@oneuptime/common 14.0.2 → 14.0.5

package/Server/Services/IncidentReminderRuleService.ts

@@ -101,10 +101,34 @@ export class Service extends DatabaseService<Model> {
     return onDelete;
   }
 
+  /*
+   * Re-matches the reminder rule for every open incident in the project and
+   * rewrites its nextReminderNotificationAt.
+   *
+   * Without options that is one read of at most LIMIT_MAX open incidents, and
+   * it must stay one: the rule create, update and delete hooks run it inside
+   * the API request.
+   *
+   * `onlyWithoutNextReminder` narrows that to open incidents with no reminder
+   * scheduled at all, and reads every one of them, in `_id`-ordered pages of
+   * LIMIT_MAX. It exists for backfills (see the
+   * ScheduleRemindersMissedByReminderRuleLookup data migration), which run in a
+   * worker rather than a request and must reach every such incident of the
+   * project, however many there are. The pages are cursored by `_id`, not
+   * offset, because refreshing an incident can take it out of the set being
+   * paged. An incident that already has a timestamp is left alone, because
+   * re-scheduling it would push a reminder that is due, or overdue, one full
+   * interval later.
+   */
   @CaptureSpan()
   public async refreshSchedulesForOpenIncidents(
     projectId: ObjectID,
+    options?: { onlyWithoutNextReminder?: boolean | undefined } | undefined,
   ): Promise<void> {
+    const onlyWithoutNextReminder: boolean = Boolean(
+      options?.onlyWithoutNextReminder,
+    );
+
     try {
       const unresolvedStates: Array<IncidentState> =
         await IncidentStateService.findBy({
@@ -132,33 +156,51 @@ export class Service extends DatabaseService<Model> {
         return;
       }
 
-      const openIncidents: Array<Incident> = await IncidentService.findBy({
-        query: {
+      let afterId: ObjectID | null = null;
+
+      while (true) {
+        const openIncidents: Array<Incident> = await this.findOpenIncidents({
           projectId: projectId,
-          currentIncidentStateId: QueryHelper.any(unresolvedStateIds),
-        },
-        select: {
-          _id: true,
-        },
-        limit: LIMIT_MAX,
-        skip: 0,
-        props: {
-          isRoot: true,
-        },
-      });
+          unresolvedStateIds: unresolvedStateIds,
+          onlyWithoutNextReminder: onlyWithoutNextReminder,
+          afterId: afterId,
+        });
 
-      for (const incident of openIncidents) {
-        try {
-          await IncidentService.refreshReminderSchedule({
-            incidentId: incident.id!,
-            projectId: projectId,
-          });
-        } catch (error) {
-          logger.error(
-            `Failed to refresh reminder schedule for incident ${incident.id}: ${error}`,
-            { projectId: projectId?.toString() } as LogAttributes,
+        for (const incident of openIncidents) {
+          try {
+            await IncidentService.refreshReminderSchedule({
+              incidentId: incident.id!,
+              projectId: projectId,
+            });
+          } catch (error) {
+            logger.error(
+              `Failed to refresh reminder schedule for incident ${incident.id}: ${error}`,
+              { projectId: projectId?.toString() } as LogAttributes,
+            );
+          }
+        }
+
+        // Without the option, the one read above is all there is.
+        if (!onlyWithoutNextReminder || openIncidents.length < LIMIT_MAX) {
+          return;
+        }
+
+        const lastId: ObjectID | null =
+          openIncidents[openIncidents.length - 1]!.id;
+
+        if (!lastId || (afterId && lastId.toString() <= afterId.toString())) {
+          /*
+           * A full page whose last row does not move the cursor forward
+           * would be read again forever. Not reachable with `_id ASC` and a
+           * `> afterId` filter; guarded so a broken sort cannot hang the
+           * backfill.
+           */
+          throw new Error(
+            "the open incident page did not advance its _id cursor",
           );
         }
+
+        afterId = lastId;
       }
     } catch (error) {
       logger.error(
@@ -168,6 +210,44 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /*
+   * One read of the project's open incidents: those whose current state is one
+   * of `unresolvedStateIds`. Both paths of refreshSchedulesForOpenIncidents
+   * read through here, so what "open" means is written once.
+   *
+   * With `onlyWithoutNextReminder`, only those with no reminder scheduled,
+   * `_id` ascending and after `afterId` when there is one. Without it, no
+   * cursor and the default order: the read the rule hooks have always made.
+   */
+  private async findOpenIncidents(data: {
+    projectId: ObjectID;
+    unresolvedStateIds: Array<ObjectID>;
+    onlyWithoutNextReminder: boolean;
+    afterId: ObjectID | null;
+  }): Promise<Array<Incident>> {
+    return await IncidentService.findBy({
+      query: {
+        projectId: data.projectId,
+        currentIncidentStateId: QueryHelper.any(data.unresolvedStateIds),
+        ...(data.onlyWithoutNextReminder
+          ? { nextReminderNotificationAt: QueryHelper.isNull() }
+          : {}),
+        ...(data.afterId ? { _id: QueryHelper.greaterThan(data.afterId) } : {}),
+      },
+      select: {
+        _id: true,
+      },
+      ...(data.onlyWithoutNextReminder
+        ? { sort: { _id: SortOrder.Ascending } }
+        : {}),
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
   @CaptureSpan()
   public async findMatchingRule(data: {
     projectId: ObjectID;

