@oneuptime/common 11.7.4 → 12.0.0

package/Server/Services/MonitorService.ts

@@ -695,6 +695,26 @@ export class Service extends DatabaseService<Model> {
       projectId: createBy.props.tenantId,
     });
 
+    /*
+     * A new monitor starts in the project's operational status. A project can
+     * hold MORE than one operational state (a user - or an E2E fixture - can
+     * add another `isOperationalState: true` status), so this lookup MUST be
+     * deterministic. Without an explicit sort, findOneBy falls back to
+     * `createdAt DESC` and hands back whichever operational status was created
+     * most recently - so a monitor created right after a caller adds a custom
+     * operational status silently adopts THAT status as its currentMonitorStatusId
+     * instead of the project's default. When the custom status is later deleted
+     * while the monitor still points at it, the currentMonitorStatusId foreign
+     * key (ON DELETE NO ACTION) blocks the delete forever - the intermittent
+     * "Monitor records still reference it" failure in the Terraform E2E suite,
+     * where the monitors quietly latched onto the fixture's freshly-created
+     * "TF Operational" instead of the seeded default.
+     *
+     * Order by priority ascending (the seeded default operational status is
+     * priority 0 - the primary/highest-precedence operational state) and break
+     * ties by the oldest row, so the choice is stable and always resolves to the
+     * project's canonical operational status.
+     */
     const monitorStatus: MonitorStatus | null =
       await MonitorStatusService.findOneBy({
         query: {
@@ -704,6 +724,10 @@ export class Service extends DatabaseService<Model> {
         select: {
           _id: true,
         },
+        sort: {
+          priority: SortOrder.Ascending,
+          createdAt: SortOrder.Ascending,
+        },
         props: {
           isRoot: true,
         },

package/Server/Services/MonitorStatusService.ts

@@ -1,3 +1,4 @@
+import logger from "../Utils/Logger";
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
@@ -142,17 +143,30 @@ export class Service extends DatabaseService<Model> {
         newPriority = monitorStatus.priority! - 1;
       }
 
-      await this.updateOneBy({
-        query: {
-          _id: monitorStatus._id!,
-        },
-        data: {
-          priority: newPriority,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
+      /*
+       * Concurrent deletes (e.g. Terraform destroying several statuses in
+       * parallel) can soft-delete a status between the findBy above and this
+       * update. save() then treats the row as new and INSERTs with a null
+       * projectId, failing the whole delete with a 500. A status that
+       * vanished mid-rearrange needs no repositioning — skip it.
+       */
+      try {
+        await this.updateOneBy({
+          query: {
+            _id: monitorStatus._id!,
+          },
+          data: {
+            priority: newPriority,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+      } catch (err) {
+        logger.warn(
+          `rearrangePriority: skipping monitor status ${monitorStatus._id?.toString()} (likely deleted concurrently): ${err}`,
+        );
+      }
     }
   }
 }

package/Server/Services/NetworkDeviceLabelRuleEngineService.ts

@@ -4,6 +4,7 @@ import NetworkDeviceLabelRule from "../../Models/DatabaseModels/NetworkDeviceLab
 import NetworkDeviceLabelRuleService from "./NetworkDeviceLabelRuleService";
 import NetworkDeviceService from "./NetworkDeviceService";
 import ObjectID from "../../Types/ObjectID";
+import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 
@@ -159,24 +160,18 @@ class NetworkDeviceLabelRuleEngineServiceClass {
 
     if (
       rule.networkDeviceNamePattern &&
-      (!networkDevice.name ||
-        !this.testRegex(
-          rule.networkDeviceNamePattern,
-          networkDevice.name,
-          rule,
-        ))
+      !this.testPattern(rule.networkDeviceNamePattern, networkDevice.name, rule)
     ) {
       return false;
     }
 
     if (
       rule.networkDeviceDescriptionPattern &&
-      (!networkDevice.description ||
-        !this.testRegex(
-          rule.networkDeviceDescriptionPattern,
-          networkDevice.description,
-          rule,
-        ))
+      !this.testPattern(
+        rule.networkDeviceDescriptionPattern,
+        networkDevice.description,
+        rule,
+      )
     ) {
       return false;
     }
@@ -184,20 +179,24 @@ class NetworkDeviceLabelRuleEngineServiceClass {
     return true;
   }
 
