
+export const globalSsoAttachmentsCache: InMemoryTTLCache<GlobalProviderAttachments> =
+  new InMemoryTTLCache(10_000);
+
+export type GlobalProviderKind = "sso" | "oidc";
+
+/*
+ * Namespaced by kind. A Global SSO provider and a Global OIDC provider are
+ * different rows in different tables and could in principle share an id;
+ * collapsing the keys would let one vouch for the other.
+ */
+export function globalProviderCacheKey(
+  providerKind: GlobalProviderKind,
+  providerId: ObjectID,
+): string {
+  return `${providerKind}:${providerId.toString()}`;
+}
+
+/**
+ * Decides whether a provider's attachments cover `projectId`, for a provider
+ * that has opted into attachment-scoped access.
+ *
+ * A provider with no attachment rows at all is instance-wide, matching the
+ * "default-all" reading the login routers use. A provider that HAS attachment
+ * rows governs exactly the enabled ones - so disabling them all denies rather
+ * than widens.
+ */
+export function doAttachmentsGovernProject(
+  attachments: GlobalProviderAttachments,
+  projectId: ObjectID,
+): boolean {
+  if (!attachments.hasAnyAttachmentRows) {
+    return true;
+  }
+
+  return attachments.enabledProjectIds.includes(projectId.toString());
+}
+
+/** Drops every cached answer. Used by the write hooks and by tests. */
+export function clearGlobalSsoAuthorizationCaches(): void {
+  globalSsoProviderTrustCache.clear();
+  globalSsoAttachmentsCache.clear();
+  inFlightTrustLookups.clear();
+  inFlightAttachmentLookups.clear();
+}
+
+/*
+ * In-flight de-duplication.
+ *
+ * The multi-tenant permission path fans out over every project the user
+ * belongs to CONCURRENTLY. Without this, a cold cache means N simultaneous
+ * copies of the same two queries - for a user in fifty projects, a hundred
+ * queries where two would do. Worse, failures are never cached, so a database
+ * that is already struggling gets the full fan-out again on every request.
+ *
+ * Sharing the promise collapses all of that to one query per provider, and a
+ * rejection is shared too rather than being retried N times in the same tick.
+ */
+const inFlightTrustLookups: Map<
+  string,
+  Promise<GlobalProviderTrust>
+> = new Map();
+const inFlightAttachmentLookups: Map<
+  string,
+  Promise<GlobalProviderAttachments>
+> = new Map();
+
+async function loadOnce<T>(
+  inFlight: Map<string, Promise<T>>,
+  key: string,
+  load: () => Promise<T>,
+): Promise<T> {
+  const existing: Promise<T> | undefined = inFlight.get(key);
+
+  if (existing) {
+    return existing;
+  }
+
+  const pending: Promise<T> = load().finally((): void => {
+    /*
+     * Only clear the slot if it is still OURS. A cache clear between the two
+     * (every write to a Global SSO/OIDC service does exactly that, twice) lets
+     * a NEWER lookup take the key while this one is still on the wire; a blind
+     * delete would evict that newer entry when this one settles, and the fan-
+     * out that follows would stop de-duplicating - the one situation this
+     * exists for.
+     */
+    if (inFlight.get(key) === pending) {
+      inFlight.delete(key);
+    }
+  });
+
+  inFlight.set(key, pending);
+
+  return pending;
+}
+
+export function loadTrustOnce(
+  key: string,
+  load: () => Promise<GlobalProviderTrust>,
+): Promise<GlobalProviderTrust> {
+  return loadOnce(inFlightTrustLookups, key, load);
+}
+
+export function loadAttachmentsOnce(
+  key: string,
+  load: () => Promise<GlobalProviderAttachments>,
+): Promise<GlobalProviderAttachments> {
+  return loadOnce(inFlightAttachmentLookups, key, load);
+}

package/Server/Utils/Marketing/ConversionUploadProvider.ts

@@ -1,6 +1,9 @@
 import { AxiosError } from "axios";
 import { JSONObject } from "../../../Types/JSON";
-import { MarketingConversionType } from "../../../Types/Marketing/MarketingConversion";
+import {
+  AdUploadableMarketingConversionTypes,
+  MarketingConversionType,
+} from "../../../Types/Marketing/MarketingConversion";
 import MarketingConversion from "../../../Models/DatabaseModels/MarketingConversion";
 
