@oneuptime/common 12.0.18 → 12.0.19

package/Server/Services/WorkspaceUserNotificationService.ts

@@ -0,0 +1,190 @@
+import BaseService from "./BaseService";
+import UserOnCallLogTimelineService from "./UserOnCallLogTimelineService";
+import WorkspaceNotificationLogService from "./WorkspaceNotificationLogService";
+import WorkspaceProjectAuthTokenService from "./WorkspaceProjectAuthTokenService";
+import SlackUtil from "../Utils/Workspace/Slack/Slack";
+import MicrosoftTeamsUtil from "../Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
+import logger from "../Utils/Logger";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import WorkspaceProjectAuthToken from "../../Models/DatabaseModels/WorkspaceProjectAuthToken";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import UserNotificationStatus from "../../Types/UserNotification/UserNotificationStatus";
+import WorkspaceNotificationActionType from "../../Types/Workspace/WorkspaceNotificationActionType";
+import WorkspaceNotificationStatus from "../../Types/Workspace/WorkspaceNotificationStatus";
+import { WorkspaceMessageBlock } from "../../Types/Workspace/WorkspaceMessagePayload";
+import WorkspaceType, {
+  getWorkspaceTypeDisplayName,
+} from "../../Types/Workspace/WorkspaceType";
+
+/*
+ * Delivers a OneUptime notification to ONE person as a workspace direct
+ * message — the send half of the Slack / Microsoft Teams notification methods
+ * (UserSlack / UserMicrosoftTeams rows created under User Settings →
+ * Notification Methods).
+ *
+ * This is deliberately NOT part of the channel-oriented workspace machinery
+ * (WorkspaceNotificationRuleService and friends): those post into project
+ * channels selected by project-level rules, while this addresses a single
+ * user id captured from that user's own workspace link, using the project's
+ * bot credentials. SMS / Call / Telegram route through the Notification
+ * FeatureSet over HTTP because provider credentials and spend accounting live
+ * there; workspace bot tokens live in this database, so this service sends
+ * in-process instead.
+ */
+
+export interface SendWorkspaceDirectMessageOptions {
+  projectId: ObjectID;
+  workspaceType: WorkspaceType;
+  /*
+   * Slack: the member id (U…). Microsoft Teams: the Microsoft Entra object
+   * id. Both are what the corresponding notification-method row stores.
+   */
+  workspaceUserId: string;
+  messageBlocks: Array<WorkspaceMessageBlock>;
+  /* Short plain-text form of the message, stored on the workspace log row. */
+  messageSummary?: string | undefined;
+  userId?: ObjectID | undefined;
+  /*
+   * When set, the on-call timeline row is flipped to Sent / Error after the
+   * send attempt, mirroring what the Notification FeatureSet does for the
+   * other channels.
+   */
+  userOnCallLogTimelineId?: ObjectID | undefined;
+  incidentId?: ObjectID | undefined;
+  alertId?: ObjectID | undefined;
+  alertEpisodeId?: ObjectID | undefined;
+  incidentEpisodeId?: ObjectID | undefined;
+  onCallPolicyId?: ObjectID | undefined;
+  onCallPolicyEscalationRuleId?: ObjectID | undefined;
+  onCallScheduleId?: ObjectID | undefined;
+  teamId?: ObjectID | undefined;
+}
+
+export class WorkspaceUserNotificationService extends BaseService {
+  public constructor() {
+    super();
+  }
+
+  @CaptureSpan()
+  public async sendDirectMessageToUser(
+    options: SendWorkspaceDirectMessageOptions,
+  ): Promise<void> {
+    const workspaceDisplayName: string = getWorkspaceTypeDisplayName(
+      options.workspaceType,
+    );
+
+    let sendError: Error | null = null;
+
+    try {
+      if (!options.workspaceUserId) {
+        throw new BadDataException(
+          `This account is not connected to ${workspaceDisplayName}. Please go to User Settings and connect the account.`,
