@oneuptime/common 13.0.1 → 13.0.4

package/Tests/Server/Services/StaticRuleCriteriaRuntimeCoverage.test.ts

@@ -0,0 +1,281 @@
+import fs from "fs";
+import path from "path";
+import { describe, expect, test } from "@jest/globals";
+import RULE_CRITERIA_FIELDS_BY_MODEL from "../../../Types/Rules/RuleCriteriaFieldRegistry";
+
+interface FormCoverage {
+  fields: Set<string>;
+  filePath: string;
+}
+
+const COMMON_ROOT: string = path.join(__dirname, "../../..");
+const REPOSITORY_ROOT: string = path.join(COMMON_ROOT, "..");
+const DASHBOARD_SOURCE_ROOT: string = path.join(
+  REPOSITORY_ROOT,
+  "App/FeatureSet/Dashboard/src",
+);
+const SERVICES_ROOT: string = path.join(COMMON_ROOT, "Server/Services");
+
+const SPECIAL_EVALUATOR_FILES: Record<string, string> = {
+  AlertGroupingRule: "AlertGroupingEngineService.ts",
+  IncidentGroupingRule: "IncidentGroupingEngineService.ts",
+  AlertReminderRule: "AlertReminderRuleService.ts",
+  IncidentReminderRule: "IncidentReminderRuleService.ts",
+  ScheduledMaintenanceReminderRule:
+    "ScheduledMaintenanceReminderRuleService.ts",
+  IncidentSlaRule: "IncidentSlaRuleService.ts",
+  NetworkSiteAssignmentRule: "NetworkDeviceService.ts",
+};
+
+function listTypescriptReactFiles(directoryPath: string): Array<string> {
+  const result: Array<string> = [];
+
+  for (const entry of fs.readdirSync(directoryPath, {
+    withFileTypes: true,
+  })) {
+    const entryPath: string = path.join(directoryPath, entry.name);
+
+    if (entry.isDirectory()) {
+      result.push(...listTypescriptReactFiles(entryPath));
+    } else if (entry.name.endsWith(".tsx")) {
+      result.push(entryPath);
+    }
+  }
+
+  return result;
+}
+
+function extractMatchFields(source: string): Set<string> {
+  const fields: Set<string> = new Set<string>();
+  const matchFieldPattern: RegExp =
+    /field\s*:\s*\{\s*([A-Za-z][A-Za-z0-9]*)\s*:\s*true\s*,?\s*\}\s*,(?:(?!stepId\s*:)[\s\S])*?stepId\s*:\s*["']match-criteria["']/g;
+
+  for (const match of source.matchAll(matchFieldPattern)) {
+    fields.add(match[1]!);
+  }
+
+  return fields;
+}
+
+function discoverStaticRuleForms(): {
+  formFiles: Array<string>;
+  formsByModel: Map<string, FormCoverage>;
+  metricPipelineFile: string;
+} {
+  const formFiles: Array<string> = listTypescriptReactFiles(
+    DASHBOARD_SOURCE_ROOT,
+  ).filter((filePath: string): boolean => {
+    return (
+      fs
+        .readFileSync(filePath, "utf8")
+        .match(/id\s*:\s*["']match-criteria["']/) !== null
+    );
+  });
+  const metricPipelineFile: string = path.join(
+    DASHBOARD_SOURCE_ROOT,
+    "Pages/Metrics/Settings/PipelineRules.tsx",
+  );
+  const formsByModel: Map<string, FormCoverage> = new Map();
+  const modelTypePattern: RegExp = /modelType=\{([A-Za-z][A-Za-z0-9]*Rule)\}/g;
+
+  for (const filePath of formFiles) {
+    const source: string = fs.readFileSync(filePath, "utf8");
+    const modelMatches: Array<RegExpMatchArray> = [
+      ...source.matchAll(modelTypePattern),
+    ];
+
+    expect(modelMatches.length).toBeGreaterThan(0);
+
+    for (let index: number = 0; index < modelMatches.length; index++) {
+      const match: RegExpMatchArray = modelMatches[index]!;
+      const nextMatch: RegExpMatchArray | undefined = modelMatches[index + 1];
