@oneuptime/common 11.4.1 → 11.5.1

package/Server/Services/IoTDeviceService.ts

@@ -348,38 +348,81 @@ export class Service extends DatabaseService<Model> {
   }
 
   /**
-   * Hard-delete all devices in a fleet whose last scrape is older
-   * than olderThan. Returns the number of deleted rows. Only called by
-   * the cleanup worker for fleets that are still connected — a
-   * disconnected fleet keeps its last-known inventory.
+   * Age out devices in a fleet whose last scrape is older than
+   * olderThan. Only called by the cleanup worker for fleets that are
+   * still connected — a disconnected fleet keeps its last-known
+   * inventory.
+   *
+   * REGISTERED devices (a matching IoTDeviceCredential row on
+   * fleet + externalId, kind-agnostic) are flipped to Down instead of
+   * deleted: registration marks the device as expected, so a silent
+   * device must stay visible in the inventory as offline. Unregistered
+   * devices are hard-deleted as before (the inventory is a projection
+   * of what is actively reporting).
+   *
+   * The UPDATE deliberately does NOT touch lastSeenAt: reconnect
+   * recovery relies on the bulkUpsert dominance guard comparing a
+   * fresh scrape against the old timestamp, so the next scrape flips
+   * isUp back to true automatically.
    */
   @CaptureSpan()
   public async deleteStaleForFleet(data: {
     iotFleetId: ObjectID;
     olderThan: Date;
-  }): Promise<number> {
-    const result: Array<{ affected?: number }> | { affected?: number } =
-      await this.getRepository().manager.query(
-        `DELETE FROM "IoTDevice" WHERE "iotFleetId" = $1 AND "lastSeenAt" < $2`,
-        [data.iotFleetId.toString(), data.olderThan],
-      );
-
-    // Postgres driver returns [rows, affected] for DELETE — normalize.
-    let affected: number = 0;
-    if (Array.isArray(result) && result.length >= 2) {
-      const second: unknown = (result as Array<unknown>)[1];
-      if (typeof second === "number") {
-        affected = second;
+  }): Promise<{ deleted: number; markedOffline: number }> {
+    // Postgres driver returns [rows, affected] for UPDATE/DELETE — normalize.
+    const affectedOf: (result: unknown) => number = (
+      result: unknown,
+    ): number => {
+      if (Array.isArray(result) && result.length >= 2) {
+        const second: unknown = (result as Array<unknown>)[1];
+        if (typeof second === "number") {
+          return second;
+        }
       }
-    }
+      return 0;
+    };
+
+    /*
+     * Registered = a live credential on the same PROJECT + fleet +
+     * device id (kind-agnostic — one credential covers every kind the
+     * device reports). The projectId correlation is defense-in-depth
+     * against a credential row that names another project's fleet.
+     */
+    const registeredSubquery: string = `SELECT 1 FROM "IoTDeviceCredential" c WHERE c."projectId" = "IoTDevice"."projectId" AND c."iotFleetId" = "IoTDevice"."iotFleetId" AND c."externalId" = "IoTDevice"."externalId" AND c."deletedAt" IS NULL`;
+
+    /*
+     * A device whose iot.device.kind label drifts mints a second
+     * inventory row (identity is projectId+iotFleetId+kind+externalId).
+     * Without this guard the stale old-kind row would be registered
+     * (same externalId) and pinned as Offline forever. "Shadowed" =
+     * a fresher row exists for the same (fleet, externalId) under a
+     * different kind — keep only the freshest, let shadows self-heal.
+     */
+    const shadowedSubquery: string = `SELECT 1 FROM "IoTDevice" d2 WHERE d2."iotFleetId" = "IoTDevice"."iotFleetId" AND d2."externalId" = "IoTDevice"."externalId" AND d2."kind" <> "IoTDevice"."kind" AND d2."lastSeenAt" > "IoTDevice"."lastSeenAt" AND d2."deletedAt" IS NULL`;
+
+    const params: Array<unknown> = [data.iotFleetId.toString(), data.olderThan];
+
+    const updateResult: unknown = await this.getRepository().manager.query(
+      `UPDATE "IoTDevice" SET "isUp" = false, "updatedAt" = now() WHERE "iotFleetId" = $1 AND "lastSeenAt" < $2 AND "isUp" IS DISTINCT FROM false AND EXISTS (${registeredSubquery}) AND NOT EXISTS (${shadowedSubquery})`,
+      params,
+    );
+
+    const deleteResult: unknown = await this.getRepository().manager.query(
+      `DELETE FROM "IoTDevice" WHERE "iotFleetId" = $1 AND "lastSeenAt" < $2 AND (NOT EXISTS (${registeredSubquery}) OR EXISTS (${shadowedSubquery}))`,
+      params,
+    );
+
+    const deleted: number = affectedOf(deleteResult);
+    const markedOffline: number = affectedOf(updateResult);
 
