@oneuptime/common 11.7.3 → 12.0.0

package/Server/Services/NetworkDeviceOwnerRuleEngineService.ts

@@ -8,6 +8,7 @@ import NetworkDeviceOwnerUserService from "./NetworkDeviceOwnerUserService";
 import NetworkDeviceOwnerTeamService from "./NetworkDeviceOwnerTeamService";
 import NetworkDeviceService from "./NetworkDeviceService";
 import ObjectID from "../../Types/ObjectID";
+import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 
@@ -177,24 +178,18 @@ class NetworkDeviceOwnerRuleEngineServiceClass {
 
     if (
       rule.networkDeviceNamePattern &&
-      (!networkDevice.name ||
-        !this.testRegex(
-          rule.networkDeviceNamePattern,
-          networkDevice.name,
-          rule,
-        ))
+      !this.testPattern(rule.networkDeviceNamePattern, networkDevice.name, rule)
     ) {
       return false;
     }
 
     if (
       rule.networkDeviceDescriptionPattern &&
-      (!networkDevice.description ||
-        !this.testRegex(
-          rule.networkDeviceDescriptionPattern,
-          networkDevice.description,
-          rule,
-        ))
+      !this.testPattern(
+        rule.networkDeviceDescriptionPattern,
+        networkDevice.description,
+        rule,
+      )
     ) {
       return false;
     }
@@ -202,20 +197,24 @@ class NetworkDeviceOwnerRuleEngineServiceClass {
     return true;
   }
 
-  private testRegex(
+  /*
+   * Patterns are regexes, with a '*' wildcard fallback so the glob syntax the
+   * neighbouring site assignment rules use does not silently match nothing.
+   * See Common/Utils/Rules/RulePatternMatchUtil.
+   */
+  private testPattern(
     pattern: string,
-    value: string,
+    value: string | undefined,
     rule: NetworkDeviceOwnerRule,
   ): boolean {
-    try {
-      const regex: RegExp = new RegExp(pattern, "i");
-      return regex.test(value);
-    } catch {
+    if (!RulePatternMatchUtil.isSupportedPattern(pattern)) {
       logger.warn(
-        `Invalid regex in network device owner rule ${rule.id}: ${pattern}`,
+        `Invalid pattern in network device owner rule ${rule.id}: ${pattern}. It is neither a valid regular expression nor a wildcard pattern, so it will never match.`,
       );
       return false;
     }
+
+    return RulePatternMatchUtil.matches(value, pattern);
   }
 }
 

package/Server/Services/NetworkDeviceOwnerRuleService.ts

@@ -1,6 +1,11 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/NetworkDeviceOwnerRule";
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import NetworkDeviceRulePatternValidator from "../Utils/NetworkDevice/RulePatternValidator";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -9,6 +14,38 @@ export class Service extends DatabaseService<Model> {
       this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365);
     }
   }
+
+  /*
+   * Same contract as NetworkDeviceLabelRuleService: a pattern that can never
+   * match is caught at write time rather than silently never adding owners.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    NetworkDeviceRulePatternValidator.validate({
+      namePattern: createBy.data.networkDeviceNamePattern,
+      descriptionPattern: createBy.data.networkDeviceDescriptionPattern,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    NetworkDeviceRulePatternValidator.validate({
+      namePattern: (updateBy.data as any)["networkDeviceNamePattern"] as
+        | string
+        | undefined,
+      descriptionPattern: (updateBy.data as any)[
+        "networkDeviceDescriptionPattern"
+      ] as string | undefined,
+    });
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();

package/Server/Services/NetworkDeviceService.ts

@@ -18,8 +18,56 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 import { EntityManager } from "typeorm";
 
