@oneuptime/common 12.0.23 → 12.0.24

package/Models/DatabaseModels/DetectionRule.ts

@@ -253,6 +253,61 @@ export default class DetectionRule extends BaseModel {
   })
   public groupByField?: string = undefined;
 
+  /*
+   * The correlation pair: distinctCountField switches what the threshold
+   * counts (unique field values instead of raw events — the difference
+   * between brute-force and one user retyping a password), and
+   * matchCountThreshold holds the rule back until a group reaches N in
+   * one evaluation window. Threshold 1 preserves fire-on-any-match, so
+   * every rule saved before these columns existed behaves unchanged.
+   */
+  @ColumnAccessControl({
+    create: createPermissions,
+    read: readPermissions,
+    update: updatePermissions,
+  })
+  @TableColumn({
+    title: "Distinct Count Field",
+    required: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    description:
+      "Optional security-event field (e.g. principalUser, principalIp) whose distinct values are counted instead of raw matching events. The match count threshold then applies to that distinct count. Empty values are not counted. Names that are not typed event columns are looked up in the event's attributes map.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public distinctCountField?: string = undefined;
+
+  @ColumnAccessControl({
+    create: createPermissions,
+    read: readPermissions,
+    update: updatePermissions,
+  })
+  @TableColumn({
+    title: "Match Count Threshold",
+    required: true,
+    type: TableColumnType.Number,
+    canReadOnRelationQuery: true,
+    description:
+      "Fire only when a group's count — distinct values when a distinct count field is set, matching events otherwise — reaches this number within one evaluation window. 1 fires on any match.",
+    defaultValue: 1,
+    /*
+     * Same reason as shouldCreateIncident: without this,
+     * checkRequiredFields 400s every create payload written before the
+     * column existed, and the DB DEFAULT 1 can never apply.
+     */
+    isDefaultValueColumn: true,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 1,
+  })
+  public matchCountThreshold?: number = undefined;
+
   @ColumnAccessControl({
     create: createPermissions,
     read: readPermissions,

package/Models/DatabaseModels/NetworkDeviceAutoImportRule.ts

@@ -78,6 +78,17 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
   tableDescription:
     "Automatically import matching hosts from network device discovery scan results as Network Devices, with no manual review step",
 })
+/*
+ * The index and foreign-key names below are written out rather than left to
+ * TypeORM's generated hashes, because this table's migration
+ * (1789100000000-AddNetworkDeviceAutoImportRule) was hand-written and created
+ * them with readable names. TypeORM compares constraint NAMES when it diffs a
+ * database against these entities, so an entity that does not spell them out
+ * reports the whole table as schema drift on every run of the Postgres Schema
+ * Drift check — which is what it did until these were added. Naming them here
+ * keeps the readable names and costs no migration; the alternative was an
+ * ALTER that renamed seven objects on every installation to hashes.
+ */
 export default class NetworkDeviceAutoImportRule extends BaseModel {
   @ColumnAccessControl({
     create: [
@@ -112,7 +123,10 @@ export default class NetworkDeviceAutoImportRule extends BaseModel {
       orphanedRowAction: "nullify",
     },
   )
-  @JoinColumn({ name: "projectId" })
+  @JoinColumn({
+    name: "projectId",
+    foreignKeyConstraintName: "FK_nd_auto_import_rule_projectId",
+  })
   public project?: Project = undefined;
 
   @ColumnAccessControl({
@@ -130,7 +144,7 @@ export default class NetworkDeviceAutoImportRule extends BaseModel {
     ],
     update: [],
   })
-  @Index()
+  @Index("IDX_network_device_auto_import_rule_projectId")
   @TableColumn({
     type: TableColumnType.ObjectID,
     required: true,
@@ -164,7 +178,7 @@ export default class NetworkDeviceAutoImportRule extends BaseModel {
       Permission.EditNetworkDeviceAutoImportRule,
     ],
   })
-  @Index()
+  @Index("IDX_network_device_auto_import_rule_name")
   @TableColumn({
     required: true,
     type: TableColumnType.ShortText,
@@ -230,7 +244,7 @@ export default class NetworkDeviceAutoImportRule extends BaseModel {
       Permission.EditNetworkDeviceAutoImportRule,
     ],
   })
-  @Index()
+  @Index("IDX_network_device_auto_import_rule_isEnabled")
   @TableColumn({
     required: true,
     type: TableColumnType.Boolean,
@@ -434,7 +448,7 @@ export default class NetworkDeviceAutoImportRule extends BaseModel {
       Permission.EditNetworkDeviceAutoImportRule,
     ],
   })
-  @Index()
+  @Index("IDX_network_device_auto_import_rule_isExclusion")
   @TableColumn({
     required: true,
     type: TableColumnType.Boolean,
@@ -485,7 +499,10 @@ export default class NetworkDeviceAutoImportRule extends BaseModel {
       orphanedRowAction: "nullify",
     },
   )
-  @JoinColumn({ name: "createdByUserId" })
+  @JoinColumn({
+    name: "createdByUserId",
+    foreignKeyConstraintName: "FK_nd_auto_import_rule_createdByUserId",
+  })
   public createdByUser?: User = undefined;
 
