@oneuptime/common 12.0.32 → 12.0.34

package/build/dist/Server/Utils/CustomField/CustomFieldMappingRegistry.js

@@ -0,0 +1,226 @@
+import CustomFieldMappingSourceResource from "../../../Types/CustomField/CustomFieldMappingSourceResource";
+import { getCustomFieldMappingRelationSelect, getCustomFieldMappingSources, } from "../../../Types/CustomField/CustomFieldMappingCatalog";
+import AlertCustomField from "../../../Models/DatabaseModels/AlertCustomField";
+import IncidentCustomField from "../../../Models/DatabaseModels/IncidentCustomField";
+import ScheduledMaintenanceCustomField from "../../../Models/DatabaseModels/ScheduledMaintenanceCustomField";
+import AlertService from "../../Services/AlertService";
+import IncidentService from "../../Services/IncidentService";
+import ScheduledMaintenanceService from "../../Services/ScheduledMaintenanceService";
+import MonitorService from "../../Services/MonitorService";
+import AlertCustomFieldService from "../../Services/AlertCustomFieldService";
+import IncidentCustomFieldService from "../../Services/IncidentCustomFieldService";
+import MonitorCustomFieldService from "../../Services/MonitorCustomFieldService";
+import ScheduledMaintenanceCustomFieldService from "../../Services/ScheduledMaintenanceCustomFieldService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import RelationIdUtil from "../Database/RelationIdUtil";
+const buildMonitorSource = (data) => {
+    const info = getCustomFieldMappingSources(data.definitionTableName).find((source) => {
+        return source.resource === CustomFieldMappingSourceResource.Monitor;
+    });
+    if (!info) {
+        /*
+         * The catalog is the single source of truth for which pairs exist. If it
+         * no longer lists this one, the registry must not invent it — a mapping
+         * the settings UI cannot offer would be a value nobody can explain.
+         */
+        throw new Error(`CustomFieldMappingRegistry: ${data.definitionTableName} has no Monitor source in the catalog.`);
+    }
+    const isMany = data.isManySources;
+    return {
+        info: info,
+        getSourceService: () => {
+            return MonitorService;
+        },
+        getSourceDefinitionService: () => {
+            return MonitorCustomFieldService;
+        },
+        relationDataKeys: info.relationDataKeys,
+        targetRelationSelect: getCustomFieldMappingRelationSelect(info),
+        readSourceIdsFromRecord: (record) => {
+            if (!isMany) {
+                const monitorId = RelationIdUtil.read(record, ["monitorId", "monitor"]);
+                return monitorId ? [monitorId] : [];
+            }
+            const monitors = ((record === null || record === void 0 ? void 0 : record.monitors) ||
+                []);
+            return monitors
+                .map((monitor) => {
+                return RelationIdUtil.read(monitor, ["_id", "id"]);
+            })
+                .filter((id) => {
+                return Boolean(id);
+            });
+        },
+        readSourceIdsFromPayload: (payload) => {
+            if (!isMany) {
+                const hasKey = RelationIdUtil.isWritten(Object.keys(payload || {}), info.relationDataKeys);
+                if (!hasKey) {
+                    return null;
+                }
+                const monitorId = RelationIdUtil.read(payload, info.relationDataKeys);
+                return monitorId ? [monitorId] : [];
+            }
+            if ((payload || {})[info.targetRelationProperty] === undefined) {
+                return null;
+            }
+            const monitors = ((payload || {})[info.targetRelationProperty] || []);
+            return monitors
+                .map((monitor) => {
+                return RelationIdUtil.read(monitor, ["_id", "id"]);
+            })
+                .filter((id) => {
+                return Boolean(id);
+            });
+        },
+        readHydratedSourcesFromPayload: (payload) => {
+            const hydrated = {};
+            /*
+             * The RELATION-object spelling only. A payload that carries just the FK
+             * (`monitorId`) has no bag to take, and must fall through to a lookup.
+             */
+            const relationObjectKey = isMany
+                ? info.targetRelationProperty
+                : info.relationDataKeys[info.relationDataKeys.length - 1];
+            const candidates = isMany
+                ? (payload || {})[relationObjectKey] || []
+                : [(payload || {})[relationObjectKey]].filter(Boolean);
+            for (const monitor of candidates) {
+                if (!monitor || !monitor.id) {
+                    continue;
+                }
+                /*
+                 * Only a monitor that was read WITH its customFields is usable here.
+                 * An id stub is not the same as a monitor whose bag is genuinely
+                 * empty: treating it as empty skips the lookup and silently inherits
+                 * nothing.
+                 *
+                 * `!== undefined` and NOT `hasOwnProperty`. Every model class in this
+                 * codebase initialises its columns in the class body
+                 * (`public customFields?: JSONObject = undefined;`), so a bare
+                 * `new Monitor()` already owns the property and hasOwnProperty is true
+                 * for every stub ever built. A row read WITH the column, whose value
+                 * is NULL in Postgres, arrives as `null` — which is a real answer and
+                 * correctly counts as hydrated.
+                 */
+                if (monitor.customFields === undefined) {
+                    continue;
+                }
+                hydrated[monitor.id.toString()] = (monitor.customFields ||
+                    {});
+            }
+            return hydrated;
+        },
+        buildTargetQueryForSourceId: (sourceId) => {
+            return {
+                [info.targetRelationProperty]: isMany
+                    ? QueryHelper.inRelationArray([sourceId])
+                    : sourceId,
+            };
+        },
+    };
+};
+/*
+ * Built on FIRST USE, not at module load.
