@oneuptime/common 12.0.34 → 13.0.1

package/Tests/Server/Utils/Monitor/NetworkInventoryUtil.test.ts

@@ -20,6 +20,8 @@ import SnmpVendorTemplateUtil, {
 import NetworkDeviceMonitoringMethod from "../../../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
 import { NetworkDevicePollMode } from "../../../../Server/Utils/Monitor/NetworkDeviceHydrationUtil";
 import logger from "../../../../Server/Utils/Logger";
+import { JSONObject } from "../../../../Types/JSON";
+import { FindOperator } from "typeorm";
 
 /*
  * NetworkInventoryUtil.updateFromWalk is the single writer that keeps the
@@ -47,6 +49,8 @@ let deviceUpdateSpy: jest.SpyInstance;
 let interfaceFindSpy: jest.SpyInstance;
 let interfaceUpsertSpy: jest.SpyInstance;
 let endpointUpsertSpy: jest.SpyInstance;
+let deviceLookupSpy: jest.SpyInstance;
+let macWriteSpy: jest.SpyInstance;
 
 function mockServices(
   existingInterfaces: Array<NetworkInterface> = [],
@@ -119,6 +123,19 @@ function mockServices(
   endpointUpsertSpy = jest
     .spyOn(NetworkEndpointService, "upsertDiscoveredEndpoints")
     .mockResolvedValue(undefined as never);
+  /*
+   * Device MAC learning follows the endpoint upsert on any walk that
+   * carried ARP bindings: one findBy for the devices registered at the
+   * bound addresses, then a hook-free compare-and-set write per device the
+   * planner picked. Stubbed here so the ARP cases never reach a database;
+   * the learning block seeds findBy with real rows where it matters.
+   */
+  deviceLookupSpy = jest
+    .spyOn(NetworkDeviceService, "findBy")
+    .mockResolvedValue([]);
+  macWriteSpy = jest
+    .spyOn(NetworkDeviceService, "updateColumnsByIdWithoutHooks")
+    .mockResolvedValue(undefined);
 }
 
 function deviceUpdatePayload(): DeviceUpdatePayload {
@@ -1101,6 +1118,306 @@ describe("NetworkInventoryUtil.updateFromWalk — endpoint discovery", () => {
   });
 });
 
