@oneuptime/common 12.0.30 → 12.0.31

package/Models/DatabaseModels/NetworkDeviceAutoImportRule.ts

@@ -1,4 +1,5 @@
 import MonitorTemplate from "./MonitorTemplate";
+import NetworkDeviceOidTemplate from "./NetworkDeviceOidTemplate";
 import Project from "./Project";
 import User from "./User";
 import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
@@ -551,6 +552,93 @@ export default class NetworkDeviceAutoImportRule extends BaseModel {
   })
   public monitorTemplateId?: ObjectID = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateNetworkDeviceAutoImportRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditNetworkDeviceAutoImportRule,
+    ],
+  })
+  /*
+   * The collect half of the pair, sitting beside the alert half above.
+   *
+   * Without it a template is only reachable by hand: a discovery scan would
+   * import a device, the vendor auto-apply would write a two-to-six OID copy
+   * onto it, and somebody would have to go back and bulk-assign the real
+   * template - after every scan, forever. That is the same per-device chore
+   * issue #3507 is about, just moved one step later. This is the OneUptime
+   * shape of Zabbix's "link template on host discovery" action.
+   */
+  @TableColumn({
+    manyToOneRelationColumn: "oidTemplateId",
+    type: TableColumnType.Entity,
+    modelType: NetworkDeviceOidTemplate,
+    title: "OID Collection Template",
+    description:
+      "Optional OID Collection Template to link to devices imported by this rule. The Monitor Template decides what those devices are ALERTED on; this decides what they COLLECT.",
+  })
+  @ManyToOne(
+    () => {
+      return NetworkDeviceOidTemplate;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({
+    name: "oidTemplateId",
+  })
+  public oidTemplate?: NetworkDeviceOidTemplate = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateNetworkDeviceAutoImportRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditNetworkDeviceAutoImportRule,
+    ],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    canReadOnRelationQuery: true,
+    title: "OID Collection Template ID",
+    description:
+      "ID of the optional OID Collection Template to link to devices imported by this rule",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public oidTemplateId?: ObjectID = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/NetworkDeviceDiscoveryScan.ts

@@ -34,6 +34,28 @@ export interface DiscoveredNetworkDevice {
   sysLocation?: string | undefined;
   sysContact?: string | undefined;
   sysUpTimeSeconds?: number | undefined;
+  /*
+   * The host's reverse-DNS (PTR) name, resolved by the probe against the
+   * scanned network's own resolvers (OneUptime issue #3529).
+   *
+   * This is what a ping-only host is NAMED by. Before it existed the Review
+   * dialog could only show such a host as its address, which is what the
+   * issue reported: an estate with DNS records for everything still read as
+   * a list of bare IPs.
+   *
+   * Optional in three different ways that all mean "no name": the address has
+   * no PTR record, the probe has no usable resolver, or the row was stored
+   * before this field existed / by an older probe. Every reader falls back to
+   * the address, so none of the three needs telling apart.
+   *
+   * ATTACKER-INFLUENCED. Its value is chosen by whoever runs DNS for the
+   * scanned subnet, which on a discovery scan is frequently not this project,
+   * and it is stored here verbatim in jsonb. Never render or store it without
+   * ReverseDnsNameUtil.normalizeReverseDnsName — normalizeDiscoveredHosts and
+   * buildDeviceName both apply it, which covers every path that reaches a
+   * screen or a name column.
+   */
+  dnsHostname?: string | undefined;
   isAlreadyRegistered?: boolean | undefined;
   /*
    * False when the host answered ping but not SNMP — such hosts cannot be