+      const modelName: string = match[1]!;
+      const sourceStart: number = match.index!;
+      const sourceEnd: number = nextMatch?.index || source.length;
+      const fields: Set<string> = extractMatchFields(
+        source.slice(sourceStart, sourceEnd),
+      );
+
+      expect(fields.size).toBeGreaterThan(0);
+      expect(formsByModel.has(modelName)).toBe(false);
+      formsByModel.set(modelName, { fields, filePath });
+    }
+  }
+
+  return {
+    formFiles,
+    formsByModel,
+    metricPipelineFile,
+  };
+}
+
+function getEvaluatorFileName(modelName: string): string {
+  return (
+    SPECIAL_EVALUATOR_FILES[modelName] ||
+    `${modelName.replace(/Rule$/, "")}RuleEngineService.ts`
+  );
+}
+
+function extractLegacyFields(source: string): Set<string> {
+  const result: Set<string> = new Set<string>();
+  const legacyFieldsPattern: RegExp = /legacyFields\s*:\s*\[([\s\S]*?)\]/g;
+
+  for (const legacyFieldsMatch of source.matchAll(legacyFieldsPattern)) {
+    for (const fieldMatch of legacyFieldsMatch[1]!.matchAll(
+      /["']([A-Za-z][A-Za-z0-9]*)["']/g,
+    )) {
+      result.add(fieldMatch[1]!);
+    }
+  }
+
+  return result;
+}
+
+function getInheritedRuleModelNames(): Array<string> {
+  const inheritanceTestSource: string = fs.readFileSync(
+    path.join(
+      COMMON_ROOT,
+      "Tests/Models/DatabaseModels/StaticRuleCriteriaInheritance.test.ts",
+    ),
+    "utf8",
+  );
+  const inventoryMatch: RegExpMatchArray | null = inheritanceTestSource.match(
+    /STATIC_MATCH_CRITERIA_RULE_MODEL_NAMES[^=]*=\s*\[([\s\S]*?)\];/,
+  );
+
+  expect(inventoryMatch).not.toBeNull();
+
+  return [...inventoryMatch![1]!.matchAll(/["']([A-Za-z0-9]+)["']/g)]
+    .map((match: RegExpMatchArray): string => {
+      return match[1]!;
+    })
+    .sort();
+}
+
+describe("static rule criteria runtime coverage", () => {
+  const { formFiles, formsByModel, metricPipelineFile } =
+    discoverStaticRuleForms();
+  const inheritedRuleModelNames: Array<string> = getInheritedRuleModelNames();
+
+  test("all 61 static match-criteria forms route their 73 rule models through ModelForm", () => {
+    expect(formFiles).toHaveLength(61);
+    expect(formsByModel.size).toBe(73);
+    expect([...formsByModel.keys()].sort()).toEqual(inheritedRuleModelNames);
+    expect(Object.keys(RULE_CRITERIA_FIELDS_BY_MODEL).sort()).toEqual(
+      inheritedRuleModelNames,
+    );
+
+    for (const [modelName, form] of formsByModel) {
+      const registeredFields: ReadonlyArray<string> | undefined =
+        RULE_CRITERIA_FIELDS_BY_MODEL[
+          modelName as keyof typeof RULE_CRITERIA_FIELDS_BY_MODEL
+        ];
+
+      if (!registeredFields) {
+        throw new Error(`No rule criteria fields registered for ${modelName}`);
+      }
+
+      expect([...registeredFields].sort()).toEqual([...form.fields].sort());
+
+      const source: string = fs.readFileSync(form.filePath, "utf8");
+      const modelTypeOffset: number = source.indexOf(
+        `modelType={${modelName}}`,
+      );
+      const openingTag: string = source.slice(
+        Math.max(0, modelTypeOffset - 100),
+        modelTypeOffset,
+      );
+
+      expect(openingTag).toMatch(/<(?:ModelTable|LabelRuleTable)<[^>]+>\s*$/);
+    }