+/*
+ * A walked router's ARP table binds the address a managed device is
+ * registered at to the MAC the switches learned - the one fact a ping-only
+ * register or handset never reports about itself. After the endpoint
+ * inventory is written, the walk hands those bindings to
+ * NetworkDeviceMacLearningUtil, which stamps the MAC on the device row while
+ * its column is still empty. The planner's rules are pinned in
+ * Tests/Utils/Monitor/DeviceMacLearningUtil.test.ts and the database contract
+ * in Tests/Server/Utils/Monitor/NetworkDeviceMacLearningUtil.test.ts; what is
+ * pinned HERE is the hand-off from the walk: when learning runs, what it is
+ * scoped by, and that a failure in it stays in it.
+ */
+describe("NetworkInventoryUtil.updateFromWalk — device MAC learning", () => {
+  const SITE_ID: ObjectID = new ObjectID(
+    "5a5a5a5a-0000-4000-8000-00000000000a",
+  );
+  const OTHER_SITE_ID: ObjectID = new ObjectID(
+    "5b5b5b5b-0000-4000-8000-00000000000b",
+  );
+  const REGISTER_ID: string = "8f2c1f0e-0000-4000-8000-0000000000bb";
+  const HANDSET_ID: string = "8f2c1f0e-0000-4000-8000-0000000000cc";
+  const REGISTER_IP: string = "10.0.0.5";
+  const REGISTER_MAC: string = "aa:bb:cc:00:11:22";
+
+  // A managed, ping-only device registered at the address the router bound.
+  function registeredDevice(
+    id: string,
+    overrides?: { siteId?: ObjectID; macAddress?: string },
+  ): NetworkDevice {
+    const row: NetworkDevice = new NetworkDevice();
+    row.id = new ObjectID(id);
+    row.hostname = REGISTER_IP;
+    if (overrides?.siteId) {
+      row.siteId = overrides.siteId;
+    }
+    if (overrides?.macAddress !== undefined) {
+      row.macAddress = overrides.macAddress;
+    }
+    return row;
+  }
+
+  // The ARP table spelling differs from the column's: learning normalizes.
+  function arpWalk(): Partial<SnmpMonitorResponse> {
+    return {
+      arpEntries: [
+        {
+          ipAddress: REGISTER_IP,
+          macAddress: "AA-BB-CC-00-11-22",
+          interfaceIndex: 3,
+          entryType: "dynamic",
+        },
+      ],
+    };
+  }
+
+  /*
+   * The addresses the device lookup asked about. QueryHelper.any renders
+   * them into a TypeORM Raw operator with a RANDOM parameter name, so the
+   * list is recovered from the operator's parameters.
+   */
+  function addressesLookedUp(): Array<string> {
+    const query: JSONObject = (deviceLookupSpy.mock.calls[0]![0] as JSONObject)[
+      "query"
+    ] as JSONObject;
+    const operator: FindOperator<string> = query[
+      "hostname"
+    ] as unknown as FindOperator<string>;
+    const parameters: Record<string, unknown> =
+      (operator.objectLiteralParameters || {}) as Record<string, unknown>;
+    const values: Array<unknown> =
+      (Object.values(parameters)[0] as Array<unknown>) || [];
+    return values.map((value: unknown): string => {
+      return String(value);
+    });
+  }
+
+  function spyError(): jest.SpyInstance {
+    return jest.spyOn(logger, "error").mockImplementation(() => {
+      return undefined;
+    });
+  }
+
+  test("a walk carrying an ARP entry looks up the devices at the bound address, in the walked device's project", async () => {
+    mockServices([], { siteId: SITE_ID });
+    deviceLookupSpy.mockResolvedValue([
+      registeredDevice(REGISTER_ID, { siteId: SITE_ID }),
+    ]);
+
+    await runWalk(arpWalk());
+
+    expect(deviceLookupSpy).toHaveBeenCalledTimes(1);
+
+    const query: JSONObject = (deviceLookupSpy.mock.calls[0]![0] as JSONObject)[
+      "query"
