@oneuptime/common 11.5.5 → 11.5.6

package/Models/DatabaseModels/User.ts

@@ -647,6 +647,53 @@ class User extends UserModel {
   })
   public tempAlertPhoneNumber?: Phone = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "createdByUserId",
+    type: TableColumnType.Entity,
+    title: "Created by User",
+    modelType: User,
+    description:
+      "Relation to the User who created (invited) this user, if this user was invited to OneUptime by another user.",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      cascade: false,
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "createdByUserId" })
+  public createdByUser?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Created by User ID",
+    description:
+      "User ID who created (invited) this user, if this user was invited to OneUptime by another user.",
+    example: "b2c3d4e5-f6a7-8901-bcde-f12345678901",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public createdByUserId?: ObjectID = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Server/Infrastructure/Postgres/SchemaMigrations/1784048917994-AddCreatedByUserToUser.ts

@@ -0,0 +1,23 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddCreatedByUserToUser1784048917994 implements MigrationInterface {
+  public name: string = "AddCreatedByUserToUser1784048917994";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Track who created (invited) a user, when they were invited by another user.
+     * Existing users are left NULL; this is only populated going forward.
+     */
+    await queryRunner.query(`ALTER TABLE "User" ADD "createdByUserId" uuid`);
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD CONSTRAINT "FK_cd94f8dd722e4d9e890b68ea262" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "User" DROP CONSTRAINT "FK_cd94f8dd722e4d9e890b68ea262"`,
+    );
+    await queryRunner.query(`ALTER TABLE "User" DROP COLUMN "createdByUserId"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -449,6 +449,7 @@ import { AddSentinelInsight1784010274993 } from "./1784010274993-AddSentinelInsi
 import { AddSentinelInsightFlags1784010274994 } from "./1784010274994-AddSentinelInsightFlags";
 import { RenameSentinelToAI1784030612266 } from "./1784030612266-RenameSentinelToAI";
 import { MigrationName1784033837629 } from "./1784033837629-MigrationName";
+import { AddCreatedByUserToUser1784048917994 } from "./1784048917994-AddCreatedByUserToUser";
 
 export default [
   InitialMigration,
@@ -902,4 +903,5 @@ export default [
   AddSentinelInsightFlags1784010274994,
   RenameSentinelToAI1784030612266,
   MigrationName1784033837629,
+  AddCreatedByUserToUser1784048917994,
 ];

package/Server/Middleware/MasterAdminAuthorization.ts

@@ -1,4 +1,5 @@
 import UserMiddleware from "./UserAuthorization";
+import ProjectMiddleware from "./ProjectAuthorization";
 import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import {
@@ -8,6 +9,7 @@ import {
 } from "../Utils/Express";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import JSONWebTokenData from "../../Types/JsonWebTokenData";
+import ObjectID from "../../Types/ObjectID";
 
 export default class MasterAdminAuthorization {
   public static async isAuthorizedMasterAdminMiddleware(
@@ -52,4 +54,39 @@ export default class MasterAdminAuthorization {
       );
     }
   }
+
+  /*
+   * Same as isAuthorizedMasterAdminMiddleware, but ALSO accepts the instance-wide
+   * master API key (Admin Dashboard → Settings → API Key) supplied in the
+   * `apikey` header. The master key has root/master-admin access, so this lets
+   * automated callers reach the master-admin instance-health endpoints with the
+   * key instead of a logged-in master-admin session.
+   *
+   * Deliberately scoped to the read-only health / diagnostics routes only. It is
+   * NOT used on higher-risk master-admin actions (e.g. the read/write query
+   * console or broadcast email), which stay on the JWT-only middleware above so
+   * that a leaked static key cannot trigger them headlessly.
+   */
+  public static async isAuthorizedMasterAdminOrMasterApiKeyMiddleware(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> {
+    try {
+      const apiKey: ObjectID | null = ProjectMiddleware.getApiKey(req);
+
+      if (apiKey && (await ProjectMiddleware.isMasterApiKey(apiKey))) {
+        next();
+        return;
+      }
+    } catch {
+      // Fall through to the master-admin session (JWT) check below.
+    }
+
+    return MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware(
+      req,
+      res,
+      next,
+    );
+  }
 }

package/Server/Middleware/ProjectAuthorization.ts

@@ -60,6 +60,43 @@ export default class ProjectMiddleware {
     return Boolean(this.getProjectId(req));
   }
 
