@oneuptime/common 12.0.32 → 12.0.34

package/Tests/Server/Services/NetworkDeviceAutoImportRuleEngineService.test.ts

@@ -130,6 +130,7 @@ import MonitorTemplateService from "../../../Server/Services/MonitorTemplateServ
 import Semaphore from "../../../Server/Infrastructure/Semaphore";
 import logger from "../../../Server/Utils/Logger";
 import NetworkDevice from "../../../Models/DatabaseModels/NetworkDevice";
+import NetworkDeviceMonitoringMethod from "../../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import MonitorTemplate from "../../../Models/DatabaseModels/MonitorTemplate";
 import NetworkDeviceAutoImportRule from "../../../Models/DatabaseModels/NetworkDeviceAutoImportRule";
@@ -218,9 +219,26 @@ const semaphoreLockMock: jest.Mock = Semaphore.lock as unknown as jest.Mock;
 const semaphoreReleaseMock: jest.Mock =
   Semaphore.release as unknown as jest.Mock;
 const loggerErrorMock: jest.Mock = logger.error as unknown as jest.Mock;
+const loggerWarnMock: jest.Mock = logger.warn as unknown as jest.Mock;
 
 const RECENT_COMPLETED_AT: Date = OneUptimeDate.getCurrentDate();
 
+/*
+ * The values behind a QueryHelper.any() filter.
+ *
+ * QueryHelper.any builds a raw TypeORM FindOperator whose parameters hold the
+ * list, so a status filter cannot be compared to a string any more. Reading
+ * the values back out is what lets a test still say WHICH statuses a query
+ * accepts rather than merely that it is some operator.
+ */
+function statusesMatchedBy(filter: unknown): Array<string> {
+  const parameters: Record<string, Array<string>> = (
+    filter as { _objectLiteralParameters?: Record<string, Array<string>> }
+  )._objectLiteralParameters!;
+
+  return Object.values(parameters)[0]!;
+}
+
 /*
  * The scan's credential sets (issue #3458), and the ids the probe stamps onto
  * a discovered host to record which one answered it. Opaque literals, because
@@ -541,9 +559,19 @@ describe("NetworkDeviceAutoImportRuleEngineService.processCompletedScan", () =>
     expect(updateCall.data.autoImportProcessedAt).toBeInstanceOf(Date);
     // Nothing was created, so the stored results are not rewritten.
     expect(Object.keys(updateCall.data)).toEqual(["autoImportProcessedAt"]);
+    /*
+     * The compare-and-set is over the run state this pass READ, not over the
+     * literal "Completed" it used to pin: a scan that is still sweeping is
+     * importable now (issue #3599), and its status is exactly what changes
+     * when its run ends. The two host counters ride along because they are
+     * what a running scan's partial uploads move, so a partial landing between
+     * the read and the stamp is caught the way a completion is.
+     */
     expect(updateCall.expectedData).toEqual({
       status: "Completed",
       completedAt: RECENT_COMPLETED_AT,
+      scannedHostCount: null,
+      respondedHostCount: null,
     });
   });
 
@@ -1034,7 +1062,15 @@ describe("NetworkDeviceAutoImportRuleEngineService.processCompletedScan", () =>
       });
     });
 
-    it("defensively skips inert Network Device monitors for ping-only hosts", async () => {
+    /*
+     * A ping-only host imports as a Probe device under ping-first polling —
+     * pinged on schedule, walked once credentials arrive — so a Network
+     * Device monitor on it is fed from its first poll: the reachability
+     * criteria evaluate from the ping while the OID and interface criteria
+     * wait, unevaluated, for a walk. It used to import monitor-backed with
+     * polling off, and the engine skipped its monitor as inert.
+     */
+    it("provisions a Network Device monitor for a ping-only host, which imports as a Probe device", async () => {
       scanFindOneByMock.mockResolvedValue(
         makeScan({
           discoveredDevices: [makeHost({ snmpReachable: false })],
@@ -1050,12 +1086,46 @@ describe("NetworkDeviceAutoImportRuleEngineService.processCompletedScan", () =>
 
       const result: AutoImportRuleRunResult | null = await processScan();
 
