@oneuptime/common 12.0.22 → 12.0.24

package/Types/Monitor/MonitorCriteriaInstance.ts

@@ -68,7 +68,14 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
       filters: [
         {
           checkOn: CheckOn.IsOnline,
-          filterType: undefined,
+          /*
+           * Seed the condition too, matching
+           * getNewMonitorCriteriaInstanceAsJSON. A filter with no filter
+           * type shows an empty "Filter Condition" dropdown in the form
+           * and never matches anything at evaluation time, because every
+           * comparator in CompareCriteria switches on the filter type.
+           */
+          filterType: FilterType.True,
           value: undefined,
         },
       ],
@@ -83,6 +90,35 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
     };
   }
 
+  /*
+   * The monitor types whose criteria MonitorCriteriaEvaluator hands to
+   * MetricMonitorCriteria. That evaluator reads exactly one thing -
+   * CheckOn.MetricValue - so these types share a single pair of defaults:
+   * a metric that is reporting a value means online, a metric that has
+   * gone to zero means offline.
+   *
+   * Kept in step with the routing list in MonitorCriteriaEvaluator and
+   * with the check-on narrowing in the dashboard's CriteriaFilter util,
+   * which offers these types the metric value and nothing else. A type
+   * missing here falls through to `new MonitorCriteriaInstance()` and
+   * ships an unnamed criteria whose "Is Online" filter no evaluator on
+   * this path reads - a rule that can never fire and cannot be saved,
+   * since getValidationError requires a name and a description.
+   */
+  public static isMetricBackedMonitorType(monitorType: MonitorType): boolean {
+    return (
+      monitorType === MonitorType.Metrics ||
+      monitorType === MonitorType.Kubernetes ||
+      monitorType === MonitorType.Docker ||
+      monitorType === MonitorType.Host ||
+      monitorType === MonitorType.Podman ||
+      monitorType === MonitorType.DockerSwarm ||
+      monitorType === MonitorType.Proxmox ||
+      monitorType === MonitorType.Ceph ||
+      monitorType === MonitorType.IoTDevice
+    );
+  }
+
   public static getDefaultOnlineMonitorCriteriaInstance(arg: {
     monitorType: MonitorType;
     monitorStatusId: ObjectID;
@@ -232,7 +268,7 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
       return monitorCriteriaInstance;
     }
 
-    if (arg.monitorType === MonitorType.Metrics) {
+    if (MonitorCriteriaInstance.isMetricBackedMonitorType(arg.monitorType)) {
       const monitorCriteriaInstance: MonitorCriteriaInstance =
         new MonitorCriteriaInstance();
 
@@ -254,7 +290,7 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
                   ? arg.metricOptions.metricAliases[0]
                   : undefined,
             },
-            value: 0, // if there are some logs then monitor is online.
+            value: 0, // the metric is reporting above zero, so the monitor is online.
           },
         ],
         incidents: [],
@@ -269,7 +305,7 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
       return monitorCriteriaInstance;
     }
 
-    if (arg.monitorType === MonitorType.Kubernetes) {
+    if (arg.monitorType === MonitorType.Profiles) {
       const monitorCriteriaInstance: MonitorCriteriaInstance =
         new MonitorCriteriaInstance();
 
@@ -279,19 +315,9 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
         filterCondition: FilterCondition.Any,
         filters: [
           {
-            checkOn: CheckOn.MetricValue,
+            checkOn: CheckOn.ProfileCount,
             filterType: FilterType.GreaterThan,
-
-            metricMonitorOptions: {
-              metricAggregationType: EvaluateOverTimeType.AnyValue,
-              metricAlias:
-                arg.metricOptions &&
-                arg.metricOptions.metricAliases &&
-                arg.metricOptions.metricAliases.length > 0
-                  ? arg.metricOptions.metricAliases[0]
-                  : undefined,
-            },
-            value: 0,
+            value: 0, // if profiles are arriving then the monitor is online.
           },
         ],
         incidents: [],
@@ -1130,7 +1156,7 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
       };
     }
 