+  /*
+   * Whether the given key is the instance-wide master API key
+   * (Admin Dashboard → Settings → API Key) and that key is currently enabled.
+   * The master key has root/master-admin access, so this is shared with
+   * MasterAdminAuthorization to let the key reach master-admin-only endpoints
+   * (e.g. instance health) as well.
+   */
+  @CaptureSpan()
+  public static async isMasterApiKey(apiKey: ObjectID): Promise<boolean> {
+    /*
+     * masterApiKey is a Postgres `uuid` column, so a non-UUID header value would
+     * make the lookup raise an "invalid input syntax for type uuid" error on
+     * every request. Reject it cleanly up front — a malformed key is never the
+     * master key anyway — so callers can safely fall through to other auth.
+     */
+    if (!ObjectID.isValidUUID(apiKey.toString())) {
+      return false;
+    }
+
+    const masterKeyGlobalConfig: GlobalConfig | null =
+      await GlobalConfigService.findOneBy({
+        query: {
+          _id: ObjectID.getZeroObjectID().toString(),
+          isMasterApiKeyEnabled: true,
+          masterApiKey: apiKey,
+        },
+        props: {
+          isRoot: true,
+        },
+        select: {
+          _id: true,
+        },
+      });
+
+    return Boolean(masterKeyGlobalConfig);
+  }
+
   @CaptureSpan()
   public static async isValidProjectIdAndApiKeyMiddleware(
     req: ExpressRequest,
@@ -124,22 +161,10 @@ export default class ProjectMiddleware {
 
       if (!apiKeyRow) {
         // check master key.
-        const masterKeyGlobalConfig: GlobalConfig | null =
-          await GlobalConfigService.findOneBy({
-            query: {
-              _id: ObjectID.getZeroObjectID().toString(),
-              isMasterApiKeyEnabled: true,
-              masterApiKey: apiKey,
-            },
-            props: {
-              isRoot: true,
-            },
-            select: {
-              _id: true,
-            },
-          });
+        const isMasterApiKey: boolean =
+          await ProjectMiddleware.isMasterApiKey(apiKey);
 
-        if (masterKeyGlobalConfig) {
+        if (isMasterApiKey) {
           (req as OneUptimeRequest).userType = UserType.MasterAdmin;
 
           // get master admin user

package/Server/Services/TeamMemberService.ts

@@ -147,6 +147,8 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
         user = await UserService.createByEmail({
           email,
           name: nameValue ? new Name(nameValue) : undefined,
+          // Record who invited this brand-new user, so it can be surfaced later.
+          createdByUserId: createBy.props.userId,
           props: {
             isRoot: true,
           },

package/Server/Services/UserService.ts

@@ -446,6 +446,7 @@ export class Service extends DatabaseService<Model> {
     name: Name | undefined;
     isEmailVerified?: boolean;
     generateRandomPassword?: boolean;
+    createdByUserId?: ObjectID | undefined;
     props: DatabaseCommonInteractionProps;
   }): Promise<Model> {
     const { email, props } = data;
@@ -457,6 +458,15 @@ export class Service extends DatabaseService<Model> {
     }
     user.isEmailVerified = data.isEmailVerified || false;
 