+      expect(createdDevice(0).monitoringMethod).toBe(
+        NetworkDeviceMonitoringMethod.Probe,
+      );
       expect(result).toMatchObject({
         devicesCreated: 1,
-        monitorsCreated: 0,
-        monitorsSkippedUnsupportedHost: 1,
+        monitorsCreated: 1,
+        monitorsSkippedUnsupportedHost: 0,
       });
-      expect(monitorCreateMock).not.toHaveBeenCalled();
+      expect(monitorCreateMock).toHaveBeenCalledTimes(1);
+    });
+
+    /*
+     * The DEVICE's method is the whole test, never the host's SNMP answer:
+     * a Probe device the sweep happened to find without SNMP this time is
+     * still polled, and still gets its monitor.
+     */
+    it("judges by the device's method, not by whether the host answered SNMP", async () => {
+      const existingDevice: NetworkDevice = makeExistingDevice({
+        monitoringMethod: NetworkDeviceMonitoringMethod.Probe,
+      });
+      scanFindOneByMock.mockResolvedValue(
+        makeScan({ discoveredDevices: [makeHost({ snmpReachable: false })] }),
+      );
+      deviceFindByMock.mockResolvedValue([existingDevice]);
+      ruleFindByMock.mockResolvedValue([
+        makeRule({
+          includePingOnlyHosts: true,
+          monitorTemplateId: TEMPLATE_ID,
+        }),
+      ]);
+      monitorTemplateFindByMock.mockResolvedValue([makeTemplate()]);
+
+      const result: AutoImportRuleRunResult | null = await processScan();
+
+      expect(result).toMatchObject({
+        devicesCreated: 0,
+        monitorsCreated: 1,
+        monitorsSkippedUnsupportedHost: 0,
+      });
+      expect(monitorCreateMock).toHaveBeenCalledTimes(1);
     });
 
     it("does not backfill an SNMP monitor onto an existing monitor-backed device", async () => {
@@ -1736,7 +1806,16 @@ describe("NetworkDeviceAutoImportRuleEngineService.applyRuleToCompletedScans", (
 