 /*
@@ -11,9 +14,12 @@ import MarketingConversion from "../../../Models/DatabaseModels/MarketingConvers
  *
  * Contract:
  * - getSkipReason returns a human-readable reason when this conversion can
- *   never be uploaded to this platform (wrong/missing click id, outside the
- *   platform's upload window, provider not configured for this conversion
- *   type). Null means uploadable.
+ *   never be uploaded to this platform (conversion type with no ad-platform
+ *   mapping, wrong/missing click id, outside the platform's upload window,
+ *   provider not configured for this conversion type). Null means uploadable.
+ *   It is implemented here and must not be overridden — providers implement
+ *   getProviderSkipReason instead, which only runs for conversion types that
+ *   are ad-uploadable at all.
  * - upload() sends one batch. Per-conversion PERMANENT rejections are
  *   returned in the result keyed by array index; they will not be retried.
  *   Transport/auth-level failures must THROW — the whole batch stays pending
@@ -52,7 +58,31 @@ export default abstract class ConversionUploadProvider {
 
   public abstract isConfigured(): boolean;
 
-  public abstract getSkipReason(
+  /*
+   * Every provider maps a conversion onto a platform conversion action by
+   * branching on isSignUp() — so a conversion type the ad platforms have no
+   * mapping for (a booked meeting) would otherwise be silently uploaded as a
+   * purchase. Screen those out here, before any provider sees them, so no
+   * provider or call site can skip the check.
+   */
+  public getSkipReason(conversion: MarketingConversion): ConversionSkip | null {
+    if (
+      !AdUploadableMarketingConversionTypes.includes(
+        conversion.conversionType as MarketingConversionType,
+      )
+    ) {
+      return {
+        reason: `Conversion type ${
+          conversion.conversionType || "unknown"
+        } has no ad platform conversion mapping`,
+        isPermanent: true,
+      };
+    }
+
+    return this.getProviderSkipReason(conversion);
+  }
+
+  protected abstract getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null;
 

package/Server/Utils/Marketing/Providers/GoogleAds.ts

@@ -46,7 +46,7 @@ export default class GoogleAdsProvider extends ConversionUploadProvider {
     );
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getGoogleClickId(conversion)) {

package/Server/Utils/Marketing/Providers/LinkedIn.ts

@@ -41,7 +41,7 @@ export default class LinkedInProvider extends ConversionUploadProvider {
     return Boolean(LinkedInConversionsAccessToken);
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getClickId(conversion, "li_fat_id")) {

package/Server/Utils/Marketing/Providers/Meta.ts

@@ -32,7 +32,7 @@ export default class MetaProvider extends ConversionUploadProvider {
     return Boolean(MetaConversionsPixelId && MetaConversionsAccessToken);
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getClickId(conversion, "fbclid")) {

package/Server/Utils/Marketing/Providers/MicrosoftAds.ts

@@ -45,7 +45,7 @@ export default class MicrosoftAdsProvider extends ConversionUploadProvider {
     );
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getClickId(conversion, "msclkid")) {

package/Server/Utils/Marketing/Providers/Reddit.ts

@@ -41,7 +41,7 @@ export default class RedditProvider extends ConversionUploadProvider {
     );
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getClickId(conversion, "rdt_cid")) {

package/Server/Utils/Monitor/Criteria/APIRequestCriteria.ts

@@ -1,6 +1,6 @@
 import DataToProcess from "../DataToProcess";
 import CompareCriteria from "./CompareCriteria";
-import EvaluateOverTime from "./EvaluateOverTime";
+import EvaluateOverTime, { OverTimeCriteriaValue } from "./EvaluateOverTime";
 import { JSONObject } from "../../../../Types/JSON";
 import {
   CheckOn,
@@ -10,50 +10,65 @@ import {
 import ProbeMonitorResponse from "../../../../Types/Probe/ProbeMonitorResponse";
 import Typeof from "../../../../Types/Typeof";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
-import logger from "../../Logger";
 
 export default class APIRequestCriteria {
   @CaptureSpan()
   public static async isMonitorInstanceCriteriaFilterMet(input: {
     dataToProcess: DataToProcess;
     criteriaFilter: CriteriaFilter;
+    /*
+     * The monitor's monitoringInterval cron. Over-time filters use it to
+     * work out how many samples a fully covered window should hold, so a
+     * monitor that has only just started is not mistaken for one whose
+     * whole window is breaching.
+     */
+    monitoringInterval?: string | undefined;
   }): Promise<string | null> {
     // Server Monitoring Checks
 
     let threshold: number | string | undefined | null =
       input.criteriaFilter.value;
 
