@oneuptime/common 11.7.3 → 12.0.0

package/build/dist/Server/API/IncidentAPI.js

@@ -1,6 +1,7 @@
 import Incident from "../../Models/DatabaseModels/Incident";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import BadDataException from "../../Types/Exception/BadDataException";
+import DatabaseCommonInteractionPropsUtil, { PermissionType, } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../Types/ObjectID";
 import IncidentService from "../Services/IncidentService";
 import UserMiddleware from "../Middleware/UserAuthorization";
@@ -98,7 +99,6 @@ export default class IncidentAPI extends BaseAPI {
         return Response.sendFileResponse(req, res, attachment);
     }
     async generatePostmortemFromAI(req, res) {
-        var _a;
         const incidentIdParam = req.params["incidentId"];
         if (!incidentIdParam) {
             throw new BadDataException("Incident ID is required");
@@ -107,20 +107,29 @@ export default class IncidentAPI extends BaseAPI {
         try {
             incidentId = new ObjectID(incidentIdParam);
         }
-        catch (_b) {
+        catch (_a) {
             throw new BadDataException("Invalid Incident ID");
         }
         const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
-        // Verify user has permission to edit the incident
-        const permissions = (_a = props
-            .userTenantAccessPermission) === null || _a === void 0 ? void 0 : _a["permissions"];
-        const hasPermission = permissions
-            ? permissions.some((p) => {
-                return (p === Permission.ProjectOwner ||
-                    p === Permission.ProjectAdmin ||
-                    p === Permission.EditProjectIncident);
-            })
-            : false;
+        CommonAPI.assertTenantScoped(props);
+        /*
+         * Read through getUserPermissions(Allow) rather than off
+         * userTenantAccessPermission directly. That dictionary is keyed by project
+         * id and its entries hold GRANTS AND DENIALS together, discriminated only
+         * by isBlockPermission, so the previous
+         * `userTenantAccessPermission["permissions"]` read was always undefined
+         * and denied every caller who was not a master admin. Mapping the array
+         * raw would swing the other way and count a team's explicit block
+         * entry for one of these permissions as a grant of it.
+         */
+        const permissions = DatabaseCommonInteractionPropsUtil.getUserPermissions(props, PermissionType.Allow).map((userPermission) => {
+            return userPermission.permission;
+        });
+        const hasPermission = permissions.some((p) => {
+            return (p === Permission.ProjectOwner ||
+                p === Permission.ProjectAdmin ||
+                p === Permission.EditProjectIncident);
+        });
         if (!hasPermission && !props.isMasterAdmin) {
             throw new BadDataException("You do not have permission to generate postmortem for this incident. You need to have one of these permissions: Project Owner, Project Admin, Edit Project Incident.");
         }
@@ -171,7 +180,6 @@ export default class IncidentAPI extends BaseAPI {
         });
     }
     async generateNoteFromAI(req, res) {
-        var _a;
         const incidentIdParam = req.params["incidentId"];
         if (!incidentIdParam) {
             throw new BadDataException("Incident ID is required");
@@ -180,22 +188,31 @@ export default class IncidentAPI extends BaseAPI {
         try {
             incidentId = new ObjectID(incidentIdParam);
         }
-        catch (_b) {
+        catch (_a) {
             throw new BadDataException("Invalid Incident ID");
         }
         const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
-        // Verify user has permission to edit the incident
-        const permissions = (_a = props
-            .userTenantAccessPermission) === null || _a === void 0 ? void 0 : _a["permissions"];
-        const hasPermission = permissions
-            ? permissions.some((p) => {
-                return (p === Permission.ProjectOwner ||
-                    p === Permission.ProjectAdmin ||
-                    p === Permission.EditProjectIncident ||
-                    p === Permission.CreateIncidentInternalNote ||
-                    p === Permission.CreateIncidentPublicNote);
-            })
-            : false;
+        CommonAPI.assertTenantScoped(props);
+        /*
+         * Read through getUserPermissions(Allow) rather than off
+         * userTenantAccessPermission directly. That dictionary is keyed by project
+         * id and its entries hold GRANTS AND DENIALS together, discriminated only
+         * by isBlockPermission, so the previous
+         * `userTenantAccessPermission["permissions"]` read was always undefined
+         * and denied every caller who was not a master admin. Mapping the array
+         * raw would swing the other way and count a team's explicit block
+         * entry for one of these permissions as a grant of it.
+         */
+        const permissions = DatabaseCommonInteractionPropsUtil.getUserPermissions(props, PermissionType.Allow).map((userPermission) => {
+            return userPermission.permission;
+        });
+        const hasPermission = permissions.some((p) => {
+            return (p === Permission.ProjectOwner ||
+                p === Permission.ProjectAdmin ||
+                p === Permission.EditProjectIncident ||
+                p === Permission.CreateIncidentInternalNote ||
+                p === Permission.CreateIncidentPublicNote);
+        });
         if (!hasPermission && !props.isMasterAdmin) {
             throw new BadDataException("You do not have permission to generate notes for this incident.");
         }

