@oneuptime/common 12.0.18 → 12.0.20

package/Models/DatabaseModels/UserNotificationSetting.ts

@@ -314,6 +314,40 @@ class UserNotificationSetting extends BaseModel {
   })
   public alertByTelegram?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [Permission.CurrentUser],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    defaultValue: false,
+    example: false,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public alertBySlack?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [Permission.CurrentUser],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    defaultValue: false,
+    example: false,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public alertByMicrosoftTeams?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [Permission.CurrentUser],
     read: [Permission.CurrentUser],

package/Models/DatabaseModels/UserOnCallLogTimeline.ts

@@ -16,6 +16,8 @@ import UserPush from "./UserPush";
 import UserOnCallLog from "./UserOnCallLog";
 import UserSMS from "./UserSMS";
 import UserTelegram from "./UserTelegram";
+import UserSlack from "./UserSlack";
+import UserMicrosoftTeams from "./UserMicrosoftTeams";
 import UserWebhook from "./UserWebhook";
 import UserWhatsApp from "./UserWhatsApp";
 import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
@@ -1057,6 +1059,99 @@ export default class UserOnCallLogTimeline extends BaseModel {
   })
   public userTelegramId?: ObjectID = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "userSlackId",
+    type: TableColumnType.Entity,
+    modelType: UserSlack,
+    title: "User Slack",
+    description: "Relation to User Slack Resource in which this object belongs",
+  })
+  @ManyToOne(
+    () => {
+      return UserSlack;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "userSlackId" })
+  public userSlack?: UserSlack = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    canReadOnRelationQuery: true,
+    title: "User Slack ID",
+    description: "ID of User Slack in which this object belongs",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public userSlackId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "userMicrosoftTeamsId",
+    type: TableColumnType.Entity,
+    modelType: UserMicrosoftTeams,
+    title: "User Microsoft Teams",
+    description:
+      "Relation to User Microsoft Teams Resource in which this object belongs",
+  })
+  @ManyToOne(
+    () => {
+      return UserMicrosoftTeams;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "userMicrosoftTeamsId" })
+  public userMicrosoftTeams?: UserMicrosoftTeams = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    canReadOnRelationQuery: true,
+    title: "User Microsoft Teams ID",
+    description: "ID of User Microsoft Teams in which this object belongs",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public userMicrosoftTeamsId?: ObjectID = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [Permission.CurrentUser],

