@oneuptime/common 14.0.3 → 14.0.5

package/Server/Services/OpenTelemetryIngestService.ts

@@ -25,6 +25,7 @@ import KubernetesCluster from "../../Models/DatabaseModels/KubernetesCluster";
 import ProxmoxCluster from "../../Models/DatabaseModels/ProxmoxCluster";
 import VMwareVCenter from "../../Models/DatabaseModels/VMwareVCenter";
 import CephCluster from "../../Models/DatabaseModels/CephCluster";
+import DatabaseServer from "../../Models/DatabaseModels/DatabaseServer";
 import DockerSwarmCluster from "../../Models/DatabaseModels/DockerSwarmCluster";
 import ServerlessFunction from "../../Models/DatabaseModels/ServerlessFunction";
 import CloudResource from "../../Models/DatabaseModels/CloudResource";
@@ -37,6 +38,7 @@ import KubernetesClusterService from "./KubernetesClusterService";
 import ProxmoxClusterService from "./ProxmoxClusterService";
 import VMwareVCenterService from "./VMwareVCenterService";
 import CephClusterService from "./CephClusterService";
+import DatabaseServerService from "./DatabaseServerService";
 import DockerSwarmClusterService from "./DockerSwarmClusterService";
 import ServerlessFunctionService from "./ServerlessFunctionService";
 import CloudResourceService from "./CloudResourceService";
@@ -1060,6 +1062,23 @@ export default class OTelIngestService {
         telemetryRetentionConfig: cluster?.telemetryRetentionConfig ?? null,
       };
     }
+    if (primaryEntityType === ServiceType.DatabaseServer) {
+      const databaseServer: DatabaseServer | null =
+        await DatabaseServerService.findOneById({
+          id: resourceId,
+          select: {
+            retainTelemetryDataForDays: true,
+            telemetryRetentionConfig: true,
+          },
+          props: { isRoot: true },
+        });
+      return {
+        retainTelemetryDataForDays:
+          databaseServer?.retainTelemetryDataForDays ?? null,
+        telemetryRetentionConfig:
+          databaseServer?.telemetryRetentionConfig ?? null,
+      };
+    }
     if (primaryEntityType === ServiceType.DockerSwarmCluster) {
       const cluster: DockerSwarmCluster | null =
         await DockerSwarmClusterService.findOneById({

package/Server/Services/PodmanResourceService.ts

@@ -39,6 +39,19 @@ export interface ParsedPodmanContainer {
   cpuPercent: number | null;
   memoryBytes: number | null;
   observedAt: Date;
+  /*
+   * The container labels the agent copies onto its metrics (Compose /
+   * Testcontainers keys, see CONTAINER_CLASSIFIER_LABEL_KEYS): MERGED into
+   * the row's labels, never replacing what the inventory snapshot wrote.
+   * Null / omitted leaves the labels alone.
+   */
+  labels?: JSONObject | null | undefined;
+  /*
+   * When the container's current run started (metric time − container.uptime).
+   * Fills an empty resourceCreationTimestamp, and moves it forward when
+   * the container was restarted or recreated under the same name.
+   */
+  startedAt?: Date | null | undefined;
 }
 
 export interface ParsedPodmanResource {
@@ -141,7 +154,7 @@ export class Service extends DatabaseService<Model> {
 
       for (const c of chunk) {
         valueFragments.push(
-          `($${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}::numeric, $${p++}::bigint, $${p++}::timestamptz, $${p++}::timestamptz, $${p++})`,
+          `($${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}::numeric, $${p++}::bigint, $${p++}::timestamptz, $${p++}::timestamptz, $${p++}, $${p++}::jsonb, $${p++}::timestamptz)`,
         );
         params.push(
           data.projectId.toString(),
@@ -160,15 +173,27 @@ export class Service extends DatabaseService<Model> {
           c.observedAt,
           c.observedAt,
           0, // version (BaseModel @VersionColumn)
+          c.labels && Object.keys(c.labels).length > 0
+            ? JSON.stringify(c.labels)
+            : null,
+          c.startedAt || null,
         );
       }
 
