@oneuptime/common 14.0.7 → 14.0.9

package/Server/Utils/CustomField/CustomFieldRename.ts

@@ -0,0 +1,378 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import TableView from "../../../Models/DatabaseModels/TableView";
+import {
+  CustomFieldSavedViewState,
+  RenamedCustomFieldSavedViewState,
+  renameCustomFieldInSavedView,
+} from "../../../Types/CustomField/CustomFieldSavedViews";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
+import { JSONObject } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import DatabaseService from "../../Services/DatabaseService";
+import TableViewService from "../../Services/TableViewService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import logger, { LogAttributes } from "../Logger";
+import { ColumnMetadata } from "typeorm/metadata/ColumnMetadata";
+import { EntityManager, EntityMetadata, Repository } from "typeorm";
+
+/*
+ * RENAMING A CUSTOM FIELD.
+ *
+ * Custom field values live in each record's `customFields` jsonb bag, keyed
+ * by the field's display name, so renaming "Impact" to "Business Impact"
+ * orphans every stored value unless the key moves with it. This moves it:
+ * one UPDATE per table, for the whole project, that takes the value out from
+ * under the old key and puts it back under the new one - and does the same
+ * to the saved table views that name the field.
+ *
+ * THE NEW NAME STARTS CLEAN. Deleting a field leaves its values in the
+ * records (see the custom fields docs), so a record can hold a value under
+ * the new name that belongs to no field: a deleted field's answer. The
+ * renamed field must not pick those up - they were never its values, and an
+ * incident field marked for subscriber notifications would send them out -
+ * so the same UPDATE removes the new name from every record of the project
+ * that holds nothing under the old one. After a rename, the values under the
+ * new name are exactly the ones that were under the old.
+ *
+ * WHY NOT DatabaseService.updateBy. It fires the model's "on update" workflow
+ * trigger for every changed row, even with ignoreHooks (see _updateBy), and
+ * customers' own workflows listen on incident custom fields. A rename is a
+ * change of label, not of any incident's answers; it must not start a
+ * workflow run per incident. The raw statements here fire no workflow, no
+ * realtime event and no audit entry, bump no `version`, and leave `updatedAt`
+ * alone, like the other derived-data writes (CustomFieldMappingService).
+ *
+ * The table and column names come from the entity metadata, never from the
+ * caller, and every value is a bound parameter, so the SQL is not an
+ * injection surface.
+ */
+
+export interface MoveCustomFieldValueKeyInput {
+  // The service whose table holds values under the field's name.
+  service: DatabaseService<any>;
+  projectId: ObjectID;
+  oldName: string;
+  newName: string;
+  // The transaction to run the statement in; on its own when not given.
+  manager?: EntityManager | undefined;
+}
+
+type GetColumnNameFunction = (
+  metadata: EntityMetadata,
+  propertyName: string,
+) => string;
+
+const getColumnName: GetColumnNameFunction = (
+  metadata: EntityMetadata,
+  propertyName: string,
+): string => {
+  const column: ColumnMetadata | undefined =
+    metadata.findColumnWithPropertyName(propertyName);
+
+  if (!column) {
+    throw new Error(
+      `Cannot rename a custom field on ${metadata.tableName}: it has no "${propertyName}" column.`,
+    );
+  }
+
+  return column.databaseName;
+};
+
+export interface MoveCustomFieldValueKeyResult {
+  // Records whose value moved from the old name to the new one.
+  moved: number;
+  // Records that held a value under the new name only, now removed.
+  cleared: number;
+}
+
+/**
+ * Move every value stored under `oldName` to `newName`, on every record of
+ * the project in the service's table, and clear what records that hold
+ * nothing under `oldName` have under `newName`.
+ *
+ * Only records whose bag is a JSON object holding one of the two names are
+ * written. A value the record already held under `newName` is replaced by
+ * the one under `oldName`, or removed when there is none: the renamed
+ * field's answer is the only one that counts. One statement, so no reader
+ * sees the values half moved.
+ */
+export const moveCustomFieldValueKey: (
+  input: MoveCustomFieldValueKeyInput,
+) => Promise<MoveCustomFieldValueKeyResult> = async (
+  input: MoveCustomFieldValueKeyInput,
