@oneuptime/common 12.0.17 → 12.0.19

package/Server/Services/UserNotificationMethodAdminService.ts

@@ -17,6 +17,8 @@ import UserPushService from "./UserPushService";
 import UserService from "./UserService";
 import UserSmsService from "./UserSmsService";
 import UserTelegramService from "./UserTelegramService";
+import UserSlackService from "./UserSlackService";
+import UserMicrosoftTeamsService from "./UserMicrosoftTeamsService";
 import UserWebhookService from "./UserWebhookService";
 import UserWhatsAppService from "./UserWhatsAppService";
 import type AuditLogServiceType from "./AuditLogService";
@@ -42,6 +44,8 @@ import UserEmail from "../../Models/DatabaseModels/UserEmail";
 import UserPush from "../../Models/DatabaseModels/UserPush";
 import UserSMS from "../../Models/DatabaseModels/UserSMS";
 import UserTelegram from "../../Models/DatabaseModels/UserTelegram";
+import UserSlack from "../../Models/DatabaseModels/UserSlack";
+import UserMicrosoftTeams from "../../Models/DatabaseModels/UserMicrosoftTeams";
 import UserWebhook from "../../Models/DatabaseModels/UserWebhook";
 import UserWhatsApp from "../../Models/DatabaseModels/UserWhatsApp";
 
@@ -66,7 +70,8 @@ import UserWhatsApp from "../../Models/DatabaseModels/UserWhatsApp";
  * filters, sort columns appended after the guard had run. The models are still
  * CurrentUser-only. Nothing in this file changes that, and an administrator's
  * every direct read or write of UserEmail, UserSMS, UserCall, UserWhatsApp,
- * UserTelegram, UserPush and UserWebhook is still refused.
+ * UserTelegram, UserSlack, UserMicrosoftTeams, UserPush and UserWebhook is
+ * still refused.
  *
  * What this file does instead is a NARROW, SERVER-SIDE, AUDITED capability
  * that runs as root on the admin's behalf and never hands them the row:
@@ -88,7 +93,7 @@ import UserWhatsApp from "../../Models/DatabaseModels/UserWhatsApp";
  *     notification methods page as an unverified method they did not add — on
  *     top of the mail this service sends them.
  *
- *   - REMOVE is allowed on all seven channels, because offboarding a stale
+ *   - REMOVE is allowed on all nine channels, because offboarding a stale
  *     device is a real administrative job and the owner may well be gone. It is
  *     the destructive direction, so it is the one with a preview attached:
  *     UserNotificationRuleService.getNotificationMethodDeletionImpact says how
@@ -100,7 +105,10 @@ import UserWhatsApp from "../../Models/DatabaseModels/UserWhatsApp";
  *     omissions are not oversights. Push is a device token minted by a browser
  *     or a phone at registration time; there is nothing an admin could type.
  *     Telegram needs the account holder to message the bot before a chat id
- *     exists. Webhook is the one that is deliberately refused rather than
+ *     exists. Slack and Microsoft Teams are pointers at the owner's own OAuth
+ *     workspace link, which only the owner can establish — and an admin-created
+ *     row would be live immediately, since creation is verification for those
+ *     two. Webhook is the one that is deliberately refused rather than
  *     merely impractical: UserWebhook has no isVerified column at all, so an
  *     admin-created webhook would be live the moment it was written, which is
  *     exactly the silent-redirect this whole design is built to prevent.
@@ -139,7 +147,7 @@ export interface AdminNotificationMethodView {
 