-    if (affected > STALE_DELETE_WARN_THRESHOLD) {
+    if (deleted > STALE_DELETE_WARN_THRESHOLD) {
       logger.warn(
-        `IoTDevice cleanup deleted ${affected} stale rows for fleet ${data.iotFleetId.toString()} — larger than expected; investigate agent health.`,
+        `IoTDevice cleanup deleted ${deleted} stale rows for fleet ${data.iotFleetId.toString()} — larger than expected; investigate agent health.`,
       );
     }
 
-    return affected;
+    return { deleted, markedOffline };
   }
 
   /**

package/Server/Services/LlmLogService.ts

@@ -1,6 +1,8 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/LlmLog";
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -9,6 +11,30 @@ export class Service extends DatabaseService<Model> {
       this.hardDeleteItemsOlderThanInDays("createdAt", 3);
     }
   }
+
+  /*
+   * Sum of totalTokens this project has consumed for the given features since
+   * the given time — one SQL aggregate, used on the hot path of the daily
+   * autonomous-budget check (G4).
+   */
+  @CaptureSpan()
+  public async getTotalTokensUsedSince(data: {
+    projectId: ObjectID;
+    since: Date;
+    features: Array<string>;
+  }): Promise<number> {
+    if (data.features.length === 0) {
+      return 0;
+    }
+
+    const rows: Array<{ total: string | number | null }> =
+      await this.getRepository().manager.query(
+        `SELECT COALESCE(SUM("totalTokens"), 0) AS "total" FROM "LlmLog" WHERE "projectId" = $1 AND "createdAt" >= $2 AND "feature" = ANY($3) AND "deletedAt" IS NULL`,
+        [data.projectId.toString(), data.since, data.features],
+      );
+
+    return Number(rows[0]?.total || 0);
+  }
 }
 
 export default new Service();

package/Server/Services/LlmProviderService.ts

@@ -115,6 +115,7 @@ export class Service extends DatabaseService<Model> {
         apiKey: true,
         baseUrl: true,
         modelName: true,
+        additionalParams: true,
         isGlobalLlm: true,
         costPerMillionTokensInUSDCents: true,
       },
@@ -140,6 +141,7 @@ export class Service extends DatabaseService<Model> {
         apiKey: true,
         baseUrl: true,
         modelName: true,
+        additionalParams: true,
         isGlobalLlm: true,
         costPerMillionTokensInUSDCents: true,
       },
@@ -180,6 +182,7 @@ export class Service extends DatabaseService<Model> {
           apiKey: true,
           baseUrl: true,
           modelName: true,
+          additionalParams: true,
           isGlobalLlm: true,
           projectId: true,
           costPerMillionTokensInUSDCents: true,

package/Server/Services/MonitorService.ts

@@ -121,7 +121,10 @@ export class Service extends DatabaseService<Model> {
         }
 
         // For SNMP monitors, use the hostname from snmpMonitor config
-        if (monitorType === MonitorType.SNMP && firstStep?.data?.snmpMonitor) {
+        if (
+          monitorType === MonitorType.NetworkDevice &&
+          firstStep?.data?.snmpMonitor
+        ) {
           monitorDestination = firstStep.data.snmpMonitor.hostname || "";
           const port: number = firstStep.data.snmpMonitor.port || 161;
           if (monitorDestination && port) {

package/Server/Services/NetworkDeviceDiscoveryScanService.ts

@@ -0,0 +1,10 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+
+export default new Service();

