@oneuptime/common 13.0.0 → 13.0.3

package/Server/Services/NetworkDeviceAutoImportRuleService.ts

@@ -1,6 +1,7 @@
 import DatabaseService from "./DatabaseService";
 import MonitorTemplateService from "./MonitorTemplateService";
 import NetworkAlertPolicyService from "./NetworkAlertPolicyService";
+import NetworkDeviceAutoImportRuleEngineService from "./NetworkDeviceAutoImportRuleEngineService";
 import NetworkDeviceOidTemplateService from "./NetworkDeviceOidTemplateService";
 import Model from "../../Models/DatabaseModels/NetworkDeviceAutoImportRule";
 import Monitor from "../../Models/DatabaseModels/Monitor";
@@ -22,6 +23,16 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import TablePermission from "../Types/Database/Permissions/TablePermission";
 import NetworkDeviceMonitorTemplateUtil from "../../Utils/Monitor/NetworkDeviceMonitorTemplateUtil";
+import QueryHelper from "../Types/Database/QueryHelper";
+import logger, { LogAttributes } from "../Utils/Logger";
+import {
+  getRuleCriteriaValidationError,
+  isValidRuleCriteria,
+} from "../../Utils/Rules/RuleCriteriaMatcher";
+import RuleCriteria, {
+  RuleCriteriaFilter,
+  RuleCriteriaOperator,
+} from "../../Types/Rules/RuleCriteria";
 
 /*
  * Write-time validation for auto-import rules, following the
@@ -60,6 +71,20 @@ function readOidTemplateId(data: Record<string, unknown>): ObjectID | null {
   );
 }
 
+/*
+ * What onUpdateSuccess needs to know about an update it did not see the
+ * payload of: did this save change anything about WHICH hosts the rule
+ * claims, or what it does with them?
+ *
+ * Only the answer travels — not the rule's resulting state, which is read
+ * back from the row instead. A payload's `isEnabled` may arrive as the string
+ * "false" from a form post, and a rule mis-read as enabled would re-arm the
+ * project's scans on the very save that switched the rule off.
+ */
+interface AutoImportRuleUpdatePlan {
+  isRuleReachChanged: boolean;
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -70,6 +95,7 @@ export class Service extends DatabaseService<Model> {
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
     this.validateCriteria({
+      criteria: createBy.data.criteria,
       ipMatchTarget: createBy.data.ipMatchTarget,
       sysNamePattern: createBy.data.sysNamePattern,
       sysDescrPattern: createBy.data.sysDescrPattern,
@@ -114,7 +140,8 @@ export class Service extends DatabaseService<Model> {
       dataKeys.includes("ipMatchTarget") ||
       dataKeys.includes("sysNamePattern") ||
       dataKeys.includes("sysDescrPattern") ||
-      dataKeys.includes("sysObjectIdPattern");
+      dataKeys.includes("sysObjectIdPattern") ||
+      dataKeys.includes("criteria");
 
     /*
      * `includePingOnlyHosts` is deliberately not here. A ping-only host
@@ -133,6 +160,28 @@ export class Service extends DatabaseService<Model> {
       OID_TEMPLATE_KEYS,
     );
 
+    /*
+     * Everything that can change what this rule imports, or what it creates
+     * for what it imports — the trigger for re-arming the project's recent
+     * scan results in onUpdateSuccess.
+     *
+     * `includePingOnlyHosts` is here even though it is not a "criteria
+     * change" above: it decides whether a whole class of discovered host is
+     * claimed, which is precisely reach. A rename or a description edit is
+     * not, and must not cost the project a sweep.
+     *
+     * The OID template is deliberately absent: it is copied onto devices as
+     * they are created and is not reconciled onto devices that already
+     * exist, so pointing a rule at a different one changes nothing about
+     * results already evaluated.
+     */
+    const plan: AutoImportRuleUpdatePlan = {
+      isRuleReachChanged:
+        isCriteriaChange ||
+        isMonitorProvisioningChange ||
+        dataKeys.includes("includePingOnlyHosts"),
+    };
+
     /*
      * Validated before the early return and independently of the rest: an OID
      * Collection Template is the collect half of the rule, so pointing at one
@@ -154,7 +203,7 @@ export class Service extends DatabaseService<Model> {
     }
 
     if (!isCriteriaChange && !isMonitorProvisioningChange) {
-      return { updateBy, carryForward: null };
+      return { updateBy, carryForward: plan };
     }
 
