@oneuptime/common 11.3.26 → 11.4.0

package/Models/DatabaseModels/AIRun.ts

@@ -284,6 +284,56 @@ export default class AIRun extends BaseModel {
   })
   public conversationId?: ObjectID = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+    ],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    canReadOnRelationQuery: true,
+    title: "Triggered By Incident ID",
+    description:
+      "The incident that triggered this run (for autonomous investigations).",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public triggeredByIncidentId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+    ],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    canReadOnRelationQuery: true,
+    title: "Triggered By Alert ID",
+    description:
+      "The alert that triggered this run (for autonomous investigations).",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public triggeredByAlertId?: ObjectID = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [

package/Models/DatabaseModels/IncidentEpisodeRoleMember.ts

@@ -356,7 +356,7 @@ export default class IncidentEpisodeRoleMember extends BaseModel {
     {
       eager: false,
       nullable: true,
-      onDelete: "SET NULL",
+      onDelete: "CASCADE",
       orphanedRowAction: "nullify",
     },
   )

package/Models/DatabaseModels/IncidentMember.ts

@@ -364,7 +364,7 @@ export default class IncidentMember extends BaseModel {
     {
       eager: false,
       nullable: true,
-      onDelete: "SET NULL",
+      onDelete: "CASCADE",
       orphanedRowAction: "nullify",
     },
   )

package/Models/DatabaseModels/IncomingCallPolicy.ts

@@ -89,6 +89,19 @@ import EnableWorkflow from "../../Types/Database/EnableWorkflow";
   tableDescription:
     "Manage incoming call routing policies with escalation rules for on-call teams",
 })
+/*
+ * A routing phone number may belong to at most one active policy. The inbound
+ * /voice webhook looks up the policy by routingPhoneNumber and assumes a single
+ * match, so this uniqueness is enforced at the DB level (partial index in the
+ * migration; NULLs are allowed for policies without a number yet).
+ */
+@Index(
+  "IDX_INCOMING_CALL_POLICY_ROUTING_PHONE_UNIQUE",
+  ["routingPhoneNumber"],
+  {
+    unique: true,
+  },
+)
 export default class IncomingCallPolicy extends BaseModel {
   @ColumnAccessControl({
     create: [

package/Models/DatabaseModels/Index.ts

@@ -58,6 +58,7 @@ import BillingPaymentMethods from "./BillingPaymentMethod";
 import CallLog from "./CallLog";
 // Date migration
 import DataMigration from "./DataMigration";
+import MigrationFailure from "./MigrationFailure";
 import Domain from "./Domain";
 import EmailLog from "./EmailLog";
 import EmailVerificationToken from "./EmailVerificationToken";
@@ -650,6 +651,8 @@ const AllModelTypes: Array<{
 
   DataMigration,
 
+  MigrationFailure,
+
   ShortLink,
 
   ScheduledMaintenanceTemplate,

package/Models/DatabaseModels/MigrationFailure.ts

@@ -0,0 +1,170 @@
+import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import ColumnLength from "../../Types/Database/ColumnLength";
+import ColumnType from "../../Types/Database/ColumnType";
+import TableColumn from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import TableMetadata from "../../Types/Database/TableMetadata";
+import IconProp from "../../Types/Icon/IconProp";
+import { Column, Entity, Index } from "typeorm";
+
+/*
+ * Persistent log of migrations that FAILED to apply. Neither the TypeORM
+ * `migrations` table nor the `DataMigrations` table records failures — they
+ * only ever gain a row on SUCCESS — so without this table the admin health
+ * page can show that a migration is pending but never why. Each failed attempt
+ * appends a row here (name + redacted error + when it ran), which the
+ * migration-status endpoint reads back to explain a stuck / behind schema.
+ *
+ * Access control is empty (root-only): rows are written by the migration
+ * runners and read by the master-admin health endpoint via raw/isRoot queries,
+ * never by tenant users, so no CRUD API is exposed.
+ */
+@TableAccessControl({
+  create: [],
+  read: [],
+  delete: [],
+  update: [],
+})
+@TableMetadata({
+  tableName: "MigrationFailure",
+  singularName: "Migration Failure",
+  pluralName: "Migration Failures",
+  icon: IconProp.Database,
+  tableDescription:
+    "Log of database migrations that failed to apply, with the error and when they were attempted.",
+})
+@Entity({
+  name: "MigrationFailure",
+})
+export default class MigrationFailure extends BaseModel {
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    required: true,
+    type: TableColumnType.ShortText,
+    title: "Migration Name",
+    description: "Name of the migration that failed to apply.",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public migrationName?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    required: true,
+    type: TableColumnType.ShortText,
+    title: "Migration Type",
+    description:
+      "Which runner the migration belongs to: 'PostgresSchema' (TypeORM schema migration) or 'DataMigration' (ClickHouse / data backfill).",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public migrationType?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.VeryLongText,
+    title: "Error Message",
+    description:
+      "The error message from the failed attempt (credentials redacted).",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.VeryLongText,
+  })
+  public errorMessage?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.VeryLongText,
+    title: "Error Stack",
+    description:
+      "The stack trace from the failed attempt, if available (credentials redacted).",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.VeryLongText,
+  })
+  public errorStack?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Date,
+    title: "Attempted At",
+    description: "When this migration was attempted (and failed).",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.Date,
+  })
+  public attemptedAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "Host Name",
+    description: "Hostname / pod that ran the failed migration.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public hostName?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "App Version",
+    description: "Build / app version that attempted the migration.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public appVersion?: string = undefined;
+}

