@oneuptime/common 12.0.33 → 12.0.34

package/Server/Services/GlobalConfigService.ts

@@ -6,6 +6,26 @@ import { OnUpdate } from "../Types/Database/Hooks";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import UpdateBy from "../Types/Database/UpdateBy";
 import BadDataException from "../../Types/Exception/BadDataException";
+import TelegramVerificationToken from "../Utils/TelegramVerificationToken";
+import GlobalCache from "../Infrastructure/GlobalCache";
+
+const TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE: string =
+  "global-config-security";
+const TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY: string =
+  "telegram-webhook-secret-generation";
+const TELEGRAM_WEBHOOK_SECRET_INITIAL_GENERATION: string = "initial";
+const TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE: string = "__not_configured__";
+const TELEGRAM_WEBHOOK_SECRET_CACHE_TTL_SECONDS: number = 5;
+
+interface TelegramWebhookSecretTokenLoadResult {
+  value: string | undefined;
+  isCurrentGeneration: boolean;
+}
+
+interface TelegramWebhookSecretTokenLoad {
+  generation: string;
+  promise: Promise<TelegramWebhookSecretTokenLoadResult>;
+}
 
 export class Service extends DatabaseService<Model> {
   /*
@@ -15,6 +35,15 @@ export class Service extends DatabaseService<Model> {
    */
   private requireSsoForLoginCache: InMemoryTTLCache<boolean> =
     new InMemoryTTLCache(10_000);
+  /*
+   * The public Telegram webhook is hit without a OneUptime session. The value
+   * cache lives in Redis so every app replica observes the same generation.
+   * Only the in-flight promise is process-local: it collapses a cache-miss
+   * burst to one Postgres read per replica without retaining a retired secret.
+   */
+  private telegramWebhookSecretTokenLoad:
+    | TelegramWebhookSecretTokenLoad
+    | undefined = undefined;
 
   public constructor() {
     super(Model);
@@ -43,10 +72,168 @@ export class Service extends DatabaseService<Model> {
     return value;
   }
 
