@oneuptime/common 14.0.1 → 14.0.2

package/Tests/Server/Utils/Monitor/MonitorAlertCriteriaReferences.test.ts

@@ -0,0 +1,362 @@
+/*
+ * The alert creation path pulls the native isolated-vm addon through its
+ * template renderer (MonitorAlert → MonitorTemplateUtil → VMAPI →
+ * VMRunner). Nothing under test here touches the sandbox, and the
+ * prebuilt binary cannot always dlopen in the test environment — so stub
+ * the module out before anything imports it.
+ */
+jest.mock("isolated-vm", () => {
+  return {};
+});
+
+import Alert from "../../../../Models/DatabaseModels/Alert";
+import AlertSeverity from "../../../../Models/DatabaseModels/AlertSeverity";
+import DatabaseBaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Label from "../../../../Models/DatabaseModels/Label";
+import Monitor from "../../../../Models/DatabaseModels/Monitor";
+import OnCallDutyPolicy from "../../../../Models/DatabaseModels/OnCallDutyPolicy";
+import AlertService from "../../../../Server/Services/AlertService";
+import AlertSeverityService from "../../../../Server/Services/AlertSeverityService";
+import LabelService from "../../../../Server/Services/LabelService";
+import NetworkDeviceOwnerUserService from "../../../../Server/Services/NetworkDeviceOwnerUserService";
+import OnCallDutyPolicyService from "../../../../Server/Services/OnCallDutyPolicyService";
+import logger from "../../../../Server/Utils/Logger";
+import MonitorAlert from "../../../../Server/Utils/Monitor/MonitorAlert";
+import MonitorResourceContextUtil from "../../../../Server/Utils/Monitor/MonitorResourceContext";
+import Dictionary from "../../../../Types/Dictionary";
+import MonitorCriteriaInstance from "../../../../Types/Monitor/MonitorCriteriaInstance";
+import MonitorType from "../../../../Types/Monitor/MonitorType";
+import ObjectID from "../../../../Types/ObjectID";
+import ProbeMonitorResponse from "../../../../Types/Probe/ProbeMonitorResponse";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
+
+/*
+ * A monitor criteria names the on-call policies to page and the labels to
+ * put on the alerts it opens. Those ids live in monitorSteps JSON, with no
+ * foreign key behind them, so a criteria can still point at a policy that was
+ * deleted or at another project's label (the monitorSteps repair could not
+ * resolve every id). AlertService now refuses both on create, and this path
+ * runs inside the probe / telemetry ingest workers: letting that refusal
+ * through would stop the monitor opening any alert for that criteria, on
+ * every check. So the stale ids are dropped and logged, and the alert is
+ * still opened with everything that is usable.
+ *
+ * The lookups are stubbed at the service level, so the real
+ * ProjectScopedReferenceValidator.isUsableInProject decides.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const OTHER_PROJECT_ID: ObjectID = new ObjectID(
+  "99999999-9999-4999-8999-999999999999",
+);
+const MONITOR_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const SEVERITY_ID: ObjectID = new ObjectID(
+  "55555555-5555-4555-8555-555555555555",
+);
+
+const OWN_POLICY_ID: string = "9d8c7b6a-5f4e-4d3c-8b2a-1f0e9d8c7b6a";
+const FOREIGN_POLICY_ID: string = "2c3d4e5f-6a7b-4c8d-9e0f-1a2b3c4d5e6f";
+const DELETED_POLICY_ID: string = "3d4e5f6a-7b8c-4d9e-8f0a-1b2c3d4e5f6a";
+const OWN_LABEL_ID: string = "5f1e2d3c-4b5a-4968-8776-655443322110";
