@oneuptime/common 13.0.5 → 13.0.6

package/Tests/Server/Utils/SecurityEvent/{GoogleSecOpsHttpIntegration.test.ts → Connectors/GoogleSecOps/GoogleSecOpsPollingHttpIntegration.test.ts}

@@ -1,29 +1,21 @@
-import { GoogleSecOpsRunResult } from "../../../../Types/SecurityEvent/GoogleSecOpsDiagnostics";
-import Semaphore from "../../../../Server/Infrastructure/Semaphore";
-import { generateKeyPairSync } from "crypto";
-import http, { IncomingMessage, Server, ServerResponse } from "http";
-import { AddressInfo } from "net";
-import jwt from "jsonwebtoken";
-import GoogleSecOpsConnection from "../../../../Models/DatabaseModels/GoogleSecOpsConnection";
-import GoogleSecOpsConnectionService from "../../../../Server/Services/GoogleSecOpsConnectionService";
-import OTelIngestService, {
-  TelemetryServiceMetadata,
-} from "../../../../Server/Services/OpenTelemetryIngestService";
-import SecurityEventService from "../../../../Server/Services/SecurityEventService";
-import GoogleSecOpsClient, {
-  FetchAlertsResult,
+import SecurityEventConnection from "../../../../../../Models/DatabaseModels/SecurityEventConnection";
+import OTelIngestService from "../../../../../../Server/Services/OpenTelemetryIngestService";
+import SecurityEventConnectionService from "../../../../../../Server/Services/SecurityEventConnectionService";
+import SecurityEventService from "../../../../../../Server/Services/SecurityEventService";
+import {
   FetchInitLike,
   FetchLike,
   FetchResponseLike,
-} from "../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsClient";
-import GoogleSecOpsPoller from "../../../../Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller";
-import ThreatIntelEnricher from "../../../../Server/Utils/SecurityEvent/ThreatIntel/ThreatIntelEnricher";
-import logger from "../../../../Server/Utils/Logger";
-import OneUptimeDate from "../../../../Types/Date";
-import { JSONObject } from "../../../../Types/JSON";
-import ObjectID from "../../../../Types/ObjectID";
-import ServiceType from "../../../../Types/Telemetry/ServiceType";
-import { getJestSpyOn } from "../../../Spy";
+} from "../../../../../../Server/Utils/SecurityEvent/Connectors/GoogleSecOps/GoogleSecOpsClient";
+import GoogleSecOpsConnector from "../../../../../../Server/Utils/SecurityEvent/Connectors/GoogleSecOps/GoogleSecOpsConnector";
+import SecurityEventConnectionPoller, {
+  PollerOverrides,
+} from "../../../../../../Server/Utils/SecurityEvent/Connectors/SecurityEventConnectionPoller";
+import SecurityEventConnectorRegistry from "../../../../../../Server/Utils/SecurityEvent/Connectors/SecurityEventConnectorRegistry";
+import OneUptimeDate from "../../../../../../Types/Date";
+import { JSONObject } from "../../../../../../Types/JSON";
+import { SecurityEventConnectionRunResult } from "../../../../../../Types/SecurityEvent/Connectors/SecurityEventConnectionDiagnostics";
+import { getJestSpyOn } from "../../../../../Spy";
 import {
   afterAll,
   afterEach,
@@ -34,34 +26,62 @@ import {
   jest,
   test,
 } from "@jest/globals";
+import http, { IncomingMessage, Server, ServerResponse } from "http";
+import { AddressInfo } from "net";
+import jwt from "jsonwebtoken";
+import {
+  INSTANCE,
+  PUBLIC_KEY,
+  SERVICE_ACCOUNT_EMAIL,
+  TOKEN_URI,
+  secOpsSettings,
+} from "./GoogleSecOpsConnectorFixtures";
+import {
+  ConnectionUpdate,
+  PROJECT_ID,
+  PollPersistence,
+  keysAndStatuses,
+  secOpsConnection,
+  stubPollPersistence,
+} from "./GoogleSecOpsPollingFixtures";
 