+    ] as JSONObject;
+
+    expect((query["projectId"] as ObjectID).toString()).toBe(PROJECT_ID);
+    expect(addressesLookedUp()).toEqual([REGISTER_IP]);
+  });
+
+  test("a device with an empty MAC in the router's site is stamped through the hook-free compare-and-set write", async () => {
+    mockServices([], { siteId: SITE_ID });
+    deviceLookupSpy.mockResolvedValue([
+      registeredDevice(REGISTER_ID, { siteId: SITE_ID }),
+    ]);
+
+    await runWalk(arpWalk());
+
+    expect(macWriteSpy).toHaveBeenCalledTimes(1);
+
+    const write: JSONObject = macWriteSpy.mock.calls[0]![0] as JSONObject;
+
+    expect((write["id"] as ObjectID).toString()).toBe(REGISTER_ID);
+    expect(write["data"]).toEqual({
+      macAddress: REGISTER_MAC,
+      isMacAddressLearned: true,
+    });
+    expect(write["expectedData"]).toEqual({
+      macAddress: null,
+      deletedAt: null,
+    });
+    // The walked router's own row is untouched by learning.
+    expect(deviceUpdateSpy).toHaveBeenCalledTimes(1);
+    expect(deviceUpdatePayload()).not.toHaveProperty("macAddress");
+  });
+
+  test("learning runs after the endpoint inventory has been written", async () => {
+    mockServices([], { siteId: SITE_ID });
+
+    await runWalk(arpWalk());
+
+    expect(endpointUpsertSpy).toHaveBeenCalledTimes(1);
+    expect(deviceLookupSpy).toHaveBeenCalledTimes(1);
+    expect(endpointUpsertSpy.mock.invocationCallOrder[0]!).toBeLessThan(
+      deviceLookupSpy.mock.invocationCallOrder[0]!,
+    );
+  });
+
+  test("a walk with FDB entries only never looks devices up", async () => {
+    mockServices([], { siteId: SITE_ID });
+
+    await runWalk({
+      interfaces: [walkedInterface({ interfaceIndex: 5, name: "Gi0/5" })],
+      fdbEntries: [
+        {
+          macAddress: REGISTER_MAC,
+          bridgePort: 5,
+          interfaceIndex: 5,
+          status: "learned",
+        },
+      ],
+    });
+
+    // The attachment was still written; only the ARP half was absent.
+    expect(endpointUpsertSpy).toHaveBeenCalledTimes(1);
+    expect(deviceLookupSpy).not.toHaveBeenCalled();
+    expect(macWriteSpy).not.toHaveBeenCalled();
+  });
+
+  test("a walk without endpoint arrays at all never looks devices up", async () => {
+    mockServices([], { siteId: SITE_ID });
+
+    await runWalk({ interfaces: [walkedInterface()] });
+
+    expect(deviceLookupSpy).not.toHaveBeenCalled();
+    expect(macWriteSpy).not.toHaveBeenCalled();
+  });
+
+  /*
+   * Learning keys off the bindings the attachment pass KEPT, not the raw
+   * ARP rows: an entry for the router's own interface MAC is dropped there
+   * and must not come back as a lookup here.
+   */
+  test("an ARP entry the attachment pass discards never reaches learning", async () => {
+    mockServices([], { siteId: SITE_ID });
+
+    await runWalk({
+      interfaces: [
+        walkedInterface({ interfaceIndex: 3, macAddress: REGISTER_MAC }),
+      ],
+      ...arpWalk(),
+    });
+
+    expect(endpointUpsertSpy).not.toHaveBeenCalled();
+    expect(deviceLookupSpy).not.toHaveBeenCalled();
+    expect(macWriteSpy).not.toHaveBeenCalled();
+  });
+
+  test("a failure in the learning step is logged and does not prevent the walk from completing", async () => {
+    mockServices([], { siteId: SITE_ID });
+    deviceLookupSpy.mockRejectedValue(new Error("connection reset"));
+    const error: jest.SpyInstance = spyError();
+
+    const snmpResponse: SnmpMonitorResponse = await runWalk(arpWalk());
+
+    // Nothing escaped, and everything before the learning step landed.