package/build/dist/Server/API/IncidentAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"IncidentAPI.js","sourceRoot":"","sources":["../../../../Server/API/IncidentAPI.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAE5D,OAAO,iBAAiB,MAAM,yCAAyC,CAAC;AACxE,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,eAEN,MAAM,6BAA6B,CAAC;AACrC,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAMhC,OAAO,SAAS,MAAM,aAAa,CAAC;AAEpC,OAAO,SAA0C,MAAM,uBAAuB,CAAC;AAC/E,OAAO,wBAGN,MAAM,sCAAsC,CAAC;AAC9C,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAEhD,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,OAGxC;IACC;;QACE,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,uDAAuD,EACrE,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF,8BAA8B;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,0CAA0C,EACxD,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,oCAAoC,EAClD,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,GAAmB,EACnB,GAAoB;;QAEpB,MAAM,cAAc,GAAuB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,eAAe,GAAuB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrE,MAAM,WAAW,GAAuB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,UAAoB,CAAC;QACzB,IAAI,MAAgB,CAAC;QACrB,IAAI,SAAmB,CAAC;QAExB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnC,SAAS,GAAG,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,GAAG,EAAE,UAAU;gBACf,SAAS;aACV;YACD,MAAM,EAAE;gBACN,qBAAqB,EAAE;oBACrB,GAAG,EAAE,IAAI;oBACT,IAAI,EAAE,IAAI;oBACV,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;iBACX;aACF;YACD,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,UAAU,GAAqB,MAAA,QAAQ,CAAC,qBAAqB,0CAAE,IAAI,CACvE,CAAC,IAAU,EAAE,EAAE;YACb,MAAM,YAAY,GAAkB,IAAI,CAAC,GAAG;gBAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACrB,CAAC,CAAC,IAAI,CAAC,EAAE;oBACP,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE;oBACpB,CAAC,CAAC,IAAI,CAAC;YACX,OAAO,YAAY,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5C,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,GAAmB,EACnB,GAAoB;;QAEpB,MAAM,eAAe,GAAuB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,UAAoB,CAAC;QAEzB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAEzD,kDAAkD;QAClD,MAAM,WAAW,GAAkC,MAAA,KAAK;aACrD,0BAA0B,0CAAG,aAAa,CAEhC,CAAC;QAEd,MAAM,aAAa,GAAY,WAAW;YACxC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE;gBACjC,OAAO,CACL,CAAC,KAAK,UAAU,CAAC,YAAY;oBAC7B,CAAC,KAAK,UAAU,CAAC,YAAY;oBAC7B,CAAC,KAAK,UAAU,CAAC,mBAAmB,CACrC,CAAC;YACJ,CAAC,CAAC;YACJ,CAAC,CAAC,KAAK,CAAC;QAEV,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,sKAAsK,CACvK,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAuB,aAAa,CAAC,kBAAkB,CACnE,GAAG,CAAC,IAAI,EACR,UAAU,CACW,CAAC;QAExB,8DAA8D;QAC9D,MAAM,wBAAwB,GAAY,IAAI,CAAC;QAE/C,8DAA8D;QAC9D,MAAM,QAAQ,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,UAAU;YACd,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;aAChB;YACD,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GACf,MAAM,wBAAwB,CAAC,oBAAoB,CAAC;YAClD,UAAU;YACV,wBAAwB;YACxB,qBAAqB,EAAE,GAAG;SAC3B,CAAC,CAAC;QAEL,2CAA2C;QAC3C,MAAM,SAAS,GACb,wBAAwB,CAAC,kCAAkC,CACzD,WAAW,EACX,QAAQ,CACT,CAAC;QAEJ,oEAAoE;QACpE,MAAM,YAAY,GAAiB;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,GAAG;YAChB;;;eAGG;YACH,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC/C,cAAc,EAAE,QAAQ,CAAC,OAAO;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAmB,EACnB,GAAoB;;QAEpB,MAAM,eAAe,GAAuB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,UAAoB,CAAC;QAEzB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAEzD,kDAAkD;QAClD,MAAM,WAAW,GAAkC,MAAA,KAAK;aACrD,0BAA0B,0CAAG,aAAa,CAEhC,CAAC;QAEd,MAAM,aAAa,GAAY,WAAW;YACxC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE;gBACjC,OAAO,CACL,CAAC,KAAK,UAAU,CAAC,YAAY;oBAC7B,CAAC,KAAK,UAAU,CAAC,YAAY;oBAC7B,CAAC,KAAK,UAAU,CAAC,mBAAmB;oBACpC,CAAC,KAAK,UAAU,CAAC,0BAA0B;oBAC3C,CAAC,KAAK,UAAU,CAAC,wBAAwB,CAC1C,CAAC;YACJ,CAAC,CAAC;YACJ,CAAC,CAAC,KAAK,CAAC;QAEV,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,MAAM,QAAQ,GAAuB,aAAa,CAAC,kBAAkB,CACnE,GAAG,CAAC,IAAI,EACR,UAAU,CACW,CAAC;QAExB,MAAM,QAAQ,GACX,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAY;YAClE,UAAU,CAAC;QAEb,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,IAAI,gBAAgB,CAAC,0CAA0C,CAAC,CAAC;QACzE,CAAC;QAED,8DAA8D;QAC9D,MAAM,wBAAwB,GAAY,IAAI,CAAC;QAE/C,8DAA8D;QAC9D,MAAM,QAAQ,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,UAAU;YACd,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;aAChB;YACD,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GACf,MAAM,wBAAwB,CAAC,oBAAoB,CAAC;YAClD,UAAU;YACV,wBAAwB;YACxB,qBAAqB,EAAE,GAAG;SAC3B,CAAC,CAAC;QAEL,qCAAqC;QACrC,MAAM,SAAS,GACb,wBAAwB,CAAC,4BAA4B,CACnD,WAAW,EACX,QAAiC,EACjC,QAAQ,CACT,CAAC;QAEJ,8DAA8D;QAC9D,MAAM,YAAY,GAAiB;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EACL,QAAQ,KAAK,QAAQ;gBACnB,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,wBAAwB;YAC9B,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,GAAG;YAChB;;;eAGG;YACH,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC/C,IAAI,EAAE,QAAQ,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"IncidentAPI.js","sourceRoot":"","sources":["../../../../Server/API/IncidentAPI.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAE5D,OAAO,iBAAiB,MAAM,yCAAyC,CAAC;AACxE,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,kCAAkC,EAAE,EACzC,cAAc,GACf,MAAM,6DAA6D,CAAC;AACrE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,eAEN,MAAM,6BAA6B,CAAC;AACrC,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAMhC,OAAO,SAAS,MAAM,aAAa,CAAC;AAEpC,OAAO,SAA0C,MAAM,uBAAuB,CAAC;AAC/E,OAAO,wBAGN,MAAM,sCAAsC,CAAC;AAC9C,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AAEpE,MAAM,CAAC,OAAO,OAAO,WAAY,SAAQ,OAGxC;IACC;;QACE,KAAK,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;QAEjC,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,uDAAuD,EACrE,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF,8BAA8B;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,0CAA0C,EACxD,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;QAEF,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,oCAAoC,EAClD,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,uBAAuB,CACnC,GAAmB,EACnB,GAAoB;;QAEpB,MAAM,cAAc,GAAuB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACnE,MAAM,eAAe,GAAuB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrE,MAAM,WAAW,GAAuB,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE7D,IAAI,CAAC,cAAc,IAAI,CAAC,eAAe,IAAI,CAAC,WAAW,EAAE,CAAC;YACxD,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,UAAoB,CAAC;QACzB,IAAI,MAAgB,CAAC;QACrB,IAAI,SAAmB,CAAC;QAExB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;YAC3C,MAAM,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,CAAC;YACnC,SAAS,GAAG,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAEzD,MAAM,QAAQ,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YAC7D,KAAK,EAAE;gBACL,GAAG,EAAE,UAAU;gBACf,SAAS;aACV;YACD,MAAM,EAAE;gBACN,qBAAqB,EAAE;oBACrB,GAAG,EAAE,IAAI;oBACT,IAAI,EAAE,IAAI;oBACV,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,IAAI;iBACX;aACF;YACD,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,MAAM,UAAU,GAAqB,MAAA,QAAQ,CAAC,qBAAqB,0CAAE,IAAI,CACvE,CAAC,IAAU,EAAE,EAAE;YACb,MAAM,YAAY,GAAkB,IAAI,CAAC,GAAG;gBAC1C,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE;gBACrB,CAAC,CAAC,IAAI,CAAC,EAAE;oBACP,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE;oBACpB,CAAC,CAAC,IAAI,CAAC;YACX,OAAO,YAAY,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC5C,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;QACtD,CAAC;QAED,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC;IACzD,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,GAAmB,EACnB,GAAoB;QAEpB,MAAM,eAAe,GAAuB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,UAAoB,CAAC;QAEzB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAEzD,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAEpC;;;;;;;;;WASG;QACH,MAAM,WAAW,GACf,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC,GAAG,CAAC,CAAC,cAA8B,EAAE,EAAE;YACvC,OAAO,cAAc,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,CAAC;QAEL,MAAM,aAAa,GAAY,WAAW,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE;YAChE,OAAO,CACL,CAAC,KAAK,UAAU,CAAC,YAAY;gBAC7B,CAAC,KAAK,UAAU,CAAC,YAAY;gBAC7B,CAAC,KAAK,UAAU,CAAC,mBAAmB,CACrC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,sKAAsK,CACvK,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAuB,aAAa,CAAC,kBAAkB,CACnE,GAAG,CAAC,IAAI,EACR,UAAU,CACW,CAAC;QAExB,8DAA8D;QAC9D,MAAM,wBAAwB,GAAY,IAAI,CAAC;QAE/C,8DAA8D;QAC9D,MAAM,QAAQ,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,UAAU;YACd,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;aAChB;YACD,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GACf,MAAM,wBAAwB,CAAC,oBAAoB,CAAC;YAClD,UAAU;YACV,wBAAwB;YACxB,qBAAqB,EAAE,GAAG;SAC3B,CAAC,CAAC;QAEL,2CAA2C;QAC3C,MAAM,SAAS,GACb,wBAAwB,CAAC,kCAAkC,CACzD,WAAW,EACX,QAAQ,CACT,CAAC;QAEJ,oEAAoE;QACpE,MAAM,YAAY,GAAiB;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,qBAAqB;YAC9B,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,GAAG;YAChB;;;eAGG;YACH,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC/C,cAAc,EAAE,QAAQ,CAAC,OAAO;SACjC,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC9B,GAAmB,EACnB,GAAoB;QAEpB,MAAM,eAAe,GAAuB,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAErE,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,UAAoB,CAAC;QAEzB,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,qBAAqB,CAAC,CAAC;QACpD,CAAC;QAED,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAEzD,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAEpC;;;;;;;;;WASG;QACH,MAAM,WAAW,GACf,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC,GAAG,CAAC,CAAC,cAA8B,EAAE,EAAE;YACvC,OAAO,cAAc,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,CAAC;QAEL,MAAM,aAAa,GAAY,WAAW,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE;YAChE,OAAO,CACL,CAAC,KAAK,UAAU,CAAC,YAAY;gBAC7B,CAAC,KAAK,UAAU,CAAC,YAAY;gBAC7B,CAAC,KAAK,UAAU,CAAC,mBAAmB;gBACpC,CAAC,KAAK,UAAU,CAAC,0BAA0B;gBAC3C,CAAC,KAAK,UAAU,CAAC,wBAAwB,CAC1C,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,iEAAiE,CAClE,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,MAAM,QAAQ,GAAuB,aAAa,CAAC,kBAAkB,CACnE,GAAG,CAAC,IAAI,EACR,UAAU,CACW,CAAC;QAExB,MAAM,QAAQ,GACX,aAAa,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAY;YAClE,UAAU,CAAC;QAEb,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,EAAE,CAAC;YACrD,MAAM,IAAI,gBAAgB,CAAC,0CAA0C,CAAC,CAAC;QACzE,CAAC;QAED,8DAA8D;QAC9D,MAAM,wBAAwB,GAAY,IAAI,CAAC;QAE/C,8DAA8D;QAC9D,MAAM,QAAQ,GAAoB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC/D,EAAE,EAAE,UAAU;YACd,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;aAChB;YACD,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,iBAAiB,CAAC,oBAAoB,CAAC,CAAC;QACpD,CAAC;QAED,yBAAyB;QACzB,MAAM,WAAW,GACf,MAAM,wBAAwB,CAAC,oBAAoB,CAAC;YAClD,UAAU;YACV,wBAAwB;YACxB,qBAAqB,EAAE,GAAG;SAC3B,CAAC,CAAC;QAEL,qCAAqC;QACrC,MAAM,SAAS,GACb,wBAAwB,CAAC,4BAA4B,CACnD,WAAW,EACX,QAAiC,EACjC,QAAQ,CACT,CAAC;QAEJ,8DAA8D;QAC9D,MAAM,YAAY,GAAiB;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EACL,QAAQ,KAAK,QAAQ;gBACnB,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,wBAAwB;YAC9B,UAAU,EAAE,UAAU;YACtB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,GAAG;YAChB;;;eAGG;YACH,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC/C,IAAI,EAAE,QAAQ,CAAC,OAAO;SACvB,CAAC,CAAC;IACL,CAAC;CACF"}

