@oneuptime/common 13.0.7 → 14.0.0

package/Server/Services/DatabaseService.ts

@@ -22,6 +22,8 @@ import {
   OnUpdate,
 } from "../Types/Database/Hooks";
 import ModelPermission from "../Types/Database/Permissions/Index";
+import PublicPermission from "../Types/Database/Permissions/PublicPermission";
+import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import OwnerOnlyColumnPermission from "../Types/Database/Permissions/OwnerOnlyColumnPermission";
 import { CheckReadPermissionType } from "../Types/Database/Permissions/ReadPermission";
 import Query from "../Types/Database/Query";
@@ -57,6 +59,7 @@ import PartialEntity from "../../Types/Database/PartialEntity";
 import { TableColumnMetadata } from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
 import { getUniqueColumnsBy } from "../../Types/Database/UniqueColumnBy";
+import QueryOperator from "../../Types/BaseDatabase/QueryOperator";
 import OneUptimeDate from "../../Types/Date";
 import Dictionary from "../../Types/Dictionary";
 import BadDataException from "../../Types/Exception/BadDataException";
@@ -96,6 +99,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import type AuditLogServiceType from "./AuditLogService";
 import EnableAuditLogOn from "../../Types/BaseDatabase/EnableAuditLogOn";
 import RelationValueUtil from "../Utils/Database/RelationValueUtil";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 
 const RULE_CRITERIA_RELATION_OPERATORS: ReadonlySet<RuleCriteriaOperator> =
   new Set<RuleCriteriaOperator>([
@@ -295,6 +299,31 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     return data;
   }
 
+  /*
+   * The permission layer's login check, run BEFORE the hooks instead of only
+   * after them.
+   *
+   * The hooks run first, and many of them key off props.userId: a missing one
+   * reads as "userId is required" (400), "User should be logged in" (422), or,
+   * for Project reads, an empty list with a 200. For an anonymous caller that
+   * is almost always a dashboard tab whose access-token cookie expired, and
+   * only a 401 makes the browser client refresh the session and replay the
+   * request. Everything this admits, the permission check would have admitted
+   * too (same condition, same exemptions for API keys and public models), so
+   * it only changes which refusal an anonymous caller gets, and it keeps hooks
+   * with side effects from running for them at all.
+   */
+  private checkIfUserIsLoggedInBeforeHooks(
+    props: DatabaseCommonInteractionProps,
+    type: DatabaseRequestType,
+  ): void {
+    if (props.isRoot || props.isMasterAdmin) {
+      return;
+    }
+
+    PublicPermission.checkIfUserIsLoggedIn(this.modelType, props, type);
+  }
+
   protected async onBeforeCreate(
     createBy: CreateBy<TBaseModel>,
   ): Promise<OnCreate<TBaseModel>> {
@@ -347,6 +376,49 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     }
   }
 
+  /*
+   * Query operators (StartsWith, NotNull, Search, GreaterThan, Includes...)
+   * belong in the `query` of a read/update, never in the `data` of a write.
+   * They can reach create/update data because JSONFunctions.deserialize - run
+   * on every request body while building the model - turns
+   * `{"_type":"StartsWith","value":"a"}` into a real operator instance, and
+   * DatabaseBaseModel._fromJSON assigns it to an id/text column unchanged.
+   *
+   * An operator is never a valid stored value, and leaving one on a write
+   * payload also feeds it to the lookups built from that data - the uniqueness
+   * check here and the findBy/countBy calls in service hooks - where QueryUtil
+   * turns the intended exact comparison into a pattern match, quietly matching
+   * rows the caller never named. Refuse such a write up front instead. JSON
+   * columns are exempt: they legitimately hold arbitrary objects, and their
+   * values are not used to build a query.
+   */
+  private rejectQueryOperatorsInData(
+    data: TBaseModel | PartialEntity<TBaseModel>,
+  ): void {
+    for (const columnName of Object.keys(data)) {
+      const value: unknown = (data as Record<string, unknown>)[columnName];
+
+      if (!(value instanceof QueryOperator)) {
+        continue;
+      }
+
+      if (!this.model.isTableColumn(columnName)) {
+        continue;
+      }
+
+      const metadata: TableColumnMetadata =
+        this.model.getTableColumnMetadata(columnName);
+
+      if (metadata && metadata.type === TableColumnType.JSON) {
+        continue;
+      }
+
+      throw new BadDataException(
+        `Invalid value for ${columnName}. A query operator cannot be used as a value when creating or updating ${this.model.singularName}.`,
+      );
+    }
+  }
+
   /*
    * Rows written before the fix above hold their ciphertext inside that
    * HashedString envelope. Decrypting the envelope itself is not just wrong
@@ -984,6 +1056,107 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       RULE_CRITERIA_LEGACY_NEVER_MATCH_PATTERN;
   }
 
