@oneuptime/common 12.0.33 → 12.0.34

package/Server/Services/NetworkDeviceAutoImportRuleEngineService.ts

@@ -31,6 +31,7 @@ import {
   buildNetworkDeviceFromDiscoveredHost,
 } from "../../Utils/NetworkDiscovery/DiscoveredDeviceBuilder";
 import { normalizeDiscoveredHosts } from "../../Utils/NetworkDiscovery/DiscoveredHostUtil";
+import { DISCOVERY_SCAN_IMPORTABLE_STATUSES } from "../../Utils/NetworkDiscovery/DiscoveryScanStatus";
 import { NetworkDeviceMonitoringMethodUtil } from "../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
 import NetworkDeviceMonitorTemplateUtil from "../../Utils/Monitor/NetworkDeviceMonitorTemplateUtil";
 import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
@@ -41,7 +42,8 @@ import logger, { LogAttributes } from "../Utils/Logger";
 
 /*
  * The engine behind network device auto-import rules (issue #3378): reads a
- * completed discovery scan's results, asks the project's rules which hosts
+ * discovery scan's results — finished or still arriving from a running sweep,
+ * see DISCOVERY_SCAN_IMPORTABLE_STATUSES — asks the project's rules which hosts
  * import, and creates the Network Devices the manual Review dialog would
  * have — through the same builder, so a rule-imported host and a
  * hand-imported host are the same device. Site assignment, owners and labels
@@ -182,24 +184,32 @@ export type ImportAttemptBudgetsByProjectId = Map<string, ImportAttemptBudget>;
 