package/Server/Services/IncidentService.ts

@@ -111,6 +111,10 @@ import IncidentAIContextBuilder, {
   AIGenerationContext,
   IncidentContextData,
 } from "../Utils/AI/IncidentAIContextBuilder";
+import IncidentAlertService, {
+  LinkAlertsToIncidentResult,
+} from "./IncidentAlertService";
+import { INCIDENT_ALERT_IDS_TO_LINK_KEY } from "../../Types/Incident/IncidentAlertLink";
 
 // key is incidentId for this dictionary.
 type UpdateCarryForward = Dictionary<{
@@ -120,6 +124,15 @@ type UpdateCarryForward = Dictionary<{
   newMonitorChangeStatusIdTo: ObjectID | undefined;
 }>;
 
+/*
+ * What onBeforeCreate hands to onCreateSuccess. Null unless the incident is
+ * being declared from alerts.
+ */
+type IncidentCreateCarryForward = {
+  // Validated, deduplicated alert ids to link once the incident exists.
+  alertIdsToLink: Array<ObjectID>;
+} | null;
+
 type IncidentUpdatePayload = {
   postmortemNote?: string | null;
   title?: string | null;
@@ -783,6 +796,30 @@ export class Service extends DatabaseService<Model> {
     const projectId: ObjectID =
       createBy.props.tenantId || createBy.data.projectId!;
 
+    /*
+     * Declaring the incident from alerts. The alert ids are checked here,
+     * before the incident number is taken and before anything is written, so
+     * a bad id (a typo, another project's alert, an alert the caller cannot
+     * see, too many alerts) rejects the whole request instead of leaving an
+     * incident behind that is missing some of its alerts. The alerts are
+     * linked in onCreateSuccess, once the incident exists.
+     */
+    let carryForward: IncidentCreateCarryForward = null;
+
+    const alertIdsToLink: unknown =
+      createBy.miscDataProps?.[INCIDENT_ALERT_IDS_TO_LINK_KEY];
+
+    if (alertIdsToLink !== undefined && alertIdsToLink !== null) {
+      carryForward = {
+        alertIdsToLink:
+          await IncidentAlertService.validateAlertIdsForNewIncident({
+            projectId: projectId,
+            alertIds: alertIdsToLink,
+            props: createBy.props,
+          }),
+      };
+    }
+
     if (!createBy.data.declaredAt) {
       createBy.data.declaredAt = OneUptimeDate.getCurrentDate();
     } else {
@@ -1179,7 +1216,7 @@ export class Service extends DatabaseService<Model> {
 
     return {
       createBy,
-      carryForward: null,
+      carryForward: carryForward,
     };
   }
 
