@oneuptime/common 10.4.17 → 10.5.1

package/Server/Types/AnalyticsDatabase/ModelPermission.ts

@@ -37,6 +37,41 @@ export interface CheckReadPermissionType<TBaseModel extends BaseModel> {
   select: Select<TBaseModel> | null;
 }
 
+/*
+ * Per-request cache for scope resolution. Keyed by the `props` object —
+ * one HTTP request reuses the same `props` for every analytics query it
+ * issues (a dashboard with 20 panels = up to 80 Postgres lookups without
+ * this; ~4 with it). The WeakMap entry is released automatically when
+ * `props` goes out of scope at request end, so there's no stale data
+ * between requests.
+ *
+ * Caches two things:
+ *   - `ownedIds`: Service IDs the user owns (one set per request — the
+ *     inputs are userId + teamIds + tenantId, all stable for one props).
+ *   - `labeledIds`: a map keyed by the sorted-label-IDs string, since
+ *     different model permission rows may carry different label sets.
+ */
+interface ScopeResolveCacheEntry {
+  ownedIds?: Set<string>;
+  labeledIds: Map<string, Set<string>>;
+}
+
+const scopeResolveCache: WeakMap<
+  DatabaseCommonInteractionProps,
+  ScopeResolveCacheEntry
+> = new WeakMap();
+
+function getScopeCacheBucket(
+  props: DatabaseCommonInteractionProps,
+): ScopeResolveCacheEntry {
+  let bucket: ScopeResolveCacheEntry | undefined = scopeResolveCache.get(props);
+  if (!bucket) {
+    bucket = { labeledIds: new Map() };
+    scopeResolveCache.set(props, bucket);
+  }
+  return bucket;
+}
+
 export default class ModelPermission {
   @CaptureSpan()
   public static async checkDeletePermission<TBaseModel extends BaseModel>(
@@ -645,12 +680,21 @@ export default class ModelPermission {
   }
 
   /*
-   * `Owned` scope filter for analytics models (Log, Span, Metric). Resolves
-   * the user's accessible Service IDs via the Postgres ServiceOwner* tables
-   * once and injects `serviceId IN (...)` into the ClickHouse query. The
-   * operational per-row owner-join from the Postgres path doesn't scale to
-   * telemetry volume; one Postgres roundtrip + one indexed predicate does.
-   * See Internal/Docs/PermissionsSimplification.md §Telemetry & Analytics.
+   * Scope filter for analytics models (Log, Span, Metric, ...). For each
+   * applicable user permission row we resolve allowed parent resource IDs
+   * based on its scope (`Owned` → ServiceOwner* tables; `Labels` → parent
+   * resources matching the user's labels), union them, and inject
+   * `serviceId IN (...)` into the ClickHouse query.
+   *
+   * Telemetry's serviceId is polymorphic — comment in Metric.ts says it
+   * "can be the monitor id or the telemetry service id" — so Labels-scope
+   * resolution walks both Service.labels (ServiceLabel join) and
+   * Monitor.labels (MonitorLabel join). Owned-scope keeps the original
+   * single-source ServiceOwner* lookup since that's what's wired today.
+   *
+   * The operational per-row owner-join from the Postgres path doesn't
+   * scale to telemetry volume; one Postgres roundtrip + one indexed
+   * predicate does. See Internal/Docs/PermissionsSimplification.md.
    */
   private static async addOwnedScopeToQuery<TBaseModel extends BaseModel>(
     modelType: { new (): TBaseModel },
@@ -701,23 +745,100 @@ export default class ModelPermission {
     }
 
     /*
-     * If any applicable row is non-Owned scope, that broader grant wins
-     * and the Owned filter doesn't apply.
+     * If any applicable row grants unrestricted access (scope=All, or the
+     * legacy Labels/unset scope with no labelIds), the broader grant wins
+     * and no filter is applied. Owned and label-restricted rows narrow
+     * access; an unrestricted row coexisting with them widens it back to
+     * full access.
      */
-    const hasNonOwnedGrant: boolean = applicableRows.some(
+    const hasUnrestrictedGrant: boolean = applicableRows.some(
       (p: UserPermission) => {
-        return p.scope !== PermissionScope.Owned;
+        if (p.scope === PermissionScope.All) {
+          return true;
+        }
+        if (p.scope === PermissionScope.Owned) {
+          return false;
+        }
+        // scope === Labels or undefined (legacy default)
+        return !p.labelIds || p.labelIds.length === 0;
       },
     );
-    if (hasNonOwnedGrant) {
+    if (hasUnrestrictedGrant) {
       return query;
     }
 
-    /*
-     * Resolve allowed service IDs via the Postgres ServiceOwner* tables.
-     * Lazy require to avoid circular deps with services that extend
-     * DatabaseService.
-     */
+    const allowedResourceIds: Set<string> = new Set<string>();
+
+    const hasOwnedGrant: boolean = applicableRows.some((p: UserPermission) => {
+      return p.scope === PermissionScope.Owned;
+    });
+    if (hasOwnedGrant) {
+      const ownedIds: Set<string> = await this.resolveOwnedParentIds(props);
+      for (const id of ownedIds) {
+        allowedResourceIds.add(id);
+      }
+    }
+
+    const labelScopedRows: Array<UserPermission> = applicableRows.filter(
+      (p: UserPermission) => {
+        const isLabelsScope: boolean =
+          p.scope === PermissionScope.Labels || p.scope === undefined;
+        return isLabelsScope && Boolean(p.labelIds && p.labelIds.length > 0);
+      },
+    );
+    if (labelScopedRows.length > 0) {
+      const labelIdSet: Set<string> = new Set<string>();
+      for (const row of labelScopedRows) {
+        for (const labelId of row.labelIds) {
+          labelIdSet.add(labelId.toString());
+        }
+      }
+      const labelIds: Array<ObjectID> = Array.from(labelIdSet).map(
+        (id: string) => {
+          return new ObjectID(id);
+        },
+      );
+      const labeledIds: Set<string> = await this.resolveLabeledParentIds(
+        labelIds,
+        props,
+      );
+      for (const id of labeledIds) {
+        allowedResourceIds.add(id);
+      }
+    }
+
+    const fkColumn: string = model.ownedThrough.fkColumn;
+    const idList: Array<string> =
+      allowedResourceIds.size > 0
+        ? Array.from(allowedResourceIds)
+        : [ObjectID.getZeroObjectID().toString()]; // sentinel: match nothing
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    (query as any)[fkColumn] = new Includes(idList);
+
+    return query;
+  }
+
+  /*
+   * Resolves Service IDs the user owns via ServiceOwnerUser /
+   * ServiceOwnerTeam in Postgres. Lazy-required to avoid circular deps
+   * with services that extend DatabaseService. Returns string IDs to
+   * make set-union with other resolvers straightforward.
+   *
+   * Cached per request via the WeakMap on `props` — the inputs (userId,
+   * teamIds, tenantId) are stable for the lifetime of one props object,
+   * so repeated calls within the same request reuse the first result.
+   */
+  private static async resolveOwnedParentIds(
+    props: DatabaseCommonInteractionProps,
+  ): Promise<Set<string>> {
+    const cache: ScopeResolveCacheEntry = getScopeCacheBucket(props);
+    if (cache.ownedIds) {
+      return cache.ownedIds;
+    }
+
+    const result: Set<string> = new Set<string>();
+
     const ownerTableRegistry: Map<
       string,
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -736,11 +857,10 @@ export default class ModelPermission {
         }
       | undefined = ownerTableRegistry.get("Service");
     if (!serviceEntry) {
-      return query;
+      cache.ownedIds = result;
+      return result;
     }
 
-    const allowedServiceIds: Set<string> = new Set<string>();
-
     if (props.userId) {
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const userOwnedRows: Array<any> =
@@ -757,7 +877,7 @@ export default class ModelPermission {
       for (const row of userOwnedRows) {
         const id: ObjectID | undefined = row.serviceId;
         if (id) {
-          allowedServiceIds.add(id.toString());
+          result.add(id.toString());
         }
       }
     }
@@ -778,21 +898,99 @@ export default class ModelPermission {
       for (const row of teamOwnedRows) {
         const id: ObjectID | undefined = row.serviceId;
         if (id) {
-          allowedServiceIds.add(id.toString());
+          result.add(id.toString());
         }
       }
     }
 
-    const fkColumn: string = model.ownedThrough.fkColumn;
-    const idList: Array<string> =
-      allowedServiceIds.size > 0
-        ? Array.from(allowedServiceIds)
-        : [ObjectID.getZeroObjectID().toString()]; // sentinel: match nothing
+    cache.ownedIds = result;
+    return result;
+  }
+
+  /*
+   * Resolves parent IDs whose labels intersect the given labelIds. Walks
+   * both TelemetryService (`ServiceLabel`) and Monitor (`MonitorLabel`)
+   * because telemetry's serviceId is polymorphic between the two. The
+   * Postgres findBy passes labels through QueryUtil, which turns the
+   * EntityArray filter into a many-to-many subquery against the join
+   * table — see QueryUtil.ts ~line 528.
+   *
+   * Cached per request via the WeakMap on `props`, keyed by the sorted
+   * label IDs joined into a string. Different model permission rows can
+   * carry different label sets, so we key by the actual labelIds rather
+   * than a single per-request slot.
+   */
+  private static async resolveLabeledParentIds(
+    labelIds: Array<ObjectID>,
+    props: DatabaseCommonInteractionProps,
+  ): Promise<Set<string>> {
+    const result: Set<string> = new Set<string>();
+
+    if (labelIds.length === 0) {
+      return result;
+    }
+
+    const cacheKey: string = labelIds
+      .map((id: ObjectID) => {
+        return id.toString();
+      })
+      .sort()
+      .join(",");
+    const cache: ScopeResolveCacheEntry = getScopeCacheBucket(props);
+    const cached: Set<string> | undefined = cache.labeledIds.get(cacheKey);
+    if (cached) {
+      return cached;
+    }
+
+    const ServiceService: any =
+      // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+      require("../../Services/ServiceService").default;
+    const MonitorService: any =
+      // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+      require("../../Services/MonitorService").default;
+
+    const tenantFilter: Record<string, ObjectID> = props.tenantId
+      ? { projectId: props.tenantId }
+      : {};
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    (query as any)[fkColumn] = new Includes(idList);
+    const serviceRows: Array<any> = await ServiceService.findBy({
+      query: {
+        labels: labelIds,
+        ...tenantFilter,
+      },
+      select: { _id: true },
+      props: { isRoot: true },
+      skip: 0,
+      limit: LIMIT_MAX,
+    });
+    for (const row of serviceRows) {
+      const id: ObjectID | string | undefined = row._id;
+      if (id) {
+        result.add(id.toString());
+      }
+    }
 
-    return query;
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const monitorRows: Array<any> = await MonitorService.findBy({
+      query: {
+        labels: labelIds,
+        ...tenantFilter,
+      },
+      select: { _id: true },
+      props: { isRoot: true },
+      skip: 0,
+      limit: LIMIT_MAX,
+    });
+    for (const row of monitorRows) {
+      const id: ObjectID | string | undefined = row._id;
+      if (id) {
+        result.add(id.toString());
+      }
+    }
+
+    cache.labeledIds.set(cacheKey, result);
+    return result;
   }
 
   private static isPublicPermissionAllowed(

package/Server/Types/Database/Permissions/EditionPermission.ts

@@ -0,0 +1,46 @@
+import {
+  IsBillingEnabled,
+  IsEnterpriseEdition,
+} from "../../../../Server/EnvironmentConfig";
+import BaseModel, {
+  DatabaseBaseModelType,
+} from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import PaymentRequiredException from "../../../../Types/Exception/PaymentRequiredException";
+import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+
+export default class EditionPermissions {
+  /*
+   * Gates models marked with @TableEditionAccessControl({ requiresEnterprise: true }).
+   *
+   * On self-hosted builds (billing disabled) the model is only accessible when
+   * the binary was built as the Enterprise Edition (IS_ENTERPRISE_EDITION=true).
+   *
+   * On the cloud / billing-enabled deployment we leave enforcement to
+   * BillingPermission — it already gates these models via the model's
+   * @TableBillingAccessControl plan tier, so a second check would be redundant.
+   */
+  @CaptureSpan()
+  public static checkEditionPermissions(
+    modelType: DatabaseBaseModelType,
+    _props: DatabaseCommonInteractionProps,
+  ): void {
+    if (IsBillingEnabled) {
+      return;
+    }
+
+    const model: BaseModel = new modelType();
+
+    if (!model.requiresEnterprise) {
+      return;
+    }
+
+    if (!IsEnterpriseEdition) {
+      throw new PaymentRequiredException(
+        `${model.singularName || "This feature"} is only available on the OneUptime Enterprise Edition. ` +
+          `Please switch to the Enterprise Edition build to enable this feature. ` +
+          `See https://oneuptime.com/enterprise/overview for details.`,
+      );
+    }
+  }
+}

package/Server/Types/Database/Permissions/TablePermission.ts

@@ -1,5 +1,6 @@
 import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
 import BillingPermissions from "./BillingPermission";
+import EditionPermissions from "./EditionPermission";
 import PublicPermission from "./PublicPermission";
 import BaseModel, {
   DatabaseBaseModelType,
@@ -55,7 +56,13 @@ export default class TablePermission {
     // 2nd CHECK: Is user project in active state?
     BillingPermissions.checkBillingPermissions(modelType, props, type);
 
-    // 2nd CHECK: Does user have access to CRUD data on this model.
+    /*
+     * 3rd CHECK: Is this an enterprise-only feature being accessed on the
+     * community self-hosted build?
+     */
+    EditionPermissions.checkEditionPermissions(modelType, props);
+
+    // 4th CHECK: Does user have access to CRUD data on this model.
     const userPermissions: Array<UserPermission> =
       DatabaseCommonInteractionPropsUtil.getUserPermissions(
         props,

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -5,6 +5,7 @@ import Host from "../../../Models/DatabaseModels/Host";
 import Label from "../../../Models/DatabaseModels/Label";
 import Monitor from "../../../Models/DatabaseModels/Monitor";
 import OnCallDutyPolicy from "../../../Models/DatabaseModels/OnCallDutyPolicy";
+import Service from "../../../Models/DatabaseModels/Service";
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 import Dictionary from "../../../Types/Dictionary";
@@ -19,6 +20,7 @@ import AlertService from "../../Services/AlertService";
 import AlertSeverityService from "../../Services/AlertSeverityService";
 import AlertStateTimelineService from "../../Services/AlertStateTimelineService";
 import HostService from "../../Services/HostService";
+import ServiceService from "../../Services/ServiceService";
 import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import DataToProcess from "./DataToProcess";
@@ -305,6 +307,39 @@ export default class MonitorAlert {
               alert.hosts = [host];
             }
           }
+
+          /*
+           * Same idea for Service — OTel ingest stamps `service.name` and
+           * auto-creates a Service row keyed by that name (see
+           * OpenTelemetryIngestService.telemetryServiceFromName). When the
+           * breaching series carries that attribute, link the alert to the
+           * emitting service so the on-call/labels pipeline can fan out.
+           */
+          const serviceName: string | undefined =
+            typeof seriesLabels["resource.service.name"] === "string"
+              ? (seriesLabels["resource.service.name"] as string)
+              : typeof seriesLabels["service.name"] === "string"
+                ? (seriesLabels["service.name"] as string)
+                : undefined;
+
+          if (serviceName) {
+            const service: Service | null = await ServiceService.findOneBy({
+              query: {
+                projectId: input.monitor.projectId!,
+                name: serviceName,
+              },
+              select: {
+                _id: true,
+              },
+              props: {
+                isRoot: true,
+              },
+            });
+
+            if (service) {
+              alert.services = [service];
+            }
+          }
         }
 
         alert.onCallDutyPolicies =