+        );
+      }
+
+      const projectAuth: WorkspaceProjectAuthToken | null =
+        await WorkspaceProjectAuthTokenService.getProjectAuth({
+          projectId: options.projectId,
+          workspaceType: options.workspaceType,
+        });
+
+      if (!projectAuth || !projectAuth.authToken) {
+        throw new BadDataException(
+          `This project is not connected to ${workspaceDisplayName}. Please go to Project Settings and connect the account.`,
+        );
+      }
+
+      if (options.workspaceType === WorkspaceType.Slack) {
+        await SlackUtil.sendDirectMessageToUser({
+          authToken: projectAuth.authToken,
+          workspaceUserId: options.workspaceUserId,
+          messageBlocks: options.messageBlocks,
+        });
+      } else if (options.workspaceType === WorkspaceType.MicrosoftTeams) {
+        await MicrosoftTeamsUtil.sendDirectMessageToUserAsBot({
+          projectId: options.projectId,
+          workspaceUserId: options.workspaceUserId,
+          messageBlocks: options.messageBlocks,
+        });
+      } else {
+        throw new BadDataException(
+          `Direct messages are not supported for workspace type ${options.workspaceType}.`,
+        );
+      }
+    } catch (error: unknown) {
+      const errorMessage: string =
+        error instanceof Error && error.message
+          ? error.message
+          : `${error as string}`;
+
+      sendError = error instanceof Error ? error : new Error(errorMessage);
+
+      logger.error(
+        `Failed to send ${workspaceDisplayName} direct message notification.`,
+      );
+      logger.error(error);
+    }
+
+    /*
+     * Log the attempt for admin visibility. Best-effort: a failed log write
+     * must never turn a delivered page into a reported failure (or mask a
+     * real send error with a logging one).
+     */
+    try {
+      await WorkspaceNotificationLogService.createWorkspaceLog(
+        {
+          projectId: options.projectId,
+          workspaceType: options.workspaceType,
+          actionType: WorkspaceNotificationActionType.SendMessage,
+          status: sendError
+            ? WorkspaceNotificationStatus.Error
+            : WorkspaceNotificationStatus.Success,
+          message: options.messageSummary,
+          statusMessage: sendError
+            ? sendError.message
+            : `Direct message sent on ${workspaceDisplayName}.`,
+          userId: options.userId,
+          incidentId: options.incidentId,
+          alertId: options.alertId,
+          alertEpisodeId: options.alertEpisodeId,
+          incidentEpisodeId: options.incidentEpisodeId,
+          onCallDutyPolicyId: options.onCallPolicyId,
+          onCallDutyPolicyEscalationRuleId:
+            options.onCallPolicyEscalationRuleId,
+          onCallDutyPolicyScheduleId: options.onCallScheduleId,
+          teamId: options.teamId,
+        },
+        {
+          isRoot: true,
+        },
+      );
+    } catch (logError) {
+      logger.error("Failed to write workspace notification log.");
+      logger.error(logError);
+    }
+
+    if (options.userOnCallLogTimelineId) {
+      await UserOnCallLogTimelineService.updateOneById({
+        id: options.userOnCallLogTimelineId,
+        data: {
+          status: sendError
+            ? UserNotificationStatus.Error
+            : UserNotificationStatus.Sent,
+          statusMessage: sendError
+            ? sendError.message
+            : `Message sent on ${workspaceDisplayName}.`,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+    }
+
+    if (sendError) {
+      throw sendError;
+    }
+  }
+}
+
+export default new WorkspaceUserNotificationService();