+  @CaptureSpan()
+  public async getTelegramWebhookSecretToken(): Promise<string | undefined> {
+    while (true) {
+      const generation: string =
+        await this.getTelegramWebhookSecretTokenGeneration();
+      const cacheKey: string =
+        this.getTelegramWebhookSecretTokenCacheKey(generation);
+      const cached: string | null = await GlobalCache.getString(
+        TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+        cacheKey,
+      );
+
+      if (cached !== null) {
+        return cached === TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE
+          ? undefined
+          : cached;
+      }
+
+      const existingLoad: TelegramWebhookSecretTokenLoad | undefined =
+        this.telegramWebhookSecretTokenLoad;
+
+      /*
+       * Cache expiry is visible to every public webhook request at once. Share
+       * the database read for that generation so a burst cannot turn one
+       * expiry into one root Postgres query per request.
+       */
+      const load: TelegramWebhookSecretTokenLoad =
+        existingLoad?.generation === generation
+          ? existingLoad
+          : {
+              generation,
+              promise: this.loadTelegramWebhookSecretToken(
+                generation,
+                cacheKey,
+              ),
+            };
+
+      if (load !== existingLoad) {
+        this.telegramWebhookSecretTokenLoad = load;
+      }
+
+      try {
+        const result: TelegramWebhookSecretTokenLoadResult = await load.promise;
+
+        /*
+         * A rotation that completed during the database read makes the result
+         * unreachable through the new generation key. Loop so this request
+         * also joins the new generation instead of authenticating with the
+         * value that was retired while it waited.
+         */
+        if (result.isCurrentGeneration) {
+          return result.value;
+        }
+      } finally {
+        /*
+         * An invalidation can start a newer-generation load while this one is
+         * still pending. The older promise must not clear that newer flight.
+         */
+        if (this.telegramWebhookSecretTokenLoad === load) {
+          this.telegramWebhookSecretTokenLoad = undefined;
+        }
+      }
+    }
+  }
+
+  private async getTelegramWebhookSecretTokenGeneration(): Promise<string> {
+    return (
+      (await GlobalCache.getString(
+        TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+        TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY,
+      )) || TELEGRAM_WEBHOOK_SECRET_INITIAL_GENERATION
+    );
+  }
+
+  private getTelegramWebhookSecretTokenCacheKey(generation: string): string {
+    return `telegram-webhook-secret:${generation}`;
+  }
+
+  private async loadTelegramWebhookSecretToken(
+    generation: string,
+    cacheKey: string,
+  ): Promise<TelegramWebhookSecretTokenLoadResult> {
+    const config: Model | null = await this.findOneBy({
+      query: {
+        _id: ObjectID.getZeroObjectID().toString(),
+      },
+      select: {
+        telegramWebhookSecretToken: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+    const value: string | undefined =
+      config?.telegramWebhookSecretToken?.trim() || undefined;
+
+    /*
+     * A read begun before a rotation may return after the update has committed.
+     * Check the shared generation before populating Redis; an old replica can
+     * still finish its query, but it cannot republish the retired value under
+     * the generation every other replica now reads.
+     */
+    if (generation !== (await this.getTelegramWebhookSecretTokenGeneration())) {
+      return {
+        value: undefined,
+        isCurrentGeneration: false,
+      };
+    }
+
+    await GlobalCache.setString(
+      TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+      cacheKey,
+      value || TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE,
+      { expiresInSeconds: TELEGRAM_WEBHOOK_SECRET_CACHE_TTL_SECONDS },
+    );
+
+    return {
+      value,
+      isCurrentGeneration:
+        generation === (await this.getTelegramWebhookSecretTokenGeneration()),
+    };
+  }
+
+  private async rotateTelegramWebhookSecretTokenGeneration(): Promise<void> {
+    await GlobalCache.setString(
+      TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+      TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY,
+      ObjectID.generate().toString(),
+    );
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.telegramWebhookSecretToken !== undefined) {
+      const secret: unknown = updateBy.data.telegramWebhookSecretToken;
+
+      if (
+        secret !== null &&
+        secret !== "" &&
+        !TelegramVerificationToken.isWebhookSecretStrong(secret)
+      ) {
+        throw new BadDataException(
+          "Telegram webhook secret token must be 32-100 characters and contain only letters, numbers, underscores, or hyphens.",
+        );
+      }
+
+      if (typeof secret === "string") {
+        updateBy.data.telegramWebhookSecretToken = secret.trim();
+      }
+
+      /*
+       * Move every replica to a fresh shared generation before the write. A
+       * request during the transaction may still read the currently committed
+       * secret, but it cannot repopulate the generation used before rotation.
+       * The success hook rotates once more after commit. If the write fails,
+       * this generation simply continues to cache the still-valid old value.
+       */
+      await this.rotateTelegramWebhookSecretTokenGeneration();
+    }
+
     const capacitySettingKeys: Array<keyof Model> = [
       "clickhouseCapacityNotificationEnabled",
       "clickhouseCapacityNotificationThresholdPercent",
@@ -201,6 +388,13 @@ export class Service extends DatabaseService<Model> {
       this.requireSsoForLoginCache.clear();
     }
 
+    if (
+      (onUpdate.updateBy.data as { telegramWebhookSecretToken?: unknown })
+        .telegramWebhookSecretToken !== undefined
+    ) {
+      await this.rotateTelegramWebhookSecretTokenGeneration();
+    }
+
     return onUpdate;
   }
 }

