@oneuptime/common 10.2.22 → 10.3.0

package/Server/Types/Database/Permissions/OwnedScopePermission.ts

@@ -0,0 +1,310 @@
+import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
+import Query from "../Query";
+import QueryHelper from "../QueryHelper";
+import TablePermission from "./TablePermission";
+/*
+ * Type-only import: keeps the OwnerTablePair shape available without
+ * triggering a runtime load of the registry (which imports 20 owner
+ * services that extend DatabaseService). The registry is lazy-required
+ * inside getAllowedResourceIds to avoid the class-extends-undefined
+ * circular-dep crash at module init.
+ */
+import type { OwnerTablePair } from "./OwnerTableRegistry";
+import BaseModel, {
+  DatabaseBaseModelType,
+} from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import LIMIT_MAX from "../../../../Types/Database/LimitMax";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import PermissionScope from "../../../../Types/Database/AccessControl/PermissionScope";
+import ObjectID from "../../../../Types/ObjectID";
+import Permission, {
+  PermissionHelper,
+  UserPermission,
+} from "../../../../Types/Permission";
+import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+
+/*
+ * Implements the `Owned` permission scope (see
+ * Internal/Docs/PermissionsSimplification.md). When the requesting user's
+ * applicable permission rows are exclusively `Owned`-scoped, this restricts
+ * the query to resources where the user is in *OwnerUser or any of the
+ * user's teams is in *OwnerTeam.
+ *
+ * `All` and `Labels` scoped rows are evaluated elsewhere; if any non-Owned
+ * row also grants the operation, that broader grant wins and this filter
+ * is skipped.
+ */
+export default class OwnedScopePermission {
+  @CaptureSpan()
+  public static async addOwnedScopeToQuery<TBaseModel extends BaseModel>(
+    modelType: { new (): TBaseModel },
+    query: Query<TBaseModel>,
+    props: DatabaseCommonInteractionProps,
+    type: DatabaseRequestType,
+  ): Promise<Query<TBaseModel>> {
+    if (props.isRoot || props.isMasterAdmin) {
+      return query;
+    }
+
+    /*
+     * Create has no resource to scope to; auto-owner-on-create lives in the
+     * create path itself, not here.
+     */
+    if (type === DatabaseRequestType.Create) {
+      return query;
+    }
+
+    const model: BaseModel = new modelType();
+
+    /*
+     * Owned scope only restricts resources that can carry ownership:
+     * operational resources (own *OwnerUser / *OwnerTeam tables) or
+     * nested resources that inherit ownership via @OwnedThrough. For
+     * everything else (settings / config tables like IncidentState,
+     * Label, Team, etc.) the table-level permission check is the only
+     * gate — Owned has no resources to scope to, so it's a no-op.
+     */
+    if (!model.isOperationalResource && !model.ownedThrough) {
+      return query;
+    }
+
+    const effectivePermissions: Array<Permission> =
+      OwnedScopePermission.getEffectivePermissionsForModel(
+        modelType as DatabaseBaseModelType,
+        type,
+      );
+
+    const userPermissions: Array<UserPermission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      );
+
+    const applicableRows: Array<UserPermission> = userPermissions.filter(
+      (p: UserPermission) => {
+        return effectivePermissions.includes(p.permission);
+      },
+    );
+
+    if (applicableRows.length === 0) {
+      /*
+       * No grant applies — the existing table-level check will reject this
+       * request. Leave the query untouched.
+       */
+      return query;
+    }
+
+    /*
+     * If any applicable row is non-Owned (All / Labels / undefined), it
+     * grants broader access than Owned and the Owned constraint is moot.
+     * Rows for scope-exempt permissions (e.g. ProjectOwner) are also
+     * treated as broader grants regardless of their stored scope, since
+     * scoping doesn't apply to them.
+     */
+    const hasNonOwnedGrant: boolean = applicableRows.some(
+      (p: UserPermission) => {
+        if (!PermissionHelper.isScopeApplicable(p.permission)) {
+          return true;
+        }
+        return p.scope !== PermissionScope.Owned;
+      },
+    );
+    if (hasNonOwnedGrant) {
+      return query;
+    }
+
+    // All applicable rows are Owned-scoped. Resolve allowed resource IDs.
+    const allowedIds: Array<ObjectID> =
+      await OwnedScopePermission.getAllowedResourceIds(modelType, props);
+
+    if (model.ownedThrough) {
+      /*
+       * Nested resource: ownership inherits via the parent FK. The allowedIds
+       * we computed are the parent's IDs, so filter on the FK column.
+       */
+      const fkColumn: string = model.ownedThrough.fkColumn;
+      if (allowedIds.length === 0) {
+        // No accessible parents -> match nothing.
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (query as any)._id = QueryHelper.equalTo(
+          ObjectID.getZeroObjectID().toString(),
+        );
+      } else {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (query as any)[fkColumn] = QueryHelper.any(allowedIds);
+      }
+    } else if (allowedIds.length === 0) {
+      // Top-level operational resource: no accessible IDs -> match nothing.
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (query as any)._id = QueryHelper.equalTo(
+        ObjectID.getZeroObjectID().toString(),
+      );
+    } else {
+      // Top-level operational resource: filter on _id.
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      (query as any)._id = QueryHelper.any(allowedIds);
+    }
+
+    return query;
+  }
+
+  /*
+   * Returns the permissions that should be considered to grant access for
+   * this op/model — model-enumerated plus operational wildcards plus the
+   * ReadAllProjectResources runtime alias. Mirrors the logic in
+   * TablePermission.getEffectiveModelPermissions but exposed here because
+   * we need to filter user-permission rows by this set.
+   */
+  private static getEffectivePermissionsForModel(
+    modelType: DatabaseBaseModelType,
+    type: DatabaseRequestType,
+  ): Array<Permission> {
+    const modelPermissions: Array<Permission> =
+      TablePermission.getTablePermission(modelType, type);
+    const effective: Array<Permission> = [...modelPermissions];
+
+    if (
+      effective.includes(Permission.ReadAllProjectResources) &&
+      !effective.includes(Permission.ReadAllOperationalResources)
+    ) {
+      effective.push(Permission.ReadAllOperationalResources);
+    }
+
+    const model: BaseModel = new modelType();
+    if (model.isOperationalResource) {
+      const wildcard: Permission | null =
+        OwnedScopePermission.getWildcardPermissionForOperation(type);
+      if (wildcard && !effective.includes(wildcard)) {
+        effective.push(wildcard);
+      }
+      if (
+        type === DatabaseRequestType.Read &&
+        !effective.includes(Permission.ReadAllProjectResources)
+      ) {
+        effective.push(Permission.ReadAllProjectResources);
+      }
+    }
+
+    return effective;
+  }
+
+  private static getWildcardPermissionForOperation(
+    type: DatabaseRequestType,
+  ): Permission | null {
+    switch (type) {
+      case DatabaseRequestType.Read:
+        return Permission.ReadAllOperationalResources;
+      case DatabaseRequestType.Update:
+        return Permission.EditAllOperationalResources;
+      case DatabaseRequestType.Delete:
+        return Permission.DeleteAllOperationalResources;
+      case DatabaseRequestType.Create:
+        return Permission.CreateAllOperationalResources;
+      default:
+        return null;
+    }
+  }
+
+  /*
+   * Computes the set of resource IDs the requesting user can access via
+   * ownership: those where they personally sit in *OwnerUser OR where any of
+   * their teams sits in *OwnerTeam.
+   *
+   * For nested models the lookup uses the parent's owner tables and returns
+   * parent IDs (the caller filters the nested query by the parent FK).
+   */
+  private static async getAllowedResourceIds<TBaseModel extends BaseModel>(
+    modelType: { new (): TBaseModel },
+    props: DatabaseCommonInteractionProps,
+  ): Promise<Array<ObjectID>> {
+    const model: BaseModel = new modelType();
+
+    // Determine which model's owner tables to consult.
+    let resolverName: string;
+    if (model.ownedThrough) {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      resolverName = (model.ownedThrough.parentModel as any).name;
+    } else {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      resolverName = (modelType as any).name;
+    }
+
+    /*
+     * Lazy require to avoid the circular dep cycle: this file is reachable
+     * from DatabaseService at module-load time, and the registry imports
+     * services that extend DatabaseService.
+     */
+    const ownerTableRegistry: Map<string, OwnerTablePair> =
+      // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+      require("./OwnerTableRegistry").default;
+
+    const registryEntry: OwnerTablePair | undefined =
+      ownerTableRegistry.get(resolverName);
+    if (!registryEntry) {
+      /*
+       * No registered owner tables for this model — Owned scope can't
+       * resolve, so nothing is accessible.
+       */
+      return [];
+    }
+
+    const seen: Set<string> = new Set<string>();
+    const fkColumn: string = registryEntry.fkColumn;
+
+    /*
+     * User-ownership lookup. Skipped for non-user callers (API keys, Probes
+     * with no userId); those evaluate `Owned` as `All` elsewhere.
+     */
+    if (props.userId) {
+      const userOwnedRows: Array<BaseModel> =
+        await registryEntry.ownerUserService.findBy({
+          query: {
+            userId: props.userId,
+            ...(props.tenantId ? { projectId: props.tenantId } : {}),
+          },
+          select: { [fkColumn]: true },
+          props: { isRoot: true },
+          skip: 0,
+          limit: LIMIT_MAX,
+        });
+      for (const row of userOwnedRows) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const value: ObjectID | undefined = (row as any)[fkColumn];
+        if (value) {
+          seen.add(value.toString());
+        }
+      }
+    }
+
+    // Team-ownership lookup.
+    if (props.userTeamIds && props.userTeamIds.length > 0) {
+      const teamOwnedRows: Array<BaseModel> =
+        await registryEntry.ownerTeamService.findBy({
+          query: {
+            teamId: QueryHelper.any(props.userTeamIds),
+            ...(props.tenantId ? { projectId: props.tenantId } : {}),
+          },
+          select: { [fkColumn]: true },
+          props: { isRoot: true },
+          skip: 0,
+          limit: LIMIT_MAX,
+        });
+      for (const row of teamOwnedRows) {
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const value: ObjectID | undefined = (row as any)[fkColumn];
+        if (value) {
+          seen.add(value.toString());
+        }
+      }
+    }
+
+    const result: Array<ObjectID> = [];
+    for (const id of seen) {
+      result.push(new ObjectID(id));
+    }
+    return result;
+  }
+}

package/Server/Types/Database/Permissions/OwnerTableRegistry.ts

@@ -0,0 +1,126 @@
+import AlertOwnerTeamService from "../../../Services/AlertOwnerTeamService";
+import AlertOwnerUserService from "../../../Services/AlertOwnerUserService";
+import DashboardOwnerTeamService from "../../../Services/DashboardOwnerTeamService";
+import DashboardOwnerUserService from "../../../Services/DashboardOwnerUserService";
+import IncidentOwnerTeamService from "../../../Services/IncidentOwnerTeamService";
+import IncidentOwnerUserService from "../../../Services/IncidentOwnerUserService";
+import MonitorOwnerTeamService from "../../../Services/MonitorOwnerTeamService";
+import MonitorOwnerUserService from "../../../Services/MonitorOwnerUserService";
+import OnCallDutyPolicyOwnerTeamService from "../../../Services/OnCallDutyPolicyOwnerTeamService";
+import OnCallDutyPolicyOwnerUserService from "../../../Services/OnCallDutyPolicyOwnerUserService";
+import RunbookOwnerTeamService from "../../../Services/RunbookOwnerTeamService";
+import RunbookOwnerUserService from "../../../Services/RunbookOwnerUserService";
+import ScheduledMaintenanceOwnerTeamService from "../../../Services/ScheduledMaintenanceOwnerTeamService";
+import ScheduledMaintenanceOwnerUserService from "../../../Services/ScheduledMaintenanceOwnerUserService";
+import ServiceOwnerTeamService from "../../../Services/ServiceOwnerTeamService";
+import ServiceOwnerUserService from "../../../Services/ServiceOwnerUserService";
+import StatusPageOwnerTeamService from "../../../Services/StatusPageOwnerTeamService";
+import StatusPageOwnerUserService from "../../../Services/StatusPageOwnerUserService";
+import WorkflowOwnerTeamService from "../../../Services/WorkflowOwnerTeamService";
+import WorkflowOwnerUserService from "../../../Services/WorkflowOwnerUserService";
+
+/*
+ * Maps an operational model name (e.g. "Monitor") to the two services that
+ * hold its ownership rows plus the FK column those services use to point at
+ * the parent resource. The `Owned` permission scope reads from these to
+ * compute which resource IDs the requesting user can act on.
+ *
+ * Nested models (those decorated with @OwnedThrough) resolve ownership
+ * through their parent, so this registry only needs entries for the
+ * canonical operational roots.
+ */
+export interface OwnerTablePair {
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ownerUserService: any;
+  // eslint-disable-next-line @typescript-eslint/no-explicit-any
+  ownerTeamService: any;
+  fkColumn: string;
+}
+
+const ownerTableRegistry: Map<string, OwnerTablePair> = new Map<
+  string,
+  OwnerTablePair
+>([
+  [
+    "Monitor",
+    {
+      ownerUserService: MonitorOwnerUserService,
+      ownerTeamService: MonitorOwnerTeamService,
+      fkColumn: "monitorId",
+    },
+  ],
+  [
+    "Incident",
+    {
+      ownerUserService: IncidentOwnerUserService,
+      ownerTeamService: IncidentOwnerTeamService,
+      fkColumn: "incidentId",
+    },
+  ],
+  [
+    "Alert",
+    {
+      ownerUserService: AlertOwnerUserService,
+      ownerTeamService: AlertOwnerTeamService,
+      fkColumn: "alertId",
+    },
+  ],
+  [
+    "StatusPage",
+    {
+      ownerUserService: StatusPageOwnerUserService,
+      ownerTeamService: StatusPageOwnerTeamService,
+      fkColumn: "statusPageId",
+    },
+  ],
+  [
+    "Dashboard",
+    {
+      ownerUserService: DashboardOwnerUserService,
+      ownerTeamService: DashboardOwnerTeamService,
+      fkColumn: "dashboardId",
+    },
+  ],
+  [
+    "OnCallDutyPolicy",
+    {
+      ownerUserService: OnCallDutyPolicyOwnerUserService,
+      ownerTeamService: OnCallDutyPolicyOwnerTeamService,
+      fkColumn: "onCallDutyPolicyId",
+    },
+  ],
+  [
+    "Runbook",
+    {
+      ownerUserService: RunbookOwnerUserService,
+      ownerTeamService: RunbookOwnerTeamService,
+      fkColumn: "runbookId",
+    },
+  ],
+  [
+    "ScheduledMaintenance",
+    {
+      ownerUserService: ScheduledMaintenanceOwnerUserService,
+      ownerTeamService: ScheduledMaintenanceOwnerTeamService,
+      fkColumn: "scheduledMaintenanceId",
+    },
+  ],
+  [
+    "Service",
+    {
+      ownerUserService: ServiceOwnerUserService,
+      ownerTeamService: ServiceOwnerTeamService,
+      fkColumn: "serviceId",
+    },
+  ],
+  [
+    "Workflow",
+    {
+      ownerUserService: WorkflowOwnerUserService,
+      ownerTeamService: WorkflowOwnerTeamService,
+      fkColumn: "workflowId",
+    },
+  ],
+]);
+
+export default ownerTableRegistry;

package/Server/Types/Database/Permissions/TablePermission.ts

@@ -65,12 +65,19 @@ export default class TablePermission {
     const modelPermissions: Array<Permission> =
       TablePermission.getTablePermission(modelType, type);
 
+    const effectiveModelPermissions: Array<Permission> =
+      TablePermission.getEffectiveModelPermissions(
+        modelType,
+        modelPermissions,
+        type,
+      );
+
     if (
       !PermissionHelper.doesPermissionsIntersect(
         userPermissions.map((userPermission: UserPermission) => {
           return userPermission.permission;
         }) || [],
-        modelPermissions,
+        effectiveModelPermissions,
       )
     ) {
       const permissions: Array<string> =
@@ -90,6 +97,67 @@ export default class TablePermission {
     }
   }
 
+  /*
+   * Resolves the model's enumerated permissions plus any wildcards that should
+   * grant access. See Internal/Docs/PermissionsSimplification.md.
+   *
+   * - Runtime equivalence: anywhere ReadAllProjectResources is accepted,
+   *   ReadAllOperationalResources is too (and vice versa for operational reads). No DB
+   *   migration is performed; this is the only place the alias lives.
+   * - Operational-resource wildcard: models marked @OperationalResource also
+   *   accept the matching *AllOperationalResources wildcard (ReadAllOperationalResources for read,
+   *   EditAllOperationalResources for update, etc.). Scope (All/Owned/Labels) on the
+   *   permission row is evaluated in a later step, not here.
+   */
+  private static getEffectiveModelPermissions(
+    modelType: DatabaseBaseModelType,
+    modelPermissions: Array<Permission>,
+    type: DatabaseRequestType,
+  ): Array<Permission> {
+    const effective: Array<Permission> = [...modelPermissions];
+
+    if (
+      effective.includes(Permission.ReadAllProjectResources) &&
+      !effective.includes(Permission.ReadAllOperationalResources)
+    ) {
+      effective.push(Permission.ReadAllOperationalResources);
+    }
+
+    const model: BaseModel = new modelType();
+    if (model.isOperationalResource) {
+      const wildcard: Permission | null =
+        TablePermission.getWildcardPermissionForOperation(type);
+      if (wildcard && !effective.includes(wildcard)) {
+        effective.push(wildcard);
+      }
+      if (
+        type === DatabaseRequestType.Read &&
+        !effective.includes(Permission.ReadAllProjectResources)
+      ) {
+        effective.push(Permission.ReadAllProjectResources);
+      }
+    }
+
+    return effective;
+  }
+
+  private static getWildcardPermissionForOperation(
+    type: DatabaseRequestType,
+  ): Permission | null {
+    switch (type) {
+      case DatabaseRequestType.Read:
+        return Permission.ReadAllOperationalResources;
+      case DatabaseRequestType.Update:
+        return Permission.EditAllOperationalResources;
+      case DatabaseRequestType.Delete:
+        return Permission.DeleteAllOperationalResources;
+      case DatabaseRequestType.Create:
+        return Permission.CreateAllOperationalResources;
+      default:
+        return null;
+    }
+  }
+
   @CaptureSpan()
   public static checkTableLevelBlockPermissions(
     modelType: DatabaseBaseModelType,

package/Server/Utils/Express.ts

@@ -45,6 +45,12 @@ export interface OneUptimeRequest extends express.Request {
   requestId?: string;
   userGlobalAccessPermission?: UserGlobalAccessPermission;
   userTenantAccessPermission?: Dictionary<UserTenantAccessPermission>; // tenantId <-> UserTenantAccessPermission;
+  /*
+   * Teams the user has accepted membership in for the current tenant.
+   * Populated at authentication time when tenantId is known. Consumed by
+   * the `Owned` permission scope. Absent for non-user callers.
+   */
+  userTeamIds?: Array<ObjectID>;
   rawFormUrlEncodedBody?: string;
   rawBody?: string; // Raw body for signature verification (JSON or URL-encoded)
 }