+    expect(snmpResponse).toBeDefined();
+    expect(deviceUpdateSpy).toHaveBeenCalledTimes(1);
+    expect(endpointUpsertSpy).toHaveBeenCalledTimes(1);
+    expect(macWriteSpy).not.toHaveBeenCalled();
+
+    const messages: Array<string> = error.mock.calls.map(
+      (call: Array<unknown>) => {
+        return String(call[0]);
+      },
+    );
+
+    /*
+     * Its OWN catch, naming the device - never the outer "failed to update
+     * network inventory" line, which would read as the endpoint upsert
+     * having failed too.
+     */
+    expect(
+      messages.some((message: string) => {
+        return message.includes("MAC") && message.includes(DEVICE_ID);
+      }),
+    ).toBe(true);
+    expect(
+      messages.some((message: string) => {
+        return message.includes("Failed to update network inventory");
+      }),
+    ).toBe(false);
+  });
+
+  test("a failing MAC write is contained the same way", async () => {
+    mockServices([], { siteId: SITE_ID });
+    deviceLookupSpy.mockResolvedValue([
+      registeredDevice(REGISTER_ID, { siteId: SITE_ID }),
+    ]);
+    macWriteSpy.mockRejectedValue(new Error("deadlock detected"));
+    const error: jest.SpyInstance = spyError();
+
+    await expect(runWalk(arpWalk())).resolves.toBeDefined();
+
+    expect(endpointUpsertSpy).toHaveBeenCalledTimes(1);
+    expect(error).toHaveBeenCalled();
+  });
+
+  test("the observing device's site scopes the match: a device in another site is not stamped", async () => {
+    mockServices([], { siteId: SITE_ID });
+    deviceLookupSpy.mockResolvedValue([
+      registeredDevice(REGISTER_ID, { siteId: OTHER_SITE_ID }),
+    ]);
+
+    await runWalk(arpWalk());
+
+    // Looked up - the read is project-wide by design - but refused.
+    expect(deviceLookupSpy).toHaveBeenCalledTimes(1);
+    expect(macWriteSpy).not.toHaveBeenCalled();
+  });
+
+  test("an observing device with no site stamps only a device with no site", async () => {
+    // The default device carries no siteId: a project without sites.
+    mockServices();
+    const siteless: NetworkDevice = registeredDevice(HANDSET_ID);
+    deviceLookupSpy.mockResolvedValue([
+      registeredDevice(REGISTER_ID, { siteId: SITE_ID }),
+    ]);
+
+    await runWalk(arpWalk());
+    expect(macWriteSpy).not.toHaveBeenCalled();
+
+    deviceLookupSpy.mockResolvedValue([siteless]);
+
+    await runWalk(arpWalk());
+    expect(macWriteSpy).toHaveBeenCalledTimes(1);
+    expect(
+      (
+        (macWriteSpy.mock.calls[0]![0] as JSONObject)["id"] as ObjectID
+      ).toString(),
+    ).toBe(HANDSET_ID);
+  });
+
+  test("a device that already carries a MAC is left alone", async () => {
+    mockServices([], { siteId: SITE_ID });
+    deviceLookupSpy.mockResolvedValue([
+      registeredDevice(REGISTER_ID, {
+        siteId: SITE_ID,
+        macAddress: "00:11:22:33:44:55",
+      }),
+    ]);
+
+    await runWalk(arpWalk());
+
+    expect(deviceLookupSpy).toHaveBeenCalledTimes(1);
+    expect(macWriteSpy).not.toHaveBeenCalled();
+  });
+
+  test("selects siteId on the device read, or learning could never scope by site", async () => {
+    mockServices();
+
+    await runWalk();
+
+    const findArgs: { select?: Record<string, boolean> } = deviceFindSpy.mock
+      .calls[0]![0] as unknown as { select?: Record<string, boolean> };
+
+    expect(findArgs.select?.["siteId"]).toBe(true);
+  });
+});
+
 describe("NetworkInventoryUtil.updateFromWalk — vendor health template auto-apply", () => {
   /*
    * The automatic counterpart of the dashboard's vendor-template banner:

