@oneuptime/common 12.0.25 → 12.0.26

package/Server/API/UserOnCallLogTimelineAPI.ts

@@ -22,6 +22,13 @@ import ObjectID from "../../Types/ObjectID";
 import UserNotificationStatus from "../../Types/UserNotification/UserNotificationStatus";
 import UserOnCallLogTimeline from "../../Models/DatabaseModels/UserOnCallLogTimeline";
 import Route from "../../Types/API/Route";
+import {
+  OnCallNotificationContext,
+  OnCallNotificationResourceReference,
+  detailsToJSON,
+  getOnCallNotificationContext,
+  getResourceReference,
+} from "../Utils/OnCallNotificationContext";
 
 export default class UserNotificationLogTimelineAPI extends BaseAPI<
   UserOnCallLogTimeline,
@@ -130,22 +137,26 @@ export default class UserNotificationLogTimelineAPI extends BaseAPI<
                 triggeredByIncidentId: true,
                 triggeredByIncident: {
                   title: true,
-                  description: true,
                 },
                 triggeredByAlertId: true,
                 triggeredByAlert: {
                   title: true,
-                  description: true,
                 },
                 triggeredByAlertEpisodeId: true,
                 triggeredByAlertEpisode: {
                   title: true,
-                  description: true,
                 },
                 triggeredByIncidentEpisodeId: true,
                 triggeredByIncidentEpisode: {
                   title: true,
-                  description: true,
+                },
+                /*
+                 * The timestamps below are rendered in the recipient's own
+                 * timezone. Formatting them in the container's zone would tell
+                 * an on-call engineer nothing.
+                 */
+                user: {
+                  timezone: true,
                 },
               },
               props: {
@@ -161,15 +172,28 @@ export default class UserNotificationLogTimelineAPI extends BaseAPI<
             );
           }
 
-          const notificationType: string = timelineItem.triggeredByIncidentId
-            ? "Incident"
-            : timelineItem.triggeredByIncidentEpisodeId
-              ? "Incident Episode"
-              : timelineItem.triggeredByAlertEpisodeId
-                ? "Alert Episode"
-                : "Alert";
+          const reference: OnCallNotificationResourceReference | null =
+            getResourceReference(timelineItem);
+
+          const notificationType: string = reference
+            ? reference.resourceType.toString()
+            : "Alert";
+
+          /*
+           * The context read is what puts severity, state, project, monitors
+           * and the time it was raised on the page. It is best effort on
+           * purpose: a deleted resource, or a resource this notification no
+           * longer points at, must still leave a page the engineer can
+           * acknowledge from.
+           */
+          const context: OnCallNotificationContext | null =
+            await getOnCallNotificationContext({
+              timelineItem: timelineItem,
+              timezone: timelineItem.user?.timezone?.toString(),
+            });
 
           const notificationTitle: string =
+            context?.resourceTitle ||
             timelineItem.triggeredByIncident?.title ||
             timelineItem.triggeredByIncidentEpisode?.title ||
             timelineItem.triggeredByAlertEpisode?.title ||
@@ -194,6 +218,10 @@ export default class UserNotificationLogTimelineAPI extends BaseAPI<
                   .addRoute(new UserOnCallLogTimeline().crudApiPath!)
                   .addRoute("/acknowledge/" + itemId.toString()),
               ).toString(),
+              resourceNumber: context?.resourceNumber || "",
+              resourceTitle: notificationTitle,
+              resourceDescription: context?.resourceDescription || "",
+              details: detailsToJSON(context?.details || []),
             },
           );
         } catch (error) {
@@ -245,6 +273,9 @@ export default class UserNotificationLogTimelineAPI extends BaseAPI<
                 },
                 acknowledgedAt: true,
                 isAcknowledged: true,
+                user: {
+                  timezone: true,
+                },
               },
               props: {
                 isRoot: true,
@@ -262,59 +293,38 @@ export default class UserNotificationLogTimelineAPI extends BaseAPI<
           const host: Hostname = await DatabaseConfig.getHost();
           const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
 
-          // Determine the resource type and ID for routing
-          type ResourceInfo = {
-            type: string;
-            path: string;
-            id: ObjectID;
-            title: string;
-          };
-
-          const getResourceInfo: () => ResourceInfo = (): ResourceInfo => {
-            if (timelineItem.triggeredByIncidentId) {
-              return {
-                type: "Incident",
-                path: "incidents",
-                id: timelineItem.triggeredByIncidentId,
-                title: timelineItem.triggeredByIncident?.title || "",
-              };
-            }
-            if (timelineItem.triggeredByIncidentEpisodeId) {
-              return {
-                type: "Incident Episode",
-                path: "incidents/episodes",
-                id: timelineItem.triggeredByIncidentEpisodeId,
-                title: timelineItem.triggeredByIncidentEpisode?.title || "",
-              };
-            }
-            if (timelineItem.triggeredByAlertEpisodeId) {
-              return {
-                type: "Alert Episode",
-                path: "alerts/episodes",
-                id: timelineItem.triggeredByAlertEpisodeId,
-                title: timelineItem.triggeredByAlertEpisode?.title || "",
-              };
-            }
-            if (timelineItem.triggeredByAlertId) {
-              return {
-                type: "Alert",
-                path: "alerts",
-                id: timelineItem.triggeredByAlertId,
-                title: timelineItem.triggeredByAlert?.title || "",
-              };
-            }
-            return { type: "", path: "", id: new ObjectID(""), title: "" };
-          };
-
-          const resourceInfo: ResourceInfo = getResourceInfo();
+          // Determine the resource type and ID for routing.
+          const reference: OnCallNotificationResourceReference | null =
+            getResourceReference(timelineItem);
+
+          const fallbackTitle: string =
+            timelineItem.triggeredByIncident?.title ||
+            timelineItem.triggeredByIncidentEpisode?.title ||
+            timelineItem.triggeredByAlertEpisode?.title ||
+            timelineItem.triggeredByAlert?.title ||
+            "";
 
           if (timelineItem.isAcknowledged) {
             // already acknowledged. Then show already acknowledged page with view details button.
 
+            /*
+             * Same context the acknowledge page shows. Someone who follows the
+             * link twice - or whose colleague got there first - still needs to
+             * know what the page they are looking at is about.
+             */
+            const context: OnCallNotificationContext | null =
+              await getOnCallNotificationContext({
+                timelineItem: timelineItem,
+                timezone: timelineItem.user?.timezone?.toString(),
+              });
+
+            const acknowledgedTitle: string =
+              context?.resourceTitle || fallbackTitle;
+
             const viewDetailsRoute: Route = new Route(
               DashboardRoute.toString(),
             ).addRoute(
-              `/${timelineItem.projectId?.toString()}/${resourceInfo.path}/${resourceInfo.id.toString()}`,
+              `/${timelineItem.projectId?.toString()}/${reference?.dashboardPath || ""}/${reference?.resourceId.toString() || ""}`,
             );
 
             const viewDetailsUrl: URL = new URL(
@@ -328,10 +338,14 @@ export default class UserNotificationLogTimelineAPI extends BaseAPI<
               res,
               "/usr/src/Common/Server/Views/ViewMessage.ejs",
               {
-                title: `Notification Already Acknowledged - ${resourceInfo.title}`,
+                title: `Notification Already Acknowledged - ${acknowledgedTitle}`,
                 message: `This notification has already been acknowledged.`,
-                viewDetailsText: `View ${resourceInfo.type}`,
+                viewDetailsText: `View ${reference?.resourceType.toString() || ""}`,
                 viewDetailsUrl: viewDetailsUrl.toString(),
+                resourceNumber: context?.resourceNumber || "",
+                resourceTitle: acknowledgedTitle,
+                resourceDescription: context?.resourceDescription || "",
+                details: detailsToJSON(context?.details || []),
               },
             );
           }
@@ -350,11 +364,11 @@ export default class UserNotificationLogTimelineAPI extends BaseAPI<
           });
 
           // redirect to dashboard to the resource page.
-          if (resourceInfo.path) {
+          if (reference) {
             const resourceRoute: Route = new Route(
               DashboardRoute.toString(),
             ).addRoute(
-              `/${timelineItem.projectId?.toString()}/${resourceInfo.path}/${resourceInfo.id.toString()}`,
+              `/${timelineItem.projectId?.toString()}/${reference.dashboardPath}/${reference.resourceId.toString()}`,
             );
 
             return Response.redirect(

package/Server/API/UserTotpAuthAPI.ts

@@ -13,9 +13,13 @@ import BaseAPI from "./BaseAPI";
 import UserTotpAuth from "../../Models/DatabaseModels/UserTotpAuth";
 import BadDataException from "../../Types/Exception/BadDataException";
 import TotpAuth from "../Utils/TotpAuth";
+import TwoFactorBackupCode from "../Utils/TwoFactorBackupCode";
 import Response from "../Utils/Response";
 import User from "../../Models/DatabaseModels/User";
 import UserService from "../Services/UserService";
+import UserTwoFactorBackupCodeService from "../Services/UserTwoFactorBackupCodeService";
+import logger from "../Utils/Logger";
+import TwoFactorBackupCodeNotification from "../Utils/TwoFactorBackupCodeNotification";
 
 export default class UserTotpAuthAPI extends BaseAPI<
   UserTotpAuth,
@@ -97,7 +101,69 @@ export default class UserTotpAuthAPI extends BaseAPI<
             },
           });
 
-          return Response.sendEmptySuccessResponse(req, res);
+          /*
+           * The account now has a second factor, which means it now has
+           * something to lose. Mint the recovery codes here rather than
+           * leaving them to a button the user has to go and find: a set that
+           * is never generated is the same as no recovery route at all, which
+           * is the state this endpoint used to leave every account in.
+           *
+           * `generateForUserIfNone` and not a regeneration -- adding a SECOND
+           * authenticator app must not void the codes the user printed when
+           * they added the first. It returns null in that case and the
+           * response simply carries no codes.
+           *
+           * THE RESPONSE IS THE ONLY COPY. Only keyed digests are stored, so
+           * whatever is returned here is the one and only time these strings
+           * exist; the profile page is expected to raise the same
+           * acknowledge-before-closing modal it raises for a manual
+           * regeneration. That is also why nothing is minted anywhere the user
+           * is not looking at a screen that can show it.
+           *
+           * A failure to mint must not fail the validation. The factor IS
+           * verified by this point -- the row is written -- so throwing here
+           * would tell the user their authenticator did not work when it did,
+           * and send them round the enrolment loop again. The profile card
+           * already warns an account holding no codes, so the fallback is a
+           * state the product knows how to talk about.
+           */
+          let backupCodes: Array<string> | null = null;
+
+          try {
+            backupCodes =
+              await UserTwoFactorBackupCodeService.generateForUserIfNone({
+                userId: userTotpAuth.userId!,
+              });
+          } catch (backupCodeError) {
+            logger.error(backupCodeError);
+          }
+
+          /*
+           * Tell the account holder, at their address rather than in this
+           * browser. Ten sign-in credentials have just come into existence on
+           * this account, and this route is authenticated by a session alone
+           * -- so a stolen session is enough to create them. The mail does not
+           * prevent that; it makes it visible to the person it was done to.
+           */
+          if (backupCodes && backupCodes.length > 0) {
+            TwoFactorBackupCodeNotification.notifyCodesCreated({
+              userId: userTotpAuth.userId!,
+              codeCount: backupCodes.length,
+            });
+          }
+
+          return Response.sendJsonObjectResponse(req, res, {
+            /*
+             * Hyphenated for the page to render as-is, exactly as the
+             * regenerate route does. The verify route normalizes whatever
+             * comes back.
+             */
+            backupCodes: backupCodes
+              ? backupCodes.map((code: string) => {
+                  return TwoFactorBackupCode.formatForDisplay(code);
+                })
+              : [],
+          });
         } catch (err) {
           next(err);
         }

package/Server/API/UserWebAuthnAPI.ts

@@ -16,6 +16,10 @@ import Response from "../Utils/Response";
 import { JSONObject } from "../../Types/JSON";
 import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import UserTwoFactorBackupCodeService from "../Services/UserTwoFactorBackupCodeService";
+import TwoFactorBackupCode from "../Utils/TwoFactorBackupCode";
+import logger from "../Utils/Logger";
+import TwoFactorBackupCodeNotification from "../Utils/TwoFactorBackupCodeNotification";
 
 export default class UserWebAuthnAPI extends BaseAPI<
   UserWebAuthn,
@@ -63,7 +67,46 @@ export default class UserWebAuthnAPI extends BaseAPI<
             props: databaseProps,
           });
 
-          return Response.sendEmptySuccessResponse(req, res);
+          /*
+           * A security key is a second factor that can be left in a taxi, so
+           * registering one is a moment that needs a recovery route behind it.
+           * Minted here for the same reason -- and with the same
+           * only-if-there-are-none rule -- as on the TOTP validate route; see
+           * the note there. A key added ALONGSIDE an authenticator app finds
+           * codes already present and changes nothing.
+           *
+           * Never fatal to the registration: the credential is already saved
+           * at this point, so an error here would report a failure for work
+           * that succeeded.
+           */
+          let backupCodes: Array<string> | null = null;
+
+          if (databaseProps.userId) {
+            try {
+              backupCodes =
+                await UserTwoFactorBackupCodeService.generateForUserIfNone({
+                  userId: databaseProps.userId,
+                });
+            } catch (backupCodeError) {
+              logger.error(backupCodeError);
+            }
+          }
+
+          /* See the note on the TOTP validate route. */
+          if (backupCodes && backupCodes.length > 0 && databaseProps.userId) {
+            TwoFactorBackupCodeNotification.notifyCodesCreated({
+              userId: databaseProps.userId,
+              codeCount: backupCodes.length,
+            });
+          }
+
+          return Response.sendJsonObjectResponse(req, res, {
+            backupCodes: backupCodes
+              ? backupCodes.map((code: string) => {
+                  return TwoFactorBackupCode.formatForDisplay(code);
+                })
+              : [],
+          });
         } catch (err) {
           next(err);
         }

package/Server/Infrastructure/Postgres/SchemaMigrations/1787923136162-MigrationName.ts

@@ -0,0 +1,57 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1787923136162 implements MigrationInterface {
+  public name = "MigrationName1787923136162";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "ThreatIntelFeed" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(50) NOT NULL, "description" character varying(500), "apiRootUrl" character varying(500) NOT NULL, "collectionId" character varying(100) NOT NULL, "apiToken" text, "basicAuthUsername" character varying(100), "basicAuthPassword" text, "isEnabled" boolean NOT NULL DEFAULT true, "pollIntervalInMinutes" integer NOT NULL DEFAULT '60', "minimumConfidence" integer NOT NULL DEFAULT '0', "shouldCreateAlert" boolean NOT NULL DEFAULT true, "shouldWriteDetectionFinding" boolean NOT NULL DEFAULT true, "shouldCreateIncident" boolean NOT NULL DEFAULT false, "alertSeverityId" uuid, "incidentSeverityId" uuid, "lastPolledAt" TIMESTAMP WITH TIME ZONE, "cursor" character varying(500), "nextPageToken" text, "lastPollSummary" character varying(500), "lastError" text, "lastEvaluatedAt" TIMESTAMP WITH TIME ZONE, "lastMatchAt" TIMESTAMP WITH TIME ZONE, "lastMatchError" text, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_f439b1608d006621778c77a13de" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5cb2e4e831d2e3b78a636e8aa3" ON "ThreatIntelFeed" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_1a73c0779724e007780632b751" ON "ThreatIntelFeed" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_5cb2e4e831d2e3b78a636e8aa3c" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_2ffbb2319e575d9707009ef9621" FOREIGN KEY ("alertSeverityId") REFERENCES "AlertSeverity"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_3fa2aadff928287f194db3bdbdd" FOREIGN KEY ("incidentSeverityId") REFERENCES "IncidentSeverity"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_faced98393bfb0882cd8929ac8a" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" ADD CONSTRAINT "FK_fa32bd7c42ea2b291e649940c7f" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_fa32bd7c42ea2b291e649940c7f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_faced98393bfb0882cd8929ac8a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_3fa2aadff928287f194db3bdbdd"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_2ffbb2319e575d9707009ef9621"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ThreatIntelFeed" DROP CONSTRAINT "FK_5cb2e4e831d2e3b78a636e8aa3c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_1a73c0779724e007780632b751"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5cb2e4e831d2e3b78a636e8aa3"`,
+    );
+    await queryRunner.query(`DROP TABLE "ThreatIntelFeed"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789600000000-AddAutoProvisionedNetworkDeviceMonitors.ts