     expect(scanFindOneByMock).toHaveBeenCalledTimes(1);
     const rereadCall: any = scanFindOneByMock.mock.calls[0]![0];
-    expect(rereadCall.query.status).toBe("Completed");
+    /*
+     * The status filter is a SET now, not the single "Completed" it used to
+     * be: a scan that is still sweeping already holds real results, and
+     * refusing to look at them is what left 527 discovered switches
+     * unimportable for a day (issue #3599).
+     */
+    expect(statusesMatchedBy(rereadCall.query.status)).toEqual([
+      "Completed",
+      "In Progress",
+    ]);
     expect(rereadCall.query.projectId.toString()).toBe(PROJECT_ID.toString());
     expect(rereadCall.select.discoveredDevices).toBe(true);
   });
@@ -1982,3 +2061,192 @@ describe("NetworkDeviceAutoImportRuleEngineService.applyRuleToCompletedScans", (
     });
   });
 });
+
+/*
+ * github.com/OneUptime/oneuptime/issues/3599 — "Auto Import Rule can't see
+ * already-discovered devices while the Discovery Scan is still running".
+ *
+ * A discovery sweep reports incrementally now: the probe uploads what it has
+ * found every 30 seconds, so an In Progress scan's row already holds real
+ * hosts. The engine used to read only Completed scans, which meant that on the
+ * 24-hour sweep of #3598 the 527 switches it had already found — stored,
+ * visible in the product, correct — were unimportable for the whole day.
+ *
+ * These tests pin that a running scan's results are treated as first-class,
+ * and that the marker protocol still holds when the row underneath is moving.
+ */
+describe("auto-import from a scan that is still sweeping (issue #3599)", () => {
+  /*
+   * A scan mid-sweep: no completedAt (the run has not ended), and the two
+   * host counters its partial uploads have been moving.
+   */
+  function makeInProgressScan(
+    overrides: Record<string, unknown> = {},
+  ): NetworkDeviceDiscoveryScan {
+    return makeScan({
+      status: "In Progress",
+      completedAt: undefined,
+      scannedHostCount: 4096,
+      respondedHostCount: 12,
+      ...overrides,
+    });
+  }
+
+  it("imports the hosts a running sweep has already found", async () => {
+    scanFindOneByMock.mockResolvedValue(
+      makeInProgressScan({ discoveredDevices: [makeHost()] }),
+    );
+    ruleFindByMock.mockResolvedValue([makeRule()]);
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    expect(result).toMatchObject({ hostsMatched: 1, devicesCreated: 1 });
+    expect(createdDevice(0).hostname).toBe("10.0.0.5");
+  });
+
+  it("asks for a running scan as well as a finished one", async () => {
+    scanFindOneByMock.mockResolvedValue(makeInProgressScan());
+    ruleFindByMock.mockResolvedValue([makeRule()]);
+
+    await processScan();
+
+    const query: any = scanFindOneByMock.mock.calls[0]![0].query;
+
+    expect(statusesMatchedBy(query.status)).toEqual([
+      "Completed",
+      "In Progress",
+    ]);
+  });
+
+  /*
+   * The freshness horizon retires results older than MAX_RESULT_AGE_IN_HOURS
+   * without importing them. It is keyed on completedAt, which a running scan
+   * does not have — and must not be read as "infinitely old". A sweep that has
+   * been running for two hours is the opposite of stale.
+   */
+  it("never treats a running scan's results as too old to import", async () => {
+    scanFindOneByMock.mockResolvedValue(
+      makeInProgressScan({ discoveredDevices: [makeHost()] }),
+    );
+    ruleFindByMock.mockResolvedValue([makeRule()]);
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    expect(result).toMatchObject({ devicesCreated: 1 });
+    expect(loggerWarnMock).not.toHaveBeenCalledWith(
+      expect.stringContaining("stamping it processed without importing"),
+      expect.anything(),
+    );
+  });
+
+  /*
+   * The marker protocol, on a row that is still moving.
+   *
+   * A running scan's status and completedAt do not change between uploads, so
+   * they cannot by themselves tell "the results I evaluated" from "the results
+   * that landed while I was evaluating". The host counters can, and they are
+   * what a partial upload moves.
+   */
+  it("guards the stamp on the run state it actually read, counters included", async () => {
+    scanFindOneByMock.mockResolvedValue(
+      makeInProgressScan({ discoveredDevices: [makeHost()] }),
+    );
+    ruleFindByMock.mockResolvedValue([makeRule()]);
+
+    await processScan();
+
+    const stamp: any = scanUpdateMock.mock.calls[0]![0];
+
+    expect(stamp.expectedData).toEqual({
+      status: "In Progress",
+      completedAt: null,
+      scannedHostCount: 4096,
+      respondedHostCount: 12,
+    });
+  });
+
+  // The counters are only a version token if they are actually read.
+  it("selects the counters it guards on", async () => {
+    scanFindOneByMock.mockResolvedValue(makeInProgressScan());
+    ruleFindByMock.mockResolvedValue([makeRule()]);
+
+    await processScan();
+
+    const select: any = scanFindOneByMock.mock.calls[0]![0].select;
+
+    expect(select.scannedHostCount).toBe(true);
+    expect(select.respondedHostCount).toBe(true);
+    expect(select.status).toBe(true);
+    expect(select.completedAt).toBe(true);
+  });
+
+  /*
+   * The write-back still retires the hosts this pass consumed, so the Review
+   * dialog stops offering them — on a running scan just as on a finished one.
+   */
+  it("flips isAlreadyRegistered on the rows it imported", async () => {
+    scanFindOneByMock.mockResolvedValue(
+      makeInProgressScan({
+        discoveredDevices: [makeHost(), makeHost({ ipAddress: "10.0.0.99" })],
+      }),
+    );
+    ruleFindByMock.mockResolvedValue([makeRule({ ipMatchTarget: "10.0.0.5" })]);
+
+    await processScan();
+
+    const written: Array<DiscoveredNetworkDevice> = scanUpdateMock.mock
+      .calls[0]![0].data.discoveredDevices as Array<DiscoveredNetworkDevice>;
+
+    expect(written[0]!.isAlreadyRegistered).toBe(true);
+    expect(written[1]!.isAlreadyRegistered).toBeUndefined();
+  });
+
+  /*
+   * A running scan is offered again on the next tick — its next partial upload
+   * clears the marker — so an address it already imported must read as
+   * registered rather than being created twice.
+   */
+  it("skips an address it already imported when the scan is offered again", async () => {
+    const alreadyImported: NetworkDevice = {
+      id: new ObjectID("55555555-5555-4555-8555-555555555555"),
+      projectId: PROJECT_ID,
+      hostname: "10.0.0.5",
+    } as unknown as NetworkDevice;
+
+    deviceFindByMock.mockResolvedValue([alreadyImported]);
+    scanFindOneByMock.mockResolvedValue(
+      makeInProgressScan({ discoveredDevices: [makeHost()] }),
+    );
+    ruleFindByMock.mockResolvedValue([makeRule()]);
+
+    const result: AutoImportRuleRunResult | null = await processScan();
+
+    expect(createMock).not.toHaveBeenCalled();
+    expect(result).toMatchObject({
+      hostsMatched: 1,
+      devicesCreated: 0,
+      hostsSkippedAlreadyRegistered: 1,
+    });
+  });
+
+  /*
+   * The manual path, which is where the report came from: "Run Now" said it
+   * had checked 25 hosts while 527 sat in the Devices list, because the scan
+   * that found them had not finished.
+   */
+  it("Run Now reads a running scan's results too", async () => {
+    ruleFindOneByMock.mockResolvedValue(makeRule());
+    ruleFindByMock.mockResolvedValue([]);
+    mockRunNowScans([makeInProgressScan({ discoveredDevices: [makeHost()] })]);
+
+    const result: AutoImportRuleRunResult = await runRule(true);
+
+    expect(result).toMatchObject({ hostsEvaluated: 1, hostsMatched: 1 });
+
+    const listQuery: any = scanFindByMock.mock.calls[0]![0].query;
+    expect(statusesMatchedBy(listQuery.status)).toEqual([
+      "Completed",
+      "In Progress",
+    ]);
+  });
+});

