@oneuptime/common 11.3.25 → 11.3.28

package/Server/Services/UserOnCallLogService.ts

@@ -23,6 +23,9 @@ import AlertEpisode from "../../Models/DatabaseModels/AlertEpisode";
 import AlertEpisodeService from "./AlertEpisodeService";
 import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
 import IncidentEpisodeService from "./IncidentEpisodeService";
+import OneUptimeDate from "../../Types/Date";
+import { JSONObject } from "../../Types/JSON";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -32,6 +35,93 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /**
+   * Atomically claim the right to execute ONE notification rule for this on-call
+   * log. Overlapping UserOnCallLog:ExecutePendingExecutions runs (a tick that
+   * exceeds the 1-minute cadence, a stalled-job re-delivery, or a burst release
+   * across worker replicas) could both read executedNotificationRules without a
+   * given delayed rule's key, both write it, and both send — double-paging the
+   * responder for a single escalation (audit F7). This mirrors
+   * OnCallDutyPolicyExecutionLogService.claimEscalationAdvance: a single
+   * conditional UPDATE that sets executedNotificationRules[ruleId] only when the
+   * key is absent and RETURNs the affected row, so exactly one concurrent run
+   * wins and the loser skips.
+   *
+   * Fail-safe: if the atomic statement errors for any reason, fall back to the
+   * previous non-atomic read-modify-write so the rule is still marked and sent.
+   * For an on-call system a rare duplicate page (the pre-fix behavior) is far
+   * better than a missed page, so this never makes paging less reliable.
+   *
+   * Returns true when THIS call claimed the rule (caller should send), false when
+   * it was already executed/claimed (caller should skip) or the log is missing.
+   */
+  @CaptureSpan()
+  public async claimNotificationRuleExecution(data: {
+    userOnCallLogId: ObjectID;
+    userNotificationRuleId: ObjectID;
+  }): Promise<boolean> {
+    const ruleKey: string = data.userNotificationRuleId.toString();
+
+    try {
+      const nowIso: string = OneUptimeDate.getCurrentDate().toISOString();
+
+      const rows: Array<{ _id: string }> =
+        await this.getRepository().manager.query(
+          `UPDATE "UserOnCallLog"
+             SET "executedNotificationRules" = jsonb_set(
+                   COALESCE("executedNotificationRules", '{}')::jsonb,
+                   ARRAY[$2::text],
+                   to_jsonb($3::text),
+                   true
+                 )::json
+           WHERE "_id" = $1::uuid
+             AND NOT (COALESCE("executedNotificationRules", '{}')::jsonb ? $2::text)
+           RETURNING "_id"`,
+          [data.userOnCallLogId.toString(), ruleKey, nowIso],
+        );
+
+      return Array.isArray(rows) && rows.length > 0;
+    } catch (err) {
+      logger.error(
+        "claimNotificationRuleExecution atomic claim failed; falling back to non-atomic marking.",
+      );
+      logger.error(err);
+
+      // Fallback: previous non-atomic read-modify-write (reliable marking).
+      const log: Model | null = await this.findOneById({
+        id: data.userOnCallLogId,
+        props: { isRoot: true },
+        select: {
+          _id: true,
+          executedNotificationRules: true,
+        },
+      });
+
+      if (!log) {
+        return false;
+      }
+
+      const executed: JSONObject = log.executedNotificationRules || {};
+
+      if (Object.keys(executed).includes(ruleKey)) {
+        return false;
+      }
+
+      executed[ruleKey] = OneUptimeDate.getCurrentDate();
+
+      await this.updateOneById({
+        id: log.id!,
+        data: {
+          executedNotificationRules: { ...executed },
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as any,
+        props: { isRoot: true },
+      });
+
+      return true;
+    }
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,