@@ -1267,14 +1304,16 @@ export class Service extends DatabaseService<Model> {
      */
     let aiInvestigationEnqueued: boolean = false;
 
-    // Execute operations sequentially with error handling
-    Promise.resolve()
-      .then(async () => {
-        /*
-         * Apply privacy rules BEFORE workspace operations so the workspace
-         * channel is created with the correct privacy setting. This may set
-         * createdItem.isPrivate=true in memory.
-         */
+    /*
+     * Apply privacy rules BEFORE workspace operations so the workspace
+     * channel is created with the correct privacy setting. This may set
+     * createdItem.isPrivate=true in memory. Kept as its own promise (it never
+     * rejects) so declaring from alerts can wait for it before linking: the
+     * links' feed entries leave out a private incident's title, so they must
+     * see the privacy the rules settle on.
+     */
+    const privacyRulesApplied: Promise<void> = Promise.resolve().then(
+      async () => {
         try {
           await IncidentPrivacyRuleEngineService.applyRulesToIncident(
             createdItem,
@@ -1288,7 +1327,11 @@ export class Service extends DatabaseService<Model> {
             } as LogAttributes,
           );
         }
-      })
+      },
+    );
+
+    // Execute operations sequentially with error handling
+    privacyRulesApplied
       .then(async () => {
         try {
           if (createdItem.projectId && createdItem.id) {
@@ -1324,6 +1367,67 @@ export class Service extends DatabaseService<Model> {
           return Promise.resolve();
         }
       })
+      .then(async () => {
+        /*
+         * Declared from alerts: announce the alerts once, here - after
+         * "Incident Created" and after the incident's Slack / Microsoft
+         * Teams channels exist - rather than once per alert as each link is
+         * written (see linkAlertsDeclaredWithIncident). Uses the validated
+         * ids, so it does not wait for the links.
+         */
+        try {
+          const alertIds: Array<ObjectID> =
+            this.getAlertIdsDeclaredWith(onCreate);
+
+          if (alertIds.length > 0) {
+            await IncidentAlertService.createDeclaredFromAlertsFeedItem({
+              projectId: createdItem.projectId!,
+              incidentId: createdItem.id!,
+              alertIds: alertIds,
+              actorUserId: this.getDeclaringUserId(onCreate, createdItem),
+            });
+          }
+        } catch (error) {
+          logger.error(
+            `Announcing the alerts an incident was declared from failed in IncidentService.onCreateSuccess: ${error}`,
+            {
+              projectId: createdItem.projectId?.toString(),
+              incidentId: createdItem.id?.toString(),
+            } as LogAttributes,
+          );
+        }
+      })
+      .then(async () => {
+        /*
+         * A private incident declared from alerts - private from the form or
+         * made private by a privacy rule above - gets the alerts' owners as
+         * its owners, so the people who could see the alerts can see the
+         * incident. Here rather than before the request returns: the owners'
+         * own hooks invite them to the incident's Slack / Microsoft Teams
+         * channels, which exist only from the workspace step above, and their
+         * "owner added" entries belong after "Incident Created".
+         */
+        try {
+          const alertIds: Array<ObjectID> =
+            this.getAlertIdsDeclaredWith(onCreate);
+
+          if (alertIds.length > 0 && createdItem.isPrivate === true) {
+            await IncidentAlertService.copyAlertOwnersToIncident({
+              projectId: createdItem.projectId!,
+              incidentId: createdItem.id!,
+              alertIds: alertIds,
+            });
+          }
+        } catch (error) {
+          logger.error(
+            `Adding the owners of the alerts a private incident was declared from failed in IncidentService.onCreateSuccess: ${error}`,
+            {
+              projectId: createdItem.projectId?.toString(),
+              incidentId: createdItem.id?.toString(),
+            } as LogAttributes,
+          );
+        }
+      })
       .then(async () => {
         try {
           return await this.handleIncidentStateChangeAsync(createdItem);
@@ -1623,9 +1727,105 @@ export class Service extends DatabaseService<Model> {
         );
       });
 
