@oneuptime/common 11.7.3 → 12.0.0

package/Server/Services/ProbeService.ts

@@ -32,6 +32,7 @@ import MonitorService from "./MonitorService";
 import PushNotificationMessage from "../../Types/PushNotification/PushNotificationMessage";
 import PushNotificationUtil from "../Utils/PushNotificationUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import QueryHelper from "../Types/Database/QueryHelper";
 import { IsBillingEnabled } from "../EnvironmentConfig";
 import GlobalCache from "../Infrastructure/GlobalCache";
 import { createWhatsAppMessageFromTemplate } from "../Utils/WhatsAppTemplateUtil";
@@ -434,6 +435,71 @@ export class Service extends DatabaseService<Model> {
     return { createBy: createBy, carryForward: [] };
   }
 
+  /*
+   * Only global probes and probes belonging to this project may be attached to
+   * that project's monitors. Probe ids reach the server from the browser - the
+   * monitor create form and the Monitor > Probes table both post them - so
+   * they cannot be trusted to stay inside the tenant. Every path that attaches
+   * a probe to a monitor filters through here.
+   */
+  @CaptureSpan()
+  public async getProbesAttachableToProject(data: {
+    probeIds: Array<ObjectID>;
+    projectId: ObjectID;
+  }): Promise<Array<Model>> {
+    if (data.probeIds.length === 0) {
+      return [];
+    }
+
+    const [globalProbes, projectProbes]: [Array<Model>, Array<Model>] =
+      await Promise.all([
+        this.findBy({
+          query: {
+            _id: QueryHelper.any(data.probeIds),
+            isGlobalProbe: true,
+          },
+          select: {
+            _id: true,
+          },
+          skip: 0,
+          limit: LIMIT_PER_PROJECT,
+          props: {
+            isRoot: true,
+          },
+        }),
+        this.findBy({
+          query: {
+            _id: QueryHelper.any(data.probeIds),
+            isGlobalProbe: false,
+            projectId: data.projectId,
+          },
+          select: {
+            _id: true,
+          },
+          skip: 0,
+          limit: LIMIT_PER_PROJECT,
+          props: {
+            isRoot: true,
+          },
+        }),
+      ]);
+
+    return [...globalProbes, ...projectProbes];
+  }
+
+  @CaptureSpan()
+  public async isProbeAttachableToProject(data: {
+    probeId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<boolean> {
+    const probes: Array<Model> = await this.getProbesAttachableToProject({
+      probeIds: [data.probeId],
+      projectId: data.projectId,
+    });
+
+    return probes.length > 0;
+  }
+
   @CaptureSpan()
   public async getOwners(probeId: ObjectID): Promise<Array<User>> {
     if (!probeId) {

package/Server/Services/ProjectService.ts

@@ -16,6 +16,7 @@ import UpdateBy from "../Types/Database/UpdateBy";
 import logger, { LogAttributes } from "../Utils/Logger";
 import Errors from "../Utils/Errors";
 import ProductAnalytics from "../Utils/ProductAnalytics";
+import SessionReplayGateCacheStore from "../Utils/SessionReplay/SessionReplayGateCacheStore";
 import AccessTokenService from "./AccessTokenService";
 import BillingService from "./BillingService";
 import DatabaseService from "./DatabaseService";
@@ -52,6 +53,7 @@ import {
 } from "../../Types/BrandColors";
 import Color from "../../Types/Color";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
+import QueryDeepPartialEntity from "../../Types/Database/PartialEntity";
 import OneUptimeDate from "../../Types/Date";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
 import BadDataException from "../../Types/Exception/BadDataException";
@@ -359,6 +361,52 @@ export class ProjectService extends DatabaseService<Model> {
     return Promise.resolve({ createBy: data, carryForward: null });
   }
 
