@oneuptime/common 11.7.3 → 12.0.0

package/Server/Services/DatabaseService.ts

@@ -68,6 +68,7 @@ import {
   EntityManager,
   Repository,
   SelectQueryBuilder,
+  UpdateResult,
 } from "typeorm";
 import { ColumnMetadata } from "typeorm/metadata/ColumnMetadata";
 import { EntityMetadata } from "typeorm/metadata/EntityMetadata";
@@ -1552,21 +1553,10 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(findBy.props);
 
-      let automaticallyAddedCreatedAtInSelect: boolean = false;
-
       if (!findBy.sort || Object.keys(findBy.sort).length === 0) {
         findBy.sort = {
           createdAt: SortOrder.Descending,
         };
-
-        if (!findBy.select) {
-          findBy.select = {} as any;
-        }
-
-        if (!(findBy.select as any)["createdAt"]) {
-          (findBy.select as any)["createdAt"] = true;
-          automaticallyAddedCreatedAtInSelect = true;
-        }
       }
 
       const onFind: OnFind<TBaseModel> = findBy.props.ignoreHooks
@@ -1600,6 +1590,9 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       onBeforeFind.query = result.query;
       onBeforeFind.select = result.select || undefined;
 
+      const sortColumnsAddedToSelect: Array<string> =
+        this.addSortColumnsToSelect(onBeforeFind);
+
       if (!(onBeforeFind.skip instanceof PositiveNumber)) {
         onBeforeFind.skip = new PositiveNumber(onBeforeFind.skip);
       }
@@ -1634,8 +1627,8 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       decryptedItems = this.sanitizeFindByItems(decryptedItems, onBeforeFind);
 
       for (const item of decryptedItems) {
-        if (automaticallyAddedCreatedAtInSelect) {
-          delete (item as any).createdAt;
+        for (const sortColumn of sortColumnsAddedToSelect) {
+          delete (item as any)[sortColumn];
         }
       }
 
@@ -1652,6 +1645,67 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     }
   }
 
+  /**
+   * Adds every sorted column to the select, and returns the ones it added so
+   * `_findBy` can strip them back off the results.
+   *
+   * A column can be ordered by without being selected in a plain SELECT, but
+   * not once a relation is also selected: the join sends the query down
+   * TypeORM's paginated path, which wraps it and orders the outer SELECT by a
+   * column the inner query only emits when that column was selected. The
+   * request then fails outright with `column distinctAlias.<Alias>_<column>
+   * does not exist`. Callers should not have to know that, so close the gap
+   * here for every sort rather than leaving each call site to remember.
+   *
+   * Deliberately runs *after* the read-permission check. ORDER BY is not
+   * permission-checked, so a column being sorted on is already reaching the
+   * database - adding it to the select must not be able to turn a query that
+   * worked into a permission error. The values never reach the caller.
+   */
+  private addSortColumnsToSelect(findBy: FindBy<TBaseModel>): Array<string> {
+    /*
+     * No select at all means every column is selected, so there is nothing to
+     * fill in.
+     */
+    if (!findBy.select) {
+      return [];
+    }
+
+    const sortColumnsToAdd: Array<string> = Object.keys(
+      findBy.sort || {},
+    ).filter((sortColumn: string) => {
+      if ((findBy.select as any)[sortColumn] !== undefined) {
+        return false;
+      }
+
+      /*
+       * Sorting by a relation orders through the joined table, which has its
+       * own alias - adding the relation to the select here would instead turn
+       * it into a fetched relation.
+       */
+      return (
+        this.model.hasColumn(sortColumn) &&
+        !this.model.isEntityColumn(sortColumn)
+      );
+    });
+
+    if (sortColumnsToAdd.length === 0) {
+      return [];
+    }
+
+    /*
+     * Copied rather than mutated: sanitizeSelect hands back the caller's own
+     * select object, and callers reuse those across queries.
+     */
+    findBy.select = { ...(findBy.select as any) };
+
+    for (const sortColumn of sortColumnsToAdd) {
+      (findBy.select as any)[sortColumn] = true;
+    }
+
+    return sortColumnsToAdd;
+  }
+
   private sanitizeFindByItems(
     items: Array<TBaseModel>,
     findBy: FindBy<TBaseModel>,
@@ -1841,6 +1895,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
       const dataColumns: [string, boolean][] = [];
       const dataKeys: string[] = Object.keys(data);
+
+      /*
+       * An update that carries no columns writes nothing, yet it would still
+       * match rows - so returning the matched count reported a write that
+       * never happened. Treat it like a query that matched nothing instead.
+       */
+      const hasColumnsToUpdate: boolean = dataKeys.length > 0;
+
       for (const key of dataKeys) {
         dataColumns.push([key, true]);
       }
@@ -1879,14 +1941,59 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         }
       }
 