+ *
+ * `new AlertCustomField().tableName` reads metadata that the model's
+ * @TableMetadata decorator installs when the class is defined. This module
+ * sits in an import cycle (AlertService/IncidentService/ScheduledMaintenance
+ * Service import it and it imports them back), so it can be reached while
+ * those modules — and the model classes they pull in — are still
+ * initialising. At that point `tableName` is `undefined`, the catalog lookup
+ * below misses, and buildMonitorSource throws AT IMPORT TIME, taking down
+ * everything that transitively imports IncidentService, BaseAPI included.
+ * The `!` assertion is what kept tsc quiet about it.
+ *
+ * Deferring construction is the same discipline this file already applies to
+ * every service reference, for the same reason.
+ *
+ * MEMOISED DELIBERATELY, not rebuilt per call: CustomFieldMappingService
+ * .propagateFromSourceRecord matches `mapping.source === pair.source` by
+ * REFERENCE across two separate accessor calls. Handing out fresh objects
+ * would leave that filter matching nothing and propagation would silently
+ * stop working.
+ */
+let CUSTOM_FIELD_MAPPING_TARGETS = null;
+const buildCustomFieldMappingTargets = () => {
+    return [
+        {
+            targetName: "Alert",
+            definitionTableName: new AlertCustomField().tableName,
+            getTargetService: () => {
+                return AlertService;
+            },
+            getDefinitionService: () => {
+                return AlertCustomFieldService;
+            },
+            sources: [
+                buildMonitorSource({
+                    isManySources: false,
+                    definitionTableName: new AlertCustomField().tableName,
+                }),
+            ],
+        },
+        {
+            targetName: "Incident",
+            definitionTableName: new IncidentCustomField().tableName,
+            getTargetService: () => {
+                return IncidentService;
+            },
+            getDefinitionService: () => {
+                return IncidentCustomFieldService;
+            },
+            sources: [
+                buildMonitorSource({
+                    isManySources: true,
+                    definitionTableName: new IncidentCustomField().tableName,
+                }),
+            ],
+        },
+        {
+            targetName: "Scheduled Maintenance",
+            definitionTableName: new ScheduledMaintenanceCustomField().tableName,
+            getTargetService: () => {
+                return ScheduledMaintenanceService;
+            },
+            getDefinitionService: () => {
+                return ScheduledMaintenanceCustomFieldService;
+            },
+            sources: [
+                buildMonitorSource({
+                    isManySources: true,
+                    definitionTableName: new ScheduledMaintenanceCustomField()
+                        .tableName,
+                }),
+            ],
+        },
+    ];
+};
+const getTargets = () => {
+    if (!CUSTOM_FIELD_MAPPING_TARGETS) {
+        CUSTOM_FIELD_MAPPING_TARGETS = buildCustomFieldMappingTargets();
+    }
+    return CUSTOM_FIELD_MAPPING_TARGETS;
+};
+export const getCustomFieldMappingTargets = () => {
+    return getTargets();
+};
+export const getCustomFieldMappingTarget = (definitionTableName) => {
+    if (!definitionTableName) {
+        return undefined;
+    }
+    return getTargets().find((target) => {
+        return target.definitionTableName === definitionTableName;
+    });
+};
+export const getCustomFieldMappingTargetsForSource = (resource) => {
+    const matches = [];
+    for (const target of getTargets()) {
+        for (const source of target.sources) {
+            if (source.info.resource === resource) {
+                matches.push({ target: target, source: source });
+            }
+        }
+    }
+    return matches;
+};
+//# sourceMappingURL=CustomFieldMappingRegistry.js.map

