@oneuptime/common 12.0.24 → 12.0.26

package/Server/Infrastructure/Postgres/SchemaMigrations/1787923136162-MigrationName.ts

@@ -0,0 +1,57 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1787923136162 implements MigrationInterface {
+  public name = "MigrationName1787923136162";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "ThreatIntelFeed" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(50) NOT NULL, "description" character varying(500), "apiRootUrl" character varying(500) NOT NULL, "collectionId" character varying(100) NOT NULL, "apiToken" text, "basicAuthUsername" character varying(100), "basicAuthPassword" text, "isEnabled" boolean NOT NULL DEFAULT true, "pollIntervalInMinutes" integer NOT NULL DEFAULT '60', "minimumConfidence" integer NOT NULL DEFAULT '0', "shouldCreateAlert" boolean NOT NULL DEFAULT true, "shouldWriteDetectionFinding" boolean NOT NULL DEFAULT true, "shouldCreateIncident" boolean NOT NULL DEFAULT false, "alertSeverityId" uuid, "incidentSeverityId" uuid, "lastPolledAt" TIMESTAMP WITH TIME ZONE, "cursor" character varying(500), "nextPageToken" text, "lastPollSummary" character varying(500), "lastError" text, "lastEvaluatedAt" TIMESTAMP WITH TIME ZONE, "lastMatchAt" TIMESTAMP WITH TIME ZONE, "lastMatchError" text, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_f439b1608d006621778c77a13de" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5cb2e4e831d2e3b78a636e8aa3" ON "ThreatIntelFeed" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_1a73c0779724e007780632b751" ON "ThreatIntelFeed" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_5cb2e4e831d2e3b78a636e8aa3c" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_2ffbb2319e575d9707009ef9621" FOREIGN KEY ("alertSeverityId") REFERENCES "AlertSeverity"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_3fa2aadff928287f194db3bdbdd" FOREIGN KEY ("incidentSeverityId") REFERENCES "IncidentSeverity"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_faced98393bfb0882cd8929ac8a" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_fa32bd7c42ea2b291e649940c7f" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_fa32bd7c42ea2b291e649940c7f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_faced98393bfb0882cd8929ac8a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_3fa2aadff928287f194db3bdbdd"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_2ffbb2319e575d9707009ef9621"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_5cb2e4e831d2e3b78a636e8aa3c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_1a73c0779724e007780632b751"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5cb2e4e831d2e3b78a636e8aa3"`,
+    );
+    await queryRunner.query(`DROP TABLE "ThreatIntelFeed"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789600000000-AddAutoProvisionedNetworkDeviceMonitors.ts

@@ -0,0 +1,49 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddAutoProvisionedNetworkDeviceMonitors1789600000000
+  implements MigrationInterface
+{
+  public name: string = "AddAutoProvisionedNetworkDeviceMonitors1789600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD "autoProvisionedNetworkDeviceId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD "monitorTemplateId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_monitor_auto_provisioned_device_template_unique" ON "Monitor" ("autoProvisionedNetworkDeviceId", "monitorTemplateId") WHERE "deletedAt" IS NULL AND "autoProvisionedNetworkDeviceId" IS NOT NULL AND "monitorTemplateId" IS NOT NULL`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_auto_import_rule_monitorTemplateId" ON "NetworkDeviceAutoImportRule" ("monitorTemplateId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD CONSTRAINT "FK_monitor_auto_provisioned_network_device" FOREIGN KEY ("autoProvisionedNetworkDeviceId") REFERENCES "NetworkDevice"("_id") ON DELETE RESTRICT ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD CONSTRAINT "FK_nd_auto_import_rule_monitorTemplateId" FOREIGN KEY ("monitorTemplateId") REFERENCES "MonitorTemplate"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" DROP CONSTRAINT "FK_nd_auto_import_rule_monitorTemplateId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP CONSTRAINT "FK_monitor_auto_provisioned_network_device"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_network_device_auto_import_rule_monitorTemplateId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_monitor_auto_provisioned_device_template_unique"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" DROP COLUMN "monitorTemplateId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP COLUMN "autoProvisionedNetworkDeviceId"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789700000000-AddNetworkScaleIndexes.ts

