@oneuptime/common 11.7.2 → 11.7.4

package/Server/Services/AlertEpisodeService.ts

@@ -32,6 +32,9 @@ import {
 import URL from "../../Types/API/URL";
 import DatabaseConfig from "../DatabaseConfig";
 import AlertSeverityService from "./AlertSeverityService";
+import ProjectScopedReferenceValidator, {
+  resolveReferenceId,
+} from "../Utils/Database/ProjectScopedReferenceValidator";
 import AlertEpisodeMemberService from "./AlertEpisodeMemberService";
 import AlertEpisodeOwnerUserService from "./AlertEpisodeOwnerUserService";
 import AlertEpisodeOwnerTeamService from "./AlertEpisodeOwnerTeamService";
@@ -94,6 +97,36 @@ export class Service extends DatabaseService<Model> {
       updateBy.query,
       updateBy.props,
     );
+
+    /*
+     * An episode carries the same project-scoped state and severity an alert
+     * does, on FKs that are equally ON DELETE NO ACTION, so an id from another
+     * project here leaves that project undeletable in exactly the same way.
+     * onBeforeCreate overwrites currentAlertStateId with this project's
+     * created state, which leaves the severity as the only create-reachable
+     * column — but an update can write either.
+     */
+    await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+      projectId: updateBy.props.tenantId,
+      subject: "alert episode",
+      references: [
+        {
+          modelName: "Alert State",
+          id:
+            resolveReferenceId(updateBy.data.currentAlertStateId) ||
+            resolveReferenceId(updateBy.data.currentAlertState),
+          service: AlertStateService,
+        },
+        {
+          modelName: "Alert Severity",
+          id:
+            resolveReferenceId(updateBy.data.alertSeverityId) ||
+            resolveReferenceId(updateBy.data.alertSeverity),
+          service: AlertSeverityService,
+        },
+      ],
+    });
+
     return { updateBy, carryForward: null };
   }
 
@@ -141,6 +174,20 @@ export class Service extends DatabaseService<Model> {
 
     createBy.data.currentAlertStateId = alertState.id;
 
+    await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+      projectId: projectId,
+      subject: "alert episode",
+      references: [
+        {
+          modelName: "Alert Severity",
+          id:
+            resolveReferenceId(createBy.data.alertSeverityId) ||
+            resolveReferenceId(createBy.data.alertSeverity),
+          service: AlertSeverityService,
+        },
+      ],
+    });
+
     // Auto-generate episode number
     const episodeCounterResult: {
       counter: number;

package/Server/Services/AlertService.ts

@@ -29,6 +29,10 @@ import Model from "../../Models/DatabaseModels/Alert";
 import AlertOwnerTeam from "../../Models/DatabaseModels/AlertOwnerTeam";
 import AlertOwnerUser from "../../Models/DatabaseModels/AlertOwnerUser";
 import AlertState from "../../Models/DatabaseModels/AlertState";
+import MonitorStatusService from "./MonitorStatusService";
+import ProjectScopedReferenceValidator, {
+  resolveReferenceId,
+} from "../Utils/Database/ProjectScopedReferenceValidator";
 import AlertStateTimeline from "../../Models/DatabaseModels/AlertStateTimeline";
 import User from "../../Models/DatabaseModels/User";
 import { IsBillingEnabled } from "../EnvironmentConfig";
@@ -258,9 +262,98 @@ export class Service extends DatabaseService<Model> {
       updateBy.query,
       updateBy.props,
     );
+
+    await this.validateProjectScopedReferences(updateBy);
+
     return { updateBy, carryForward: null };
   }
 