package/Models/DatabaseModels/OnCallDutyPolicyExecutionLog.ts

@@ -1017,7 +1017,16 @@ export default class OnCallDutyPolicyExecutionLog extends BaseModel {
       Permission.OnCallMember,
       Permission.CreateProjectOnCallDutyPolicyExecutionLog,
     ],
-    read: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.OnCallAdmin,
+      Permission.OnCallMember,
+      Permission.OnCallViewer,
+      Permission.ReadProjectOnCallDutyPolicyExecutionLog,
+    ],
     update: [],
   })
   @Index()
@@ -1180,7 +1189,16 @@ export default class OnCallDutyPolicyExecutionLog extends BaseModel {
       Permission.OnCallMember,
       Permission.CreateProjectOnCallDutyPolicyExecutionLog,
     ],
-    read: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.OnCallAdmin,
+      Permission.OnCallMember,
+      Permission.OnCallViewer,
+      Permission.ReadProjectOnCallDutyPolicyExecutionLog,
+    ],
     update: [],
   })
   @Index()
@@ -1201,6 +1219,37 @@ export default class OnCallDutyPolicyExecutionLog extends BaseModel {
   })
   public onCallPolicyExecutionRepeatCount?: number = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.OnCallAdmin,
+      Permission.OnCallMember,
+      Permission.OnCallViewer,
+      Permission.ReadProjectOnCallDutyPolicyExecutionLog,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Number,
+    required: true,
+    isDefaultValueColumn: true,
+    title: "Schedule Gap Retry Count",
+    description:
+      "How many times the current escalation rule has been re-sampled because its target schedule(s) momentarily had no on-call user.",
+    defaultValue: 0,
+    example: 0,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public scheduleGapRetryCount?: number = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/OnCallDutyPolicySchedule.ts

@@ -20,6 +20,7 @@ import TenantColumn from "../../Types/Database/TenantColumn";
 import IconProp from "../../Types/Icon/IconProp";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import Timezone from "../../Types/Timezone";
 import {
   Column,
   Entity,
@@ -319,6 +320,49 @@ export default class OnCallDutyPolicySchedule extends BaseModel {
   })
   public description?: string = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.OnCallAdmin,
+      Permission.OnCallMember,
+      Permission.CreateProjectOnCallDutyPolicySchedule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.OnCallAdmin,
+      Permission.OnCallMember,
+      Permission.OnCallViewer,
+      Permission.ReadProjectOnCallDutyPolicySchedule,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.OnCallAdmin,
+      Permission.OnCallMember,
+      Permission.EditProjectOnCallDutyPolicySchedule,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "Timezone",
+    description:
+      "IANA timezone this schedule's restriction and hand-off wall-clock times are interpreted in. When empty, times are interpreted in the server's local timezone (legacy behavior).",
+    example: "America/New_York",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public timezone?: Timezone = undefined;
+
   @Index()
   @ColumnAccessControl({
     create: [

package/Models/DatabaseModels/OnCallDutyPolicyScheduleLayer.ts

@@ -52,11 +52,17 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
   delete: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.OnCallAdmin,
+    Permission.OnCallMember,
     Permission.DeleteOnCallDutyPolicyScheduleLayer,
   ],
   update: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.OnCallAdmin,
+    Permission.OnCallMember,
     Permission.EditOnCallDutyPolicyScheduleLayer,
   ],
 })

package/Models/DatabaseModels/OnCallDutyPolicyScheduleLayerUser.ts

@@ -50,11 +50,17 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
   delete: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.OnCallAdmin,
+    Permission.OnCallMember,
     Permission.DeleteOnCallDutyPolicyScheduleLayer,
   ],
   update: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
+    Permission.ProjectMember,
+    Permission.OnCallAdmin,
+    Permission.OnCallMember,
     Permission.EditOnCallDutyPolicyScheduleLayer,
   ],
 })

package/Models/DatabaseModels/OnCallDutyPolicyTimeLog.ts

@@ -458,7 +458,7 @@ export default class OnCallDutyPolicyTimeLog extends BaseModel {
     {
       eager: false,
       nullable: true,
-      onDelete: "SET NULL",
+      onDelete: "CASCADE",
       orphanedRowAction: "nullify",
     },
   )

package/Models/DatabaseModels/OnCallDutyPolicyUserOverride.ts

@@ -357,7 +357,7 @@ export default class OnCallDutyPolicyUserOverride extends BaseModel {
     {
       eager: false,
       nullable: true,
-      onDelete: "SET NULL",
+      onDelete: "CASCADE",
       orphanedRowAction: "nullify",
     },
   )
@@ -435,7 +435,7 @@ export default class OnCallDutyPolicyUserOverride extends BaseModel {
     {
       eager: false,
       nullable: true,
-      onDelete: "SET NULL",
+      onDelete: "CASCADE",
       orphanedRowAction: "nullify",
     },
   )

