@oneuptime/common 13.0.1 → 13.0.3

package/build/dist/Server/Services/NetworkSiteAssignmentRuleService.js

@@ -13,13 +13,25 @@ import Model from "../../Models/DatabaseModels/NetworkSiteAssignmentRule";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
+import { RuleCriteriaOperator, } from "../../Types/Rules/RuleCriteria";
 import CidrMatchUtil from "../../Utils/NetworkSite/CidrMatchUtil";
+import { getRuleCriteriaValidationError } from "../../Utils/Rules/RuleCriteriaMatcher";
 import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 /*
  * The dashboard posts the `site` relation while server-side callers write the
  * `siteId` column; read whichever is present. See RelationIdUtil.
  */
 const SITE_KEYS = ["siteId", "site"];
+const HOSTNAME_OPERATORS = new Set([
+    RuleCriteriaOperator.Equals,
+    RuleCriteriaOperator.NotEquals,
+    RuleCriteriaOperator.Contains,
+    RuleCriteriaOperator.DoesNotContain,
+    RuleCriteriaOperator.StartsWith,
+    RuleCriteriaOperator.EndsWith,
+    RuleCriteriaOperator.MatchesPattern,
+    RuleCriteriaOperator.DoesNotMatchPattern,
+]);
 function readSiteId(data) {
     return RelationIdUtil.read(data, SITE_KEYS);
 }
@@ -63,6 +75,7 @@ export class Service extends DatabaseService {
      */
     async onBeforeCreate(createBy) {
         this.validateCriteria({
+            criteria: createBy.data.criteria,
             subnetCidr: createBy.data.subnetCidr,
             hostnamePattern: createBy.data.hostnamePattern,
         });
@@ -77,7 +90,9 @@ export class Service extends DatabaseService {
     }
     async onBeforeUpdate(updateBy) {
         const dataKeys = Object.keys(updateBy.data || {});
-        const isCriteriaChange = dataKeys.includes("subnetCidr") || dataKeys.includes("hostnamePattern");
+        const isCriteriaChange = dataKeys.includes("criteria") ||
+            dataKeys.includes("subnetCidr") ||
+            dataKeys.includes("hostnamePattern");
         const newSiteId = readSiteId(updateBy.data);
         if (!isCriteriaChange && !newSiteId) {
             return { updateBy, carryForward: null };
@@ -93,6 +108,7 @@ export class Service extends DatabaseService {
                 projectId: true,
                 subnetCidr: true,
                 hostnamePattern: true,
+                criteria: true,
             },
             limit: LIMIT_MAX,
             skip: 0,
@@ -103,6 +119,9 @@ export class Service extends DatabaseService {
         for (const existingRule of existingRules) {
             if (isCriteriaChange) {
                 this.validateCriteria({
+                    criteria: dataKeys.includes("criteria")
+                        ? updateBy.data.criteria
+                        : existingRule.criteria,
                     subnetCidr: dataKeys.includes("subnetCidr")
                         ? updateBy.data["subnetCidr"]
                         : existingRule.subnetCidr,
@@ -121,6 +140,20 @@ export class Service extends DatabaseService {
         return { updateBy, carryForward: null };
     }
     validateCriteria(data) {
+        if (data.criteria !== undefined && data.criteria !== null) {
+            const validationError = getRuleCriteriaValidationError(data.criteria);
+            if (validationError) {
+                throw new BadDataException(validationError);
+            }
+            const criteria = data.criteria;
+            if (criteria.filters.length === 0) {
+                throw new BadDataException("At least one network site assignment condition is required.");
+            }
+            for (const filter of criteria.filters) {
+                this.validateConfiguredFilter(filter);
+            }
+            return;
+        }
         const subnetCidr = (data.subnetCidr || "").trim();
