@oneuptime/common 11.7.4 → 12.0.1

package/Server/Services/NetworkDeviceService.ts

@@ -18,8 +18,56 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 import { EntityManager } from "typeorm";
 
+/*
+ * Columns a NetworkSiteAssignmentRule's hostname pattern is matched against.
+ * A write to any of them can change which rule wins for the device, so
+ * onUpdateSuccess re-evaluates the rules. `sysName` matters most in practice:
+ * a discovery import stores the responding IP in `hostname` and only the SNMP
+ * walk fills `sysName` in later, so a device's real identity usually lands
+ * AFTER creation.
+ */
+const SITE_RULE_IDENTITY_COLUMNS: Array<string> = [
+  "hostname",
+  "name",
+  "sysName",
+];
+
+/*
+ * Both spellings of "the device's site" in a write payload - see
+ * RelationIdUtil for why a hook has to watch for both.
+ */
+const SITE_KEYS: Array<string> = ["siteId", "site"];
+
+/*
+ * Null, undefined and "  Core-SW " all mean the same thing to a
+ * case-insensitive wildcard match, so compare identity values normalised -
+ * otherwise a no-op rewrite of sysName on every SNMP walk would look like a
+ * change and re-run the rules for the whole fleet every polling cycle.
+ */
+function normalizeIdentityValue(value: unknown): string {
+  if (value === null || value === undefined) {
+    return "";
+  }
+
+  return String(value).trim().toLowerCase();
+}
+
+// True when the payload sets the device's site, under either spelling.
+function isSiteWrite(dataKeys: Array<string>): boolean {
+  return RelationIdUtil.isWritten(dataKeys, SITE_KEYS);
+}
+
+/*
+ * The site a payload moves the device to, or null when it clears the site (or
+ * carries no resolvable id).
+ */
+function readSiteIdFromData(data: Record<string, unknown>): ObjectID | null {
+  return RelationIdUtil.read(data, SITE_KEYS);
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -88,9 +136,18 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
-    if (createBy.data.siteId) {
+    /*
+     * Read both spellings: the dashboard posts the `site` relation, not the
+     * `siteId` column, so guarding only `siteId` let a UI-created device
+     * point at another project's site.
+     */
+    const siteId: ObjectID | null = readSiteIdFromData(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (siteId) {
       await this.assertSiteBelongsToProject({
-        siteId: createBy.data.siteId,
+        siteId: siteId,
         projectId: createBy.data.projectId,
       });
     }
@@ -124,9 +181,16 @@ export class Service extends DatabaseService<Model> {
           );
         })
         .then(async () => {
-          if (createdItem.siteId) {
+          /*
+           * `site` (relation) or `siteId` (column) - a device created from
+           * the dashboard carries only the former.
+           */
+          const createdSiteId: ObjectID | null =
+            createdItem.siteId || createdItem.site?.id || null;
+
+          if (createdSiteId) {
             await NetworkSiteService.recomputeRollupForSiteAndAncestors(
-              createdItem.siteId,
+              createdSiteId,
             );
           } else {
             await this.applySiteAssignmentRulesToDevice(createdItem.id!);
@@ -146,9 +210,11 @@ export class Service extends DatabaseService<Model> {
   }
 
   /*
-   * Capture the previous site of every matched device when an update
-   * touches siteId, so onUpdateSuccess can refresh the OLD site's rollup
-   * as well as the new one.
+   * Capture the previous state of every matched device when an update
+   * touches siteId (so onUpdateSuccess can refresh the OLD site's rollup as
+   * well as the new one) or touches one of the columns site assignment rules
+   * match on (so onUpdateSuccess can tell a real rename from the identical
+   * sysName the SNMP walk rewrites on every poll).
    */
   @CaptureSpan()
   protected override async onBeforeUpdate(
@@ -156,7 +222,14 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnUpdate<Model>> {
     const dataKeys: Array<string> = Object.keys(updateBy.data || {});
 
