@oneuptime/common 11.3.20 → 11.3.22

package/Models/DatabaseModels/ScheduledMaintenanceStateTimeline.ts

@@ -11,6 +11,7 @@ import CanAccessIfCanReadOn from "../../Types/Database/CanAccessIfCanReadOn";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
+import EnableMCP from "../../Types/Database/EnableMCP";
 import EnableWorkflow from "../../Types/Database/EnableWorkflow";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
@@ -23,6 +24,7 @@ import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/Statu
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
 @EnableDocumentation()
+@EnableMCP()
 @CanAccessIfCanReadOn("scheduledMaintenance")
 @TenantColumn("projectId")
 @TableAccessControl({

package/Models/DatabaseModels/StatusPageAnnouncement.ts

@@ -14,6 +14,7 @@ import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
+import EnableMCP from "../../Types/Database/EnableMCP";
 import EnableWorkflow from "../../Types/Database/EnableWorkflow";
 import SlugifyColumn from "../../Types/Database/SlugifyColumn";
 import TableColumn from "../../Types/Database/TableColumn";
@@ -35,6 +36,7 @@ import {
 } from "typeorm";
 
 @EnableDocumentation()
+@EnableMCP()
 @TenantColumn("projectId")
 @CanAccessIfCanReadOn("statusPages")
 @TableBillingAccessControl({

package/Server/API/DashboardAPI.ts

@@ -375,6 +375,58 @@ const PUBLIC_DASHBOARD_RESOURCES: Record<
   },
 };
 
+type ResolveDashboardIdOrThrowFunction = (
+  dashboardIdOrDomain: string,
+) => Promise<ObjectID>;
+
+/*
+ * Resolve the :dashboardIdOrDomain route param to a dashboard ID. Accepts
+ * either a dashboard ID (UUID) or a verified custom dashboard domain —
+ * same contract as the status page overview endpoint.
+ */
+const resolveDashboardIdOrThrow: ResolveDashboardIdOrThrowFunction = async (
+  dashboardIdOrDomain: string,
+): Promise<ObjectID> => {
+  if (!dashboardIdOrDomain) {
+    throw new NotFoundException("Dashboard not found");
+  }
+
+  if (dashboardIdOrDomain.includes(".")) {
+    const dashboardDomain: DashboardDomain | null =
+      await DashboardDomainService.findOneBy({
+        query: {
+          fullDomain: dashboardIdOrDomain,
+          domain: {
+            isVerified: true,
+          } as any,
+        },
+        select: {
+          dashboardId: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (!dashboardDomain || !dashboardDomain.dashboardId) {
+      throw new NotFoundException("Dashboard not found");
+    }
+
+    return dashboardDomain.dashboardId;
+  }
+
+  try {
+    ObjectID.validateUUID(dashboardIdOrDomain);
+    return new ObjectID(dashboardIdOrDomain);
+  } catch (err) {
+    logger.error(
+      `Error converting dashboardIdOrDomain to ObjectID: ${dashboardIdOrDomain}`,
+    );
+    logger.error(err);
+    throw new NotFoundException("Dashboard not found");
+  }
+};
+
 export default class DashboardAPI extends BaseAPI<
   Dashboard,
   DashboardServiceType
@@ -476,6 +528,111 @@ export default class DashboardAPI extends BaseAPI<
       },
     );
 
+    /*
+     * Shared handler for the public overview endpoint. Registered for both
+     * POST and GET (machine-readable access for crawlers / AI agents that
+     * only issue plain GET requests — discovered via llms.txt on public
+     * dashboard URLs) so the authentication and authorization path can
+     * never drift between the two methods. It does not read req.body.
+     */
+    const overviewHandler: (
+      req: ExpressRequest,
+      res: ExpressResponse,
+      next: NextFunction,
+    ) => Promise<void> = async (
+      req: ExpressRequest,
+      res: ExpressResponse,
+      next: NextFunction,
+    ): Promise<void> => {
+      try {
+        const dashboardId: ObjectID = await resolveDashboardIdOrThrow(
+          req.params["dashboardIdOrDomain"] as string,
+        );
+
+        // Check read access (handles public check, IP whitelist, master password)
+        const accessResult: {
+          hasReadAccess: boolean;
+          error?: NotAuthenticatedException | ForbiddenException;
+        } = await DashboardService.hasReadAccess({
+          dashboardId,
+          req,
+        });
+
+        if (!accessResult.hasReadAccess) {
+          throw (
+            accessResult.error ||
+            new BadDataException("Access denied to this dashboard.")
+          );
+        }
+
+        const dashboard: Dashboard | null = await DashboardService.findOneById({
+          id: dashboardId,
+          select: {
+            _id: true,
+            name: true,
+            description: true,
+            pageTitle: true,
+            pageDescription: true,
+            dashboardViewConfig: true,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+
+        if (!dashboard) {
+          throw new NotFoundException("Dashboard not found");
+        }
+
+        /*
+         * Everything below is derived from columns the public /metadata and
+         * /view-config endpoints already serve to anonymous viewers — the
+         * overview only reshapes them into a single GET-able document.
+         */
+        return Response.sendJsonObjectResponse(req, res, {
+          _id: dashboard._id?.toString() || "",
+          name: dashboard.name || "Dashboard",
+          description: dashboard.description || "",
+          pageTitle: dashboard.pageTitle || "",
+          pageDescription: dashboard.pageDescription || "",
+          components: DashboardAPI.buildPublicComponentSummaries(
+            dashboard.dashboardViewConfig,
+          ),
+          metricsUsed: Array.from(
+            DashboardAPI.collectDashboardMetricNames(
+              dashboard.dashboardViewConfig,
+            ),
+          ).sort(),
+          dashboardViewConfig: dashboard.dashboardViewConfig
+            ? JSONFunctions.serialize(dashboard.dashboardViewConfig as any)
+            : null,
+        });
+      } catch (err) {
+        next(err);
+      }
+    };
+
+    const overviewApiPath: string = `${new this.entityType()
+      .getCrudApiPath()
+      ?.toString()}/overview/:dashboardIdOrDomain`;
+
+    this.router.post(
+      overviewApiPath,
+      UserMiddleware.getUserMiddleware,
+      overviewHandler,
+    );
+
+    /*
+     * GET variant of the overview endpoint. Same middleware and same handler
+     * as the POST route above — non-public dashboards are rejected for
+     * unauthenticated callers exactly as they are on POST.
+     */
+    this.router.get(
+      overviewApiPath,
+      UserMiddleware.getUserMiddleware,
+      overviewHandler,
+    );
+
     // Domain resolution endpoint
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/domain`,
@@ -1079,6 +1236,70 @@ export default class DashboardAPI extends BaseAPI<
     );
   }
 
+  /*
+   * Build a compact machine-readable summary of the widgets on a dashboard
+   * for the public overview endpoint. Derived entirely from the stored
+   * dashboardViewConfig (already served to public viewers by /view-config) —
+   * this only lifts out the human-meaningful fields (widget type, title,
+   * text, metric names). The config comes straight from a JSON column, so
+   * every field is read defensively.
+   */
+  private static buildPublicComponentSummaries(
+    dashboardViewConfig: unknown,
+  ): Array<JSONObject> {
+    const summaries: Array<JSONObject> = [];
+
+    const components: unknown =
+      dashboardViewConfig && typeof dashboardViewConfig === "object"
+        ? (dashboardViewConfig as Record<string, unknown>)["components"]
+        : undefined;
+
+    if (!Array.isArray(components)) {
+      return summaries;
+    }
+
+    for (const component of components) {
+      if (!component || typeof component !== "object") {
+        continue;
+      }
+
+      const componentObject: Record<string, unknown> = component as Record<
+        string,
+        unknown
+      >;
+
+      const argumentsObject: Record<string, unknown> =
+        componentObject["arguments"] &&
+        typeof componentObject["arguments"] === "object"
+          ? (componentObject["arguments"] as Record<string, unknown>)
+          : {};
+
+      const getStringArgument: (key: string) => string | null = (
+        key: string,
+      ): string | null => {
+        const value: unknown = argumentsObject[key];
+        return typeof value === "string" && value.trim().length > 0
+          ? value
+          : null;
+      };
+
+      summaries.push({
+        componentType:
+          typeof componentObject["componentType"] === "string"
+            ? componentObject["componentType"]
+            : "",
+        title: getStringArgument("chartTitle") || getStringArgument("title"),
+        description: getStringArgument("chartDescription"),
+        text: getStringArgument("text"),
+        metricNames: Array.from(
+          DashboardAPI.collectDashboardMetricNames(component),
+        ).sort(),
+      });
+    }
+
+    return summaries;
+  }
+
   /*
    * Walk a stored dashboard view config and collect every metric name it
    * references (chart/value/gauge/table widgets all carry their metric in a

package/Server/API/EnterpriseLicenseAPI.ts

@@ -1,9 +1,18 @@
 import EnterpriseLicense from "../../Models/DatabaseModels/EnterpriseLicense";
+import EnterpriseLicenseInstance from "../../Models/DatabaseModels/EnterpriseLicenseInstance";
 import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
+import PartialEntity from "../../Types/Database/PartialEntity";
+import EnterpriseLicenseInstanceSummary from "../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
+import EnterpriseLicenseUsageUtil from "../../Utils/EnterpriseLicense/EnterpriseLicenseUsage";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import EnterpriseLicenseService, {
   Service as EnterpriseLicenseServiceType,
 } from "../Services/EnterpriseLicenseService";
+import EnterpriseLicenseInstanceService from "../Services/EnterpriseLicenseInstanceService";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import JSONWebToken from "../Utils/JsonWebToken";
 import OneUptimeDate from "../../Types/Date";
@@ -16,6 +25,23 @@ import {
 import BaseAPI from "./BaseAPI";
 // import { Host } from "../EnvironmentConfig";
 
+export interface LicenseInstanceUpsert {
+  licenseId: ObjectID;
+  instanceId: string;
+  host: string | undefined;
+  // Usage fields are only set on report-user-count, not on validate.
+  userCount?: number | undefined;
+  userEmailHashes?: Array<string> | undefined;
+  lastReportedAt?: Date | undefined;
+}
+
+/*
+ * Bounds how many instance rows one license key can register. Real customers
+ * run a handful of instances; this stops a leaked key from being used to
+ * fill the table with junk rows.
+ */
+const MAX_INSTANCES_PER_LICENSE: number = 100;
+
 export default class EnterpriseLicenseAPI extends BaseAPI<
   EnterpriseLicense,
   EnterpriseLicenseServiceType
@@ -50,6 +76,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
                 licenseKey: licenseKey,
               },
               select: {
+                _id: true,
                 companyName: true,
                 expiresAt: true,
                 licenseKey: true,
@@ -80,6 +107,27 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
             throw new BadDataException("License key has expired");
           }
 
+          /*
+           * The validating instance sends its instanceId and host so it
+           * shows up in the instance list right away (usage is reported
+           * later by the daily job on the instance).
+           */
+          const instanceId: string = this.parseShortText(
+            req.body["instanceId"],
+          );
+          const instanceHost: string = this.parseShortText(req.body["host"]);
+
+          if (instanceId) {
+            await this.upsertLicenseInstance({
+              licenseId: license.id!,
+              instanceId: instanceId,
+              host: instanceHost || undefined,
+            });
+          }
+
+          const instances: Array<EnterpriseLicenseInstance> =
+            await this.findLicenseInstances(license.id!);
+
           const payload: JSONObject = {
             companyName: license.companyName || "",
             expiresAt: license.expiresAt.toISOString(),
@@ -105,6 +153,7 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
             userCountUpdatedAt: license.userCountUpdatedAt
               ? license.userCountUpdatedAt.toISOString()
               : null,
+            instances: this.getInstanceSummaries(instances),
             token,
           });
         } catch (err) {
@@ -158,23 +207,67 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
 
           const reportedAt: Date = OneUptimeDate.getCurrentDate();
 
-          await EnterpriseLicenseService.updateOneById({
-            id: license.id!,
-            data: {
-              currentUserCount: userCount,
-              userCountUpdatedAt: reportedAt,
-            },
-            props: {
-              isRoot: true,
-              ignoreHooks: true,
-            },
-          });
+          const instanceId: string = this.parseShortText(
+            req.body["instanceId"],
+          );
+          const instanceHost: string = this.parseShortText(req.body["host"]);
+          const userEmailHashes: Array<string> =
+            EnterpriseLicenseUsageUtil.sanitizeUserEmailHashes(
+              req.body["userEmailHashes"],
+            );
+
+          if (instanceId) {
+            /*
+             * Multi-instance report: track usage per instance and count
+             * users uniquely across all instances of this license.
+             */
+            await this.upsertLicenseInstance({
+              licenseId: license.id!,
+              instanceId: instanceId,
+              host: instanceHost || undefined,
+              userCount: userCount,
+              userEmailHashes: userEmailHashes,
+              lastReportedAt: reportedAt,
+            });
+          }
+
+          const instances: Array<EnterpriseLicenseInstance> =
+            await this.findLicenseInstances(license.id!);
+
+          let currentUserCount: number = userCount;
+
+          if (instances.length > 0) {
+            currentUserCount = EnterpriseLicenseUsageUtil.getUniqueUserCount(
+              instances,
+              reportedAt,
+            );
+          }
+
+          /*
+           * Legacy reports (no instanceId) only drive the license-wide count
+           * while no instance has registered — otherwise they would stomp
+           * the deduplicated multi-instance count.
+           */
+          if (instanceId || instances.length === 0) {
+            await EnterpriseLicenseService.updateOneById({
+              id: license.id!,
+              data: {
+                currentUserCount: currentUserCount,
+                userCountUpdatedAt: reportedAt,
+              },
+              props: {
+                isRoot: true,
+                ignoreHooks: true,
+              },
+            });
+          }
 
           return Response.sendJsonObjectResponse(req, res, {
-            currentUserCount: userCount,
+            currentUserCount: currentUserCount,
             userCountUpdatedAt: reportedAt.toISOString(),
             userLimit:
               typeof license.userLimit === "number" ? license.userLimit : null,
+            instances: this.getInstanceSummaries(instances),
           });
         } catch (err) {
           next(err);
@@ -182,4 +275,178 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
       },
     );
   }
+
+  private parseShortText(value: unknown): string {
+    if (typeof value !== "string") {
+      return "";
+    }
+
+    return value.trim().substring(0, 100);
+  }
+
+  private async findLicenseInstances(
+    licenseId: ObjectID,
+  ): Promise<Array<EnterpriseLicenseInstance>> {
+    return EnterpriseLicenseInstanceService.findBy({
+      query: {
+        enterpriseLicenseId: licenseId,
+      },
+      select: {
+        _id: true,
+        instanceId: true,
+        host: true,
+        userCount: true,
+        userEmailHashes: true,
+        lastReportedAt: true,
+      },
+      sort: {
+        createdAt: SortOrder.Ascending,
+      },
+      skip: 0,
+      limit: LIMIT_MAX,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
+  private getInstanceSummaries(
+    instances: Array<EnterpriseLicenseInstance>,
+  ): Array<EnterpriseLicenseInstanceSummary> {
+    return instances.map(
+      (
+        instance: EnterpriseLicenseInstance,
+      ): EnterpriseLicenseInstanceSummary => {
+        return {
+          instanceId: instance.instanceId || "",
+          host: instance.host || null,
+          userCount:
+            typeof instance.userCount === "number" ? instance.userCount : null,
+          lastReportedAt: instance.lastReportedAt
+            ? instance.lastReportedAt.toISOString()
+            : null,
+        };
+      },
+    );
+  }
+
+  private async upsertLicenseInstance(
+    data: LicenseInstanceUpsert,
+  ): Promise<void> {
+    const updated: boolean = await this.updateLicenseInstanceIfExists(data);
+
+    if (updated) {
+      return;
+    }
+
+    const instanceCount: PositiveNumber =
+      await EnterpriseLicenseInstanceService.countBy({
+        query: {
+          enterpriseLicenseId: data.licenseId,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (instanceCount.toNumber() >= MAX_INSTANCES_PER_LICENSE) {
+      throw new BadDataException(
+        "Too many instances are registered for this license. Please contact support@oneuptime.com.",
+      );
+    }
+
+    const newInstance: EnterpriseLicenseInstance =
+      new EnterpriseLicenseInstance();
+    newInstance.enterpriseLicenseId = data.licenseId;
+    newInstance.instanceId = data.instanceId;
+
+    if (data.host !== undefined) {
+      newInstance.host = data.host;
+    }
+
+    if (data.userCount !== undefined) {
+      newInstance.userCount = data.userCount;
+    }
+
+    if (data.userEmailHashes !== undefined) {
+      newInstance.userEmailHashes = data.userEmailHashes;
+    }
+
+    if (data.lastReportedAt !== undefined) {
+      newInstance.lastReportedAt = data.lastReportedAt;
+    }
+
+    try {
+      await EnterpriseLicenseInstanceService.create({
+        data: newInstance,
+        props: {
+          isRoot: true,
+        },
+      });
+    } catch (err) {
+      /*
+       * A concurrent request created the row between our check and this
+       * insert — the unique index on (enterpriseLicenseId, instanceId)
+       * rejected the duplicate. Apply the report as an update instead.
+       */
+      const retried: boolean = await this.updateLicenseInstanceIfExists(data);
+
+      if (!retried) {
+        throw err;
+      }
+    }
+  }
+
+  private async updateLicenseInstanceIfExists(
+    data: LicenseInstanceUpsert,
+  ): Promise<boolean> {
+    const existingInstance: EnterpriseLicenseInstance | null =
+      await EnterpriseLicenseInstanceService.findOneBy({
+        query: {
+          enterpriseLicenseId: data.licenseId,
+          instanceId: data.instanceId,
+        },
+        select: {
+          _id: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (!existingInstance) {
+      return false;
+    }
+
+    const updateData: PartialEntity<EnterpriseLicenseInstance> = {};
+
+    if (data.host !== undefined) {
+      updateData.host = data.host;
+    }
+
+    if (data.userCount !== undefined) {
+      updateData.userCount = data.userCount;
+    }
+
+    if (data.userEmailHashes !== undefined) {
+      updateData.userEmailHashes = data.userEmailHashes;
+    }
+
+    if (data.lastReportedAt !== undefined) {
+      updateData.lastReportedAt = data.lastReportedAt;
+    }
+
+    if (Object.keys(updateData).length > 0) {
+      await EnterpriseLicenseInstanceService.updateOneById({
+        id: existingInstance.id!,
+        data: updateData,
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+    }
+
+    return true;
+  }
 }