+): Promise<MoveCustomFieldValueKeyResult> => {
+  if (!input.oldName || !input.newName || input.oldName === input.newName) {
+    return { moved: 0, cleared: 0 };
+  }
+
+  const repository: Repository<BaseModel> = input.service.getRepository();
+  const metadata: EntityMetadata = repository.metadata;
+  const customFieldsColumn: string = getColumnName(metadata, "customFields");
+  const projectIdColumn: string = getColumnName(metadata, "projectId");
+
+  /*
+   * In a CTE so the statement answers with the rows it wrote: TypeORM hands
+   * back a top-level UPDATE as [rows, rowCount] whatever happened. RETURNING
+   * reads the row as written, so a record holds the new name afterwards
+   * exactly when its value was moved there.
+   *
+   * jsonb_typeof guards the operators: on a jsonb array `-` and `?` act on
+   * the array's string elements, and a bag that is not an object is not a
+   * bag of named values to rename.
+   */
+  const sql: string = `WITH "renamed" AS (
+    UPDATE "${metadata.tableName}"
+    SET "${customFieldsColumn}" = CASE
+      WHEN jsonb_exists("${customFieldsColumn}", $2::text)
+        THEN ("${customFieldsColumn}" - $2::text) || jsonb_build_object($3::text, "${customFieldsColumn}" -> $2::text)
+      ELSE "${customFieldsColumn}" - $3::text
+    END
+    WHERE "${projectIdColumn}" = $1
+      AND jsonb_typeof("${customFieldsColumn}") = 'object'
+      AND (
+        jsonb_exists("${customFieldsColumn}", $2::text)
+        OR jsonb_exists("${customFieldsColumn}", $3::text)
+      )
+    RETURNING jsonb_exists("${customFieldsColumn}", $3::text) AS "moved"
+  ) SELECT
+    (COUNT(*) FILTER (WHERE "moved"))::int AS "moved",
+    (COUNT(*) FILTER (WHERE NOT "moved"))::int AS "cleared"
+  FROM "renamed"`;
+
+  const manager: EntityManager = input.manager || repository.manager;
+
+  const result: unknown = await manager.query(sql, [
+    input.projectId.toString(),
+    input.oldName,
+    input.newName,
+  ]);
+
+  const row: JSONObject | undefined = Array.isArray(result)
+    ? (result[0] as JSONObject | undefined)
+    : undefined;
+
+  return {
+    moved: Number(row?.["moved"]) || 0,
+    cleared: Number(row?.["cleared"]) || 0,
+  };
+};
+
+export interface RenameCustomFieldInTableViewsInput {
+  projectId: ObjectID;
+  // The saved views to look at, by TableView.tableId.
+  tableIds: Array<string>;
+  oldName: string;
+  newName: string;
+}
+
+/**
+ * Rewrite the saved table views of the project that name the field, so a
+ * view keeps its column and its filter chip after the rename. Returns how
+ * many views it rewrote.
+ *
+ * Each view is written with a compare-and-set on the columns it was read
+ * with, so a view someone saves at the same moment is left as they saved it
+ * rather than half overwritten.
+ */
+export const renameCustomFieldInTableViews: (
+  input: RenameCustomFieldInTableViewsInput,
+) => Promise<number> = async (
+  input: RenameCustomFieldInTableViewsInput,
+): Promise<number> => {
+  if (
+    !input.oldName ||
+    !input.newName ||
+    input.oldName === input.newName ||
+    input.tableIds.length === 0
+  ) {
+    return 0;
+  }
+
+  const views: Array<TableView> = await TableViewService.findBy({
+    query: {
+      projectId: input.projectId,
+      tableId: QueryHelper.any(input.tableIds),
+    },
+    select: {
+      _id: true,
+      query: true,
+      facets: true,
+      columns: true,
+    },
+    limit: LIMIT_MAX,
+    skip: 0,
+    props: {
+      isRoot: true,
+    },
+  });
+
+  let renamedCount: number = 0;
+
+  for (const view of views) {
+    const current: CustomFieldSavedViewState = {
+      query: (view.query as unknown as JSONObject | undefined) ?? null,
+      facets: view.facets ?? null,
+      columns: view.columns ?? null,
+    };
+
+    const renamed: RenamedCustomFieldSavedViewState =
+      renameCustomFieldInSavedView({
+        view: current,
+        oldName: input.oldName,
+        newName: input.newName,
+      });
+
+    if (!renamed.hasChanged || !view.id) {
+      continue;
+    }
+
+    const data: Record<string, unknown> = {};
+    const expectedData: Record<string, unknown> = {};
+
+    for (const key of Object.keys(renamed.changes) as Array<
+      keyof CustomFieldSavedViewState
+    >) {
+      data[key] = renamed.changes[key];
+      expectedData[key] = current[key];
+    }
+
+    await TableViewService.updateColumnsByIdWithoutHooks({
+      id: view.id,
+      data: data as never,
+      expectedData: expectedData as never,
