@oneuptime/common 12.0.24 → 12.0.26

package/Server/Utils/TwoFactorBackupCodeNotification.ts

@@ -0,0 +1,106 @@
+import Hostname from "../../Types/API/Hostname";
+import Protocol from "../../Types/API/Protocol";
+import Route from "../../Types/API/Route";
+import URL from "../../Types/API/URL";
+import OneUptimeDate from "../../Types/Date";
+import EmailTemplateType from "../../Types/Email/EmailTemplateType";
+import ObjectID from "../../Types/ObjectID";
+import { DashboardRoute } from "../../ServiceRoute";
+import User from "../../Models/DatabaseModels/User";
+import DatabaseConfig from "../DatabaseConfig";
+import MailService from "../Services/MailService";
+import UserService from "../Services/UserService";
+import logger from "./Logger";
+
+/**
+ * Tell the account holder, at their own address, that a set of recovery codes
+ * was just created for them.
+ *
+ * WHY THIS EXISTS AT ALL
+ *
+ * Backup codes are sign-in credentials. The self-service regenerate route has
+ * always mailed the owner when a set changed -- not to prevent anything, but
+ * so that a change the owner did not make is VISIBLE to them, at an address
+ * rather than in the browser that made it. Enrolment now mints codes too, and
+ * it mints them on a route authenticated by a session alone: somebody holding
+ * a stolen session can register a security key of their own and walk away with
+ * ten recovery codes for an account they do not own. Without this mail the
+ * real owner finds out at the sign-in they cannot complete.
+ *
+ * NOTHING SENSITIVE TRAVELS. The codes themselves are never mailed -- a count
+ * and a timestamp, and a link to the page where the owner can replace the set.
+ * Mailing a recovery credential would hand the account to whoever later reads
+ * the mailbox, which is exactly the second factor's job to prevent.
+ *
+ * NEVER FATAL. Every caller invokes this without awaiting it. The codes are
+ * already written and already on their way to the user's screen by the time it
+ * runs, so an unreachable mail server must not fail the request that carries
+ * the only copy of them.
+ */
+export default class TwoFactorBackupCodeNotification {
+  public static async sendCodesCreatedEmail(data: {
+    userId: ObjectID;
+    codeCount: number;
+  }): Promise<void> {
+    /*
+     * The address is read off the account rather than taken from the caller.
+     * The caller proved which user they are; it did not prove where that
+     * user's mail should go, and this notice is worth nothing if it can be
+     * pointed somewhere else.
+     */
+    const user: User | null = await UserService.findOneById({
+      id: data.userId,
+      select: {
+        email: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!user || !user.email) {
+      return;
+    }
+
+    const host: Hostname = await DatabaseConfig.getHost();
+    const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
+
+    await MailService.sendMail({
+      toEmail: user.email,
+      subject: "Backup codes were created for your OneUptime account",
+      templateType: EmailTemplateType.TwoFactorBackupCodesCreated,
+      vars: {
+        generatedAt: OneUptimeDate.getCurrentDateAsFormattedString(),
+        newCodeCount: data.codeCount.toString(),
+        twoFactorAuthUrl: new URL(
+          httpProtocol,
+          host,
+          new Route(DashboardRoute.toString()).addRoute(
+            "/user-profile/two-factor-auth",
+          ),
+        ).toString(),
+        homeUrl: new URL(httpProtocol, host).toString(),
+      },
+    });
+  }
+
+  /**
+   * Fire-and-forget wrapper, so a caller does not have to repeat the same
+   * detached-and-logged shape at every mint site.
+   *
+   * Deliberately returns void rather than the promise: a caller holding one
+   * would be tempted to await it, and awaiting is the thing this must never
+   * do. The mint sites run inside requests whose response carries the only
+   * copy of the codes.
+   */
+  public static notifyCodesCreated(data: {
+    userId: ObjectID;
+    codeCount: number;
+  }): void {
+    TwoFactorBackupCodeNotification.sendCodesCreatedEmail(data).catch(
+      (err: Error) => {
+        logger.error(err);
+      },
+    );
+  }
+}

