@oneuptime/common 12.0.22 → 12.0.23

package/Tests/Utils/NetworkDiscovery/DiscoveredDeviceBuilder.test.ts

@@ -0,0 +1,272 @@
+import {
+  MAX_DEVICE_DESCRIPTION_LENGTH,
+  MAX_DEVICE_NAME_LENGTH,
+  buildDeviceName,
+  buildFallbackDeviceName,
+  buildNetworkDeviceFromDiscoveredHost,
+  DiscoveredDeviceScanSource,
+} from "../../../Utils/NetworkDiscovery/DiscoveredDeviceBuilder";
+import NetworkDevice from "../../../Models/DatabaseModels/NetworkDevice";
+import { DiscoveredNetworkDevice } from "../../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+import NetworkDeviceMonitoringMethod from "../../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
+import ObjectID from "../../../Types/ObjectID";
+import { describe, expect, it } from "@jest/globals";
+
+/*
+ * Contract under test — one discovered host maps to one NetworkDevice the
+ * SAME way everywhere. The builder is the shared recipe behind the
+ * dashboard's Review-dialog import and the server-side auto-import rule
+ * engine, so what these tests pin is the device both paths must agree on:
+ * which host field lands in which device column, which scan credentials ride
+ * along (and when they must NOT), and the length ceilings that keep a
+ * real-world 255-octet sysName from failing the create on the slug.
+ */
+
+const PROJECT_ID: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+const PROBE_ID: ObjectID = new ObjectID("11111111-1111-4111-8111-111111111111");
+
+function snmpHost(
+  overrides: Partial<DiscoveredNetworkDevice> = {},
+): DiscoveredNetworkDevice {
+  return {
+    ipAddress: "10.0.0.5",
+    sysName: "core-switch-01",
+    sysDescr: "Cisco IOS Software, C2960X",
+    ...overrides,
+  };
+}
+
+// A scan carrying every credential column the builder knows how to copy.
+function fullScanSource(): DiscoveredDeviceScanSource {
+  return {
+    probeId: PROBE_ID,
+    snmpVersion: "V3",
+    snmpCommunityString: "public",
+    snmpPort: 1161,
+    snmpV3SecurityLevel: "authPriv",
+    snmpV3Username: "observer",
+    snmpV3AuthProtocol: "SHA",
+    snmpV3AuthKey: "auth-key-value",
+    snmpV3PrivProtocol: "AES",
+    snmpV3PrivKey: "priv-key-value",
+  };
+}
+
+function build(data: {
+  host?: DiscoveredNetworkDevice | undefined;
+  scan?: DiscoveredDeviceScanSource | undefined;
+  name?: string | undefined;
+}): NetworkDevice {
+  return buildNetworkDeviceFromDiscoveredHost({
+    projectId: PROJECT_ID,
+    host: data.host || snmpHost(),
+    scan: data.scan || fullScanSource(),
+    name: data.name,
+  });
+}
+
+describe("buildNetworkDeviceFromDiscoveredHost - vendor template auto-apply flag", () => {
+  it("is off unless the caller asks for it", () => {
+    expect(build({}).autoApplyVendorHealthTemplate).toBeUndefined();
+  });
+
+  it("is set on an SNMP host when the caller asks (the rule engine does)", () => {
+    const device: NetworkDevice = buildNetworkDeviceFromDiscoveredHost({
+      projectId: PROJECT_ID,
+      host: snmpHost(),
+      scan: fullScanSource(),
+      autoApplyVendorHealthTemplate: true,
+    });
+
+    expect(device.autoApplyVendorHealthTemplate).toBe(true);
+  });
+
+  /*
+   * A ping-only host is never SNMP-polled, so no poll can ever fingerprint
+   * its vendor — the flag would be a dead toggle that reads as a promise.
+   */
+  it("stays off on a ping-only host even when requested", () => {
+    const device: NetworkDevice = buildNetworkDeviceFromDiscoveredHost({
+      projectId: PROJECT_ID,