     /*
@@ -174,6 +223,7 @@ export class Service extends DatabaseService<Model> {
       select: {
         _id: true,
         projectId: true,
+        criteria: true,
         ipMatchTarget: true,
         sysNamePattern: true,
         sysDescrPattern: true,
@@ -203,6 +253,9 @@ export class Service extends DatabaseService<Model> {
     for (const existingRule of existingRules) {
       if (isCriteriaChange) {
         this.validateCriteria({
+          criteria: dataKeys.includes("criteria")
+            ? (data["criteria"] as RuleCriteria | null | undefined)
+            : existingRule.criteria,
           ipMatchTarget: dataKeys.includes("ipMatchTarget")
             ? (data["ipMatchTarget"] as string | null)
             : existingRule.ipMatchTarget,
@@ -253,7 +306,142 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
-    return { updateBy, carryForward: null };
+    return { updateBy, carryForward: plan };
+  }
+
+  /*
+   * A rule that can import must not have to wait for the next scan to prove
+   * it — see rearmRecentScansForRuleChange on the engine, and issue #3487.
+   *
+   * The sweep only ever looks at results nothing has evaluated yet, so
+   * without this a rule written after a scan finished reaches nothing at all
+   * until that scan runs again — never, for the one-shot scans most projects
+   * start with — and the operator is left pressing "Run Now" by hand for
+   * work the product describes as automatic.
+   */
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    this.rearmRecentScansForRules([
+      /*
+       * projectId off the saved row, falling back to the tenant the write
+       * ran under: a create that named the project through the relation
+       * alone still has to reach the right scans.
+       */
+      {
+        projectId: createdItem.projectId || onCreate.createBy.props.tenantId,
+        isEnabled: createdItem.isEnabled,
+        isExclusion: createdItem.isExclusion,
+      },
+    ]);
+
+    return createdItem;
+  }
+
+  /*
+   * The same re-arm for an EDIT that changes what the rule claims: enabling a
+   * rule, widening its criteria, or attaching a monitor template to it all
+   * make the project's recent results answer differently than they did when
+   * the sweep last read them.
+   */
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    const plan: AutoImportRuleUpdatePlan | null =
+      (onUpdate.carryForward as AutoImportRuleUpdatePlan | null) || null;
+
+    if (!plan?.isRuleReachChanged || updatedItemIds.length === 0) {
+      return onUpdate;
+    }
+
+    /*
+     * The rules as they stand now that the update has landed, read back
+     * rather than predicted from the payload — one update payload is shared
+     * by every row its query matched, and the toggles that decide whether a
+     * re-arm is worth anything arrive from a form as strings. See
+     * AutoImportRuleUpdatePlan.
+     */
+    const updatedRules: Array<Model> = await this.findBy({
+      query: {
+        _id: QueryHelper.any(updatedItemIds),
+      },
+      select: {
+        _id: true,
+        projectId: true,
+        isEnabled: true,
+        isExclusion: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    this.rearmRecentScansForRules(updatedRules);
+
+    return onUpdate;
+  }
+
+  /*
+   * Hand every affected project's recent scan results back to the auto-import
+   * sweep, once per project however many of its rules one write touched.
+   *
+   * Detached on purpose, in the shape NetworkDeviceService.onCreateSuccess
+   * uses for its own rule chain: the caller is a rule save, the operator is
+   * waiting on its response, and this is a query plus up to a hundred small
+   * writes. It must also never fail that save — a re-arm that could not run
+   * costs a delay until the next scan result (or one press of Run Now),
+   * which is not worth failing an otherwise valid edit over.
+   */
+  private rearmRecentScansForRules(
+    rules: Array<{
+      projectId?: ObjectID | undefined;
+      isEnabled?: boolean | undefined;
+      isExclusion?: boolean | undefined;
+    }>,
+  ): void {
+    const projectIds: Map<string, ObjectID> = new Map<string, ObjectID>();
+
+    for (const rule of rules) {
+      /*
+       * A disabled rule imports nothing, and an exclusion rule only vetoes
+       * what other rules claim — neither can newly take a host, so neither
+       * is worth a sweep of the project's results. isEnabled is checked
+       * against `false` rather than for truth because the column defaults to
+       * true: a create that never mentioned it is enabled.
+       *
+       * The mirror case — an exclusion rule switched off or deleted, which
+       * lifts a veto and so widens what the OTHER rules claim — is left to
+       * the next scan result or to Run Now. Re-arming needs a write that says
+       * "this now claims hosts", and lifting a veto says it only about rules
+       * this write never mentioned.
+       */
+      if (rule.isEnabled === false || rule.isExclusion) {
+        continue;
+      }
+
+      if (!rule.projectId) {
+        continue;
+      }
+
+      projectIds.set(rule.projectId.toString(), rule.projectId);
+    }
+
+    for (const projectId of projectIds.values()) {
+      NetworkDeviceAutoImportRuleEngineService.rearmRecentScansForRuleChange({
+        projectId: projectId,
+      }).catch((error: Error) => {
+        logger.error(
+          `Error re-arming discovery scan results after an auto-import rule was written: ${error}`,
+          { projectId: projectId.toString() } as LogAttributes,
+        );
+      });
+    }
   }
 