-    if (!dataKeys.includes("siteId")) {
+    const isSiteChange: boolean = isSiteWrite(dataKeys);
+    const isIdentityChange: boolean = SITE_RULE_IDENTITY_COLUMNS.some(
+      (column: string) => {
+        return dataKeys.includes(column);
+      },
+    );
+
+    if (!isSiteChange && !isIdentityChange) {
       return { updateBy, carryForward: null };
     }
 
@@ -166,6 +239,9 @@ export class Service extends DatabaseService<Model> {
         _id: true,
         projectId: true,
         siteId: true,
+        hostname: true,
+        name: true,
+        sysName: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -174,10 +250,11 @@ export class Service extends DatabaseService<Model> {
       },
     });
 
-    const newSiteIdValue: unknown = (updateBy.data as any)["siteId"];
+    const newSiteId: ObjectID | null = readSiteIdFromData(
+      updateBy.data as unknown as Record<string, unknown>,
+    );
 
-    if (newSiteIdValue) {
-      const newSiteId: ObjectID = new ObjectID(newSiteIdValue.toString());
+    if (newSiteId) {
       const checkedProjectIds: Set<string> = new Set();
 
       for (const previousDevice of previousDevices) {
@@ -216,7 +293,7 @@ export class Service extends DatabaseService<Model> {
     try {
       const dataKeys: Array<string> = Object.keys(onUpdate.updateBy.data || {});
 
-      if (dataKeys.includes("siteId")) {
+      if (isSiteWrite(dataKeys)) {
         // Manual or rule-driven site change: refresh old + new site chains.
         const affectedSiteIds: Map<string, ObjectID> = new Map();
 
@@ -250,23 +327,55 @@ export class Service extends DatabaseService<Model> {
           }
         }
 
-        const newSiteIdValue: unknown = (onUpdate.updateBy.data as any)[
-          "siteId"
-        ];
-        if (newSiteIdValue && updatedItemIds.length > 0) {
-          const newSiteId: ObjectID = new ObjectID(newSiteIdValue.toString());
+        const newSiteId: ObjectID | null = readSiteIdFromData(
+          onUpdate.updateBy.data as unknown as Record<string, unknown>,
+        );
+        if (newSiteId && updatedItemIds.length > 0) {
           affectedSiteIds.set(newSiteId.toString(), newSiteId);
         }
 
         for (const siteId of affectedSiteIds.values()) {
           await NetworkSiteService.recomputeRollupForSiteAndAncestors(siteId);
         }
-      } else if (dataKeys.includes("hostname")) {
+      } else if (
+        SITE_RULE_IDENTITY_COLUMNS.some((column: string) => {
+          return dataKeys.includes(column);
+        })
+      ) {
         /*
-         * The device's address changed, so subnet/hostname rules may now
-         * resolve differently — re-evaluate each updated device.
+         * The device's address or name changed, so subnet/hostname rules may
+         * now resolve differently — re-evaluate each updated device whose
+         * identity actually moved (or that has no site yet).
          */
+        const previousDevicesById: Map<string, Model> = new Map();
+
+        const previousDevices: Array<Model> =
+          (onUpdate.carryForward?.previousDevices as Array<Model>) || [];
+
+        for (const previousDevice of previousDevices) {
+          if (previousDevice.id) {
+            previousDevicesById.set(
+              previousDevice.id.toString(),
+              previousDevice,
+            );
+          }
+        }
+
         for (const deviceId of updatedItemIds) {
+          const previousDevice: Model | undefined = previousDevicesById.get(
+            deviceId.toString(),
+          );
+
+          if (
+            previousDevice &&
+            !this.shouldReapplySiteAssignmentRules(
+              previousDevice,
+              onUpdate.updateBy.data as Record<string, unknown>,
+            )
+          ) {
+            continue;
+          }
+
           await this.applySiteAssignmentRulesToDevice(deviceId);
         }
       }
@@ -279,6 +388,43 @@ export class Service extends DatabaseService<Model> {
     return onUpdate;
   }
 