   @ColumnAccessControl({
@@ -541,7 +558,10 @@ export default class NetworkDeviceAutoImportRule extends BaseModel {
       orphanedRowAction: "nullify",
     },
   )
-  @JoinColumn({ name: "deletedByUserId" })
+  @JoinColumn({
+    name: "deletedByUserId",
+    foreignKeyConstraintName: "FK_nd_auto_import_rule_deletedByUserId",
+  })
   public deletedByUser?: User = undefined;
 
   @ColumnAccessControl({

package/Models/DatabaseModels/NetworkDeviceDiscoveryScan.ts

@@ -250,6 +250,73 @@ export default class NetworkDeviceDiscoveryScan extends BaseModel {
   })
   public probeId?: ObjectID = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceDiscoveryScan,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceDiscoveryScan,
+    ],
+    /*
+     * Updatable, unlike everything that describes the sweep itself: changing
+     * the target or the credentials of a scan mid-flight would mean the stored
+     * row no longer described the sweep that ran, so those grant no update at
+     * all. (The recurrence pair is updatable too — it describes the NEXT run
+     * rather than the one that happened.)
+     *
+     * A name describes nothing but itself, and the whole point of it is to be
+     * fixable after the fact: a scan mislabelled "Region 1100" is worse than
+     * an unnamed one, and deleting a scan to rename it would throw away its
+     * results.
+     */
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDeviceDiscoveryScan,
+    ],
+  })
+  /*
+   * What this scan is FOR, in the operator's own words — "Router Discovery —
+   * Region 1100", "Switch Discovery — WB Units". Optional, not unique, and
+   * never used to look a scan up: it exists so the Discovery Scans list can be
+   * read at a glance instead of by matching octet ranges against a subnet plan
+   * kept somewhere else (OneUptime issue #3391).
+   *
+   * Nullable, and every scan created before this column existed is null — so
+   * every surface that renders it falls back to the scan target. See
+   * Common/Utils/NetworkDiscovery/ScanNameUtil.
+   */
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "Name",
+    description:
+      "Optional name for this scan, so it can be told apart from other scans at a glance. Falls back to the scan target when empty.",
+    example: "Router Discovery - Region 1100",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public name?: string = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/Project.ts

@@ -2576,6 +2576,74 @@ export default class Project extends TenantModel {
   })
   public utmContent?: string = undefined;
 
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmId?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmSourcePlatform?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmCreativeFormat?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.User],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmMarketingTactic?: string = undefined;
+
   @ColumnAccessControl({
     create: [Permission.User],
     read: [],

package/Models/DatabaseModels/User.ts

@@ -634,6 +634,74 @@ class User extends UserModel {
   })
   public utmContent?: string = undefined;
 
+  @ColumnAccessControl({
+    create: [Permission.Public],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmId?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.Public],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmSourcePlatform?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.Public],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmCreativeFormat?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.Public],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.LongText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+    nullable: true,
+    unique: false,
+  })
+  public utmMarketingTactic?: string = undefined;
+
   @ColumnAccessControl({
     create: [Permission.Public],
     read: [],

package/Server/API/TelemetryAPI.ts

@@ -204,6 +204,13 @@ const requireExceptionReadAccess: Array<RequestHandler> =
 const requireProfileReadAccess: Array<RequestHandler> =
   createTelemetryReadAccessGuard(Permission.ReadTelemetryServiceProfiles);
 
+/*
+ * Mirrors the read access control declared on the SecurityEvent analytics
+ * model.
+ */
+const requireSecurityEventReadAccess: Array<RequestHandler> =
+  createTelemetryReadAccessGuard(Permission.ReadSecurityEvent);
+
 router.post(
   "/telemetry/metrics/get-attributes",
   ...requireMetricReadAccess,
@@ -268,6 +275,28 @@ router.post(
   },
 );
 
+/*
+ * Security events flatten their whole source payload into `attributes`, so
+ * these are what backs the "add an attribute column" picker on the security
+ * events table — the keys differ per event class and per source, so there is
+ * no fixed list the UI could ship.
+ */
+router.post(
+  "/telemetry/security-events/get-attributes",
+  ...requireSecurityEventReadAccess,
+  async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+    return getAttributes(req, res, next, TelemetryType.SecurityEvent);
+  },
+);
+
+router.post(
+  "/telemetry/security-events/get-attribute-values",
+  ...requireSecurityEventReadAccess,
+  async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+    return getAttributeValues(req, res, next, TelemetryType.SecurityEvent);
+  },
+);
+
 type GetAttributesFunction = (
   req: ExpressRequest,
   res: ExpressResponse,

package/Server/Infrastructure/Postgres/SchemaMigrations/1789400000000-AddNameToNetworkDeviceDiscoveryScan.ts

