@oneuptime/common 12.0.34 → 13.0.1

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsPollerFailureTaxonomy.test.ts

@@ -1,3 +1,4 @@
+import Semaphore from "../../../../Server/Infrastructure/Semaphore";
 import { generateKeyPairSync } from "crypto";
 import GoogleSecOpsConnection from "../../../../Models/DatabaseModels/GoogleSecOpsConnection";
 import GoogleSecOpsConnectionService from "../../../../Server/Services/GoogleSecOpsConnectionService";
@@ -6,7 +7,6 @@ import OTelIngestService, {
 } from "../../../../Server/Services/OpenTelemetryIngestService";
 import SecurityEventService from "../../../../Server/Services/SecurityEventService";
 import logger from "../../../../Server/Utils/Logger";
-import { MAX_CONNECTOR_ERROR_MESSAGE_LENGTH } from "../../../../Server/Utils/SecurityEvent/ConnectorErrorMessage";
 import GoogleSecOpsClient, {
   FetchLike,
   FetchResponseLike,
@@ -160,7 +160,8 @@ function makeConnection(): GoogleSecOpsConnection {
   connection.instanceResourceName = INSTANCE_RESOURCE_NAME;
   connection.serviceAccountJson = SERVICE_ACCOUNT_JSON;
   connection.pollIntervalInMinutes = 5;
-  // lastPolledAt left unset: never polled, therefore always due.
+  connection.cursor = new Date(Date.now() - 5 * 60 * 1000).toISOString();
+  // A saved cursor with no recent attempt is due and must survive failures.
   return connection;
 }
 
@@ -467,10 +468,8 @@ function recordedLastError(run: PollRun): string {
   const lastError: unknown = run.updates[0]!.data["lastError"];
   expect(typeof lastError).toBe("string");
 
-  // Whatever it says, it must still fit the column the clamp exists for.
-  expect((lastError as string).length).toBeLessThanOrEqual(
-    MAX_CONNECTOR_ERROR_MESSAGE_LENGTH,
-  );
+  // Google SecOps stores the full redacted diagnostic in its unbounded column.
+  expect((lastError as string).trim().length).toBeGreaterThan(0);
 
   return lastError as string;
 }
@@ -552,6 +551,11 @@ async function missingFieldRun(): Promise<PollRun> {
 
 describe("GoogleSecOpsPoller lastError failure taxonomy", () => {
   beforeEach(() => {
+    getJestSpyOn(Semaphore, "lock").mockResolvedValue({});
+    getJestSpyOn(Semaphore, "release").mockResolvedValue(undefined);
+    getJestSpyOn(GoogleSecOpsPoller, "findExistingEventUids").mockResolvedValue(
+      new Set(),
+    );
     // Every test here drives an expected failure down the logging path.
     getJestSpyOn(logger, "error").mockImplementation((() => {
       return undefined;
@@ -699,18 +703,15 @@ describe("GoogleSecOpsPoller lastError failure taxonomy", () => {
     expect(lastError).toBe(CLICKHOUSE_OUTAGE_MESSAGE);
 
     /*
-     * And the durability half. pollConnection writes lastPolledAt, cursor
-     * and a cleared lastError together at the very end, so a throw from
-     * insertJsonRows skips all three; the catch block's bookkeeping write
-     * carries lastPolledAt and lastError only. The cursor therefore stays
-     * where it was and the same window is re-fetched next tick, which is
-     * the correct outcome for alerts that were never durably ingested.
+     * Failed imports retain the saved cursor and persist their diagnostics,
+     * so the same window is retried with the original failure still visible.
      */
     expect(
       Object.prototype.hasOwnProperty.call(run.updates[0]!.data, "cursor"),
     ).toBe(false);
     expect(Object.keys(run.updates[0]!.data).sort()).toEqual([
       "lastError",
+      "lastPollResult",
       "lastPolledAt",
     ]);
   });

