@oneuptime/common 11.7.2 → 11.7.4

package/Server/Services/MonitorService.ts

@@ -70,6 +70,9 @@ import WorkspaceNotificationRuleService, {
   MessageBlocksByWorkspaceType,
 } from "./WorkspaceNotificationRuleService";
 import MonitorStepsProjectValidator from "../Utils/Monitor/MonitorStepsProjectValidator";
+import ProjectScopedReferenceValidator, {
+  resolveReferenceId,
+} from "../Utils/Database/ProjectScopedReferenceValidator";
 import MonitorWorkspaceMessages from "../Utils/Workspace/WorkspaceMessages/Monitor";
 import MonitorFeedService from "./MonitorFeedService";
 import { MonitorFeedEventType } from "../../Models/DatabaseModels/MonitorFeed";
@@ -388,7 +391,19 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
-    if (updateBy.data.monitorSteps) {
+    /*
+     * currentMonitorStatusId is writable by any project member and its FK is
+     * ON DELETE NO ACTION, so an id from another project here leaves that
+     * project undeletable — the same shape monitorSteps had. The
+     * 1785240000000 migration repaired the rows that existed then; this stops
+     * new ones. It stays NO ACTION on purpose: deleting a status monitors are
+     * currently in should be blocked, not cascaded.
+     */
+    const currentMonitorStatusId: ObjectID | string | undefined =
+      resolveReferenceId(updateBy.data.currentMonitorStatusId) ||
+      resolveReferenceId(updateBy.data.currentMonitorStatus);
+
+    if (updateBy.data.monitorSteps || currentMonitorStatusId) {
       /*
        * Root/API updates do not always carry a tenantId, so fall back to the
        * project of each monitor the query actually matches.
@@ -398,10 +413,30 @@ export class Service extends DatabaseService<Model> {
         : await this.getProjectIdsForUpdateQuery(updateBy);
 
       for (const projectId of projectIds) {
-        await MonitorStepsProjectValidator.validateMonitorStepsBelongToProject({
-          monitorSteps: updateBy.data.monitorSteps as MonitorSteps | JSONObject,
-          projectId: projectId,
-        });
+        if (updateBy.data.monitorSteps) {
+          await MonitorStepsProjectValidator.validateMonitorStepsBelongToProject(
+            {
+              monitorSteps: updateBy.data.monitorSteps as
+                | MonitorSteps
+                | JSONObject,
+              projectId: projectId,
+            },
+          );
+        }
+
+        await ProjectScopedReferenceValidator.validateReferencesBelongToProject(
+          {
+            projectId: projectId,
+            subject: "monitor",
+            references: [
+              {
+                modelName: "Monitor Status",
+                id: currentMonitorStatusId,
+                service: MonitorStatusService,
+              },
+            ],
+          },
+        );
       }
     }
 
@@ -1207,7 +1242,8 @@ ${createdItem.description?.trim() || "No description provided."}
   /*
    * Only global probes and probes belonging to this project may be attached -
    * the id list comes from the browser, so it cannot be trusted to stay inside
-   * the tenant.
+   * the tenant. ProbeService.getProbesAttachableToProject owns that rule and
+   * MonitorProbeService enforces the same one on the CRUD path.
    */
   @CaptureSpan()
   public async addSelectedProbesToMonitor(
@@ -1215,47 +1251,16 @@ ${createdItem.description?.trim() || "No description provided."}
     monitorId: ObjectID,
     probeIds: Array<ObjectID>,
   ): Promise<void> {
-    if (probeIds.length === 0) {
-      return;
-    }
-
-    const [globalProbes, projectProbes]: [Array<Probe>, Array<Probe>] =
-      await Promise.all([
-        ProbeService.findBy({
-          query: {
-            _id: QueryHelper.any(probeIds),
-            isGlobalProbe: true,
-          },
-          select: {
-            _id: true,
-          },
-          skip: 0,
-          limit: LIMIT_PER_PROJECT,
-          props: {
-            isRoot: true,
-          },
-        }),
-        ProbeService.findBy({
-          query: {
-            _id: QueryHelper.any(probeIds),
-            isGlobalProbe: false,
-            projectId: projectId,
-          },
-          select: {
-            _id: true,
-          },
-          skip: 0,
-          limit: LIMIT_PER_PROJECT,
-          props: {
-            isRoot: true,
-          },
-        }),
-      ]);
+    const probes: Array<Probe> =
+      await ProbeService.getProbesAttachableToProject({
+        probeIds: probeIds,
+        projectId: projectId,
+      });
 
