@oneuptime/common 10.2.22 → 10.3.0

package/Server/Services/WorkflowOwnerRuleEngineService.ts

@@ -0,0 +1,216 @@
+import Label from "../../Models/DatabaseModels/Label";
+import Workflow from "../../Models/DatabaseModels/Workflow";
+import WorkflowOwnerRule from "../../Models/DatabaseModels/WorkflowOwnerRule";
+import WorkflowOwnerTeam from "../../Models/DatabaseModels/WorkflowOwnerTeam";
+import WorkflowOwnerUser from "../../Models/DatabaseModels/WorkflowOwnerUser";
+import WorkflowOwnerRuleService from "./WorkflowOwnerRuleService";
+import WorkflowOwnerTeamService from "./WorkflowOwnerTeamService";
+import WorkflowOwnerUserService from "./WorkflowOwnerUserService";
+import WorkflowService from "./WorkflowService";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger, { LogAttributes } from "../Utils/Logger";
+
+class WorkflowOwnerRuleEngineServiceClass {
+  /**
+   * Evaluates WorkflowOwnerRule rows for the given workflow and adds matched
+   * owner users / teams via WorkflowOwnerUserService / WorkflowOwnerTeamService.
+   * Rules with notifyOwners set notify the added owners; rules with notifyOwners
+   * off add silently.
+   */
+  @CaptureSpan()
+  public async applyRulesToWorkflow(workflow: Workflow): Promise<void> {
+    if (!workflow.id || !workflow.projectId) {
+      return;
+    }
+
+    try {
+      const rules: Array<WorkflowOwnerRule> =
+        await WorkflowOwnerRuleService.findBy({
+          query: {
+            projectId: workflow.projectId,
+            isEnabled: true,
+          },
+          props: { isRoot: true },
+          select: {
+            _id: true,
+            name: true,
+            notifyOwners: true,
+            workflowLabels: { _id: true },
+            workflowNamePattern: true,
+            workflowDescriptionPattern: true,
+            ownerUsers: { _id: true },
+            ownerTeams: { _id: true },
+          },
+          limit: 100,
+          skip: 0,
+        });
+
+      if (rules.length === 0) {
+        return;
+      }
+
+      const workflowWithDetails: Workflow | null =
+        await WorkflowService.findOneById({
+          id: workflow.id,
+          select: {
+            name: true,
+            description: true,
+            labels: { _id: true },
+          },
+          props: { isRoot: true },
+        });
+
+      if (!workflowWithDetails) {
+        return;
+      }
+
+      const usersByNotify: Map<boolean, Set<string>> = new Map([
+        [true, new Set()],
+        [false, new Set()],
+      ]);
+      const teamsByNotify: Map<boolean, Set<string>> = new Map([
+        [true, new Set()],
+        [false, new Set()],
+      ]);
+
+      const matchedRules: Array<WorkflowOwnerRule> = [];
+
+      for (const rule of rules) {
+        const matches: boolean = this.doesWorkflowMatchRule(
+          workflowWithDetails,
+          rule,
+        );
+        if (!matches) {
+          continue;
+        }
+        let ruleAddedAny: boolean = false;
+        const notify: boolean = rule.notifyOwners !== false;
+        for (const user of rule.ownerUsers || []) {
+          if (user.id) {
+            usersByNotify.get(notify)!.add(user.id.toString());
+            ruleAddedAny = true;
+          }
+        }
+        for (const team of rule.ownerTeams || []) {
+          if (team.id) {
+            teamsByNotify.get(notify)!.add(team.id.toString());
+            ruleAddedAny = true;
+          }
+        }
+        if (ruleAddedAny) {
+          matchedRules.push(rule);
+        }
+      }
+
+      if (matchedRules.length === 0) {
+        return;
+      }
+
+      for (const notify of [true, false]) {
+        const userIds: Set<string> = usersByNotify.get(notify)!;
+        const teamIds: Set<string> = teamsByNotify.get(notify)!;
+
+        for (const userId of userIds) {
+          const owner: WorkflowOwnerUser = new WorkflowOwnerUser();
+          owner.workflowId = workflow.id;
+          owner.projectId = workflow.projectId;
+          owner.userId = new ObjectID(userId);
+          owner.isOwnerNotified = !notify;
+          await WorkflowOwnerUserService.create({
+            data: owner,
+            props: { isRoot: true },
+          });
+        }
+
+        for (const teamId of teamIds) {
+          const owner: WorkflowOwnerTeam = new WorkflowOwnerTeam();
+          owner.workflowId = workflow.id;
+          owner.projectId = workflow.projectId;
+          owner.teamId = new ObjectID(teamId);
+          owner.isOwnerNotified = !notify;
+          await WorkflowOwnerTeamService.create({
+            data: owner,
+            props: { isRoot: true },
+          });
+        }
+      }
+
+      logger.debug(
+        `WorkflowOwnerRuleEngine added owners to workflow ${workflow.id}`,
+        { projectId: workflow.projectId.toString() } as LogAttributes,
+      );
+    } catch (error) {
+      logger.error(`Error applying workflow owner rules: ${error}`, {
+        projectId: workflow.projectId?.toString(),
+        workflowId: workflow.id?.toString(),
+      } as LogAttributes);
+    }
+  }
+
+  private doesWorkflowMatchRule(
+    workflow: Workflow,
+    rule: WorkflowOwnerRule,
+  ): boolean {
+    if (rule.workflowLabels && rule.workflowLabels.length > 0) {
+      if (!workflow.labels || workflow.labels.length === 0) {
+        return false;
+      }
+      const ruleLabelIds: Array<string> = rule.workflowLabels.map(
+        (l: Label) => {
+          return l.id?.toString() || "";
+        },
+      );
+      const labelIds: Array<string> = workflow.labels.map((l: Label) => {
+        return l.id?.toString() || "";
+      });
+      if (
+        !ruleLabelIds.some((id: string) => {
+          return labelIds.includes(id);
+        })
+      ) {
+        return false;
+      }
+    }
+
+    if (
+      rule.workflowNamePattern &&
+      (!workflow.name ||
+        !this.testRegex(rule.workflowNamePattern, workflow.name, rule))
+    ) {
+      return false;
+    }
+
+    if (
+      rule.workflowDescriptionPattern &&
+      (!workflow.description ||
+        !this.testRegex(
+          rule.workflowDescriptionPattern,
+          workflow.description,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    return true;
+  }
+
+  private testRegex(
+    pattern: string,
+    value: string,
+    rule: WorkflowOwnerRule,
+  ): boolean {
+    try {
+      const regex: RegExp = new RegExp(pattern, "i");
+      return regex.test(value);
+    } catch {
+      logger.warn(
+        `Invalid regex in workflow owner rule ${rule.id}: ${pattern}`,
+      );
+      return false;
+    }
+  }
+}
+
+export default new WorkflowOwnerRuleEngineServiceClass();