+      host: snmpHost({ snmpReachable: false }),
+      scan: fullScanSource(),
+      autoApplyVendorHealthTemplate: true,
+    });
+
+    expect(device.autoApplyVendorHealthTemplate).toBeUndefined();
+  });
+});
+
+describe("buildNetworkDeviceFromDiscoveredHost - SNMP host", () => {
+  it("maps identity fields: sysName to name, address to hostname, sysDescr to description", () => {
+    const device: NetworkDevice = build({});
+
+    expect(device.projectId?.toString()).toBe(PROJECT_ID.toString());
+    expect(device.name).toBe("core-switch-01");
+    // The address is both the hostname and the registered-host dedup key.
+    expect(device.hostname).toBe("10.0.0.5");
+    expect(device.description).toBe("Cisco IOS Software, C2960X");
+    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Snmp);
+  });
+
+  /*
+   * Every credential the scan swept with must land on the device, or the
+   * imported device can never poll. The v3 block matters most: a v3 scan
+   * that imported as a credential-less device would sit unreachable with no
+   * error anywhere.
+   */
+  it("copies the probe and every SNMP credential from the scan source", () => {
+    const device: NetworkDevice = build({});
+
+    expect(device.probeId?.toString()).toBe(PROBE_ID.toString());
+    expect(device.snmpVersion).toBe("V3");
+    expect(device.snmpCommunityString).toBe("public");
+    expect(device.snmpPort).toBe(1161);
+    expect(device.snmpV3SecurityLevel).toBe("authPriv");
+    expect(device.snmpV3Username).toBe("observer");
+    expect(device.snmpV3AuthProtocol).toBe("SHA");
+    expect(device.snmpV3AuthKey).toBe("auth-key-value");
+    expect(device.snmpV3PrivProtocol).toBe("AES");
+    expect(device.snmpV3PrivKey).toBe("priv-key-value");
+  });
+
+  /*
+   * The scan row may hold a serialized id rather than an ObjectID instance
+   * (the rule engine selects its scan itself); the builder re-wraps rather
+   * than trusting the shape.
+   */
+  it("re-wraps the probe id so a serialized id still becomes an ObjectID", () => {
+    const device: NetworkDevice = build({
+      scan: {
+        ...fullScanSource(),
+        probeId: PROBE_ID.toString() as unknown as ObjectID,
+      },
+    });
+
+    expect(device.probeId).toBeInstanceOf(ObjectID);
+    expect(device.probeId?.toString()).toBe(PROBE_ID.toString());
+  });
+});
+
+describe("buildNetworkDeviceFromDiscoveredHost - ping-only host", () => {
+  /*
+   * A ping-only host becomes a monitor-backed device: recorded so it can
+   * belong to a site and appear on the topology map, with binding a monitor
+   * to it a separate deliberate step. Credentials it never answered to must
+   * not ride along.
+   */
+  it("builds a monitor-backed device with polling off and no credentials", () => {
+    const device: NetworkDevice = build({
+      host: snmpHost({ snmpReachable: false, sysName: undefined }),
+    });
+
+    expect(device.monitoringMethod).toBe(NetworkDeviceMonitoringMethod.Monitor);
+    expect(device.isPollingEnabled).toBe(false);
+    expect(device.probeId).toBeUndefined();
+    expect(device.snmpVersion).toBeUndefined();
+    expect(device.snmpCommunityString).toBeUndefined();
+    expect(device.snmpPort).toBeUndefined();
+    expect(device.snmpV3SecurityLevel).toBeUndefined();
+    expect(device.snmpV3Username).toBeUndefined();
+    expect(device.snmpV3AuthProtocol).toBeUndefined();
+    expect(device.snmpV3AuthKey).toBeUndefined();
+    expect(device.snmpV3PrivProtocol).toBeUndefined();