 /**
  * The four channels an administrator may CREATE. See the header for why the
- * other three are absent; this enum is the single place that decides, and both
+ * other five are absent; this enum is the single place that decides, and both
  * the API's validation and the service's own dispatch read it.
  */
 export enum AdminAddableChannel {
@@ -751,6 +759,160 @@ export class UserNotificationMethodAdminService extends BaseService {
           });
         },
       },
+      {
+        methodType: ReadinessMethodType.Slack,
+        isAdminAddable: false,
+        modelType: UserSlack,
+        list: async (data: {
+          projectId: ObjectID;
+          userId: ObjectID;
+        }): Promise<Array<AdminNotificationMethodView>> => {
+          const rows: Array<UserSlack> = await UserSlackService.findBy({
+            query: { projectId: data.projectId, userId: data.userId },
+            /*
+             * The username only — never slackUserId, which is the addressable
+             * target the bot sends to. Same rule OnCallReadinessService
+             * follows.
+             */
+            select: {
+              _id: true,
+              slackUserName: true,
+              isVerified: true,
+              createdAt: true,
+            },
+            sort: { createdAt: SortOrder.Ascending },
+            skip: 0,
+            limit: LIMIT_PER_PROJECT,
+            props: { isRoot: true },
+          });
+
+          return rows.map((row: UserSlack): AdminNotificationMethodView => {
+            return this.toView({
+              row: row,
+              methodType: ReadinessMethodType.Slack,
+              isAdminAddable: false,
+              identifier: row.slackUserName,
+              kind: MaskedIdentifierKind.Handle,
+              isVerified: row.isVerified,
+            });
+          });
+        },
+        findOwnedRow: async (data: {
+          methodId: ObjectID;
+          projectId: ObjectID;
+          userId: ObjectID;
+        }): Promise<AdminNotificationMethodView | null> => {
+          const row: UserSlack | null = await UserSlackService.findOneBy({
+            query: {
+              _id: data.methodId,
+              projectId: data.projectId,
+              userId: data.userId,
+            },
+            select: {
+              _id: true,
+              slackUserName: true,
+              isVerified: true,
+            },
+            props: { isRoot: true },
+          });
+
+          return row
+            ? this.toView({
+                row: row,
+                methodType: ReadinessMethodType.Slack,
+                isAdminAddable: false,
+                identifier: row.slackUserName,
+                kind: MaskedIdentifierKind.Handle,
+                isVerified: row.isVerified,
+              })
+            : null;
+        },
+        deleteRow: async (data: { methodId: ObjectID }): Promise<void> => {
+          await UserSlackService.deleteOneById({
+            id: data.methodId,
+            props: { isRoot: true },
+          });
+        },
+      },
+      {
+        methodType: ReadinessMethodType.MicrosoftTeams,
+        isAdminAddable: false,
+        modelType: UserMicrosoftTeams,
+        list: async (data: {
+          projectId: ObjectID;
+          userId: ObjectID;
+        }): Promise<Array<AdminNotificationMethodView>> => {
+          const rows: Array<UserMicrosoftTeams> =
+            await UserMicrosoftTeamsService.findBy({
+              query: { projectId: data.projectId, userId: data.userId },
+              /*
+               * The display name only — never microsoftTeamsUserId, which is
+               * the addressable target the bot sends to. Same rule
+               * OnCallReadinessService follows.
+               */
+              select: {
+                _id: true,
+                microsoftTeamsUserName: true,
+                isVerified: true,
+                createdAt: true,
+              },
+              sort: { createdAt: SortOrder.Ascending },
+              skip: 0,
+              limit: LIMIT_PER_PROJECT,
+              props: { isRoot: true },
+            });
+
+          return rows.map(
+            (row: UserMicrosoftTeams): AdminNotificationMethodView => {
+              return this.toView({
+                row: row,
+                methodType: ReadinessMethodType.MicrosoftTeams,
+                isAdminAddable: false,
+                identifier: row.microsoftTeamsUserName,
+                kind: MaskedIdentifierKind.Handle,
+                isVerified: row.isVerified,
+              });
+            },
+          );
+        },
+        findOwnedRow: async (data: {
+          methodId: ObjectID;
+          projectId: ObjectID;
+          userId: ObjectID;
+        }): Promise<AdminNotificationMethodView | null> => {
+          const row: UserMicrosoftTeams | null =
+            await UserMicrosoftTeamsService.findOneBy({
+              query: {
+                _id: data.methodId,
+                projectId: data.projectId,
+                userId: data.userId,
+              },
+              select: {
+                _id: true,
+                microsoftTeamsUserName: true,
+                isVerified: true,
+              },
+              props: { isRoot: true },
+            });
+
+          return row
+            ? this.toView({
+                row: row,
+                methodType: ReadinessMethodType.MicrosoftTeams,
+                isAdminAddable: false,
+                identifier: row.microsoftTeamsUserName,
+                kind: MaskedIdentifierKind.Handle,
+                isVerified: row.isVerified,
+              })
+            : null;
+        },
+        deleteRow: async (data: { methodId: ObjectID }): Promise<void> => {
+          await UserMicrosoftTeamsService.deleteOneById({
+            id: data.methodId,
+            props: { isRoot: true },
+          });
+        },
+      },
       {
         methodType: ReadinessMethodType.Webhook,
         isAdminAddable: false,
@@ -966,7 +1128,7 @@ export class UserNotificationMethodAdminService extends BaseService {
        * the feature to somebody probing it.
        */
       throw new BadDataException(
-        `A project administrator can only add Email, SMS, Call and WhatsApp notification methods for another user. Push, Telegram and webhook methods have to be added by the person who owns the device.`,
+        `A project administrator can only add Email, SMS, Call and WhatsApp notification methods for another user. Push, Telegram, Slack, Microsoft Teams and webhook methods have to be added by the person who owns the device or account.`,
       );
     }
 