package/Server/Utils/VM/VMAPI.ts

@@ -11,6 +11,9 @@ export default class VMUtil {
     options: {
       args?: JSONObject | undefined;
       timeout?: number;
+      // See VMRunner.runCodeInSandbox — decided by the caller, not here.
+      allowPrivateNetworkRequests?: boolean | undefined;
+      privateNetworkHint?: string | undefined;
     };
   }): Promise<ReturnResult> {
     return VMRunner.runCodeInSandbox(data);

package/Server/Utils/VM/VMRunner.ts

@@ -61,6 +61,22 @@ export default class VMRunner {
     options: {
       timeout?: number;
       args?: JSONObject | undefined;
+      /*
+       * Passed straight through to the SSRF guard on the axios bridge below.
+       * Decided by the CALLER, never here: this runner is shared between the
+       * workflow Custom JavaScript component, where the policy comes from the
+       * API server's environment, and the Probe's custom code monitor, where
+       * it comes from the probe's own environment — a different process on a
+       * different machine, usually owned by a different person. Absent ⇒ the
+       * strict policy, which is what a caller that says nothing should get.
+       */
+      allowPrivateNetworkRequests?: boolean | undefined;
+      /*
+       * Overrides the sentence a private-tier refusal appends, telling the
+       * operator which setting would permit it. Whoever runs this sandbox
+       * knows which process's environment that is; the guard does not.
+       */
+      privateNetworkHint?: string | undefined;
     };
   }): Promise<ReturnResult> {
     const { code, options } = data;
@@ -419,7 +435,17 @@ export default class VMRunner {
           config,
         });
 
-        await SSRFProtection.validateWebhookTargetIsSafe(effectiveUrl);
+        await SSRFProtection.validateWebhookTargetIsSafe(effectiveUrl, {
+          allowPrivateNetworkTargets:
+            options.allowPrivateNetworkRequests === true,
+          /*
+           * "Webhook URL" is wrong here in both directions: sandboxed code
+           * requests whatever it likes, and one of this runner's two callers
+           * is a monitor, not a webhook.
+           */
+          targetLabel: "Request URL",
+          privateNetworkHint: options.privateNetworkHint,
+        });
 
         /*
          * The URL that was just validated has to be the URL that gets

package/Server/Utils/VendorAssets.ts

@@ -44,6 +44,29 @@ export const VendorAssetsPath: string = path.resolve(
   "Vendor",
 );
 
+/**
+ * OneUptime's own brand images, served under the same prefix.
+ *
+ * Not third-party, so they do not belong in Static/Vendor, but they have the
+ * identical problem: the server-rendered pages that carry the logo (the on-call
+ * acknowledge page, the SSO message page) come out of the App container, and
+ * `/img/...` is served by Home. nginx sends "/" to App on every install with
+ * billing off - which is every self-hosted install - so the logo those pages
+ * asked for 404'd and rendered as a broken image.
+ * See https://github.com/OneUptime/oneuptime/issues/3457.
+ */
+export const BrandAssetsRouteSegment: string = "brand";
+
+export const BrandAssetsPath: string = path.resolve(
+  __dirname,
+  "..",
+  "Static",
+  "Brand",
+);
+
+/** Host-relative URL of the OneUptime wordmark, for use in a view's <img src>. */
+export const OneUptimeLogoUrl: string = `${VendorAssetsRoute}/${BrandAssetsRouteSegment}/oneuptime-logo.svg`;
+
 /**
  * Mermaid is a dependency of Common already (Common/UI renders diagrams in
  * markdown with it), so it is on disk in every image and there is no reason to
@@ -114,6 +137,25 @@ const mountVendorAssets: MountVendorAssetsFunction = (
     );
   }
 