+      /*
+       * The same container name with a different id is a recreated
+       * container: its labels and start time replace the old ones. Else
+       * the metric labels are merged into whatever the inventory wrote,
+       * and the start time only moves forward (a restart) — by more than
+       * a minute, so clock jitter between scrapes never rewrites it.
+       */
       const sql: string = `
         INSERT INTO "PodmanResource" (
           "projectId", "podmanHostId", "kind", "name",
           "containerId", "imageName", "state",
           "latestCpuPercent", "latestMemoryBytes",
-          "metricsUpdatedAt", "lastSeenAt", "version"
+          "metricsUpdatedAt", "lastSeenAt", "version",
+          "labels", "resourceCreationTimestamp"
         )
         VALUES ${valueFragments.join(", ")}
         ON CONFLICT ("projectId", "podmanHostId", "kind", "name")
@@ -180,6 +205,22 @@ export class Service extends DatabaseService<Model> {
           "latestMemoryBytes" = COALESCE(EXCLUDED."latestMemoryBytes", "PodmanResource"."latestMemoryBytes"),
           "metricsUpdatedAt" = EXCLUDED."metricsUpdatedAt",
           "lastSeenAt" = EXCLUDED."lastSeenAt",
+          "labels" = CASE
+            WHEN EXCLUDED."labels" IS NULL THEN "PodmanResource"."labels"
+            WHEN lower(left(EXCLUDED."containerId", 12)) <> lower(left("PodmanResource"."containerId", 12))
+              THEN EXCLUDED."labels"
+            WHEN jsonb_typeof("PodmanResource"."labels") = 'object'
+              THEN "PodmanResource"."labels" || EXCLUDED."labels"
+            ELSE EXCLUDED."labels"
+          END,
+          "resourceCreationTimestamp" = CASE
+            WHEN EXCLUDED."resourceCreationTimestamp" IS NULL THEN "PodmanResource"."resourceCreationTimestamp"
+            WHEN "PodmanResource"."resourceCreationTimestamp" IS NULL
+              OR lower(left(EXCLUDED."containerId", 12)) <> lower(left("PodmanResource"."containerId", 12))
+              OR EXCLUDED."resourceCreationTimestamp" > "PodmanResource"."resourceCreationTimestamp" + interval '1 minute'
+              THEN EXCLUDED."resourceCreationTimestamp"
+            ELSE "PodmanResource"."resourceCreationTimestamp"
+          END,
           "updatedAt" = now()
         WHERE EXCLUDED."lastSeenAt" >= "PodmanResource"."lastSeenAt"
       `;

package/Server/Services/ScheduledMaintenanceReminderRuleService.ts

@@ -102,10 +102,34 @@ export class Service extends DatabaseService<Model> {
     return onDelete;
   }
 
+  /*
+   * Re-matches the reminder rule for every open scheduled maintenance in the
+   * project and rewrites its nextReminderNotificationAt.
+   *
+   * Without options that is one read of at most LIMIT_MAX open scheduled
+   * maintenances, and it must stay one: the rule create, update and delete
+   * hooks run it inside the API request.
+   *
+   * `onlyWithoutNextReminder` narrows that to open scheduled maintenances with
+   * no reminder scheduled at all, and reads every one of them, in `_id`-ordered
+   * pages of LIMIT_MAX. It exists for backfills (see the
+   * ScheduleRemindersMissedByReminderRuleLookup data migration), which run in a
+   * worker rather than a request and must reach every such scheduled
+   * maintenance of the project, however many there are. The pages are cursored
+   * by `_id`, not offset, because refreshing a scheduled maintenance can take
+   * it out of the set being paged. A scheduled maintenance that already has a
+   * timestamp is left alone, because re-scheduling it would push a reminder
+   * that is due, or overdue, one full interval later.
+   */
   @CaptureSpan()
   public async refreshSchedulesForOpenScheduledMaintenances(
     projectId: ObjectID,
+    options?: { onlyWithoutNextReminder?: boolean | undefined } | undefined,
   ): Promise<void> {
+    const onlyWithoutNextReminder: boolean = Boolean(
+      options?.onlyWithoutNextReminder,
+    );
+
     try {
       const openStates: Array<ScheduledMaintenanceState> =
         await ScheduledMaintenanceStateService.findBy({
@@ -133,34 +157,55 @@ export class Service extends DatabaseService<Model> {
         return;
       }
 