+    expect(device.snmpV3PrivKey).toBeUndefined();
+  });
+});
+
+describe("buildDeviceName", () => {
+  it("prefers the sysName", () => {
+    expect(buildDeviceName(snmpHost())).toBe("core-switch-01");
+  });
+
+  // A ping-only host has no SNMP identity; the address is all there is.
+  it("falls back to the address when sysName is missing", () => {
+    expect(buildDeviceName(snmpHost({ sysName: undefined }))).toBe("10.0.0.5");
+  });
+
+  it("falls back to the address when sysName is whitespace", () => {
+    expect(buildDeviceName(snmpHost({ sysName: "   " }))).toBe("10.0.0.5");
+  });
+
+  /*
+   * SNMP sysName is a DisplayString of up to 255 octets, so over-long names
+   * are routine on real gear — and the create path THROWS on an over-long
+   * name (via the slug ceiling) rather than truncating, so the clamp has to
+   * happen here.
+   */
+  it("clamps a 255-character sysName to MAX_DEVICE_NAME_LENGTH", () => {
+    const longSysName: string = "x".repeat(255);
+    const name: string = buildDeviceName(snmpHost({ sysName: longSysName }));
+
+    expect(name.length).toBe(MAX_DEVICE_NAME_LENGTH);
+    expect(name).toBe(longSysName.substring(0, MAX_DEVICE_NAME_LENGTH));
+  });
+});
+
+describe("buildFallbackDeviceName", () => {
+  it("appends the address that tells name-twins apart", () => {
+    expect(buildFallbackDeviceName(snmpHost())).toBe(
+      "core-switch-01 (10.0.0.5)",
+    );
+  });
+
+  /*
+   * The collision fallback must fit under the SAME ceiling as the first
+   * attempt: the widest possible suffix is " (255.255.255.255)", so the base
+   * name is cut down first rather than the composed string overflowing into
+   * the very slug-length failure the ceiling exists to avoid.
+   */
+  it("keeps the composed name within MAX_DEVICE_NAME_LENGTH at the widest address", () => {
+    const name: string = buildFallbackDeviceName(
+      snmpHost({
+        sysName: "y".repeat(255),
+        ipAddress: "255.255.255.255",
+      }),
+    );
+
+    expect(name.length).toBeLessThanOrEqual(MAX_DEVICE_NAME_LENGTH);
+    expect(name.endsWith(" (255.255.255.255)")).toBe(true);
+  });
+});
+
+describe("description clamping", () => {
+  it("clamps an over-long sysDescr to MAX_DEVICE_DESCRIPTION_LENGTH", () => {
+    const longSysDescr: string = "d".repeat(700);
+    const device: NetworkDevice = build({
+      host: snmpHost({ sysDescr: longSysDescr }),
+    });
+
+    expect(device.description?.length).toBe(MAX_DEVICE_DESCRIPTION_LENGTH);
+    expect(device.description).toBe(
+      longSysDescr.substring(0, MAX_DEVICE_DESCRIPTION_LENGTH),
+    );
+  });
+
+  it("sets no description when the host has no sysDescr", () => {
+    const device: NetworkDevice = build({
+      host: snmpHost({ sysDescr: undefined }),
+    });
+
+    expect(device.description).toBeUndefined();
+  });
+});
+
+describe("the name override", () => {
+  /*
+   * The caller supplies the name so the collision retry can rebuild the SAME
+   * device under the fallback name without re-deciding anything else — the
+   * override must therefore be taken verbatim.
+   */
+  it("uses a supplied name verbatim instead of deriving one", () => {
+    const device: NetworkDevice = build({
+      name: "core-switch-01 (10.0.0.5)",
+    });
+
+    expect(device.name).toBe("core-switch-01 (10.0.0.5)");
+    // Everything else is still derived from the host as usual.
+    expect(device.hostname).toBe("10.0.0.5");
+  });
+});

