@oneuptime/common 12.0.2 → 12.0.3

package/Server/Utils/Database/ProjectScopedReferenceValidator.ts

@@ -3,6 +3,7 @@ import Query from "../../Types/Database/Query";
 import QueryHelper from "../../Types/Database/QueryHelper";
 import Select from "../../Types/Database/Select";
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import ObjectID from "../../../Types/ObjectID";
 import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
@@ -20,12 +21,23 @@ import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/
  * FKs are ON DELETE NO ACTION, so Postgres raises 23503 and the API answers
  * "This item cannot be deleted because Incident records still reference it."
  *
- * The check below is deliberately narrow, for the same reason
- * MonitorStepsProjectValidator is: it only rejects an id that really is
- * another project's record. An id that matches no row at all is left alone —
- * refusing it would block users from saving their way out of a record that
- * already references something deleted, and the not-null/foreign-key checks
- * report that case on their own.
+ * An id that matches NO row is rejected too (issue #3039). The REST API used to
+ * take any uuid for these columns; the write then either blew up deep inside
+ * Postgres as a raw 23503 (an opaque 500 rather than "you picked a bad id"), or
+ * — for ids that live in a JSON blob with no foreign key behind it, like
+ * monitorSteps — saved happily and only failed much later, inside the probe
+ * worker, as
+ *   insert or update on table "MonitorStatusTimeline" violates foreign key
+ *   constraint
+ * with nothing surfaced to the caller who typed the bad id.
+ *
+ * Rejecting a missing id is safe for the columns validated here because every
+ * one of them is a real foreign key and deletes in this codebase are hard
+ * deletes (DatabaseService._deleteBy), so a *stored* id can never dangle: the
+ * ON DELETE NO ACTION constraint blocks the delete while a row still points at
+ * it. A missing id therefore only ever comes from the payload being validated.
+ * Callers whose reference is NOT foreign-key backed (monitorSteps ids, say) can
+ * opt a single reference out with `mustExist: false`.
  */
 
 export interface ProjectScopedReference {
@@ -34,6 +46,13 @@ export interface ProjectScopedReference {
   id: ObjectID | string | undefined | null;
   // The service that owns the referenced model, e.g. IncidentSeverityService.
   service: DatabaseService<DatabaseBaseModel>;
+  /*
+   * Defaults to true: an id that matches no record is rejected. Set false for a
+   * reference that is allowed to dangle — one with no foreign key behind it,
+   * where refusing would block a user from saving their way out of a record
+   * that already points at something deleted.
+   */
+  mustExist?: boolean | undefined;
 }
 
 interface ForeignReference {
@@ -41,6 +60,33 @@ interface ForeignReference {
   name: string;
 }
 
+interface MissingReference {
+  modelName: string;
+  id: string;
+}
+
+// What the caller asked about, keyed by id inside one service's lookup.
+interface RequestedReference {
+  modelName: string;
+  mustExist: boolean;
+  // The id exactly as the caller wrote it, so the message echoes their input.
+  id: string;
+}
+
+/*
+ * Ids are matched case-insensitively.
+ *
+ * ObjectID keeps whatever case it was handed (its validation regex is
+ * case-insensitive) and Postgres compares `uuid` values by parsed value, so a
+ * payload carrying an UPPERCASE uuid selects the row fine — but reads the id
+ * back lower-cased, because that is how Postgres renders `uuid`. Comparing the
+ * two verbatim would find no match and report a record that plainly exists as
+ * missing.
+ */
+function normalizeId(id: string): string {
+  return id.trim().toLowerCase();
+}
+
 /*
  * The same reference reaches a service hook in several shapes: the id column
  * (`incidentSeverityId`), a relation object (`incidentSeverity: { _id }`), an
@@ -92,11 +138,11 @@ export default class ProjectScopedReferenceValidator {
      */
     const idsByService: Map<
       DatabaseService<DatabaseBaseModel>,
-      Map<string, string>
+      Map<string, RequestedReference>
     > = new Map();
 
     for (const reference of data.references) {
-      const id: string = reference.id?.toString() || "";
+      const id: string = reference.id?.toString().trim() || "";
 
       if (!id) {
         continue;
@@ -106,7 +152,25 @@ export default class ProjectScopedReferenceValidator {
         idsByService.set(reference.service, new Map());
       }
 