@@ -0,0 +1,129 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * What a network estate of eighty thousand devices and a thousand-odd sites
+ * needs from Postgres.
+ *
+ * Before this, the hottest queries in the network product were sequential
+ * scans of the whole NetworkDevice table — including the polling claim loop,
+ * which every probe runs on every cycle and which had no index on `probeId` at
+ * all, a foreign key creating none in Postgres.
+ *
+ * Measured on a seeded 80,000-device fleet, before → after:
+ *
+ *   device list, first page          14.4 ms → 0.10 ms
+ *   device list, Status facet        13.7 ms → 0.12 ms
+ *   probe claim (40,000 devices)      117 ms → 0.85 ms   (2,702 → 86 buffers)
+ */
+export class AddNetworkScaleIndexes1789700000000 implements MigrationInterface {
+  public name: string = "AddNetworkScaleIndexes1789700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * `nextPollAt` becomes NOT NULL, defaulting to now.
+     *
+     * NULL meant "poll as soon as possible", so the claim query had to read
+     * `(nextPollAt IS NULL OR nextPollAt <= now)` ordered `ASC NULLS FIRST`.
+     * A btree is ASC NULLS LAST, so that ordering could never be served by an
+     * index however the index was declared: every claim cycle sequentially
+     * scanned the probe's whole slice of the fleet and top-N sorted it, inside
+     * a transaction already holding FOR UPDATE row locks.
+     *
+     * `now()` says exactly what NULL said, in a value the index can order.
+     *
+     * The backfill runs first and must: SET NOT NULL rejects the statement
+     * outright if a single row still holds NULL. `createdAt` rather than
+     * `now()` for those rows, so a device that has been waiting to be polled
+     * since it was created keeps its place at the front of the queue instead
+     * of going to the back of it.
+     */
+    await queryRunner.query(
+      `UPDATE "NetworkDevice" SET "nextPollAt" = "createdAt" WHERE "nextPollAt" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ALTER COLUMN "nextPollAt" SET NOT NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ALTER COLUMN "nextPollAt" SET DEFAULT now()`,
+    );
+
+    /*
+     * Superseded by IDX_15660584d280ed474504cb4021, which has it as a prefix.
+     * Keeping both would cost every insert and update a second index write for
+     * nothing — and this is a table every SNMP poll updates.
+     */
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_878d6fc3878837bb01e09b2f3f"`,
+    );
+
+    // The device list's default page, and every fleet-wide count over it.
+    await queryRunner.query(
+      `CREATE INDEX "IDX_15660584d280ed474504cb4021" ON "NetworkDevice" ("projectId", "isArchived", "createdAt") `,
+    );
+    /*
+     * The Status facet and the summary strip's three counts, plus the
+     * Overview's "longest out of contact" list, which is what `lastSeenAt` is
+     * doing on the end.
+     */
+    await queryRunner.query(
+      `CREATE INDEX "IDX_87566f1ca6cc63ee3afd3aeaff" ON "NetworkDevice" ("projectId", "isArchived", "isReachable", "lastSeenAt") `,
+    );
+    // Every per-site rollup, the hierarchy drill-down, and the unassigned count.
+    await queryRunner.query(
+      `CREATE INDEX "IDX_42360e479fb36f6d34c0e3c485" ON "NetworkDevice" ("projectId", "siteId") `,
+    );
+    /*
+     * PARTIAL: dark ports are a small minority of a healthy fleet, so this
+     * stays tiny and an interface flap only touches it when the count crosses
+     * zero. A full index on a column every SNMP walk rewrites would be write
+     * amplification for the sake of one eight-row list.
+     */
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5767b485012a9b4b49d0f99b6a" ON "NetworkDevice" ("projectId", "interfacesDown") WHERE "interfacesDown" > 0 AND "isArchived" = false`,
+    );
+    // The polling claim loop. See the nextPollAt note above.
+    await queryRunner.query(
+      `CREATE INDEX "IDX_52f8f551a9796060489ebaf31c" ON "NetworkDevice" ("probeId", "nextPollAt") `,
+    );
+    // The Sites summary strip's grouped status count, and the unhealthy list.
+    await queryRunner.query(
+      `CREATE INDEX "IDX_387febc5598c05f9795463292c" ON "NetworkSite" ("projectId", "currentMonitorStatusId") `,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_387febc5598c05f9795463292c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_52f8f551a9796060489ebaf31c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5767b485012a9b4b49d0f99b6a"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_42360e479fb36f6d34c0e3c485"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_87566f1ca6cc63ee3afd3aeaff"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_15660584d280ed474504cb4021"`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_878d6fc3878837bb01e09b2f3f" ON "NetworkDevice" ("projectId", "isArchived") `,
+    );
+    /*
+     * The rows the backfill filled in are indistinguishable from real
+     * schedules, so `down` restores the shape of the column and not its
+     * former NULLs. Nothing reads NULL as anything but "due now", which is
+     * what those rows already say.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ALTER COLUMN "nextPollAt" DROP DEFAULT`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ALTER COLUMN "nextPollAt" DROP NOT NULL`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789800000000-WidenSecurityEventLastErrorColumns.ts

