@oneuptime/common 12.0.34 → 13.0.1

package/Models/DatabaseModels/Incident.ts

@@ -17,6 +17,7 @@ import OnCallDutyPolicy from "./OnCallDutyPolicy";
 import Probe from "./Probe";
 import Project from "./Project";
 import ProxmoxCluster from "./ProxmoxCluster";
+import VMwareVCenter from "./VMwareVCenter";
 import IoTFleet from "./IoTFleet";
 import DockerSwarmCluster from "./DockerSwarmCluster";
 import Service from "./Service";
@@ -968,6 +969,60 @@ export default class Incident extends BaseModel {
   })
   public proxmoxClusters?: Array<ProxmoxCluster> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.IncidentAdmin,
+      Permission.IncidentMember,
+      Permission.CreateProjectIncident,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.IncidentAdmin,
+      Permission.IncidentMember,
+      Permission.IncidentViewer,
+      Permission.ReadProjectIncident,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.IncidentAdmin,
+      Permission.IncidentMember,
+      Permission.EditProjectIncident,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: VMwareVCenter,
+    title: "vCenters",
+    description: "List of vCenters affected by this incident.",
+  })
+  @ManyToMany(
+    () => {
+      return VMwareVCenter;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "IncidentVMwareVCenter",
+    inverseJoinColumn: {
+      name: "vmwareVCenterId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "incidentId",
+      referencedColumnName: "_id",
+    },
+  })
+  public vmwareVCenters?: Array<VMwareVCenter> = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/Index.ts

@@ -51,6 +51,10 @@ import CephCluster from "./CephCluster";
 import CephClusterOwnerTeam from "./CephClusterOwnerTeam";
 import CephClusterOwnerUser from "./CephClusterOwnerUser";
 import CephResource from "./CephResource";
+import VMwareVCenter from "./VMwareVCenter";
+import VMwareVCenterOwnerTeam from "./VMwareVCenterOwnerTeam";
+import VMwareVCenterOwnerUser from "./VMwareVCenterOwnerUser";
+import VMwareResource from "./VMwareResource";
 import Host from "./Host";
 import HostOwnerTeam from "./HostOwnerTeam";
 import HostOwnerUser from "./HostOwnerUser";
@@ -121,6 +125,7 @@ import LogPipelineProcessor from "./LogPipelineProcessor";
 import LogDropFilter from "./LogDropFilter";
 import DetectionRule from "./DetectionRule";
 import GoogleSecOpsConnection from "./GoogleSecOpsConnection";
+import GoogleSecOpsConnectionRun from "./GoogleSecOpsConnectionRun";
 import ThreatIntelFeed from "./ThreatIntelFeed";
 import LogScrubRule from "./LogScrubRule";
 import MetricPipelineRule from "./MetricPipelineRule";
@@ -425,6 +430,8 @@ import IoTFleetOwnerRule from "./IoTFleetOwnerRule";
 import IoTFleetLabelRule from "./IoTFleetLabelRule";
 import CephClusterOwnerRule from "./CephClusterOwnerRule";
 import CephClusterLabelRule from "./CephClusterLabelRule";
+import VMwareVCenterOwnerRule from "./VMwareVCenterOwnerRule";
+import VMwareVCenterLabelRule from "./VMwareVCenterLabelRule";
 import RunbookOwnerRule from "./RunbookOwnerRule";
 import RunbookLabelRule from "./RunbookLabelRule";
 import WorkflowOwnerRule from "./WorkflowOwnerRule";
@@ -455,6 +462,7 @@ import DockerSwarmClusterFeed from "./DockerSwarmClusterFeed";
 import CephClusterFeed from "./CephClusterFeed";
 import PodmanHostFeed from "./PodmanHostFeed";
 import ProxmoxClusterFeed from "./ProxmoxClusterFeed";
+import VMwareVCenterFeed from "./VMwareVCenterFeed";
 import HostFeed from "./HostFeed";
 import CloudResourceFeed from "./CloudResourceFeed";
 import ServiceFeed from "./ServiceFeed";
@@ -492,6 +500,7 @@ const AllModelTypes: Array<{
   LogDropFilter,
   DetectionRule,
   GoogleSecOpsConnection,
+  GoogleSecOpsConnectionRun,
   ThreatIntelFeed,
   LogScrubRule,
   MetricPipelineRule,
@@ -633,6 +642,8 @@ const AllModelTypes: Array<{
   IoTFleetLabelRule,
   CephClusterOwnerRule,
   CephClusterLabelRule,
+  VMwareVCenterOwnerRule,
+  VMwareVCenterLabelRule,
   RunbookOwnerRule,
   RunbookLabelRule,
   WorkflowOwnerRule,
@@ -861,6 +872,7 @@ const AllModelTypes: Array<{
   CephClusterFeed,
   PodmanHostFeed,
   ProxmoxClusterFeed,
+  VMwareVCenterFeed,
   HostFeed,
   CloudResourceFeed,
   ServiceFeed,
@@ -924,6 +936,10 @@ const AllModelTypes: Array<{
   CephClusterOwnerTeam,
   CephClusterOwnerUser,
   CephResource,
+  VMwareVCenter,
+  VMwareVCenterOwnerTeam,
+  VMwareVCenterOwnerUser,
+  VMwareResource,
   Host,
   HostOwnerTeam,
   HostOwnerUser,

package/Models/DatabaseModels/InventoryItem.ts

@@ -18,7 +18,19 @@ import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
 import EntitySource from "../../Types/Telemetry/EntitySource";
 import EntityType from "../../Types/Telemetry/EntityType";
-import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+import {
+  InventoryLiveness,
+  INVENTORY_LIVE_WINDOW_MINUTES,
+  INVENTORY_STALE_AFTER_MINUTES,
+} from "../../Types/Telemetry/InventoryLiveness";
+import {
+  Column,
+  Entity,
+  Index,
+  JoinColumn,
+  ManyToOne,
+  VirtualColumn,
+} from "typeorm";
 import DatabaseBaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 
 /*
@@ -368,6 +380,37 @@ export default class InventoryItem extends DatabaseBaseModel {
   @Column({ type: ColumnType.Date, nullable: true })
   public lastSeenAt?: Date = undefined;
 
+  /**
+   * Computed at read time so filters, counts and pagination use the same
+   * status without persisting a value that becomes stale as time passes.
+   * A virtual column needs no schema migration and is never written.
+   *
+   * The badge floors elapsed minutes before applying inclusive thresholds:
+   * 30m59s is still Live, and 24h00m59s is still Recent. Strict comparisons
+   * against the following minute preserve those exact boundaries.
+   */
+  @ColumnAccessControl({ create: [], read: READ_PERMS, update: [] })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    required: false,
+    title: "Status",
+    description:
+      "Current heartbeat status: live, recent, stale, never seen, or not tracked.",
+  })
+  @VirtualColumn({
+    type: ColumnType.ShortText,
+    query: (alias: string): string => {
+      return `CASE
+        WHEN ${alias}."source" IS DISTINCT FROM '${EntitySource.Discovered}' THEN '${InventoryLiveness.NotTracked}'
+        WHEN ${alias}."lastSeenAt" IS NULL THEN '${InventoryLiveness.Never}'
+        WHEN ${alias}."lastSeenAt" > CURRENT_TIMESTAMP - INTERVAL '${INVENTORY_LIVE_WINDOW_MINUTES + 1} minutes' THEN '${InventoryLiveness.Live}'
+        WHEN ${alias}."lastSeenAt" > CURRENT_TIMESTAMP - INTERVAL '${INVENTORY_STALE_AFTER_MINUTES + 1} minutes' THEN '${InventoryLiveness.Recent}'
+        ELSE '${InventoryLiveness.Stale}'
+      END`;
+    },
+  })
+  public inventoryStatus?: InventoryLiveness = undefined;
+
   /*
    * Archiving is the disposal route that actually works for this table.
    *

package/Models/DatabaseModels/NetworkDevice.ts

@@ -434,6 +434,132 @@ export default class NetworkDevice extends BaseModel {
   })
   public hostname?: string = undefined;
 
