@oneuptime/common 11.5.7 → 11.5.8

package/Models/DatabaseModels/AIRun.ts

@@ -66,6 +66,7 @@ import CodeFixTaskContext from "../../Types/AI/CodeFixTaskContext";
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
     Permission.ProjectMember,
+    Permission.Viewer,
   ],
   delete: [],
   update: [],
@@ -77,6 +78,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -109,6 +111,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -133,6 +136,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -157,6 +161,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -181,6 +186,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -206,6 +212,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -238,6 +245,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -262,6 +270,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -294,6 +303,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -318,6 +328,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -343,6 +354,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -368,6 +380,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -397,6 +410,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -422,6 +436,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -447,6 +462,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -472,6 +488,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -497,6 +514,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -518,6 +536,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -539,6 +558,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -561,6 +581,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -583,6 +604,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -605,6 +627,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -627,6 +650,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -649,6 +673,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -724,6 +749,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -753,6 +779,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -777,6 +804,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -798,6 +826,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -828,6 +857,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })
@@ -852,6 +882,7 @@ export default class AIRun extends BaseModel {
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
       Permission.ProjectMember,
+      Permission.Viewer,
     ],
     update: [],
   })

package/Server/API/CodeFixRunAPI.ts

@@ -9,11 +9,9 @@ import Express, {
 import Response from "../Utils/Response";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
-import PositiveNumber from "../../Types/PositiveNumber";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
-import Query from "../../Types/BaseDatabase/Query";
 import Select from "../Types/Database/Select";
 import { JSONObject } from "../../Types/JSON";
 import AIRunType from "../../Types/AI/AIRunType";
@@ -26,19 +24,26 @@ import ProjectService from "../Services/ProjectService";
 import AIRunService from "../Services/AIRunService";
 import AIRunEventService from "../Services/AIRunEventService";
 
-const DEFAULT_LIMIT: number = 25;
-const MAX_LIMIT: number = 100;
 const MAX_EVENTS: number = 500;
 
 /*
- * Dedicated read endpoints for the dashboard's AI fix-task pages.
+ * The AI fix task detail page's event trail.
  *
- * Code-fix runs are system-authored AIRuns (runType CodeFix, userId = null)
- * and are therefore hidden by the per-user privacy pin on the generic
- * AIRun / AIRunEvent CRUD. So access is gated explicitly here — the same
- * pattern as AIInvestigationAPI: first confirm the caller can read the
- * parent object (the project) under THEIR permissions, then read the runs
- * and their events as root.
+ * The LIST page does NOT come through here — it reads AIRuns through the
+ * standard /ai-run CRUD, which AIRunService opens up for code-fix runs via a
+ * forced `runType = CodeFix OR userId = <caller>` clause (see
+ * Utils/AI/AIRunPrivacyFilter).
+ *
+ * The events cannot follow. AIRunEvent has NO runType column to key that
+ * clause off, and "userId is null" does not mean "system-authored" — the
+ * investigation engine writes null-userId events too — so project-scoping
+ * AIRunEvent wholesale would expose other members' CHAT toolArguments, which
+ * carry user-typed prompt content. Events are therefore still reached only
+ * through a run this endpoint has already authorized as runType = CodeFix.
+ *
+ * Access is gated explicitly, the same pattern as AIInvestigationAPI: confirm
+ * the caller can read the parent object (the project) under THEIR permissions,
+ * then read the run and its events as root.
  */
 
 const RUN_SELECT: Select<AIRun> = {
@@ -51,6 +56,15 @@ const RUN_SELECT: Select<AIRun> = {
   triggeredByTelemetryExceptionId: true,
   totalTokens: true,
   codeFixTaskType: true,
+  attemptCount: true,
+  llmCallCount: true,
+  toolCallCount: true,
+  /*
+   * Deliberately NOT selected: totalCostInUSDCents. This endpoint's gate is
+   * Project read, which admits roles beyond AIRun's own table ACL, so it must
+   * not return more than the detail page renders — and nothing there renders
+   * per-run spend.
+   */
 };
 