+  /*
+   * True when an update that touched an identity column is worth re-running
+   * the assignment rules for.
+   *
+   * A device with no site is always re-evaluated: rules are usually written
+   * (or corrected) after the devices were imported, and the SNMP walk is the
+   * only thing that ever touches such a device again — without this, a
+   * matching rule would never reach it. Assigning a site to a device that has
+   * none cannot undo a human's choice.
+   *
+   * A device that already sits in a site is only re-evaluated when its
+   * identity really changed, so the sysName the walk rewrites verbatim every
+   * polling cycle does not keep dragging a manually placed device back to
+   * whatever a rule prefers.
+   */
+  private shouldReapplySiteAssignmentRules(
+    previousDevice: Model,
+    data: Record<string, unknown>,
+  ): boolean {
+    if (!previousDevice.siteId) {
+      return true;
+    }
+
+    const dataKeys: Array<string> = Object.keys(data || {});
+
+    return SITE_RULE_IDENTITY_COLUMNS.some((column: string) => {
+      if (!dataKeys.includes(column)) {
+        return false;
+      }
+
+      return (
+        normalizeIdentityValue(data[column]) !==
+        normalizeIdentityValue((previousDevice as any)[column])
+      );
+    });
+  }
+
   /*
    * Matches one device against the project's NetworkSiteAssignmentRules
    * (highest priority wins) and assigns the winning site. The assignment
@@ -297,6 +443,7 @@ export class Service extends DatabaseService<Model> {
         siteId: true,
         hostname: true,
         sysName: true,
+        name: true,
       },
       props: {
         isRoot: true,
@@ -333,7 +480,10 @@ export class Service extends DatabaseService<Model> {
 
     /*
      * The device's hostname column stores an IP address or a DNS name; pass
-     * it as both — ipInCidr safely rejects non-IP strings.
+     * it as both — ipInCidr safely rejects non-IP strings. `name` is passed
+     * too because a discovery import puts the responding IP in `hostname`
+     * and the device's real identity in `name`, so a hostname pattern that
+     * only ever saw `hostname` could not match anything a user recognises.
      */
     const winner: NetworkSiteAssignmentRule | null = CidrMatchUtil.pickRule(
       rules,
@@ -341,6 +491,7 @@ export class Service extends DatabaseService<Model> {
         ip: device.hostname,
         hostname: device.hostname,
         sysName: device.sysName,
+        name: device.name,
       },
     );
 

package/Server/Services/NetworkSiteAssignmentRuleService.ts

@@ -1,18 +1,73 @@
 import DatabaseService from "./DatabaseService";
+import NetworkSiteService from "./NetworkSiteService";
 import Model from "../../Models/DatabaseModels/NetworkSiteAssignmentRule";
+import NetworkSite from "../../Models/DatabaseModels/NetworkSite";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
 import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
+
+/*
+ * The dashboard posts the `site` relation while server-side callers write the
+ * `siteId` column; read whichever is present. See RelationIdUtil.
+ */
+const SITE_KEYS: Array<string> = ["siteId", "site"];
+
+function readSiteId(data: Record<string, unknown>): ObjectID | null {
+  return RelationIdUtil.read(data, SITE_KEYS);
+}
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /*
+   * The FK behind siteId only requires the NetworkSite row to exist, not that
+   * it belongs to the rule's project. A rule pointing at a foreign site is
+   * both a cross-tenant read (the rules table renders `site.name`) and a rule
+   * that can never assign anything - NetworkDeviceService's own tenancy guard
+   * rejects the resulting device update. Fail at write time instead, where
+   * the user can see it.
+   */
+  private async assertSiteBelongsToProject(data: {
+    siteId: ObjectID;
+    projectId: ObjectID | undefined;
+  }): Promise<void> {
+    if (!data.projectId) {
+      return;
+    }
+
+    const site: NetworkSite | null = await NetworkSiteService.findOneById({
+      id: data.siteId,
+      select: {
+        _id: true,
+        projectId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!site) {
+      throw new BadDataException("Network site not found.");
+    }
+
+    if (
+      site.projectId &&
+      site.projectId.toString() !== data.projectId.toString()
+    ) {
+      throw new BadDataException(
+        "Network site must belong to the same project.",
+      );
+    }
+  }
+
   /*
    * A rule with neither criterion would match nothing (or, worse, read as
    * "match everything" to a future maintainer) - reject it at write time.
@@ -26,6 +81,17 @@ export class Service extends DatabaseService<Model> {
       hostnamePattern: createBy.data.hostnamePattern,
     });
 
