@oneuptime/common 11.5.4 → 11.5.5

package/Server/API/CodeFixRunAPI.ts

@@ -0,0 +1,251 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import CommonAPI from "./CommonAPI";
+import Express, {
+  ExpressRequest,
+  ExpressResponse,
+  ExpressRouter,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import Query from "../../Types/BaseDatabase/Query";
+import Select from "../Types/Database/Select";
+import { JSONObject } from "../../Types/JSON";
+import AIRunType from "../../Types/AI/AIRunType";
+import { CodeFixTaskTypeHelper } from "../../Types/AI/CodeFixTaskType";
+import AIRun from "../../Models/DatabaseModels/AIRun";
+import AIRunEvent from "../../Models/DatabaseModels/AIRunEvent";
+import Project from "../../Models/DatabaseModels/Project";
+import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import ProjectService from "../Services/ProjectService";
+import AIRunService from "../Services/AIRunService";
+import AIRunEventService from "../Services/AIRunEventService";
+
+const DEFAULT_LIMIT: number = 25;
+const MAX_LIMIT: number = 100;
+const MAX_EVENTS: number = 500;
+
+/*
+ * Dedicated read endpoints for the dashboard's AI fix-task pages.
+ *
+ * Code-fix runs are system-authored AIRuns (runType CodeFix, userId = null)
+ * and are therefore hidden by the per-user privacy pin on the generic
+ * AIRun / AIRunEvent CRUD. So access is gated explicitly here — the same
+ * pattern as AIInvestigationAPI: first confirm the caller can read the
+ * parent object (the project) under THEIR permissions, then read the runs
+ * and their events as root.
+ */
+
+const RUN_SELECT: Select<AIRun> = {
+  _id: true,
+  status: true,
+  createdAt: true,
+  startedAt: true,
+  completedAt: true,
+  errorMessage: true,
+  triggeredByTelemetryExceptionId: true,
+  totalTokens: true,
+  codeFixTaskType: true,
+};
+
+/*
+ * Serialize a run with codeFixTaskType normalized: a null column means
+ * FixException (rows created before task recipes existed), and clients
+ * should never have to know about the legacy null.
+ */
+function runToJson(run: AIRun): JSONObject {
+  const runJson: JSONObject = BaseModel.toJSONArray([run], AIRun)[0] || {};
+
+  runJson["codeFixTaskType"] = CodeFixTaskTypeHelper.fromDatabaseValue(
+    run.codeFixTaskType,
+  );
+
+  return runJson;
+}
+
+export default class CodeFixRunAPI {
+  public router!: ExpressRouter;
+
+  public constructor() {
+    this.router = Express.getRouter();
+    this.initRoutes();
+  }
+
+  public getRouter(): ExpressRouter {
+    return this.router;
+  }
+
+  private initRoutes(): void {
+    // List the project's code-fix runs, newest first.
+    this.router.post(
+      "/code-fix-run/list",
+      UserMiddleware.getUserMiddleware,
+      async (
+        req: ExpressRequest,
+        res: ExpressResponse,
+        next: NextFunction,
+      ): Promise<void> => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await this.getAccessCheckedProps(req);
+
+          const body: JSONObject = (req.body as JSONObject) || {};
+
+          let limit: number = DEFAULT_LIMIT;
+
+          if (typeof body["limit"] === "number") {
+            limit = body["limit"];
+          }
+
+          limit = Math.min(Math.max(Math.floor(limit), 1), MAX_LIMIT);
+
+          let skip: number = 0;
+
+          if (typeof body["skip"] === "number") {
+            skip = Math.max(Math.floor(body["skip"]), 0);
+          }
+
+          const query: Query<AIRun> = {
+            projectId: props.tenantId!,
+            runType: AIRunType.CodeFix,
+          };
+
+          // Root read after the tenant access check above.
+          const runs: Array<AIRun> = await AIRunService.findBy({
+            query: query,
+            select: RUN_SELECT,
+            sort: { createdAt: SortOrder.Descending },