 /*
@@ -81,69 +95,6 @@ export default class CodeFixRunAPI {
   }
 
   private initRoutes(): void {
-    // List the project's code-fix runs, newest first.
-    this.router.post(
-      "/code-fix-run/list",
-      UserMiddleware.getUserMiddleware,
-      async (
-        req: ExpressRequest,
-        res: ExpressResponse,
-        next: NextFunction,
-      ): Promise<void> => {
-        try {
-          const props: DatabaseCommonInteractionProps =
-            await this.getAccessCheckedProps(req);
-
-          const body: JSONObject = (req.body as JSONObject) || {};
-
-          let limit: number = DEFAULT_LIMIT;
-
-          if (typeof body["limit"] === "number") {
-            limit = body["limit"];
-          }
-
-          limit = Math.min(Math.max(Math.floor(limit), 1), MAX_LIMIT);
-
-          let skip: number = 0;
-
-          if (typeof body["skip"] === "number") {
-            skip = Math.max(Math.floor(body["skip"]), 0);
-          }
-
-          const query: Query<AIRun> = {
-            projectId: props.tenantId!,
-            runType: AIRunType.CodeFix,
-          };
-
-          // Root read after the tenant access check above.
-          const runs: Array<AIRun> = await AIRunService.findBy({
-            query: query,
-            select: RUN_SELECT,
-            sort: { createdAt: SortOrder.Descending },
-            limit: limit,
-            skip: skip,
-            props: { isRoot: true },
-          });
-
-          const count: PositiveNumber = await AIRunService.countBy({
-            query: query,
-            props: { isRoot: true },
-          });
-
-          Response.sendJsonObjectResponse(req, res, {
-            runs: runs.map((run: AIRun): JSONObject => {
-              return runToJson(run);
-            }),
-            count: count.toNumber(),
-          });
-          return;
-        } catch (err) {
-          next(err);
-          return;
-        }
-      },
-    );
-
     // One run + its ordered glass-box event trail.
     this.router.post(
       "/code-fix-run/get/:runId",

package/Server/Infrastructure/Postgres/SchemaMigrations/1784105912819-BackfillCodeFixTaskType.ts

@@ -0,0 +1,41 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class BackfillCodeFixTaskType1784105912819
+  implements MigrationInterface
+{
+  public name = "BackfillCodeFixTaskType1784105912819";
+
+  /*
+   * A null AIRun.codeFixTaskType on a CodeFix run has always MEANT
+   * FixException: every code-fix run created before task recipes existed was
+   * an exception fix, and both the server's read path
+   * (CodeFixTaskTypeHelper.fromDatabaseValue) and the dashboard normalize the
+   * null to FixException so nobody ever sees it.
+   *
+   * That normalization only covers reads. Now that the AI Tasks list filters
+   * through the standard CRUD, a "Fix Exception" filter compiles to
+   * `codeFixTaskType IN ('FixException')`, which NULL never matches — the
+   * oldest runs would silently vanish from the filtered list. The bespoke
+   * endpoint papered over this with an equalToOrNull query it built itself;
+   * that endpoint is gone, so the meaning gets written into the data instead.
+   *
+   * Scoped to runType = 'CodeFix': codeFixTaskType is meaningless on chat and
+   * investigation runs and must stay null there.
+   */
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `UPDATE "AIRun" SET "codeFixTaskType" = 'FixException' WHERE "runType" = 'CodeFix' AND "codeFixTaskType" IS NULL`,
+    );
+  }
+
+  /*
+   * Deliberately a no-op. The rows this set are indistinguishable from rows
+   * that already said FixException, so nulling them back would corrupt data
+   * this migration never touched. Reverting is also unnecessary: the read path
+   * still normalizes null to FixException, so an older build reads these rows
+   * exactly as it did before.
+   */
+  public async down(_queryRunner: QueryRunner): Promise<void> {
+    return;
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -450,6 +450,7 @@ import { AddSentinelInsightFlags1784010274994 } from "./1784010274994-AddSentine
 import { RenameSentinelToAI1784030612266 } from "./1784030612266-RenameSentinelToAI";
 import { MigrationName1784033837629 } from "./1784033837629-MigrationName";
 import { AddCreatedByUserToUser1784048917994 } from "./1784048917994-AddCreatedByUserToUser";
+import { BackfillCodeFixTaskType1784105912819 } from "./1784105912819-BackfillCodeFixTaskType";
 
