@oneuptime/common 10.4.0 → 10.4.2

package/Server/Infrastructure/Postgres/SchemaMigrations/1779125489830-IncreaseSmtpUsernameLength.ts

@@ -0,0 +1,31 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class IncreaseSmtpUsernameLength1779125489830
+  implements MigrationInterface
+{
+  public name = "IncreaseSmtpUsernameLength1779125489830";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Widen SMTP username columns from varchar(100) to varchar(500) to support
+     * longer usernames. Providers such as Oracle Cloud Infrastructure (OCI)
+     * issue SMTP usernames that follow RFC 6409 and RFC 4616, which allow up
+     * to 255 bytes and can exceed the previous 100 character ceiling.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "ProjectSMTPConfig" ALTER COLUMN "username" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" ALTER COLUMN "smtpUsername" TYPE character varying(500)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "GlobalConfig" ALTER COLUMN "smtpUsername" TYPE character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProjectSMTPConfig" ALTER COLUMN "username" TYPE character varying(100)`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -336,6 +336,7 @@ import { UpdateTeamPermissionScopeDefault1778877094014 } from "./1778877094014-U
 import { MigrateLegacyManagerRolesToAdmin1778900000000 } from "./1778900000000-MigrateLegacyManagerRolesToAdmin";
 import { AddOnCallDutyPolicyScheduleOwners1778929624633 } from "./1778929624633-AddOnCallDutyPolicyScheduleOwners";
 import { AddOnCallIncomingCallOwnersAndRules1778931537020 } from "./1778931537020-AddOnCallIncomingCallOwnersAndRules";
+import { IncreaseSmtpUsernameLength1779125489830 } from "./1779125489830-IncreaseSmtpUsernameLength";
 export default [
   InitialMigration,
   MigrationName1717678334852,
@@ -675,4 +676,5 @@ export default [
   MigrateLegacyManagerRolesToAdmin1778900000000,
   AddOnCallDutyPolicyScheduleOwners1778929624633,
   AddOnCallIncomingCallOwnersAndRules1778931537020,
+  IncreaseSmtpUsernameLength1779125489830,
 ];

package/Server/Services/ProfileAggregationService.ts

@@ -59,6 +59,30 @@ export interface FunctionListRequest {
   sortBy?: "selfValue" | "totalValue" | "sampleCount";
 }
 
+export interface ServiceActivityRequest {
+  projectId: ObjectID;
+  startTime: Date;
+  endTime: Date;
+  /**
+   * Single profile type to filter on. Kept for backwards compat. When
+   * `profileTypes` is also supplied, `profileTypes` wins.
+   */
+  profileType?: string;
+  /**
+   * Multiple raw profile-type strings to OR together. The UI maps a
+   * user-facing category (e.g. "CPU") to all the raw type strings real
+   * agents actually emit (e.g. ["cpu", "samples"]).
+   */
+  profileTypes?: Array<string>;
+}
+
+export interface ServiceActivityItem {
+  serviceId: string;
+  sampleCount: number;
+  profileCount: number;
+  totalValue: number;
+}
+
 export interface DiffFlamegraphRequest {
   projectId: ObjectID;
   baselineStartTime: Date;
@@ -417,6 +441,42 @@ export class ProfileAggregationService {
     return node;
   }
 
+  /**
+   * Aggregate sample / profile counts per serviceId for a time window.
+   * Drives the "loudest services first" sort on the Profiles dashboard
+   * so a developer opening the page lands on the workloads that are
+   * actually doing work rather than scrolling past kernel-thread noise.
+   */
+  @CaptureSpan()
+  public static async getServiceActivity(
+    request: ServiceActivityRequest,
+  ): Promise<Array<ServiceActivityItem>> {
+    const statement: Statement =
+      ProfileAggregationService.buildServiceActivityQuery(request);
+
+    const dbResult: Results =
+      await ProfileSampleDatabaseService.executeQuery(statement);
+    const response: DbJSONResponse = await dbResult.json<{
+      data?: Array<JSONObject>;
+    }>();
+
+    const rows: Array<JSONObject> = response.data || [];
+    const out: Array<ServiceActivityItem> = [];
+    for (const row of rows) {
+      const serviceId: string = String(row["serviceId"] || "");
+      if (!serviceId) {
+        continue;
+      }
+      out.push({
+        serviceId,
+        sampleCount: Number(row["sampleCount"] || 0),
+        profileCount: Number(row["profileCount"] || 0),
+        totalValue: Number(row["totalValue"] || 0),
+      });
+    }
+    return out;
+  }
+
   // --- Query builders ---
 
   private static buildFlamegraphQuery(request: FlamegraphRequest): Statement {
@@ -506,6 +566,65 @@ export class ProfileAggregationService {
     return statement;
   }
 
