uptime-monitoring/test/monitors.spec.ts

import { applyD1Migrations, env, SELF, type D1Migration } from "cloudflare:test";
import { afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
import { hashPassword } from "../src/worker/lib/password";
import { resolveFavicon } from "../src/worker/routes/monitors";

const ADMIN_PASSWORD = "correct-horse-battery-staple";
const VALID_MONITOR = {
	name: "Example",
	url: "https://example.com/health",
	method: "GET",
	expectedStatus: 200,
	intervalSeconds: 300,
	timeoutMs: 10_000,
};

async function seedAdmin() {
	await env.DB.batch([
		env.DB.prepare("DELETE FROM checks"),
		env.DB.prepare("DELETE FROM incidents"),
		env.DB.prepare("DELETE FROM monitor_daily_stats"),
		env.DB.prepare("DELETE FROM notification_settings"),
		env.DB.prepare("DELETE FROM monitors"),
		env.DB.prepare("DELETE FROM login_attempts"),
		env.DB.prepare("DELETE FROM sessions"),
		env.DB.prepare("DELETE FROM admin_credentials"),
	]);
	const now = Date.now();
	await env.DB.prepare("INSERT INTO admin_credentials (id, password_hash, created_at, updated_at) VALUES (1, ?, ?, ?)")
		.bind(await hashPassword(ADMIN_PASSWORD), now, now)
		.run();
}

async function authenticatedCookie() {
	const response = await SELF.fetch("https://example.com/api/auth/login", {
		method: "POST",
		headers: {
			"Content-Type": "application/json",
			"CF-Connecting-IP": "198.51.100.20",
			Origin: "https://example.com",
		},
		body: JSON.stringify({ password: ADMIN_PASSWORD }),
	});
	return response.headers.get("Set-Cookie")?.split(";", 1)[0] ?? "";
}

function apiFetch(path: string, method = "GET", cookie = "", body?: unknown) {
	return SELF.fetch(`https://example.com${path}`, {
		method,
		headers: {
			...(cookie ? { Cookie: cookie } : {}),
			...(method !== "GET" ? { Origin: "https://example.com" } : {}),
			...(body === undefined ? {} : { "Content-Type": "application/json" }),
		},
		body: body === undefined ? undefined : JSON.stringify(body),
	});
}

async function createMonitor(cookie: string, overrides: Record<string, unknown> = {}) {
	return apiFetch("/api/monitors", "POST", cookie, { ...VALID_MONITOR, ...overrides });
}

describe("monitor API", () => {
	beforeAll(async () => {
		const testEnv = env as Env & { TEST_MIGRATIONS: D1Migration[] };
		await applyD1Migrations(testEnv.DB, testEnv.TEST_MIGRATIONS);
	});
	beforeEach(seedAdmin);
	afterEach(() => vi.unstubAllGlobals());

	it("protects every monitor endpoint, including the collection path without a trailing slash", async () => {
		const requests = [
			apiFetch("/api/monitors"),
			apiFetch("/api/monitors/1/favicon"),
			apiFetch("/api/monitors", "POST", "", VALID_MONITOR),
			apiFetch("/api/monitors/1", "PATCH", "", { name: "Changed" }),
			apiFetch("/api/monitors/1", "DELETE"),
			apiFetch("/api/monitors/1/check", "POST"),
		];
		const responses = await Promise.all(requests);
		for (const response of responses) {
			expect(response.status).toBe(401);
			expect(await response.json()).toEqual({ message: "Authentication required" });
		}
	});

	it("proxies and caches a monitor favicon response", async () => {
		const cookie = await authenticatedCookie();
		const created = await (await createMonitor(cookie, { url: "https://favicon-route.example.test/health" }))
			.json<{ monitor: { id: number } }>();
		vi.stubGlobal("fetch", vi.fn(async (input: RequestInfo | URL) => {
			const url = new URL(input.toString());
			expect(url.href).toBe("https://favicon-route.example.test/favicon.ico");
			return new Response(new Uint8Array([0, 0, 1, 0]), {
				headers: { "Content-Type": "image/x-icon" },
			});
		}));