package/Server/Services/UserOnCallLogTimelineService.ts

@@ -15,6 +15,8 @@ import UserNotificationExecutionStatus from "../../Types/UserNotification/UserNo
 import User from "../../Models/DatabaseModels/User";
 import Model from "../../Models/DatabaseModels/UserOnCallLogTimeline";
 import AlertService from "./AlertService";
+import AlertEpisodeService from "./AlertEpisodeService";
+import IncidentEpisodeService from "./IncidentEpisodeService";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -40,6 +42,8 @@ export class Service extends DatabaseService<Model> {
           onCallDutyPolicyExecutionLogId: true,
           triggeredByIncidentId: true,
           triggeredByAlertId: true,
+          triggeredByAlertEpisodeId: true,
+          triggeredByIncidentEpisodeId: true,
           onCallDutyPolicyExecutionLogTimelineId: true,
         },
         skip: 0,
@@ -52,6 +56,19 @@ export class Service extends DatabaseService<Model> {
       for (const item of items) {
         const isIncident: boolean = Boolean(item.triggeredByIncidentId);
         const isAlert: boolean = Boolean(item.triggeredByAlertId);
+        /*
+         * Alert-episode and incident-episode pages were never handled here, so
+         * acknowledging one via call/SMS/email/push marked only this user's log
+         * done but never acknowledged the EPISODE. ExecutePendingExecutions gates
+         * every co-notified user's continuation solely on isEpisodeAcknowledged,
+         * so the other responders kept escalating and the episode stayed
+         * unacknowledged in its own state (audit F15). Handle both episode kinds
+         * the same way incident/alert are handled below.
+         */
+        const isAlertEpisode: boolean = Boolean(item.triggeredByAlertEpisodeId);
+        const isIncidentEpisode: boolean = Boolean(
+          item.triggeredByIncidentEpisodeId,
+        );
 
         // this incident is acknowledged.
 
@@ -73,7 +90,16 @@ export class Service extends DatabaseService<Model> {
           throw new BadDataException("User not found.");
         }
 
-        const statusMessage: string = `${isIncident ? "Incident" : "Alert"} acknowledged by ${user.name} (${user.email})`;
+        const entityLabel: string =
+          isIncident || isIncidentEpisode
+            ? isIncidentEpisode
+              ? "Incident Episode"
+              : "Incident"
+            : isAlertEpisode
+              ? "Alert Episode"
+              : "Alert";
+
+        const statusMessage: string = `${entityLabel} acknowledged by ${user.name} (${user.email})`;
 
         await UserOnCallLogService.updateOneById({
           id: item.userNotificationLogId!,
@@ -133,6 +159,22 @@ export class Service extends DatabaseService<Model> {
             item.userId!,
           );
         }
+
+        if (isAlertEpisode) {
+          // alert episode — stops co-notified responders from escalating.
+          await AlertEpisodeService.acknowledgeEpisode(
+            item.triggeredByAlertEpisodeId!,
+            item.userId!,
+          );
+        }
+
+        if (isIncidentEpisode) {
+          // incident episode — stops co-notified responders from escalating.
+          await IncidentEpisodeService.acknowledgeEpisode(
+            item.triggeredByIncidentEpisodeId!,
+            item.userId!,
+          );
+        }
       }
     }
 

package/Server/Types/AnalyticsDatabase/ModelPermission.ts

@@ -703,18 +703,31 @@ export default class ModelPermission {
    * scale to telemetry volume; one Postgres roundtrip + one indexed
    * predicate does. See Internal/Docs/PermissionsSimplification.md.
    */
-  private static async addOwnedScopeToQuery<TBaseModel extends BaseModel>(
+  /*
+   * Resolves the owned-scope decision for an analytics model without touching
+   * a query. Returns `null` when no ownership filter applies (root/master,
+   * creates, models without @OwnedThrough, no applicable permission rows, or
+   * an unrestricted grant) — i.e. the caller has full access. Otherwise
+   * returns the FK column plus the exact set of parent resource IDs the user
+   * may read (possibly empty, meaning "access to nothing").
+   *
+   * This is the single source of truth for owned-scope resolution:
+   * addOwnedScopeToQuery injects it into a ClickHouse query, and
+   * getAccessibleServiceIdsForAnalyticsModel exposes it to callers that build
+   * their own aggregation SQL (e.g. the AI toolbox), so the two can never
+   * drift apart.
+   */
+  private static async resolveOwnedScope<TBaseModel extends BaseModel>(
     modelType: { new (): TBaseModel },
-    query: Query<TBaseModel>,
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
-  ): Promise<Query<TBaseModel>> {
+  ): Promise<{ fkColumn: string; allowedResourceIds: Set<string> } | null> {
     if (props.isRoot || props.isMasterAdmin) {
-      return query;
+      return null;
     }
 
