@oneuptime/common 14.0.2 → 14.0.5

package/Tests/Utils/NetworkDiscovery/DiscoveredHostUtil.test.ts

@@ -1,4 +1,8 @@
 import { DiscoveredNetworkDevice } from "../../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+import {
+  DiscoveredHostNetbiosStatus,
+  DiscoveredHostReverseDnsStatus,
+} from "../../../Types/NetworkDevice/DiscoveredHostNamingStatus";
 import { normalizeDiscoveredHosts } from "../../../Utils/NetworkDiscovery/DiscoveredHostUtil";
 import {
   DiscoveredHostNaming,
@@ -642,3 +646,314 @@ describe("normalizeDiscoveredHosts — the NetBIOS name (issue #3677)", () => {
     expect(getDiscoveredHostDisplayName(normalized!, FULL_NAMES)).toBe("reg01");
   });
 });
+
+/*
+ * OneUptime issue #3916 — why a host is unnamed.
+ *
+ * `dnsHostnameStatus` and `netbiosNameStatus` are short codes the probe
+ * stamps on a host that reverse DNS or NetBIOS left without a name. The
+ * Review dialog turns them into the sentence beside a bare address. Unlike
+ * the names above they are not chosen by the scanned network, but they come
+ * out of the same verbatim jsonb, so they get the same treatment: only an
+ * exact code survives, and anything else is DELETED, not blanked.
+ *
+ * Deleted matters for the same `in`-versus-truthiness reason as the names.
+ * It matters more for the explanation, because "this row carries a code" is
+ * what tells a still-sweeping scan's previous results apart from its fresh
+ * ones. A key left behind holding junk would make one reader say "a code"
+ * and another say "no code" about the same row.
+ */
+describe("normalizeDiscoveredHosts — the naming status codes (issue #3916)", () => {
+  /*
+   * Values that are not a code, as the column can hold them. The other
+   * field's codes are added per test: a reverse-DNS code is junk in the
+   * NetBIOS field, and the reverse.
+   */
+  const NOT_A_CODE: Array<[string, unknown]> = [
+    ["an unknown string", "dnssec-bogus"],
+    ["an upper-case code", "TIMEOUT"],
+    ["a padded code", " no-reply "],
+    ["an underscored code", "no_record"],
+    ["the empty string", ""],
+    ["a prototype key", "constructor"],
+    ["another prototype key", "__proto__"],
+    ["markup", "<img src=x onerror=1>"],
+    ["a number", 3],
+    ["zero", 0],
+    ["an object", { code: "timeout" }],
+    ["an array holding a code", ["timeout"]],
+    ["true", true],
+    ["null", null],
+  ];
+
+  test.each(Object.values(DiscoveredHostReverseDnsStatus))(
+    "keeps the reverse-DNS code %p exactly as stored",
+    (code: DiscoveredHostReverseDnsStatus) => {
+      const [normalized] = normalizeDiscoveredHosts([
+        host({ dnsHostnameStatus: code }),
+      ]);
+
+      expect(normalized?.dnsHostnameStatus).toBe(code);
+    },
+  );
+
+  test.each(Object.values(DiscoveredHostNetbiosStatus))(
+    "keeps the NetBIOS code %p exactly as stored",
+    (code: DiscoveredHostNetbiosStatus) => {
+      const [normalized] = normalizeDiscoveredHosts([
+        host({ netbiosNameStatus: code }),
+      ]);
+
+      expect(normalized?.netbiosNameStatus).toBe(code);
+    },
+  );
+
+  test.each([
+    ...NOT_A_CODE,
+    ...Object.values(DiscoveredHostNetbiosStatus).map(
+      (code: string): [string, unknown] => {
+        return [`the NetBIOS code ${code}`, code];
+      },
+    ),
+  ])(
+    "deletes %s from the reverse-DNS field",
+    (_label: string, value: unknown) => {
+      const [normalized] = normalizeDiscoveredHosts([
+        host({
+          dnsHostnameStatus: value as DiscoveredHostReverseDnsStatus,
+        }),
+      ]);
+
+      expect(normalized).not.toHaveProperty("dnsHostnameStatus");
+    },
+  );
+
+  test.each([
+    ...NOT_A_CODE,
+    ...Object.values(DiscoveredHostReverseDnsStatus).map(
+      (code: string): [string, unknown] => {
+        return [`the reverse-DNS code ${code}`, code];
+      },
+    ),
+  ])("deletes %s from the NetBIOS field", (_label: string, value: unknown) => {
+    const [normalized] = normalizeDiscoveredHosts([
+      host({ netbiosNameStatus: value as DiscoveredHostNetbiosStatus }),
+    ]);
+
+    expect(normalized).not.toHaveProperty("netbiosNameStatus");
+  });
+
+  test("an explicitly undefined code is removed rather than kept as a key", () => {
+    const [normalized] = normalizeDiscoveredHosts([
+      host({ dnsHostnameStatus: undefined, netbiosNameStatus: undefined }),
+    ]);
+
+    expect(normalized).not.toHaveProperty("dnsHostnameStatus");
+    expect(normalized).not.toHaveProperty("netbiosNameStatus");
+  });
+
+  test("a host with no codes gains no keys", () => {
+    /*
+     * Named hosts, rows stored before the codes existed, and rows from an
+     * older probe all have neither key, and must still have neither: a
+     * normaliser that added them would change what `in` says about every
+     * row in every scan.
