@oneuptime/common 12.0.31 → 12.0.32

package/Models/DatabaseModels/StatusPagePrivateUser.ts

@@ -14,7 +14,6 @@ import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import EnableWorkflow from "../../Types/Database/EnableWorkflow";
-import SlugifyColumn from "../../Types/Database/SlugifyColumn";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
 import TableMetadata from "../../Types/Database/TableMetadata";
@@ -78,7 +77,6 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
   read: true,
 })
 @CrudApiEndpoint(new Route("/status-page-private-user"))
-@SlugifyColumn("name", "slug")
 @TableMetadata({
   tableName: "StatusPagePrivateUser",
   singularName: "Status Page Private User",

package/Models/DatabaseModels/StatusPageResource.ts

@@ -15,7 +15,6 @@ import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import EnableWorkflow from "../../Types/Database/EnableWorkflow";
-import SlugifyColumn from "../../Types/Database/SlugifyColumn";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
 import TableMetadata from "../../Types/Database/TableMetadata";
@@ -72,7 +71,6 @@ import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
   read: true,
 })
 @CrudApiEndpoint(new Route("/status-page-resource"))
-@SlugifyColumn("name", "slug")
 @TableMetadata({
   tableName: "StatusPageResource",
   singularName: "Status Page Resource",

package/Models/DatabaseModels/StatusPageSubscriber.ts

@@ -14,7 +14,6 @@ import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import EnableWorkflow from "../../Types/Database/EnableWorkflow";
-import SlugifyColumn from "../../Types/Database/SlugifyColumn";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
 import TableMetadata from "../../Types/Database/TableMetadata";
@@ -82,7 +81,6 @@ import StatusPageEventType from "../../Types/StatusPage/StatusPageEventType";
   ],
 })
 @CrudApiEndpoint(new Route("/status-page-subscriber"))
-@SlugifyColumn("name", "slug")
 @TableMetadata({
   tableName: "StatusPageSubscriber",
   singularName: "Status Page Subscriber",

package/Server/Infrastructure/Postgres/SchemaMigrations/1790800000000-AddNetworkDeviceRoleTable.ts

@@ -0,0 +1,72 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Device roles become a per-project lookup instead of a fixed union.
+ *
+ * "deviceRole" (the inline string on NetworkDevice) is NOT touched here: the
+ * BackfillNetworkDeviceRoles data migration still reads it to point every
+ * device that has one at its new NetworkDeviceRole row. It is dropped in a
+ * follow-up once that backfill has run everywhere.
+ *
+ * networkDeviceRoleId is ON DELETE SET NULL on purpose. Deleting a role from
+ * the project's settings must not delete the devices using it - they simply go
+ * back to being classified from their own SNMP identity, which is exactly what
+ * a NULL role has always meant.
+ */
+export class AddNetworkDeviceRoleTable1790800000000
+  implements MigrationInterface
+{
+  public name: string = "AddNetworkDeviceRoleTable1790800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceRole" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "slug" character varying(100) NOT NULL, "key" character varying(100) NOT NULL, "description" character varying(500), "topologyShape" character varying(100), "isCoreLayer" boolean NOT NULL DEFAULT false, "isSnmpWalkable" boolean NOT NULL DEFAULT true, "order" integer, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_10fb79a5d66950e4a9c6d774d07" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_188009b80d1281f1d7ccecdf74" ON "NetworkDeviceRole" ("projectId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "networkDeviceRoleId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_41f59fed52c5ec4ff6a2725ad9" ON "NetworkDevice" ("networkDeviceRoleId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" ADD CONSTRAINT "FK_188009b80d1281f1d7ccecdf74d" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" ADD CONSTRAINT "FK_9860e7a5b4d23cf1c4192c468cd" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" ADD CONSTRAINT "FK_9dc66fa19636ba160af1521f45d" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD CONSTRAINT "FK_41f59fed52c5ec4ff6a2725ad9a" FOREIGN KEY ("networkDeviceRoleId") REFERENCES "NetworkDeviceRole"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP CONSTRAINT "FK_41f59fed52c5ec4ff6a2725ad9a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" DROP CONSTRAINT "FK_9dc66fa19636ba160af1521f45d"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" DROP CONSTRAINT "FK_9860e7a5b4d23cf1c4192c468cd"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" DROP CONSTRAINT "FK_188009b80d1281f1d7ccecdf74d"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_41f59fed52c5ec4ff6a2725ad9"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "networkDeviceRoleId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_188009b80d1281f1d7ccecdf74"`,
+    );
+    await queryRunner.query(`DROP TABLE "NetworkDeviceRole"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -566,6 +566,7 @@ import { AddCertificateReissueRequestedAtToDomains1790300000000 } from "./179030
 import { AddOnCallCalendarFeeds1790400000000 } from "./1790400000000-AddOnCallCalendarFeeds";
 import { AddNetworkDeviceOidTemplate1790500000000 } from "./1790500000000-AddNetworkDeviceOidTemplate";
 import { AddAutoImportRuleOidTemplate1790600000000 } from "./1790600000000-AddAutoImportRuleOidTemplate";
+import { AddNetworkDeviceRoleTable1790800000000 } from "./1790800000000-AddNetworkDeviceRoleTable";
 