 export default [
   InitialMigration,
@@ -904,4 +905,5 @@ export default [
   RenameSentinelToAI1784030612266,
   MigrationName1784033837629,
   AddCreatedByUserToUser1784048917994,
+  BackfillCodeFixTaskType1784105912819,
 ];

package/Server/Middleware/MasterAdminAuthorization.ts

@@ -59,7 +59,7 @@ export default class MasterAdminAuthorization {
    * Same as isAuthorizedMasterAdminMiddleware, but ALSO accepts the instance-wide
    * master API key (Admin Dashboard → Settings → API Key) supplied in the
    * `apikey` header. The master key has root/master-admin access, so this lets
-   * automated callers reach the master-admin instance-health endpoints with the
+   * automated callers reach the master-admin OneUptime Health endpoints with the
    * key instead of a logged-in master-admin session.
    *
    * Deliberately scoped to the read-only health / diagnostics routes only. It is

package/Server/Middleware/ProjectAuthorization.ts

@@ -65,7 +65,7 @@ export default class ProjectMiddleware {
    * (Admin Dashboard → Settings → API Key) and that key is currently enabled.
    * The master key has root/master-admin access, so this is shared with
    * MasterAdminAuthorization to let the key reach master-admin-only endpoints
-   * (e.g. instance health) as well.
+   * (e.g. OneUptime Health) as well.
    */
   @CaptureSpan()
   public static async isMasterApiKey(apiKey: ObjectID): Promise<boolean> {

package/Server/Services/AIRunService.ts

@@ -16,7 +16,7 @@ import FindBy from "../Types/Database/FindBy";
 import { OnFind } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/AIRun";
-import { pinQueryToRequestingUser } from "../Utils/AI/AIChatPrivacyFilter";
+import { applyAIRunPrivacyFilter } from "../Utils/AI/AIRunPrivacyFilter";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { UpdateQueryBuilder, UpdateResult } from "typeorm";
 import { QueryDeepPartialEntity } from "typeorm/query-builder/QueryPartialEntity";
@@ -331,23 +331,22 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeFind(
     findBy: FindBy<Model>,
   ): Promise<OnFind<Model>> {
-    findBy.query = pinQueryToRequestingUser(
-      findBy.query,
-      findBy.props,
-      "userId",
-    );
+    findBy.query = applyAIRunPrivacyFilter(findBy.query, findBy.props);
     return { findBy, carryForward: null };
   }
 
+  /*
+   * countBy MUST repeat the filter. DatabaseService has no onBeforeCount hook
+   * (only onCountSuccess / onCountError), and BaseAPI.getList issues findBy
+   * and countBy with the SAME client query, so filtering in onBeforeFind alone
+   * would return a correctly-scoped list beside an unscoped project-wide
+   * count on every page. IncidentService repeats it for the same reason.
+   */
   @CaptureSpan()
   public override async countBy(
     countBy: CountBy<Model>,
   ): Promise<PositiveNumber> {
-    countBy.query = pinQueryToRequestingUser(
-      countBy.query,
-      countBy.props,
-      "userId",
-    );
+    countBy.query = applyAIRunPrivacyFilter(countBy.query, countBy.props);
     return super.countBy(countBy);
   }
 }