+    await this.linkAlertsDeclaredWithIncident(
+      onCreate,
+      createdItem,
+      privacyRulesApplied,
+    );
+
     return createdItem;
   }
 
+  // The validated alert ids an incident is being declared from, if any.
+  private getAlertIdsDeclaredWith(onCreate: OnCreate<Model>): Array<ObjectID> {
+    const carryForward: IncidentCreateCarryForward =
+      (onCreate.carryForward as IncidentCreateCarryForward) || null;
+
+    return carryForward?.alertIdsToLink || [];
+  }
+
+  /*
+   * Who declared the incident, as "Linked by" on the links and the actor of
+   * their feed entries. A user is recorded as themselves and an API key as
+   * nobody: Incident.createdByUserId is writable by the create payload, and
+   * an API key must not be able to name somebody else as the one who linked
+   * the alerts (IncidentAlertService.onBeforeCreate applies the same rule to
+   * a link created directly). Only an internal root caller is trusted to
+   * name the incident's creator.
+   */
+  private getDeclaringUserId(
+    onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): ObjectID | undefined {
+    if (onCreate.createBy.props.isRoot) {
+      return createdItem.createdByUserId || undefined;
+    }
+
+    return onCreate.createBy.props.userId || undefined;
+  }
+
+  /*
+   * The incident was declared from alerts (see onBeforeCreate): link them now
+   * that it exists. Awaited, unlike the chain above, so the incident page the
+   * user lands on already lists its alerts. Written as root because the
+   * caller's right to link them was checked before the incident was created;
+   * the user who declared the incident is recorded as the one who linked
+   * them. The links write no incident-side feed entries: the chain above
+   * posts one "Declared from N alerts" entry instead. A link that fails is
+   * logged and never fails the incident.
+   *
+   * The privacy rules run first: each link's entry on its alert leaves out
+   * the incident's title when the incident is private, and a rule can make
+   * it private after it was saved. (The alerts' owners are added to a private
+   * incident later in the chain, once its workspace channels exist.)
+   */
+  @CaptureSpan()
+  private async linkAlertsDeclaredWithIncident(
+    onCreate: OnCreate<Model>,
+    createdItem: Model,
+    privacyRulesApplied: Promise<void>,
+  ): Promise<void> {
+    const alertIds: Array<ObjectID> = this.getAlertIdsDeclaredWith(onCreate);
+
+    if (alertIds.length === 0 || !createdItem.projectId || !createdItem.id) {
+      return;
+    }
+
+    await privacyRulesApplied;
+
+    try {
+      const result: LinkAlertsToIncidentResult =
+        await IncidentAlertService.linkAlertsToIncident({
+          projectId: createdItem.projectId,
+          incidentId: createdItem.id,
+          alertIds: alertIds,
+          createdByUserId: this.getDeclaringUserId(onCreate, createdItem),
+          declaredWithIncident: true,
+          props: {
+            isRoot: true,
+          },
+        });
+
+      if (result.failed.length > 0) {
+        logger.error(
+          `${result.failed.length} of ${alertIds.length} alerts could not be linked to the incident they were declared with.`,
+          {
+            projectId: createdItem.projectId.toString(),
+            incidentId: createdItem.id.toString(),
+          } as LogAttributes,
+        );
+      }
+    } catch (error) {
+      logger.error(
+        `Linking the alerts an incident was declared from failed in IncidentService.onCreateSuccess: ${error}`,
+        {
+          projectId: createdItem.projectId.toString(),
+          incidentId: createdItem.id.toString(),
+        } as LogAttributes,
+      );
+    }
+  }
+
   @CaptureSpan()
   private async handleIncidentWorkspaceOperationsAsync(
     createdItem: Model,

package/Server/Services/IncidentStateTimelineService.ts

@@ -37,6 +37,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import WorkspaceNotificationRuleService from "./WorkspaceNotificationRuleService";
 import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
+import IncidentAlertService from "./IncidentAlertService";
 
 export class Service extends DatabaseService<IncidentStateTimeline> {
   public constructor() {
@@ -485,6 +486,29 @@ export class Service extends DatabaseService<IncidentStateTimeline> {
       }
     }
 