+    /*
+     * Record who created this user, when they were created on behalf of
+     * another user (for example, when invited to a project by a team member).
+     * This lets the admin dashboard show who invited a given user.
+     */
+    if (data.createdByUserId) {
+      user.createdByUserId = data.createdByUserId;
+    }
+
     if (data.generateRandomPassword) {
       user.password = new HashedString(Text.generateRandomText(20));
     }

package/Server/Utils/Monitor/MonitorCriteriaExpectationBuilder.ts

@@ -22,6 +22,7 @@ export default class MonitorCriteriaExpectationBuilder {
 
   public static describeCriteriaExpectation(
     criteriaFilter: CriteriaFilter,
+    options?: { unit?: string | undefined },
   ): string | null {
     if (!criteriaFilter.filterType) {
       return null;
@@ -31,24 +32,33 @@ export default class MonitorCriteriaExpectationBuilder {
 
     const value: string | number | undefined = criteriaFilter.value;
 
+    /*
+     * Suffix numeric-threshold comparisons with the metric's display unit
+     * (e.g. "greater than 5 sec") so the threshold reads in the same unit
+     * as the observed value. Only the value-comparison filter types below
+     * carry a numeric threshold — the others (empty, boolean, heartbeat
+     * windows, …) supply their own wording and get no suffix.
+     */
+    const unitSuffix: string = options?.unit ? ` ${options.unit}` : "";
+
     switch (criteriaFilter.filterType) {
       case FilterType.GreaterThan:
-        expectation = `to be greater than ${value}`;
+        expectation = `to be greater than ${value}${unitSuffix}`;
         break;
       case FilterType.GreaterThanOrEqualTo:
-        expectation = `to be greater than or equal to ${value}`;
+        expectation = `to be greater than or equal to ${value}${unitSuffix}`;
         break;
       case FilterType.LessThan:
-        expectation = `to be less than ${value}`;
+        expectation = `to be less than ${value}${unitSuffix}`;
         break;
       case FilterType.LessThanOrEqualTo:
-        expectation = `to be less than or equal to ${value}`;
+        expectation = `to be less than or equal to ${value}${unitSuffix}`;
         break;
       case FilterType.EqualTo:
-        expectation = `to equal ${value}`;
+        expectation = `to equal ${value}${unitSuffix}`;
         break;
       case FilterType.NotEqualTo:
-        expectation = `to not equal ${value}`;
+        expectation = `to not equal ${value}${unitSuffix}`;
         break;
       case FilterType.Contains:
         expectation = `to contain ${value}`;

package/Server/Utils/Monitor/MonitorCriteriaMessageBuilder.ts

@@ -53,9 +53,23 @@ export default class MonitorCriteriaMessageBuilder {
     dataToProcess: DataToProcess;
     monitorStep: MonitorStep;
   }): string | null {
+    /*
+     * Resolve the metric's display unit (undefined for non-metric criteria)
+     * so the threshold in the expectation clause reads in the same unit as
+     * the observed value — "recorded latest 0.06 sec (expected to be greater
+     * than 5 sec)" rather than the unitless "0.06 (expected ... 5)".
+     */
+    const metricDisplayUnit: string | undefined =
+      MonitorCriteriaObservationBuilder.getMetricValueDisplayUnit({
+        criteriaFilter: input.criteriaFilter,
+        dataToProcess: input.dataToProcess,
+        monitorStep: input.monitorStep,
+      });
+
     const expectation: string | null =
       MonitorCriteriaExpectationBuilder.describeCriteriaExpectation(
         input.criteriaFilter,
+        { unit: metricDisplayUnit },
       );
 
     const observation: string | null =

package/Server/Utils/Monitor/MonitorCriteriaMessageFormatter.ts

@@ -136,7 +136,10 @@ export default class MonitorCriteriaMessageFormatter {
     return null;
   }
 
-  public static summarizeNumericSeries(values: Array<number>): string | null {
+  public static summarizeNumericSeries(
+    values: Array<number>,
+    unit?: string | undefined,
+  ): string | null {
     if (!values.length) {
       return null;
     }
@@ -147,12 +150,18 @@ export default class MonitorCriteriaMessageFormatter {
       return null;
     }
 
