@oneuptime/common 12.0.22 → 12.0.24

package/Models/DatabaseModels/NetworkDeviceDiscoveryScan.ts

@@ -22,6 +22,17 @@ export interface DiscoveredNetworkDevice {
   ipAddress: string;
   sysName?: string | undefined;
   sysDescr?: string | undefined;
+  /*
+   * The rest of the SNMP system group, carried since the probe started
+   * reporting it — the same single GET fetches all six scalars, so these
+   * cost nothing extra on the wire. sysObjectId is the vendor's registered
+   * enterprise OID, which vendor-based auto-import conditions match on.
+   * Undefined on ping-only hosts and on scan rows stored by older probes.
+   */
+  sysObjectId?: string | undefined;
+  sysLocation?: string | undefined;
+  sysContact?: string | undefined;
+  sysUpTimeSeconds?: number | undefined;
   isAlreadyRegistered?: boolean | undefined;
   /*
    * False when the host answered ping but not SNMP — such hosts cannot be
@@ -239,6 +250,73 @@ export default class NetworkDeviceDiscoveryScan extends BaseModel {
   })
   public probeId?: ObjectID = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceDiscoveryScan,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    /*
+     * Updatable, unlike everything that describes the sweep itself: changing
+     * the target or the credentials of a scan mid-flight would mean the stored
+     * row no longer described the sweep that ran, so those grant no update at
+     * all. (The recurrence pair is updatable too — it describes the NEXT run
+     * rather than the one that happened.)
+     *
+     * A name describes nothing but itself, and the whole point of it is to be
+     * fixable after the fact: a scan mislabelled "Region 1100" is worse than
+     * an unnamed one, and deleting a scan to rename it would throw away its
+     * results.
+     */
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDeviceDiscoveryScan,
+    ],
+  })
+  /*
+   * What this scan is FOR, in the operator's own words — "Router Discovery —
+   * Region 1100", "Switch Discovery — WB Units". Optional, not unique, and
+   * never used to look a scan up: it exists so the Discovery Scans list can be
+   * read at a glance instead of by matching octet ranges against a subnet plan
+   * kept somewhere else (OneUptime issue #3391).
+   *
+   * Nullable, and every scan created before this column existed is null — so
+   * every surface that renders it falls back to the scan target. See
+   * Common/Utils/NetworkDiscovery/ScanNameUtil.
+   */
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "Name",
+    description:
+      "Optional name for this scan, so it can be told apart from other scans at a glance. Falls back to the scan target when empty.",
+    example: "Router Discovery - Region 1100",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public name?: string = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,
@@ -913,6 +991,33 @@ export default class NetworkDeviceDiscoveryScan extends BaseModel {
   })
   public nextScanAt?: Date = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "Auto Import Processed At",
+    description:
+      "When auto-import rules last processed this scan's results. Managed by the server: cleared when new results arrive, stamped by the worker that evaluates the rules. NULL means the current results have not been processed yet.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Date,
+  })
+  public autoImportProcessedAt?: Date = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/Project.ts

@@ -2576,6 +2576,74 @@ export default class Project extends TenantModel {
   })
   public utmContent?: string = undefined;
 
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmId?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmSourcePlatform?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmCreativeFormat?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmMarketingTactic?: string = undefined;
+
   @ColumnAccessControl({
     create: [Permission.User],
     read: [],

package/Models/DatabaseModels/User.ts

@@ -634,6 +634,74 @@ class User extends UserModel {
   })
   public utmContent?: string = undefined;
 
+  @ColumnAccessControl({
+    create: [Permission.Public],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmId?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.Public],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmSourcePlatform?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.Public],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmCreativeFormat?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.Public],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmMarketingTactic?: string = undefined;
+
   @ColumnAccessControl({
     create: [Permission.Public],
     read: [],

package/Server/API/TelemetryAPI.ts

@@ -204,6 +204,13 @@ const requireExceptionReadAccess: Array<RequestHandler> =
 const requireProfileReadAccess: Array<RequestHandler> =
   createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceProfiles);
 
+/*
+ * Mirrors the read access control declared on the SecurityEvent analytics
+ * model.
+ */
+const requireSecurityEventReadAccess: Array<RequestHandler> =
+  createTelemetryReadAccessGuard(Permission.ReadSecurityEvent);
+
 router.post(
   "/telemetry/metrics/get-attributes",
   ...requireMetricReadAccess,
@@ -268,6 +275,28 @@ router.post(
   },
 );
 
+/*
+ * Security events flatten their whole source payload into `attributes`, so
+ * these are what backs the "add an attribute column" picker on the security
+ * events table — the keys differ per event class and per source, so there is
+ * no fixed list the UI could ship.
+ */
+router.post(
+  "/telemetry/security-events/get-attributes",
+  ...requireSecurityEventReadAccess,
+  async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+    return getAttributes(req, res, next, TelemetryType.SecurityEvent);
+  },
+);
+
+router.post(
+  "/telemetry/security-events/get-attribute-values",
+  ...requireSecurityEventReadAccess,
+  async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+    return getAttributeValues(req, res, next, TelemetryType.SecurityEvent);
+  },
+);
+
 type GetAttributesFunction = (
   req: ExpressRequest,
   res: ExpressResponse,

package/Server/Infrastructure/Postgres/SchemaMigrations/1789100000000-AddNetworkDeviceAutoImportRule.ts