         const hostnamePattern = (data.hostnamePattern || "").trim();
         if (!subnetCidr && !hostnamePattern) {
@@ -130,6 +163,28 @@ export class Service extends DatabaseService {
             throw new BadDataException(`${subnetCidr} is not a valid IPv4 CIDR (expected e.g. 10.0.0.0/24).`);
         }
     }
+    validateConfiguredFilter(filter) {
+        const value = String(filter.value).trim();
+        if (filter.field === "subnetCidr") {
+            if (filter.operator !== RuleCriteriaOperator.MatchesPattern &&
+                filter.operator !== RuleCriteriaOperator.DoesNotMatchPattern) {
+                throw new BadDataException("Subnet CIDR conditions must use a CIDR match operator.");
+            }
+            if (!CidrMatchUtil.isValidCidr(value)) {
+                throw new BadDataException(`${value} is not a valid IPv4 CIDR (expected e.g. 10.0.0.0/24).`);
+            }
+            return;
+        }
+        if (filter.field !== "hostnamePattern") {
+            throw new BadDataException(`${filter.field} is not a supported network site assignment condition.`);
+        }
+        if (!HOSTNAME_OPERATORS.has(filter.operator)) {
+            throw new BadDataException(`${filter.operator} is not supported for Hostname Pattern.`);
+        }
+        if (value.length > CidrMatchUtil.MAX_HOSTNAME_PATTERN_LENGTH) {
+            throw new BadDataException(`Hostname Pattern cannot exceed ${CidrMatchUtil.MAX_HOSTNAME_PATTERN_LENGTH} characters.`);
+        }
+    }
 }
 __decorate([
     CaptureSpan(),

package/build/dist/Server/Services/NetworkSiteAssignmentRuleService.js.map

@@ -1 +1 @@
-{"version":3,"file":"NetworkSiteAssignmentRuleService.js","sourceRoot":"","sources":["../../../../Server/Services/NetworkSiteAssignmentRuleService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,kBAAkB,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,MAAM,uDAAuD,CAAC;AAK1E,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAO,aAAa,MAAM,uCAAuC,CAAC;AAClE,OAAO,cAAc,MAAM,kCAAkC,CAAC;AAE9D;;;GAGG;AACH,MAAM,SAAS,GAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAEpD,SAAS,UAAU,CAAC,IAA6B;IAC/C,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,0BAA0B,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAuB,MAAM,kBAAkB,CAAC,WAAW,CAAC;YACpE,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;aAChB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,IACE,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EACvD,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IAEsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,gBAAgB,CAAC;YACpB,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;YACpC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe;SAC/C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAoB,UAAU,CACxC,QAAQ,CAAC,IAA0C,CACpD,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,0BAA0B,CAAC;gBACpC,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,QAAQ,GAAkB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEjE,MAAM,gBAAgB,GACpB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAE1E,MAAM,SAAS,GAAoB,UAAU,CAC3C,QAAQ,CAAC,IAA0C,CACpD,CAAC;QAEF,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAED;;;WAGG;QACH,MAAM,aAAa,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YACpD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,IAAI;aACtB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC,gBAAgB,CAAC;oBACpB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;wBACzC,CAAC,CAAG,QAAQ,CAAC,IAAY,CAAC,YAAY,CAAmB;wBACzD,CAAC,CAAC,YAAY,CAAC,UAAU;oBAC3B,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;wBACnD,CAAC,CAAG,QAAQ,CAAC,IAAY,CAAC,iBAAiB,CAAmB;wBAC9D,CAAC,CAAC,YAAY,CAAC,eAAe;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,0BAA0B,CAAC;oBACpC,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