+const FOREIGN_LABEL_ID: string = "6a7b8c9d-0e1f-4a2b-9c3d-4e5f6a7b8c9d";
+
+function monitor(): Monitor {
+  const model: Monitor = new Monitor();
+  model._id = MONITOR_ID.toString();
+  model.projectId = PROJECT_ID;
+  model.monitorType = MonitorType.Metrics;
+  model.name = "API latency";
+  return model;
+}
+
+function criteriaInstance(data: {
+  onCallPolicyIds?: Array<ObjectID> | undefined;
+  labelIds?: Array<ObjectID> | undefined;
+}): MonitorCriteriaInstance {
+  const instance: MonitorCriteriaInstance = new MonitorCriteriaInstance();
+  instance.data!.id = "criteria-1";
+  instance.data!.name = "Latency > 1s";
+  instance.data!.createIncidents = false;
+  instance.data!.createAlerts = true;
+  instance.data!.alerts = [
+    {
+      id: "alert-template-1",
+      title: "Latency is high",
+      description: "API latency breached 1s.",
+      alertSeverityId: SEVERITY_ID,
+      autoResolveAlert: false,
+      onCallPolicyIds: data.onCallPolicyIds,
+      labelIds: data.labelIds,
+    },
+  ];
+  return instance;
+}
+
+const dataToProcess: ProbeMonitorResponse = {
+  projectId: PROJECT_ID,
+  monitorId: MONITOR_ID,
+  monitoredAt: new Date("2026-09-23T03:33:00.000Z"),
+} as unknown as ProbeMonitorResponse;
+
+const NO_AUTO_RESOLVE: Dictionary<Array<string>> = {};
+
+function withProject<T extends DatabaseBaseModel>(
+  model: T,
+  id: string,
+  projectId: ObjectID,
+): T {
+  model._id = id;
+  model.setValue("projectId", projectId);
+  return model;
+}
+
+/*
+ * isUsableInProject reads `{ _id, projectId }` with findOneBy. Answer it the
+ * way Postgres would from these rows: a record from another project, or one
+ * that is not there, is not found.
+ */
+function registerRecords(
+  service: { findOneBy: unknown },
+  records: Array<DatabaseBaseModel>,
+): jest.Mock {
+  const findOneBy: jest.Mock = jest.fn(async (findBy: unknown) => {
+    const query: { _id?: unknown; projectId?: unknown } = (
+      findBy as { query: { _id?: unknown; projectId?: unknown } }
+    ).query;
+
+    return (
+      records.find((record: DatabaseBaseModel) => {
+        return (
+          record._id === String(query._id).toLowerCase() &&
+          record.getValue<ObjectID>("projectId")?.toString() ===
+            String(query.projectId)
+        );
+      }) || null
+    );
+  }) as unknown as jest.Mock;
+
+  jest
+    .spyOn(service as never, "findOneBy" as never)
+    .mockImplementation(findOneBy as never);
+
+  return findOneBy;
+}
+
+function idsOn(
+  relation: Array<{ _id?: string | undefined }> | undefined,
+): Array<string> {
+  return (relation || []).map((item: { _id?: string | undefined }): string => {
+    return String(item._id);
+  });
+}
+
+async function openAlert(instance: MonitorCriteriaInstance): Promise<void> {
+  await MonitorAlert.criteriaMetCreateAlertsAndUpdateMonitorStatus({
+    criteriaInstance: instance,
+    monitor: monitor(),
+    dataToProcess: dataToProcess,
+    rootCause: "Latency is above 1s",
+    autoResolveCriteriaInstanceIdAlertIdsDictionary: NO_AUTO_RESOLVE,
+    props: {},
+  });
+}
+
+describe("MonitorAlert drops criteria references the project cannot use", () => {
+  let createdAlerts: Array<Alert> = [];
+  let policyLookup: jest.Mock;
+  let labelLookup: jest.Mock;
+
+  beforeEach(() => {
+    createdAlerts = [];
+
+    // No alert is already open for this monitor.