 export default [
   InitialMigration,
@@ -1136,4 +1137,5 @@ export default [
   AddOnCallCalendarFeeds1790400000000,
   AddNetworkDeviceOidTemplate1790500000000,
   AddAutoImportRuleOidTemplate1790600000000,
+  AddNetworkDeviceRoleTable1790800000000,
 ];

package/Server/Services/DatabaseService.ts

@@ -616,21 +616,51 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     throw PostgresErrorTranslator.translateException(error);
   }
 
+  /*
+   * Both halves of @SlugifyColumn are resolved BY NAME off the object rather
+   * than through the schema, so a name matching no declared column misfires
+   * silently: a missing source reads `undefined` and Slug.getSlug answers with
+   * a random Faker name, and a missing destination is assigned to a property
+   * TypeORM drops on insert. ModelRegistryInvariants sweeps every model for
+   * both, so the pairing is guaranteed by a test rather than by this code.
+   *
+   * The ceiling comes from the DESTINATION column, not from Slug: getSlug
+   * appends a dash and ten random digits, and checkMaxLengthOfFields -- which
+   * runs later in the same create -- THROWS on overflow rather than
+   * truncating. Sources are routinely wider than the slug they feed
+   * (Incident.title is varchar(500) against a varchar(100) slug), so without
+   * this a long title would be a failed insert rather than a long slug.
+   */
   private generateSlug(createBy: CreateBy<TBaseModel>): CreateBy<TBaseModel> {
-    if (createBy.data.getSlugifyColumn()) {
-      (createBy.data as any)[createBy.data.getSaveSlugToColumn() as string] =
-        Slug.getSlug(
-          (createBy.data as any)[createBy.data.getSlugifyColumn() as string]
-            ? ((createBy.data as any)[
-                createBy.data.getSlugifyColumn() as string
-              ] as string)
-            : null,
-        );
+    const slugifyColumn: string | null = createBy.data.getSlugifyColumn();
+    const saveSlugToColumn: string | null = createBy.data.getSaveSlugToColumn();
+
+    if (!slugifyColumn || !saveSlugToColumn) {
+      return createBy;
     }
 
+    const source: JSONValue = (createBy.data as any)[slugifyColumn];
+
+    (createBy.data as any)[saveSlugToColumn] = Slug.getSlug(
+      source ? String(source) : null,
+      this.getMaxLengthOfColumn(saveSlugToColumn),
+    );
+
     return createBy;
   }
 
+  /*
+   * The declared width of a column, or undefined for a column that declares
+   * none -- including a name that is not a column at all, which is what
+   * getTableColumnMetadata answers for.
+   */
+  private getMaxLengthOfColumn(columnName: string): number | undefined {
+    const columnType: TableColumnType | undefined =
+      this.model.getTableColumnMetadata(columnName)?.type;
+
+    return columnType ? getMaxLengthFromTableColumnType(columnType) : undefined;
+  }
+
   private async sanitizeCreateOrUpdate(
     data: TBaseModel | PartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,

package/Server/Services/Index.ts

@@ -62,6 +62,7 @@ import NetworkDeviceOwnerRuleService from "./NetworkDeviceOwnerRuleService";
 import NetworkDeviceLabelRuleService from "./NetworkDeviceLabelRuleService";
 import NetworkDeviceAutoImportRuleService from "./NetworkDeviceAutoImportRuleService";
 import NetworkDeviceOidTemplateService from "./NetworkDeviceOidTemplateService";
+import NetworkDeviceRoleService from "./NetworkDeviceRoleService";
 import NetworkDeviceDiscoveryScanService from "./NetworkDeviceDiscoveryScanService";
 import NetworkInterfaceService from "./NetworkInterfaceService";
 import NetworkSiteService from "./NetworkSiteService";
@@ -508,6 +509,7 @@ const services: Array<BaseService> = [
   NetworkDeviceLabelRuleService,
   NetworkDeviceAutoImportRuleService,
   NetworkDeviceOidTemplateService,
+  NetworkDeviceRoleService,
   NetworkDeviceDiscoveryScanService,
   NetworkInterfaceService,
   NetworkSiteService,