-  private testRegex(
+  /*
+   * Patterns are regexes, with a '*' wildcard fallback so the glob syntax the
+   * neighbouring site assignment rules use does not silently match nothing.
+   * See Common/Utils/Rules/RulePatternMatchUtil.
+   */
+  private testPattern(
     pattern: string,
-    value: string,
+    value: string | undefined,
     rule: NetworkDeviceLabelRule,
   ): boolean {
-    try {
-      const regex: RegExp = new RegExp(pattern, "i");
-      return regex.test(value);
-    } catch {
+    if (!RulePatternMatchUtil.isSupportedPattern(pattern)) {
       logger.warn(
-        `Invalid regex in network device label rule ${rule.id}: ${pattern}`,
+        `Invalid pattern in network device label rule ${rule.id}: ${pattern}. It is neither a valid regular expression nor a wildcard pattern, so it will never match.`,
       );
       return false;
     }
+
+    return RulePatternMatchUtil.matches(value, pattern);
   }
 }
 

package/Server/Services/NetworkDeviceLabelRuleService.ts

@@ -1,6 +1,11 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/NetworkDeviceLabelRule";
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import NetworkDeviceRulePatternValidator from "../Utils/NetworkDevice/RulePatternValidator";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -9,6 +14,40 @@ export class Service extends DatabaseService<Model> {
       this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365);
     }
   }
+
+  /*
+   * A pattern that is neither a valid regex nor a wildcard can only ever
+   * match nothing, and the rule engine has no way to say so - it just quietly
+   * stops labelling. Reject it while the user is still looking at the form.
+   * See Common/Utils/Rules/RulePatternMatchUtil for the accepted syntaxes.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    NetworkDeviceRulePatternValidator.validate({
+      namePattern: createBy.data.networkDeviceNamePattern,
+      descriptionPattern: createBy.data.networkDeviceDescriptionPattern,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    NetworkDeviceRulePatternValidator.validate({
+      namePattern: (updateBy.data as any)["networkDeviceNamePattern"] as
+        | string
+        | undefined,
+      descriptionPattern: (updateBy.data as any)[
+        "networkDeviceDescriptionPattern"
+      ] as string | undefined,
+    });
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();

package/Server/Services/NetworkDeviceOwnerRuleEngineService.ts

@@ -8,6 +8,7 @@ import NetworkDeviceOwnerUserService from "./NetworkDeviceOwnerUserService";
 import NetworkDeviceOwnerTeamService from "./NetworkDeviceOwnerTeamService";
 import NetworkDeviceService from "./NetworkDeviceService";
 import ObjectID from "../../Types/ObjectID";
+import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 
@@ -177,24 +178,18 @@ class NetworkDeviceOwnerRuleEngineServiceClass {
 
     if (
       rule.networkDeviceNamePattern &&
-      (!networkDevice.name ||
-        !this.testRegex(
-          rule.networkDeviceNamePattern,
-          networkDevice.name,
-          rule,
-        ))
+      !this.testPattern(rule.networkDeviceNamePattern, networkDevice.name, rule)
     ) {
       return false;
     }
 
     if (
       rule.networkDeviceDescriptionPattern &&
-      (!networkDevice.description ||
-        !this.testRegex(
-          rule.networkDeviceDescriptionPattern,
-          networkDevice.description,
-          rule,
-        ))
+      !this.testPattern(
+        rule.networkDeviceDescriptionPattern,
+        networkDevice.description,
+        rule,
+      )
     ) {
       return false;
     }
@@ -202,20 +197,24 @@ class NetworkDeviceOwnerRuleEngineServiceClass {
     return true;
   }
 