package/Tests/Utils/NetworkDiscovery/ScanTargetUtil.test.ts

@@ -581,3 +581,167 @@ describe("ScanTargetUtil.isValid", () => {
     expect(ScanTargetUtil.isValid("")).toBe(false);
   });
 });
+
+/*
+ * contains() is the matcher behind the auto-import rules' "Host IP is in"
+ * condition. It is CONTAINMENT, not membership of the sweep list — the two
+ * disagree at a CIDR block's network and broadcast addresses (in the block,
+ * never swept) — and an octet range is per-octet interval membership, not a
+ * numeric interval between the range's corners. Both distinctions are pinned
+ * here because either one, drifting, silently changes which hosts a rule
+ * imports.
+ */
+describe("ScanTargetUtil.contains", () => {
+  describe("CIDR containment", () => {
+    it("contains addresses inside the block and not those outside", () => {
+      expect(ScanTargetUtil.contains("192.168.1.0/24", "192.168.1.1")).toBe(
+        true,
+      );
+      expect(ScanTargetUtil.contains("192.168.1.0/24", "192.168.1.254")).toBe(
+        true,
+      );
+      expect(ScanTargetUtil.contains("192.168.1.0/24", "192.168.2.1")).toBe(
+        false,
+      );
+      expect(ScanTargetUtil.contains("192.168.1.0/24", "192.167.1.1")).toBe(
+        false,
+      );
+    });
+
+    /*
+     * The deliberate divergence from expand(): a rule asking "is this address
+     * in 10.0.0.0/24" means the subnet, so the network and broadcast
+     * addresses are IN even though no sweep would ever probe them.
+     */
+    it("contains the network and broadcast addresses expand() excludes", () => {
+      expect(ScanTargetUtil.contains("192.168.1.0/24", "192.168.1.0")).toBe(
+        true,
+      );
+      expect(ScanTargetUtil.contains("192.168.1.0/24", "192.168.1.255")).toBe(
+        true,
+      );
+      expect(ScanTargetUtil.expand("192.168.1.0/24")).not.toContain(
+        "192.168.1.0",
+      );
+      expect(ScanTargetUtil.expand("192.168.1.0/24")).not.toContain(
+        "192.168.1.255",
+      );
+    });
+
+    it("treats a /32 as exactly one address", () => {
+      expect(ScanTargetUtil.contains("10.0.0.5/32", "10.0.0.5")).toBe(true);
+      expect(ScanTargetUtil.contains("10.0.0.5/32", "10.0.0.4")).toBe(false);
+      expect(ScanTargetUtil.contains("10.0.0.5/32", "10.0.0.6")).toBe(false);
+    });
+
+    it("treats a /31 as both of its addresses", () => {
+      expect(ScanTargetUtil.contains("10.0.0.0/31", "10.0.0.0")).toBe(true);
+      expect(ScanTargetUtil.contains("10.0.0.0/31", "10.0.0.1")).toBe(true);
+      expect(ScanTargetUtil.contains("10.0.0.0/31", "10.0.0.2")).toBe(false);
+    });
+
+    // Same masking rule as expand(): the block, not the address as typed.
+    it("masks a non-network address down to its subnet before matching", () => {
+      expect(ScanTargetUtil.contains("192.168.1.37/29", "192.168.1.32")).toBe(
+        true,
+      );
+      expect(ScanTargetUtil.contains("192.168.1.37/29", "192.168.1.39")).toBe(
+        true,
+      );
+      expect(ScanTargetUtil.contains("192.168.1.37/29", "192.168.1.40")).toBe(
+        false,
+      );
+    });
+
+    it("matches every address under /0", () => {
+      expect(ScanTargetUtil.contains("0.0.0.0/0", "0.0.0.0")).toBe(true);
+      expect(ScanTargetUtil.contains("0.0.0.0/0", "10.1.2.3")).toBe(true);
+      expect(ScanTargetUtil.contains("0.0.0.0/0", "255.255.255.255")).toBe(
+        true,
+      );
+    });
+
+    /*
+     * The high end of the address space, where every octet has the sign bit
+     * territory in play: signed arithmetic anywhere in the comparison would
+     * surface here first.
+     */