package/Server/Services/NetworkDeviceRoleService.ts

@@ -0,0 +1,90 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/NetworkDeviceRole";
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate } from "../Types/Database/Hooks";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import ObjectID from "../../Types/ObjectID";
+import BadDataException from "../../Types/Exception/BadDataException";
+import { buildUniqueDeviceRoleKey } from "../../Utils/NetworkDevice/DeviceRoleKeyUtil";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * Every role gets its stable key here, and only here.
+   *
+   * The key is not a form field - an operator names a role, they do not name
+   * its identifier - and it must never change afterwards, because it is what
+   * the SNMP classifier's answer and every stored topology payload match
+   * against. Deriving it at create time is therefore the whole of its
+   * lifecycle: the column's ColumnAccessControl grants create and update to
+   * nobody, so the API cannot set or move it either.
+   *
+   * The seeders pass an explicit key so the eleven built-in roles keep the
+   * exact identifiers the classifier emits ("wirelessAccessPoint" from
+   * "Wireless AP", which no derivation would produce). Anything else derives
+   * one from the name, de-duplicated against the keys the project already
+   * holds.
+   */
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.data.key) {
+      const projectId: ObjectID | undefined =
+        createBy.data.projectId || createBy.props.tenantId || undefined;
+
+      if (!projectId) {
+        throw new BadDataException(
+          "Project ID is required to create a network device role.",
+        );
+      }
+
+      createBy.data.key = buildUniqueDeviceRoleKey(
+        createBy.data.name || "",
+        await this.getKeysInProject(projectId),
+      );
+    }
+
+    return {
+      createBy: createBy,
+      carryForward: undefined,
+    };
+  }
+
+  /**
+   * Every role key already in use in this project, for uniqueness checks.
+   *
+   * Read as root: a member who may create a role must get a key that does not
+   * collide with one they are not allowed to see, and a partial view of the
+   * project's keys would hand them a duplicate the database then rejects.
+   */
+  public async getKeysInProject(projectId: ObjectID): Promise<Set<string>> {
+    const existing: Array<Model> = await this.findBy({
+      query: {
+        projectId: projectId,
+      },
+      select: {
+        key: true,
+      },
+      skip: 0,
+      limit: LIMIT_MAX,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const keys: Set<string> = new Set<string>();
+
+    for (const role of existing) {
+      if (role.key) {
+        keys.add(role.key);
+      }
+    }
+
+    return keys;
+  }
+}
+
+export default new Service();

package/Server/Services/ProjectService.ts

@@ -34,6 +34,7 @@ import IncidentStateService from "./IncidentStateService";
 import IncidentRoleService from "./IncidentRoleService";
 import MailService from "./MailService";
 import MonitorStatusService from "./MonitorStatusService";
+import NetworkDeviceRoleService from "./NetworkDeviceRoleService";
 import NetworkSiteTypeService from "./NetworkSiteTypeService";
 import NotificationService from "./NotificationService";
 import PromoCodeService from "./PromoCodeService";
@@ -79,6 +80,11 @@ import IncidentRole from "../../Models/DatabaseModels/IncidentRole";
 import MonitorStatus from "../../Models/DatabaseModels/MonitorStatus";
 import NetworkSiteType from "../../Models/DatabaseModels/NetworkSiteType";
 import DefaultNetworkSiteType from "../../Types/NetworkSite/DefaultNetworkSiteType";
+import NetworkDeviceRole from "../../Models/DatabaseModels/NetworkDeviceRole";
+import {
+  DEFAULT_NETWORK_DEVICE_ROLES,
+  DefaultNetworkDeviceRole,
+} from "../../Types/NetworkDevice/DefaultNetworkDeviceRole";
 import Model from "../../Models/DatabaseModels/Project";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import PromoCode from "../../Models/DatabaseModels/PromoCode";
@@ -1444,6 +1450,7 @@ These are no longer recorded against the project and have to be cancelled by han
       this.addDefaultAlertState(createdItem),
       this.addDefaultIncidentRoles(createdItem),
       this.addDefaultNetworkSiteTypes(createdItem),
+      this.addDefaultNetworkDeviceRoles(createdItem),
     ]);
 
     if (createdItem.createdOwnerEmail) {
@@ -2007,6 +2014,84 @@ These are no longer recorded against the project and have to be cancelled by han
     return createdItem;
   }
 