package/Server/Services/NetworkDeviceLabelRuleEngineService.ts

@@ -0,0 +1,204 @@
+import Label from "../../Models/DatabaseModels/Label";
+import NetworkDevice from "../../Models/DatabaseModels/NetworkDevice";
+import NetworkDeviceLabelRule from "../../Models/DatabaseModels/NetworkDeviceLabelRule";
+import NetworkDeviceLabelRuleService from "./NetworkDeviceLabelRuleService";
+import NetworkDeviceService from "./NetworkDeviceService";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger, { LogAttributes } from "../Utils/Logger";
+
+class NetworkDeviceLabelRuleEngineServiceClass {
+  /**
+   * Evaluates NetworkDeviceLabelRule rows for the given network device and attaches matched
+   * labels to it. The union is deduped against labels already on the network device
+   * before insert to avoid PK conflicts on the join table.
+   */
+  @CaptureSpan()
+  public async applyRulesToNetworkDevice(
+    networkDevice: NetworkDevice,
+  ): Promise<void> {
+    if (!networkDevice.id || !networkDevice.projectId) {
+      return;
+    }
+
+    try {
+      const rules: Array<NetworkDeviceLabelRule> =
+        await NetworkDeviceLabelRuleService.findBy({
+          query: {
+            projectId: networkDevice.projectId,
+            isEnabled: true,
+          },
+          props: { isRoot: true },
+          select: {
+            _id: true,
+            name: true,
+            networkDeviceLabels: { _id: true },
+            networkDeviceNamePattern: true,
+            networkDeviceDescriptionPattern: true,
+            labelsToAdd: { _id: true },
+          },
+          limit: 100,
+          skip: 0,
+        });
+
+      if (rules.length === 0) {
+        return;
+      }
+
+      const networkDeviceWithDetails: NetworkDevice | null =
+        await NetworkDeviceService.findOneById({
+          id: networkDevice.id,
+          select: {
+            name: true,
+            description: true,
+            labels: { _id: true },
+          },
+          props: { isRoot: true },
+        });
+
+      if (!networkDeviceWithDetails) {
+        return;
+      }
+
+      const labelIdsToAdd: Set<string> = new Set();
+
+      for (const rule of rules) {
+        const matches: boolean = this.doesNetworkDeviceMatchRule(
+          networkDeviceWithDetails,
+          rule,
+        );
+        if (!matches) {
+          continue;
+        }
+        for (const label of rule.labelsToAdd || []) {
+          if (label.id) {
+            labelIdsToAdd.add(label.id.toString());
+          }
+        }
+      }
+
+      if (labelIdsToAdd.size === 0) {
+        return;
+      }
+
+      const existingLabelIds: Set<string> = new Set(
+        (networkDeviceWithDetails.labels || [])
+          .map((l: Label) => {
+            return l.id?.toString() || "";
+          })
+          .filter((id: string) => {
+            return id !== "";
+          }),
+      );
+
+      const newLabelIds: Array<string> = Array.from(labelIdsToAdd).filter(
+        (id: string) => {
+          return !existingLabelIds.has(id);
+        },
+      );
+      if (newLabelIds.length === 0) {
+        return;
+      }
+
+      await NetworkDeviceService.getRepository()
+        .createQueryBuilder()
+        .relation(NetworkDevice, "labels")
+        .of(networkDevice.id.toString())
+        .add(newLabelIds);
+
+      /*
+       * Sync in-memory networkDevice.labels so a downstream owner-rule engine in
+       * the same onCreateSuccess chain can match on rule-added labels.
+       */
+      const mergedLabelIds: Set<string> = new Set([
+        ...existingLabelIds,
+        ...newLabelIds,
+      ]);
+      networkDevice.labels = Array.from(mergedLabelIds).map((id: string) => {
+        const label: Label = new Label();
+        label.id = new ObjectID(id);
+        return label;
+      });
+
+      logger.debug(
+        `NetworkDeviceLabelRuleEngine attached ${newLabelIds.length} labels to network device ${networkDevice.id}`,
+        { projectId: networkDevice.projectId.toString() } as LogAttributes,
+      );
+    } catch (error) {
+      logger.error(`Error applying network device label rules: ${error}`, {
+        projectId: networkDevice.projectId?.toString(),
+        networkDeviceId: networkDevice.id?.toString(),
+      } as LogAttributes);
+    }
+  }
+
+  private doesNetworkDeviceMatchRule(
+    networkDevice: NetworkDevice,
+    rule: NetworkDeviceLabelRule,
+  ): boolean {
+    if (rule.networkDeviceLabels && rule.networkDeviceLabels.length > 0) {
+      if (!networkDevice.labels || networkDevice.labels.length === 0) {
+        return false;
+      }
+      const ruleLabelIds: Array<string> = rule.networkDeviceLabels.map(
+        (l: Label) => {
+          return l.id?.toString() || "";
+        },
+      );
+      const labelIds: Array<string> = networkDevice.labels.map((l: Label) => {
+        return l.id?.toString() || "";
+      });
+      if (
+        !ruleLabelIds.some((id: string) => {
+          return labelIds.includes(id);
+        })
+      ) {
+        return false;
+      }
+    }
+
+    if (
+      rule.networkDeviceNamePattern &&
+      (!networkDevice.name ||
+        !this.testRegex(
+          rule.networkDeviceNamePattern,
+          networkDevice.name,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    if (
+      rule.networkDeviceDescriptionPattern &&
+      (!networkDevice.description ||
+        !this.testRegex(
+          rule.networkDeviceDescriptionPattern,
+          networkDevice.description,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    return true;
+  }
+
+  private testRegex(
+    pattern: string,
+    value: string,
+    rule: NetworkDeviceLabelRule,
+  ): boolean {
+    try {
+      const regex: RegExp = new RegExp(pattern, "i");
+      return regex.test(value);
+    } catch {
+      logger.warn(
+        `Invalid regex in network device label rule ${rule.id}: ${pattern}`,
+      );
+      return false;
+    }
+  }
+}
+
+export default new NetworkDeviceLabelRuleEngineServiceClass();

