@oneuptime/common 12.0.12 → 12.0.14

package/Server/Services/AnalyticsDatabaseService.ts

@@ -1542,6 +1542,159 @@ export default class AnalyticsDatabaseService<
     return { ...sort, _id: direction } as Sort<TBaseModel>;
   }
 
+  /**
+   * Bounds the rows an `ORDER BY ... , _id` find has to sort, without
+   * changing which rows it returns.
+   *
+   * ClickHouse can read in sorting-key order — and stop early — only when the
+   * ORDER BY lines up with the table's physical key. The `_id` tiebreaker
+   * appended by `toPaginationStableSort` is deliberately NOT a sorting-key
+   * column, so it denies that plan: the engine reads every row matching the
+   * WHERE, sorts the lot in memory, then discards all but one page. On the
+   * Logs viewer that turned a 100-row page into a full-window scan and tripped
+   * the 3 GiB `max_memory_usage` ceiling (Code 241, surfacing as
+   * "Server Error").
+   *
+   * Weakening the tiebreaker would reintroduce the skip/repeat paging bug it
+   * was added to fix, so bound the input instead. `min(k)` over the top
+   * `skip + limit` values of the leading sort key `k` is a rank statistic of
+   * k's MULTISET: it does not depend on which of several tied rows the inner
+   * LIMIT happened to keep. Every row that could reach position `skip + limit`
+   * satisfies `k >= min(k)`, and every row tied at the boundary value is
+   * admitted — so the page is exactly the page the unbounded query returns.
+   * That is what makes this a pure cost change: every gate below is a
+   * performance gate, and getting one wrong can only make a query slower,
+   * never lose or repeat a row.
+   *
+   * The inner pass reads one narrow key column in physical order and stops at
+   * `skip + limit` rows, so it costs far less than the wide outer read it
+   * saves.
+   *
+   * `min()` is nested over a subquery rather than taken as the N-th value via
+   * `ORDER BY k DESC LIMIT 1 OFFSET n - 1` on purpose: on a final page with
+   * fewer than `skip + limit` matching rows the latter returns no row, the
+   * scalar is NULL, `k >= NULL` is NULL, and the page comes back empty.
+   * `min()` over the available rows degrades to the smallest matching value.
+   */
+  private toSortKeyBoundaryFilter(
+    findBy: FindBy<TBaseModel>,
+    sort: Sort<TBaseModel>,
+    options: { hasGroupBy: boolean; databaseName: string },
+  ): Statement | null {
+    /*
+     * Under GROUP BY the predicate would restrict the aggregation INPUT
+     * rather than the page, so it would change results. Mirrors the
+     * tiebreaker's own exemption, leaving grouped finds byte-identical.
+     */
+    if (options.hasGroupBy) {
+      return null;
+    }
+
+    /*
+     * Without an `_id` column there is no off-key tiebreaker — the six
+     * `includeBaseColumns: false` aggregate targets — so the ORDER BY is
+     * already key-aligned and the bound would be pure overhead. Same
+     * condition toPaginationStableSort bails on.
+     */
+    const hasIdColumn: boolean = this.model.tableColumns.some(
+      (column: AnalyticsTableColumn): boolean => {
+        return column.key === "_id";
+      },
+    );
+
+    if (!hasIdColumn) {
+      return null;
+    }
+
+    const leadingSortKey: string | undefined = Object.keys(sort || {})[0];
+
+    if (!leadingSortKey) {
+      return null;
