@oneuptime/common 12.0.12 → 12.0.13

package/Server/Services/WorkspaceNotificationRuleService.ts

@@ -252,228 +252,44 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
           throw new BadDataException((err as Error)?.message);
         }
       }
+    }
 
-      // post message
-
-      for (const createdChannel of createdChannels) {
-        try {
-          const responses: Array<WorkspaceSendMessageResponse> =
-            await WorkspaceUtil.postMessageToAllWorkspaceChannelsAsBot({
-              projectId: data.projectId,
-              messagePayloadsByWorkspace: messageBlocksByWorkspaceTypes.map(
-                (
-                  messageBlocksByWorkspaceType: MessageBlocksByWorkspaceType,
-                ) => {
-                  const payload: WorkspaceMessagePayload = {
-                    _type: "WorkspaceMessagePayload",
-                    workspaceType: messageBlocksByWorkspaceType.workspaceType,
-                    messageBlocks: messageBlocksByWorkspaceType.messageBlocks,
-                    channelNames: [],
-                    channelIds: [createdChannel.id],
-                    teamId: notificationRule.existingTeam,
-                  };
-
-                  return payload;
-                },
-              ),
-            });
-
-          // Log results for test sends (created channels)
-          const getMessageSummary: (wt: WorkspaceType) => string = (
-            wt: WorkspaceType,
-          ): string => {
-            const blocks: Array<WorkspaceMessageBlock> | undefined =
-              messageBlocksByWorkspaceTypes.find(
-                (b: MessageBlocksByWorkspaceType) => {
-                  return b.workspaceType === wt;
-                },
-              )?.messageBlocks;
-            if (!blocks) {
-              return "";
-            }
-            const texts: Array<string> = [];
-            for (const block of blocks) {
-              if (
-                (block as WorkspacePayloadMarkdown)._type ===
-                "WorkspacePayloadMarkdown"
-              ) {
-                texts.push((block as WorkspacePayloadMarkdown).text);
-              }
-            }
-            const joined: string = texts.join(" \n").trim();
-            return joined;
-          };
-
-          for (const res of responses) {
-            const messageSummary: string = getMessageSummary(res.workspaceType);
-
-            // Check for errors in the response
-            if (res.errors && res.errors.length > 0) {
-              /*
-               * Record the failure before throwing. Test sends used to throw
-               * straight out of here, so a failed test left no trace in
-               * Notification Logs and support had no way to see what Microsoft
-               * or Slack actually said.
-               */
-              await this.logTestSendFailures({
-                projectId: data.projectId,
-                workspaceType: res.workspaceType,
-                errors: res.errors,
-                message: messageSummary,
-                userId: data.testByUserId,
-              });
-
-              const errorMessages: Array<string> = res.errors.map(
-                (error: { channel: WorkspaceChannel; error: string }) => {
-                  return `Channel ${error.channel.name}: ${error.error}`;
-                },
-              );
-              throw new BadDataException(
-                `Failed to send test message to some channels: ${errorMessages.join(
-                  "; ",
-                )}`,
-              );
-            }
-
-            for (const thread of res.threads) {
-              const log: WorkspaceNotificationLog =
-                new WorkspaceNotificationLog();
-              log.projectId = data.projectId;
-              log.workspaceType = res.workspaceType;
-              log.channelId = thread.channel.id;
-              log.channelName = thread.channel.name;
-              log.threadId = thread.threadId;
-              log.message = messageSummary;
-              log.status = WorkspaceNotificationStatus.Success;
-              log.statusMessage = "Test message posted to workspace channel";
-              log.userId = data.testByUserId;
-              log.actionType = WorkspaceNotificationActionType.SendMessage;
-
-              await WorkspaceNotificationLogService.create({
-                data: log,
-                props: { isRoot: true },
-              });
-            }
-          }
-        } catch (err) {
-          throw new BadDataException(
-            "Cannot post message to channel. " + (err as Error)?.message,
-          );
-        }
-      }
-