+/*
+ * Columns a NetworkSiteAssignmentRule's hostname pattern is matched against.
+ * A write to any of them can change which rule wins for the device, so
+ * onUpdateSuccess re-evaluates the rules. `sysName` matters most in practice:
+ * a discovery import stores the responding IP in `hostname` and only the SNMP
+ * walk fills `sysName` in later, so a device's real identity usually lands
+ * AFTER creation.
+ */
+const SITE_RULE_IDENTITY_COLUMNS: Array<string> = [
+  "hostname",
+  "name",
+  "sysName",
+];
+
+/*
+ * Both spellings of "the device's site" in a write payload - see
+ * RelationIdUtil for why a hook has to watch for both.
+ */
+const SITE_KEYS: Array<string> = ["siteId", "site"];
+
+/*
+ * Null, undefined and "  Core-SW " all mean the same thing to a
+ * case-insensitive wildcard match, so compare identity values normalised -
+ * otherwise a no-op rewrite of sysName on every SNMP walk would look like a
+ * change and re-run the rules for the whole fleet every polling cycle.
+ */
+function normalizeIdentityValue(value: unknown): string {
+  if (value === null || value === undefined) {
+    return "";
+  }
+
+  return String(value).trim().toLowerCase();
+}
+
+// True when the payload sets the device's site, under either spelling.
+function isSiteWrite(dataKeys: Array<string>): boolean {
+  return RelationIdUtil.isWritten(dataKeys, SITE_KEYS);
+}
+
+/*
+ * The site a payload moves the device to, or null when it clears the site (or
+ * carries no resolvable id).
+ */
+function readSiteIdFromData(data: Record<string, unknown>): ObjectID | null {
+  return RelationIdUtil.read(data, SITE_KEYS);
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -88,9 +136,18 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
-    if (createBy.data.siteId) {
+    /*
+     * Read both spellings: the dashboard posts the `site` relation, not the
+     * `siteId` column, so guarding only `siteId` let a UI-created device
+     * point at another project's site.
+     */
+    const siteId: ObjectID | null = readSiteIdFromData(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (siteId) {
       await this.assertSiteBelongsToProject({
-        siteId: createBy.data.siteId,
+        siteId: siteId,
         projectId: createBy.data.projectId,
       });
     }
@@ -124,9 +181,16 @@ export class Service extends DatabaseService<Model> {
           );
         })
         .then(async () => {
-          if (createdItem.siteId) {
+          /*
+           * `site` (relation) or `siteId` (column) - a device created from
+           * the dashboard carries only the former.
+           */
+          const createdSiteId: ObjectID | null =
+            createdItem.siteId || createdItem.site?.id || null;
+
+          if (createdSiteId) {
             await NetworkSiteService.recomputeRollupForSiteAndAncestors(
-              createdItem.siteId,
+              createdSiteId,
             );
           } else {
             await this.applySiteAssignmentRulesToDevice(createdItem.id!);
@@ -146,9 +210,11 @@ export class Service extends DatabaseService<Model> {
   }
 
   /*
-   * Capture the previous site of every matched device when an update
-   * touches siteId, so onUpdateSuccess can refresh the OLD site's rollup
-   * as well as the new one.
+   * Capture the previous state of every matched device when an update
+   * touches siteId (so onUpdateSuccess can refresh the OLD site's rollup as
+   * well as the new one) or touches one of the columns site assignment rules
+   * match on (so onUpdateSuccess can tell a real rename from the identical
+   * sysName the SNMP walk rewrites on every poll).
    */
   @CaptureSpan()
   protected override async onBeforeUpdate(
@@ -156,7 +222,14 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnUpdate<Model>> {
     const dataKeys: Array<string> = Object.keys(updateBy.data || {});
 
-    if (!dataKeys.includes("siteId")) {
+    const isSiteChange: boolean = isSiteWrite(dataKeys);
+    const isIdentityChange: boolean = SITE_RULE_IDENTITY_COLUMNS.some(
+      (column: string) => {
+        return dataKeys.includes(column);
+      },
+    );
+
+    if (!isSiteChange && !isIdentityChange) {
       return { updateBy, carryForward: null };
     }
 
@@ -166,6 +239,9 @@ export class Service extends DatabaseService<Model> {
         _id: true,
         projectId: true,
         siteId: true,
+        hostname: true,
+        name: true,
+        sysName: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -174,10 +250,11 @@ export class Service extends DatabaseService<Model> {
       },
     });
 
-    const newSiteIdValue: unknown = (updateBy.data as any)["siteId"];
+    const newSiteId: ObjectID | null = readSiteIdFromData(
+      updateBy.data as unknown as Record<string, unknown>,
+    );
 