+  if (fs.existsSync(BrandAssetsPath)) {
+    /*
+     * Revalidating rather than immutable: the filename carries no version, so
+     * a rebrand must not be stuck behind a year-old cache entry.
+     */
+    app.use(
+      `${VendorAssetsRoute}/${BrandAssetsRouteSegment}`,
+      ExpressStatic(BrandAssetsPath, {
+        maxAge: REVALIDATE_CACHE_MAX_AGE_MILLISECONDS,
+        index: false,
+        redirect: false,
+      }) as RequestHandler,
+    );
+  } else {
+    logger.error(
+      `OneUptime brand images are missing at ${BrandAssetsPath}. Server-rendered pages will render without a logo.`,
+    );
+  }
+
   const mermaidDistPath: string | null = getMermaidDistPath();
 
   if (mermaidDistPath) {

package/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.ts

@@ -108,6 +108,7 @@ import MicrosoftTeamsOnCallDutyActions from "./Actions/OnCallDutyPolicy";
  */
 import type { ObservabilityAssistantResult } from "../../AI/Chat/ObservabilityAssistant";
 import AccessTokenService from "../../../Services/AccessTokenService";
+import AIService, { AI_DISABLED_MESSAGE } from "../../../Services/AIService";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { AIChatCitation } from "../../../../Types/AI/AIChatTypes";
 
@@ -134,13 +135,33 @@ export interface MicrosoftTeamsTenantResolution {
  * Graph permission that deployments connected before it was documented have not
  * consented to, and a tenant that answers "I won't tell you" must never be
  * reported to an admin as "the app is not installed".
+ *
+ * PermissionDenied is that same "I won't tell you", separated out because it is
+ * the one flavour of Unknown the admin can fix in a minute — Microsoft is not
+ * failing, it is refusing, and it names the grant that would stop it. Folding it
+ * in with transport errors is what left admins reading a list of four possible
+ * causes when OneUptime could have told them which one it was.
  */
 export enum MicrosoftTeamsAppInstallState {
   Installed = "Installed",
   NotInstalled = "NotInstalled",
+  PermissionDenied = "PermissionDenied",
   Unknown = "Unknown",
 }
 
+/*
+ * The Graph application permission that lets OneUptime read a team's installed
+ * apps, and so tell "the app is missing" apart from "the app is there but is a
+ * different package".
+ *
+ * Server-side error text builds off this constant. The setup documentation and
+ * the docs site still spell it out literally, because prose there explains the
+ * permission rather than just naming it — if you rename it here, grep for the
+ * literal too.
+ */
+export const MICROSOFT_TEAMS_INSTALL_READ_PERMISSION: string =
+  "TeamsAppInstallation.ReadForTeam.All";
+
 /*
  * Microsoft's wording when the Bot Framework refuses a proactive post because
  * the app is not a member of the target conversation. Matched case-insensitively
@@ -1861,11 +1882,27 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
     channelName: string;
     membershipType?: string | undefined;
   }): string {
+    /*
+     * "Not installed" here means no installed app carries THIS deployment's
+     * app id — which is also what a OneUptime tile from the Teams store looks
+     * like. Saying only "add OneUptime" to an admin who is looking straight at
+     * a OneUptime tile reads as nonsense and sends them round the loop again,
+     * so name that case explicitly.
+     */
+    const wrongPackageNote: string = `If a tile named OneUptime is already listed there, it is a different package — the app from the Teams store points at OneUptime Cloud's bot and will never accept posts from this deployment. Remove it, then upload the manifest from Project Settings > Workspace > Microsoft Teams, which is the only package built with this deployment's MICROSOFT_TEAMS_APP_CLIENT_ID.`;
+
+    /*
+     * No wrong-package note for private channels. The install check reads
+     * /teams/{id}/installedApps — team scope — and a private channel needs its
+     * own channel-scope install, so a correct channel install still reads as
+     * "not installed" here. Telling that admin their package is the wrong one
+     * and to remove it would destroy a working install to fix nothing.
+     */
     if (data.membershipType === "private") {
       return `The OneUptime app is not installed in the private channel "${data.channelName}". In Microsoft Teams, open the channel, click the "..." menu, then Manage channel > Apps > Add an app, and add OneUptime. Installing OneUptime in the parent team does not cover private channels.`;
     }
 
