@oneuptime/common 12.0.8 → 12.0.9

package/Server/Services/AlertSeverityService.ts

@@ -10,7 +10,18 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import Model from "../../Models/DatabaseModels/AlertSeverity";
+import Queue, { QueueName } from "../Infrastructure/Queue";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * Must stay identical to the RunCron job name in
+ * App/FeatureSet/Workers/Jobs/OnCallDutyPolicy/BackfillNotificationRulesForNewSeverities.ts.
+ * Common cannot import from App, so the string is duplicated deliberately; the
+ * job file carries a matching comment naming its two enqueue sites.
+ */
+const BACKFILL_NOTIFICATION_RULES_JOB_NAME: string =
+  "OnCallDutyPolicy:BackfillNotificationRulesForNewSeverities";
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -40,6 +51,58 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  /**
+   * A severity created today is a severity every existing responder has no
+   * notification rule for. See the twin hook on IncidentSeverityService for the
+   * full reasoning; the short version is that default rules are only ever
+   * written when a responder joins or verifies a method, and both iterate the
+   * severities that exist AT THAT MOMENT, so a severity added later pages
+   * nobody until something backfills it.
+   *
+   * Queued rather than inline because a project can hold thousands of
+   * responders and this hook runs inside the request that created the severity.
+   * Best-effort because the severity must be created either way - the backfill
+   * job also sweeps recently-created severities on its own schedule, so a
+   * dropped enqueue costs latency, not coverage.
+   */
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    try {
+      await Queue.addJob(
+        QueueName.Worker,
+        `${BACKFILL_NOTIFICATION_RULES_JOB_NAME}-${createdItem.id?.toString()}`,
+        BACKFILL_NOTIFICATION_RULES_JOB_NAME,
+        {
+          /*
+           * The Worker queue dispatches purely on job NAME and hands the job
+           * function no payload, so the job re-derives which severities need
+           * backfilling for itself. These ride along for the queue inspector and
+           * the failure log.
+           */
+          projectId: createdItem.projectId?.toString() || "",
+          alertSeverityId: createdItem.id?.toString() || "",
+        },
+        {
+          // One active, one queued, latest payload wins - never N overlapping scans.
+          deduplication: {
+            id: BACKFILL_NOTIFICATION_RULES_JOB_NAME,
+            keepLastIfActive: true,
+          },
+        },
+      );
+    } catch (err) {
+      logger.error(
+        "Could not enqueue the on-call notification rule backfill for a newly created alert severity. The scheduled sweep will still pick it up.",
+      );
+      logger.error(err);
+    }
+
+    return createdItem;
+  }
+
   @CaptureSpan()
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<Model>,

package/Server/Services/DashboardService.ts

@@ -24,6 +24,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import ObjectID from "../../Types/ObjectID";
 import { JSONObject } from "../../Types/JSON";
 import IP from "../../Types/IP/IP";
+import { resolveClientIp } from "../Utils/ClientIp";
 import {
   DASHBOARD_MASTER_PASSWORD_COOKIE_IDENTIFIER,
   DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
@@ -169,12 +170,13 @@ export class Service extends DatabaseService<Model> {
       if (dashboard?.ipWhitelist && dashboard.ipWhitelist.length > 0) {
         const ipWhitelist: Array<string> = dashboard.ipWhitelist?.split("\n");
 
-        const ipAccessedFrom: string | undefined =
-          req.headers["x-forwarded-for"]?.toString() ||
-          req.headers["x-real-ip"]?.toString() ||
-          req.socket.remoteAddress ||
-          req.ip ||
-          req.ips[0];
+        /*
+         * One address, resolved from the trusted end of X-Forwarded-For.
+         * Never the raw header: a caller can prepend any address they like to
+         * it, so checking the chain rather than a single resolved address let
+         * anyone who knew an allowlisted address walk straight in.
+         */
+        const ipAccessedFrom: string | undefined = resolveClientIp(req);
 
         if (!ipAccessedFrom) {
           logger.error("IP address not found in request.", {
@@ -189,10 +191,7 @@ export class Service extends DatabaseService<Model> {
         }
 
         const isIPWhitelisted: boolean = IP.isInWhitelist({
-          ips:
-            ipAccessedFrom?.split(",").map((i: string) => {
-              return i.trim();
-            }) || [],
+          ip: ipAccessedFrom,
           whitelist: ipWhitelist,
         });
 