package/build/dist/Server/Utils/CustomField/CustomFieldMappingRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomFieldMappingRegistry.js","sourceRoot":"","sources":["../../../../../Server/Utils/CustomField/CustomFieldMappingRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,gCAAgC,MAAM,6DAA6D,CAAC;AAC3G,OAAO,EAEL,mCAAmC,EACnC,4BAA4B,GAC7B,MAAM,sDAAsD,CAAC;AAI9D,OAAO,gBAAgB,MAAM,iDAAiD,CAAC;AAC/E,OAAO,mBAAmB,MAAM,oDAAoD,CAAC;AACrF,OAAO,+BAA+B,MAAM,gEAAgE,CAAC;AAC7G,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,eAAe,MAAM,gCAAgC,CAAC;AAC7D,OAAO,2BAA2B,MAAM,4CAA4C,CAAC;AACrF,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAC3D,OAAO,uBAAuB,MAAM,wCAAwC,CAAC;AAC7E,OAAO,0BAA0B,MAAM,2CAA2C,CAAC;AACnF,OAAO,yBAAyB,MAAM,0CAA0C,CAAC;AACjF,OAAO,sCAAsC,MAAM,uDAAuD,CAAC;AAC3G,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,cAAc,MAAM,4BAA4B,CAAC;AAwFxD,MAAM,kBAAkB,GAA+B,CAAC,IAGvD,EAAiC,EAAE;IAClC,MAAM,IAAI,GACR,4BAA4B,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,CACzD,CAAC,MAAoC,EAAE,EAAE;QACvC,OAAO,MAAM,CAAC,QAAQ,KAAK,gCAAgC,CAAC,OAAO,CAAC;IACtE,CAAC,CACF,CAAC;IAEJ,IAAI,CAAC,IAAI,EAAE,CAAC;QACV;;;;WAIG;QACH,MAAM,IAAI,KAAK,CACb,+BAA+B,IAAI,CAAC,mBAAmB,wCAAwC,CAChG,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAY,IAAI,CAAC,aAAa,CAAC;IAE3C,OAAO;QACL,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,GAAwB,EAAE;YAC1C,OAAO,cAAgD,CAAC;QAC1D,CAAC;QACD,0BAA0B,EAAE,GAAwB,EAAE;YACpD,OAAO,yBAA2D,CAAC;QACrE,CAAC;QACD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,oBAAoB,EAAE,mCAAmC,CACvD,IAAI,CACS;QACf,uBAAuB,EAAE,CAAC,MAAW,EAAmB,EAAE;YACxD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,GAAoB,cAAc,CAAC,IAAI,CACpD,MAAiC,EACjC,CAAC,WAAW,EAAE,SAAS,CAAC,CACzB,CAAC;gBAEF,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,QAAQ,GAAmB,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ;gBAChD,EAAE,CAAmB,CAAC;YAExB,OAAO,QAAQ;iBACZ,GAAG,CAAC,CAAC,OAAgB,EAAE,EAAE;gBACxB,OAAO,cAAc,CAAC,IAAI,CACxB,OAA6C,EAC7C,CAAC,KAAK,EAAE,IAAI,CAAC,CACd,CAAC;YACJ,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,EAAmB,EAAkB,EAAE;gBAC9C,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,wBAAwB,EAAE,CAAC,OAAY,EAA0B,EAAE;YACjE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAY,cAAc,CAAC,SAAS,CAC9C,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAC1B,IAAI,CAAC,gBAAgB,CACtB,CAAC;gBAEF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,MAAM,SAAS,GAAoB,cAAc,CAAC,IAAI,CACpD,OAAkC,EAClC,IAAI,CAAC,gBAAgB,CACtB,CAAC;gBAEF,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,CAAC;YAED,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC/D,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAmB,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAC/C,IAAI,CAAC,sBAAsB,CAC5B,IAAI,EAAE,CAAmB,CAAC;YAE3B,OAAO,QAAQ;iBACZ,GAAG,CAAC,CAAC,OAAgB,EAAE,EAAE;gBACxB,OAAO,cAAc,CAAC,IAAI,CACxB,OAA6C,EAC7C,CAAC,KAAK,EAAE,IAAI,CAAC,CACd,CAAC;YACJ,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,EAAmB,EAAkB,EAAE;gBAC9C,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC;QACD,8BAA8B,EAAE,CAC9B,OAAY,EACgB,EAAE;YAC9B,MAAM,QAAQ,GAA+B,EAAE,CAAC;YAEhD;;;eAGG;YACH,MAAM,iBAAiB,GAAW,MAAM;gBACtC,CAAC,CAAC,IAAI,CAAC,sBAAsB;gBAC7B,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;YAE7D,MAAM,UAAU,GAAmB,MAAM;gBACvC,CAAC,CAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAoB,IAAI,EAAE;gBAC9D,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAY,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAEpE,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;gBACjC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAC5B,SAAS;gBACX,CAAC;gBAED;;;;;;;;;;;;;mBAaG;gBACH,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;oBACvC,SAAS;gBACX,CAAC;gBAED,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,YAAY;oBACrD,EAAE,CAAe,CAAC;YACtB,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QACD,2BAA2B,EAAE,CAAC,QAAkB,EAAc,EAAE;YAC9D,OAAO;gBACL,CAAC,IAAI,CAAC,sBAAsB,CAAC,EAAE,MAAM;oBACnC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,CAAC;oBACzC,CAAC,CAAC,QAAQ;aACY,CAAC;QAC7B,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,IAAI,4BAA4B,GAC9B,IAAI,CAAC;AAKP,MAAM,8BAA