-      const items: Array<TBaseModel> = await this._findBy({
-        query: beforeUpdateBy.query,
-        skip: updateBy.skip.toNumber(),
-        limit: updateBy.limit.toNumber(),
-        select: selectColumns,
-        props: { isRoot: true, ignoreHooks: true },
+      const items: Array<TBaseModel> = hasColumnsToUpdate
+        ? await this._findBy({
+            query: beforeUpdateBy.query,
+            skip: updateBy.skip.toNumber(),
+            limit: updateBy.limit.toNumber(),
+            select: selectColumns,
+            props: { isRoot: true, ignoreHooks: true },
+          })
+        : [];
+
+      /*
+       * save() has upsert semantics: if the located row is hard-deleted by a
+       * concurrent request between the _findBy above and the write below,
+       * save() INSERTs a resurrected "zombie" row carrying only the update's
+       * columns. Zombies with enough NOT NULL columns persist and then hold
+       * foreign keys forever (e.g. a probe status-update racing a monitor
+       * delete resurrected the Monitor and permanently blocked deleting the
+       * MonitorStatus it referenced). Updates therefore go through
+       * repository.update(), which never inserts and simply affects zero
+       * rows when the target is gone.
+       *
+       * Only EntityArray (many-to-many) columns still need save(), because
+       * their junction rows cannot be written by a plain UPDATE. Entity
+       * (many-to-one) columns must NOT route to save(): they are ordinary
+       * foreign-key columns on this same table, and TypeORM's update()
+       * resolves a relation property to its join columns
+       * (EntityMetadata.findColumnsWithPropertyPath). Routing them to save()
+       * left the resurrection hole open for any caller that expressed the
+       * write as the relation member rather than the scalar id — e.g.
+       * Monitor.currentMonitorStatus vs Monitor.currentMonitorStatusId,
+       * which are two decorated members over the SAME physical column.
+       */
+      const relationColumnNames: Set<string> = new Set<string>(
+        this.getModel()
+          .getTableColumns()
+          .columns.filter((column: string) => {
+            const metadata: TableColumnMetadata | undefined =
+              this.getModel().getTableColumnMetadata(column);
+            return metadata?.type === TableColumnType.EntityArray;
+          }),
+      );
+      const hasRelationUpdates: boolean = dataKeys.some((key: string) => {
+        return relationColumnNames.has(key);
       });
 
+      /*
+       * Rows the write actually touched. A row hard-deleted between the find
+       * above and the write is reported by update() as zero rows affected;
+       * it must not fire success hooks (they re-read the row and would
+       * dereference null) nor be counted as updated.
+       */
+      const affectedItems: Array<TBaseModel> = [];
+
       for (const item of items) {
         /*
          * _id must be set AFTER the spread: update data can carry an
@@ -1908,7 +2015,37 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
           projectId: updateBy.props.tenantId?.toString(),
         } as LogAttributes);
 
-        await this.getRepository().save(updatedItem);
+        if (hasRelationUpdates) {
+          await this.getRepository().save(updatedItem);
+        } else {
+          const { _id, ...updateData } = updatedItem;
+          const updateResult: UpdateResult = await this.getRepository().update(
+            { _id: _id } as any,
+            {
+              ...updateData,
+              /*
+               * save() bumps the @VersionColumn automatically; update() does
+               * not, so emulate it to keep the audit counter behaviour
+               * identical.
+               */
+              version: () => {
+                return '"version" + 1';
+              },
+            } as any,
+          );
+
+          /*
+           * The row was hard-deleted between the find above and this write.
+           * Nothing was updated, so skip the success hooks for it: they
+           * re-read the row and would dereference null (and would report a
+           * change that never happened).
+           */
+          if (updateResult.affected === 0) {
+            continue;
+          }
+        }
+
+        affectedItems.push(item);
 