package/Server/Services/DatabaseService.ts

@@ -18,6 +18,7 @@ import {
   OnUpdate,
 } from "../Types/Database/Hooks";
 import ModelPermission from "../Types/Database/Permissions/Index";
+import OwnerOnlyColumnPermission from "../Types/Database/Permissions/OwnerOnlyColumnPermission";
 import { CheckReadPermissionType } from "../Types/Database/Permissions/ReadPermission";
 import Query from "../Types/Database/Query";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -913,7 +914,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * `Incident` -> `incidentId`, `Monitor` -> `monitorId`. Matches the keys in
    * TelemetryContextAttributes so dashboards/queries stay consistent.
    */
-  private getTelemetryEntityIdKey(): string {
+  private getInventoryItemIdKey(): string {
     const name: string = this.modelName || "entity";
     return name.charAt(0).toLowerCase() + name.slice(1) + "Id";
   }
@@ -960,7 +961,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       }
 
       if (item.id) {
-        attributes[this.getTelemetryEntityIdKey()] = item.id.toString();
+        attributes[this.getInventoryItemIdKey()] = item.id.toString();
       }
 
       if (Object.keys(attributes).length > 0) {
@@ -1905,6 +1906,17 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * permission-checked, so a column being sorted on is already reaching the
    * database - adding it to the select must not be able to turn a query that
    * worked into a permission error. The values never reach the caller.
+   *
+   * That last sentence is exactly why owner-only columns are excluded below.
+   * Running after the gate means anything added here was never gated, so
+   * `sort: { webhookUrl: "ASC" }` is a way of writing a column into the select
+   * that ModelPermission has already finished looking at. The column is
+   * stripped off the returned rows again, but "the caller only learns the
+   * ORDER of everyone's webhook URLs" is not a defence - order is a comparison
+   * oracle, and a handful of paged requests reconstructs the value. A caller
+   * who may genuinely read the column has already put it in the select
+   * themselves, in which case the first filter clause below has already
+   * returned false and nothing here applies to them.
    */
   private addSortColumnsToSelect(findBy: FindBy<TBaseModel>): Array<string> {
     /*
@@ -1915,6 +1927,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       return [];
     }
 
+    /*
+     * Root and master admin keep the existing behaviour untouched: they are
+     * past every permission check by definition, and notification delivery
+     * reads and orders these columns as root in order to actually page people.
+     */
+    const isPrivilegedInternalRead: boolean =
+      Boolean(findBy.props.isRoot) || Boolean(findBy.props.isMasterAdmin);
+
     const sortColumnsToAdd: Array<string> = Object.keys(
       findBy.sort || {},
     ).filter((sortColumn: string) => {
@@ -1922,6 +1942,16 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         return false;
       }
 
+      if (
+        !isPrivilegedInternalRead &&
+        OwnerOnlyColumnPermission.isOwnerOnlyColumnOnModel(
+          this.modelType,
+          sortColumn,
+        )
+      ) {
+        return false;
+      }
+
       /*
        * Sorting by a relation orders through the joined table, which has its
        * own alias - adding the relation to the select here would instead turn

package/Server/Services/IncidentEpisodeStateTimelineService.ts

@@ -20,6 +20,9 @@ import IncidentEpisodeFeedService from "./IncidentEpisodeFeedService";
 import { IncidentEpisodeFeedEventType } from "../../Models/DatabaseModels/IncidentEpisodeFeed";
 import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
 import IncidentEpisodeService from "./IncidentEpisodeService";
+import IncidentEpisodeInternalNote from "../../Models/DatabaseModels/IncidentEpisodeInternalNote";
+import IncidentEpisodeInternalNoteService from "./IncidentEpisodeInternalNoteService";
+import { JSONObject } from "../../Types/JSON";
 
 export class Service extends DatabaseService<IncidentEpisodeStateTimeline> {
   public constructor() {
@@ -188,11 +191,21 @@ export class Service extends DatabaseService<IncidentEpisodeStateTimeline> {
         incidentEpisodeId: createBy.data.incidentEpisodeId?.toString(),
       } as LogAttributes);
 
+      /*
+       * The note a user writes when they change the state. It is not a column
+       * on this model, so it travels alongside the create and becomes an
+       * internal note on the episode once the timeline row exists.
+       */
+      const privateNote: string | undefined = (
+        createBy.miscDataProps as JSONObject | undefined
+      )?.["privateNote"] as string | undefined;
+
       return {
         createBy,
         carryForward: {
           statusTimelineBeforeThisStatus: stateBeforeThis || null,
           statusTimelineAfterThisStatus: stateAfterThis || null,
+          privateNote: privateNote,
           mutex: mutex,
         },
       };
@@ -442,6 +455,22 @@ export class Service extends DatabaseService<IncidentEpisodeStateTimeline> {
       },
     });
 
+    if (onCreate.carryForward.privateNote) {
+      const privateNote: string = onCreate.carryForward.privateNote;
+
+      const episodeInternalNote: IncidentEpisodeInternalNote =
+        new IncidentEpisodeInternalNote();
+      episodeInternalNote.incidentEpisodeId = createdItem.incidentEpisodeId;
+      episodeInternalNote.note = privateNote;
+      episodeInternalNote.createdAt = createdItem.startsAt!;
+      episodeInternalNote.projectId = createdItem.projectId!;
+
+      await IncidentEpisodeInternalNoteService.create({
+        data: episodeInternalNote,
+        props: onCreate.createBy.props,
+      });
+    }
+
     return createdItem;
   }
 

package/Server/Services/IncidentSeverityService.ts

@@ -10,7 +10,18 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import Model from "../../Models/DatabaseModels/IncidentSeverity";
+import Queue, { QueueName } from "../Infrastructure/Queue";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * Must stay identical to the RunCron job name in
+ * App/FeatureSet/Workers/Jobs/OnCallDutyPolicy/BackfillNotificationRulesForNewSeverities.ts.
+ * Common cannot import from App, so the string is duplicated deliberately; the
+ * job file carries a matching comment naming its two enqueue sites.
+ */
+const BACKFILL_NOTIFICATION_RULES_JOB_NAME: string =
+  "OnCallDutyPolicy:BackfillNotificationRulesForNewSeverities";
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -40,6 +51,71 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  /**
+   * A severity created today is a severity every existing responder has no
+   * notification rule for.
+   *
+   * The default rules a responder gets are written when they join the project
+   * and when they verify a notification method, and both of those iterate the
+   * severities that exist AT THAT MOMENT. Nothing revisited the question
+   * afterwards, so adding a "Sev4" a year into a project silently switched off
+   * paging for it: every Sev4 incident counted zero matching rules and dropped
+   * into an execution log nobody reads.
+   *
+   * The repair is queued rather than run inline. A project can hold thousands of
+   * responders, this hook sits inside the request that created the severity, and
+   * a fan-out that slow would either time the request out or fail half-finished
+   * with nothing to roll back. The worker owns the work; this only rings the
+   * bell.
+   *
+   * Ringing the bell is best-effort on purpose. If Redis is unreachable the
+   * severity must still be created - the backfill job also sweeps
+   * recently-created severities on its own schedule, so a dropped enqueue costs
+   * a few minutes of latency, not coverage.
+   */
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    try {
+      await Queue.addJob(
+        QueueName.Worker,
+        `${BACKFILL_NOTIFICATION_RULES_JOB_NAME}-${createdItem.id?.toString()}`,
+        BACKFILL_NOTIFICATION_RULES_JOB_NAME,
+        {
+          /*
+           * The Worker queue dispatches purely on job NAME and hands the job
+           * function no payload, so the job re-derives which severities need
+           * backfilling for itself. These ride along for the queue inspector and
+           * the failure log, where "which severity was this?" is the first
+           * question anyone asks.
+           */
+          projectId: createdItem.projectId?.toString() || "",
+          incidentSeverityId: createdItem.id?.toString() || "",
+        },
+        {
+          /*
+           * Seeding a project with four severities in one go must not start four
+           * overlapping scans that all see the same uncovered responders and all
+           * write the same rules. One active, one queued, latest payload wins.
+           */
+          deduplication: {
+            id: BACKFILL_NOTIFICATION_RULES_JOB_NAME,
+            keepLastIfActive: true,
+          },
+        },
+      );
+    } catch (err) {
+      logger.error(
+        "Could not enqueue the on-call notification rule backfill for a newly created incident severity. The scheduled sweep will still pick it up.",
+      );
+      logger.error(err);
+    }
+
+    return createdItem;
+  }
+
   @CaptureSpan()
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<Model>,