package/Tests/Server/Utils/Monitor/PerSeriesSecondEntityAlerting.test.ts

@@ -186,6 +186,7 @@ function emptyResourceContext(): SeriesResolvedResourceIds {
     kubernetesClusterIds: [],
     serviceIds: [],
     proxmoxClusterIds: [],
+    vmwareVCenterIds: [],
     cephClusterIds: [],
     dockerSwarmClusterIds: [],
     iotFleetIds: [],

package/Tests/Server/Utils/Monitor/SeriesResourceLinker.test.ts

@@ -30,6 +30,7 @@ import KubernetesClusterService from "../../../../Server/Services/KubernetesClus
 import PodmanHostService from "../../../../Server/Services/PodmanHostService";
 import ProxmoxClusterService from "../../../../Server/Services/ProxmoxClusterService";
 import ServiceService from "../../../../Server/Services/ServiceService";
+import VMwareVCenterService from "../../../../Server/Services/VMwareVCenterService";
 import SeriesResourceLinker, {
   SeriesLinkableModel,
   SeriesResolvedResourceIds,
@@ -102,6 +103,11 @@ const RESOURCE_SERVICES: Array<ResourceServiceUnderTest> = [
     service: ProxmoxClusterService,
     nameColumn: "name",
   },
+  {
+    relation: "vmwareVCenters",
+    service: VMwareVCenterService,
+    nameColumn: "name",
+  },
   { relation: "cephClusters", service: CephClusterService, nameColumn: "name" },
   {
     relation: "dockerSwarmClusters",
@@ -185,6 +191,7 @@ function emptyResourceContext(): SeriesResolvedResourceIds {
     kubernetesClusterIds: [],
     serviceIds: [],
     proxmoxClusterIds: [],
+    vmwareVCenterIds: [],
     cephClusterIds: [],
     dockerSwarmClusterIds: [],
     iotFleetIds: [],
@@ -336,6 +343,8 @@ describe("SeriesResourceLinker.linkSeriesResourcesToModel", () => {
     ["services", "service.name", "name"],
     ["services", "oneuptime.service.name", "name"],
     ["proxmoxClusters", "proxmox.cluster.name", "name"],
+    ["vmwareVCenters", "vmware.vcenter.name", "name"],
+    ["vmwareVCenters", "resource.vmware.vcenter.name", "name"],
     ["cephClusters", "ceph.cluster.name", "name"],
     ["dockerSwarmClusters", "docker.swarm.cluster.name", "name"],
     ["iotFleets", "iot.fleet.name", "name"],
@@ -522,6 +531,7 @@ describe("SeriesResourceLinker.linkSeriesResourcesToModel", () => {
         "k8s.cluster.name": "k8s-1",
         "service.name": "svc-1",
         "proxmox.cluster.name": "pve-1",
+        "vmware.vcenter.name": "vcsa-1",
         "ceph.cluster.name": "ceph-1",
         "docker.swarm.cluster.name": "swarm-1",
         "iot.fleet.name": "fleet-1",
@@ -541,8 +551,8 @@ describe("SeriesResourceLinker.linkSeriesResourcesToModel", () => {
       }
     }
 
-    // 9 types, and hosts get an extra query for the id stamp.
-    expect(assertedQueries).toBe(10);
+    // 10 types, and hosts get an extra query for the id stamp.
+    expect(assertedQueries).toBe(11);
   });
 
   test("does not link a resource that belongs to another project", async () => {
@@ -664,6 +674,7 @@ describe("SeriesResourceLinker.resolveResourcesFromSeriesLabels", () => {
     expect(resolved.podmanHostIds).toEqual([]);
     expect(resolved.kubernetesClusterIds).toEqual([]);
     expect(resolved.proxmoxClusterIds).toEqual([]);
+    expect(resolved.vmwareVCenterIds).toEqual([]);
     expect(resolved.cephClusterIds).toEqual([]);
     expect(resolved.dockerSwarmClusterIds).toEqual([]);
   });
@@ -678,6 +689,7 @@ describe("SeriesResourceLinker.attachResolvedResources", () => {
       resolved: {
         ...emptyResourceContext(),
         proxmoxClusterIds: ["pve-1"],
+        vmwareVCenterIds: ["vcsa-1"],
         cephClusterIds: ["ceph-1"],
         dockerSwarmClusterIds: ["swarm-1"],
         iotFleetIds: ["fleet-1"],
@@ -685,6 +697,7 @@ describe("SeriesResourceLinker.attachResolvedResources", () => {
     });
 
     expect(idsOn(alert, "proxmoxClusters")).toEqual(["pve-1"]);
+    expect(idsOn(alert, "vmwareVCenters")).toEqual(["vcsa-1"]);
     expect(idsOn(alert, "cephClusters")).toEqual(["ceph-1"]);
     expect(idsOn(alert, "dockerSwarmClusters")).toEqual(["swarm-1"]);
     expect(idsOn(alert, "iotFleets")).toEqual(["fleet-1"]);
@@ -721,6 +734,36 @@ describe("SeriesResourceLinker.attachResolvedResources", () => {
     ]);
   });
 
