@oneuptime/common 12.0.22 → 12.0.23

package/Server/Services/NetworkDeviceAutoImportRuleService.ts

@@ -0,0 +1,181 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceAutoImportRule";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
+import ScanTargetUtil from "../../Utils/NetworkDiscovery/ScanTargetUtil";
+
+/*
+ * Write-time validation for auto-import rules, following the
+ * NetworkSiteAssignmentRuleService contract: a condition that can only ever
+ * match nothing is rejected where the user can see it, not logged about by
+ * the engine long after they left the form.
+ */
+
+/*
+ * What a sysObjectID condition may contain: an optional leading dot, then
+ * digits, dots and '*' wildcards. Hoisted so the literal is not the object
+ * of a member expression, which `wrap-regex` and Prettier cannot agree on —
+ * same reason as CidrMatchUtil.
+ */
+const OID_PATTERN_SHAPE: RegExp = /^\.?[\d.*]+$/;
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    this.validateCriteria({
+      ipMatchTarget: createBy.data.ipMatchTarget,
+      sysNamePattern: createBy.data.sysNamePattern,
+      sysDescrPattern: createBy.data.sysDescrPattern,
+      sysObjectIdPattern: createBy.data.sysObjectIdPattern,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    const dataKeys: Array<string> = Object.keys(updateBy.data || {});
+
+    const isCriteriaChange: boolean =
+      dataKeys.includes("ipMatchTarget") ||
+      dataKeys.includes("sysNamePattern") ||
+      dataKeys.includes("sysDescrPattern") ||
+      dataKeys.includes("sysObjectIdPattern");
+
+    if (!isCriteriaChange) {
+      return { updateBy, carryForward: null };
+    }
+
+    /*
+     * The update may clear one criterion while another only exists on the
+     * stored row, so validate the RESULTING state of every matched row.
+     */
+    const existingRules: Array<Model> = await this.findBy({
+      query: updateBy.query,
+      select: {
+        _id: true,
+        ipMatchTarget: true,
+        sysNamePattern: true,
+        sysDescrPattern: true,
+        sysObjectIdPattern: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const data: Record<string, unknown> = updateBy.data as unknown as Record<
+      string,
+      unknown
+    >;
+
+    for (const existingRule of existingRules) {
+      this.validateCriteria({
+        ipMatchTarget: dataKeys.includes("ipMatchTarget")
+          ? (data["ipMatchTarget"] as string | null)
+          : existingRule.ipMatchTarget,
+        sysNamePattern: dataKeys.includes("sysNamePattern")
+          ? (data["sysNamePattern"] as string | null)
+          : existingRule.sysNamePattern,
+        sysDescrPattern: dataKeys.includes("sysDescrPattern")
+          ? (data["sysDescrPattern"] as string | null)
+          : existingRule.sysDescrPattern,
+        sysObjectIdPattern: dataKeys.includes("sysObjectIdPattern")
+          ? (data["sysObjectIdPattern"] as string | null)
+          : existingRule.sysObjectIdPattern,
+      });
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  private validateCriteria(data: {
+    ipMatchTarget?: string | null | undefined;
+    sysNamePattern?: string | null | undefined;
+    sysDescrPattern?: string | null | undefined;
+    sysObjectIdPattern?: string | null | undefined;
+  }): void {
+    const ipMatchTarget: string = (data.ipMatchTarget || "").trim();
+    const sysNamePattern: string = (data.sysNamePattern || "").trim();
+    const sysDescrPattern: string = (data.sysDescrPattern || "").trim();
+    const sysObjectIdPattern: string = (data.sysObjectIdPattern || "").trim();
+
+    /*
+     * A rule with no conditions matches nothing (see AutoImportRuleMatcher) —
+     * and would read as "match everything" to whoever finds it later.
+     */
+    if (
+      !ipMatchTarget &&
+      !sysNamePattern &&
+      !sysDescrPattern &&
+      !sysObjectIdPattern
+    ) {
+      throw new BadDataException(
+        "At least one of Host IP Is In, System Name Pattern, System Description Pattern, or System Object ID Pattern is required.",
+      );
+    }
+
+    /*
+     * Well-formedness only, deliberately NOT the scan-size ceiling: matching
+     * an address against 10.0.0.0/8 is a containment check, not a sweep, so
+     * a condition covering a huge block is legitimate here even though a
+     * scan target that size is not.