-      idsByService.get(reference.service)!.set(id, reference.modelName);
+      const requested: Map<string, RequestedReference> = idsByService.get(
+        reference.service,
+      )!;
+
+      const key: string = normalizeId(id);
+
+      const existing: RequestedReference | undefined = requested.get(key);
+
+      requested.set(key, {
+        modelName: reference.modelName,
+        id: existing?.id || id,
+        /*
+         * The same id can arrive twice for one service (e.g. two monitor
+         * criteria pointing at the same status). If ANY of them requires the
+         * record to exist, the strictest wins.
+         */
+        mustExist:
+          (existing?.mustExist ?? false) || (reference.mustExist ?? true),
+      });
     }
 
     if (idsByService.size === 0) {
@@ -114,21 +178,38 @@ export default class ProjectScopedReferenceValidator {
     }
 
     const foreignReferences: Array<ForeignReference> = [];
+    const missingReferences: Array<MissingReference> = [];
+
+    for (const [service, requestedById] of idsByService) {
+      /*
+       * Read the tenant and name columns off the model rather than assuming
+       * `projectId` / `name`. Not every referenced model is project scoped —
+       * a monitor criteria can name owner *users*, and User has no tenant
+       * column at all. Selecting a column a model does not have throws, and
+       * comparing an absent projectId against the write's project would
+       * report every such record as belonging to "a different project".
+       */
+      const referencedModel: DatabaseBaseModel = service.getModel();
+      const tenantColumnName: string | null = referencedModel.getTenantColumn();
+      const hasNameColumn: boolean = referencedModel.hasColumn("name");
+
+      const select: Select<DatabaseBaseModel> = {
+        _id: true,
+      } as Select<DatabaseBaseModel>;
+
+      if (hasNameColumn) {
+        (select as Dictionary<boolean>)["name"] = true;
+      }
+
+      if (tenantColumnName) {
+        (select as Dictionary<boolean>)[tenantColumnName] = true;
+      }
 
-    for (const [service, idToModelName] of idsByService) {
       const records: Array<DatabaseBaseModel> = await service.findBy({
         query: {
-          _id: QueryHelper.any(Array.from(idToModelName.keys())),
+          _id: QueryHelper.any(Array.from(requestedById.keys())),
         },
-        /*
-         * `name` and `projectId` are not on DatabaseBaseModel, but every model
-         * passed here is project scoped and named, so the cast is safe.
-         */
-        select: {
-          _id: true,
-          name: true,
-          projectId: true,
-        } as Select<DatabaseBaseModel>,
+        select: select,
         limit: LIMIT_PER_PROJECT,
         skip: 0,
         props: {
@@ -136,37 +217,84 @@ export default class ProjectScopedReferenceValidator {
         },
       });
 
+      const foundIds: Set<string> = new Set();
+
       for (const record of records) {
+        const id: string = normalizeId(record._id?.toString() || "");
+
+        foundIds.add(id);
+
+        if (!tenantColumnName) {
+          // Global record (e.g. User) — there is no project to compare against.
+          continue;
+        }
+
         const recordProjectId: ObjectID | undefined =
-          record.getValue<ObjectID>("projectId") || undefined;
+          record.getValue<ObjectID>(tenantColumnName) || undefined;
 
         if (recordProjectId?.toString() === data.projectId.toString()) {
           continue;
         }
 
-        const id: string = record._id?.toString() || "";
-
         foreignReferences.push({
-          modelName: idToModelName.get(id) || "Record",
-          name: record.getValue<string>("name")?.toString() || id,
+          modelName: requestedById.get(id)?.modelName || "Record",
+          name:
+            (hasNameColumn && record.getValue<string>("name")?.toString()) ||
+            id,
+        });
+      }
+
+      for (const [id, requested] of requestedById) {
+        if (foundIds.has(id) || !requested.mustExist) {
+          continue;
+        }
+
+        missingReferences.push({
+          modelName: requested.modelName,
+          // Echo the id as the caller wrote it, not the normalized key.
+          id: requested.id,
         });
       }
     }
 
-    if (foreignReferences.length === 0) {
-      return;
+    /*
+     * Both problems are reported in one go so a caller fixing a payload with
+     * several bad ids does not have to discover them one round-trip at a time.
+     * The wording of each clause is kept verbatim from when they were separate
+     * messages — support runbooks and tests match on it.
+     */
+    const clauses: Array<string> = [];
+
+    if (foreignReferences.length > 0) {
+      const described: string = foreignReferences
+        .map((reference: ForeignReference) => {
+          return `${reference.modelName} "${reference.name}"`;
+        })
+        .join(", ");
+
+      clauses.push(
+        `references records that belong to a different project: ${described}. Please pick values from this project and try again.`,
+      );
+    }
+
+    if (missingReferences.length > 0) {
+      const described: string = missingReferences
+        .map((reference: MissingReference) => {
+          return `${reference.modelName} "${reference.id}"`;
+        })
+        .join(", ");
+
+      clauses.push(
+        `references records that do not exist: ${described}. Please pick values that exist in this project and try again.`,
+      );
     }
 