-    if (arg.monitorType === MonitorType.Metrics) {
+    if (MonitorCriteriaInstance.isMetricBackedMonitorType(arg.monitorType)) {
       monitorCriteriaInstance.data = {
         id: ObjectID.generate().toString(),
         monitorStatusId: arg.monitorStatusId,
@@ -1148,7 +1174,15 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
                   ? arg.metricOptions.metricAliases[0]
                   : undefined,
             },
-            value: 0, // if there are no logs then the monitor is offline
+            /*
+             * A reported value of zero, not an absent one. When the window
+             * holds no samples at all the evaluator honours
+             * metricMonitorOptions.onNoDataPolicy, which defaults to
+             * Ignore, so silence alone does not fire this - a user who
+             * wants "stopped reporting" to page has to opt into
+             * NoDataPolicy.Trigger or TreatAsZero on the filter.
+             */
+            value: 0,
           },
         ],
         incidents: [
@@ -1179,25 +1213,16 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
       };
     }
 
-    if (arg.monitorType === MonitorType.Kubernetes) {
+    if (arg.monitorType === MonitorType.Profiles) {
       monitorCriteriaInstance.data = {
         id: ObjectID.generate().toString(),
         monitorStatusId: arg.monitorStatusId,
         filterCondition: FilterCondition.Any,
         filters: [
           {
-            checkOn: CheckOn.MetricValue,
+            checkOn: CheckOn.ProfileCount,
             filterType: FilterType.EqualTo,
-            metricMonitorOptions: {
-              metricAggregationType: EvaluateOverTimeType.AnyValue,
-              metricAlias:
-                arg.metricOptions &&
-                arg.metricOptions.metricAliases &&
-                arg.metricOptions.metricAliases.length > 0
-                  ? arg.metricOptions.metricAliases[0]
-                  : undefined,
-            },
-            value: 0,
+            value: 0, // if no profiles are arriving then the monitor is offline
           },
         ],
         incidents: [
@@ -1482,39 +1507,62 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
       return `Description is required for criteria "${value.data.name}"`;
     }
 
-    for (const incident of value.data.incidents) {
-      if (!incident) {
-        continue;
-      }
-
-      if (!incident.title) {
-        return `Incident title is required for criteria "${value.data.name}"`;
-      }
+    /*
+     * Each "when filters match, ..." action is validated only while its own
+     * switch is on.
+     *
+     * The criteria form keeps the incident / alert rows it seeded when a
+     * switch was turned on, so that turning the switch back on restores what
+     * was typed - the same retained-but-inert config that
+     * MonitorStepsReferenceExtractor documents for project references. The
+     * evaluator ignores those rows entirely while the flag is off
+     * (MonitorIncident.criteriaMetCreateIncidentsAndUpdateMonitorStatus,
+     * MonitorAlert.criteriaMetCreateAlertsAndUpdateMonitorStatus), so
+     * validating them anyway only blocked the form: the row is rendered only
+     * while its switch is on, which left the user staring at "Incident title
+     * is required" with no field on screen to type it into and no way past
+     * Next (issues #3410, #3413).
+     *
+     * The predicate is the falsy one the evaluator uses, not `!== false`, so
+     * a criteria saved before these flags existed - populated rows, no flag -
+     * is treated as off here exactly as it already is at runtime.
+     *
+     * Title and severity are the two fields the form marks required; the
+     * description is not one of them. It sits in a collapsed section labelled
+     * "Optional incident description" / "Optional alert description", and both
+     * Incident.description and Alert.description are nullable columns. So it is
+     * not required here either - demanding it stuck the form on a field the UI
+     * calls optional and keeps folded away, which is the second half of #3410.
+     */
+    if (value.data.createIncidents) {
+      for (const incident of value.data.incidents) {
+        if (!incident) {
+          continue;
+        }
 
-      if (!incident.description) {
-        return `Incident description is required for criteria "${value.data.name}"`;
-      }
+        if (!incident.title) {
+          return `Incident title is required for criteria "${value.data.name}"`;
+        }
 