package/Models/DatabaseModels/NetworkDeviceOidTemplate.ts

@@ -0,0 +1,499 @@
+import Project from "./Project";
+import User from "./User";
+import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import Route from "../../Types/API/Route";
+import SnmpOid from "../../Types/Monitor/SnmpMonitor/SnmpOid";
+import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import ColumnLength from "../../Types/Database/ColumnLength";
+import ColumnType from "../../Types/Database/ColumnType";
+import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import EnableDocumentation from "../../Types/Database/EnableDocumentation";
+import EnableWorkflow from "../../Types/Database/EnableWorkflow";
+import SlugifyColumn from "../../Types/Database/SlugifyColumn";
+import TableColumn from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import TableMetadata from "../../Types/Database/TableMetadata";
+import TenantColumn from "../../Types/Database/TenantColumn";
+import UniqueColumnBy from "../../Types/Database/UniqueColumnBy";
+import IconProp from "../../Types/Icon/IconProp";
+import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
+import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+
+/*
+ * A reusable set of SNMP health OIDs, shared by every network device linked
+ * to it (issue #3507).
+ *
+ * The link is LIVE, not a copy. Nothing here is ever written onto a device:
+ * NetworkDevicePoll merges a device's template OIDs with its own on every
+ * poll, so editing this row changes what every linked device collects on its
+ * next poll, with no fan-out and no write to NetworkDevice. That deliberately
+ * inverts the MonitorTemplate precedent, which pushes on an explicit button
+ * press - because that template carries ALERTING config, where a silent
+ * fleet-wide change is dangerous, and this one carries COLLECTION config,
+ * where adding an OID raises nothing by itself and editing the row back
+ * undoes it.
+ *
+ * The template's NAME is the device type. There is no NetworkDeviceType
+ * model and every candidate matching key was defective: labels double as the
+ * row-level ACL column, deviceRole is unconstrained free text, and
+ * vendor/sysObjectId are probe-managed and NULL until the first successful
+ * walk. Devices link by an explicit FK the operator sets, in bulk from the
+ * device list.
+ */
+@EnableDocumentation()
+@TenantColumn("projectId")
+@TableAccessControl({
+  create: [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.SettingsAdmin,
+    Permission.SettingsMember,
+    Permission.CreateNetworkDeviceOidTemplate,
+  ],
+  read: [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.Viewer,
+    Permission.SettingsAdmin,
+    Permission.SettingsMember,
+    Permission.SettingsViewer,
+    Permission.ReadNetworkDeviceOidTemplate,
+  ],
+  delete: [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.SettingsAdmin,
+    Permission.SettingsMember,
+    Permission.DeleteNetworkDeviceOidTemplate,
+  ],
+  update: [
+    Permission.ProjectOwner,
+    Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.SettingsAdmin,
+    Permission.SettingsMember,
+    Permission.EditNetworkDeviceOidTemplate,
+  ],
+})
+@CrudApiEndpoint(new Route("/network-device-oid-template"))
+@SlugifyColumn("name", "slug")
+@TableMetadata({
+  tableName: "NetworkDeviceOidTemplate",
+  singularName: "OID Collection Template",
+  pluralName: "OID Collection Templates",
+  icon: IconProp.List,
+  tableDescription:
+    "A reusable set of SNMP health OIDs. Every network device linked to a template collects its OIDs, and editing the template changes what every linked device collects on its next poll.",
+})
+@Entity({
+  name: "NetworkDeviceOidTemplate",
+})
+@EnableWorkflow({
+  create: true,
+  delete: true,
+  update: true,
+  read: true,
+})
+export default class NetworkDeviceOidTemplate extends BaseModel {
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceOidTemplate,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "projectId",
+    type: TableColumnType.Entity,
+    modelType: Project,
+    title: "Project",
+    description: "Relation to Project Resource in which this object belongs",
+  })
+  @ManyToOne(
+    () => {
+      return Project;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "projectId" })
+  public project?: Project = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceOidTemplate,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: true,
+    canReadOnRelationQuery: true,
+    title: "Project ID",
+    description: "ID of your OneUptime Project in which this object belongs",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public projectId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceOidTemplate,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDeviceOidTemplate,
+    ],
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "Name",
+    description:
+      "The device type this template describes. Devices linked to it all collect the same OIDs.",
+    example: "Cisco Catalyst 9300",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  @UniqueColumnBy("projectId")
+  public name?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: true,
+    unique: true,
+    type: TableColumnType.Slug,
+    computed: true,
+    title: "Slug",