+     */
+    const [normalized] = normalizeDiscoveredHosts([
+      host({ snmpReachable: false }),
+    ]);
+
+    expect(normalized).toStrictEqual({
+      ipAddress: "10.0.0.1",
+      snmpReachable: false,
+    });
+    expect(Object.keys(normalized!).sort()).toEqual([
+      "ipAddress",
+      "snmpReachable",
+    ]);
+  });
+
+  test("the two codes are cleaned independently of each other", () => {
+    const [badDnsGoodNetbios, goodDnsBadNetbios] = normalizeDiscoveredHosts([
+      host({
+        dnsHostnameStatus: "TIMEOUT" as DiscoveredHostReverseDnsStatus,
+        netbiosNameStatus: DiscoveredHostNetbiosStatus.NoReply,
+      }),
+      host({
+        ipAddress: "10.0.0.2",
+        dnsHostnameStatus: DiscoveredHostReverseDnsStatus.Timeout,
+        netbiosNameStatus: 7 as unknown as DiscoveredHostNetbiosStatus,
+      }),
+    ]);
+
+    expect(badDnsGoodNetbios).not.toHaveProperty("dnsHostnameStatus");
+    expect(badDnsGoodNetbios?.netbiosNameStatus).toBe(
+      DiscoveredHostNetbiosStatus.NoReply,
+    );
+
+    expect(goodDnsBadNetbios?.dnsHostnameStatus).toBe(
+      DiscoveredHostReverseDnsStatus.Timeout,
+    );
+    expect(goodDnsBadNetbios).not.toHaveProperty("netbiosNameStatus");
+  });
+
+  test("the codes and the names are cleaned independently", () => {
+    /*
+     * A rejected PTR name must not take the code with it, and a rejected
+     * code must not take a good name with it. The code on the first row is
+     * exactly the one a probe stamps for a PTR answer that normalised away.
+     */
+    const [rejectedName, rejectedCode] = normalizeDiscoveredHosts([
+      host({
+        dnsHostname: "51.0.0.10.in-addr.arpa",
+        dnsHostnameStatus: DiscoveredHostReverseDnsStatus.UnusableName,
+      }),
+      host({
+        ipAddress: "10.0.0.2",
+        netbiosName: "REG01",
+        netbiosNameStatus: "no reply" as DiscoveredHostNetbiosStatus,
+      }),
+    ]);
+
+    expect(rejectedName).not.toHaveProperty("dnsHostname");
+    expect(rejectedName?.dnsHostnameStatus).toBe(
+      DiscoveredHostReverseDnsStatus.UnusableName,
+    );
+
+    expect(rejectedCode?.netbiosName).toBe("reg01");
+    expect(rejectedCode).not.toHaveProperty("netbiosNameStatus");
+  });
+
+  test("a code on a host that has a name is kept, not judged", () => {
+    /*
+     * This function whitelists values; it does not decide what a row means.
+     * A valid code on a named row is harmless, because the explanation is
+     * only ever shown for a row whose name line is its address, and deleting
+     * it here would be a second copy of that rule.