package/Server/Services/NetworkDeviceLabelRuleService.ts

@@ -0,0 +1,14 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceLabelRule";
+import { IsBillingEnabled } from "../EnvironmentConfig";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+    if (IsBillingEnabled) {
+      this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365);
+    }
+  }
+}
+
+export default new Service();

package/Server/Services/NetworkDeviceOwnerRuleEngineService.ts

@@ -0,0 +1,222 @@
+import Label from "../../Models/DatabaseModels/Label";
+import NetworkDevice from "../../Models/DatabaseModels/NetworkDevice";
+import NetworkDeviceOwnerRule from "../../Models/DatabaseModels/NetworkDeviceOwnerRule";
+import NetworkDeviceOwnerUser from "../../Models/DatabaseModels/NetworkDeviceOwnerUser";
+import NetworkDeviceOwnerTeam from "../../Models/DatabaseModels/NetworkDeviceOwnerTeam";
+import NetworkDeviceOwnerRuleService from "./NetworkDeviceOwnerRuleService";
+import NetworkDeviceOwnerUserService from "./NetworkDeviceOwnerUserService";
+import NetworkDeviceOwnerTeamService from "./NetworkDeviceOwnerTeamService";
+import NetworkDeviceService from "./NetworkDeviceService";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger, { LogAttributes } from "../Utils/Logger";
+
+class NetworkDeviceOwnerRuleEngineServiceClass {
+  /**
+   * Evaluates NetworkDeviceOwnerRule rows for the given network device and adds matched
+   * owner users / teams via NetworkDeviceOwnerUserService / NetworkDeviceOwnerTeamService. Rules
+   * with notifyOwners set notify the added owners; rules with notifyOwners off
+   * add silently.
+   */
+  @CaptureSpan()
+  public async applyRulesToNetworkDevice(
+    networkDevice: NetworkDevice,
+  ): Promise<void> {
+    if (!networkDevice.id || !networkDevice.projectId) {
+      return;
+    }
+
+    try {
+      const rules: Array<NetworkDeviceOwnerRule> =
+        await NetworkDeviceOwnerRuleService.findBy({
+          query: {
+            projectId: networkDevice.projectId,
+            isEnabled: true,
+          },
+          props: { isRoot: true },
+          select: {
+            _id: true,
+            name: true,
+            notifyOwners: true,
+            networkDeviceLabels: { _id: true },
+            networkDeviceNamePattern: true,
+            networkDeviceDescriptionPattern: true,
+            ownerUsers: { _id: true },
+            ownerTeams: { _id: true },
+          },
+          limit: 100,
+          skip: 0,
+        });
+
+      if (rules.length === 0) {
+        return;
+      }
+
+      const networkDeviceWithDetails: NetworkDevice | null =
+        await NetworkDeviceService.findOneById({
+          id: networkDevice.id,
+          select: {
+            name: true,
+            description: true,
+            labels: { _id: true },
+          },
+          props: { isRoot: true },
+        });
+
+      if (!networkDeviceWithDetails) {
+        return;
+      }
+
+      const usersByNotify: Map<boolean, Set<string>> = new Map([
+        [true, new Set()],
+        [false, new Set()],
+      ]);
+      const teamsByNotify: Map<boolean, Set<string>> = new Map([
+        [true, new Set()],
+        [false, new Set()],
+      ]);
+
+      const matchedRules: Array<NetworkDeviceOwnerRule> = [];
+
+      for (const rule of rules) {
+        const matches: boolean = this.doesNetworkDeviceMatchRule(
+          networkDeviceWithDetails,
+          rule,
+        );
+        if (!matches) {
+          continue;
+        }
+        let ruleAddedAny: boolean = false;
+        const notify: boolean = rule.notifyOwners !== false;
+        for (const user of rule.ownerUsers || []) {
+          if (user.id) {
+            usersByNotify.get(notify)!.add(user.id.toString());
+            ruleAddedAny = true;
+          }
+        }
+        for (const team of rule.ownerTeams || []) {
+          if (team.id) {
+            teamsByNotify.get(notify)!.add(team.id.toString());
+            ruleAddedAny = true;
+          }
+        }
+        if (ruleAddedAny) {
+          matchedRules.push(rule);
+        }
+      }
+
+      if (matchedRules.length === 0) {
+        return;