+    it("compares correctly at the top of the address space", () => {
+      expect(ScanTargetUtil.contains("255.255.255.0/24", "255.255.255.7")).toBe(
+        true,
+      );
+      expect(ScanTargetUtil.contains("255.255.255.0/24", "255.255.254.7")).toBe(
+        false,
+      );
+    });
+  });
+
+  describe("octet-range containment", () => {
+    /*
+     * A bare address parses as an octet range of four single values, so as a
+     * condition it means "exactly this host" — not a prefix, not a wildcard.
+     */
+    it("matches a bare-IP target only exactly", () => {
+      expect(ScanTargetUtil.contains("10.0.0.5", "10.0.0.5")).toBe(true);
+      expect(ScanTargetUtil.contains("10.0.0.5", "10.0.0.6")).toBe(false);
+      expect(ScanTargetUtil.contains("10.0.0.5", "10.0.0.50")).toBe(false);
+      expect(ScanTargetUtil.contains("10.0.0.5", "11.0.0.5")).toBe(false);
+    });
+
+    /*
+     * The distinction that makes octet ranges worth having: membership is
+     * per-octet, NOT "between the lowest and highest address". 10.17.5.10
+     * sits numerically between 10.16.0.51 and 10.22.255.66, but its fourth
+     * octet is outside 51-66, so it is not in the target — exactly as the
+     * sweep would never probe it.
+     */
+    it("matches per octet, not as a numeric interval", () => {
+      const target: string = "10.16-22.0-255.51-66";
+
+      expect(ScanTargetUtil.contains(target, "10.17.5.60")).toBe(true);
+      // Inside the interval's corners, outside the fourth octet's range.
+      expect(ScanTargetUtil.contains(target, "10.17.5.10")).toBe(false);
+      expect(ScanTargetUtil.contains(target, "10.17.5.67")).toBe(false);
+    });
+
+    it("respects the corners of every octet's range", () => {
+      const target: string = "10.16-22.0-255.51-66";
+
+      expect(ScanTargetUtil.contains(target, "10.16.0.51")).toBe(true);
+      expect(ScanTargetUtil.contains(target, "10.22.255.66")).toBe(true);
+      // One below / one above the second octet's bounds.
+      expect(ScanTargetUtil.contains(target, "10.15.0.60")).toBe(false);
+      expect(ScanTargetUtil.contains(target, "10.23.0.60")).toBe(false);
+    });
+
+    it("holds single-value octets exact while others range", () => {
+      const target: string = "10.16-22.0-255.51-66";
+
+      expect(ScanTargetUtil.contains(target, "11.17.5.60")).toBe(false);
+      expect(ScanTargetUtil.contains(target, "9.17.5.60")).toBe(false);
+    });
+  });
+
+  describe("malformed input", () => {
+    /*
+     * A condition that cannot parse matches nothing, same as the matcher's
+     * other conditions — never "matches everything".
+     */
+    it("returns false for a malformed target", () => {
+      expect(ScanTargetUtil.contains("", "10.0.0.5")).toBe(false);
+      expect(ScanTargetUtil.contains("   ", "10.0.0.5")).toBe(false);
+      expect(ScanTargetUtil.contains("abc", "10.0.0.5")).toBe(false);
+      expect(ScanTargetUtil.contains("10.0.0.0/99", "10.0.0.5")).toBe(false);
+      expect(ScanTargetUtil.contains("10.22-16.0.1", "10.20.0.1")).toBe(false);
+    });
+
+    it("returns false for a malformed address", () => {
+      expect(ScanTargetUtil.contains("10.0.0.0/24", "")).toBe(false);
+      expect(ScanTargetUtil.contains("10.0.0.0/24", "abc")).toBe(false);
+      expect(ScanTargetUtil.contains("10.0.0.0/24", "10.0.0")).toBe(false);
+      expect(ScanTargetUtil.contains("10.0.0.0/24", "10.0.0.1.5")).toBe(false);
+      expect(ScanTargetUtil.contains("10.0.0.0/24", "10.0.0.256")).toBe(false);
+      expect(ScanTargetUtil.contains("0.0.0.0/0", "not-an-ip")).toBe(false);
+    });
+  });
+});

