@oneuptime/common 12.0.32 → 12.0.33

package/Types/Monitor/SnmpMonitor/NetworkDeviceAlertPack.ts

@@ -26,7 +26,7 @@ const PACK: Array<NetworkDeviceAlertPackItem> = [
   {
     name: "Device unreachable",
     description:
-      "The device stopped answering SNMP — likely down or unreachable.",
+      "The device stopped answering ping and SNMP — likely down or unreachable.",
     filters: [
       {
         checkOn: CheckOn.SnmpIsOnline,
@@ -37,6 +37,27 @@ const PACK: Array<NetworkDeviceAlertPackItem> = [
     createIncidents: true,
     createAlerts: false,
   },
+  /*
+   * An alert, not an incident: the device is still answering ping, so it is
+   * not down - but its SNMP walk is failing, which means no interfaces, no
+   * inventory and no health OIDs until someone fixes the credentials, the
+   * agent or the ACL. Never fires on a device that is only pinged: the
+   * criterion is not evaluated at all when no walk ran.
+   */
+  {
+    name: "SNMP walk failing",
+    description:
+      "The device answers ping but its SNMP walk is failing — check the credentials, the SNMP agent, or an ACL.",
+    filters: [
+      {
+        checkOn: CheckOn.SnmpWalkIsSucceeding,
+        filterType: FilterType.False,
+        value: undefined,
+      },
+    ],
+    createIncidents: false,
+    createAlerts: true,
+  },
   {
     name: "Interface down",
     description:

package/Types/Monitor/SqlConnectionConfig.ts

@@ -0,0 +1,31 @@
+import SqlDatabaseType from "./SqlDatabaseType";
+
+/*
+ * The connection half of a SQL-speaking monitor's configuration.
+ *
+ * Extracted so the SQL Query monitor and the Database Health monitor can
+ * share one implementation of the fiddly parts - TLS options, and especially
+ * the SQL Server integrated-authentication path, which has to detect the
+ * host's ODBC driver and build a connection string by hand. Duplicating that
+ * for a second monitor type would guarantee the two drift.
+ *
+ * Both MonitorStepSqlMonitor and MonitorStepDatabaseMonitor extend this, so
+ * anything that only needs to CONNECT should take this type rather than
+ * either step type.
+ */
+export default interface SqlConnectionConfig {
+  databaseType: SqlDatabaseType;
+  host: string;
+  port: number;
+  databaseName: string;
+  username: string;
+  // Raw password OR a {{monitorSecrets.name}} reference resolved server-side.
+  password: string;
+  /*
+   * Microsoft SQL Server only: authenticate as the identity the probe runs
+   * as (SSPI on Windows, Kerberos elsewhere).
+   */
+  useWindowsIntegratedAuthentication: boolean;
+  useSsl: boolean;
+  rejectUnauthorizedSsl: boolean;
+}

