@oneuptime/common 12.0.31 → 12.0.33

package/Server/Services/DatabaseService.ts

@@ -616,21 +616,51 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     throw PostgresErrorTranslator.translateException(error);
   }
 
+  /*
+   * Both halves of @SlugifyColumn are resolved BY NAME off the object rather
+   * than through the schema, so a name matching no declared column misfires
+   * silently: a missing source reads `undefined` and Slug.getSlug answers with
+   * a random Faker name, and a missing destination is assigned to a property
+   * TypeORM drops on insert. ModelRegistryInvariants sweeps every model for
+   * both, so the pairing is guaranteed by a test rather than by this code.
+   *
+   * The ceiling comes from the DESTINATION column, not from Slug: getSlug
+   * appends a dash and ten random digits, and checkMaxLengthOfFields -- which
+   * runs later in the same create -- THROWS on overflow rather than
+   * truncating. Sources are routinely wider than the slug they feed
+   * (Incident.title is varchar(500) against a varchar(100) slug), so without
+   * this a long title would be a failed insert rather than a long slug.
+   */
   private generateSlug(createBy: CreateBy<TBaseModel>): CreateBy<TBaseModel> {
-    if (createBy.data.getSlugifyColumn()) {
-      (createBy.data as any)[createBy.data.getSaveSlugToColumn() as string] =
-        Slug.getSlug(
-          (createBy.data as any)[createBy.data.getSlugifyColumn() as string]
-            ? ((createBy.data as any)[
-                createBy.data.getSlugifyColumn() as string
-              ] as string)
-            : null,
-        );
+    const slugifyColumn: string | null = createBy.data.getSlugifyColumn();
+    const saveSlugToColumn: string | null = createBy.data.getSaveSlugToColumn();
+
+    if (!slugifyColumn || !saveSlugToColumn) {
+      return createBy;
     }
 
+    const source: JSONValue = (createBy.data as any)[slugifyColumn];
+
+    (createBy.data as any)[saveSlugToColumn] = Slug.getSlug(
+      source ? String(source) : null,
+      this.getMaxLengthOfColumn(saveSlugToColumn),
+    );
+
     return createBy;
   }
 
+  /*
+   * The declared width of a column, or undefined for a column that declares
+   * none -- including a name that is not a column at all, which is what
+   * getTableColumnMetadata answers for.
+   */
+  private getMaxLengthOfColumn(columnName: string): number | undefined {
+    const columnType: TableColumnType | undefined =
+      this.model.getTableColumnMetadata(columnName)?.type;
+
+    return columnType ? getMaxLengthFromTableColumnType(columnType) : undefined;
+  }
+
   private async sanitizeCreateOrUpdate(
     data: TBaseModel | PartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,

package/Server/Services/EnterpriseLicenseInstanceService.ts

@@ -1,10 +1,207 @@
 import DatabaseService from "./DatabaseService";
 import EnterpriseLicenseInstance from "../../Models/DatabaseModels/EnterpriseLicenseInstance";
+import EnterpriseLicense from "../../Models/DatabaseModels/EnterpriseLicense";
+import EnterpriseLicenseService from "./EnterpriseLicenseService";
+import EnterpriseLicenseUsageUtil, {
+  EffectiveEnterpriseLicenseUserCount,
+} from "../../Utils/EnterpriseLicense/EnterpriseLicenseUsage";
+import EnterpriseLicenseUserCountSource from "../../Types/EnterpriseLicense/EnterpriseLicenseUserCountSource";
+import DeleteById from "../Types/Database/DeleteById";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import OneUptimeDate from "../../Types/Date";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import ObjectID from "../../Types/ObjectID";
+import PartialEntity from "../../Types/Database/PartialEntity";
+import ModelPermission from "../Types/Database/Permissions/Index";
 