+  test("merges a vCenter from the label path with the step-config one", async () => {
+    /*
+     * VMware twin of the Proxmox merge: a user-built monitor grouped by
+     * `vmware.vcenter.name` names one vCenter through its labels while
+     * the step's vcenterIdentifier names another; both must survive.
+     */
+    rowsByRelation.set("vmwareVCenters", [{ _id: "vcsa-from-label" }]);
+
+    const alert: Alert = new Alert();
+
+    await SeriesResourceLinker.linkSeriesResourcesToModel({
+      model: alert,
+      seriesLabels: { "resource.vmware.vcenter.name": "vcsa-a" },
+      projectId: PROJECT_ID,
+    });
+
+    SeriesResourceLinker.attachResolvedResources({
+      model: alert,
+      resolved: {
+        ...emptyResourceContext(),
+        vmwareVCenterIds: ["vcsa-from-step-config"],
+      },
+    });
+
+    expect(idsOn(alert, "vmwareVCenters")).toEqual([
+      "vcsa-from-label",
+      "vcsa-from-step-config",
+    ]);
+  });
+
   test("dedupes a cluster both paths resolved", async () => {
     rowsByRelation.set("cephClusters", [{ _id: "ceph-1" }]);
 
@@ -752,6 +795,7 @@ describe("SeriesResourceLinker.attachResolvedResources", () => {
     });
 
     expect(alert.proxmoxClusters).toBeUndefined();
+    expect(alert.vmwareVCenters).toBeUndefined();
     expect(alert.cephClusters).toBeUndefined();
     expect(alert.dockerSwarmClusters).toBeUndefined();
     expect(alert.iotFleets).toBeUndefined();

package/Tests/Server/Utils/SecurityEvent/ConnectorErrorMessage.test.ts

@@ -31,7 +31,7 @@ import {
  * caught a per-connection poll failure and then wrote { lastPolledAt,
  * lastError } back onto the row with a bare, unguarded updateOneById.
  * lastError was TableColumnType.LongText — varchar(500) — while a Google
- * SecOps client error is a fixed prefix plus up to 500 characters of
+ * SecOps client error was a fixed prefix plus up to 500 characters of
  * echoed response body, so it overflowed. DatabaseService's
  * checkMaxLengthOfFields turns an overflow into a BadDataException, the
  * throw escaped the catch block and the whole loop with it, nothing was
@@ -46,8 +46,8 @@ import {
  * So this file pins both halves of the fix, plus the column widening that
  * makes the clamp sufficient:
  *
- *   - toMessage: every thrown shape becomes a non-empty string that is
- *     never longer than MAX_CONNECTOR_ERROR_MESSAGE_LENGTH, with the
+ *   - toMessage: by default, every thrown shape becomes a non-empty string
+ *     no longer than MAX_CONNECTOR_ERROR_MESSAGE_LENGTH, with the
  *     truncation marker counted inside the limit rather than added on
  *     top of it.
  *   - recordFailure: the bookkeeping write runs inside its own
@@ -273,7 +273,7 @@ describe("ConnectorErrorMessage.toMessage", () => {
       ).toBe(true);
     });
 