-const { privateKey, publicKey } = generateKeyPairSync("rsa", {
-  modulusLength: 2048,
-  privateKeyEncoding: { type: "pkcs8", format: "pem" },
-  publicKeyEncoding: { type: "spki", format: "pem" },
-});
-
-const TOKEN_URL: string = "https://oauth2.googleapis.com/token";
-const SERVICE_ACCOUNT_EMAIL: string = "poller@example.iam.gserviceaccount.com";
-const INSTANCE: string =
-  "projects/test-project/locations/us/instances/test-instance";
-const ALERTS_PATH: string = `/v1alpha/${INSTANCE}/legacy:legacyFetchAlertsView`;
 /*
- * The created-time passes the poller now runs first. The simulator answers
- * them with an empty page so these cases keep describing the alerts view.
+ * Signing, HTTP serialization, streamed response parsing and the shared
+ * poller's persistence decisions together, over real sockets: the REAL
+ * SecurityEventConnectionPoller runs a Google SecOps connection whose REAL
+ * GoogleSecOpsConnector and GoogleSecOpsClient send every request through a
+ * transport that forwards the known Google URLs to a loopback contract
+ * simulator. The simulator verifies the RS256 assertion against the key's
+ * public half, requires the alerts view's documented query (snapshotQuery
+ * serialized explicitly, no unknown parameters) and streams its answer in
+ * two chunks. No Google credentials or external network are needed.
+ *
+ * Only persistence and the source lock are stubbed, as the retired Google
+ * SecOps HTTP integration suite stubbed them.
  */
+
+jest.mock(
+  "../../../../../../Server/Utils/SecurityEvent/Connectors/SecurityEventConnectorRegistry",
+  () => {
+    return {
+      __esModule: true,
+      default: { getConnector: jest.fn() },
+    };
+  },
+);
+
+const ALERTS_PATH: string = `/v1alpha/${INSTANCE}/legacy:legacyFetchAlertsView`;
 const SEARCH_PATHS: Array<string> = [
   `/v1alpha/${INSTANCE}/legacy:legacySearchDetections`,
   `/v1alpha/${INSTANCE}/legacy:legacySearchCuratedDetections`,
 ];
-const SERVICE_ACCOUNT_JSON: string = JSON.stringify({
-  client_email: SERVICE_ACCOUNT_EMAIL,
-  private_key: privateKey,
-  token_uri: TOKEN_URL,
-});
-const PROJECT_ID: ObjectID = new ObjectID(
-  "11111111-1111-4111-8111-111111111111",
-);
+/*
+ * legacySearchCuratedDetections has no wildcard, so the curated pass asks
+ * countAllCuratedRuleSetDetections which curated rules to name before it
+ * searches any.
+ */
+const CURATED_COUNTS_PATH: string = `/v1alpha/${INSTANCE}:countAllCuratedRuleSetDetections`;
+const WEEK_MS: number = 7 * 24 * 60 * 60 * 1000;
 const NOW: Date = new Date("2026-09-09T12:00:00.000Z");
 const CURSOR: string = "2026-09-09T11:55:00.000Z";
 const OPEN_ALERT: JSONObject = {
@@ -76,14 +96,6 @@ const CLOSED_ALERT: JSONObject = {
   detection: [{ ruleName: "Closed detection", severity: "LOW" }],
   feedbackSummary: { status: "CLOSED" },
 };
-const NON_ALERTING_DETECTION: JSONObject = {
-  id: "detection-only",
-  detectionTime: "2026-09-08T01:30:00.000Z",
-  createdTime: "2026-09-09T04:16:00.000Z",
-  detection: [
-    { ruleName: "Detection without alert", alertState: "NOT_ALERTING" },
-  ],
-};
 const QUERY_FIELDS: Array<string> = [
   "alertListOptions.maxReturnedAlerts",
   "includeNonAlertingDetections",
@@ -124,19 +136,25 @@ const FULL_GOOGLE_ERROR_BODY: string = JSON.stringify({
 });
 