package/Tests/Server/Services/NetworkDeviceAutoImportRuleService.test.ts

@@ -1,5 +1,7 @@
 import NetworkDeviceAutoImportRuleService from "../../../Server/Services/NetworkDeviceAutoImportRuleService";
 import MonitorTemplateService from "../../../Server/Services/MonitorTemplateService";
+import NetworkAlertPolicyService from "../../../Server/Services/NetworkAlertPolicyService";
+import NetworkAlertPolicy from "../../../Models/DatabaseModels/NetworkAlertPolicy";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import NetworkDeviceAutoImportRule from "../../../Models/DatabaseModels/NetworkDeviceAutoImportRule";
 import MonitorTemplate from "../../../Models/DatabaseModels/MonitorTemplate";
@@ -97,11 +99,33 @@ function mockMonitorTemplate(
     delete monitorTemplate.projectId;
   }
 
+  /*
+   * A template is only selectable if no Network Alert Policy already
+   * provisions from it, so every accepting case has to answer that question
+   * too. "No policy claims it" is the default; the cases about the conflict
+   * itself override this spy.
+   */
+  jest.spyOn(NetworkAlertPolicyService, "findBy").mockResolvedValue([]);
+
   return jest
     .spyOn(MonitorTemplateService, "findOneById")
     .mockResolvedValue(monitorTemplate);
 }
 
+/*
+ * The other side of the exclusivity rule: this template already belongs to a
+ * policy.
+ */
+function mockPolicyOwnsTemplate(): jest.SpyInstance {
+  const policy: NetworkAlertPolicy = new NetworkAlertPolicy();
+  policy._id = "99999999-9999-4999-8999-999999999999";
+  policy.projectId = PROJECT_ID;
+
+  return jest
+    .spyOn(NetworkAlertPolicyService, "findBy")
+    .mockResolvedValue([policy]);
+}
+
 describe("NetworkDeviceAutoImportRule monitor template column access", () => {
   const rule: NetworkDeviceAutoImportRule = new NetworkDeviceAutoImportRule();
 
@@ -417,11 +441,15 @@ describe("NetworkDeviceAutoImportRuleService.onBeforeCreate monitor template val
     expect(findTemplateSpy).not.toHaveBeenCalled();
   });
 