package/build/dist/Server/API/IncidentEpisodeAPI.js

@@ -1,6 +1,7 @@
 import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
+import DatabaseCommonInteractionPropsUtil, { PermissionType, } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../Types/ObjectID";
 import IncidentEpisodeService from "../Services/IncidentEpisodeService";
 import UserMiddleware from "../Middleware/UserAuthorization";
@@ -27,7 +28,6 @@ export default class IncidentEpisodeAPI extends BaseAPI {
         });
     }
     async generatePostmortemFromAI(req, res) {
-        var _a;
         const episodeIdParam = req.params["episodeId"];
         if (!episodeIdParam) {
             throw new BadDataException("Episode ID is required");
@@ -36,20 +36,29 @@ export default class IncidentEpisodeAPI extends BaseAPI {
         try {
             episodeId = new ObjectID(episodeIdParam);
         }
-        catch (_b) {
+        catch (_a) {
             throw new BadDataException("Invalid Episode ID");
         }
         const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
-        // Verify user has permission to edit the episode
-        const permissions = (_a = props
-            .userTenantAccessPermission) === null || _a === void 0 ? void 0 : _a["permissions"];
-        const hasPermission = permissions
-            ? permissions.some((p) => {
-                return (p === Permission.ProjectOwner ||
-                    p === Permission.ProjectAdmin ||
-                    p === Permission.EditIncidentEpisode);
-            })
-            : false;
+        CommonAPI.assertTenantScoped(props);
+        /*
+         * Read through getUserPermissions(Allow) rather than off
+         * userTenantAccessPermission directly. That dictionary is keyed by project
+         * id and its entries hold GRANTS AND DENIALS together, discriminated only
+         * by isBlockPermission, so the previous
+         * `userTenantAccessPermission["permissions"]` read was always undefined
+         * and denied every caller who was not a master admin. Mapping the array
+         * raw would swing the other way and count a team's explicit block
+         * entry for one of these permissions as a grant of it.
+         */
+        const permissions = DatabaseCommonInteractionPropsUtil.getUserPermissions(props, PermissionType.Allow).map((userPermission) => {
+            return userPermission.permission;
+        });
+        const hasPermission = permissions.some((p) => {
+            return (p === Permission.ProjectOwner ||
+                p === Permission.ProjectAdmin ||
+                p === Permission.EditIncidentEpisode);
+        });
         if (!hasPermission && !props.isMasterAdmin) {
             throw new BadDataException("You do not have permission to generate postmortem for this episode. You need to have one of these permissions: Project Owner, Project Admin, Edit Incident Episode.");
         }