 /*
- * Exercise signing, HTTP serialization, streamed response parsing and the
- * poller's persistence decisions together. Only the transport destination
- * changes: known Google URLs go to a loopback contract simulator. It requires
- * the documented snapshotQuery field to be explicitly serialized; this does
- * not establish whether a live tenant rejects an omitted empty proto field.
- * No Google credentials or external network are needed.
+ * Captured at import time, before any spy replaces it, so a spy on
+ * pollConnection can hand the due connection back to the real poll with the
+ * loopback transport attached.
  */
-describe("Google SecOps alerts HTTP integration", () => {
+const realPollConnection: (
+  connection: SecurityEventConnection,
+  overrides?: PollerOverrides | undefined,
+) => Promise<number> = SecurityEventConnectionPoller.pollConnection.bind(
+  SecurityEventConnectionPoller,
+);
+
+describe("Google SecOps polls over HTTP through the shared poller", () => {
   let server: Server;
   let port: number;
   let alertsRequests: Array<URL>;
+  let countIntervals: Array<JSONObject>;
   let assertions: Array<JSONObject>;
   let alertsErrorBody: string | null;
+  let persistence: PollPersistence;
 
   function rejectRequest(response: ServerResponse, message: string): void {
     response.writeHead(400, { "Content-Type": "application/json" });
@@ -158,6 +176,7 @@ describe("Google SecOps alerts HTTP integration", () => {
     });
     request.on("end", (): void => {
       const url: URL = new URL(request.url || "/", "http://127.0.0.1");
+
       if (url.pathname === "/token") {
         try {
           const form: URLSearchParams = new URLSearchParams(body);
@@ -172,10 +191,10 @@ describe("Google SecOps alerts HTTP integration", () => {
           }
           const assertion: JSONObject = jwt.verify(
             form.get("assertion") || "",
-            publicKey,
+            PUBLIC_KEY,
             {
               algorithms: ["RS256"],
-              audience: TOKEN_URL,
+              audience: TOKEN_URI,
               issuer: SERVICE_ACCOUNT_EMAIL,
             },
           ) as JSONObject;
@@ -200,6 +219,33 @@ describe("Google SecOps alerts HTTP integration", () => {
         return;
       }
 
+      /*
+       * The curated rule counts: a POST carrying the interval, answered the
+       * way a tenant whose curated rules have not fired answers it, with a
+       * bare {}. The curated pass then has no rule to search.
+       */
+      if (url.pathname === CURATED_COUNTS_PATH && request.method === "POST") {
+        if (
+          request.headers["authorization"] !== "Bearer local-verified-token"
+        ) {
+          response.writeHead(401);
+          response.end("Bearer token required");
+          return;
+        }
+        if (request.headers["content-type"] !== "application/json") {
+          rejectRequest(response, "Expected a JSON request body.");
+          return;
+        }
+        countIntervals.push(
+          ((JSON.parse(body || "{}") as JSONObject)["interval"] ||
+            {}) as JSONObject,
+        );
+        response.writeHead(200, { "Content-Type": "application/json" });
+        response.end("{}");
+        return;
+      }
+
+      // The created-time searches answer with an empty page.
       if (SEARCH_PATHS.includes(url.pathname) && request.method === "GET") {
         if (
           request.headers["authorization"] !== "Bearer local-verified-token"
@@ -269,15 +315,9 @@ describe("Google SecOps alerts HTTP integration", () => {
       }
 
       // Match-all must return closed alerts too; a status filter loses them.
-      const closedAlerts: Array<JSONObject> =
-        url.searchParams.get("snapshotQuery") === "" ? [CLOSED_ALERT] : [];
       const allAlerts: Array<JSONObject> = [
         OPEN_ALERT,
-        ...closedAlerts,
-        ...(url.searchParams.get("includeNonAlertingDetections") ===
-        "ALERTS_FEATURE_PREFERENCE_ENABLED"
-          ? [NON_ALERTING_DETECTION]
-          : []),
+        ...(url.searchParams.get("snapshotQuery") === "" ? [CLOSED_ALERT] : []),
       ];
       const returnedAlerts: Array<JSONObject> = allAlerts.slice(0, count);
       response.writeHead(200, { "Content-Type": "application/json" });
@@ -302,10 +342,11 @@ describe("Google SecOps alerts HTTP integration", () => {
   ): Promise<FetchResponseLike> => {
     const destination: URL = new URL(url);
     if (
-      url !== TOKEN_URL &&
+      url !== TOKEN_URI &&
       !(
         destination.origin === "https://us-chronicle.googleapis.com" &&
         (destination.pathname === ALERTS_PATH ||
+          destination.pathname === CURATED_COUNTS_PATH ||
           SEARCH_PATHS.includes(destination.pathname))
       )
     ) {
@@ -350,17 +391,6 @@ describe("Google SecOps alerts HTTP integration", () => {
     );
   };
 