+     */
+    const [normalized] = normalizeDiscoveredHosts([
+      host({
+        netbiosName: "REG01",
+        dnsHostnameStatus: DiscoveredHostReverseDnsStatus.NoRecord,
+      }),
+    ]);
+
+    expect(normalized?.dnsHostnameStatus).toBe(
+      DiscoveredHostReverseDnsStatus.NoRecord,
+    );
+  });
+
+  test("normalising is stable when applied twice, key for key", () => {
+    /*
+     * toStrictEqual, so a key left behind as `undefined` would fail it, and
+     * the key lists too, so a failure names the key.
+     */
+    const once: Array<DiscoveredNetworkDevice> = normalizeDiscoveredHosts([
+      host({
+        dnsHostnameStatus: DiscoveredHostReverseDnsStatus.ServerFailure,
+        netbiosNameStatus: DiscoveredHostNetbiosStatus.SkippedGlobalProbe,
+      }),
+      host({
+        ipAddress: "10.0.0.2",
+        dnsHostnameStatus: "server_failure" as DiscoveredHostReverseDnsStatus,
+        netbiosNameStatus: {} as unknown as DiscoveredHostNetbiosStatus,
+      }),
+      host({ ipAddress: "10.0.0.3", dnsHostnameStatus: undefined }),
+    ]);
+    const twice: Array<DiscoveredNetworkDevice> =
+      normalizeDiscoveredHosts(once);
+
+    expect(twice).toStrictEqual(once);
+    expect(
+      twice.map((entry: DiscoveredNetworkDevice): Array<string> => {
+        return Object.keys(entry).sort();
+      }),
+    ).toEqual([
+      ["dnsHostnameStatus", "ipAddress", "netbiosNameStatus"],
+      ["ipAddress"],
+      ["ipAddress"],
+    ]);
+  });
+
+  test("the codes survive a JSON round trip of the normalised rows", () => {
+    /*
+     * The normalised rows are what the server's auto-import engine works
+     * from and what a re-serialised response carries. The codes are plain
+     * strings, so nothing is lost or reshaped on the way.
+     */
+    const once: Array<DiscoveredNetworkDevice> = normalizeDiscoveredHosts([
+      host({
+        dnsHostnameStatus: DiscoveredHostReverseDnsStatus.SkippedNoResolver,
+        netbiosNameStatus: DiscoveredHostNetbiosStatus.SkippedHostCap,
+      }),
+    ]);
+    const roundTripped: Array<DiscoveredNetworkDevice> = JSON.parse(
+      JSON.stringify(once),
+    ) as Array<DiscoveredNetworkDevice>;
+
+    expect(normalizeDiscoveredHosts(roundTripped)).toStrictEqual(once);
+  });
+
+  test("the row the caller passed in is not changed", () => {
+    /*
+     * The dialog normalises the scan's stored array on every render. If
+     * this deleted keys from the rows it was handed, the stored copy would
+     * change underneath the next reader.
+     */
+    const raw: DiscoveredNetworkDevice = host({
+      dnsHostnameStatus: "junk" as DiscoveredHostReverseDnsStatus,
+      netbiosNameStatus: DiscoveredHostNetbiosStatus.NoReply,
+    });
+
+    const [normalized] = normalizeDiscoveredHosts([raw]);
+
+    expect(normalized).not.toBe(raw);
+    expect(normalized).not.toHaveProperty("dnsHostnameStatus");
+    expect(raw.dnsHostnameStatus).toBe("junk");
+    expect(raw.netbiosNameStatus).toBe(DiscoveredHostNetbiosStatus.NoReply);
+  });
+
+  test("a row marked registered because of another row keeps its codes", () => {
+    /*
+     * The registered-address pass rebuilds the rows it flips. The codes on
+     * those rows must come through it.