package/Server/Services/Index.ts

@@ -49,6 +49,9 @@ import NetworkSiteTypeService from "./NetworkSiteTypeService";
 import NetworkEndpointService from "./NetworkEndpointService";
 import NetworkSiteStatusTimelineService from "./NetworkSiteStatusTimelineService";
 import NetworkSiteLinkService from "./NetworkSiteLinkService";
+import NetworkDeviceLinkService from "./NetworkDeviceLinkService";
+import NetworkDeviceLinkRuleService from "./NetworkDeviceLinkRuleService";
+import NetworkTopologySuppressionService from "./NetworkTopologySuppressionService";
 import NetworkSiteAssignmentRuleService from "./NetworkSiteAssignmentRuleService";
 import PodmanHostService from "./PodmanHostService";
 import ProxmoxClusterService from "./ProxmoxClusterService";
@@ -213,8 +216,9 @@ import WorkflowService from "./WorkflowService";
 import WorkflowVariablesService from "./WorkflowVariableService";
 import AnalyticsBaseModel from "../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
 import TelemetryExceptionService from "./TelemetryExceptionService";
-import TelemetryEntityService from "./TelemetryEntityService";
-import TelemetryEntityRelationshipService from "./TelemetryEntityRelationshipService";
+import InventoryItemService from "./InventoryItemService";
+import InventoryItemCustomFieldService from "./InventoryItemCustomFieldService";
+import InventoryItemRelationshipService from "./InventoryItemRelationshipService";
 import ExceptionInstanceService from "./ExceptionInstanceService";
 import KubernetesCostAllocationService from "./KubernetesCostAllocationService";
 import ScheduledMaintenanceTemplateService from "./ScheduledMaintenanceTemplateService";
@@ -351,6 +355,9 @@ const services: Array<BaseService> = [
   NetworkEndpointService,
   NetworkSiteStatusTimelineService,
   NetworkSiteLinkService,
+  NetworkDeviceLinkService,
+  NetworkDeviceLinkRuleService,
+  NetworkTopologySuppressionService,
   NetworkSiteAssignmentRuleService,
   PodmanHostService,
   ProxmoxClusterService,
@@ -498,8 +505,9 @@ const services: Array<BaseService> = [
   ServiceOwnerUserService,
 
   TelemetryExceptionService,
-  TelemetryEntityService,
-  TelemetryEntityRelationshipService,
+  InventoryItemService,
+  InventoryItemCustomFieldService,
+  InventoryItemRelationshipService,
 
   // scheduled maintenance templates
   ScheduledMaintenanceTemplateService,

package/Server/Services/InventoryItemCustomFieldService.ts

@@ -0,0 +1,9 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/InventoryItemCustomField";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+export default new Service();

package/Server/Services/{TelemetryEntityRelationshipService.ts → InventoryItemRelationshipService.ts}

@@ -1,5 +1,5 @@
 import DatabaseService from "./DatabaseService";
-import Model from "../../Models/DatabaseModels/TelemetryEntityRelationship";
+import Model from "../../Models/DatabaseModels/InventoryItemRelationship";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import logger from "../Utils/Logger";
@@ -9,7 +9,7 @@ import EntitySource from "../../Types/Telemetry/EntitySource";
 import { reconcileByNaturalKey } from "../Utils/Telemetry/EntityRegistry";
 import QueryDeepPartialEntity from "../../Types/Database/PartialEntity";
 
-export class TelemetryEntityRelationshipService extends DatabaseService<Model> {
+export class InventoryItemRelationshipService extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
@@ -32,7 +32,7 @@ export class TelemetryEntityRelationshipService extends DatabaseService<Model> {
         await this.upsertRelationship({ projectId: data.projectId, edge });
       } catch (err) {
         logger.error(
-          `TelemetryEntityRelationshipService: failed to upsert edge ${edge.fromEntityKey}-[${edge.relationshipType}]->${edge.toEntityKey}:`,
+          `InventoryItemRelationshipService: failed to upsert edge ${edge.fromEntityKey}-[${edge.relationshipType}]->${edge.toEntityKey}:`,
         );
         logger.error(err as Error);
       }
@@ -95,4 +95,4 @@ export class TelemetryEntityRelationshipService extends DatabaseService<Model> {
   }
 }
 
-export default new TelemetryEntityRelationshipService();
+export default new InventoryItemRelationshipService();

package/Server/Services/{TelemetryEntityService.ts → InventoryItemService.ts}

@@ -1,5 +1,5 @@
 import DatabaseService from "./DatabaseService";
-import Model from "../../Models/DatabaseModels/TelemetryEntity";
+import Model from "../../Models/DatabaseModels/InventoryItem";
 import Service from "../../Models/DatabaseModels/Service";
 import ServiceService from "./ServiceService";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -31,7 +31,7 @@ import {
   shouldWarnEntityBudgetOnce,
 } from "../Utils/Telemetry/EntityRegistry";
 