-    if (newSiteIdValue) {
-      const newSiteId: ObjectID = new ObjectID(newSiteIdValue.toString());
+    if (newSiteId) {
       const checkedProjectIds: Set<string> = new Set();
 
       for (const previousDevice of previousDevices) {
@@ -216,7 +293,7 @@ export class Service extends DatabaseService<Model> {
     try {
       const dataKeys: Array<string> = Object.keys(onUpdate.updateBy.data || {});
 
-      if (dataKeys.includes("siteId")) {
+      if (isSiteWrite(dataKeys)) {
         // Manual or rule-driven site change: refresh old + new site chains.
         const affectedSiteIds: Map<string, ObjectID> = new Map();
 
@@ -250,23 +327,55 @@ export class Service extends DatabaseService<Model> {
           }
         }
 
-        const newSiteIdValue: unknown = (onUpdate.updateBy.data as any)[
-          "siteId"
-        ];
-        if (newSiteIdValue && updatedItemIds.length > 0) {
-          const newSiteId: ObjectID = new ObjectID(newSiteIdValue.toString());
+        const newSiteId: ObjectID | null = readSiteIdFromData(
+          onUpdate.updateBy.data as unknown as Record<string, unknown>,
+        );
+        if (newSiteId && updatedItemIds.length > 0) {
           affectedSiteIds.set(newSiteId.toString(), newSiteId);
         }
 
         for (const siteId of affectedSiteIds.values()) {
           await NetworkSiteService.recomputeRollupForSiteAndAncestors(siteId);
         }
-      } else if (dataKeys.includes("hostname")) {
+      } else if (
+        SITE_RULE_IDENTITY_COLUMNS.some((column: string) => {
+          return dataKeys.includes(column);
+        })
+      ) {
         /*
-         * The device's address changed, so subnet/hostname rules may now
-         * resolve differently — re-evaluate each updated device.
+         * The device's address or name changed, so subnet/hostname rules may
+         * now resolve differently — re-evaluate each updated device whose
+         * identity actually moved (or that has no site yet).
          */
+        const previousDevicesById: Map<string, Model> = new Map();
+
+        const previousDevices: Array<Model> =
+          (onUpdate.carryForward?.previousDevices as Array<Model>) || [];
+
+        for (const previousDevice of previousDevices) {
+          if (previousDevice.id) {
+            previousDevicesById.set(
+              previousDevice.id.toString(),
+              previousDevice,
+            );
+          }
+        }
+
         for (const deviceId of updatedItemIds) {
+          const previousDevice: Model | undefined = previousDevicesById.get(
+            deviceId.toString(),
+          );
+
+          if (
+            previousDevice &&
+            !this.shouldReapplySiteAssignmentRules(
+              previousDevice,
+              onUpdate.updateBy.data as Record<string, unknown>,
+            )
+          ) {
+            continue;
+          }
+
           await this.applySiteAssignmentRulesToDevice(deviceId);
         }
       }
@@ -279,6 +388,43 @@ export class Service extends DatabaseService<Model> {
     return onUpdate;
   }
 
+  /*
+   * True when an update that touched an identity column is worth re-running
+   * the assignment rules for.
+   *
+   * A device with no site is always re-evaluated: rules are usually written
+   * (or corrected) after the devices were imported, and the SNMP walk is the
+   * only thing that ever touches such a device again — without this, a
+   * matching rule would never reach it. Assigning a site to a device that has
+   * none cannot undo a human's choice.
+   *
+   * A device that already sits in a site is only re-evaluated when its
+   * identity really changed, so the sysName the walk rewrites verbatim every
+   * polling cycle does not keep dragging a manually placed device back to
+   * whatever a rule prefers.
+   */
+  private shouldReapplySiteAssignmentRules(
+    previousDevice: Model,
+    data: Record<string, unknown>,
+  ): boolean {
+    if (!previousDevice.siteId) {
+      return true;
+    }
+
+    const dataKeys: Array<string> = Object.keys(data || {});
+
+    return SITE_RULE_IDENTITY_COLUMNS.some((column: string) => {
+      if (!dataKeys.includes(column)) {
+        return false;
+      }
+
+      return (
+        normalizeIdentityValue(data[column]) !==
+        normalizeIdentityValue((previousDevice as any)[column])
+      );
+    });
+  }
+
   /*
    * Matches one device against the project's NetworkSiteAssignmentRules
    * (highest priority wins) and assigns the winning site. The assignment
@@ -297,6 +443,7 @@ export class Service extends DatabaseService<Model> {
         siteId: true,
         hostname: true,
         sysName: true,
+        name: true,
       },
       props: {
         isRoot: true,
@@ -333,7 +480,10 @@ export class Service extends DatabaseService<Model> {
 