-    let overTimeValue: Array<number | boolean> | number | boolean | undefined =
-      undefined;
+    const overTime: OverTimeCriteriaValue =
+      await EvaluateOverTime.getOverTimeValueForCriteriaFilter({
+        projectId: (input.dataToProcess as ProbeMonitorResponse).projectId,
+        monitorId: input.dataToProcess.monitorId!,
+        criteriaFilter: input.criteriaFilter,
+        /*
+         * Only the disk-usage series carries a diskPath attribute, so
+         * scoping any other series by it would filter against an attribute
+         * no row has - and an empty window now means "cannot judge yet"
+         * rather than "compare the live value", which would silence the
+         * filter outright.
+         */
+        miscData:
+          input.criteriaFilter.checkOn === CheckOn.DiskUsagePercent
+            ? (input.criteriaFilter.serverMonitorOptions as JSONObject)
+            : undefined,
+        monitoringInterval: input.monitoringInterval,
+      });
 
-    if (
-      input.criteriaFilter.evaluateOverTime &&
-      input.criteriaFilter.evaluateOverTimeOptions
-    ) {
-      try {
-        overTimeValue = await EvaluateOverTime.getValueOverTime({
-          projectId: (input.dataToProcess as ProbeMonitorResponse).projectId,
-          monitorId: input.dataToProcess.monitorId!,
-          evaluateOverTimeOptions: input.criteriaFilter.evaluateOverTimeOptions,
-          metricType: input.criteriaFilter.checkOn,
-          miscData: input.criteriaFilter.serverMonitorOptions as JSONObject,
-        });
-
-        if (Array.isArray(overTimeValue) && overTimeValue.length === 0) {
-          overTimeValue = undefined;
-        }
-      } catch (err) {
-        logger.error(
-          `Error in getting over time value for ${input.criteriaFilter.checkOn}`,
-        );
-        logger.error(err);
-        overTimeValue = undefined;
-      }
+    /*
+     * The window could not back this over-time filter (nothing recorded yet,
+     * or the monitor has not been running long enough to cover it). Return
+     * the decision the no-data policy already made instead of falling
+     * through to the value that arrived with this one check - that fallback
+     * is what let "all values over the last N minutes" fire off a single
+     * bad reading.
+     */
+    if (overTime.earlyReturn) {
+      return overTime.earlyReturn.result;
     }
 
+    const overTimeValue:
+      | Array<number | boolean>
+      | number
+      | boolean
+      | undefined = overTime.value;
+
     if (input.criteriaFilter.checkOn === CheckOn.IsOnline) {
       const currentIsOnline: boolean | Array<boolean> =
-        (overTimeValue as Array<boolean>) ||
+        (overTimeValue as Array<boolean>) ??
         (input.dataToProcess as ProbeMonitorResponse).isOnline;
 
       return CompareCriteria.compareCriteriaBoolean({
@@ -64,7 +79,7 @@ export default class APIRequestCriteria {
 
     if (input.criteriaFilter.checkOn === CheckOn.IsRequestTimeout) {
       const currentIsTimeout: boolean | Array<boolean> =
-        (overTimeValue as Array<boolean>) ||
+        (overTimeValue as Array<boolean>) ??
         (input.dataToProcess as ProbeMonitorResponse).isTimeout;
 
       return CompareCriteria.compareCriteriaBoolean({
@@ -78,7 +93,7 @@ export default class APIRequestCriteria {
       threshold = CompareCriteria.convertToNumber(threshold);
 
       const value: Array<number> | number =
-        (overTimeValue as Array<number>) ||
+        (overTimeValue as Array<number>) ??
         (input.dataToProcess as ProbeMonitorResponse).responseTimeInMs!;
 
       return CompareCriteria.compareCriteriaNumbers({
@@ -124,7 +139,7 @@ export default class APIRequestCriteria {
       ).pingResponse?.packetLossPercent;
 
       const value: Array<number> | number | undefined =
-        (overTimeValue as Array<number>) || packetLossPercent;
+        (overTimeValue as Array<number>) ?? packetLossPercent;
 
       if (value === undefined) {
         return null;
@@ -146,7 +161,7 @@ export default class APIRequestCriteria {
       ).pingResponse?.jitterInMs;
 
       const value: Array<number> | number | undefined =
-        (overTimeValue as Array<number>) || jitterInMs;
+        (overTimeValue as Array<number>) ?? jitterInMs;
 
       if (value === undefined) {
         return null;
@@ -169,7 +184,7 @@ export default class APIRequestCriteria {
       threshold = CompareCriteria.convertToNumber(threshold);
 