package/Server/Services/WorkflowOwnerRuleService.ts

@@ -0,0 +1,14 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/WorkflowOwnerRule";
+import { IsBillingEnabled } from "../EnvironmentConfig";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+    if (IsBillingEnabled) {
+      this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365);
+    }
+  }
+}
+
+export default new Service();

package/Server/Services/WorkflowOwnerTeamService.ts

@@ -0,0 +1,9 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/WorkflowOwnerTeam";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+export default new Service();

package/Server/Services/WorkflowOwnerUserService.ts

@@ -0,0 +1,9 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/WorkflowOwnerUser";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+export default new Service();

package/Server/Services/WorkflowService.ts

@@ -2,6 +2,8 @@ import { WorkflowHostname } from "../EnvironmentConfig";
 import ClusterKeyAuthorization from "../Middleware/ClusterKeyAuthorization";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
+import WorkflowLabelRuleEngineService from "./WorkflowLabelRuleEngineService";
+import WorkflowOwnerRuleEngineService from "./WorkflowOwnerRuleEngineService";
 import EmptyResponseData from "../../Types/API/EmptyResponse";
 import Protocol from "../../Types/API/Protocol";
 import Route from "../../Types/API/Route";
@@ -47,6 +49,34 @@ export class Service extends DatabaseService<Model> {
       createdItem.webhookSecretKey = secretKey;
     }
 