     /*
      * The device's hostname column stores an IP address or a DNS name; pass
-     * it as both — ipInCidr safely rejects non-IP strings.
+     * it as both — ipInCidr safely rejects non-IP strings. `name` is passed
+     * too because a discovery import puts the responding IP in `hostname`
+     * and the device's real identity in `name`, so a hostname pattern that
+     * only ever saw `hostname` could not match anything a user recognises.
      */
     const winner: NetworkSiteAssignmentRule | null = CidrMatchUtil.pickRule(
       rules,
@@ -341,6 +491,7 @@ export class Service extends DatabaseService<Model> {
         ip: device.hostname,
         hostname: device.hostname,
         sysName: device.sysName,
+        name: device.name,
       },
     );
 

package/Server/Services/NetworkSiteAssignmentRuleService.ts

@@ -1,18 +1,73 @@
 import DatabaseService from "./DatabaseService";
+import NetworkSiteService from "./NetworkSiteService";
 import Model from "../../Models/DatabaseModels/NetworkSiteAssignmentRule";
+import NetworkSite from "../../Models/DatabaseModels/NetworkSite";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
 import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
+
+/*
+ * The dashboard posts the `site` relation while server-side callers write the
+ * `siteId` column; read whichever is present. See RelationIdUtil.
+ */
+const SITE_KEYS: Array<string> = ["siteId", "site"];
+
+function readSiteId(data: Record<string, unknown>): ObjectID | null {
+  return RelationIdUtil.read(data, SITE_KEYS);
+}
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /*
+   * The FK behind siteId only requires the NetworkSite row to exist, not that
+   * it belongs to the rule's project. A rule pointing at a foreign site is
+   * both a cross-tenant read (the rules table renders `site.name`) and a rule
+   * that can never assign anything - NetworkDeviceService's own tenancy guard
+   * rejects the resulting device update. Fail at write time instead, where
+   * the user can see it.
+   */
+  private async assertSiteBelongsToProject(data: {
+    siteId: ObjectID;
+    projectId: ObjectID | undefined;
+  }): Promise<void> {
+    if (!data.projectId) {
+      return;
+    }
+
+    const site: NetworkSite | null = await NetworkSiteService.findOneById({
+      id: data.siteId,
+      select: {
+        _id: true,
+        projectId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!site) {
+      throw new BadDataException("Network site not found.");
+    }
+
+    if (
+      site.projectId &&
+      site.projectId.toString() !== data.projectId.toString()
+    ) {
+      throw new BadDataException(
+        "Network site must belong to the same project.",
+      );
+    }
+  }
+
   /*
    * A rule with neither criterion would match nothing (or, worse, read as
    * "match everything" to a future maintainer) - reject it at write time.
@@ -26,6 +81,17 @@ export class Service extends DatabaseService<Model> {
       hostnamePattern: createBy.data.hostnamePattern,
     });
 
+    const siteId: ObjectID | null = readSiteId(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (siteId) {
+      await this.assertSiteBelongsToProject({
+        siteId: siteId,
+        projectId: createBy.data.projectId,
+      });
+    }
+
     return { createBy, carryForward: null };
   }
 
@@ -35,10 +101,14 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnUpdate<Model>> {
     const dataKeys: Array<string> = Object.keys(updateBy.data || {});
 
-    if (
-      !dataKeys.includes("subnetCidr") &&
-      !dataKeys.includes("hostnamePattern")
-    ) {
+    const isCriteriaChange: boolean =
+      dataKeys.includes("subnetCidr") || dataKeys.includes("hostnamePattern");
+
+    const newSiteId: ObjectID | null = readSiteId(
+      updateBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (!isCriteriaChange && !newSiteId) {
       return { updateBy, carryForward: null };
     }
 
