@oneuptime/common 11.7.2 → 11.7.4

package/Server/Types/Workflow/Components/API/Put.ts

@@ -48,6 +48,19 @@ export default class ApiPut extends ComponentCode {
         headers: args["request-headers"] as Dictionary<string>,
       });
 
+      /*
+       * On the server API resolves with an HTTPErrorResponse instead of
+       * throwing (only the UI subclass throws), so the catch below never sees
+       * an HTTP error - a 4xx/5xx used to take the success port and log
+       * "Success" at the customer.
+       */
+      if (apiResult instanceof HTTPErrorResponse) {
+        return Promise.resolve({
+          returnValues: ApiComponentUtils.getReturnValues(apiResult),
+          executePort: result.errorPort,
+        });
+      }
+
       return Promise.resolve({
         returnValues: ApiComponentUtils.getReturnValues(apiResult),
         executePort: result.successPort,

package/Server/Utils/Database/ProjectScopedReferenceValidator.ts

@@ -0,0 +1,212 @@
+import DatabaseService from "../../Services/DatabaseService";
+import Query from "../../Types/Database/Query";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import Select from "../../Types/Database/Select";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+
+/*
+ * Incidents, alerts and scheduled maintenance events point at project-scoped
+ * records — the current state, the severity, the monitor status to switch to.
+ * Nothing checked that those ids belonged to the row's own project, so an id
+ * taken from a second project (an API call, a template, a monitor criteria)
+ * could be persisted.
+ *
+ * That is what makes the *referenced* project undeletable: deleting a Project
+ * cascades into its IncidentState / IncidentSeverity / MonitorStatus rows, but
+ * the Incident row owned by a different project still points at them and those
+ * FKs are ON DELETE NO ACTION, so Postgres raises 23503 and the API answers
+ * "This item cannot be deleted because Incident records still reference it."
+ *
+ * The check below is deliberately narrow, for the same reason
+ * MonitorStepsProjectValidator is: it only rejects an id that really is
+ * another project's record. An id that matches no row at all is left alone —
+ * refusing it would block users from saving their way out of a record that
+ * already references something deleted, and the not-null/foreign-key checks
+ * report that case on their own.
+ */
+
+export interface ProjectScopedReference {
+  // Human readable name of the referenced model, e.g. "Incident Severity".
+  modelName: string;
+  id: ObjectID | string | undefined | null;
+  // The service that owns the referenced model, e.g. IncidentSeverityService.
+  service: DatabaseService<DatabaseBaseModel>;
+}
+
+interface ForeignReference {
+  modelName: string;
+  name: string;
+}
+
+/*
+ * The same reference reaches a service hook in several shapes: the id column
+ * (`incidentSeverityId`), a relation object (`incidentSeverity: { _id }`), an
+ * ObjectID in either slot, or — on the update path — a bare uuid string in the
+ * relation slot, which DatabaseService.sanitizeCreateOrUpdate only turns into
+ * a relation entity *after* onBeforeUpdate has run. Reading `?._id` alone
+ * misses the string shape and the guard would silently pass.
+ */
+export function resolveReferenceId(
+  value: unknown,
+): ObjectID | string | undefined {
+  if (!value) {
+    return undefined;
+  }
+
+  if (typeof value === "string") {
+    return value;
+  }
+
+  if (value instanceof ObjectID) {
+    return value;
+  }
+
+  const relation: { _id?: string | undefined; id?: ObjectID | undefined } =
+    value as { _id?: string | undefined; id?: ObjectID | undefined };
+
+  return relation._id || relation.id || undefined;
+}
+
+export default class ProjectScopedReferenceValidator {
+  public static async validateReferencesBelongToProject(data: {
+    projectId: ObjectID | undefined;
+    references: Array<ProjectScopedReference>;
+    // Used in the error message, e.g. "incident" -> "This incident references…".
