update tests

server/test/integration/monitorRepository.test.ts

@@ -123,4 +123,70 @@ describe("MongoMonitorsRepository", () => {
 			expect(monitors[0].recentChecks).toEqual([]);
 		});
 	});
+
+	describe("docker tls key access", () => {
+		const seedDockerMonitor = (overrides: Record<string, unknown> = {}) =>
+			MonitorModel.create({
+				userId: new mongoose.Types.ObjectId(),
+				teamId: new mongoose.Types.ObjectId(),
+				name: "docker",
+				type: "docker",
+				url: "tcp://host",
+				...overrides,
+			});
+
+		it("never returns the key on a normal load, even with the flag set", async () => {
+			const repo = new MongoMonitorsRepository();
+			const doc = await seedDockerMonitor({ dockerTlsKey: "v1.abc123.iv.tag.data", dockerTlsKeySet: true });
+
+			const monitor = await repo.findByIdLean(doc._id.toString());
+
+			expect(monitor?.dockerTlsKeySet).toBe(true);
+			expect(monitor?.dockerTlsKey).toBeUndefined();
+		});
+
+		it("findDockerTlsKeyById returns the stored key despite select: false", async () => {
+			const repo = new MongoMonitorsRepository();
+			const doc = await seedDockerMonitor({ dockerTlsKey: "v1.abc123.iv.tag.data", dockerTlsKeySet: true });
+
+			await expect(repo.findDockerTlsKeyById(doc._id.toString())).resolves.toBe("v1.abc123.iv.tag.data");
+		});
+
+		it("findDockerTlsKeyById returns null for a monitor without a key and for an unknown id", async () => {
+			const repo = new MongoMonitorsRepository();
+			const doc = await seedDockerMonitor({ url: "unix:///var/run/docker.sock" });
+
+			await expect(repo.findDockerTlsKeyById(doc._id.toString())).resolves.toBeNull();
+			await expect(repo.findDockerTlsKeyById(new mongoose.Types.ObjectId().toString())).resolves.toBeNull();
+		});
+
+		it("findAllDockerTlsKeys returns only rows with the flag set and a key present", async () => {
+			const repo = new MongoMonitorsRepository();
+			const keyed = await seedDockerMonitor({ dockerTlsKey: "v1.abc123.k1", dockerTlsKeySet: true });
+			await seedDockerMonitor({ url: "unix:///var/run/docker.sock" });
+			await seedDockerMonitor({ dockerTlsKeySet: true }); // flag without key: inconsistent, dropped
+			await MonitorModel.create({
+				userId: new mongoose.Types.ObjectId(),
+				teamId: new mongoose.Types.ObjectId(),
+				name: "http",
+				type: "http",
+				url: "https://example.com",
+			});
+
+			await expect(repo.findAllDockerTlsKeys()).resolves.toEqual([{ id: keyed._id.toString(), dockerTlsKey: "v1.abc123.k1" }]);
+		});
+
+		it("updateDockerTlsKey replaces the key and nothing else", async () => {
+			const repo = new MongoMonitorsRepository();
+			const doc = await seedDockerMonitor({ dockerTlsKey: "v1.old.k", dockerTlsKeySet: true, dockerTlsCert: "cert" });
+
+			await repo.updateDockerTlsKey(doc._id.toString(), "v1.new.k");
+
+			const after = await MonitorModel.findById(doc._id).select("+dockerTlsKey").lean();
+			expect(after?.dockerTlsKey).toBe("v1.new.k");
+			expect(after?.dockerTlsCert).toBe("cert");
+			expect(after?.dockerTlsKeySet).toBe(true);
+			expect(after?.name).toBe("docker");
+		});
+	});
 });

server/test/unit/services/checkProducer.test.ts

@@ -22,7 +22,7 @@ const activeWindow = () => {
 const createProducer = (overrides?: Record<string, any>) => {
 	const defaults = {
 		logger: createMockLogger(),
-		monitorsRepository: { updateById: jest.fn().mockResolvedValue({}) },
+		monitorsRepository: { updateById: jest.fn().mockResolvedValue({}), findDockerTlsKeyById: jest.fn().mockResolvedValue(null) },
 		maintenanceWindowsRepository: { findByMonitorId: jest.fn().mockResolvedValue([]) },
 		checkService: { toCheck: jest.fn().mockReturnValue({ id: "check-1" }) },
 		networkService: { requestStatus: jest.fn().mockResolvedValue({ monitorId: "m1", status: true, code: 200, message: "OK" }) },
@@ -111,6 +111,48 @@ describe("CheckProducer", () => {
 
 	// ── acquire / record ──────────────────────────────────────────────────────
 
+	// ── docker tls key resolution ─────────────────────────────────────────────
+
+	it("fetches the stored key for a docker monitor with a key set and passes it in the context", async () => {
+		const { producer, defaults } = createProducer({
+			monitorsRepository: { updateById: jest.fn(), findDockerTlsKeyById: jest.fn().mockResolvedValue("v1.abc123.iv.tag.data") },
+		});
+		const monitor = makeMonitor({ type: "docker", url: "tcp://host", dockerTlsKeySet: true });
+
+		await producer.produce(monitor);
+
+		expect(defaults.monitorsRepository.findDockerTlsKeyById).toHaveBeenCalledWith("m1");
+		expect(defaults.networkService.requestStatus).toHaveBeenCalledWith(monitor, { proxyUrl: undefined, dockerTlsKey: "v1.abc123.iv.tag.data" });
+	});
+
+	it("does not fetch a key for a docker monitor without one set", async () => {
+		const { producer, defaults } = createProducer();
+		const monitor = makeMonitor({ type: "docker", url: "unix:///var/run/docker.sock", dockerTlsKeySet: false });
+
+		await producer.produce(monitor);
+
+		expect(defaults.monitorsRepository.findDockerTlsKeyById).not.toHaveBeenCalled();
+		expect(defaults.networkService.requestStatus).toHaveBeenCalledWith(monitor, { proxyUrl: undefined, dockerTlsKey: undefined });
+	});
+
+	it("does not fetch a key for non-docker monitors even if the flag is set", async () => {
+		const { producer, defaults } = createProducer();
+
+		await producer.produce(makeMonitor({ type: "http", dockerTlsKeySet: true }));
+
+		expect(defaults.monitorsRepository.findDockerTlsKeyById).not.toHaveBeenCalled();
+	});
+
+	it("passes undefined when the flag is set but the repository has no key", async () => {
+		const { producer, defaults } = createProducer();
+		const monitor = makeMonitor({ type: "docker", url: "tcp://host", dockerTlsKeySet: true });
+
+		await producer.produce(monitor);
+
+		expect(defaults.monitorsRepository.findDockerTlsKeyById).toHaveBeenCalledWith("m1");
+		expect(defaults.networkService.requestStatus).toHaveBeenCalledWith(monitor, { proxyUrl: undefined, dockerTlsKey: undefined });
+	});
+
 	it("throws when the network response is null", async () => {
 		const { producer } = createProducer({
 			networkService: { requestStatus: jest.fn().mockResolvedValue(null) },