+  /*
+   * Session replay is gated on the project's org-wide allow flag, and the
+   * ingest gate caches the resolved policy per pod. Turning the flag off has
+   * to reach every pod now, not after the cache TTL plus the config
+   * endpoint's browser cache - roughly six minutes - so the Redis kill key
+   * is written here. Best effort: a Redis outage only means the ordinary
+   * cache expiry applies.
+   */
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    const updateData: Record<string, unknown> = onUpdate.updateBy
+      .data as unknown as Record<string, unknown>;
+
+    if (!("isSessionReplayAllowed" in updateData)) {
+      return onUpdate;
+    }
+
+    const isTurningOff: boolean = updateData["isSessionReplayAllowed"] !== true;
+
+    for (const projectId of updatedItemIds) {
+      try {
+        SessionReplayGateCacheStore.clearCache(projectId);
+
+        if (isTurningOff) {
+          await SessionReplayGateCacheStore.markProjectDisabled(projectId);
+        } else {
+          /*
+           * Re-enabling has to drop a kill key left over from an earlier
+           * disable, or the project stays refused for the rest of its TTL.
+           */
+          await SessionReplayGateCacheStore.clearProjectDisabled(projectId);
+        }
+      } catch (err) {
+        logger.warn(
+          `ProjectService: could not invalidate the session replay gate cache for project ${projectId.toString()}`,
+        );
+        logger.warn(err);
+      }
+    }
+
+    return onUpdate;
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
@@ -609,6 +657,99 @@ export class ProjectService extends DatabaseService<Model> {
     await this.sendSubscriptionChangeWebhookSlackNotification(project.id!);
   }
 
+  /*
+   * Pushes a project's trial end date out to a new date, in the payment
+   * provider first and then on the project row.
+   *
+   * The payment provider is the source of truth for what the customer is
+   * actually charged, so it is updated first: if Stripe rejects the change
+   * the project row keeps its old trial date rather than showing the customer
+   * a trial that is not really there.
+   */
+  @CaptureSpan()
+  public async extendTrial(params: {
+    projectId: ObjectID;
+    trialEndsAt: Date;
+    extendedByUserId?: ObjectID | undefined;
+  }): Promise<void> {
+    if (!IsBillingEnabled) {
+      throw new BadDataException("Billing is not enabled for this server");
+    }
+
+    const project: Model | null = await this.findOneById({
+      id: params.projectId,
+      select: {
+        _id: true,
+        trialEndsAt: true,
+        paymentProviderSubscriptionId: true,
+        paymentProviderMeteredSubscriptionId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!project) {
+      throw new BadDataException("Project not found");
+    }
+
+    if (!project.paymentProviderSubscriptionId) {
+      throw new BadDataException("Payment Provider subscription not found");
+    }
+
+    if (!project.paymentProviderMeteredSubscriptionId) {
+      throw new BadDataException(
+        "Payment Provider metered subscription not found",
+      );
+    }
+
+    await BillingService.extendTrial({
+      subscriptionId: project.paymentProviderSubscriptionId,
+      meteredSubscriptionId: project.paymentProviderMeteredSubscriptionId,
+      trialEndsAt: params.trialEndsAt,
+    });
+
+    /*
+     * Pushing trial_end out puts the subscriptions back into `trialing`. Read
+     * the statuses back rather than assuming them, so the project row - which
+     * drives the customer's trial banner and the paywall - matches Stripe.
+     */
+    const subscriptionStatus: SubscriptionStatus =
+      await BillingService.getSubscriptionStatus(
+        project.paymentProviderSubscriptionId,
+      );
+
+    const meteredSubscriptionStatus: SubscriptionStatus =
+      await BillingService.getSubscriptionStatus(
+        project.paymentProviderMeteredSubscriptionId,
+      );
+
+    await this.updateOneById({
+      id: project.id!,
+      data: {
+        trialEndsAt: params.trialEndsAt,
+        paymentProviderSubscriptionStatus: subscriptionStatus,
+        paymentProviderMeteredSubscriptionStatus: meteredSubscriptionStatus,
+      },
+      props: {
+        isRoot: true,
+        ignoreHooks: true,
+      },
+    });
+
+    /*
+     * The audit trail for handing out free service. There is no generic
+     * admin-action table, so the acting master admin goes in the log line.
+     */
+    logger.info(
+      `Trial for project ${project.id?.toString()} extended from ${
+        project.trialEndsAt?.toISOString() || "none"
+      } to ${params.trialEndsAt.toISOString()} by master admin ${
+        params.extendedByUserId?.toString() || "unknown"
+      }`,
+    );
+  }
+
   /*
    * The paid-conversion event for ad platforms: fires server-side (immune to
    * ad blockers) whenever a project's subscription plan changes, with enough
@@ -2040,6 +2181,7 @@ export class ProjectService extends DatabaseService<Model> {
         paymentProviderMeteredSubscriptionId: true,
         paymentProviderSubscriptionSeats: true,
         paymentProviderPlanId: true,
+        trialEndsAt: true,
       },
     });
 