+  /**
+   * Seeds the per-project network device role lookup table.
+   *
+   * Device roles used to be a fixed union with the label, the silhouette and
+   * the "is this a core device?" flag hardcoded in three different modules.
+   * They are now a configurable per-project table, so a project can rename
+   * "Wireless AP" to "Access Point", draw firewalls as something else, or add
+   * a role of its own - which means every project needs its own seeded copy of
+   * the defaults.
+   *
+   * Public for the same reason addDefaultNetworkSiteTypes is: the
+   * BackfillNetworkDeviceRoles data migration calls it to seed roles into
+   * projects that existed before the table did, so the defaults are defined
+   * once and cannot drift between project creation and the backfill.
+   *
+   * The key is passed explicitly rather than derived from the name. It has to
+   * be exactly what the SNMP classifier emits - "wirelessAccessPoint", which
+   * no derivation from "Wireless AP" would produce - or a classified access
+   * point would match no row.
+   */
+  @CaptureSpan()
+  public async addDefaultNetworkDeviceRoles(
+    createdItem: Model,
+  ): Promise<Model> {
+    const projectId: ObjectID = createdItem.id!;
+
+    // Idempotent - see getExistingProjectScopedNames.
+    const existingNames: Set<string | undefined> =
+      await this.getExistingProjectScopedNames(
+        NetworkDeviceRoleService,
+        projectId,
+      );
+
+    /*
+     * Also guarded on the key, not just the name: a project that renamed the
+     * seeded "Router" to "Edge Router" must not get a second row called
+     * "Router" the next time this runs, and the key is the identity that
+     * survives the rename.
+     */
+    const existingKeys: Set<string> =
+      await NetworkDeviceRoleService.getKeysInProject(projectId);
+
+    for (
+      let index: number = 0;
+      index < DEFAULT_NETWORK_DEVICE_ROLES.length;
+      index++
+    ) {
+      const defaultRole: DefaultNetworkDeviceRole =
+        DEFAULT_NETWORK_DEVICE_ROLES[index]!;
+
+      if (
+        existingNames.has(defaultRole.name) ||
+        existingKeys.has(defaultRole.key)
+      ) {
+        continue;
+      }
+
+      const networkDeviceRole: NetworkDeviceRole = new NetworkDeviceRole();
+      networkDeviceRole.name = defaultRole.name;
+      networkDeviceRole.key = defaultRole.key;
+      networkDeviceRole.description = defaultRole.description;
+      networkDeviceRole.topologyShape = defaultRole.topologyShape;
+      networkDeviceRole.isCoreLayer = defaultRole.isCoreLayer;
+      networkDeviceRole.isSnmpWalkable = defaultRole.isSnmpWalkable;
+      networkDeviceRole.projectId = projectId;
+      networkDeviceRole.order = index + 1;
+
+      await NetworkDeviceRoleService.create({
+        data: networkDeviceRole,
+        props: {
+          isRoot: true,
+        },
+      });
+    }
+
+    return createdItem;
+  }
+
   private async addDefaultProjectTeams(createdItem: Model): Promise<Model> {
     // add a team member.
 

package/Server/Services/UserNotificationSettingService.ts

@@ -800,12 +800,6 @@ export class Service extends DatabaseService<UserNotificationSetting> {
     userId: ObjectID,
     projectId: ObjectID,
   ): Promise<void> {
-    await this.addNotificationSettingIfNotExists(
-      userId,
-      projectId,
-      NotificationSettingEventType.SEND_MONITOR_STATUS_CHANGED_OWNER_NOTIFICATION,
-    );
-
     await this.addNotificationSettingIfNotExists(
       userId,
       projectId,

package/Tests/App/Dashboard/AddNeighborToMonitoringModal.test.tsx

@@ -128,12 +128,26 @@ const SECOND_SWITCH_NODE: NetworkTopologyNode = {
   status: "up",
 };
 
+/*
+ * Carries the role stamp the topology builder puts on a node now that roles
+ * are per-project rows: `roleId` is the project's row for the classified role,
+ * and it is what the form can actually preselect - the role is a relation, and
+ * a form cannot resolve a key to a row.
+ */
+const PHONE_ROLE_ID: string = "b7a1a0f6-3a4b-4a0e-9c3f-4f1f7f2a91cd";
+
+const SWITCH_ROLE_ID: string = "0c2d5b41-9f22-4a3e-8f61-2d7c6a4e8b03";
+
 const PHONE_NODE: NetworkTopologyNode = {
   id: "unmanaged:sep6026aaf2b46b",
   name: "SEP6026AAF2B46B",
   isManaged: false,
   kind: "unmanaged",
   role: "phone",
+  roleKey: "phone",
+  roleLabel: "IP phone",
+  roleId: PHONE_ROLE_ID,
+  isSnmpWalkableRole: false,
   status: "unknown",
   deviceModel: "Cisco IP Phone 8811",
   ipAddress: "10.0.12.41",
@@ -227,7 +241,12 @@ describe("the Add to Monitoring dialog", () => {
   test("opens on the role the map classified the device as", async () => {
     const props: CapturedModalProps = await openDialog();
 