+    const siteId: ObjectID | null = readSiteId(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (siteId) {
+      await this.assertSiteBelongsToProject({
+        siteId: siteId,
+        projectId: createBy.data.projectId,
+      });
+    }
+
     return { createBy, carryForward: null };
   }
 
@@ -35,10 +101,14 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnUpdate<Model>> {
     const dataKeys: Array<string> = Object.keys(updateBy.data || {});
 
-    if (
-      !dataKeys.includes("subnetCidr") &&
-      !dataKeys.includes("hostnamePattern")
-    ) {
+    const isCriteriaChange: boolean =
+      dataKeys.includes("subnetCidr") || dataKeys.includes("hostnamePattern");
+
+    const newSiteId: ObjectID | null = readSiteId(
+      updateBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (!isCriteriaChange && !newSiteId) {
       return { updateBy, carryForward: null };
     }
 
@@ -50,6 +120,7 @@ export class Service extends DatabaseService<Model> {
       query: updateBy.query,
       select: {
         _id: true,
+        projectId: true,
         subnetCidr: true,
         hostnamePattern: true,
       },
@@ -61,14 +132,23 @@ export class Service extends DatabaseService<Model> {
     });
 
     for (const existingRule of existingRules) {
-      this.validateCriteria({
-        subnetCidr: dataKeys.includes("subnetCidr")
-          ? ((updateBy.data as any)["subnetCidr"] as string | null)
-          : existingRule.subnetCidr,
-        hostnamePattern: dataKeys.includes("hostnamePattern")
-          ? ((updateBy.data as any)["hostnamePattern"] as string | null)
-          : existingRule.hostnamePattern,
-      });
+      if (isCriteriaChange) {
+        this.validateCriteria({
+          subnetCidr: dataKeys.includes("subnetCidr")
+            ? ((updateBy.data as any)["subnetCidr"] as string | null)
+            : existingRule.subnetCidr,
+          hostnamePattern: dataKeys.includes("hostnamePattern")
+            ? ((updateBy.data as any)["hostnamePattern"] as string | null)
+            : existingRule.hostnamePattern,
+        });
+      }
+
+      if (newSiteId) {
+        await this.assertSiteBelongsToProject({
+          siteId: newSiteId,
+          projectId: existingRule.projectId,
+        });
+      }
     }
 
     return { updateBy, carryForward: null };

package/Server/Services/NetworkSiteService.ts

@@ -34,12 +34,22 @@ import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import Text from "../../Types/Text";
 import { Raw } from "typeorm";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 import MaterializedPathUtil from "../../Utils/NetworkSite/MaterializedPathUtil";
 import SiteStatusRollupUtil, {
   DeviceHealthState,
   RollupStatusOption,
 } from "../../Utils/NetworkSite/SiteStatusRollupUtil";
 
+/*
+ * Both spellings of "this site's parent" in a write payload: the dashboard's
+ * site form posts the `parentSite` relation while server-side callers write
+ * the `parentSiteId` column. Watching only the column let a re-parent done
+ * from the UI skip cycle detection, the same-project guard and the subtree
+ * path rebase entirely. See RelationIdUtil.
+ */
+const PARENT_SITE_KEYS: Array<string> = ["parentSiteId", "parentSite"];
+
 /*
  * Carried from onBeforeUpdate to onUpdateSuccess when an update touches
  * parentSiteId, so the subtree rebase knows each site's previous state.
@@ -152,9 +162,18 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnCreate<Model>> {
     let parentPath: string | null = null;
 