+    jest.spyOn(AlertService, "findBy").mockResolvedValue([]);
+
+    registerRecords(AlertSeverityService, [
+      withProject(new AlertSeverity(), SEVERITY_ID.toString(), PROJECT_ID),
+    ]);
+
+    policyLookup = registerRecords(OnCallDutyPolicyService, [
+      withProject(new OnCallDutyPolicy(), OWN_POLICY_ID, PROJECT_ID),
+      withProject(new OnCallDutyPolicy(), FOREIGN_POLICY_ID, OTHER_PROJECT_ID),
+    ]);
+
+    labelLookup = registerRecords(LabelService, [
+      withProject(new Label(), OWN_LABEL_ID, PROJECT_ID),
+      withProject(new Label(), FOREIGN_LABEL_ID, OTHER_PROJECT_ID),
+    ]);
+
+    jest
+      .spyOn(MonitorResourceContextUtil, "resolveResourceContextForMonitor")
+      .mockResolvedValue({
+        hostIds: [],
+        dockerHostIds: [],
+        podmanHostIds: [],
+        kubernetesClusterIds: [],
+        serviceIds: [],
+        proxmoxClusterIds: [],
+        vmwareVCenterIds: [],
+        cephClusterIds: [],
+        dockerSwarmClusterIds: [],
+        iotFleetIds: [],
+      });
+
+    jest
+      .spyOn(NetworkDeviceOwnerUserService, "getDeviceOwnersForMonitor")
+      .mockResolvedValue({ ownerUserIds: [], ownerTeamIds: [] });
+
+    jest
+      .spyOn(AlertService, "create")
+      .mockImplementation(async (createBy: unknown): Promise<Alert> => {
+        const alert: Alert = (createBy as { data: Alert }).data;
+        createdAlerts.push(alert);
+        alert._id = new ObjectID(
+          "77777777-7777-4777-8777-777777777777",
+        ).toString();
+        return alert;
+      });
+
+    jest.spyOn(AlertService, "addOwners").mockResolvedValue(undefined);
+
+    jest.spyOn(logger, "error").mockImplementation(() => {
+      return undefined as never;
+    });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("opens the alert with the usable on-call policies and logs the rest", async () => {
+    await openAlert(
+      criteriaInstance({
+        onCallPolicyIds: [
+          new ObjectID(OWN_POLICY_ID),
+          new ObjectID(FOREIGN_POLICY_ID),
+          new ObjectID(DELETED_POLICY_ID),
+        ],
+      }),
+    );
+
+    expect(createdAlerts).toHaveLength(1);
+    expect(idsOn(createdAlerts[0]!.onCallDutyPolicies)).toEqual([
+      OWN_POLICY_ID,
+    ]);
+
+    const logged: string = JSON.stringify(
+      (logger.error as unknown as jest.Mock).mock.calls,
+    );
+    expect(logged).toContain(FOREIGN_POLICY_ID);
+    expect(logged).toContain(DELETED_POLICY_ID);
+    expect(logged).not.toContain(`on-call policy ${OWN_POLICY_ID}`);
+    expect(logged).toContain("Creating the alert without it.");
+  });
+
+  it("opens the alert with the usable labels and logs the rest", async () => {
+    await openAlert(
+      criteriaInstance({
+        labelIds: [new ObjectID(FOREIGN_LABEL_ID), new ObjectID(OWN_LABEL_ID)],
+      }),
+    );
+
+    expect(createdAlerts).toHaveLength(1);
+    expect(idsOn(createdAlerts[0]!.labels)).toEqual([OWN_LABEL_ID]);
+    expect(
+      JSON.stringify((logger.error as unknown as jest.Mock).mock.calls),
+    ).toContain(`label ${FOREIGN_LABEL_ID}`);
+  });
+
+  it("checks each list against its own model", async () => {
+    /*
+     * A label id is not a policy. If the lists were looked up in the wrong
+     * table, the own label would be dropped as unknown here.