@@ -2081,6 +2223,21 @@ export class ProjectService extends DatabaseService<Model> {
       throw new BadDataException("Subscription plan not found");
     }
 
+    /*
+     * Reactivating goes through changePlan, which cancels both subscriptions
+     * and creates new ones - so a trial the project still has to run has to be
+     * carried onto the replacements explicitly. Otherwise a customer whose
+     * trial a master admin extended as a goodwill gesture loses the extension
+     * the moment their subscription is reactivated, and is billed right away.
+     *
+     * A trial that has already lapsed is not revived: reactivation is not the
+     * place to hand out free service.
+     */
+    const endTrialAt: Date | undefined =
+      project.trialEndsAt && OneUptimeDate.isInTheFuture(project.trialEndsAt)
+        ? project.trialEndsAt
+        : undefined;
+
     const result: {
       subscriptionId: string;
       meteredSubscriptionId: string;
@@ -2093,7 +2250,7 @@ export class ProjectService extends DatabaseService<Model> {
       newPlan: subscriptionPlan,
       quantity: project.paymentProviderSubscriptionSeats,
       isYearly: SubscriptionPlan.isYearlyPlan(project.paymentProviderPlanId),
-      endTrialAt: undefined,
+      endTrialAt: endTrialAt,
     });
 
     // refresh subscription status.
@@ -2109,14 +2266,28 @@ export class ProjectService extends DatabaseService<Model> {
 
     // now update project with new subscription id.
 
+    const updateData: QueryDeepPartialEntity<Model> = {
+      paymentProviderSubscriptionId: result.subscriptionId,
+      paymentProviderMeteredSubscriptionId: result.meteredSubscriptionId,
+      paymentProviderSubscriptionStatus: subscriptionState,
+      paymentProviderMeteredSubscriptionStatus: meteredSubscriptionState,
+    };
+
+    /*
+     * The payment provider is the source of truth for the trial the new
+     * subscriptions were created with, so its date wins over the one sent.
+     * The column is left alone when there is no trial to record, rather than
+     * stamping a project whose trial lapsed long ago with a fresh date.
+     */
+    const newTrialEndsAt: Date | undefined = result.trialEndsAt || endTrialAt;
+
+    if (newTrialEndsAt) {
+      updateData.trialEndsAt = newTrialEndsAt;
+    }
+
     await this.updateOneById({
       id: project.id!,
-      data: {
-        paymentProviderSubscriptionId: result.subscriptionId,
-        paymentProviderMeteredSubscriptionId: result.meteredSubscriptionId,
-        paymentProviderSubscriptionStatus: subscriptionState,
-        paymentProviderMeteredSubscriptionStatus: meteredSubscriptionState,
-      },
+      data: updateData,
       props: {
         isRoot: true,
       },