   /*
@@ -428,11 +616,64 @@ export class Service extends DatabaseService<Model> {
   }
 
   private validateCriteria(data: {
+    criteria?: RuleCriteria | null | undefined;
     ipMatchTarget?: string | null | undefined;
     sysNamePattern?: string | null | undefined;
     sysDescrPattern?: string | null | undefined;
     sysObjectIdPattern?: string | null | undefined;
   }): void {
+    if (data.criteria !== undefined && data.criteria !== null) {
+      const validationError: string | null = getRuleCriteriaValidationError(
+        data.criteria,
+      );
+
+      if (validationError) {
+        throw new BadDataException(validationError);
+      }
+
+      if (!isValidRuleCriteria(data.criteria)) {
+        throw new BadDataException("Rule criteria is invalid.");
+      }
+
+      if (data.criteria.filters.length === 0) {
+        throw new BadDataException(
+          "At least one auto-import match condition is required.",
+        );
+      }
+
+      const supportedFields: Set<string> = new Set([
+        "ipMatchTarget",
+        "sysNamePattern",
+        "sysDescrPattern",
+        "sysObjectIdPattern",
+      ]);
+
+      for (const filter of data.criteria.filters) {
+        if (!supportedFields.has(filter.field)) {
+          throw new BadDataException(
+            `Unsupported auto-import match condition: ${filter.field}`,
+          );
+        }
+
+        if (Array.isArray(filter.value)) {
+          throw new BadDataException(
+            `${filter.field} requires a text comparison operator.`,
+          );
+        }
+
+        if (
+          filter.operator !== RuleCriteriaOperator.MatchesPattern &&
+          filter.operator !== RuleCriteriaOperator.DoesNotMatchPattern
+        ) {
+          continue;
+        }
+
+        this.validateConfiguredPattern(filter);
+      }
+
+      return;
+    }
+
     const ipMatchTarget: string = (data.ipMatchTarget || "").trim();
     const sysNamePattern: string = (data.sysNamePattern || "").trim();
     const sysDescrPattern: string = (data.sysDescrPattern || "").trim();
@@ -470,6 +711,31 @@ export class Service extends DatabaseService<Model> {
     this.validateOidPattern(sysObjectIdPattern);
   }
 
+  private validateConfiguredPattern(filter: RuleCriteriaFilter): void {
+    const pattern: string = String(filter.value).trim();
+
+    if (filter.field === "ipMatchTarget") {
+      if (!ScanTargetUtil.isValid(pattern)) {
+        throw new BadDataException(
+          `"${pattern}" is not a valid Host IP condition. ${ScanTargetUtil.getSyntaxHint()}`,
+        );
+      }
+      return;
+    }
+
+    if (filter.field === "sysObjectIdPattern") {
+      this.validateOidPattern(pattern);
+      return;
+    }
+
+    this.validatePattern(
+      filter.field === "sysNamePattern"
+        ? "System Name Pattern"
+        : "System Description Pattern",
+      pattern,
+    );
+  }
+
   private validatePattern(title: string, pattern: string): void {
     if (!pattern || RulePatternMatchUtil.isSupportedPattern(pattern)) {
       return;