+  /*
+   * An update can repoint an alert at another project's state, severity or
+   * monitor status just as easily as a create can, and the result is the same:
+   * the referenced project can no longer be deleted. Only the columns actually
+   * being written are checked, so ordinary updates cost no extra queries.
+   */
+  private async validateProjectScopedReferences(
+    updateBy: UpdateBy<Model>,
+  ): Promise<void> {
+    const alertStateId: ObjectID | string | undefined =
+      resolveReferenceId(updateBy.data.currentAlertStateId) ||
+      resolveReferenceId(updateBy.data.currentAlertState);
+
+    const alertSeverityId: ObjectID | string | undefined =
+      resolveReferenceId(updateBy.data.alertSeverityId) ||
+      resolveReferenceId(updateBy.data.alertSeverity);
+
+    const monitorStatusId: ObjectID | string | undefined =
+      resolveReferenceId(
+        updateBy.data.monitorStatusWhenThisAlertWasCreatedId,
+      ) ||
+      resolveReferenceId(updateBy.data.monitorStatusWhenThisAlertWasCreated);
+
+    if (!alertStateId && !alertSeverityId && !monitorStatusId) {
+      return;
+    }
+
+    /*
+     * Root/API updates do not always carry a tenantId, so fall back to the
+     * project of each alert the query actually matches.
+     */
+    const projectIds: Array<ObjectID> = updateBy.props.tenantId
+      ? [updateBy.props.tenantId]
+      : await this.getProjectIdsForUpdateQuery(updateBy);
+
+    for (const projectId of projectIds) {
+      await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: projectId,
+        subject: "alert",
+        references: [
+          {
+            modelName: "Alert State",
+            id: alertStateId,
+            service: AlertStateService,
+          },
+          {
+            modelName: "Alert Severity",
+            id: alertSeverityId,
+            service: AlertSeverityService,
+          },
+          {
+            modelName: "Monitor Status",
+            id: monitorStatusId,
+            service: MonitorStatusService,
+          },
+        ],
+      });
+    }
+  }
+
+  private async getProjectIdsForUpdateQuery(
+    updateBy: UpdateBy<Model>,
+  ): Promise<Array<ObjectID>> {
+    const alerts: Array<Model> = await this.findBy({
+      query: updateBy.query,
+      select: {
+        projectId: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const projectIds: Dictionary<ObjectID> = {};
+
+    for (const alert of alerts) {
+      if (alert.projectId) {
+        projectIds[alert.projectId.toString()] = alert.projectId;
+      }
+    }
+
+    return Object.values(projectIds);
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
@@ -293,6 +386,38 @@ export class Service extends DatabaseService<Model> {
 
     createBy.data.currentAlertStateId = alertState.id;
 
+    /*
+     * The severity and the monitor status stamped on the alert come from the
+     * monitor criteria or the API caller, neither of which checked that the
+     * record belongs to this project. Persisting another project's id leaves
+     * that project undeletable. Runs before the counter increment so a
+     * rejected create does not burn an alert number.
+     */
+    await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+      projectId: projectId,
+      subject: "alert",
+      references: [
+        {
+          modelName: "Alert Severity",
+          id:
+            resolveReferenceId(createBy.data.alertSeverityId) ||
+            resolveReferenceId(createBy.data.alertSeverity),
+          service: AlertSeverityService,
+        },
+        {
+          modelName: "Monitor Status",
+          id:
+            resolveReferenceId(
+              createBy.data.monitorStatusWhenThisAlertWasCreatedId,
+            ) ||
+            resolveReferenceId(
+              createBy.data.monitorStatusWhenThisAlertWasCreated,
+            ),
+          service: MonitorStatusService,
+        },
+      ],
+    });
+
     const alertCounterResult: {
       counter: number;
       prefix: string | undefined;

package/Server/Services/BillingService.ts

@@ -37,6 +37,13 @@ export interface PaymentMethod {
   isDefault: boolean;
 }
 
+/*
+ * Stripe rejects a trial_end more than two years past the billing cycle
+ * anchor. Enforce the same ceiling here so an admin gets a readable error
+ * instead of a raw payment-provider failure.
+ */
+export const MAX_TRIAL_LENGTH_IN_DAYS: number = 730;
+
 export interface Invoice {
   id: string;
   amount: number;
@@ -870,6 +877,97 @@ export class BillingService extends BaseService {
     }
   }
 