8B,GAClC,GAAyC,EAAE;IACzC,OAAO;QACL;YACE,UAAU,EAAE,OAAO;YACnB,mBAAmB,EAAE,IAAI,gBAAgB,EAAE,CAAC,SAAU;YACtD,gBAAgB,EAAE,GAAwB,EAAE;gBAC1C,OAAO,YAA8C,CAAC;YACxD,CAAC;YACD,oBAAoB,EAAE,GAAwB,EAAE;gBAC9C,OAAO,uBAAyD,CAAC;YACnE,CAAC;YACD,OAAO,EAAE;gBACP,kBAAkB,CAAC;oBACjB,aAAa,EAAE,KAAK;oBACpB,mBAAmB,EAAE,IAAI,gBAAgB,EAAE,CAAC,SAAU;iBACvD,CAAC;aACH;SACF;QACD;YACE,UAAU,EAAE,UAAU;YACtB,mBAAmB,EAAE,IAAI,mBAAmB,EAAE,CAAC,SAAU;YACzD,gBAAgB,EAAE,GAAwB,EAAE;gBAC1C,OAAO,eAAiD,CAAC;YAC3D,CAAC;YACD,oBAAoB,EAAE,GAAwB,EAAE;gBAC9C,OAAO,0BAA4D,CAAC;YACtE,CAAC;YACD,OAAO,EAAE;gBACP,kBAAkB,CAAC;oBACjB,aAAa,EAAE,IAAI;oBACnB,mBAAmB,EAAE,IAAI,mBAAmB,EAAE,CAAC,SAAU;iBAC1D,CAAC;aACH;SACF;QACD;YACE,UAAU,EAAE,uBAAuB;YACnC,mBAAmB,EAAE,IAAI,+BAA+B,EAAE,CAAC,SAAU;YACrE,gBAAgB,EAAE,GAAwB,EAAE;gBAC1C,OAAO,2BAA6D,CAAC;YACvE,CAAC;YACD,oBAAoB,EAAE,GAAwB,EAAE;gBAC9C,OAAO,sCAAwE,CAAC;YAClF,CAAC;YACD,OAAO,EAAE;gBACP,kBAAkB,CAAC;oBACjB,aAAa,EAAE,IAAI;oBACnB,mBAAmB,EAAE,IAAI,+BAA+B,EAAE;yBACvD,SAAU;iBACd,CAAC;aACH;SACF;KACF,CAAC;AACJ,CAAC,CAAC;AAIJ,MAAM,UAAU,GACd,GAAyC,EAAE;IACzC,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,8BAA8B,EAAE,CAAC;IAClE,CAAC;IAED,OAAO,4BAA4B,CAAC;AACtC,CAAC,CAAC;AAKJ,MAAM,CAAC,MAAM,4BAA4B,GACvC,GAAyC,EAAE;IACzC,OAAO,UAAU,EAAE,CAAC;AACtB,CAAC,CAAC;AAMJ,MAAM,CAAC,MAAM,2BAA2B,GACtC,CACE,mBAAuC,EACI,EAAE;IAC7C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,MAAqC,EAAE,EAAE;QACjE,OAAO,MAAM,CAAC,mBAAmB,KAAK,mBAAmB,CAAC;IAC5D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAaJ,MAAM,CAAC,MAAM,qCAAqC,GAChD,CACE,QAA0C,EAIzC,EAAE;IACH,MAAM,OAAO,GAGR,EAAE,CAAC;IAER,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,EAAE,CAAC;QAClC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}

package/build/dist/Server/Utils/CustomField/CustomFieldMappingValidator.js

@@ -0,0 +1,189 @@
+import { getCustomFieldMappingCompatibilityError } from "../../../Types/CustomField/CustomFieldValueMapping";
+import { getCustomFieldMappingSources, } from "../../../Types/CustomField/CustomFieldMappingCatalog";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import { getCustomFieldMappingTarget, } from "./CustomFieldMappingRegistry";
+/*
+ * Turning a mapping off has to clear BOTH columns, and `showIf` will not do it
+ * for us: it hides the "field to copy from" input but BasicForm still posts the
+ * whole value bag, so clearing "Map value from" leaves the field name behind.
+ * A half-set mapping is not a state anything downstream should reason about.
+ *
+ * What this deliberately does NOT do is treat "absent" as "cleared". An update
+ * payload is a PARTIAL: changing only the source field name says nothing about
+ * the resource, and reading that as "turn the mapping off" would silently
+ * delete a working mapping every time someone repointed it at another field.
+ * Only an explicitly emptied key clears anything; the merged result is what
+ * gets validated, by the caller.
+ */
+export const normalizeCustomFieldMappingPayload = (data) => {
+    const resource = data["mapFromResourceType"];
+    const fieldName = data["mapFromCustomFieldName"];
+    const isCleared = (value) => {
+        if (value === undefined) {
+            return false;
+        }
+        return typeof value !== "string" || value.trim().length === 0;
+    };
+    if (isCleared(resource) || isCleared(fieldName)) {
+        data["mapFromResourceType"] = null;
+        data["mapFromCustomFieldName"] = null;
+        return;
+    }
+    if (resource !== undefined) {
+        data["mapFromResourceType"] = resource.trim();
+    }
+    if (fieldName !== undefined) {
+        data["mapFromCustomFieldName"] = fieldName.trim();
+    }
+};
+const validateState = async (data) => {
+    const resource = data.state.mapFromResourceType;
+    const sourceFieldName = data.state.mapFromCustomFieldName;
+    if (!resource && !sourceFieldName) {
+        return;
+    }
+    /*
+     * Half a mapping is rejected rather than quietly stored. It resolves nothing,
+     * and the settings table would show a field claiming to be mapped to nowhere.