+      skipUpdateDateColumn: true,
+    });
+
+    renamedCount++;
+  }
+
+  return renamedCount;
+};
+
+export interface RenameCustomFieldInput {
+  projectId: ObjectID;
+  oldName: string;
+  newName: string;
+  // Every service whose table stores values under the field's name.
+  valueServices: Array<DatabaseService<any>>;
+  // The saved views of tables that show the field.
+  tableViewIds: Array<string>;
+  // How the field is named in logs, e.g. "incident custom field".
+  definitionName: string;
+  /*
+   * Called when the values could not be moved, and are all still under the
+   * old name, before the failure is thrown: the caller gives the field its
+   * old name back, so the values stay in view (see renameCustomField).
+   */
+  onValuesNotMoved?: (() => Promise<void>) | undefined;
+}
+
+export interface RenameCustomFieldResult {
+  movedRecordsByTable: Record<string, number>;
+  // Records whose stale value under the new name was removed, by table.
+  clearedRecordsByTable: Record<string, number>;
+  renamedTableViews: number;
+}
+
+/**
+ * Everything a rename has to move: the stored values in each table, then the
+ * saved views.
+ *
+ * The values move in one transaction across the tables, so either every
+ * table holds them under the new name or none does. That matters because
+ * the move also clears stale values under the new name: had one table moved
+ * and another not, renaming the field back would clear the values the
+ * second table still held under the old name. When the transaction fails,
+ * onValuesNotMoved runs - the caller puts the field's old name back, so the
+ * field and its values agree again - and the failure is thrown. A saved view
+ * that could not be rewritten only loses the field's column or filter, and
+ * throws too.
+ */
+export const renameCustomField: (
+  input: RenameCustomFieldInput,
+) => Promise<RenameCustomFieldResult> = async (
+  input: RenameCustomFieldInput,
+): Promise<RenameCustomFieldResult> => {
+  const result: RenameCustomFieldResult = {
+    movedRecordsByTable: {},
+    clearedRecordsByTable: {},
+    renamedTableViews: 0,
+  };
+
+  if (!input.oldName || !input.newName || input.oldName === input.newName) {
+    return result;
+  }
+
+  const firstService: DatabaseService<any> | undefined = input.valueServices[0];
+
+  if (firstService) {
+    try {
+      await firstService
+        .getRepository()
+        .manager.transaction(async (manager: EntityManager): Promise<void> => {
+          for (const service of input.valueServices) {
+            const tableName: string =
+              service.getModel().tableName ||
+              service.getRepository().metadata.name;
+
+            const moved: MoveCustomFieldValueKeyResult =
+              await moveCustomFieldValueKey({
+                service: service,
+                projectId: input.projectId,
+                oldName: input.oldName,
+                newName: input.newName,
+                manager: manager,
+              });
+
+            result.movedRecordsByTable[tableName] = moved.moved;
+            result.clearedRecordsByTable[tableName] = moved.cleared;
+          }
+        });
+    } catch (err) {
+      logger.error(
+        `Could not move ${input.definitionName} values from ${JSON.stringify(
+          input.oldName,
+        )} to ${JSON.stringify(input.newName)}; none were moved.`,
+        {
+          projectId: input.projectId.toString(),
+        } as LogAttributes,
+      );
+
+      if (input.onValuesNotMoved) {
+        try {
+          await input.onValuesNotMoved();
+        } catch (restoreError) {
+          logger.error(restoreError, {
+            projectId: input.projectId.toString(),
+          } as LogAttributes);
+        }
+      }
+
+      throw err;
+    }
+  }
+
+  result.renamedTableViews = await renameCustomFieldInTableViews({
+    projectId: input.projectId,
+    tableIds: input.tableViewIds,
+    oldName: input.oldName,
+    newName: input.newName,
+  });
+
+  logger.info(
+    `Renamed ${input.definitionName} values from ${JSON.stringify(
+      input.oldName,
+    )} to ${JSON.stringify(input.newName)}: ${JSON.stringify(
+      result.movedRecordsByTable,
+    )} records moved, ${JSON.stringify(
+      result.clearedRecordsByTable,
+    )} stale values under the new name cleared, ${
+      result.renamedTableViews
+    } saved views.`,
+    {
+      projectId: input.projectId.toString(),
+    } as LogAttributes,
+  );
+
+  return result;
+};