-      if (!incident.incidentSeverityId) {
-        return `Incident severity is required for criteria "${value.data.name}"`;
+        if (!incident.incidentSeverityId) {
+          return `Incident severity is required for criteria "${value.data.name}"`;
+        }
       }
     }
 
-    for (const alert of value.data.alerts) {
-      if (!alert) {
-        continue;
-      }
-
-      if (!alert.title) {
-        return `Alert title is required for criteria "${value.data.name}"`;
-      }
+    if (value.data.createAlerts) {
+      for (const alert of value.data.alerts) {
+        if (!alert) {
+          continue;
+        }
 
-      if (!alert.description) {
-        return `Alert description is required for criteria "${value.data.name}"`;
-      }
+        if (!alert.title) {
+          return `Alert title is required for criteria "${value.data.name}"`;
+        }
 
-      if (!alert.alertSeverityId) {
-        return `Alert severity is required for criteria "${value.data.name}"`;
+        if (!alert.alertSeverityId) {
+          return `Alert severity is required for criteria "${value.data.name}"`;
+        }
       }
     }
 
@@ -1523,6 +1571,18 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
         return `Filter Type is required for criteria "${value.data.name}"`;
       }
 
+      /*
+       * A filter with no condition is silently dead: every comparator in
+       * CompareCriteria switches on the filter type and returns "no
+       * match" for one it does not recognise, so the criteria never
+       * fires. The empty dropdown is easy to walk past when every field
+       * around it is filled in, so refuse the save instead of accepting
+       * a rule that can never be true.
+       */
+      if (!filter.filterType) {
+        return `Filter Condition is required for criteria "${value.data.name}" on filter type: ${filter.checkOn}`;
+      }
+
       if (
         monitorType === MonitorType.Ping &&
         filter.checkOn !== CheckOn.IsOnline &&

package/Types/Monitor/Recommendation/MonitorRecommendationSeverityMapper.ts

@@ -108,7 +108,8 @@ export default class MonitorRecommendationSeverityMapper {
    *
    * Returns undefined when the mapping has no entry, which callers must treat
    * as "leave the template's own severity alone" rather than as "no severity"
-   * — a criteria instance with a populated incident and no severity id fails
+   * — a criteria instance that creates incidents (`createIncidents`) and has a
+   * populated incident with no severity id fails
    * `MonitorCriteriaInstance.getValidationError` and the whole create fails.
    */
   public static resolveSeverityId(data: {

package/Types/NetworkAutomation/RuleRunResult.ts

@@ -65,6 +65,58 @@ export interface LabelRuleRunResult {
   isTruncated: boolean;
 }
 