,YAAY,CAAC,SAAS;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAEO,gBAAgB,CAAC,IAGxB;QACC,MAAM,UAAU,GAAW,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,eAAe,GAAW,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEpE,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,gBAAgB,CACxB,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,gBAAgB,CACxB,GAAG,UAAU,wDAAwD,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AApG0B;IADxB,WAAW,EAAE;;;;6CAqBb;AAGwB;IADxB,WAAW,EAAE;;;;6CAyDb;AAuBH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"NetworkSiteAssignmentRuleService.js","sourceRoot":"","sources":["../../../../Server/Services/NetworkSiteAssignmentRuleService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,kBAAkB,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,MAAM,uDAAuD,CAAC;AAK1E,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,OAAqB,EAEnB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,aAAa,MAAM,uCAAuC,CAAC;AAClE,OAAO,EAAE,8BAA8B,EAAE,MAAM,uCAAuC,CAAC;AACvF,OAAO,cAAc,MAAM,kCAAkC,CAAC;AAE9D;;;GAGG;AACH,MAAM,SAAS,GAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAEpD,MAAM,kBAAkB,GAAsC,IAAI,GAAG,CAAC;IACpE,oBAAoB,CAAC,MAAM;IAC3B,oBAAoB,CAAC,SAAS;IAC9B,oBAAoB,CAAC,QAAQ;IAC7B,oBAAoB,CAAC,cAAc;IACnC,oBAAoB,CAAC,UAAU;IAC/B,oBAAoB,CAAC,QAAQ;IAC7B,oBAAoB,CAAC,cAAc;IACnC,oBAAoB,CAAC,mBAAmB;CACzC,CAAC,CAAC;AAEH,SAAS,UAAU,CAAC,IAA6B;IAC/C,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,0BAA0B,CAAC,IAGxC;QACC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAuB,MAAM,kBAAkB,CAAC,WAAW,CAAC;YACpE,EAAE,EAAE,IAAI,CAAC,MAAM;YACf,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;aAChB;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,IACE,IAAI,CAAC,SAAS;YACd,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,EACvD,CAAC;YACD,MAAM,IAAI,gBAAgB,CACxB,+CAA+C,CAChD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;OAGG;IAEsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,gBAAgB,CAAC;YACpB,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ;YAChC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;YACpC,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe;SAC/C,CAAC,CAAC;QAEH,MAAM,MAAM,GAAoB,UAAU,CACxC,QAAQ,CAAC,IAA0C,CACpD,CAAC;QAEF,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,0BAA0B,CAAC;gBACpC,MAAM,EAAE,MAAM;gBACd,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,SAAS;aACnC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,QAAQ,GAAkB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAEjE,MAAM,gBAAgB,GACpB,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;YAC7B,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC/B,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;QAEvC,MAAM,SAAS,GAAoB,UAAU,CAC3C,QAAQ,CAAC,IAA0C,CACpD,CAAC;QAEF,IAAI,CAAC,gBAAgB,IAAI,CAAC,SAAS,EAAE,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAED;;;WAGG;QACH,MAAM,aAAa,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YACpD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,eAAe,EAAE,IAAI;gBACrB,QAAQ,EAAE,IAAI;aACf;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YACzC,IAAI,gBAAgB,EAAE,CAAC;gBACrB,IAAI,CAAC,gBAAgB,CAAC;oBACpB,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC;wBACrC,CAAC,CAAE,QAAQ,CAAC,IAA+B,CAAC,QAAQ;wBACpD,CAAC,CAAC,YAAY,CAAC,QAAQ;oBACzB,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;wBACzC,CAAC,CAAG,QAAQ,CAAC,IAAY,CAAC,YAAY,CAAmB;wBACzD,CAAC,CAAC,YAAY,CAAC,UAAU;oBAC3B,eAAe,EAAE,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;wBACnD,CAAC,CAAG,QAAQ,CAAC,IAAY,CAAC,iBAAiB,CAAmB;wBAC9D,CAAC,CAAC,YAAY,CAAC,eAAe;iBACjC,CAAC,CAAC;YACL,CAAC;YAED,IAAI,SAAS,EAAE,CAAC;gBACd,MAAM,IAAI,CAAC,0BAA0B,CAAC;oBACpC,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,YAAY,CAAC,SAAS;iBAClC