+
+    const modelFormSource: string = fs.readFileSync(
+      path.join(COMMON_ROOT, "UI/Components/Forms/ModelForm.tsx"),
+      "utf8",
+    );
+
+    expect(modelFormSource).toContain("addRuleCriteriaToSelect");
+    expect(modelFormSource).toContain("replaceLegacyRuleCriteriaFields");
+  });
+
+  test.each([...formsByModel.entries()])(
+    "%s selects criteria and evaluates every form field through the shared matcher",
+    (modelName: string, form: FormCoverage) => {
+      const evaluatorFileName: string = getEvaluatorFileName(modelName);
+      const evaluatorSource: string = fs.readFileSync(
+        path.join(SERVICES_ROOT, evaluatorFileName),
+        "utf8",
+      );
+
+      expect(evaluatorSource).toContain(modelName);
+      expect(evaluatorSource).toMatch(/criteria\s*:\s*true/);
+
+      if (modelName === "NetworkDeviceAutoImportRule") {
+        expect(evaluatorSource).toContain("AutoImportRuleMatcher.evaluateHost");
+
+        const matcherSource: string = fs.readFileSync(
+          path.join(
+            COMMON_ROOT,
+            "Utils/NetworkDiscovery/AutoImportRuleMatcher.ts",
+          ),
+          "utf8",
+        );
+
+        expect(matcherSource).toContain("RuleCriteriaMatcher.matchesSync");
+        const evaluatorFields: Set<string> = new Set<string>(
+          [
+            ...matcherSource.matchAll(/case\s+"([A-Za-z][A-Za-z0-9]*)"\s*:/g),
+          ].map((match: RegExpMatchArray): string => {
+            return match[1]!;
+          }),
+        );
+
+        expect([...evaluatorFields].sort()).toEqual([...form.fields].sort());
+        return;
+      }
+
+      if (modelName === "NetworkSiteAssignmentRule") {
+        expect(evaluatorSource).toContain("CidrMatchUtil");
+
+        const matcherSource: string = fs.readFileSync(
+          path.join(COMMON_ROOT, "Utils/NetworkSite/CidrMatchUtil.ts"),
+          "utf8",
+        );
+
+        expect(matcherSource).toContain("RuleCriteriaMatcher.matchesSync");
+        const evaluatorFields: Set<string> = new Set<string>(
+          [
+            ...matcherSource.matchAll(
+              /filter\.field\s*(?:===|!==)\s*"([A-Za-z][A-Za-z0-9]*)"/g,
+            ),
+          ].map((match: RegExpMatchArray): string => {
+            return match[1]!;
+          }),
+        );
+
+        expect([...evaluatorFields].sort()).toEqual([...form.fields].sort());
+        return;
+      }
+
+      expect(evaluatorSource).toMatch(
+        /RuleCriteriaMatcher\.matchesWithLegacy(?:Sync)?\(/,
+      );
+      expect([...extractLegacyFields(evaluatorSource)].sort()).toEqual(
+        [...form.fields].sort(),
+      );
+    },
+  );
+
+  test("leaves the existing Metric Pipeline rule builder outside the generic criteria path", () => {
+    const metricPipelineSource: string = fs.readFileSync(
+      metricPipelineFile,
+      "utf8",
+    );
+
+    expect(metricPipelineSource).toContain("modelType={MetricPipelineRule}");
+    expect(metricPipelineSource).toContain("field: { filterCondition: true }");
+    expect(metricPipelineSource).toContain("field: { filters: true }");
+    expect(formsByModel.has("MetricPipelineRule")).toBe(false);
+    expect(inheritedRuleModelNames).not.toContain("MetricPipelineRule");
+  });
+});