 export class Service extends DatabaseService<EnterpriseLicenseInstance> {
   public constructor() {
     super(EnterpriseLicenseInstance);
   }
+
+  public override async deleteOneById(deleteById: DeleteById): Promise<number> {
+    /*
+     * A source marker is written before deleting some upgrade-era rows. Check
+     * permission first so a refused delete can never produce that write. The
+     * inherited deletion below deliberately performs its normal check again.
+     */
+    await ModelPermission.checkDeletePermissionByModel({
+      modelType: this.modelType,
+      fetchModelWithAccessControlIds: async () => {
+        return await this.findOneById({
+          id: deleteById.id,
+          select: {},
+          props: {
+            isRoot: true,
+          },
+        });
+      },
+      props: deleteById.props,
+    });
+
+    /*
+     * Resolve the owning license before taking its lock. The actual delete
+     * still goes through DatabaseService below with the caller's original
+     * props, so this root read does not bypass delete permission checks.
+     */
+    const instance: EnterpriseLicenseInstance | null = await this.findOneById({
+      id: deleteById.id,
+      select: {
+        enterpriseLicenseId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+    const licenseId: ObjectID | undefined = instance?.enterpriseLicenseId;
+
+    if (!licenseId) {
+      return await super.deleteOneById(deleteById);
+    }
+
+    return await EnterpriseLicenseService.runWithUsageAggregationLock({
+      licenseId,
+      fn: async (): Promise<number> => {
+        /*
+         * A report for this row uses the same lock. Re-read its provenance in
+         * the critical section so the fallback decision cannot race a report.
+         */
+        const lockedInstance: EnterpriseLicenseInstance | null =
+          await this.findOneById({
+            id: deleteById.id,
+            select: {
+              lastReportedAt: true,
+            },
+            props: {
+              isRoot: true,
+            },
+          });
+        const deletedTargetHadReportedUsage: boolean = Boolean(
+          lockedInstance?.lastReportedAt,
+        );
+
+        if (deletedTargetHadReportedUsage) {
+          const sourceLicense: EnterpriseLicense | null =
+            await EnterpriseLicenseService.findOneById({
+              id: licenseId,
+              select: {
+                userCountSource: true,
+              },
+              props: {
+                isRoot: true,
+              },
+            });
+
+          /*
+           * Old rows predate the persisted provenance column. Mark the stored
+           * aggregate before deleting its last evidence, so even a later
+           * aggregate-write failure cannot resurrect it as legacy usage.
+           */
+          if (sourceLicense && !sourceLicense.userCountSource) {
+            await EnterpriseLicenseService.updateOneById({
+              id: licenseId,
+              data: {
+                userCountSource: EnterpriseLicenseUserCountSource.Instance,
+              },
+              props: {
+                isRoot: true,
+                ignoreHooks: true,
+              },
+            });
+          }
+        }
+
+        const deletedCount: number = await super.deleteOneById(deleteById);
+
+        /*
+         * The row may have disappeared between the ownership lookup and lock
+         * acquisition. Preserve DatabaseService's zero-row result and avoid
+         * changing an aggregate for a deletion this call did not perform.
+         */
+        if (deletedCount === 0) {
+          return 0;
+        }
+
+        const now: Date = OneUptimeDate.getCurrentDate();
+        const remainingInstances: Array<EnterpriseLicenseInstance> =
+          await this.findBy({
+            query: {
+              enterpriseLicenseId: licenseId,
+            },
+            select: {
+              createdAt: true,
+              userCount: true,
+              userEmailHashes: true,
+              lastReportedAt: true,
+            },
+            sort: {
+              createdAt: SortOrder.Ascending,
+            },
+            skip: 0,
+            limit: LIMIT_MAX,
+            props: {
+              isRoot: true,
+            },
+          });
+        const license: EnterpriseLicense | null =
+          await EnterpriseLicenseService.findOneById({
+            id: licenseId,
+            select: {
+              currentUserCount: true,
+              userCountUpdatedAt: true,
+              userCountSource: true,
+              legacyUserCount: true,
+              legacyUserCountUpdatedAt: true,
+            },
+            props: {
+              isRoot: true,
+            },
+          });
+
+        if (!license) {
+          return deletedCount;
+        }
+
+        const effectiveUsage: EffectiveEnterpriseLicenseUserCount =
+          EnterpriseLicenseUsageUtil.getEffectiveUserCountAndSource({
+            instances: remainingInstances,
+            storedUserCount: license.currentUserCount,
+            storedUserCountUpdatedAt: license.userCountUpdatedAt,
+            storedUserCountSource:
+              license.userCountSource ||
+              (deletedTargetHadReportedUsage
+                ? EnterpriseLicenseUserCountSource.Instance
+                : undefined),
+            legacyUserCount: license.legacyUserCount,
+            legacyUserCountUpdatedAt: license.legacyUserCountUpdatedAt,
+            allowStoredUserCountAsLegacyFallback:
+              !deletedTargetHadReportedUsage,
+            now,
+          });
+
+        if (effectiveUsage.userCount !== null) {
+          const usageUpdate: PartialEntity<EnterpriseLicense> = {
+            currentUserCount: effectiveUsage.userCount,
+          };
+
+          if (effectiveUsage.source !== null) {
+            usageUpdate.userCountSource = effectiveUsage.source;
+          }
+
+          await EnterpriseLicenseService.updateOneById({
+            id: licenseId,
+            data: usageUpdate,
+            props: {
+              isRoot: true,
+              ignoreHooks: true,
+            },
+          });
+        }
+
+        return deletedCount;
+      },
+    });
+  }
 }
 