package/Models/DatabaseModels/UserSlack.ts

@@ -0,0 +1,341 @@
+import Project from "./Project";
+import User from "./User";
+import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import Route from "../../Types/API/Route";
+import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
+import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import OwnerOnlyColumn from "../../Types/Database/AccessControl/OwnerOnlyColumn";
+import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import ColumnLength from "../../Types/Database/ColumnLength";
+import ColumnType from "../../Types/Database/ColumnType";
+import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import CurrentUserCanAccessRecordBy from "../../Types/Database/CurrentUserCanAccessRecordBy";
+import TableColumn from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import TableMetadata from "../../Types/Database/TableMetadata";
+import TenantColumn from "../../Types/Database/TenantColumn";
+import IconProp from "../../Types/Icon/IconProp";
+import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
+import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+
+/*
+ * `read` names Permission.CurrentUser and nothing else, exactly like the other
+ * notification-method models (UserTelegram has the full essay). That single
+ * entry is what keeps every row owner-only: row scoping comes from the TABLE
+ * list alone, and widening it would expose the Slack member id every project
+ * member's pages are delivered to. Do not add administrator permissions here -
+ * OnCallReadinessService returns the masked, admin-sanctioned view instead.
+ *
+ * Unlike Telegram/SMS/WhatsApp there is no verification code: a row is only
+ * ever created from an existing, OAuth-established workspace link
+ * (WorkspaceUserAuthToken), so creation IS verification. UserSlackService
+ * enforces that and stamps the Slack identifiers server-side.
+ */
+@TenantColumn("projectId")
+@AllowAccessIfSubscriptionIsUnpaid()
+@TableAccessControl({
+  create: [Permission.CurrentUser],
+  read: [Permission.CurrentUser],
+  delete: [Permission.CurrentUser],
+  update: [Permission.CurrentUser],
+})
+@CrudApiEndpoint(new Route("/user-slack"))
+@Entity({
+  name: "UserSlack",
+})
+@TableMetadata({
+  tableName: "UserSlack",
+  singularName: "Slack Account",
+  pluralName: "Slack Accounts",
+  icon: IconProp.Slack,
+  tableDescription: "Slack accounts used for Slack notifications.",
+})
+@CurrentUserCanAccessRecordBy("userId")
+class UserSlack extends BaseModel {
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "projectId",
+    type: TableColumnType.Entity,
+    modelType: Project,
+    title: "Project",
+    description: "Relation to Project Resource in which this object belongs",
+  })
+  @ManyToOne(
+    () => {
+      return Project;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "projectId" })
+  public project?: Project = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: true,
+    canReadOnRelationQuery: true,
+    title: "Project ID",
+    description: "ID of your OneUptime Project in which this object belongs",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public projectId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    /*
+     * CurrentUser here does NOT mean the client may choose the value: the
+     * service hook refuses any non-root payload that carries these columns
+     * and then stamps them itself, and hooks run BEFORE the column
+     * permission check (DatabaseService.create). The entry exists because
+     * that same check runs on the STAMPED data - with an empty list the
+     * server's own write is refused and no user can add this method at all.
+     * Same shape as UserWebAuthn's server-stamped isVerified.
+     */
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @Index()
+  /*
+   * The Slack member id (e.g. U0123ABCD) the project's bot delivers direct
+   * messages to. Holding it is enough to address bot messages at that person,
+   * so it is a delivery target and not a label. Captured server-side from the
+   * user's own WorkspaceUserAuthToken - never writable by the client.
+   */
+  @OwnerOnlyColumn()
+  @TableColumn({
+    title: "Slack User ID",
+    required: false,
+    unique: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    description:
+      "Slack member ID captured from your connected Slack account. Populated automatically.",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public slackUserId?: string = undefined;
+
+  @ColumnAccessControl({
+    /*
+     * CurrentUser here does NOT mean the client may choose the value: the
+     * service hook refuses any non-root payload that carries these columns
+     * and then stamps them itself, and hooks run BEFORE the column
+     * permission check (DatabaseService.create). The entry exists because
+     * that same check runs on the STAMPED data - with an empty list the
+     * server's own write is refused and no user can add this method at all.
+     * Same shape as UserWebAuthn's server-stamped isVerified.
+     */
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  /*
+   * The person's Slack display name at the time the method was added. Only a
+   * label for the row, but it is still their identity in an outside workspace,
+   * so it stays owner-only like the Telegram handle.
+   */
+  @OwnerOnlyColumn()
+  @TableColumn({
+    title: "Slack Username",
+    required: false,
+    unique: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    description:
+      "Slack username captured from your connected Slack account. Populated automatically.",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public slackUserName?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "user",
+    type: TableColumnType.Entity,
+    modelType: User,
+    title: "User",
+    description: "Relation to User who this Slack account belongs to",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "userId" })
+  public user?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "User ID",
+    description: "User ID who this Slack account belongs to",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  @Index()
+  public userId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "createdByUserId",
+    type: TableColumnType.Entity,
+    modelType: User,
+    title: "Created by User",
+    description:
+      "Relation to User who created this object (if this object was created by a User)",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "createdByUserId" })
+  public createdByUser?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Created by User ID",
+    description:
+      "User ID who created this object (if this object was created by a User)",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public createdByUserId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "deletedByUserId",
+    type: TableColumnType.Entity,
+    title: "Deleted by User",
+    modelType: User,
+    description:
+      "Relation to User who deleted this object (if this object was deleted by a User)",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      cascade: false,
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "deletedByUserId" })
+  public deletedByUser?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Deleted by User ID",
+    description:
+      "User ID who deleted this object (if this object was deleted by a User)",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public deletedByUserId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    /*
+     * CurrentUser here does NOT mean the client may choose the value: the
+     * service hook refuses any non-root payload that carries these columns
+     * and then stamps them itself, and hooks run BEFORE the column
+     * permission check (DatabaseService.create). The entry exists because
+     * that same check runs on the STAMPED data - with an empty list the
+     * server's own write is refused and no user can add this method at all.
+     * Same shape as UserWebAuthn's server-stamped isVerified.
+     */
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    title: "Is Verified",
+    description: "Is this Slack account verified?",
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    defaultValue: false,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public isVerified?: boolean = undefined;
+}
+
+export default UserSlack;