-    test("no input can produce a string longer than the limit", () => {
+    test("default options never produce a string longer than the limit", () => {
       const cases: Array<unknown> = [
         new Error(repeatToLength("x", 10)),
         new Error(repeatToLength("x", MAX_CONNECTOR_ERROR_MESSAGE_LENGTH)),
@@ -314,6 +314,61 @@ describe("ConnectorErrorMessage.toMessage", () => {
       expect(message.endsWith(TRUNCATION_MARKER)).toBe(false);
     });
   });
+
+  describe("full diagnostics for an unbounded column", () => {
+    test.each(["Error", "string", "custom object"])(
+      "truncate:false preserves the complete %s message, including its final detail",
+      (shape: string): void => {
+        const fullMessage: string = `${"Google diagnostic detail. ".repeat(100)}final-instance-detail`;
+        const error: unknown =
+          shape === "Error"
+            ? new Error(fullMessage)
+            : shape === "string"
+              ? fullMessage
+              : {
+                  toString: (): string => {
+                    return fullMessage;
+                  },
+                };
+
+        expect(fullMessage.length).toBeGreaterThan(
+          MAX_CONNECTOR_ERROR_MESSAGE_LENGTH,
+        );
+        expect(
+          ConnectorErrorMessage.toMessage(error, { truncate: false }),
+        ).toBe(fullMessage);
+
+        // Opting in for Google SecOps must not change existing bounded callers.
+        for (const options of [
+          {},
+          { truncate: true },
+          { truncate: undefined },
+        ]) {
+          const bounded: string = ConnectorErrorMessage.toMessage(
+            error,
+            options,
+          );
+          expect(bounded.length).toBe(MAX_CONNECTOR_ERROR_MESSAGE_LENGTH);
+          expect(bounded.endsWith(TRUNCATION_MARKER)).toBe(true);
+          expect(bounded).not.toContain("final-instance-detail");
+        }
+      },
+    );
+
+    test("full diagnostics still trim outer whitespace and supply the empty-message fallback", (): void => {
+      const fullMessage: string = `${"diagnostic ".repeat(150)}final-detail`;
+      expect(
+        ConnectorErrorMessage.toMessage(new Error(` \n${fullMessage}\t `), {
+          truncate: false,
+        }),
+      ).toBe(fullMessage);
+      for (const error of [null, undefined, " \n ", new Error("\t")]) {
+        expect(
+          ConnectorErrorMessage.toMessage(error, { truncate: false }),
+        ).toBe(UNKNOWN_ERROR_MESSAGE);
+      }
+    });
+  });
 });
 
 /*
@@ -345,8 +400,8 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
     "projects/my-project/locations/us/instances/3f0a-instance";
 
   /*
-   * A Google error body is JSON and routinely far longer than the 500
-   * characters the client keeps of it.
+   * Google error bodies routinely exceed both the old 500-character client
+   * slice and the helper's default 1,000-character limit.
    */
   const HUGE_ERROR_BODY: string = JSON.stringify({
     error: {
@@ -401,7 +456,7 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
     throw new Error("expected the client to throw");
   }
 
-  test("a failed alerts fetch overflows the old column, and toMessage keeps it storable", async () => {
+  test("a failed alerts fetch retains its full body with opt-in and remains bounded by default", async () => {
     const error: Error = await captureFetchAlertsError([
       {
         status: 200,
@@ -416,18 +471,8 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
     expect(rawMessage.startsWith(prefix)).toBe(true);
 
     /*
-     * The template is a 46-character prefix plus responseText.slice(0, 500),
-     * and now an operator hint behind that. 546 was already > 500, so under
-     * the old TableColumnType.LongText declaration checkMaxLengthOfFields
-     * threw BadDataException on the poller's own recovery write — which is
-     * how lastPolledAt and lastError both stayed null while the connector
-     * silently stopped polling. The hint only makes the overflow worse.
-     *
-     * Both halves are pinned by content rather than by total length: the
-     * echo is exactly the first 500 characters of the body, and the tail is
-     * exactly what describeHttpFailure derives for this status and body. A
-     * length-only check would go on passing if the echo and the hint ever
-     * traded characters with each other.
+     * The entire Google response precedes the operator hint. Applying the
+     * old 500-character slice here would make full persistence ineffective.
      */
     const guidance: string = GoogleSecOpsClient.describeHttpFailure(
       403,
@@ -436,33 +481,24 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
 
     expect(prefix.length).toBe(46);
     expect(guidance.length).toBeGreaterThan(0);
-    expect(rawMessage).toBe(
-      `${prefix}${HUGE_ERROR_BODY.slice(0, 500)}${guidance}`,
-    );
+    expect(rawMessage).toBe(`${prefix}${HUGE_ERROR_BODY}${guidance}`);
     expect(rawMessage.length).toBeGreaterThan(OLD_LAST_ERROR_COLUMN_MAX_LENGTH);
     expect(rawMessage.length).toBeGreaterThan(
       getMaxLengthFromTableColumnType(TableColumnType.LongText)!,
     );
 