package/Server/Services/IncidentCustomFieldService.ts

@@ -1,9 +1,107 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/IncidentCustomField";
+import ObjectID from "../../Types/ObjectID";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { backfillMappedCustomFieldValues } from "../Utils/CustomField/CustomFieldDefinitionMappingHooks";
+import {
+  validateCustomFieldMappingOnCreate,
+  validateCustomFieldMappingOnUpdate,
+} from "../Utils/CustomField/CustomFieldMappingValidator";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * An incident custom field can take its value from the same field on the
+ * incident's monitors instead of being typed in again
+ * (OneUptime/oneuptime#3549). These hooks are the two halves of that
+ * configuration being saved: refusing a mapping that could never resolve, and
+ * filling in the incidents that already exist once one is saved.
+ */
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    await validateCustomFieldMappingOnCreate({
+      definitionModelType: Model,
+      createBy: createBy,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    await validateCustomFieldMappingOnUpdate({
+      definitionModelType: Model,
+      definitionService: this,
+      updateBy: updateBy,
+    });
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    backfillMappedCustomFieldValues({
+      definitionModelType: Model,
+      projectId: createdItem.projectId,
+      definitionName: "incident custom field",
+    });
+
+    return createdItem;
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    if (updatedItemIds.length > 0) {
+      backfillMappedCustomFieldValues({
+        definitionModelType: Model,
+        projectId: await this.getProjectIdForBackfill(onUpdate, updatedItemIds),
+        definitionName: "incident custom field",
+      });
+    }
+
+    return onUpdate;
+  }
+
+  /*
+   * `props.tenantId` is set on every dashboard write but not on internal
+   * root-scoped ones, so fall back to the row itself rather than skipping the
+   * backfill for a mapping that was changed by a script.
+   */
+  private async getProjectIdForBackfill(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<ObjectID | undefined> {
+    const tenantId: ObjectID | undefined = onUpdate.updateBy.props.tenantId as
+      | ObjectID
+      | undefined;
+
+    if (tenantId) {
+      return tenantId;
+    }
+
+    const item: Model | null = await this.findOneById({
+      id: updatedItemIds[0]!,
+      select: { projectId: true },
+      props: { isRoot: true },
+    });
+
+    return item?.projectId;
+  }
 }
 export default new Service();

package/Server/Services/IncidentService.ts

@@ -8,6 +8,8 @@ import FindBy from "../Types/Database/FindBy";
 import { OnCreate, OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
 import DatabaseService from "./DatabaseService";
+import IncidentCustomField from "../../Models/DatabaseModels/IncidentCustomField";
+import CustomFieldMappingService from "./CustomFieldMappingService";
 import AIRunService from "./AIRunService";
 import AIRunType from "../../Types/AI/AIRunType";
 import AIRunStatus from "../../Types/AI/AIRunStatus";
@@ -556,6 +558,18 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * Re-apply mapped custom field values. Covers the Custom Fields modal
+     * saving the whole bag back over a mapped value, and the incident's
+     * monitors being added or removed — both change what a mapped field should
+     * hold, and folding the answer into this payload keeps it one write with a
+     * truthful audit entry.
+     */
+    await CustomFieldMappingService.applyMappingsToUpdate({
+      definitionModelType: IncidentCustomField,
+      updateBy: updateBy,
+    });
+
     return {
       updateBy: updateBy,
       carryForward: carryForward,
@@ -1014,6 +1028,21 @@ export class Service extends DatabaseService<Model> {
         StatusPageSubscriberNotificationStatus.Pending;
     }
 
+    /*
+     * Last, because the incident template copy above can still be adding
+     * monitors and mapped custom fields are resolved from the final set.
+     *
+     * In onBeforeCreate rather than onCreateSuccess because `customFields` is
+     * a column on this row and the onCreateSuccess chain is un-awaited — a
+     * value written there would be missing from the incident the caller gets
+     * back. Written not to throw: a custom field failing to inherit must not
+     * stop an incident from being declared.
+     */
+    await CustomFieldMappingService.applyMappingsToCreate({
+      definitionModelType: IncidentCustomField,
+      createBy: createBy,
+    });
+
     return {
       createBy,
       carryForward: null,
@@ -1914,6 +1943,12 @@ ${incident.remediationNotes || "No remediation notes provided."}
     onUpdate: OnUpdate<Model>,
     updatedItemIds: ObjectID[],
   ): Promise<OnUpdate<Model>> {
+    CustomFieldMappingService.restampAfterMultiRowUpdate({
+      definitionModelType: IncidentCustomField,
+      updateBy: onUpdate.updateBy,
+      updatedItemIds: updatedItemIds,
+    });
+
     /*
      * Correcting a timestamp is the whole point of making these fields
      * editable, so the numbers derived from them have to move. Without this