-      const openScheduledMaintenances: Array<ScheduledMaintenance> =
-        await ScheduledMaintenanceService.findBy({
-          query: {
-            projectId: projectId,
-            currentScheduledMaintenanceStateId: QueryHelper.any(openStateIds),
-          },
-          select: {
-            _id: true,
-          },
-          limit: LIMIT_MAX,
-          skip: 0,
-          props: {
-            isRoot: true,
-          },
-        });
+      let afterId: ObjectID | null = null;
 
-      for (const scheduledMaintenance of openScheduledMaintenances) {
-        try {
-          await ScheduledMaintenanceService.refreshReminderSchedule({
-            scheduledMaintenanceId: scheduledMaintenance.id!,
+      while (true) {
+        const openScheduledMaintenances: Array<ScheduledMaintenance> =
+          await this.findOpenScheduledMaintenances({
             projectId: projectId,
+            openStateIds: openStateIds,
+            onlyWithoutNextReminder: onlyWithoutNextReminder,
+            afterId: afterId,
           });
-        } catch (error) {
-          logger.error(
-            `Failed to refresh reminder schedule for scheduled maintenance ${scheduledMaintenance.id}: ${error}`,
-            { projectId: projectId?.toString() } as LogAttributes,
+
+        for (const scheduledMaintenance of openScheduledMaintenances) {
+          try {
+            await ScheduledMaintenanceService.refreshReminderSchedule({
+              scheduledMaintenanceId: scheduledMaintenance.id!,
+              projectId: projectId,
+            });
+          } catch (error) {
+            logger.error(
+              `Failed to refresh reminder schedule for scheduled maintenance ${scheduledMaintenance.id}: ${error}`,
+              { projectId: projectId?.toString() } as LogAttributes,
+            );
+          }
+        }
+
+        // Without the option, the one read above is all there is.
+        if (
+          !onlyWithoutNextReminder ||
+          openScheduledMaintenances.length < LIMIT_MAX
+        ) {
+          return;
+        }
+
+        const lastId: ObjectID | null =
+          openScheduledMaintenances[openScheduledMaintenances.length - 1]!.id;
+
+        if (!lastId || (afterId && lastId.toString() <= afterId.toString())) {
+          /*
+           * A full page whose last row does not move the cursor forward
+           * would be read again forever. Not reachable with `_id ASC` and a
+           * `> afterId` filter; guarded so a broken sort cannot hang the
+           * backfill.
+           */
+          throw new Error(
+            "the open scheduled maintenance page did not advance its _id cursor",
           );
         }
+
+        afterId = lastId;
       }
     } catch (error) {
       logger.error(
@@ -170,6 +215,45 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /*
+   * One read of the project's open scheduled maintenances: those whose current
+   * state is one of `openStateIds`. Both paths of
+   * refreshSchedulesForOpenScheduledMaintenances read through here, so what
+   * "open" means is written once.
+   *
+   * With `onlyWithoutNextReminder`, only those with no reminder scheduled,
+   * `_id` ascending and after `afterId` when there is one. Without it, no
+   * cursor and the default order: the read the rule hooks have always made.
+   */
+  private async findOpenScheduledMaintenances(data: {
+    projectId: ObjectID;
+    openStateIds: Array<ObjectID>;
+    onlyWithoutNextReminder: boolean;
+    afterId: ObjectID | null;
+  }): Promise<Array<ScheduledMaintenance>> {
+    return await ScheduledMaintenanceService.findBy({
+      query: {
+        projectId: data.projectId,
+        currentScheduledMaintenanceStateId: QueryHelper.any(data.openStateIds),
+        ...(data.onlyWithoutNextReminder
+          ? { nextReminderNotificationAt: QueryHelper.isNull() }
+          : {}),
+        ...(data.afterId ? { _id: QueryHelper.greaterThan(data.afterId) } : {}),
+      },
+      select: {
+        _id: true,
+      },
+      ...(data.onlyWithoutNextReminder
+        ? { sort: { _id: SortOrder.Ascending } }
+        : {}),
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
   @CaptureSpan()
   public async findMatchingRule(data: {
     projectId: ObjectID;