         // hit workflow.
         if (
@@ -1970,16 +2107,22 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
        *     ).affected || 0;
        */
 
+      /*
+       * onUpdateSuccess always fires — subclasses rely on it being called
+       * even when nothing matched — but it is handed only the rows the write
+       * actually affected, so a row deleted mid-update never appears as a
+       * phantom id that hooks would then fail to re-read.
+       */
       if (!updateBy.props.ignoreHooks) {
         await this.onUpdateSuccess(
           { updateBy, carryForward },
-          items.map((i: TBaseModel) => {
+          affectedItems.map((i: TBaseModel) => {
             return new ObjectID(i._id!);
           }),
         );
       }
 
-      return items.length;
+      return affectedItems.length;
     } catch (error) {
       await this.onUpdateError(error as Exception);
       throw this.getException(error as Exception);
@@ -2110,6 +2253,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   public async updateColumnsByIdWithoutHooks(input: {
     id: ObjectID;
     data: PartialEntity<TBaseModel>;
+    /*
+     * Leave `updatedAt` untouched. For passive bookkeeping writes (liveness
+     * timestamps, ingest health markers) where consumers key change
+     * detection off updatedAt - e.g. the session replay configEpoch - a
+     * refreshed updateDate would broadcast "configuration changed" on every
+     * heartbeat.
+     */
+    skipUpdateDateColumn?: boolean;
   }): Promise<void> {
     if (!input.id) {
       throw new BadDataException("id is required");
@@ -2159,6 +2310,107 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     }
 
     // The raw path has no entity machinery to touch updateDate — do it here.
+    if (metadata.updateDateColumn && !input.skipUpdateDateColumn) {
+      setClauses.push(
+        `"${metadata.updateDateColumn.databaseName}" = CURRENT_TIMESTAMP`,
+      );
+    }
+
+    const primaryColumnName: string =
+      metadata.primaryColumns[0]?.databaseName || "_id";
+    params.push(input.id.toString());
+
+    const sql: string = `UPDATE "${metadata.tableName}" SET ${setClauses.join(
+      ", ",
+    )} WHERE "${primaryColumnName}" = $${params.length}`;
+
+    await repository.manager.query(sql, params);
+  }
+
+  /*
+   * Atomically add to numeric columns and set literal columns for one row,
+   * in a SINGLE auto-committed UPDATE, with no hooks and no `version` bump.
+   *
+   * This is the counter-flush primitive. `updateColumnsByIdWithoutHooks`
+   * can't express it (a read-modify-write would lose concurrent writers'
+   * increments, and the value isn't known to the caller), and
+   * `getRepository().increment()` can't either: it goes through
+   * UpdateQueryBuilder, which always appends `version = version + 1`, so an
+   * ingest-driven counter bump would fight the optimistic lock on a row a
+   * human may be editing — and it can't set a second column in the same
+   * statement.
+   *
+   * `COALESCE(col, 0)` so a NULL counter starts from zero rather than
+   * staying NULL forever.
+   *
+   * Column and table identifiers come from entity metadata (never from the
+   * caller) and every value is bound as a parameter, so this is not an
+   * injection surface. Use ONLY for trusted, internal, side-effect-free
+   * column writes.
+   */
+  @CaptureSpan()
+  public async atomicAddToColumnsByIdWithoutHooks(input: {
+    id: ObjectID;
+    add: Partial<Record<keyof TBaseModel, number>>;
+    set?: PartialEntity<TBaseModel> | undefined;
+  }): Promise<void> {
+    if (!input.id) {
+      throw new BadDataException("id is required");
+    }
+
+    const repository: Repository<TBaseModel> = this.getRepository();
+    const metadata: EntityMetadata = repository.metadata;
+    const driver: Driver = repository.manager.connection.driver;
+
+    const setClauses: Array<string> = [];
+    const params: Array<unknown> = [];
+
+    const columnFor: (propertyName: string) => ColumnMetadata = (
+      propertyName: string,
+    ): ColumnMetadata => {
+      const column: ColumnMetadata | undefined =
+        metadata.findColumnWithPropertyName(propertyName);
+      if (!column) {
+        throw new BadDataException(
+          `atomicAddToColumnsByIdWithoutHooks: unknown column "${propertyName}" on "${metadata.tableName}"`,
+        );
+      }
+      return column;
+    };
+
+    for (const [propertyName, delta] of Object.entries(
+      input.add as ObjectLiteral,
+    )) {
+      if (typeof delta !== "number" || !Number.isFinite(delta)) {
+        throw new BadDataException(
+          `atomicAddToColumnsByIdWithoutHooks: "${propertyName}" delta must be a finite number`,
+        );
+      }
+
+      const column: ColumnMetadata = columnFor(propertyName);
+      params.push(delta);
+      const quoted: string = `"${column.databaseName}"`;
+      setClauses.push(`${quoted} = COALESCE(${quoted}, 0) + $${params.length}`);
+    }
+
+    for (const [propertyName, value] of Object.entries(
+      (input.set || {}) as ObjectLiteral,
+    )) {
+      if (typeof value === "function") {
+        throw new BadDataException(
+          `atomicAddToColumnsByIdWithoutHooks: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`,
+        );
+      }
+
+      const column: ColumnMetadata = columnFor(propertyName);
+      params.push(driver.preparePersistentValue(value, column));
+      setClauses.push(`"${column.databaseName}" = $${params.length}`);
+    }
+
+    if (setClauses.length === 0) {
+      return;
+    }
+
     if (metadata.updateDateColumn) {
       setClauses.push(
         `"${metadata.updateDateColumn.databaseName}" = CURRENT_TIMESTAMP`,