package/Server/Services/MetricService.ts

@@ -30,6 +30,8 @@ import {
 import { keyForContainer } from "../Utils/Telemetry/TelemetryEntity";
 import { getEntityBudget } from "../Utils/Telemetry/EntityRegistry";
 import { EntityScopeQueryValue } from "../Utils/AnalyticsDatabase/StatementGenerator";
+import Includes from "../../Types/BaseDatabase/Includes";
+import EqualTo from "../../Types/BaseDatabase/EqualTo";
 import InventoryItemService from "./InventoryItemService";
 import InventoryItem from "../../Models/DatabaseModels/InventoryItem";
 import EntityType from "../../Types/Telemetry/EntityType";
@@ -1030,6 +1032,12 @@ export class MetricService extends AnalyticsDatabaseService<Metric> {
         }
       }
 
+      /*
+       * No rollup can serve this aggregation, so it reads the raw table.
+       * Narrow that scan to the queried entity before it is compiled.
+       */
+      this.applyRawEntityKeyPrune(aggregateBy);
+
       if (
         aggregateBy.aggregateColumnName.toString() === "value" &&
         aggregateBy.aggregationTimestampColumnName.toString() === "time"
@@ -1043,6 +1051,13 @@ export class MetricService extends AnalyticsDatabaseService<Metric> {
       return super.toAggregateStatement(aggregateBy);
     }
 
+    /*
+     * Percentiles never route to a rollup (the MVs store sum/count/min/max
+     * states, not quantile states), so every percentile aggregation reads
+     * the raw table and wants the same entity prune.
+     */
+    this.applyRawEntityKeyPrune(aggregateBy);
+
     const percentileLevel: number | null = getPercentileLevel(
       aggregateBy.aggregationType,
     );
@@ -2569,6 +2584,185 @@ export class MetricService extends AnalyticsDatabaseService<Metric> {
     return { route, keys: [expectedKey] };
   }
 