+  /*
+   * --- Which switch port is this device on? ---
+   *
+   * LLDP and CDP answer that for a device that speaks them. A device that
+   * does not - a POS register, a handset, a kiosk, anything monitored by
+   * ping alone - is invisible to both, and until now the only way to draw
+   * its cable on the map was a NetworkDeviceLink somebody typed in and then
+   * had to keep true by hand (issue #3489).
+   *
+   * The switches already know. Every walked switch reports its forwarding
+   * table, and the server keeps one NetworkEndpoint row per MAC it learned
+   * with the switch and port that learned it. This column is what lets a
+   * device be recognised in that inventory: a device whose MAC matches an
+   * endpoint's is drawn on the port that endpoint was learned on, and the
+   * link moves with the device when it is re-cabled, because the next walk
+   * learns the MAC somewhere else.
+   *
+   * Optional twice over. A device whose hostname is an IP address that a
+   * walked device's ARP table resolves is matched by address without it,
+   * and the MAC learned that way is written here so the match survives the
+   * ARP entry ageing out. The server fills an EMPTY value, and corrects a
+   * value it learned itself when the table later binds the address to a
+   * different MAC (isMacAddressLearned says which); anything an operator
+   * typed is left alone. Normalised to lowercase colon form on write; any
+   * of the usual spellings is accepted.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDevice,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "MAC Address",
+    description:
+      "MAC address of this device. Lets the topology map find the switch port it is plugged into from the forwarding tables of walked switches, for a device that speaks neither LLDP nor CDP (one monitored by ping alone). Optional: a device whose hostname is an IP address that a walked router's ARP table resolves is matched by address, and the MAC learned that way is stored here.",
+    example: "aa:bb:cc:dd:ee:ff",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public macAddress?: string = undefined;
+
+  /*
+   * Where the MAC above came from, when the server wrote it.
+   *
+   * A MAC an operator typed is theirs and is never touched. A MAC the ARP
+   * pass learned is only as good as the router's table was on the walk
+   * that learned it - an address re-leased to a laptop the day before the
+   * register was plugged in stamps the laptop's MAC on the register - so
+   * the pass may correct its OWN answer when a later walk binds the
+   * address to a different MAC, and this flag is what tells the two apart.
+   * Set by the learner's write, cleared by any write of macAddress that
+   * comes through the API (see NetworkDeviceService).
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateNetworkDevice,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Boolean,
+    canReadOnRelationQuery: true,
+    title: "MAC Address Learned",
+    description:
+      "True when the MAC Address was filled in from a walked device's ARP table rather than typed. A learned MAC is corrected when a later walk binds the device's address to a different MAC; a typed one is never touched.",
+    defaultValue: false,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public isMacAddressLearned?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/ScheduledMaintenance.ts

@@ -8,6 +8,7 @@ import Monitor from "./Monitor";
 import MonitorStatus from "./MonitorStatus";
 import Project from "./Project";
 import ProxmoxCluster from "./ProxmoxCluster";
+import VMwareVCenter from "./VMwareVCenter";
 import IoTFleet from "./IoTFleet";
 import NetworkSite from "./NetworkSite";
 import DockerSwarmCluster from "./DockerSwarmCluster";
@@ -766,6 +767,60 @@ export default class ScheduledMaintenance extends BaseModel {
   })
   public proxmoxClusters?: Array<ProxmoxCluster> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.CreateProjectScheduledMaintenance,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.ScheduledMaintenanceViewer,
+      Permission.ReadProjectScheduledMaintenance,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.EditProjectScheduledMaintenance,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: VMwareVCenter,
+    title: "vCenters",
+    description: "List of vCenters affected by this event.",
+  })
+  @ManyToMany(
+    () => {
+      return VMwareVCenter;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "ScheduledMaintenanceVMwareVCenter",
+    inverseJoinColumn: {
+      name: "vmwareVCenterId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "scheduledMaintenanceId",
+      referencedColumnName: "_id",
+    },
+  })
+  public vmwareVCenters?: Array<VMwareVCenter> = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/User.ts