-  it("rejects selecting a template when ping-only hosts are included without a lookup", async () => {
-    const findTemplateSpy: jest.SpyInstance = jest.spyOn(
-      MonitorTemplateService,
-      "findOneById",
-    );
+  /*
+   * Ping-only hosts import as Probe devices under ping-first polling, so a
+   * rule that includes them may carry a Network Device monitor template
+   * like any other: the template is validated the ordinary way, and the
+   * refusal that used to live here ("Rules that include ping-only hosts
+   * cannot select a Network Device monitor template") is gone.
+   */
+  it("allows selecting a template on a rule that includes ping-only hosts", async () => {
+    const findTemplateSpy: jest.SpyInstance = mockMonitorTemplate();
 
     await expect(
       (NetworkDeviceAutoImportRuleService as any).onBeforeCreate(
@@ -430,11 +458,9 @@ describe("NetworkDeviceAutoImportRuleService.onBeforeCreate monitor template val
           includePingOnlyHosts: true,
         }),
       ),
-    ).rejects.toThrow(
-      "Rules that include ping-only hosts cannot select a Network Device monitor template.",
-    );
+    ).resolves.toBeDefined();
 
-    expect(findTemplateSpy).not.toHaveBeenCalled();
+    expect(findTemplateSpy).toHaveBeenCalledTimes(1);
   });
 
   it("allows exclusion and ping-only rules when no template is selected", async () => {
@@ -451,6 +477,57 @@ describe("NetworkDeviceAutoImportRuleService.onBeforeCreate monitor template val
 
     expect(findTemplateSpy).not.toHaveBeenCalled();
   });
+
+  /*
+   * THE INVARIANT THIS CASE EXISTS FOR. A provisioned monitor's provenance is
+   * the pair (device, template) — the partial unique index Monitor carries —
+   * so one template has room for exactly one provisioner per device. Sharing
+   * a template between a rule and a policy would have the rule provision a
+   * monitor on import that the policy's engine then believes it owns, and
+   * delete the moment that device left the policy's scope: an import rule
+   * silently losing its monitors because somebody edited a site list.
+   *
+   * NetworkAlertPolicyService refuses the mirror image (a policy on a
+   * template a rule uses). Both halves have to exist, or whichever thing is
+   * created second wins by accident.
+   */
+  it("refuses a template a network alert policy already provisions from", async () => {
+    mockMonitorTemplate();
+    mockPolicyOwnsTemplate();
+
+    await expect(
+      (NetworkDeviceAutoImportRuleService as any).onBeforeCreate(
+        makeCreateBy({ monitorTemplateId: TEMPLATE_ID }),
+      ),
+    ).rejects.toThrow(
+      "This Monitor Template is used by a network alert policy; pick a different template.",
+    );
+  });
+
+  it("asks about policies within the rule's own project", async () => {
+    mockMonitorTemplate();
+    const policySpy: jest.SpyInstance = mockPolicyOwnsTemplate();
+
+    await expect(
+      (NetworkDeviceAutoImportRuleService as any).onBeforeCreate(
+        makeCreateBy({ monitorTemplateId: TEMPLATE_ID }),
+      ),
+    ).rejects.toThrow(BadDataException);
+
+    /*
+     * Project-keyed, so another tenant's policy on a template of the same id
+     * can never refuse this project's rule — and can never be inferred from
+     * the refusal either.
+     */
+    expect(policySpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        query: expect.objectContaining({
+          projectId: PROJECT_ID,
+          monitorTemplateId: TEMPLATE_ID,
+        }),
+      }),
+    );
+  });
 });
 
 describe("NetworkDeviceAutoImportRuleService.onBeforeUpdate monitor template validation", () => {
@@ -729,8 +806,15 @@ describe("NetworkDeviceAutoImportRuleService.onBeforeUpdate monitor template val
     expect(findTemplateSpy).not.toHaveBeenCalled();
   });
 