+  /**
+   * Entity keys derivable from ONE attribute filter on a recognized
+   * entity attribute, or null when this filter shape yields no provable
+   * key set.
+   *
+   * Accepts the shapes an entity filter actually arrives in — a bare
+   * string, `EqualTo(string)`, and `Includes([...strings])` ("is any
+   * of") — because for each of those the set of matching rows is exactly
+   * the union of the listed values' entities. Everything else (negations
+   * like NotEqual / IncludesNone, substring operators, numbers, arrays of
+   * AND-ed operators) is refused: their matching set is not a finite
+   * enumerable key set, so no key predicate could be proven lossless.
+   */
+  private getEntityKeysForAttributeFilter(data: {
+    route: EntityMVRoute;
+    projectId: string;
+    attributeValue: unknown;
+  }): Array<string> | null {
+    const keyForValue: ((projectId: string, value: string) => string) | null =
+      data.route.keyForValue;
+
+    /*
+     * Service is excluded for the same reason it is excluded from the
+     * single-attribute MV route: ingest folds `service.namespace` into
+     * the key, so a bare name does not derive the stamped key and the
+     * predicate could drop the namespaced variants' rows.
+     */
+    if (!keyForValue) {
+      return null;
+    }
+
+    const rawValues: Array<unknown> =
+      data.attributeValue instanceof Includes
+        ? (data.attributeValue.values as Array<unknown>) || []
+        : [
+            data.attributeValue instanceof EqualTo
+              ? (data.attributeValue.value as unknown)
+              : data.attributeValue,
+          ];
+
+    const keys: Array<string> = [];
+    for (const rawValue of rawValues) {
+      /*
+       * One non-string (or empty) member makes the whole union
+       * underivable — refuse rather than prune to a partial set, which
+       * would silently drop rows.
+       */
+      if (typeof rawValue !== "string" || !rawValue) {
+        return null;
+      }
+      const key: string = keyForValue(data.projectId, rawValue);
+      if (!keys.includes(key)) {
+        keys.push(key);
+      }
+    }
+
+    return keys.length > 0 ? keys : null;
+  }
+
+  /**
+   * Narrow a raw-table aggregation to the entity it filters on, by
+   * ANDing a predicate on the bloom-indexed scalar entity-key column
+   * onto the query.
+   *
+   * WHY: `attributes` is a Map column with no index and no place in the
+   * sort key, so `attributes['resource.host.name'] = 'web-1'` cannot
+   * prune a single granule — ClickHouse reads EVERY row for the
+   * project+metric in the window and evaluates the map lookup per row.
+   * The per-entity rollups (tryBuildEntityAggregateMVStatement) hide
+   * that for the common single-filter case, but they decline as soon as
+   * the query carries anything they cannot express: a second attribute
+   * filter (`state is any of system, user`), a group-by, a percentile, a
+   * distribution metric, a `Total` interval. Those queries then fall to
+   * the raw table UNPRUNED, and the scan cost grows with the window —
+   * measured on a production project, one host's `system.cpu.utilization`
+   * with a second attribute filter took ~1.5s over 1 hour but blew
+   * through the 45s `max_execution_time` over 1 week, returning either a
+   * 500 or (under `timeout_overflow_mode = 'break'`) a silently partial
+   * chart. With this prune the same 1-week query returns complete
+   * results in ~2.4s.
+   *
+   * WHY IT IS LOSSLESS: the added predicate can only ever remove rows the
+   * attribute predicate already removed. A row matching
+   * `attributes[<entity attr>] = v` either
+   *   - was ingested with the scalar key columns stamped, in which case
+   *     its `<keyColumn>` IS `keyFor<type>(projectId, v)` — the ingest
+   *     stamp and `keyForValue` are the same canonicalizing function
+   *     (see Common/Utils/Telemetry/EntityKey); or
+   *   - predates those columns, in which case it reads the non-Nullable
+   *     default `''`.
+   * Both are in the emitted `IN` set, so the predicate is a pure
+   * restriction on the scan, not on the result. (This is strictly safer
+   * than the rollup path it backstops, which drops the `''` rows.)
+   *
+   * Applied only after MV routing has declined — adding a key column to
+   * the query beforehand would fail the MVs' `mvQueryableColumns` gate
+   * and disable the fast path this backstops.
+   */
+  private applyRawEntityKeyPrune(aggregateBy: AggregateBy<Metric>): void {
+    const queryRecord: Record<string, unknown> =
+      (aggregateBy.query as unknown as Record<string, unknown>) || {};
+
+    /*
+     * Entity keys fold the tenant into the hash, so they are only
+     * derivable for a project-scoped query. Dashboard reads always are.
+     */
+    const projectIdValue: unknown = queryRecord["projectId"];
+    let projectId: string = "";
+    if (projectIdValue instanceof ObjectID) {
+      projectId = projectIdValue.toString();
+    } else if (typeof projectIdValue === "string") {
+      projectId = projectIdValue;
+    }
+    if (!projectId) {
+      return;
+    }
+
+    const attrs: unknown = queryRecord["attributes"];
+    if (!attrs || typeof attrs !== "object" || Array.isArray(attrs)) {
+      return;
+    }
+
+    const prunePredicates: Record<string, Includes> = {};
+
+    for (const [attrKey, attrValue] of Object.entries(
+      attrs as Record<string, unknown>,
+    )) {
+      const route: EntityMVRoute | undefined = ENTITY_MV_ROUTES.find(
+        (candidate: EntityMVRoute) => {
+          return candidate.attributeKey === attrKey;
+        },
+      );
+      if (!route) {
+        continue;
+      }
+
+      /*
+       * Never touch a key column the caller already constrained — theirs
+       * is the authoritative predicate, and a second one could only
+       * narrow it further.
+       */
+      if (queryRecord[route.keyColumn] !== undefined) {
+        continue;
+      }
+
+      // Models without the column (older schema) simply get no prune.
+      if (!this.model.getTableColumn(route.keyColumn)) {
+        continue;
+      }
+
+      const keys: Array<string> | null = this.getEntityKeysForAttributeFilter({
+        route,
+        projectId,
+        attributeValue: attrValue,
+      });
+      if (!keys) {
+        continue;
+      }
+
+      // '' keeps rows ingested before the key columns existed. See above.
+      prunePredicates[route.keyColumn] = new Includes([...keys, ""]);
+    }
+
+    if (Object.keys(prunePredicates).length === 0) {
+      return;
+    }
+
+    /*
+     * Replace `query` rather than mutating it in place: callers (the API
+     * aggregate cache, the metric-monitor worker) may still hold the
+     * object they passed in. `aggregateBy` itself keeps its identity, so
+     * the point-type / service-key hints keyed on it in WeakMaps survive.
+     */
+    aggregateBy.query = {
+      ...(aggregateBy.query as unknown as Record<string, unknown>),
+      ...prunePredicates,
+    } as unknown as typeof aggregateBy.query;
+  }
+
   private stripEntityFilterAndTimeFromQuery(query: unknown): typeof query {
     if (!query || typeof query !== "object") {
       return query;