package/Server/Services/ServiceService.ts

@@ -502,7 +502,7 @@ export class Service extends DatabaseService<Model> {
     };
 
     return crypto
-      .createHash("sha1")
+      .createHash("sha256")
       .update(JSON.stringify(normalized))
       .digest("hex");
   }

package/Server/Services/TelemetryUsageBillingService.ts

@@ -32,6 +32,7 @@ import KubernetesClusterService from "./KubernetesClusterService";
 import ProxmoxClusterService from "./ProxmoxClusterService";
 import VMwareVCenterService from "./VMwareVCenterService";
 import CephClusterService from "./CephClusterService";
+import DatabaseServerService from "./DatabaseServerService";
 import IoTFleetService from "./IoTFleetService";
 import Host from "../../Models/DatabaseModels/Host";
 import DockerHost from "../../Models/DatabaseModels/DockerHost";
@@ -41,6 +42,7 @@ import ProxmoxCluster from "../../Models/DatabaseModels/ProxmoxCluster";
 import VMwareVCenter from "../../Models/DatabaseModels/VMwareVCenter";
 import IoTFleet from "../../Models/DatabaseModels/IoTFleet";
 import CephCluster from "../../Models/DatabaseModels/CephCluster";
+import DatabaseServer from "../../Models/DatabaseModels/DatabaseServer";
 import ServiceType from "../../Types/Telemetry/ServiceType";
 import {
   AverageSpanRowSizeInBytes,
@@ -485,8 +487,8 @@ export class Service extends DatabaseService<Model> {
   /*
    * Map of resourceId -> retainTelemetryDataForDays for every resource in
    * the project that can own telemetry (Service, Host, DockerHost,
-   * KubernetesCluster, ProxmoxCluster, VMwareVCenter, CephCluster). Used to
-   * scale billed
+   * KubernetesCluster, ProxmoxCluster, VMwareVCenter, CephCluster,
+   * DatabaseServer). Used to scale billed
    * cost by the actual retention applied to each resource's telemetry.
    * Resources without an override (and the unattributed bucket) fall back
    * to the project default.
@@ -628,6 +630,31 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * Databases are mostly auto-discovered (collector, client spans,
+     * Kubernetes / Docker / Podman), so a project can hold hundreds of
+     * them. Only rows carrying an override matter here — read just those.
+     */
+    const databaseServers: Array<DatabaseServer> =
+      await DatabaseServerService.findBy({
+        query: {
+          projectId: projectId,
+          retainTelemetryDataForDays: QueryHelper.notNull(),
+        },
+        select: { _id: true, retainTelemetryDataForDays: true },
+        skip: 0,
+        limit: LIMIT_MAX,
+        props: { isRoot: true },
+      });
+    for (const databaseServer of databaseServers) {
+      if (databaseServer.id && databaseServer.retainTelemetryDataForDays) {
+        retentionByServiceId.set(
+          databaseServer.id.toString(),
+          databaseServer.retainTelemetryDataForDays,
+        );
+      }
+    }
+
     const iotFleets: Array<IoTFleet> = await IoTFleetService.findBy({
       query: { projectId: projectId },
       select: { _id: true, retainTelemetryDataForDays: true },