		const response = await apiFetch(`/api/monitors/${created.monitor.id}/favicon`, "GET", cookie);
		expect(response.status).toBe(200);
		expect(response.headers.get("Content-Type")).toBe("image/x-icon");
		expect(response.headers.get("Cache-Control")).toBe("public, max-age=86400");
		expect(response.headers.get("X-Content-Type-Options")).toBe("nosniff");
		expect(new Uint8Array(await response.arrayBuffer())).toEqual(new Uint8Array([0, 0, 1, 0]));
	});

	it("discovers a favicon declared in the website head", async () => {
		const fetchMock = vi.fn(async (input: RequestInfo | URL) => {
			const url = new URL(input.toString());
			if (url.pathname === "/favicon.ico") return new Response(null, { status: 404 });
			if (url.pathname === "/") {
				return new Response('<html><head><link rel="apple-touch-icon" href="/assets/icon.png"></head></html>', {
					headers: { "Content-Type": "text/html; charset=utf-8" },
				});
			}
			return new Response(new Uint8Array([137, 80, 78, 71]), {
				headers: { "Content-Type": "image/png" },
			});
		});
		vi.stubGlobal("fetch", fetchMock);

		const favicon = await resolveFavicon("https://favicon-head.example.test/status");
		expect(favicon?.contentType).toBe("image/png");
		expect(new Uint8Array(favicon?.body ?? new ArrayBuffer(0))).toEqual(new Uint8Array([137, 80, 78, 71]));
		expect(fetchMock).toHaveBeenCalledTimes(3);
	});

	it("does not fetch favicons from private network hosts", async () => {
		const fetchMock = vi.fn();
		vi.stubGlobal("fetch", fetchMock);

		await expect(resolveFavicon("http://127.0.0.1/admin")).resolves.toBeNull();
		await expect(resolveFavicon("http://[::1]/admin")).resolves.toBeNull();
		await expect(resolveFavicon("http://10.0.0.1/admin")).resolves.toBeNull();
		expect(fetchMock).not.toHaveBeenCalled();
	});

	it("creates a valid monitor and returns it in the list", async () => {
		const cookie = await authenticatedCookie();
		const response = await createMonitor(cookie);
		const created = await response.json<{ monitor: { id: number; name: string; enabled: boolean; alertsEnabled: boolean } }>();

		expect(response.status).toBe(200);
		expect(created.monitor).toMatchObject({ name: "Example", enabled: true, alertsEnabled: true });

		const listResponse = await apiFetch("/api/monitors", "GET", cookie);
		const list = await listResponse.json<{ monitors: Array<{ id: number; url: string }> }>();
		expect(list.monitors).toHaveLength(1);
		expect(list.monitors[0]).toMatchObject({ id: created.monitor.id, url: "https://example.com/health" });
	});

	it.each([
		[{ url: "file:///etc/passwd" }, "Enter a valid http or https URL"],
		[{ intervalSeconds: 60 }, "intervalSeconds must be an integer between 300 and 86400"],
		[{ expectedStatus: 99 }, "expectedStatus must be an integer between 100 and 599"],
	] as const)("rejects invalid monitor input %o", async (overrides, message) => {
		const response = await createMonitor(await authenticatedCookie(), overrides);
		expect(response.status).toBe(400);
		expect(await response.json()).toEqual({ message });
	});

	it("patches only the requested fields", async () => {
		const cookie = await authenticatedCookie();
		const created = await (await createMonitor(cookie)).json<{ monitor: { id: number } }>();
		const response = await apiFetch(`/api/monitors/${created.monitor.id}`, "PATCH", cookie, {
			name: "Renamed endpoint",
			enabled: false,
		});
		const body = await response.json<{ monitor: { name: string; url: string; enabled: boolean } }>();

		expect(response.status).toBe(200);
		expect(body.monitor).toMatchObject({
			name: "Renamed endpoint",
			url: "https://example.com/health",
			enabled: false,
		});
	});