package/build/dist/Server/API/IncidentEpisodeAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"IncidentEpisodeAPI.js","sourceRoot":"","sources":["../../../../Server/API/IncidentEpisodeAPI.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,6CAA6C,CAAC;AAC1E,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,iBAAiB,MAAM,yCAAyC,CAAC;AACxE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,sBAEN,MAAM,oCAAoC,CAAC;AAC5C,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAMhC,OAAO,SAAS,MAAM,aAAa,CAAC;AAEpC,OAAO,SAA0C,MAAM,uBAAuB,CAAC;AAC/E,OAAO,+BAEN,MAAM,6CAA6C,CAAC;AAErD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,UAAU,MAAM,wBAAwB,CAAC;AAEhD,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,OAG/C;IACC;;QACE,KAAK,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAE/C,8BAA8B;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,yCAAyC,EACvD,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,GAAmB,EACnB,GAAoB;;QAEpB,MAAM,cAAc,GAAuB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEnE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,SAAmB,CAAC;QAExB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAEzD,iDAAiD;QACjD,MAAM,WAAW,GAAkC,MAAA,KAAK;aACrD,0BAA0B,0CAAG,aAAa,CAEhC,CAAC;QAEd,MAAM,aAAa,GAAY,WAAW;YACxC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE;gBACjC,OAAO,CACL,CAAC,KAAK,UAAU,CAAC,YAAY;oBAC7B,CAAC,KAAK,UAAU,CAAC,YAAY;oBAC7B,CAAC,KAAK,UAAU,CAAC,mBAAmB,CACrC,CAAC;YACJ,CAAC,CAAC;YACJ,CAAC,CAAC,KAAK,CAAC;QAEV,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,qKAAqK,CACtK,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAuB,aAAa,CAAC,kBAAkB,CACnE,GAAG,CAAC,IAAI,EACR,UAAU,CACW,CAAC;QAExB,8DAA8D;QAC9D,MAAM,wBAAwB,GAAY,IAAI,CAAC;QAE/C,6DAA6D;QAC7D,MAAM,OAAO,GAA2B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YACrE,EAAE,EAAE,SAAS;YACb,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;aAChB;YACD,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,wBAAwB;QACxB,MAAM,WAAW,GACf,MAAM,+BAA+B,CAAC,mBAAmB,CAAC;YACxD,SAAS;YACT,wBAAwB;YACxB,qBAAqB,EAAE,GAAG;SAC3B,CAAC,CAAC;QAEL,2CAA2C;QAC3C,MAAM,SAAS,GACb,+BAA+B,CAAC,iCAAiC,CAC/D,WAAW,EACX,QAAQ,CACT,CAAC;QAEJ,oEAAoE;QACpE,MAAM,YAAY,GAAiB;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,6BAA6B;YACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,GAAG;YAChB;;;eAGG;YACH,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC/C,cAAc,EAAE,QAAQ,CAAC,OAAO;SACjC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"IncidentEpisodeAPI.js","sourceRoot":"","sources":["../../../../Server/API/IncidentEpisodeAPI.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,6CAA6C,CAAC;AAC1E,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,iBAAiB,MAAM,yCAAyC,CAAC;AACxE,OAAO,kCAAkC,EAAE,EACzC,cAAc,GACf,MAAM,6DAA6D,CAAC;AACrE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,sBAEN,MAAM,oCAAoC,CAAC;AAC5C,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAMhC,OAAO,SAAS,MAAM,aAAa,CAAC;AAEpC,OAAO,SAA0C,MAAM,uBAAuB,CAAC;AAC/E,OAAO,+BAEN,MAAM,6CAA6C,CAAC;AAErD,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,UAA8B,MAAM,wBAAwB,CAAC;AAEpE,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,OAG/C;IACC;;QACE,KAAK,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAE/C,8BAA8B;QAC9B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,yCAAyC,EACvD,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,wBAAwB,CACpC,GAAmB,EACnB,GAAoB;QAEpB,MAAM,cAAc,GAAuB,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAEnE,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,gBAAgB,CAAC,wBAAwB,CAAC,CAAC;QACvD,CAAC;QAED,IAAI,SAAmB,CAAC;QAExB,IAAI,CAAC;YACH,SAAS,GAAG,IAAI,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3C,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,gBAAgB,CAAC,oBAAoB,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;QAEzD,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;QAEpC;;;;;;;;;WASG;QACH,MAAM,WAAW,GACf,kCAAkC,CAAC,kBAAkB,CACnD,KAAK,EACL,cAAc,CAAC,KAAK,CACrB,CAAC,GAAG,CAAC,CAAC,cAA8B,EAAE,EAAE;YACvC,OAAO,cAAc,CAAC,UAAU,CAAC;QACnC,CAAC,CAAC,CAAC;QAEL,MAAM,aAAa,GAAY,WAAW,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,EAAE;YAChE,OAAO,CACL,CAAC,KAAK,UAAU,CAAC,YAAY;gBAC7B,CAAC,KAAK,UAAU,CAAC,YAAY;gBAC7B,CAAC,KAAK,UAAU,CAAC,mBAAmB,CACrC,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,MAAM,IAAI,gBAAgB,CACxB,qKAAqK,CACtK,CAAC;QACJ,CAAC;QAED,iDAAiD;QACjD,MAAM,QAAQ,GAAuB,aAAa,CAAC,kBAAkB,CACnE,GAAG,CAAC,IAAI,EACR,UAAU,CACW,CAAC;QAExB,8DAA8D;QAC9D,MAAM,wBAAwB,GAAY,IAAI,CAAC;QAE/C,6DAA6D;QAC7D,MAAM,OAAO,GAA2B,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YACrE,EAAE,EAAE,SAAS;YACb,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;aAChB;YACD,KAAK;SACN,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACnC,MAAM,IAAI,iBAAiB,CAAC,mBAAmB,CAAC,CAAC;QACnD,CAAC;QAED,wBAAwB;QACxB,MAAM,WAAW,GACf,MAAM,+BAA+B,CAAC,mBAAmB,CAAC;YACxD,SAAS;YACT,wBAAwB;YACxB,qBAAqB,EAAE,GAAG;SAC3B,CAAC,CAAC;QAEL,2CAA2C;QAC3C,MAAM,SAAS,GACb,+BAA+B,CAAC,iCAAiC,CAC/D,WAAW,EACX,QAAQ,CACT,CAAC;QAEJ,oEAAoE;QACpE,MAAM,YAAY,GAAiB;YACjC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,6BAA6B;YACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,GAAG;YAChB;;;eAGG;YACH,oBAAoB,EAAE,KAAK;SAC5B,CAAC;QAEF,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YACjB,YAAY,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QACrC,CAAC;QAED,MAAM,QAAQ,GACZ,MAAM,SAAS,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;QAEnD,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE;YAC/C,cAAc,EAAE,QAAQ,CAAC,OAAO;SACjC,CAAC,CAAC;IACL,CAAC;CACF"}