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsPollerHardening.test.ts

@@ -6,6 +6,8 @@ import OTelIngestService, {
 } from "../../../../Server/Services/OpenTelemetryIngestService";
 import SecurityEventService from "../../../../Server/Services/SecurityEventService";
 import logger from "../../../../Server/Utils/Logger";
+import Semaphore from "../../../../Server/Infrastructure/Semaphore";
+import { GoogleSecOpsRunResult } from "../../../../Types/SecurityEvent/GoogleSecOpsDiagnostics";
 import GoogleSecOpsClient, {
   FetchAlertsResult,
   FetchLike,
@@ -419,6 +421,11 @@ function linesAboutConnection(lines: Array<string>): Array<string> {
 function stubPollPath(): PollHarness {
   const updates: Array<ConnectionUpdateCall> = [];
   const insertedBatches: Array<Array<JSONObject>> = [];
+  getJestSpyOn(Semaphore, "lock").mockResolvedValue({} as never);
+  getJestSpyOn(Semaphore, "release").mockResolvedValue(undefined as never);
+  getJestSpyOn(GoogleSecOpsPoller, "findExistingEventUids").mockResolvedValue(
+    new Set() as never,
+  );
 
   const telemetrySpy: ReturnType<typeof getJestSpyOn> = getJestSpyOn(
     OTelIngestService,
@@ -462,10 +469,13 @@ function stubPollPath(): PollHarness {
 }
 
 function onlyUpdate(harness: PollHarness): JSONObject {
-  expect(harness.updates).toHaveLength(1);
+  expect(harness.updates.length).toBeGreaterThanOrEqual(1);
   expect(harness.updates[0]!.id.toString()).toBe(CONNECTION_ID.toString());
-
-  return harness.updates[0]!.data;
+  return (
+    harness.updates.find((update: ConnectionUpdateCall): boolean => {
+      return Boolean(update.data["lastPollResult"]);
+    })?.data || harness.updates[0]!.data
+  );
 }
 
 function rowsByEventUid(rows: Array<JSONObject>): Map<string, JSONObject> {
@@ -546,11 +556,13 @@ describe("GoogleSecOpsPoller over a real streaming response", () => {
     expect(second["classUid"]).toBe(DETECTION_FINDING_CLASS_UID);
 
     const written: JSONObject = onlyUpdate(harness);
-    expect(Object.keys(written).sort()).toEqual([
-      "cursor",
-      "lastError",
-      "lastPolledAt",
-    ]);
+    expect(written).toEqual(
+      expect.objectContaining({
+        cursor: expect.any(String),
+        lastPolledAt: expect.any(Date),
+        lastPollResult: expect.any(Object),
+      }),
+    );
     expect(written["lastError"]).toBeNull();
   });
 
@@ -573,7 +585,9 @@ describe("GoogleSecOpsPoller over a real streaming response", () => {
 
     const written: JSONObject = onlyUpdate(harness);
     expect(written["cursor"]).toBe(sent.endTime);
-    expect((written["lastPolledAt"] as Date).toISOString()).toBe(sent.endTime);
+    expect((written["lastPolledAt"] as Date).getTime()).toBeGreaterThanOrEqual(
+      Date.parse(sent.endTime),
+    );
 
     // ...and the window it closes really did start earlier than it ends.
     expect(new Date(sent.startTime).getTime()).toBeLessThan(
@@ -599,36 +613,29 @@ describe("GoogleSecOpsPoller over a real streaming response", () => {
     expect(harness.insertSpy).not.toHaveBeenCalled();
 
     const written: JSONObject = onlyUpdate(harness);
-    expect(Object.keys(written).sort()).toEqual([
-      "cursor",
-      "lastError",
-      "lastPolledAt",
-    ]);
+    expect(written).toEqual(
+      expect.objectContaining({
+        cursor: expect.any(String),
+        lastPolledAt: expect.any(Date),
+        lastPollResult: expect.any(Object),
+      }),
+    );
     expect(written["cursor"]).toBe(windowSentTo(requests).endTime);
     expect(written["lastError"]).toBeNull();
 