@@ -0,0 +1,49 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddAutoProvisionedNetworkDeviceMonitors1789600000000
+  implements MigrationInterface
+{
+  public name: string = "AddAutoProvisionedNetworkDeviceMonitors1789600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD "autoProvisionedNetworkDeviceId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD "monitorTemplateId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_monitor_auto_provisioned_device_template_unique" ON "Monitor" ("autoProvisionedNetworkDeviceId", "monitorTemplateId") WHERE "deletedAt" IS NULL AND "autoProvisionedNetworkDeviceId" IS NOT NULL AND "monitorTemplateId" IS NOT NULL`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_network_device_auto_import_rule_monitorTemplateId" ON "NetworkDeviceAutoImportRule" ("monitorTemplateId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD CONSTRAINT "FK_monitor_auto_provisioned_network_device" FOREIGN KEY ("autoProvisionedNetworkDeviceId") REFERENCES "NetworkDevice"("_id") ON DELETE RESTRICT ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD CONSTRAINT "FK_nd_auto_import_rule_monitorTemplateId" FOREIGN KEY ("monitorTemplateId") REFERENCES "MonitorTemplate"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" DROP CONSTRAINT "FK_nd_auto_import_rule_monitorTemplateId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP CONSTRAINT "FK_monitor_auto_provisioned_network_device"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_network_device_auto_import_rule_monitorTemplateId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_monitor_auto_provisioned_device_template_unique"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" DROP COLUMN "monitorTemplateId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP COLUMN "autoProvisionedNetworkDeviceId"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789700000000-AddNetworkScaleIndexes.ts

@@ -0,0 +1,129 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * What a network estate of eighty thousand devices and a thousand-odd sites
+ * needs from Postgres.
+ *
+ * Before this, the hottest queries in the network product were sequential
+ * scans of the whole NetworkDevice table — including the polling claim loop,
+ * which every probe runs on every cycle and which had no index on `probeId` at
+ * all, a foreign key creating none in Postgres.
+ *
+ * Measured on a seeded 80,000-device fleet, before → after:
+ *
+ *   device list, first page          14.4 ms → 0.10 ms
+ *   device list, Status facet        13.7 ms → 0.12 ms
+ *   probe claim (40,000 devices)      117 ms → 0.85 ms   (2,702 → 86 buffers)
+ */
+export class AddNetworkScaleIndexes1789700000000 implements MigrationInterface {
+  public name: string = "AddNetworkScaleIndexes1789700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * `nextPollAt` becomes NOT NULL, defaulting to now.
+     *
+     * NULL meant "poll as soon as possible", so the claim query had to read
+     * `(nextPollAt IS NULL OR nextPollAt <= now)` ordered `ASC NULLS FIRST`.
+     * A btree is ASC NULLS LAST, so that ordering could never be served by an
+     * index however the index was declared: every claim cycle sequentially
+     * scanned the probe's whole slice of the fleet and top-N sorted it, inside
+     * a transaction already holding FOR UPDATE row locks.
+     *
+     * `now()` says exactly what NULL said, in a value the index can order.
+     *
+     * The backfill runs first and must: SET NOT NULL rejects the statement
+     * outright if a single row still holds NULL. `createdAt` rather than
+     * `now()` for those rows, so a device that has been waiting to be polled
+     * since it was created keeps its place at the front of the queue instead
+     * of going to the back of it.
+     */
+    await queryRunner.query(
+      `UPDATE "NetworkDevice" SET "nextPollAt" = "createdAt" WHERE "nextPollAt" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ALTER COLUMN "nextPollAt" SET NOT NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ALTER COLUMN "nextPollAt" SET DEFAULT now()`,
+    );
+
+    /*
+     * Superseded by IDX_15660584d280ed474504cb4021, which has it as a prefix.
+     * Keeping both would cost every insert and update a second index write for
+     * nothing — and this is a table every SNMP poll updates.
+     */
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_878d6fc3878837bb01e09b2f3f"`,
+    );
+
+    // The device list's default page, and every fleet-wide count over it.
+    await queryRunner.query(
+      `CREATE INDEX "IDX_15660584d280ed474504cb4021" ON "NetworkDevice" ("projectId", "isArchived", "createdAt") `,
+    );
+    /*
+     * The Status facet and the summary strip's three counts, plus the
+     * Overview's "longest out of contact" list, which is what `lastSeenAt` is
+     * doing on the end.
+     */
+    await queryRunner.query(
+      `CREATE INDEX "IDX_87566f1ca6cc63ee3afd3aeaff" ON "NetworkDevice" ("projectId", "isArchived", "isReachable", "lastSeenAt") `,
+    );
+    // Every per-site rollup, the hierarchy drill-down, and the unassigned count.
+    await queryRunner.query(
+      `CREATE INDEX "IDX_42360e479fb36f6d34c0e3c485" ON "NetworkDevice" ("projectId", "siteId") `,
+    );
+    /*
+     * PARTIAL: dark ports are a small minority of a healthy fleet, so this
+     * stays tiny and an interface flap only touches it when the count crosses
+     * zero. A full index on a column every SNMP walk rewrites would be write
+     * amplification for the sake of one eight-row list.
+     */
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5767b485012a9b4b49d0f99b6a" ON "NetworkDevice" ("projectId", "interfacesDown") WHERE "interfacesDown" > 0 AND "isArchived" = false`,
+    );
+    // The polling claim loop. See the nextPollAt note above.
+    await queryRunner.query(
+      `CREATE INDEX "IDX_52f8f551a9796060489ebaf31c" ON "NetworkDevice" ("probeId", "nextPollAt") `,
+    );
+    // The Sites summary strip's grouped status count, and the unhealthy list.
+    await queryRunner.query(
+      `CREATE INDEX "IDX_387febc5598c05f9795463292c" ON "NetworkSite" ("projectId", "currentMonitorStatusId") `,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_387febc5598c05f9795463292c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_52f8f551a9796060489ebaf31c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5767b485012a9b4b49d0f99b6a"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_42360e479fb36f6d34c0e3c485"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_87566f1ca6cc63ee3afd3aeaff"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_15660584d280ed474504cb4021"`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_878d6fc3878837bb01e09b2f3f" ON "NetworkDevice" ("projectId", "isArchived") `,
+    );
+    /*
+     * The rows the backfill filled in are indistinguishable from real
+     * schedules, so `down` restores the shape of the column and not its
+     * former NULLs. Nothing reads NULL as anything but "due now", which is
+     * what those rows already say.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ALTER COLUMN "nextPollAt" DROP DEFAULT`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ALTER COLUMN "nextPollAt" DROP NOT NULL`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1789800000000-WidenSecurityEventLastErrorColumns.ts

