@oneuptime/common 12.0.30 → 12.0.32

package/Server/Services/NetworkDeviceAutoImportRuleService.ts

@@ -1,8 +1,10 @@
 import DatabaseService from "./DatabaseService";
 import MonitorTemplateService from "./MonitorTemplateService";
+import NetworkDeviceOidTemplateService from "./NetworkDeviceOidTemplateService";
 import Model from "../../Models/DatabaseModels/NetworkDeviceAutoImportRule";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import MonitorTemplate from "../../Models/DatabaseModels/MonitorTemplate";
+import NetworkDeviceOidTemplate from "../../Models/DatabaseModels/NetworkDeviceOidTemplate";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
@@ -46,6 +48,16 @@ function readMonitorTemplateId(data: Record<string, unknown>): ObjectID | null {
   );
 }
 
+const OID_TEMPLATE_KEYS: Array<string> = ["oidTemplateId", "oidTemplate"];
+
+function readOidTemplateId(data: Record<string, unknown>): ObjectID | null {
+  return RelationIdUtil.readConsistent(
+    data,
+    OID_TEMPLATE_KEYS,
+    "OID Collection Template",
+  );
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -76,6 +88,18 @@ export class Service extends DatabaseService<Model> {
       });
     }
 
+    const oidTemplateId: ObjectID | null = readOidTemplateId(
+      createBy.data as unknown as Record<string, unknown>,
+    );
+
+    if (oidTemplateId) {
+      await this.validateOidTemplateSelection({
+        oidTemplateId: oidTemplateId,
+        projectId: createBy.props.tenantId || createBy.data.projectId,
+        props: createBy.props,
+      });
+    }
+
     return { createBy, carryForward: null };
   }
 
@@ -97,6 +121,31 @@ export class Service extends DatabaseService<Model> {
       dataKeys.includes("includePingOnlyHosts") ||
       dataKeys.includes("isEnabled");
 
+    const isOidTemplateChange: boolean = RelationIdUtil.isWritten(
+      dataKeys,
+      OID_TEMPLATE_KEYS,
+    );
+
+    /*
+     * Validated before the early return and independently of the rest: an OID
+     * Collection Template is the collect half of the rule, so pointing at one
+     * is legitimate on its own and must not need a criteria or monitor change
+     * to be checked.
+     */
+    if (isOidTemplateChange) {
+      const writtenOidTemplateId: ObjectID | null = readOidTemplateId(
+        updateBy.data as unknown as Record<string, unknown>,
+      );
+
+      if (writtenOidTemplateId) {
+        await this.validateOidTemplateSelection({
+          oidTemplateId: writtenOidTemplateId,
+          projectId: updateBy.props.tenantId,
+          props: updateBy.props,
+        });
+      }
+    }
+
     if (!isCriteriaChange && !isMonitorProvisioningChange) {
       return { updateBy, carryForward: null };
     }
@@ -205,6 +254,53 @@ export class Service extends DatabaseService<Model> {
     return { updateBy, carryForward: null };
   }
 
+  /*
+   * A rule may only name an OID Collection Template from its own project.
+   *
+   * Without this, a rule could hold a cross-project reference: the read is
+   * tenant-scoped only at the ROOT query, so the rules list would render
+   * another project's template name, and every device the rule imported would
+   * be created pointing at it. NetworkDeviceService refuses that link, so the
+   * devices would simply come out unconfigured — a silent, confusing failure
+   * whose cause is one field on a rule nobody is looking at.
+   *
+   * The read carries the caller's own props, exactly as the monitor-template
+   * check does: selecting a template is also a read of it, so a user who
+   * cannot see it must not be able to attach it.
+   */
+  private async validateOidTemplateSelection(data: {
+    oidTemplateId: ObjectID;
+    projectId: ObjectID | undefined;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    if (!data.projectId) {
+      return;
+    }
+
+    const oidTemplate: NetworkDeviceOidTemplate | null =
+      await NetworkDeviceOidTemplateService.findOneById({
+        id: data.oidTemplateId,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        props: data.props,
+      });
+
+    if (!oidTemplate) {
+      throw new BadDataException("OID Collection Template not found.");
+    }
+
+    if (
+      !oidTemplate.projectId ||
+      oidTemplate.projectId.toString() !== data.projectId.toString()
+    ) {
+      throw new BadDataException(
+        "OID Collection Template must belong to the same project.",
+      );
+    }
+  }
+
   private async validateMonitorTemplateSelection(data: {
     monitorTemplateId: ObjectID;
     projectId: ObjectID | undefined;

package/Server/Services/NetworkDeviceLabelRuleEngineService.ts

@@ -10,6 +10,8 @@ import { LabelRuleRunResult } from "../../Types/NetworkAutomation/RuleRunResult"
 import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 /*
  * Bounds on one manual "Run now" of a label rule. The automatic path only
@@ -65,10 +67,16 @@ class NetworkDeviceLabelRuleEngineServiceClass {
             networkDeviceDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "NetworkDeviceLabelRule",
+        projectId: networkDevice.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/NetworkDeviceOidTemplateService.ts