 class NetworkDeviceAutoImportRuleEngineServiceClass {
   /**
-   * The automatic path: apply the project's enabled rules to one Completed
-   * scan, then stamp the scan's autoImportProcessedAt marker.
+   * The automatic path: apply the project's enabled rules to one scan's
+   * stored results, then stamp the scan's autoImportProcessedAt marker.
+   *
+   * The scan may still be SWEEPING — see
+   * DISCOVERY_SCAN_IMPORTABLE_STATUSES. Its partial results are as real as
+   * a finished scan's (the probe found those hosts; it simply has more of the
+   * range to cover), and waiting for the whole sweep is what left 527
+   * discovered switches unimportable for a day in OneUptime issue #3599. The
+   * name is kept because it is the automatic path's identity across the
+   * worker, its tests and its logs.
    *
    * Returns null when there was nothing to do (scan gone, superseded,
    * already processed, no import rules, or results too old) and the run's
    * counters otherwise. Throws only on unexpected failures — the caller
    * (the worker sweep) isolates those per scan.
    *
-   * The marker protocol, and why every stamp is a compare-and-set on
-   * (status, completedAt): the ingest endpoint clears the marker in the same
-   * write that stores new results, so "marker is NULL" always means "the
-   * results now on the row have not been processed". If new results land
-   * while this pass is reading the old ones, the CAS misses, the marker
-   * stays NULL, and the next tick processes the new upload — the stamp can
-   * never retire results it did not see, and the jsonb write-back can never
-   * clobber a newer host list. A truncated pass that created something
-   * stamps nothing on purpose: the NULL marker is what makes the next tick
-   * resume. (A truncated pass where every create FAILED stamps anyway — see
+   * The marker protocol, and why every stamp is a compare-and-set on the run
+   * state this pass read: the ingest endpoint clears the marker in the same
+   * write that stores new results — partial uploads included — so "marker is
+   * NULL" always means "the results now on the row have not been processed".
+   * If new results land while this pass is reading the old ones, the CAS
+   * misses, the marker stays NULL, and the next tick processes the new upload
+   * — the stamp can never retire results it did not see, and the jsonb
+   * write-back can never clobber a newer host list. A truncated pass that
+   * created something stamps nothing on purpose: the NULL marker is what
+   * makes the next tick resume. (A truncated pass where every create FAILED stamps anyway — see
    * the zero-progress note at the stamp below.)
    */
   @CaptureSpan()
@@ -213,13 +223,21 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
       await NetworkDeviceDiscoveryScanService.findOneBy({
         query: {
           _id: data.scanId,
-          status: "Completed",
+          status: QueryHelper.any(DISCOVERY_SCAN_IMPORTABLE_STATUSES),
         },
         select: {
           _id: true,
           projectId: true,
           status: true,
           completedAt: true,
+          /*
+           * The two counters a running scan's partial uploads move. They are
+           * not read for anything; they are the version token stampScan's
+           * compare-and-set uses to tell "the results I evaluated" from "the
+           * results that landed while I was evaluating".
+           */
+          scannedHostCount: true,
+          respondedHostCount: true,
           autoImportProcessedAt: true,
           discoveredDevices: true,
           ...AUTO_IMPORT_SCAN_CREDENTIAL_SELECT,
@@ -538,11 +556,21 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
       await NetworkDeviceDiscoveryScanService.findBy({
         query: {
           projectId: data.projectId,
-          status: "Completed",
+          /*
+           * A scan that is still sweeping counts too: its partial results are
+           * already on the row, and "Run Now found 25 hosts while 527 sat in
+           * the Devices list" was exactly the report (OneUptime issue #3599).
+           */
+          status: QueryHelper.any(DISCOVERY_SCAN_IMPORTABLE_STATUSES),
         },
         select: {
           _id: true,
         },
+        /*
+         * Newest results first. An in-progress scan has no completedAt, and
+         * Postgres orders NULLs first under DESC — which is the right place
+         * for it: its results are the freshest the project has.
+         */
         sort: {
           completedAt: SortOrder.Descending,
         },
@@ -564,13 +592,16 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
           query: {
             _id: scanStub.id!,
             projectId: data.projectId,
-            status: "Completed",
+            status: QueryHelper.any(DISCOVERY_SCAN_IMPORTABLE_STATUSES),
           },
           select: {
             _id: true,
             projectId: true,
             status: true,
             completedAt: true,
+            // The version token stampScan's compare-and-set uses; see there.
+            scannedHostCount: true,
+            respondedHostCount: true,
             discoveredDevices: true,
             ...AUTO_IMPORT_SCAN_CREDENTIAL_SELECT,
           },
@@ -1566,20 +1597,20 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
   /*
    * The one write this engine makes to the scan row: retire the consumed
    * hosts in the stored jsonb (so the Review dialog stops offering them) and
-   * stamp the processed marker — in a single hook-free compare-and-set on
-   * (status, completedAt), for the reasons on processCompletedScan. The
+   * stamp the processed marker — in a single hook-free compare-and-set on the
+   * run state that was read, for the reasons on processCompletedScan. The
    * claim endpoint's hook-free contract is why this must never go through
    * updateOneById: the scan service deliberately has no update-success hooks
    * to piggyback on, and this write must not fire the full pipeline on every
    * worker tick.
    *
    * The CAS defends against exactly one concurrent writer — the ingest
-   * endpoint, which rewrites completedAt with every upload. It cannot
-   * defend against another ENGINE write (which changes neither status nor
-   * completedAt), and does not need to: every path that reaches this method
-   * holds the sweep lock (the worker for its whole sweep, Run Now for a
-   * real run; dry runs never write), so the full-array replace below always
-   * has the row's only engine writer. Weaken that invariant and this
+   * endpoint, which rewrites completedAt with a final upload and the host
+   * counters with a partial one. It cannot defend against another ENGINE
+   * write (which changes none of those columns), and does not need to: every
+   * path that reaches this method holds the sweep lock (the worker for its
+   * whole sweep, Run Now for a real run; dry runs never write), so the
+   * full-array replace below always has the row's only engine writer. Weaken that invariant and this
    * becomes last-writer-wins on the isAlreadyRegistered flips.
    */
   private async stampScan(data: {
@@ -1632,8 +1663,30 @@ class NetworkDeviceAutoImportRuleEngineServiceClass {
       // Cast: the model's JSON column makes DeepPartial recursion blow up.
       data: payload as unknown as QueryDeepPartialEntity<NetworkDeviceDiscoveryScan>,
       expectedData: {
-        status: "Completed",
+        /*
+         * The scan's own status, not the literal "Completed" this used to
+         * pin. A scan that is still sweeping is importable now (issue
+         * #3599), and its status is exactly the thing that changes when its
+         * run ends — so reading it off the row keeps the guard doing what it
+         * always did rather than making an In Progress stamp always miss.
+         */
+        status: data.scan.status ?? null,
         completedAt: data.scan.completedAt || null,
+        /*
+         * The counters a running scan's partial uploads move, so a partial
+         * landing between the read and this write is caught the way a
+         * completion is: the stamp misses, the marker stays NULL, and the
+         * next tick processes the newer host list.
+         *
+         * Not a perfect version token for an in-progress scan — the
+         * ICMP-filtered fallback pass finds hosts without advancing
+         * scannedHostCount, so two partials can carry both counts unchanged.
+         * The consequence is bounded and self-healing: one batch of hosts
+         * waits for the next partial upload (which clears the marker again),
+         * and the run's final result clears it unconditionally.
+         */
+        scannedHostCount: data.scan.scannedHostCount ?? null,
+        respondedHostCount: data.scan.respondedHostCount ?? null,
       } as unknown as QueryDeepPartialEntity<NetworkDeviceDiscoveryScan>,
     });
   }