+/*
+ * One run of a network device auto-import rule — automatic (the worker
+ * processing a completed scan) or manual ("Run Now" against the project's
+ * completed scans, optionally as a dry run that writes nothing).
+ *
+ * Every discovered host the run looked at lands in a bucket for the same
+ * reason as above: "nothing matched", "everything that matched is already in
+ * the inventory", and "an exclusion rule vetoed it" are very different
+ * answers to "why did this import zero devices".
+ */
+export interface AutoImportRuleRunResult {
+  // Discovered hosts the run evaluated, across every scan it read.
+  hostsEvaluated: number;
+  // Of those, the ones an import rule matched (exclusions already applied).
+  hostsMatched: number;
+  // Hosts an exclusion rule vetoed.
+  hostsExcluded: number;
+  /*
+   * Matched hosts skipped because a device with that address already exists
+   * — including one created earlier in this same run from a duplicate row or
+   * an overlapping scan. Re-running a rule is idempotent, not additive.
+   */
+  hostsSkippedAlreadyRegistered: number;
+  // Devices actually created. Always zero on a dry run.
+  devicesCreated: number;
+  // Matched hosts whose create threw. Logged server-side, never fatal.
+  devicesFailed: number;
+  /*
+   * True when the run stopped at the DEVICE cap with matched hosts left
+   * over. Running again continues: already-imported hosts are skipped.
+   */
+  isTruncated: boolean;
+  /*
+   * True when the project has more completed scans than one manual run
+   * reads (the newest MAX_SCANS_PER_AUTO_IMPORT_RULE_RUN). Distinct from
+   * isTruncated because the advice differs: re-running re-reads the same
+   * newest scans, so hosts that appear ONLY in older scans stay unread.
+   */
+  hasMoreScans: boolean;
+  // True when this run was a dry run: full evaluation, no writes.
+  isDryRun: boolean;
+  /*
+   * Up to MAX_MATCHED_IP_SAMPLE addresses the run imported (or, on a dry
+   * run, would import) — the operator's "which hosts is this rule actually
+   * claiming" answer, without shipping a 30k-element array.
+   */
+  matchedIpAddressSample: Array<string>;
+}
+
+// How many addresses matchedIpAddressSample carries at most.
+export const MAX_MATCHED_IP_SAMPLE: number = 50;
+
 /*
  * A count off the wire. An absent or non-numeric field reads as zero rather
  * than as NaN: a summary line that says "NaN devices" is worse than one that
@@ -118,4 +170,36 @@ export class RuleRunResultUtil {
       isTruncated: source["isTruncated"] === true,
     };
   }
+
+  public static parseAutoImportRuleRunResult(
+    json: JSONObject | undefined | null,
+  ): AutoImportRuleRunResult {
+    const source: JSONObject = json || {};
+
+    const sample: Array<string> = Array.isArray(
+      source["matchedIpAddressSample"],
+    )
+      ? (source["matchedIpAddressSample"] as Array<unknown>)
+          .filter((value: unknown) => {
+            return typeof value === "string";
+          })
+          .slice(0, MAX_MATCHED_IP_SAMPLE)
+      : [];
+
+    return {
+      hostsEvaluated: readCount(source, "hostsEvaluated"),
+      hostsMatched: readCount(source, "hostsMatched"),
+      hostsExcluded: readCount(source, "hostsExcluded"),
+      hostsSkippedAlreadyRegistered: readCount(
+        source,
+        "hostsSkippedAlreadyRegistered",
+      ),
+      devicesCreated: readCount(source, "devicesCreated"),
+      devicesFailed: readCount(source, "devicesFailed"),
+      isTruncated: source["isTruncated"] === true,
+      hasMoreScans: source["hasMoreScans"] === true,
+      isDryRun: source["isDryRun"] === true,
+      matchedIpAddressSample: sample as Array<string>,
+    };
+  }
 }

package/Types/Permission.ts

@@ -600,6 +600,11 @@ enum Permission {
   EditNetworkDeviceLabelRule = "EditNetworkDeviceLabelRule",
   ReadNetworkDeviceLabelRule = "ReadNetworkDeviceLabelRule",
 
+  CreateNetworkDeviceAutoImportRule = "CreateNetworkDeviceAutoImportRule",
+  DeleteNetworkDeviceAutoImportRule = "DeleteNetworkDeviceAutoImportRule",
+  EditNetworkDeviceAutoImportRule = "EditNetworkDeviceAutoImportRule",
+  ReadNetworkDeviceAutoImportRule = "ReadNetworkDeviceAutoImportRule",
+
   // Podman Host Label Rule Permissions
   CreatePodmanHostLabelRule = "CreatePodmanHostLabelRule",
   DeletePodmanHostLabelRule = "DeletePodmanHostLabelRule",
@@ -11883,6 +11888,48 @@ export class PermissionHelper {
         group: PermissionGroup.Telemetry,
       },
 