	it("returns detail, checks, incidents, and raw stats", async () => {
		const cookie = await authenticatedCookie();
		const created = await (await createMonitor(cookie)).json<{ monitor: { id: number } }>();
		const id = created.monitor.id;
		const now = Date.now();
		await env.DB.batch([
			env.DB.prepare("INSERT INTO checks (monitor_id, ok, status_code, latency_ms, checked_at) VALUES (?, 1, 200, 100, ?)").bind(id, now - 2000),
			env.DB.prepare("INSERT INTO checks (monitor_id, ok, status_code, latency_ms, checked_at) VALUES (?, 0, 500, 300, ?)").bind(id, now - 1000),
			env.DB.prepare("INSERT INTO incidents (monitor_id, started_at, start_status_code, start_error, created_at, updated_at) VALUES (?, ?, 500, 'Down', ?, ?)").bind(id, now - 1000, now - 1000, now - 1000),
		]);

		const [detail, checksResponse, incidentsResponse, statsResponse] = await Promise.all([
			apiFetch(`/api/monitors/${id}`, "GET", cookie),
			apiFetch(`/api/monitors/${id}/checks`, "GET", cookie),
			apiFetch(`/api/monitors/${id}/incidents`, "GET", cookie),
			apiFetch(`/api/monitors/${id}/stats`, "GET", cookie),
		]);
		expect((await detail.json<{ monitor: { id: number } }>()).monitor.id).toBe(id);
		expect((await checksResponse.json<{ checks: unknown[] }>()).checks).toHaveLength(2);
		expect((await incidentsResponse.json<{ incidents: unknown[] }>()).incidents).toHaveLength(1);
		const stats = await statsResponse.json<{ windows: { "24h": { uptimePct: number; totalChecks: number; upChecks: number; avgLatencyMs: number; incidentCount: number } } }>();
		expect(stats.windows["24h"]).toEqual({ uptimePct: 50, totalChecks: 2, upChecks: 1, avgLatencyMs: 200, incidentCount: 1 });
	});

	it("combines daily rollups with the current partial day for long-range stats", async () => {
		const cookie = await authenticatedCookie();
		const created = await (await createMonitor(cookie)).json<{ monitor: { id: number } }>();
		const id = created.monitor.id;
		const now = new Date();
		const today = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
		await env.DB.batch([
			env.DB.prepare("INSERT INTO monitor_daily_stats (monitor_id, day, total_checks, up_checks, avg_latency_ms, min_latency_ms, max_latency_ms) VALUES (?, ?, 8, 6, 100, 50, 150)").bind(id, today - 24 * 60 * 60 * 1000),
			env.DB.prepare("INSERT INTO checks (monitor_id, ok, status_code, latency_ms, checked_at) VALUES (?, 1, 200, 200, ?)").bind(id, today + 1000),
			env.DB.prepare("INSERT INTO checks (monitor_id, ok, status_code, latency_ms, checked_at) VALUES (?, 1, 200, 200, ?)").bind(id, today + 2000),
		]);

		const response = await apiFetch(`/api/monitors/${id}/stats`, "GET", cookie);
		const stats = await response.json<{ windows: { "30d": { uptimePct: number; totalChecks: number; upChecks: number; avgLatencyMs: number } } }>();
		expect(stats.windows["30d"]).toMatchObject({
			uptimePct: 80,
			totalChecks: 10,
			upChecks: 8,
			avgLatencyMs: 120,
		});
	});

	it("deletes the monitor and its check records explicitly", async () => {
		const cookie = await authenticatedCookie();
		const created = await (await createMonitor(cookie)).json<{ monitor: { id: number } }>();
		await env.DB.prepare("INSERT INTO checks (monitor_id, ok, status_code, latency_ms, checked_at) VALUES (?, 1, 200, 12, ?)")
			.bind(created.monitor.id, Date.now())
			.run();

		const response = await apiFetch(`/api/monitors/${created.monitor.id}`, "DELETE", cookie);
		expect(response.status).toBe(200);
		expect(await response.json()).toEqual({ ok: true });

		const monitorCount = await env.DB.prepare("SELECT COUNT(*) AS count FROM monitors").first<{ count: number }>();
		const checkCount = await env.DB.prepare("SELECT COUNT(*) AS count FROM checks").first<{ count: number }>();
		expect(monitorCount?.count).toBe(0);
		expect(checkCount?.count).toBe(0);
	});
});