package/Types/NetworkAutomation/RuleRunResult.ts

@@ -65,6 +65,58 @@ export interface LabelRuleRunResult {
   isTruncated: boolean;
 }
 
+/*
+ * One run of a network device auto-import rule — automatic (the worker
+ * processing a completed scan) or manual ("Run Now" against the project's
+ * completed scans, optionally as a dry run that writes nothing).
+ *
+ * Every discovered host the run looked at lands in a bucket for the same
+ * reason as above: "nothing matched", "everything that matched is already in
+ * the inventory", and "an exclusion rule vetoed it" are very different
+ * answers to "why did this import zero devices".
+ */
+export interface AutoImportRuleRunResult {
+  // Discovered hosts the run evaluated, across every scan it read.
+  hostsEvaluated: number;
+  // Of those, the ones an import rule matched (exclusions already applied).
+  hostsMatched: number;
+  // Hosts an exclusion rule vetoed.
+  hostsExcluded: number;
+  /*
+   * Matched hosts skipped because a device with that address already exists
+   * — including one created earlier in this same run from a duplicate row or
+   * an overlapping scan. Re-running a rule is idempotent, not additive.
+   */
+  hostsSkippedAlreadyRegistered: number;
+  // Devices actually created. Always zero on a dry run.
+  devicesCreated: number;
+  // Matched hosts whose create threw. Logged server-side, never fatal.
+  devicesFailed: number;
+  /*
+   * True when the run stopped at the DEVICE cap with matched hosts left
+   * over. Running again continues: already-imported hosts are skipped.
+   */
+  isTruncated: boolean;
+  /*
+   * True when the project has more completed scans than one manual run
+   * reads (the newest MAX_SCANS_PER_AUTO_IMPORT_RULE_RUN). Distinct from
+   * isTruncated because the advice differs: re-running re-reads the same
+   * newest scans, so hosts that appear ONLY in older scans stay unread.
+   */
+  hasMoreScans: boolean;
+  // True when this run was a dry run: full evaluation, no writes.
+  isDryRun: boolean;
+  /*
+   * Up to MAX_MATCHED_IP_SAMPLE addresses the run imported (or, on a dry
+   * run, would import) — the operator's "which hosts is this rule actually
+   * claiming" answer, without shipping a 30k-element array.
+   */
+  matchedIpAddressSample: Array<string>;
+}
+
+// How many addresses matchedIpAddressSample carries at most.
+export const MAX_MATCHED_IP_SAMPLE: number = 50;
+
 /*
  * A count off the wire. An absent or non-numeric field reads as zero rather
  * than as NaN: a summary line that says "NaN devices" is worse than one that
@@ -118,4 +170,36 @@ export class RuleRunResultUtil {
       isTruncated: source["isTruncated"] === true,
     };
   }
+
+  public static parseAutoImportRuleRunResult(
+    json: JSONObject | undefined | null,
+  ): AutoImportRuleRunResult {
+    const source: JSONObject = json || {};
+
+    const sample: Array<string> = Array.isArray(
+      source["matchedIpAddressSample"],
+    )
+      ? (source["matchedIpAddressSample"] as Array<unknown>)
+          .filter((value: unknown) => {
+            return typeof value === "string";
+          })
+          .slice(0, MAX_MATCHED_IP_SAMPLE)
+      : [];
+
+    return {
+      hostsEvaluated: readCount(source, "hostsEvaluated"),
+      hostsMatched: readCount(source, "hostsMatched"),
+      hostsExcluded: readCount(source, "hostsExcluded"),
+      hostsSkippedAlreadyRegistered: readCount(
+        source,
+        "hostsSkippedAlreadyRegistered",
+      ),
+      devicesCreated: readCount(source, "devicesCreated"),
+      devicesFailed: readCount(source, "devicesFailed"),
+      isTruncated: source["isTruncated"] === true,
+      hasMoreScans: source["hasMoreScans"] === true,
+      isDryRun: source["isDryRun"] === true,
+      matchedIpAddressSample: sample as Array<string>,
+    };
+  }
 }

package/Types/Permission.ts

@@ -600,6 +600,11 @@ enum Permission {
   EditNetworkDeviceLabelRule = "EditNetworkDeviceLabelRule",
   ReadNetworkDeviceLabelRule = "ReadNetworkDeviceLabelRule",
 
+  CreateNetworkDeviceAutoImportRule = "CreateNetworkDeviceAutoImportRule",
+  DeleteNetworkDeviceAutoImportRule = "DeleteNetworkDeviceAutoImportRule",
+  EditNetworkDeviceAutoImportRule = "EditNetworkDeviceAutoImportRule",
+  ReadNetworkDeviceAutoImportRule = "ReadNetworkDeviceAutoImportRule",
+
   // Podman Host Label Rule Permissions
   CreatePodmanHostLabelRule = "CreatePodmanHostLabelRule",
   DeletePodmanHostLabelRule = "DeletePodmanHostLabelRule",
@@ -11883,6 +11888,48 @@ export class PermissionHelper {
         group: PermissionGroup.Telemetry,
       },
 
+      // Network Device Auto Import Rule Permissions
+      {
+        permission: Permission.CreateNetworkDeviceAutoImportRule,
+        title: "Create Network Device Auto Import Rule",
+        description:
+          "This permission can create Network Device Auto Import Rules in this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.DeleteNetworkDeviceAutoImportRule,
+        title: "Delete Network Device Auto Import Rule",
+        description:
+          "This permission can delete Network Device Auto Import Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.EditNetworkDeviceAutoImportRule,
+        title: "Edit Network Device Auto Import Rule",
+        description:
+          "This permission can edit Network Device Auto Import Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.ReadNetworkDeviceAutoImportRule,
+        title: "Read Network Device Auto Import Rule",
+        description:
+          "This permission can read Network Device Auto Import Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+
       // Podman Host Label Rule Permissions
       {
         permission: Permission.CreatePodmanHostLabelRule,