-  private testRegex(
+  /*
+   * Patterns are regexes, with a '*' wildcard fallback so the glob syntax the
+   * neighbouring site assignment rules use does not silently match nothing.
+   * See Common/Utils/Rules/RulePatternMatchUtil.
+   */
+  private testPattern(
     pattern: string,
-    value: string,
+    value: string | undefined,
     rule: NetworkDeviceOwnerRule,
   ): boolean {
-    try {
-      const regex: RegExp = new RegExp(pattern, "i");
-      return regex.test(value);
-    } catch {
+    if (!RulePatternMatchUtil.isSupportedPattern(pattern)) {
       logger.warn(
-        `Invalid regex in network device owner rule ${rule.id}: ${pattern}`,
+        `Invalid pattern in network device owner rule ${rule.id}: ${pattern}. It is neither a valid regular expression nor a wildcard pattern, so it will never match.`,
       );
       return false;
     }
+
+    return RulePatternMatchUtil.matches(value, pattern);
   }
 }
 

package/Server/Services/NetworkDeviceOwnerRuleService.ts

@@ -1,6 +1,11 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/NetworkDeviceOwnerRule";
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import NetworkDeviceRulePatternValidator from "../Utils/NetworkDevice/RulePatternValidator";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -9,6 +14,38 @@ export class Service extends DatabaseService<Model> {
       this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365);
     }
   }
+
+  /*
+   * Same contract as NetworkDeviceLabelRuleService: a pattern that can never
+   * match is caught at write time rather than silently never adding owners.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    NetworkDeviceRulePatternValidator.validate({
+      namePattern: createBy.data.networkDeviceNamePattern,
+      descriptionPattern: createBy.data.networkDeviceDescriptionPattern,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    NetworkDeviceRulePatternValidator.validate({
+      namePattern: (updateBy.data as any)["networkDeviceNamePattern"] as
+        | string
+        | undefined,
+      descriptionPattern: (updateBy.data as any)[
+        "networkDeviceDescriptionPattern"
+      ] as string | undefined,
+    });
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();

package/Server/Services/NetworkDeviceService.ts

@@ -18,8 +18,56 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 import { EntityManager } from "typeorm";
 
+/*
+ * Columns a NetworkSiteAssignmentRule's hostname pattern is matched against.
+ * A write to any of them can change which rule wins for the device, so
+ * onUpdateSuccess re-evaluates the rules. `sysName` matters most in practice:
+ * a discovery import stores the responding IP in `hostname` and only the SNMP
+ * walk fills `sysName` in later, so a device's real identity usually lands
+ * AFTER creation.
+ */
+const SITE_RULE_IDENTITY_COLUMNS: Array<string> = [
+  "hostname",
+  "name",
+  "sysName",
+];
+
+/*
+ * Both spellings of "the device's site" in a write payload - see
+ * RelationIdUtil for why a hook has to watch for both.
+ */
+const SITE_KEYS: Array<string> = ["siteId", "site"];
+
+/*
+ * Null, undefined and "  Core-SW " all mean the same thing to a
+ * case-insensitive wildcard match, so compare identity values normalised -
+ * otherwise a no-op rewrite of sysName on every SNMP walk would look like a
+ * change and re-run the rules for the whole fleet every polling cycle.
+ */
+function normalizeIdentityValue(value: unknown): string {
+  if (value === null || value === undefined) {
+    return "";
+  }
+
+  return String(value).trim().toLowerCase();
+}
+
+// True when the payload sets the device's site, under either spelling.
+function isSiteWrite(dataKeys: Array<string>): boolean {
+  return RelationIdUtil.isWritten(dataKeys, SITE_KEYS);
+}
+
+/*
+ * The site a payload moves the device to, or null when it clears the site (or
+ * carries no resolvable id).
+ */
+function readSiteIdFromData(data: Record<string, unknown>): ObjectID | null {
+  return RelationIdUtil.read(data, SITE_KEYS);
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -88,9 +136,18 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
-    if (createBy.data.siteId) {
+    /*
+     * Read both spellings: the dashboard posts the `site` relation, not the
+     * `siteId` column, so guarding only `siteId` let a UI-created device
+     * point at another project's site.
+     */
+    const siteId: ObjectID | null = readSiteIdFromData(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (siteId) {
       await this.assertSiteBelongsToProject({
-        siteId: createBy.data.siteId,
+        siteId: siteId,
         projectId: createBy.data.projectId,
       });
     }
@@ -124,9 +181,16 @@ export class Service extends DatabaseService<Model> {
           );
         })
         .then(async () => {
-          if (createdItem.siteId) {
+          /*
+           * `site` (relation) or `siteId` (column) - a device created from
+           * the dashboard carries only the former.
+           */
+          const createdSiteId: ObjectID | null =
+            createdItem.siteId || createdItem.site?.id || null;
+
+          if (createdSiteId) {
             await NetworkSiteService.recomputeRollupForSiteAndAncestors(
-              createdItem.siteId,
+              createdSiteId,
             );
           } else {
             await this.applySiteAssignmentRulesToDevice(createdItem.id!);
@@ -146,9 +210,11 @@ export class Service extends DatabaseService<Model> {
   }
 