     await this.createMonitorProbes({
       projectId: projectId,
       monitorId: monitorId,
-      probes: [...globalProbes, ...projectProbes],
+      probes: probes,
     });
   }
 

package/Server/Services/NetworkDeviceDiscoveryScanService.ts

@@ -1,10 +1,80 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/NetworkDeviceDiscoveryScan";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ScanTargetUtil from "../../Utils/NetworkDiscovery/ScanTargetUtil";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  /*
+   * Validate the scan target at write time, with the same parser the probe
+   * expands it with (Common/Utils/NetworkDiscovery/ScanTargetUtil).
+   *
+   * Without this, a typo'd target is accepted, sits Pending until a probe
+   * claims it, and only surfaces minutes later as a Failed scan with the
+   * parser's complaint buried in statusMessage. Octet-range notation makes
+   * that far likelier than CIDR did — a reversed range ("10.22-16.0.1-20") or
+   * an out-of-range octet is easy to type and impossible to spot by eye — so
+   * the feedback belongs on the form, not on a scan result.
+   *
+   * The size ceiling is checked here too: an oversized target is rejected the
+   * moment it is entered rather than after a probe has been handed a sweep it
+   * refuses to run.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    this.validateScanTarget(createBy.data.cidr);
+
+    return { createBy, carryForward: null };
+  }
+
+  /*
+   * The target column is not user-updatable (its ColumnAccessControl grants no
+   * update permission), but root writers — the probe-ingest endpoints, workers,
+   * migrations — bypass that. Validating any update that carries the column
+   * keeps the invariant true for every writer instead of just the form.
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    const dataKeys: Array<string> = Object.keys(updateBy.data || {});
+
+    if (dataKeys.includes("cidr")) {
+      this.validateScanTarget(
+        (updateBy.data as Record<string, unknown>)["cidr"],
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * The value is passed through UNTOUCHED. It arrives straight from the
+   * request JSON — BaseAPI assigns ShortText columns verbatim, and this hook
+   * runs before the model's type and length checks — so it may be a number,
+   * an object or an array, not just a string. ScanTargetUtil already type-
+   * guards and trims internally; normalizing here (the obvious
+   * `(target || "").trim()`) would instead throw a TypeError on any truthy
+   * non-string and turn an intended 400 into a 500.
+   */
+  private validateScanTarget(target: unknown): void {
+    const validationError: string | null = ScanTargetUtil.getValidationError(
+      target as string,
+    );
+
+    if (validationError) {
+      throw new BadDataException(validationError);
+    }
+  }
 }
 
 export default new Service();

package/Server/Services/ProbeService.ts

@@ -32,6 +32,7 @@ import MonitorService from "./MonitorService";
 import PushNotificationMessage from "../../Types/PushNotification/PushNotificationMessage";
 import PushNotificationUtil from "../Utils/PushNotificationUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import QueryHelper from "../Types/Database/QueryHelper";
 import { IsBillingEnabled } from "../EnvironmentConfig";
 import GlobalCache from "../Infrastructure/GlobalCache";
 import { createWhatsAppMessageFromTemplate } from "../Utils/WhatsAppTemplateUtil";
@@ -434,6 +435,71 @@ export class Service extends DatabaseService<Model> {
     return { createBy: createBy, carryForward: [] };
   }
 
+  /*
+   * Only global probes and probes belonging to this project may be attached to
+   * that project's monitors. Probe ids reach the server from the browser - the
+   * monitor create form and the Monitor > Probes table both post them - so
+   * they cannot be trusted to stay inside the tenant. Every path that attaches
+   * a probe to a monitor filters through here.
+   */
+  @CaptureSpan()
+  public async getProbesAttachableToProject(data: {
+    probeIds: Array<ObjectID>;
+    projectId: ObjectID;
+  }): Promise<Array<Model>> {
+    if (data.probeIds.length === 0) {
+      return [];
+    }
+
+    const [globalProbes, projectProbes]: [Array<Model>, Array<Model>] =
+      await Promise.all([
+        this.findBy({
+          query: {
+            _id: QueryHelper.any(data.probeIds),
+            isGlobalProbe: true,
+          },
+          select: {
+            _id: true,
+          },
+          skip: 0,
+          limit: LIMIT_PER_PROJECT,
+          props: {
+            isRoot: true,
+          },
+        }),
+        this.findBy({
+          query: {
+            _id: QueryHelper.any(data.probeIds),
+            isGlobalProbe: false,
+            projectId: data.projectId,
+          },
+          select: {
+            _id: true,
+          },
+          skip: 0,
+          limit: LIMIT_PER_PROJECT,
+          props: {
+            isRoot: true,
+          },
+        }),
+      ]);
+
+    return [...globalProbes, ...projectProbes];
+  }
+
+  @CaptureSpan()
+  public async isProbeAttachableToProject(data: {
+    probeId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<boolean> {
+    const probes: Array<Model> = await this.getProbesAttachableToProject({
+      probeIds: [data.probeId],
+      projectId: data.projectId,
+    });
+
+    return probes.length > 0;
+  }
+
   @CaptureSpan()
   public async getOwners(probeId: ObjectID): Promise<Array<User>> {
     if (!probeId) {