+     */
+    const result: Array<DiscoveredNetworkDevice> = normalizeDiscoveredHosts([
+      host({
+        ipAddress: "10.0.0.40",
+        isAlreadyRegistered: false,
+        dnsHostnameStatus: DiscoveredHostReverseDnsStatus.Refused,
+        netbiosNameStatus: DiscoveredHostNetbiosStatus.NoUsableName,
+      }),
+      host({ ipAddress: "10.0.0.40", isAlreadyRegistered: true }),
+    ]);
+
+    expect(result[0]).toStrictEqual({
+      ipAddress: "10.0.0.40",
+      isAlreadyRegistered: true,
+      dnsHostnameStatus: DiscoveredHostReverseDnsStatus.Refused,
+      netbiosNameStatus: DiscoveredHostNetbiosStatus.NoUsableName,
+    });
+  });
+
+  test("cleaning the codes leaves the row's other fields alone", () => {
+    const [normalized] = normalizeDiscoveredHosts([
+      {
+        ipAddress: " 10.16.42.51 ",
+        snmpReachable: false,
+        isAlreadyRegistered: false,
+        sysDescr: "KDS terminal",
+        dnsHostnameStatus: DiscoveredHostReverseDnsStatus.Timeout,
+        netbiosNameStatus: "?" as DiscoveredHostNetbiosStatus,
+      },
+    ]);
+
+    expect(normalized).toStrictEqual({
+      ipAddress: "10.16.42.51",
+      snmpReachable: false,
+      isAlreadyRegistered: false,
+      sysDescr: "KDS terminal",
+      dnsHostnameStatus: DiscoveredHostReverseDnsStatus.Timeout,
+    });
+  });
+});

package/Tests/Utils/NetworkDiscovery/DiscoveryReverseDnsChain.test.ts

@@ -7,6 +7,16 @@ import {
   getDiscoveredHostDisplayName,
 } from "../../../Utils/NetworkDiscovery/DiscoveredDeviceBuilder";
 import { normalizeDiscoveredHosts } from "../../../Utils/NetworkDiscovery/DiscoveredHostUtil";
+import {
+  DiscoveredHostNamingExplanation,
+  REVERSE_DNS_NOT_RECORDED_SENTENCE,
+  explainUnnamedDiscoveredHost,
+} from "../../../Utils/NetworkDiscovery/DiscoveredHostNamingDiagnosis";
+import { DiscoveryScanStatus } from "../../../Utils/NetworkDiscovery/DiscoveryScanStatus";
+import {
+  DiscoveredHostNetbiosStatus,
+  DiscoveredHostReverseDnsStatus,
+} from "../../../Types/NetworkDevice/DiscoveredHostNamingStatus";
 import NetworkDevice from "../../../Models/DatabaseModels/NetworkDevice";
 import NetworkDeviceDiscoveryScan, {
   DiscoveredNetworkDevice,
@@ -521,6 +531,13 @@ describe("Reverse DNS, probe payload to created NetworkDevice", () => {
      * a root dot is stripped, a padded address is trimmed, a numeric sysName
      * is blanked, and a rejected PTR key is deleted. A payload that was
      * already clean would make this test pass no matter what.
+     *
+     * The last two rows also carry the naming status codes of issue #3916,
+     * one valid and one junk each, so the first pass deletes a code from
+     * each field and keeps one in each. Those keys decide whether a row
+     * reads as "the naming passes ran" in the Review dialog, so a code that
+     * came back as `undefined` on the second pass would be exactly the
+     * split reading this test exists for.
      */
     const payload: Array<unknown> = [
       {
@@ -528,11 +545,18 @@ describe("Reverse DNS, probe payload to created NetworkDevice", () => {
         snmpReachable: false,
         dnsHostname: "hq-router-01.corp.example.net.",
       },
-      { ipAddress: " 10.18.166.53 ", sysName: 42 },
+      {
+        ipAddress: " 10.18.166.53 ",
+        sysName: 42,
+        dnsHostnameStatus: "TIMEOUT",
+        netbiosNameStatus: DiscoveredHostNetbiosStatus.NoReply,
+      },
       {
         ipAddress: "10.18.166.54",
         snmpReachable: false,
         dnsHostname: "in-addr.arpa",
+        dnsHostnameStatus: DiscoveredHostReverseDnsStatus.UnusableName,
+        netbiosNameStatus: 7,
       },
     ];
 
@@ -567,6 +591,32 @@ describe("Reverse DNS, probe payload to created NetworkDevice", () => {
     expect(once[2]).not.toHaveProperty("dnsHostname");
     expect(twice[2]).not.toHaveProperty("dnsHostname");
 
+    /*
+     * The exact keys each row ends with, the two naming status codes
+     * included: the junk ones gone, the valid ones kept, and no row gaining
+     * a key it did not arrive with.