+    /*
+     * Carry the incident's new state over to its linked alerts, when the
+     * project has opted in (acknowledge and/or resolve them with the
+     * incident). Only for the incident's current state - a back-dated row has
+     * an endsAt - and after the mutex is released, since it writes alert
+     * timelines. Fire-and-forget: it never fails or delays the state change.
+     */
+    if (!createdItem.endsAt && createdItem.projectId) {
+      IncidentAlertService.cascadeIncidentStateToLinkedAlerts({
+        projectId: createdItem.projectId,
+        incidentId: createdItem.incidentId,
+        incidentStateId: createdItem.incidentStateId,
+      }).catch((error: Error) => {
+        logger.error(
+          `Error while carrying the incident state over to linked alerts: ${error}`,
+          {
+            projectId: createdItem.projectId?.toString(),
+            incidentId: createdItem.incidentId?.toString(),
+          } as LogAttributes,
+        );
+      });
+    }
+
     const stateName: string = incidentState?.name || "";
     let stateEmoji: string = "➡️";
 

package/Server/Services/Index.ts

@@ -106,6 +106,12 @@ import VMwareVCenterOwnerRuleService from "./VMwareVCenterOwnerRuleService";
 import VMwareVCenterOwnerTeamService from "./VMwareVCenterOwnerTeamService";
 import VMwareVCenterOwnerUserService from "./VMwareVCenterOwnerUserService";
 import CephClusterOwnerUserService from "./CephClusterOwnerUserService";
+import DatabaseServerService from "./DatabaseServerService";
+import DatabaseServerEndpointService from "./DatabaseServerEndpointService";
+import DatabaseServerLabelRuleService from "./DatabaseServerLabelRuleService";
+import DatabaseServerOwnerRuleService from "./DatabaseServerOwnerRuleService";
+import DatabaseServerOwnerTeamService from "./DatabaseServerOwnerTeamService";
+import DatabaseServerOwnerUserService from "./DatabaseServerOwnerUserService";
 import LlmProviderService from "./LlmProviderService";
 import DataSourceService from "./DataSourceService";
 import AuditLogService from "./AuditLogService";
@@ -150,6 +156,7 @@ import KubernetesClusterFeedService from "./KubernetesClusterFeedService";
 import DockerHostFeedService from "./DockerHostFeedService";
 import DockerSwarmClusterFeedService from "./DockerSwarmClusterFeedService";
 import CephClusterFeedService from "./CephClusterFeedService";
+import DatabaseServerFeedService from "./DatabaseServerFeedService";
 import PodmanHostFeedService from "./PodmanHostFeedService";
 import ProxmoxClusterFeedService from "./ProxmoxClusterFeedService";
 import VMwareVCenterFeedService from "./VMwareVCenterFeedService";
@@ -291,6 +298,7 @@ import UserOnCallLogService from "./UserOnCallLogService";
 import UserOnCallLogTimelineService from "./UserOnCallLogTimelineService";
 import UserService from "./UserService";
 import UserSessionService from "./UserSessionService";
+import UserProjectSsoConsentService from "./UserProjectSsoConsentService";
 import UserTotpAuthService from "./UserTotpAuthService";
 import UserTwoFactorBackupCodeService from "./UserTwoFactorBackupCodeService";
 import UserWebAuthnService from "./UserWebAuthnService";
@@ -361,6 +369,7 @@ import IncidentEpisodeLabelRuleService from "./IncidentEpisodeLabelRuleService";
 import IncidentEpisodeFeedService from "./IncidentEpisodeFeedService";
 import IncidentEpisodeInternalNoteService from "./IncidentEpisodeInternalNoteService";
 import IncidentEpisodeMemberService from "./IncidentEpisodeMemberService";
+import IncidentAlertService from "./IncidentAlertService";
 import IncidentEpisodeRoleMemberService from "./IncidentEpisodeRoleMemberService";
 import IncidentEpisodeOwnerTeamService from "./IncidentEpisodeOwnerTeamService";
 import IncidentEpisodeOwnerRuleService from "./IncidentEpisodeOwnerRuleService";
@@ -572,6 +581,12 @@ const services: Array<BaseService> = [
   VMwareVCenterOwnerRuleService,
   VMwareVCenterOwnerTeamService,
   VMwareVCenterOwnerUserService,
+  DatabaseServerService,
+  DatabaseServerEndpointService,
+  DatabaseServerLabelRuleService,
+  DatabaseServerOwnerRuleService,
+  DatabaseServerOwnerTeamService,
+  DatabaseServerOwnerUserService,
   LlmProviderService,
   DataSourceService,
 