@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * An optional operator-supplied name on a discovery scan (issue #3391), so the
+ * Discovery Scans list can be read by purpose — "Router Discovery — Region
+ * 1100" — instead of only by the raw address range it sweeps.
+ *
+ * Nullable with no default and no backfill: every scan that already exists
+ * stays unnamed, and every surface that renders the name falls back to the
+ * scan target exactly as it did before this column existed.
+ */
+export class AddNameToNetworkDeviceDiscoveryScan1789400000000
+  implements MigrationInterface
+{
+  public name: string = "AddNameToNetworkDeviceDiscoveryScan1789400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD "name" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" DROP COLUMN "name"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789500000000-AddCampaignUtmFields.ts

@@ -0,0 +1,49 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * GA4's second tier of campaign parameters, on the two tables that already
+ * carry the first five.
+ *
+ * `utm_id`, `utm_source_platform`, `utm_creative_format` and
+ * `utm_marketing_tactic` arrive on the landing URL from Google Ads auto-tagging
+ * and the GA4 URL builder. Until now the browser captured them nowhere and the
+ * signup door dropped them, so a campaign that distinguished its creatives
+ * only by `utm_creative_format` was reportable as one undifferentiated
+ * campaign.
+ *
+ * Nullable with no default, matching utmSource..utmContent beside them: an
+ * existing row has no campaign to backfill, and NULL says "not known" rather
+ * than claiming an empty campaign.
+ */
+export class AddCampaignUtmFields1789500000000 implements MigrationInterface {
+  public name: string = "AddCampaignUtmFields1789500000000";
+
+  private static readonly columns: Array<string> = [
+    "utmId",
+    "utmSourcePlatform",
+    "utmCreativeFormat",
+    "utmMarketingTactic",
+  ];
+
+  private static readonly tables: Array<string> = ["User", "Project"];
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    for (const table of AddCampaignUtmFields1789500000000.tables) {
+      for (const column of AddCampaignUtmFields1789500000000.columns) {
+        await queryRunner.query(
+          `ALTER TABLE "${table}" ADD "${column}" character varying(500)`,
+        );
+      }
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    for (const table of AddCampaignUtmFields1789500000000.tables) {
+      for (const column of AddCampaignUtmFields1789500000000.columns) {
+        await queryRunner.query(
+          `ALTER TABLE "${table}" DROP COLUMN "${column}"`,
+        );
+      }
+    }
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789512000000-AddDetectionRuleDistinctCountColumns.ts

@@ -0,0 +1,33 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Detection rules gain correlation semantics (issue #3398):
+ * distinctCountField switches what a rule counts — unique values of a
+ * field (distinct usernames, distinct source IPs) instead of raw matching
+ * events — and matchCountThreshold holds a rule back until a group
+ * reaches N in one evaluation window. Threshold defaults to 1 so every
+ * existing rule keeps its fire-on-any-match behavior.
+ */
+export class AddDetectionRuleDistinctCountColumns1789512000000
+  implements MigrationInterface
+{
+  public name: string = "AddDetectionRuleDistinctCountColumns1789512000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD "distinctCountField" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD "matchCountThreshold" integer NOT NULL DEFAULT '1'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP COLUMN "matchCountThreshold"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP COLUMN "distinctCountField"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -546,7 +546,10 @@ import { AddUserSlackAndMicrosoftTeams1789000000000 } from "./1789000000000-AddU
 import { AddNetworkDeviceAutoImportRule1789100000000 } from "./1789100000000-AddNetworkDeviceAutoImportRule";
 import { AddSysObjectIdPatternToAutoImportRule1789200000000 } from "./1789200000000-AddSysObjectIdPatternToAutoImportRule";
 import { AddAutoApplyVendorHealthTemplate1789300000000 } from "./1789300000000-AddAutoApplyVendorHealthTemplate";
+import { AddCampaignUtmFields1789500000000 } from "./1789500000000-AddCampaignUtmFields";
 import { AddUserTwoFactorBackupCode1789100000000 } from "./1789100000000-AddUserTwoFactorBackupCode";
+import { AddNameToNetworkDeviceDiscoveryScan1789400000000 } from "./1789400000000-AddNameToNetworkDeviceDiscoveryScan";
+import { AddDetectionRuleDistinctCountColumns1789512000000 } from "./1789512000000-AddDetectionRuleDistinctCountColumns";
 import { MigrationName1787142779538 } from "./1787142779538-MigrationName";
 import { MigrationName1787156982416 } from "./1787156982416-MigrationName";
 
@@ -1102,4 +1105,7 @@ export default [
   AddSysObjectIdPatternToAutoImportRule1789200000000,
   AddAutoApplyVendorHealthTemplate1789300000000,
   AddUserTwoFactorBackupCode1789100000000,
+  AddNameToNetworkDeviceDiscoveryScan1789400000000,
+  AddCampaignUtmFields1789500000000,
+  AddDetectionRuleDistinctCountColumns1789512000000,
 ];