bug fix

Author: deexno

README.md

@@ -63,7 +63,7 @@ graph_count = 3
 allow_legacy_url_auth = no
 ```
 
-The local `http://127.0.0.1/<omd_site_name>` URL is recommended for the graph export. The bot first tries CheckMK's legacy internal graph renderer. If that renderer is not available, it uses the CheckMK Web `graph_image.py` PNG export endpoint with the automation credentials above. The bridge authenticates with HTTP auth headers so secrets are not sent in the URL. If a loopback HTTPS URL fails because the certificate is not valid for `127.0.0.1` or `localhost`, the bridge retries over local HTTP and, if the local web server redirects back to HTTPS, as a last resort retries the loopback HTTPS request without certificate verification. This relaxed TLS fallback is only used for loopback hosts. Missing graph support will not stop the bot or bridge service.
+The local `http://127.0.0.1/<omd_site_name>` URL is recommended for the graph export. The bot first tries CheckMK's legacy internal graph renderer. If that renderer is not available, it tries CheckMK's notification graph endpoint `ajax_graph_images.py` and then the public `graph_image.py` PNG export endpoint. The bridge authenticates with HTTP auth headers so secrets are not sent in the URL. If a loopback HTTPS URL fails because the certificate is not valid for `127.0.0.1` or `localhost`, the bridge retries over local HTTP and, if the local web server redirects back to HTTPS, as a last resort retries the loopback HTTPS request without certificate verification. This relaxed TLS fallback is only used for loopback hosts. Missing graph support will not stop the bot or bridge service.
 
 Existing installations are migrated automatically. Legacy configuration files are backed up before changes are made, and old site-local application files are moved to a `legacy-<timestamp>` directory below `/omd/sites/<omd_site_name>/local/share/checkmk-telegram-plus`.
 

checkmk/bridge/checkmk_bridge.py

@@ -133,13 +133,59 @@ def service_graphs(params: dict[str, Any]) -> list[str]:
         return render_graphs_internal(hostname, service)
     except Exception as internal_exc:
         try:
-            return fetch_graphs_from_web(hostname, service)
-        except Exception as web_exc:
-            raise RuntimeError(
-                "Could not render Checkmk service graphs. "
-                f"Internal renderer failed: {internal_exc}. "
-                f"Web graph export failed: {web_exc}"
-            ) from web_exc
+            return fetch_graphs_from_ajax(hostname, service)
+        except Exception as ajax_exc:
+            try:
+                return fetch_graphs_from_web(hostname, service)
+            except Exception as web_exc:
+                raise RuntimeError(
+                    "Could not render Checkmk service graphs. "
+                    f"Internal renderer failed: {internal_exc}. "
+                    f"Notification graph endpoint failed: {ajax_exc}. "
+                    f"Web graph export failed: {web_exc}"
+                ) from web_exc
+
+
+def fetch_graphs_from_ajax(hostname: str, service: str) -> list[str]:
+    config = read_web_config()
+    base_url = config.get("base_url", "")
+    username = config.get("automation_user", "")
+    secret = config.get("automation_secret", "")
+    if not base_url:
+        raise RuntimeError(f"checkmk_web.base_url is not configured in {CONFIG_PATH}")
+
+    try:
+        graph_count = max(1, min(int(config.get("graph_count", "3")), 10))
+    except ValueError:
+        graph_count = 3
+
+    errors = []
+    for candidate_base_url, verify_tls in graph_fetch_attempts(base_url):
+        for auth_method in graph_auth_methods(
+            config.get("allow_legacy_url_auth", "").lower()
+            in {"1", "true", "yes", "on"}
+        ):
+            if auth_method != "none" and (not username or not secret):
+                continue
+            try:
+                graphs = fetch_ajax_graph_images(
+                    candidate_base_url,
+                    username,
+                    secret,
+                    hostname,
+                    service,
+                    graph_count,
+                    verify_tls=verify_tls,
+                    auth_method=auth_method,
+                )
+                if graphs:
+                    return graphs
+                errors.append("ajax_graph_images.py returned no graphs")
+            except Exception as exc:
+                errors.append(str(exc))
+                if not should_try_next_graph_auth_method(exc):
+                    break
+    raise RuntimeError("; ".join(errors[-4:]) or "no graph images returned")
 
 
 def render_graphs_internal(hostname: str, service: str) -> list[str]:
@@ -325,6 +371,52 @@ def graph_image_requests(hostname: str, service: str, graph_index: int) -> list[
     ]
 
 
+def fetch_ajax_graph_images(
+    base_url: str,
+    username: str,
+    secret: str,
+    hostname: str,
+    service: str,
+    graph_count: int,
+    *,
+    verify_tls: bool,
+    auth_method: str,
+) -> list[str]:
+    query = parse.urlencode(
+        {
+            "site": SITE,
+            "host": hostname,
+            "service": service,
+            "num_graphs": str(graph_count),
+        }
+    )
+    url = f"{base_url}/check_mk/ajax_graph_images.py?{query}"
+    headers = {"Accept": "application/json"}
+    add_auth_headers(headers, username, secret, auth_method)
+    req = request.Request(url, headers=headers)
+    body, content_type = open_graph_url(
+        req, base_url, verify_tls=verify_tls, auth_method=auth_method
+    )
+    if "json" not in content_type.lower():
+        raise RuntimeError(
+            "ajax_graph_images.py did not return JSON using "
+            f"{auth_method} auth (Content-Type: {content_type}): "
