@oneuptime/common 13.0.3 → 13.0.5

package/Tests/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsRunExecutor.test.ts

@@ -1,6 +1,8 @@
 import GoogleSecOpsRunExecutor, {
   GOOGLE_SECOPS_RUN_JOB,
 } from "../../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsRunExecutor";
+import logger from "../../../../../Server/Utils/Logger";
+import BadDataException from "../../../../../Types/Exception/BadDataException";
 import GoogleSecOpsPoller from "../../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller";
 import GoogleSecOpsConnectionRunService from "../../../../../Server/Services/GoogleSecOpsConnectionRunService";
 import GoogleSecOpsConnectionService from "../../../../../Server/Services/GoogleSecOpsConnectionService";
@@ -48,7 +50,11 @@ jest.mock(
   () => {
     return {
       __esModule: true,
-      default: { findOneBy: jest.fn(), findBy: jest.fn() },
+      default: {
+        findOneBy: jest.fn(),
+        findBy: jest.fn(),
+        updateOneById: jest.fn(),
+      },
     };
   },
 );
@@ -370,6 +376,22 @@ test("reads run status after locking and scopes credential read to recorded proj
     }),
   );
 });
+test("loads the previous poll result with the connection, which carries the next catch-up chunk", async () => {
+  /*
+   * Review finding alerts-view-budget-pins-cursor-forever (F1): a poll's
+   * window length comes from lastPollResult.nextChunkMinutes, so the row
+   * handed to the poller must include it alongside the cursor.
+   */
+  await GoogleSecOpsRunExecutor.executeRun(RUN);
+  expect(GoogleSecOpsConnectionService.findOneBy).toHaveBeenCalledWith(
+    expect.objectContaining({
+      select: expect.objectContaining({
+        cursor: true,
+        lastPollResult: true,
+      }),
+    }),
+  );
+});
 test.each(["success", "empty", "partial", "failed"])(
   "does not repeat a terminal %s run",
   async (status: string) => {
@@ -559,6 +581,96 @@ test("scheduler continues after a single connection fails admission", async () =
   expect(spy).toHaveBeenCalledTimes(2);
 });
 
+test("an admission conflict stays quiet and leaves the connection row alone", async () => {
+  (GoogleSecOpsConnectionService.findBy as jest.Mock).mockResolvedValue([
+    connection,
+  ]);
+  const errorLog: jest.SpyInstance = jest
+    .spyOn(logger, "error")
+    .mockImplementation(() => {});
+  const debugLog: jest.SpyInstance = jest
+    .spyOn(logger, "debug")
+    .mockImplementation(() => {});
+  jest
+    .spyOn(GoogleSecOpsRunExecutor, "enqueue")
+    .mockRejectedValueOnce(
+      new BadDataException(
+        "This connection already has a queued or running operation. Open run history for its progress.",
+      ),
+    );
+  await GoogleSecOpsRunExecutor.enqueueDueConnections();
+  expect(debugLog).toHaveBeenCalled();
+  expect(errorLog).not.toHaveBeenCalled();
+  expect(GoogleSecOpsConnectionService.updateOneById).not.toHaveBeenCalled();
+});
+
+test("any other enqueue failure is logged at error and stamped on the connection, redacted", async () => {
+  (GoogleSecOpsConnectionService.findBy as jest.Mock).mockResolvedValue([
+    connection,
+  ]);
+  const errorLog: jest.SpyInstance = jest
+    .spyOn(logger, "error")
+    .mockImplementation(() => {});
+  jest
+    .spyOn(GoogleSecOpsRunExecutor, "enqueue")
+    .mockRejectedValueOnce(
+      new Error(
+        'Redis client is not connected {"access_token":"ya29.leaked-token"}',
+      ),
+    );
+  await GoogleSecOpsRunExecutor.enqueueDueConnections();
+  expect(errorLog).toHaveBeenCalledWith(
+    expect.stringContaining("could not queue the scheduled poll"),
+  );
+  expect(GoogleSecOpsConnectionService.updateOneById).toHaveBeenCalledWith({
+    id: CONNECTION,
+    data: {
+      lastError: expect.stringMatching(
+        /^Scheduler could not queue a poll: Redis client is not connected/,
+      ),
+    },
+    props: { isRoot: true },
+  });
+  const stamped: string = (
+    (GoogleSecOpsConnectionService.updateOneById as jest.Mock).mock
+      .calls[0]![0] as { data: { lastError: string } }
+  ).data.lastError;
+  expect(stamped).not.toContain("leaked-token");
+});
+
+test("a failed stamp write does not stop the scheduler tick", async () => {
+  const nextConnection: GoogleSecOpsConnection = new GoogleSecOpsConnection();
+  nextConnection.id = USER;
+  nextConnection.projectId = PROJECT;
+  (GoogleSecOpsConnectionService.findBy as jest.Mock).mockResolvedValue([
+    connection,
+    nextConnection,
+  ]);
+  jest.spyOn(logger, "error").mockImplementation(() => {});
+  (GoogleSecOpsConnectionService.updateOneById as jest.Mock).mockRejectedValue(
+    new Error("database unavailable"),
+  );
+  const spy: jest.SpyInstance = jest
+    .spyOn(GoogleSecOpsRunExecutor, "enqueue")
+    .mockRejectedValueOnce(new Error("Redis client is not connected"))
+    .mockResolvedValueOnce(RUN);
+  await GoogleSecOpsRunExecutor.enqueueDueConnections();
+  expect(spy).toHaveBeenCalledTimes(2);
+});
+
+test("markRunFailed stamps a failed status, completion time and reason on the run", async () => {
+  await GoogleSecOpsRunExecutor.markRunFailed(RUN, "lock timed out");
+  expect(GoogleSecOpsConnectionRunService.updateOneById).toHaveBeenCalledWith({
+    id: RUN,
+    data: {
+      status: "failed",
+      completedAt: expect.any(Date),
+      error: "lock timed out",
+    },
+    props: { isRoot: true },
+  });
+});
+
 function useCoordinatedLocks(): void {
   const pending: Map<string, Promise<void>> = new Map<string, Promise<void>>();
   (Semaphore.lock as jest.Mock).mockImplementation(

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsClient.test.ts

@@ -213,7 +213,11 @@ describe("GoogleSecOpsClient.fetchDetectionAlerts", () => {
   test("exchanges a signed JWT assertion for a token, then calls the alerts view with Bearer auth", async () => {
     const { client, requests } = makeClient([
       tokenResponse(),
-      { status: 200, body: JSON.stringify({ alerts: [{ id: "a-1" }] }) },
+      {
+        status: 200,
+        // complete: true, or the client re-issues the GET for an unfinished stream.
+        body: JSON.stringify({ alerts: [{ id: "a-1" }], complete: true }),
+      },
     ]);
 
     const result: FetchAlertsResult = await client.fetchDetectionAlerts({

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsDiagnostics.test.ts

@@ -7,6 +7,7 @@ import OTelIngestService from "../../../../Server/Services/OpenTelemetryIngestSe
 import SecurityEventService from "../../../../Server/Services/SecurityEventService";
 import GoogleSecOpsClient, {
   FetchAlertsResult,
+  SearchDetectionsResult,
 } from "../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient";
 import GoogleSecOpsPoller, {
   GOOGLE_SECOPS_SOURCE_LOCK_NAMESPACE,
@@ -96,6 +97,10 @@ function client(
   let index: number = 0;
   return {
     testAuthentication: jest.fn(async (): Promise<void> => {}),
+    // The created-time passes answer quietly; these cases drive the alerts view.
+    searchDetections: jest.fn(async (): Promise<SearchDetectionsResult> => {
+      return { detections: [], nextPageToken: null, truncated: false };
+    }),
     fetchDetectionAlerts: jest.fn(async (): Promise<FetchAlertsResult> => {
       return results[Math.min(index++, results.length - 1)]!;
     }),
@@ -170,9 +175,24 @@ describe("Google SecOps connection diagnostics and replay", () => {
     ).toEqual([
       "Validate configuration",
       "Authenticate with Google",
-      "Read detections from the configured instance",
+      "Read rule detections by created time",
+      "Read curated rule detections by created time",
+      "Read alerts view by detection time",
       "Normalize detections",
     ]);
+    // One record per pass: the search probes ask for a single-item page.
+    expect(api.searchDetections).toHaveBeenCalledTimes(2);
+    expect(api.searchDetections).toHaveBeenCalledWith(
+      expect.objectContaining({
+        listBasis: "CREATED_TIME",
+        alertingOnly: true,
+        pageSize: 1,
+        curated: false,
+      }),
+    );
+    expect(api.searchDetections).toHaveBeenCalledWith(
+      expect.objectContaining({ curated: true, pageSize: 1 }),
+    );
     expect(api.testAuthentication).toHaveBeenCalledTimes(1);
     expect(api.fetchDetectionAlerts).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -238,7 +258,7 @@ describe("Google SecOps connection diagnostics and replay", () => {
     expect(result.status).toBe("failed");
     expect(result.checks[1]?.status).toBe("success");
     expect(result.checks[result.checks.length - 1]?.name).toMatch(
-      /Read detections/,
+      /Read alerts view/,
     );
     expect(result.error).toContain("403");
   });
@@ -363,7 +383,7 @@ describe("Google SecOps connection diagnostics and replay", () => {
     expect(lastUpdate()["lastError"]).toMatch(/complete/);
   });
 
-  test("a partial first poll anchors its window so a delayed retry cannot skip detections", async (): Promise<void> => {
+  test("a partial first poll anchors its window so a delayed retry re-covers it from the same start in half the chunk", async (): Promise<void> => {
     const item: GoogleSecOpsConnection = connection();
     delete item.cursor;
     const first: GoogleSecOpsRunResult =
@@ -372,7 +392,11 @@ describe("Google SecOps connection diagnostics and replay", () => {
         { type: "poll" },
         client([fetched([], { complete: false })]),
       );
+    expect(first.chunkMinutes).toBe(24 * 60);
+    expect(first.nextChunkMinutes).toBe(12 * 60);
     item.cursor = String(lastUpdate()["cursor"]);
+    // The row is reloaded with the result it was written with.
+    item.lastPollResult = lastUpdate()["lastPollResult"] as JSONObject;
     getJestSpyOn(OneUptimeDate, "getCurrentDate").mockReturnValue(
       new Date("2026-09-10T14:00:00Z"),
     );
@@ -383,7 +407,16 @@ describe("Google SecOps connection diagnostics and replay", () => {
         client([fetched()]),
       );
     expect(retry.windowStart).toBe(first.windowStart);
-    expect(retry.windowEnd).toBe("2026-09-10T14:00:00.000Z");
+    /*
+     * Review finding alerts-view-budget-pins-cursor-forever (F1): the retry
+     * used to re-read exactly the same day, which on a busy tenant never
+     * fitted and pinned the cursor for good. It now keeps the start and
+     * reads half the chunk, measured from the anchored cursor.
+     */
+    expect(retry.windowEnd).toBe("2026-09-10T00:01:00.000Z");
+    expect(retry.chunkMinutes).toBe(12 * 60);
+    expect(retry.warnings.join(" ")).toMatch(/12 hour windows/);
+    expect(lastUpdate()["cursor"]).toBe("2026-09-10T00:01:00.000Z");
   });
 
   test("a mixed normalization failure preserves retry coverage even after other records import", async (): Promise<void> => {
@@ -412,19 +445,31 @@ describe("Google SecOps connection diagnostics and replay", () => {
     expect(lastUpdate()).not.toHaveProperty("cursor");
   });
 
-  test("unrecognized payloads are reported and cannot make a poll falsely healthy", async (): Promise<void> => {
+  test("unrecognized payloads are counted and warned without holding the cursor", async (): Promise<void> => {
     const result: GoogleSecOpsRunResult =
       await GoogleSecOpsPoller.executeConnection(
         connection(),
         { type: "poll" },
         client([fetched([{ arbitrary: "envelope" }, detection()])]),
       );
+    /*
+     * A permanently unrecognizable object used to hold the cursor, which
+     * pinned the window until the 24 hour chunk could never reach the
+     * present. It is now counted, warned, and shown as a "warn" check.
+     */
     expect(result).toMatchObject({
-      status: "partial",
+      status: "success",
+      complete: true,
       rejectedCount: 1,
       ingestedCount: 1,
     });
-    expect(lastUpdate()).not.toHaveProperty("cursor");
+    expect(result.warnings.join(" ")).toMatch(/discarded/);
+    expect(
+      result.checks.find((check: GoogleSecOpsDiagnosticCheck): boolean => {
+        return check.name === "Normalize detections";
+      })?.status,
+    ).toBe("warn");
+    expect(lastUpdate()["cursor"]).toBe(NOW.toISOString());
   });
 
   test("replaying a previously imported alert skips its persisted event uid", async (): Promise<void> => {
@@ -498,12 +543,18 @@ describe("Google SecOps connection diagnostics and replay", () => {
           { type: "poll" },
           api,
         );
+      // Two search passes plus three alerts-view requests.
       expect(result).toMatchObject({
         complete: true,
         status: "success",
         fetchedCount: 2,
         ingestedCount: 2,
-        requestCount: 3,
+        requestCount: 5,
+        sourceCounts: {
+          ruleDetections: 0,
+          curatedDetections: 0,
+          alertsView: 3,
+        },
       });
       const calls: Array<Array<{ startTime: Date; endTime: Date }>> =
         getJestSpyOn(api, "fetchDetectionAlerts").mock.calls;
@@ -522,28 +573,49 @@ describe("Google SecOps connection diagnostics and replay", () => {
     ]);
     const result: GoogleSecOpsRunResult =
       await GoogleSecOpsPoller.executeConnection(connection(), RANGE, api);
+    // Four search requests (two bases per pass for a preview) plus three alerts-view requests.
     expect(result).toMatchObject({
       complete: true,
       fetchedCount: 2,
-      requestCount: 3,
+      requestCount: 7,
+      basis: "detection-time",
     });
   });
 
-  test("perpetually truncated responses stop at a fixed budget and hold cursor", async (): Promise<void> => {
+  test("perpetually truncated responses stop at the alerts view budget, hold the cursor and narrow the next chunk", async (): Promise<void> => {
     const result: GoogleSecOpsRunResult =
       await GoogleSecOpsPoller.executeConnection(
         connection(),
         { type: "poll" },
         client([fetched([detection()], { truncatedByCount: true })]),
       );
+    /*
+     * Review findings alerts-view-budget-pins-cursor-forever and
+     * budget-skipped-passes-reported-success (F1b): the alerts view has its
+     * own sixteen requests next to the two search pages, its check says the
+     * budget stopped it, and the old "Narrow the time range" advice is gone.
+     */
     expect(result).toMatchObject({
       status: "partial",
-      requestCount: 12,
+      requestCount: 18,
       ingestedCount: 1,
       complete: false,
+      chunkMinutes: 5,
+      nextChunkMinutes: 2,
     });
+    const alertsCheck: GoogleSecOpsDiagnosticCheck | undefined =
+      result.checks.find((check: GoogleSecOpsDiagnosticCheck): boolean => {
+        return check.name === "Read alerts view by detection time";
+      });
+    expect(alertsCheck?.status).toBe("warn");
+    expect(alertsCheck?.message).toContain(
+      "stopped by the request budget after 16 requests",
+    );
     expect(lastUpdate()).not.toHaveProperty("cursor");
-    expect(result.warnings.join(" ")).toMatch(/request limit/);
+    expect(result.warnings.join(" ")).not.toMatch(/request limit/);
+    expect(lastUpdate()["lastError"]).toContain(
+      "This window holds more records than one poll can read; the next poll reads a 2 minute window from the same starting point.",
+    );
   });
 
   test("stale cursors process the earliest backlog instead of skipping to yesterday", async (): Promise<void> => {
@@ -556,7 +628,8 @@ describe("Google SecOps connection diagnostics and replay", () => {
         client([fetched()]),
       );
     expect(result.windowStart).toBe("2026-09-01T11:59:00.000Z");
-    expect(result.windowEnd).toBe("2026-09-02T11:59:00.000Z");
+    // F1: the 24 hour chunk is measured from the cursor, not the overlapped start.
+    expect(result.windowEnd).toBe("2026-09-02T12:00:00.000Z");
     expect(lastUpdate()["cursor"]).toBe(result.windowEnd);
   });
 
@@ -756,6 +829,13 @@ describe("Google SecOps connection diagnostics and replay", () => {
     expect(result.windowStart).toBe("2026-09-10T11:57:00.000Z");
     expect(result.includeNonAlertingDetections).toBe(true);
     expect(Semaphore.release).toHaveBeenCalledTimes(1);
+    // The next chunk length lives on the previous result, so it is reloaded too.
+    expect(
+      getJestSpyOn(GoogleSecOpsConnectionService, "findOneById").mock
+        .calls[0]![0],
+    ).toMatchObject({
+      select: { cursor: true, lastPollResult: true },
+    });
   });
 });
 