+      // Network Device Auto Import Rule Permissions
+      {
+        permission: Permission.CreateNetworkDeviceAutoImportRule,
+        title: "Create Network Device Auto Import Rule",
+        description:
+          "This permission can create Network Device Auto Import Rules in this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.DeleteNetworkDeviceAutoImportRule,
+        title: "Delete Network Device Auto Import Rule",
+        description:
+          "This permission can delete Network Device Auto Import Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.EditNetworkDeviceAutoImportRule,
+        title: "Edit Network Device Auto Import Rule",
+        description:
+          "This permission can edit Network Device Auto Import Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.ReadNetworkDeviceAutoImportRule,
+        title: "Read Network Device Auto Import Rule",
+        description:
+          "This permission can read Network Device Auto Import Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+
       // Podman Host Label Rule Permissions
       {
         permission: Permission.CreatePodmanHostLabelRule,

package/Types/SecurityEvent/DetectionFindingConstants.ts

@@ -18,6 +18,17 @@ export const DETECTION_RULE_NAME_ATTRIBUTE: string =
   "oneuptime.detection.rule_name";
 export const DETECTION_MATCH_COUNT_ATTRIBUTE: string =
   "oneuptime.detection.match_count";
+// Present only on findings from rules with a distinctCountField set.
+export const DETECTION_DISTINCT_COUNT_ATTRIBUTE: string =
+  "oneuptime.detection.distinct_count";
+
+/*
+ * Save-time bounds for DetectionRule.matchCountThreshold — one home for
+ * the server validator and the dashboard form, so the two ranges cannot
+ * drift apart.
+ */
+export const DETECTION_MATCH_COUNT_THRESHOLD_MIN: number = 1;
+export const DETECTION_MATCH_COUNT_THRESHOLD_MAX: number = 1000000;
 export const DETECTION_GROUP_VALUE_ATTRIBUTE: string =
   "oneuptime.detection.group_value";
 export const DETECTION_SIGMA_ID_ATTRIBUTE: string =