package/Server/Utils/Marketing/MarketingEventUtil.ts

@@ -0,0 +1,145 @@
+import Attribution from "../Attribution";
+import MarketingEventWebhook from "./MarketingEventWebhook";
+import Queue, { QueueName } from "../../Infrastructure/Queue";
+import { JSONObject } from "../../../Types/JSON";
+import {
+  MARKETING_EVENT_SCHEMA_VERSION,
+  MarketingEvent,
+  MarketingEventAttribution,
+  MarketingEventType,
+} from "../../../Types/Marketing/MarketingEvent";
+import logger from "../Logger";
+
+/*
+ * How many times the queue delivers one event before giving up, and the base
+ * for its exponential backoff. Five attempts at 30s exponential spans roughly
+ * eight minutes, which covers a rolling deploy of the receiver.
+ *
+ * There is no dead-letter store and deliberately so: the point of this design
+ * is that OneUptime does not hold marketing data. An event that exhausts its
+ * attempts is logged as an error and lost, which is the cost of not keeping a
+ * ledger and should be alerted on rather than engineered around here.
+ */
+const DELIVERY_ATTEMPTS: number = 5;
+const DELIVERY_BACKOFF_MS: number = 30_000;
+
+/*
+ * Anything carrying the attribution columns. User and Project both do —
+ * ProjectService copies them off the creating user at project creation — so
+ * one shape serves every caller and they cannot drift apart.
+ */
+export interface AttributionSource {
+  utmSource?: string | undefined;
+  utmMedium?: string | undefined;
+  utmCampaign?: string | undefined;
+  utmTerm?: string | undefined;
+  utmContent?: string | undefined;
+  utmUrl?: string | undefined;
+  clickIds?: JSONObject | undefined;
+  firstTouchAttribution?: JSONObject | undefined;
+}
+
+export default class MarketingEventUtil {
+  public static buildAttribution(
+    source: AttributionSource | undefined,
+  ): MarketingEventAttribution {
+    return {
+      utmSource: source?.utmSource,
+      utmMedium: source?.utmMedium,
+      utmCampaign: source?.utmCampaign,
+      utmTerm: source?.utmTerm,
+      utmContent: source?.utmContent,
+      utmUrl: source?.utmUrl,
+      clickIds: source?.clickIds || {},
+      firstTouch: source?.firstTouchAttribution || {},
+    };
+  }
+
+  public static buildEvent(data: {
+    eventType: MarketingEventType;
+    eventId: string;
+    occurredAt: Date;
+    email?: string | undefined;
+    attributionSource?: AttributionSource | undefined;
+    data?: JSONObject | undefined;
+  }): MarketingEvent {
+    const emailHash: string | null = Attribution.hashEmail(data.email);
+
+    return {
+      schemaVersion: MARKETING_EVENT_SCHEMA_VERSION,
+      eventId: data.eventId,
+      eventType: data.eventType,
+      occurredAt: data.occurredAt.toISOString(),
+      email: data.email,
+      emailHash: emailHash || undefined,
+      attribution: this.buildAttribution(data.attributionSource),
+      data: data.data || {},
+    };
+  }
+
+  /*
+   * Hand one event to the queue.
+   *
+   * Never throws and never awaits delivery. Every caller is a commercial code
+   * path — a signup completing, a plan change being written, a booking being
+   * accepted — and none of them may fail, block, or slow down because a
+   * marketing endpoint is unreachable. Enqueue is the only synchronous part
+   * and it is a single Redis write.
+   */
+  public static async emit(event: MarketingEvent): Promise<void> {
+    if (MarketingEventWebhook.isMisconfigured()) {
+      logger.error(
+        `MarketingEvent: MARKETING_WEBHOOK_URL is set but MARKETING_WEBHOOK_SECRET is not — refusing to send ${event.eventType} unsigned. Set the secret or unset the URL.`,
+      );
+      return;
+    }
+
+    if (!MarketingEventWebhook.isConfigured()) {
+      return;
+    }
+
+    try {
+      await Queue.addJob(
+        QueueName.MarketingEvent,
+        event.eventId,
+        event.eventType,
+        event as JSONObject,
+        {
+          attempts: DELIVERY_ATTEMPTS,
+          backoffDelayInMs: DELIVERY_BACKOFF_MS,
+        },
+      );
+
+      logger.debug(
+        `MarketingEvent: queued ${event.eventType} (${event.eventId})`,
+      );
+    } catch (err) {
+      logger.error(
+        `MarketingEvent: failed to queue ${event.eventType} (${event.eventId}): ${err}`,
+      );
+    }
+  }
+
+  /*
+   * Fire-and-forget wrapper for callers that are not async or must not await.
+   *
+   * Guarantees it neither throws nor rejects. Every caller is inside a
+   * commercial transaction that has already succeeded by the time it gets
+   * here — a user is created, a plan is changed, a booking is verified — so
+   * the one thing this must never do is turn a completed action into a failed
+   * one. The rejection path is covered by .catch and the synchronous path by
+   * the try, because an argument expression that throws (buildEvent on a
+   * malformed row) would otherwise propagate straight into the caller.
+   */
+  public static emitInBackground(event: MarketingEvent): void {
+    try {
+      this.emit(event).catch((err: Error) => {
+        logger.error(
+          `MarketingEvent: failed to emit ${event.eventType}: ${err}`,
+        );
+      });
+    } catch (err) {
+      logger.error(`MarketingEvent: failed to emit ${event.eventType}: ${err}`);
+    }
+  }
+}