+     */
+    await openAlert(
+      criteriaInstance({
+        onCallPolicyIds: [new ObjectID(OWN_POLICY_ID)],
+        labelIds: [new ObjectID(OWN_LABEL_ID)],
+      }),
+    );
+
+    expect(idsOn(createdAlerts[0]!.onCallDutyPolicies)).toEqual([
+      OWN_POLICY_ID,
+    ]);
+    expect(idsOn(createdAlerts[0]!.labels)).toEqual([OWN_LABEL_ID]);
+    expect(logger.error).not.toHaveBeenCalled();
+  });
+
+  it("checks the ids against the monitor's own project", async () => {
+    await openAlert(
+      criteriaInstance({
+        onCallPolicyIds: [new ObjectID(OWN_POLICY_ID)],
+        labelIds: [new ObjectID(OWN_LABEL_ID)],
+      }),
+    );
+
+    for (const lookup of [policyLookup, labelLookup]) {
+      expect(lookup).toHaveBeenCalledTimes(1);
+
+      const query: { projectId?: unknown } = (
+        lookup.mock.calls[0]![0] as { query: { projectId?: unknown } }
+      ).query;
+
+      expect(String(query.projectId)).toBe(PROJECT_ID.toString());
+    }
+  });
+
+  it("still opens the alert when every criteria reference is stale", async () => {
+    await openAlert(
+      criteriaInstance({
+        onCallPolicyIds: [new ObjectID(FOREIGN_POLICY_ID)],
+        labelIds: [new ObjectID(FOREIGN_LABEL_ID)],
+      }),
+    );
+
+    expect(createdAlerts).toHaveLength(1);
+    expect(createdAlerts[0]!.onCallDutyPolicies).toEqual([]);
+    expect(createdAlerts[0]!.labels).toEqual([]);
+  });
+
+  it("drops a value that is not a uuid without looking it up", async () => {
+    /*
+     * Postgres would reject the cast, failing the create just like the
+     * foreign id would have.
+     */
+    await openAlert(
+      criteriaInstance({
+        labelIds: [
+          {
+            toString: () => {
+              return "not-a-uuid";
+            },
+          } as unknown as ObjectID,
+          new ObjectID(OWN_LABEL_ID),
+        ],
+      }),
+    );
+
+    expect(idsOn(createdAlerts[0]!.labels)).toEqual([OWN_LABEL_ID]);
+    expect(labelLookup).toHaveBeenCalledTimes(1);
+  });
+
+  it("looks nothing up when the criteria names no policy or label", async () => {
+    await openAlert(criteriaInstance({}));
+
+    expect(createdAlerts).toHaveLength(1);
+    expect(createdAlerts[0]!.onCallDutyPolicies).toEqual([]);
+    expect(createdAlerts[0]!.labels).toEqual([]);
+    expect(policyLookup).not.toHaveBeenCalled();
+    expect(labelLookup).not.toHaveBeenCalled();
+  });
+});

package/Tests/Server/Utils/Monitor/MonitorCriteriaEvaluatorBreachingSamples.test.ts

@@ -1098,4 +1098,59 @@ describe("Breaching Samples - as plain text", () => {
     expect(lines).toContain(`${iso(19)} — 20`);
     expect(lines).toContain("host.name: host-20");
   });
+
+  /*
+   * OpenTelemetry keys and values are snake_case, and the cap note is
+   * _italic_. convertToPlainText used to strip emphasis before code, with a
+   * regex that crossed newlines, so the "_" in `http.status_code` paired
+   * with the next underscore anywhere below it and both were deleted: the
+   * SMS read "http.statuscode: 503" and "... breaching samples._".