-export class TelemetryEntityService extends DatabaseService<Model> {
+export class InventoryItemService extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
@@ -161,7 +161,7 @@ export class TelemetryEntityService extends DatabaseService<Model> {
         });
       } catch (err) {
         logger.error(
-          `TelemetryEntityService: failed to upsert entity ${entity.entityType}/${entity.entityKey}:`,
+          `InventoryItemService: failed to upsert entity ${entity.entityType}/${entity.entityKey}:`,
         );
         logger.error(err as Error);
       }
@@ -184,7 +184,7 @@ export class TelemetryEntityService extends DatabaseService<Model> {
     if (data.entity.entityType !== EntityType.Service) {
       return null;
     }
-    const name: string = TelemetryEntityService.deriveDisplayName(data.entity);
+    const name: string = InventoryItemService.deriveDisplayName(data.entity);
     if (!name) {
       return null;
     }
@@ -206,7 +206,7 @@ export class TelemetryEntityService extends DatabaseService<Model> {
       return service?._id ? new ObjectID(service._id.toString()) : null;
     } catch (err) {
       logger.error(
-        `TelemetryEntityService: failed to resolve Service row for entity name "${name}":`,
+        `InventoryItemService: failed to resolve Service row for entity name "${name}":`,
       );
       logger.error(err as Error);
       return null;
@@ -234,10 +234,15 @@ export class TelemetryEntityService extends DatabaseService<Model> {
       lastSeenAt: now,
       describe: `entity ${entity.entityType}/${entity.entityKey}`,
       rowFenceId: `${projectId.toString()}:${entity.entityType}:${entity.entityKey}`,
-      select: { descriptiveAttributes: true, labels: true, resourceId: true },
+      select: {
+        displayName: true,
+        descriptiveAttributes: true,
+        labels: true,
+        resourceId: true,
+      },
       buildUpdate: (existing: Model): QueryDeepPartialEntity<Model> => {
         const update: QueryDeepPartialEntity<Model> =
-          TelemetryEntityService.buildDescriptiveUpdate(entity, existing);
+          InventoryItemService.buildDescriptiveUpdate(entity, existing);
         /*
          * Stamp / refresh the pointer on the throttled bump too, so
          * pre-existing rows converge and a deleted+recreated Service
@@ -295,7 +300,7 @@ export class TelemetryEntityService extends DatabaseService<Model> {
           })
         ) {
           logger.warn(
-            `TelemetryEntityService: entity budget reached for project ${projectId.toString()} type ${entity.entityType} (${count} >= ${budget}); skipping new registry rows. Membership keys still flow on signals.`,
+            `InventoryItemService: entity budget reached for project ${projectId.toString()} type ${entity.entityType} (${count} >= ${budget}); skipping new registry rows. Membership keys still flow on signals.`,
           );
         }
         return false;
@@ -319,10 +324,10 @@ export class TelemetryEntityService extends DatabaseService<Model> {
           model.descriptiveAttributes = entity.descriptiveAttributes;
         }
         if (entity.labels && entity.labels.length > 0) {
-          model.labels = TelemetryEntityService.normalizeLabels(entity.labels);
+          model.labels = InventoryItemService.normalizeLabels(entity.labels);
         }
         // varchar(ShortText) column; k8s names can run to 253 chars.
-        model.displayName = TelemetryEntityService.deriveDisplayName(
+        model.displayName = InventoryItemService.deriveDisplayName(
           entity,
         ).substring(0, ColumnLength.ShortText);
         if (serviceResourceId) {
@@ -337,11 +342,11 @@ export class TelemetryEntityService extends DatabaseService<Model> {
   }
 