-    /*
-     * The count that separates this from the failure below has to be
-     * readable somewhere; "quiet" and "broken" looked identical for as
-     * long as it was not.
-     */
-    const quietWindowLine: RegExp = /fetched 0 alerts and ingested 0/;
-    const counted: Array<string> = linesAboutConnection(
-      harness.logs.debug,
-    ).filter((line: string): boolean => {
-      return quietWindowLine.test(line);
-    });
-    expect(counted).toHaveLength(1);
+    expect(written["lastPollResult"]).toEqual(
+      expect.objectContaining({
+        status: "empty",
+        fetchedCount: 0,
+        ingestedCount: 0,
+        complete: true,
+      }),
+    );
+    expect(written["lastSuccessfulPollAt"]).toBeInstanceOf(Date);
   });
 
-  test("truncation flags surface as warnings without failing the poll", async () => {
+  test("persistent truncation reports partial coverage and preserves the first window for retry", async () => {
     const harness: PollHarness = stubPollPath();
-
-    /*
-     * Chronicle capped the result server side. There is no pagination on
-     * this endpoint, so the dropped alerts are gone — the poll still
-     * succeeded, and the operator still has to be told.
-     */
     const { client, requests } = makeClient(
       streamingResponse([
         {
@@ -640,37 +647,25 @@ describe("GoogleSecOpsPoller over a real streaming response", () => {
         },
       ]),
     );
-
-    const ingested: number = await GoogleSecOpsPoller.pollConnection(
-      makeConnection(),
-      client,
-    );
-
-    expect(ingested).toBe(1);
+    const result: GoogleSecOpsRunResult =
+      await GoogleSecOpsPoller.executeConnection(
+        makeConnection(),
+        { type: "poll" },
+        client,
+      );
+    expect(result.status).toBe("partial");
+    expect(result.complete).toBe(false);
+    expect(result.ingestedCount).toBe(1);
     expect(harness.insertedBatches).toHaveLength(1);
-    expect(harness.insertedBatches[0]!).toHaveLength(1);
-
+    expect(result.requestCount).toBeGreaterThan(1);
+    expect(result.warnings.join(" ")).toMatch(/limited|truncated|limit/);
     const written: JSONObject = onlyUpdate(harness);
-    expect(written["cursor"]).toBe(windowSentTo(requests).endTime);
-    expect(written["lastError"]).toBeNull();
-
-    const warnings: Array<string> = linesAboutConnection(harness.logs.warn);
-
-    // Both truncations named, both against the window they happened in.
-    const truncatedByCountLine: RegExp = /no pagination/i;
-    const truncatedByBytesLine: RegExp = /memory limit/i;
-
-    const byCount: Array<string> = warnings.filter((line: string): boolean => {
-      return truncatedByCountLine.test(line);
-    });
-    const byBytes: Array<string> = warnings.filter((line: string): boolean => {
-      return truncatedByBytesLine.test(line);
-    });
-
-    expect(byCount).toHaveLength(1);
-    expect(byBytes).toHaveLength(1);
-    expect(byCount[0]!).toContain(windowSentTo(requests).endTime);
-    expect(byBytes[0]!).toContain(windowSentTo(requests).endTime);
+    expect(Date.parse(String(written["cursor"])) - MINUTE_IN_MS).toBe(
+      Date.parse(result.windowStart),
+    );
+    expect(written["lastError"]).toBeTruthy();
+    expect(written["lastSuccessfulPollAt"]).toBeUndefined();
+    expect(requests.length).toBeGreaterThan(2);
   });
 });
 
@@ -724,9 +719,13 @@ describe("GoogleSecOpsPoller cursor durability", () => {
      * No `cursor` key at all. Not "the same cursor" — the failure path
      * must not be in the business of writing the column.
      */
-    expect(Object.keys(written).sort()).toEqual(["lastError", "lastPolledAt"]);
+    expect(written["lastPollResult"]).toEqual(
+      expect.objectContaining({ complete: false }),
+    );
+    expect(written["lastSuccessfulPollAt"]).toBeUndefined();
     expect(written["lastPolledAt"]).toBeInstanceOf(Date);
     expect(connection.cursor).toBe(storedCursor);
+    expect(written["cursor"]).toBeUndefined();
 
     const lastError: unknown = written["lastError"];
     expect(typeof lastError).toBe("string");
@@ -755,7 +754,10 @@ describe("GoogleSecOpsPoller cursor durability", () => {
     await GoogleSecOpsPoller.pollAllDueConnections();
 
     const written: JSONObject = onlyUpdate(harness);
-    expect(Object.keys(written).sort()).toEqual(["lastError", "lastPolledAt"]);
+    expect(written["lastPollResult"]).toEqual(
+      expect.objectContaining({ complete: false }),
+    );
+    expect(written["lastSuccessfulPollAt"]).toBeUndefined();
     expect(written["lastError"]).toContain("socket hang up");
   });
 
