@oneuptime/common 12.0.31 → 12.0.33

package/Types/Monitor/SnmpMonitor/NetworkDeviceAlertPack.ts

@@ -26,7 +26,7 @@ const PACK: Array<NetworkDeviceAlertPackItem> = [
   {
     name: "Device unreachable",
     description:
-      "The device stopped answering SNMP — likely down or unreachable.",
+      "The device stopped answering ping and SNMP — likely down or unreachable.",
     filters: [
       {
         checkOn: CheckOn.SnmpIsOnline,
@@ -37,6 +37,27 @@ const PACK: Array<NetworkDeviceAlertPackItem> = [
     createIncidents: true,
     createAlerts: false,
   },
+  /*
+   * An alert, not an incident: the device is still answering ping, so it is
+   * not down - but its SNMP walk is failing, which means no interfaces, no
+   * inventory and no health OIDs until someone fixes the credentials, the
+   * agent or the ACL. Never fires on a device that is only pinged: the
+   * criterion is not evaluated at all when no walk ran.
+   */
+  {
+    name: "SNMP walk failing",
+    description:
+      "The device answers ping but its SNMP walk is failing — check the credentials, the SNMP agent, or an ACL.",
+    filters: [
+      {
+        checkOn: CheckOn.SnmpWalkIsSucceeding,
+        filterType: FilterType.False,
+        value: undefined,
+      },
+    ],
+    createIncidents: false,
+    createAlerts: true,
+  },
   {
     name: "Interface down",
     description:

package/Types/Monitor/SnmpMonitor/NetworkTopology.ts

@@ -57,6 +57,25 @@ export type NetworkTopologyDeviceRole =
   | "host"
   | "unknown";
 
+/*
+ * The silhouette a node is drawn with on the topology map.
+ *
+ * It lives here, next to the roles, rather than in the renderer that owns
+ * the geometry, because a project's device roles are configurable
+ * (NetworkDeviceRole) and each one stores the shape it is drawn with. The
+ * renderer re-exports this type, so every existing import of it still
+ * resolves to exactly this union.
+ */
+export type NetworkTopologyNodeShape =
+  | "circle"
+  | "rounded-square"
+  | "diamond"
+  | "triangle"
+  | "hexagon"
+  | "tower"
+  | "cylinder"
+  | "rect";
+
 /*
  * Why a device is drawn with no links.
  *
@@ -100,6 +119,48 @@ export interface NetworkTopologyNode {
    * name one — readers must treat both the same way.
    */
   role?: NetworkTopologyDeviceRole | undefined;
+  /*
+   * The project's OWN role for this node, from the configurable
+   * NetworkDeviceRole table (Network > Settings > Device Roles).
+   *
+   * `role` above is the built-in vocabulary the classifier speaks and can
+   * only ever be one of the twelve values in NetworkTopologyDeviceRole.
+   * A project may rename those roles or add roles of its own ("PoS
+   * Terminal", "SD-WAN Edge"), and neither survives that union — so the
+   * four fields here carry the configured answer alongside it.
+   *
+   * They are additive and every one of them is optional: a payload built
+   * before this existed, or for a project with no roles configured, simply
+   * omits them and every reader falls back to `role` exactly as before.
+   * When present they WIN, because they are what the operator configured.
+   *
+   * `roleKey` is the role's stable key — the built-in key ("switch") for a
+   * built-in role however it has been renamed, or a derived key for a
+   * custom one. It is what the legend groups by and what search matches.
+   */
+  roleKey?: string | undefined;
+  // The configured display name, e.g. "Edge Router" for a renamed "router".
+  roleLabel?: string | undefined;
+  // The configured silhouette. Falls back to the built-in shape for `role`.
+  roleShape?: NetworkTopologyNodeShape | undefined;
+  /*
+   * Whether devices of this role sit at the top of the network. Load-bearing:
+   * the tiered and radial layouts band by it, so a custom role can be placed
+   * at core level without the layout having to recognise its name.
+   */
+  isCoreLayerRole?: boolean | undefined;
+  /*
+   * Whether devices of this role are worth walking with SNMP. Read by the
+   * adopt-a-neighbour flow to decide whether it opens on SNMP polling or on
+   * a monitor.
+   */
+  isSnmpWalkableRole?: boolean | undefined;
+  /*
+   * The NetworkDeviceRole row's id, so a form can preselect the role the map
+   * already shows without resolving the key itself. Absent when the project
+   * has no row for this role.
+   */
+  roleId?: string | undefined;
   interfacesUp?: number | undefined;
   interfacesDown?: number | undefined;
   // Extra device identity for search and the detail panel (managed nodes).