package/Models/DatabaseModels/Project.ts

@@ -1422,6 +1422,66 @@ export default class Project extends TenantModel {
   })
   public enableAi?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: true,
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Enable Automatic Incident Investigation",
+    description:
+      "When enabled, OneUptime's AI SRE (Sentinel) automatically investigates every new incident and posts a cited root cause analysis to the incident timeline. Requires AI to be enabled and an LLM provider to be configured.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    nullable: false,
+    default: false,
+    type: ColumnType.Boolean,
+  })
+  public enableAutomaticIncidentInvestigation?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: true,
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Enable Automatic Alert Investigation",
+    description:
+      "When enabled, OneUptime's AI SRE (Sentinel) automatically investigates every new alert and posts a cited root cause analysis to the alert timeline. Requires AI to be enabled and an LLM provider to be configured.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    nullable: false,
+    default: false,
+    type: ColumnType.Boolean,
+  })
+  public enableAutomaticAlertInvestigation?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [

package/Server/API/AIInvestigationAPI.ts

@@ -0,0 +1,148 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import CommonAPI from "./CommonAPI";
+import Express, {
+  ExpressRequest,
+  ExpressResponse,
+  ExpressRouter,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../Types/ObjectID";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import { JSONArray, JSONObject } from "../../Types/JSON";
+import AIRunType from "../../Types/AI/AIRunType";
+import AIRun from "../../Models/DatabaseModels/AIRun";
+import AIRunEvent from "../../Models/DatabaseModels/AIRunEvent";
+import Incident from "../../Models/DatabaseModels/Incident";
+import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import IncidentService from "../Services/IncidentService";
+import AIRunService from "../Services/AIRunService";
+import AIRunEventService from "../Services/AIRunEventService";
+
+const router: ExpressRouter = Express.getRouter();
+
+const MAX_EVENTS: number = 500;
+
+/*
+ * Returns the latest Sentinel investigation (the AIRun + its ordered
+ * AIRunEvents) for an incident, so the dashboard can render a live "watch it
+ * think" panel.
+ *
+ * Investigation runs are system-authored (userId = null) and are therefore
+ * hidden by the per-user privacy pin on the generic AIRun / AIRunEvent CRUD. So
+ * we gate access explicitly here: first confirm the caller can read the incident
+ * under THEIR permissions, then read the run + events as root.
+ */
+router.post(
+  "/ai-investigation/incident",
+  UserMiddleware.getUserMiddleware,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const props: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!props.userId) {
+        throw new NotAuthorizedException(
+          "A logged-in user session is required.",
+        );
+      }
+
+      const incidentIdString: string | undefined = req.body["incidentId"] as
+        | string
+        | undefined;
+
+      if (!incidentIdString) {
+        throw new BadDataException("incidentId is required.");
+      }
+
+      const incidentId: ObjectID = new ObjectID(incidentIdString);
+
+      // Access check under the USER's permissions (null when not allowed).
+      const incident: Incident | null = await IncidentService.findOneById({
+        id: incidentId,
+        select: { _id: true },
+        props,
+      });
+
+      if (!incident) {
+        throw new BadDataException(
+          "Incident not found (or you do not have access to it).",
+        );
+      }
+
+      // Read the latest investigation run as root (bypasses the per-user pin).
+      const runs: Array<AIRun> = await AIRunService.findBy({
+        query: {
+          triggeredByIncidentId: incidentId,
+          runType: AIRunType.Investigation,
+        },
+        select: {
+          _id: true,
+          status: true,
+          startedAt: true,
+          completedAt: true,
+          errorMessage: true,
+          llmCallCount: true,
+          toolCallCount: true,
+          totalTokens: true,
+          createdAt: true,
+        },
+        sort: { createdAt: SortOrder.Descending },
+        limit: 1,
+        skip: 0,
+        props: { isRoot: true },
+      });
+
+      const run: AIRun | undefined = runs[0];
+
+      if (!run) {
+        Response.sendJsonObjectResponse(req, res, {
+          run: null,
+          events: [],
+        });
+        return;
+      }
+
+      const events: Array<AIRunEvent> = await AIRunEventService.findBy({
+        query: { aiRunId: run.id! },
+        select: {
+          _id: true,
+          sequence: true,
+          eventType: true,
+          toolName: true,
+          resultSummary: true,
+          createdAt: true,
+        },
+        sort: { sequence: SortOrder.Ascending },
+        limit: MAX_EVENTS,
+        skip: 0,
+        props: { isRoot: true },
+      });
+
+      const runJson: JSONObject | undefined = BaseModel.toJSONArray(
+        [run],
+        AIRun,
+      )[0];
+
+      const eventsJson: JSONArray = BaseModel.toJSONArray(events, AIRunEvent);
+
+      Response.sendJsonObjectResponse(req, res, {
+        run: runJson || null,
+        events: eventsJson,
+      });
+      return;
+    } catch (err) {
+      next(err);
+      return;
+    }
+  },
+);
+
+export default router;