+    if (createdItem.projectId && createdItem.id) {
+      /*
+       * Run label rule first so rule-added labels are persisted before
+       * owner rules run. Owner rules re-fetch labels, so this lets owner
+       * rules key on rule-added labels.
+       */
+      Promise.resolve()
+        .then(async () => {
+          await WorkflowLabelRuleEngineService.applyRulesToWorkflow(
+            createdItem,
+          );
+        })
+        .then(async () => {
+          await WorkflowOwnerRuleEngineService.applyRulesToWorkflow(
+            createdItem,
+          );
+        })
+        .catch((error: Error) => {
+          logger.error(
+            `Error applying workflow rules in WorkflowService.onCreateSuccess: ${error}`,
+            {
+              projectId: createdItem.projectId?.toString(),
+              workflowId: createdItem.id?.toString(),
+            } as LogAttributes,
+          );
+        });
+    }
+
     return createdItem;
   }
 

package/Server/Types/AnalyticsDatabase/ModelPermission.ts

@@ -5,6 +5,7 @@ import {
 import DatabaseRequestType from "../BaseDatabase/DatabaseRequestType";
 import Query from "./Query";
 import Select from "./Select";
+import QueryHelper from "../Database/QueryHelper";
 import BaseModel, {
   AnalyticsBaseModelType,
 } from "../../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
@@ -14,8 +15,11 @@ import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/Database
 import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import Includes from "../../../Types/BaseDatabase/Includes";
 import SubscriptionPlan from "../../../Types/Billing/SubscriptionPlan";
+import PermissionScope from "../../../Types/Database/AccessControl/PermissionScope";
 import Columns from "../../../Types/Database/Columns";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
@@ -51,6 +55,13 @@ export default class ModelPermission {
         DatabaseRequestType.Delete,
       );
       query = await this.addTenantScopeToQuery(modelType, query, null, props);
+      // Owned scope: restrict deletes to telemetry from accessible services.
+      query = await this.addOwnedScopeToQuery(
+        modelType,
+        query,
+        props,
+        DatabaseRequestType.Delete,
+      );
     }
 
     return query;
@@ -252,6 +263,19 @@ export default class ModelPermission {
           DatabaseRequestType.Read,
         );
 
+        /*
+         * Apply the `Owned` permission scope filter for telemetry models
+         * (Log/Span/Metric). Resolves the user's accessible Service IDs
+         * once and constrains the ClickHouse query with `serviceId IN (...)`.
+         * See Internal/Docs/PermissionsSimplification.md.
+         */
+        query = await this.addOwnedScopeToQuery(
+          modelType,
+          query,
+          props,
+          DatabaseRequestType.Read,
+        );
+
         /*
          * We will check for this permission in recursive function.
          * check query permissions.
@@ -579,6 +603,212 @@ export default class ModelPermission {
     return modelPermissions;
   }
 
