@oneuptime/common 11.3.20 → 11.3.22

package/Server/Utils/Monitor/MonitorCriteriaObservationBuilder.ts

@@ -29,6 +29,7 @@ import MonitorCriteriaExpectationBuilder from "./MonitorCriteriaExpectationBuild
 import MetricMonitorResponse from "../../../Types/Monitor/MetricMonitor/MetricMonitorResponse";
 import MetricQueryConfigData from "../../../Types/Metrics/MetricQueryConfigData";
 import MetricFormulaConfigData from "../../../Types/Metrics/MetricFormulaConfigData";
+import MetricsViewConfig from "../../../Types/Metrics/MetricsViewConfig";
 import MetricUnitUtil from "../../../Utils/MetricUnitUtil";
 
 export default class MonitorCriteriaObservationBuilder {
@@ -1208,12 +1209,13 @@ export default class MonitorCriteriaObservationBuilder {
       return input.values;
     }
 
+    const metricViewConfig: MetricsViewConfig | undefined =
+      MonitorStep.getMetricsViewConfig(input.monitorStep);
+
     const queryConfigs: Array<MetricQueryConfigData> =
-      input.monitorStep.data?.metricMonitor?.metricViewConfig?.queryConfigs ||
-      [];
+      metricViewConfig?.queryConfigs || [];
     const formulaConfigs: Array<MetricFormulaConfigData> =
-      input.monitorStep.data?.metricMonitor?.metricViewConfig?.formulaConfigs ||
-      [];
+      metricViewConfig?.formulaConfigs || [];
 
     const alias: string | null = input.alias;
     const matchedQuery: MetricQueryConfigData | undefined = alias

package/Server/Utils/Telemetry/IoTSnapshotScan.ts

@@ -1,3 +1,4 @@
+import ColumnLength from "../../../Types/Database/ColumnLength";
 import OneUptimeDate from "../../../Types/Date";
 import { JSONArray, JSONObject, JSONValue } from "../../../Types/JSON";
 import logger from "../Logger";
@@ -109,6 +110,29 @@ function toNumberOrNull(value: unknown): number | null {
   return null;
 }
 
+/*
+ * A device with a future-skewed clock must not be allowed to stamp a
+ * future observedAt: it becomes lastSeenAt / metricsUpdatedAt, and the
+ * `>=` dominance guards in IoTDeviceService would then reject every
+ * legitimate (present-time) update until the wall clock catches up to
+ * the skew. Anything more than this far ahead of the ingest clock is
+ * folded back to "now" at ingest time.
+ */
+export const IOT_MAX_FUTURE_CLOCK_SKEW_MINUTES: number = 5;
+
+export function clampIoTTimestamp(date: Date, nowOverride?: Date): Date {
+  const now: Date = nowOverride || OneUptimeDate.getCurrentDate();
+  const maxAllowedMs: number =
+    now.getTime() + IOT_MAX_FUTURE_CLOCK_SKEW_MINUTES * 60 * 1000;
+  if (date.getTime() > maxAllowedMs) {
+    logger.debug(
+      `IoT timestamp ${date.toISOString()} is beyond the ${IOT_MAX_FUTURE_CLOCK_SKEW_MINUTES}m future-skew tolerance; clamping to ingest time.`,
+    );
+    return now;
+  }
+  return date;
+}
+
 /*
  * Same fall-back-to-now parse contract as the ingest service's
  * safeParseUnixNano — only the Date is needed on the snapshot path.
@@ -200,9 +224,11 @@ export function bufferIoTSnapshotMetric(data: {
     return;
   }
 
-  const observedAt: Date = parseUnixNanoToDate(
-    data.datapoint["timeUnixNano"] as string | number | undefined,
-    "iot snapshot timeUnixNano",
+  const observedAt: Date = clampIoTTimestamp(
+    parseUnixNanoToDate(
+      data.datapoint["timeUnixNano"] as string | number | undefined,
+      "iot snapshot timeUnixNano",
+    ),
   );
 
   const dpAttributes: JSONArray =
@@ -214,14 +240,26 @@ export function bufferIoTSnapshotMetric(data: {
   );
 
   // Identity lives in the `device.id` datapoint label.
-  const externalId: string | null = getStringAttribute(
-    dpAttributes,
-    "device.id",
-  );
+  let externalId: string | null = getStringAttribute(dpAttributes, "device.id");
   if (!externalId) {
     return;
   }
 