-    return `The OneUptime app is not installed in the Microsoft Teams team that owns "${data.channelName}". In Microsoft Teams, click the "..." next to the team name, then Manage team > Apps > More apps, and add OneUptime. Installing OneUptime for yourself or in a chat is not the same as adding it to the team.`;
+    return `The OneUptime app is not installed in the Microsoft Teams team that owns "${data.channelName}". In Microsoft Teams, click the "..." next to the team name, then Manage team > Apps > More apps, and add OneUptime. Installing OneUptime for yourself or in a chat is not the same as adding it to the team. ${wrongPackageNote}`;
   }
 
   /*
@@ -1889,8 +1926,18 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
         `"${data.channelName}" is a private channel, which needs the app installed into the channel itself (channel "..." > Manage channel > Apps > Add an app) — a team-level install does not cover it`,
       );
     } else if (data.installState === MicrosoftTeamsAppInstallState.Installed) {
+      /*
+       * Graph confirmed a package carrying THIS deployment's app id is in the
+       * team, so the usual suspect — a OneUptime package from somewhere else —
+       * is largely ruled out and should not lead. "Largely", not "entirely":
+       * the check matches teamsApp.externalId, which is the manifest id, and
+       * only OneUptime's own generator guarantees that equals the bot id. A
+       * hand-edited manifest can satisfy this and still carry a foreign bot, so
+       * the wording stays probabilistic rather than promising the admin the
+       * package is fine.
+       */
       causes.push(
-        "the app is installed in this team, so the bot behind it may not be the one this OneUptime deployment uses — check that the Teams app package was built from this deployment (Project Settings > Workspace > Microsoft Teams) and that its bot id matches MICROSOFT_TEAMS_APP_CLIENT_ID",
+        "the app installed in this team already matches this deployment's MICROSOFT_TEAMS_APP_CLIENT_ID, so the package is probably not the problem — the most likely remaining cause is the Azure Bot resource, below",
       );
     } else {
       causes.push(
@@ -1902,6 +1949,23 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
       "the Azure Bot resource for this deployment does not have the Microsoft Teams channel enabled",
     );
 
+    /*
+     * The list above is a guess, and it only has to be a guess because Graph
+     * would not tell us. Say so, and say what turns it into an answer — this is
+     * the single cheapest step an admin reading this can take.
+     *
+     * The promise is hedged for private channels: the grant unlocks a
+     * team-scope read, and for a private channel the deciding fact is the
+     * channel-scope install, which that read cannot see. Worth granting anyway,
+     * just not worth promising it settles this particular send.
+     */
+    const suffixHint: string =
+      data.installState === MicrosoftTeamsAppInstallState.PermissionDenied
+        ? data.membershipType === "private"
+          ? ` OneUptime could not narrow this down because Microsoft Graph denied the installed-apps check: granting the ${MICROSOFT_TEAMS_INSTALL_READ_PERMISSION} application permission to this deployment's app registration restores that check for team-level installs, though a private channel's own install still has to be confirmed in Microsoft Teams.`
+          : ` OneUptime could not narrow this down because Microsoft Graph denied the installed-apps check: grant the ${MICROSOFT_TEAMS_INSTALL_READ_PERMISSION} application permission to this deployment's app registration, re-grant admin consent, and try again to be told which cause it is.`
+        : "";
+
     const microsoftMessage: string =
       data.microsoftError instanceof Error
         ? data.microsoftError.message
@@ -1911,7 +1975,43 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
       ? ` Microsoft's response was: "${microsoftMessage}"`
       : "";
 