+  /*
+   * Moves the trial end of a project's subscriptions to a new date.
+   *
+   * Both the flat-fee subscription and the metered subscription have to move
+   * together: they were created with the same trial_end (see subscribeToPlan),
+   * and leaving the metered one behind would start billing usage while the
+   * customer still believes they are on trial.
+   */
+  @CaptureSpan()
+  public async extendTrial(data: {
+    subscriptionId: string;
+    meteredSubscriptionId?: string | undefined;
+    trialEndsAt: Date;
+  }): Promise<void> {
+    if (!this.isBillingEnabled()) {
+      throw new BadDataException(Errors.BillingService.BILLING_NOT_ENABLED);
+    }
+
+    if (!OneUptimeDate.isInTheFuture(data.trialEndsAt)) {
+      throw new BadDataException(Errors.BillingService.TRIAL_END_DATE_IN_PAST);
+    }
+
+    if (
+      OneUptimeDate.isAfter(
+        data.trialEndsAt,
+        OneUptimeDate.getSomeDaysAfter(MAX_TRIAL_LENGTH_IN_DAYS),
+      )
+    ) {
+      throw new BadDataException(
+        Errors.BillingService.TRIAL_END_DATE_TOO_FAR_IN_FUTURE,
+      );
+    }
+
+    const subscriptionIds: Array<string> = [data.subscriptionId];
+
+    if (data.meteredSubscriptionId) {
+      subscriptionIds.push(data.meteredSubscriptionId);
+    }
+
+    /*
+     * Validate every subscription before touching any of them. Updating the
+     * flat-fee subscription and then discovering the metered one is cancelled
+     * would leave the project's two subscriptions on different trial dates.
+     */
+    for (const subscriptionId of subscriptionIds) {
+      const subscription: Stripe.Subscription =
+        await this.getSubscription(subscriptionId);
+
+      if (!subscription) {
+        throw new BadDataException(
+          Errors.BillingService.SUBSCRIPTION_NOT_FOUND,
+        );
+      }
+
+      if (
+        subscription.status === "canceled" ||
+        subscription.status === "incomplete_expired"
+      ) {
+        throw new BadDataException(
+          Errors.BillingService.CANNOT_EXTEND_TRIAL_ON_CANCELLED_SUBSCRIPTION,
+        );
+      }
+    }
+
+    for (const subscriptionId of subscriptionIds) {
+      await this.stripe.subscriptions.update(subscriptionId, {
+        trial_end: OneUptimeDate.toUnixTimestamp(data.trialEndsAt),
+
+        /*
+         * Setting trial_end also moves the billing cycle anchor to that date.
+         * With the default proration behaviour Stripe raises proration line
+         * items for the shifted period, which is exactly the surprise invoice
+         * extending a trial is meant to prevent - so prorations are disabled.
+         *
+         * Caveat: this only silences the flat-fee subscription. Usage-based
+         * billing is not subject to proration, so closing the metered
+         * subscription's period early still invoices the usage recorded in it.
+         * For a project that is still trialing that is nothing (trial usage is
+         * not billable), but extending the trial of an already-active project
+         * bills its accrued usage immediately - the admin page warns about
+         * this before the extension is submitted.
+         */
+        proration_behavior: "none",
+      });
+
+      logger.debug(
+        `Extended trial for subscription ${subscriptionId} to ${data.trialEndsAt.toISOString()}`,
+      );
+    }
+  }
+
   @CaptureSpan()
   public async getSubscriptionStatus(
     subscriptionId: string,

package/Server/Services/DatabaseService.ts

@@ -1552,21 +1552,10 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(findBy.props);
 