+     */
+    expect(
+      once.map((host: DiscoveredNetworkDevice): Array<string> => {
+        return Object.keys(host).sort();
+      }),
+    ).toEqual([
+      ["dnsHostname", "ipAddress", "snmpReachable"],
+      ["ipAddress", "netbiosNameStatus", "sysName"],
+      ["dnsHostnameStatus", "ipAddress", "snmpReachable"],
+    ]);
+
+    for (const pass of [once, twice]) {
+      expect(pass[1]).not.toHaveProperty("dnsHostnameStatus");
+      expect(pass[1]?.netbiosNameStatus).toBe(
+        DiscoveredHostNetbiosStatus.NoReply,
+      );
+      expect(pass[2]?.dnsHostnameStatus).toBe(
+        DiscoveredHostReverseDnsStatus.UnusableName,
+      );
+      expect(pass[2]).not.toHaveProperty("netbiosNameStatus");
+    }
+
     const namesOnce: Array<string> = once.map(
       (host: DiscoveredNetworkDevice): string => {
         return buildDeviceName(host, FULL_NAMES);
@@ -1703,3 +1753,288 @@ describe("NetBIOS names, probe payload to created NetworkDevice", () => {
     expect(retry.dnsName).toBeUndefined();
   });
 });
+
+/*
+ * OneUptime issue #3916 — why a host is listed by its address.
+ *
+ * The probe now stamps a short code on each host it could not name: what
+ * the reverse-DNS lookup came back with, and what NetBIOS did. The Review
+ * dialog turns those into the sentence beside the address. This block runs
+ * the codes down the same path the names take — payload, jsonb,
+ * normalizeDiscoveredHosts, then the row's name and its explanation — and
+ * pins the joints:
+ *
+ *   - the normaliser and the explanation read the codes the same way, so a
+ *     junk code cannot mean "a code" to one and "no code" to the other;
+ *   - the explanation is shown on exactly the rows whose name is their
+ *     address;
+ *   - the codes never change what a host is called or what device is built.
+ */
+describe("Naming status codes, probe payload to the Review row's explanation", () => {
+  /*
+   * The scan the way the dialog really hands it over: through the model's
+   * serializer and back, so its status and settings are what a stored row
+   * yields.
+   */
+  function scanThroughSerializer(settings: {
+    isSnmpEnabled: boolean;
+    isNetbiosLookupEnabled: boolean;
+  }): NetworkDeviceDiscoveryScan {
+    const scan: NetworkDeviceDiscoveryScan = new NetworkDeviceDiscoveryScan();
+    scan.status = DiscoveryScanStatus.Completed;
+    scan.isSnmpEnabled = settings.isSnmpEnabled;
+    scan.isNetbiosLookupEnabled = settings.isNetbiosLookupEnabled;
+
+    const wire: JSONObject = JSON.parse(
+      JSON.stringify(
+        DatabaseBaseModel.toJSON(scan, NetworkDeviceDiscoveryScan),
+      ),
+    ) as JSONObject;
+
+    return DatabaseBaseModel.fromJSONObject(wire, NetworkDeviceDiscoveryScan);
+  }
+
+  /*
+   * The reporter's scan: ping only. NetBIOS names on, the wizard's default,
+   * since the issue does not say.