-    expect(props.initialValues["deviceRole"]).toBe("phone");
+    /*
+     * The row's id, not the classifier's key: the role is a relation to the
+     * project's own NetworkDeviceRole table, so this is what the picker binds
+     * to and what a rename or a custom role travels through.
+     */
+    expect(props.initialValues["networkDeviceRole"]).toBe(PHONE_ROLE_ID);
   });
 
   /*
@@ -297,7 +316,18 @@ describe("the Add to Monitoring dialog", () => {
   test("inherits a probe for a device that will be polled", async () => {
     const props: CapturedModalProps = await openDialog({
       ...PHONE_NODE,
+      /*
+       * The whole role stamp, not just `role`: the configured
+       * isSnmpWalkableRole is what decides the monitoring method now, and the
+       * phone fixture carries the handset's (false). Overriding only the
+       * built-in role would leave the flag saying "nothing will poll this",
+       * which is the opposite of what this test is about.
+       */
       role: "switch",
+      roleKey: "switch",
+      roleLabel: "Switch",
+      roleId: SWITCH_ROLE_ID,
+      isSnmpWalkableRole: true,
     });
 
     expect(props.initialValues["monitoringMethod"]).toBe("SNMP");

package/Tests/App/Dashboard/DashboardChartWidgetZoom.test.tsx

@@ -20,13 +20,23 @@ import * as React from "react";
 import getJestMockFunction, { MockFunction } from "../../MockType";
 
 /*
- * Drag-to-zoom on a dashboard chart widget is the "investigate this
- * spike" entry point: selecting a window must narrow THIS widget only
- * (never the dashboard-wide range), refetch for the narrowed window, and
- * offer a way back (Reset) and a way deeper (Open in Explorer, carrying
- * the zoomed window). Edit mode must not zoom — the drag gesture belongs
- * to widget move/resize there, and series pivots would navigate away from
- * unsaved dashboard changes.
+ * The chart widget's STANDALONE fallback: what drag-to-zoom does when the
+ * host hands down no onDashboardTimeRangeSelect — the edit-mode settings
+ * preview, and any future surface that mounts the widget without owning a
+ * time range. Selecting a window narrows THIS widget, refetches for the
+ * narrowed window, and offers a way back (Reset) and a way deeper (Open in
+ * Explorer, carrying the zoomed window).
+ *
+ * On a real dashboard the shell DOES take the drag and the whole board
+ * retimes (issue #3530) — that contract lives in
+ * DashboardWideChartZoom.test.tsx. Both paths are pinned because the
+ * widget picks between them purely on whether the callback prop is
+ * present, and a host that forgets to pass it should degrade to this
+ * rather than lose the gesture.
+ *
+ * Edit mode must not zoom either way — the drag gesture belongs to widget
+ * move/resize there, and series pivots would navigate away from unsaved
+ * dashboard changes.
  */
 
 const fetchResultsMock: MockFunction = getJestMockFunction();
@@ -215,7 +225,24 @@ afterEach(() => {
   cleanup();
 });
 
-describe("dashboard chart widget drag-to-zoom", () => {
+describe("dashboard chart widget drag-to-zoom (standalone fallback)", () => {
+  test("the fallback is what runs when the host offers no dashboard-wide zoom", async () => {
+    renderWidget();
+
+    await waitFor(() => {
+      expect(screen.getByTestId("metric-charts")).toBeInTheDocument();
+    });
+
+    /*
+     * Guards the branch this whole suite depends on: these props are the
+     * switch between narrowing this widget and retiming the board, and
+     * buildBaseProps deliberately leaves them off.
+     */
+    const baseProps: DashboardBaseComponentProps = buildBaseProps();
+    expect(baseProps.onDashboardTimeRangeSelect).toBeUndefined();
+    expect(baseProps.onDashboardTimeRangeReset).toBeUndefined();
+  });
+
   test("drag-selecting a window refetches THIS widget for that window and shows the zoom bar", async () => {
     renderWidget();