+            limit: limit,
+            skip: skip,
+            props: { isRoot: true },
+          });
+
+          const count: PositiveNumber = await AIRunService.countBy({
+            query: query,
+            props: { isRoot: true },
+          });
+
+          Response.sendJsonObjectResponse(req, res, {
+            runs: runs.map((run: AIRun): JSONObject => {
+              return runToJson(run);
+            }),
+            count: count.toNumber(),
+          });
+          return;
+        } catch (err) {
+          next(err);
+          return;
+        }
+      },
+    );
+
+    // One run + its ordered glass-box event trail.
+    this.router.post(
+      "/code-fix-run/get/:runId",
+      UserMiddleware.getUserMiddleware,
+      async (
+        req: ExpressRequest,
+        res: ExpressResponse,
+        next: NextFunction,
+      ): Promise<void> => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await this.getAccessCheckedProps(req);
+
+          const runIdString: string | undefined = req.params["runId"];
+
+          if (!runIdString) {
+            throw new BadDataException("runId is required.");
+          }
+
+          const runId: ObjectID = new ObjectID(runIdString);
+
+          /*
+           * Root read, but pinned to the caller's (access-checked) project —
+           * a run id from another project resolves to "not found".
+           */
+          const run: AIRun | null = await AIRunService.findOneBy({
+            query: {
+              _id: runId.toString(),
+              projectId: props.tenantId!,
+              runType: AIRunType.CodeFix,
+            },
+            select: RUN_SELECT,
+            props: { isRoot: true },
+          });
+
+          if (!run) {
+            throw new BadDataException(
+              "Code fix run not found (or it does not belong to this project).",
+            );
+          }
+
+          const events: Array<AIRunEvent> = await AIRunEventService.findBy({
+            query: { aiRunId: run.id! },
+            select: {
+              _id: true,
+              sequence: true,
+              eventType: true,
+              toolName: true,
+              resultSummary: true,
+              createdAt: true,
+            },
+            sort: { sequence: SortOrder.Ascending },
+            limit: MAX_EVENTS,
+            skip: 0,
+            props: { isRoot: true },
+          });
+
+          Response.sendJsonObjectResponse(req, res, {
+            run: runToJson(run),
+            events: BaseModel.toJSONArray(events, AIRunEvent),
+          });
+          return;
+        } catch (err) {
+          next(err);
+          return;
+        }
+      },
+    );
+  }
+
+  /*
+   * Requires a logged-in session and a tenant, then verifies project access
+   * by reading the project under the USER's permissions (null when the user
+   * is not a member). Returns the props for further use.
+   */
+  private async getAccessCheckedProps(
+    req: ExpressRequest,
+  ): Promise<DatabaseCommonInteractionProps> {
+    const props: DatabaseCommonInteractionProps =
+      await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+    if (!props.userId) {
+      throw new NotAuthorizedException("A logged-in user session is required.");
+    }
+
+    if (!props.tenantId) {
+      throw new BadDataException("Project ID is required (tenantid header).");
+    }
+
+    // Access check under the USER's permissions (null when not allowed).
+    const project: Project | null = await ProjectService.findOneById({
+      id: props.tenantId,
+      select: { _id: true },
+      props: props,
+    });
+
+    if (!project) {
+      throw new NotAuthorizedException(
+        "Project not found (or you do not have access to it).",
+      );
+    }
+
+    return props;
+  }
+}