-      let automaticallyAddedCreatedAtInSelect: boolean = false;
-
       if (!findBy.sort || Object.keys(findBy.sort).length === 0) {
         findBy.sort = {
           createdAt: SortOrder.Descending,
         };
-
-        if (!findBy.select) {
-          findBy.select = {} as any;
-        }
-
-        if (!(findBy.select as any)["createdAt"]) {
-          (findBy.select as any)["createdAt"] = true;
-          automaticallyAddedCreatedAtInSelect = true;
-        }
       }
 
       const onFind: OnFind<TBaseModel> = findBy.props.ignoreHooks
@@ -1600,6 +1589,9 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       onBeforeFind.query = result.query;
       onBeforeFind.select = result.select || undefined;
 
+      const sortColumnsAddedToSelect: Array<string> =
+        this.addSortColumnsToSelect(onBeforeFind);
+
       if (!(onBeforeFind.skip instanceof PositiveNumber)) {
         onBeforeFind.skip = new PositiveNumber(onBeforeFind.skip);
       }
@@ -1634,8 +1626,8 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       decryptedItems = this.sanitizeFindByItems(decryptedItems, onBeforeFind);
 
       for (const item of decryptedItems) {
-        if (automaticallyAddedCreatedAtInSelect) {
-          delete (item as any).createdAt;
+        for (const sortColumn of sortColumnsAddedToSelect) {
+          delete (item as any)[sortColumn];
         }
       }
 
@@ -1652,6 +1644,67 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     }
   }
 
+  /**
+   * Adds every sorted column to the select, and returns the ones it added so
+   * `_findBy` can strip them back off the results.
+   *
+   * A column can be ordered by without being selected in a plain SELECT, but
+   * not once a relation is also selected: the join sends the query down
+   * TypeORM's paginated path, which wraps it and orders the outer SELECT by a
+   * column the inner query only emits when that column was selected. The
+   * request then fails outright with `column distinctAlias.<Alias>_<column>
+   * does not exist`. Callers should not have to know that, so close the gap
+   * here for every sort rather than leaving each call site to remember.
+   *
+   * Deliberately runs *after* the read-permission check. ORDER BY is not
+   * permission-checked, so a column being sorted on is already reaching the
+   * database - adding it to the select must not be able to turn a query that
+   * worked into a permission error. The values never reach the caller.
+   */
+  private addSortColumnsToSelect(findBy: FindBy<TBaseModel>): Array<string> {
+    /*
+     * No select at all means every column is selected, so there is nothing to
+     * fill in.
+     */
+    if (!findBy.select) {
+      return [];
+    }
+
+    const sortColumnsToAdd: Array<string> = Object.keys(
+      findBy.sort || {},
+    ).filter((sortColumn: string) => {
+      if ((findBy.select as any)[sortColumn] !== undefined) {
+        return false;
+      }
+
+      /*
+       * Sorting by a relation orders through the joined table, which has its
+       * own alias - adding the relation to the select here would instead turn
+       * it into a fetched relation.
+       */
+      return (
+        this.model.hasColumn(sortColumn) &&
+        !this.model.isEntityColumn(sortColumn)
+      );
+    });
+
+    if (sortColumnsToAdd.length === 0) {
+      return [];
+    }
+
+    /*
+     * Copied rather than mutated: sanitizeSelect hands back the caller's own
+     * select object, and callers reuse those across queries.
+     */
+    findBy.select = { ...(findBy.select as any) };
+
+    for (const sortColumn of sortColumnsToAdd) {
+      (findBy.select as any)[sortColumn] = true;
+    }
+
+    return sortColumnsToAdd;
+  }
+
   private sanitizeFindByItems(
     items: Array<TBaseModel>,
     findBy: FindBy<TBaseModel>,
@@ -1841,6 +1894,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
       const dataColumns: [string, boolean][] = [];
       const dataKeys: string[] = Object.keys(data);
+
+      /*
+       * An update that carries no columns writes nothing, yet it would still
+       * match rows - so returning the matched count reported a write that
+       * never happened. Treat it like a query that matched nothing instead.
+       */
+      const hasColumnsToUpdate: boolean = dataKeys.length > 0;
+
       for (const key of dataKeys) {
         dataColumns.push([key, true]);
       }
@@ -1879,13 +1940,15 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         }
       }
 
-      const items: Array<TBaseModel> = await this._findBy({
-        query: beforeUpdateBy.query,
-        skip: updateBy.skip.toNumber(),
-        limit: updateBy.limit.toNumber(),
-        select: selectColumns,
-        props: { isRoot: true, ignoreHooks: true },
-      });
+      const items: Array<TBaseModel> = hasColumnsToUpdate
+        ? await this._findBy({
+            query: beforeUpdateBy.query,
+            skip: updateBy.skip.toNumber(),
+            limit: updateBy.limit.toNumber(),
+            select: selectColumns,
+            props: { isRoot: true, ignoreHooks: true },
+          })
+        : [];
 
       for (const item of items) {
         /*
@@ -2176,6 +2239,107 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     await repository.manager.query(sql, params);
   }
 
+  /*
+   * Atomically add to numeric columns and set literal columns for one row,
+   * in a SINGLE auto-committed UPDATE, with no hooks and no `version` bump.
+   *
+   * This is the counter-flush primitive. `updateColumnsByIdWithoutHooks`
+   * can't express it (a read-modify-write would lose concurrent writers'
+   * increments, and the value isn't known to the caller), and
+   * `getRepository().increment()` can't either: it goes through
+   * UpdateQueryBuilder, which always appends `version = version + 1`, so an
+   * ingest-driven counter bump would fight the optimistic lock on a row a
+   * human may be editing — and it can't set a second column in the same
+   * statement.
+   *
+   * `COALESCE(col, 0)` so a NULL counter starts from zero rather than
+   * staying NULL forever.
+   *
+   * Column and table identifiers come from entity metadata (never from the
+   * caller) and every value is bound as a parameter, so this is not an
+   * injection surface. Use ONLY for trusted, internal, side-effect-free
+   * column writes.
+   */
+  @CaptureSpan()
+  public async atomicAddToColumnsByIdWithoutHooks(input: {
+    id: ObjectID;
+    add: Partial<Record<keyof TBaseModel, number>>;
+    set?: PartialEntity<TBaseModel> | undefined;
+  }): Promise<void> {
+    if (!input.id) {
+      throw new BadDataException("id is required");
+    }
+
+    const repository: Repository<TBaseModel> = this.getRepository();
+    const metadata: EntityMetadata = repository.metadata;
+    const driver: Driver = repository.manager.connection.driver;
+
+    const setClauses: Array<string> = [];
+    const params: Array<unknown> = [];
+
+    const columnFor: (propertyName: string) => ColumnMetadata = (
+      propertyName: string,
+    ): ColumnMetadata => {
+      const column: ColumnMetadata | undefined =
+        metadata.findColumnWithPropertyName(propertyName);
+      if (!column) {
+        throw new BadDataException(
+          `atomicAddToColumnsByIdWithoutHooks: unknown column "${propertyName}" on "${metadata.tableName}"`,
+        );
+      }
+      return column;
+    };
+
+    for (const [propertyName, delta] of Object.entries(
+      input.add as ObjectLiteral,
+    )) {
+      if (typeof delta !== "number" || !Number.isFinite(delta)) {
+        throw new BadDataException(
+          `atomicAddToColumnsByIdWithoutHooks: "${propertyName}" delta must be a finite number`,
+        );
+      }
+
+      const column: ColumnMetadata = columnFor(propertyName);
+      params.push(delta);
+      const quoted: string = `"${column.databaseName}"`;
+      setClauses.push(`${quoted} = COALESCE(${quoted}, 0) + $${params.length}`);
+    }
+
+    for (const [propertyName, value] of Object.entries(
+      (input.set || {}) as ObjectLiteral,
+    )) {
+      if (typeof value === "function") {
+        throw new BadDataException(
+          `atomicAddToColumnsByIdWithoutHooks: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`,
+        );
+      }
+
+      const column: ColumnMetadata = columnFor(propertyName);
+      params.push(driver.preparePersistentValue(value, column));
+      setClauses.push(`"${column.databaseName}" = $${params.length}`);
+    }
+
+    if (setClauses.length === 0) {
+      return;
+    }
+
+    if (metadata.updateDateColumn) {
+      setClauses.push(
+        `"${metadata.updateDateColumn.databaseName}" = CURRENT_TIMESTAMP`,
+      );
+    }
+
+    const primaryColumnName: string =
+      metadata.primaryColumns[0]?.databaseName || "_id";
+    params.push(input.id.toString());
+
+    const sql: string = `UPDATE "${metadata.tableName}" SET ${setClauses.join(
+      ", ",
+    )} WHERE "${primaryColumnName}" = $${params.length}`;
+
+    await repository.manager.query(sql, params);
+  }
+
   @CaptureSpan()
   protected async atomicIncrementColumnValueByOne(data: {
     id: ObjectID;