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAEO,gBAAgB,CAAC,IAIxB;QACC,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,eAAe,GAAkB,8BAA8B,CACnE,IAAI,CAAC,QAAQ,CACd,CAAC;YAEF,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,gBAAgB,CAAC,eAAe,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,QAAQ,GAAiB,IAAI,CAAC,QAAwB,CAAC;YAE7D,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,gBAAgB,CACxB,6DAA6D,CAC9D,CAAC;YACJ,CAAC;YAED,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;gBACtC,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACxC,CAAC;YAED,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GAAW,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,eAAe,GAAW,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAEpE,IAAI,CAAC,UAAU,IAAI,CAAC,eAAe,EAAE,CAAC;YACpC,MAAM,IAAI,gBAAgB,CACxB,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,IAAI,UAAU,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,gBAAgB,CACxB,GAAG,UAAU,wDAAwD,CACtE,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,wBAAwB,CAAC,MAA0B;QACzD,MAAM,KAAK,GAAW,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAElD,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClC,IACE,MAAM,CAAC,QAAQ,KAAK,oBAAoB,CAAC,cAAc;gBACvD,MAAM,CAAC,QAAQ,KAAK,oBAAoB,CAAC,mBAAmB,EAC5D,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,wDAAwD,CACzD,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,MAAM,IAAI,gBAAgB,CACxB,GAAG,KAAK,wDAAwD,CACjE,CAAC;YACJ,CAAC;YAED,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CACxB,GAAG,MAAM,CAAC,KAAK,wDAAwD,CACxE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,gBAAgB,CACxB,GAAG,MAAM,CAAC,QAAQ,yCAAyC,CAC5D,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,aAAa,CAAC,2BAA2B,EAAE,CAAC;YAC7D,MAAM,IAAI,gBAAgB,CACxB,kCAAkC,aAAa,CAAC,2BAA2B,cAAc,CAC1F,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AA7K0B;IADxB,WAAW,EAAE;;;;6CAsBb;AAGwB;IADxB,WAAW,EAAE;;;;6CA+Db;AAyFH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/NetworkSiteService.js

@@ -29,6 +29,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import NetworkDeviceHydrationUtil from "../Utils/Monitor/NetworkDeviceHydrationUtil";
 import logger from "../Utils/Logger";
 import { NetworkDeviceMonitoringMethodUtil } from "../../Types/NetworkDevice/NetworkDeviceMonitoringMethod";
+import ColumnLength from "../../Types/Database/ColumnLength";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import MonitorType from "../../Types/Monitor/MonitorType";
@@ -96,6 +97,20 @@ const DIRECT_CHILD_TYPE_VALIDATION_PAGE_SIZE = 1000;
  * row from the old path prefix, so every page must start at offset zero.
  */
 const SUBTREE_REBASE_PAGE_SIZE = 1000;
+/*
+ * How deep a site tree may go, derived from the column that has to hold it:
+ * materializedPath is varchar(ColumnLength.LongText) and every segment costs a
+ * 36-character id plus its separator, after the leading slash.
+ *
+ * The bound has to be stated here now. It used to fall out of the placement
+ * rule for free - a site's depth was exactly its type's depth in the catalog,
+ * because the parent type was pinned recursively. Placement no longer pins
+ * anything (a site may sit under one of its own type), so without this a chain
+ * of thirteen sites would silently overflow the column: Postgres refuses the
+ * write, and it refuses it in onUpdateSuccess, after the parent change has
+ * already been committed.
+ */
+const MAX_SITE_HIERARCHY_PATH_SEGMENTS = Math.floor((ColumnLength.LongText - 1) / 37);
 /*
  * Model instances initialise optional fields to undefined. Those properties
  * are omissions, not requests to clear a relation; null is the explicit
@@ -539,6 +554,20 @@ export class Service extends DatabaseService {
      * explicitly rather than confuse "foreign" with "missing".
