@oneuptime/common 12.0.29 → 12.0.31

package/Server/Services/IncidentPrivacyRuleEngineService.ts

@@ -11,6 +11,8 @@ import { IncidentFeedEventType } from "../../Models/DatabaseModels/IncidentFeed"
 import { Red500 } from "../../Types/BrandColors";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class IncidentPrivacyRuleEngineServiceClass {
   /**
@@ -52,10 +54,16 @@ class IncidentPrivacyRuleEngineServiceClass {
             monitorNamePattern: true,
             monitorDescriptionPattern: true,
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "IncidentPrivacyRule",
+        projectId: incident.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return false;
       }

package/Server/Services/IncidentReminderRuleService.ts

@@ -15,6 +15,8 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -193,13 +195,19 @@ export class Service extends DatabaseService<Model> {
           _id: true,
         },
       },
-      limit: 100,
+      limit: MAX_RULES_EVALUATED_PER_PROJECT,
       skip: 0,
       props: {
         isRoot: true,
       },
     });
 
+    logIfRuleReadWasTruncated({
+      ruleKind: "IncidentReminderRule",
+      projectId: data.projectId,
+      rulesRead: rules.length,
+    });
+
     for (const rule of rules) {
       if (rule.incidentSeverities && rule.incidentSeverities.length > 0) {
         if (!data.incidentSeverityId) {

package/Server/Services/IncidentSlaRuleService.ts

@@ -13,6 +13,8 @@ import logger, { LogAttributes } from "../Utils/Logger";
 import { IsBillingEnabled } from "../EnvironmentConfig";
 import MonitorService from "./MonitorService";
 import IncidentService from "./IncidentService";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -132,13 +134,19 @@ export class Service extends DatabaseService<Model> {
         incidentTitlePattern: true,
         incidentDescriptionPattern: true,
       },
-      limit: 100,
+      limit: MAX_RULES_EVALUATED_PER_PROJECT,
       skip: 0,
       props: {
         isRoot: true,
       },
     });
 
+    logIfRuleReadWasTruncated({
+      ruleKind: "IncidentSlaRule",
+      projectId: data.projectId,
+      rulesRead: rules.length,
+    });
+
     if (rules.length === 0) {
       logger.debug(`No enabled SLA rules found for project ${data.projectId}`, {
         projectId: data.projectId?.toString(),

package/Server/Services/IncomingCallPolicyLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import IncomingCallPolicyService from "./IncomingCallPolicyService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class IncomingCallPolicyLabelRuleEngineServiceClass {
   @CaptureSpan()
@@ -32,10 +34,16 @@ class IncomingCallPolicyLabelRuleEngineServiceClass {
             incomingCallPolicyDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "IncomingCallPolicyLabelRule",
+        projectId: policy.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/IncomingCallPolicyOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import IncomingCallPolicyService from "./IncomingCallPolicyService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class IncomingCallPolicyOwnerRuleEngineServiceClass {
   @CaptureSpan()
@@ -38,10 +40,16 @@ class IncomingCallPolicyOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "IncomingCallPolicyOwnerRule",
+        projectId: policy.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/Index.ts