+    }
+
+    /*
+     * Only a column in the physical sorting key can be read in order, so
+     * only there can the off-key `_id` term have cost anything. Off-key
+     * leads (e.g. Log by `severityText`) already plan a bounded top-N and
+     * an extra pass would be pure waste.
+     */
+    if (!this.model.sortKeys.includes(leadingSortKey)) {
+      return null;
+    }
+
+    /*
+     * A non-required column is `Nullable(...)` in the DDL, and `k >= NULL`
+     * is NULL — the predicate would DROP those rows rather than just
+     * narrowing the scan. Fail safe to today's behavior.
+     */
+    const leadingSortColumn: AnalyticsTableColumn | null =
+      this.model.getTableColumn(leadingSortKey);
+
+    if (!leadingSortColumn || !leadingSortColumn.required) {
+      return null;
+    }
+
+    /*
+     * `findOneById` funnels a point lookup through `findOneBy` carrying the
+     * model's default sort. At most one row can match, so bounding it would
+     * double a query that has no ordering problem to begin with.
+     */
+    if ((findBy.query as Record<string, unknown> | undefined)?.["_id"]) {
+      return null;
+    }
+
+    /*
+     * The predicate is valid only BECAUSE of LIMIT/OFFSET: it admits the
+     * rows that can reach position `skip + limit` and no more. Guards the
+     * `new PositiveNumber(undefined)` -> NaN path that exists upstream.
+     */
+    const limit: number = Number(findBy.limit);
+    const skip: number = Number(findBy.skip);
+
+    if (!Number.isFinite(limit) || !Number.isFinite(skip)) {
+      return null;
+    }
+
+    const boundaryRowCount: number = skip + limit;
+
+    if (boundaryRowCount <= 0) {
+      return null;
+    }
+
+    const isDescending: boolean =
+      (sort as Record<string, SortOrder | undefined>)[leadingSortKey] !==
+      SortOrder.Ascending;
+
+    /*
+     * The bound must be computed over the same row set the outer query
+     * filters on, so the WHERE is regenerated rather than shared: appending
+     * one Statement into two places would bind its parameters twice.
+     */
+    const boundaryWhereStatement: Statement =
+      this.statementGenerator.toWhereStatement(findBy.query);
+
+    const boundaryStatement: Statement = SQL` AND ${leadingSortKey} `;
+
+    boundaryStatement.append(isDescending ? SQL`>=` : SQL`<=`);
+    boundaryStatement.append(
+      isDescending
+        ? SQL` (SELECT min(${leadingSortKey}) FROM (SELECT ${leadingSortKey} FROM ${options.databaseName}.${this.model.tableName} WHERE TRUE `
+        : SQL` (SELECT max(${leadingSortKey}) FROM (SELECT ${leadingSortKey} FROM ${options.databaseName}.${this.model.tableName} WHERE TRUE `,
+    );
+    boundaryStatement.append(boundaryWhereStatement);
+    boundaryStatement.append(this.getRetentionReadFilter());
+    boundaryStatement.append(SQL` ORDER BY ${leadingSortKey} `);
+    boundaryStatement.append(isDescending ? SQL`DESC` : SQL`ASC`);
+    boundaryStatement.append(
+      SQL` LIMIT ${{
+        value: boundaryRowCount,
+        type: TableColumnType.Number,
+      }}))`,
+    );
+
+    return boundaryStatement;
+  }
+
   public toFindStatement(findBy: FindBy<TBaseModel>): {
     statement: Statement;
     columns: Array<string>;
@@ -1577,6 +1730,18 @@ export default class AnalyticsDatabaseService<
       }),
     );
 