+  /*
+   * Mirror of TablePermission.getEffectiveModelPermissions. Adds the
+   * *AllOperationalResources wildcard for @OperationalResource analytics models and the
+   * ReadAllOperationalResources/ReadAllProjectResources runtime alias. See
+   * Internal/Docs/PermissionsSimplification.md.
+   */
+  private static getEffectiveModelPermissions(
+    modelType: AnalyticsBaseModelType,
+    modelPermissions: Array<Permission>,
+    type: DatabaseRequestType,
+  ): Array<Permission> {
+    const effective: Array<Permission> = [...modelPermissions];
+
+    if (
+      effective.includes(Permission.ReadAllProjectResources) &&
+      !effective.includes(Permission.ReadAllOperationalResources)
+    ) {
+      effective.push(Permission.ReadAllOperationalResources);
+    }
+
+    const model: any = new modelType();
+    if (model.isOperationalResource) {
+      const wildcard: Permission | null =
+        this.getWildcardPermissionForOperation(type);
+      if (wildcard && !effective.includes(wildcard)) {
+        effective.push(wildcard);
+      }
+      if (
+        type === DatabaseRequestType.Read &&
+        !effective.includes(Permission.ReadAllProjectResources)
+      ) {
+        effective.push(Permission.ReadAllProjectResources);
+      }
+    }
+
+    return effective;
+  }
+
+  private static getWildcardPermissionForOperation(
+    type: DatabaseRequestType,
+  ): Permission | null {
+    switch (type) {
+      case DatabaseRequestType.Read:
+        return Permission.ReadAllOperationalResources;
+      case DatabaseRequestType.Update:
+        return Permission.EditAllOperationalResources;
+      case DatabaseRequestType.Delete:
+        return Permission.DeleteAllOperationalResources;
+      case DatabaseRequestType.Create:
+        return Permission.CreateAllOperationalResources;
+      default:
+        return null;
+    }
+  }
+
+  /*
+   * `Owned` scope filter for analytics models (Log, Span, Metric). Resolves
+   * the user's accessible Service IDs via the Postgres ServiceOwner* tables
+   * once and injects `serviceId IN (...)` into the ClickHouse query. The
+   * operational per-row owner-join from the Postgres path doesn't scale to
+   * telemetry volume; one Postgres roundtrip + one indexed predicate does.
+   * See Internal/Docs/PermissionsSimplification.md §Telemetry & Analytics.
+   */
+  private static async addOwnedScopeToQuery<TBaseModel extends BaseModel>(
+    modelType: { new (): TBaseModel },
+    query: Query<TBaseModel>,
+    props: DatabaseCommonInteractionProps,
+    type: DatabaseRequestType,
+  ): Promise<Query<TBaseModel>> {
+    if (props.isRoot || props.isMasterAdmin) {
+      return query;
+    }
+
+    if (type === DatabaseRequestType.Create) {
+      return query;
+    }
+
+    /*
+     * Only applies to analytics models that declare @OwnedThrough — today
+     * Log, Span, Metric all do (to Service via serviceId). Anything without
+     * it can't have ownership filtering applied, so we leave the query alone.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const model: any = new modelType();
+    if (!model.ownedThrough) {
+      return query;
+    }
+
+    const modelPermissions: Array<Permission> = this.getModelPermissions(
+      modelType,
+      type,
+    );
+    const effectivePermissions: Array<Permission> =
+      this.getEffectiveModelPermissions(modelType, modelPermissions, type);
+
+    const userPermissions: Array<UserPermission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      );
+
+    const applicableRows: Array<UserPermission> = userPermissions.filter(
+      (p: UserPermission) => {
+        return effectivePermissions.includes(p.permission);
+      },
+    );
+
+    if (applicableRows.length === 0) {
+      return query;
+    }
+
+    /*
+     * If any applicable row is non-Owned scope, that broader grant wins
+     * and the Owned filter doesn't apply.
+     */
+    const hasNonOwnedGrant: boolean = applicableRows.some(
+      (p: UserPermission) => {
+        return p.scope !== PermissionScope.Owned;
+      },
+    );
+    if (hasNonOwnedGrant) {
+      return query;
+    }
+
+    /*
+     * Resolve allowed service IDs via the Postgres ServiceOwner* tables.
+     * Lazy require to avoid circular deps with services that extend
+     * DatabaseService.
+     */
+    const ownerTableRegistry: Map<
+      string,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      { ownerUserService: any; ownerTeamService: any; fkColumn: string }
+    > =
+      // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+      require("../Database/Permissions/OwnerTableRegistry").default;
+
+    const serviceEntry:
+      | {
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          ownerUserService: any;
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          ownerTeamService: any;
+          fkColumn: string;
+        }
+      | undefined = ownerTableRegistry.get("Service");
+    if (!serviceEntry) {
+      return query;
+    }
+
+    const allowedServiceIds: Set<string> = new Set<string>();
+
+    if (props.userId) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const userOwnedRows: Array<any> =
+        await serviceEntry.ownerUserService.findBy({
+          query: {
+            userId: props.userId,
+            ...(props.tenantId ? { projectId: props.tenantId } : {}),
+          },
+          select: { serviceId: true },
+          props: { isRoot: true },
+          skip: 0,
+          limit: LIMIT_MAX,
+        });
+      for (const row of userOwnedRows) {
+        const id: ObjectID | undefined = row.serviceId;
+        if (id) {
+          allowedServiceIds.add(id.toString());
+        }
+      }
+    }
+
+    if (props.userTeamIds && props.userTeamIds.length > 0) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const teamOwnedRows: Array<any> =
+        await serviceEntry.ownerTeamService.findBy({
+          query: {
+            teamId: QueryHelper.any(props.userTeamIds),
+            ...(props.tenantId ? { projectId: props.tenantId } : {}),
+          },
+          select: { serviceId: true },
+          props: { isRoot: true },
+          skip: 0,
+          limit: LIMIT_MAX,
+        });
+      for (const row of teamOwnedRows) {
+        const id: ObjectID | undefined = row.serviceId;
+        if (id) {
+          allowedServiceIds.add(id.toString());
+        }
+      }
+    }
+
+    const fkColumn: string = model.ownedThrough.fkColumn;
+    const idList: Array<string> =
+      allowedServiceIds.size > 0
+        ? Array.from(allowedServiceIds)
+        : [ObjectID.getZeroObjectID().toString()]; // sentinel: match nothing
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (query as any)[fkColumn] = new Includes(idList);
+
+    return query;
+  }
+
   private static isPublicPermissionAllowed(
     modelType: AnalyticsBaseModelType,
     type: DatabaseRequestType,
@@ -631,12 +861,21 @@ export default class ModelPermission {
       type,
     );
 