-      for (const channel of existingChannels) {
-        try {
-          const responses: Array<WorkspaceSendMessageResponse> =
-            await WorkspaceUtil.postMessageToAllWorkspaceChannelsAsBot({
-              projectId: data.projectId,
-              messagePayloadsByWorkspace: messageBlocksByWorkspaceTypes.map(
-                (
-                  messageBlocksByWorkspaceType: MessageBlocksByWorkspaceType,
-                ) => {
-                  const payload: WorkspaceMessagePayload = {
-                    _type: "WorkspaceMessagePayload",
-                    workspaceType: messageBlocksByWorkspaceType.workspaceType,
-                    messageBlocks: messageBlocksByWorkspaceType.messageBlocks,
-                    channelNames: [channel.name],
-                    channelIds: [],
-                  };
-
-                  if (
-                    messageBlocksByWorkspaceType.workspaceType ===
-                    WorkspaceType.MicrosoftTeams
-                  ) {
-                    payload.teamId = channel.teamId;
-                  }
-
-                  return payload;
-                },
-              ),
-            });
-
-          // Log results for test sends (existing channels)
-          const getMessageSummary: (wt: WorkspaceType) => string = (
-            wt: WorkspaceType,
-          ): string => {
-            const blocks: Array<WorkspaceMessageBlock> | undefined =
-              messageBlocksByWorkspaceTypes.find(
-                (b: MessageBlocksByWorkspaceType) => {
-                  return b.workspaceType === wt;
-                },
-              )?.messageBlocks;
-            if (!blocks) {
-              return "";
-            }
-            const texts: Array<string> = [];
-            for (const block of blocks) {
-              if (
-                (block as WorkspacePayloadMarkdown)._type ===
-                "WorkspacePayloadMarkdown"
-              ) {
-                texts.push((block as WorkspacePayloadMarkdown).text);
-              }
-            }
-            const joined: string = texts.join(" \n").trim();
-            return joined;
-          };
-
-          for (const res of responses) {
-            const messageSummary: string = getMessageSummary(res.workspaceType);
-
-            // Check for errors in the response
-            if (res.errors && res.errors.length > 0) {
-              /*
-               * Record the failure before throwing. Test sends used to throw
-               * straight out of here, so a failed test left no trace in
-               * Notification Logs and support had no way to see what Microsoft
-               * or Slack actually said.
-               */
-              await this.logTestSendFailures({
-                projectId: data.projectId,
-                workspaceType: res.workspaceType,
-                errors: res.errors,
-                message: messageSummary,
-                userId: data.testByUserId,
-              });
-
-              const errorMessages: Array<string> = res.errors.map(
-                (error: { channel: WorkspaceChannel; error: string }) => {
-                  return `Channel ${error.channel.name}: ${error.error}`;
-                },
-              );
-              throw new BadDataException(
-                `Failed to send test message to some channels: ${errorMessages.join(
-                  "; ",
-                )}`,
-              );
-            }
+    /*
+     * Post to the channels this test just created.
+     *
+     * This loop used to sit inside the shouldPostToExistingChannel block, so a
+     * rule that only creates a channel created it, invited nobody (a no-op on
+     * Teams) and reported success without ever attempting a send. The one
+     * action an admin runs to prove the bot can post proved nothing, and a
+     * passing test was read as evidence that the workspace app was wired up
+     * correctly when it had never been exercised.
+     */
+    for (const createdChannel of createdChannels) {
+      await this.postTestMessageToChannels({
+        projectId: data.projectId,
+        messageBlocksByWorkspaceTypes: messageBlocksByWorkspaceTypes,
+        testByUserId: data.testByUserId,
+        channelNames: [],
+        channelIds: [createdChannel.id],
+        /*
+         * The team the channel was actually created in. This used to pass
+         * existingTeam, which is a different field on a different rule — for a
+         * create-only rule it is undefined, and when both are set they can name
+         * two different teams.
+         */
+        teamId: createdChannel.teamId,
+      });
+    }
 