package/Models/DatabaseModels/WorkspaceProjectAuthToken.ts

@@ -34,6 +34,15 @@ export interface MicrosoftTeamsChat {
   chatType: MicrosoftTeamsChatType;
   serviceUrl?: string | undefined; // Bot Framework service URL captured when the bot was added.
   addedAt?: string | undefined;
+  /*
+   * Microsoft Entra object ids of the human members, captured from the chat
+   * roster. What lets a personal chat be matched back to the OneUptime user
+   * it belongs to (WorkspaceUserAuthToken.workspaceUserId is the same id), so
+   * user direct-message notifications can reuse the existing chat instead of
+   * creating a new conversation. Absent on records captured before this
+   * shipped.
+   */
+  memberAadObjectIds?: Array<string> | undefined;
 }
 
 /*

package/Server/API/EnterpriseLicenseAPI.ts

@@ -1,7 +1,6 @@
 import EnterpriseLicense from "../../Models/DatabaseModels/EnterpriseLicense";
 import EnterpriseLicenseInstance from "../../Models/DatabaseModels/EnterpriseLicenseInstance";
 import BadDataException from "../../Types/Exception/BadDataException";
-import { JSONObject } from "../../Types/JSON";
 import PartialEntity from "../../Types/Database/PartialEntity";
 import EnterpriseLicenseInstanceSummary from "../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
 import EnterpriseLicenseUsageUtil from "../../Utils/EnterpriseLicense/EnterpriseLicenseUsage";
@@ -26,6 +25,20 @@ import {
 import BaseAPI from "./BaseAPI";
 // import { Host } from "../EnvironmentConfig";
 
+/*
+ * The license state every installation of a license key mirrors locally.
+ * Returned by both /validate and /report-user-count so that the daily report
+ * keeps a self-hosted installation current on its own.
+ */
+export interface LicenseTerms {
+  companyName: string;
+  // ISO 8601, or null for a license with no expiry set.
+  expiresAt: string | null;
+  licenseKey: string;
+  // Null means the license carries no seat limit.
+  userLimit: number | null;
+}
+
 export interface LicenseInstanceUpsert {
   licenseId: ObjectID;
   instanceId: string;
@@ -137,24 +150,15 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
           const instances: Array<EnterpriseLicenseInstance> =
             await this.findLicenseInstances(license.id!);
 
-          const payload: JSONObject = {
-            companyName: license.companyName || "",
-            expiresAt: license.expiresAt.toISOString(),
-            licenseKey: license.licenseKey || "",
-            userLimit:
-              typeof license.userLimit === "number" ? license.userLimit : null,
-          };
-
-          const token: string = JSONWebToken.signJsonPayload(
-            payload,
-            Math.max(secondsUntilExpiry, 1),
-          );
+          const terms: LicenseTerms = this.getLicenseTerms(license);
+
+          const token: string | null = this.signLicenseToken(license);
 