package/build/dist/Server/API/MonitorAPI.js

@@ -2,6 +2,7 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import MonitorService from "../Services/MonitorService";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import ObjectID from "../../Types/ObjectID";
 export default class MonitorAPI extends BaseAPI {
@@ -10,7 +11,29 @@ export default class MonitorAPI extends BaseAPI {
         super(Monitor, MonitorService);
         this.router.get(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/refresh-status/:monitorId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             try {
+                const databaseProps = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                /*
+                 * getUserMiddleware lets unauthenticated requests through as
+                 * "public", and refreshMonitorCurrentStatus reads and writes the
+                 * monitor as root. Require an authenticated member of the
+                 * monitor's own project — the caller-supplied tenant says nothing
+                 * about which project the monitor id in the path belongs to.
+                 */
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(databaseProps);
                 const monitorId = new ObjectID(req.params["monitorId"]);
+                const monitor = await MonitorService.findOneById({
+                    id: monitorId,
+                    select: {
+                        projectId: true,
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                CommonAPI.assertResourceBelongsToProject({
+                    resourceProjectId: monitor === null || monitor === void 0 ? void 0 : monitor.projectId,
+                    projectId: projectId,
+                });
                 await MonitorService.refreshMonitorCurrentStatus(monitorId);
                 return Response.sendEmptySuccessResponse(req, res);
             }

package/build/dist/Server/API/MonitorAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"MonitorAPI.js","sourceRoot":"","sources":["../../../../Server/API/MonitorAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,cAEN,MAAM,4BAA4B,CAAC;AAMpC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,OAAO,MAAM,qCAAqC,CAAC;AAC1D,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAoC;IAC1E;;QACE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,4BAA4B,EACjF,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,SAAS,GAAa,IAAI,QAAQ,CACtC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAW,CAClC,CAAC;gBAEF,MAAM,cAAc,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;gBAC5D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"MonitorAPI.js","sourceRoot":"","sources":["../../../../Server/API/MonitorAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,cAEN,MAAM,4BAA4B,CAAC;AAMpC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,aAAa,CAAC;AAEpC,OAAO,OAAO,MAAM,qCAAqC,CAAC;AAC1D,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,OAAoC;IAC1E;;QACE,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAE/B,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,4BAA4B,EACjF,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,aAAa,GACjB,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD;;;;;;mBAMG;gBACH,MAAM,SAAS,GACb,SAAS,CAAC,gCAAgC,CAAC,aAAa,CAAC,CAAC;gBAE5D,MAAM,SAAS,GAAa,IAAI,QAAQ,CACtC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAW,CAClC,CAAC;gBAEF,MAAM,OAAO,GAAmB,MAAM,cAAc,CAAC,WAAW,CAAC;oBAC/D,EAAE,EAAE,SAAS;oBACb,MAAM,EAAE;wBACN,SAAS,EAAE,IAAI;qBAChB;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,SAAS,CAAC,8BAA8B,CAAC;oBACvC,iBAAiB,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS;oBACrC,SAAS,EAAE,SAAS;iBACrB,CAAC,CAAC;gBAEH,MAAM,cAAc,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC;gBAC5D,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/MonitorTemplateAPI.js

@@ -37,6 +37,7 @@ export default class MonitorTemplateAPI extends BaseAPI {
             try {
                 const monitorTemplateId = new ObjectID(req.params["monitorTemplateId"]);
                 const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                CommonAPI.assertTenantScoped(props);
                 const fields = readSyncFields(req);
                 const result = await MonitorTemplateService.syncLinkedMonitors(Object.assign({ monitorTemplateId,
                     props }, (fields !== undefined ? { fields } : {})));
@@ -54,6 +55,7 @@ export default class MonitorTemplateAPI extends BaseAPI {
                 const monitorTemplateId = new ObjectID(req.params["monitorTemplateId"]);
                 const monitorId = new ObjectID(req.params["monitorId"]);
                 const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                CommonAPI.assertTenantScoped(props);
                 const fields = readSyncFields(req);
                 await MonitorTemplateService.syncToMonitor(Object.assign({ monitorTemplateId,
                     monitorId,
@@ -72,6 +74,7 @@ export default class MonitorTemplateAPI extends BaseAPI {
                 const monitorTemplateId = new ObjectID(req.params["monitorTemplateId"]);
                 const monitorId = new ObjectID(req.params["monitorId"]);
                 const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                CommonAPI.assertTenantScoped(props);
                 await MonitorTemplateService.linkMonitor({
                     monitorTemplateId,
                     monitorId,
@@ -91,6 +94,7 @@ export default class MonitorTemplateAPI extends BaseAPI {
                 const monitorTemplateId = new ObjectID(req.params["monitorTemplateId"]);
                 const monitorId = new ObjectID(req.params["monitorId"]);
                 const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+                CommonAPI.assertTenantScoped(props);
                 await MonitorTemplateService.unlinkMonitor({
                     monitorTemplateId,
                     monitorId,