+     */
+    if (!resource || !sourceFieldName) {
+        throw new BadDataException("Choose both the resource to copy this field's value from and the field to copy, or leave both empty to enter values by hand.");
+    }
+    const info = getCustomFieldMappingSources(data.target.definitionTableName).find((candidate) => {
+        return candidate.resource === resource;
+    });
+    if (!info) {
+        throw new BadDataException(`${data.target.targetName} custom fields cannot take their value from "${resource}".`);
+    }
+    const source = data.target.sources.find((candidate) => {
+        return candidate.info.resource === resource;
+    });
+    if (!source) {
+        throw new BadDataException(`${data.target.targetName} custom fields cannot take their value from "${resource}".`);
+    }
+    if (!data.state.projectId) {
+        throw new BadDataException("ProjectId is required to map a custom field's value from another resource.");
+    }
+    const sourceDefinitions = await source
+        .getSourceDefinitionService()
+        .findBy({
+        query: {
+            projectId: data.state.projectId,
+            name: sourceFieldName,
+        },
+        select: {
+            name: true,
+            customFieldType: true,
+            dropdownOptions: true,
+        },
+        limit: 1,
+        skip: 0,
+        props: {
+            isRoot: true,
+        },
+    });
+    const sourceDefinition = sourceDefinitions[0];
+    if (!sourceDefinition) {
+        throw new BadDataException(`${info.title} does not have a custom field called "${sourceFieldName}". Create it first, or choose a different field.`);
+    }
+    const compatibilityError = getCustomFieldMappingCompatibilityError({
+        targetFieldType: data.state.customFieldType,
+        sourceFieldType: sourceDefinition["customFieldType"],
+        targetDropdownOptions: data.state.dropdownOptions,
+        sourceDropdownOptions: sourceDefinition["dropdownOptions"],
+        sourceFieldName: sourceFieldName,
+    });
+    if (compatibilityError) {
+        throw new BadDataException(compatibilityError);
+    }
+};
+export const validateCustomFieldMappingOnCreate = async (data) => {
+    normalizeCustomFieldMappingPayload(data.createBy.data);
+    const target = getCustomFieldMappingTarget(new data.definitionModelType().tableName);
+    if (!target) {
+        /*
+         * Six of the nine definition tables carry the columns for lockstep with
+         * their siblings but have no reachable source. Refusing a value there is
+         * better than accepting one that could never resolve.
+         */
+        if (data.createBy.data["mapFromResourceType"]) {
+            throw new BadDataException("Custom fields on this resource cannot take their value from another resource.");
+        }
+        return;
+    }
+    await validateState({
+        target: target,
+        state: {
+            projectId: data.createBy.props.tenantId ||
+                data.createBy.data["projectId"],
+            customFieldType: data.createBy.data["customFieldType"],
+            dropdownOptions: data.createBy.data["dropdownOptions"],
+            mapFromResourceType: data.createBy.data["mapFromResourceType"],
+            mapFromCustomFieldName: data.createBy.data["mapFromCustomFieldName"],
+        },
+    });
+};
+export const validateCustomFieldMappingOnUpdate = async (data) => {
+    normalizeCustomFieldMappingPayload(data.updateBy.data);
+    const payload = data.updateBy
+        .data;
+    const touchesMapping = [
+        "mapFromResourceType",
+        "mapFromCustomFieldName",
+        "customFieldType",
+        "dropdownOptions",
+    ].some((key) => {
+        return payload[key] !== undefined;
+    });
+    if (!touchesMapping) {
+        return;
+    }
+    const target = getCustomFieldMappingTarget(new data.definitionModelType().tableName);
+    if (!target) {
+        if (payload["mapFromResourceType"]) {
+            throw new BadDataException("Custom fields on this resource cannot take their value from another resource.");
+        }
+        return;
+    }
+    /*
+     * The payload is a PARTIAL: changing only the source field name must still
+     * be checked against the type and options already stored on the row. And
+     * narrowing the target's dropdown options must be checked against a
+     * mapping that was valid when it was saved.
+     */
+    const existingRows = await data.definitionService.findBy({
+        query: data.updateBy.query,
+        select: {
+            projectId: true,
+            customFieldType: true,
+            dropdownOptions: true,
+            mapFromResourceType: true,
+            mapFromCustomFieldName: true,
+        },
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+            isRoot: true,
+        },
+    });
+    for (const row of existingRows) {
+        const merged = {
+            projectId: row["projectId"],
+            customFieldType: payload["customFieldType"] !== undefined
+                ? payload["customFieldType"]
+                : row["customFieldType"],