       const value: Array<number> | number =
-        (overTimeValue as Array<number>) ||
+        (overTimeValue as Array<number>) ??
         (input.dataToProcess as ProbeMonitorResponse).responseCode!;
 
       return CompareCriteria.compareCriteriaNumbers({

package/Server/Utils/Monitor/Criteria/DnsMonitorCriteria.ts

@@ -7,15 +7,21 @@ import {
 } from "../../../../Types/Monitor/CriteriaFilter";
 import DnsMonitorResponse from "../../../../Types/Monitor/DnsMonitor/DnsMonitorResponse";
 import ProbeMonitorResponse from "../../../../Types/Probe/ProbeMonitorResponse";
-import EvaluateOverTime from "./EvaluateOverTime";
+import EvaluateOverTime, { OverTimeCriteriaValue } from "./EvaluateOverTime";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
-import logger from "../../Logger";
 
 export default class DnsMonitorCriteria {
   @CaptureSpan()
   public static async isMonitorInstanceCriteriaFilterMet(input: {
     dataToProcess: DataToProcess;
     criteriaFilter: CriteriaFilter;
+    /*
+     * The monitor's monitoringInterval cron. Over-time filters use it to
+     * work out how many samples a fully covered window should hold, so a
+     * monitor that has only just started is not mistaken for one whose
+     * whole window is breaching.
+     */
+    monitoringInterval?: string | undefined;
   }): Promise<string | null> {
     let threshold: number | string | undefined | null =
       input.criteriaFilter.value;
@@ -26,37 +32,36 @@ export default class DnsMonitorCriteria {
     const dnsResponse: DnsMonitorResponse | undefined =
       dataToProcess.dnsResponse;
 
-    let overTimeValue: Array<number | boolean> | number | boolean | undefined =
-      undefined;
-
-    if (
-      input.criteriaFilter.evaluateOverTime &&
-      input.criteriaFilter.evaluateOverTimeOptions
-    ) {
-      try {
-        overTimeValue = await EvaluateOverTime.getValueOverTime({
-          projectId: (input.dataToProcess as ProbeMonitorResponse).projectId,
-          monitorId: input.dataToProcess.monitorId!,
-          evaluateOverTimeOptions: input.criteriaFilter.evaluateOverTimeOptions,
-          metricType: input.criteriaFilter.checkOn,
-        });
+    const overTime: OverTimeCriteriaValue =
+      await EvaluateOverTime.getOverTimeValueForCriteriaFilter({
+        projectId: (input.dataToProcess as ProbeMonitorResponse).projectId,
+        monitorId: input.dataToProcess.monitorId!,
+        criteriaFilter: input.criteriaFilter,
+        monitoringInterval: input.monitoringInterval,
+      });
 
-        if (Array.isArray(overTimeValue) && overTimeValue.length === 0) {
-          overTimeValue = undefined;
-        }
-      } catch (err) {
-        logger.error(
-          `Error in getting over time value for ${input.criteriaFilter.checkOn}`,
-        );
-        logger.error(err);
-        overTimeValue = undefined;
-      }
+    /*
+     * The window could not back this over-time filter (nothing recorded yet,
+     * or the monitor has not been running long enough to cover it). Return
+     * the decision the no-data policy already made instead of falling
+     * through to the value that arrived with this one check - that fallback
+     * is what let "all values over the last N minutes" fire off a single
+     * bad reading.
+     */
+    if (overTime.earlyReturn) {
+      return overTime.earlyReturn.result;
     }
 
+    const overTimeValue:
+      | Array<number | boolean>
+      | number
+      | boolean
+      | undefined = overTime.value;
+
     // Check if DNS is online
     if (input.criteriaFilter.checkOn === CheckOn.DnsIsOnline) {
       const currentIsOnline: boolean | Array<boolean> =
-        (overTimeValue as Array<boolean>) ||
+        (overTimeValue as Array<boolean>) ??
         (input.dataToProcess as ProbeMonitorResponse).isOnline;
 
       return CompareCriteria.compareCriteriaBoolean({
@@ -74,9 +79,9 @@ export default class DnsMonitorCriteria {
       }
 
       const currentResponseTime: number | Array<number> =
-        (overTimeValue as Array<number>) ||
-        dnsResponse?.responseTimeInMs ||
-        (input.dataToProcess as ProbeMonitorResponse).responseTimeInMs;
+        (overTimeValue as Array<number>) ??
+        (dnsResponse?.responseTimeInMs ||
+          (input.dataToProcess as ProbeMonitorResponse).responseTimeInMs);
 