@@ -0,0 +1,60 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Auto-import rules for network device discovery (issue #3378): a rule table
+ * whose conditions decide which discovered hosts become Network Devices with
+ * no manual review step, plus a processed-marker column on the scan so the
+ * worker that evaluates the rules knows which results it has already seen.
+ */
+export class AddNetworkDeviceAutoImportRule1789100000000
+  implements MigrationInterface
+{
+  public name: string = "AddNetworkDeviceAutoImportRule1789100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceAutoImportRule" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "isEnabled" boolean NOT NULL DEFAULT true, "ipMatchTarget" character varying(100), "sysNamePattern" character varying(500), "sysDescrPattern" character varying(500), "includePingOnlyHosts" boolean NOT NULL DEFAULT false, "isExclusion" boolean NOT NULL DEFAULT false, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_network_device_auto_import_rule_id" PRIMARY KEY ("_id"))`,
+    );
+
+    for (const column of ["projectId", "name", "isEnabled", "isExclusion"]) {
+      await queryRunner.query(
+        `CREATE INDEX "IDX_network_device_auto_import_rule_${column}" ON "NetworkDeviceAutoImportRule" ("${column}")`,
+      );
+    }
+
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD CONSTRAINT "FK_nd_auto_import_rule_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD CONSTRAINT "FK_nd_auto_import_rule_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD CONSTRAINT "FK_nd_auto_import_rule_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD "autoImportProcessedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+
+    /*
+     * Backfill EVERY existing scan as already-processed, making the feature
+     * forward-only. One-shot scans stay "Completed" forever, so without this
+     * every scan ever run would sit unprocessed and the first rule a project
+     * creates would mass-import months-old results — the opposite of what an
+     * operator writing a rule about FUTURE discoveries intends. Old results
+     * remain reachable on purpose through the rule's explicit "Run Now".
+     */
+    await queryRunner.query(
+      `UPDATE "NetworkDeviceDiscoveryScan" SET "autoImportProcessedAt" = now()`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" DROP COLUMN "autoImportProcessedAt"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE IF EXISTS "NetworkDeviceAutoImportRule"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789200000000-AddSysObjectIdPatternToAutoImportRule.ts

@@ -0,0 +1,26 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Vendor-based auto-import conditions (issue #3378, phase 2): the probe now
+ * reports the full SNMP system group per discovered host (sysObjectId,
+ * sysLocation, sysContact, sysUpTimeSeconds ride inside the scan's existing
+ * discoveredDevices jsonb, so they need no column), and a rule can match on
+ * the sysObjectID — the vendor's registered enterprise OID.
+ */
+export class AddSysObjectIdPatternToAutoImportRule1789200000000
+  implements MigrationInterface
+{
+  public name: string = "AddSysObjectIdPatternToAutoImportRule1789200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD "sysObjectIdPattern" character varying(500)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" DROP COLUMN "sysObjectIdPattern"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789300000000-AddAutoApplyVendorHealthTemplate.ts

@@ -0,0 +1,26 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Vendor health template auto-apply (issue #3378, phase 3): a per-device
+ * opt-in that lets the inventory poll merge the matching vendor OID template
+ * into an empty Health OIDs list once the device's sysObjectID is known.
+ * Defaults false everywhere — existing devices keep the manual banner flow;
+ * the auto-import engine turns it on for the devices it creates.
+ */
+export class AddAutoApplyVendorHealthTemplate1789300000000
+  implements MigrationInterface
+{
+  public name: string = "AddAutoApplyVendorHealthTemplate1789300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "autoApplyVendorHealthTemplate" boolean NOT NULL DEFAULT false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "autoApplyVendorHealthTemplate"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789400000000-AddNameToNetworkDeviceDiscoveryScan.ts

@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * An optional operator-supplied name on a discovery scan (issue #3391), so the
+ * Discovery Scans list can be read by purpose — "Router Discovery — Region
+ * 1100" — instead of only by the raw address range it sweeps.
+ *
+ * Nullable with no default and no backfill: every scan that already exists
+ * stays unnamed, and every surface that renders the name falls back to the
+ * scan target exactly as it did before this column existed.
+ */
+export class AddNameToNetworkDeviceDiscoveryScan1789400000000
+  implements MigrationInterface
+{
+  public name: string = "AddNameToNetworkDeviceDiscoveryScan1789400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD "name" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" DROP COLUMN "name"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789500000000-AddCampaignUtmFields.ts