package/Server/API/GitHubAPI.ts

@@ -9,7 +9,8 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
-import { JSONObject } from "../../Types/JSON";
+import { JSONArray, JSONObject } from "../../Types/JSON";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
 import {
   DashboardClientUrl,
   GitHubAppName,
@@ -20,10 +21,13 @@ import GitHubUtil, {
   GitHubRepository,
   GitHubInstallationNotFoundError,
 } from "../Utils/CodeRepository/GitHub/GitHub";
-import CodeRepositoryService from "../Services/CodeRepositoryService";
+import CodeRepositoryService, {
+  ImportReposFromInstallationResult,
+} from "../Services/CodeRepositoryService";
 import ProjectService from "../Services/ProjectService";
 import AccessTokenService from "../Services/AccessTokenService";
 import CodeRepository from "../../Models/DatabaseModels/CodeRepository";
+import Project from "../../Models/DatabaseModels/Project";
 import CodeRepositoryType from "../../Types/CodeRepository/CodeRepositoryType";
 import URL from "../../Types/API/URL";
 import UserMiddleware from "../Middleware/UserAuthorization";
@@ -32,6 +36,141 @@ import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBas
 import { UserTenantAccessPermission } from "../../Types/Permission";
 
 export default class GitHubAPI {
+  /*
+   * Resolves the projects linked to a GitHub App installation. The
+   * installation ID is stored on the Project when the install callback runs
+   * (mirroring how the uninstall webhook resolves projects). As a fallback,
+   * also look at existing CodeRepository rows that carry the installation ID
+   * (e.g. if the ID was cleared from the project but repositories remain).
+   */
+  private static async getProjectIdsForInstallation(
+    installationId: string,
+  ): Promise<Array<ObjectID>> {
+    const projectIds: Array<string> = [];
+
+    const projects: Array<Project> = await ProjectService.findBy({
+      query: {
+        gitHubAppInstallationId: installationId,
+      },
+      select: {
+        _id: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const project of projects) {
+      if (project.id) {
+        projectIds.push(project.id.toString());
+      }
+    }
+
+    const codeRepositories: Array<CodeRepository> =
+      await CodeRepositoryService.findBy({
+        query: {
+          gitHubAppInstallationId: installationId,
+        },
+        select: {
+          projectId: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+    for (const codeRepository of codeRepositories) {
+      if (
+        codeRepository.projectId &&
+        !projectIds.includes(codeRepository.projectId.toString())
+      ) {
+        projectIds.push(codeRepository.projectId.toString());
+      }
+    }
+
+    return projectIds.map((projectId: string) => {
+      return new ObjectID(projectId);
+    });
+  }
+
+  // Imports all repositories in an installation into every project linked to it.
+  private static async importInstallationRepositoriesForLinkedProjects(
+    installationId: string,
+  ): Promise<void> {
+    const projectIds: Array<ObjectID> =
+      await GitHubAPI.getProjectIdsForInstallation(installationId);
+
+    if (projectIds.length === 0) {
+      logger.info(
+        `GitHub webhook: no projects linked to installation ${installationId}. Skipping repository import.`,
+      );
+      return;
+    }
+
+    for (const projectId of projectIds) {
+      const importResult: ImportReposFromInstallationResult =
+        await CodeRepositoryService.importReposFromInstallation({
+          projectId: projectId,
+          installationId: installationId,
+        });
+
+      logger.info(
+        `GitHub webhook: imported ${importResult.imported} repositories (${importResult.skipped} skipped) into project ${projectId.toString()} for installation ${installationId}`,
+      );
+    }
+  }
+
+  /*
+   * Deletes CodeRepository rows for repositories that were removed from the
+   * installation. Once a repository is removed we can no longer mint tokens
+   * for it, so keeping the row around is a dead end. Uses the service delete
+   * so cascades / SET NULLs apply.
+   */
+  private static async removeRepositoriesForInstallation(
+    installationId: string,
+    removedRepositories: JSONArray,
+  ): Promise<void> {
+    for (const removedRepository of removedRepositories) {
+      const fullName: string | undefined = (removedRepository as JSONObject)?.[
+        "full_name"
+      ]?.toString();
+
+      if (!fullName) {
+        continue;
+      }
+
+      const slashIndex: number = fullName.indexOf("/");
+
+      if (slashIndex <= 0) {
+        continue;
+      }
+
+      const organizationName: string = fullName.substring(0, slashIndex);
+      const repositoryName: string = fullName.substring(slashIndex + 1);
+
+      const deletedCount: number = await CodeRepositoryService.deleteBy({
+        query: {
+          gitHubAppInstallationId: installationId,
+          organizationName: organizationName,
+          repositoryName: repositoryName,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      logger.info(
+        `GitHub webhook: removed ${deletedCount} repository record(s) for ${fullName} (installation ${installationId})`,
+      );
+    }
+  }
+
   public getRouter(): ExpressRouter {
     const router: ExpressRouter = Express.getRouter();
 
@@ -135,6 +274,34 @@ export default class GitHubAPI {
             },
           });
 