package/Server/Services/UserProjectSsoConsentService.ts

@@ -0,0 +1,74 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/UserProjectSsoConsent";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * See the model for what a row means. Written only from the confirmation link
+ * a project-SSO sign-in emails to the account's own address; read on every
+ * project-SSO sign-in on the hosted service.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  public async hasConsent(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<boolean> {
+    const count: PositiveNumber = await this.countBy({
+      query: {
+        userId: data.userId,
+        projectId: data.projectId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return count.toNumber() > 0;
+  }
+
+  /*
+   * Idempotent. Two clicks on the same link, or two links for the same
+   * project, must end with one row and no error for whoever clicked second.
+   */
+  @CaptureSpan()
+  public async recordConsent(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<void> {
+    if (await this.hasConsent(data)) {
+      return;
+    }
+
+    const consent: Model = new Model();
+    consent.userId = data.userId;
+    consent.projectId = data.projectId;
+
+    try {
+      await this.create({
+        data: consent,
+        props: {
+          isRoot: true,
+        },
+      });
+    } catch (err) {
+      /*
+       * Lost a race with a concurrent click: the unique index turned the
+       * second insert away, and the row it wanted is there. Anything else is
+       * a real failure.
+       */
+      if (await this.hasConsent(data)) {
+        return;
+      }
+
+      throw err;
+    }
+  }
+}
+
+export default new Service();

package/Server/Services/UserService.ts

@@ -799,13 +799,26 @@ export class Service extends DatabaseService<Model> {
    * `isMasterAdmin` on a self-service signup. It always assigns the column, so
    * an `isMasterAdmin: true` smuggled into the request body is overwritten
    * rather than honoured (signup creates with `isRoot: true`, which bypasses
-   * the column's empty `create: []` access control).
+   * the column's empty `create: []` access control). For the same reason it
+   * refuses a user that already carries an `_id`.
    */
   @CaptureSpan()
   public async createUserOnSignup(data: {
     user: Model;
     props: DatabaseCommonInteractionProps;
   }): Promise<Model> {
+    /*
+     * A signup is always a new row. TypeORM's save() turns an entity carrying
+     * an existing primary key into an UPDATE of that row, and this create runs
+     * as root, which DatabaseService.create exempts from its own supplied-id
+     * check -- so an `_id` reaching here would overwrite the email and password
+     * of whichever user it names instead of creating one. /signup builds its
+     * model from an allow-list that never includes `_id`; this is the backstop.
+     */
+    if (data.user._id) {
+      throw new BadDataException("An id cannot be supplied when signing up.");
+    }
+
     // Never inherited from the caller. Decided below, or not at all.
     data.user.isMasterAdmin = false;
 

package/Server/Types/Database/Permissions/OwnerTableRegistry.ts

@@ -38,6 +38,8 @@ import DockerSwarmClusterOwnerTeamService from "../../../Services/DockerSwarmClu
 import DockerSwarmClusterOwnerUserService from "../../../Services/DockerSwarmClusterOwnerUserService";
 import VMwareVCenterOwnerTeamService from "../../../Services/VMwareVCenterOwnerTeamService";
 import VMwareVCenterOwnerUserService from "../../../Services/VMwareVCenterOwnerUserService";
+import DatabaseServerOwnerTeamService from "../../../Services/DatabaseServerOwnerTeamService";
+import DatabaseServerOwnerUserService from "../../../Services/DatabaseServerOwnerUserService";
 import IoTFleetOwnerTeamService from "../../../Services/IoTFleetOwnerTeamService";
 import IoTFleetOwnerUserService from "../../../Services/IoTFleetOwnerUserService";
 import NetworkDeviceOwnerTeamService from "../../../Services/NetworkDeviceOwnerTeamService";
@@ -65,6 +67,7 @@ import ProxmoxClusterService from "../../../Services/ProxmoxClusterService";
 import CephClusterService from "../../../Services/CephClusterService";
 import DockerSwarmClusterService from "../../../Services/DockerSwarmClusterService";
 import VMwareVCenterService from "../../../Services/VMwareVCenterService";
+import DatabaseServerService from "../../../Services/DatabaseServerService";
 import IoTFleetService from "../../../Services/IoTFleetService";
 import NetworkDeviceService from "../../../Services/NetworkDeviceService";
 