package/Server/Services/ProjectService.ts

@@ -1653,6 +1653,28 @@ These are no longer recorded against the project and have to be cancelled by han
     return createdItem;
   }
 
+  /*
+   * NOTE ON THE TWO-TIER SCALE, and what it costs downstream.
+   *
+   * This seeds TWO alert severities (High 1 / Low 2) while
+   * `addDefaultIncidentSeverity` immediately below seeds THREE
+   * (Critical Incident 1 / Major Incident 2 / Minor Incident 3). That
+   * asymmetry is load-bearing for monitor recommendations:
+   * `MonitorRecommendationSeverityMapper` maps a recommendation's declared
+   * `Critical` onto rank 1 and `Warning` onto rank 2, so on a default project
+   * a Warning template opens a "Major Incident" but an alert whose severity
+   * reads "Low" — which is how an alert email can say SEVERITY: Low for a
+   * catalog card badged Warning.
+   *
+   * If a third alert tier is ever added here to close that gap, it CANNOT
+   * ship alone. This function only seeds names a project does not already
+   * have, so existing projects would keep the two-tier scale and map Warning
+   * differently from new ones indefinitely. It needs a paired data migration
+   * over every existing project — see
+   * App/FeatureSet/Workers/DataMigrations/AddDefaultAlertSeverityAndStateToExistingProjects.ts
+   * for the shape — and that migration has to decide what to do about the
+   * `order` of a "Low" row a project may have reordered or renamed itself.
+   */
   @CaptureSpan()
   public async addDefaultAlertSeverity(createdItem: Model): Promise<Model> {
     const projectId: ObjectID = createdItem.id!;

package/Server/Services/RoutineEmailSettingsService.ts

@@ -0,0 +1,73 @@
+import DatabaseService, { EntityManager } from "./DatabaseService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import UserNotificationSetting from "../../Models/DatabaseModels/UserNotificationSetting";
+import { ROUTINE_EMAIL_EVENT_TYPES } from "../../Types/NotificationSetting/RoutineEmailEvents";
+import ObjectID from "../../Types/ObjectID";
+
+export class Service extends DatabaseService<UserNotificationSetting> {
+  public constructor() {
+    super(UserNotificationSetting);
+  }
+
+  /*
+   * The API authorizes the authenticated user's own settings before calling
+   * this method. Every statement remains scoped to that user and project.
+   */
+  @CaptureSpan()
+  public async reduceRoutineEmails(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<void> {
+    await this.executeTransaction(async (manager: EntityManager) => {
+      /*
+       * There is no unique constraint on (user, project, event). Serializing
+       * preset requests also protects the missing-row insert on a double click.
+       */
+      await manager.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1, 0))",
+        [
+          `routine-email-settings:${data.projectId.toString()}:${data.userId.toString()}`,
+        ],
+      );
+
+      const parameters: [string, string, ReadonlyArray<string>] = [
+        data.userId.toString(),
+        data.projectId.toString(),
+        ROUTINE_EMAIL_EVENT_TYPES,
+      ];
+
+      /*
+       * Update every matching row, including historical duplicates. Changing
+       * only email avoids overwriting another channel edited concurrently.
+       */
+      await manager.query(
+        `UPDATE "UserNotificationSetting"
+         SET "alertByEmail" = false, "updatedAt" = now(), "version" = "version" + 1
+         WHERE "userId" = $1 AND "projectId" = $2
+           AND "eventType" = ANY($3::text[])
+           AND "deletedAt" IS NULL AND "alertByEmail" = true`,
+        parameters,
+      );
+
+      /*
+       * Persist an explicit opt-out for missing events so later default
+       * seeding sees the user's choice. Other channels keep their false defaults.
+       */
+      await manager.query(
+        `INSERT INTO "UserNotificationSetting"
+           ("userId", "projectId", "eventType", "alertByEmail", "createdByUserId", "version")
+         SELECT $1::uuid, $2::uuid, event."eventType", false, $1::uuid, 1
+         FROM unnest($3::text[]) AS event("eventType")
+         WHERE NOT EXISTS (
+           SELECT 1 FROM "UserNotificationSetting" setting
+           WHERE setting."userId" = $1 AND setting."projectId" = $2
+             AND setting."eventType" = event."eventType"
+             AND setting."deletedAt" IS NULL
+         )`,
+        parameters,
+      );
+    });
+  }
+}
+
+export default new Service();