package/Tests/Server/Services/StatusPageMonitorRuleEngineService.test.ts

@@ -9,6 +9,11 @@ import StatusPageMonitorRuleEngineService, {
 import StatusPageMonitorRuleService from "../../../Server/Services/StatusPageMonitorRuleService";
 import StatusPageResourceService from "../../../Server/Services/StatusPageResourceService";
 import ObjectID from "../../../Types/ObjectID";
+import FilterCondition from "../../../Types/Filter/FilterCondition";
+import RuleCriteria, {
+  RULE_CRITERIA_SCHEMA_VERSION,
+  RuleCriteriaOperator,
+} from "../../../Types/Rules/RuleCriteria";
 import UptimePrecision from "../../../Types/StatusPage/UptimePrecision";
 import { describe, expect, it, beforeEach, afterEach } from "@jest/globals";
 
@@ -106,6 +111,7 @@ function fakeRule(fields?: {
   monitorLabels?: Array<ObjectID> | undefined;
   monitorNamePattern?: string | undefined;
   monitorDescriptionPattern?: string | undefined;
+  criteria?: RuleCriteria | undefined;
   showCurrentStatus?: boolean | undefined;
   showUptimePercent?: boolean | undefined;
   showStatusHistoryChart?: boolean | undefined;
@@ -124,6 +130,7 @@ function fakeRule(fields?: {
     monitorLabels: (fields?.monitorLabels || []).map(fakeLabel),
     monitorNamePattern: fields?.monitorNamePattern,
     monitorDescriptionPattern: fields?.monitorDescriptionPattern,
+    criteria: fields?.criteria,
     showCurrentStatus: fields?.showCurrentStatus,
     showUptimePercent: fields?.showUptimePercent,
     showStatusHistoryChart: fields?.showStatusHistoryChart,
@@ -167,6 +174,131 @@ function createdResource(
 }
 
 describe("StatusPageMonitorRuleEngineService.doesMonitorMatchRule", () => {
+  it("supports Match any across labels and name conditions", () => {
+    expect(
+      StatusPageMonitorRuleEngineService.doesMonitorMatchRule({
+        monitor: fakeMonitor(MONITOR_A_ID, {
+          name: "worker-queue",
+          labels: [LABEL_PRODUCTION_ID],
+        }),
+        rule: fakeRule({
+          criteria: {
+            schemaVersion: RULE_CRITERIA_SCHEMA_VERSION,
+            filterCondition: FilterCondition.Any,
+            filters: [
+              {
+                field: "monitorNamePattern",
+                operator: RuleCriteriaOperator.StartsWith,
+                value: "api",
+              },
+              {
+                field: "monitorLabels",
+                operator: RuleCriteriaOperator.HasAnyOf,
+                value: [LABEL_PRODUCTION_ID.toString()],
+              },
+            ],
+          },
+        }),
+      }),
+    ).toBe(true);
+  });
+
+  it("supports Match all across labels and name conditions", () => {
+    const rule: StatusPageMonitorRule = fakeRule({
+      criteria: {
+        schemaVersion: RULE_CRITERIA_SCHEMA_VERSION,
+        filterCondition: FilterCondition.All,
+        filters: [
+          {
+            field: "monitorNamePattern",
+            operator: RuleCriteriaOperator.Contains,
+            value: "api",
+          },
+          {
+            field: "monitorLabels",
+            operator: RuleCriteriaOperator.HasAnyOf,
+            value: [LABEL_PRODUCTION_ID.toString()],
+          },
+        ],
+      },
+    });
+
+    expect(
+      StatusPageMonitorRuleEngineService.doesMonitorMatchRule({
+        monitor: fakeMonitor(MONITOR_A_ID, {
+          name: "checkout-api",
+          labels: [LABEL_PRODUCTION_ID],
+        }),
+        rule: rule,
+      }),
+    ).toBe(true);
+    expect(
+      StatusPageMonitorRuleEngineService.doesMonitorMatchRule({
+        monitor: fakeMonitor(MONITOR_A_ID, {
+          name: "checkout-worker",
+          labels: [LABEL_PRODUCTION_ID],
+        }),
+        rule: rule,
+      }),
+    ).toBe(false);
+  });
+
+  it("supports requiring every selected label", () => {
+    expect(
+      StatusPageMonitorRuleEngineService.doesMonitorMatchRule({
+        monitor: fakeMonitor(MONITOR_A_ID, {
+          labels: [LABEL_PRODUCTION_ID, LABEL_TIER1_ID],
+        }),
+        rule: fakeRule({
+          criteria: {
+            schemaVersion: RULE_CRITERIA_SCHEMA_VERSION,
+            filterCondition: FilterCondition.All,
+            filters: [
+              {
+                field: "monitorLabels",
+                operator: RuleCriteriaOperator.HasAllOf,
+                value: [
+                  LABEL_PRODUCTION_ID.toString(),
+                  LABEL_TIER1_ID.toString(),
+                ],
+              },
+            ],
+          },
+        }),
+      }),
+    ).toBe(true);
+  });
+
+  it("supports negative conditions without consulting stale legacy fields", () => {
+    expect(
+      StatusPageMonitorRuleEngineService.doesMonitorMatchRule({
+        monitor: fakeMonitor(MONITOR_A_ID, {
+          name: "production-api",
+          labels: [LABEL_PRODUCTION_ID],
+        }),
+        rule: fakeRule({
+          monitorNamePattern: "never-use-this-legacy-value",
+          criteria: {
+            schemaVersion: RULE_CRITERIA_SCHEMA_VERSION,
+            filterCondition: FilterCondition.All,
+            filters: [
+              {
+                field: "monitorNamePattern",
+                operator: RuleCriteriaOperator.DoesNotContain,
+                value: "staging",
+              },
+              {
+                field: "monitorLabels",
+                operator: RuleCriteriaOperator.HasNoneOf,
+                value: [LABEL_STAGING_ID.toString()],
+              },
+            ],
+          },
+        }),
+      }),
+    ).toBe(true);
+  });
+
   it("matches a monitor carrying any one of the rule's labels", () => {
     expect(
       StatusPageMonitorRuleEngineService.doesMonitorMatchRule({