package/Server/Services/RecommendationDismissalService.ts

@@ -0,0 +1,52 @@
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import BadDataException from "../../Types/Exception/BadDataException";
+import RecommendationType from "../../Types/Recommendation/RecommendationType";
+import Model from "../../Models/DatabaseModels/RecommendationDismissal";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * `recommendationType` is a string column rather than a Postgres enum (the
+   * codebase keeps enums in TypeScript so adding a member needs no migration),
+   * which means nothing below this point would reject a typo. A dismissal
+   * written under "monitor" instead of "Monitor" is silently invisible: the
+   * page filters on the enum value, finds nothing, and the card the user
+   * dismissed simply reappears with no error anywhere. Validating at the write
+   * boundary is the only place that failure is still cheap.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const recommendationType: string | undefined =
+      createBy.data.recommendationType;
+
+    if (!recommendationType) {
+      throw new BadDataException("Recommendation type is required.");
+    }
+
+    const validTypes: Array<string> = Object.values(RecommendationType);
+
+    if (!validTypes.includes(recommendationType)) {
+      throw new BadDataException(
+        `Invalid recommendation type: ${recommendationType}. Valid types are ${validTypes.join(
+          ", ",
+        )}.`,
+      );
+    }
+
+    if (!createBy.data.recommendationId) {
+      throw new BadDataException("Recommendation ID is required.");
+    }
+
+    return { createBy, carryForward: null };
+  }
+}
+
+export default new Service();

package/Server/Services/RumApplicationService.ts

@@ -7,9 +7,10 @@ import QueryHelper from "../Types/Database/QueryHelper";
 import OneUptimeDate from "../../Types/Date";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import GlobalCache from "../Infrastructure/GlobalCache";
+import SessionReplayGateCacheStore from "../Utils/SessionReplay/SessionReplayGateCacheStore";
 import logger, { LogAttributes } from "../Utils/Logger";
 import crypto from "crypto";
-import { OnCreate } from "../Types/Database/Hooks";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import RumApplicationLabelRuleEngineService from "./RumApplicationLabelRuleEngineService";
 import RumApplicationOwnerRuleEngineService from "./RumApplicationOwnerRuleEngineService";
 
@@ -19,6 +20,14 @@ const LAST_SEEN_THROTTLE_SECONDS: number = 60;
 const LABELS_APPLIED_CACHE_NAMESPACE: string = "rum-application-labels-applied";
 const LABELS_APPLIED_CACHE_TTL_SECONDS: number = 60;
 
+const REPLAY_CHUNK_RECEIVED_CACHE_NAMESPACE: string =
+  "rum-application-replay-chunk-received";
+const REPLAY_CHUNK_RECEIVED_THROTTLE_SECONDS: number = 60;
+
+const REPLAY_BUDGET_EXCEEDED_CACHE_NAMESPACE: string =
+  "rum-application-replay-budget-exceeded";
+const REPLAY_BUDGET_EXCEEDED_THROTTLE_SECONDS: number = 300;
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -54,6 +63,144 @@ export class Service extends DatabaseService<Model> {
     return createdItem;
   }
 