package/Server/Services/MonitorService.ts

@@ -10,6 +10,8 @@ import CreateBy from "../Types/Database/CreateBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
 import DatabaseService from "./DatabaseService";
+import CustomFieldMappingService from "./CustomFieldMappingService";
+import CustomFieldMappingSourceResource from "../../Types/CustomField/CustomFieldMappingSourceResource";
 import MonitorLabelRuleEngineService from "./MonitorLabelRuleEngineService";
 import MonitorOwnerRuleEngineService from "./MonitorOwnerRuleEngineService";
 import MonitorOwnerTeamService from "./MonitorOwnerTeamService";
@@ -1099,6 +1101,36 @@ export class Service extends DatabaseService<Model> {
           });
         }
 
+        /*
+         * The "stays in sync" half of custom field value mapping
+         * (OneUptime/oneuptime#3549): alerts, incidents and maintenance events
+         * attached to this monitor whose custom fields are configured to
+         * inherit from it are brought back in line.
+         *
+         * `!== undefined` rather than truthiness: clearing the bag arrives as
+         * `{}` or null, and is exactly the edit worth reacting to. In its own
+         * try/catch because a propagation failure must never fail the
+         * operator's save — the house rule for every side effect in this hook.
+         */
+        if (onUpdate.updateBy.data.customFields !== undefined) {
+          try {
+            await CustomFieldMappingService.propagateFromSourceRecord({
+              resource: CustomFieldMappingSourceResource.Monitor,
+              sourceId: monitorId,
+              projectId: projectId,
+            });
+          } catch (error) {
+            logger.error(
+              "Custom field value mapping: propagating monitor custom fields failed in MonitorService.onUpdateSuccess",
+              {
+                projectId: projectId?.toString(),
+                monitorId: monitorId?.toString(),
+              } as LogAttributes,
+            );
+            logger.error(error as Error);
+          }
+        }
+
         if (onUpdate.updateBy.data.monitorSteps) {
           const validMonitorStepIds: Array<string> = this.extractMonitorStepIds(
             onUpdate.updateBy.data.monitorSteps as MonitorSteps | JSONObject,