 export default new Service();

package/Server/Services/EnterpriseLicenseService.ts

@@ -5,12 +5,67 @@ import { MarketingEventType } from "../../Types/Marketing/MarketingEvent";
 import { OnCreate } from "../Types/Database/Hooks";
 import OneUptimeDate from "../../Types/Date";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ObjectID from "../../Types/ObjectID";
+import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
+import logger from "../Utils/Logger";
+
+export const ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_NAMESPACE: string =
+  "EnterpriseLicenseService.usageAggregation";
+
+export const ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_OPTIONS: Readonly<{
+  namespace: string;
+  lockTimeout: number;
+  acquireTimeout: number;
+}> = Object.freeze({
+  namespace: ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_NAMESPACE,
+  lockTimeout: 60_000,
+  acquireTimeout: 10_000,
+});
 
 export class Service extends DatabaseService<EnterpriseLicense> {
   public constructor() {
     super(EnterpriseLicense);
   }
 
+  /**
+   * Serialize usage aggregation for one enterprise license across every API
+   * and worker process. Callers must put the complete read-compute-write
+   * operation inside `fn`; locking only the write would leave the stale-read
+   * race intact.
+   */
+  public async runWithUsageAggregationLock<TResult>(data: {
+    licenseId: ObjectID;
+    fn: () => Promise<TResult>;
+  }): Promise<TResult> {
+    /*
+     * Acquisition is deliberately outside the callback try/finally. If Redis
+     * is unavailable or contention exceeds the bounded acquire timeout, the
+     * operation fails closed and there is no unowned mutex to release.
+     */
+    const mutex: SemaphoreMutex = await Semaphore.lock({
+      key: data.licenseId.toString(),
+      ...ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_OPTIONS,
+    });
+
+    try {
+      return await data.fn();
+    } finally {
+      try {
+        await Semaphore.release(mutex);
+      } catch (error) {
+        /*
+         * redis-semaphore refreshes held locks and lets them expire after the
+         * lock timeout if explicit release fails. Logging is best effort: a
+         * release error must not replace either the callback's value or its
+         * more useful error.
+         */
+        logger.error(
+          `Failed to release enterprise license usage aggregation lock for ${data.licenseId.toString()}; it will expire automatically: ${error}`,
+        );
+      }
+    }
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<EnterpriseLicense>,

package/Server/Services/Index.ts

@@ -62,6 +62,9 @@ import NetworkDeviceOwnerRuleService from "./NetworkDeviceOwnerRuleService";
 import NetworkDeviceLabelRuleService from "./NetworkDeviceLabelRuleService";
 import NetworkDeviceAutoImportRuleService from "./NetworkDeviceAutoImportRuleService";
 import NetworkDeviceOidTemplateService from "./NetworkDeviceOidTemplateService";
+import NetworkDeviceRoleService from "./NetworkDeviceRoleService";
+import NetworkAlertPolicyService from "./NetworkAlertPolicyService";
+import NetworkSnmpCredentialProfileService from "./NetworkSnmpCredentialProfileService";
 import NetworkDeviceDiscoveryScanService from "./NetworkDeviceDiscoveryScanService";
 import NetworkInterfaceService from "./NetworkInterfaceService";
 import NetworkSiteService from "./NetworkSiteService";
@@ -424,6 +427,9 @@ import IoTFleetLabelRuleService from "./IoTFleetLabelRuleService";
 import IoTFleetOwnerRuleService from "./IoTFleetOwnerRuleService";
 import IoTFleetOwnerTeamService from "./IoTFleetOwnerTeamService";
 import IoTFleetOwnerUserService from "./IoTFleetOwnerUserService";
+import UserNotificationEmailRollupItemService from "./UserNotificationEmailRollupItemService";
+import UserNotificationEmailRollupBatchService from "./UserNotificationEmailRollupBatchService";
+import UserNotificationEmailRollupSettingService from "./UserNotificationEmailRollupSettingService";
 