           return Response.sendJsonObjectResponse(req, res, {
-            companyName: payload["companyName"] as string,
-            expiresAt: payload["expiresAt"] as string,
-            licenseKey: payload["licenseKey"] as string,
-            userLimit: payload["userLimit"],
+            companyName: terms.companyName,
+            expiresAt: terms.expiresAt,
+            licenseKey: terms.licenseKey,
+            userLimit: terms.userLimit,
             currentUserCount:
               typeof license.currentUserCount === "number"
                 ? license.currentUserCount
@@ -202,8 +206,19 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
               query: {
                 licenseKey: licenseKey,
               },
+              /*
+               * The full set of terms, not just the usage columns: this
+               * response is what a self-hosted installation mirrors into its
+               * own GlobalConfig every day, so anything it is missing here is
+               * a field the customer keeps the stale value of until somebody
+               * re-types the license key by hand. Same indexed lookup either
+               * way.
+               */
               select: {
                 _id: true,
+                companyName: true,
+                expiresAt: true,
+                licenseKey: true,
                 userLimit: true,
                 isEvaluationLicense: true,
               },
@@ -282,13 +297,25 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
             });
           }
 
+          const terms: LicenseTerms = this.getLicenseTerms(license);
+
           return Response.sendJsonObjectResponse(req, res, {
+            companyName: terms.companyName,
+            expiresAt: terms.expiresAt,
+            licenseKey: terms.licenseKey,
+            userLimit: terms.userLimit,
             currentUserCount: currentUserCount,
             userCountUpdatedAt: reportedAt.toISOString(),
-            userLimit:
-              typeof license.userLimit === "number" ? license.userLimit : null,
             isEvaluationLicense: Boolean(license.isEvaluationLicense),
             instances: this.getInstanceSummaries(instances),
+            /*
+             * Null once the license has expired. Unlike /validate this route
+             * does not reject an expired license - the instance is still
+             * expected to report, and the expiry notification emails are built
+             * from what it reports - but it must not keep being handed a fresh
+             * token, and the expiresAt above is what tells it the truth.
+             */
+            token: this.signLicenseToken(license),
           });
         } catch (err) {
           next(err);
@@ -297,6 +324,54 @@ export default class EnterpriseLicenseAPI extends BaseAPI<
     );
   }
 
+  /*
+   * The license terms a self-hosted installation mirrors locally. Built in one
+   * place so /validate and /report-user-count cannot drift: the seat limit was
+   * missing from what an instance could refresh for exactly as long as the two
+   * responses were written out by hand, separately.
+   */
+  private getLicenseTerms(license: EnterpriseLicense): LicenseTerms {
+    return {
+      companyName: license.companyName || "",
+      expiresAt: license.expiresAt ? license.expiresAt.toISOString() : null,
+      licenseKey: license.licenseKey || "",
+      userLimit:
+        typeof license.userLimit === "number" ? license.userLimit : null,
+    };
+  }
+
+  /*
+   * Signed with the license server's own secret, so it is opaque to the
+   * installation holding it - it is the proof that oneuptime.com recognized
+   * the key, and the instance only checks that it exists. An expired license
+   * gets none, which is why this returns null rather than a short-lived token.
+   */
+  private signLicenseToken(license: EnterpriseLicense): string | null {
+    if (!license.expiresAt) {
+      return null;
+    }
+
+    const secondsUntilExpiry: number = Math.floor(
+      (license.expiresAt.getTime() - Date.now()) / 1000,
+    );
+
+    if (secondsUntilExpiry <= 0) {
+      return null;
+    }
+
+    const terms: LicenseTerms = this.getLicenseTerms(license);
+
+    return JSONWebToken.signJsonPayload(
+      {
+        companyName: terms.companyName,
+        expiresAt: terms.expiresAt,
+        licenseKey: terms.licenseKey,
+        userLimit: terms.userLimit,
+      },
+      Math.max(secondsUntilExpiry, 1),
+    );
+  }
+
   private parseShortText(value: unknown): string {
     if (typeof value !== "string") {
       return "";