+    /*
+     * Suffix each value with its unit (e.g. "0.06 sec") so the reader knows
+     * what the numbers mean. Empty when the metric has no known unit.
+     */
+    const unitSuffix: string = unit ? ` ${unit}` : "";
+
     const latestFormatted: string | null =
       MonitorCriteriaMessageFormatter.formatNumber(latest, {
         maximumFractionDigits: 2,
       });
 
-    let summary: string = `latest ${latestFormatted ?? latest}`;
+    let summary: string = `latest ${latestFormatted ?? latest}${unitSuffix}`;
 
     if (values.length > 1) {
       const min: number = Math.min(...values);
@@ -167,7 +176,9 @@ export default class MonitorCriteriaMessageFormatter {
           maximumFractionDigits: 2,
         });
 
-      summary += ` (min ${minFormatted ?? min}, max ${maxFormatted ?? max})`;
+      summary += ` (min ${minFormatted ?? min}${unitSuffix}, max ${
+        maxFormatted ?? max
+      }${unitSuffix})`;
     }
 
     summary += ` across ${values.length} data point${

package/Server/Utils/Monitor/MonitorCriteriaObservationBuilder.ts

@@ -1169,8 +1169,25 @@ export default class MonitorCriteriaObservationBuilder {
         alias: metricValues.alias,
       });
 
+    /*
+     * The display values are expressed in the threshold's unit (or the
+     * metric's native/legend unit when no threshold unit was set). Surface
+     * that unit alongside the numbers so the message reads "latest 0.06 sec"
+     * instead of the unitless "latest 0.06".
+     */
+    const displayUnit: string | undefined =
+      MonitorCriteriaObservationBuilder.resolveMetricUnits({
+        criteriaFilter: input.criteriaFilter,
+        dataToProcess: input.dataToProcess,
+        monitorStep: input.monitorStep,
+        alias: metricValues.alias,
+      }).displayUnit;
+
     const summary: string | null =
-      MonitorCriteriaMessageFormatter.summarizeNumericSeries(displayValues);
+      MonitorCriteriaMessageFormatter.summarizeNumericSeries(
+        displayValues,
+        displayUnit,
+      );
 
     if (!summary) {
       return null;
@@ -1195,18 +1212,67 @@ export default class MonitorCriteriaObservationBuilder {
     monitorStep: MonitorStep;
     alias: string | null;
   }): Array<number> {
-    const thresholdUnit: string | undefined =
-      input.criteriaFilter.metricMonitorOptions?.thresholdUnit;
+    const { sampleUnit, thresholdUnit } =
+      MonitorCriteriaObservationBuilder.resolveMetricUnits({
+        criteriaFilter: input.criteriaFilter,
+        dataToProcess: input.dataToProcess,
+        monitorStep: input.monitorStep,
+        alias: input.alias,
+      });
+
     if (!thresholdUnit) {
       return input.values;
     }
 