package/Server/Services/NetworkDeviceLabelRuleEngineService.ts

@@ -11,6 +11,7 @@ import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 /*
@@ -62,6 +63,7 @@ class NetworkDeviceLabelRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             networkDeviceLabels: { _id: true },
             networkDeviceNamePattern: true,
             networkDeviceDescriptionPattern: true,
@@ -194,6 +196,7 @@ class NetworkDeviceLabelRuleEngineServiceClass {
         select: {
           _id: true,
           name: true,
+          criteria: true,
           isEnabled: true,
           networkDeviceLabels: { _id: true },
           networkDeviceNamePattern: true,
@@ -384,6 +387,29 @@ class NetworkDeviceLabelRuleEngineServiceClass {
   private doesNetworkDeviceMatchRule(
     networkDevice: NetworkDevice,
     rule: NetworkDeviceLabelRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "networkDeviceLabels",
+        "networkDeviceNamePattern",
+        "networkDeviceDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (
+        networkDeviceRule: NetworkDeviceLabelRule,
+      ): boolean => {
+        return this.doesNetworkDeviceMatchRuleLegacy(
+          networkDevice,
+          networkDeviceRule,
+        );
+      },
+    });
+  }
+
+  private doesNetworkDeviceMatchRuleLegacy(
+    networkDevice: NetworkDevice,
+    rule: NetworkDeviceLabelRule,
   ): boolean {
     if (rule.networkDeviceLabels && rule.networkDeviceLabels.length > 0) {
       if (!networkDevice.labels || networkDevice.labels.length === 0) {

package/Server/Services/NetworkDeviceOwnerRuleEngineService.ts

@@ -12,6 +12,7 @@ import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class NetworkDeviceOwnerRuleEngineServiceClass {
@@ -40,6 +41,7 @@ class NetworkDeviceOwnerRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             notifyOwners: true,
             networkDeviceLabels: { _id: true },
             networkDeviceNamePattern: true,
@@ -162,6 +164,29 @@ class NetworkDeviceOwnerRuleEngineServiceClass {
   private doesNetworkDeviceMatchRule(
     networkDevice: NetworkDevice,
     rule: NetworkDeviceOwnerRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "networkDeviceLabels",
+        "networkDeviceNamePattern",
+        "networkDeviceDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (
+        networkDeviceRule: NetworkDeviceOwnerRule,
+      ): boolean => {
+        return this.doesNetworkDeviceMatchRuleLegacy(
+          networkDevice,
+          networkDeviceRule,
+        );
+      },
+    });
+  }
+
+  private doesNetworkDeviceMatchRuleLegacy(
+    networkDevice: NetworkDevice,
+    rule: NetworkDeviceOwnerRule,
   ): boolean {
     if (rule.networkDeviceLabels && rule.networkDeviceLabels.length > 0) {
       if (!networkDevice.labels || networkDevice.labels.length === 0) {

package/Server/Services/NetworkDeviceService.ts

@@ -2725,6 +2725,7 @@ export class Service extends DatabaseService<Model> {
           siteId: true,
           subnetCidr: true,
           hostnamePattern: true,
+          criteria: true,
           priority: true,
           createdAt: true,
         },
@@ -2825,6 +2826,7 @@ export class Service extends DatabaseService<Model> {
           siteId: true,
           subnetCidr: true,
           hostnamePattern: true,
+          criteria: true,
           priority: true,
           createdAt: true,
         },

package/Server/Services/NetworkSiteAssignmentRuleService.ts

@@ -9,7 +9,12 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
+import RuleCriteria, {
+  RuleCriteriaFilter,
+  RuleCriteriaOperator,
+} from "../../Types/Rules/RuleCriteria";
 import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
+import { getRuleCriteriaValidationError } from "../../Utils/Rules/RuleCriteriaMatcher";
 import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 
 /*
@@ -18,6 +23,17 @@ import RelationIdUtil from "../Utils/Database/RelationIdUtil";
  */
 const SITE_KEYS: Array<string> = ["siteId", "site"];
 