       if (currentResponseTime === null || currentResponseTime === undefined) {
         return null;

package/Server/Utils/Monitor/Criteria/DomainMonitorCriteria.ts

@@ -8,14 +8,20 @@ import {
 import DomainMonitorResponse from "../../../../Types/Monitor/DomainMonitor/DomainMonitorResponse";
 import ProbeMonitorResponse from "../../../../Types/Probe/ProbeMonitorResponse";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
-import EvaluateOverTime from "./EvaluateOverTime";
-import logger from "../../Logger";
+import EvaluateOverTime, { OverTimeCriteriaValue } from "./EvaluateOverTime";
 
 export default class DomainMonitorCriteria {
   @CaptureSpan()
   public static async isMonitorInstanceCriteriaFilterMet(input: {
     dataToProcess: DataToProcess;
     criteriaFilter: CriteriaFilter;
+    /*
+     * The monitor's monitoringInterval cron. Over-time filters use it to
+     * work out how many samples a fully covered window should hold, so a
+     * monitor that has only just started is not mistaken for one whose
+     * whole window is breaching.
+     */
+    monitoringInterval?: string | undefined;
   }): Promise<string | null> {
     let threshold: number | string | undefined | null =
       input.criteriaFilter.value;
@@ -26,33 +32,32 @@ export default class DomainMonitorCriteria {
     const domainResponse: DomainMonitorResponse | undefined =
       dataToProcess.domainResponse;
 
-    let overTimeValue: Array<number | boolean> | number | boolean | undefined =
-      undefined;
-
-    if (
-      input.criteriaFilter.evaluateOverTime &&
-      input.criteriaFilter.evaluateOverTimeOptions
-    ) {
-      try {
-        overTimeValue = await EvaluateOverTime.getValueOverTime({
-          projectId: dataToProcess.projectId,
-          monitorId: input.dataToProcess.monitorId!,
-          evaluateOverTimeOptions: input.criteriaFilter.evaluateOverTimeOptions,
-          metricType: input.criteriaFilter.checkOn,
-        });
+    const overTime: OverTimeCriteriaValue =
+      await EvaluateOverTime.getOverTimeValueForCriteriaFilter({
+        projectId: dataToProcess.projectId,
+        monitorId: input.dataToProcess.monitorId!,
+        criteriaFilter: input.criteriaFilter,
+        monitoringInterval: input.monitoringInterval,
+      });
 
-        if (Array.isArray(overTimeValue) && overTimeValue.length === 0) {
-          overTimeValue = undefined;
-        }
-      } catch (err) {
-        logger.error(
-          `Error in getting over time value for ${input.criteriaFilter.checkOn}`,
-        );
-        logger.error(err);
-        overTimeValue = undefined;
-      }
+    /*
+     * The window could not back this over-time filter (nothing recorded yet,
+     * or the monitor has not been running long enough to cover it). Return
+     * the decision the no-data policy already made instead of falling
+     * through to the value that arrived with this one check - that fallback
+     * is what let "all values over the last N minutes" fire off a single
+     * bad reading.
+     */
+    if (overTime.earlyReturn) {
+      return overTime.earlyReturn.result;
     }
 
+    const overTimeValue:
+      | Array<number | boolean>
+      | number
+      | boolean
+      | undefined = overTime.value;
+
     /*
      * Whether the registration lookup itself succeeded. Without this, a
      * domain whose TLD has no working WHOIS or RDAP service produces a
@@ -62,7 +67,7 @@ export default class DomainMonitorCriteria {
      */
     if (input.criteriaFilter.checkOn === CheckOn.IsOnline) {
       const currentIsOnline: boolean | Array<boolean> =
-        (overTimeValue as Array<boolean>) || dataToProcess.isOnline;
+        (overTimeValue as Array<boolean>) ?? dataToProcess.isOnline;
 
       return CompareCriteria.compareCriteriaBoolean({
         value: currentIsOnline,
@@ -72,7 +77,7 @@ export default class DomainMonitorCriteria {
 
     if (input.criteriaFilter.checkOn === CheckOn.IsRequestTimeout) {
       const currentIsTimeout: boolean | Array<boolean> =
-        (overTimeValue as Array<boolean>) || dataToProcess.isTimeout;
+        (overTimeValue as Array<boolean>) ?? dataToProcess.isTimeout;
 
       return CompareCriteria.compareCriteriaBoolean({
         value: currentIsTimeout,