+            dropdownOptions: payload["dropdownOptions"] !== undefined
+                ? payload["dropdownOptions"]
+                : row["dropdownOptions"],
+            mapFromResourceType: payload["mapFromResourceType"] !== undefined
+                ? payload["mapFromResourceType"] || undefined
+                : row["mapFromResourceType"],
+            mapFromCustomFieldName: payload["mapFromCustomFieldName"] !== undefined
+                ? payload["mapFromCustomFieldName"] || undefined
+                : row["mapFromCustomFieldName"],
+        };
+        await validateState({ target: target, state: merged });
+    }
+};
+//# sourceMappingURL=CustomFieldMappingValidator.js.map

package/build/dist/Server/Utils/CustomField/CustomFieldMappingValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomFieldMappingValidator.js","sourceRoot":"","sources":["../../../../../Server/Utils/CustomField/CustomFieldMappingValidator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,uCAAuC,EAAE,MAAM,oDAAoD,CAAC;AAC7G,OAAO,EAEL,4BAA4B,GAC7B,MAAM,sDAAsD,CAAC;AAC9D,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAKrE,OAAO,EAGL,2BAA2B,GAC5B,MAAM,8BAA8B,CAAC;AAoCtC;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C,CAAC,IAA6B,EAAQ,EAAE;IACtC,MAAM,QAAQ,GAAY,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACtD,MAAM,SAAS,GAAY,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAI1D,MAAM,SAAS,GAAsB,CAAC,KAAc,EAAW,EAAE;QAC/D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,IAAI,SAAS,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,qBAAqB,CAAC,GAAG,IAAI,CAAC;QACnC,IAAI,CAAC,wBAAwB,CAAC,GAAG,IAAI,CAAC;QACtC,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,qBAAqB,CAAC,GAAI,QAAmB,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,IAAI,CAAC,wBAAwB,CAAC,GAAI,SAAoB,CAAC,IAAI,EAAE,CAAC;IAChE,CAAC;AACH,CAAC,CAAC;AAOJ,MAAM,aAAa,GAA0B,KAAK,EAAE,IAGnD,EAAiB,EAAE;IAClB,MAAM,QAAQ,GAAuB,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACpE,MAAM,eAAe,GAAuB,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC;IAE9E,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,QAAQ,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,gBAAgB,CACxB,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GACR,4BAA4B,CAAC,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAChE,CAAC,SAAuC,EAAE,EAAE;QAC1C,OAAO,SAAS,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACzC,CAAC,CACF,CAAC;IAEJ,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,gDAAgD,QAAQ,IAAI,CACtF,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAwC,EAAE,EAAE;QACpE,OAAO,SAAS,CAAC,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEL,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,gDAAgD,QAAQ,IAAI,CACtF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,gBAAgB,CACxB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAqB,MAAM,MAAM;SACrD,0BAA0B,EAAE;SAC5B,MAAM,CAAC;QACN,KAAK,EAAE;YACL,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS;YAC/B,IAAI,EAAE,eAAe;SACtB;QACD,MAAM,EAAE;YACN,IAAI,EAAE,IAAI;YACV,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;SACtB;QACD,KAAK,EAAE,CAAC;QACR,IAAI,EAAE,CAAC;QACP,KAAK,EAAE;YACL,MAAM,EAAE,IAAI;SACb;KACF,CAAC,CAAC;IAEL,MAAM,gBAAgB,GAA0B,iBAAiB,CAAC,CAAC,CAAC,CAAC;IAErE,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CACxB,GAAG,IAAI,CAAC,KAAK,yCAAyC,eAAe,kDAAkD,CACxH,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GACtB,uCAAuC,CAAC;QACtC,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;QAC3C,eAAe,EAAG,gBAAwB,CAAC,iBAAiB,CAAC;QAC7D,qBAAqB,EAAE,IAAI,CAAC,KAAK,CAAC,eAAe;QACjD,qBAAqB,EAAG,gBAAwB,CAAC,iBAAiB,CAAC;QACnE,eAAe,EAAE,eAAe;KACjC,CAAC,CAAC;IAEL,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CAAC,kBAAkB,CAAC,CAAC;IACjD,CAAC;AACH,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,kCAAkC,GAC7C,KAAK,EAAE,IAGN,EAAiB,EAAE;IAClB,kCAAkC,CAChC,IAAI,CAAC,QAAQ,CAAC,IAA0C,CACzD,CAAC;IAEF,MAAM,MAAM,GACV,2BAA2B,CAAC,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC,SAAU,CAAC,CAAC;IAEzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ;;;;WAIG;QACH,IAAK,IAAI,CAAC,QAAQ,CAAC,IAAY,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,gBAAgB,CACxB,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,OAAO;IACT,CAAC;IAED,MAAM,aAAa,CAAC;QAClB,MAAM,EAAE,MAAM;QACd,KAAK,EAAE;YACL,SAAS,EACN,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAiC;gBACrD,IAAI,CAAC,QAAQ,CAAC,IAAY,CAAC,WAAW,CAAC;YAC1C,eAAe,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAY,CAAC,iBAAiB,CAAC;YAC/D,eAAe,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAY,CAAC,iBAAiB,CAAC;YAC/D,mBAAmB,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAY,CAAC,qBAAqB,CAAC;YACvE,sBAAsB,EAAG,IAAI,CAAC,QAAQ,CAAC,IAAY,CACjD,wBAAwB,CACzB;SACF;KACF,CAAC,CAAC;AACL,CAAC,CAAC;AAUJ,MAAM,CAAC,MAAM,kCAAkC,GAC7C,KAAK,EAAE,IAMN,EAAiB,EAAE;IAClB,kCAAkC,CAChC,IAAI,CAAC,QAAQ,CAAC,IAA0C,CACzD,CAAC;IAEF,MAAM,OAAO,GAA4B,IAAI,CAAC,QAAQ;SACnD,IAA0C,CAAC;IAE9C,MAAM,cAAc,GAAY;QAC9B,qBAAqB;QACrB,wBAAwB;QACxB,iBAAiB;QACjB,iBAAiB;KAClB,CAAC,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE;QACrB