+     */
+    if (ipMatchTarget && !ScanTargetUtil.isValid(ipMatchTarget)) {
+      throw new BadDataException(
+        `"${ipMatchTarget}" is not a valid Host IP condition. ${ScanTargetUtil.getSyntaxHint()}`,
+      );
+    }
+
+    this.validatePattern("System Name Pattern", sysNamePattern);
+    this.validatePattern("System Description Pattern", sysDescrPattern);
+    this.validateOidPattern(sysObjectIdPattern);
+  }
+
+  private validatePattern(title: string, pattern: string): void {
+    if (!pattern || RulePatternMatchUtil.isSupportedPattern(pattern)) {
+      return;
+    }
+
+    throw new BadDataException(
+      `${title} is neither a valid regular expression nor a '*' wildcard pattern, so it would never match: ${pattern}`,
+    );
+  }
+
+  /*
+   * The sysObjectID condition is NOT free-text: an OID is a dotted numeric
+   * arc, matched as a literal-dot '*' glob or an arc prefix (see
+   * AutoImportRuleMatcher.matchesOidPattern — regex-first matching would make
+   * "1.3.6.1.4.1.9.*" match enterprise 94 too). So the only characters that
+   * can ever match anything are digits, dots and '*'; anything else is a
+   * pattern that silently never fires, which is exactly what this service
+   * exists to reject at the write.
+   */
+  private validateOidPattern(pattern: string): void {
+    if (!pattern) {
+      return;
+    }
+
+    if (!OID_PATTERN_SHAPE.test(pattern)) {
+      throw new BadDataException(
+        `System Object ID Pattern must be an OID prefix (1.3.6.1.4.1.9) or a '*' wildcard OID pattern (1.3.6.1.4.1.9.*) — digits, dots and '*' only: ${pattern}`,
+      );
+    }
+  }
+}
+
+export default new Service();

package/Server/Utils/Monitor/NetworkInventoryUtil.ts

@@ -15,7 +15,9 @@ import EndpointAttachmentUtil, {
 } from "../../../Utils/Monitor/EndpointAttachmentUtil";
 import SnmpSystemInfo from "../../../Types/Monitor/SnmpMonitor/SnmpSystemInfo";
 import SnmpEntityInfo from "../../../Types/Monitor/SnmpMonitor/SnmpEntityInfo";
-import SnmpVendorTemplateUtil from "../../../Types/Monitor/SnmpMonitor/SnmpVendorTemplate";
+import SnmpVendorTemplateUtil, {
+  SnmpVendorTemplate,
+} from "../../../Types/Monitor/SnmpMonitor/SnmpVendorTemplate";
 import ObjectID from "../../../Types/ObjectID";
 import OneUptimeDate from "../../../Types/Date";
 import logger from "../Logger";
@@ -55,6 +57,9 @@ export default class NetworkInventoryUtil {
         select: {
           _id: true,
           siteId: true,
+          // For the vendor-template auto-apply below.
+          autoApplyVendorHealthTemplate: true,
+          snmpOids: true,
         },
         props: {
           isRoot: true,
@@ -150,6 +155,39 @@ export default class NetworkInventoryUtil {
       if (vendor) {
         deviceUpdate["vendor"] = vendor.substring(0, 100);
       }
+
+      /*
+       * Vendor health template auto-apply — the automatic counterpart of the
+       * dashboard's vendor-template banner, for devices that opted in
+       * (auto-imported devices do; hand-made ones keep the manual flow).
+       *
+       * Deliberately narrow: only when the device has NO health OIDs at all.
+       * An existing list — template-seeded and pruned, or hand-built — is
+       * the operator's, and a poll must never edit it. That also makes this
+       * one-shot in practice: the first poll that fingerprints the vendor
+       * seeds the list, and every later poll sees a non-empty list and
+       * leaves it alone (including after the operator empties it on purpose
+       * AND turns the toggle off; with the toggle still on, an emptied list
+       * re-seeds next poll, which is what "auto-apply" says on the tin).