+const HOSTNAME_OPERATORS: ReadonlySet<RuleCriteriaOperator> = new Set([
+  RuleCriteriaOperator.Equals,
+  RuleCriteriaOperator.NotEquals,
+  RuleCriteriaOperator.Contains,
+  RuleCriteriaOperator.DoesNotContain,
+  RuleCriteriaOperator.StartsWith,
+  RuleCriteriaOperator.EndsWith,
+  RuleCriteriaOperator.MatchesPattern,
+  RuleCriteriaOperator.DoesNotMatchPattern,
+]);
+
 function readSiteId(data: Record<string, unknown>): ObjectID | null {
   return RelationIdUtil.read(data, SITE_KEYS);
 }
@@ -77,6 +93,7 @@ export class Service extends DatabaseService<Model> {
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
     this.validateCriteria({
+      criteria: createBy.data.criteria,
       subnetCidr: createBy.data.subnetCidr,
       hostnamePattern: createBy.data.hostnamePattern,
     });
@@ -102,7 +119,9 @@ export class Service extends DatabaseService<Model> {
     const dataKeys: Array<string> = Object.keys(updateBy.data || {});
 
     const isCriteriaChange: boolean =
-      dataKeys.includes("subnetCidr") || dataKeys.includes("hostnamePattern");
+      dataKeys.includes("criteria") ||
+      dataKeys.includes("subnetCidr") ||
+      dataKeys.includes("hostnamePattern");
 
     const newSiteId: ObjectID | null = readSiteId(
       updateBy.data as unknown as Record<string, unknown>,
@@ -123,6 +142,7 @@ export class Service extends DatabaseService<Model> {
         projectId: true,
         subnetCidr: true,
         hostnamePattern: true,
+        criteria: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -134,6 +154,9 @@ export class Service extends DatabaseService<Model> {
     for (const existingRule of existingRules) {
       if (isCriteriaChange) {
         this.validateCriteria({
+          criteria: dataKeys.includes("criteria")
+            ? (updateBy.data as { criteria?: unknown }).criteria
+            : existingRule.criteria,
           subnetCidr: dataKeys.includes("subnetCidr")
             ? ((updateBy.data as any)["subnetCidr"] as string | null)
             : existingRule.subnetCidr,
@@ -155,9 +178,34 @@ export class Service extends DatabaseService<Model> {
   }
 
   private validateCriteria(data: {
+    criteria?: unknown;
     subnetCidr?: string | null | undefined;
     hostnamePattern?: string | null | undefined;
   }): void {
+    if (data.criteria !== undefined && data.criteria !== null) {
+      const validationError: string | null = getRuleCriteriaValidationError(
+        data.criteria,
+      );
+
+      if (validationError) {
+        throw new BadDataException(validationError);
+      }
+
+      const criteria: RuleCriteria = data.criteria as RuleCriteria;
+
+      if (criteria.filters.length === 0) {
+        throw new BadDataException(
+          "At least one network site assignment condition is required.",
+        );
+      }
+
+      for (const filter of criteria.filters) {
+        this.validateConfiguredFilter(filter);
+      }
+
+      return;
+    }
+
     const subnetCidr: string = (data.subnetCidr || "").trim();
     const hostnamePattern: string = (data.hostnamePattern || "").trim();
 
@@ -173,6 +221,47 @@ export class Service extends DatabaseService<Model> {
       );
     }
   }
+
+  private validateConfiguredFilter(filter: RuleCriteriaFilter): void {
+    const value: string = String(filter.value).trim();
+
+    if (filter.field === "subnetCidr") {
+      if (
+        filter.operator !== RuleCriteriaOperator.MatchesPattern &&
+        filter.operator !== RuleCriteriaOperator.DoesNotMatchPattern
+      ) {
+        throw new BadDataException(
+          "Subnet CIDR conditions must use a CIDR match operator.",
+        );
+      }
+
+      if (!CidrMatchUtil.isValidCidr(value)) {
+        throw new BadDataException(
+          `${value} is not a valid IPv4 CIDR (expected e.g. 10.0.0.0/24).`,
+        );
+      }
+
+      return;
+    }
+
+    if (filter.field !== "hostnamePattern") {
+      throw new BadDataException(
+        `${filter.field} is not a supported network site assignment condition.`,
+      );
+    }
+
+    if (!HOSTNAME_OPERATORS.has(filter.operator)) {
+      throw new BadDataException(
+        `${filter.operator} is not supported for Hostname Pattern.`,
+      );
+    }
+
+    if (value.length > CidrMatchUtil.MAX_HOSTNAME_PATTERN_LENGTH) {
+      throw new BadDataException(
+        `Hostname Pattern cannot exceed ${CidrMatchUtil.MAX_HOSTNAME_PATTERN_LENGTH} characters.`,
+      );
+    }
+  }
 }
 
 export default new Service();