   /*
-   * Capture the previous site of every matched device when an update
-   * touches siteId, so onUpdateSuccess can refresh the OLD site's rollup
-   * as well as the new one.
+   * Capture the previous state of every matched device when an update
+   * touches siteId (so onUpdateSuccess can refresh the OLD site's rollup as
+   * well as the new one) or touches one of the columns site assignment rules
+   * match on (so onUpdateSuccess can tell a real rename from the identical
+   * sysName the SNMP walk rewrites on every poll).
    */
   @CaptureSpan()
   protected override async onBeforeUpdate(
@@ -156,7 +222,14 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnUpdate<Model>> {
     const dataKeys: Array<string> = Object.keys(updateBy.data || {});
 
-    if (!dataKeys.includes("siteId")) {
+    const isSiteChange: boolean = isSiteWrite(dataKeys);
+    const isIdentityChange: boolean = SITE_RULE_IDENTITY_COLUMNS.some(
+      (column: string) => {
+        return dataKeys.includes(column);
+      },
+    );
+
+    if (!isSiteChange && !isIdentityChange) {
       return { updateBy, carryForward: null };
     }
 
@@ -166,6 +239,9 @@ export class Service extends DatabaseService<Model> {
         _id: true,
         projectId: true,
         siteId: true,
+        hostname: true,
+        name: true,
+        sysName: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -174,10 +250,11 @@ export class Service extends DatabaseService<Model> {
       },
     });
 
-    const newSiteIdValue: unknown = (updateBy.data as any)["siteId"];
+    const newSiteId: ObjectID | null = readSiteIdFromData(
+      updateBy.data as unknown as Record<string, unknown>,
+    );
 
-    if (newSiteIdValue) {
-      const newSiteId: ObjectID = new ObjectID(newSiteIdValue.toString());
+    if (newSiteId) {
       const checkedProjectIds: Set<string> = new Set();
 
       for (const previousDevice of previousDevices) {
@@ -216,7 +293,7 @@ export class Service extends DatabaseService<Model> {
     try {
       const dataKeys: Array<string> = Object.keys(onUpdate.updateBy.data || {});
 
-      if (dataKeys.includes("siteId")) {
+      if (isSiteWrite(dataKeys)) {
         // Manual or rule-driven site change: refresh old + new site chains.
         const affectedSiteIds: Map<string, ObjectID> = new Map();
 
@@ -250,23 +327,55 @@ export class Service extends DatabaseService<Model> {
           }
         }
 
-        const newSiteIdValue: unknown = (onUpdate.updateBy.data as any)[
-          "siteId"
-        ];
-        if (newSiteIdValue && updatedItemIds.length > 0) {
-          const newSiteId: ObjectID = new ObjectID(newSiteIdValue.toString());
+        const newSiteId: ObjectID | null = readSiteIdFromData(
+          onUpdate.updateBy.data as unknown as Record<string, unknown>,
+        );
+        if (newSiteId && updatedItemIds.length > 0) {
           affectedSiteIds.set(newSiteId.toString(), newSiteId);
         }
 