package/build/dist/Server/API/MonitorTemplateAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"MonitorTemplateAPI.js","sourceRoot":"","sources":["../../../../Server/API/MonitorTemplateAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,sBAGN,MAAM,oCAAoC,CAAC;AAM5C,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,aAAa,CAAC;AACpC,OAAO,eAAe,MAAM,6CAA6C,CAAC;AAE1E,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAmB;;IACzC,MAAM,GAAG,GAAY,MAAC,GAAG,CAAC,IAA4C,0CACpE,QAAQ,CACT,CAAC;IACF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,OAG/C;IACC;;QACE,KAAK,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAE/C,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,6CAA6C,EAC3D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAa,IAAI,QAAQ,CAC9C,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAW,CAC1C,CAAC;gBAEF,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,MAAM,MAAM,GAA8B,cAAc,CAAC,GAAG,CAAC,CAAC;gBAE9D,MAAM,MAAM,GACV,MAAM,sBAAsB,CAAC,kBAAkB,iBAC7C,iBAAiB;oBACjB,KAAK,IACF,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC3C,CAAC;gBAEL,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,oBAC1C,MAAM,EACT,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;YACD,OAAO;QACT,CAAC,CACF,CAAC;QAEF,0EAA0E;QAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,gDAAgD,EAC9D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAa,IAAI,QAAQ,CAC9C,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAW,CAC1C,CAAC;gBACF,MAAM,SAAS,GAAa,IAAI,QAAQ,CACtC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAW,CAClC,CAAC;gBAEF,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,MAAM,MAAM,GAA8B,cAAc,CAAC,GAAG,CAAC,CAAC;gBAE9D,MAAM,sBAAsB,CAAC,aAAa,iBACxC,iBAAiB;oBACjB,SAAS;oBACT,KAAK,IACF,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC3C,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;YACD,OAAO;QACT,CAAC,CACF,CAAC;QAEF,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,6CAA6C,EAC3D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAa,IAAI,QAAQ,CAC9C,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAW,CAC1C,CAAC;gBACF,MAAM,SAAS,GAAa,IAAI,QAAQ,CACtC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAW,CAClC,CAAC;gBAEF,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,MAAM,sBAAsB,CAAC,WAAW,CAAC;oBACvC,iBAAiB;oBACjB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;YACD,OAAO;QACT,CAAC,CACF,CAAC;QAEF,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,+CAA+C,EAC7D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAa,IAAI,QAAQ,CAC9C,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAW,CAC1C,CAAC;gBACF,MAAM,SAAS,GAAa,IAAI,QAAQ,CACtC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAW,CAClC,CAAC;gBAEF,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,MAAM,sBAAsB,CAAC,aAAa,CAAC;oBACzC,iBAAiB;oBACjB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;YACD,OAAO;QACT,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"MonitorTemplateAPI.js","sourceRoot":"","sources":["../../../../Server/API/MonitorTemplateAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,sBAGN,MAAM,oCAAoC,CAAC;AAM5C,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,aAAa,CAAC;AACpC,OAAO,eAAe,MAAM,6CAA6C,CAAC;AAE1E,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C;;;;GAIG;AACH,SAAS,cAAc,CAAC,GAAmB;;IACzC,MAAM,GAAG,GAAY,MAAC,GAAG,CAAC,IAA4C,0CACpE,QAAQ,CACT,CAAC;IACF,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACtC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;IACrE,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,sCAAsC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,kBAAmB,SAAQ,OAG/C;IACC;;QACE,KAAK,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAAC;QAE/C,uEAAuE;QACvE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,6CAA6C,EAC3D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAa,IAAI,QAAQ,CAC9C,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAW,CAC1C,CAAC;gBAEF,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAEpC,MAAM,MAAM,GAA8B,cAAc,CAAC,GAAG,CAAC,CAAC;gBAE9D,MAAM,MAAM,GACV,MAAM,sBAAsB,CAAC,kBAAkB,iBAC7C,iBAAiB;oBACjB,KAAK,IACF,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC3C,CAAC;gBAEL,OAAO,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,oBAC1C,MAAM,EACT,CAAC;YACL,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;YACD,OAAO;QACT,CAAC,CACF,CAAC;QAEF,0EAA0E;QAC1E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,gDAAgD,EAC9D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAa,IAAI,QAAQ,CAC9C,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAW,CAC1C,CAAC;gBACF,MAAM,SAAS,GAAa,IAAI,QAAQ,CACtC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAW,CAClC,CAAC;gBAEF,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAEpC,MAAM,MAAM,GAA8B,cAAc,CAAC,GAAG,CAAC,CAAC;gBAE9D,MAAM,sBAAsB,CAAC,aAAa,iBACxC,iBAAiB;oBACjB,SAAS;oBACT,KAAK,IACF,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC3C,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;YACD,OAAO;QACT,CAAC,CACF,CAAC;QAEF,6CAA6C;QAC7C,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,6CAA6C,EAC3D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAa,IAAI,QAAQ,CAC9C,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAW,CAC1C,CAAC;gBACF,MAAM,SAAS,GAAa,IAAI,QAAQ,CACtC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAW,CAClC,CAAC;gBAEF,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAEpC,MAAM,sBAAsB,CAAC,WAAW,CAAC;oBACvC,iBAAiB;oBACjB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;YACD,OAAO;QACT,CAAC,CACF,CAAC;QAEF,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE;aACrB,cAAc,EAAE,0CACf,QAAQ,EAAE,+CAA+C,EAC7D,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAa,IAAI,QAAQ,CAC9C,GAAG,CAAC,MAAM,CAAC,mBAAmB,CAAW,CAC1C,CAAC;gBACF,MAAM,SAAS,GAAa,IAAI,QAAQ,CACtC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAW,CAClC,CAAC;gBAEF,MAAM,KAAK,GACT,MAAM,SAAS,CAAC,iCAAiC,CAAC,GAAG,CAAC,CAAC;gBAEzD,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAEpC,MAAM,sBAAsB,CAAC,aAAa,CAAC;oBACzC,iBAAiB;oBACjB,SAAS;oBACT,KAAK;iBACN,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACrD,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,IAAI,CAAC,CAAC,CAAC,CAAC;YACV,CAAC;YACD,OAAO;QACT,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}