package/Server/Services/RumSessionReplayViewService.ts

@@ -1,5 +1,6 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/RumSessionReplayView";
+import QueryHelper from "../Types/Database/QueryHelper";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
@@ -19,6 +20,45 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
  * modelled on, the whole point of the audit is that it outlives the
  * recording it describes.
  */
+
+/*
+ * The heartbeat cadence the player reports on. secondsWatched is floored
+ * to it so a chatty client costs at most one write per bucket, and the
+ * figure shown to viewers ("watched 1m 30s") never pretends to more
+ * precision than the heartbeat had.
+ */
+export const SESSION_REPLAY_WATCH_BUCKET_SECONDS: number = 15;
+
+/*
+ * Ceiling on one view's watched time: the longest session the recorder
+ * will ever produce, at the slowest speed anyone would watch it, with
+ * headroom for pauses. A client cannot report more than this; the audit
+ * figure is a privacy control shown to other viewers, and an unbounded
+ * number would let a buggy or hostile client render a nonsense one.
+ */
+export const SESSION_REPLAY_MAX_SECONDS_WATCHED: number = 24 * 60 * 60;
+
+/*
+ * Floor a client-reported figure to the heartbeat bucket and clamp it.
+ * Module-level so the route and the service agree on the one rounding
+ * rule without the route reaching for the class behind the instance.
+ */
+export function normalizeSecondsWatched(secondsWatched: number): number {
+  if (!Number.isFinite(secondsWatched) || secondsWatched <= 0) {
+    return 0;
+  }
+
+  const clamped: number = Math.min(
+    secondsWatched,
+    SESSION_REPLAY_MAX_SECONDS_WATCHED,
+  );
+
+  return (
+    Math.floor(clamped / SESSION_REPLAY_WATCH_BUCKET_SECONDS) *
+    SESSION_REPLAY_WATCH_BUCKET_SECONDS
+  );
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -64,12 +104,13 @@ export class Service extends DatabaseService<Model> {
     }
 
     /*
-     * All three come straight off an untrusted request: a header, or a
+     * All four come straight off an untrusted request: a header, or a
      * free-text field in the body. Truncated rather than validated because
      * failing the audit write would fail the playback it is auditing, and
      * DatabaseService.checkMaxLengthOfFields throws on anything longer
-     * than the column. An oversized user agent must not be able to stop a
-     * read from being recorded.
+     * than the column. An oversized user agent - or a fingerprint longer
+     * than its ShortText column - must not be able to stop a read from
+     * being recorded.
      */
     if (data.ipAddress) {
       item.ipAddress = data.ipAddress.substring(0, ColumnLength.ShortText);
@@ -88,7 +129,8 @@ export class Service extends DatabaseService<Model> {
     }
 
     if (data.linkedExceptionFingerprint) {
-      item.linkedExceptionFingerprint = data.linkedExceptionFingerprint;
+      item.linkedExceptionFingerprint =
+        data.linkedExceptionFingerprint.substring(0, ColumnLength.ShortText);
     }
 
     return await this.create({
@@ -98,47 +140,85 @@ export class Service extends DatabaseService<Model> {
   }
 