+  /*
+   * A tenant model declares its tenant TWICE: a scalar column (e.g.
+   * `projectId`) AND a ManyToOne relation (`project`) whose @JoinColumn names
+   * that same scalar. Both are separately writable through the public API, and
+   * both land on the entity that reaches getRepository().save()/update().
+   * TypeORM (metadata/ColumnMetadata.js getEntityValue) resolves the relation
+   * object to the join-column value with PRECEDENCE over the scalar, so a
+   * request carrying `project: { _id: <another project> }` is persisted under
+   * THAT project even though create() has just stamped the scalar to
+   * props.tenantId. That is a cross-tenant write of the whole row (reproduced
+   * end to end: the generated INSERT binds `projectId` to the relation's id,
+   * not the stamped scalar).
+   *
+   * The stamped scalar is the authoritative tenant for every non-root write,
+   * and no `project` relation in the schema legitimately points at a project
+   * other than the tenant (every one joins on `projectId`; there is no second,
+   * foreign-project reference to preserve). So neutralize the relation
+   * spelling: reject a tenant relation that points anywhere other than the
+   * request tenant, then delete it so the scalar is the single source of truth
+   * and no TypeORM precedence rule between the two can move the row. This is
+   * the framework-level generalisation of the per-service fixes already
+   * shipped in ApiKeyPermissionService and UserTelegramService.
+   *
+   * Root / master-admin / internal callers are left untouched — they have no
+   * request tenant (props.tenantId is unset) and legitimately set the tenant
+   * relation for another project during seeding, migrations and
+   * invitation-acceptance. This mirrors the create() scalar stamp, which is
+   * likewise gated on props.tenantId.
+   */
+  private enforceTenantRelationMatchesScalar(
+    data: TBaseModel | PartialEntity<TBaseModel>,
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    if (props.isRoot || props.isMasterAdmin) {
+      return;
+    }
+
+    const tenantColumn: string | null = this.model.getTenantColumn();
+
+    if (!tenantColumn || !props.tenantId) {
+      return;
+    }
+
+    const tenantRelationProperty: string | null =
+      this.getTenantRelationProperty(tenantColumn);
+
+    if (!tenantRelationProperty) {
+      /*
+       * e.g. Project itself, whose tenant column is its own `_id`, has no such
+       * relation; global (non-tenant) models return null from getTenantColumn.
+       */
+      return;
+    }
+
+    const suppliedRelation: unknown = (data as Record<string, unknown>)[
+      tenantRelationProperty
+    ];
+
+    if (suppliedRelation === undefined) {
+      return;
+    }
+
+    const relationTenantId: ObjectID | null = RelationIdUtil.read(
+      data as Record<string, unknown>,
+      [tenantRelationProperty],
+    );
+
+    if (
+      relationTenantId &&
+      relationTenantId.toString() !== props.tenantId.toString()
+    ) {
+      throw new BadDataException(
+        `The ${tenantRelationProperty} relation does not belong to this project.`,
+      );
+    }
+
+    delete (data as Record<string, unknown>)[tenantRelationProperty];
+  }
+
+  /*
+   * Property name of the ManyToOne relation that shares the tenant scalar
+   * column as its join column (`project` for the `projectId` tenant column),
+   * or null when the model has no such relation.
+   */
+  private getTenantRelationProperty(tenantColumn: string): string | null {
+    for (const columnName of this.model.getTableColumns().columns) {
+      const metadata: TableColumnMetadata | undefined =
+        this.model.getTableColumnMetadata(columnName);
+
+      if (
+        metadata &&
+        metadata.type === TableColumnType.Entity &&
+        metadata.manyToOneRelationColumn === tenantColumn
+      ) {
+        return columnName;
+      }
+    }
+
+    return null;
+  }
+
   private async sanitizeCreateOrUpdate(
     data: TBaseModel | PartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,
@@ -1368,6 +1541,34 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
   @CaptureSpan()
   public async create(createBy: CreateBy<TBaseModel>): Promise<TBaseModel> {
+    this.checkIfUserIsLoggedInBeforeHooks(
+      createBy.props,
+      DatabaseRequestType.Create,
+    );
+
+    /*
+     * A non-root create must not pin the row's own primary key. save() treats
+     * an entity carrying an existing id as an update of that row rather than an
+     * insert, so a supplied `_id` turns a create into an in-place modification
+     * of a record the caller never named. BaseAPI.createItem already strips it;
+     * this guards every other non-root caller (custom routes, workflow
+     * components) too. Root/internal seeding legitimately assigns ids and is
+     * exempt. Only the top-level primary key is checked - nested relation
+     * `_id`s reference existing related rows and are fine.
+     */
+    if (
+      !createBy.props.isRoot &&
+      !createBy.props.isMasterAdmin &&
+      (createBy.data as TBaseModel)._id
+    ) {
+      throw new BadDataException(
+        `An id cannot be supplied when creating ${this.model.singularName}.`,
+      );
+    }
+
+    // Query operators are for queries, not for write payloads. See the helper.
+    this.rejectQueryOperatorsInData(createBy.data);
+
     this.unwrapHashedStringsForUnhashedColumns(createBy.data);
 