@@ -384,6 +384,55 @@ class User extends UserModel {
   })
   public resetPasswordExpires?: Date = undefined;
 
+  /*
+   * TWO challenge slots, not one, and the split is the whole point.
+   *
+   * A WebAuthn challenge is a one-shot value: the server issues it, the
+   * authenticator signs it, and the server compares what came back against
+   * what it stored. Registration and signing in are separate flows that each
+   * need one, and they used to share a single `webauthnChallenge` column --
+   * so whichever flow wrote last silently destroyed the other's.
+   *
+   * That is not a theoretical race. Registration is keyed by the session's
+   * user and signing in is keyed by an email address, so both land on the
+   * SAME row: a user adding a second key in one tab while a stale sign-in page
+   * in another asks for a fresh challenge loses the registration they were
+   * halfway through, and gets "No pending WebAuthn challenge found" for a key
+   * they are holding and touching. The anonymous
+   * /generate-authentication-options route made it reachable by strangers as
+   * well as by the user's own second tab.
+   *
+   * Named for their purposes rather than one being left as the bare
+   * `webauthnChallenge`, because a slot whose name does not say which flow
+   * owns it is exactly how the two came to share one.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({ type: TableColumnType.ShortText })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+    unique: false,
+  })
+  public webauthnRegistrationChallenge?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({ type: TableColumnType.Date })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+    unique: false,
+  })
+  public webauthnRegistrationChallengeExpiresAt?: Date = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],
@@ -396,7 +445,7 @@ class User extends UserModel {
     nullable: true,
     unique: false,
   })
-  public webauthnChallenge?: string = undefined;
+  public webauthnAuthenticationChallenge?: string = undefined;
 
   @ColumnAccessControl({
     create: [],
@@ -409,7 +458,7 @@ class User extends UserModel {
     nullable: true,
     unique: false,
   })
-  public webauthnChallengeExpiresAt?: Date = undefined;
+  public webauthnAuthenticationChallengeExpiresAt?: Date = undefined;
 
   @ColumnAccessControl({
     create: [],

package/Models/DatabaseModels/UserNotificationEmailRollupItem.ts

@@ -40,8 +40,9 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
  * this customer" without adding telemetry.
  *
  * WHAT IS DELIBERATELY NOT STORED: the envelope vars, the template type, and
- * any rendered body. A rollup line is eventType + subject + an optional deep
- * link. Storing envelopes would multiply row size roughly fiftyfold, add a
+ * any rendered body. A rollup line stores eventType, subject, an optional deep
+ * link, and the severity and state names shown in alert/incident emails.
+ * Storing envelopes would multiply row size roughly fiftyfold, add a
  * stale-template bug class the moment a template changes under a queued row,
  * and buy nothing a reader of the rollup email ever sees.
  *
@@ -291,6 +292,46 @@ export default class UserNotificationEmailRollupItem extends BaseModel {
   })
   public subject?: string = undefined;
 
+  /*
+   * Snapshot the labels in the original notification so a later state change
+   * or rename cannot make a queued event describe a different point in time.
+   * Nullable for older queue items and notification families without these
+   * details. These names use the same length as severity and state models.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    title: "Severity",
+    description: "Severity name when this notification was queued",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public severity?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    title: "Current State",
+    description: "State name when this notification was queued",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public currentState?: string = undefined;
+
   /*
    * The deep link back into the dashboard, lifted out of the envelope vars,
    * and also the key rows are folded on when the rollup is rendered - two

package/Models/DatabaseModels/UserWebAuthn.ts

@@ -153,6 +153,23 @@ class UserWebAuthn extends BaseModel {
   })
   public isVerified?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Boolean,
+    title: "Registered as a Passkey",
+    description:
+      "Whether this credential was registered for passwordless sign-in. Older credentials have no recorded purpose.",
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: true,
+  })
+  public isPasskey?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],