-  function makeClient(
-    fetchImplementation: FetchLike = forwardToServer,
-  ): GoogleSecOpsClient {
-    return new GoogleSecOpsClient({
-      region: "us",
-      instanceResourceName: INSTANCE,
-      serviceAccountJson: SERVICE_ACCOUNT_JSON,
-      fetchImplementation,
-    });
-  }
-
   beforeAll(async (): Promise<void> => {
     server = http.createServer(handleRequest);
     await new Promise<void>((resolve: () => void): void => {
@@ -370,18 +400,19 @@ describe("Google SecOps alerts HTTP integration", () => {
   });
 
   beforeEach((): void => {
-    getJestSpyOn(Semaphore, "lock").mockResolvedValue({});
-    getJestSpyOn(Semaphore, "release").mockResolvedValue(undefined);
-    getJestSpyOn(GoogleSecOpsPoller, "findExistingEventUids").mockResolvedValue(
-      new Set(),
-    );
+    getJestSpyOn(OneUptimeDate, "getCurrentDate").mockReturnValue(NOW);
+    persistence = stubPollPersistence();
     alertsRequests = [];
+    countIntervals = [];
     assertions = [];
     alertsErrorBody = null;
   });
 
   afterEach((): void => {
     jest.restoreAllMocks();
+    (
+      SecurityEventConnectorRegistry.getConnector as unknown as jest.Mock
+    ).mockReset();
   });
 
   afterAll(async (): Promise<void> => {
@@ -398,165 +429,87 @@ describe("Google SecOps alerts HTTP integration", () => {
     );
   });
 
-  test.each([true, false])(
-    "serializes the documented non-alerting detection preference %s over HTTP",
-    async (includeNonAlertingDetections: boolean): Promise<void> => {
-      const result: FetchAlertsResult = await makeClient().fetchDetectionAlerts(
+  test("a queued connection test authenticates once and proves read permission over HTTP without importing or writing", async (): Promise<void> => {
+    const result: SecurityEventConnectionRunResult =
+      await SecurityEventConnectionPoller.executeConnection(
+        secOpsConnection({ cursor: CURSOR }),
+        { type: "test" },
         {
-          startTime: new Date("2026-09-09T11:54:00Z"),
-          endTime: NOW,
-          includeNonAlertingDetections,
+          connector: new GoogleSecOpsConnector(forwardToServer),
+          settings: secOpsSettings(),
         },
       );
-      expect(
-        result.alerts.some((alert: JSONObject): boolean => {
-          return alert["id"] === "detection-only";
-        }),
-      ).toBe(includeNonAlertingDetections);
-      expect(
-        alertsRequests[0]!.searchParams.get("includeNonAlertingDetections"),
-      ).toBe(
-        includeNonAlertingDetections
-          ? "ALERTS_FEATURE_PREFERENCE_ENABLED"
-          : "ALERTS_FEATURE_PREFERENCE_DISABLED",
-      );
-    },
-  );
 