+   */
+  test("snake_case keys, values and metric names survive, and the cap note closes cleanly", () => {
+    const samples: Array<MetricBreachingSample> = [];
+
+    for (let i: number = 1; i <= 25; i++) {
+      samples.push({
+        value: 4 + i,
+        timestamp: at(i - 1),
+        attributes: {
+          "http.status_code": 503,
+          "k8s.pod.name": `checkout_api-${i}`,
+        },
+      });
+    }
+
+    const ctx: MetricCriteriaContext = makeContext({
+      metricName: "http_server_request_errors",
+      unit: null,
+      groupBy: ["http.status_code", "k8s.pod.name"],
+      totalSamplesInWindow: 100,
+      breachingSamples: samples,
+    });
+
+    const lines: Array<string> = Markdown.convertToPlainText(
+      section(ctx),
+    ).split("\n");
+
+    expect(lines.slice(0, 8)).toEqual([
+      "Breaching Samples",
+      "25 of 100 samples breached the threshold.",
+      `${iso(0)} — 5`,
+      "http.status_code: 503",
+      "k8s.pod.name: checkout_api-1",
+      `${iso(1)} — 6`,
+      "http.status_code: 503",
+      "k8s.pod.name: checkout_api-2",
+    ]);
+    expect(lines).toContain("k8s.pod.name: checkout_api-20");
+    expect(lines[lines.length - 1]).toBe(
+      "Showing the first 20 of 25 breaching samples.",
+    );
+
+    const wholeRootCause: string = Markdown.convertToPlainText(rootCause(ctx));
+
+    expect(wholeRootCause).toContain("http_server_request_errors");
+    expect(wholeRootCause).not.toContain("statuscode");
+    expect(wholeRootCause).not.toContain("samples._");
+  });
 });

package/Tests/Server/Utils/Monitor/MonitorEmailAddressRedaction.test.ts

@@ -0,0 +1,255 @@
+import {
+  redactMonitorEmailAddress,
+  redactMonitorSecret,
+} from "../../../../Server/Utils/Monitor/MonitorPayloadRedaction";
+import { REDACTED } from "../../../../Server/Utils/LogRedaction";
+import { JSONObject } from "../../../../Types/JSON";
+import ObjectID from "../../../../Types/ObjectID";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * An Incoming Email monitor with a custom address receives mail at
+ * `{name}@{inboundDomain}` rather than at `monitor-{secretKey}@...`. That name
+ * is now the credential: whoever reads it can send mail the monitor counts. It
+ * reaches the stored payload the same way the generated address did -- in
+ * `emailTo`, `To:`, `Delivered-To:` and `Received:` -- and from there columns a
+ * Viewer can select.
+ *
+ * `redactMonitorEmailAddress` masks it. The hard part is what it must NOT
+ * touch: a custom name is an ordinary word, so a naive substring sweep would
+ * eat subjects, bodies and the sender's own address -- which is evidence, and
+ * which the "Email from" criteria evaluate.
+ */
+
+const DOMAIN: string = "inbound.oneuptime.example";
+const NAME: string = "backups";
+const ADDRESS: string = `${NAME}@${DOMAIN}`;
+const MASKED: string = `${REDACTED}@${DOMAIN}`;
+
+type EmailPayloadFunction = () => JSONObject;
+
+const emailPayload: EmailPayloadFunction = (): JSONObject => {
+  return {
+    emailFrom: "backups@acme.example",
+    emailTo: ADDRESS,
+    emailSubject: "Nightly backups completed",
+    emailBody: `Backups finished. Replies go to ${ADDRESS}.`,
+    emailHeaders: {
+      To: `Backups Bot <${ADDRESS}>`,
+      From: "Backups <backups@acme.example>",
+      "Delivered-To": ADDRESS,
+      Received: `by mx.sendgrid.net with SMTP id xW9 for <${ADDRESS}>; Sun, 23 Aug 2026 10:00:00 +0000`,