-    return `Microsoft Teams refused the message to "${data.channelName}" because the OneUptime bot is not a member of that conversation. Likely causes: ${causes.join("; ")}.${suffix}`;
+    return `Microsoft Teams refused the message to "${data.channelName}" because the OneUptime bot is not a member of that conversation. Likely causes: ${causes.join("; ")}.${suffixHint}${suffix}`;
+  }
+
+  /*
+   * True when Graph refused a read rather than failing it.
+   *
+   * 403 only, deliberately. Graph answers a missing application permission with
+   * 403 and reserves 401 for a token it would not accept — an expired secret, a
+   * cached app token we did not re-check (see getValidAccessToken, which returns
+   * a stored token unvalidated when miscData carries no expiry). Treating 401 as
+   * a permission problem would send an admin off to grant a Graph permission
+   * when their credential had simply gone stale, which is the same species of
+   * wrong-but-confident answer this whole diagnostic exists to stop producing.
+   *
+   * The error codes are still matched at any status, so a permission refusal
+   * that arrives with an unexpected status is not missed.
+   */
+  public static isGraphPermissionDeniedResponse(
+    response: HTTPErrorResponse,
+  ): boolean {
+    if (response.statusCode === 403) {
+      return true;
+    }
+
+    const message: string = (response.message || "").toLowerCase();
+
+    if (!message) {
+      return false;
+    }
+
+    return [
+      "authorization_requestdenied",
+      "accessdenied",
+      "insufficient privileges",
+    ].some((fragment: string) => {
+      return message.includes(fragment);
+    });
   }
 
   /*
@@ -1924,9 +2024,11 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
    * not the weaker one an admin can answer by eye ("is something called
    * OneUptime in the app list?").
    *
-   * Every failure is Unknown. The call needs TeamsAppInstallation.ReadForTeam.All,
-   * which deployments connected before it was documented have not granted, and a
-   * missing permission must not be reported as a missing install.
+   * No failure is ever reported as NotInstalled. The call needs
+   * TeamsAppInstallation.ReadForTeam.All, which deployments connected before it
+   * was documented have not granted, and a missing permission must not be
+   * reported as a missing install. A refusal comes back as PermissionDenied so
+   * the admin is told which grant to add; everything else is Unknown.
    */
   @CaptureSpan()
   public static async isAppInstalledInTeam(data: {
@@ -1968,6 +2070,19 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
           });
 
         if (response instanceof HTTPErrorResponse) {
+          /*
+           * A refusal is not a failure. That distinction is the whole value of
+           * this call: it is the difference between "we cannot tell you which of
+           * four causes this is" and "grant this one permission and we will tell
+           * you".
+           */
+          if (this.isGraphPermissionDeniedResponse(response)) {
+            logger.warn(
+              `Cannot read installed apps for team ${data.teamId}: Microsoft Graph denied the request. Grant the ${MICROSOFT_TEAMS_INSTALL_READ_PERMISSION} application permission to this app registration and re-grant admin consent so OneUptime can verify Teams app installs.`,
+            );
+            return MicrosoftTeamsAppInstallState.PermissionDenied;
+          }
+
           logger.debug(
             `Could not read installed apps for team ${data.teamId}; treating installation as unknown.`,
           );
@@ -3232,6 +3347,21 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
       return;
     }
 
+    /*
+     * The project's AI kill switch, read before we acknowledge. The catch
+     * around the assistant below answers every failure with the same generic
+     * "I ran into a problem" — true for a provider outage, actively wrong for
+     * a setting somebody chose on purpose. Reading the switch here lets us
+     * say what actually happened, and where to undo it.
+     */
+    if (!(await AIService.isProjectAIEnabled(projectId))) {
+      logger.debug("AI Ops declined: AI is disabled for this project", {
+        projectId: projectId.toString(),
+      });
+      await turnContext.sendActivity(AI_DISABLED_MESSAGE);
+      return;
+    }
+
     /*
      * Let the user know we're working on it. The assistant runs a bounded,
      * tool-grounded agent loop and can take several seconds, so send a quick

package/Server/Utils/Workspace/Slack/Actions/Auth.ts

@@ -65,8 +65,6 @@ export default class SlackAuthAction {
     const { req } = data;
 
     logger.debug("Starting Slack request authorization");
-    logger.debug(`Request body: `);
-    logger.debug(req.body);
 
     let payload: JSONObject = req.body;
 