-  test("tests authentication and actual read permission over HTTP without ingestion", async (): Promise<void> => {
-    const item: GoogleSecOpsConnection = new GoogleSecOpsConnection();
-    item._id = "22222222-2222-4222-8222-222222222222";
-    item.projectId = PROJECT_ID;
-    item.region = "us";
-    item.instanceResourceName = INSTANCE;
-    item.serviceAccountJson = SERVICE_ACCOUNT_JSON;
-    getJestSpyOn(SecurityEventService, "insertJsonRows").mockResolvedValue(
-      undefined,
-    );
-    getJestSpyOn(
-      GoogleSecOpsConnectionService,
-      "updateOneById",
-    ).mockResolvedValue(undefined);
-    const result: GoogleSecOpsRunResult =
-      await GoogleSecOpsPoller.executeConnection(
-        item,
-        { type: "test" },
-        makeClient(),
-      );
     expect(result.status).toBe("success");
-    expect(result.checks[1]?.status).toBe("success");
-    expect(result.checks[2]?.status).toBe("success");
+    /*
+     * The retired poller reported "Authenticate with Google" and the read
+     * steps as "success". The shared loop keeps the connector's own check
+     * keys, and a queued test skips the availability counts.
+     */
+    expect(keysAndStatuses(result.checks)).toEqual([
+      "configuration:pass",
+      "authentication:pass",
+      "rule-detections-read:pass",
+      "curated-detections-read:pass",
+      "alerts-view-read:pass",
+      "detections-available:skip",
+    ]);
+    expect(alertsRequests).toHaveLength(1);
     expect(
       alertsRequests[0]!.searchParams.get("alertListOptions.maxReturnedAlerts"),
     ).toBe("1");
+    /*
+     * The curated read probe proves the curated permission through the
+     * counts route, over the last 7 days: with no curated rule reported it
+     * has no rule id to probe a search with, and the curated route has no
+     * wildcard to fall back on.
+     */
+    expect(countIntervals).toEqual([
+      {
+        startTime: new Date(NOW.getTime() - WEEK_MS).toISOString(),
+        endTime: NOW.toISOString(),
+      },
+    ]);
     expect(assertions).toHaveLength(1);
     expect(SecurityEventService.insertJsonRows).not.toHaveBeenCalled();
-    expect(GoogleSecOpsConnectionService.updateOneById).not.toHaveBeenCalled();
+    expect(persistence.updates).toHaveLength(0);
   });
 