-    if (createBy.data.parentSiteId) {
+    /*
+     * Both spellings: the dashboard's site form posts the `parentSite`
+     * relation, not the `parentSiteId` column. See RelationIdUtil.
+     */
+    const parentSiteId: ObjectID | null = RelationIdUtil.read(
+      createBy.data as unknown as Record<string, unknown>,
+      PARENT_SITE_KEYS,
+    );
+
+    if (parentSiteId) {
       const parent: Model | null = await this.findOneById({
-        id: createBy.data.parentSiteId,
+        id: parentSiteId,
         select: {
           _id: true,
           projectId: true,
@@ -178,9 +197,7 @@ export class Service extends DatabaseService<Model> {
         );
       }
 
-      parentPath = await this.getMaterializedPathForSite(
-        createBy.data.parentSiteId,
-      );
+      parentPath = await this.getMaterializedPathForSite(parentSiteId);
     }
 
     return {
@@ -228,14 +245,14 @@ export class Service extends DatabaseService<Model> {
   ): Promise<OnUpdate<Model>> {
     const dataKeys: Array<string> = Object.keys(updateBy.data || {});
 
-    if (!dataKeys.includes("parentSiteId")) {
+    if (!RelationIdUtil.isWritten(dataKeys, PARENT_SITE_KEYS)) {
       return { updateBy, carryForward: null };
     }
 
-    const newParentIdValue: unknown = (updateBy.data as any)["parentSiteId"];
-    const newParentId: ObjectID | null = newParentIdValue
-      ? new ObjectID(newParentIdValue.toString())
-      : null;
+    const newParentId: ObjectID | null = RelationIdUtil.read(
+      updateBy.data as unknown as Record<string, unknown>,
+      PARENT_SITE_KEYS,
+    );
 
     const previousItems: Array<Model> = await this.findBy({
       query: this.scopeQueryToCallerTenant(updateBy.query, updateBy.props),

package/Server/Services/ProjectService.ts

@@ -16,6 +16,7 @@ import UpdateBy from "../Types/Database/UpdateBy";
 import logger, { LogAttributes } from "../Utils/Logger";
 import Errors from "../Utils/Errors";
 import ProductAnalytics from "../Utils/ProductAnalytics";
+import SessionReplayGateCacheStore from "../Utils/SessionReplay/SessionReplayGateCacheStore";
 import AccessTokenService from "./AccessTokenService";
 import BillingService from "./BillingService";
 import DatabaseService from "./DatabaseService";
@@ -360,6 +361,52 @@ export class ProjectService extends DatabaseService<Model> {
     return Promise.resolve({ createBy: data, carryForward: null });
   }
 
+  /*
+   * Session replay is gated on the project's org-wide allow flag, and the
+   * ingest gate caches the resolved policy per pod. Turning the flag off has
+   * to reach every pod now, not after the cache TTL plus the config
+   * endpoint's browser cache - roughly six minutes - so the Redis kill key
+   * is written here. Best effort: a Redis outage only means the ordinary
+   * cache expiry applies.
+   */
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    const updateData: Record<string, unknown> = onUpdate.updateBy
+      .data as unknown as Record<string, unknown>;
+
+    if (!("isSessionReplayAllowed" in updateData)) {
+      return onUpdate;
+    }
+
+    const isTurningOff: boolean = updateData["isSessionReplayAllowed"] !== true;
+
+    for (const projectId of updatedItemIds) {
+      try {
+        SessionReplayGateCacheStore.clearCache(projectId);
+
+        if (isTurningOff) {
+          await SessionReplayGateCacheStore.markProjectDisabled(projectId);
+        } else {
+          /*
+           * Re-enabling has to drop a kill key left over from an earlier
+           * disable, or the project stays refused for the rest of its TTL.
+           */
+          await SessionReplayGateCacheStore.clearProjectDisabled(projectId);
+        }
+      } catch (err) {
+        logger.warn(
+          `ProjectService: could not invalidate the session replay gate cache for project ${projectId.toString()}`,
+        );
+        logger.warn(err);
+      }
+    }
+
+    return onUpdate;
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,