@@ -0,0 +1,201 @@
+import DatabaseService from "./DatabaseService";
+import NetworkDeviceAutoImportRuleService from "./NetworkDeviceAutoImportRuleService";
+import NetworkDeviceService from "./NetworkDeviceService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceOidTemplate";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import Query from "../Types/Database/Query";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import SnmpOid from "../../Types/Monitor/SnmpMonitor/SnmpOid";
+import SnmpOidListUtil, {
+  MAX_OIDS_PER_TEMPLATE,
+} from "../../Types/Monitor/SnmpMonitor/SnmpOidListUtil";
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * OID Collection Templates carry COLLECTION config for a whole device type,
+ * so this service has exactly three jobs and deliberately no fourth:
+ *
+ *   1. Refuse a malformed OID list at save time. Nothing validated snmpOids
+ *      before, which was survivable when one bad row broke one device; with
+ *      a template it would break every device linked to it.
+ *   2. Answer "how many devices use this?" for the UI.
+ *   3. Refuse to delete a template that devices are still using.
+ *
+ * There is no syncToDevices, no onUpdateSuccess, and no fan-out of any kind.
+ * The template is resolved live against each device at poll time in
+ * NetworkDevicePoll, so there is nothing to push and nothing to reconcile -
+ * see the model's class comment for why that inverts MonitorTemplate.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (createBy.data.oids !== undefined) {
+      createBy.data.oids = SnmpOidListUtil.validateOidList(createBy.data.oids, {
+        max: MAX_OIDS_PER_TEMPLATE,
+        label: "OID Collection Template",
+      });
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * `!== undefined` rather than a truthiness check: an explicit empty array
+     * is a legitimate "this template collects nothing" edit, and
+     * validateOidList accepts it.
+     */
+    if (updateBy.data.oids !== undefined) {
+      updateBy.data.oids = SnmpOidListUtil.validateOidList(
+        updateBy.data.oids as Array<SnmpOid>,
+        {
+          max: MAX_OIDS_PER_TEMPLATE,
+          label: "OID Collection Template",
+        },
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * Deleting a template devices still use would silently drop OIDs from every
+   * one of them: the FK is ON DELETE SET NULL, so those devices just quietly
+   * fall back to their own lists on the next poll with nothing to tell
+   * anyone. Refuse, and say how many devices are in the way.
+   *
+   * Counting rather than keeping a rollup column is deliberate - a maintained
+   * counter would make this row hot under every device create and rebind, and
+   * MonitorTemplateService.countLinkedMonitors already set the precedent.
+   */
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    const templatesToDelete: Array<Model> = await this.findBy({
+      /*
+       * This hook runs BEFORE DatabaseService permission-checks the query, so
+       * a raw isRoot read of deleteBy.query would hand back other tenants'
+       * templates. Re-apply the caller's tenant, exactly as NetworkSiteService
+       * does for the same reason.
+       */
+      query: this.scopeQueryToCallerTenant(deleteBy.query, deleteBy.props),
+      select: {
+        _id: true,
+        name: true,
+        projectId: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const template of templatesToDelete) {
+      if (!template.id || !template.projectId) {
+        continue;
+      }
+
+      const linkedDeviceCount: number = await this.countLinkedDevices({
+        templateId: template.id,
+        projectId: template.projectId,
+      });
+
+      if (linkedDeviceCount > 0) {
+        throw new BadDataException(
+          `${template.name || "This OID Collection Template"} is still used by ${linkedDeviceCount} network device(s). Move those devices to another template, or clear their template, before deleting it.`,
+        );
+      }
+
+      /*
+       * Auto-import rules count too, and for the same reason.
+       *
+       * The FK there is also ON DELETE SET NULL, so deleting a template a rule
+       * still names does not fail - it silently turns that rule back into one
+       * that imports devices collecting nothing, and the next discovery scan
+       * quietly produces a fleet nobody configured. A rule can hold the last
+       * reference to a template with zero devices linked yet (it was created
+       * ahead of the scan), which is exactly when the device count alone says
+       * the delete is safe.
+       */
+      const linkedRuleCount: PositiveNumber =
+        await NetworkDeviceAutoImportRuleService.countBy({
+          query: {
+            projectId: template.projectId,
+            oidTemplateId: template.id,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+
+      if (linkedRuleCount.toNumber() > 0) {
+        throw new BadDataException(
+          `${template.name || "This OID Collection Template"} is still used by ${linkedRuleCount.toNumber()} auto-import rule(s). Clear it from those rules before deleting it, or devices they import will collect nothing.`,
+        );
+      }
+    }
+
+    return { deleteBy, carryForward: null };
+  }
+
+  /**
+   * How many devices collect this template's OIDs. Used by the template page
+   * and by the delete guard above.
+   */
+  @CaptureSpan()
+  public async countLinkedDevices(data: {
+    templateId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<number> {
+    const count: PositiveNumber = await NetworkDeviceService.countBy({
+      query: {
+        projectId: data.projectId,
+        oidTemplateId: data.templateId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return count.toNumber();
+  }
+
+  /*
+   * See NetworkSiteService for the full explanation: hooks run before
+   * ModelPermission scopes the caller's query, so anything a hook reads with
+   * isRoot has to be re-scoped by hand or it spans projects.
+   */
+  private scopeQueryToCallerTenant(
+    query: Query<Model>,
+    props: DatabaseCommonInteractionProps,
+  ): Query<Model> {
+    if (props.isRoot || !props.tenantId) {
+      return query;
+    }
+
+    return {
+      ...query,
+      projectId: props.tenantId,
+    };
+  }
+}
+
+export default new Service();