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsHttpIntegration.test.ts

@@ -46,6 +46,14 @@ const SERVICE_ACCOUNT_EMAIL: string = "poller@example.iam.gserviceaccount.com";
 const INSTANCE: string =
   "projects/test-project/locations/us/instances/test-instance";
 const ALERTS_PATH: string = `/v1alpha/${INSTANCE}/legacy:legacyFetchAlertsView`;
+/*
+ * The created-time passes the poller now runs first. The simulator answers
+ * them with an empty page so these cases keep describing the alerts view.
+ */
+const SEARCH_PATHS: Array<string> = [
+  `/v1alpha/${INSTANCE}/legacy:legacySearchDetections`,
+  `/v1alpha/${INSTANCE}/legacy:legacySearchCuratedDetections`,
+];
 const SERVICE_ACCOUNT_JSON: string = JSON.stringify({
   client_email: SERVICE_ACCOUNT_EMAIL,
   private_key: privateKey,
@@ -192,6 +200,19 @@ describe("Google SecOps alerts HTTP integration", () => {
         return;
       }
 
+      if (SEARCH_PATHS.includes(url.pathname) && request.method === "GET") {
+        if (
+          request.headers["authorization"] !== "Bearer local-verified-token"
+        ) {
+          response.writeHead(401);
+          response.end("Bearer token required");
+          return;
+        }
+        response.writeHead(200, { "Content-Type": "application/json" });
+        response.end("{}");
+        return;
+      }
+
       alertsRequests.push(url);
       if (url.pathname !== ALERTS_PATH || request.method !== "GET") {
         response.writeHead(404);
@@ -284,7 +305,8 @@ describe("Google SecOps alerts HTTP integration", () => {
       url !== TOKEN_URL &&
       !(
         destination.origin === "https://us-chronicle.googleapis.com" &&
-        destination.pathname === ALERTS_PATH
+        (destination.pathname === ALERTS_PATH ||
+          SEARCH_PATHS.includes(destination.pathname))
       )
     ) {
       return Promise.reject(new Error(`Unexpected outbound URL: ${url}`));

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsPoller.test.ts

@@ -7,6 +7,7 @@ import OTelIngestService, {
 import SecurityEventService from "../../../../Server/Services/SecurityEventService";
 import GoogleSecOpsClient, {
   FetchAlertsResult,
+  SearchDetectionsResult,
 } from "../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient";
 import GoogleSecOpsPoller from "../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller";
 import { MAX_CONNECTOR_ERROR_MESSAGE_LENGTH } from "../../../../Server/Utils/SecurityEvent/ConnectorErrorMessage";
@@ -83,6 +84,17 @@ function makeFakeClient(alerts: Array<JSONObject>): {
   const calls: Array<{ startTime: Date; endTime: Date }> = [];
 
   const client: GoogleSecOpsClient = {
+    /*
+     * The created-time passes answer quietly so these tests keep
+     * exercising the alerts-view path they were written against.
+     */
+    searchDetections: (): Promise<SearchDetectionsResult> => {
+      return Promise.resolve({
+        detections: [],
+        nextPageToken: null,
+        truncated: false,
+      });
+    },
     fetchDetectionAlerts: (data: {
       startTime: Date;
       endTime: Date;
@@ -169,7 +181,7 @@ describe("GoogleSecOpsPoller.pollConnection", () => {
     expect(updateData["lastError"]).toBeNull();
   });
 
-  test("first poll (no cursor) looks back the default window; cursor polls overlap by a minute", async () => {
+  test("first poll (no cursor) looks back 24 hours; cursor polls overlap by a minute", async () => {
     const connection: GoogleSecOpsConnection = makeConnection();
     const { client, calls } = makeFakeClient([]);
 
@@ -179,7 +191,7 @@ describe("GoogleSecOpsPoller.pollConnection", () => {
     const firstWindowMinutes: number =
       (calls[0]!.endTime.getTime() - calls[0]!.startTime.getTime()) /
       (60 * 1000);
-    expect(Math.round(firstWindowMinutes)).toBe(15);
+    expect(Math.round(firstWindowMinutes)).toBe(24 * 60);
 
     /*
      * Second poll with a cursor five minutes ago: window starts one
@@ -206,10 +218,20 @@ describe("GoogleSecOpsPoller.pollConnection", () => {
 
     await GoogleSecOpsPoller.pollConnection(connection, client);
 