package/Types/Monitor/SqlConnectionConfig.ts

@@ -0,0 +1,31 @@
+import SqlDatabaseType from "./SqlDatabaseType";
+
+/*
+ * The connection half of a SQL-speaking monitor's configuration.
+ *
+ * Extracted so the SQL Query monitor and the Database Health monitor can
+ * share one implementation of the fiddly parts - TLS options, and especially
+ * the SQL Server integrated-authentication path, which has to detect the
+ * host's ODBC driver and build a connection string by hand. Duplicating that
+ * for a second monitor type would guarantee the two drift.
+ *
+ * Both MonitorStepSqlMonitor and MonitorStepDatabaseMonitor extend this, so
+ * anything that only needs to CONNECT should take this type rather than
+ * either step type.
+ */
+export default interface SqlConnectionConfig {
+  databaseType: SqlDatabaseType;
+  host: string;
+  port: number;
+  databaseName: string;
+  username: string;
+  // Raw password OR a {{monitorSecrets.name}} reference resolved server-side.
+  password: string;
+  /*
+   * Microsoft SQL Server only: authenticate as the identity the probe runs
+   * as (SSPI on Windows, Kerberos elsewhere).
+   */
+  useWindowsIntegratedAuthentication: boolean;
+  useSsl: boolean;
+  rejectUnauthorizedSsl: boolean;
+}

package/Types/NetworkDevice/DefaultNetworkDeviceRole.ts

@@ -0,0 +1,145 @@
+import {
+  NetworkTopologyDeviceRole,
+  NetworkTopologyNodeShape,
+} from "../Monitor/SnmpMonitor/NetworkTopology";
+
+/*
+ * The device roles seeded into every project.
+ *
+ * Device roles used to be a fixed union (NetworkTopologyDeviceRole) with the
+ * label, the silhouette and the "is this a core device?" flag each hardcoded
+ * in a different module. They are now the per-project NetworkDeviceRole
+ * lookup table, so a project can rename "Wireless AP" to "Access Point",
+ * change what a firewall is drawn as, or add a role of its own.
+ *
+ * This file is the single source of truth for the DEFAULTS, shared by
+ * ProjectService (which seeds new projects) and the BackfillNetworkDeviceRoles
+ * data migration (which seeds projects that predate the table), so the two can
+ * never disagree about what a fresh project starts with.
+ *
+ * `key` is deliberately the built-in NetworkTopologyDeviceRole value. The SNMP
+ * classifier speaks that vocabulary and always will — it is evidence-driven
+ * and cannot invent a project's custom role — so matching its answer back to a
+ * configured row is a lookup by this key. That is also why the key is stable
+ * and the name is not: renaming a role must not stop the classifier finding it.
+ */
+export interface DefaultNetworkDeviceRole {
+  key: NetworkTopologyDeviceRole;
+  name: string;
+  description: string;
+  topologyShape: NetworkTopologyNodeShape;
+  isCoreLayer: boolean;
+  isSnmpWalkable: boolean;
+}
+
+/*
+ * Ordered exactly as the map legend lists them, because the seeded `order`
+ * column is this array's index — a fresh project's settings page and its map
+ * legend therefore read in the same sequence.
+ *
+ * The shapes reproduce the renderer's historical SHAPE_BY_ROLE map and the
+ * isCoreLayer flags reproduce its CORE_DEVICE_ROLES set, so a project seeded
+ * from this list draws exactly the map it drew before roles were configurable.
+ *
+ * "unknown" is not here on purpose. It is not a role an operator assigns; it
+ * is the classifier saying it has no answer, and offering it as a choice would
+ * mean "stop classifying this device forever" rather than "I don't know".
+ */
+export const DEFAULT_NETWORK_DEVICE_ROLES: ReadonlyArray<DefaultNetworkDeviceRole> =
+  [
+    {
+      key: "router",
+      name: "Router",
+      description:
+        "Moves traffic between networks. Sits at the top of the topology with the other core devices.",
+      topologyShape: "circle",
+      isCoreLayer: true,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "switch",
+      name: "Switch",
+      description:
+        "Access or distribution switching. Endpoints hang off it, and it hangs off a core device.",
+      topologyShape: "rounded-square",
+      isCoreLayer: false,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "firewall",
+      name: "Firewall",
+      description:
+        "Security appliance at a network boundary. Drawn at core level.",
+      topologyShape: "diamond",
+      isCoreLayer: true,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "wirelessAccessPoint",
+      name: "Wireless AP",
+      description: "Wireless access point serving client devices.",
+      topologyShape: "triangle",
+      isCoreLayer: false,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "loadBalancer",
+      name: "Load balancer",
+      description:
+        "Distributes traffic across a pool of servers. Drawn at core level.",
+      topologyShape: "hexagon",
+      isCoreLayer: true,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "server",
+      name: "Server",
+      description: "A general purpose server or compute node.",
+      topologyShape: "tower",
+      isCoreLayer: false,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "storage",
+      name: "Storage",
+      description: "A NAS, SAN or other storage appliance.",
+      topologyShape: "cylinder",
+      isCoreLayer: false,
+      isSnmpWalkable: true,
+    },
+    {
+      key: "printer",
+      name: "Printer",
+      description: "A network printer or multifunction device.",
+      topologyShape: "rect",
+      isCoreLayer: false,
+      isSnmpWalkable: false,
+    },
+    {
+      key: "camera",
+      name: "Camera",
+      description: "An IP camera or other video endpoint.",
+      topologyShape: "rect",
+      isCoreLayer: false,
+      isSnmpWalkable: false,
+    },
+    {
+      key: "phone",
+      name: "IP phone",
+      description: "A VoIP handset or conference phone.",
+      topologyShape: "rect",
+      isCoreLayer: false,
+      isSnmpWalkable: false,
+    },
+    {
+      key: "host",
+      name: "Host",
+      description:
+        "Anything plugged into an access port that is not one of the roles above.",
+      topologyShape: "rect",
+      isCoreLayer: false,
+      isSnmpWalkable: false,
+    },
+  ];
+
+export default DEFAULT_NETWORK_DEVICE_ROLES;