@@ -306,6 +309,21 @@ const ownerTableRegistry: Map<string, OwnerTablePair> = new Map<
       modelService: VMwareVCenterService,
     },
   ],
+  [
+    /*
+     * Receiver batches (the collector / Database Agent) stamp the database
+     * server's id as the telemetry row's serviceId (serviceType
+     * DatabaseServer), so owning a database grants its telemetry.
+     */
+    "DatabaseServer",
+    {
+      ownerUserService: DatabaseServerOwnerUserService,
+      ownerTeamService: DatabaseServerOwnerTeamService,
+      fkColumn: "databaseServerId",
+      canOwnTelemetry: true,
+      modelService: DatabaseServerService,
+    },
+  ],
   [
     /*
      * IoT telemetry carries the fleet ID in primaryEntityId even though its

package/Server/Types/Database/QueryHelper.ts

@@ -28,9 +28,22 @@ export default class QueryHelper {
 
     return Raw(
       (alias: string) => {
+        /*
+         * SELECT builders hand Raw the unescaped `Alias.property` path and
+         * quote it afterwards, but only where the whole token is `Alias.<known
+         * property>`. `Alias."criteria"` is not such a token, so an unquoted
+         * qualifier reached Postgres as-is and folded to lowercase, which
+         * names no table in FROM ("missing FROM-clause entry for table
+         * "incidentreminderrule""). Quote the qualifier here instead.
+         *
+         * UPDATE and DELETE builders hand Raw the bare property name, with no
+         * alias, and there criteria stays a bare quoted column.
+         */
         const separatorIndex: number = alias.lastIndexOf(".");
         const qualifier: string =
-          separatorIndex >= 0 ? alias.slice(0, separatorIndex + 1) : "";
+          separatorIndex >= 0
+            ? `${QueryHelper.quoteIdentifier(alias.slice(0, separatorIndex))}.`
+            : "";
         const criteriaAlias: string = `${qualifier}"${criteriaColumnName}"`;
 
         return `((CASE WHEN ${criteriaAlias} IS NULL THEN COALESCE(${alias}, false) ELSE ${alias} IS NULL END) = :${rid})`;
@@ -41,6 +54,22 @@ export default class QueryHelper {
     );
   }
 
+  /*
+   * A Postgres quoted identifier. TypeORM 0.3 always hands Raw an unescaped
+   * alias; one that is already quoted is kept as is, defensively.
+   */
+  private static quoteIdentifier(identifier: string): string {
+    if (
+      identifier.length >= 2 &&
+      identifier.startsWith('"') &&
+      identifier.endsWith('"')
+    ) {
+      return identifier;
+    }
+
+    return `"${identifier.replace(/"/g, '""')}"`;
+  }
+
   @CaptureSpan()
   public static modulo(
     moduloBy: number,

package/Server/Utils/AI/Toolbox/ResourceTools.ts

@@ -11,6 +11,7 @@ import ServerlessFunction from "../../../../Models/DatabaseModels/ServerlessFunc
 import CloudResource from "../../../../Models/DatabaseModels/CloudResource";
 import IoTFleet from "../../../../Models/DatabaseModels/IoTFleet";
 import NetworkDevice from "../../../../Models/DatabaseModels/NetworkDevice";
+import DatabaseServer from "../../../../Models/DatabaseModels/DatabaseServer";
 import Metric from "../../../../Models/AnalyticsModels/Metric";
 import Log from "../../../../Models/AnalyticsModels/Log";
 import Span from "../../../../Models/AnalyticsModels/Span";
@@ -55,6 +56,7 @@ import ServerlessFunctionService from "../../../Services/ServerlessFunctionServi
 import CloudResourceService from "../../../Services/CloudResourceService";
 import IoTFleetService from "../../../Services/IoTFleetService";
 import NetworkDeviceService from "../../../Services/NetworkDeviceService";
+import DatabaseServerService from "../../../Services/DatabaseServerService";
 import MetricService from "../../../Services/MetricService";
 import LogAggregationService, {
   HistogramBucket,
@@ -66,7 +68,9 @@ import FindBy from "../../../Types/Database/FindBy";
 import QueryHelper from "../../../Types/Database/QueryHelper";
 import DatabaseRequestType from "../../../Types/BaseDatabase/DatabaseRequestType";
 import ModelPermission from "../../../Types/AnalyticsDatabase/ModelPermission";
-import { ResourceEntityScope } from "../../Telemetry/ResourceEntityFilter";
+import ResourceEntityFilter, {
+  ResourceEntityScope,
+} from "../../Telemetry/ResourceEntityFilter";
 import ToolResultSerializer, { SerializedResult } from "./Serializer";
 import {
   ObservabilityTool,
@@ -87,6 +91,17 @@ interface ResourceDescriptor {
   attributeKey?: string;
   keyFor?: (projectId: string, identifier: string) => string;
   runtime?: string;
+  /*
+   * For a resource whose telemetry is not named by one identifier (a
+   * Database owns several endpoints plus the pods / containers it runs as):
+   * its scope, resolved exactly the way the explorer's resource facet and
+   * the resource's own pages resolve it. Called only after the
+   * permission-checked parent read.
+   */
+  resolveResourceScopes?: (data: {
+    projectId: ObjectID;
+    id: ObjectID;
+  }) => Promise<Array<ResourceEntityScope>>;
 }
 