@@ -74,9 +72,6 @@ export default class SlackAuthAction {
       payload = JSON.parse(payload["payload"]);
     }
 
-    logger.debug(`Payload: `);
-    logger.debug(payload);
-
     let slackUserId: string | undefined = (
       (payload as JSONObject)["user"] as JSONObject
     )?.["id"] as string;
@@ -216,11 +211,6 @@ export default class SlackAuthAction {
       };
 
       actions.push(action);
-      logger.debug("View values: ");
-      logger.debug(viewValues);
-
-      logger.debug("Actions: ");
-      logger.debug(actions);
     }
 
     if (payload["callback_id"]) {
@@ -296,8 +286,6 @@ export default class SlackAuthAction {
     logger.debug("Slack request authorized successfully", {
       projectId: projectId.toString(),
     });
-    logger.debug("Slack request: ");
-    logger.debug(slackRequest);
 
     return slackRequest;
   }

package/Server/Views/AcknowledgeUserOnCallNotification.ejs

@@ -9,29 +9,31 @@
 
     <div class="h-full">
 
-        <main class="mx-auto max-w-7xl pb-10 lg:py-12 lg:px-8">
-            
+        <main class="mx-auto max-w-3xl pb-10 lg:py-12 lg:px-8">
+
             <div class="sm:mx-auto sm:w-full sm:max-w-md flex justify-center mt-10 mb-10">
                 <img
                     class="mx-auto h-12 w-auto"
-                    src="/img/3-transparent.svg"
+                    src="/oneuptime-assets/brand/oneuptime-logo.svg"
                     alt="OneUptime"
                 />
             </div>
 
 
             <div class="">
-                <!-- Payment details -->
                 <div class="space-y-6 sm:px-6 lg:col-span-9 lg:px-0">
-                    <section aria-labelledby="payment-details-heading">
-                       
+                    <section aria-labelledby="acknowledge-heading">
+
                             <div class="shadow sm:overflow-hidden sm:rounded-md">
                                 <div class="bg-white py-6 px-4 sm:p-6">
                                     <div>
-                                        <h2 id="payment-details-heading"
+                                        <h2 id="acknowledge-heading"
                                             class="text-lg font-medium leading-6 text-gray-900"><%= title %></h2>
                                         <p class="mt-1 text-sm text-gray-500"><%= message %></p>
                                     </div>
+
+                                    <%- include('./Partials/OnCallNotificationDetails.ejs') -%>
+
                                     <div>
                                         <div class="mt-6">
                                             <a href="<%= acknowledgeUrl %>"
@@ -42,7 +44,7 @@
                                     </div>
                                 </div>
                             </div>
-                        
+
                     </section>
 
 
@@ -53,4 +55,4 @@
 
 </body>
 
-</html>
+</html>

package/Server/Views/Partials/Head.ejs

@@ -74,15 +74,15 @@
 
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
-<link rel="shortcut icon" href="/img/favicons/favicon.ico">
-<link rel="apple-touch-icon" sizes="180x180" href="/img/favicons/apple-touch-icon.png">
-<link rel="icon" type="image/png" sizes="32x32" href="/img/favicons/favicon-32x32.png">
-<link rel="icon" type="image/png" sizes="16x16" href="/img/favicons/favicon-16x16.png">
-<link rel="mask-icon" href="/img/favicons/safari-pinned-tab.svg" color="#32335b">
+<link rel="shortcut icon" href="/oneuptime-assets/brand/favicons/favicon.ico">
+<link rel="apple-touch-icon" sizes="180x180" href="/oneuptime-assets/brand/favicons/apple-touch-icon.png">
+<link rel="icon" type="image/png" sizes="32x32" href="/oneuptime-assets/brand/favicons/favicon-32x32.png">
+<link rel="icon" type="image/png" sizes="16x16" href="/oneuptime-assets/brand/favicons/favicon-16x16.png">
+<link rel="mask-icon" href="/oneuptime-assets/brand/favicons/safari-pinned-tab.svg" color="#32335b">
 <meta name="msapplication-TileColor" content="#32335b">
-<link rel="apple-touch-icon-precomposed" href="/img/ou-wb.svg">
-<link rel="icon" href="/img/ou-wb.svg">
-<link rel="image_src" type="image/png" href="/img/hou-wb.svg">
+<link rel="apple-touch-icon-precomposed" href="/oneuptime-assets/brand/ou-wb.svg">
+<link rel="icon" href="/oneuptime-assets/brand/ou-wb.svg">
+<link rel="image_src" type="image/png" href="/oneuptime-assets/brand/hou-wb.svg">
 <link rel="manifest" href="/manifest.json">
 <meta property="og:title" content="OneUptime - One Complete Observability platform.">
 <meta property="og:url" content="https://oneuptime.com">
@@ -93,7 +93,7 @@
 