     if (type === DatabaseRequestType.Create) {
-      return query;
+      return null;
     }
 
     /*
@@ -725,7 +738,7 @@ export default class ModelPermission {
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const model: any = new modelType();
     if (!model.ownedThrough) {
-      return query;
+      return null;
     }
 
     const modelPermissions: Array<Permission> = this.getModelPermissions(
@@ -748,7 +761,7 @@ export default class ModelPermission {
     );
 
     if (applicableRows.length === 0) {
-      return query;
+      return null;
     }
 
     /*
@@ -771,7 +784,7 @@ export default class ModelPermission {
       },
     );
     if (hasUnrestrictedGrant) {
-      return query;
+      return null;
     }
 
     const allowedResourceIds: Set<string> = new Set<string>();
@@ -831,7 +844,59 @@ export default class ModelPermission {
       allowedResourceIds.add(props.tenantId.toString());
     }
 
-    const fkColumn: string = model.ownedThrough.fkColumn;
+    return { fkColumn: model.ownedThrough.fkColumn, allowedResourceIds };
+  }
+
+  /*
+   * The set of parent resource (Service) IDs the user may read for an analytics
+   * model, for callers that bypass findBy() and build aggregation SQL directly
+   * (e.g. the AI toolbox's log_histogram / query_traces, which call the
+   * aggregation services with a raw projectId). Pass the result as the
+   * aggregation's `serviceIds` filter.
+   *
+   * `null` means no ownership restriction applies — do NOT constrain (the user
+   * has project-wide access). A returned array (even empty) means the user is
+   * label/owned-restricted: constrain to exactly these IDs, and treat an empty
+   * array as "no accessible services" (match nothing), NEVER as "no filter".
+   */
+  public static async getAccessibleServiceIdsForAnalyticsModel<
+    TBaseModel extends BaseModel,
+  >(
+    modelType: { new (): TBaseModel },
+    props: DatabaseCommonInteractionProps,
+    type: DatabaseRequestType,
+  ): Promise<Array<ObjectID> | null> {
+    const scope: {
+      fkColumn: string;
+      allowedResourceIds: Set<string>;
+    } | null = await this.resolveOwnedScope(modelType, props, type);
+
+    if (!scope) {
+      return null;
+    }
+
+    return Array.from(scope.allowedResourceIds).map((id: string) => {
+      return new ObjectID(id);
+    });
+  }
+
+  private static async addOwnedScopeToQuery<TBaseModel extends BaseModel>(
+    modelType: { new (): TBaseModel },
+    query: Query<TBaseModel>,
+    props: DatabaseCommonInteractionProps,
+    type: DatabaseRequestType,
+  ): Promise<Query<TBaseModel>> {
+    const scope: {
+      fkColumn: string;
+      allowedResourceIds: Set<string>;
+    } | null = await this.resolveOwnedScope(modelType, props, type);
+
+    if (!scope) {
+      return query;
+    }
+
+    const fkColumn: string = scope.fkColumn;
+    const allowedResourceIds: Set<string> = scope.allowedResourceIds;
     const sentinelNoMatch: Array<string> = [
       ObjectID.getZeroObjectID().toString(),
     ];