package/Server/Services/IncidentEpisodeService.ts

@@ -27,6 +27,9 @@ import { Red500, Yellow500, Purple500 } from "../../Types/BrandColors";
 import URL from "../../Types/API/URL";
 import DatabaseConfig from "../DatabaseConfig";
 import IncidentSeverityService from "./IncidentSeverityService";
+import ProjectScopedReferenceValidator, {
+  resolveReferenceId,
+} from "../Utils/Database/ProjectScopedReferenceValidator";
 import IncidentEpisodeMemberService from "./IncidentEpisodeMemberService";
 import IncidentEpisodeOwnerUserService from "./IncidentEpisodeOwnerUserService";
 import IncidentEpisodeOwnerTeamService from "./IncidentEpisodeOwnerTeamService";
@@ -90,6 +93,36 @@ export class Service extends DatabaseService<Model> {
       updateBy.query,
       updateBy.props,
     );
+
+    /*
+     * An episode carries the same project-scoped state and severity an
+     * incident does, on FKs that are equally ON DELETE NO ACTION, so an id
+     * from another project here leaves that project undeletable in exactly
+     * the same way. onBeforeCreate overwrites currentIncidentStateId with
+     * this project's created state, which leaves the severity as the only
+     * create-reachable column — but an update can write either.
+     */
+    await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+      projectId: updateBy.props.tenantId,
+      subject: "incident episode",
+      references: [
+        {
+          modelName: "Incident State",
+          id:
+            resolveReferenceId(updateBy.data.currentIncidentStateId) ||
+            resolveReferenceId(updateBy.data.currentIncidentState),
+          service: IncidentStateService,
+        },
+        {
+          modelName: "Incident Severity",
+          id:
+            resolveReferenceId(updateBy.data.incidentSeverityId) ||
+            resolveReferenceId(updateBy.data.incidentSeverity),
+          service: IncidentSeverityService,
+        },
+      ],
+    });
+
     return { updateBy, carryForward: null };
   }
 
@@ -140,6 +173,20 @@ export class Service extends DatabaseService<Model> {
 
     createBy.data.currentIncidentStateId = incidentState.id;
 
+    await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+      projectId: projectId,
+      subject: "incident episode",
+      references: [
+        {
+          modelName: "Incident Severity",
+          id:
+            resolveReferenceId(createBy.data.incidentSeverityId) ||
+            resolveReferenceId(createBy.data.incidentSeverity),
+          service: IncidentSeverityService,
+        },
+      ],
+    });
+
     // Auto-generate episode number
     const episodeCounterResult: {
       counter: number;