@@ -61,6 +61,7 @@ import NetworkDeviceOwnerUserService from "./NetworkDeviceOwnerUserService";
 import NetworkDeviceOwnerRuleService from "./NetworkDeviceOwnerRuleService";
 import NetworkDeviceLabelRuleService from "./NetworkDeviceLabelRuleService";
 import NetworkDeviceAutoImportRuleService from "./NetworkDeviceAutoImportRuleService";
+import NetworkDeviceOidTemplateService from "./NetworkDeviceOidTemplateService";
 import NetworkDeviceDiscoveryScanService from "./NetworkDeviceDiscoveryScanService";
 import NetworkInterfaceService from "./NetworkInterfaceService";
 import NetworkSiteService from "./NetworkSiteService";
@@ -166,6 +167,12 @@ import OnCallDutyPolicyScheduleOwnerTeamService from "./OnCallDutyPolicySchedule
 import OnCallDutyPolicyScheduleLabelRuleService from "./OnCallDutyPolicyScheduleLabelRuleService";
 import OnCallDutyPolicyScheduleLayerUserService from "./OnCallDutyPolicyScheduleLayerUserService";
 import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
+// On-call calendar feeds and shift reminders
+import UserOnCallCalendarFeedService from "./UserOnCallCalendarFeedService";
+import OnCallDutyPolicyScheduleCalendarFeedService from "./OnCallDutyPolicyScheduleCalendarFeedService";
+import ProjectOnCallCalendarFeedService from "./ProjectOnCallCalendarFeedService";
+import UserOnCallShiftReminderService from "./UserOnCallShiftReminderService";
+import UserOnCallShiftReminderLogService from "./UserOnCallShiftReminderLogService";
 // On-Call Duty
 import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import ProbeService from "./ProbeService";
@@ -500,6 +507,7 @@ const services: Array<BaseService> = [
   NetworkDeviceOwnerRuleService,
   NetworkDeviceLabelRuleService,
   NetworkDeviceAutoImportRuleService,
+  NetworkDeviceOidTemplateService,
   NetworkDeviceDiscoveryScanService,
   NetworkInterfaceService,
   NetworkSiteService,
@@ -688,6 +696,12 @@ const services: Array<BaseService> = [
   OnCallDutyPolicyScheduleOwnerTeamService,
   OnCallDutyPolicyScheduleLabelRuleService,
   OnCallDutyPolicyScheduleLayerUserService,
+  // On-call calendar feeds and shift reminders
+  UserOnCallCalendarFeedService,
+  OnCallDutyPolicyScheduleCalendarFeedService,
+  ProjectOnCallCalendarFeedService,
+  UserOnCallShiftReminderService,
+  UserOnCallShiftReminderLogService,
   OnCallDutyPolicyScheduleLayerService,
   OnCallDutyPolicyEscalationRuleScheduleService,
 

package/Server/Services/IoTFleetLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import IoTFleetService from "./IoTFleetService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class IoTFleetLabelRuleEngineServiceClass {
   /**
@@ -35,10 +37,16 @@ class IoTFleetLabelRuleEngineServiceClass {
             iotFleetDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "IoTFleetLabelRule",
+        projectId: iotFleet.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/IoTFleetOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import IoTFleetService from "./IoTFleetService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class IoTFleetOwnerRuleEngineServiceClass {
   /**
@@ -42,10 +44,16 @@ class IoTFleetOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "IoTFleetOwnerRule",
+        projectId: iotFleet.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/KubernetesClusterLabelRuleEngineService.ts

@@ -9,6 +9,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class KubernetesClusterLabelRuleEngineServiceClass {
   /**
@@ -40,10 +42,16 @@ class KubernetesClusterLabelRuleEngineServiceClass {
             kubernetesClusterDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "KubernetesClusterLabelRule",
+        projectId: kubernetesCluster.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/KubernetesClusterOwnerRuleEngineService.ts

@@ -13,6 +13,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class KubernetesClusterOwnerRuleEngineServiceClass {
   /**
@@ -47,10 +49,16 @@ class KubernetesClusterOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "KubernetesClusterOwnerRule",
+        projectId: kubernetesCluster.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/KubernetesResourceService.ts

@@ -946,7 +946,11 @@ export class Service extends DatabaseService<Model> {
 
   /**
    * Helper for the cleanup worker: snapshot-interval aware cutoff.
-   * 3× the 5-minute snapshot interval. Tune via CLEANUP_THRESHOLD_MINUTES.
+   * 3× the 5-minute snapshot interval by default. Tune via
+   * K8S_INVENTORY_STALE_MINUTES — a value below 5 is ignored and the
+   * 15-minute default applies, so it is not clamped to the floor. Keep the
+   * threshold above the agent's resourceSpecs interval: CleanupStaleResources
+   * hard-deletes inventory rows whose lastSeenAt is older than this cutoff.
    */
   public getStaleThresholdDate(nowOverride?: Date): Date {
     const minutes: number = this.getStaleThresholdMinutes();

package/Server/Services/MonitorLabelRuleEngineService.ts

@@ -12,6 +12,8 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class MonitorLabelRuleEngineServiceClass {
   /**
@@ -41,10 +43,16 @@ class MonitorLabelRuleEngineServiceClass {
             monitorDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "MonitorLabelRule",
+        projectId: monitor.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/MonitorOwnerRuleEngineService.ts