+   */
+  const REPORTERS_SCAN: NetworkDeviceDiscoveryScan = scanThroughSerializer({
+    isSnmpEnabled: false,
+    isNetbiosLookupEnabled: true,
+  });
+
+  /*
+   * The reporter's kitchen displays as a current probe would send them,
+   * plus the rows a probe of another version could leave in the column:
+   *
+   *   .51  named by PTR: a named host carries no codes
+   *   .52  the DNS server answered: no PTR record
+   *   .53  the DNS server did not answer in time
+   *   .54  the DNS server answered SERVFAIL
+   *   .55  a PTR answer that normalised away (an older probe stored the name
+   *        too), so the host is unnamed, with the code that says why
+   *   .56  a code from a newer probe, which this build does not know
+   *   .57  a row from an older probe: no codes at all
+   *   .58  a reverse-DNS code on a host NetBIOS then named
+   */
+  const PAYLOAD: Array<unknown> = [
+    {
+      ipAddress: "10.16.42.51",
+      snmpReachable: false,
+      dnsHostname: "WB0024KDS02.corp.example.com",
+    },
+    {
+      ipAddress: "10.16.42.52",
+      snmpReachable: false,
+      dnsHostnameStatus: "no-record",
+      netbiosNameStatus: "no-reply",
+    },
+    {
+      ipAddress: "10.16.42.53",
+      snmpReachable: false,
+      dnsHostnameStatus: "timeout",
+      netbiosNameStatus: "no-reply",
+    },
+    {
+      ipAddress: "10.16.42.54",
+      snmpReachable: false,
+      dnsHostnameStatus: "server-failure",
+      netbiosNameStatus: "no-reply",
+    },
+    {
+      ipAddress: "10.16.42.55",
+      snmpReachable: false,
+      dnsHostname: "55.42.16.10.in-addr.arpa",
+      dnsHostnameStatus: "unusable-name",
+      netbiosNameStatus: "no-usable-name",
+    },
+    {
+      ipAddress: "10.16.42.56",
+      snmpReachable: false,
+      dnsHostnameStatus: "dnssec-bogus",
+      netbiosNameStatus: "no-reply",
+    },
+    { ipAddress: "10.16.42.57", snmpReachable: false },
+    {
+      ipAddress: "10.16.42.58",
+      snmpReachable: false,
+      dnsHostnameStatus: "no-record",
+      netbiosName: "WB0024KDS08",
+    },
+  ];
+
+  function explanationsOf(
+    hosts: Array<DiscoveredNetworkDevice>,
+  ): Array<DiscoveredHostNamingExplanation | undefined> {
+    return hosts.map(
+      (
+        host: DiscoveredNetworkDevice,
+      ): DiscoveredHostNamingExplanation | undefined => {
+        return explainUnnamedDiscoveredHost({
+          host: host,
+          scan: REPORTERS_SCAN,
+          isGlobalProbe: false,
+        });
+      },
+    );
+  }
+
+  it("keeps the scan's settings and status through the serializer", () => {
+    expect(REPORTERS_SCAN.status).toBe(DiscoveryScanStatus.Completed);
+    expect(REPORTERS_SCAN.isSnmpEnabled).toBe(false);
+    expect(REPORTERS_SCAN.isNetbiosLookupEnabled).toBe(true);
+  });
+
+  it("stores every code a current probe sends, and drops the one this build does not know", () => {
+    const hosts: Array<DiscoveredNetworkDevice> = hostsFromPayload(PAYLOAD);
+
+    expect(
+      hosts.map((host: DiscoveredNetworkDevice): Array<unknown> => {
+        return [host.dnsHostnameStatus, host.netbiosNameStatus];
+      }),
+    ).toEqual([
+      [undefined, undefined],
+      [
+        DiscoveredHostReverseDnsStatus.NoRecord,
+        DiscoveredHostNetbiosStatus.NoReply,
+      ],
+      [
+        DiscoveredHostReverseDnsStatus.Timeout,
+        DiscoveredHostNetbiosStatus.NoReply,
+      ],
+      [
+        DiscoveredHostReverseDnsStatus.ServerFailure,
+        DiscoveredHostNetbiosStatus.NoReply,
+      ],
+      [
+        DiscoveredHostReverseDnsStatus.UnusableName,
+        DiscoveredHostNetbiosStatus.NoUsableName,
+      ],
+      [undefined, DiscoveredHostNetbiosStatus.NoReply],
+      [undefined, undefined],
+      [DiscoveredHostReverseDnsStatus.NoRecord, undefined],
+    ]);
+
+    // Deleted, not left behind holding undefined.
+    expect(hosts[5]).not.toHaveProperty("dnsHostnameStatus");
+    expect(hosts[6]).not.toHaveProperty("dnsHostnameStatus");
+    expect(hosts[6]).not.toHaveProperty("netbiosNameStatus");
+  });
+
+  it("explains each unnamed display by its own lookup, and the named ones not at all", () => {
+    const explanations: Array<DiscoveredHostNamingExplanation | undefined> =
+      explanationsOf(hostsFromPayload(PAYLOAD));
+
+    // Named by PTR, and by NetBIOS: no hint.