@@ -796,15 +798,19 @@ describe("GoogleSecOpsPoller cursor durability", () => {
     expect(harness.insertSpy).not.toHaveBeenCalled();
 
     const written: JSONObject = onlyUpdate(harness);
-    expect(Object.keys(written).sort()).toEqual(["lastError", "lastPolledAt"]);
-
-    const heldCursorLine: RegExp = /normalized none of its 2 fetched alerts/;
-    const held: Array<string> = linesAboutConnection(harness.logs.warn).filter(
-      (line: string): boolean => {
-        return heldCursorLine.test(line);
-      },
+    expect(written["lastPollResult"]).toEqual(
+      expect.objectContaining({ complete: false }),
+    );
+    expect(written["lastSuccessfulPollAt"]).toBeUndefined();
+
+    const result: GoogleSecOpsRunResult = written[
+      "lastPollResult"
+    ] as unknown as GoogleSecOpsRunResult;
+    expect(result.status).toBe("partial");
+    expect(result.failedCount).toBe(2);
+    expect(Date.parse(String(written["cursor"])) - MINUTE_IN_MS).toBe(
+      Date.parse(result.windowStart),
     );
-    expect(held).toHaveLength(1);
   });
 
   /*
@@ -863,25 +869,17 @@ describe("GoogleSecOpsPoller cursor durability", () => {
       expect(row["severityName"]).not.toBe("Unknown");
     }
 
-    const discardedLine: RegExp = /discarded 1 of 2/;
-    const discarded: Array<string> = linesAboutConnection(
-      harness.logs.warn,
-    ).filter((line: string): boolean => {
-      return discardedLine.test(line);
-    });
-    expect(discarded).toHaveLength(1);
-
-    /*
-     * A refusal is deterministic: re-fetching the window would refuse the
-     * same object again forever, so unlike a normalization failure it must
-     * not hold the cursor.
-     */
     const written: JSONObject = onlyUpdate(harness);
-    expect(Object.keys(written).sort()).toEqual([
-      "cursor",
-      "lastError",
-      "lastPolledAt",
-    ]);
+    const result: GoogleSecOpsRunResult = written[
+      "lastPollResult"
+    ] as unknown as GoogleSecOpsRunResult;
+    expect(result.status).toBe("partial");
+    expect(result.rejectedCount).toBe(1);
+    expect(result.ingestedCount).toBe(1);
+    expect(result.warnings.join(" ")).toMatch(/discarded/);
+    expect(Date.parse(String(written["cursor"])) - MINUTE_IN_MS).toBe(
+      Date.parse(result.windowStart),
+    );
   });
 });
 
@@ -905,13 +903,13 @@ describe("GoogleSecOpsPoller ingest bookkeeping", () => {
     expect(ingested).toBe(2);
     expect(harness.insertedBatches[0]!).toHaveLength(ingested);
 
-    const countedLine: RegExp = /fetched 3 alerts and ingested 2/;
-    const counted: Array<string> = linesAboutConnection(
-      harness.logs.debug,
-    ).filter((line: string): boolean => {
-      return countedLine.test(line);
-    });
-    expect(counted).toHaveLength(1);
+    expect(onlyUpdate(harness)["lastPollResult"]).toEqual(
+      expect.objectContaining({
+        fetchedCount: 3,
+        ingestedCount: 2,
+        rejectedCount: 1,
+      }),
+    );
   });
 
   test("a multi-alert batch is written in a single insert", async () => {
@@ -1038,18 +1036,15 @@ describe("GoogleSecOpsPoller poll window arithmetic", () => {
     expect(durationInMs(garbage)).not.toBe(durationInMs(stale));
   });
 