   /*
-   * Advance how much of the recording was actually watched, from the
-   * player's throttled heartbeat.
-   *
-   * Monotonic on purpose: the heartbeat carries a cumulative total, and a
-   * player that seeks backwards or reloads would otherwise walk the
-   * recorded figure back down and make a full viewing look like a glance.
+   * The caller's OWN view row, or null. The heartbeat and the manifest
+   * refresh both need "does this viewId belong to this user, this
+   * project, and (for the refresh) this session" answered in one lookup,
+   * and both must refuse somebody else's row indistinguishably from a
+   * missing one: secondsWatched is a privacy control, and the refresh
+   * would otherwise let a caller reuse a colleague's audit row.
    */
   @CaptureSpan()
-  public async recordSecondsWatched(data: {
+  public async findOwnView(data: {
     viewId: ObjectID;
     projectId: ObjectID;
-    secondsWatched: number;
-  }): Promise<void> {
-    if (!Number.isFinite(data.secondsWatched) || data.secondsWatched <= 0) {
-      return;
-    }
-
-    const existing: Model | null = await this.findOneBy({
+    viewedByUserId: ObjectID;
+    sessionId?: string | undefined;
+  }): Promise<Model | null> {
+    return await this.findOneBy({
       query: {
         _id: data.viewId.toString(),
         projectId: data.projectId,
+        viewedByUserId: data.viewedByUserId,
+        ...(data.sessionId !== undefined && { sessionId: data.sessionId }),
       },
       select: {
         _id: true,
+        rumApplicationId: true,
+        sessionId: true,
         secondsWatched: true,
       },
       props: { isRoot: true },
     });
+  }
+
+  /*
+   * Advance how much of the recording was actually watched.
+   *
+   * SEMANTICS: secondsWatched is the cumulative number of seconds of
+   * footage the player has PLAYED for this view - accumulated client-side
+   * only while playback is running, scaled by speed - not the furthest
+   * offset the playhead reached. Dragging the scrubber to the end of a
+   * recording is not watching it, and the audit figure is shown to other
+   * viewers as "who watched how much", so it must not over-report.
+   *
+   * Monotonic on purpose: the heartbeat carries a cumulative total, and a
+   * player that reloads would otherwise walk the recorded figure back
+   * down and make a full viewing look like a glance. The guard is in the
+   * UPDATE's own predicate (secondsWatched < new value) rather than in a
+   * read-then-write, so two heartbeats racing for the same row cannot
+   * regress it; a heartbeat that does not advance writes nothing.
+   *
+   * When the caller already holds the row's current figure (the route
+   * reads it in the same lookup that proves ownership) it passes it as
+   * currentSecondsWatched and a non-advancing heartbeat costs no query at
+   * all.
+   */
+  @CaptureSpan()
+  public async recordSecondsWatched(data: {
+    viewId: ObjectID;
+    projectId: ObjectID;
+    secondsWatched: number;
+    currentSecondsWatched?: number | undefined;
+  }): Promise<void> {
+    const seconds: number = normalizeSecondsWatched(data.secondsWatched);
 
-    if (!existing) {
+    if (seconds <= 0) {
       return;
     }
 
-    const seconds: number = Math.floor(data.secondsWatched);
-
-    if ((existing.secondsWatched || 0) >= seconds) {
+    if (
+      data.currentSecondsWatched !== undefined &&
+      data.currentSecondsWatched >= seconds
+    ) {
       return;
     }
 
-    await this.updateOneById({
-      id: data.viewId,
+    await this.updateOneBy({
+      query: {
+        _id: data.viewId.toString(),
+        projectId: data.projectId,
+        secondsWatched: QueryHelper.lessThanOrNull(seconds),
+      },
       data: {
         secondsWatched: seconds,
       },