 const services: Array<BaseService> = [
   OnCallDutyPolicyTimeLogService,
@@ -508,6 +514,9 @@ const services: Array<BaseService> = [
   NetworkDeviceLabelRuleService,
   NetworkDeviceAutoImportRuleService,
   NetworkDeviceOidTemplateService,
+  NetworkDeviceRoleService,
+  NetworkAlertPolicyService,
+  NetworkSnmpCredentialProfileService,
   NetworkDeviceDiscoveryScanService,
   NetworkInterfaceService,
   NetworkSiteService,
@@ -846,6 +855,9 @@ const services: Array<BaseService> = [
   ServerlessFunctionOwnerTeamService,
   ServerlessFunctionOwnerUserService,
   WebhookLogService,
+  UserNotificationEmailRollupItemService,
+  UserNotificationEmailRollupBatchService,
+  UserNotificationEmailRollupSettingService,
 ];
 
 export const AnalyticsServices: Array<

package/Server/Services/MonitorService.ts

@@ -19,6 +19,8 @@ import MonitorStatusService from "./MonitorStatusService";
 import ServiceLevelObjectiveMonitorRuleEngineService from "./ServiceLevelObjectiveMonitorRuleEngineService";
 import StatusPageMonitorRuleEngineService from "./StatusPageMonitorRuleEngineService";
 import NetworkSiteService from "./NetworkSiteService";
+import NetworkDeviceService from "./NetworkDeviceService";
+import NetworkDevice from "../../Models/DatabaseModels/NetworkDevice";
 import MonitorStatusTimelineService, {
   MONITOR_STATUS_SAME_AS_PREVIOUS_ERROR_MESSAGE,
   MONITOR_STATUS_TIMELINE_LOCK_ERROR_MESSAGE,
@@ -237,6 +239,21 @@ export class Service extends DatabaseService<Model> {
             monitorDestination = `${sql.host}:${sql.port}/${sql.databaseName}`;
           }
         }
+
+        // For Database Health monitors, show host:port/database (never the credentials).
+        if (
+          monitorType === MonitorType.Database &&
+          firstStep?.data?.databaseMonitor
+        ) {
+          const database: {
+            host: string;
+            port: number;
+            databaseName: string;
+          } = firstStep.data.databaseMonitor;
+          if (database.host) {
+            monitorDestination = `${database.host}:${database.port}/${database.databaseName}`;
+          }
+        }
       }
     }
 
@@ -296,6 +313,7 @@ export class Service extends DatabaseService<Model> {
       id: monitorId,
       select: {
         _id: true,
+        projectId: true,
         currentMonitorStatusId: true,
       },
       props: {
@@ -313,6 +331,7 @@ export class Service extends DatabaseService<Model> {
         select: {
           _id: true,
           monitorStatusId: true,
+          projectId: true,
         },
         props: {
           isRoot: true,
@@ -343,6 +362,39 @@ export class Service extends DatabaseService<Model> {
           isRoot: true,
         },
       });
+
+      /*
+       * The update above is root (no tenantId), so onUpdateSuccess's
+       * tenant-gated changeMonitorStatus does not run for it and nothing
+       * else re-stamps the network devices bound to this monitor. Bridge
+       * them here, and only when the id actually moved - an unchanged
+       * status must not churn every site rollup above the device.
+       */
+      const projectId: ObjectID | undefined =
+        monitor.projectId || lastMonitorStatus.projectId;
+
+      if (!projectId) {
+        logger.warn(
+          `refreshMonitorCurrentStatus: monitor ${monitorId.toString()} has no projectId; skipping the network site rollup bridge.`,
+        );
+        return;
+      }
+
+      try {
+        await NetworkSiteService.onMonitorStatusChanged({
+          projectId: projectId,
+          monitorIds: [monitorId],
+          monitorStatusId: lastMonitorStatus.monitorStatusId,
+        });
+      } catch (err) {
+        logger.error(
+          `refreshMonitorCurrentStatus: failed to update network site rollups for monitor ${monitorId.toString()}: ${err}`,
+          {
+            projectId: projectId.toString(),
+            monitorId: monitorId.toString(),
+          } as LogAttributes,
+        );
+      }
     }
   }
 