     const onCreate: OnCreate<TBaseModel> = createBy.props.ignoreHooks
@@ -1389,6 +1590,15 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       data.setColumnValue(tenantColumnName, _createdBy.props.tenantId);
     }
 
+    /*
+     * The tenant scalar has just been stamped to the request tenant, but the
+     * matching tenant RELATION object (e.g. `project`) is still whatever the
+     * caller sent, and TypeORM lets that relation override the scalar on the
+     * INSERT. Force the relation to agree with — or be dropped in favour of —
+     * the stamped scalar so a caller cannot write the row into another tenant.
+     */
+    this.enforceTenantRelationMatchesScalar(data, _createdBy.props);
+
     data = this.generateDefaultValues(data);
 
     data = this.checkRequiredFields(data);
@@ -2291,6 +2501,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   @CaptureSpan()
   public async hardDeleteBy(deleteBy: DeleteBy<TBaseModel>): Promise<number> {
     try {
+      this.checkIfUserIsLoggedInBeforeHooks(
+        deleteBy.props,
+        DatabaseRequestType.Delete,
+      );
+
       const onDelete: OnDelete<TBaseModel> = deleteBy.props.ignoreHooks
         ? { deleteBy, carryForward: [] }
         : await this.onBeforeDelete(deleteBy);
@@ -2353,6 +2568,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(deleteBy.props);
 
+      this.checkIfUserIsLoggedInBeforeHooks(
+        deleteBy.props,
+        DatabaseRequestType.Delete,
+      );
+
       if (this.doNotAllowDelete && !deleteBy.props.isRoot) {
         throw new BadDataException("Delete not allowed");
       }
@@ -2587,6 +2807,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(findBy.props);
 