-  test("an unreadable cursor is reported, quoting the value that could not be read", async () => {
+  test("an unreadable cursor is reported in persisted diagnostics", async () => {
     const harness: PollHarness = stubPollPath();
 
     await pollWindow("2026-13-45T99:99:99Z");
 
-    const warnings: Array<string> = linesAboutConnection(
-      harness.logs.warn,
-    ).filter((line: string): boolean => {
-      return line.includes(JSON.stringify("2026-13-45T99:99:99Z"));
-    });
-
-    expect(warnings).toHaveLength(1);
+    const result: GoogleSecOpsRunResult = onlyUpdate(harness)[
+      "lastPollResult"
+    ] as unknown as GoogleSecOpsRunResult;
+    expect(result.warnings.join(" ")).toMatch(/cursor is unreadable/);
   });
 
   test("a cursor in the future never produces an inverted time range", async () => {
@@ -1065,32 +1060,22 @@ describe("GoogleSecOpsPoller poll window arithmetic", () => {
     expect(future.startTime.getTime()).toBeLessThan(future.endTime.getTime());
     expect(durationInMs(future)).toBe(durationInMs(firstPoll));
 
-    expect(linesAboutConnection(harness.logs.warn).length).toBeGreaterThan(0);
+    expect(harness.logs.warn.join(" ")).toMatch(/cursor is in the future/);
   });
 
-  test("a stale cursor is truncated to the cap and the skipped gap is stated", async () => {
+  test("a stale cursor catches up from its original boundary without discarding the gap", async () => {
     const harness: PollHarness = stubPollPath();
-
-    const stale: RecordedWindow = await pollWindow(
-      new Date(Date.now() - 7 * DAY_IN_MS).toISOString(),
-    );
-
+    const cursor: string = new Date(Date.now() - 7 * DAY_IN_MS).toISOString();
+    const stale: RecordedWindow = await pollWindow(cursor);
     expect(durationInMs(stale)).toBe(DAY_IN_MS);
-
-    /*
-     * The alerts between the cursor and the cap are skipped and will never
-     * be fetched again. Truncating silently is how a connector comes back
-     * from an outage looking healthy with a day of detections missing, so
-     * the warning has to name the boundary the poll actually resumed from.
-     */
-    const warnings: Array<string> = linesAboutConnection(
-      harness.logs.warn,
-    ).filter((line: string): boolean => {
-      return line.includes(stale.startTime.toISOString());
-    });
-
-    expect(warnings).toHaveLength(1);
-    expect(warnings[0]!).toMatch(/skipped/i);
+    expect(stale.startTime.getTime()).toBe(Date.parse(cursor) - MINUTE_IN_MS);
+    expect(stale.endTime.getTime()).toBeLessThan(Date.now() - 5 * DAY_IN_MS);
+    const written: JSONObject = onlyUpdate(harness);
+    expect(written["cursor"]).toBe(stale.endTime.toISOString());
+    const result: GoogleSecOpsRunResult = written[
+      "lastPollResult"
+    ] as unknown as GoogleSecOpsRunResult;
+    expect(result.warnings.join(" ")).toMatch(/Catching up/);
   });
 });
 

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsRequestContract.test.ts

@@ -68,6 +68,8 @@ const WINDOW_END: Date = new Date("2026-08-21T10:00:00.000Z");
  */
 const EXPECTED_QUERY_KEYS: Array<string> = [
   "alertListOptions.maxReturnedAlerts",
+  "includeNonAlertingDetections",
+  "snapshotQuery",
   "timeRange.endTime",
   "timeRange.startTime",
 ];
@@ -301,7 +303,7 @@ function serviceAccountJsonWith(fields: Record<string, unknown>): string {
 }
 
 describe("GoogleSecOpsClient alerts request parameters", () => {
-  test("sends exactly the three documented field paths and nothing else", async () => {
+  test("sends exactly the documented field paths and nothing else", async () => {
     const { client, requests } = makeClient();
 
     const result: FetchAlertsResult = await client.fetchDetectionAlerts({
@@ -386,7 +388,7 @@ describe("GoogleSecOpsClient alerts request parameters", () => {
     expect(sortedQueryKeysOf(cappedRequest)).toEqual(EXPECTED_QUERY_KEYS);
   });
 