@@ -599,6 +614,7 @@ const services: Array<BaseService> = [
   DockerHostFeedService,
   DockerSwarmClusterFeedService,
   CephClusterFeedService,
+  DatabaseServerFeedService,
   PodmanHostFeedService,
   ProxmoxClusterFeedService,
   VMwareVCenterFeedService,
@@ -690,6 +706,7 @@ const services: Array<BaseService> = [
 
   UserService,
   UserSessionService,
+  UserProjectSsoConsentService,
   UserCallService,
   UserEmailService,
   UserNotificationRuleService,
@@ -797,6 +814,7 @@ const services: Array<BaseService> = [
   IncidentEpisodeFeedService,
   IncidentEpisodeInternalNoteService,
   IncidentEpisodeMemberService,
+  IncidentAlertService,
   IncidentEpisodeRoleMemberService,
   IncidentEpisodeOwnerTeamService,
   IncidentEpisodeOwnerRuleService,

package/Server/Services/InventoryItemService.ts

@@ -31,6 +31,11 @@ import {
   shouldWarnEntityBudgetOnce,
 } from "../Utils/Telemetry/EntityRegistry";
 
+// A database node's port, as its calls named it (deriveDatabaseDisplayName).
+const PORT_REGEX: RegExp = /^\d{1,5}$/;
+// A bare IPv6 address - bracketed before a port.
+const IPV6_LITERAL_REGEX: RegExp = /^[0-9a-f:.]+$/i;
+
 export class InventoryItemService extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -427,6 +432,39 @@ export class InventoryItemService extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * A database dependency node named by the old rule - its bare namespace,
+     * "orders" for every Postgres a project calls - is renamed to
+     * "<namespace> @ <server>" the next time it is seen. Same guard as above:
+     * only a name this service generated is replaced, never one a person
+     * typed, and a later sighting that cannot name the port does not undo a
+     * name that has it.
+     */
+    if (entity.entityType === EntityType.Database) {
+      const desiredDisplayName: string =
+        InventoryItemService.deriveDatabaseDisplayName(entity).substring(
+          0,
+          ColumnLength.ShortText,
+        );
+      const existingDisplayName: string = existing.displayName || "";
+      const generatedBefore: Array<string> = [
+        InventoryItemService.deriveLegacyDatabaseDisplayName(entity),
+        InventoryItemService.deriveDatabaseDisplayName(entity, {
+          withPort: false,
+        }),
+      ].map((name: string): string => {
+        return name.substring(0, ColumnLength.ShortText);
+      });
+
+      if (
+        desiredDisplayName &&
+        existingDisplayName !== desiredDisplayName &&
+        (!existingDisplayName || generatedBefore.includes(existingDisplayName))
+      ) {
+        update.displayName = desiredDisplayName;
+      }
+    }
+
     const incoming: Record<string, string> = entity.descriptiveAttributes || {};
     if (Object.keys(incoming).length > 0) {
       const current: Record<string, unknown> =
@@ -498,6 +536,13 @@ export class InventoryItemService extends DatabaseService<Model> {
       }
     }
 