+      this.checkIfUserIsLoggedInBeforeHooks(
+        findBy.props,
+        DatabaseRequestType.Read,
+      );
+
       if (!findBy.sort || Object.keys(findBy.sort).length === 0) {
         findBy.sort = {
           createdAt: SortOrder.Descending,
@@ -2967,8 +3192,28 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(updateBy.props);
 
+      this.checkIfUserIsLoggedInBeforeHooks(
+        updateBy.props,
+        DatabaseRequestType.Update,
+      );
+
       updateBy.data = this.sanitizeUpdateData(updateBy.data);
 
+      // Query operators are for queries, not for write payloads. See the helper.
+      this.rejectQueryOperatorsInData(updateBy.data);
+
+      /*
+       * Defense in depth for the tenant confused-deputy on the update path.
+       * Unlike create(), _updateBy() never re-stamps the tenant scalar, and a
+       * tenant relation object would likewise override the scalar join column
+       * on the UPDATE. Today the tenant columns carry `update: []` so the
+       * column-permission check rejects them first, but that is incidental —
+       * this keeps the row's tenant immutable even if a model ever grants
+       * update on the tenant relation. Runs before the permission check so the
+       * ACL stays a redundant second line rather than the only one.
+       */
+      this.enforceTenantRelationMatchesScalar(updateBy.data, updateBy.props);
+
       this.unwrapHashedStringsForUnhashedColumns(updateBy.data);
 
       const onUpdate: OnUpdate<TBaseModel> = updateBy.props.ignoreHooks

package/Server/Services/DetectionRuleService.ts

@@ -5,6 +5,8 @@ import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import BadDataException from "../../Types/Exception/BadDataException";
 import {
+  DETECTION_EVALUATION_INTERVAL_MAX_IN_MINUTES,
+  DETECTION_EVALUATION_INTERVAL_MIN_IN_MINUTES,
   DETECTION_MATCH_COUNT_THRESHOLD_MAX,
   DETECTION_MATCH_COUNT_THRESHOLD_MIN,
 } from "../../Types/SecurityEvent/DetectionFindingConstants";
@@ -52,10 +54,9 @@ export class Service extends DatabaseService<Model> {
   private validateEvaluationInterval(interval: number | undefined): void {
     this.validateIntegerInRange({
       value: interval,
-      min: 1,
-      max: 1440,
-      message:
-        "Evaluation interval must be a whole number of minutes between 1 and 1440.",
+      min: DETECTION_EVALUATION_INTERVAL_MIN_IN_MINUTES,
+      max: DETECTION_EVALUATION_INTERVAL_MAX_IN_MINUTES,
+      message: `Evaluation interval must be a whole number of minutes between ${DETECTION_EVALUATION_INTERVAL_MIN_IN_MINUTES} and ${DETECTION_EVALUATION_INTERVAL_MAX_IN_MINUTES}.`,
     });
   }
 

package/Server/Services/EnterpriseLicenseService.ts

@@ -3,11 +3,26 @@ import EnterpriseLicense from "../../Models/DatabaseModels/EnterpriseLicense";
 import MarketingEventUtil from "../Utils/Marketing/MarketingEventUtil";
 import { MarketingEventType } from "../../Types/Marketing/MarketingEvent";
 import { OnCreate } from "../Types/Database/Hooks";
+import CreateBy from "../Types/Database/CreateBy";
 import OneUptimeDate from "../../Types/Date";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import ObjectID from "../../Types/ObjectID";
 import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
 import logger from "../Utils/Logger";
+import crypto from "crypto";
+
+/*
+ * Random bytes in a license key generated by the server: 256 bits, written as
+ * 64 hex characters (the column holds 100). Keys issued before server-side
+ * generation are browser-made UUIDs and keep working unchanged.
+ */
+export const ENTERPRISE_LICENSE_KEY_RANDOM_BYTES: number = 32;
+
+export const generateEnterpriseLicenseKey: () => string = (): string => {
+  return crypto
+    .randomBytes(ENTERPRISE_LICENSE_KEY_RANDOM_BYTES)
+    .toString("hex");
+};
 
 export const ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_NAMESPACE: string =
   "EnterpriseLicenseService.usageAggregation";
@@ -66,6 +81,29 @@ export class Service extends DatabaseService<EnterpriseLicense> {
     }
   }
 