package/Tests/Server/Services/StatusPageMonitorRuleHooks.test.ts

@@ -26,8 +26,21 @@ import {
 import UpdateBy from "../../../Server/Types/Database/UpdateBy";
 import URL from "../../../Types/API/URL";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import FilterCondition from "../../../Types/Filter/FilterCondition";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
 import ObjectID from "../../../Types/ObjectID";
-import { describe, expect, it, beforeEach, afterEach } from "@jest/globals";
+import {
+  RULE_CRITERIA_SCHEMA_VERSION,
+  RuleCriteriaOperator,
+} from "../../../Types/Rules/RuleCriteria";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
 
 /*
  * Contract under test - the places that have to notice a status page monitor
@@ -65,6 +78,9 @@ const RULE_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
 const OTHER_RULE_ID: ObjectID = new ObjectID(
   "1a1a1a1a-1a1a-4a1a-8a1a-1a1a1a1a1a1a",
 );
+const CRITERIA_RULE_ID: ObjectID = new ObjectID(
+  "1b1b1b1b-1b1b-4b1b-8b1b-1b1b1b1b1b1b",
+);
 const OTHER_STATUS_PAGE_ID: ObjectID = new ObjectID(
   "34343434-3434-4434-8434-343434343434",
 );
@@ -155,8 +171,13 @@ function fakeRuleRow(id: ObjectID): StatusPageMonitorRule {
   } as unknown as StatusPageMonitorRule;
 }
 
+interface RawOperator {
+  objectLiteralParameters: Record<string, unknown>;
+  getSql: (aliasPath: string) => string;
+}
+
 describe("MonitorService.onUpdateSuccess - keeping status page monitor rules honest", () => {
-  let syncRulesForMonitorSpy: jest.SpyInstance;
+  let syncRulesForMonitorSpy: ReturnType<typeof jest.spyOn>;
 
   beforeEach(() => {
     syncRulesForMonitorSpy = jest
@@ -294,8 +315,8 @@ describe("MonitorService.onUpdateSuccess - keeping status page monitor rules hon
 });
 
 describe("LabelService delete hooks - a deleted label must not strand resources", () => {
-  let syncResourcesForRuleSpy: jest.SpyInstance;
-  let ruleFindBySpy: jest.SpyInstance;
+  let syncResourcesForRuleSpy: ReturnType<typeof jest.spyOn>;
+  let ruleFindBySpy: ReturnType<typeof jest.spyOn>;
 