package/Server/Services/NetworkDeviceOwnerRuleEngineService.ts

@@ -11,6 +11,8 @@ import ObjectID from "../../Types/ObjectID";
 import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class NetworkDeviceOwnerRuleEngineServiceClass {
   /**
@@ -45,10 +47,16 @@ class NetworkDeviceOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "NetworkDeviceOwnerRule",
+        projectId: networkDevice.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/NetworkDeviceRoleService.ts

@@ -0,0 +1,90 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceRole";
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate } from "../Types/Database/Hooks";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import ObjectID from "../../Types/ObjectID";
+import BadDataException from "../../Types/Exception/BadDataException";
+import { buildUniqueDeviceRoleKey } from "../../Utils/NetworkDevice/DeviceRoleKeyUtil";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * Every role gets its stable key here, and only here.
+   *
+   * The key is not a form field - an operator names a role, they do not name
+   * its identifier - and it must never change afterwards, because it is what
+   * the SNMP classifier's answer and every stored topology payload match
+   * against. Deriving it at create time is therefore the whole of its
+   * lifecycle: the column's ColumnAccessControl grants create and update to
+   * nobody, so the API cannot set or move it either.
+   *
+   * The seeders pass an explicit key so the eleven built-in roles keep the
+   * exact identifiers the classifier emits ("wirelessAccessPoint" from
+   * "Wireless AP", which no derivation would produce). Anything else derives
+   * one from the name, de-duplicated against the keys the project already
+   * holds.
+   */
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.data.key) {
+      const projectId: ObjectID | undefined =
+        createBy.data.projectId || createBy.props.tenantId || undefined;
+
+      if (!projectId) {
+        throw new BadDataException(
+          "Project ID is required to create a network device role.",
+        );
+      }
+
+      createBy.data.key = buildUniqueDeviceRoleKey(
+        createBy.data.name || "",
+        await this.getKeysInProject(projectId),
+      );
+    }
+
+    return {
+      createBy: createBy,
+      carryForward: undefined,
+    };
+  }
+
+  /**
+   * Every role key already in use in this project, for uniqueness checks.
+   *
+   * Read as root: a member who may create a role must get a key that does not
+   * collide with one they are not allowed to see, and a partial view of the
+   * project's keys would hand them a duplicate the database then rejects.
+   */
+  public async getKeysInProject(projectId: ObjectID): Promise<Set<string>> {
+    const existing: Array<Model> = await this.findBy({
+      query: {
+        projectId: projectId,
+      },
+      select: {
+        key: true,
+      },
+      skip: 0,
+      limit: LIMIT_MAX,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const keys: Set<string> = new Set<string>();
+
+    for (const role of existing) {
+      if (role.key) {
+        keys.add(role.key);
+      }
+    }
+
+    return keys;
+  }
+}
+
+export default new Service();