@@ -0,0 +1,54 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * lastError on both security-event connectors becomes unbounded text.
+ *
+ * Both columns were varchar(500), and both hold an error produced
+ * elsewhere: the Google SecOps client echoes up to 500 characters of the
+ * Chronicle response body behind a ~46 character prefix, and a ClickHouse
+ * error echoes the whole compiled query. Either overflows 500, and
+ * DatabaseService.checkMaxLengthOfFields turns that overflow into a
+ * BadDataException — thrown from inside the catch block that was trying to
+ * record the failure, which took the whole poll/evaluation tick down with
+ * it and left lastError and its lastPolledAt/lastEvaluatedAt stamp null.
+ *
+ * ALTER COLUMN ... TYPE rather than the DROP + ADD pair TypeORM generates
+ * for this change: varchar -> text is binary-coercible in Postgres, so
+ * this preserves whatever error is currently stored instead of discarding
+ * it on upgrade. Same end state, same shape as the MonitorSecret
+ * secretValue widening in 1720024126646.
+ */
+export class WidenSecurityEventLastErrorColumns1789800000000
+  implements MigrationInterface
+{
+  public name: string = "WidenSecurityEventLastErrorColumns1789800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ALTER COLUMN "lastError" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ALTER COLUMN "lastError" TYPE text`,
+    );
+  }
+
+  /*
+   * Reversing narrows the column, so anything already stored past 500
+   * characters has to go somewhere: truncate it rather than let the ALTER
+   * fail on existing rows.
+   */
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `UPDATE "GoogleSecOpsConnection" SET "lastError" = LEFT("lastError", 500) WHERE LENGTH("lastError") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ALTER COLUMN "lastError" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "DetectionRule" SET "lastError" = LEFT("lastError", 500) WHERE LENGTH("lastError") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ALTER COLUMN "lastError" TYPE character varying(500)`,
+    );
+  }
+}