@@ -15,6 +15,8 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class MonitorOwnerRuleEngineServiceClass {
   /**
@@ -46,10 +48,16 @@ class MonitorOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "MonitorOwnerRule",
+        projectId: monitor.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/NetworkDeviceAutoImportRuleEngineService.ts

@@ -399,6 +399,7 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
           sysObjectIdPattern: true,
           includePingOnlyHosts: true,
           monitorTemplateId: true,
+          oidTemplateId: true,
         },
         props: { isRoot: true },
       });
@@ -695,6 +696,7 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
             sysObjectIdPattern: true,
             includePingOnlyHosts: true,
             monitorTemplateId: true,
+            oidTemplateId: true,
           },
           sort: {
             createdAt: SortOrder.Ascending,
@@ -1119,6 +1121,31 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
         ),
       );
 
+      /*
+       * The OID Collection Template the imported device is LINKED to.
+       *
+       * A device carries at most one, so unlike the monitor templates above
+       * this is not a set: the first matching rule that names one wins, and
+       * rules are already in a deterministic order. Linking here is what
+       * makes the template a device TYPE rather than a shortcut - without it
+       * every scan would import devices that somebody has to go back and
+       * bulk-assign by hand, which is the chore issue #3507 is about.
+       */
+      const oidTemplateIdForHost: ObjectID | undefined = (():
+        | ObjectID
+        | undefined => {
+        for (const matchedRule of evaluation.matchedRules) {
+          const candidateId: string =
+            matchedRule.oidTemplateId?.toString() || "";
+
+          if (candidateId) {
+            return new ObjectID(candidateId);
+          }
+        }
+
+        return undefined;
+      })();
+
       let networkDevice: NetworkDevice | undefined = data.existingDevices.get(
         host.ipAddress,
       );
@@ -1168,6 +1195,9 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
             host: host,
             scan: scan,
             autoApplyVendorHealthTemplate: true,
+            ...(oidTemplateIdForHost
+              ? { oidTemplateId: oidTemplateIdForHost }
+              : {}),
           });
           networkDevice.id = ObjectID.generate();
           data.existingDevices.set(host.ipAddress, networkDevice);
@@ -1182,6 +1212,9 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
             existingDevices: data.existingDevices,
             result: result,
             attempts: data.attempts,
+            ...(oidTemplateIdForHost
+              ? { oidTemplateId: oidTemplateIdForHost }
+              : {}),
           });
 
           networkDevice = createResult.device || undefined;
@@ -1447,6 +1480,7 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
    * and one retry under the address-suffixed fallback name settles it.
    */
   private async createDeviceForHost(data: {
+    oidTemplateId?: ObjectID | undefined;
     projectId: ObjectID;
     scan: NetworkDeviceDiscoveryScan;
     host: DiscoveredNetworkDevice;
@@ -1471,6 +1505,7 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
          * OIDs instead (NetworkInventoryUtil).
          */
         autoApplyVendorHealthTemplate: true,
+        ...(data.oidTemplateId ? { oidTemplateId: data.oidTemplateId } : {}),
       });
 
       const created: NetworkDevice = await NetworkDeviceService.create({

package/Server/Services/NetworkDeviceAutoImportRuleService.ts

@@ -1,8 +1,10 @@
 import DatabaseService from "./DatabaseService";
 import MonitorTemplateService from "./MonitorTemplateService";
+import NetworkDeviceOidTemplateService from "./NetworkDeviceOidTemplateService";
 import Model from "../../Models/DatabaseModels/NetworkDeviceAutoImportRule";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import MonitorTemplate from "../../Models/DatabaseModels/MonitorTemplate";
+import NetworkDeviceOidTemplate from "../../Models/DatabaseModels/NetworkDeviceOidTemplate";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
@@ -46,6 +48,16 @@ function readMonitorTemplateId(data: Record<string, unknown>): ObjectID | null {
   );
 }
 