+    /*
+     * Keeps the `_id` tiebreaker affordable. Result-preserving by
+     * construction, so it is appended to the WHERE without touching the
+     * ORDER BY above. Null whenever the bound cannot help or cannot be
+     * proven safe.
+     */
+    const sortKeyBoundaryStatement: Statement | null =
+      this.toSortKeyBoundaryFilter(findBy, findBy.sort!, {
+        hasGroupBy: Boolean(groupByStatement),
+        databaseName: databaseName,
+      });
+
     const statement: Statement = SQL``;
 
     statement.append(SQL`SELECT `.append(select.statement));
@@ -1586,6 +1751,10 @@ export default class AnalyticsDatabaseService<
       .append(whereStatement)
       .append(this.getRetentionReadFilter());
 
+    if (sortKeyBoundaryStatement) {
+      statement.append(sortKeyBoundaryStatement);
+    }
+
     if (groupByStatement) {
       statement.append(SQL` GROUP BY `).append(groupByStatement);
     }

package/Server/Services/ApiKeyPermissionService.ts

@@ -1,20 +1,120 @@
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DeleteBy from "../Types/Database/DeleteBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import DatabaseService from "./DatabaseService";
-import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Model from "../../Models/DatabaseModels/ApiKeyPermission";
+import Label from "../../Models/DatabaseModels/Label";
+import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+
+/*
+ * 60s is the worst-case staleness on any single API node after a key's
+ * permissions are edited. We invalidate in-process immediately on
+ * create/update/delete; this TTL is the upper bound for *other* processes
+ * (same bound the ApiKeyService key cache accepted).
+ */
+const PERMISSIONS_TTL_MS: number = 60 * 1000;
+
+interface CachedApiKeyPermissionRow {
+  permission: Permission;
+  labelIds: Array<string>;
+  isBlockPermission: boolean | undefined;
+}
+
+export interface ApiKeyPermissionRow {
+  permission: Permission;
+  labelIds: Array<ObjectID>;
+  isBlockPermission: boolean | undefined;
+}
+
 export class Service extends DatabaseService<Model> {
+  /*
+   * Cache of `apiKeyId -> permission rows`. The API-key auth path builds the
+   * request's tenant permissions from these rows on every request; without it
+   * that's a Postgres findBy (with a labels join) per request.
+   */
+  private permissionCache: InMemoryTTLCache<Array<CachedApiKeyPermissionRow>> =
+    new InMemoryTTLCache(10_000);
+
   public constructor() {
     super(Model);
   }
 
+  public clearCache(): void {
+    this.permissionCache.clear();
+  }
+
+  /**
+   * Resolves the permission rows granted to an API key, with a short-lived
+   * in-process cache. Returns freshly built objects on every call (hit or
+   * miss), so callers never share mutable state with the cache. Use this from
+   * the auth hot path instead of calling `findBy` directly.
+   */
+  @CaptureSpan()
+  public async findPermissionsByApiKeyId(
+    apiKeyId: ObjectID,
+  ): Promise<Array<ApiKeyPermissionRow>> {
+    const cacheKey: string = apiKeyId.toString();
+
+    let cachedRows: Array<CachedApiKeyPermissionRow> | undefined =
+      this.permissionCache.get(cacheKey);
+
+    if (cachedRows === undefined) {
+      const rows: Array<Model> = await this.findBy({
+        query: {
+          apiKeyId: apiKeyId,
+        },
+        select: {
+          permission: true,
+          labels: {
+            _id: true,
+          },
+          isBlockPermission: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      cachedRows = rows.map((row: Model): CachedApiKeyPermissionRow => {
+        return {
+          permission: row.permission!,
+          labelIds: (row.labels ?? []).map((label: Label) => {
+            return label.id!.toString();
+          }),
+          isBlockPermission: row.isBlockPermission,
+        };
+      });
+
+      this.permissionCache.set(cacheKey, cachedRows, PERMISSIONS_TTL_MS);
+    }
+
+    return cachedRows.map(
+      (row: CachedApiKeyPermissionRow): ApiKeyPermissionRow => {
+        return {
+          permission: row.permission,
+          labelIds: row.labelIds.map((id: string) => {
+            return new ObjectID(id);
+          }),
+          isBlockPermission: row.isBlockPermission,
+        };
+      },
+    );
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
+    this.clearCache();
+
     if (!createBy.data.apiKeyId) {
       throw new BadDataException("API Key ID is required to create permission");
     }
@@ -92,6 +192,12 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    /*
+     * We don't know which keys are being updated without a query; updates
+     * are rare so clearing is cheap.
+     */
+    this.clearCache();
+
     if (updateBy.data.labels && updateBy.data.labels.length > 0) {
       const existingPermissions: Array<Model> = await this.findBy({
         query: updateBy.query,
@@ -153,6 +259,14 @@ export class Service extends DatabaseService<Model> {
 
     return { updateBy, carryForward: null };
   }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    this.clearCache();
+    return { deleteBy, carryForward: null };
+  }
 }
 
 export default new Service();

package/Server/Services/DatabaseService.ts

@@ -34,6 +34,7 @@ import Encryption from "../Utils/Encryption";
 import PasswordHash from "../Utils/PasswordHash";
 import PostgresErrorTranslator from "../Utils/Database/PostgresErrorTranslator";
 import logger, { LogAttributes } from "../Utils/Logger";
+import ConfigLogLevel from "../Types/ConfigLogLevel";
 import BaseService from "./BaseService";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import { WorkflowRoute } from "../../ServiceRoute";
@@ -2268,6 +2269,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
        */
       const affectedItems: Array<TBaseModel> = [];
 