@@ -50,6 +120,7 @@ export class Service extends DatabaseService<Model> {
       query: updateBy.query,
       select: {
         _id: true,
+        projectId: true,
         subnetCidr: true,
         hostnamePattern: true,
       },
@@ -61,14 +132,23 @@ export class Service extends DatabaseService<Model> {
     });
 
     for (const existingRule of existingRules) {
-      this.validateCriteria({
-        subnetCidr: dataKeys.includes("subnetCidr")
-          ? ((updateBy.data as any)["subnetCidr"] as string | null)
-          : existingRule.subnetCidr,
-        hostnamePattern: dataKeys.includes("hostnamePattern")
-          ? ((updateBy.data as any)["hostnamePattern"] as string | null)
-          : existingRule.hostnamePattern,
-      });
+      if (isCriteriaChange) {
+        this.validateCriteria({
+          subnetCidr: dataKeys.includes("subnetCidr")
+            ? ((updateBy.data as any)["subnetCidr"] as string | null)
+            : existingRule.subnetCidr,
+          hostnamePattern: dataKeys.includes("hostnamePattern")
+            ? ((updateBy.data as any)["hostnamePattern"] as string | null)
+            : existingRule.hostnamePattern,
+        });
+      }
+
+      if (newSiteId) {
+        await this.assertSiteBelongsToProject({
+          siteId: newSiteId,
+          projectId: existingRule.projectId,
+        });
+      }
     }
 
     return { updateBy, carryForward: null };

package/Server/Services/NetworkSiteService.ts

@@ -34,12 +34,22 @@ import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import Text from "../../Types/Text";
 import { Raw } from "typeorm";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 import MaterializedPathUtil from "../../Utils/NetworkSite/MaterializedPathUtil";
 import SiteStatusRollupUtil, {
   DeviceHealthState,
   RollupStatusOption,
 } from "../../Utils/NetworkSite/SiteStatusRollupUtil";
 
+/*
+ * Both spellings of "this site's parent" in a write payload: the dashboard's
+ * site form posts the `parentSite` relation while server-side callers write
+ * the `parentSiteId` column. Watching only the column let a re-parent done
+ * from the UI skip cycle detection, the same-project guard and the subtree
+ * path rebase entirely. See RelationIdUtil.
+ */
+const PARENT_SITE_KEYS: Array<string> = ["parentSiteId", "parentSite"];
+
 /*
  * Carried from onBeforeUpdate to onUpdateSuccess when an update touches
  * parentSiteId, so the subtree rebase knows each site's previous state.
@@ -152,9 +162,18 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnCreate<Model>> {
     let parentPath: string | null = null;
 
-    if (createBy.data.parentSiteId) {
+    /*
+     * Both spellings: the dashboard's site form posts the `parentSite`
+     * relation, not the `parentSiteId` column. See RelationIdUtil.
+     */
+    const parentSiteId: ObjectID | null = RelationIdUtil.read(
+      createBy.data as unknown as Record<string, unknown>,
+      PARENT_SITE_KEYS,
+    );
+
+    if (parentSiteId) {
       const parent: Model | null = await this.findOneById({
-        id: createBy.data.parentSiteId,
+        id: parentSiteId,
         select: {
           _id: true,
           projectId: true,
@@ -178,9 +197,7 @@ export class Service extends DatabaseService<Model> {
         );
       }
 
-      parentPath = await this.getMaterializedPathForSite(
-        createBy.data.parentSiteId,
-      );
+      parentPath = await this.getMaterializedPathForSite(parentSiteId);
     }
 
     return {
@@ -228,14 +245,14 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnUpdate<Model>> {
     const dataKeys: Array<string> = Object.keys(updateBy.data || {});
 
-    if (!dataKeys.includes("parentSiteId")) {
+    if (!RelationIdUtil.isWritten(dataKeys, PARENT_SITE_KEYS)) {
       return { updateBy, carryForward: null };
     }
 
-    const newParentIdValue: unknown = (updateBy.data as any)["parentSiteId"];
-    const newParentId: ObjectID | null = newParentIdValue
-      ? new ObjectID(newParentIdValue.toString())
-      : null;
+    const newParentId: ObjectID | null = RelationIdUtil.read(
+      updateBy.data as unknown as Record<string, unknown>,
+      PARENT_SITE_KEYS,
+    );
 
     const previousItems: Array<Model> = await this.findBy({
       query: this.scopeQueryToCallerTenant(updateBy.query, updateBy.props),