+    expect(explanations[0]).toBeUndefined();
+    expect(explanations[7]).toBeUndefined();
+
+    /*
+     * The three the issue could not tell apart. The exact sentences are
+     * pinned in DiscoveredHostNamingDiagnosis.test.ts; this only checks that
+     * each row reached the one for its own code.
+     */
+    expect(explanations[1]?.text).toContain("no PTR record");
+    expect(explanations[2]?.text).toContain("did not answer in time");
+    expect(explanations[3]?.text).toContain("SERVFAIL");
+    expect(explanations[4]?.text).toContain("not a valid hostname");
+
+    for (const index of [1, 2, 3, 4]) {
+      expect(explanations[index]?.text).not.toContain(
+        REVERSE_DNS_NOT_RECORDED_SENTENCE,
+      );
+    }
+
+    /*
+     * The unknown code and the older probe's row both say only that no name
+     * was recorded, and say it the same way.
+     */
+    expect(explanations[5]?.text).toContain(REVERSE_DNS_NOT_RECORDED_SENTENCE);
+    expect(explanations[6]?.text).toContain(REVERSE_DNS_NOT_RECORDED_SENTENCE);
+    expect(explanations[5]?.text).not.toContain("PTR");
+    expect(explanations[6]?.text).not.toContain("PTR");
+  });
+
+  it("explains a row the same from the raw stored jsonb as from the normalised row", () => {
+    /*
+     * The explanation reads the codes through the same whitelist the
+     * normaliser applies, so handing it an un-normalised row changes
+     * nothing. If the two whitelists ever drifted, the unknown-code row
+     * would be where it showed.
+     */
+    expect(explanationsOf(storedScanResults(PAYLOAD))).toStrictEqual(
+      explanationsOf(hostsFromPayload(PAYLOAD)),
+    );
+  });
+
+  it("shows the explanation on exactly the rows named by their address", () => {
+    const hosts: Array<DiscoveredNetworkDevice> = hostsFromPayload(PAYLOAD);
+    const explanations: Array<DiscoveredHostNamingExplanation | undefined> =
+      explanationsOf(hosts);
+
+    hosts.forEach((host: DiscoveredNetworkDevice, index: number) => {
+      expect(Boolean(explanations[index])).toBe(
+        buildDeviceName(host, FULL_NAMES) === host.ipAddress,
+      );
+    });
+  });
+
+  it("names and builds the same devices with the codes as without them", () => {
+    /*
+     * The codes explain a name; they must never choose one. The same payload
+     * with every code stripped has to import identically.
+     */
+    const withoutCodes: Array<unknown> = PAYLOAD.map(
+      (entry: unknown): unknown => {
+        const copy: JSONObject = { ...(entry as JSONObject) };
+        delete copy["dnsHostnameStatus"];
+        delete copy["netbiosNameStatus"];
+        return copy;
+      },
+    );
+
+    expect(namesFromPayload(PAYLOAD)).toEqual(namesFromPayload(withoutCodes));
+    expect(namesFromPayload(PAYLOAD)).toEqual([
+      "WB0024KDS02.corp.example.com",
+      "10.16.42.52",
+      "10.16.42.53",
+      "10.16.42.54",
+      "10.16.42.55",
+      "10.16.42.56",
+      "10.16.42.57",
+      "wb0024kds08",
+    ]);
+
+    expect(deviceHostnames(devicesFromPayload(PAYLOAD))).toEqual(
+      deviceHostnames(devicesFromPayload(withoutCodes)),
+    );
+  });
+
+  it("never carries a code into the created device", () => {
+    /*
+     * A code is a note about one scan's lookup, not a property of the
+     * device. Nothing of it may reach the NetworkDevice row an import
+     * creates.
+     */
+    for (const device of devicesFromPayload(PAYLOAD)) {
+      const stored: string = JSON.stringify(
+        DatabaseBaseModel.toJSON(device, NetworkDevice),
+      );
+
+      // The serialised device is real: it carries the address it dials.
+      expect(stored).toContain(`"${device.hostname}"`);
+
+      for (const forbidden of [
+        "dnsHostnameStatus",
+        "netbiosNameStatus",
+        "no-record",
+        "server-failure",
+        "unusable-name",
+        "no-reply",
+        "no-usable-name",
+      ]) {
+        expect(stored).not.toContain(forbidden);
+      }
+    }
+  });
+});