-            for (const thread of res.threads) {
-              const log: WorkspaceNotificationLog =
-                new WorkspaceNotificationLog();
-              log.projectId = data.projectId;
-              log.workspaceType = res.workspaceType;
-              log.channelId = thread.channel.id;
-              log.channelName = thread.channel.name;
-              log.threadId = thread.threadId;
-              log.message = messageSummary;
-              log.status = WorkspaceNotificationStatus.Success;
-              log.statusMessage = "Test message posted to workspace channel";
-              log.userId = data.testByUserId;
-              log.actionType = WorkspaceNotificationActionType.SendMessage;
-
-              await WorkspaceNotificationLogService.create({
-                data: log,
-                props: { isRoot: true },
-              });
-            }
-          }
-        } catch (err) {
-          throw new BadDataException(
-            "Cannot post message to channel. " + (err as Error)?.message,
-          );
-        }
-      }
+    for (const channel of existingChannels) {
+      await this.postTestMessageToChannels({
+        projectId: data.projectId,
+        messageBlocksByWorkspaceTypes: messageBlocksByWorkspaceTypes,
+        testByUserId: data.testByUserId,
+        channelNames: [channel.name],
+        channelIds: [],
+        teamId: channel.teamId,
+      });
     }
 
     // Post test message to Microsoft Teams chats.
@@ -568,6 +384,142 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
     }
   }
 
+  /*
+   * The markdown of a test message, for the Notification Log entry.
+   */
+  private getTestMessageSummary(data: {
+    messageBlocksByWorkspaceTypes: Array<MessageBlocksByWorkspaceType>;
+    workspaceType: WorkspaceType;
+  }): string {
+    const blocks: Array<WorkspaceMessageBlock> | undefined =
+      data.messageBlocksByWorkspaceTypes.find(
+        (b: MessageBlocksByWorkspaceType) => {
+          return b.workspaceType === data.workspaceType;
+        },
+      )?.messageBlocks;
+
+    if (!blocks) {
+      return "";
+    }
+
+    const texts: Array<string> = [];
+
+    for (const block of blocks) {
+      if (
+        (block as WorkspacePayloadMarkdown)._type === "WorkspacePayloadMarkdown"
+      ) {
+        texts.push((block as WorkspacePayloadMarkdown).text);
+      }
+    }
+
+    return texts.join(" \n").trim();
+  }
+
+  /*
+   * Post one test message to one set of destinations, then record the outcome in
+   * Notification Logs.
+   *
+   * Created channels and existing channels ran two byte-identical copies of
+   * this, which is how the created-channel copy ended up nested in the wrong
+   * conditional without anyone noticing. One path now serves both.
+   */
+  @CaptureSpan()
+  private async postTestMessageToChannels(data: {
+    projectId: ObjectID;
+    messageBlocksByWorkspaceTypes: Array<MessageBlocksByWorkspaceType>;
+    testByUserId: ObjectID;
+    channelNames: Array<string>;
+    channelIds: Array<string>;
+    teamId?: string | undefined;
+  }): Promise<void> {
+    try {
+      const responses: Array<WorkspaceSendMessageResponse> =
+        await WorkspaceUtil.postMessageToAllWorkspaceChannelsAsBot({
+          projectId: data.projectId,
+          messagePayloadsByWorkspace: data.messageBlocksByWorkspaceTypes.map(
+            (messageBlocksByWorkspaceType: MessageBlocksByWorkspaceType) => {
+              const payload: WorkspaceMessagePayload = {
+                _type: "WorkspaceMessagePayload",
+                workspaceType: messageBlocksByWorkspaceType.workspaceType,
+                messageBlocks: messageBlocksByWorkspaceType.messageBlocks,
+                channelNames: data.channelNames,
+                channelIds: data.channelIds,
+              };
+
+              // teamId is a Microsoft Teams concept; Slack has no equivalent.
+              if (
+                messageBlocksByWorkspaceType.workspaceType ===
+                WorkspaceType.MicrosoftTeams
+              ) {
+                payload.teamId = data.teamId;
+              }
+
+              return payload;
+            },
+          ),
+        });
+
+      for (const res of responses) {
+        const messageSummary: string = this.getTestMessageSummary({
+          messageBlocksByWorkspaceTypes: data.messageBlocksByWorkspaceTypes,
+          workspaceType: res.workspaceType,
+        });
+
+        // Check for errors in the response
+        if (res.errors && res.errors.length > 0) {
+          /*
+           * Record the failure before throwing. Test sends used to throw
+           * straight out of here, so a failed test left no trace in
+           * Notification Logs and support had no way to see what Microsoft
+           * or Slack actually said.
+           */
+          await this.logTestSendFailures({
+            projectId: data.projectId,
+            workspaceType: res.workspaceType,
+            errors: res.errors,
+            message: messageSummary,
+            userId: data.testByUserId,
+          });
+
+          const errorMessages: Array<string> = res.errors.map(
+            (error: { channel: WorkspaceChannel; error: string }) => {
+              return `Channel ${error.channel.name}: ${error.error}`;
+            },
+          );
+
+          throw new BadDataException(
+            `Failed to send test message to some channels: ${errorMessages.join(
+              "; ",
+            )}`,
+          );
+        }
+
+        for (const thread of res.threads) {
+          const log: WorkspaceNotificationLog = new WorkspaceNotificationLog();
+          log.projectId = data.projectId;
+          log.workspaceType = res.workspaceType;
+          log.channelId = thread.channel.id;
+          log.channelName = thread.channel.name;
+          log.threadId = thread.threadId;
+          log.message = messageSummary;
+          log.status = WorkspaceNotificationStatus.Success;
+          log.statusMessage = "Test message posted to workspace channel";
+          log.userId = data.testByUserId;
+          log.actionType = WorkspaceNotificationActionType.SendMessage;
+
+          await WorkspaceNotificationLogService.create({
+            data: log,
+            props: { isRoot: true },
+          });
+        }
+      }
+    } catch (err) {
+      throw new BadDataException(
+        "Cannot post message to channel. " + (err as Error)?.message,
+      );
+    }
+  }
+
   /*
    * Persist per-destination failures from a test send so they show up in
    * Settings > Notification Logs alongside real notification failures. Real