+    },
+    attachments: [
+      { filename: "backups.log", contentType: "text/plain", size: 2048 },
+    ],
+  };
+};
+
+type RedactFunction = (payload: JSONObject) => JSONObject;
+
+const redact: RedactFunction = (payload: JSONObject): JSONObject => {
+  return redactMonitorEmailAddress(payload, {
+    localPart: NAME,
+    domain: DOMAIN,
+  });
+};
+
+describe("redactMonitorEmailAddress - the custom address is masked", () => {
+  it("leaves the full address nowhere in the payload", () => {
+    const result: JSONObject = redact(emailPayload());
+
+    expect(JSON.stringify(result).toLowerCase()).not.toContain(ADDRESS);
+  });
+
+  it("masks the recipient but keeps the inbound domain readable", () => {
+    const result: JSONObject = redact(emailPayload());
+
+    expect(result["emailTo"]).toBe(MASKED);
+  });
+
+  it("masks the To:, Delivered-To: and Received: copies", () => {
+    const headers: JSONObject = redact(emailPayload())[
+      "emailHeaders"
+    ] as JSONObject;
+
+    expect(headers["To"]).toBe(`Backups Bot <${MASKED}>`);
+    expect(headers["Delivered-To"]).toBe(MASKED);
+    expect(headers["Received"]).toBe(
+      `by mx.sendgrid.net with SMTP id xW9 for <${MASKED}>; Sun, 23 Aug 2026 10:00:00 +0000`,
+    );
+  });
+
+  it("masks a copy in the body", () => {
+    expect(redact(emailPayload())["emailBody"]).toBe(
+      `Backups finished. Replies go to ${MASKED}.`,
+    );
+  });
+
+  it("masks the address whatever case a relay used", () => {
+    const result: JSONObject = redact({
+      emailTo: ADDRESS.toUpperCase(),
+      emailHeaders: { To: `BaCkUpS@${DOMAIN.toUpperCase()}` },
+    });
+
+    expect(JSON.stringify(result).toLowerCase()).not.toContain(ADDRESS);
+    expect(result["emailTo"]).toBe(`${REDACTED}@${DOMAIN.toUpperCase()}`);
+  });
+
+  it("masks every occurrence in one string", () => {
+    expect(
+      redact({ emailBody: `${ADDRESS}, ${ADDRESS};${ADDRESS}` })["emailBody"],
+    ).toBe(`${MASKED}, ${MASKED};${MASKED}`);
+  });
+
+  it("masks header names too, which are no more trustworthy than values", () => {
+    const result: JSONObject = redact({
+      emailHeaders: { [`rfc822;${ADDRESS}`]: "1" },
+    });
+
+    expect(JSON.stringify(result)).not.toContain(ADDRESS);
+  });
+});
+
+describe("redactMonitorEmailAddress - the evidence survives", () => {
+  it("keeps the sender's own address, even when it shares the name", () => {
+    /*
+     * backups@acme.example sending to backups@<inbound> is exactly the setup a
+     * customer is likely to pick. The sender is evidence, and "Email from"
+     * criteria read it.
+     */
+    const result: JSONObject = redact(emailPayload());
+    const headers: JSONObject = result["emailHeaders"] as JSONObject;
+
+    expect(result["emailFrom"]).toBe("backups@acme.example");
+    expect(headers["From"]).toBe("Backups <backups@acme.example>");
+  });
+
+  it("keeps the name where it is just a word", () => {
+    const result: JSONObject = redact(emailPayload());
+
+    expect(result["emailSubject"]).toBe("Nightly backups completed");
+    expect(result["attachments"]).toEqual([
+      { filename: "backups.log", contentType: "text/plain", size: 2048 },
+    ]);
+  });
+
+  it("leaves a longer mailbox that merely ends in the name alone", () => {
+    // nightly-backups@ is a different mailbox (maybe another monitor's).