+  /*
+   * A license created with no key (the Admin Dashboard's "leave blank to
+   * auto-generate") gets one from the server's CSPRNG here, instead of from
+   * the browser. A key typed by the admin is kept, trimmed: installations
+   * trim the key they send, so stored whitespace would make it unmatchable.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<EnterpriseLicense>,
+  ): Promise<OnCreate<EnterpriseLicense>> {
+    const providedKey: string =
+      typeof createBy.data.licenseKey === "string"
+        ? createBy.data.licenseKey.trim()
+        : "";
+
+    createBy.data.licenseKey = providedKey || generateEnterpriseLicenseKey();
+
+    return {
+      createBy,
+      carryForward: undefined,
+    };
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<EnterpriseLicense>,

package/Server/Services/GlobalConfigService.ts

@@ -2,13 +2,45 @@ import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalConfig";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 import ObjectID from "../../Types/ObjectID";
-import { OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import TelegramVerificationToken from "../Utils/TelegramVerificationToken";
 import GlobalCache from "../Infrastructure/GlobalCache";
 
+/*
+ * The columns that hold this installation's license state and identity. They
+ * are written only by OneUptime itself - the license client (activation,
+ * refresh, the daily usage report), the first-boot stamp of the Enterprise
+ * Edition and the data migrations - and every one of those writes runs with
+ * isRoot. A master admin reaches GlobalConfig through the generic CRUD API
+ * too, and master admins bypass the (empty) column ACLs, so without this list
+ * one PUT could forge a license expiry, raise the seat limit, restart the
+ * unlicensed trial or swap the instance id an instance-bound license
+ * is checked against.
+ *
+ * enterpriseLicenseNotificationEmail and enterpriseLicenseExpiryReminderDays
+ * are deliberately NOT here: they are settings the oneuptime.com admin edits
+ * from the Admin Dashboard.
+ */
+export const ROOT_ONLY_LICENSE_COLUMNS: ReadonlyArray<keyof Model> = [
+  "instanceId",
+  "enterpriseCompanyName",
+  "enterpriseLicenseKey",
+  "enterpriseLicenseExpiresAt",
+  "enterpriseLicenseToken",
+  "enterpriseLicenseIsEvaluation",
+  "enterpriseLicenseUserLimit",
+  "enterpriseLicenseCurrentUserCount",
+  "enterpriseLicenseUserCountUpdatedAt",
+  "enterpriseLicenseInstances",
+  "enterpriseEditionFirstSeenAt",
+];
+
 const TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE: string =
   "global-config-security";
 const TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY: string =
@@ -203,10 +235,57 @@ export class Service extends DatabaseService<Model> {
     );
   }
 
+  /*
+   * Refuses any write to ROOT_ONLY_LICENSE_COLUMNS that does not come from
+   * OneUptime itself. An explicit null counts as a write: clearing the license
+   * token is as much a forgery as setting one.
+   */
+  public assertLicenseColumnsWrittenByRootOnly(
+    data: unknown,
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    if (props.isRoot) {
+      return;
+    }
+
+    const writtenColumns: Array<string> = ROOT_ONLY_LICENSE_COLUMNS.filter(
+      (column: keyof Model): boolean => {
+        return (
+          (data as Record<string, unknown>)[column as string] !== undefined
+        );
+      },
+    ).map((column: keyof Model): string => {
+      return column as string;
+    });
+
+    if (writtenColumns.length === 0) {
+      return;
+    }
+
+    throw new NotAuthorizedException(
+      `${writtenColumns.join(", ")} can only be changed by OneUptime itself. ` +
+        "Use the license dialog in the Admin Dashboard to activate or refresh the Enterprise license.",
+    );
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    this.assertLicenseColumnsWrittenByRootOnly(createBy.data, createBy.props);
+
+    return {
+      createBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    this.assertLicenseColumnsWrittenByRootOnly(updateBy.data, updateBy.props);
+
     if (updateBy.data.telegramWebhookSecretToken !== undefined) {
       const secret: unknown = updateBy.data.telegramWebhookSecretToken;
 