package/Server/Types/AnalyticsDatabase/ModelPermission.ts

@@ -366,6 +366,15 @@ export default class ModelPermission {
        * never widens access (authorization stays on primaryEntityId).
        */
       "entityScope",
+      /*
+       * Synthetic query key compiled by StatementGenerator to an AND of
+       * per-resource-facet OR groups (primaryEntityId / entityKeys /
+       * resource attribute). Like entityScope it is not a real column and
+       * only ever narrows rows — authorization still runs on
+       * primaryEntityId. Written by the telemetry services' onBeforeFind
+       * from the client-sent `resourceFilters` ids.
+       */
+      "resourceEntityScopes",
     ];
 
     return returnArr;

package/Server/Types/Database/Permissions/AccessControlPermission.ts

@@ -23,6 +23,17 @@ import { combineWithPrivacyClause } from "../../../Utils/PrivacyFilterUtil";
 import QueryHelper from "../QueryHelper";
 import QueryUtil from "../QueryUtil";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+import Dictionary from "../../../../Types/Dictionary";
+
+/*
+ * Built once per invocation and threaded through the per-column loop; never
+ * cached on props or module scope (the multi-tenant path re-enters with
+ * different per-tenant props and must rebuild fresh).
+ */
+type AccessControlPermissionContext = {
+  nonAccessControlPermissions: Array<Permission>;
+  accessControlPermissions: Array<UserPermission>;
+};
 
 export default class AccessControlPermission {
   @CaptureSpan()
@@ -290,7 +301,10 @@ export default class AccessControlPermission {
     modelType: DatabaseBaseModelType,
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
+    context?: AccessControlPermissionContext,
   ): Array<ObjectID> {
+    context = context ?? this.buildPermissionContext(props);
+
     let labelIds: Array<ObjectID> = [];
 
     // check model level permissions.
@@ -299,7 +313,7 @@ export default class AccessControlPermission {
       TablePermission.getTablePermission(modelType, type);
 
     const modelLevelLabelIds: Array<ObjectID> =
-      this.getAccessControlIdsByPermissions(modelLevelPermissions, props);
+      this.getAccessControlIdsByPermissions(modelLevelPermissions, context);
 
     labelIds = [...labelIds, ...modelLevelLabelIds];
 
@@ -331,11 +345,23 @@ export default class AccessControlPermission {
       ];
     }
 
-    labelIds = this.getAccessControlIdsForModel(modelType, props, type);
+    // Build the permission context once — not per column.
+    const context: AccessControlPermissionContext =
+      this.buildPermissionContext(props);
+
+    labelIds = this.getAccessControlIdsForModel(
+      modelType,
+      props,
+      type,
+      context,
+    );
+
+    const columnAccessControlDictionary: Dictionary<ColumnAccessControl> =
+      model.getColumnAccessControlForAllColumns();
 
     for (const column of columnsToCheckPermissionFor) {
       const accessControl: ColumnAccessControl | null =
-        model.getColumnAccessControlFor(column);
+        columnAccessControlDictionary[column] || null;
 
       if (!accessControl) {
         continue;
@@ -343,21 +369,21 @@ export default class AccessControlPermission {
 
       if (type === DatabaseRequestType.Read && accessControl.read) {
         const columnReadLabelIds: Array<ObjectID> =
-          this.getAccessControlIdsByPermissions(accessControl.read, props);
+          this.getAccessControlIdsByPermissions(accessControl.read, context);
 
         labelIds = [...labelIds, ...columnReadLabelIds];
       }
 
       if (type === DatabaseRequestType.Create && accessControl.create) {
         const columnCreateLabelIds: Array<ObjectID> =
-          this.getAccessControlIdsByPermissions(accessControl.create, props);
+          this.getAccessControlIdsByPermissions(accessControl.create, context);
 
         labelIds = [...labelIds, ...columnCreateLabelIds];
       }
 
       if (type === DatabaseRequestType.Update && accessControl.update) {
         const columnUpdateLabelIds: Array<ObjectID> =
-          this.getAccessControlIdsByPermissions(accessControl.update, props);
+          this.getAccessControlIdsByPermissions(accessControl.update, context);
 
         labelIds = [...labelIds, ...columnUpdateLabelIds];
       }
@@ -369,35 +395,40 @@ export default class AccessControlPermission {
     return distinctLabelIds;
   }
 