+      }
+
+      for (const notify of [true, false]) {
+        const userIds: Set<string> = usersByNotify.get(notify)!;
+        const teamIds: Set<string> = teamsByNotify.get(notify)!;
+
+        for (const userId of userIds) {
+          const owner: NetworkDeviceOwnerUser = new NetworkDeviceOwnerUser();
+          owner.networkDeviceId = networkDevice.id;
+          owner.projectId = networkDevice.projectId;
+          owner.userId = new ObjectID(userId);
+          owner.isOwnerNotified = !notify;
+          await NetworkDeviceOwnerUserService.create({
+            data: owner,
+            props: { isRoot: true },
+          });
+        }
+
+        for (const teamId of teamIds) {
+          const owner: NetworkDeviceOwnerTeam = new NetworkDeviceOwnerTeam();
+          owner.networkDeviceId = networkDevice.id;
+          owner.projectId = networkDevice.projectId;
+          owner.teamId = new ObjectID(teamId);
+          owner.isOwnerNotified = !notify;
+          await NetworkDeviceOwnerTeamService.create({
+            data: owner,
+            props: { isRoot: true },
+          });
+        }
+      }
+
+      logger.debug(
+        `NetworkDeviceOwnerRuleEngine added owners to network device ${networkDevice.id}`,
+        { projectId: networkDevice.projectId.toString() } as LogAttributes,
+      );
+    } catch (error) {
+      logger.error(`Error applying network device owner rules: ${error}`, {
+        projectId: networkDevice.projectId?.toString(),
+        networkDeviceId: networkDevice.id?.toString(),
+      } as LogAttributes);
+    }
+  }
+
+  private doesNetworkDeviceMatchRule(
+    networkDevice: NetworkDevice,
+    rule: NetworkDeviceOwnerRule,
+  ): boolean {
+    if (rule.networkDeviceLabels && rule.networkDeviceLabels.length > 0) {
+      if (!networkDevice.labels || networkDevice.labels.length === 0) {
+        return false;
+      }
+      const ruleLabelIds: Array<string> = rule.networkDeviceLabels.map(
+        (l: Label) => {
+          return l.id?.toString() || "";
+        },
+      );
+      const labelIds: Array<string> = networkDevice.labels.map((l: Label) => {
+        return l.id?.toString() || "";
+      });
+      if (
+        !ruleLabelIds.some((id: string) => {
+          return labelIds.includes(id);
+        })
+      ) {
+        return false;
+      }
+    }
+
+    if (
+      rule.networkDeviceNamePattern &&
+      (!networkDevice.name ||
+        !this.testRegex(
+          rule.networkDeviceNamePattern,
+          networkDevice.name,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    if (
+      rule.networkDeviceDescriptionPattern &&
+      (!networkDevice.description ||
+        !this.testRegex(
+          rule.networkDeviceDescriptionPattern,
+          networkDevice.description,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    return true;
+  }
+
+  private testRegex(
+    pattern: string,
+    value: string,
+    rule: NetworkDeviceOwnerRule,
+  ): boolean {
+    try {
+      const regex: RegExp = new RegExp(pattern, "i");
+      return regex.test(value);
+    } catch {
+      logger.warn(
+        `Invalid regex in network device owner rule ${rule.id}: ${pattern}`,
+      );
+      return false;
+    }
+  }
+}
+
+export default new NetworkDeviceOwnerRuleEngineServiceClass();

package/Server/Services/NetworkDeviceOwnerRuleService.ts

@@ -0,0 +1,14 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceOwnerRule";
+import { IsBillingEnabled } from "../EnvironmentConfig";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+    if (IsBillingEnabled) {
+      this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365);
+    }
+  }
+}
+
+export default new Service();

package/Server/Services/NetworkDeviceOwnerTeamService.ts

@@ -0,0 +1,10 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceOwnerTeam";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+
+export default new Service();

package/Server/Services/NetworkDeviceOwnerUserService.ts

@@ -0,0 +1,10 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceOwnerUser";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+
+export default new Service();