package/Types/NetworkDevice/NetworkAlertPolicyScope.ts

@@ -0,0 +1,343 @@
+/*
+ * WHICH devices a Network Alert Policy covers.
+ *
+ * A policy says "devices like THESE get a Network Device monitor cloned from
+ * THIS template" once, and the engine keeps one monitor per matching device
+ * from then on. The "like these" half is this object: a set of site ids, a
+ * set of device-role ids and a set of label ids, stored as one jsonb column
+ * on the policy row rather than as three join tables.
+ *
+ * jsonb, not join tables, on purpose. The scope is read whole every time the
+ * engine asks "does this device match?" and never queried the other way
+ * round ("which policies name site X?" is answered by scanning the project's
+ * handful of policies, not by an index), so three link tables would buy
+ * nothing but three more CRUD surfaces and three more cascade rules to get
+ * right. It also lets the dashboard post the whole picker state as one field.
+ *
+ * The matching rule is the one every filter in this product uses:
+ *
+ *   - AND across kinds: a device must satisfy the site list AND the role list
+ *     AND the label list.
+ *   - OR within a kind: "in site A or site B", "carrying label X or label Y".
+ *   - An EMPTY kind matches everything. Leaving the sites list empty means
+ *     "any site (including no site)", not "no site".
+ *
+ * So `{}` — every list empty — is the widest possible scope: every device in
+ * the project. That is a legitimate and common policy ("everything gets a
+ * reachability monitor"), but it is also the one that provisions the most
+ * billable monitors, which is why `isUnscoped` exists as a named question
+ * rather than a `length === 0` check scattered over the callers: the settings
+ * table, the confirm dialog and the engine all need to say "ALL devices" in
+ * the same breath.
+ *
+ * Everything that reads a scope goes through `normalize` first. The column is
+ * jsonb, so a row can hold whatever a client — or a hand-edited API call — put
+ * in it: a lone string where an array was expected, nulls, duplicated ids,
+ * blank strings from an empty picker. Tolerating all of that in one place
+ * means the engine never throws over one bad row and never double-counts a
+ * device because a site id was listed twice.
+ */
+export interface NetworkAlertPolicyScope {
+  siteIds?: Array<string>;
+  networkDeviceRoleIds?: Array<string>;
+  labelIds?: Array<string>;
+}
+
+/*
+ * The slice of a NetworkDevice the matcher looks at. Kept to plain ids so
+ * the engine can feed it rows selected with three columns and a label join,
+ * and so a test can build one in a line.
+ */
+export interface NetworkAlertPolicyScopeDevice {
+  siteId?: string | null;
+  networkDeviceRoleId?: string | null;
+  labelIds?: Array<string>;
+}
+
+/*
+ * Display names for `describe`, keyed by id. Every map is optional and every
+ * lookup may miss: the settings table renders before its lookups resolve,
+ * and a scope can name a site that has since been deleted. A missing name
+ * falls back to a count ("in 2 sites"), never to the raw id.
+ */
+export interface NetworkAlertPolicyScopeNames {
+  sites?: Record<string, string>;
+  roles?: Record<string, string>;
+  labels?: Record<string, string>;
+}
+
+/*
+ * A normalized scope: every list present, deduplicated, and holding only
+ * non-blank strings. What `normalize` returns and what every other method
+ * works on internally.
+ */
+interface NormalizedNetworkAlertPolicyScope {
+  siteIds: Array<string>;
+  networkDeviceRoleIds: Array<string>;
+  labelIds: Array<string>;
+}
+
+/*
+ * One kind of id, for `describe`. `singular`/`plural` are the nouns; how the
+ * clause hangs off "Devices" is decided by the caller — sites are somewhere
+ * ("in"), roles and labels are something a device has ("with").
+ */
+interface ScopeKindDescription {
+  ids: Array<string>;
+  names: Record<string, string> | undefined;
+  singular: string;
+  plural: string;