-  private static getAccessControlIdsByPermissions(
-    permissions: Array<Permission>,
+  private static buildPermissionContext(
     props: DatabaseCommonInteractionProps,
-  ): Array<ObjectID> {
+  ): AccessControlPermissionContext {
     const userPermissions: Array<UserPermission> =
       DatabaseCommonInteractionPropsUtil.getUserPermissions(
         props,
         PermissionType.Allow,
       );
 
-    const nonAccessControlPermissionPermission: Array<Permission> =
-      PermissionHelper.getNonAccessControlPermissions(userPermissions);
-
-    const accessControlPermissions: Array<UserPermission> =
-      PermissionHelper.getAccessControlPermissions(userPermissions);
+    return {
+      nonAccessControlPermissions:
+        PermissionHelper.getNonAccessControlPermissions(userPermissions),
+      accessControlPermissions:
+        PermissionHelper.getAccessControlPermissions(userPermissions),
+    };
+  }
 
+  private static getAccessControlIdsByPermissions(
+    permissions: Array<Permission>,
+    context: AccessControlPermissionContext,
+  ): Array<ObjectID> {
     let labelIds: Array<ObjectID> = [];
 
     if (
       PermissionHelper.doesPermissionsIntersect(
         permissions,
-        nonAccessControlPermissionPermission,
+        context.nonAccessControlPermissions,
       )
     ) {
       return []; // if this is intersecting, then return empty array. We dont need to check for access control.
     }
 
     for (const permission of permissions) {
-      for (const accessControlPermission of accessControlPermissions) {
+      for (const accessControlPermission of context.accessControlPermissions) {
         if (
           accessControlPermission.permission === permission &&
           accessControlPermission.labelIds.length > 0

package/Server/Utils/APIKey/AccessPermission.ts

@@ -1,13 +1,12 @@
-import APIKeyPermission from "../../../Models/DatabaseModels/ApiKeyPermission";
-import Label from "../../../Models/DatabaseModels/Label";
-import LIMIT_MAX from "../../../Types/Database/LimitMax";
 import ObjectID from "../../../Types/ObjectID";
 import Permission, {
   UserGlobalAccessPermission,
   UserPermission,
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
-import ApiKeyPermissionService from "../../Services/ApiKeyPermissionService";
+import ApiKeyPermissionService, {
+  ApiKeyPermissionRow,
+} from "../../Services/ApiKeyPermissionService";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import UserPermissionUtil from "../UserPermission/UserPermission";
 
@@ -68,43 +67,20 @@ export default class APIKeyAccessPermission {
     projectId: ObjectID,
     apiKeyId: ObjectID,
   ): Promise<UserTenantAccessPermission> {
-    // get team permissions.
-    const apiKeyPermission: Array<APIKeyPermission> =
-      await ApiKeyPermissionService.findBy({
-        query: {
-          apiKeyId: apiKeyId,
-        },
-        select: {
-          permission: true,
-          labels: {
-            _id: true,
-          },
-          isBlockPermission: true,
-        },
+    // get team permissions (cached — see ApiKeyPermissionService).
+    const apiKeyPermissionRows: Array<ApiKeyPermissionRow> =
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
 
-        limit: LIMIT_MAX,
-        skip: 0,
-        props: {
-          isRoot: true,
-        },
-      });
-
-    const userPermissions: Array<UserPermission> = [];
-
-    for (const apiPermission of apiKeyPermission) {
-      if (!apiPermission.labels) {
-        apiPermission.labels = [];
-      }
-
-      userPermissions.push({
-        permission: apiPermission.permission!,
-        labelIds: apiPermission.labels.map((label: Label) => {
-          return label.id!;
-        }),
-        isBlockPermission: apiPermission.isBlockPermission,
-        _type: "UserPermission",
-      });
-    }
+    const userPermissions: Array<UserPermission> = apiKeyPermissionRows.map(
+      (row: ApiKeyPermissionRow): UserPermission => {
+        return {
+          permission: row.permission,
+          labelIds: row.labelIds,
+          isBlockPermission: row.isBlockPermission,
+          _type: "UserPermission",
+        };
+      },
+    );
 
     const permission: UserTenantAccessPermission =
       UserPermissionUtil.getDefaultUserTenantAccessPermission(projectId);