+      /*
+       * The per-item debug payload below is a pretty-printed JSON.stringify
+       * of every matched row; skip building it entirely unless the log level
+       * is DEBUG, since logger.debug() no-ops at any other level.
+       */
+      const isDebugLogEnabled: boolean =
+        logger.getLogLevel() === ConfigLogLevel.DEBUG;
+
       for (const item of items) {
         /*
          * _id must be set AFTER the spread: update data can carry an
@@ -2282,12 +2291,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
           _id: item._id!,
         } as any;
 
-        logger.debug("Updated Item", {
-          projectId: updateBy.props.tenantId?.toString(),
-        } as LogAttributes);
-        logger.debug(JSON.stringify(updatedItem, null, 2), {
-          projectId: updateBy.props.tenantId?.toString(),
-        } as LogAttributes);
+        if (isDebugLogEnabled) {
+          logger.debug("Updated Item", {
+            projectId: updateBy.props.tenantId?.toString(),
+          } as LogAttributes);
+          logger.debug(JSON.stringify(updatedItem, null, 2), {
+            projectId: updateBy.props.tenantId?.toString(),
+          } as LogAttributes);
+        }
 
         if (hasRelationUpdates) {
           await this.getRepository().save(updatedItem);
@@ -2875,6 +2886,107 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     await repository.manager.query(sql, params);
   }
 
+  /*
+   * Add one to a numeric column and return what it became, in a SINGLE
+   * statement.
+   *
+   * This exists for counters that GATE something, where the read and the
+   * write cannot be allowed to come apart. The motivating case is the failed
+   * attempt counter on a notification-channel verification code: read the
+   * count, decide, then write it back, and N requests racing each other all
+   * read the same pre-increment value and all decide they are under the
+   * limit — which is precisely the shape an attacker running a brute-force
+   * loop produces. `atomicAddToColumnsByIdWithoutHooks` closes the
+   * lost-update half of that but cannot answer "and what is it now?", and
+   * `getRepository().increment()` cannot either.
+   *
+   * RETURNING makes the increment and the observation the same operation, so
+   * every concurrent caller gets a distinct value and the k-th attempt is
+   * refused no matter how the requests interleave.
+   *
+   * COALESCE so a NULL counter starts from zero rather than staying NULL.
+   *
+   * The column and table identifiers come from entity metadata, never from
+   * the caller, and the id is bound as a parameter. Hooks, the `version`
+   * bump and access control are all skipped: use ONLY for trusted internal
+   * counter writes.
+   */
+  @CaptureSpan()
+  public async atomicIncrementColumnValueByOneAndGetValue(data: {
+    id: ObjectID;
+    columnName: keyof TBaseModel;
+  }): Promise<number> {
+    if (!data.id) {
+      throw new BadDataException("id is required");
+    }
+
+    const repository: Repository<TBaseModel> = this.getRepository();
+    const metadata: EntityMetadata = repository.metadata;
+
+    const column: ColumnMetadata | undefined =
+      metadata.findColumnWithPropertyName(data.columnName as string);
+
+    if (!column) {
+      throw new BadDataException(
+        `atomicIncrementColumnValueByOneAndGetValue: unknown column "${String(
+          data.columnName,
+        )}" on "${metadata.tableName}"`,
+      );
+    }
+
+    const primaryColumnName: string =
+      metadata.primaryColumns[0]?.databaseName || "_id";
+
+    const quoted: string = `"${column.databaseName}"`;
+
+    const sql: string = `UPDATE "${metadata.tableName}" SET ${quoted} = COALESCE(${quoted}, 0) + 1 WHERE "${primaryColumnName}" = $1 RETURNING ${quoted}`;
+
+    const result: unknown = await repository.manager.query(sql, [
+      data.id.toString(),
+    ]);
+
+    /*
+     * TypeORM's Postgres driver returns `[rows, affectedCount]` for an UPDATE
+     * and a bare row array for everything else, so both shapes are unwrapped
+     * rather than one being assumed.
+     */
+    const rows: Array<unknown> = Array.isArray(result)
+      ? Array.isArray(result[0])
+        ? (result[0] as Array<unknown>)
+        : (result as Array<unknown>)
+      : [];
+
+    const row: unknown = rows[0];
+
+    if (!row || typeof row !== "object" || Array.isArray(row)) {
+      /*
+       * Nothing came back, so the row does not exist — deleted underneath us,
+       * or never there. Callers gate on the returned count, so this must be an
+       * error and not a zero, which would read as a fresh allowance.
+       */
+      throw new BadDataException(
+        `Item with ID ${data.id.toString()} not found`,
+      );
+    }
+
+    const value: unknown = (row as Record<string, unknown>)[
+      column.databaseName
+    ];
+
+    const parsed: number =
+      typeof value === "number" ? value : parseInt(String(value), 10);
+
+    if (!Number.isFinite(parsed)) {
+      throw new BadDataException(
+        `atomicIncrementColumnValueByOneAndGetValue: "${String(
+          data.columnName,
+        )}" did not return a number`,
+      );
+    }
+
+    return parsed;
+  }
+
   @CaptureSpan()
   protected async atomicIncrementColumnValueByOne(data: {
     id: ObjectID;