+       */
+      if (
+        ownedDevice.autoApplyVendorHealthTemplate &&
+        (ownedDevice.snmpOids || []).length === 0 &&
+        systemInfo?.sysObjectId
+      ) {
+        const vendorTemplate: SnmpVendorTemplate | undefined =
+          SnmpVendorTemplateUtil.matchBySysObjectId(systemInfo.sysObjectId);
+
+        if (vendorTemplate) {
+          deviceUpdate["snmpOids"] = SnmpVendorTemplateUtil.mergeOids(
+            [],
+            vendorTemplate.id,
+          );
+          logger.debug(
+            `Auto-applied the "${vendorTemplate.label}" vendor health template to network device ${deviceId.toString()} (sysObjectID ${systemInfo.sysObjectId}).`,
+          );
+        }
+      }
       if (entityInfo?.model) {
         deviceUpdate["deviceModel"] = entityInfo.model.substring(0, 100);
       }

package/Tests/Server/Services/AutoImportScanCredentialSelect.test.ts

@@ -0,0 +1,205 @@
+/*
+ * The auto-import rule engine reads a completed scan's SNMP credentials
+ * through AUTO_IMPORT_SCAN_CREDENTIAL_SELECT and copies them onto every
+ * device it creates via DiscoveredDeviceBuilder. The probe claim endpoint
+ * (App/FeatureSet/Telemetry/API/ProbeIngest/DiscoveryScan.ts) selects the
+ * same credential columns for the same reason: an unselected column arrives
+ * undefined and is silently NOT copied/used — no error anywhere, just a
+ * device (or a sweep) that can never authenticate.
+ *
+ * That failure mode is exactly the kind that drifts in: someone adds a
+ * credential column to the scan model, wires it into ONE of the three
+ * consumers, and the other two quietly drop it. So this suite pins the list
+ * in BOTH directions against the claim endpoint's select and against the
+ * builder — read from source with fs, the
+ * DiscoveryScanClaimHookFreeSafety.test.ts technique, because the select
+ * literal in a route handler is not importable. If an assertion here fails,
+ * its variable name says which side is missing which key; add the key to
+ * that side rather than relaxing the pin.
+ */
+
+/*
+ * The engine's import closure reaches DatabaseService (and through it
+ * PasswordHash) via the three collaborating services. None of them is called
+ * here — this suite only wants the exported select constant — so the service
+ * MODULES are stubbed out before the engine is imported, keeping the suite
+ * Postgres-free and immune to the local-only PasswordHash ts-jest compile
+ * failure.
+ */
+jest.mock("../../../Server/Services/NetworkDeviceService", () => {
+  return {
+    __esModule: true,
+    default: {},
+  };
+});
+
+jest.mock("../../../Server/Services/NetworkDeviceDiscoveryScanService", () => {
+  return {
+    __esModule: true,
+    default: {},
+  };
+});
+
+jest.mock("../../../Server/Services/NetworkDeviceAutoImportRuleService", () => {
+  return {
+    __esModule: true,
+    default: {},
+  };
+});
+
+// The engine's sweep lock would otherwise pull the Redis client in.
+jest.mock("../../../Server/Infrastructure/Semaphore", () => {
+  return {
+    __esModule: true,
+    default: {},
+  };
+});
+
+jest.mock("../../../Server/Utils/Logger", () => {
+  return {
+    __esModule: true,
+    default: {
+      debug: jest.fn(),
+      info: jest.fn(),
+      warn: jest.fn(),
+      error: jest.fn(),
+      trace: jest.fn(),
+    },
+  };
+});
+
+import { AUTO_IMPORT_SCAN_CREDENTIAL_SELECT } from "../../../Server/Services/NetworkDeviceAutoImportRuleEngineService";
+import { describe, expect, test } from "@jest/globals";
+import fs from "fs";
+import path from "path";
+
+const REPO_ROOT: string = path.join(__dirname, "..", "..", "..", "..");
+
+const CLAIM_ENDPOINT_SOURCE: string = fs.readFileSync(
+  path.join(
+    REPO_ROOT,
+    "App",
+    "FeatureSet",
+    "Telemetry",
+    "API",
+    "ProbeIngest",
+    "DiscoveryScan.ts",
+  ),
+  "utf8",
+);
+
+const BUILDER_SOURCE: string = fs.readFileSync(
+  path.join(
+    REPO_ROOT,
+    "Common",
+    "Utils",
+    "NetworkDiscovery",
+    "DiscoveredDeviceBuilder.ts",
+  ),
+  "utf8",
+);
+
+/*
+ * Every `snmp*: true` in the claim endpoint is a select entry — the file's
+ * only other snmp mention is the `snmpReachable !== false` responder count,
+ * which this shape can never match.