+  /*
+   * Session replay policy invalidation.
+   *
+   * The ingest gate caches the resolved policy for POLICY_CACHE_TTL_MS per
+   * pod, and the config endpoint is cached in the browser for 300s on top of
+   * that. Without these hooks, switching replay off for an application would
+   * keep being accepted for up to ~6 minutes across the fleet - so the kill
+   * key exists precisely to be written here.
+   *
+   * The kill key is per PROJECT, which is coarser than the per-application
+   * change that triggered it: disabling one application in a multi-app
+   * project briefly refuses the project's other applications too. That is
+   * accepted deliberately. The window is KILL_KEY_CACHE_TTL_MS plus the
+   * policy TTL, the failure mode is "a few recordings not taken", and the
+   * alternative - keying on projectId:appIdentifier - would leave the
+   * project-level `isSessionReplayAllowed` switch with no fast path at all.
+   */
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    await this.invalidateSessionReplayPolicy({
+      updateData: onUpdate.updateBy.data as Record<string, unknown>,
+      itemIds: updatedItemIds,
+      tenantId: onUpdate.updateBy.props.tenantId,
+    });
+
+    return onUpdate;
+  }
+
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<Model>,
+    itemIdsBeforeDelete: Array<ObjectID>,
+  ): Promise<OnDelete<Model>> {
+    /*
+     * A deleted application can never be re-enabled, so this always takes
+     * the "turn it off now" path rather than only clearing the cache.
+     */
+    await this.invalidateSessionReplayPolicy({
+      updateData: { isSessionReplayEnabled: false },
+      itemIds: itemIdsBeforeDelete,
+      tenantId: onDelete.deleteBy.props.tenantId,
+    });
+
+    return onDelete;
+  }
+
+  private async invalidateSessionReplayPolicy(data: {
+    updateData: Record<string, unknown>;
+    itemIds: Array<ObjectID>;
+    tenantId: ObjectID | undefined;
+  }): Promise<void> {
+    /*
+     * Only replay-relevant edits invalidate. A lastSeenAt heartbeat or a
+     * label change must not write a kill key, and updateLastSeen bypasses
+     * hooks entirely for the same reason.
+     */
+    const touchesReplayPolicy: boolean = Object.keys(data.updateData).some(
+      (key: string): boolean => {
+        return (
+          key.startsWith("sessionReplay") || key === "isSessionReplayEnabled"
+        );
+      },
+    );
+
+    if (!touchesReplayPolicy) {
+      return;
+    }
+
+    const projectIds: Array<ObjectID> = await this.resolveProjectIds(data);
+
+    const isTurningOff: boolean =
+      data.updateData["isSessionReplayEnabled"] === false;
+
+    for (const projectId of projectIds) {
+      try {
+        SessionReplayGateCacheStore.clearCache(projectId);
+
+        if (isTurningOff) {
+          await SessionReplayGateCacheStore.markProjectDisabled(projectId);
+        } else {
+          /*
+           * Any other replay edit (including turning it back ON) must also
+           * drop a kill key left over from an earlier disable, or the
+           * project stays refused for the remainder of the key's TTL.
+           */
+          await SessionReplayGateCacheStore.clearProjectDisabled(projectId);
+        }
+      } catch (err) {
+        /*
+         * Best effort. The ordinary cache expiry still applies, so a Redis
+         * outage degrades the response time of a settings change rather
+         * than failing the settings change itself.
+         */
+        logger.warn(
+          `RumApplicationService: could not invalidate the session replay gate cache for project ${projectId.toString()}`,
+        );
+        logger.warn(err);
+      }
+    }
+  }
+
+  private async resolveProjectIds(data: {
+    itemIds: Array<ObjectID>;
+    tenantId: ObjectID | undefined;
+  }): Promise<Array<ObjectID>> {
+    if (data.tenantId) {
+      return [data.tenantId];
+    }
+
+    /*
+     * A root-props update carries no tenantId, so the project has to be read
+     * back off the rows that were touched.
+     */
+    const projectIds: Map<string, ObjectID> = new Map();
+
+    for (const id of data.itemIds) {
+      const app: Model | null = await this.findOneById({
+        id: id,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+      if (app?.projectId) {
+        projectIds.set(app.projectId.toString(), app.projectId);
+      }
+    }
+
+    return Array.from(projectIds.values());
+  }
+
   @CaptureSpan()
   public async findOrCreateByAppIdentifier(data: {
     projectId: ObjectID;
@@ -196,6 +343,98 @@ export class Service extends DatabaseService<Model> {
     });
   }
 