@@ -0,0 +1,54 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * lastError on both security-event connectors becomes unbounded text.
+ *
+ * Both columns were varchar(500), and both hold an error produced
+ * elsewhere: the Google SecOps client echoes up to 500 characters of the
+ * Chronicle response body behind a ~46 character prefix, and a ClickHouse
+ * error echoes the whole compiled query. Either overflows 500, and
+ * DatabaseService.checkMaxLengthOfFields turns that overflow into a
+ * BadDataException — thrown from inside the catch block that was trying to
+ * record the failure, which took the whole poll/evaluation tick down with
+ * it and left lastError and its lastPolledAt/lastEvaluatedAt stamp null.
+ *
+ * ALTER COLUMN ... TYPE rather than the DROP + ADD pair TypeORM generates
+ * for this change: varchar -> text is binary-coercible in Postgres, so
+ * this preserves whatever error is currently stored instead of discarding
+ * it on upgrade. Same end state, same shape as the MonitorSecret
+ * secretValue widening in 1720024126646.
+ */
+export class WidenSecurityEventLastErrorColumns1789800000000
+  implements MigrationInterface
+{
+  public name: string = "WidenSecurityEventLastErrorColumns1789800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ALTER COLUMN "lastError" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ALTER COLUMN "lastError" TYPE text`,
+    );
+  }
+
+  /*
+   * Reversing narrows the column, so anything already stored past 500
+   * characters has to go somewhere: truncate it rather than let the ALTER
+   * fail on existing rows.
+   */
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `UPDATE "GoogleSecOpsConnection" SET "lastError" = LEFT("lastError", 500) WHERE LENGTH("lastError") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ALTER COLUMN "lastError" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "DetectionRule" SET "lastError" = LEFT("lastError", 500) WHERE LENGTH("lastError") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ALTER COLUMN "lastError" TYPE character varying(500)`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789900000000-AddNetworkSiteRollupPolicyAndMaintenance.ts