package/Server/Utils/Marketing/MarketingEventWebhook.ts

@@ -0,0 +1,114 @@
+import axios, { AxiosError, AxiosResponse } from "axios";
+import crypto from "crypto";
+import {
+  MarketingWebhookSecret,
+  MarketingWebhookUrl,
+} from "../../EnvironmentConfig";
+import { MarketingEvent } from "../../../Types/Marketing/MarketingEvent";
+import logger from "../Logger";
+
+const REQUEST_TIMEOUT_MS: number = 15000;
+
+/*
+ * Delivers marketing conversion events to one operator-configured endpoint.
+ *
+ * OneUptime keeps no conversion ledger, so this is the only exit for a signup,
+ * a booked meeting or a plan change. That has one consequence worth stating
+ * plainly: a delivery this class gives up on is gone, because there is no row
+ * anywhere to reconcile against later. deliver() therefore THROWS on anything
+ * that might succeed on a retry, and the queue is what retries it.
+ *
+ * SIGNING
+ *
+ * The signature is HMAC-SHA256 over the exact request body bytes, hex encoded,
+ * in `x-oneuptime-signature-256`. This is the same scheme OneUptime verifies
+ * on the way in from Cal, deliberately: one thing to understand rather than
+ * two. The receiver must compute its digest over the raw bytes it received —
+ * JSON parsed and re-serialised is NOT equivalent, because whitespace, key
+ * order and escaping all change the digest.
+ *
+ * The body is serialised once, here, and that exact string is both signed and
+ * sent, so nothing between the signature and the socket can reformat it.
+ *
+ * Both the URL and the secret are required. An endpoint configured without a
+ * secret is not sent to at all rather than sent to unsigned: the payload
+ * carries email addresses and campaign data, and a receiver with no way to
+ * tell OneUptime's POST from anyone else's is not a receiver worth having.
+ */
+export default class MarketingEventWebhook {
+  public static isConfigured(): boolean {
+    return Boolean(MarketingWebhookUrl && MarketingWebhookSecret);
+  }
+
+  /*
+   * True when an endpoint is set but unusable, so callers can say so once at
+   * emit time rather than letting events vanish into a silent no-op.
+   */
+  public static isMisconfigured(): boolean {
+    return Boolean(MarketingWebhookUrl) && !MarketingWebhookSecret;
+  }
+
+  public static sign(body: string): string {
+    return crypto
+      .createHmac("sha256", MarketingWebhookSecret)
+      .update(body, "utf8")
+      .digest("hex");
+  }
+
+  /*
+   * One delivery attempt.
+   *
+   * Throws on a transport error or any non-2xx, which is what makes the queue
+   * retry. A 4xx is retried too: the receiver rejecting a payload it should
+   * have taken is far more often a deploy in progress or a bad rule than a
+   * payload that will never be acceptable, and the alternative — dropping it
+   * silently — has no backstop now that nothing is stored.
+   */
+  public static async deliver(event: MarketingEvent): Promise<void> {
+    if (!this.isConfigured()) {
+      return;
+    }
+
+    // Serialise once. This exact string is signed and sent.
+    const body: string = JSON.stringify(event);
+
+    try {
+      const response: AxiosResponse = await axios.post(
+        MarketingWebhookUrl,
+        body,
+        {
+          headers: {
+            "content-type": "application/json",
+            "x-oneuptime-signature-256": this.sign(body),
+            "x-oneuptime-event-id": event.eventId,
+            "x-oneuptime-event-type": event.eventType,
+          },
+          timeout: REQUEST_TIMEOUT_MS,
+          // Non-2xx must reach the catch below rather than resolving.
+          validateStatus: (status: number): boolean => {
+            return status >= 200 && status < 300;
+          },
+        },
+      );
+
+      logger.debug(
+        `MarketingEvent: delivered ${event.eventType} (${event.eventId}) — HTTP ${response.status}`,
+      );
+    } catch (err) {
+      const message: string =
+        err instanceof AxiosError
+          ? `HTTP ${err.response?.status || "?"}: ${JSON.stringify(
+              err.response?.data || err.message,
+            ).slice(0, 500)}`
+          : (err as Error)?.message || "Unknown error";
+
+      /*
+       * Rethrown, not swallowed. The queue's retry is the only thing standing
+       * between a receiver hiccup and a permanently lost conversion.
+       */
+      throw new Error(
+        `Marketing webhook delivery failed for ${event.eventType} (${event.eventId}): ${message}`,
+      );
+    }
+  }
+}

package/Server/Utils/Monitor/MonitorLogUtil.ts

@@ -7,6 +7,7 @@ import OneUptimeDate from "../../../Types/Date";
 import ObjectID from "../../../Types/ObjectID";
 import { JSONObject } from "../../../Types/JSON";
 import DataToProcess from "./DataToProcess";
+import { redactForPersistence } from "./MonitorPayloadRedaction";
 
 /*
  * Maximum rows held in memory before we force a flush, and the
@@ -138,7 +139,19 @@ export default class MonitorLogUtil {
           projectId: data.projectId.toString(),
           monitorId: data.monitorId.toString(),
           time: logTimestamp,
-          logBody: JSON.parse(JSON.stringify(data.dataToProcess)),
+          /*
+           * Redact on the way out, never in place: `dataToProcess` is still
+           * live here (saveMonitorLog is fire-and-forget and the caller keeps
+           * evaluating criteria against it), so the stringify/parse clone is
+           * what gets masked. logBody is readable by Permission.Viewer, which
+           * makes it the widest-reach sink in the product — anything
+           * credential-shaped in it is readable by the least-privileged role
+           * OneUptime grants. See MonitorPayloadRedaction.
+           * https://github.com/OneUptime/oneuptime/issues/3360
+           */
+          logBody: redactForPersistence(
+            JSON.parse(JSON.stringify(data.dataToProcess)),
+          ),
           retentionDate: OneUptimeDate.toClickhouseDateTime(retentionDate),
         };