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GACV,2BAA2B,CAAC,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC,SAAU,CAAC,CAAC;IAEzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,gBAAgB,CACxB,+EAA+E,CAChF,CAAC;QACJ,CAAC;QAED,OAAO;IACT,CAAC;IAED;;;;;OAKG;IACH,MAAM,YAAY,GAAqB,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC;QACzE,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;QAC1B,MAAM,EAAE;YACN,SAAS,EAAE,IAAI;YACf,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;YACrB,mBAAmB,EAAE,IAAI;YACzB,sBAAsB,EAAE,IAAI;SAC7B;QACD,KAAK,EAAE,iBAAiB;QACxB,IAAI,EAAE,CAAC;QACP,KAAK,EAAE;YACL,MAAM,EAAE,IAAI;SACb;KACF,CAAC,CAAC;IAEH,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAsC;YAChD,SAAS,EAAG,GAAW,CAAC,WAAW,CAAC;YACpC,eAAe,EACb,OAAO,CAAC,iBAAiB,CAAC,KAAK,SAAS;gBACtC,CAAC,CAAE,OAAO,CAAC,iBAAiB,CAAqB;gBACjD,CAAC,CAAE,GAAW,CAAC,iBAAiB,CAAC;YACrC,eAAe,EACb,OAAO,CAAC,iBAAiB,CAAC,KAAK,SAAS;gBACtC,CAAC,CAAE,OAAO,CAAC,iBAAiB,CAAY;gBACxC,CAAC,CAAE,GAAW,CAAC,iBAAiB,CAAC;YACrC,mBAAmB,EACjB,OAAO,CAAC,qBAAqB,CAAC,KAAK,SAAS;gBAC1C,CAAC,CAAE,OAAO,CAAC,qBAAqB,CAAY,IAAI,SAAS;gBACzD,CAAC,CAAE,GAAW,CAAC,qBAAqB,CAAC;YACzC,sBAAsB,EACpB,OAAO,CAAC,wBAAwB,CAAC,KAAK,SAAS;gBAC7C,CAAC,CAAE,OAAO,CAAC,wBAAwB,CAAY,IAAI,SAAS;gBAC5D,CAAC,CAAE,GAAW,CAAC,wBAAwB,CAAC;SAC7C,CAAC;QAEF,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;AACH,CAAC,CAAC"}

package/build/dist/Server/Utils/DataSource/EgressGuard.js

@@ -8,6 +8,9 @@ const DNS_LOOKUP_TIMEOUT_IN_MS = 5000;
 const ALWAYS_BLOCKED_IPV4_RANGE_SPECS = [
     ["127.0.0.0", 8, "loopback address"],
     ["169.254.0.0", 16, "link-local address (cloud metadata range)"],
+    ["100.100.100.200", 32, "cloud metadata address"],
+    ["168.63.129.16", 32, "cloud platform metadata address"],
+    ["192.0.0.192", 32, "cloud metadata address"],
     ["0.0.0.0", 8, "unspecified address"],
     ["224.0.0.0", 4, "multicast address"],
     ["240.0.0.0", 4, "reserved address"],
@@ -80,7 +83,11 @@ export default class DataSourceEgressGuard {
         if (blockPrivateAddresses) {
             for (const range of this.buildRanges(PRIVATE_IPV4_RANGE_SPECS)) {
                 if (this.isInRange(ipAsInt, range)) {
-                    return { blocked: true, reason: range.reason };
+                    return {
+                        blocked: true,
+                        reason: range.reason,
+                        isPrivateNetwork: true,
+                    };
                 }
             }
         }
@@ -181,6 +188,61 @@ export default class DataSourceEgressGuard {
         if (expanded === "0000:".repeat(7) + "0001") {
             return { blocked: true, reason: "loopback address" };
         }
+        const groups = expanded.split(":").map((group) => {
+            return parseInt(group, 16);
+        });
+        /*
+         * These cloud-local IPv6 endpoints expose instance metadata or workload
+         * credentials. They remain forbidden even when a self-hosted operator
+         * explicitly enables ordinary private-network monitor targets.
+         */
+        if (groups[0] === 0xfd00 && groups[1] === 0x0ec2) {
+            return { blocked: true, reason: "cloud metadata address" };
+        }
+        if (expanded === "fd20:00ce:0000:0000:0000:0000:0000:0254") {
+            return { blocked: true, reason: "cloud metadata address" };
+        }
+        /*
+         * RFC 8215 reserves 64:ff9b:1::/48 for locally assigned IPv4/IPv6
+         * translation. Its IPv4 layout is operator-defined, so it cannot be
+         * decoded safely here and the special-use prefix is refused wholesale.
+         * RFC 2765's legacy IPv4-translated prefix receives the same treatment.
+         */
+        if (expanded.startsWith("0064:ff9b:0001:") ||
+            expanded.startsWith("0000:0000:0000:0000:ffff:0000:")) {
+            return { blocked: true, reason: "IPv4 translation address" };
+        }
+        const embeddedIpv4 = (highGroupIndex, invert = false) => {
+            let high = groups[highGroupIndex];
+            let low = groups[highGroupIndex + 1];
+            if (invert) {
+                high ^= 0xffff;
+                low ^= 0xffff;
+            }
+            return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+        };
+        /*
+         * Deprecated IPv4-compatible ::/96 addresses are still understood by
+         * network stacks. Classify the IPv4 destination they carry rather than
+         * accepting the globally-looking IPv6 wrapper.
+         */
+        if (groups.slice(0, 6).every((group) => {
+            return group === 0;
+        })) {
+            return this.checkIpv4(embeddedIpv4(6), blockPrivateAddresses);
+        }
+        // 6to4 (2002::/16) stores its IPv4 gateway in the next 32 bits.
+        if (groups[0] === 0x2002) {
+            return this.checkIpv4(embeddedIpv4(1), blockPrivateAddresses);
+        }
+        /*
+         * Teredo (2001:0000::/32) carries both a server IPv4 address and a
+         * bitwise-inverted client IPv4 address. Either endpoint being forbidden
+         * is enough to reject the route.