+    description: "Friendly globally unique name for your object",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.Slug,
+    length: ColumnLength.Slug,
+  })
+  public slug?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceOidTemplate,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDeviceOidTemplate,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.LongText,
+    title: "Description",
+    description: "Friendly description that will help you remember",
+    example: "Branch routers: CPU, memory pool and chassis temperature.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+  })
+  public description?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceOidTemplate,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDeviceOidTemplate,
+    ],
+  })
+  /*
+   * The same element type as NetworkDevice.snmpOids, deliberately. Sharing
+   * it means the same editor, the same merge and the same probe wire format
+   * serve both, and "template OIDs plus device OIDs" is a legal list needing
+   * no conversion anywhere.
+   */
+  @TableColumn({
+    required: false,
+    type: TableColumnType.JSON,
+    /*
+     * Readable through a device's `oidTemplate` relation, because the
+     * dashboard has to show the EFFECTIVE OID list - the template's plus the
+     * device's own - in two places that only hold a device: the criteria OID
+     * picker, and the device's own settings card. Live resolution means the
+     * device row alone no longer says what it collects, so without this the
+     * operator has no way to see it.
+     *
+     * Safe specifically because NetworkDeviceService now refuses to link a
+     * device to a template from another project (assertOidTemplateBelongsTo-
+     * Project). Nested relation selects are NOT tenant-checked - only the root
+     * query is - so that write-time guard is what makes this read-time flag
+     * sound.
+     */
+    canReadOnRelationQuery: true,
+    title: "OIDs",
+    description:
+      "SNMP OIDs (CPU, memory, temperature, or any custom OID) collected by every device linked to this template. You do not need OIDs for interfaces - bits in/out, errors, utilization and up/down are walked for every port automatically.",
+  })
+  @Column({
+    type: ColumnType.JSON,
+    nullable: true,
+  })
+  public oids?: Array<SnmpOid> = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceOidTemplate,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "createdByUserId",
+    type: TableColumnType.Entity,
+    modelType: User,
+    title: "Created by User",
+    description:
+      "Relation to User who created this object (if this object was created by a User)",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "createdByUserId" })
+  public createdByUser?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDeviceOidTemplate,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Created by User ID",
+    description:
+      "User ID who created this object (if this object was created by a User)",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public createdByUserId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "deletedByUserId",
+    type: TableColumnType.Entity,
+    title: "Deleted by User",
+    modelType: User,
+    description:
+      "Relation to User who deleted this object (if this object was deleted by a User)",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      cascade: false,
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "deletedByUserId" })
+  public deletedByUser?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDeviceOidTemplate,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Deleted by User ID",
+    description:
+      "User ID who deleted this object (if this object was deleted by a User)",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public deletedByUserId?: ObjectID = undefined;
+}

package/Models/DatabaseModels/ThreatIntelFeed.ts

@@ -22,26 +22,35 @@ import Permission from "../../Types/Permission";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+/*
+ * Part of the SIEM, so it reads and is administered through the Security
+ * tiers rather than the Telemetry ones it used to share a list with. A
+ * detection rule and a threat-intel subscription describe what a project is
+ * watching for and what it believes it is up against, which is security
+ * posture rather than observability configuration.
+ */
 const createPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
   Permission.CreateProjectThreatIntelFeed,
 ];
 
 const readPermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
-  Permission.ProjectMember,
-  Permission.Viewer,
-  Permission.TelemetryAdmin,
-  Permission.TelemetryMember,
-  Permission.TelemetryViewer,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
+  Permission.SecurityViewer,
   Permission.ReadProjectThreatIntelFeed,
 ];
 
 const updatePermissions: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
   Permission.EditProjectThreatIntelFeed,
 ];
 
@@ -86,6 +95,8 @@ const updatePermissions: Array<Permission> = [
   delete: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
+    Permission.SecurityAdmin,
+    Permission.SecurityMember,
     Permission.DeleteProjectThreatIntelFeed,
   ],
   update: updatePermissions,