package/Types/NetworkDevice/NetworkAlertPolicyScope.ts

@@ -0,0 +1,343 @@
+/*
+ * WHICH devices a Network Alert Policy covers.
+ *
+ * A policy says "devices like THESE get a Network Device monitor cloned from
+ * THIS template" once, and the engine keeps one monitor per matching device
+ * from then on. The "like these" half is this object: a set of site ids, a
+ * set of device-role ids and a set of label ids, stored as one jsonb column
+ * on the policy row rather than as three join tables.
+ *
+ * jsonb, not join tables, on purpose. The scope is read whole every time the
+ * engine asks "does this device match?" and never queried the other way
+ * round ("which policies name site X?" is answered by scanning the project's
+ * handful of policies, not by an index), so three link tables would buy
+ * nothing but three more CRUD surfaces and three more cascade rules to get
+ * right. It also lets the dashboard post the whole picker state as one field.
+ *
+ * The matching rule is the one every filter in this product uses:
+ *
+ *   - AND across kinds: a device must satisfy the site list AND the role list
+ *     AND the label list.
+ *   - OR within a kind: "in site A or site B", "carrying label X or label Y".
+ *   - An EMPTY kind matches everything. Leaving the sites list empty means
+ *     "any site (including no site)", not "no site".
+ *
+ * So `{}` — every list empty — is the widest possible scope: every device in
+ * the project. That is a legitimate and common policy ("everything gets a
+ * reachability monitor"), but it is also the one that provisions the most
+ * billable monitors, which is why `isUnscoped` exists as a named question
+ * rather than a `length === 0` check scattered over the callers: the settings
+ * table, the confirm dialog and the engine all need to say "ALL devices" in
+ * the same breath.
+ *
+ * Everything that reads a scope goes through `normalize` first. The column is
+ * jsonb, so a row can hold whatever a client — or a hand-edited API call — put
+ * in it: a lone string where an array was expected, nulls, duplicated ids,
+ * blank strings from an empty picker. Tolerating all of that in one place
+ * means the engine never throws over one bad row and never double-counts a
+ * device because a site id was listed twice.
+ */
+export interface NetworkAlertPolicyScope {
+  siteIds?: Array<string>;
+  networkDeviceRoleIds?: Array<string>;
+  labelIds?: Array<string>;
+}
+
+/*
+ * The slice of a NetworkDevice the matcher looks at. Kept to plain ids so
+ * the engine can feed it rows selected with three columns and a label join,
+ * and so a test can build one in a line.
+ */
+export interface NetworkAlertPolicyScopeDevice {
+  siteId?: string | null;
+  networkDeviceRoleId?: string | null;
+  labelIds?: Array<string>;
+}
+
+/*
+ * Display names for `describe`, keyed by id. Every map is optional and every
+ * lookup may miss: the settings table renders before its lookups resolve,
+ * and a scope can name a site that has since been deleted. A missing name
+ * falls back to a count ("in 2 sites"), never to the raw id.
+ */
+export interface NetworkAlertPolicyScopeNames {
+  sites?: Record<string, string>;
+  roles?: Record<string, string>;
+  labels?: Record<string, string>;
+}
+
+/*
+ * A normalized scope: every list present, deduplicated, and holding only
+ * non-blank strings. What `normalize` returns and what every other method
+ * works on internally.
+ */
+interface NormalizedNetworkAlertPolicyScope {
+  siteIds: Array<string>;
+  networkDeviceRoleIds: Array<string>;
+  labelIds: Array<string>;
+}
+
+/*
+ * One kind of id, for `describe`. `singular`/`plural` are the nouns; how the
+ * clause hangs off "Devices" is decided by the caller — sites are somewhere
+ * ("in"), roles and labels are something a device has ("with").
+ */
+interface ScopeKindDescription {
+  ids: Array<string>;
+  names: Record<string, string> | undefined;
+  singular: string;
+  plural: string;
+}
+
+export class NetworkAlertPolicyScopeUtil {
+  /*
+   * The canonical form of whatever was stored or posted.
+   *
+   * Accepts anything: `undefined`, `null`, a non-object, an object whose
+   * lists are missing, `null`, lone strings, or arrays holding nulls,
+   * numbers, blanks and duplicates. Returns three arrays of unique, trimmed,
+   * non-empty strings — and nothing else, so a stray property on the stored
+   * JSON never round-trips back into the column.
+   */
+  public static normalize(raw: unknown): NetworkAlertPolicyScope {
+    const source: Record<string, unknown> =
+      raw && typeof raw === "object" && !Array.isArray(raw)
+        ? (raw as Record<string, unknown>)
+        : {};
+
+    return {
+      siteIds: NetworkAlertPolicyScopeUtil.readIdList(source["siteIds"]),
+      networkDeviceRoleIds: NetworkAlertPolicyScopeUtil.readIdList(
+        source["networkDeviceRoleIds"],
+      ),
+      labelIds: NetworkAlertPolicyScopeUtil.readIdList(source["labelIds"]),
+    };
+  }
+
+  /*
+   * True when the scope names nothing at all — every device in the project.
+   *
+   * Runs through `normalize` first, so a scope of `{ siteIds: [""] }` or
+   * `{ siteIds: null }` reads as unscoped too: a blank picker is an empty
+   * picker, and the alternative — a scope that matches nothing because it
+   * holds one blank id — would be a policy that silently does nothing.
+   */
+  public static isUnscoped(
+    scope: NetworkAlertPolicyScope | null | undefined,
+  ): boolean {
+    const normalized: NormalizedNetworkAlertPolicyScope =
+      NetworkAlertPolicyScopeUtil.normalize(
+        scope,
+      ) as NormalizedNetworkAlertPolicyScope;
+
+    return (
+      normalized.siteIds.length === 0 &&
+      normalized.networkDeviceRoleIds.length === 0 &&
+      normalized.labelIds.length === 0
+    );
+  }
+
+  /*
+   * The matching rule itself: AND across kinds, OR within a kind, an empty
+   * kind matches everything.
+   *