+  private static buildServiceActivityQuery(
+    request: ServiceActivityRequest,
+  ): Statement {
+    /*
+     * sum(value) directly — value is stored as Int128 in ClickHouse, so
+     * toFloat64OrZero would fail ("Illegal type Int128"); a plain sum is
+     * the right idiom here, and we coerce to Number when serialising in
+     * getServiceActivity.
+     */
+    const statement: Statement = SQL`
+      SELECT
+        toString(serviceId) AS serviceId,
+        count() AS sampleCount,
+        uniqExact(profileId) AS profileCount,
+        toFloat64(sum(value)) AS totalValue
+      FROM ${ProfileAggregationService.TABLE_NAME}
+      WHERE projectId = ${{
+        type: TableColumnType.ObjectID,
+        value: request.projectId,
+      }}
+        AND time >= ${{
+          type: TableColumnType.Date,
+          value: request.startTime,
+        }}
+        AND time <= ${{
+          type: TableColumnType.Date,
+          value: request.endTime,
+        }}
+    `;
+
+    /*
+     * profileTypes (array) wins over profileType (single) so the UI
+     * can OR together every raw type string in a category.
+     */
+    if (request.profileTypes && request.profileTypes.length > 0) {
+      statement.append(
+        SQL` AND profileType IN (${{
+          type: TableColumnType.Text,
+          value: new Includes(request.profileTypes),
+        }})`,
+      );
+    } else if (request.profileType) {
+      statement.append(
+        SQL` AND profileType = ${{
+          type: TableColumnType.Text,
+          value: request.profileType,
+        }}`,
+      );
+    }
+
+    statement.append(
+      SQL` GROUP BY serviceId
+           ORDER BY sampleCount DESC
+           LIMIT 10000`,
+    );
+
+    return statement;
+  }
+
   private static appendCommonFilters(
     statement: Statement,
     request: Pick<

package/Server/Types/AnalyticsDatabase/ModelPermission.ts

@@ -605,8 +605,7 @@ export default class ModelPermission {
 
   /*
    * Mirror of TablePermission.getEffectiveModelPermissions. Adds the
-   * *AllOperationalResources wildcard for @OperationalResource analytics models and the
-   * ReadAllOperationalResources/ReadAllProjectResources runtime alias. See
+   * *AllOperationalResources wildcard for @OperationalResource analytics models. See
    * Internal/Docs/PermissionsSimplification.md.
    */
   private static getEffectiveModelPermissions(
@@ -616,13 +615,6 @@ export default class ModelPermission {
   ): Array<Permission> {
     const effective: Array<Permission> = [...modelPermissions];
 
-    if (
-      effective.includes(Permission.ReadAllProjectResources) &&
-      !effective.includes(Permission.ReadAllOperationalResources)
-    ) {
-      effective.push(Permission.ReadAllOperationalResources);
-    }
-
     const model: any = new modelType();
     if (model.isOperationalResource) {
       const wildcard: Permission | null =
@@ -630,12 +622,6 @@ export default class ModelPermission {
       if (wildcard && !effective.includes(wildcard)) {
         effective.push(wildcard);
       }
-      if (
-        type === DatabaseRequestType.Read &&
-        !effective.includes(Permission.ReadAllProjectResources)
-      ) {
-        effective.push(Permission.ReadAllProjectResources);
-      }
     }
 
     return effective;
@@ -864,8 +850,7 @@ export default class ModelPermission {
     /*
      * Mirror of TablePermission's wildcard short-circuit so the analytics
      * path (ClickHouse-backed Log/Span/Metric) honors the same *AllOperationalResources
-     * permissions and the ReadAllProjectResources runtime alias. See
-     * Internal/Docs/PermissionsSimplification.md.
+     * permissions. See Internal/Docs/PermissionsSimplification.md.
      */
     const effectiveModelPermissions: Array<Permission> =
       this.getEffectiveModelPermissions(modelType, modelPermissions, type);

package/Server/Types/Database/Permissions/OwnedScopePermission.ts

@@ -153,10 +153,9 @@ export default class OwnedScopePermission {
 
   /*
    * Returns the permissions that should be considered to grant access for
-   * this op/model — model-enumerated plus operational wildcards plus the
-   * ReadAllProjectResources runtime alias. Mirrors the logic in
-   * TablePermission.getEffectiveModelPermissions but exposed here because
-   * we need to filter user-permission rows by this set.
+   * this op/model — model-enumerated plus operational wildcards. Mirrors the
+   * logic in TablePermission.getEffectiveModelPermissions but exposed here
+   * because we need to filter user-permission rows by this set.
    */
   private static getEffectivePermissionsForModel(
     modelType: DatabaseBaseModelType,
@@ -166,13 +165,6 @@ export default class OwnedScopePermission {
       TablePermission.getTablePermission(modelType, type);
     const effective: Array<Permission> = [...modelPermissions];
 
-    if (
-      effective.includes(Permission.ReadAllProjectResources) &&
-      !effective.includes(Permission.ReadAllOperationalResources)
-    ) {
-      effective.push(Permission.ReadAllOperationalResources);
-    }
-
     const model: BaseModel = new modelType();
     if (model.isOperationalResource) {
       const wildcard: Permission | null =
@@ -180,12 +172,6 @@ export default class OwnedScopePermission {
       if (wildcard && !effective.includes(wildcard)) {
         effective.push(wildcard);
       }
-      if (
-        type === DatabaseRequestType.Read &&
-        !effective.includes(Permission.ReadAllProjectResources)
-      ) {
-        effective.push(Permission.ReadAllProjectResources);
-      }
     }
 
     return effective;

package/Server/Types/Database/Permissions/QueryPermission.ts

@@ -9,6 +9,7 @@ import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/Datab
 import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import MultiSearch from "../../../../Types/BaseDatabase/MultiSearch";
 import Columns from "../../../../Types/Database/Columns";
 import { TableColumnMetadata } from "../../../../Types/Database/TableColumn";
 import TableColumnType from "../../../../Types/Database/TableColumnType";
@@ -156,6 +157,41 @@ export default class QueryPermission {
         continue;
       }
 
+      /*
+       * MultiSearch is a synthetic operator: the key itself is not a column,
+       * but the operator carries the list of fields it will ILIKE against
+       * (QueryUtil.serializeQuery expands it into an OR over those fields).
+       * Validate each inner field the same way we validate any other queried
+       * column so a client can't search across columns the user can't read.
+       */
+      if (query[key] instanceof MultiSearch) {
+        const multiSearch: MultiSearch = query[key] as unknown as MultiSearch;
+
+        for (const field of multiSearch.fields) {
+          if (excludedColumnNames.includes(field)) {
+            continue;
+          }
+
+          if (!tableColumns.includes(field)) {
+            throw new BadDataException(
+              `Invalid column on ${model.singularName} - ${field}. Column does not exist.`,
+            );
+          }
+
+          if (!canReadOnTheseColumns.columns.includes(field)) {
+            throw new NotAuthorizedException(
+              `You do not have permissions to query on - ${field}. You need any one of these permissions: ${PermissionHelper.getPermissionTitles(
+                model.getColumnAccessControlFor(field)
+                  ? model.getColumnAccessControlFor(field)!.read
+                  : [],
+              ).join(", ")}`,
+            );
+          }
+        }
+
+        continue;
+      }
+
       if (!canReadOnTheseColumns.columns.includes(key)) {
         if (!tableColumns.includes(key)) {
           throw new BadDataException(

package/Server/Types/Database/Permissions/TablePermission.ts

@@ -101,13 +101,10 @@ export default class TablePermission {
    * Resolves the model's enumerated permissions plus any wildcards that should
    * grant access. See Internal/Docs/PermissionsSimplification.md.
    *
-   * - Runtime equivalence: anywhere ReadAllProjectResources is accepted,
-   *   ReadAllOperationalResources is too (and vice versa for operational reads). No DB
-   *   migration is performed; this is the only place the alias lives.
-   * - Operational-resource wildcard: models marked @OperationalResource also
-   *   accept the matching *AllOperationalResources wildcard (ReadAllOperationalResources for read,
-   *   EditAllOperationalResources for update, etc.). Scope (All/Owned/Labels) on the
-   *   permission row is evaluated in a later step, not here.
+   * Operational-resource wildcard: models marked @OperationalResource also
+   * accept the matching *AllOperationalResources wildcard (ReadAllOperationalResources for read,
+   * EditAllOperationalResources for update, etc.). Scope (All/Owned/Labels) on the
+   * permission row is evaluated in a later step, not here.
    */
   private static getEffectiveModelPermissions(
     modelType: DatabaseBaseModelType,
@@ -116,13 +113,6 @@ export default class TablePermission {
   ): Array<Permission> {
     const effective: Array<Permission> = [...modelPermissions];
 
-    if (
-      effective.includes(Permission.ReadAllProjectResources) &&
-      !effective.includes(Permission.ReadAllOperationalResources)
-    ) {
-      effective.push(Permission.ReadAllOperationalResources);
-    }
-
     const model: BaseModel = new modelType();
     if (model.isOperationalResource) {
       const wildcard: Permission | null =
@@ -130,12 +120,6 @@ export default class TablePermission {
       if (wildcard && !effective.includes(wildcard)) {
         effective.push(wildcard);
       }
-      if (
-        type === DatabaseRequestType.Read &&
-        !effective.includes(Permission.ReadAllProjectResources)
-      ) {
-        effective.push(Permission.ReadAllProjectResources);
-      }
     }
 
     return effective;

package/Types/Monitor/MonitorStep.ts

@@ -64,6 +64,14 @@ export interface MonitorStepType {
   doNotFollowRedirects?: boolean | undefined;
   allowSelfSignedCertificates?: boolean | undefined;
 
+  /*
+   * mTLS / client certificate authentication (API and Website monitors).
+   * Values can be raw PEM strings or {{monitorSecrets.name}} references.
+   */
+  tlsClientCertificate?: string | undefined;
+  tlsClientKey?: string | undefined;
+  tlsClientKeyPassphrase?: string | undefined;
+
   // this is for port monitors.
   monitorDestinationPort?: Port | undefined;
 
@@ -122,6 +130,9 @@ export default class MonitorStep extends DatabaseProperty {
       monitorDestination: undefined,
       doNotFollowRedirects: undefined,
       allowSelfSignedCertificates: undefined,
+      tlsClientCertificate: undefined,
+      tlsClientKey: undefined,
+      tlsClientKeyPassphrase: undefined,
       monitorDestinationPort: undefined,
       monitorCriteria: new MonitorCriteria(),
       requestType: HTTPMethod.GET,
@@ -160,6 +171,9 @@ export default class MonitorStep extends DatabaseProperty {
       monitorDestination: undefined,
       doNotFollowRedirects: undefined,
       allowSelfSignedCertificates: undefined,
+      tlsClientCertificate: undefined,
+      tlsClientKey: undefined,
+      tlsClientKeyPassphrase: undefined,
       monitorDestinationPort: undefined,
       monitorCriteria: MonitorCriteria.getDefaultMonitorCriteria(arg),
       requestType: HTTPMethod.GET,
@@ -231,6 +245,25 @@ export default class MonitorStep extends DatabaseProperty {
     return this;
   }
 
+  public setTlsClientCertificate(
+    tlsClientCertificate: string | undefined,
+  ): MonitorStep {
+    this.data!.tlsClientCertificate = tlsClientCertificate || undefined;
+    return this;
+  }
+
+  public setTlsClientKey(tlsClientKey: string | undefined): MonitorStep {
+    this.data!.tlsClientKey = tlsClientKey || undefined;
+    return this;
+  }
+
+  public setTlsClientKeyPassphrase(
+    tlsClientKeyPassphrase: string | undefined,
+  ): MonitorStep {
+    this.data!.tlsClientKeyPassphrase = tlsClientKeyPassphrase || undefined;
+    return this;
+  }
+
   public setPort(monitorDestinationPort: Port): MonitorStep {
     this.data!.monitorDestinationPort = monitorDestinationPort;
     return this;
@@ -340,6 +373,9 @@ export default class MonitorStep extends DatabaseProperty {
         monitorDestination: undefined,
         doNotFollowRedirects: undefined,
         allowSelfSignedCertificates: undefined,
+        tlsClientCertificate: undefined,
+        tlsClientKey: undefined,
+        tlsClientKeyPassphrase: undefined,
         monitorDestinationPort: undefined,
         monitorCriteria: MonitorCriteria.getNewMonitorCriteriaAsJSON(),
         requestType: HTTPMethod.GET,
@@ -409,6 +445,25 @@ export default class MonitorStep extends DatabaseProperty {
       return "Request Type is required";
     }
 
+    if (
+      monitorType === MonitorType.API ||
+      monitorType === MonitorType.Website
+    ) {
+      const hasCert: boolean = Boolean(
+        value.data.tlsClientCertificate &&
+          value.data.tlsClientCertificate.trim(),
+      );
+      const hasKey: boolean = Boolean(
+        value.data.tlsClientKey && value.data.tlsClientKey.trim(),
+      );
+      if (hasCert && !hasKey) {
+        return "Client private key is required when a client certificate is provided";
+      }
+      if (hasKey && !hasCert) {
+        return "Client certificate is required when a client private key is provided";
+      }
+    }
+
     if (
       monitorType === MonitorType.Port &&
       !value.data.monitorDestinationPort
@@ -497,6 +552,9 @@ export default class MonitorStep extends DatabaseProperty {
           doNotFollowRedirects: this.data.doNotFollowRedirects || undefined,
           allowSelfSignedCertificates:
             this.data.allowSelfSignedCertificates || undefined,
+          tlsClientCertificate: this.data.tlsClientCertificate || undefined,
+          tlsClientKey: this.data.tlsClientKey || undefined,
+          tlsClientKeyPassphrase: this.data.tlsClientKeyPassphrase || undefined,
           monitorDestinationPort:
             this.data?.monitorDestinationPort?.toJSON() || undefined,
           monitorCriteria: this.data.monitorCriteria.toJSON(),
@@ -634,6 +692,11 @@ export default class MonitorStep extends DatabaseProperty {
       doNotFollowRedirects: json["doNotFollowRedirects"] || undefined,
       allowSelfSignedCertificates:
         json["allowSelfSignedCertificates"] || undefined,
+      tlsClientCertificate:
+        (json["tlsClientCertificate"] as string) || undefined,
+      tlsClientKey: (json["tlsClientKey"] as string) || undefined,
+      tlsClientKeyPassphrase:
+        (json["tlsClientKeyPassphrase"] as string) || undefined,
       monitorDestinationPort: monitorDestinationPort || undefined,
       monitorCriteria: MonitorCriteria.fromJSON(
         json["monitorCriteria"] as JSONObject,
@@ -697,6 +760,9 @@ export default class MonitorStep extends DatabaseProperty {
         requestBody: Zod.string().optional(),
         doNotFollowRedirects: Zod.boolean().optional(),
         allowSelfSignedCertificates: Zod.boolean().optional(),
+        tlsClientCertificate: Zod.string().optional(),
+        tlsClientKey: Zod.string().optional(),
+        tlsClientKeyPassphrase: Zod.string().optional(),
         monitorDestinationPort: Zod.any().optional(),
         customCode: Zod.string().optional(),
         screenSizeTypes: Zod.any().optional(),

package/Types/Permission.ts

@@ -1389,14 +1389,6 @@ enum Permission {
   EditIncidentSla = "EditIncidentSla",
   ReadIncidentSla = "ReadIncidentSla",
 
-  // Read All Project Resources Permission - Grants read access to all project resources
-  /**
-   * @deprecated Use {@link ReadAllOperationalResources} instead. Kept as a runtime alias
-   * for backward compatibility; the permission check treats this and
-   * `ReadAllOperationalResources` as equivalent. Will be removed in a future major version.
-   */
-  ReadAllProjectResources = "ReadAllProjectResources",
-
   /*
    * Wildcard permissions covering all models marked @OperationalResource().
    * These short-circuit table-level checks for that resource class. Scope on
@@ -11617,24 +11609,12 @@ export class PermissionHelper {
         group: PermissionGroup.Incident,
       },
 
-      // Read All Project Resources Permission (deprecated; alias of ReadAllOperationalResources)
-      {
-        permission: Permission.ReadAllProjectResources,
-        title: "Read All Project Resources",
-        description:
-          "Deprecated. Use Read All Operational Resources instead. Grants read access to all resources in this project.",
-        isAssignableToTenant: true,
-        isAccessControlPermission: false,
-        isRolePermission: false,
-        group: PermissionGroup.Project,
-      },
-
       // Operational Resource Wildcard Permissions
       {
         permission: Permission.ReadAllOperationalResources,
         title: "Read All Operational Resources",
         description:
-          "Wildcard read permission for all operational resources in this project (Monitor, Incident, Alert, StatusPage, etc.). Supersedes Read All Project Resources.",
+          "Wildcard read permission for all operational resources in this project (Monitor, Incident, Alert, StatusPage, etc.).",
         isAssignableToTenant: true,
         isAccessControlPermission: false,
         isRolePermission: false,

package/build/dist/Models/DatabaseModels/AIAgent.js

@@ -72,11 +72,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [
-            Permission.ProjectOwner,
-            Permission.ProjectAdmin,
-            Permission.ReadAllProjectResources,
-        ],
+        read: [Permission.ProjectOwner, Permission.ProjectAdmin],
         update: [
             Permission.ProjectOwner,
             Permission.ProjectAdmin,
@@ -108,7 +104,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [Permission.Public, Permission.ReadAllProjectResources],
+        read: [Permission.Public],
         update: [
             Permission.ProjectOwner,
             Permission.ProjectAdmin,
@@ -141,7 +137,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [Permission.Public, Permission.ReadAllProjectResources],
+        read: [Permission.Public],
         update: [
             Permission.ProjectOwner,
             Permission.ProjectAdmin,
@@ -166,7 +162,7 @@ __decorate([
 __decorate([
     ColumnAccessControl({
         create: [],
-        read: [Permission.Public, Permission.ReadAllProjectResources],
+        read: [Permission.Public],
         update: [],
     }),
     TableColumn({
@@ -195,7 +191,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [Permission.Public, Permission.ReadAllProjectResources],
+        read: [Permission.Public],
         update: [
             Permission.ProjectOwner,
             Permission.ProjectAdmin,
@@ -233,7 +229,6 @@ __decorate([
             Permission.SettingsMember,
             Permission.SettingsViewer,
             Permission.ReadProjectAIAgent,
-            Permission.ReadAllProjectResources,
         ],
         update: [],
     }),
@@ -268,7 +263,6 @@ __decorate([
             Permission.SettingsMember,
             Permission.SettingsViewer,
             Permission.ReadProjectAIAgent,
-            Permission.ReadAllProjectResources,
         ],
         update: [
             Permission.ProjectOwner,
@@ -316,7 +310,6 @@ __decorate([
             Permission.SettingsMember,
             Permission.SettingsViewer,
             Permission.ReadProjectAIAgent,
-            Permission.ReadAllProjectResources,
         ],
         update: [
             Permission.ProjectOwner,
@@ -351,7 +344,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [Permission.Public, Permission.ReadAllProjectResources],
+        read: [Permission.Public],
         update: [],
     }),
     TableColumn({
@@ -381,7 +374,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [Permission.Public, Permission.ReadAllProjectResources],
+        read: [Permission.Public],
         update: [],
     }),
     TableColumn({
@@ -445,7 +438,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [Permission.ProjectOwner, Permission.ReadAllProjectResources],
+        read: [Permission.ProjectOwner],
         update: [],
     }),
     TableColumn({ type: TableColumnType.Entity, modelType: User }),
@@ -470,7 +463,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [Permission.ProjectOwner, Permission.ReadAllProjectResources],
+        read: [Permission.ProjectOwner],
         update: [],
     }),
     TableColumn({
@@ -519,7 +512,6 @@ __decorate([
             Permission.SettingsMember,
             Permission.SettingsViewer,
             Permission.ReadProjectAIAgent,
-            Permission.ReadAllProjectResources,
         ],
         update: [],
     }),
@@ -548,7 +540,7 @@ __decorate([
             Permission.SettingsMember,
             Permission.CreateProjectAIAgent,
         ],
-        read: [Permission.Public, Permission.ReadAllProjectResources],
+        read: [Permission.Public],
         update: [
             Permission.ProjectOwner,
             Permission.ProjectAdmin,
@@ -593,7 +585,6 @@ __decorate([
             Permission.SettingsMember,
             Permission.SettingsViewer,
             Permission.ReadProjectAIAgent,
-            Permission.ReadAllProjectResources,
         ],
         update: [
             Permission.ProjectOwner,
@@ -672,7 +663,6 @@ AIAgent = __decorate([
             Permission.SettingsMember,
             Permission.SettingsViewer,
             Permission.ReadProjectAIAgent,
-            Permission.ReadAllProjectResources,
         ],
         delete: [
             Permission.ProjectOwner,