package/Server/Services/MonitorProbeService.ts

@@ -13,14 +13,66 @@ import MonitorService from "./MonitorService";
 import ProbeService from "./ProbeService";
 import { MonitorTypeHelper } from "../../Types/Monitor/MonitorType";
 import CronTab from "../Utils/CronTab";
-import logger, { LogAttributes } from "../Utils/Logger";
+import logger, { EXTERNAL_FAULT, LogAttributes } from "../Utils/Logger";
 import { SubscriptionStatusUtil } from "../../Types/Billing/SubscriptionStatus";
+import MonitoringIntervalValidator from "../Utils/Monitor/MonitoringIntervalValidator";
 
 export class Service extends DatabaseService<MonitorProbe> {
   public constructor() {
     super(MonitorProbe);
   }
 
+  /**
+   * The next time a monitor with this interval is due, or `fallback`.
+   *
+   * Exported on the class (and covered directly by tests) because both
+   * scheduling paths — the batch claim query and the single-monitor refresh
+   * after an edit — have to agree about what a stored interval means. They
+   * did not before: the claim query swallowed a parse failure silently and
+   * fell back to one minute, so a monitor asking for five minutes was probed
+   * four times more often than requested, indefinitely and invisibly.
+   *
+   * Order is load-bearing. cron-parser gets the RAW value first, so the
+   * thousands of rows that were always valid take a byte-identical path and
+   * anything the parser understands but our grammar does not ("@hourly") is
+   * still honoured. Only when that fails do we try to read the value as a
+   * human cadence ("5m", "Every 5 minutes"), which is what makes those rows
+   * schedule correctly on deploy — before the data migration has run, and
+   * for any row that later arrives through a hook-free write or a restore.
+   */
+  public static resolveNextPingAt(data: {
+    monitoringInterval: string | null | undefined;
+    fallback: Date;
+    onUnreadable?: (() => void) | undefined;
+  }): Date {
+    if (!data.monitoringInterval) {
+      return data.fallback;
+    }
+
+    try {
+      return CronTab.getNextExecutionTime(data.monitoringInterval);
+    } catch {
+      // Not a cron expression. Try to read it as a human cadence instead.
+    }
+
+    const normalizedCron: string | null =
+      MonitoringIntervalValidator.normalizeForRead(data.monitoringInterval);
+
+    if (normalizedCron) {
+      try {
+        return CronTab.getNextExecutionTime(normalizedCron);
+      } catch {
+        // Normalizer produced something cron-parser rejects. Report it.
+      }
+    }
+
+    if (data.onUnreadable) {
+      data.onUnreadable();
+    }
+
+    return data.fallback;
+  }
+
   public async pruneStaleLastMonitoringLogEntries(data: {
     monitorId: ObjectID;
     validMonitorStepIds: Array<string>;
@@ -103,20 +155,28 @@ export class Service extends DatabaseService<MonitorProbe> {
         continue;
       }
 