-  it("rejects enabling ping-only hosts on a template-backed rule", async () => {
-    mockExistingRule({ monitorTemplateId: TEMPLATE_ID });
+  /*
+   * Toggling ping-only hosts has no bearing on the template any more, so
+   * it is not a provisioning change either: no row snapshot, no template
+   * lookup, and certainly no refusal.
+   */
+  it("lets ping-only hosts be enabled on a template-backed rule without a lookup", async () => {
+    const findRulesSpy: jest.SpyInstance = mockExistingRule({
+      monitorTemplateId: TEMPLATE_ID,
+    });
     const findTemplateSpy: jest.SpyInstance = jest.spyOn(
       MonitorTemplateService,
       "findOneById",
@@ -740,8 +824,9 @@ describe("NetworkDeviceAutoImportRuleService.onBeforeUpdate monitor template val
       (NetworkDeviceAutoImportRuleService as any).onBeforeUpdate(
         makeUpdateBy({ includePingOnlyHosts: true }),
       ),
-    ).rejects.toThrow(BadDataException);
+    ).resolves.toBeDefined();
 
+    expect(findRulesSpy).not.toHaveBeenCalled();
     expect(findTemplateSpy).not.toHaveBeenCalled();
   });
 

package/Tests/Server/Services/NetworkDeviceAutoMonitorLifecycle.test.ts

@@ -16,7 +16,14 @@ import MonitorType from "../../../Types/Monitor/MonitorType";
 import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
 import LIMIT_MAX from "../../../Types/Database/LimitMax";
-import { afterEach, describe, expect, it, jest } from "@jest/globals";
+import {
+  afterEach,
+  beforeEach,
+  describe,
+  expect,
+  it,
+  jest,
+} from "@jest/globals";
 import type { SpyInstance } from "jest-mock";
 import { getMetadataArgsStorage } from "typeorm";
 import { RelationMetadataArgs } from "typeorm/metadata-args/RelationMetadataArgs";
@@ -304,7 +311,32 @@ describe("auto-provisioned Monitor lifecycle", () => {
   });
 });
 
+/*
+ * Reads the SQL a QueryHelper operator would emit, so a test can say "this
+ * clause is IS NULL" rather than "this clause is some opaque object".
+ */
+function rawSqlOf(operator: unknown): string {
+  const findOperator: { getSql?: (alias: string) => string } = operator as {
+    getSql?: (alias: string) => string;
+  };
+
+  return findOperator?.getSql
+    ? findOperator.getSql("column")
+    : String(operator);
+}
+
 describe("Network Device deletion with automatic monitors", () => {
+  /*
+   * The delete hook now asks the Network Alert Policy engine to remove the
+   * POLICY-owned monitors of every device in the request, as root, before it
+   * deletes the rest with the caller's own permissions. That engine call
+   * pages MonitorService.findBy; unless a case is about policy monitors, the
+   * answer is "this device has none".
+   */
+  beforeEach(() => {
+    jest.spyOn(MonitorService, "findBy").mockResolvedValue([]);
+  });
+
   it("fails closed at the foreign key when a monitor appears after service preflight", () => {
     const provenanceRelation: RelationMetadataArgs | undefined =
       getMetadataArgsStorage().relations.find(
@@ -360,16 +392,31 @@ describe("Network Device deletion with automatic monitors", () => {
 
     expect(deleteMonitorSpy).toHaveBeenCalledWith(
       expect.objectContaining({
-        query: {
+        query: expect.objectContaining({
           projectId: PROJECT_ID,
           autoProvisionedNetworkDeviceId: DEVICE_ID,
-        },
+        }),
         props: expect.objectContaining({
           tenantId: PROJECT_ID,
           userId: props.userId,
         }),
       }),
     );
+
+    /*
+     * ...and ONLY the monitors no alert policy owns. A policy's monitors are
+     * system-managed — the API can neither set nor clear their
+     * networkAlertPolicyId — so requiring the caller's Monitor delete
+     * permission on them would refuse a device delete over rows the caller
+     * never chose to own. The engine removes those as root instead.
+     */
+    const deletedMonitorQuery: Query<Monitor> = (
+      deleteMonitorSpy.mock.calls[0]![0] as { query: Query<Monitor> }
+    ).query;
+
+    expect(rawSqlOf(deletedMonitorQuery.networkAlertPolicyId)).toContain(
+      "IS NULL",
+    );
   });
 
   it("does not require Monitor delete permission when the device has no automatic monitor", async () => {
@@ -393,6 +440,104 @@ describe("Network Device deletion with automatic monitors", () => {
     expect(deleteMonitorSpy).not.toHaveBeenCalled();
   });
 