 /*
@@ -274,6 +289,30 @@ const RESOURCE_DESCRIPTORS: Record<AIResourceType, ResourceDescriptor> = {
       "lastPolledAt",
     ],
   },
+  [AIResourceType.DatabaseServer]: {
+    model: DatabaseServer,
+    findBy: (data: FindBy<BaseModel>) => {
+      return DatabaseServerService.findBy(data as never);
+    },
+    fields: [
+      "dbSystem",
+      "dbVersion",
+      "serverAddress",
+      "serverPort",
+      "discoverySource",
+      "instanceCount",
+      "collectorLastSeenAt",
+    ],
+    resolveResourceScopes: (data: {
+      projectId: ObjectID;
+      id: ObjectID;
+    }): Promise<Array<ResourceEntityScope>> => {
+      return ResourceEntityFilter.resolveScopes({
+        projectId: data.projectId,
+        selections: { databaseServerId: [data.id.toString()] },
+      });
+    },
+  },
 };
 
 function getResourceType(args: JSONObject): AIResourceType {
@@ -503,10 +542,33 @@ export function buildAIResourceTelemetryScope(data: {
   resource: JSONObject;
   projectId: ObjectID;
   signal: ResourceSignal;
+  // From the descriptor's resolveResourceScopes, when it has one.
+  resolvedScopes?: Array<ResourceEntityScope> | undefined;
 }): AIResourceTelemetryScope {
   const descriptor: ResourceDescriptor = RESOURCE_DESCRIPTORS[data.type];
   const note: string =
     "Scope is the parent resource; no individual child identity or namespace was selected. Missing telemetry is not evidence of health.";
+  if (data.type === AIResourceType.DatabaseServer) {
+    /*
+     * Only a resolved scope of THIS database is used; one that could not be
+     * resolved narrows to the row's own collector / agent data, never widens.
+     */
+    const scopes: Array<ResourceEntityScope> = (
+      data.resolvedScopes || []
+    ).filter((scope: ResourceEntityScope): boolean => {
+      return (
+        scope.entityIds.length === 1 &&
+        scope.entityIds[0] === data.id.toString()
+      );
+    });
+    return {
+      resourceScopes:
+        scopes.length > 0
+          ? scopes
+          : [{ entityIds: [data.id.toString()], entityKeys: [] }],
+      note: `${note} A database's telemetry is its own collector / Database Agent data plus everything carrying one of its endpoints or workload members: application database calls, and the logs and metrics of the pods and containers it runs as.`,
+    };
+  }
   if (data.type === AIResourceType.CloudResource) {
     const attributes: Record<string, string> = {};
     for (const [column, key] of [
@@ -707,6 +769,12 @@ export const QueryResourceTelemetryTool: ObservabilityTool = {
       resource: resources[0] as unknown as JSONObject,
       projectId: ctx.projectId,
       signal,
+      resolvedScopes: descriptor.resolveResourceScopes
+        ? await descriptor.resolveResourceScopes({
+            projectId: ctx.projectId,
+            id,
+          })
+        : undefined,
     });
     const target: AIChatCitationTarget = resourceTarget(type, id);
     const label: string = `${getAIResourceDefinition(type).label} ${signal}, ${startTime.toISOString()} – ${endTime.toISOString()}`;