         for (const siteId of affectedSiteIds.values()) {
           await NetworkSiteService.recomputeRollupForSiteAndAncestors(siteId);
         }
-      } else if (dataKeys.includes("hostname")) {
+      } else if (
+        SITE_RULE_IDENTITY_COLUMNS.some((column: string) => {
+          return dataKeys.includes(column);
+        })
+      ) {
         /*
-         * The device's address changed, so subnet/hostname rules may now
-         * resolve differently — re-evaluate each updated device.
+         * The device's address or name changed, so subnet/hostname rules may
+         * now resolve differently — re-evaluate each updated device whose
+         * identity actually moved (or that has no site yet).
          */
+        const previousDevicesById: Map<string, Model> = new Map();
+
+        const previousDevices: Array<Model> =
+          (onUpdate.carryForward?.previousDevices as Array<Model>) || [];
+
+        for (const previousDevice of previousDevices) {
+          if (previousDevice.id) {
+            previousDevicesById.set(
+              previousDevice.id.toString(),
+              previousDevice,
+            );
+          }
+        }
+
         for (const deviceId of updatedItemIds) {
+          const previousDevice: Model | undefined = previousDevicesById.get(
+            deviceId.toString(),
+          );
+
+          if (
+            previousDevice &&
+            !this.shouldReapplySiteAssignmentRules(
+              previousDevice,
+              onUpdate.updateBy.data as Record<string, unknown>,
+            )
+          ) {
+            continue;
+          }
+
           await this.applySiteAssignmentRulesToDevice(deviceId);
         }
       }
@@ -279,6 +388,43 @@ export class Service extends DatabaseService<Model> {
     return onUpdate;
   }
 
+  /*
+   * True when an update that touched an identity column is worth re-running
+   * the assignment rules for.
+   *
+   * A device with no site is always re-evaluated: rules are usually written
+   * (or corrected) after the devices were imported, and the SNMP walk is the
+   * only thing that ever touches such a device again — without this, a
+   * matching rule would never reach it. Assigning a site to a device that has
+   * none cannot undo a human's choice.
+   *
+   * A device that already sits in a site is only re-evaluated when its
+   * identity really changed, so the sysName the walk rewrites verbatim every
+   * polling cycle does not keep dragging a manually placed device back to
+   * whatever a rule prefers.
+   */
+  private shouldReapplySiteAssignmentRules(
+    previousDevice: Model,
+    data: Record<string, unknown>,
+  ): boolean {
+    if (!previousDevice.siteId) {
+      return true;
+    }
+
+    const dataKeys: Array<string> = Object.keys(data || {});
+
+    return SITE_RULE_IDENTITY_COLUMNS.some((column: string) => {
+      if (!dataKeys.includes(column)) {
+        return false;
+      }
+
+      return (
+        normalizeIdentityValue(data[column]) !==
+        normalizeIdentityValue((previousDevice as any)[column])
+      );
+    });
+  }
+
   /*
    * Matches one device against the project's NetworkSiteAssignmentRules
    * (highest priority wins) and assigns the winning site. The assignment
@@ -297,6 +443,7 @@ export class Service extends DatabaseService<Model> {
         siteId: true,
         hostname: true,
         sysName: true,
+        name: true,
       },
       props: {
         isRoot: true,
@@ -333,7 +480,10 @@ export class Service extends DatabaseService<Model> {
 
     /*
      * The device's hostname column stores an IP address or a DNS name; pass
-     * it as both — ipInCidr safely rejects non-IP strings.
+     * it as both — ipInCidr safely rejects non-IP strings. `name` is passed
+     * too because a discovery import puts the responding IP in `hostname`
+     * and the device's real identity in `name`, so a hostname pattern that
+     * only ever saw `hostname` could not match anything a user recognises.
      */
     const winner: NetworkSiteAssignmentRule | null = CidrMatchUtil.pickRule(
       rules,
@@ -341,6 +491,7 @@ export class Service extends DatabaseService<Model> {
         ip: device.hostname,
         hostname: device.hostname,
         sysName: device.sysName,
+        name: device.name,
       },
     );