   beforeEach(() => {
     syncResourcesForRuleSpy = jest
@@ -339,6 +360,40 @@ describe("LabelService delete hooks - a deleted label must not strand resources"
         return id.toString();
       }),
     ).toEqual([LABEL_ID.toString()]);
+    expect(ruleFindBySpy).toHaveBeenCalledTimes(2);
+  });
+
+  it("also looks inside criteria filters that reference the deleted monitor label", async () => {
+    await callHook(LabelService, "onBeforeDelete", {
+      query: { _id: LABEL_ID.toString() },
+      props: { isRoot: true },
+    });
+
+    const call: {
+      query: { criteria: RawOperator };
+      limit: number;
+      skip: number;
+    } = ruleFindBySpy.mock.calls[1]![0] as {
+      query: { criteria: RawOperator };
+      limit: number;
+      skip: number;
+    };
+    const sql: string = call.query.criteria.getSql(
+      '"StatusPageMonitorRule"."criteria"',
+    );
+    const parameters: Array<unknown> = Object.values(
+      call.query.criteria.objectLiteralParameters,
+    );
+
+    expect(parameters).toContain("filters");
+    expect(parameters).toContain("field");
+    expect(parameters).toContain("monitorLabels");
+    expect(parameters).toContain("value");
+    expect(parameters).toContainEqual([LABEL_ID.toString()]);
+    expect(sql).not.toContain(LABEL_ID.toString());
+    expect(sql).not.toContain("monitorLabels");
+    expect(call.limit).toBe(LIMIT_MAX);
+    expect(call.skip).toBe(0);
   });
 
   it("does not go looking for rules when the delete matched no labels", async () => {
@@ -370,7 +425,7 @@ describe("LabelService delete hooks - a deleted label must not strand resources"
       { query: { _id: LABEL_ID.toString() }, props: { isRoot: true } },
     )) as OnDelete<Label>;
 
-    expect(ruleFindBySpy).toHaveBeenCalledTimes(1);
+    expect(ruleFindBySpy).toHaveBeenCalledTimes(2);
     expect(
       (
         onDelete.carryForward as {
@@ -380,6 +435,30 @@ describe("LabelService delete hooks - a deleted label must not strand resources"
     ).toEqual([RULE_ID, OTHER_RULE_ID]);
   });
 
+  it("unions criteria-backed rules with legacy matches and deduplicates overlaps", async () => {
+    ruleFindBySpy
+      .mockReset()
+      .mockResolvedValueOnce([fakeRuleRow(RULE_ID), fakeRuleRow(OTHER_RULE_ID)])
+      .mockResolvedValueOnce([
+        fakeRuleRow(OTHER_RULE_ID),
+        fakeRuleRow(CRITERIA_RULE_ID),
+      ]);
+
+    const onDelete: OnDelete<Label> = (await callHook(
+      LabelService,
+      "onBeforeDelete",
+      { query: { _id: LABEL_ID.toString() }, props: { isRoot: true } },
+    )) as OnDelete<Label>;
+
+    expect(
+      (
+        onDelete.carryForward as {
+          statusPageMonitorRuleIds: Array<ObjectID>;
+        }
+      ).statusPageMonitorRuleIds,
+    ).toEqual([RULE_ID, OTHER_RULE_ID, CRITERIA_RULE_ID]);
+  });
+
   it("re-runs each of those rules once the label is gone", async () => {
     await callHook(LabelService, "onDeleteSuccess", {
       deleteBy: {} as unknown as DeleteBy<Label>,
@@ -503,6 +582,72 @@ describe("StatusPageMonitorRuleService.onBeforeCreate - refusing an ambiguous ru
     ).resolves.toBeDefined();
   });
 
+  it("accepts a rule configured only with the condition builder", async () => {
+    await expect(
+      callHook(
+        StatusPageMonitorRuleService,
+        "onBeforeCreate",
+        ruleCreate({
+          statusPageId: STATUS_PAGE_ID,
+          name: "Production APIs",
+          criteria: {
+            schemaVersion: RULE_CRITERIA_SCHEMA_VERSION,
+            filterCondition: FilterCondition.Any,
+            filters: [
+              {
+                field: "monitorNamePattern",
+                operator: RuleCriteriaOperator.Contains,
+                value: "api",
+              },
+              {
+                field: "monitorLabels",
+                operator: RuleCriteriaOperator.HasAnyOf,
+                value: [LABEL_ID.toString()],
+              },
+            ],
+          },
+        }),
+      ),
+    ).resolves.toBeDefined();
+  });
+
+  it("rejects an empty configured condition set even when stale legacy values remain", async () => {
+    await expect(
+      callHook(
+        StatusPageMonitorRuleService,
+        "onBeforeCreate",
+        ruleCreate({
+          statusPageId: STATUS_PAGE_ID,
+          name: "Empty conditions",
+          monitorNamePattern: ".*",
+          criteria: {
+            schemaVersion: RULE_CRITERIA_SCHEMA_VERSION,
+            filterCondition: FilterCondition.All,
+            filters: [],
+          },
+        }),
+      ),
+    ).rejects.toThrow(/at least one match condition/i);
+  });
+
+  it("rejects malformed configured conditions at write time", async () => {
+    await expect(
+      callHook(
+        StatusPageMonitorRuleService,
+        "onBeforeCreate",
+        ruleCreate({
+          statusPageId: STATUS_PAGE_ID,
+          name: "Malformed conditions",
+          criteria: {
+            schemaVersion: 99,
+            filterCondition: FilterCondition.All,
+            filters: [],
+          },
+        }),
+      ),
+    ).rejects.toThrow(/schemaVersion/);
+  });
+
   it("requires a status page - a rule with nowhere to add monitors is meaningless", async () => {
     await expect(
       callHook(
@@ -580,11 +725,11 @@ describe("StatusPageMonitorRuleService.onBeforeCreate - refusing an ambiguous ru
 });
 
 describe("StatusPageMonitorRuleService write hooks - running the rule", () => {
-  let syncResourcesForRuleSpy: jest.SpyInstance;
-  let removeResourcesSpy: jest.SpyInstance;
-  let ruleFindBySpy: jest.SpyInstance;
-  let syncRulesForMonitorSpy: jest.SpyInstance;
-  let resourceDeleteSpy: jest.SpyInstance;
+  let syncResourcesForRuleSpy: ReturnType<typeof jest.spyOn>;
+  let removeResourcesSpy: ReturnType<typeof jest.spyOn>;
+  let ruleFindBySpy: ReturnType<typeof jest.spyOn>;
+  let syncRulesForMonitorSpy: ReturnType<typeof jest.spyOn>;
+  let resourceDeleteSpy: ReturnType<typeof jest.spyOn>;
 
   beforeEach(() => {
     syncResourcesForRuleSpy = jest
@@ -994,8 +1139,8 @@ describe("StatusPageMonitorRuleService write hooks - running the rule", () => {
  * ones worth checking. Neither is validated by the framework.
  */
 describe("StatusPageMonitorRuleService - keeping a rule's references in scope", () => {
-  let validatorSpy: jest.SpyInstance;
-  let groupFindOneByIdSpy: jest.SpyInstance;
+  let validatorSpy: ReturnType<typeof jest.spyOn>;
+  let groupFindOneByIdSpy: ReturnType<typeof jest.spyOn>;
 
   beforeEach(() => {
     validatorSpy = jest
@@ -1177,7 +1322,7 @@ describe("StatusPageMonitorRuleService - keeping a rule's references in scope",
    * for another project's rules.
    */
   it("pins the caller's project onto the validation read", async () => {
-    const findBySpy: jest.SpyInstance = jest
+    const findBySpy: ReturnType<typeof jest.spyOn> = jest
       .spyOn(StatusPageMonitorRuleService, "findBy")
       .mockResolvedValue([fakeRuleRow(RULE_ID)]);
 
@@ -1194,7 +1339,7 @@ describe("StatusPageMonitorRuleService - keeping a rule's references in scope",
   });
 
   it("leaves the query alone for a genuinely root caller, which carries no tenant", async () => {
-    const findBySpy: jest.SpyInstance = jest
+    const findBySpy: ReturnType<typeof jest.spyOn> = jest
       .spyOn(StatusPageMonitorRuleService, "findBy")
       .mockResolvedValue([fakeRuleRow(RULE_ID)]);