package/Server/Services/ProjectService.ts

@@ -52,6 +52,7 @@ import {
 } from "../../Types/BrandColors";
 import Color from "../../Types/Color";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
+import QueryDeepPartialEntity from "../../Types/Database/PartialEntity";
 import OneUptimeDate from "../../Types/Date";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
 import BadDataException from "../../Types/Exception/BadDataException";
@@ -609,6 +610,99 @@ export class ProjectService extends DatabaseService<Model> {
     await this.sendSubscriptionChangeWebhookSlackNotification(project.id!);
   }
 
+  /*
+   * Pushes a project's trial end date out to a new date, in the payment
+   * provider first and then on the project row.
+   *
+   * The payment provider is the source of truth for what the customer is
+   * actually charged, so it is updated first: if Stripe rejects the change
+   * the project row keeps its old trial date rather than showing the customer
+   * a trial that is not really there.
+   */
+  @CaptureSpan()
+  public async extendTrial(params: {
+    projectId: ObjectID;
+    trialEndsAt: Date;
+    extendedByUserId?: ObjectID | undefined;
+  }): Promise<void> {
+    if (!IsBillingEnabled) {
+      throw new BadDataException("Billing is not enabled for this server");
+    }
+
+    const project: Model | null = await this.findOneById({
+      id: params.projectId,
+      select: {
+        _id: true,
+        trialEndsAt: true,
+        paymentProviderSubscriptionId: true,
+        paymentProviderMeteredSubscriptionId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!project) {
+      throw new BadDataException("Project not found");
+    }
+
+    if (!project.paymentProviderSubscriptionId) {
+      throw new BadDataException("Payment Provider subscription not found");
+    }
+
+    if (!project.paymentProviderMeteredSubscriptionId) {
+      throw new BadDataException(
+        "Payment Provider metered subscription not found",
+      );
+    }
+
+    await BillingService.extendTrial({
+      subscriptionId: project.paymentProviderSubscriptionId,
+      meteredSubscriptionId: project.paymentProviderMeteredSubscriptionId,
+      trialEndsAt: params.trialEndsAt,
+    });
+
+    /*
+     * Pushing trial_end out puts the subscriptions back into `trialing`. Read
+     * the statuses back rather than assuming them, so the project row - which
+     * drives the customer's trial banner and the paywall - matches Stripe.
+     */
+    const subscriptionStatus: SubscriptionStatus =
+      await BillingService.getSubscriptionStatus(
+        project.paymentProviderSubscriptionId,
+      );
+
+    const meteredSubscriptionStatus: SubscriptionStatus =
+      await BillingService.getSubscriptionStatus(
+        project.paymentProviderMeteredSubscriptionId,
+      );
+
+    await this.updateOneById({
+      id: project.id!,
+      data: {
+        trialEndsAt: params.trialEndsAt,
+        paymentProviderSubscriptionStatus: subscriptionStatus,
+        paymentProviderMeteredSubscriptionStatus: meteredSubscriptionStatus,
+      },
+      props: {
+        isRoot: true,
+        ignoreHooks: true,
+      },
+    });
+
+    /*
+     * The audit trail for handing out free service. There is no generic
+     * admin-action table, so the acting master admin goes in the log line.
+     */
+    logger.info(
+      `Trial for project ${project.id?.toString()} extended from ${
+        project.trialEndsAt?.toISOString() || "none"
+      } to ${params.trialEndsAt.toISOString()} by master admin ${
+        params.extendedByUserId?.toString() || "unknown"
+      }`,
+    );
+  }
+
   /*
    * The paid-conversion event for ad platforms: fires server-side (immune to
    * ad blockers) whenever a project's subscription plan changes, with enough
@@ -2040,6 +2134,7 @@ export class ProjectService extends DatabaseService<Model> {
         paymentProviderMeteredSubscriptionId: true,
         paymentProviderSubscriptionSeats: true,
         paymentProviderPlanId: true,
+        trialEndsAt: true,
       },
     });
 