@@ -0,0 +1,64 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Network site health rollup policy + scheduled maintenance (issue #3431).
+ *
+ * `healthRollupPolicy` defaults to WorstStatus and `offlineThresholdPercent`
+ * to 50, so every existing site keeps rolling up exactly as it did — the
+ * threshold column is inert until a site opts into the percentage policy.
+ *
+ * `ScheduledMaintenanceNetworkSite` is the join table that lets a
+ * maintenance window cover a site (and, by hierarchy, everything under it).
+ */
+
+export class AddNetworkSiteRollupPolicyAndMaintenance1789900000000
+  implements MigrationInterface
+{
+  public name: string = "AddNetworkSiteRollupPolicyAndMaintenance1789900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "ScheduledMaintenanceNetworkSite" ("scheduledMaintenanceId" uuid NOT NULL, "networkSiteId" uuid NOT NULL, CONSTRAINT "PK_a681f30c9cb03c3bfa93d6d5037" PRIMARY KEY ("scheduledMaintenanceId", "networkSiteId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_8b7cce916b128ceda5e9f8e273" ON "ScheduledMaintenanceNetworkSite" ("scheduledMaintenanceId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_872ce07950223aab717f5b063f" ON "ScheduledMaintenanceNetworkSite" ("networkSiteId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD "healthRollupPolicy" character varying(100) NOT NULL DEFAULT 'WorstStatus'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD "offlineThresholdPercent" integer NOT NULL DEFAULT '50'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ScheduledMaintenanceNetworkSite" ADD CONSTRAINT "FK_8b7cce916b128ceda5e9f8e273c" FOREIGN KEY ("scheduledMaintenanceId") REFERENCES "ScheduledMaintenance"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ScheduledMaintenanceNetworkSite" ADD CONSTRAINT "FK_872ce07950223aab717f5b063f1" FOREIGN KEY ("networkSiteId") REFERENCES "NetworkSite"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ScheduledMaintenanceNetworkSite" DROP CONSTRAINT "FK_872ce07950223aab717f5b063f1"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ScheduledMaintenanceNetworkSite" DROP CONSTRAINT "FK_8b7cce916b128ceda5e9f8e273c"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP COLUMN "offlineThresholdPercent"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP COLUMN "healthRollupPolicy"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_872ce07950223aab717f5b063f"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_8b7cce916b128ceda5e9f8e273"`,
+    );
+    await queryRunner.query(`DROP TABLE "ScheduledMaintenanceNetworkSite"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790000000000-AddTelemetrySourceMap.ts

@@ -0,0 +1,64 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Source map storage for unminifying browser exception stack traces
+ * (issue #3452). One row per uploaded map, keyed by
+ * (projectId, serviceId, serviceVersion, bundlePath); the composite index
+ * backs the resolver's lookup on every exception detail view.
+ */
+
+export class AddTelemetrySourceMap1790000000000 implements MigrationInterface {
+  public name: string = "AddTelemetrySourceMap1790000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "TelemetrySourceMap" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "serviceId" uuid NOT NULL, "serviceVersion" character varying(100) NOT NULL, "bundlePath" character varying(500) NOT NULL, "content" text NOT NULL, "sizeInBytes" integer, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_f60ecab6137171569d7da8005ac" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_e10130843e508e58d565f11d2f" ON "TelemetrySourceMap" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_fdbfe3dd16c9869e9b18d5ddf3" ON "TelemetrySourceMap" ("serviceId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_a91ae66cbfe28db9e34ccab75b" ON "TelemetrySourceMap" ("projectId", "serviceId", "serviceVersion") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetrySourceMap" ADD CONSTRAINT "FK_e10130843e508e58d565f11d2fc" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetrySourceMap" ADD CONSTRAINT "FK_fdbfe3dd16c9869e9b18d5ddf31" FOREIGN KEY ("serviceId") REFERENCES "Service"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetrySourceMap" ADD CONSTRAINT "FK_a1290792648323d6a34ef9df28c" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetrySourceMap" ADD CONSTRAINT "FK_33c4d65e39e1fbd5e98cf117a45" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetrySourceMap" DROP CONSTRAINT "FK_33c4d65e39e1fbd5e98cf117a45"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetrySourceMap" DROP CONSTRAINT "FK_a1290792648323d6a34ef9df28c"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetrySourceMap" DROP CONSTRAINT "FK_fdbfe3dd16c9869e9b18d5ddf31"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetrySourceMap" DROP CONSTRAINT "FK_e10130843e508e58d565f11d2fc"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_a91ae66cbfe28db9e34ccab75b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_fdbfe3dd16c9869e9b18d5ddf3"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_e10130843e508e58d565f11d2f"`,
+    );
+    await queryRunner.query(`DROP TABLE "TelemetrySourceMap"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790000000001-AddSnmpConfigsToNetworkDeviceDiscoveryScan.ts