-  test.each([undefined, 23])(
-    "authenticates and requests all alert statuses with maxAlerts=%s",
-    async (maxAlerts: number | undefined): Promise<void> => {
-      const result: FetchAlertsResult = await makeClient().fetchDetectionAlerts(
-        {
-          startTime: new Date("2026-09-09T11:54:00.000Z"),
-          endTime: NOW,
-          maxAlerts,
-        },
-      );
-
-      expect(assertions).toHaveLength(1);
-      expect(
-        (assertions[0]!["exp"] as number) - (assertions[0]!["iat"] as number),
-      ).toBe(3600);
-      expect(alertsRequests).toHaveLength(1);
-      expect([...alertsRequests[0]!.searchParams.entries()].sort()).toEqual([
-        ["alertListOptions.maxReturnedAlerts", String(maxAlerts || 1000)],
-        ["includeNonAlertingDetections", "ALERTS_FEATURE_PREFERENCE_DISABLED"],
-        ["snapshotQuery", ""],
-        ["timeRange.endTime", NOW.toISOString()],
-        ["timeRange.startTime", "2026-09-09T11:54:00.000Z"],
-      ]);
-      expect(result).toEqual({
-        alerts: [OPEN_ALERT, CLOSED_ALERT],
-        complete: true,
-        progress: 1,
-        truncatedByCount: false,
-        truncatedByBytes: false,
-        baselineAlertsCount: 2,
-        filteredAlertsCount: 2,
-        chunkCount: 2,
-      });
-    },
-  );
-
   test.each([
     ["pageSize", "Unknown name"],
     ["missing snapshotQuery", "Missing required field: snapshotQuery"],
     ["full Google diagnostic", "Google request diagnostic."],
   ])(
-    "records %s rejection without advancing, then retries from the cursor and ingests",
+    "records a %s rejection without advancing, then retries from the cursor and ingests",
     async (invalidRequest: string, expectedError: string): Promise<void> => {
-      const connection: GoogleSecOpsConnection = new GoogleSecOpsConnection();
-      connection._id = "22222222-2222-4222-8222-222222222222";
-      connection.projectId = PROJECT_ID;
-      connection.region = "us";
-      connection.instanceResourceName = INSTANCE;
-      connection.serviceAccountJson = SERVICE_ACCOUNT_JSON;
-      connection.cursor = CURSOR;
-
+      const connection: SecurityEventConnection = secOpsConnection({
+        cursor: CURSOR,
+      });
       const updates: Array<JSONObject> = [];
-      const rows: Array<JSONObject> = [];
       let currentTime: Date = NOW;
       getJestSpyOn(OneUptimeDate, "getCurrentDate").mockImplementation(
         (): Date => {
           return currentTime;
         },
       );
-      getJestSpyOn(logger, "error").mockImplementation((): void => {
-        return;
-      });
-      getJestSpyOn(GoogleSecOpsConnectionService, "findBy").mockResolvedValue([
+      getJestSpyOn(SecurityEventConnectionService, "findBy").mockResolvedValue([
         connection,
-      ]);
+      ] as never);
+      // The row keeps what each poll wrote, as the database would.
       getJestSpyOn(
-        GoogleSecOpsConnectionService,
+        SecurityEventConnectionService,
         "updateOneById",
-      ).mockImplementation(
-        async (call: { data: JSONObject }): Promise<void> => {
-          updates.push(call.data);
-          Object.assign(connection, call.data);
-        },
-      );
-      const metadata: TelemetryServiceMetadata = {
-        serviceName: "Google SecOps",
-        primaryEntityId: new ObjectID("33333333-3333-4333-8333-333333333333"),
-        primaryEntityType: ServiceType.OpenTelemetry,
-        dataRententionInDays: 15,
-        serviceRetentionConfig: null,
-        serviceRetentionInDays: null,
-        projectRetentionConfig: null,
-        projectRetentionInDays: 15,
-      };
-      getJestSpyOn(
-        OTelIngestService,
-        "telemetryServiceFromName",
-      ).mockResolvedValue(metadata);
-      getJestSpyOn(
-        ThreatIntelEnricher,
-        "enrichNormalizedEvents",
-      ).mockResolvedValue({ eventsMatched: 0, valuesLookedUp: 0 });
-      getJestSpyOn(SecurityEventService, "insertJsonRows").mockImplementation(
-        async (batch: Array<JSONObject>): Promise<void> => {
-          rows.push(...batch);
-        },
-      );
+      ).mockImplementation(((call: ConnectionUpdate): Promise<void> => {
+        updates.push(call.data);
+        Object.assign(connection, call.data);
+        return Promise.resolve();
+      }) as never);
 
       let injectInvalidRequest: boolean = true;
       if (invalidRequest === "full Google diagnostic") {
         alertsErrorBody = FULL_GOOGLE_ERROR_BODY;
       }
-      const client: GoogleSecOpsClient = makeClient(
+      const connector: GoogleSecOpsConnector = new GoogleSecOpsConnector(
         (url: string, init: FetchInitLike): Promise<FetchResponseLike> => {
           const outgoing: URL = new URL(url);
           if (injectInvalidRequest && outgoing.pathname === ALERTS_PATH) {
@@ -569,24 +522,33 @@ describe("Google SecOps alerts HTTP integration", () => {
           return forwardToServer(outgoing.toString(), init);
         },
       );
-      const realPollConnection: typeof GoogleSecOpsPoller.pollConnection =
-        GoogleSecOpsPoller.pollConnection.bind(GoogleSecOpsPoller);
-      getJestSpyOn(GoogleSecOpsPoller, "pollConnection").mockImplementation(
-        async (dueConnection: GoogleSecOpsConnection): Promise<number> => {
-          return realPollConnection(dueConnection, client);
-        },
-      );
+      getJestSpyOn(
+        SecurityEventConnectionPoller,
+        "pollConnection",
+      ).mockImplementation(((
+        dueConnection: SecurityEventConnection,
+      ): Promise<number> => {
+        return realPollConnection(dueConnection, {
+          connector,
+          settings: secOpsSettings(),
+        });
+      }) as never);
 
-      await GoogleSecOpsPoller.pollAllDueConnections();
+      await SecurityEventConnectionPoller.pollAllDueConnections();
 