package/Server/Utils/DataSource/EgressGuard.ts

@@ -15,9 +15,10 @@ import logger from "../Logger";
  * It started life guarding external Data Source connections — hence the
  * file's home — but the same policy now covers every sink where a project
  * member picks the host and a self-hosted install may legitimately point at
- * something internal: LLM providers (self-hosted Ollama/vLLM), SMTP OAuth
- * token endpoints, status page / dashboard domain verification, OIDC
- * discovery and Runbook HTTP steps. Sinks that can only ever be third-party
+ * something internal: LLM providers (self-hosted Ollama/vLLM), SMTP servers
+ * (project SMTP settings and the workflow Send Email step), SMTP OAuth token
+ * endpoints, status page / dashboard domain verification, OIDC discovery and
+ * Runbook HTTP steps. Sinks that can only ever be third-party
  * SaaS (Slack, Teams, subscriber webhooks) use SSRFProtection instead, which
  * blocks private ranges unconditionally.
  *
@@ -78,10 +79,21 @@ export interface EgressGuardOptions {
    */
   privateNetworkHint?: string | undefined;
   /*
-   * Detailed DNS failures and address-policy reasons are useful to operators,
-   * but tenant-facing callers can compare them to enumerate internal names.
-   * Defaults to true for backwards compatibility; shared-probe monitor
-   * requests set it to false and receive one indistinguishable failure.
+   * Whether a refused HOSTNAME may say why: which address it resolved to and
+   * which policy refused it, or the resolver's own error. That is exactly what
+   * an operator needs, and exactly what a tenant must not get — trying names
+   * like `redis` or `kubernetes.default.svc.cluster.local` and comparing
+   * "resolves to 10.1.2.3" with "could not resolve" maps the internal network
+   * without a socket ever being opened. With false, every resolve-path refusal
+   * is one sentence ("<Label> host X could not be reached.") and the precise
+   * cause goes to the debug log.
+   *
+   * Undefined ⇒ shouldIncludeResolutionDetail(): detail on a self-hosted
+   * install, where whoever configures the target also runs the network; none
+   * wherever shouldBlockPrivateAddresses() is true, i.e. multi-tenant SaaS or
+   * an operator who asked for SaaS policy. Shared-probe monitor requests pass
+   * false outright, whatever the deployment. Literal IPs are unaffected: their
+   * refusal echoes only what the caller typed.
    */
   includeResolvedAddressInError?: boolean | undefined;
   /*
@@ -196,6 +208,21 @@ export default class DataSourceEgressGuard {
     return process.env["BILLING_ENABLED"] === "true";
   }
 
+  /*
+   * Default for EgressGuardOptions.includeResolvedAddressInError, and for the
+   * equivalent switch on SSRFProtection. It keys off the private-address
+   * POLICY of the deployment, not off any per-call override of it: the oracle
+   * exists because the person choosing the target is not trusted with the
+   * network's layout, and that is a property of the deployment. So a caller
+   * that loosens blockPrivateAddresses on SaaS still gets no detail unless it
+   * asks for it explicitly.
+   */
+  public static shouldIncludeResolutionDetail(
+    includeResolvedAddressInError?: boolean | undefined,
+  ): boolean {
+    return includeResolvedAddressInError ?? !this.shouldBlockPrivateAddresses();
+  }
+
   private static ipv4ToInt(ip: string): number {
     const parts: Array<string> = ip.split(".");
     let value: number = 0;
@@ -672,15 +699,19 @@ export default class DataSourceEgressGuard {
         return this.defaultResolve(host, options);
       });
 
+    const includeDetail: boolean = this.shouldIncludeResolutionDetail(
+      options?.includeResolvedAddressInError,
+    );
+
     let addresses: Array<ResolvedAddress> = [];
     try {
       addresses = await resolveFunction(bareHostname);
     } catch (error) {
-      if (options?.includeResolvedAddressInError === false) {
+      if (!includeDetail) {
         /*
          * The cause is destroyed for the caller by design, so log it here:
-         * this is the only place an operator can still learn whether a
-         * monitor failed on DNS or on address policy.
+         * this is the only place an operator can still learn whether the
+         * target failed on DNS or on address policy.
          */
         logger.debug(
           `EgressGuard: could not resolve ${bareHostname} - ${
@@ -701,7 +732,7 @@ export default class DataSourceEgressGuard {
     }
 
     if (addresses.length === 0) {
-      if (options?.includeResolvedAddressInError === false) {
+      if (!includeDetail) {
         logger.debug(`EgressGuard: ${bareHostname} resolved to no addresses.`);
         throw new EgressGuardException(
           `${label} host ${bareHostname} could not be reached.`,
@@ -720,14 +751,14 @@ export default class DataSourceEgressGuard {
         options,
       );
       if (verdict.blocked) {
-        if (options?.includeResolvedAddressInError === false) {
+        if (!includeDetail) {
           logger.debug(
-            `EgressGuard: ${bareHostname} resolved to a blocked address - ${verdict.reason}.`,
+            `EgressGuard: ${bareHostname} resolved to a blocked address ${resolved.address} - ${verdict.reason}.`,
           );
           /*
            * Reported as Unreachable, NOT AddressBlocked. Sharing one reason
-           * with the DNS branches above is what stops a tenant on a shared
-           * probe from using the difference to enumerate internal names.
+           * with the DNS branches above is what stops a tenant from using the
+           * difference to enumerate internal names.
            */
           throw new EgressGuardException(
             `${label} host ${bareHostname} could not be reached.`,
@@ -798,6 +829,15 @@ export default class DataSourceEgressGuard {
    * that was checked the address that gets dialed, closing the DNS-rebind
    * window between validation and connect. TLS still verifies against the
    * original hostname because SNI is taken from the URL, not from here.
+   *
+   * It always answers asynchronously, the way dns.lookup does. Node's
+   * net/tls connect can fail every pinned address synchronously (a probe
+   * with no IPv6 gets EADDRNOTAVAIL or ENETUNREACH from connect() itself),
+   * and when the lookup has answered synchronously that destroys the
+   * TLSSocket before tls.connect calls setServername on it. The request then
+   * throws "Cannot read properties of null (reading 'setServername')" in
+   * place of the real connect error, and that error escapes as an unhandled
+   * 'error' event on the socket.
    */
   public static createPinnedLookup(
     addresses: Array<ResolvedAddress>,
@@ -823,22 +863,27 @@ export default class DataSourceEgressGuard {
           `No IPv${wantedFamily} address is available for the validated host.`,
         );
         error.code = "ENOTFOUND";
-        callback(error, "");
+        process.nextTick(() => {
+          callback(error, "");
+        });
         return;
       }
 
       if (lookupOptions && lookupOptions.all) {
-        callback(
-          null,
+        const allAddresses: Array<{ address: string; family: number }> =
           usableAddresses.map((resolved: ResolvedAddress) => {
             return { address: resolved.address, family: resolved.family };
-          }),
-        );
+          });
+        process.nextTick(() => {
+          callback(null, allAddresses);
+        });
         return;
       }
 
       const first: ResolvedAddress = usableAddresses[0]!;
-      callback(null, first.address, first.family);
+      process.nextTick(() => {
+        callback(null, first.address, first.family);
+      });
     };
   }
 