package/Server/Services/LogAggregationService.ts

@@ -10,6 +10,10 @@ import AnalyticsTableName from "../../Types/AnalyticsDatabase/AnalyticsTableName
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DbJSONResponse, Results } from "./AnalyticsDatabaseService";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import {
+  appendResourceScopeFilters,
+  ResourceEntityScope,
+} from "../Utils/Telemetry/ResourceEntityFilter";
 
 export interface HistogramBucket {
   time: string;
@@ -27,6 +31,15 @@ export interface HistogramRequest {
   bucketSizeInMinutes: number;
   serviceIds?: Array<ObjectID> | undefined;
   entityKeys?: Array<string> | undefined;
+  /*
+   * Resource-facet selections (Kubernetes cluster / host / docker host /
+   * podman host) already resolved to their entity keys. One scope per
+   * facet: the branches inside a scope OR (a row proves membership either
+   * by being primary-keyed on the resource or by carrying its entity key),
+   * and the scopes AND with each other so two facets intersect. See
+   * ResourceEntityFilter.
+   */
+  resourceScopes?: Array<ResourceEntityScope> | undefined;
   severityTexts?: Array<string> | undefined;
   bodySearchText?: string | undefined;
   traceIds?: Array<string> | undefined;
@@ -49,6 +62,15 @@ export interface FacetRequest {
   limit?: number | undefined;
   serviceIds?: Array<ObjectID> | undefined;
   entityKeys?: Array<string> | undefined;
+  /*
+   * Resource-facet selections (Kubernetes cluster / host / docker host /
+   * podman host) already resolved to their entity keys. One scope per
+   * facet: the branches inside a scope OR (a row proves membership either
+   * by being primary-keyed on the resource or by carrying its entity key),
+   * and the scopes AND with each other so two facets intersect. See
+   * ResourceEntityFilter.
+   */
+  resourceScopes?: Array<ResourceEntityScope> | undefined;
   severityTexts?: Array<string> | undefined;
   bodySearchText?: string | undefined;
   traceIds?: Array<string> | undefined;
@@ -70,6 +92,15 @@ export interface AnalyticsRequest {
   aggregation: AnalyticsAggregation;
   aggregationField?: string | undefined;
   serviceIds?: Array<ObjectID> | undefined;
+  /*
+   * Resource-facet selections (Kubernetes cluster / host / docker host /
+   * podman host) already resolved to their entity keys. One scope per
+   * facet: the branches inside a scope OR (a row proves membership either
+   * by being primary-keyed on the resource or by carrying its entity key),
+   * and the scopes AND with each other so two facets intersect. See
+   * ResourceEntityFilter.
+   */
+  resourceScopes?: Array<ResourceEntityScope> | undefined;
   severityTexts?: Array<string> | undefined;
   bodySearchText?: string | undefined;
   traceIds?: Array<string> | undefined;
@@ -251,6 +282,7 @@ export class LogAggregationService {
       getQuerySettings({
         maxExecutionTimeInSeconds: 45,
         timeoutOverflowMode: "break",
+        boundScanMemory: true,
         additionalSettings: { optimize_use_projections: 1 },
       }),
     );
@@ -361,6 +393,7 @@ export class LogAggregationService {
       getQuerySettings({
         maxExecutionTimeInSeconds: 45,
         timeoutOverflowMode: "break",
+        boundScanMemory: true,
       }),
     );
 