package/Server/Services/UserNotificationRuleAdminService.ts

@@ -9,6 +9,8 @@ import UserPushService from "./UserPushService";
 import UserService from "./UserService";
 import UserSmsService from "./UserSmsService";
 import UserTelegramService from "./UserTelegramService";
+import UserSlackService from "./UserSlackService";
+import UserMicrosoftTeamsService from "./UserMicrosoftTeamsService";
 import UserWebhookService from "./UserWebhookService";
 import UserWhatsAppService from "./UserWhatsAppService";
 import type AuditLogServiceType from "./AuditLogService";
@@ -74,7 +76,7 @@ import UserNotificationRule from "../../Models/DatabaseModels/UserNotificationRu
  */
 
 /*
- * One of the seven ways a rule can name a delivery address, reduced to what the
+ * One of the nine ways a rule can name a delivery address, reduced to what the
  * ownership guard needs: which column carried it (for the error message and the
  * audit line) and which row it points at.
  */
@@ -96,7 +98,7 @@ export interface NotificationMethodReference {
 }
 
 /*
- * A rule-shaped bag of values to read the guarded columns out of — the seven
+ * A rule-shaped bag of values to read the guarded columns out of — the nine
  * method references AND the ownership column, because both halves of the pair
  * this file exists to compare arrive through the same payload.
  *
@@ -231,6 +233,38 @@ export class UserNotificationRuleAdminService extends BaseService {
           )?.userId;
         },
       },
+      {
+        idColumn: "userSlackId",
+        relationColumn: "userSlack",
+        label: "Slack",
+        findOwnerUserId: async (
+          methodId: ObjectID,
+        ): Promise<ObjectID | undefined> => {
+          return (
+            await UserSlackService.findOneById({
+              id: methodId,
+              select: { _id: true, userId: true },
+              props: { isRoot: true },
+            })
+          )?.userId;
+        },
+      },
+      {
+        idColumn: "userMicrosoftTeamsId",
+        relationColumn: "userMicrosoftTeams",
+        label: "Microsoft Teams",
+        findOwnerUserId: async (
+          methodId: ObjectID,
+        ): Promise<ObjectID | undefined> => {
+          return (
+            await UserMicrosoftTeamsService.findOneById({
+              id: methodId,
+              select: { _id: true, userId: true },
+              props: { isRoot: true },
+            })
+          )?.userId;
+        },
+      },
       {
         idColumn: "userPushId",
         relationColumn: "userPush",
@@ -267,9 +301,9 @@ export class UserNotificationRuleAdminService extends BaseService {
   }
 
   /*
-   * The seven FK columns, in one place, so a future eighth channel is a single
-   * entry rather than an eighth thing to remember. A guard that covers six of
-   * seven covers none: the attacker picks the seventh.
+   * The nine FK columns, in one place, so a future tenth channel is a single
+   * entry rather than a tenth thing to remember. A guard that covers eight of
+   * nine covers none: the attacker picks the ninth.
    */
   public getNotificationMethodIdColumns(): Array<string> {
     return this.getNotificationMethodDescriptors().map(
@@ -372,7 +406,7 @@ export class UserNotificationRuleAdminService extends BaseService {
    * spelling survives a create.
    *
    * This is the same reduction collapseNotificationMethodRelationsOnCreate
-   * performs for the seven method FKs, and the same one
+   * performs for the nine method FKs, and the same one
    * CreatePermission.checkCreateOwnership performs for this very column — it
    * validates `user` identically to `userId` and then CLEARS it, because after
    * clearing there is no second source of truth left to disagree with the