+            f"{short_html_error(body.decode('utf-8', 'replace'))}"
+        )
+    try:
+        payload = json.loads(body.decode("utf-8"))
+    except json.JSONDecodeError as exc:
+        raise RuntimeError(f"ajax_graph_images.py returned invalid JSON: {exc}") from exc
+    if not isinstance(payload, list):
+        raise RuntimeError(
+            f"ajax_graph_images.py returned unexpected payload: {type(payload).__name__}"
+        )
+    graphs = [item for item in payload if isinstance(item, str) and item]
+    if not graphs:
+        raise RuntimeError("ajax_graph_images.py returned no graph images")
+    return graphs
+
+
 def fetch_graph_image(
     base_url: str,
     username: str,
@@ -341,14 +433,42 @@ def fetch_graph_image(
     query = parse.urlencode(query_values)
     url = f"{base_url}/check_mk/graph_image.py?{query}"
     headers = {"Accept": "image/png"}
+    add_auth_headers(headers, username, secret, auth_method)
+    req = request.Request(url, headers=headers)
+    body, content_type = open_graph_url(
+        req, base_url, verify_tls=verify_tls, auth_method=auth_method
+    )
+    if "image" not in content_type.lower() or not body.startswith(b"\x89PNG"):
+        preview = short_html_error(body.decode("utf-8", "replace"))
+        raise RuntimeError(
+            f"graph_image.py did not return a PNG image using {auth_method} auth "
+            f"(Content-Type: {content_type}): {preview}"
+        )
+    return base64.b64encode(body).decode("ascii")
+
+
+def add_auth_headers(
+    headers: dict[str, str],
+    username: str,
+    secret: str,
+    auth_method: str,
+) -> None:
     if auth_method == "basic":
         token = base64.b64encode(f"{username}:{secret}".encode("utf-8")).decode(
             "ascii"
         )
         headers["Authorization"] = f"Basic {token}"
     elif auth_method == "bearer":
         headers["Authorization"] = f"Bearer {username} {secret}"
-    req = request.Request(url, headers=headers)
+
+
+def open_graph_url(
+    req: request.Request,
+    base_url: str,
+    *,
+    verify_tls: bool,
+    auth_method: str,
+) -> tuple[bytes, str]:
     context = None
     if parse.urlsplit(base_url).scheme == "https" and not verify_tls:
         context = ssl._create_unverified_context()
@@ -359,23 +479,18 @@ def fetch_graph_image(
     except error.HTTPError as exc:
         body = exc.read(500).decode("utf-8", "replace")
         raise RuntimeError(
-            f"graph_image.py returned HTTP {exc.code} using {auth_method} auth: "
+            f"{Path(parse.urlsplit(req.full_url).path).name} returned HTTP "
+            f"{exc.code} using {auth_method} auth: "
             f"{short_html_error(body)}"
         ) from exc
     except error.URLError as exc:
         verification = " without TLS verification" if not verify_tls else ""
         raise RuntimeError(
-            f"graph_image.py request failed using {auth_method} auth"
+            f"{Path(parse.urlsplit(req.full_url).path).name} request failed "
+            f"using {auth_method} auth"
             f"{verification}: {exc.reason}"
         ) from exc
-
-    if "image" not in content_type.lower() or not body.startswith(b"\x89PNG"):
-        preview = short_html_error(body.decode("utf-8", "replace"))
-        raise RuntimeError(
-            f"graph_image.py did not return a PNG image using {auth_method} auth "
-            f"(Content-Type: {content_type}): {preview}"
-        )
-    return base64.b64encode(body).decode("ascii")
+    return body, content_type
 
 
 def short_html_error(text: str) -> str:

docs/ARCHITECTURE.md

@@ -61,20 +61,23 @@ Graph rendering is version tolerant:
 1. The bridge first tries Checkmk's legacy internal notification graph renderer,
    if the installed Checkmk version still exposes it.
 2. If that renderer is unavailable, the bridge falls back to Checkmk Web's
-   `graph_image.py` PNG export endpoint.
+   notification graph endpoint `ajax_graph_images.py`.
 3. The web export requires `[checkmk_web]` settings in
    `/etc/checkmk-telegram-plus/<site>.ini`: `base_url`, `automation_user` and
    `automation_secret`. The bridge uses HTTP auth headers by default so secrets
    are not embedded in URLs. Legacy URL authentication can be enabled explicitly
    with `allow_legacy_url_auth = yes` for old Checkmk installations if needed.
-4. The recommended `base_url` is the local HTTP URL
+4. If the notification graph endpoint is unavailable or rejected by the Checkmk
+   version, the bridge tries the public `graph_image.py` PNG export endpoint
+   with multiple known request formats.
+5. The recommended `base_url` is the local HTTP URL
    `http://127.0.0.1/<site>`. If a loopback HTTPS URL fails certificate
    verification because the certificate is not valid for `127.0.0.1`,
    `localhost` or `::1`, the bridge retries the local request over HTTP. If
    the local web server redirects that HTTP request back to HTTPS, the bridge
    retries loopback HTTPS without certificate verification as a last resort.
    This relaxed TLS fallback is never used for non-loopback hosts.
-5. If neither method is available, only the graph request fails with a clear
+6. If neither method is available, only the graph request fails with a clear
    error message. The bridge service and the bot keep running.
 
 ### External app

tests/test_security_static.py

@@ -46,6 +46,8 @@ def test_graphs_have_web_export_fallback(self):
         )
         config = (ROOT / "resources" / "config.ini").read_text(encoding="utf-8")
         self.assertIn("fetch_graphs_from_web", bridge)
+        self.assertIn("fetch_graphs_from_ajax", bridge)
+        self.assertIn("ajax_graph_images.py", bridge)
         self.assertIn("graph_image.py", bridge)
         self.assertIn("graph_fetch_attempts", bridge)
         self.assertIn("should_retry_graph_fetch", bridge)