package/build/dist/Server/API/ProbeAPI.js

@@ -2,40 +2,156 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import ProbeService from "../Services/ProbeService";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
-import LIMIT_MAX from "../../Types/Database/LimitMax";
+import MultiSearch from "../../Types/BaseDatabase/MultiSearch";
+import { DEFAULT_LIMIT, LIMIT_PER_PROJECT, } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import BadRequestException from "../../Types/Exception/BadRequestException";
+import JSONFunctions from "../../Types/JSONFunctions";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Probe from "../../Models/DatabaseModels/Probe";
+// What a caller that asks for no fields in particular gets back.
+const DEFAULT_GLOBAL_PROBE_SELECT = {
+    name: true,
+    description: true,
+    lastAlive: true,
+    iconFileId: true,
+    connectionStatus: true,
+    // The monitor create form pre-selects the auto-enabled probes.
+    shouldAutoEnableProbeOnNewMonitors: true,
+};
+/*
+ * Global probes are not project rows, so this endpoint has to read them as
+ * root - which means none of the usual per-column permission checks run.
+ * Every field a caller may select, filter or sort on is therefore listed
+ * here, and nothing else is reachable: `key` in particular is a probe's
+ * shared secret, and a root-privileged query on it would be an oracle for
+ * reading it back one character at a time.
+ */
+const GLOBAL_PROBE_FIELDS = [
+    ...Object.keys(DEFAULT_GLOBAL_PROBE_SELECT),
+    "_id",
+    /*
+     * Readable, but not something a caller can steer: the query below pins it
+     * to true whatever the caller sent.
+     */
+    "isGlobalProbe",
+];
 export default class ProbeAPI extends BaseAPI {
     constructor() {
         var _a;
         super(Probe, ProbeService);
         this.router.post(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/global-probes`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             try {
+                const body = req.body || {};
+                const skip = new PositiveNumber(ProbeAPI.getPaginationValue(req, "skip", 0));
+                const limit = new PositiveNumber(ProbeAPI.getPaginationValue(req, "limit", DEFAULT_LIMIT));
+                if (limit.toNumber() > LIMIT_PER_PROJECT) {
+                    throw new BadRequestException("Limit should be less than " + LIMIT_PER_PROJECT);
+                }
+                if (skip.toNumber() < 0) {
+                    throw new BadRequestException("Skip should be greater than or equal to 0");
+                }
+                if (limit.toNumber() <= 0) {
+                    throw new BadRequestException("Limit should be greater than 0");
+                }
+                const query = Object.assign(Object.assign({}, ProbeAPI.getQuery(body["query"])), { 
+                    /*
+                     * Last, so a caller cannot widen the read past the global probes
+                     * by sending isGlobalProbe themselves.
+                     */
+                    isGlobalProbe: true });
+                const select = ProbeAPI.getSelect(body["select"]);
+                const sort = ProbeAPI.getSort(body["sort"]);
                 const probes = await ProbeService.findBy({
-                    query: {
-                        isGlobalProbe: true,
-                    },
-                    select: {
-                        name: true,
-                        description: true,
-                        lastAlive: true,
-                        iconFileId: true,
-                        connectionStatus: true,
-                        // The monitor create form pre-selects the auto-enabled probes.
-                        shouldAutoEnableProbeOnNewMonitors: true,
+                    query,
+                    select,
+                    sort,
+                    props: {
+                        isRoot: true,
                     },
+                    skip,
+                    limit,
+                });
+                const count = await ProbeService.countBy({
+                    query,
                     props: {
                         isRoot: true,
                     },
-                    skip: 0,
-                    limit: LIMIT_MAX,
                 });
-                return Response.sendEntityArrayResponse(req, res, probes, new PositiveNumber(probes.length), Probe);
+                return Response.sendEntityArrayResponse(req, res, probes, count, Probe);
             }
             catch (err) {
                 next(err);
             }
         });
     }
+    /*
+     * skip/limit arrive as query params from ModelAPI.getList and in the body
+     * from anything hand-rolled, so both are read - same precedence as
+     * BaseAPI.getList.
+     */
+    static getPaginationValue(req, key, defaultValue) {
+        if (req.query && req.query[key]) {
+            return parseInt(req.query[key], 10) || defaultValue;
+        }
+        if (req.body && req.body[key] !== undefined) {
+            return (parseInt(req.body[key], 10) || defaultValue);
+        }
+        return defaultValue;
+    }
+    static getQuery(query) {
+        const deserialized = JSONFunctions.deserialize(query);
+        for (const key in deserialized) {
+            const value = deserialized[key];
+            /*
+             * MultiSearch is the free-text search operator. Its key is synthetic -
+             * the columns it reads are the ones it carries - so those are what get
+             * checked against the allow-list.
+             */
+            if (value instanceof MultiSearch) {
+                for (const field of value.fields) {
+                    if (!GLOBAL_PROBE_FIELDS.includes(field)) {
+                        throw new BadDataException(`Global probes cannot be searched on ${field}.`);
+                    }
+                }
+                continue;
+            }
+            if (!GLOBAL_PROBE_FIELDS.includes(key)) {
+                throw new BadDataException(`Global probes cannot be filtered on ${key}.`);
+            }
+        }
+        return deserialized;
+    }
+    static getSelect(select) {
+        const requested = {};
+        for (const key in select) {
+            if (!GLOBAL_PROBE_FIELDS.includes(key) || !select[key]) {
+                continue;
+            }
+            /*
+             * Coerced rather than copied: every selectable field here is a scalar,
+             * so a nested (relation) select on one of them is not something the
+             * caller gets to ask for.
+             */
+            requested[key] = true;
+        }
+        /*
+         * A caller that asks for nothing gets what this endpoint returned before
+         * it honoured select at all.
+         */
+        if (Object.keys(requested).length === 0) {
+            return Object.assign({}, DEFAULT_GLOBAL_PROBE_SELECT);
+        }
+        return requested;
+    }
+    static getSort(sort) {
+        const deserialized = JSONFunctions.deserialize(sort);
+        for (const key in deserialized) {
+            if (!GLOBAL_PROBE_FIELDS.includes(key)) {
+                throw new BadDataException(`Global probes cannot be sorted on ${key}.`);
+            }
+        }
+        return deserialized;
+    }
 }
 //# sourceMappingURL=ProbeAPI.js.map

package/build/dist/Server/API/ProbeAPI.js.map

@@ -1 +1 @@
-{"version":3,"file":"ProbeAPI.js","sourceRoot":"","sources":["../../../../Server/API/ProbeAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,YAEN,MAAM,0BAA0B,CAAC;AAMlC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,MAAM,mCAAmC,CAAC;AAEtD,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,OAAgC;IACpE;;QACE,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAE3B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,gBAAgB,EACrE,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;oBACrD,KAAK,EAAE;wBACL,aAAa,EAAE,IAAI;qBACpB;oBACD,MAAM,EAAE;wBACN,IAAI,EAAE,IAAI;wBACV,WAAW,EAAE,IAAI;wBACjB,SAAS,EAAE,IAAI;wBACf,UAAU,EAAE,IAAI;wBAChB,gBAAgB,EAAE,IAAI;wBACtB,+DAA+D;wBAC/D,kCAAkC,EAAE,IAAI;qBACzC;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,IAAI,EAAE,CAAC;oBACP,KAAK,EAAE,SAAS;iBACjB,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,uBAAuB,CACrC,GAAG,EACH,GAAG,EACH,MAAM,EACN,IAAI,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EACjC,KAAK,CACN,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"ProbeAPI.js","sourceRoot":"","sources":["../../../../Server/API/ProbeAPI.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAC7D,OAAO,YAEN,MAAM,0BAA0B,CAAC;AASlC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,OAAO,MAAM,WAAW,CAAC;AAChC,OAAO,WAAW,MAAM,sCAAsC,CAAC;AAC/D,OAAO,EACL,aAAa,EACb,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,mBAAmB,MAAM,2CAA2C,CAAC;AAE5E,OAAO,aAAa,MAAM,2BAA2B,CAAC;AACtD,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,KAAK,MAAM,mCAAmC,CAAC;AAEtD,iEAAiE;AACjE,MAAM,2BAA2B,GAAkB;IACjD,IAAI,EAAE,IAAI;IACV,WAAW,EAAE,IAAI;IACjB,SAAS,EAAE,IAAI;IACf,UAAU,EAAE,IAAI;IAChB,gBAAgB,EAAE,IAAI;IACtB,+DAA+D;IAC/D,kCAAkC,EAAE,IAAI;CACzC,CAAC;AAEF;;;;;;;GAOG;AACH,MAAM,mBAAmB,GAAkB;IACzC,GAAG,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC;IAC3C,KAAK;IACL;;;OAGG;IACH,eAAe;CAChB,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,OAAgC;IACpE;;QACE,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QAE3B,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,GAAG,MAAA,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC,cAAc,EAAE,0CAAE,QAAQ,EAAE,gBAAgB,EACrE,cAAc,CAAC,iBAAiB,EAChC,KAAK,EAAE,GAAmB,EAAE,GAAoB,EAAE,IAAkB,EAAE,EAAE;YACtE,IAAI,CAAC;gBACH,MAAM,IAAI,GAAgB,GAAG,CAAC,IAAmB,IAAI,EAAE,CAAC;gBAExD,MAAM,IAAI,GAAmB,IAAI,cAAc,CAC7C,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,CAC5C,CAAC;gBAEF,MAAM,KAAK,GAAmB,IAAI,cAAc,CAC9C,QAAQ,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,aAAa,CAAC,CACzD,CAAC;gBAEF,IAAI,KAAK,CAAC,QAAQ,EAAE,GAAG,iBAAiB,EAAE,CAAC;oBACzC,MAAM,IAAI,mBAAmB,CAC3B,4BAA4B,GAAG,iBAAiB,CACjD,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,mBAAmB,CAC3B,2CAA2C,CAC5C,CAAC;gBACJ,CAAC;gBAED,IAAI,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,mBAAmB,CAAC,gCAAgC,CAAC,CAAC;gBAClE,CAAC;gBAED,MAAM,KAAK,mCACN,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAe,CAAC;oBACjD;;;uBAGG;oBACH,aAAa,EAAE,IAAI,GACpB,CAAC;gBAEF,MAAM,MAAM,GAAkB,QAAQ,CAAC,SAAS,CAC9C,IAAI,CAAC,QAAQ,CAAe,CAC7B,CAAC;gBAEF,MAAM,IAAI,GAAgB,QAAQ,CAAC,OAAO,CACxC,IAAI,CAAC,MAAM,CAAe,CAC3B,CAAC;gBAEF,MAAM,MAAM,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;oBACrD,KAAK;oBACL,MAAM;oBACN,IAAI;oBACJ,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;oBACD,IAAI;oBACJ,KAAK;iBACN,CAAC,CAAC;gBAEH,MAAM,KAAK,GAAmB,MAAM,YAAY,CAAC,OAAO,CAAC;oBACvD,KAAK;oBACL,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,OAAO,QAAQ,CAAC,uBAAuB,CACrC,GAAG,EACH,GAAG,EACH,MAAM,EACN,KAAK,EACL,KAAK,CACN,CAAC;YACJ,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,kBAAkB,CAC/B,GAAmB,EACnB,GAAqB,EACrB,YAAoB;QAEpB,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChC,OAAO,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAW,EAAE,EAAE,CAAC,IAAI,YAAY,CAAC;QAChE,CAAC;QAED,IAAI,GAAG,CAAC,IAAI,IAAK,GAAG,CAAC,IAAmB,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,OAAO,CACL,QAAQ,CAAE,GAAG,CAAC,IAAmB,CAAC,GAAG,CAAW,EAAE,EAAE,CAAC,IAAI,YAAY,CACtE,CAAC;QACJ,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;IAEO,MAAM,CAAC,QAAQ,CAAC,KAA6B;QACnD,MAAM,YAAY,GAAe,aAAa,CAAC,WAAW,CACxD,KAAmB,CACpB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAc,YAAY,CAAC,GAAG,CAAc,CAAC;YAExD;;;;eAIG;YACH,IAAI,KAAK,YAAY,WAAW,EAAE,CAAC;gBACjC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;oBACjC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;wBACzC,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,KAAK,GAAG,CAChD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAED,SAAS;YACX,CAAC;YAED,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,gBAAgB,CACxB,uCAAuC,GAAG,GAAG,CAC9C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,OAAO,YAA4B,CAAC;IACtC,CAAC;IAEO,MAAM,CAAC,SAAS,CAAC,MAA8B;QACrD,MAAM,SAAS,GAAwB,EAAE,CAAC;QAE1C,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvD,SAAS;YACX,CAAC;YAED;;;;eAIG;YACH,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACxB,CAAC;QAED;;;WAGG;QACH,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,yBAAY,2BAA2B,EAAG;QAC5C,CAAC;QAED,OAAO,SAA0B,CAAC;IACpC,CAAC;IAEO,MAAM,CAAC,OAAO,CAAC,IAA4B;QACjD,MAAM,YAAY,GAAe,aAAa,CAAC,WAAW,CACxD,IAAkB,CACnB,CAAC;QAEF,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvC,MAAM,IAAI,gBAAgB,CAAC,qCAAqC,GAAG,GAAG,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QAED,OAAO,YAA2B,CAAC;IACrC,CAAC;CACF"}