@@ -2081,6 +2176,21 @@ export class ProjectService extends DatabaseService<Model> {
       throw new BadDataException("Subscription plan not found");
     }
 
+    /*
+     * Reactivating goes through changePlan, which cancels both subscriptions
+     * and creates new ones - so a trial the project still has to run has to be
+     * carried onto the replacements explicitly. Otherwise a customer whose
+     * trial a master admin extended as a goodwill gesture loses the extension
+     * the moment their subscription is reactivated, and is billed right away.
+     *
+     * A trial that has already lapsed is not revived: reactivation is not the
+     * place to hand out free service.
+     */
+    const endTrialAt: Date | undefined =
+      project.trialEndsAt && OneUptimeDate.isInTheFuture(project.trialEndsAt)
+        ? project.trialEndsAt
+        : undefined;
+
     const result: {
       subscriptionId: string;
       meteredSubscriptionId: string;
@@ -2093,7 +2203,7 @@ export class ProjectService extends DatabaseService<Model> {
       newPlan: subscriptionPlan,
       quantity: project.paymentProviderSubscriptionSeats,
       isYearly: SubscriptionPlan.isYearlyPlan(project.paymentProviderPlanId),
-      endTrialAt: undefined,
+      endTrialAt: endTrialAt,
     });
 
     // refresh subscription status.
@@ -2109,14 +2219,28 @@ export class ProjectService extends DatabaseService<Model> {
 
     // now update project with new subscription id.
 
+    const updateData: QueryDeepPartialEntity<Model> = {
+      paymentProviderSubscriptionId: result.subscriptionId,
+      paymentProviderMeteredSubscriptionId: result.meteredSubscriptionId,
+      paymentProviderSubscriptionStatus: subscriptionState,
+      paymentProviderMeteredSubscriptionStatus: meteredSubscriptionState,
+    };
+
+    /*
+     * The payment provider is the source of truth for the trial the new
+     * subscriptions were created with, so its date wins over the one sent.
+     * The column is left alone when there is no trial to record, rather than
+     * stamping a project whose trial lapsed long ago with a fresh date.
+     */
+    const newTrialEndsAt: Date | undefined = result.trialEndsAt || endTrialAt;
+
+    if (newTrialEndsAt) {
+      updateData.trialEndsAt = newTrialEndsAt;
+    }
+
     await this.updateOneById({
       id: project.id!,
-      data: {
-        paymentProviderSubscriptionId: result.subscriptionId,
-        paymentProviderMeteredSubscriptionId: result.meteredSubscriptionId,
-        paymentProviderSubscriptionStatus: subscriptionState,
-        paymentProviderMeteredSubscriptionStatus: meteredSubscriptionState,
-      },
+      data: updateData,
       props: {
         isRoot: true,
       },

package/Server/Services/RecommendationDismissalService.ts

@@ -0,0 +1,52 @@
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import BadDataException from "../../Types/Exception/BadDataException";
+import RecommendationType from "../../Types/Recommendation/RecommendationType";
+import Model from "../../Models/DatabaseModels/RecommendationDismissal";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * `recommendationType` is a string column rather than a Postgres enum (the
+   * codebase keeps enums in TypeScript so adding a member needs no migration),
+   * which means nothing below this point would reject a typo. A dismissal
+   * written under "monitor" instead of "Monitor" is silently invisible: the
+   * page filters on the enum value, finds nothing, and the card the user
+   * dismissed simply reappears with no error anywhere. Validating at the write
+   * boundary is the only place that failure is still cheap.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const recommendationType: string | undefined =
+      createBy.data.recommendationType;
+
+    if (!recommendationType) {
+      throw new BadDataException("Recommendation type is required.");
+    }
+
+    const validTypes: Array<string> = Object.values(RecommendationType);
+
+    if (!validTypes.includes(recommendationType)) {
+      throw new BadDataException(
+        `Invalid recommendation type: ${recommendationType}. Valid types are ${validTypes.join(
+          ", ",
+        )}.`,
+      );
+    }
+
+    if (!createBy.data.recommendationId) {
+      throw new BadDataException("Recommendation ID is required.");
+    }
+
+    return { createBy, carryForward: null };
+  }
+}
+
+export default new Service();

package/Server/Services/RunbookAgentJobService.ts

@@ -4,6 +4,7 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import Model from "../../Models/DatabaseModels/RunbookAgentJob";
 import RunbookAgentJobStatus from "../../Types/Runbook/RunbookAgentJobStatus";
 import RunbookStepType from "../../Types/Runbook/RunbookStepType";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import OneUptimeDate from "../../Types/Date";
 import { JSONObject } from "../../Types/JSON";
 import PostgresAppInstance from "../Infrastructure/PostgresDatabase";
@@ -26,6 +27,24 @@ const DEFAULT_CLAIM_TIMEOUT_MS: number = 2 * 60_000;
 
 const POLL_INTERVAL_MS: number = 500;
 
+/*
+ * A job in one of these states will never change again, so its row is a
+ * durable record of what the step did. Everything else is still in flight and
+ * can be waited on.
+ */
+const TERMINAL_STATUSES: Array<RunbookAgentJobStatus> = [
+  RunbookAgentJobStatus.Succeeded,
+  RunbookAgentJobStatus.Failed,
+  RunbookAgentJobStatus.TimedOut,
+  RunbookAgentJobStatus.Cancelled,
+];
+
+export function isTerminalAgentJobStatus(
+  status: RunbookAgentJobStatus | undefined,
+): boolean {
+  return Boolean(status && TERMINAL_STATUSES.includes(status));
+}
+
 /*
  * TypeORM's dataSource.query returns `[rows, rowCount]` for UPDATE/DELETE
  * (even with RETURNING), and just `rows` for SELECT/INSERT. This helper
@@ -95,6 +114,47 @@ export class Service extends DatabaseService<Model> {
     return this.create({ data: row, props: { isRoot: true } });
   }
 
+  /*
+   * The job this (execution, step) pair already produced, if any.
+   *
+   * A runbook execution runs inside a single BullMQ job, so a Worker restart
+   * mid-step means the execution is re-delivered and RunRunbook walks back to
+   * the same step — which is still persisted as Running. Without this lookup
+   * the step would be dispatched a second time and the agent would run the
+   * script again. The dispatcher calls this first: a terminal row is the
+   * step's result, a live row is something to re-attach to.
+   *
+   * A step is dispatched at most once per execution, so the newest row is the
+   * only one there can be; ordering is belt-and-braces against a torn write
+   * from a previous release.
+   */
+  @CaptureSpan()
+  public async findLatestJobForStep(data: {
+    runbookExecutionId: ObjectID;
+    stepId: string;
+  }): Promise<Model | null> {
+    const jobs: Array<Model> = await this.findBy({
+      query: {
+        runbookExecutionId: data.runbookExecutionId,
+        stepId: data.stepId,
+      },
+      select: {
+        _id: true,
+        status: true,
+        output: true,
+        exitCode: true,
+        errorMessage: true,
+        createdAt: true,
+      },
+      sort: { createdAt: SortOrder.Descending },
+      limit: 1,
+      skip: 0,
+      props: { isRoot: true },
+    });
+
+    return jobs[0] || null;
+  }
+
   /*
    * Atomically claim the oldest Pending job in the agent's project targeted
    * at this specific agent. Uses FOR UPDATE SKIP LOCKED so concurrent agents
@@ -279,15 +339,21 @@ export class Service extends DatabaseService<Model> {
    * POLL_INTERVAL_MS until the job reaches a terminal status, or until the
    * combined claim + execution window is exhausted (in which case we mark
    * the job TimedOut ourselves and return it).
+   *
+   * waitStartedAt anchors that window. It defaults to now — right for a job
+   * this Worker just enqueued — but a Worker re-attaching to a job left behind
+   * by a restart passes the job's createdAt, so the step keeps the single
+   * window its author configured instead of earning a fresh one per redelivery.
    */
   @CaptureSpan()
   public async pollUntilTerminal(data: {
     jobId: ObjectID;
     claimTimeoutInMs: number;
     executionTimeoutInMs: number;
+    waitStartedAt?: Date | undefined;
   }): Promise<Model> {
     const overallDeadline: Date = OneUptimeDate.addRemoveSeconds(
-      OneUptimeDate.getCurrentDate(),
+      data.waitStartedAt || OneUptimeDate.getCurrentDate(),
       Math.ceil(
         (data.claimTimeoutInMs + data.executionTimeoutInMs + 5_000) / 1000,
       ),
@@ -318,12 +384,7 @@ export class Service extends DatabaseService<Model> {
         );
       }
 
-      if (
-        job.status === RunbookAgentJobStatus.Succeeded ||
-        job.status === RunbookAgentJobStatus.Failed ||
-        job.status === RunbookAgentJobStatus.TimedOut ||
-        job.status === RunbookAgentJobStatus.Cancelled
-      ) {
+      if (isTerminalAgentJobStatus(job.status)) {
         return job;
       }