package/Server/Utils/Mail/PinnedSmtpSocket.ts

@@ -0,0 +1,130 @@
+import net from "net";
+import DataSourceEgressGuard, {
+  ResolvedAddress,
+} from "../DataSource/EgressGuard";
+
+// What nodemailer's getSocket hook hands back: an already connected socket.
+export type SmtpSocketCallback = (
+  error: Error | null,
+  socketOptions?: { connection: net.Socket },
+) => void;
+
+/*
+ * The socket half of pinning a tenant-chosen SMTP server to the addresses
+ * the egress guard validated.
+ *
+ * Given a host name, nodemailer resolves it again on its own (dns.resolve4/6,
+ * falling back to dns.lookup, behind a process-wide cache kept for five
+ * minutes whatever the record's TTL), so a DNS answer that changed after the
+ * check would choose the address actually connected to. Callers validate the
+ * host, open the socket here, and hand it to nodemailer through its getSocket
+ * hook as `{ connection: socket }`; nodemailer then resolves and dials
+ * nothing itself.
+ *
+ * nodemailer still gets the name the user typed as `host`: it is what TLS
+ * sends as SNI and checks the certificate against, on implicit TLS and on the
+ * STARTTLS upgrade alike.
+ *
+ * Used by the workflow Send Email component and by MailService for project
+ * SMTP configs.
+ */
+export default class PinnedSmtpSocket {
+  /*
+   * Open a TCP connection that can only reach the given, already validated
+   * addresses.
+   *
+   * The pinned lookup answers with every validated address, and
+   * autoSelectFamily tries them in turn, alternating families. That keeps
+   * what nodemailer did when it resolved the name itself: a host whose
+   * address family this worker cannot route (IPv4 on an IPv6-only cluster),
+   * or one record that is down, falls through to the next address instead
+   * of failing the send.
+   *
+   * timeoutInMs bounds the TCP connect. nodemailer's own connectionTimeout
+   * only starts once it is handed the connected socket, so without this a
+   * blackholed address would hang the send.
+   */
+  public static connect(data: {
+    host: string;
+    port: number;
+    addresses: Array<ResolvedAddress>;
+    timeoutInMs: number;
+    onDone: SmtpSocketCallback;
+  }): void {
+    const socket: net.Socket = net.connect({
+      host: data.host,
+      port: data.port,
+      lookup: DataSourceEgressGuard.createPinnedLookup(data.addresses) as never,
+      autoSelectFamily: true,
+    });
+
+    let settled: boolean = false;
+
+    const settle: (error: Error | null) => void = (
+      error: Error | null,
+    ): void => {
+      if (settled) {
+        return;
+      }
+
+      settled = true;
+      socket.setTimeout(0);
+
+      if (error) {
+        // A late error from a socket nobody owns would crash the process.
+        socket.on("error", () => {});
+        socket.destroy();
+        data.onDone(error);
+        return;
+      }
+
+      /*
+       * nodemailer attaches its own error and timeout handlers synchronously
+       * inside this callback, so the socket is never left unwatched. The
+       * listeners below stay behind as no-ops.
+       */
+      data.onDone(null, { connection: socket });
+    };
+
+    socket.once("connect", () => {
+      settle(null);
+    });
+    socket.once("error", (error: Error) => {
+      settle(PinnedSmtpSocket.describeConnectionError(error));
+    });
+    socket.once("timeout", () => {
+      settle(new Error("Connection timeout"));
+    });
+    socket.setTimeout(data.timeoutInMs);
+  }
+
+  /*
+   * When every address fails, autoSelectFamily reports an AggregateError
+   * whose own message is empty, which would reach the user as a generic
+   * "could not be sent". Name each attempt instead, the way nodemailer's
+   * "connect ECONNREFUSED <ip>:<port>" did.
+   */
+  public static describeConnectionError(error: Error): Error {
+    const attempts: unknown = (error as { errors?: unknown }).errors;
+
+    if (error.message || !Array.isArray(attempts) || attempts.length === 0) {
+      return error;
+    }
+
+    const described: NodeJS.ErrnoException = new Error(
+      attempts
+        .map((attempt: unknown) => {
+          const message: unknown = (attempt as { message?: unknown } | null)
+            ?.message;
+          return typeof message === "string" ? message : String(attempt);
+        })
+        .join("; "),
+    );
+    const code: string | undefined = (error as NodeJS.ErrnoException).code;
+    if (code) {
+      described.code = code;
+    }
+
+    return described;
+  }
+}

package/Server/Utils/Monitor/MonitorCriteriaObservationBuilder.ts

@@ -36,6 +36,7 @@ import MonitorMetricType from "../../../Types/Monitor/MonitorMetricType";
 import MonitorCriteriaMessageFormatter from "./MonitorCriteriaMessageFormatter";
 import MonitorCriteriaDataExtractor from "./MonitorCriteriaDataExtractor";
 import MonitorCriteriaExpectationBuilder from "./MonitorCriteriaExpectationBuilder";
+import ProbeNetworkFailureUtil from "../../../Utils/ProbeNetworkFailureUtil";
 import MetricMonitorResponse from "../../../Types/Monitor/MetricMonitor/MetricMonitorResponse";
 import MetricQueryConfigData from "../../../Types/Metrics/MetricQueryConfigData";
 import MetricFormulaConfigData from "../../../Types/Metrics/MetricFormulaConfigData";
@@ -1556,6 +1557,15 @@ export default class MonitorCriteriaObservationBuilder {
       return "Device is reachable (answered ping or SNMP).";
     }
 
+    /*
+     * A probe that could not send at all (no IPv6 on the probe, say) never
+     * contacted the device, so "unreachable" would be a verdict on a device
+     * nobody checked, and would contradict the cause that follows it.
+     */
+    if (ProbeNetworkFailureUtil.isProbeSideCause(probeResponse.failureCause)) {
+      return `Device could not be checked from this probe: ${probeResponse.failureCause}`;
+    }
+
     if (probeResponse.failureCause) {
       return `Device is unreachable by ping and SNMP: ${probeResponse.failureCause}`;
     }