+const OID_TEMPLATE_KEYS: Array<string> = ["oidTemplateId", "oidTemplate"];
+
+function readOidTemplateId(data: Record<string, unknown>): ObjectID | null {
+  return RelationIdUtil.readConsistent(
+    data,
+    OID_TEMPLATE_KEYS,
+    "OID Collection Template",
+  );
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -76,6 +88,18 @@ export class Service extends DatabaseService<Model> {
       });
     }
 
+    const oidTemplateId: ObjectID | null = readOidTemplateId(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (oidTemplateId) {
+      await this.validateOidTemplateSelection({
+        oidTemplateId: oidTemplateId,
+        projectId: createBy.props.tenantId || createBy.data.projectId,
+        props: createBy.props,
+      });
+    }
+
     return { createBy, carryForward: null };
   }
 
@@ -97,6 +121,31 @@ export class Service extends DatabaseService<Model> {
       dataKeys.includes("includePingOnlyHosts") ||
       dataKeys.includes("isEnabled");
 
+    const isOidTemplateChange: boolean = RelationIdUtil.isWritten(
+      dataKeys,
+      OID_TEMPLATE_KEYS,
+    );
+
+    /*
+     * Validated before the early return and independently of the rest: an OID
+     * Collection Template is the collect half of the rule, so pointing at one
+     * is legitimate on its own and must not need a criteria or monitor change
+     * to be checked.
+     */
+    if (isOidTemplateChange) {
+      const writtenOidTemplateId: ObjectID | null = readOidTemplateId(
+        updateBy.data as unknown as Record<string, unknown>,
+      );
+
+      if (writtenOidTemplateId) {
+        await this.validateOidTemplateSelection({
+          oidTemplateId: writtenOidTemplateId,
+          projectId: updateBy.props.tenantId,
+          props: updateBy.props,
+        });
+      }
+    }
+
     if (!isCriteriaChange && !isMonitorProvisioningChange) {
       return { updateBy, carryForward: null };
     }
@@ -205,6 +254,53 @@ export class Service extends DatabaseService<Model> {
     return { updateBy, carryForward: null };
   }
 
+  /*
+   * A rule may only name an OID Collection Template from its own project.
+   *
+   * Without this, a rule could hold a cross-project reference: the read is
+   * tenant-scoped only at the ROOT query, so the rules list would render
+   * another project's template name, and every device the rule imported would
+   * be created pointing at it. NetworkDeviceService refuses that link, so the
+   * devices would simply come out unconfigured — a silent, confusing failure
+   * whose cause is one field on a rule nobody is looking at.
+   *
+   * The read carries the caller's own props, exactly as the monitor-template
+   * check does: selecting a template is also a read of it, so a user who
+   * cannot see it must not be able to attach it.
+   */
+  private async validateOidTemplateSelection(data: {
+    oidTemplateId: ObjectID;
+    projectId: ObjectID | undefined;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    if (!data.projectId) {
+      return;
+    }
+
+    const oidTemplate: NetworkDeviceOidTemplate | null =
+      await NetworkDeviceOidTemplateService.findOneById({
+        id: data.oidTemplateId,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        props: data.props,
+      });
+
+    if (!oidTemplate) {
+      throw new BadDataException("OID Collection Template not found.");
+    }
+
+    if (
+      !oidTemplate.projectId ||
+      oidTemplate.projectId.toString() !== data.projectId.toString()
+    ) {
+      throw new BadDataException(
+        "OID Collection Template must belong to the same project.",
+      );
+    }
+  }
+
   private async validateMonitorTemplateSelection(data: {
     monitorTemplateId: ObjectID;
     projectId: ObjectID | undefined;

package/Server/Services/NetworkDeviceLabelRuleEngineService.ts

@@ -10,6 +10,8 @@ import { LabelRuleRunResult } from "../../Types/NetworkAutomation/RuleRunResult"
 import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 /*
  * Bounds on one manual "Run now" of a label rule. The automatic path only
@@ -65,10 +67,16 @@ class NetworkDeviceLabelRuleEngineServiceClass {
             networkDeviceDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "NetworkDeviceLabelRule",
+        projectId: networkDevice.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }