@oneuptime/common 12.0.29 → 12.0.31

package/Server/Services/NetworkDeviceOidTemplateService.ts

@@ -0,0 +1,201 @@
+import DatabaseService from "./DatabaseService";
+import NetworkDeviceAutoImportRuleService from "./NetworkDeviceAutoImportRuleService";
+import NetworkDeviceService from "./NetworkDeviceService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceOidTemplate";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import Query from "../Types/Database/Query";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import SnmpOid from "../../Types/Monitor/SnmpMonitor/SnmpOid";
+import SnmpOidListUtil, {
+  MAX_OIDS_PER_TEMPLATE,
+} from "../../Types/Monitor/SnmpMonitor/SnmpOidListUtil";
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * OID Collection Templates carry COLLECTION config for a whole device type,
+ * so this service has exactly three jobs and deliberately no fourth:
+ *
+ *   1. Refuse a malformed OID list at save time. Nothing validated snmpOids
+ *      before, which was survivable when one bad row broke one device; with
+ *      a template it would break every device linked to it.
+ *   2. Answer "how many devices use this?" for the UI.
+ *   3. Refuse to delete a template that devices are still using.
+ *
+ * There is no syncToDevices, no onUpdateSuccess, and no fan-out of any kind.
+ * The template is resolved live against each device at poll time in
+ * NetworkDevicePoll, so there is nothing to push and nothing to reconcile -
+ * see the model's class comment for why that inverts MonitorTemplate.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (createBy.data.oids !== undefined) {
+      createBy.data.oids = SnmpOidListUtil.validateOidList(createBy.data.oids, {
+        max: MAX_OIDS_PER_TEMPLATE,
+        label: "OID Collection Template",
+      });
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * `!== undefined` rather than a truthiness check: an explicit empty array
+     * is a legitimate "this template collects nothing" edit, and
+     * validateOidList accepts it.
+     */
+    if (updateBy.data.oids !== undefined) {
+      updateBy.data.oids = SnmpOidListUtil.validateOidList(
+        updateBy.data.oids as Array<SnmpOid>,
+        {
+          max: MAX_OIDS_PER_TEMPLATE,
+          label: "OID Collection Template",
+        },
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * Deleting a template devices still use would silently drop OIDs from every
+   * one of them: the FK is ON DELETE SET NULL, so those devices just quietly
+   * fall back to their own lists on the next poll with nothing to tell
+   * anyone. Refuse, and say how many devices are in the way.
+   *
+   * Counting rather than keeping a rollup column is deliberate - a maintained
+   * counter would make this row hot under every device create and rebind, and
+   * MonitorTemplateService.countLinkedMonitors already set the precedent.
+   */
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    const templatesToDelete: Array<Model> = await this.findBy({
+      /*
+       * This hook runs BEFORE DatabaseService permission-checks the query, so
+       * a raw isRoot read of deleteBy.query would hand back other tenants'
+       * templates. Re-apply the caller's tenant, exactly as NetworkSiteService
+       * does for the same reason.
+       */
+      query: this.scopeQueryToCallerTenant(deleteBy.query, deleteBy.props),
+      select: {
+        _id: true,
+        name: true,
+        projectId: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const template of templatesToDelete) {
+      if (!template.id || !template.projectId) {
+        continue;
+      }
+
+      const linkedDeviceCount: number = await this.countLinkedDevices({
+        templateId: template.id,
+        projectId: template.projectId,
+      });
+
+      if (linkedDeviceCount > 0) {
+        throw new BadDataException(
+          `${template.name || "This OID Collection Template"} is still used by ${linkedDeviceCount} network device(s). Move those devices to another template, or clear their template, before deleting it.`,
+        );
+      }
+
+      /*
+       * Auto-import rules count too, and for the same reason.
+       *
+       * The FK there is also ON DELETE SET NULL, so deleting a template a rule
+       * still names does not fail - it silently turns that rule back into one
+       * that imports devices collecting nothing, and the next discovery scan
+       * quietly produces a fleet nobody configured. A rule can hold the last
+       * reference to a template with zero devices linked yet (it was created
+       * ahead of the scan), which is exactly when the device count alone says
+       * the delete is safe.
+       */
+      const linkedRuleCount: PositiveNumber =
+        await NetworkDeviceAutoImportRuleService.countBy({
+          query: {
+            projectId: template.projectId,
+            oidTemplateId: template.id,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+
+      if (linkedRuleCount.toNumber() > 0) {
+        throw new BadDataException(
+          `${template.name || "This OID Collection Template"} is still used by ${linkedRuleCount.toNumber()} auto-import rule(s). Clear it from those rules before deleting it, or devices they import will collect nothing.`,
+        );
+      }
+    }
+
+    return { deleteBy, carryForward: null };
+  }
+
+  /**
+   * How many devices collect this template's OIDs. Used by the template page
+   * and by the delete guard above.
+   */
+  @CaptureSpan()
+  public async countLinkedDevices(data: {
+    templateId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<number> {
+    const count: PositiveNumber = await NetworkDeviceService.countBy({
+      query: {
+        projectId: data.projectId,
+        oidTemplateId: data.templateId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return count.toNumber();
+  }
+
+  /*
+   * See NetworkSiteService for the full explanation: hooks run before
+   * ModelPermission scopes the caller's query, so anything a hook reads with
+   * isRoot has to be re-scoped by hand or it spans projects.
+   */
+  private scopeQueryToCallerTenant(
+    query: Query<Model>,
+    props: DatabaseCommonInteractionProps,
+  ): Query<Model> {
+    if (props.isRoot || !props.tenantId) {
+      return query;
+    }
+
+    return {
+      ...query,
+      projectId: props.tenantId,
+    };
+  }
+}
+
+export default new Service();

package/Server/Services/NetworkDeviceOwnerRuleEngineService.ts

@@ -11,6 +11,8 @@ import ObjectID from "../../Types/ObjectID";
 import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class NetworkDeviceOwnerRuleEngineServiceClass {
   /**
@@ -45,10 +47,16 @@ class NetworkDeviceOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "NetworkDeviceOwnerRule",
+        projectId: networkDevice.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/NetworkDeviceService.ts

@@ -26,6 +26,13 @@ import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
 import { SiteAssignmentRuleRunResult } from "../../Types/NetworkAutomation/RuleRunResult";
 import { NetworkDeviceMonitoringMethodUtil } from "../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
 import RelationIdUtil from "../Utils/Database/RelationIdUtil";
+import NetworkDeviceOidTemplate from "../../Models/DatabaseModels/NetworkDeviceOidTemplate";
+import NetworkDeviceOidTemplateService from "./NetworkDeviceOidTemplateService";
+import SnmpOid from "../../Types/Monitor/SnmpMonitor/SnmpOid";
+import SnmpOidListUtil, {
+  MAX_DEVICE_SPECIFIC_OIDS,
+  MAX_EFFECTIVE_OIDS_PER_DEVICE,
+} from "../../Types/Monitor/SnmpMonitor/SnmpOidListUtil";
 import { EntityManager } from "typeorm";
 import ModelPermission from "../Types/Database/Permissions/Index";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -106,6 +113,30 @@ function readSiteIdFromData(data: Record<string, unknown>): ObjectID | null {
 // Both spellings of "the monitor that reports this device's health".
 const MONITOR_KEYS: Array<string> = ["monitorId", "monitor"];
 
+/*
+ * Both spellings of "the OID Collection Template this device collects". The
+ * settings page posts the `oidTemplate` relation and the bulk action posts
+ * the `oidTemplateId` column, so a guard that watched only one of them would
+ * be trivially bypassable from the UI.
+ */
+const OID_TEMPLATE_KEYS: Array<string> = ["oidTemplateId", "oidTemplate"];
+
+function readOidTemplateIdFromData(
+  data: Record<string, unknown>,
+): ObjectID | null {
+  /*
+   * readConsistent, not read: a payload that writes BOTH spellings with
+   * different ids would otherwise have one of them validated and the other
+   * persisted, which turns the cross-project guard below into something a
+   * caller can steer. It refuses the contradiction instead of picking.
+   */
+  return RelationIdUtil.readConsistent(
+    data,
+    OID_TEMPLATE_KEYS,
+    "OID Collection Template",
+  );
+}
+
 function readMonitorIdFromData(data: Record<string, unknown>): ObjectID | null {
   return RelationIdUtil.read(data, MONITOR_KEYS);
 }
@@ -838,6 +869,50 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /*
+   * Same hole as siteId, and it matters more here: the FK behind
+   * oidTemplateId only requires the row to exist, not that it belongs to the
+   * device's project. Tenant scoping is applied to the ROOT query only, so a
+   * device pointed at another project's template would leak that template's
+   * name and OID list through every nested `select: { oidTemplate: ... }` the
+   * dashboard makes - and the poll would ship those OIDs to this project's
+   * probe. Refuse the link at the point it is written, rather than auditing
+   * it afterwards at poll time.
+   */
+  private async assertOidTemplateBelongsToProject(data: {
+    oidTemplateId: ObjectID;
+    projectId: ObjectID | undefined;
+  }): Promise<void> {
+    if (!data.projectId) {
+      return;
+    }
+
+    const oidTemplate: NetworkDeviceOidTemplate | null =
+      await NetworkDeviceOidTemplateService.findOneById({
+        id: data.oidTemplateId,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (!oidTemplate) {
+      throw new BadDataException("OID Collection Template not found.");
+    }
+
+    if (
+      oidTemplate.projectId &&
+      oidTemplate.projectId.toString() !== data.projectId.toString()
+    ) {
+      throw new BadDataException(
+        "OID Collection Template must belong to the same project.",
+      );
+    }
+  }
+
   /*
    * onBeforeUpdate runs before DatabaseService permission-checks the query,
    * so reading the raw client query as root would hand the hook rows from
@@ -877,6 +952,30 @@ export class Service extends DatabaseService<Model> {
       });
     }
 
+    const createOidTemplateId: ObjectID | null = readOidTemplateIdFromData(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (createOidTemplateId) {
+      await this.assertOidTemplateBelongsToProject({
+        oidTemplateId: createOidTemplateId,
+        projectId: createBy.data.projectId,
+      });
+    }
+
+    if (createBy.data.snmpOids !== undefined) {
+      // Same budget rule as onBeforeUpdate: the tight cap is what linking costs.
+      createBy.data.snmpOids = SnmpOidListUtil.validateOidList(
+        createBy.data.snmpOids,
+        {
+          max: createOidTemplateId
+            ? MAX_DEVICE_SPECIFIC_OIDS
+            : MAX_EFFECTIVE_OIDS_PER_DEVICE,
+          label: "Device-Specific Health OIDs",
+        },
+      );
+    }
+
     if (
       NetworkDeviceMonitoringMethodUtil.isMonitorBacked(
         createBy.data.monitoringMethod,
@@ -1098,8 +1197,34 @@ export class Service extends DatabaseService<Model> {
         return dataKeys.includes(column);
       },
     );
+    /*
+     * The OID writes have to get past this return too, and that is the whole
+     * reason they are named here.
+     *
+     * The early return exists so a write that changes neither site nor
+     * identity skips a read it does not need — but linking a template and
+     * editing snmpOids are EXACTLY such writes, so a guard placed below the
+     * return would be dead code on the only path it exists for. Both need the
+     * read: the tenancy check needs each matched device's projectId, and the
+     * OID cap needs to know whether the device is linked to a template.
+     *
+     * `!== undefined` rather than truthiness for the OID list: every poll
+     * writes device columns through this path (NetworkInventoryUtil), and an
+     * explicit empty array is a legitimate "collect nothing device-specific"
+     * edit.
+     */
+    const isOidTemplateChange: boolean = RelationIdUtil.isWritten(
+      dataKeys,
+      OID_TEMPLATE_KEYS,
+    );
+    const isDeviceOidsChange: boolean = updateBy.data.snmpOids !== undefined;
 
-    if (!isSiteChange && !isIdentityChange) {
+    if (
+      !isSiteChange &&
+      !isIdentityChange &&
+      !isOidTemplateChange &&
+      !isDeviceOidsChange
+    ) {
       return { updateBy, carryForward: null };
     }
 
@@ -1112,6 +1237,9 @@ export class Service extends DatabaseService<Model> {
         hostname: true,
         name: true,
         sysName: true,
+        // Decide which OID budget applies below, and whether a link would truncate.
+        oidTemplateId: true,
+        snmpOids: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -1143,6 +1271,86 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    const newOidTemplateId: ObjectID | null = readOidTemplateIdFromData(
+      updateBy.data as unknown as Record<string, unknown>,
+    );
+
+    /*
+     * Same shape as the site guard above: one check per distinct project in
+     * the matched set, because a single updateBy can span devices from more
+     * than one project when a root caller issues it.
+     */
+    if (newOidTemplateId) {
+      const checkedTemplateProjectIds: Set<string> = new Set();
+
+      for (const previousDevice of previousDevices) {
+        if (
+          !previousDevice.projectId ||
+          checkedTemplateProjectIds.has(previousDevice.projectId.toString())
+        ) {
+          continue;
+        }
+        checkedTemplateProjectIds.add(previousDevice.projectId.toString());
+
+        await this.assertOidTemplateBelongsToProject({
+          oidTemplateId: newOidTemplateId,
+          projectId: previousDevice.projectId,
+        });
+      }
+    }
+
+    /*
+     * How many OIDs a device may carry of its own.
+     *
+     * The tight budget is a consequence of ADOPTING a template, not a
+     * retroactive limit on every device that already exists. A device with no
+     * template collects only its own list, so its ceiling is the full
+     * per-device budget; the moment it links to one, template plus
+     * device-specific has to fit inside that same ceiling, and the
+     * device-specific half is what gives.
+     *
+     * Enforcing the tight budget unconditionally would have been hostile in
+     * exactly the wrong direction: a device that predates this feature, with a
+     * long hand-built list, could no longer save ANY polling setting — the
+     * fleet in issue #3507 being the likeliest example.
+     */
+    /*
+     * Linking a device whose STORED list already exceeds the device-specific
+     * budget would leave the merge over the effective ceiling, and truncation
+     * drops from the end — so the operator's own OIDs would silently stop
+     * being polled, on a write that never mentioned them. Refuse the link and
+     * say what to trim, rather than accepting it and losing data at poll time.
+     */
+    if (isOidTemplateChange && newOidTemplateId && !isDeviceOidsChange) {
+      for (const previousDevice of previousDevices) {
+        const storedOidCount: number = (previousDevice.snmpOids || []).length;
+
+        if (storedOidCount > MAX_DEVICE_SPECIFIC_OIDS) {
+          throw new BadDataException(
+            `This device has ${storedOidCount} device-specific Health OIDs, and a device linked to an OID Collection Template may keep at most ${MAX_DEVICE_SPECIFIC_OIDS} of its own. Remove ${storedOidCount - MAX_DEVICE_SPECIFIC_OIDS} of them - or move them onto the template - before linking it.`,
+          );
+        }
+      }
+    }
+
+    if (isDeviceOidsChange) {
+      const becomesLinked: boolean = isOidTemplateChange
+        ? Boolean(newOidTemplateId)
+        : previousDevices.some((previousDevice: Model) => {
+            return Boolean(previousDevice.oidTemplateId);
+          });
+
+      updateBy.data.snmpOids = SnmpOidListUtil.validateOidList(
+        updateBy.data.snmpOids as Array<SnmpOid>,
+        {
+          max: becomesLinked
+            ? MAX_DEVICE_SPECIFIC_OIDS
+            : MAX_EFFECTIVE_OIDS_PER_DEVICE,
+          label: "Device-Specific Health OIDs",
+        },
+      );
+    }
+
     return {
       updateBy,
       carryForward: {