package/Server/Types/Database/QueryUtil.ts

@@ -549,6 +549,63 @@ export default class QueryUtil {
           _id: QueryHelper.any(query[key] as Array<string>),
         };
       }
+
+      /*
+       * Text-search operator nested under a single-Entity relation, e.g.
+       * { user: { name: new Search("foo") } }. serializeQuery otherwise only
+       * visits top-level keys, so the nested operator reaches TypeORM as a raw
+       * class instance and silently degrades to an exact equality
+       * (`user.name = 'foo'` instead of `user.name ILIKE '%foo%'`) — which is
+       * why the Owner / user picker "search" appeared to do nothing once a
+       * project had more than a page of members.
+       *
+       * We deliberately touch ONLY the ILIKE-family leaf operators here and
+       * leave every other nested value (arrays, ids, plain equality, other
+       * operators) exactly as it was, so existing nested relation filters (the
+       * access-control label filters built by @CanAccessIfCanReadOn, etc.)
+       * serialize unchanged.
+       */
+      if (
+        tableColumnMetadata &&
+        tableColumnMetadata.modelType &&
+        tableColumnMetadata.type === TableColumnType.Entity &&
+        query[key] &&
+        typeof query[key] === Typeof.Object &&
+        !Array.isArray(query[key]) &&
+        (Object.getPrototypeOf(query[key]) === Object.prototype ||
+          Object.getPrototypeOf(query[key]) === null)
+      ) {
+        const relationModel: BaseModel = new tableColumnMetadata.modelType();
+        const relationQuery: Record<string, any> = query[key] as Record<
+          string,
+          any
+        >;
+        for (const relationKey in relationQuery) {
+          const relationColumnMetadata: TableColumnMetadata =
+            relationModel.getTableColumnMetadata(relationKey);
+          if (!relationColumnMetadata) {
+            continue;
+          }
+          const nestedValue: any = relationQuery[relationKey];
+          if (nestedValue instanceof Search) {
+            relationQuery[relationKey] = QueryHelper.search(
+              (nestedValue as Search<string>).toString(),
+            ) as any;
+          } else if (nestedValue instanceof StartsWith) {
+            relationQuery[relationKey] = QueryHelper.startsWith(
+              (nestedValue as StartsWith<string>).toString(),
+            ) as any;
+          } else if (nestedValue instanceof EndsWith) {
+            relationQuery[relationKey] = QueryHelper.endsWith(
+              (nestedValue as EndsWith<string>).toString(),
+            ) as any;
+          } else if (nestedValue instanceof NotContains) {
+            relationQuery[relationKey] = QueryHelper.notContains(
+              (nestedValue as NotContains<string>).toString(),
+            ) as any;
+          }
+        }
+      }
     }
 
     return query;

package/Server/Utils/AI/AIChatPrivacyFilter.ts

@@ -0,0 +1,28 @@
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+
+/*
+ * AI conversations (and their messages, runs and run events) are personal to
+ * the user who created them. This filter pins every non-root query to the
+ * requesting user so one project member can never read another member's
+ * conversations — including through the auto-generated list/count endpoints.
+ */
+export function pinQueryToRequestingUser<TQuery>(
+  query: TQuery,
+  props: DatabaseCommonInteractionProps,
+  userColumnName: string,
+): TQuery {
+  if (props.isRoot || props.isMasterAdmin) {
+    return query;
+  }
+
+  if (!props.userId) {
+    throw new NotAuthorizedException(
+      "AI conversations are personal and can only be accessed by the user who created them.",
+    );
+  }
+
+  (query as Record<string, unknown>)[userColumnName] = props.userId;
+
+  return query;
+}

package/Server/Utils/AI/AlertAIContextBuilder.ts

@@ -235,7 +235,12 @@ The note should:
 4. Be detailed enough to help team members understand the situation
 5. Use technical language appropriate for the engineering team
 
-Write in markdown format for better readability. Be thorough and technical.`;
+Write in markdown format for better readability. Be thorough and technical.
+
+Grounding rules (important):
+- Use ONLY facts that appear in the provided alert data. Do NOT invent causes, metrics, impact, or actions the data does not support.
+- If something a section needs is not in the data, write "Not available in the alert record" instead of guessing.
+- Never fabricate numbers or state confidence levels.`;
     }
 
     // Build user message