+         */
+        if (groups[0] === 0x2001 && groups[1] === 0) {
+            return this.getStrictestVerdict(this.checkIpv4(embeddedIpv4(2), blockPrivateAddresses), this.checkIpv4(embeddedIpv4(6, true), blockPrivateAddresses));
+        }
         const firstGroup = parseInt(expanded.substring(0, 4), 16);
         // fe80::/10 link-local.
         if ((firstGroup & 0xffc0) === 0xfe80) {
@@ -193,15 +255,46 @@ export default class DataSourceEgressGuard {
         if (blockPrivateAddresses) {
             // fc00::/7 unique-local.
             if ((firstGroup & 0xfe00) === 0xfc00) {
-                return { blocked: true, reason: "private network address" };
+                return {
+                    blocked: true,
+                    reason: "private network address",
+                    isPrivateNetwork: true,
+                };
+            }
+            // fec0::/10 deprecated site-local addresses are still routed in places.
+            if ((firstGroup & 0xffc0) === 0xfec0) {
+                return {
+                    blocked: true,
+                    reason: "private network address",
+                    isPrivateNetwork: true,
+                };
             }
             // 2001:db8::/32 documentation.
             if (expanded.startsWith("2001:0db8:")) {
-                return { blocked: true, reason: "documentation address" };
+                return {
+                    blocked: true,
+                    reason: "documentation address",
+                    isPrivateNetwork: true,
+                };
             }
         }
         return { blocked: false };
     }
+    static getStrictestVerdict(left, right) {
+        if (left.blocked && !left.isPrivateNetwork) {
+            return left;
+        }
+        if (right.blocked && !right.isPrivateNetwork) {
+            return right;
+        }
+        if (left.blocked) {
+            return left;
+        }
+        if (right.blocked) {
+            return right;
+        }
+        return { blocked: false };
+    }
     /*
      * Verdict for a single literal IP address under the given (or derived)
      * policy. Exposed for tests and for connectors that receive addresses
@@ -264,7 +357,7 @@ export default class DataSourceEgressGuard {
         if (net.isIP(bareHostname) !== 0) {
             const verdict = this.checkAddress(bareHostname, options);
             if (verdict.blocked) {
-                throw new BadDataException(`${label} host ${bareHostname} is not allowed: ${verdict.reason}.`);
+                throw new BadDataException(`${label} host ${bareHostname} is not allowed: ${verdict.reason}.${verdict.isPrivateNetwork ? (options === null || options === void 0 ? void 0 : options.privateNetworkHint) || "" : ""}`);
             }
             return [{ address: bareHostname, family: net.isIP(bareHostname) }];
         }
@@ -277,15 +370,24 @@ export default class DataSourceEgressGuard {
             addresses = await resolveFunction(bareHostname);
         }
         catch (error) {
+            if ((options === null || options === void 0 ? void 0 : options.includeResolvedAddressInError) === false) {
+                throw new BadDataException(`${label} host ${bareHostname} could not be reached.`);
+            }
             throw new BadDataException(`Could not resolve ${label.toLowerCase()} host ${bareHostname}: ${error instanceof Error ? error.message : String(error)}`);
         }
         if (addresses.length === 0) {
+            if ((options === null || options === void 0 ? void 0 : options.includeResolvedAddressInError) === false) {
+                throw new BadDataException(`${label} host ${bareHostname} could not be reached.`);
+            }
             throw new BadDataException(`Could not resolve ${label.toLowerCase()} host ${bareHostname}.`);
         }
         for (const resolved of addresses) {
             const verdict = this.checkAddress(resolved.address, options);
             if (verdict.blocked) {
-                throw new BadDataException(`${label} host ${bareHostname} resolves to ${resolved.address}, which is not allowed: ${verdict.reason}.`);
+                if ((options === null || options === void 0 ? void 0 : options.includeResolvedAddressInError) === false) {
+                    throw new BadDataException(`${label} host ${bareHostname} could not be reached.`);
+                }
+                throw new BadDataException(`${label} host ${bareHostname} resolves to ${resolved.address}, which is not allowed: ${verdict.reason}.${verdict.isPrivateNetwork ? (options === null || options === void 0 ? void 0 : options.privateNetworkHint) || "" : ""}`);
             }
         }
         return addresses;
@@ -322,13 +424,25 @@ export default class DataSourceEgressGuard {
      */
     static createPinnedLookup(addresses) {
         return (_hostname, lookupOptions, callback) => {
+            const wantedFamily = lookupOptions === null || lookupOptions === void 0 ? void 0 : lookupOptions.family;
+            const usableAddresses = wantedFamily === 4 || wantedFamily === 6
+                ? addresses.filter((resolved) => {
+                    return resolved.family === wantedFamily;
+                })
+                : addresses;
+            if (usableAddresses.length === 0) {
+                const error = new Error(`No IPv${wantedFamily} address is available for the validated host.`);
+                error.code = "ENOTFOUND";
+                callback(error, "");
+                return;
+            }
             if (lookupOptions && lookupOptions.all) {
-                callback(null, addresses.map((resolved) => {
+                callback(null, usableAddresses.map((resolved) => {
                     return { address: resolved.address, family: resolved.family };
                 }));
                 return;
             }
-            const first = addresses[0];
+            const first = usableAddresses[0];
             callback(null, first.address, first.family);
         };
     }