+    subject?: string | undefined;
+  }): Promise<void> {
+    if (!data.projectId) {
+      /*
+       * Root/internal writes do not always carry a project. Callers resolve the
+       * project themselves where they can; when they cannot there is nothing to
+       * compare against and the check is a no-op.
+       */
+      return;
+    }
+
+    /*
+     * One lookup per referenced model rather than one per id — an incident
+     * carries three of these and they are on the create path.
+     */
+    const idsByService: Map<
+      DatabaseService<DatabaseBaseModel>,
+      Map<string, string>
+    > = new Map();
+
+    for (const reference of data.references) {
+      const id: string = reference.id?.toString() || "";
+
+      if (!id) {
+        continue;
+      }
+
+      if (!idsByService.has(reference.service)) {
+        idsByService.set(reference.service, new Map());
+      }
+
+      idsByService.get(reference.service)!.set(id, reference.modelName);
+    }
+
+    if (idsByService.size === 0) {
+      return;
+    }
+
+    const foreignReferences: Array<ForeignReference> = [];
+
+    for (const [service, idToModelName] of idsByService) {
+      const records: Array<DatabaseBaseModel> = await service.findBy({
+        query: {
+          _id: QueryHelper.any(Array.from(idToModelName.keys())),
+        },
+        /*
+         * `name` and `projectId` are not on DatabaseBaseModel, but every model
+         * passed here is project scoped and named, so the cast is safe.
+         */
+        select: {
+          _id: true,
+          name: true,
+          projectId: true,
+        } as Select<DatabaseBaseModel>,
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      for (const record of records) {
+        const recordProjectId: ObjectID | undefined =
+          record.getValue<ObjectID>("projectId") || undefined;
+
+        if (recordProjectId?.toString() === data.projectId.toString()) {
+          continue;
+        }
+
+        const id: string = record._id?.toString() || "";
+
+        foreignReferences.push({
+          modelName: idToModelName.get(id) || "Record",
+          name: record.getValue<string>("name")?.toString() || id,
+        });
+      }
+    }
+
+    if (foreignReferences.length === 0) {
+      return;
+    }
+
+    const described: string = foreignReferences
+      .map((reference: ForeignReference) => {
+        return `${reference.modelName} "${reference.name}"`;
+      })
+      .join(", ");
+
+    throw new BadDataException(
+      `This ${
+        data.subject || "request"
+      } references records that belong to a different project: ${described}. Please pick values from this project and try again.`,
+    );
+  }
+
+  /*
+   * "Can this project actually use this record?" — for callers that must not
+   * throw. The probe and telemetry ingest workers build incidents and alerts
+   * from monitor criteria, whose stored ids may still point at another
+   * project (monitorSteps repair could not always resolve them). Throwing
+   * there fails the whole ingest job for that monitor, so those callers ask
+   * this instead and fall back to their project's own default.
+   *
+   * Note the deliberate difference from validateReferencesBelongToProject: an
+   * id that matches NO record is unusable here (false), while the write guard
+   * lets it pass so a record already pointing at something deleted stays
+   * saveable.
+   */
+  public static async isUsableInProject(data: {
+    projectId: ObjectID | undefined;
+    id: ObjectID | string | undefined | null;
+    service: DatabaseService<DatabaseBaseModel>;
+  }): Promise<boolean> {
+    const id: string = data.id?.toString() || "";
+
+    if (!id || !data.projectId) {
+      return false;
+    }
+
+    const record: DatabaseBaseModel | null = await data.service.findOneBy({
+      query: {
+        _id: id,
+        projectId: data.projectId,
+      } as Query<DatabaseBaseModel>,
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return Boolean(record);
+  }
+}

package/Server/Utils/DropFilterValidation.ts

@@ -0,0 +1,127 @@
+import BadDataException from "../../Types/Exception/BadDataException";
+import {
+  MAX_SAMPLE_PERCENTAGE,
+  MIN_SAMPLE_PERCENTAGE,
+} from "../../Types/Telemetry/DropFilterSampling";
+
+/*
+ * Shared save-time validation for log and trace drop filters.
+ *
+ * Both drop-filter models have historically accepted configurations the
+ * ingest engine could not honour, and both failed silently and
+ * destructively:
+ *
+ *   - A blank `filterQuery` compiles to "match every record", so a drop
+ *     filter saved with an empty query discards 100% of a project's
+ *     telemetry. Nothing warned, and nothing recorded the drops.
+ *
+ *   - `samplePercentage` is nullable with no default and the form field is
+ *     optional, so `action = "sample"` could be saved with no percentage at
+ *     all. The engine then fell back to a hardcoded 50, i.e. "silently
+ *     throw away half of it", while the UI rendered the unset value as
+ *     "0% kept".
+ *
+ * Rejecting both at the API boundary is the only place a human is present
+ * to read the error. The ingest path additionally fails *safe* on rows that
+ * predate this validation (see DropFilterSampling.resolveSamplePercentage
+ * and LogDropFilterService.loadDropFilters).
+ *
+ * Deliberately not validated here: whether `filterQuery` actually parses.
+ * The parser lives in the App feature set, which Common must not import,
+ * and an unparsable query compiles to "match nothing" — a harmless no-op
+ * rather than a data-destroying one.
+ */
+
+/*
+ * Both LogDropFilterAction and TraceDropFilterAction spell this "sample";
+ * comparing the raw string keeps this validator usable from both services
+ * without either enum leaking in.
+ */
+export const SAMPLE_ACTION: string = "sample";
+
+export interface DropFilterCandidate {
+  action: string | undefined | null;
+  samplePercentage: number | undefined | null;
+  filterQuery: string | undefined | null;
+}
+
+export interface DropFilterValidationOptions {
+  /*
+   * "logs" or "spans" — only used to make the error message read like the
+   * product surface the user is actually on.
+   */
+  recordNoun: string;
+}
+
+export function validateDropFilterFilterQuery(
+  filterQuery: string | undefined | null,
+  options: DropFilterValidationOptions,
+): void {
+  if (
+    filterQuery === undefined ||
+    filterQuery === null ||
+    filterQuery.trim().length === 0
+  ) {
+    throw new BadDataException(
+      `Filter query is required. A drop filter with an empty query matches every record, which would discard all of this project's ${options.recordNoun}. Add a condition, or delete the filter.`,
+    );
+  }
+}
+
+export function validateDropFilterSamplePercentage(
+  candidate: DropFilterCandidate,
+  options: DropFilterValidationOptions,
+): void {
+  if (candidate.action !== SAMPLE_ACTION) {
+    return;
+  }
+
+  const samplePercentage: number | undefined | null =
+    candidate.samplePercentage;
+
+  if (
+    typeof samplePercentage !== "number" ||
+    !Number.isFinite(samplePercentage)
+  ) {
+    throw new BadDataException(
+      `Sample percentage is required when the action is "Sample". Enter the percentage of matching ${options.recordNoun} to keep, between ${MIN_SAMPLE_PERCENTAGE} and ${MAX_SAMPLE_PERCENTAGE}.`,
+    );
+  }
+
+  if (
+    samplePercentage < MIN_SAMPLE_PERCENTAGE ||
+    samplePercentage > MAX_SAMPLE_PERCENTAGE
+  ) {
+    throw new BadDataException(
+      `Sample percentage must be between ${MIN_SAMPLE_PERCENTAGE} and ${MAX_SAMPLE_PERCENTAGE}. Use the "Drop" action to discard every matching record, or disable the filter to keep every one.`,
+    );
+  }
+}
+
+/*
+ * Validate a fully-resolved candidate row. Callers building this from an
+ * update must merge the incoming partial over the stored row first, so a
+ * request that flips `action` to "sample" without supplying a percentage is
+ * still caught.
+ */
+export function validateDropFilter(
+  candidate: DropFilterCandidate,
+  options: DropFilterValidationOptions,
+): void {
+  validateDropFilterFilterQuery(candidate.filterQuery, options);
+  validateDropFilterSamplePercentage(candidate, options);
+}
+
+/*
+ * `PartialEntity` values may be `() => string` raw SQL expressions rather
+ * than literals. We cannot evaluate one here, so an update that sets a
+ * validated field to an expression cannot be checked — validating a
+ * stringified function would be worse than not validating at all.
+ *
+ * Nothing in the product writes drop-filter fields this way; the branch
+ * exists so the types stay honest and a future caller that does it gets
+ * skipped rather than spuriously rejected.
+ */
+export function isSqlExpressionValue(value: unknown): boolean {
+  return typeof value === "function";
+}

package/Server/Utils/Errors.ts

@@ -14,6 +14,11 @@ export default {
     SUBSCRIPTION_NOT_FOUND: "Subscription not found.",
     INVOICE_NOT_FOUND: "Invoice not found.",
     PAYMENT_INTENT_NOT_FOUND: "Payment intent not found.",
+    TRIAL_END_DATE_IN_PAST: "Trial end date must be in the future.",
+    TRIAL_END_DATE_TOO_FAR_IN_FUTURE:
+      "Trial end date cannot be more than 730 days (two years) in the future. This is a limit imposed by the payment provider.",
+    CANNOT_EXTEND_TRIAL_ON_CANCELLED_SUBSCRIPTION:
+      "This subscription has been cancelled. Its trial cannot be extended.",
   },
   TeamMemberService: {
     ALREADY_INVITED: "This user has already been invited to this team",

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -22,6 +22,7 @@ import { TelemetryQuery } from "../../../Types/Telemetry/TelemetryQuery";
 import { DisableAutomaticAlertCreation } from "../../EnvironmentConfig";
 import AlertService from "../../Services/AlertService";
 import AlertSeverityService from "../../Services/AlertSeverityService";
+import ProjectScopedReferenceValidator from "../Database/ProjectScopedReferenceValidator";
 import AlertStateTimelineService from "../../Services/AlertStateTimelineService";
 import HostService from "../../Services/HostService";
 import NetworkDeviceOwnerUserService, {
@@ -420,7 +421,33 @@ export default class MonitorAlert {
           storageMap,
         });
 
-        if (!criteriaAlert.alertSeverityId) {
+        /*
+         * A criteria severity belonging to *another* project is rejected by
+         * AlertService on create. Throwing here would fail the whole
+         * probe/telemetry ingest job for this monitor, so treat it as
+         * "missing" and fall back to this project's own default — which is
+         * also what stops the bad id spreading onto new alerts. See the same
+         * fallback in MonitorIncident.
+         */
+        const isCriteriaSeverityUsable: boolean =
+          await ProjectScopedReferenceValidator.isUsableInProject({
+            projectId: input.monitor.projectId!,
+            id: criteriaAlert.alertSeverityId,
+            service: AlertSeverityService,
+          });
+
+        if (
+          criteriaAlert.alertSeverityId?.toString() &&
+          !isCriteriaSeverityUsable
+        ) {
+          logger.error(
+            `${input.monitor.id?.toString()} - Criteria "${
+              input.criteriaInstance.data?.name
+            }" references alert severity ${criteriaAlert.alertSeverityId.toString()}, which does not belong to project ${input.monitor.projectId?.toString()}. Falling back to this project's default severity.`,
+          );
+        }
+
+        if (!isCriteriaSeverityUsable) {
           // pick the critical criteria.
 
           const severity: AlertSeverity | null =

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -34,6 +34,7 @@ import PodmanHostService from "../../Services/PodmanHostService";
 import ProxmoxClusterService from "../../Services/ProxmoxClusterService";
 import ServiceService from "../../Services/ServiceService";
 import IncidentSeverityService from "../../Services/IncidentSeverityService";
+import ProjectScopedReferenceValidator from "../Database/ProjectScopedReferenceValidator";
 import IncidentStateTimelineService from "../../Services/IncidentStateTimelineService";
 import IncidentMemberService from "../../Services/IncidentMemberService";
 import NetworkDeviceOwnerUserService, {
@@ -505,7 +506,35 @@ export default class MonitorIncident {
          * Use `?.toString()` truthiness so an empty/blank ObjectID is treated
          * the same as "missing" and falls through to the project-default lookup.
          */
-        if (!criteriaIncident.incidentSeverityId?.toString()) {
+        /*
+         * A criteria severity that belongs to *another* project is rejected by
+         * IncidentService on create. Throwing here would fail the whole
+         * probe/telemetry ingest job for this monitor — no incident, and no
+         * payload or monitor log persisted either, because those run after the
+         * create. Treat it as "missing" and fall back to this project's own
+         * default, which is also what stops the bad id spreading onto new
+         * incidents. monitorSteps can still hold one: the 1785240000000
+         * repair skipped ids it could not resolve.
+         */
+        const isCriteriaSeverityUsable: boolean =
+          await ProjectScopedReferenceValidator.isUsableInProject({
+            projectId: input.monitor.projectId!,
+            id: criteriaIncident.incidentSeverityId,
+            service: IncidentSeverityService,
+          });
+
+        if (
+          criteriaIncident.incidentSeverityId?.toString() &&
+          !isCriteriaSeverityUsable
+        ) {
+          logger.error(
+            `${input.monitor.id?.toString()} - Criteria "${
+              input.criteriaInstance.data?.name
+            }" references incident severity ${criteriaIncident.incidentSeverityId.toString()}, which does not belong to project ${input.monitor.projectId?.toString()}. Falling back to this project's default severity.`,
+          );
+        }
+
+        if (!isCriteriaSeverityUsable) {
           // pick the critical (first/lowest-order root) severity.
 