+   * A device with no site never matches a scope that lists sites, and a
+   * device with no labels never matches a scope that lists labels — "in site
+   * A" cannot be true of a device that is nowhere. The converse is the
+   * empty-kind rule: a scope that lists no sites is satisfied by a device
+   * with no site.
+   */
+  public static matchesDevice(
+    scope: NetworkAlertPolicyScope | null | undefined,
+    device: NetworkAlertPolicyScopeDevice,
+  ): boolean {
+    const normalized: NormalizedNetworkAlertPolicyScope =
+      NetworkAlertPolicyScopeUtil.normalize(
+        scope,
+      ) as NormalizedNetworkAlertPolicyScope;
+
+    if (
+      normalized.siteIds.length > 0 &&
+      !NetworkAlertPolicyScopeUtil.listHasId(normalized.siteIds, device.siteId)
+    ) {
+      return false;
+    }
+
+    if (
+      normalized.networkDeviceRoleIds.length > 0 &&
+      !NetworkAlertPolicyScopeUtil.listHasId(
+        normalized.networkDeviceRoleIds,
+        device.networkDeviceRoleId,
+      )
+    ) {
+      return false;
+    }
+
+    if (normalized.labelIds.length > 0) {
+      const deviceLabelIds: Array<string> =
+        NetworkAlertPolicyScopeUtil.readIdList(device.labelIds);
+
+      const hasAnyLabel: boolean = deviceLabelIds.some(
+        (labelId: string): boolean => {
+          return normalized.labelIds.includes(labelId);
+        },
+      );
+
+      if (!hasAnyLabel) {
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  /*
+   * A sentence for the settings table.
+   *
+   *   {}                                    -> "All devices"
+   *   { siteIds: [a, b] }                   -> "Devices in 2 sites"
+   *   { siteIds: [a], roles: [switch] }     -> "Devices in site Warehouse with role Switch"
+   *   { roles: [switch], labels: [prod] }   -> "Devices with role Switch and label Production"
+   *
+   * A single id whose name is known is named; anything else is counted. The
+   * count, never the id: an operator reading "in site 7f3c..." learns
+   * nothing, and "in 1 site" at least tells them to open the policy.
+   *
+   * "All devices" is deliberately blunt. It is the row that provisions a
+   * monitor for everything, and the wording should make somebody scanning
+   * the table stop on it.
+   */
+  public static describe(
+    scope: NetworkAlertPolicyScope | null | undefined,
+    names: NetworkAlertPolicyScopeNames = {},
+  ): string {
+    const normalized: NormalizedNetworkAlertPolicyScope =
+      NetworkAlertPolicyScopeUtil.normalize(
+        scope,
+      ) as NormalizedNetworkAlertPolicyScope;
+
+    if (NetworkAlertPolicyScopeUtil.isUnscoped(normalized)) {
+      return "All devices";
+    }
+
+    let sentence: string = "Devices";
+
+    if (normalized.siteIds.length > 0) {
+      sentence += ` in ${NetworkAlertPolicyScopeUtil.describeKind({
+        ids: normalized.siteIds,
+        names: names.sites,
+        singular: "site",
+        plural: "sites",
+      })}`;
+    }
+
+    const withClauses: Array<string> = [];
+
+    if (normalized.networkDeviceRoleIds.length > 0) {
+      withClauses.push(
+        NetworkAlertPolicyScopeUtil.describeKind({
+          ids: normalized.networkDeviceRoleIds,
+          names: names.roles,
+          singular: "role",
+          plural: "roles",
+        }),
+      );
+    }
+
+    if (normalized.labelIds.length > 0) {
+      withClauses.push(
+        NetworkAlertPolicyScopeUtil.describeKind({
+          ids: normalized.labelIds,
+          names: names.labels,
+          singular: "label",
+          plural: "labels",
+        }),
+      );
+    }
+
+    if (withClauses.length > 0) {
+      sentence += ` with ${withClauses.join(" and ")}`;
+    }
+
+    return sentence;
+  }
+
+  // "site Warehouse" when there is one id and a name for it; "2 sites" else.
+  private static describeKind(kind: ScopeKindDescription): string {
+    if (kind.ids.length === 1) {
+      const name: string = (kind.names?.[kind.ids[0] as string] || "").trim();
+
+      if (name) {
+        return `${kind.singular} ${name}`;
+      }
+    }
+
+    return `${kind.ids.length} ${
+      kind.ids.length === 1 ? kind.singular : kind.plural
+    }`;
+  }
+
+  /*
+   * One id list, cleaned. A lone string is one id (a client that sent
+   * `siteIds: "abc"` meant `["abc"]`); anything that is not a string or an
+   * array yields nothing. Inside an array only non-blank strings and
+   * ObjectID-shaped objects (which carry their id under `_id` / `id`) count,
+   * trimmed and deduplicated in first-seen order so the stored form is
+   * stable across saves.
+   */
+  private static readIdList(raw: unknown): Array<string> {
+    const candidates: Array<unknown> = Array.isArray(raw)
+      ? raw
+      : raw === undefined || raw === null
+        ? []
+        : [raw];
+
+    const ids: Array<string> = [];
+
+    for (const candidate of candidates) {
+      const id: string | null = NetworkAlertPolicyScopeUtil.readId(candidate);
+
+      if (id && !ids.includes(id)) {
+        ids.push(id);
+      }
+    }
+
+    return ids;
+  }
+
+  private static readId(value: unknown): string | null {
+    if (typeof value === "string") {
+      const trimmed: string = value.trim();
+
+      return trimmed || null;
+    }
+
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      const relation: { _id?: unknown; id?: unknown } = value as {
+        _id?: unknown;
+        id?: unknown;
+      };
+
+      const relationId: unknown = relation._id || relation.id;
+
+      if (typeof relationId === "string") {
+        const trimmed: string = relationId.trim();
+
+        return trimmed || null;
+      }
+    }
+
+    return null;
+  }
+
+  private static listHasId(
+    list: Array<string>,
+    id: string | null | undefined,
+  ): boolean {
+    const normalizedId: string | null = NetworkAlertPolicyScopeUtil.readId(id);
+
+    return normalizedId !== null && list.includes(normalizedId);
+  }
+}
+
+export default NetworkAlertPolicyScope;