package/Server/Services/IncidentEpisodeService.ts

@@ -27,6 +27,9 @@ import { Red500, Yellow500, Purple500 } from "../../Types/BrandColors";
 import URL from "../../Types/API/URL";
 import DatabaseConfig from "../DatabaseConfig";
 import IncidentSeverityService from "./IncidentSeverityService";
+import ProjectScopedReferenceValidator, {
+  resolveReferenceId,
+} from "../Utils/Database/ProjectScopedReferenceValidator";
 import IncidentEpisodeMemberService from "./IncidentEpisodeMemberService";
 import IncidentEpisodeOwnerUserService from "./IncidentEpisodeOwnerUserService";
 import IncidentEpisodeOwnerTeamService from "./IncidentEpisodeOwnerTeamService";
@@ -90,6 +93,36 @@ export class Service extends DatabaseService<Model> {
       updateBy.query,
       updateBy.props,
     );
+
+    /*
+     * An episode carries the same project-scoped state and severity an
+     * incident does, on FKs that are equally ON DELETE NO ACTION, so an id
+     * from another project here leaves that project undeletable in exactly
+     * the same way. onBeforeCreate overwrites currentIncidentStateId with
+     * this project's created state, which leaves the severity as the only
+     * create-reachable column — but an update can write either.
+     */
+    await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+      projectId: updateBy.props.tenantId,
+      subject: "incident episode",
+      references: [
+        {
+          modelName: "Incident State",
+          id:
+            resolveReferenceId(updateBy.data.currentIncidentStateId) ||
+            resolveReferenceId(updateBy.data.currentIncidentState),
+          service: IncidentStateService,
+        },
+        {
+          modelName: "Incident Severity",
+          id:
+            resolveReferenceId(updateBy.data.incidentSeverityId) ||
+            resolveReferenceId(updateBy.data.incidentSeverity),
+          service: IncidentSeverityService,
+        },
+      ],
+    });
+
     return { updateBy, carryForward: null };
   }
 
@@ -140,6 +173,20 @@ export class Service extends DatabaseService<Model> {
 
     createBy.data.currentIncidentStateId = incidentState.id;
 
+    await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+      projectId: projectId,
+      subject: "incident episode",
+      references: [
+        {
+          modelName: "Incident Severity",
+          id:
+            resolveReferenceId(createBy.data.incidentSeverityId) ||
+            resolveReferenceId(createBy.data.incidentSeverity),
+          service: IncidentSeverityService,
+        },
+      ],
+    });
+
     // Auto-generate episode number
     const episodeCounterResult: {
       counter: number;