+    const other: string = `nightly-${ADDRESS}`;
+
+    expect(redact({ emailTo: other })["emailTo"]).toBe(other);
+    expect(redact({ emailTo: `x.${ADDRESS}` })["emailTo"]).toBe(`x.${ADDRESS}`);
+  });
+
+  it("does not mutate the payload it was given", () => {
+    const payload: JSONObject = emailPayload();
+    const before: string = JSON.stringify(payload);
+
+    redact(payload);
+
+    expect(JSON.stringify(payload)).toBe(before);
+  });
+
+  it("passes live Dates and ObjectIDs through untouched", () => {
+    const receivedAt: Date = new Date("2026-08-23T10:00:00.000Z");
+    const monitorId: ObjectID = new ObjectID(
+      "8f14e45f-ceea-467a-9575-1b0d0d3e7a9c",
+    );
+
+    const result: JSONObject = redactMonitorEmailAddress(
+      {
+        emailTo: ADDRESS,
+        emailReceivedAt: receivedAt,
+        monitorId: monitorId,
+      } as unknown as JSONObject,
+      { localPart: NAME, domain: DOMAIN },
+    );
+
+    expect(result["emailTo"]).toBe(MASKED);
+
+    expect(result["emailReceivedAt"]).toBe(receivedAt);
+    expect(result["monitorId"]).toBe(monitorId);
+  });
+});
+
+describe("redactMonitorEmailAddress - edges", () => {
+  it.each([null, undefined, ""])(
+    "is a no-op when the monitor has no custom name (%p)",
+    (localPart: string | null | undefined) => {
+      const payload: JSONObject = emailPayload();
+
+      expect(
+        redactMonitorEmailAddress(payload, {
+          localPart: localPart,
+          domain: DOMAIN,
+        }),
+      ).toBe(payload);
+    },
+  );
+
+  it("passes null and undefined payloads through", () => {
+    expect(
+      redactMonitorEmailAddress(null, { localPart: NAME, domain: DOMAIN }),
+    ).toBeNull();
+    expect(
+      redactMonitorEmailAddress(undefined, {
+        localPart: NAME,
+        domain: DOMAIN,
+      }),
+    ).toBeUndefined();
+  });
+
+  it("over-redacts rather than leaks when the inbound domain is unknown", () => {
+    const result: JSONObject = redactMonitorEmailAddress(emailPayload(), {
+      localPart: NAME,
+      domain: undefined,
+    });
+
+    expect(JSON.stringify(result).toLowerCase()).not.toContain(ADDRESS);
+    expect(result["emailTo"]).toBe(MASKED);
+  });
+});
+
+describe("redactMonitorSecret - unchanged by the shared sweep", () => {
+  /*
+   * redactMonitorEmailAddress reuses the walker behind redactMonitorSecret.
+   * These pin that the generated-address path still behaves exactly as before.
+   */
+  const SECRET: string = "b1946ac9-2492-4b0f-9b2f-ee9b6cbe36ba";
+  const GENERATED: string = `monitor-${SECRET}@${DOMAIN}`;
+
+  it("masks the key inside the generated address, keeping the rest", () => {
+    const result: JSONObject = redactMonitorSecret(
+      {
+        emailTo: GENERATED,
+        emailHeaders: { [`X-${SECRET}`]: GENERATED.toUpperCase() },
+      },
+      SECRET,
+    );
+
+    expect(result["emailTo"]).toBe(`monitor-${REDACTED}@${DOMAIN}`);
+    expect(JSON.stringify(result).toLowerCase()).not.toContain(SECRET);
+  });
+
+  it("still ignores a secret too short to be one we minted", () => {
+    const payload: JSONObject = { emailSubject: "abc" };
+
+    expect(redactMonitorSecret(payload, "abc")).toBe(payload);
+  });
+
+  it("composes with the custom-address redaction", () => {
+    const result: JSONObject = redactMonitorEmailAddress(
+      redactMonitorSecret(
+        { emailTo: ADDRESS, emailBody: `old address ${GENERATED}` },
+        SECRET,
+      ),
+      { localPart: NAME, domain: DOMAIN },
+    );
+
+    expect(result["emailTo"]).toBe(MASKED);
+    expect(result["emailBody"]).toBe(
+      `old address monitor-${REDACTED}@${DOMAIN}`,
+    );
+  });
+});