      */
     async getNetworkSiteTypeForHierarchy(networkSiteTypeId, cache) {
+        const networkSiteType = await this.findNetworkSiteTypeForHierarchy(networkSiteTypeId, cache);
+        if (!networkSiteType) {
+            throw new BadDataException("Network site type not found.");
+        }
+        return networkSiteType;
+    }
+    /*
+     * The nullable form, for rows that are read as CONTEXT rather than written.
+     * A parent site's type - or a link further up the catalog - can be missing
+     * after a direct database edit, and an unresolvable ancestor proves nothing
+     * about the proposed edge; refusing the whole write there would strand the
+     * site instead of describing a problem the operator can act on.
+     */
+    async findNetworkSiteTypeForHierarchy(networkSiteTypeId, cache) {
         const key = normalizeId(networkSiteTypeId);
         const cached = cache.get(key);
         if (cached) {
@@ -548,24 +577,34 @@ export class Service extends DatabaseService {
             id: networkSiteTypeId,
             select: {
                 _id: true,
+                name: true,
                 projectId: true,
+                isUnitLevel: true,
                 parentNetworkSiteTypeId: true,
             },
             props: {
                 isRoot: true,
             },
         });
-        if (!networkSiteType) {
-            throw new BadDataException("Network site type not found.");
+        if (networkSiteType) {
+            cache.set(key, networkSiteType);
         }
-        cache.set(key, networkSiteType);
         return networkSiteType;
     }
     /*
-     * Assert one proposed site edge against the type hierarchy. Untyped legacy
-     * root rows remain readable/editable, but as soon as a site has a type its
-     * placement is exact: a root type has no parent, and a non-root type has a
-     * parent site whose type is precisely the configured direct parent type.
+     * Assert one proposed site edge against the type hierarchy.
+     *
+     * The type tree describes which levels sit above which; it does NOT dictate
+     * an exact placement. A parent site is always optional, may skip levels, and
+     * may be of an unrelated type — the only inversion refused is a parent whose
+     * type sits BELOW the child's own type. The stricter reading this replaces
+     * (parent must be exactly the configured direct parent type, root types may
+     * never have a parent) made whole hierarchies impossible to build: see
+     * GitHub issue #3744, where every type in the project was top-level and no
+     * parent could be linked at all, by hand or by CSV.
+     *
+     * A unit-level type is the declared leaf of the hierarchy, so its sites hold
+     * devices rather than more sites and can never be a parent here.
      */
     async validateSiteTypeEdge(data) {
         if (!data.networkSiteTypeId) {
@@ -580,19 +619,53 @@ export class Service extends DatabaseService {
             !sameId(networkSiteType.projectId, data.projectId)) {
             throw new BadDataException("Network site type must belong to the same project.");
         }
-        const requiredParentTypeId = networkSiteType.parentNetworkSiteTypeId || null;
-        if (!requiredParentTypeId) {
-            if (data.parentSite) {
-                throw new BadDataException("A site with a root network site type cannot have a parent site.");
-            }
+        if (!data.parentSite) {
             return;
         }
-        if (!data.parentSite) {
-            throw new BadDataException("This network site type requires a parent site.");
+        /*
+         * A parent that predates site types belongs to no level, so no inversion
+         * can be proven against it. Refusing it would make legacy rows permanently
+         * unusable as parents without a data migration nobody can safely write.