package/Types/Telemetry/LlmMetricConventions.ts

@@ -0,0 +1,124 @@
+/*
+ * Single source of truth for the OpenTelemetry GenAI **metric** names and
+ * attribute keys OneUptime recognizes — the metric-side sibling of
+ * Common/Types/Telemetry/LlmConventions.ts, which does the same job for span
+ * attributes.
+ *
+ * Why this exists: the LLM feature was originally span-only. A span carries
+ * model, tokens and cost together, so one row answers every question. But a
+ * large class of emitters never produce GenAI spans at all:
+ *
+ *   - Native OpenTelemetry GenAI metrics (gen_ai.client.token.usage) emitted
+ *     by an SDK configured for metrics without tracing.
+ *   - AI gateways and vendor exporters that publish spend/usage counters only.
+ *
+ * For those, token and cost totals have to come off the metric stream instead.
+ * Both the budget evaluator (Common/Server/Utils/Telemetry/LlmMetricSpend.ts)
+ * and anything else that needs metric-sourced LLM figures import these lists,
+ * so a newly recognized metric name is added HERE, once.
+ *
+ * Order matters: within each list the preferred convention comes first.
+ */
+
+/*
+ * Metric names carrying token counts. `gen_ai.client.token.usage` is the OTel
+ * semantic convention (a histogram whose `sum` is the token total); the rest
+ * are the spellings the dominant instrumentations shipped before/alongside it.
+ */
+export const LlmTokenUsageMetricNames: Array<string> = [
+  "gen_ai.client.token.usage",
+  "gen_ai.client.token.count",
+  "llm.token.usage",
+  "llm.usage.tokens",
+];
+
+/*
+ * Metric names carrying spend in USD.
+ *
+ * There is no OTel semantic convention for LLM cost — every entry below is a
+ * vendor spelling. That is precisely why metric-sourced cost is worth
+ * supporting: the emitters that publish a cost metric are generally the ones
+ * that publish no spans, so this list is the only way their spend is visible.
+ */
+export const LlmCostMetricNames: Array<string> = [
+  "gen_ai.client.cost",
+  "gen_ai.client.cost.usd",
+  "gen_ai.usage.cost",
+  // LiteLLM proxy.
+  "litellm_spend_metric",
+  "litellm.cost.total",
+];
+
+/*
+ * Attribute keys naming which side of the exchange a token datapoint counts.
+ * The OTel convention is `gen_ai.token.type`; the others are pre-convention
+ * spellings still in the wild.
+ */
+export const LlmTokenTypeAttributeKeys: Array<string> = [
+  "gen_ai.token.type",
+  "llm.token.type",
+];
+
+/*
+ * Attribute values that mean "tokens sent to the model". `prompt` is the
+ * pre-1.27 semconv spelling that several instrumentations still emit.
+ */
+export const LlmInputTokenTypeValues: Array<string> = ["input", "prompt"];
+
+/*
+ * Attribute values that mean "tokens produced by the model".
+ *
+ * Note what is deliberately absent: cache_read / cache_creation. Those are
+ * real token counts, but they are neither input nor output in the sense the
+ * span columns (llmInputTokens / llmOutputTokens) use, and folding them in
+ * would silently inflate the metric-sourced totals relative to the
+ * span-sourced ones they stand in for.
+ */
+export const LlmOutputTokenTypeValues: Array<string> = ["output", "completion"];
+
+/**
+ * Which side of the exchange a `gen_ai.token.type` value denotes, or null
+ * when the value is one we deliberately do not count (cache_read,
+ * cache_creation) or do not recognize at all.
+ *
+ * Comparison is case-insensitive and whitespace-trimmed: the value reaches us
+ * as a free-form OTLP string attribute, and emitters are inconsistent about
+ * casing.
+ */
+export type LlmTokenDirection = "input" | "output";
+
+export function getLlmTokenDirection(
+  attributeValue: string | undefined | null,
+): LlmTokenDirection | null {
+  if (typeof attributeValue !== "string") {
+    return null;
+  }
+
+  const normalized: string = attributeValue.trim().toLowerCase();
+
+  if (!normalized) {
+    return null;
+  }
+
+  if (LlmInputTokenTypeValues.includes(normalized)) {
+    return "input";
+  }
+
+  if (LlmOutputTokenTypeValues.includes(normalized)) {
+    return "output";
+  }
+
+  return null;
+}
+
+/**
+ * The attribute values to match for a direction. Exposed so query builders
+ * and tests share one definition of "what counts as input".
+ */
+export function getLlmTokenTypeValues(
+  direction: LlmTokenDirection,
+): Array<string> {
+  return direction === "input"
+    ? LlmInputTokenTypeValues
+    : LlmOutputTokenTypeValues;
+}

package/UI/Components/AutocompleteTextInput/AutocompleteTextInput.tsx

@@ -27,6 +27,8 @@ export interface ComponentProps {
   isLoadingSuggestions?: boolean | undefined;
   loadingMessage?: string | undefined;
   noSuggestionsMessage?: string | undefined;
+  // For inputs with no visible label element to point ariaLabelledby at.
+  ariaLabel?: string | undefined;
   /*
    * The id of the element that names this input. Without it a picker that draws
    * its own label - the workflow record editor, where the field's name sits in
@@ -464,6 +466,7 @@ const AutocompleteTextInput: FunctionComponent<ComponentProps> = (
         className={getInputClassName()}
         data-testid={props.dataTestId}
         disabled={props.disabled}
+        aria-label={props.ariaLabel}
         aria-labelledby={props.ariaLabelledby}
         aria-autocomplete="list"
         aria-controls={listboxIdRef.current}

package/UI/Components/BulkUpdate/BulkUpdateForm.tsx

@@ -358,7 +358,16 @@ const BulkUpdateForm: <T extends GenericObject>(
                   className="h-4 w-4 text-indigo-600"
                 />
                 <span>
-                  {props.selectedItems.length} {props.pluralLabel} Selected
+                  {props.selectedItems.length}{" "}
+                  {/*
+                   * The singular when there is one of them. The badge is the
+                   * one sentence in this bar that is always on screen, and
+                   * "1 resources Selected" reads as a bug in the count.
+                   */}
+                  {props.selectedItems.length === 1
+                    ? props.singularLabel
+                    : props.pluralLabel}{" "}
+                  Selected
                 </span>
               </div>