-  test("never sends pageSize, snapshotQuery or baselineQuery", async () => {
+  test("explicitly requests all alert statuses without pagination or a baseline filter", async () => {
     const { client, requests } = makeClient();
 
     await client.fetchDetectionAlerts({
@@ -414,22 +416,12 @@ describe("GoogleSecOpsClient alerts request parameters", () => {
     expect(params.has("pageToken")).toBe(false);
 
     /*
-     * Spec conflict C2, open and deliberately unsettled here. The reference
-     * doc prefixes snapshotQuery with `Required.`, but that is a
-     * field_behavior annotation the HTTP transcoder does not enforce, and
-     * this service validates queries in-band (validSnapshotQuery /
-     * queryValidationErrors) instead of rejecting them. We omit it, because
-     * the only concrete catch-all candidate is Google's own SDK default
-     * `feedback_summary.status != "CLOSED"`, which silently drops every
-     * CLOSED alert — trading a loud, testable 400 for permanent invisible
-     * data loss. Omission fails loudly if it turns out to be enforced.
-     *
-     * Settling this needs one live call against a real tenant, with and
-     * without the parameter, comparing HTTP status and baselineAlertsCount.
-     * Until that runs, this assertion is the record of the decision and the
-     * first line to change if the tenant disagrees.
+     * Google documents an empty snapshot query as matching the entire
+     * baseline. A CLOSED-status filter would silently lose detections.
      */
-    expect(params.has("snapshotQuery")).toBe(false);
+    expect(params.has("snapshotQuery")).toBe(true);
+    expect(params.get("snapshotQuery")).toBe("");
+    expect(rawQueryPairsOf(request).get("snapshotQuery")).toBe("");
 
     /*
      * baselineQuery exists only to reuse a cached baseline across repeated
@@ -443,7 +435,9 @@ describe("GoogleSecOpsClient alerts request parameters", () => {
      * the same class of 400 being fixed here.
      */
     expect(params.has("enableCache")).toBe(false);
-    expect(params.has("includeNonAlertingDetections")).toBe(false);
+    expect(params.get("includeNonAlertingDetections")).toBe(
+      "ALERTS_FEATURE_PREFERENCE_DISABLED",
+    );
   });
 });
 

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsResponseParsing.test.ts

@@ -651,3 +651,46 @@ describe("GoogleSecOpsClient.fetchDetectionAlerts response parsing", () => {
     expect(outcome.result).toBeNull();
   });
 });
+
+describe("Google SecOps count completeness diagnostics", () => {
+  test.each(["baselineAlertsCount", "filteredAlertsCount"])(
+    "detects missing returned records from %s without tooManyAlerts",
+    (count: string): void => {
+      const result: FetchAlertsResult = GoogleSecOpsClient.parseAlertsBody(
+        JSON.stringify([
+          {
+            alerts: { alerts: [{ id: "one" }] },
+            complete: true,
+            tooManyAlerts: false,
+            [count]: 2,
+          },
+        ]),
+      );
+      expect(result.truncatedByCount).toBe(true);
+    },
+  );
+  test("does not flag a fully accounted list at its requested ceiling", (): void => {
+    const result: FetchAlertsResult = GoogleSecOpsClient.parseAlertsBody(
+      JSON.stringify([
+        {
+          alerts: { alerts: [{ id: "one" }] },
+          complete: true,
+          baselineAlertsCount: 1,
+          filteredAlertsCount: 1,
+        },
+      ]),
+      1,
+    );
+    expect(result.truncatedByCount).toBe(false);
+  });
+  test("keeps truncation flags reported by earlier streamed chunks", (): void => {
+    const result: FetchAlertsResult = GoogleSecOpsClient.parseAlertsBody(
+      JSON.stringify([
+        { tooManyAlerts: true, memoryLimitExceeded: true },
+        { complete: true, tooManyAlerts: false, memoryLimitExceeded: false },
+      ]),
+    );
+    expect(result.truncatedByCount).toBe(true);
+    expect(result.truncatedByBytes).toBe(true);
+  });
+});