-    const described: string = foreignReferences
-      .map((reference: ForeignReference) => {
-        return `${reference.modelName} "${reference.name}"`;
-      })
-      .join(", ");
+    if (clauses.length === 0) {
+      return;
+    }
 
     throw new BadDataException(
-      `This ${
-        data.subject || "request"
-      } references records that belong to a different project: ${described}. Please pick values from this project and try again.`,
+      `This ${data.subject || "request"} ${clauses.join(" It also ")}`,
     );
   }
 
@@ -178,10 +306,13 @@ export default class ProjectScopedReferenceValidator {
    * there fails the whole ingest job for that monitor, so those callers ask
    * this instead and fall back to their project's own default.
    *
-   * Note the deliberate difference from validateReferencesBelongToProject: an
-   * id that matches NO record is unusable here (false), while the write guard
-   * lets it pass so a record already pointing at something deleted stays
-   * saveable.
+   * Note the deliberate difference from validateReferencesBelongToProject:
+   * that one refuses the write and names what is wrong, which is right when
+   * someone is typing an id in. This one answers a question and never throws,
+   * which is right when a worker is reading an id that was typed in long ago —
+   * an id monitorSteps is allowed to keep holding (the write guard exempts what
+   * a record already stores, since none of those ids has a foreign key behind
+   * it and there is no migration to clean them up).
    */
   public static async isUsableInProject(data: {
     projectId: ObjectID | undefined;

package/Server/Utils/Monitor/MonitorResource.ts

@@ -50,6 +50,7 @@ import CaptureSpan from "../Telemetry/CaptureSpan";
 import ExceptionMessages from "../../../Types/Exception/ExceptionMessages";
 import MonitorEvaluationSummary from "../../../Types/Monitor/MonitorEvaluationSummary";
 import MonitorStatusService from "../../Services/MonitorStatusService";
+import ProjectScopedReferenceValidator from "../Database/ProjectScopedReferenceValidator";
 import { ProbeConnectionStatus } from "../../../Models/DatabaseModels/Probe";
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 
@@ -1063,48 +1064,74 @@ export default class MonitorResourceUtil {
            */
           let revertedToDefaultStatus: boolean = true;
 
-          try {
-            await MonitorStatusTimelineService.create({
-              data: monitorStatusTimeline,
-              props: {
-                isRoot: true,
-              },
+          /*
+           * The stored default status can be a status that no longer exists, or
+           * one from another project: monitorSteps is a JSON blob with no
+           * foreign key behind it, and before issue #3039 was fixed the API
+           * accepted any uuid for it. Writing it raised the
+           * "violates foreign key constraint" error from the probe/telemetry
+           * worker and failed the whole ingest run for this monitor, losing the
+           * monitor log and payload persisted below. Skip the revert and log,
+           * the same way the criteria path in Utils/Monitor/MonitorStatusTimeline
+           * does. New writes are rejected up front by
+           * MonitorStepsProjectValidator.
+           */
+          const isDefaultStatusUsable: boolean =
+            await ProjectScopedReferenceValidator.isUsableInProject({
+              projectId: monitor.projectId!,
+              id: monitorSteps.data.defaultMonitorStatusId,
+              service: MonitorStatusService,
             });
-            logger.debug(
-              `${dataToProcess.monitorId.toString()} - Monitor status updated to default.`,
+
+          if (!isDefaultStatusUsable) {
+            logger.error(
+              `${dataToProcess.monitorId.toString()} - The default monitor status ${monitorSteps.data.defaultMonitorStatusId.toString()} does not exist in project ${monitor.projectId?.toString()}. Skipping revert to default status. Please pick a default monitor status that exists in this project.`,
             );
-          } catch (err) {
-            /*
-             * Idempotent concurrency race (see MonitorStatusTimeline.ts): a
-             * concurrent result already moved the monitor to this default status,
-             * so onBeforeCreate's dedupe check throws this exact BadDataException.
-             * Treat as a no-op at debug level rather than failing the job. Match the
-             * exact message so unrelated BadDataExceptions still propagate.
-             */
-            if (
-              err instanceof BadDataException &&
-              err.message === MONITOR_STATUS_SAME_AS_PREVIOUS_ERROR_MESSAGE
-            ) {
+            revertedToDefaultStatus = false;
+          } else {
+            try {
+              await MonitorStatusTimelineService.create({
+                data: monitorStatusTimeline,
+                props: {
+                  isRoot: true,
+                },
+              });
               logger.debug(
-                `${dataToProcess.monitorId.toString()} - Monitor status already at default; skipping duplicate status timeline (concurrent race).`,
+                `${dataToProcess.monitorId.toString()} - Monitor status updated to default.`,
               );
-            } else if (
-              err instanceof ServerException &&
-              err.message === MONITOR_STATUS_TIMELINE_LOCK_ERROR_MESSAGE
-            ) {
+            } catch (err) {
               /*
-               * The per-monitor timeline mutex could not be acquired (fail-closed
-               * create, see MonitorStatusTimelineService). Skipping is recoverable:
-               * the next probe result re-evaluates the same criteria and recreates
-               * the revert-to-default, while failing here would abort the whole
-               * ingest run and lose the monitor log for this probe result.
+               * Idempotent concurrency race (see MonitorStatusTimeline.ts): a
+               * concurrent result already moved the monitor to this default status,
+               * so onBeforeCreate's dedupe check throws this exact BadDataException.
+               * Treat as a no-op at debug level rather than failing the job. Match the
+               * exact message so unrelated BadDataExceptions still propagate.
                */
-              logger.error(
-                `${dataToProcess.monitorId.toString()} - Could not acquire the monitor status timeline lock; skipping revert to default status. It will be retried on the next probe result.`,
-              );
-              revertedToDefaultStatus = false;
-            } else {
-              throw err;
+              if (
+                err instanceof BadDataException &&
+                err.message === MONITOR_STATUS_SAME_AS_PREVIOUS_ERROR_MESSAGE
+              ) {
+                logger.debug(
+                  `${dataToProcess.monitorId.toString()} - Monitor status already at default; skipping duplicate status timeline (concurrent race).`,
+                );
+              } else if (
+                err instanceof ServerException &&
+                err.message === MONITOR_STATUS_TIMELINE_LOCK_ERROR_MESSAGE
+              ) {
+                /*
+                 * The per-monitor timeline mutex could not be acquired (fail-closed
+                 * create, see MonitorStatusTimelineService). Skipping is recoverable:
+                 * the next probe result re-evaluates the same criteria and recreates
+                 * the revert-to-default, while failing here would abort the whole
+                 * ingest run and lose the monitor log for this probe result.
+                 */
+                logger.error(
+                  `${dataToProcess.monitorId.toString()} - Could not acquire the monitor status timeline lock; skipping revert to default status. It will be retried on the next probe result.`,
+                );
+                revertedToDefaultStatus = false;
+              } else {
+                throw err;
+              }
             }
           }
 