           const severity: IncidentSeverity | null =
@@ -550,7 +579,7 @@ export default class MonitorIncident {
 
           incident.incidentSeverityId = severity.id!;
         } else {
-          incident.incidentSeverityId = criteriaIncident.incidentSeverityId;
+          incident.incidentSeverityId = criteriaIncident.incidentSeverityId!;
         }
 
         incident.monitors = [input.monitor];

package/Server/Utils/Telemetry/AppMetrics.ts

@@ -208,4 +208,35 @@ export default class AppMetrics {
 
     return this.ingestPayloadBytes;
   }
+
+  // -- Telemetry discarded by project drop filters -----------------------
+
+  private static ingestDroppedCounter: TelemetryCounter | null = null;
+
+  /*
+   * Records telemetry a project's own drop filters discarded at ingest.
+   *
+   * Before this existed, a drop filter deleted records with no trace
+   * anywhere — no log line, no metric, no counter — so "my logs are
+   * missing" tickets could not be distinguished from a broken pipeline
+   * without reading the customer's filter rows by hand.
+   *
+   * Attributes carry `oneuptime.project.id` and `oneuptime.drop_filter.id`
+   * on purpose: without them the counter says only "something dropped
+   * telemetry", which is exactly the unanswerable state this replaces.
+   * Cardinality stays bounded — projects times a handful of filters each,
+   * and only projects that configured a filter ever emit a point.
+   */
+  public static getIngestDroppedCounter(): TelemetryCounter {
+    if (!this.ingestDroppedCounter) {
+      this.ingestDroppedCounter = Telemetry.getCounter({
+        name: "oneuptime.telemetry.ingest.dropped.count",
+        description:
+          "Number of telemetry records discarded by a project's drop filters, partitioned by signal, action, project and filter.",
+        unit: "1",
+      });
+    }
+
+    return this.ingestDroppedCounter;
+  }
 }

package/Tests/Models/AnalyticsModels/KubernetesCostAllocation.test.ts

@@ -37,12 +37,15 @@ describe("Analytics KubernetesCostAllocation model", () => {
       "cpuCoreHours",
       "cpuCoreRequestAverage",
       "cpuCoreUsageAverage",
+      "cpuCoreLimitAverage",
       "cpuCost",
       "gpuHours",
       "gpuCost",
       "ramByteHours",
       "ramBytesRequestAverage",
       "ramBytesUsageAverage",
+      "ramBytesLimitAverage",
+      "ramBytesUsageMax",
       "ramCost",
       "pvByteHours",
       "pvCost",
@@ -95,6 +98,19 @@ describe("Analytics KubernetesCostAllocation model", () => {
     );
   });
 
+  test("carries the shipment identity the ingest dedup relies on", () => {
+    const shipmentId: AnalyticsTableColumn | null =
+      model.getTableColumn("shipmentId");
+    expect(shipmentId?.type).toBe(TableColumnType.Text);
+    // Rows written before the shipment contract read back as "no identity".
+    expect(shipmentId?.defaultValue).toBe("");
+
+    const shipmentChunk: AnalyticsTableColumn | null =
+      model.getTableColumn("shipmentChunk");
+    expect(shipmentChunk?.type).toBe(TableColumnType.Number);
+    expect(shipmentChunk?.defaultValue).toBe(0);
+  });
+
   test("stores labels as a map with an extracted key column", () => {
     const labels: AnalyticsTableColumn | null = model.getTableColumn("labels");
     expect(labels?.type).toBe(TableColumnType.MapStringString);