+}
+
+export class NetworkAlertPolicyScopeUtil {
+  /*
+   * The canonical form of whatever was stored or posted.
+   *
+   * Accepts anything: `undefined`, `null`, a non-object, an object whose
+   * lists are missing, `null`, lone strings, or arrays holding nulls,
+   * numbers, blanks and duplicates. Returns three arrays of unique, trimmed,
+   * non-empty strings — and nothing else, so a stray property on the stored
+   * JSON never round-trips back into the column.
+   */
+  public static normalize(raw: unknown): NetworkAlertPolicyScope {
+    const source: Record<string, unknown> =
+      raw && typeof raw === "object" && !Array.isArray(raw)
+        ? (raw as Record<string, unknown>)
+        : {};
+
+    return {
+      siteIds: NetworkAlertPolicyScopeUtil.readIdList(source["siteIds"]),
+      networkDeviceRoleIds: NetworkAlertPolicyScopeUtil.readIdList(
+        source["networkDeviceRoleIds"],
+      ),
+      labelIds: NetworkAlertPolicyScopeUtil.readIdList(source["labelIds"]),
+    };
+  }
+
+  /*
+   * True when the scope names nothing at all — every device in the project.
+   *
+   * Runs through `normalize` first, so a scope of `{ siteIds: [""] }` or
+   * `{ siteIds: null }` reads as unscoped too: a blank picker is an empty
+   * picker, and the alternative — a scope that matches nothing because it
+   * holds one blank id — would be a policy that silently does nothing.
+   */
+  public static isUnscoped(
+    scope: NetworkAlertPolicyScope | null | undefined,
+  ): boolean {
+    const normalized: NormalizedNetworkAlertPolicyScope =
+      NetworkAlertPolicyScopeUtil.normalize(
+        scope,
+      ) as NormalizedNetworkAlertPolicyScope;
+
+    return (
+      normalized.siteIds.length === 0 &&
+      normalized.networkDeviceRoleIds.length === 0 &&
+      normalized.labelIds.length === 0
+    );
+  }
+
+  /*
+   * The matching rule itself: AND across kinds, OR within a kind, an empty
+   * kind matches everything.
+   *
+   * A device with no site never matches a scope that lists sites, and a
+   * device with no labels never matches a scope that lists labels — "in site
+   * A" cannot be true of a device that is nowhere. The converse is the
+   * empty-kind rule: a scope that lists no sites is satisfied by a device
+   * with no site.
+   */
+  public static matchesDevice(
+    scope: NetworkAlertPolicyScope | null | undefined,
+    device: NetworkAlertPolicyScopeDevice,
+  ): boolean {
+    const normalized: NormalizedNetworkAlertPolicyScope =
+      NetworkAlertPolicyScopeUtil.normalize(
+        scope,
+      ) as NormalizedNetworkAlertPolicyScope;
+
+    if (
+      normalized.siteIds.length > 0 &&
+      !NetworkAlertPolicyScopeUtil.listHasId(normalized.siteIds, device.siteId)
+    ) {
+      return false;
+    }
+
+    if (
+      normalized.networkDeviceRoleIds.length > 0 &&
+      !NetworkAlertPolicyScopeUtil.listHasId(
+        normalized.networkDeviceRoleIds,
+        device.networkDeviceRoleId,
+      )
+    ) {
+      return false;
+    }
+
+    if (normalized.labelIds.length > 0) {
+      const deviceLabelIds: Array<string> =
+        NetworkAlertPolicyScopeUtil.readIdList(device.labelIds);
+
+      const hasAnyLabel: boolean = deviceLabelIds.some(
+        (labelId: string): boolean => {
+          return normalized.labelIds.includes(labelId);
+        },
+      );
+
+      if (!hasAnyLabel) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  /*
+   * A sentence for the settings table.
+   *
+   *   {}                                    -> "All devices"
+   *   { siteIds: [a, b] }                   -> "Devices in 2 sites"
+   *   { siteIds: [a], roles: [switch] }     -> "Devices in site Warehouse with role Switch"
+   *   { roles: [switch], labels: [prod] }   -> "Devices with role Switch and label Production"
+   *
+   * A single id whose name is known is named; anything else is counted. The
+   * count, never the id: an operator reading "in site 7f3c..." learns