+         */
+        if (!data.parentSite.networkSiteTypeId) {
+            return;
         }
-        if (!data.parentSite.networkSiteTypeId ||
-            !sameId(data.parentSite.networkSiteTypeId, requiredParentTypeId)) {
-            throw new BadDataException("Parent site must use the configured parent network site type.");
+        const parentNetworkSiteType = await this.findNetworkSiteTypeForHierarchy(data.parentSite.networkSiteTypeId, data.typeCache);
+        if (!parentNetworkSiteType) {
+            return;
+        }
+        const childTypeName = networkSiteType.name || "this site's network site type";
+        const parentTypeName = parentNetworkSiteType.name || "the parent site's network site type";
+        if (parentNetworkSiteType.isUnitLevel === true) {
+            throw new BadDataException(`Sites of network site type "${parentTypeName}" are unit level, so they cannot have child sites.`);
+        }
+        if (sameId(data.networkSiteTypeId, data.parentSite.networkSiteTypeId)) {
+            return;
+        }
+        /*
+         * Walk UP from the parent's type. Reaching the child's type means the
+         * parent sits below it, which is the one arrangement that contradicts the
+         * configured hierarchy. The visited set bounds a catalog cycle written
+         * straight into the database, which must fail the request rather than
+         * spin the event loop.
+         */
+        const visited = new Set([
+            normalizeId(data.parentSite.networkSiteTypeId),
+        ]);
+        let ancestorTypeId = parentNetworkSiteType.parentNetworkSiteTypeId || null;
+        while (ancestorTypeId) {
+            if (sameId(ancestorTypeId, data.networkSiteTypeId)) {
+                throw new BadDataException(`A site of network site type "${childTypeName}" cannot be placed under a site of network site type "${parentTypeName}", because "${parentTypeName}" sits below "${childTypeName}" in the site type hierarchy.`);
+            }
+            if (visited.has(normalizeId(ancestorTypeId))) {
+                break;
+            }
+            visited.add(normalizeId(ancestorTypeId));
+            const ancestorType = await this.findNetworkSiteTypeForHierarchy(ancestorTypeId, data.typeCache);
+            if (!ancestorType) {
+                break;
+            }
+            ancestorTypeId = ancestorType.parentNetworkSiteTypeId || null;
         }
     }
     /*
@@ -631,6 +704,16 @@ export class Service extends DatabaseService {
                 },
             });
             for (const child of children) {
+                /*
+                 * An untyped site is tolerated as a parent only where legacy data
+                 * already made it one. Clearing the type of a site that still owns
+                 * children would manufacture that shape deliberately, and every
+                 * placement check below it would then have nothing to compare
+                 * against.
+                 */
+                if (!data.proposedNetworkSiteTypeId) {
+                    throw new BadDataException("A network site with child sites must have a network site type.");
+                }
                 await this.validateSiteTypeEdge({
                     networkSiteTypeId: child.networkSiteTypeId || null,
                     parentSite: proposedParent,
@@ -855,6 +938,10 @@ export class Service extends DatabaseService {
         }
         if (parentSiteId) {
             parentPath = await this.getMaterializedPathForSite(parentSiteId);
+            this.assertHierarchyDepthFits({
+                parentPath: parentPath,
+                additionalSegments: 1,
+            });
         }
         return {
             createBy: createBy,
@@ -863,6 +950,60 @@ export class Service extends DatabaseService {
             },
         };
     }
+    /*
+     * Refuse a placement whose resulting path would not fit the column, before
+     * anything is written. `additionalSegments` is the height of what is being
+     * hung off this parent: 1 for a new leaf, and for a move the moved site plus
+     * the deepest thing already under it.
+     */
+    assertHierarchyDepthFits(data) {
+        const parentSegments = MaterializedPathUtil.segmentsOf(data.parentPath).length;
+        if (parentSegments + data.additionalSegments <=
+            MAX_SITE_HIERARCHY_PATH_SEGMENTS) {
+            return;
+        }
+        throw new BadDataException(`A network site hierarchy can be at most ${MAX_SITE_HIERARCHY_PATH_SEGMENTS} levels deep, and this placement would make it deeper. Move the sites below it first, or attach this one higher up.`);
+    }
+    /*
+     * How many levels the subtree rooted at `site` occupies, itself included, so
+     * a move can be measured before it is made rather than discovered when the
+     * post-commit rebase writes an over-long path.