+  /*
+   * THE INVARIANT THESE TWO CASES EXIST FOR. Monitor's provenance FK is
+   * RESTRICT, so a policy-owned monitor left behind makes the device delete
+   * fail outright — and those monitors are exactly the ones the operator
+   * never chose individually, because the API cannot write
+   * networkAlertPolicyId at all. They are removed by the engine, as root,
+   * and they never appear in the caller-authorized preflight.
+   */
+  it("removes the device's policy-owned monitors as root", async () => {
+    const policyMonitor: Monitor = automaticMonitor();
+    policyMonitor.networkAlertPolicyId = ObjectID.generate();
+
+    jest
+      .spyOn(ModelPermission, "checkDeleteQueryPermission")
+      .mockImplementation(allowDeleteQuery);
+    jest.spyOn(NetworkDeviceService, "findBy").mockResolvedValue([device()]);
+    // No monitors are left for the caller-permissioned half of the cleanup.
+    jest
+      .spyOn(MonitorService, "countBy")
+      .mockResolvedValue(new PositiveNumber(0));
+    jest
+      .spyOn(MonitorService, "findBy")
+      .mockResolvedValueOnce([policyMonitor])
+      .mockResolvedValue([]);
+    const deleteMonitorSpy: SpyInstance<typeof MonitorService.deleteBy> = jest
+      .spyOn(MonitorService, "deleteBy")
+      .mockResolvedValue(1);
+
+    await (NetworkDeviceService as any).onBeforeDelete({
+      query: { _id: DEVICE_ID },
+      limit: 1,
+      skip: 0,
+      props: { tenantId: PROJECT_ID, userId: ObjectID.generate() },
+    });
+
+    expect(deleteMonitorSpy).toHaveBeenCalledWith(
+      expect.objectContaining({
+        props: { isRoot: true },
+      }),
+    );
+
+    /*
+     * Still keyed on "a policy owns it" at the moment of the delete, so a
+     * monitor that lost its owner between the page read and the delete is
+     * left to the caller-permissioned half rather than swept up as root.
+     */
+    const policyDeleteQuery: Query<Monitor> = (
+      deleteMonitorSpy.mock.calls[0]![0] as { query: Query<Monitor> }
+    ).query;
+
+    expect(rawSqlOf(policyDeleteQuery.networkAlertPolicyId)).toContain(
+      "IS NOT NULL",
+    );
+  });
+
+  it("does not remove policy monitors until every device has cleared the preflight", async () => {
+    jest
+      .spyOn(ModelPermission, "checkDeleteQueryPermission")
+      .mockImplementation(
+        async (
+          modelType: { new (): BaseModel },
+          query: Query<BaseModel>,
+          props: DatabaseCommonInteractionProps,
+        ): Promise<Query<BaseModel>> => {
+          if ((modelType as unknown) === Monitor) {
+            throw new NotAuthorizedException("no monitor delete");
+          }
+
+          return await allowDeleteQuery(modelType, query, props);
+        },
+      );
+    jest
+      .spyOn(NetworkDeviceService, "findBy")
+      .mockResolvedValue([device(), otherDevice()]);
+    jest
+      .spyOn(MonitorService, "countBy")
+      .mockResolvedValue(new PositiveNumber(1));
+    const deleteMonitorSpy: SpyInstance<typeof MonitorService.deleteBy> =
+      jest.spyOn(MonitorService, "deleteBy");
+
+    await expect(
+      (NetworkDeviceService as any).onBeforeDelete({
+        query: { _id: DEVICE_ID },
+        limit: 2,
+        skip: 0,
+        props: { tenantId: PROJECT_ID },
+      }),
+    ).rejects.toThrow(NotAuthorizedException);
+
+    /*
+     * Nothing was deleted. A policy's monitors carry the fleet's incident
+     * history, and destroying them for a device that then SURVIVES the
+     * request — because a later device in the same bulk delete was refused —
+     * would be unrecoverable.
+     */
+    expect(deleteMonitorSpy).not.toHaveBeenCalled();
+  });
+
   it("keeps the device when Monitor deletion is not authorized", async () => {
     jest
       .spyOn(ModelPermission, "checkDeleteQueryPermission")