package/Types/NetworkDevice/NetworkDeviceMonitoringMethod.ts

@@ -1,39 +1,54 @@
 /*
  * How a NetworkDevice's health is established.
  *
- * The network product was built around SNMP: a device is a thing an assigned
- * probe walks on a schedule, and everything downstream — the status pill, the
- * site rollup, the topology map — reads freshness off `lastSeenAt`, which only
- * a successful walk ever stamps.
+ * A device is the unit; reachability is a built-in capability of every device
+ * a probe polls, and SNMP is an enrichment layered on top when credentials
+ * exist. That is what `Probe` means: the assigned probe pings the device on
+ * its own schedule, and walks it over SNMP as well whenever it has usable
+ * credentials (its own, or through a credential profile). A device with no
+ * credentials is simply pinged — it still has a status from its first poll,
+ * still belongs to a site, still appears on the map.
  *
- * Plenty of real gear cannot be walked. Consumer APs, PDUs, cameras, anything
- * with SNMP disabled by policy: an operator tracks those with an ordinary Ping
- * or IP monitor. They are as real a part of the network as the switch they
- * hang off, and before this existed they could not be recorded as devices at
- * all — so they were absent from the site hierarchy and from the topology map,
- * which is what issue #3023 is about.
+ * `Monitor` is the override for gear a probe cannot reach at all, or whose
+ * health is better judged by an HTTP or port check: no polling; the bound
+ * Monitor's status IS the device's status, stamped through the same bridge
+ * that stamps every other device.
  *
- * `Monitor` is that second answer: no probe, no credentials, no polling; the
- * bound Monitor's status IS the device's status, stamped through the same
- * bridge that already stamps SNMP devices watched by a Network Device monitor.
+ * HISTORY. The product started SNMP-first: the first value was "SNMP", and
+ * everything that could not be walked had to be `Monitor`-backed, which meant
+ * a Ping monitor per phone and per camera (issue #3023, #3447). Rows written
+ * in that era hold "SNMP" or NULL, and both read as `Probe` — they were
+ * probe-polled devices all along, the probe just did not ping them yet.
  *
  * Stored as free text on the column (the SnmpVersion precedent), so parse it
  * through `NetworkDeviceMonitoringMethodUtil.parse` rather than comparing the
- * raw column: rows written before this existed hold NULL and must read as
- * `Snmp`, which is what they are.
+ * raw column: NULL, "", "SNMP" and anything unrecognised must read as
+ * `Probe`, and defaulting a device into "monitor-backed" would silently stop
+ * it being polled.
  */
 export enum NetworkDeviceMonitoringMethod {
-  // An assigned probe walks the device over SNMP on its own schedule.
-  Snmp = "SNMP",
-  // No polling; a bound Monitor (Ping, IP, Port, ...) reports its health.
+  /*
+   * The assigned probe pings the device on its schedule, and walks it over
+   * SNMP as well whenever it has usable credentials.
+   */
+  Probe = "Probe",
+  // No polling; a bound Monitor (Ping, IP, Port, HTTP, ...) reports its health.
   Monitor = "Monitor",
 }
 