@@ -0,0 +1,72 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddSnmpConfigsToNetworkDeviceDiscoveryScan1790000000001
+  implements MigrationInterface
+{
+  public name: string =
+    "AddSnmpConfigsToNetworkDeviceDiscoveryScan1790000000001";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * The ordered list of SNMP credential sets a discovery scan tries against
+     * every host, first match wins (OneUptime issue #3458).
+     */
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD "snmpConfigs" jsonb`,
+    );
+
+    /*
+     * Backfill every existing scan with the one credential set it already
+     * had, taken from the flattened columns beside this one.
+     *
+     * The READER does not need this — SnmpScanConfigUtil.resolve() synthesizes
+     * exactly this config whenever the column is NULL, which is why the
+     * flattened columns are kept rather than dropped. The EDIT FORM does. Its
+     * only SNMP control is the credential-list editor, so it selects
+     * `snmpConfigs` alone; a scan whose column were NULL would open with a
+     * blank card, and saving it would replace credentials the operator was
+     * never shown. Backfilling here, and deriving the same list on every
+     * create (NetworkDeviceDiscoveryScanService.onBeforeCreate), means the
+     * column is populated for every scan the product has ever made.
+     *
+     * `id` is the same literal the resolver uses for a synthesized legacy
+     * config, so a result stored against it before this migration still
+     * resolves afterwards. It only has to be unique WITHIN the row's list,
+     * which holds one entry.
+     *
+     * jsonb_strip_nulls drops the credentials this scan does not use, leaving
+     * the same object shape the application writes: a v2c scan carries no v3
+     * keys, a v3 scan no community string. snmpVersion is the one key
+     * defaulted rather than dropped, because it is what decides how the rest
+     * is read, and the column's own default is 'V2c'.
+     */
+    await queryRunner.query(
+      `UPDATE "NetworkDeviceDiscoveryScan" SET "snmpConfigs" = jsonb_build_array(jsonb_strip_nulls(jsonb_build_object(` +
+        `'id', 'legacy', ` +
+        `'snmpVersion', COALESCE("snmpVersion", 'V2c'), ` +
+        `'snmpCommunityString', "snmpCommunityString", ` +
+        `'snmpPort', "snmpPort", ` +
+        `'snmpV3SecurityLevel', "snmpV3SecurityLevel", ` +
+        `'snmpV3Username', "snmpV3Username", ` +
+        `'snmpV3AuthProtocol', "snmpV3AuthProtocol", ` +
+        `'snmpV3AuthKey', "snmpV3AuthKey", ` +
+        `'snmpV3PrivProtocol', "snmpV3PrivProtocol", ` +
+        `'snmpV3PrivKey', "snmpV3PrivKey"` +
+        `))) WHERE "snmpConfigs" IS NULL`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * The flattened columns were never stopped being written — the service
+     * mirrors the list's first entry onto them on every save — so dropping
+     * this column returns every scan to a working single-credential
+     * configuration rather than to no credentials. A scan that was using more
+     * than one credential set loses the extra ones, which is the unavoidable
+     * cost of going back to a schema that cannot hold them.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" DROP COLUMN "snmpConfigs"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790003445000-AddSnmpEnabledToNetworkDeviceDiscoveryScan.ts

@@ -0,0 +1,31 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Whether a discovery scan queries each live host over SNMP, or stops at the
+ * ping that found it (OneUptime issue #3445).
+ *
+ * NOT NULL DEFAULT true, so every scan that already exists is backfilled to
+ * the only value that describes the sweep it actually ran: before this column,
+ * every discovery scan was an SNMP scan. The default is what lets the reader
+ * (Common/Utils/NetworkDiscovery/ScanModeUtil) treat an absent value as "SNMP"
+ * as well — which is the case a new probe hits when it polls a server too old
+ * to send the column.
+ */
+export class AddSnmpEnabledToNetworkDeviceDiscoveryScan1790003445000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddSnmpEnabledToNetworkDeviceDiscoveryScan1790003445000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" ADD "isSnmpEnabled" boolean NOT NULL DEFAULT true`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceDiscoveryScan" DROP COLUMN "isSnmpEnabled"`,
+    );
+  }
+}