@oneuptime/common 10.4.17 → 10.5.0

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -1,11 +1,15 @@
+import DockerHost from "../../../Models/DatabaseModels/DockerHost";
 import Host from "../../../Models/DatabaseModels/Host";
 import Incident from "../../../Models/DatabaseModels/Incident";
 import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
 import IncidentStateTimeline from "../../../Models/DatabaseModels/IncidentStateTimeline";
 import IncidentMember from "../../../Models/DatabaseModels/IncidentMember";
+import KubernetesCluster from "../../../Models/DatabaseModels/KubernetesCluster";
 import Label from "../../../Models/DatabaseModels/Label";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import OnCallDutyPolicy from "../../../Models/DatabaseModels/OnCallDutyPolicy";
+import Service from "../../../Models/DatabaseModels/Service";
+import Includes from "../../../Types/BaseDatabase/Includes";
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 import Dictionary from "../../../Types/Dictionary";
@@ -16,8 +20,11 @@ import ObjectID from "../../../Types/ObjectID";
 import ProbeMonitorResponse from "../../../Types/Probe/ProbeMonitorResponse";
 import { TelemetryQuery } from "../../../Types/Telemetry/TelemetryQuery";
 import { DisableAutomaticIncidentCreation } from "../../EnvironmentConfig";
+import DockerHostService from "../../Services/DockerHostService";
 import HostService from "../../Services/HostService";
 import IncidentService from "../../Services/IncidentService";
+import KubernetesClusterService from "../../Services/KubernetesClusterService";
+import ServiceService from "../../Services/ServiceService";
 import IncidentSeverityService from "../../Services/IncidentSeverityService";
 import IncidentStateTimelineService from "../../Services/IncidentStateTimelineService";
 import IncidentMemberService from "../../Services/IncidentMemberService";
@@ -316,40 +323,11 @@ export default class MonitorIncident {
         if (seriesLabels && Object.keys(seriesLabels).length > 0) {
           incident.seriesLabels = seriesLabels;
 
-          /*
-           * Link the incident to the Host that emitted this series, if
-           * the metric carried a `host.name` resource attribute. The
-           * Host record was auto-discovered during OTel ingestion.
-           * Metric attributes are stored with the `resource.` prefix in
-           * ClickHouse, so the group-by dropdown surfaces
-           * `resource.host.name` — but accept the bare `host.name` too
-           * for any non-OTel ingest paths.
-           */
-          const hostName: string | undefined =
-            typeof seriesLabels["resource.host.name"] === "string"
-              ? (seriesLabels["resource.host.name"] as string)
-              : typeof seriesLabels["host.name"] === "string"
-                ? (seriesLabels["host.name"] as string)
-                : undefined;
-
-          if (hostName) {
-            const host: Host | null = await HostService.findOneBy({
-              query: {
-                projectId: input.monitor.projectId!,
-                hostIdentifier: hostName,
-              },
-              select: {
-                _id: true,
-              },
-              props: {
-                isRoot: true,
-              },
-            });
-
-            if (host) {
-              incident.hosts = [host];
-            }
-          }
+          await this.linkResourceContextFromSeries({
+            incident,
+            seriesLabels,
+            projectId: input.monitor.projectId!,
+          });
         }
 
         incident.onCallDutyPolicies =
@@ -494,6 +472,238 @@ export default class MonitorIncident {
     }
   }
 
+  /*
+   * Pull every host / docker-host / k8s-cluster identifier out of the
+   * series labels and attach the matching project-scoped records to
+   * the incident. Series labels carry both raw OTel resource
+   * attributes (`host.name`, `k8s.cluster.name`) and the OneUptime
+   * stamps added at ingest (`oneuptime.host.id`,
+   * `oneuptime.docker.host.id`, `oneuptime.kubernetes.cluster.id` and
+   * their `.name` twins). OTel resource attributes are stored under
+   * the `resource.` prefix in ClickHouse, so prefixed and unprefixed
+   * forms are both accepted — whichever the group-by query surfaced,
+   * we'll find it. Multi-value labels are flattened, so a series that
+   * groups by a multi-valued attribute attaches every matching
+   * record. Lookups are always project-scoped so a stale or hostile
+   * stamp can't pull in a record from another tenant.
+   *
+   * For Docker hosts we deliberately ignore raw `host.name`/
+   * `oneuptime.host.name`: those are the Host's territory, and the
+   * ingest pipeline stamps `oneuptime.docker.host.*` independently
+   * when the source is a docker host.
+   */
+  private static async linkResourceContextFromSeries(input: {
+    incident: Incident;
+    seriesLabels: JSONObject;
+    projectId: ObjectID;
+  }): Promise<void> {
+    const collect: (keys: ReadonlyArray<string>) => Array<string> = (
+      keys: ReadonlyArray<string>,
+    ): Array<string> => {
+      const found: Set<string> = new Set<string>();
+      for (const key of keys) {
+        const value: unknown = input.seriesLabels[key];
+        if (typeof value === "string" && value.length > 0) {
+          found.add(value);
+          continue;
+        }
+        if (Array.isArray(value)) {
+          for (const item of value) {
+            if (typeof item === "string" && item.length > 0) {
+              found.add(item);
+            }
+          }
+        }
+      }
+      return Array.from(found);
+    };
+
+    const hostIds: Array<string> = collect([
+      "resource.oneuptime.host.id",
+      "oneuptime.host.id",
+    ]);
+    const hostNames: Array<string> = collect([
+      "resource.oneuptime.host.name",
+      "oneuptime.host.name",
+      "resource.host.name",
+      "host.name",
+    ]);
+
+    const dockerHostIds: Array<string> = collect([
+      "resource.oneuptime.docker.host.id",
+      "oneuptime.docker.host.id",
+    ]);
+    const dockerHostNames: Array<string> = collect([
+      "resource.oneuptime.docker.host.name",
+      "oneuptime.docker.host.name",
+    ]);
+
+    const clusterIds: Array<string> = collect([
+      "resource.oneuptime.kubernetes.cluster.id",
+      "oneuptime.kubernetes.cluster.id",
+    ]);
+    const clusterNames: Array<string> = collect([
+      "resource.oneuptime.kubernetes.cluster.name",
+      "oneuptime.kubernetes.cluster.name",
+      "resource.k8s.cluster.name",
+      "k8s.cluster.name",
+    ]);
+
+    /*
+     * Services come from OTel-ingested telemetry. The ingest pipeline
+     * auto-creates a Service row keyed by `service.name`, so any series
+     * label that carries that attribute (raw or prefixed) tells us the
+     * emitting service. We also accept the `oneuptime.service.id`
+     * stamp for callers that already resolved the ID upstream.
+     */
+    const serviceIds: Array<string> = collect([
+      "resource.oneuptime.service.id",
+      "oneuptime.service.id",
+    ]);
+    const serviceNames: Array<string> = collect([
+      "resource.service.name",
+      "service.name",
+    ]);
+
+    const [
+      resolvedHosts,
+      resolvedDockerHosts,
+      resolvedClusters,
+      resolvedServices,
+    ] = await Promise.all([
+      this.resolveResourceIds({
+        ids: hostIds,
+        names: hostNames,
+        nameColumn: "hostIdentifier",
+        projectId: input.projectId,
+        findBy: HostService.findBy.bind(HostService),
+      }),
+      this.resolveResourceIds({
+        ids: dockerHostIds,
+        names: dockerHostNames,
+        nameColumn: "hostIdentifier",
+        projectId: input.projectId,
+        findBy: DockerHostService.findBy.bind(DockerHostService),
+      }),
+      this.resolveResourceIds({
+        ids: clusterIds,
+        names: clusterNames,
+        nameColumn: "clusterIdentifier",
+        projectId: input.projectId,
+        findBy: KubernetesClusterService.findBy.bind(KubernetesClusterService),
+      }),
+      this.resolveResourceIds({
+        ids: serviceIds,
+        names: serviceNames,
+        nameColumn: "name",
+        projectId: input.projectId,
+        findBy: ServiceService.findBy.bind(ServiceService),
+      }),
+    ]);
+
+    if (resolvedHosts.length > 0) {
+      input.incident.hosts = resolvedHosts.map((id: string): Host => {
+        const host: Host = new Host();
+        host._id = id;
+        return host;
+      });
+    }
+    if (resolvedDockerHosts.length > 0) {
+      input.incident.dockerHosts = resolvedDockerHosts.map(
+        (id: string): DockerHost => {
+          const dockerHost: DockerHost = new DockerHost();
+          dockerHost._id = id;
+          return dockerHost;
+        },
+      );
+    }
+    if (resolvedClusters.length > 0) {
+      input.incident.kubernetesClusters = resolvedClusters.map(
+        (id: string): KubernetesCluster => {
+          const cluster: KubernetesCluster = new KubernetesCluster();
+          cluster._id = id;
+          return cluster;
+        },
+      );
+    }
+    if (resolvedServices.length > 0) {
+      input.incident.services = resolvedServices.map((id: string): Service => {
+        const service: Service = new Service();
+        service._id = id;
+        return service;
+      });
+    }
+  }
+
+  /*
+   * Resolve a mix of ids and names to a deduped set of database ids
+   * for one resource type, project-scoped. Either or both lists may
+   * be empty; if both are empty the method short-circuits with no DB
+   * round-trip.
+   */
+  private static async resolveResourceIds(input: {
+    ids: Array<string>;
+    names: Array<string>;
+    nameColumn: string;
+    projectId: ObjectID;
+    /*
+     * Loosely typed because the three resource services (Host,
+     * DockerHost, KubernetesCluster) each have their own
+     * `Query<TBaseModel>` shape and we deliberately abstract over
+     * them. We only need the row's `_id` back, which every model
+     * exposes via `DatabaseBaseModel`.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    findBy: (args: any) => Promise<Array<{ _id?: string | undefined }>>;
+  }): Promise<Array<string>> {
+    if (input.ids.length === 0 && input.names.length === 0) {
+      return [];
+    }
+
+    const resolved: Set<string> = new Set<string>();
+
+    const lookups: Array<Promise<Array<{ _id?: string | undefined }>>> = [];
+    if (input.ids.length > 0) {
+      lookups.push(
+        input.findBy({
+          query: {
+            projectId: input.projectId,
+            _id: new Includes(input.ids),
+          },
+          select: { _id: true },
+          skip: 0,
+          limit: LIMIT_PER_PROJECT,
+          props: { isRoot: true },
+        }),
+      );
+    }
+    if (input.names.length > 0) {
+      lookups.push(
+        input.findBy({
+          query: {
+            projectId: input.projectId,
+            [input.nameColumn]: new Includes(input.names),
+          },
+          select: { _id: true },
+          skip: 0,
+          limit: LIMIT_PER_PROJECT,
+          props: { isRoot: true },
+        }),
+      );
+    }
+
+    const buckets: Array<Array<{ _id?: string | undefined }>> =
+      await Promise.all(lookups);
+    for (const bucket of buckets) {
+      for (const row of bucket) {
+        if (row._id) {
+          resolved.add(String(row._id));
+        }
+      }
+    }
+    return Array.from(resolved);
+  }
+
   private static async resolveOpenIncident(input: {
     openIncident: Incident;
     rootCause: string;

package/Tests/Server/Middleware/UserAuthorization.test.ts

@@ -17,6 +17,7 @@ import Email from "../../../Types/Email";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import NotAuthenticatedException from "../../../Types/Exception/NotAuthenticatedException";
 import SsoAuthorizationException from "../../../Types/Exception/SsoAuthorizationException";
+import TenantNotFoundException from "../../../Types/Exception/TenantNotFoundException";
 import HashedString from "../../../Types/HashedString";
 import JSONFunctions from "../../../Types/JSONFunctions";
 import JSONWebTokenData from "../../../Types/JsonWebTokenData";
@@ -585,9 +586,9 @@ describe("UserMiddleware", () => {
   describe("getUserTenantAccessPermissionWithTenantId", () => {
     const req: ExpressRequest = {} as ExpressRequest;
 
-    const spyFindOneById: jest.SpyInstance = getJestSpyOn(
+    const spyGetRequireSsoForLogin: jest.SpyInstance = getJestSpyOn(
       ProjectService,
-      "findOneById",
+      "getRequireSsoForLogin",
     );
     const spyDoesSsoTokenForProjectExist: jest.SpyInstance = getJestSpyOn(
       UserMiddleware,
@@ -599,7 +600,9 @@ describe("UserMiddleware", () => {
     });
 
     test("should throw 'Invalid tenantId' error, when project is not found for the tenantId", async () => {
-      spyFindOneById.mockResolvedValueOnce(null);
+      spyGetRequireSsoForLogin.mockRejectedValueOnce(
+        new BadDataException("Project not found"),
+      );
 
       await expect(
         UserMiddleware.getUserTenantAccessPermissionWithTenantId({
@@ -607,23 +610,12 @@ describe("UserMiddleware", () => {
           tenantId: projectId,
           userId,
         }),
-      ).rejects.toThrowError(new BadDataException("Invalid tenantId"));
-      expect(spyFindOneById).toHaveBeenCalledWith({
-        id: projectId,
-        select: {
-          requireSsoForLogin: true,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
+      ).rejects.toThrowError(new TenantNotFoundException("Invalid tenantId"));
+      expect(spyGetRequireSsoForLogin).toHaveBeenCalledWith(projectId);
     });
 
     test("should throw SsoAuthorizationException error, when sso login is required but sso token for the projectId does not exist", async () => {
-      spyFindOneById.mockResolvedValueOnce({
-        ...mockedProject,
-        requireSsoForLogin: true,
-      });
+      spyGetRequireSsoForLogin.mockResolvedValueOnce(true);
 
       spyDoesSsoTokenForProjectExist.mockReturnValueOnce(false);
 
@@ -642,7 +634,7 @@ describe("UserMiddleware", () => {
     });
 
     test("should return null when getUserTenantAccessPermission returns null", async () => {
-      spyFindOneById.mockResolvedValueOnce(mockedProject);
+      spyGetRequireSsoForLogin.mockResolvedValueOnce(false);
 
       const spyGetUserTenantAccessPermission: jest.SpyInstance = getJestSpyOn(
         AccessTokenService,
@@ -668,7 +660,7 @@ describe("UserMiddleware", () => {
         projectId,
       } as UserTenantAccessPermission;
 
-      spyFindOneById.mockResolvedValueOnce(mockedProject);
+      spyGetRequireSsoForLogin.mockResolvedValueOnce(false);
 
       const spyGetUserTenantAccessPermission: jest.SpyInstance = getJestSpyOn(
         AccessTokenService,

package/Tests/Types/Permission.test.ts

@@ -1,4 +1,9 @@
-import Permission from "../../Types/Permission";
+import ObjectID from "../../Types/ObjectID";
+import Permission, {
+  PermissionHelper,
+  UserPermission,
+} from "../../Types/Permission";
+import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
 
 describe("Permission", () => {
   test("Permission.ProjectMember should be ProjectMember", () => {
@@ -9,3 +14,126 @@ describe("Permission", () => {
     expect(Permission.Public).toBe("Public");
   });
 });
+
+const makeRow: (
+  permission: Permission,
+  scope: PermissionScope | undefined,
+  labelIds?: Array<ObjectID>,
+) => UserPermission = (
+  permission: Permission,
+  scope: PermissionScope | undefined,
+  labelIds: Array<ObjectID> = [],
+): UserPermission => {
+  return {
+    _type: "UserPermission",
+    permission,
+    labelIds,
+    scope,
+  };
+};
+
+describe("PermissionHelper label/scope filtering", () => {
+  /*
+   * Regression coverage for the bug where a team permission with
+   * scope=Labels on a role permission (IncidentViewer, MonitorViewer,
+   * Viewer, …) was treated as an unconditional grant because the
+   * legacy filter consulted the per-permission `isAccessControlPermission`
+   * flag instead of the explicit scope on the row.
+   */
+
+  test("getNonAccessControlPermissions: scope=All counts as unrestricted", () => {
+    const rows: Array<UserPermission> = [
+      makeRow(Permission.IncidentViewer, PermissionScope.All, []),
+    ];
+    expect(PermissionHelper.getNonAccessControlPermissions(rows)).toEqual([
+      Permission.IncidentViewer,
+    ]);
+  });
+
+  test("getNonAccessControlPermissions: scope=Labels with labels is restricted (NOT included)", () => {
+    const labelId: ObjectID = ObjectID.generate();
+    const rows: Array<UserPermission> = [
+      makeRow(Permission.IncidentViewer, PermissionScope.Labels, [labelId]),
+    ];
+    expect(PermissionHelper.getNonAccessControlPermissions(rows)).toEqual([]);
+  });
+
+  test("getNonAccessControlPermissions: scope=Labels with empty labels is treated as unrestricted (legacy parity)", () => {
+    const rows: Array<UserPermission> = [
+      makeRow(Permission.IncidentViewer, PermissionScope.Labels, []),
+    ];
+    expect(PermissionHelper.getNonAccessControlPermissions(rows)).toEqual([
+      Permission.IncidentViewer,
+    ]);
+  });
+
+  test("getNonAccessControlPermissions: scope=Owned is excluded (OwnedScope handles it)", () => {
+    const rows: Array<UserPermission> = [
+      makeRow(Permission.IncidentViewer, PermissionScope.Owned, []),
+    ];
+    expect(PermissionHelper.getNonAccessControlPermissions(rows)).toEqual([]);
+  });
+
+  test("getNonAccessControlPermissions: legacy row (scope undefined, no labels) is unrestricted", () => {
+    const rows: Array<UserPermission> = [
+      makeRow(Permission.CurrentUser, undefined, []),
+    ];
+    expect(PermissionHelper.getNonAccessControlPermissions(rows)).toEqual([
+      Permission.CurrentUser,
+    ]);
+  });
+
+  test("getAccessControlPermissions: role permission with scope=Labels + labels is collected", () => {
+    const labelId: ObjectID = ObjectID.generate();
+    const row: UserPermission = makeRow(
+      Permission.IncidentViewer,
+      PermissionScope.Labels,
+      [labelId],
+    );
+    expect(PermissionHelper.getAccessControlPermissions([row])).toEqual([row]);
+  });
+
+  test("getAccessControlPermissions: granular permission with scope=Labels + labels is collected", () => {
+    const labelId: ObjectID = ObjectID.generate();
+    const row: UserPermission = makeRow(
+      Permission.ReadProjectIncident,
+      PermissionScope.Labels,
+      [labelId],
+    );
+    expect(PermissionHelper.getAccessControlPermissions([row])).toEqual([row]);
+  });
+
+  test("getAccessControlPermissions: scope=All with labels is NOT collected (All wins over labels)", () => {
+    const labelId: ObjectID = ObjectID.generate();
+    const row: UserPermission = makeRow(
+      Permission.IncidentViewer,
+      PermissionScope.All,
+      [labelId],
+    );
+    expect(PermissionHelper.getAccessControlPermissions([row])).toEqual([]);
+  });
+
+  test("getAccessControlPermissions: scope=Owned never contributes a label filter", () => {
+    const labelId: ObjectID = ObjectID.generate();
+    const row: UserPermission = makeRow(
+      Permission.IncidentViewer,
+      PermissionScope.Owned,
+      [labelId],
+    );
+    expect(PermissionHelper.getAccessControlPermissions([row])).toEqual([]);
+  });
+
+  test("Mixed: All row on a different permission does NOT suppress a Labels row's filter", () => {
+    const labelId: ObjectID = ObjectID.generate();
+    const rows: Array<UserPermission> = [
+      makeRow(Permission.MonitorViewer, PermissionScope.All, []),
+      makeRow(Permission.IncidentViewer, PermissionScope.Labels, [labelId]),
+    ];
+    expect(PermissionHelper.getNonAccessControlPermissions(rows)).toEqual([
+      Permission.MonitorViewer,
+    ]);
+    expect(PermissionHelper.getAccessControlPermissions(rows)).toEqual([
+      rows[1],
+    ]);
+  });
+});

package/Types/Accounts/AccountsLanguage.ts

@@ -20,7 +20,16 @@ export const SUPPORTED_ACCOUNTS_LANGUAGES: Array<AccountsLanguage> = [
   { code: "ru", nativeName: "Русский", englishName: "Russian" },
   { code: "ja", nativeName: "日本語", englishName: "Japanese" },
   { code: "ko", nativeName: "한국어", englishName: "Korean" },
-  { code: "zh", nativeName: "中文", englishName: "Chinese" },
+  {
+    code: "zh-CN",
+    nativeName: "简体中文",
+    englishName: "Chinese (Simplified)",
+  },
+  {
+    code: "zh-TW",
+    nativeName: "繁體中文",
+    englishName: "Chinese (Traditional)",
+  },
   { code: "hi", nativeName: "हिन्दी", englishName: "Hindi" },
 ];
 

package/Types/AdminDashboard/AdminDashboardLanguage.ts

@@ -21,7 +21,16 @@ export const SUPPORTED_ADMIN_DASHBOARD_LANGUAGES: Array<AdminDashboardLanguage>
     { code: "ru", nativeName: "Русский", englishName: "Russian" },
     { code: "ja", nativeName: "日本語", englishName: "Japanese" },
     { code: "ko", nativeName: "한국어", englishName: "Korean" },
-    { code: "zh", nativeName: "中文", englishName: "Chinese" },
+    {
+      code: "zh-CN",
+      nativeName: "简体中文",
+      englishName: "Chinese (Simplified)",
+    },
+    {
+      code: "zh-TW",
+      nativeName: "繁體中文",
+      englishName: "Chinese (Traditional)",
+    },
     { code: "hi", nativeName: "हिन्दी", englishName: "Hindi" },
   ];
 

package/Types/BaseDatabase/TableEditionAccessControl.ts

@@ -0,0 +1,3 @@
+export default interface TableEditionAccessControl {
+  requiresEnterprise: boolean;
+}

package/Types/Dashboard/DashboardLanguage.ts

@@ -20,7 +20,16 @@ export const SUPPORTED_DASHBOARD_LANGUAGES: Array<DashboardLanguage> = [
   { code: "ru", nativeName: "Русский", englishName: "Russian" },
   { code: "ja", nativeName: "日本語", englishName: "Japanese" },
   { code: "ko", nativeName: "한국어", englishName: "Korean" },
-  { code: "zh", nativeName: "中文", englishName: "Chinese" },
+  {
+    code: "zh-CN",
+    nativeName: "简体中文",
+    englishName: "Chinese (Simplified)",
+  },
+  {
+    code: "zh-TW",
+    nativeName: "繁體中文",
+    englishName: "Chinese (Traditional)",
+  },
   { code: "hi", nativeName: "हिन्दी", englishName: "Hindi" },
 ];
 

package/Types/Database/AccessControl/TableEditionAccessControl.ts

@@ -0,0 +1,8 @@
+import TableEditionAccessControl from "../../BaseDatabase/TableEditionAccessControl";
+import GenericFunction from "../../GenericFunction";
+
+export default (accessControl: TableEditionAccessControl) => {
+  return (ctr: GenericFunction) => {
+    ctr.prototype.requiresEnterprise = accessControl.requiresEnterprise;
+  };
+};

package/Types/Date.ts

@@ -1560,7 +1560,7 @@ export default class OneUptimeDate {
        */
       try {
         return moment(trimmedDate).toDate();
-      } catch (_err: unknown) {
+      } catch {
         return new Date(trimmedDate);
       }
     }

package/Types/Docs/DocsLanguage.ts

@@ -20,7 +20,16 @@ export const SUPPORTED_DOCS_LANGUAGES: Array<DocsLanguage> = [
   { code: "ru", nativeName: "Русский", englishName: "Russian" },
   { code: "ja", nativeName: "日本語", englishName: "Japanese" },
   { code: "ko", nativeName: "한국어", englishName: "Korean" },
-  { code: "zh", nativeName: "中文", englishName: "Chinese" },
+  {
+    code: "zh-CN",
+    nativeName: "简体中文",
+    englishName: "Chinese (Simplified)",
+  },
+  {
+    code: "zh-TW",
+    nativeName: "繁體中文",
+    englishName: "Chinese (Traditional)",
+  },
   { code: "hi", nativeName: "हिन्दी", englishName: "Hindi" },
 ];