+      /*
+       * One write: the poll books its own failure, and the loop does not
+       * stamp it a second time.
+       */
       expect(updates).toHaveLength(1);
       expect(updates[0]!["lastError"]).toContain("HTTP 400");
       expect(updates[0]!["lastError"]).toContain(expectedError);
       expect(updates[0]).not.toHaveProperty("cursor");
       expect(updates[0]!["lastPolledAt"]).toEqual(NOW);
       expect(connection.cursor).toBe(CURSOR);
-      expect(rows).toEqual([]);
+      expect(persistence.insertedBatches).toEqual([]);
       expect(OTelIngestService.telemetryServiceFromName).not.toHaveBeenCalled();
+
       if (invalidRequest === "full Google diagnostic") {
         const lastError: string = updates[0]!["lastError"] as string;
         /*
@@ -624,11 +586,23 @@ describe("Google SecOps alerts HTTP integration", () => {
       injectInvalidRequest = false;
       alertsErrorBody = null;
       currentTime = new Date("2026-09-09T12:05:00.000Z");
-      await GoogleSecOpsPoller.pollAllDueConnections();
+      await SecurityEventConnectionPoller.pollAllDueConnections();
 
-      expect(assertions).toHaveLength(1);
-      expect(alertsRequests).toHaveLength(2);
-      for (const request of alertsRequests) {
+      /*
+       * Every fetch opens its own client session, so each poll signs one
+       * assertion. The retired poller reused one client across both ticks
+       * and signed once.
+       */
+      expect(assertions).toHaveLength(2);
+      /*
+       * Three alerts-view reads: each poll reads its own window from the
+       * cursor, and the second poll, whose window read succeeded, then
+       * sweeps the day before that window for alerts Google made readable
+       * after their detection time. The first poll failed at its window
+       * read, so it never reached its sweep.
+       */
+      expect(alertsRequests).toHaveLength(3);
+      for (const request of alertsRequests.slice(0, 2)) {
         expect(request.searchParams.get("timeRange.startTime")).toBe(
           "2026-09-09T11:54:00.000Z",
         );
@@ -639,6 +613,35 @@ describe("Google SecOps alerts HTTP integration", () => {
       expect(alertsRequests[1]!.searchParams.get("timeRange.endTime")).toBe(
         currentTime.toISOString(),
       );
+      // The sweep ends where the window starts and reads alerts only.
+      expect(alertsRequests[2]!.searchParams.get("timeRange.startTime")).toBe(
+        new Date(currentTime.getTime() - 24 * 60 * 60 * 1000).toISOString(),
+      );
+      expect(alertsRequests[2]!.searchParams.get("timeRange.endTime")).toBe(
+        "2026-09-09T11:54:00.000Z",
+      );
+      expect(
+        alertsRequests[2]!.searchParams.get("includeNonAlertingDetections"),
+      ).toBe("ALERTS_FEATURE_PREFERENCE_DISABLED");
+      /*
+       * Each poll's curated pass asked which curated rules to search first,
+       * over the week before its own window.
+       */
+      expect(countIntervals).toEqual([
+        {
+          startTime: new Date(
+            Date.parse("2026-09-09T11:54:00.000Z") - WEEK_MS,
+          ).toISOString(),
+          endTime: NOW.toISOString(),
+        },
+        {
+          startTime: new Date(
+            Date.parse("2026-09-09T11:54:00.000Z") - WEEK_MS,
+          ).toISOString(),
+          endTime: currentTime.toISOString(),
+        },
+      ]);
+      const rows: Array<JSONObject> = persistence.insertedBatches.flat();
       expect(
         rows.map((row: JSONObject): unknown => {
           return row["eventUid"];
@@ -648,7 +651,9 @@ describe("Google SecOps alerts HTTP integration", () => {
         rows.every((row: JSONObject): boolean => {
           return (
             row["projectId"] === PROJECT_ID.toString() &&
-            row["classUid"] === 2004
+            row["classUid"] === 2004 &&
+            row["vendorName"] === "Google" &&
+            row["productName"] === "Google SecOps"
           );
         }),
       ).toBe(true);