+     */
+    async getSubtreeHeight(site) {
+        var _a;
+        if (!site.materializedPath || !site.projectId) {
+            return 1;
+        }
+        const ownSegments = MaterializedPathUtil.segmentsOf(site.materializedPath).length;
+        /*
+         * Ordering on the maintained `depth` column keeps this to one row. Rows
+         * with no depth at all are excluded rather than sorted first: such a row
+         * predates path maintenance and would otherwise answer the question with a
+         * shallow path, and leaving the bound permissive for already-broken data
+         * is better than refusing a move the operator can see is fine.
+         */
+        const deepest = await this.findBy({
+            query: {
+                projectId: site.projectId,
+                materializedPath: this.pathStartsWith(site.materializedPath),
+                depth: QueryHelper.notNull(),
+            },
+            select: {
+                _id: true,
+                materializedPath: true,
+            },
+            sort: {
+                depth: SortOrder.Descending,
+            },
+            limit: 1,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const deepestSegments = MaterializedPathUtil.segmentsOf((_a = deepest[0]) === null || _a === void 0 ? void 0 : _a.materializedPath).length;
+        return Math.max(1, deepestSegments - ownSegments + 1);
+    }
     async onCreateSuccess(onCreate, createdItem) {
         var _a;
         if (!createdItem.id) {
@@ -1057,6 +1198,16 @@ export class Service extends DatabaseService {
                     MaterializedPathUtil.wouldCreateCycle(item.id.toString(), newParentPath)) {
                     throw new BadDataException("Cannot move a site under itself or one of its own descendants.");
                 }
+                /*
+                 * The whole subtree moves with the site, so the deepest row in it is
+                 * what decides whether the move fits. Measuring it here is the only
+                 * chance: the rebase that writes those paths runs after the parent
+                 * change has been committed.
+                 */
+                this.assertHierarchyDepthFits({
+                    parentPath: newParentPath,
+                    additionalSegments: await this.getSubtreeHeight(item),
+                });
             }
         }
         const typeCache = new Map();
@@ -1302,11 +1453,16 @@ export class Service extends DatabaseService {
             return Boolean(projectId);
         })));
         /*
-         * A valid child type explicitly names the deleted site's type as its
-         * required direct parent type. Legacy SET NULL/orphan-repair behaviour
-         * therefore cannot produce a valid edge: promoting the child to root or
-         * attaching it to the grandparent both violate its type. Reject the
-         * delete unless every direct child is part of this same bulk delete.
+         * Reject the delete unless every direct child is part of this same bulk
+         * delete.
+         *
+         * This used to be argued from the type rule - promoting an orphan to root
+         * or to its grandparent was said to be impossible without breaking its
+         * type. That argument no longer holds: a parent is optional now, and a
+         * grandparent is usually a legal parent. The guard stays on its own terms.
+         * Deleting one site is not permission to silently restructure the tree
+         * underneath it, and the operator, not the repair loop, should decide
+         * where those sites belong.
          *
          * Parent ids and result rows are both batched so neither a wide delete nor
          * a wide site is silently truncated at a service query limit.
@@ -1394,6 +1550,15 @@ export class Service extends DatabaseService {
      * Rewrites the deleted site's former subtree so the '/deletedId/' segment
      * is dropped from every path, and re-points its direct children at the
      * deleted site's parent.
+     *
+     * onBeforeDelete refuses a delete that would leave a surviving child, so
+     * this only runs for rows that got past it - a hard delete, or a child
+     * created in the window between the check and the write. It writes the
+     * promotion without re-checking the placement rule: the grandparent it
+     * promotes to is almost always legal, the alternative is leaving a site
+     * pointing at a row that no longer exists, and the result is visible and
+     * fixable in the parent picker. A repair prefers a whole tree to a
+     * perfectly modelled one.
      */
     async reattachOrphanedSubtree(deletedSite) {
         const oldPath = deletedSite.materializedPath || null;