package/Server/Services/ScheduledMaintenanceCustomFieldService.ts

@@ -1,9 +1,107 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/ScheduledMaintenanceCustomField";
+import ObjectID from "../../Types/ObjectID";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { backfillMappedCustomFieldValues } from "../Utils/CustomField/CustomFieldDefinitionMappingHooks";
+import {
+  validateCustomFieldMappingOnCreate,
+  validateCustomFieldMappingOnUpdate,
+} from "../Utils/CustomField/CustomFieldMappingValidator";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * A scheduled maintenance custom field can take its value from the same field
+ * on the event's monitors instead of being typed in again
+ * (OneUptime/oneuptime#3549). These hooks are the two halves of that
+ * configuration being saved: refusing a mapping that could never resolve, and
+ * filling in the events that already exist once one is saved.
+ */
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    await validateCustomFieldMappingOnCreate({
+      definitionModelType: Model,
+      createBy: createBy,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    await validateCustomFieldMappingOnUpdate({
+      definitionModelType: Model,
+      definitionService: this,
+      updateBy: updateBy,
+    });
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    backfillMappedCustomFieldValues({
+      definitionModelType: Model,
+      projectId: createdItem.projectId,
+      definitionName: "scheduled maintenance custom field",
+    });
+
+    return createdItem;
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    if (updatedItemIds.length > 0) {
+      backfillMappedCustomFieldValues({
+        definitionModelType: Model,
+        projectId: await this.getProjectIdForBackfill(onUpdate, updatedItemIds),
+        definitionName: "scheduled maintenance custom field",
+      });
+    }
+
+    return onUpdate;
+  }
+
+  /*
+   * `props.tenantId` is set on every dashboard write but not on internal
+   * root-scoped ones, so fall back to the row itself rather than skipping the
+   * backfill for a mapping that was changed by a script.
+   */
+  private async getProjectIdForBackfill(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<ObjectID | undefined> {
+    const tenantId: ObjectID | undefined = onUpdate.updateBy.props.tenantId as
+      | ObjectID
+      | undefined;
+
+    if (tenantId) {
+      return tenantId;
+    }
+
+    const item: Model | null = await this.findOneById({
+      id: updatedItemIds[0]!,
+      select: { projectId: true },
+      props: { isRoot: true },
+    });
+
+    return item?.projectId;
+  }
 }
 export default new Service();

package/Server/Services/ScheduledMaintenanceService.ts

@@ -6,6 +6,8 @@ import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
+import ScheduledMaintenanceCustomField from "../../Models/DatabaseModels/ScheduledMaintenanceCustomField";
+import CustomFieldMappingService from "./CustomFieldMappingService";
 import MonitorService from "./MonitorService";
 import ScheduledMaintenanceOwnerTeamService from "./ScheduledMaintenanceOwnerTeamService";
 import ScheduledMaintenanceOwnerUserService from "./ScheduledMaintenanceOwnerUserService";
@@ -609,6 +611,17 @@ ${resourcesAffected ? `**Resources Affected:** ${resourcesAffected}` : ""}
 
     await this.validateProjectScopedReferences(updateBy);
 
+    /*
+     * Re-apply mapped custom field values. Covers the Custom Fields modal
+     * saving the whole bag back over a mapped value, and the event's monitors
+     * changing — both change what a mapped field should hold, and folding the
+     * answer into this payload keeps it one write with a truthful audit entry.
+     */
+    await CustomFieldMappingService.applyMappingsToUpdate({
+      definitionModelType: ScheduledMaintenanceCustomField,
+      updateBy: updateBy,
+    });
+
     return {
       updateBy,
       carryForward: null,
@@ -937,6 +950,19 @@ ${resourcesAffected ? `**Resources Affected:** ${resourcesAffected}` : ""}
         StatusPageSubscriberNotificationStatus.Pending;
     }
 
+    /*
+     * Custom fields configured to inherit from the event's monitors are
+     * stamped here rather than in onCreateSuccess: `customFields` is a column
+     * on this row and the onCreateSuccess chain is un-awaited, so a value
+     * written there would be missing from the event the caller gets back.
+     * Written not to throw — a field failing to inherit must not stop an event
+     * from being scheduled.
+     */
+    await CustomFieldMappingService.applyMappingsToCreate({
+      definitionModelType: ScheduledMaintenanceCustomField,
+      createBy: createBy,
+    });
+
     return { createBy, carryForward: null };
   }
 
@@ -1562,6 +1588,12 @@ ${scheduledMaintenance.description || "No description provided."}
     onUpdate: OnUpdate<Model>,
     updatedItemIds: ObjectID[],
   ): Promise<OnUpdate<Model>> {
+    CustomFieldMappingService.restampAfterMultiRowUpdate({
+      definitionModelType: ScheduledMaintenanceCustomField,
+      updateBy: onUpdate.updateBy,
+      updatedItemIds: updatedItemIds,
+    });
+
     /*
      * Rescheduling the planned window is the whole point of making these
      * fields editable, so the numbers derived from them have to move. Without