+  /*
+   * The inventory identity columns are ShortText (100 chars). Truncate
+   * over-long ids at ingest so the fold key, the inventory upsert and
+   * the latest-metric mirror all agree on the same (truncated)
+   * identity — IoTDeviceService also sanitizes before building its
+   * INSERT chunks, so one malformed device can never fail the chunk
+   * and drop the other rows with it.
+   */
+  if (externalId.length > ColumnLength.ShortText) {
+    logger.warn(
+      `IoT device.id exceeds ${ColumnLength.ShortText} chars; truncating to "${externalId.substring(0, ColumnLength.ShortText)}".`,
+    );
+    externalId = externalId.substring(0, ColumnLength.ShortText);
+  }
+
   /*
    * Kind/type/firmware: read from the iot.device.* attributes the
    * device SDK stamps; kind falls back to "Device" so inventory still

package/Server/Utils/WhatsAppTemplateUtil.ts

@@ -35,6 +35,8 @@ const templateDashboardLinkVariableMap: Partial<
   [WhatsAppTemplateIds.IncidentStateChangedOwnerNotification]: "incident_link",
   [WhatsAppTemplateIds.IncidentOwnerAddedNotification]: "incident_link",
   [WhatsAppTemplateIds.IncidentMemberAddedNotification]: "incident_link",
+  [WhatsAppTemplateIds.IncidentReminderOwnerNotification]: "incident_link",
+  [WhatsAppTemplateIds.AlertReminderOwnerNotification]: "alert_link",
   [WhatsAppTemplateIds.MonitorOwnerAddedNotification]: "monitor_link",
   [WhatsAppTemplateIds.MonitorCreatedOwnerNotification]: "monitor_link",
   [WhatsAppTemplateIds.MonitorStatusChangedOwnerNotification]: "monitor_link",
@@ -48,6 +50,8 @@ const templateDashboardLinkVariableMap: Partial<
     "maintenance_link",
   [WhatsAppTemplateIds.ScheduledMaintenanceStateChangedOwnerNotification]:
     "maintenance_link",
+  [WhatsAppTemplateIds.ScheduledMaintenanceReminderOwnerNotification]:
+    "event_link",
   [WhatsAppTemplateIds.StatusPageAnnouncementCreatedOwnerNotification]:
     "status_page_link",
   [WhatsAppTemplateIds.StatusPageCreatedOwnerNotification]: "status_page_link",
@@ -78,6 +82,10 @@ const templateIdByEventType: Record<
     WhatsAppTemplateIds.IncidentOwnerAddedNotification,
   [NotificationSettingEventType.SEND_INCIDENT_MEMBER_ADDED_NOTIFICATION]:
     WhatsAppTemplateIds.IncidentMemberAddedNotification,
+  [NotificationSettingEventType.SEND_INCIDENT_REMINDER_OWNER_NOTIFICATION]:
+    WhatsAppTemplateIds.IncidentReminderOwnerNotification,
+  [NotificationSettingEventType.SEND_ALERT_REMINDER_OWNER_NOTIFICATION]:
+    WhatsAppTemplateIds.AlertReminderOwnerNotification,
   [NotificationSettingEventType.SEND_ALERT_CREATED_OWNER_NOTIFICATION]:
     WhatsAppTemplateIds.AlertCreatedOwnerNotification,
   [NotificationSettingEventType.SEND_ALERT_NOTE_POSTED_OWNER_NOTIFICATION]:
@@ -124,6 +132,8 @@ const templateIdByEventType: Record<
     WhatsAppTemplateIds.ScheduledMaintenanceOwnerAddedNotification,
   [NotificationSettingEventType.SEND_SCHEDULED_MAINTENANCE_STATE_CHANGED_OWNER_NOTIFICATION]:
     WhatsAppTemplateIds.ScheduledMaintenanceStateChangedOwnerNotification,
+  [NotificationSettingEventType.SEND_SCHEDULED_MAINTENANCE_REMINDER_OWNER_NOTIFICATION]:
+    WhatsAppTemplateIds.ScheduledMaintenanceReminderOwnerNotification,
   [NotificationSettingEventType.SEND_STATUS_PAGE_ANNOUNCEMENT_CREATED_OWNER_NOTIFICATION]:
     WhatsAppTemplateIds.StatusPageAnnouncementCreatedOwnerNotification,
   [NotificationSettingEventType.SEND_STATUS_PAGE_CREATED_OWNER_NOTIFICATION]:

package/ServiceRoute.ts

@@ -39,3 +39,7 @@ export const DocsRoute: Route = new Route("/docs");
 export const StatusPageApiRoute: Route = new Route("/status-page-api");
 
 export const PublicDashboardRoute: Route = new Route("/public-dashboard");
+
+export const PublicDashboardApiRoute: Route = new Route(
+  "/public-dashboard-api",
+);

package/Tests/Server/Services/IoTDeviceService.test.ts

@@ -0,0 +1,280 @@
+import IoTDeviceService, {
+  IoTDeviceLatestMetric,
+  ParsedIoTDevice,
+} from "../../../Server/Services/IoTDeviceService";
+import { IOT_MAX_FUTURE_CLOCK_SKEW_MINUTES } from "../../../Server/Utils/Telemetry/IoTSnapshotScan";
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * Malformed-device hardening for the IoTDevice inventory write path.
+ * The service builds raw parameterized SQL against the TypeORM manager
+ * — these tests mock the query runner (no Postgres) and lock in:
+ *
+ *   - ShortText values (externalId and friends) truncate to the
+ *     100-char column limit BEFORE the chunk is built, so one bad
+ *     device can never fail the whole 500-row INSERT and drop the
+ *     other 499 with it,
+ *   - identities that collide after truncation dedupe to the newest
+ *     row (two VALUES rows on one conflict target abort the statement),
+ *   - a future-skewed lastSeenAt / observedAt clamps to ingest time so
+ *     the `>=` dominance guards can't get wedged by one bogus device
+ *     clock,
+ *   - the latest-metric mirror truncates identity the SAME way the
+ *     upsert does, so the UPDATE still finds the row the upsert wrote.
+ */
+
+const PROJECT_ID: ObjectID = ObjectID.generate();
+const FLEET_ID: ObjectID = ObjectID.generate();
+const SHORT_TEXT_LIMIT: number = 100;
+const UPSERT_PARAMS_PER_ROW: number = 11;
+
+type QueryCall = [string, Array<unknown>];
+
+function mockQueryRunner(result: unknown = []): jest.Mock {
+  const query: jest.Mock = jest.fn().mockResolvedValue(result);
+  jest
+    .spyOn(IoTDeviceService, "getRepository")
+    .mockReturnValue({ manager: { query } } as any);
+  return query;
+}
+
+function parsedDevice(
+  overrides: Partial<ParsedIoTDevice> = {},
+): ParsedIoTDevice {
+  return {
+    kind: "Sensor",
+    externalId: "sensor-1",
+    name: "greenhouse-sensor",
+    deviceType: "temperature",
+    firmwareVersion: "1.2.3",
+    isUp: true,
+    uptimeSeconds: 3600,
+    lastSeenAt: new Date("2026-06-13T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+function latestMetric(
+  overrides: Partial<IoTDeviceLatestMetric> = {},
+): IoTDeviceLatestMetric {
+  return {
+    kind: "Sensor",
+    externalId: "sensor-1",
+    cpuPercent: 12.5,
+    memoryBytes: 1024,
+    maxMemoryBytes: 4096,
+    memoryPercent: 25,
+    batteryPercent: 88,
+    signalStrengthDbm: -61,
+    temperatureCelsius: 21.4,
+    observedAt: new Date("2026-06-13T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+afterEach(() => {
+  jest.restoreAllMocks();
+});
+
+describe("IoTDeviceService.bulkUpsert — ShortText sanitation", () => {
+  test("truncates an over-long externalId instead of failing the chunk", async () => {
+    const query: jest.Mock = mockQueryRunner();
+    const longId: string = "x".repeat(150);
+
+    await IoTDeviceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      devices: [
+        parsedDevice({ externalId: longId }),
+        parsedDevice({ externalId: "sensor-good" }),
+      ],
+    });
+
+    expect(query).toHaveBeenCalledTimes(1);
+    const [, params] = query.mock.calls[0] as QueryCall;
+
+    // Both rows made it into the one chunk — the bad id dropped nobody.
+    expect(params).toHaveLength(2 * UPSERT_PARAMS_PER_ROW);
+    expect(params).toContain("x".repeat(SHORT_TEXT_LIMIT));
+    expect(params).toContain("sensor-good");
+    expect(params).not.toContain(longId);
+  });
+
+  test("truncates over-long kind/name/deviceType/firmwareVersion values", async () => {
+    const query: jest.Mock = mockQueryRunner();
+
+    await IoTDeviceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      devices: [
+        parsedDevice({
+          kind: "k".repeat(140),
+          name: "n".repeat(140),
+          deviceType: "t".repeat(140),
+          firmwareVersion: "f".repeat(140),
+        }),
+      ],
+    });
+
+    const [, params] = query.mock.calls[0] as QueryCall;
+    expect(params).toContain("k".repeat(SHORT_TEXT_LIMIT));
+    expect(params).toContain("n".repeat(SHORT_TEXT_LIMIT));
+    expect(params).toContain("t".repeat(SHORT_TEXT_LIMIT));
+    expect(params).toContain("f".repeat(SHORT_TEXT_LIMIT));
+  });
+
+  test("identities colliding after truncation dedupe to the newest row", async () => {
+    const query: jest.Mock = mockQueryRunner();
+    const shared: string = "z".repeat(SHORT_TEXT_LIMIT);
+    const older: Date = new Date("2026-06-13T00:00:00.000Z");