@@ -603,6 +636,7 @@ export class LogAggregationService {
       getQuerySettings({
         maxExecutionTimeInSeconds: 45,
         timeoutOverflowMode: "break",
+        boundScanMemory: true,
       }),
     );
 
@@ -683,6 +717,7 @@ export class LogAggregationService {
       getQuerySettings({
         maxExecutionTimeInSeconds: 45,
         timeoutOverflowMode: "break",
+        boundScanMemory: true,
       }),
     );
 
@@ -752,6 +787,7 @@ export class LogAggregationService {
       getQuerySettings({
         maxExecutionTimeInSeconds: 45,
         timeoutOverflowMode: "break",
+        boundScanMemory: true,
       }),
     );
 
@@ -764,6 +800,7 @@ export class LogAggregationService {
       HistogramRequest,
       | "serviceIds"
       | "entityKeys"
+      | "resourceScopes"
       | "severityTexts"
       | "bodySearchText"
       | "traceIds"
@@ -794,6 +831,8 @@ export class LogAggregationService {
       );
     }
 
+    appendResourceScopeFilters(statement, request.resourceScopes);
+
     if (request.severityTexts && request.severityTexts.length > 0) {
       statement.append(
         SQL` AND severityText IN (${{

package/Server/Services/LogService.ts

@@ -1,11 +1,32 @@
 import ClickhouseDatabase from "../Infrastructure/ClickhouseDatabase";
 import AnalyticsDatabaseService from "./AnalyticsDatabaseService";
 import Log from "../../Models/AnalyticsModels/Log";
+import FindBy from "../Types/AnalyticsDatabase/FindBy";
+import { OnFind } from "../Types/AnalyticsDatabase/Hooks";
+import ResourceEntityFilter from "../Utils/Telemetry/ResourceEntityFilter";
 
 export class LogService extends AnalyticsDatabaseService<Log> {
   public constructor(clickhouseDatabase?: ClickhouseDatabase | undefined) {
     super({ modelType: Log, database: clickhouseDatabase });
   }
+
+  /*
+   * Resolve the logs explorer's resource-facet selections (a Kubernetes
+   * cluster, a host, ...) before the query is compiled. They arrive as
+   * Postgres ids under `resourceFilters`; matching them needs the
+   * resource's entity key, which only Postgres can supply. See
+   * ResourceEntityFilter.
+   */
+  protected override async onBeforeFind(
+    findBy: FindBy<Log>,
+  ): Promise<OnFind<Log>> {
+    await ResourceEntityFilter.rewriteAnalyticsQuery({
+      query: findBy.query as unknown as Record<string, unknown>,
+      projectId: findBy.props?.tenantId,
+    });
+
+    return { findBy, carryForward: null };
+  }
 }
 
 export default new LogService();

package/Server/Services/NetworkSiteService.ts

@@ -849,7 +849,16 @@ export class Service extends DatabaseService<Model> {
       select: {
         _id: true,
         currentMonitorStatusId: true,
+        /*
+         * All four reachability inputs. isReachable is the one that decides
+         * up/down; the other three only size the "polling has stopped
+         * entirely" backstop. Selecting lastSeenAt alone silently drops the
+         * rollup back to the old freshness rule.
+         */
+        isReachable: true,
+        lastPolledAt: true,
         lastSeenAt: true,
+        pollingIntervalInMinutes: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -908,7 +917,10 @@ export class Service extends DatabaseService<Model> {
           monitorStatusPriority: statusId
             ? priorityByStatusId.get(statusId)
             : undefined,
+          isReachable: device.isReachable,
+          lastPolledAt: device.lastPolledAt,
           lastSeenAt: device.lastSeenAt,
+          pollingIntervalInMinutes: device.pollingIntervalInMinutes,
         };
       },
     );