+    /*
+     * Mirror of TablePermission's wildcard short-circuit so the analytics
+     * path (ClickHouse-backed Log/Span/Metric) honors the same *AllOperationalResources
+     * permissions and the ReadAllProjectResources runtime alias. See
+     * Internal/Docs/PermissionsSimplification.md.
+     */
+    const effectiveModelPermissions: Array<Permission> =
+      this.getEffectiveModelPermissions(modelType, modelPermissions, type);
+
     if (
       !PermissionHelper.doesPermissionsIntersect(
         userPermissions.map((userPermission: UserPermission) => {
           return userPermission.permission;
         }) || [],
-        modelPermissions,
+        effectiveModelPermissions,
       )
     ) {
       const permissions: Array<string> =

package/Server/Types/Database/Permissions/BasePermission.ts

@@ -3,6 +3,7 @@ import Query from "../Query";
 import QueryUtil from "../QueryUtil";
 import Select from "../Select";
 import AccessControlPermission from "./AccessControlPermission";
+import OwnedScopePermission from "./OwnedScopePermission";
 import PermissionUtil from "./PermissionsUtil";
 import PublicPermission from "./PublicPermission";
 import QueryPermission from "./QueryPermission";
@@ -80,6 +81,20 @@ export default class BasePermission {
           type,
         );
 
+        /*
+         * Apply the `Owned` permission scope filter (see
+         * Internal/Docs/PermissionsSimplification.md). When the user's
+         * applicable permission rows are exclusively Owned-scoped, this
+         * restricts the query to resources where the user is in *OwnerUser
+         * or any of their teams is in *OwnerTeam.
+         */
+        query = await OwnedScopePermission.addOwnedScopeToQuery(
+          modelType,
+          query,
+          props,
+          type,
+        );
+
         /// Implement Related Permissions.
         if (model.canAccessIfCanReadOn) {
           const tableColumnMetadata: TableColumnMetadata =