-      let nextPing: Date = OneUptimeDate.addRemoveMinutes(
-        OneUptimeDate.getCurrentDate(),
-        1,
-      );
-
-      try {
-        nextPing = CronTab.getNextExecutionTime(
-          monitorProbe?.monitor?.monitoringInterval as string,
-        );
-      } catch (err) {
-        logger.error(err, {
-          monitorId: data.monitorId?.toString(),
-        } as LogAttributes);
-      }
+      /*
+       * The falsy guard matters: a Manual monitor (and every other row with
+       * no interval) reaches here with undefined, and the old unguarded call
+       * handed that straight to cron-parser, which threw and logged an error
+       * for a perfectly ordinary row on every single interval edit.
+       */
+      const nextPing: Date = Service.resolveNextPingAt({
+        monitoringInterval: monitorProbe?.monitor?.monitoringInterval,
+        fallback: OneUptimeDate.addRemoveMinutes(
+          OneUptimeDate.getCurrentDate(),
+          1,
+        ),
+        onUnreadable: () => {
+          logger.error(
+            `updateNextPingAtForMonitor: monitoringInterval "${monitorProbe?.monitor?.monitoringInterval}" cannot be read as a schedule; falling back to a 1-minute cadence.`,
+            {
+              ...EXTERNAL_FAULT,
+              monitorId: data.monitorId?.toString(),
+            } as LogAttributes,
+          );
+        },
+      });
 
       if (nextPing && monitorProbe.id) {
         await this.updateOneById({
@@ -223,6 +283,17 @@ export class Service extends DatabaseService<MonitorProbe> {
         const nextPingDates: Array<Date> = [];
         const caseFragments: Array<string> = [];
 
+        /*
+         * Rows whose interval neither cron-parser nor the normalizer could
+         * read. Collected and logged ONCE per batch below rather than per
+         * row: this loop runs for every claimed monitor, every minute, on
+         * every probe-ingest instance, so a per-row log line would flood.
+         */
+        const unreadableIntervals: Array<{
+          monitorProbeId: string;
+          monitoringInterval: string;
+        }> = [];
+
         for (let i: number = 0; i < selectedRows.length; i++) {
           const row: { _id: string; monitoringInterval: string | null } =
             selectedRows[i]!;
@@ -230,11 +301,16 @@ export class Service extends DatabaseService<MonitorProbe> {
 
           let nextPing: Date = defaultNextPing;
           if (row.monitoringInterval) {
-            try {
-              nextPing = CronTab.getNextExecutionTime(row.monitoringInterval);
-            } catch {
-              // fall back to default 1 minute
-            }
+            nextPing = Service.resolveNextPingAt({
+              monitoringInterval: row.monitoringInterval,
+              fallback: defaultNextPing,
+              onUnreadable: () => {
+                unreadableIntervals.push({
+                  monitorProbeId: row._id,
+                  monitoringInterval: row.monitoringInterval as string,
+                });
+              },
+            });
           }
 
           nextPingDates.push(nextPing);
@@ -243,6 +319,26 @@ export class Service extends DatabaseService<MonitorProbe> {
           );
         }
 
+        /*
+         * One aggregated line per batch, at error level with EXTERNAL_FAULT.
+         *
+         * Not debug: LOG_LEVEL=ERROR is what ships, so a debug or warn line
+         * here is deleted from stdout on exactly the installs where an
+         * operator would go looking. This condition used to be swallowed by
+         * a bare `catch {}`, which is why a monitor storing "5m" was probed
+         * every minute instead of every five for as long as the row existed,
+         * with nothing anywhere to grep for. EXTERNAL_FAULT marks it as
+         * tenant data rather than our own failure, so it does not page us.
+         */
+        if (unreadableIntervals.length > 0) {
+          logger.error(
+            `claimMonitorProbesForProbing: ${unreadableIntervals.length} monitor(s) have a monitoringInterval that cannot be read as a schedule and are falling back to a 1-minute cadence. Fix the stored value - "*/5 * * * *" means every 5 minutes. Offenders: ${JSON.stringify(
+              unreadableIntervals.slice(0, 20),
+            )}`,
+            EXTERNAL_FAULT,
+          );
+        }
+
         const updateQuery: string = `
         UPDATE "MonitorProbe"
         SET "lastPingAt" = $1,