+   * nothing, and "in 1 site" at least tells them to open the policy.
+   *
+   * "All devices" is deliberately blunt. It is the row that provisions a
+   * monitor for everything, and the wording should make somebody scanning
+   * the table stop on it.
+   */
+  public static describe(
+    scope: NetworkAlertPolicyScope | null | undefined,
+    names: NetworkAlertPolicyScopeNames = {},
+  ): string {
+    const normalized: NormalizedNetworkAlertPolicyScope =
+      NetworkAlertPolicyScopeUtil.normalize(
+        scope,
+      ) as NormalizedNetworkAlertPolicyScope;
+
+    if (NetworkAlertPolicyScopeUtil.isUnscoped(normalized)) {
+      return "All devices";
+    }
+
+    let sentence: string = "Devices";
+
+    if (normalized.siteIds.length > 0) {
+      sentence += ` in ${NetworkAlertPolicyScopeUtil.describeKind({
+        ids: normalized.siteIds,
+        names: names.sites,
+        singular: "site",
+        plural: "sites",
+      })}`;
+    }
+
+    const withClauses: Array<string> = [];
+
+    if (normalized.networkDeviceRoleIds.length > 0) {
+      withClauses.push(
+        NetworkAlertPolicyScopeUtil.describeKind({
+          ids: normalized.networkDeviceRoleIds,
+          names: names.roles,
+          singular: "role",
+          plural: "roles",
+        }),
+      );
+    }
+
+    if (normalized.labelIds.length > 0) {
+      withClauses.push(
+        NetworkAlertPolicyScopeUtil.describeKind({
+          ids: normalized.labelIds,
+          names: names.labels,
+          singular: "label",
+          plural: "labels",
+        }),
+      );
+    }
+
+    if (withClauses.length > 0) {
+      sentence += ` with ${withClauses.join(" and ")}`;
+    }
+
+    return sentence;
+  }
+
+  // "site Warehouse" when there is one id and a name for it; "2 sites" else.
+  private static describeKind(kind: ScopeKindDescription): string {
+    if (kind.ids.length === 1) {
+      const name: string = (kind.names?.[kind.ids[0] as string] || "").trim();
+
+      if (name) {
+        return `${kind.singular} ${name}`;
+      }
+    }
+
+    return `${kind.ids.length} ${
+      kind.ids.length === 1 ? kind.singular : kind.plural
+    }`;
+  }
+
+  /*
+   * One id list, cleaned. A lone string is one id (a client that sent
+   * `siteIds: "abc"` meant `["abc"]`); anything that is not a string or an
+   * array yields nothing. Inside an array only non-blank strings and
+   * ObjectID-shaped objects (which carry their id under `_id` / `id`) count,
+   * trimmed and deduplicated in first-seen order so the stored form is
+   * stable across saves.
+   */
+  private static readIdList(raw: unknown): Array<string> {
+    const candidates: Array<unknown> = Array.isArray(raw)
+      ? raw
+      : raw === undefined || raw === null
+        ? []
+        : [raw];
+
+    const ids: Array<string> = [];
+
+    for (const candidate of candidates) {
+      const id: string | null = NetworkAlertPolicyScopeUtil.readId(candidate);
+
+      if (id && !ids.includes(id)) {
+        ids.push(id);
+      }
+    }
+
+    return ids;
+  }
+
+  private static readId(value: unknown): string | null {
+    if (typeof value === "string") {
+      const trimmed: string = value.trim();
+
+      return trimmed || null;
+    }
+
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const relation: { _id?: unknown; id?: unknown } = value as {
+        _id?: unknown;
+        id?: unknown;
+      };
+
+      const relationId: unknown = relation._id || relation.id;
+
+      if (typeof relationId === "string") {
+        const trimmed: string = relationId.trim();
+
+        return trimmed || null;
+      }
+    }
+
+    return null;
+  }
+
+  private static listHasId(
+    list: Array<string>,
+    id: string | null | undefined,
+  ): boolean {
+    const normalizedId: string | null = NetworkAlertPolicyScopeUtil.readId(id);
+
+    return normalizedId !== null && list.includes(normalizedId);
+  }
+}
+
+export default NetworkAlertPolicyScope;