package/Server/Utils/Monitor/MonitorStatusTimeline.ts

@@ -9,7 +9,9 @@ import MonitorStatusTimelineService, {
   MONITOR_STATUS_SAME_AS_PREVIOUS_ERROR_MESSAGE,
   MONITOR_STATUS_TIMELINE_LOCK_ERROR_MESSAGE,
 } from "../../Services/MonitorStatusTimelineService";
+import MonitorStatusService from "../../Services/MonitorStatusService";
 import ServerException from "../../../Types/Exception/ServerException";
+import ProjectScopedReferenceValidator from "../Database/ProjectScopedReferenceValidator";
 import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import DataToProcess from "./DataToProcess";
@@ -112,6 +114,40 @@ export default class MonitorStatusTimelineUtil {
         throw new BadDataException("Monitor status is not defined.");
       }
 
+      /*
+       * The criteria can name a status that no longer exists, or that belongs to
+       * another project: monitorSteps is a JSON blob with no foreign key behind
+       * it, so deleting a monitor status does not rewrite the criteria that
+       * point at it, and before issue #3039 was fixed the API accepted any uuid
+       * here in the first place. Writing it anyway is what raised
+       *   insert or update on table "MonitorStatusTimeline" violates foreign key
+       *   constraint
+       * inside the probe/telemetry worker, failing the whole ingest run for this
+       * monitor - no status change, and no monitor log or payload persisted
+       * either, because those come after this. Skip the status change and log,
+       * the same way MonitorIncident and MonitorAlert handle an unusable
+       * severity. New writes are rejected up front by
+       * MonitorStepsProjectValidator, so this only ever fires for monitors saved
+       * before that guard existed.
+       */
+      const isMonitorStatusUsable: boolean =
+        await ProjectScopedReferenceValidator.isUsableInProject({
+          projectId: input.monitor.projectId!,
+          id: monitorStatusId,
+          service: MonitorStatusService,
+        });
+
+      if (!isMonitorStatusUsable) {
+        logger.error(
+          `${input.monitor.id?.toString()} - Criteria "${
+            input.criteriaInstance.data?.name
+          }" changes the monitor status to ${monitorStatusId.toString()}, which does not exist in project ${input.monitor.projectId?.toString()}. Skipping the status change. Please pick a monitor status that exists in this project.`,
+          monitorLogAttributes,
+        );
+
+        return null;
+      }
+
       //change monitor status.
 
       // get last status of this monitor.