@@ -0,0 +1,49 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * GA4's second tier of campaign parameters, on the two tables that already
+ * carry the first five.
+ *
+ * `utm_id`, `utm_source_platform`, `utm_creative_format` and
+ * `utm_marketing_tactic` arrive on the landing URL from Google Ads auto-tagging
+ * and the GA4 URL builder. Until now the browser captured them nowhere and the
+ * signup door dropped them, so a campaign that distinguished its creatives
+ * only by `utm_creative_format` was reportable as one undifferentiated
+ * campaign.
+ *
+ * Nullable with no default, matching utmSource..utmContent beside them: an
+ * existing row has no campaign to backfill, and NULL says "not known" rather
+ * than claiming an empty campaign.
+ */
+export class AddCampaignUtmFields1789500000000 implements MigrationInterface {
+  public name: string = "AddCampaignUtmFields1789500000000";
+
+  private static readonly columns: Array<string> = [
+    "utmId",
+    "utmSourcePlatform",
+    "utmCreativeFormat",
+    "utmMarketingTactic",
+  ];
+
+  private static readonly tables: Array<string> = ["User", "Project"];
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    for (const table of AddCampaignUtmFields1789500000000.tables) {
+      for (const column of AddCampaignUtmFields1789500000000.columns) {
+        await queryRunner.query(
+          `ALTER TABLE "${table}" ADD "${column}" character varying(500)`,
+        );
+      }
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    for (const table of AddCampaignUtmFields1789500000000.tables) {
+      for (const column of AddCampaignUtmFields1789500000000.columns) {
+        await queryRunner.query(
+          `ALTER TABLE "${table}" DROP COLUMN "${column}"`,
+        );
+      }
+    }
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789512000000-AddDetectionRuleDistinctCountColumns.ts

@@ -0,0 +1,33 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Detection rules gain correlation semantics (issue #3398):
+ * distinctCountField switches what a rule counts — unique values of a
+ * field (distinct usernames, distinct source IPs) instead of raw matching
+ * events — and matchCountThreshold holds a rule back until a group
+ * reaches N in one evaluation window. Threshold defaults to 1 so every
+ * existing rule keeps its fire-on-any-match behavior.
+ */
+export class AddDetectionRuleDistinctCountColumns1789512000000
+  implements MigrationInterface
+{
+  public name: string = "AddDetectionRuleDistinctCountColumns1789512000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD "distinctCountField" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD "matchCountThreshold" integer NOT NULL DEFAULT '1'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP COLUMN "matchCountThreshold"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP COLUMN "distinctCountField"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -543,7 +543,13 @@ import { AddDetectionRuleIncidentColumns1788600000000 } from "./1788600000000-Ad
 import { RemoveMarketingConversionUploadState1788700000000 } from "./1788700000000-RemoveMarketingConversionUploadState";
 import { DropMarketingConversionAddEnterpriseLicenseEmail1788800000000 } from "./1788800000000-DropMarketingConversionAddEnterpriseLicenseEmail";
 import { AddUserSlackAndMicrosoftTeams1789000000000 } from "./1789000000000-AddUserSlackAndMicrosoftTeams";
+import { AddNetworkDeviceAutoImportRule1789100000000 } from "./1789100000000-AddNetworkDeviceAutoImportRule";
+import { AddSysObjectIdPatternToAutoImportRule1789200000000 } from "./1789200000000-AddSysObjectIdPatternToAutoImportRule";
+import { AddAutoApplyVendorHealthTemplate1789300000000 } from "./1789300000000-AddAutoApplyVendorHealthTemplate";
+import { AddCampaignUtmFields1789500000000 } from "./1789500000000-AddCampaignUtmFields";
 import { AddUserTwoFactorBackupCode1789100000000 } from "./1789100000000-AddUserTwoFactorBackupCode";
+import { AddNameToNetworkDeviceDiscoveryScan1789400000000 } from "./1789400000000-AddNameToNetworkDeviceDiscoveryScan";
+import { AddDetectionRuleDistinctCountColumns1789512000000 } from "./1789512000000-AddDetectionRuleDistinctCountColumns";
 import { MigrationName1787142779538 } from "./1787142779538-MigrationName";
 import { MigrationName1787156982416 } from "./1787156982416-MigrationName";
 
@@ -1095,5 +1101,11 @@ export default [
   RemoveMarketingConversionUploadState1788700000000,
   DropMarketingConversionAddEnterpriseLicenseEmail1788800000000,
   AddUserSlackAndMicrosoftTeams1789000000000,
+  AddNetworkDeviceAutoImportRule1789100000000,
+  AddSysObjectIdPatternToAutoImportRule1789200000000,
+  AddAutoApplyVendorHealthTemplate1789300000000,
   AddUserTwoFactorBackupCode1789100000000,
+  AddNameToNetworkDeviceDiscoveryScan1789400000000,
+  AddCampaignUtmFields1789500000000,
+  AddDetectionRuleDistinctCountColumns1789512000000,
 ];