+  /*
+   * Session replay ingest health markers.
+   *
+   * Both write columns whose names start with "sessionReplay", which the
+   * onUpdateSuccess hook treats as a policy edit (cache clear + kill-key
+   * churn) - so they MUST go through the hook-free single-statement path,
+   * exactly like updateLastSeen. They also skip the updatedAt refresh:
+   * configEpoch is derived from updatedAt, and a passive health timestamp
+   * broadcasting "configuration changed" to every live recorder once a
+   * minute would be self-inflicted config-fetch load.
+   *
+   * Throttled through GlobalCache so 20k chunks/min becomes at most one
+   * Postgres write per application per window across the whole fleet.
+   * Failures are swallowed after a warn: this bookkeeping must never make
+   * an ingest request fail.
+   */
+  @CaptureSpan()
+  public async markSessionReplayChunkReceived(
+    rumApplicationId: ObjectID,
+  ): Promise<void> {
+    await this.writeReplayHealthColumn({
+      rumApplicationId: rumApplicationId,
+      cacheNamespace: REPLAY_CHUNK_RECEIVED_CACHE_NAMESPACE,
+      throttleSeconds: REPLAY_CHUNK_RECEIVED_THROTTLE_SECONDS,
+      column: "sessionReplayLastChunkReceivedAt",
+    });
+  }
+
+  @CaptureSpan()
+  public async markSessionReplayBudgetExceeded(
+    rumApplicationId: ObjectID,
+  ): Promise<void> {
+    await this.writeReplayHealthColumn({
+      rumApplicationId: rumApplicationId,
+      cacheNamespace: REPLAY_BUDGET_EXCEEDED_CACHE_NAMESPACE,
+      throttleSeconds: REPLAY_BUDGET_EXCEEDED_THROTTLE_SECONDS,
+      column: "sessionReplayBudgetExceededAt",
+    });
+  }
+
+  private async writeReplayHealthColumn(data: {
+    rumApplicationId: ObjectID;
+    cacheNamespace: string;
+    throttleSeconds: number;
+    column:
+      | "sessionReplayLastChunkReceivedAt"
+      | "sessionReplayBudgetExceededAt";
+  }): Promise<void> {
+    const cacheKey: string = data.rumApplicationId.toString();
+
+    try {
+      const cached: string | null = await GlobalCache.getString(
+        data.cacheNamespace,
+        cacheKey,
+      );
+
+      if (cached) {
+        return; // written recently, across all pods
+      }
+    } catch {
+      /*
+       * Cache unavailable - fail open and write anyway, same stance as
+       * updateLastSeen: a stale health column is worse than an occasional
+       * extra single-row UPDATE.
+       */
+    }
+
+    try {
+      await GlobalCache.setString(data.cacheNamespace, cacheKey, "1", {
+        expiresInSeconds: data.throttleSeconds,
+      });
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
+
+    try {
+      await this.updateColumnsByIdWithoutHooks({
+        id: data.rumApplicationId,
+        data: {
+          [data.column]: OneUptimeDate.getCurrentDate(),
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as any,
+        skipUpdateDateColumn: true,
+      });
+    } catch (err) {
+      logger.warn(
+        `RumApplicationService: could not write ${data.column} for application ${cacheKey}`,
+      );
+      logger.warn(err);
+    }
+  }
+
   @CaptureSpan()
   public async attachLabels(data: {
     rumApplicationId: ObjectID;

package/Server/Services/RumSessionChunkService.ts

@@ -0,0 +1,11 @@
+import ClickhouseDatabase from "../Infrastructure/ClickhouseDatabase";
+import AnalyticsDatabaseService from "./AnalyticsDatabaseService";
+import RumSessionChunk from "../../Models/AnalyticsModels/RumSessionChunk";
+
+export class RumSessionChunkService extends AnalyticsDatabaseService<RumSessionChunk> {
+  public constructor(clickhouseDatabase?: ClickhouseDatabase | undefined) {
+    super({ modelType: RumSessionChunk, database: clickhouseDatabase });
+  }
+}
+
+export default new RumSessionChunkService();