+    if (entity.entityType === EntityType.Database) {
+      const databaseName: string = this.deriveDatabaseDisplayName(entity);
+      if (databaseName) {
+        return databaseName;
+      }
+    }
+
     for (const key of this.dependencyDisplayNameOrderByType[
       entity.entityType
     ] || []) {
@@ -509,13 +554,76 @@ export class InventoryItemService extends DatabaseService<Model> {
     return this.deriveFallbackDisplayName(entity);
   }
 
+  /*
+   * A database dependency node is named after the logical database AND the
+   * server it lives on: "<db.namespace> @ <host[:port]>". The namespace alone
+   * ("orders") is shared by every copy of an application's schema - an e2e
+   * project showed ten different PostgreSQL servers all named "orders" on
+   * the Service Map and in Inventory. The host is the node's identifying
+   * `server.address`; the port is the descriptive `server.port` its calls
+   * named (left off when they named none, or several). Only the name
+   * changes: the node's identity (engine, host, namespace) does not.
+   * Without a namespace it is the server alone, without a host the
+   * namespace, and with neither the engine. '' when nothing names it.
+   */
+  public static deriveDatabaseDisplayName(
+    entity: ExtractedEntity,
+    options?: { withPort?: boolean | undefined },
+  ): string {
+    const id: Record<string, string> = entity.identifyingAttributes || {};
+    const descriptive: Record<string, string> =
+      entity.descriptiveAttributes || {};
+
+    const namespace: string = (id["db.namespace"] || "").trim();
+    const host: string = (id["server.address"] || "").trim();
+    const port: string = (descriptive["server.port"] || "").trim();
+
+    let server: string = host;
+    if (host && options?.withPort !== false && PORT_REGEX.test(port)) {
+      if (!host.includes(":")) {
+        server = `${host}:${port}`;
+      } else if (IPV6_LITERAL_REGEX.test(host)) {
+        // A bare IPv6 address takes brackets before a port.
+        server = `[${host}]:${port}`;
+      }
+      // Anything else with a colon (a host list) already names its ports.
+    }
+
+    if (namespace && server) {
+      return `${namespace} @ ${server}`;
+    }
+
+    return server || namespace || (id["db.system.name"] || "").trim();
+  }
+
+  /*
+   * What deriveDisplayName named a database node before it named the server
+   * too: the first of namespace, host, engine. Only a row still carrying
+   * this (or the port-less new name) is renamed - see buildDescriptiveUpdate.
+   */
+  private static deriveLegacyDatabaseDisplayName(
+    entity: ExtractedEntity,
+  ): string {
+    const id: Record<string, string> = entity.identifyingAttributes || {};
+
+    for (const key of this.dependencyDisplayNameOrderByType[
+      EntityType.Database
+    ] || []) {
+      if (id[key]) {
+        return id[key]!;
+      }
+    }
+
+    return this.deriveFallbackDisplayName(entity);
+  }
+
   /*
    * Dependency endpoints have composite identities in which the most
-   * recognisable part is not a `*.name` key: a database reads best as its
-   * namespace ("orders"), then the host it lives on, and only as a last
-   * resort as its engine ("postgresql" is shared by every Postgres a project
-   * calls). Remote endpoints read best as the service name their callers gave
-   * them, then their host.
+   * recognisable part is not a `*.name` key. A database is named by
+   * deriveDatabaseDisplayName; its order here is the old rule (namespace,
+   * then host, then engine), which deriveLegacyDatabaseDisplayName reads to
+   * recognise the names it generated. Remote endpoints read best as the
+   * service name their callers gave them, then their host.
    */
   private static readonly dependencyDisplayNameOrderByType: Partial<
     Record<EntityType, Array<string>>