Rename Resource/ResourceGroup via PutAsync + EntityPropertyWrite for safe hidden-field writes

[davidnmbond]

Why

Surfaced while renaming ~294 LogicMonitor ping-check resources (PS-3019). Two things needed proving/adding:

1. Rename works via PutAsync<T>. Resource and ResourceGroup are both IdentifiedItem, IHasEndpoint, so PutAsync already supports them. This adds integration tests that prove it, and captures a real footgun: on uptimepingcheck devices a rename must set both Name and DisplayName (a DisplayName-only change silently no-ops), while the ping target (Host) is preserved.

2. Safe hidden-field writes. LogicMonitor masks secret custom properties (snmp.community, *.pass, *.key) as ******** on read, so round-tripping a whole object via PUT would write the mask back and clobber the real value. This adds EntityPropertyWrite — the admin-gated, config-as-code shape:

   [ { "type": "resourceGroup", "id": 1234, "name": "snmp.community", "value": "public" } ]

   plus SetCustomPropertyAsync(EntityPropertyWrite, …) / SetCustomPropertiesAsync(…), which write one field at a time and never send the mask.

Changes

• New: EntityPropertyWrite, EntityPropertyWriteTargetType (LogicMonitor.Api/Resources).
• New: LogicMonitorClient.SetCustomPropertyAsync(EntityPropertyWrite, SetPropertyMode, ct) and SetCustomPropertiesAsync(IEnumerable<EntityPropertyWrite>, …) — route to the existing per-field property setters.
• Tests (unit, portal-free): EntityPropertyWriteTests — config deserialisation + endpoint mapping (4 tests, passing).
• Tests (integration, live portal): ResourceRenameTests — PutAsync renames a ResourceGroup; PutAsync renames an uptime ping check (Name+DisplayName, Host preserved, skips if Uptime not enabled); hidden field written via EntityPropertyWrite.

Notes

• Full solution builds clean (warnings-as-errors); unit tests pass. Integration tests require a live portal (creds via user secrets) and will run in CI.

🤖 Generated with Claude Code

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 high · 1 medium

Alerts:
⚠ 2 issues (≤ 0 issues of at least minor severity)

Results:
2 new issues

Category	Results
Security	1 high
Complexity	1 medium

View in Codacy

🟢 Metrics 18 complexity

Metric	Results
Complexity	18

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[davidnmbond]

Empirical result: full PUT does not clobber Resource/ResourceGroup secrets

Ran the clobber experiment on a live portal to settle the masked-secret concern:

1. Created a throwaway device with test.pass=SuperSecret123 (+ unhide.properties=test.pass).
2. Deployed a reveal PropertySource (AppliesTo unhide.properties) that echoes nominated hidden props to auto.* fingerprints (md5/len/head) — letting us see past the ******** API mask.
3. Baseline: auto.unhide.result.0 = test.pass|len=14|md5=28db9e12… ✅ (collector script gets the real value).
4. Did a full-object GET → PUT round-trip (body carried test.pass="********", ?ignoreReference=true — exactly what PutAsync<Resource> sends).
5. Planted a fresh-run marker (new prop via a per-field write) to prove the PropertySource re-ran after the PUT, defeating stale-value ambiguity.
6. Fresh read: test.pass still len=14 md5=28db9e12… head=Su → SuperSecret123 preserved, not clobbered.

Conclusion: LogicMonitor treats the ******** mask as leave unchanged on a device/group PUT, so PutAsync-based rename is secret-safe. Docs/comments in this PR corrected to say so (the earlier "PUT clobbers" wording came from a NetScan credentials.custom incident — a different path that is not covered here and still warrants caution).

EntityPropertyWrite stays as the admin-gated, config-as-code way to set/rotate hidden fields (caller supplies the real value). Test resource + PropertySource were cleaned up after the run.