+ */
+function extractSelectedSnmpColumns(source: string): Array<string> {
+  return Array.from(source.matchAll(/\b(snmp\w+)\s*:\s*true\b/g)).map(
+    (match: RegExpMatchArray) => {
+      return match[1]!;
+    },
+  );
+}
+
+describe("AUTO_IMPORT_SCAN_CREDENTIAL_SELECT", () => {
+  test("carries exactly the credential columns an import copies", () => {
+    expect(Object.keys(AUTO_IMPORT_SCAN_CREDENTIAL_SELECT).sort()).toEqual(
+      [
+        "probeId",
+        "snmpVersion",
+        "snmpCommunityString",
+        "snmpPort",
+        "snmpV3SecurityLevel",
+        "snmpV3Username",
+        "snmpV3AuthProtocol",
+        "snmpV3AuthKey",
+        "snmpV3PrivProtocol",
+        "snmpV3PrivKey",
+      ].sort(),
+    );
+  });
+
+  // Guard against the extraction regex rotting into a vacuous pass.
+  test("the claim endpoint's select is extractable from its source", () => {
+    const selected: Array<string> = extractSelectedSnmpColumns(
+      CLAIM_ENDPOINT_SOURCE,
+    );
+
+    expect(selected).toContain("snmpVersion");
+    expect(selected).toContain("snmpV3PrivKey");
+    // The responder-count read is not a select entry and must not match.
+    expect(selected).not.toContain("snmpReachable");
+  });
+
+  /*
+   * Direction one: a credential column the probe sweeps WITH but the engine
+   * does not select would import devices that poll with less than the scan
+   * used — a v3 scan importing v2c-shaped devices, say. Any name listed in
+   * this failure is selected by the claim endpoint and missing from
+   * AUTO_IMPORT_SCAN_CREDENTIAL_SELECT.
+   */
+  test("every snmp column the probe claim endpoint selects is in the engine's select", () => {
+    const snmpColumnsSelectedByClaimEndpointButMissingFromEngineSelect: Array<string> =
+      extractSelectedSnmpColumns(CLAIM_ENDPOINT_SOURCE).filter(
+        (column: string) => {
+          return !(column in AUTO_IMPORT_SCAN_CREDENTIAL_SELECT);
+        },
+      );
+
+    expect(
+      snmpColumnsSelectedByClaimEndpointButMissingFromEngineSelect,
+    ).toEqual([]);
+  });
+
+  /*
+   * Direction two: a credential column the engine copies onto devices but
+   * the probe never receives would mean sweeps and imports disagree about
+   * what the credentials ARE. Any name listed in this failure is a key of
+   * AUTO_IMPORT_SCAN_CREDENTIAL_SELECT missing from the claim endpoint's
+   * select.
+   */
+  test("every snmp key of the engine's select is selected by the probe claim endpoint", () => {
+    const claimSelectedColumns: Array<string> = extractSelectedSnmpColumns(
+      CLAIM_ENDPOINT_SOURCE,
+    );
+
+    const engineSnmpKeysMissingFromClaimEndpointSelect: Array<string> =
+      Object.keys(AUTO_IMPORT_SCAN_CREDENTIAL_SELECT)
+        .filter((key: string) => {
+          return key.startsWith("snmp");
+        })
+        .filter((key: string) => {
+          return !claimSelectedColumns.includes(key);
+        });
+
+    expect(engineSnmpKeysMissingFromClaimEndpointSelect).toEqual([]);
+  });
+
+  /*
+   * And the last hop: selecting a credential the builder never copies is the
+   * same silent drop one module later. Every key of the select must appear
+   * in DiscoveredDeviceBuilder.ts — the copy is a same-named field access,
+   * so a plain occurrence check is a faithful pin. Any name listed in this
+   * failure is selected by the engine and never mentioned by the builder.
+   */
+  test("every key of the engine's select is copied by the device builder", () => {
+    const engineSelectKeysNeverMentionedByBuilder: Array<string> = Object.keys(
+      AUTO_IMPORT_SCAN_CREDENTIAL_SELECT,
+    ).filter((key: string) => {
+      return !BUILDER_SOURCE.includes(key);
+    });
+
+    expect(engineSelectKeysNeverMentionedByBuilder).toEqual([]);
+  });
+});