+          /*
+           * Import all repositories in the installation automatically so the
+           * user does not have to pick them one at a time. Failures are
+           * logged but do not fail the callback — the import is retried via
+           * the installation_repositories webhook or on reinstall.
+           */
+          try {
+            const importResult: ImportReposFromInstallationResult =
+              await CodeRepositoryService.importReposFromInstallation({
+                projectId: new ObjectID(projectId),
+                installationId: installationId,
+              });
+
+            logger.info(
+              `GitHub App installation ${installationId}: imported ${importResult.imported} repositories (${importResult.skipped} skipped) into project ${projectId}`,
+              getLogAttributesFromRequest(req as OneUptimeRequest),
+            );
+          } catch (importError) {
+            logger.error(
+              `GitHub Auth Callback: Failed to import repositories from installation ${installationId} into project ${projectId}:`,
+              getLogAttributesFromRequest(req as OneUptimeRequest),
+            );
+            logger.error(
+              importError,
+              getLogAttributesFromRequest(req as OneUptimeRequest),
+            );
+          }
+
           // Redirect back to dashboard with installation ID
           const redirectUrl: string = `${DashboardClientUrl.toString()}/${projectId}/code-repository?installation_id=${installationId}`;
 
@@ -518,7 +685,7 @@ export default class GitHubAPI {
             getLogAttributesFromRequest(req as OneUptimeRequest),
           );
 
-          // Handle installation events - specifically when the app is uninstalled
+          // Handle installation events - install and uninstall of the app
           if (event === "installation") {
             const action: string | undefined = (req.body as JSONObject)?.[
               "action"
@@ -527,6 +694,28 @@ export default class GitHubAPI {
               (req.body as JSONObject)?.["installation"] as JSONObject
             )?.["id"]?.toString();
 
+            /*
+             * App installed - import all repositories in the installation
+             * into any project linked to it. This covers installs done
+             * directly from GitHub (marketplace) without our redirect flow.
+             */
+            if (action === "created" && installationId) {
+              try {
+                await GitHubAPI.importInstallationRepositoriesForLinkedProjects(
+                  installationId,
+                );
+              } catch (importError) {
+                logger.error(
+                  `Failed to import repositories for GitHub App installation ${installationId}:`,
+                  getLogAttributesFromRequest(req as OneUptimeRequest),
+                );
+                logger.error(
+                  importError,
+                  getLogAttributesFromRequest(req as OneUptimeRequest),
+                );
+              }
+            }
+
             if (action === "deleted" && installationId) {
               logger.info(
                 `GitHub App installation ${installationId} was deleted. Clearing from database...`,
@@ -581,6 +770,60 @@ export default class GitHubAPI {
             }
           }
 
+          /*
+           * Handle repositories being added to / removed from the
+           * installation so connected repositories stay in sync with GitHub
+           * without any manual picking.
+           */
+          if (event === "installation_repositories") {
+            const body: JSONObject = req.body as JSONObject;
+            const installationId: string | undefined = (
+              body["installation"] as JSONObject
+            )?.["id"]?.toString();
+
+            if (installationId) {
+              const repositoriesAdded: JSONArray =
+                (body["repositories_added"] as JSONArray) || [];
+              const repositoriesRemoved: JSONArray =
+                (body["repositories_removed"] as JSONArray) || [];
+
+              if (repositoriesAdded.length > 0) {
+                try {
+                  await GitHubAPI.importInstallationRepositoriesForLinkedProjects(
+                    installationId,
+                  );
+                } catch (importError) {
+                  logger.error(
+                    `Failed to import added repositories for GitHub App installation ${installationId}:`,
+                    getLogAttributesFromRequest(req as OneUptimeRequest),
+                  );
+                  logger.error(
+                    importError,
+                    getLogAttributesFromRequest(req as OneUptimeRequest),
+                  );
+                }
+              }
+
+              if (repositoriesRemoved.length > 0) {
+                try {
+                  await GitHubAPI.removeRepositoriesForInstallation(
+                    installationId,
+                    repositoriesRemoved,
+                  );
+                } catch (removeError) {
+                  logger.error(
+                    `Failed to remove repositories for GitHub App installation ${installationId}:`,
+                    getLogAttributesFromRequest(req as OneUptimeRequest),
+                  );
+                  logger.error(
+                    removeError,
+                    getLogAttributesFromRequest(req as OneUptimeRequest),
+                  );
+                }
+              }
+            }
+          }
+
           /*
            * Handle different webhook events here
            * For now, just acknowledge receipt