package/build/dist/Server/API/ProjectAPI.js

@@ -1,9 +1,11 @@
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import ProjectService from "../Services/ProjectService";
 import ResellerService from "../Services/ResellerService";
 import TeamMemberService from "../Services/TeamMemberService";
 import QueryHelper from "../Types/Database/QueryHelper";
+import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BillingService from "../Services/BillingService";
@@ -13,11 +15,12 @@ import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedExc
 import PositiveNumber from "../../Types/PositiveNumber";
 import Project from "../../Models/DatabaseModels/Project";
 import BadDataException from "../../Types/Exception/BadDataException";
+import OneUptimeDate from "../../Types/Date";
 import Permission from "../../Types/Permission";
 import ObjectID from "../../Types/ObjectID";
 export default class ProjectAPI extends BaseAPI {
     constructor() {
-        var _a, _b;
+        var _a, _b, _c;
         super(Project, ProjectService);
         this.router.put(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/:id/change-plan`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             var _a;
@@ -84,12 +87,68 @@ export default class ProjectAPI extends BaseAPI {
                 next(err);
             }
         });
+        /*
+         * Extends a project's trial. Master-admin only: this hands out free
+         * service and moves the customer's next invoice, so it is deliberately not
+         * reachable with project-level billing permissions - only OneUptime staff
+         * acting from the Admin Dashboard can call it.
+         */
+        this.router.put(`${(_b = new this.entityType().getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/:id/extend-trial`, MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware, async (req, res, next) => {
+            try {
+                if (!IsBillingEnabled) {
+                    throw new BadDataException("Billing is not enabled for this server");
+                }
+                const projectId = new ObjectID(req.params["id"]);
+                const body = req.body || {};
+                const data = body["data"] || {};
+                const trialEndsAtValue = data["trialEndsAt"];
+                if (!trialEndsAtValue) {
+                    throw new BadDataException("Trial end date is required to extend the trial");
+                }
+                /*
+                 * OneUptimeDate.fromString only parses strings and Dates - anything
+                 * else comes back as its own error text, not a Date - so reject a
+                 * non-string body value here rather than letting it through.
+                 */
+                if (typeof trialEndsAtValue !== "string") {
+                    throw new BadDataException("Trial end date is not a valid date");
+                }
+                const trialEndsAt = OneUptimeDate.fromString(trialEndsAtValue);
+                if (isNaN(trialEndsAt.getTime())) {
+                    throw new BadDataException("Trial end date is not a valid date");
+                }
+                /*
+                 * The master admin middleware verifies the token but does not put
+                 * the decoded payload on the request, so read it again here - who
+                 * granted the extension is the only audit trail this action has.
+                 */
+                let extendedByUserId = undefined;
+                try {
+                    const accessToken = UserMiddleware.getAccessTokenFromExpressRequest(req);
+                    if (accessToken) {
+                        extendedByUserId = JSONWebToken.decode(accessToken).userId;
+                    }
+                }
+                catch (_a) {
+                    // Only used for the log line - never block the extension on it.
+                }
+                await ProjectService.extendTrial({
+                    projectId: projectId,
+                    trialEndsAt: trialEndsAt,
+                    extendedByUserId: extendedByUserId,
+                });
+                return Response.sendEmptySuccessResponse(req, res);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
         /*
          * This API lists all the projects where user is its team member.
          * This API is usually used to show project selector dropdown in the UI
          */
-        this.router.post(`${(_b = new this.entityType()
-            .getCrudApiPath()) === null || _b === void 0 ? void 0 : _b.toString()}/list-user-projects`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_c = new this.entityType()
+            .getCrudApiPath()) === null || _c === void 0 ? void 0 : _c.toString()}/list-user-projects`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
             var _a, _b;
             try {
                 if (!((_a = req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId)) {