package/Server/Utils/AI/AIRunPrivacyFilter.ts

@@ -0,0 +1,106 @@
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { FindWhereProperty } from "../../../Types/BaseDatabase/Query";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import AIRunType from "../../../Types/AI/AIRunType";
+import Text from "../../../Types/Text";
+import { combineWithPrivacyClause } from "../PrivacyFilterUtil";
+import { Raw } from "typeorm";
+
+/*
+ * AIRun mixes two kinds of row under one table:
+ *
+ *  - Chat and investigation runs are PERSONAL. They hang off a conversation
+ *    and carry the user's own prompt trail, so only their author may read
+ *    them. This is what AIChatPrivacyFilter's flat pin protects, and that pin
+ *    stays exactly as it is for AIConversation, AIConversationMessage and
+ *    AIRunEvent.
+ *  - CodeFix runs are a SHARED TEAM ARTIFACT: they are triggered off an
+ *    exception or an incident, they produce a pull request, and their child
+ *    AIAgentTaskPullRequest rows are already project-readable through the
+ *    standard CRUD. `userId` on a CodeFix run is attribution only (who
+ *    clicked "Fix with AI Agent") and is null for automatic triggers — it
+ *    carries no conversational content.
+ *
+ * So AIRun cannot use that flat pin. It needs `runType = CodeFix OR userId =
+ * <caller>`, a CROSS-COLUMN disjunction, which a query object cannot express
+ * (query objects are conjunctions).
+ *
+ * The clause below is built ENTIRELY from server state and AND-ed onto the
+ * caller's query. It never READS query.runType to decide anything — that
+ * would be unsound, because onBeforeFind runs BEFORE QueryUtil.serializeQuery,
+ * so query.runType here is still a raw, client-controlled operator object
+ * whose .value/.toString() are identical across the safe and hostile cases:
+ * LessThan("CodeFix") stringifies to exactly "CodeFix" but compiles to
+ * `runType < 'CodeFix'`, which matches "Chat". Because the clause is forced, a
+ * caller-supplied runType filter can only ever NARROW it, and
+ * combineWithPrivacyClause fails closed on operator shapes it does not
+ * recognize.
+ *
+ * Modelled on Utils/Incident/IncidentPrivacyFilter, which solves the same
+ * "unrestricted rows for everyone, restricted rows only for their owner"
+ * shape.
+ */
+export function getAIRunPrivacyRaw(
+  props: DatabaseCommonInteractionProps,
+): FindWhereProperty<any> | undefined {
+  if (props.isRoot || props.isMasterAdmin) {
+    return undefined;
+  }
+
+  /*
+   * The same hard gate the flat pin has, and it must stay. A caller with no
+   * user — a project API key, which gets userTenantAccessPermission but never
+   * userAuthorization (see ProjectAuthorization), so props.userId is
+   * undefined — has no personal scope. Today such a caller cannot read AIRun
+   * at all. Letting CodeFix rows through here would hand every API key holding
+   * ProjectMember the project's whole fix history: access that neither
+   * /ai-run nor /code-fix-run grants today. That is a separate product
+   * decision and must not ride in as a side effect of this filter.
+   */
+  if (!props.userId) {
+    throw new NotAuthorizedException(
+      "AI runs are personal and can only be accessed by the user who created them.",
+    );
+  }
+
+  const userIdRid: string = "aiRunUid_" + Text.generateRandomText(10);
+  const runTypeRid: string = "aiRunType_" + Text.generateRandomText(10);
+
+  return Raw(
+    (alias: string): string => {
+      return `(${alias} = :${runTypeRid} OR "AIRun"."userId" = :${userIdRid})`;
+    },
+    {
+      [runTypeRid]: AIRunType.CodeFix,
+      [userIdRid]: props.userId.toString(),
+    },
+  );
+}
+
+/*
+ * Applies the clause above on AIRun.runType. Project isolation is unaffected:
+ * @TenantColumn("projectId") independently forces projectId = <tenant>, so
+ * "CodeFix runs are readable" always means "in YOUR project".
+ */
+export function applyAIRunPrivacyFilter<TQuery>(
+  query: TQuery,
+  props: DatabaseCommonInteractionProps,
+): TQuery {
+  const rawClause: FindWhereProperty<any> | undefined =
+    getAIRunPrivacyRaw(props);
+
+  if (!rawClause) {
+    return query;
+  }
+
+  if (!query) {
+    return { runType: rawClause } as unknown as TQuery;
+  }
+
+  (query as any).runType = combineWithPrivacyClause(
+    (query as any).runType,
+    rawClause,
+  );
+
+  return query;
+}