+/*
+ * The value every device written before ping-first polling carries. Kept as
+ * a named constant for the parser, the normalising data migration and tests;
+ * it is not a value the product writes any more.
+ */
+export const LEGACY_SNMP_MONITORING_METHOD: string = "SNMP";
+
 export class NetworkDeviceMonitoringMethodUtil {
   /*
-   * NULL, empty and anything unrecognised read as Snmp — that is what every
-   * device created before this column existed is, and defaulting a device
-   * into "monitor-backed" would silently stop it being polled.
+   * NULL, empty, the legacy "SNMP" and anything unrecognised read as Probe —
+   * that is what every device created before this column (or before
+   * ping-first polling) is, and defaulting a device into "monitor-backed"
+   * would silently stop it being polled.
    */
   public static parse(
     value: string | undefined | null,
@@ -41,7 +56,7 @@ export class NetworkDeviceMonitoringMethodUtil {
     if ((value || "").trim().toLowerCase() === "monitor") {
       return NetworkDeviceMonitoringMethod.Monitor;
     }
-    return NetworkDeviceMonitoringMethod.Snmp;
+    return NetworkDeviceMonitoringMethod.Probe;
   }
 
   public static isMonitorBacked(value: string | undefined | null): boolean {
@@ -50,6 +65,11 @@ export class NetworkDeviceMonitoringMethodUtil {
       NetworkDeviceMonitoringMethod.Monitor
     );
   }
+
+  /** The complement of isMonitorBacked: the assigned probe polls the device. */
+  public static isProbePolled(value: string | undefined | null): boolean {
+    return !NetworkDeviceMonitoringMethodUtil.isMonitorBacked(value);
+  }
 }
 
 export default NetworkDeviceMonitoringMethod;

package/Types/NetworkSite/DefaultNetworkSiteTypeHierarchy.ts

@@ -0,0 +1,30 @@
+import DefaultNetworkSiteType from "./DefaultNetworkSiteType";
+
+/*
+ * One shared hierarchy policy for new-project seeding and the idempotent data
+ * migration that repairs projects created before parent site types existed.
+ * Keep parents before children in creation order so every FK can be resolved
+ * from a row that has already been found or created.
+ */
+export const DefaultNetworkSiteTypeParent: Readonly<
+  Record<DefaultNetworkSiteType, DefaultNetworkSiteType | null>
+> = Object.freeze({
+  [DefaultNetworkSiteType.AccountType]: null,
+  [DefaultNetworkSiteType.Region]: DefaultNetworkSiteType.AccountType,
+  [DefaultNetworkSiteType.Franchisee]: DefaultNetworkSiteType.Region,
+  [DefaultNetworkSiteType.Market]: DefaultNetworkSiteType.Franchisee,
+  [DefaultNetworkSiteType.Unit]: DefaultNetworkSiteType.Market,
+  [DefaultNetworkSiteType.DataCenter]: null,
+  [DefaultNetworkSiteType.Other]: null,
+});
+
+export const DefaultNetworkSiteTypeCreationOrder: ReadonlyArray<DefaultNetworkSiteType> =
+  Object.freeze([
+    DefaultNetworkSiteType.AccountType,
+    DefaultNetworkSiteType.Region,
+    DefaultNetworkSiteType.Franchisee,
+    DefaultNetworkSiteType.Market,
+    DefaultNetworkSiteType.Unit,
+    DefaultNetworkSiteType.DataCenter,
+    DefaultNetworkSiteType.Other,
+  ]);