+    const newer: Date = new Date("2026-06-13T00:05:00.000Z");
+
+    await IoTDeviceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      devices: [
+        parsedDevice({
+          externalId: `${shared}-alpha`,
+          name: "older-device",
+          lastSeenAt: older,
+        }),
+        parsedDevice({
+          externalId: `${shared}-bravo`,
+          name: "newer-device",
+          lastSeenAt: newer,
+        }),
+      ],
+    });
+
+    const [, params] = query.mock.calls[0] as QueryCall;
+
+    // One conflict target → exactly one VALUES row, the newest one.
+    expect(params).toHaveLength(UPSERT_PARAMS_PER_ROW);
+    expect(params).toContain(shared);
+    expect(params).toContain("newer-device");
+    expect(params).not.toContain("older-device");
+  });
+
+  test("skips rows whose externalId is empty", async () => {
+    const query: jest.Mock = mockQueryRunner();
+
+    await IoTDeviceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      devices: [parsedDevice({ externalId: "" })],
+    });
+
+    expect(query).not.toHaveBeenCalled();
+  });
+});
+
+describe("IoTDeviceService.bulkUpsert — future clock-skew clamping", () => {
+  test("clamps a lastSeenAt beyond the skew tolerance to ingest time", async () => {
+    const query: jest.Mock = mockQueryRunner();
+    const before: number = Date.now();
+
+    await IoTDeviceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      devices: [
+        parsedDevice({
+          lastSeenAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+        }),
+      ],
+    });
+
+    const after: number = Date.now();
+    const [, params] = query.mock.calls[0] as QueryCall;
+    const lastSeenAt: Date = params[9] as Date;
+
+    expect(lastSeenAt.getTime()).toBeGreaterThanOrEqual(before);
+    expect(lastSeenAt.getTime()).toBeLessThanOrEqual(after);
+  });
+
+  test("keeps a lastSeenAt within the skew tolerance untouched", async () => {
+    const query: jest.Mock = mockQueryRunner();
+    const slightlyAhead: Date = new Date(
+      Date.now() + (IOT_MAX_FUTURE_CLOCK_SKEW_MINUTES - 1) * 60 * 1000,
+    );
+
+    await IoTDeviceService.bulkUpsert({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      devices: [parsedDevice({ lastSeenAt: slightlyAhead })],
+    });
+
+    const [, params] = query.mock.calls[0] as QueryCall;
+    expect(params[9]).toEqual(slightlyAhead);
+  });
+});
+
+describe("IoTDeviceService.bulkUpdateLatestMetrics — sanitation matches the upsert", () => {
+  test("truncates an over-long externalId to the same identity the upsert wrote", async () => {
+    const query: jest.Mock = mockQueryRunner();
+    const longId: string = "x".repeat(150);
+
+    await IoTDeviceService.bulkUpdateLatestMetrics({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      metrics: [latestMetric({ externalId: longId })],
+    });
+
+    expect(query).toHaveBeenCalledTimes(1);
+    const [, params] = query.mock.calls[0] as QueryCall;
+
+    // Params: projectId, fleetId, then kind, externalId, ... per row.
+    expect(params[3]).toBe("x".repeat(SHORT_TEXT_LIMIT));
+  });
+
+  test("clamps a future observedAt beyond the skew tolerance", async () => {
+    const query: jest.Mock = mockQueryRunner();
+    const before: number = Date.now();
+
+    await IoTDeviceService.bulkUpdateLatestMetrics({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      metrics: [
+        latestMetric({
+          observedAt: new Date(Date.now() + 24 * 60 * 60 * 1000),
+        }),
+      ],
+    });
+
+    const after: number = Date.now();
+    const [, params] = query.mock.calls[0] as QueryCall;
+    const observedAt: Date = params[11] as Date;
+
+    expect(observedAt.getTime()).toBeGreaterThanOrEqual(before);
+    expect(observedAt.getTime()).toBeLessThanOrEqual(after);
+  });
+
+  test("identities colliding after truncation dedupe to the newest observation", async () => {
+    const query: jest.Mock = mockQueryRunner();
+    const shared: string = "z".repeat(SHORT_TEXT_LIMIT);
+
+    await IoTDeviceService.bulkUpdateLatestMetrics({
+      projectId: PROJECT_ID,
+      iotFleetId: FLEET_ID,
+      metrics: [
+        latestMetric({
+          externalId: `${shared}-alpha`,
+          batteryPercent: 10,
+          observedAt: new Date("2026-06-13T00:00:00.000Z"),
+        }),
+        latestMetric({
+          externalId: `${shared}-bravo`,
+          batteryPercent: 90,
+          observedAt: new Date("2026-06-13T00:05:00.000Z"),
+        }),
+      ],
+    });
+
+    const [, params] = query.mock.calls[0] as QueryCall;
+
+    // 2 shared params + one 9-param row (kind..temp) + observedAt.
+    expect(params).toHaveLength(2 + 10);
+    expect(params[3]).toBe(shared);
+    expect(params).toContain(90);
+    expect(params).not.toContain(10);
+  });
+});