package/Server/Services/OnCallDutyPolicyEscalationRuleScheduleService.ts

@@ -25,12 +25,35 @@ import { WhatsAppMessagePayload } from "../../Types/WhatsApp/WhatsAppMessage";
 import OnCallDutyPolicyTimeLogService from "./OnCallDutyPolicyTimeLogService";
 import OneUptimeDate from "../../Types/Date";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /**
+   * Attaching to / detaching from a policy changes the schedule's policy
+   * context (which overrides apply, and which policies its calendar events
+   * list), so it is a configuration change for the calendar feeds and the
+   * reminders: bump shiftConfigVersion, purge the feed caches, notify the
+   * listeners. Runs after the roster refresh; never throws.
+   */
+  private async propagateAttachmentChange(
+    onCallDutyPolicyScheduleId: ObjectID | null | undefined,
+    projectId: ObjectID | null | undefined,
+  ): Promise<void> {
+    if (!onCallDutyPolicyScheduleId) {
+      return;
+    }
+
+    await OnCallDutyPolicyScheduleService.propagateShiftConfigChange({
+      scheduleIds: [onCallDutyPolicyScheduleId],
+      projectId: projectId || null,
+      reason: OnCallShiftChangeReason.PolicyAttachmentChanged,
+    });
+  }
+
   /**
    * Re-resolve and persist the schedule's roster after it is attached to, or
    * detached from, an on-call policy.
@@ -123,6 +146,11 @@ export class Service extends DatabaseService<Model> {
      */
     await this.refreshScheduleRoster(createdModel.onCallDutyPolicyScheduleId);
 
+    await this.propagateAttachmentChange(
+      createdModel.onCallDutyPolicyScheduleId,
+      createdModel.projectId,
+    );
+
     // send notification to the new current user.
 
     const userOnSchedule: ObjectID | null =
@@ -387,6 +415,10 @@ export class Service extends DatabaseService<Model> {
       }
       refreshedScheduleIds.add(scheduleId);
       await this.refreshScheduleRoster(deletedItem.onCallDutyPolicyScheduleId);
+      await this.propagateAttachmentChange(
+        deletedItem.onCallDutyPolicyScheduleId,
+        deletedItem.projectId,
+      );
     }
 
     for (const deletedItem of deletedItems) {

package/Server/Services/OnCallDutyPolicyLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class OnCallDutyPolicyLabelRuleEngineServiceClass {
   @CaptureSpan()
@@ -32,10 +34,16 @@ class OnCallDutyPolicyLabelRuleEngineServiceClass {
             onCallDutyPolicyDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "OnCallDutyPolicyLabelRule",
+        projectId: onCallDutyPolicy.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/OnCallDutyPolicyOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class OnCallDutyPolicyOwnerRuleEngineServiceClass {
   @CaptureSpan()
@@ -38,10 +40,16 @@ class OnCallDutyPolicyOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "OnCallDutyPolicyOwnerRule",
+        projectId: onCallDutyPolicy.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }