@oneuptime/common 11.3.25 → 11.3.28

package/Server/Services/OnCallDutyPolicyEscalationRuleUserService.ts

@@ -261,22 +261,30 @@ export class Service extends DatabaseService<Model> {
               notifyUserId: userId || undefined,
             },
           });
-
-          // also remove on-call duty time log.
-          OnCallDutyPolicyTimeLogService.endTimeLogForUser({
-            projectId: projectId,
-            onCallDutyPolicyId: onCallDutyPolicyId,
-            onCallDutyPolicyEscalationRuleId:
-              item.onCallDutyPolicyEscalationRule!.id!,
-            userId: userId,
-            endsAt: OneUptimeDate.getCurrentDate(),
-          }).catch((error: Error) => {
-            logger.error(`Error ending time log for user ${userId}: ${error}`, {
-              projectId: projectId?.toString(),
-              userId: userId?.toString(),
-            } as LogAttributes);
-          });
         }
+
+        /*
+         * Close the removed user's open on-call time log. This MUST run
+         * independently of whether the user has a display name — invited users
+         * who have not finished signup commonly have a null/empty name, and the
+         * ADD path (onCreateSuccess) opens their time log regardless of name.
+         * Nesting this inside `if (user && user.name)` left those users' logs
+         * open forever, showing them as perpetually on-call in reporting
+         * (audit F19).
+         */
+        OnCallDutyPolicyTimeLogService.endTimeLogForUser({
+          projectId: projectId,
+          onCallDutyPolicyId: onCallDutyPolicyId,
+          onCallDutyPolicyEscalationRuleId:
+            item.onCallDutyPolicyEscalationRule!.id!,
+          userId: userId,
+          endsAt: OneUptimeDate.getCurrentDate(),
+        }).catch((error: Error) => {
+          logger.error(`Error ending time log for user ${userId}: ${error}`, {
+            projectId: projectId?.toString(),
+            userId: userId?.toString(),
+          } as LogAttributes);
+        });
       }
     }
 

package/Server/Services/OnCallDutyPolicyExecutionLogService.ts

@@ -26,6 +26,7 @@ import IncidentService from "./IncidentService";
 import AlertService from "./AlertService";
 import AlertEpisodeService from "./AlertEpisodeService";
 import IncidentEpisodeService from "./IncidentEpisodeService";
+import { IsNull, UpdateResult } from "typeorm";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -35,6 +36,44 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /**
+   * Atomically claim the right to advance this execution to its next escalation
+   * rule on the current tick. Implemented as a single conditional
+   * `UPDATE ... WHERE lastEscalationRuleExecutedAt = <the value just read>`
+   * (via TypeORM's repository.update, which emits one atomic statement and
+   * returns the affected-row count), so that when two overlapping cron runs read
+   * the same lastEscalationRuleExecutedAt, exactly one wins — the loser sees
+   * `affected === 0` and bows out instead of double-paging responders (audit
+   * F13). `updateOneBy` could NOT provide this: it does a non-locking SELECT and
+   * then `save()` keyed only on `_id`, and returns the SELECT match count, so
+   * both overlapping runs would "win".
+   */
+  @CaptureSpan()
+  public async claimEscalationAdvance(data: {
+    executionLogId: ObjectID;
+    previousLastEscalationRuleExecutedAt: Date | null;
+    newLastEscalationRuleExecutedAt: Date;
+  }): Promise<boolean> {
+    const whereClause: Record<string, unknown> = {
+      _id: data.executionLogId.toString(),
+      status: OnCallDutyPolicyStatus.Executing,
+      lastEscalationRuleExecutedAt: data.previousLastEscalationRuleExecutedAt
+        ? data.previousLastEscalationRuleExecutedAt
+        : IsNull(),
+    };
+
+    const result: UpdateResult = await this.getRepository().update(
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      whereClause as any,
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      {
+        lastEscalationRuleExecutedAt: data.newLastEscalationRuleExecutedAt,
+      } as any,
+    );
+
+    return (result.affected || 0) > 0;
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,

package/Server/Services/OnCallDutyPolicyScheduleLayerService.ts

@@ -8,6 +8,12 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import PositiveNumber from "../../Types/PositiveNumber";
+import Recurring from "../../Types/Events/Recurring";
+import RestrictionTimes, {
+  RestrictionType,
+} from "../../Types/OnCallDutyPolicy/RestrictionTimes";
+import OneUptimeDate from "../../Types/Date";
+import UpdateBy from "../Types/Database/UpdateBy";
 import Model from "../../Models/DatabaseModels/OnCallDutyPolicyScheduleLayer";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
@@ -17,6 +23,90 @@ export class Service extends DatabaseService<Model> {
     super(Model);
   }
 
+  /*
+   * A rotation interval count of 0 / NaN / negative breaks the handoff math
+   * (division by zero, Invalid Date), so reject it at the persistence boundary.
+   * The client also guards this, and the engine defensively clamps, but a raw
+   * API write must not be able to store an invalid rotation.
+   */
+  private validateRotationInterval(rotation: unknown): void {
+    if (!rotation || typeof rotation === "function") {
+      return;
+    }
+
+    let count: number;
+    try {
+      const recurring: Recurring =
+        rotation instanceof Recurring
+          ? rotation
+          : Recurring.fromJSON(rotation as any);
+      count = recurring.intervalCount.toNumber();
+    } catch {
+      throw new BadDataException("Invalid rotation configuration.");
+    }
+
+    if (
+      !Number.isFinite(count) ||
+      isNaN(count) ||
+      !Number.isInteger(count) ||
+      count < 1
+    ) {
+      throw new BadDataException(
+        "Rotation interval must be a whole number greater than or equal to 1.",
+      );
+    }
+  }
+
+  /*
+   * Reject a zero-length Daily restriction window (From == To time-of-day) at the
+   * persistence boundary. Such a window is active 0 seconds/day, so the layer
+   * silently pages nobody for its coverage. The dashboard already blocks this
+   * (audit F22), but a raw API write bypasses the form — so guard server-side
+   * too. Compares UTC time-of-day, which is stable regardless of server zone.
+   */
+  private validateRestrictionTimes(restrictionTimes: unknown): void {
+    if (!restrictionTimes || typeof restrictionTimes === "function") {
+      return;
+    }
+
+    let parsed: RestrictionTimes;
+    try {
+      parsed =
+        restrictionTimes instanceof RestrictionTimes
+          ? restrictionTimes
+          : RestrictionTimes.fromJSON(restrictionTimes as any);
+    } catch {
+      // Malformed input is handled elsewhere; nothing to validate here.
+      return;
+    }
+
+    if (
+      parsed.restictionType === RestrictionType.Daily &&
+      parsed.dayRestrictionTimes &&
+      parsed.dayRestrictionTimes.startTime &&
+      parsed.dayRestrictionTimes.endTime
+    ) {
+      const start: Date = OneUptimeDate.fromString(
+        parsed.dayRestrictionTimes.startTime as any,
+      );
+      const end: Date = OneUptimeDate.fromString(
+        parsed.dayRestrictionTimes.endTime as any,
+      );
+
+      const timeOfDay: (d: Date) => number = (d: Date): number => {
+        return (
+          d.getUTCHours() * 3600 + d.getUTCMinutes() * 60 + d.getUTCSeconds()
+        );
+      };
+
+      if (timeOfDay(start) === timeOfDay(end)) {
+        throw new BadDataException(
+          "Daily restriction 'From' and 'To' times cannot be the same. Choose a window with a positive duration, or set restrictions to None for 24/7 coverage.",
+        );
+      }
+    }
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
@@ -25,6 +115,9 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("onCallDutyPolicyScheduleId is required");
     }
 
+    this.validateRotationInterval(createBy.data.rotation);
+    this.validateRestrictionTimes(createBy.data.restrictionTimes);
+
     if (!createBy.data.order) {
       // count number of users in this layer.
 
@@ -77,6 +170,19 @@ export class Service extends DatabaseService<Model> {
     return createdItem;
   }
 
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    this.validateRotationInterval(updateBy.data.rotation);
+    this.validateRestrictionTimes(updateBy.data.restrictionTimes);
+
+    return {
+      updateBy,
+      carryForward: null,
+    };
+  }
+
   protected override async onUpdateSuccess(
     _onUpdate: OnUpdate<Model>,
     updatedItemIds: Array<ObjectID>,
@@ -107,6 +213,48 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    /*
+     * Capture the layer's order + schedule id as carryForward so onDeleteSuccess
+     * can re-sequence the remaining layers AND refresh the schedule roster after
+     * a layer is removed. Without this hook, onDeleteSuccess (which gates all of
+     * its work on onDelete.carryForward) was dead code: deleting a layer never
+     * re-sequenced order and never called
+     * refreshCurrentUserIdAndHandoffTimeInSchedule, so the schedule kept showing
+     * the removed layer's user as on-call and the genuinely-now-on-call user got
+     * no handoff notification for up to a full rotation period (audit F3).
+     * Mirrors OnCallDutyPolicyScheduleLayerUserService.onBeforeDelete.
+     */
+    if (!deleteBy.query._id && !deleteBy.props.isRoot) {
+      throw new BadDataException(
+        "_id should be present when deleting a schedule layer. Please try the delete with objectId",
+      );
+    }
+
+    let resource: Model | null = null;
+
+    if (!deleteBy.props.isRoot) {
+      resource = await this.findOneBy({
+        query: deleteBy.query,
+        props: {
+          isRoot: true,
+        },
+        select: {
+          order: true,
+          onCallDutyPolicyScheduleId: true,
+        },
+      });
+    }
+
+    return {
+      deleteBy,
+      carryForward: resource,
+    };
+  }
+
   @CaptureSpan()
   protected override async onDeleteSuccess(
     onDelete: OnDelete<Model>,

package/Server/Services/OnCallDutyPolicyScheduleLayerUserService.ts

@@ -247,8 +247,17 @@ export class Service extends DatabaseService<Model> {
         // moving down.
 
         for (const resource of resources) {
-          if (resource.order! <= newOrder) {
-            // increment order.
+          /*
+           * Only shift rows strictly BETWEEN the old and new position. The lower
+           * bound (order > currentOrder) was missing, so every row above the
+           * moved user was also decremented — driving the top row's order to 0
+           * (and negative after repeated down-drags) and opening a gap at 1,
+           * breaking the 1-based contiguous invariant that create-default
+           * (count+1) and delete re-sequencing rely on (audit L3). Mirrors the
+           * double-bounded moving-up branch above.
+           */
+          if (resource.order! <= newOrder && resource.order! > currentOrder) {
+            // decrement order.
             await this.updateOneBy({
               query: {
                 _id: resource._id!,