-    const stored: string = ConnectorErrorMessage.toMessage(error);
-
-    expect(stored.length).toBeLessThanOrEqual(
+    expect(rawMessage.length).toBeGreaterThan(
       MAX_CONNECTOR_ERROR_MESSAGE_LENGTH,
     );
-
-    /*
-     * Prefix + echo + hint still fits inside 1000, so the whole diagnostic
-     * survives the clamp. Asserted rather than assumed: if a future hint
-     * pushes the worst case past the clamp, the operator starts reading a
-     * truncated message and this test should be the thing that says so.
-     */
-    expect(rawMessage.length).toBeLessThanOrEqual(
-      MAX_CONNECTOR_ERROR_MESSAGE_LENGTH,
+    const bounded: string = ConnectorErrorMessage.toMessage(error);
+    expect(bounded.length).toBe(MAX_CONNECTOR_ERROR_MESSAGE_LENGTH);
+    expect(bounded.endsWith(TRUNCATION_MARKER)).toBe(true);
+    expect(ConnectorErrorMessage.toMessage(error, { truncate: false })).toBe(
+      rawMessage,
     );
-    expect(stored).toBe(rawMessage);
   });
 
-  test("a failed token exchange overflows the old column too, and toMessage keeps it storable", async () => {
+  test("a failed token exchange retains its full body with opt-in and remains bounded by default", async () => {
     const error: Error = await captureFetchAlertsError([
       { status: 401, body: HUGE_ERROR_BODY },
     ]);
@@ -473,7 +509,7 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
     expect(rawMessage.startsWith(prefix)).toBe(true);
 
     /*
-     * Prefix + 500 characters of echoed body, and nothing behind it. The
+     * Prefix + the complete response body, and nothing behind it. The
      * token exchange deliberately carries no Chronicle hint: every hint
      * describeHttpFailure knows how to give is about the instance resource
      * name, the chronicle.viewer role or the region prefix, none of which
@@ -481,23 +517,23 @@ describe("ConnectorErrorMessage.toMessage on the real Google SecOps client error
      * that appending guidance here becomes a decision rather than a
      * side effect of editing the alerts path.
      */
-    expect(rawMessage).toBe(`${prefix}${HUGE_ERROR_BODY.slice(0, 500)}`);
-    expect(rawMessage.length).toBe(prefix.length + 500);
+    expect(rawMessage).toBe(`${prefix}${HUGE_ERROR_BODY}`);
+    expect(rawMessage.length).toBe(prefix.length + HUGE_ERROR_BODY.length);
     expect(rawMessage.length).toBeGreaterThan(OLD_LAST_ERROR_COLUMN_MAX_LENGTH);
 
-    const stored: string = ConnectorErrorMessage.toMessage(error);
-
-    expect(stored.length).toBeLessThanOrEqual(
-      MAX_CONNECTOR_ERROR_MESSAGE_LENGTH,
+    const bounded: string = ConnectorErrorMessage.toMessage(error);
+    expect(bounded.length).toBe(MAX_CONNECTOR_ERROR_MESSAGE_LENGTH);
+    expect(bounded.endsWith(TRUNCATION_MARKER)).toBe(true);
+    expect(ConnectorErrorMessage.toMessage(error, { truncate: false })).toBe(
+      rawMessage,
     );
-    expect(stored).toBe(rawMessage);
   });
 
   test("a ClickHouse-style error that echoes a whole compiled query is clamped", () => {
     /*
      * The evaluator side of the same bug: a ClickHouse failure echoes the
      * compiled query back, so its messages run to thousands of characters
-     * rather than the client's bounded 546.
+     * just as a detailed Google API failure does.
      */
     const echoedQuery: string = repeatToLength(
       "SELECT count() FROM security_event WHERE projectId = {p0:String} AND ",