+    /*
+     * Review finding alerts-view-budget-pins-cursor-forever (F1): the
+     * catch-up chunk is now measured from the cursor rather than from the
+     * overlapped window start, so a narrowed chunk no longer than the
+     * overlap still reads past the cursor. A full chunk therefore reads 24
+     * hours of new time plus the one minute overlap.
+     */
     const windowMinutes: number =
       (calls[0]!.endTime.getTime() - calls[0]!.startTime.getTime()) /
       (60 * 1000);
-    expect(Math.round(windowMinutes)).toBe(24 * 60);
+    expect(Math.round(windowMinutes)).toBe(24 * 60 + 1);
+    expect(calls[0]!.endTime.getTime()).toBe(
+      new Date(connection.cursor).getTime() + 24 * 60 * 60 * 1000,
+    );
   });
 
   test("an unparseable alert is skipped without failing the batch", async () => {

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsPollerFailureTaxonomy.test.ts

@@ -192,6 +192,7 @@ function okTokenResponse(): StubbedResponse {
 function alertsResponseWithOneAlert(): StubbedResponse {
   return {
     status: 200,
+    // complete: true, or the client re-issues the GET for an unfinished stream.
     body: JSON.stringify({
       alerts: [
         {
@@ -199,6 +200,7 @@ function alertsResponseWithOneAlert(): StubbedResponse {
           detection: [{ ruleName: "Brute force", severity: "HIGH" }],
         },
       ],
+      complete: true,
     }),
   };
 }
@@ -227,8 +229,17 @@ function makeFetch(responses: {
   ): Promise<FetchResponseLike> => {
     requests.push({ url: url, method: init.method });
 
+    /*
+     * The created-time search passes answer with an empty page: every
+     * fixture here describes a failure of the token exchange, the alerts
+     * view, or OneUptime's own store, and the search passes stay quiet.
+     */
     const response: StubbedResponse =
-      url === GOOGLE_TOKEN_URI ? responses.token : responses.alerts;
+      url === GOOGLE_TOKEN_URI
+        ? responses.token
+        : url.includes("legacySearch")
+          ? { status: 200, body: "{}" }
+          : responses.alerts;
 
     return Promise.resolve({
       ok: response.status >= 200 && response.status < 300,
@@ -658,10 +669,13 @@ describe("GoogleSecOpsPoller lastError failure taxonomy", () => {
     expect(lastError.startsWith(tokenExchangePrefix)).toBe(false);
     expect(lastError).toContain("PERMISSION_DENIED");
 
-    // Token endpoint first, then Chronicle: the failure is genuinely theirs.
-    expect(run.requests).toHaveLength(2);
+    /*
+     * Token endpoint first, then Chronicle three times (two quiet search
+     * passes, then the alerts view that failed): the failure is theirs.
+     */
+    expect(run.requests).toHaveLength(4);
     expect(run.requests[0]!.url).toBe(GOOGLE_TOKEN_URI);
-    expect(run.requests[1]!.url.startsWith(run.client.getApiBaseUrl())).toBe(
+    expect(run.requests[3]!.url.startsWith(run.client.getApiBaseUrl())).toBe(
       true,
     );
 
@@ -685,10 +699,10 @@ describe("GoogleSecOpsPoller lastError failure taxonomy", () => {
     const run: PollRun = await telemetryStoreFailureRun();
     const lastError: string = recordedLastError(run);
 
-    // The alerts really did arrive — both Google calls succeeded...
-    expect(run.requests).toHaveLength(2);
+    // The alerts really did arrive — every Google call succeeded...
+    expect(run.requests).toHaveLength(4);
     expect(run.requests[0]!.url).toBe(GOOGLE_TOKEN_URI);
-    expect(run.requests[1]!.url.startsWith(run.client.getApiBaseUrl())).toBe(
+    expect(run.requests[3]!.url.startsWith(run.client.getApiBaseUrl())).toBe(
       true,
     );
 
@@ -735,7 +749,7 @@ describe("GoogleSecOpsPoller lastError failure taxonomy", () => {
     expect(lastError).not.toContain("(HTTP");
 
     // The request did reach Chronicle; the body it returned was unusable.
-    expect(run.requests).toHaveLength(2);
+    expect(run.requests).toHaveLength(4);
     expect(run.insertedBatches).toHaveLength(0);
   });