   /**
-   * Extra fields for the `lastSeenAt` bump on an existing row:
-   * descriptive attributes merge last-writer-wins per key, labels merge
-   * as a set union. Both are written ONLY when the merge actually changes
-   * the stored value, so a stable resource keeps its bump a one-column
-   * update (no jsonb churn).
+   * Extra fields for the `lastSeenAt` bump on an existing row: a legacy
+   * generated Kubernetes fallback display name can converge to the resource
+   * name, descriptive attributes merge last-writer-wins per key, and labels
+   * merge as a set union. Each is written ONLY when it actually changes, so a
+   * stable resource keeps its bump a one-column update (no text/jsonb churn).
    */
   private static buildDescriptiveUpdate(
     entity: ExtractedEntity,
@@ -353,10 +358,45 @@ export class TelemetryEntityService extends DatabaseService<Model> {
      * recursive JSONObject mapping (TS2589).
      */
     const update: {
+      displayName?: string;
       descriptiveAttributes?: JSONObject;
       labels?: Array<string>;
     } = {};
 
+    const preferredNameKey: string | undefined =
+      InventoryItemService.preferredDisplayNameAttributeByType[
+        entity.entityType
+      ];
+    /*
+     * Existing inventory display names may be user-edited. Only migrate a
+     * pod/node row when its current value is exactly the value the old generic
+     * algorithm generated. A sparse observation cannot erase a learned name,
+     * and an unrelated entity type never has its display name reconciled here.
+     */
+    const preferredName: string | undefined = preferredNameKey
+      ? entity.descriptiveAttributes?.[preferredNameKey] ||
+        entity.identifyingAttributes?.[preferredNameKey]
+      : undefined;
+    if (preferredName) {
+      const desiredDisplayName: string = preferredName.substring(
+        0,
+        ColumnLength.ShortText,
+      );
+      const legacyDisplayName: string =
+        InventoryItemService.deriveFallbackDisplayName(entity).substring(
+          0,
+          ColumnLength.ShortText,
+        );
+      const existingDisplayName: string = existing.displayName || "";
+
+      if (
+        existingDisplayName !== desiredDisplayName &&
+        (!existingDisplayName || existingDisplayName === legacyDisplayName)
+      ) {
+        update.displayName = desiredDisplayName;
+      }
+    }
+
     const incoming: Record<string, string> = entity.descriptiveAttributes || {};
     if (Object.keys(incoming).length > 0) {
       const current: Record<string, unknown> =
@@ -384,7 +424,7 @@ export class TelemetryEntityService extends DatabaseService<Model> {
       });
 
       if (hasNew) {
-        update.labels = TelemetryEntityService.normalizeLabels([
+        update.labels = InventoryItemService.normalizeLabels([
           ...currentLabels,
           ...incomingLabels,
         ]);
@@ -399,13 +439,42 @@ export class TelemetryEntityService extends DatabaseService<Model> {
     return Array.from(new Set<string>(labels)).sort();
   }
 
+  private static readonly preferredDisplayNameAttributeByType: Partial<
+    Record<EntityType, string>
+  > = {
+    [EntityType.KubernetesNode]: "k8s.node.name",
+    [EntityType.KubernetesPod]: "k8s.pod.name",
+  };
+
   /**
-   * Best-effort human-readable name for the entity explorer: prefer the
-   * most specific `*.name` identifying attribute (e.g. k8s.pod.name over
-   * k8s.cluster.name), else the last identifying value, else the key.
+   * Best-effort human-readable name for Inventory. Prefer the name belonging
+   * to this exact entity type, including a descriptive name paired with a
+   * stable UID identity (the normal Kubernetes pod/node shape). Falling back
+   * to the longest identifying `*.name` preserves the behaviour for types
+   * without a dedicated display-name rule.
    */
   public static deriveDisplayName(entity: ExtractedEntity): string {
     const id: Record<string, string> = entity.identifyingAttributes || {};
+    const descriptive: Record<string, string> =
+      entity.descriptiveAttributes || {};
+    const preferredKey: string | undefined =
+      this.preferredDisplayNameAttributeByType[entity.entityType];
+
+    if (preferredKey) {
+      const preferredValue: string | undefined =
+        descriptive[preferredKey] || id[preferredKey];
+      if (preferredValue) {
+        return preferredValue;
+      }
+    }
+
+    return this.deriveFallbackDisplayName(entity);
+  }
+
+  /** The generic display-name algorithm used before type-aware K8s names. */
+  private static deriveFallbackDisplayName(entity: ExtractedEntity): string {
+    const id: Record<string, string> = entity.identifyingAttributes || {};
+
     const nameKeys: Array<string> = Object.keys(id)
       .filter((k: string) => {
         return k.endsWith(".name");
@@ -427,4 +496,4 @@ export class TelemetryEntityService extends DatabaseService<Model> {
   }
 }
 
-export default new TelemetryEntityService();
+export default new InventoryItemService();