package/Tests/Server/Utils/AnalyticsDatabase/StatementGenerator.test.ts

@@ -672,6 +672,55 @@ describe("StatementGenerator", () => {
         expect(statement.query).toBe("");
         expect(statement.query_params).toStrictEqual({});
       });
+
+      test("emits NOT hasAny(...) for IncludesNone on an Array(String) column", () => {
+        const statement: Statement = arrayGenerator.toWhereStatement({
+          entityKeys: new IncludesNone(["210dac24142f1baa"]),
+        } as any);
+        expect(statement.query).toBe(
+          "AND NOT hasAny({p0:Identifier}, {p1:Array(String)})",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "entityKeys",
+          p1: ["210dac24142f1baa"],
+        });
+      });
+
+      test("drops empty IncludesNone instead of NOT hasAny(col, [])", () => {
+        const statement: Statement = arrayGenerator.toWhereStatement({
+          entityKeys: new IncludesNone([]),
+        } as any);
+        expect(statement.query).toBe("");
+        expect(statement.query_params).toStrictEqual({});
+      });
+    });
+
+    describe("scalar IncludesNone exclusion", () => {
+      /*
+       * "is none of" on a scalar column compiles to `col NOT IN (...)` —
+       * the exception monitor uses this to exclude occurrences of
+       * resolved/archived exception groups by fingerprint.
+       */
+      test("emits NOT IN (...) for IncludesNone on a Text column", () => {
+        const statement: Statement = generator.toWhereStatement({
+          column_1: new IncludesNone(["<fingerprint-1>", "<fingerprint-2>"]),
+        } as any);
+        expect(statement.query).toBe(
+          "AND {p0:Identifier} NOT IN {p1:Array(String)}",
+        );
+        expect(statement.query_params).toStrictEqual({
+          p0: "column_1",
+          p1: ["<fingerprint-1>", "<fingerprint-2>"],
+        });
+      });
+
+      test("drops empty IncludesNone instead of producing NOT IN ()", () => {
+        const statement: Statement = generator.toWhereStatement({
+          column_1: new IncludesNone([]),
+        } as any);
+        expect(statement.query).toBe("");
+        expect(statement.query_params).toStrictEqual({});
+      });
     });
 
     describe("entityScope synthetic key", () => {