+    if (!sampleUnit || sampleUnit === thresholdUnit) {
+      return input.values;
+    }
+
+    return input.values.map((v: number) => {
+      return MetricUnitUtil.convertToMetricUnit({
+        value: v,
+        fromUnit: sampleUnit,
+        metricUnit: thresholdUnit,
+      });
+    });
+  }
+
+  /*
+   * Resolve the units involved in a metric-value observation:
+   *   - sampleUnit:    the unit the raw samples arrive in (legendUnit, or
+   *                    the metric's native unit when no legend was set).
+   *   - thresholdUnit: the unit the user entered the threshold in, if any.
+   *   - displayUnit:   the unit the rendered numbers (samples + threshold)
+   *                    are actually expressed in. This mirrors the
+   *                    MetricMonitorCriteria evaluator: the threshold unit
+   *                    wins when present (samples are converted into it),
+   *                    otherwise the samples stay in their native unit.
+   * Every field is best-effort — undefined when the metric response or
+   * config isn't available. Never throws.
+   */
+  private static resolveMetricUnits(input: {
+    criteriaFilter: CriteriaFilter;
+    dataToProcess: DataToProcess;
+    monitorStep: MonitorStep;
+    alias: string | null;
+  }): {
+    sampleUnit: string | undefined;
+    thresholdUnit: string | undefined;
+    displayUnit: string | undefined;
+  } {
+    const thresholdUnit: string | undefined =
+      input.criteriaFilter.metricMonitorOptions?.thresholdUnit || undefined;
+
     const metricResponse: MetricMonitorResponse | null =
       MonitorCriteriaDataExtractor.getMetricMonitorResponse(
         input.dataToProcess,
       );
     if (!metricResponse) {
-      return input.values;
+      return {
+        sampleUnit: undefined,
+        thresholdUnit,
+        displayUnit: thresholdUnit,
+      };
     }
 
     const metricViewConfig: MetricsViewConfig | undefined =
@@ -1244,17 +1310,69 @@ export default class MonitorCriteriaObservationBuilder {
       nativeUnitFromMap ||
       undefined;
 
-    if (!sampleUnit || sampleUnit === thresholdUnit) {
-      return input.values;
+    return {
+      sampleUnit,
+      thresholdUnit,
+      displayUnit: MonitorCriteriaObservationBuilder.normalizeDisplayUnit(
+        thresholdUnit || sampleUnit,
+      ),
+    };
+  }
+
+  /*
+   * Suppress units that would read as noise next to a raw number. OTel's
+   * dimensionless "1" marks ratio metrics whose samples are fractions in
+   * [0, 1]; rendering "0.06 1" is both ugly and misleading (it is not 1% —
+   * it is 6%). Returning undefined leaves the number unlabelled, matching
+   * the pre-unit behavior for that specific case. Any real unit passes
+   * through unchanged.
+   */
+  private static normalizeDisplayUnit(
+    unit: string | undefined,
+  ): string | undefined {
+    if (!unit || !unit.trim()) {
+      return undefined;
     }
 
-    return input.values.map((v: number) => {
-      return MetricUnitUtil.convertToMetricUnit({
-        value: v,
-        fromUnit: sampleUnit,
-        metricUnit: thresholdUnit,
-      });
+    if (unit.trim() === "1") {
+      return undefined;
+    }
+
+    return unit;
+  }
+
+  /*
+   * Public accessor for the unit that a metric-value criteria's observed
+   * samples and threshold are displayed in. Returns undefined for
+   * non-metric criteria or when no unit can be resolved, so callers can
+   * safely append it as a suffix. Used by the message builder to label the
+   * threshold in the "expected to be greater than 5 sec" clause so it
+   * matches the "recorded latest 0.06 sec" observation.
+   */
+  public static getMetricValueDisplayUnit(input: {
+    criteriaFilter: CriteriaFilter;
+    dataToProcess: DataToProcess;
+    monitorStep: MonitorStep;
+  }): string | undefined {
+    if (input.criteriaFilter.checkOn !== CheckOn.MetricValue) {
+      return undefined;
+    }
+
+    const metricValues: {
+      alias: string | null;
+      values: Array<number>;
+    } | null = MonitorCriteriaDataExtractor.extractMetricValues({
+      criteriaFilter: input.criteriaFilter,
+      dataToProcess: input.dataToProcess,
+      monitorStep: input.monitorStep,
     });
+
+    return MonitorCriteriaObservationBuilder.resolveMetricUnits({
+      criteriaFilter: input.criteriaFilter,
+      dataToProcess: input.dataToProcess,
+      monitorStep: input.monitorStep,
+      alias: metricValues?.alias ?? null,
+    }).displayUnit;
   }
 
   private static getSnmpResponse(input: {