@@ -408,10 +460,65 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * Network devices bound to these monitors (NetworkDevice.monitorId, the
+     * monitor-backed path). The FK is ON DELETE SET NULL, so the binding
+     * disappears with the monitor - but the device's stamped
+     * currentMonitorStatusId / isReachable do not, and nothing else ever
+     * clears them: the device would keep reporting the dead monitor's last
+     * status forever. The ids have to be read BEFORE the delete, because
+     * after it the column that links them is already NULL.
+     *
+     * A lookup failure degrades to "no re-stamp" rather than blocking the
+     * delete itself: a device carrying a stale stamp is a cosmetic bug, a
+     * monitor the operator cannot delete is not.
+     */
+    let networkDeviceIdsToRefresh: Array<ObjectID> = [];
+
+    const monitorIdsPendingDeletion: Array<ObjectID> = monitorsPendingDeletion
+      .map((monitor: Model) => {
+        return monitor.id;
+      })
+      .filter((id: ObjectID | null): id is ObjectID => {
+        return Boolean(id);
+      });
+
+    if (monitorIdsPendingDeletion.length > 0) {
+      try {
+        const boundDevices: Array<NetworkDevice> =
+          await NetworkDeviceService.findBy({
+            query: {
+              monitorId: QueryHelper.any(monitorIdsPendingDeletion),
+            },
+            select: {
+              _id: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+              isRoot: true,
+            },
+          });
+
+        networkDeviceIdsToRefresh = boundDevices
+          .map((device: NetworkDevice) => {
+            return device.id;
+          })
+          .filter((id: ObjectID | null): id is ObjectID => {
+            return Boolean(id);
+          });
+      } catch (error) {
+        logger.error(
+          `Error while looking up network devices bound to monitors pending deletion: ${error}`,
+        );
+      }
+    }
+
     return {
       deleteBy,
       carryForward: {
         monitors: monitorsPendingDeletion,
+        networkDeviceIdsToRefresh: networkDeviceIdsToRefresh,
       },
     };
   }
@@ -434,6 +541,34 @@ export class Service extends DatabaseService<Model> {
      * A synchronous ALTER TABLE … DELETE on every monitor deletion is both
      * redundant and expensive.
      */
+
+    /*
+     * Re-derive the stamp of every device that was bound to a deleted
+     * monitor. The FK has nulled NetworkDevice.monitorId by now, so for a
+     * monitor-backed device this resolves to "nothing bound": stamp and
+     * isReachable both go to NULL (the device honestly reads Pending) and
+     * its site chain is recomputed. clearWhenNotMonitorBacked is false on
+     * purpose - an SNMP device's stamp comes from the Network Device monitor
+     * watching its walk, not from this column, and is not ours to clear.
+     * Per device and never propagating: one failed refresh must not stop the
+     * rest, nor fail a delete that has already happened.
+     */
+    const networkDeviceIdsToRefresh: Array<ObjectID> =
+      onDelete.carryForward?.networkDeviceIdsToRefresh || [];
+
+    for (const deviceId of networkDeviceIdsToRefresh) {
+      try {
+        await NetworkDeviceService.refreshStampedMonitorStatus({
+          deviceId: deviceId,
+          clearWhenNotMonitorBacked: false,
+        });
+      } catch (error) {
+        logger.error(
+          `Error while refreshing the stamped monitor status of network device ${deviceId.toString()} after its monitor was deleted: ${error}`,
+        );
+      }
+    }
+
     if (onDelete.deleteBy.props.tenantId && IsBillingEnabled) {
       try {
         await ActiveMonitoringMeteredPlan.reportQuantityToBillingProvider(
@@ -2578,6 +2713,14 @@ ${createdItem.description?.trim() || "No description provided."}
         statusTimeline.startsAt = startsAt;
       }
 
+      /*
+       * The network-site rollup bridge (stamping the NetworkDevices these
+       * monitors report on and refreshing their sites) is NOT called from
+       * here. It runs inside MonitorStatusTimelineService.onCreateSuccess,
+       * which this create reaches, so calling it here as well stamped every
+       * device twice - and that hook is the only place the PROBE path
+       * (which never comes through changeMonitorStatus) passes through.
+       */
       await this.createStatusTimelineWithRetry({
         statusTimeline: statusTimeline,
         props: props,
@@ -2585,27 +2728,6 @@ ${createdItem.description?.trim() || "No description provided."}
         monitorId: monitorId,
       });
     }
-
-    /*
-     * Bridge to the network-site rollup engine: stamp the NetworkDevices
-     * these monitors poll and refresh their sites' worst-of status.
-     * Resilient by contract - a rollup failure can never break a monitor
-     * status change (onMonitorStatusChanged also catches internally).
-     */
-    try {
-      await NetworkSiteService.onMonitorStatusChanged({
-        projectId: projectId,
-        monitorIds: monitorIds,
-        monitorStatusId: monitorStatusId,
-      });
-    } catch (err) {
-      logger.error(
-        `changeMonitorStatus: failed to update network site rollups: ${err}`,
-        {
-          projectId: projectId.toString(),
-        } as LogAttributes,
-      );
-    }
   }
 
   /*