 <meta name="twitter:card" content="summary">
 <meta name="theme-color" content="#000000">
-<meta name="twitter:image" content="/img/ou-wb.svg">
+<meta name="twitter:image" content="/oneuptime-assets/brand/ou-wb.svg">
 <meta name="twitter:site" content="@oneuptimeinc">
 <meta name="twitter:title" content="OneUptime - One Complete Observability platform.">
 <meta name="twitter:description"

package/Server/Views/Partials/OnCallNotificationDetails.ejs

@@ -0,0 +1,48 @@
+<%
+/*
+ * Context for the resource an on-call notification was raised for, so the
+ * person following an acknowledge link from an SMS at 3am can see what they
+ * are acknowledging before they acknowledge it.
+ * See https://github.com/OneUptime/oneuptime/issues/3457.
+ *
+ * Every local is optional: these pages still render when the resource has been
+ * deleted, and a missing description must never block the acknowledgement.
+ */
+var hasResourceNumber = typeof resourceNumber !== 'undefined' && resourceNumber;
+var hasResourceTitle = typeof resourceTitle !== 'undefined' && resourceTitle;
+var hasResourceDescription = typeof resourceDescription !== 'undefined' && resourceDescription;
+var resourceDetails = (typeof details !== 'undefined' && details) ? details : [];
+var hasAnyContext = hasResourceTitle || hasResourceDescription || resourceDetails.length > 0;
+%>
+<% if (hasAnyContext) { %>
+<div class="mt-6 border-t border-gray-200 pt-6">
+    <% if (hasResourceTitle) { %>
+    <div class="flex flex-wrap items-center">
+        <% if (hasResourceNumber) { %>
+        <span class="mr-2 inline-flex items-center rounded-md bg-gray-100 px-2 py-1 text-xs font-medium text-gray-600"><%= resourceNumber %></span>
+        <% } %>
+        <h3 class="text-base font-semibold leading-6 text-gray-900"><%= resourceTitle %></h3>
+    </div>
+    <% } %>
+
+    <% if (hasResourceDescription) { %>
+    <p class="mt-2 whitespace-pre-line text-sm text-gray-600"><%= resourceDescription %></p>
+    <% } %>
+
+    <% if (resourceDetails.length > 0) { %>
+    <dl class="mt-5 grid grid-cols-1 gap-x-6 gap-y-4 sm:grid-cols-2">
+        <% resourceDetails.forEach(function (detail) { %>
+        <div>
+            <dt class="text-xs font-medium uppercase tracking-wide text-gray-500"><%= detail.label %></dt>
+            <dd class="mt-1 flex items-center text-sm text-gray-900">
+                <% if (detail.color) { %>
+                <span class="mr-2 inline-block h-2.5 w-2.5 flex-none rounded-full" style="background-color: <%= detail.color %>"></span>
+                <% } %>
+                <span><%= detail.value %></span>
+            </dd>
+        </div>
+        <% }); %>
+    </dl>
+    <% } %>
+</div>
+<% } %>

package/Server/Views/ViewMessage.ejs

@@ -9,29 +9,31 @@
 
     <div class="h-full">
 
-        <main class="mx-auto max-w-7xl pb-10 lg:py-12 lg:px-8">
-            
+        <main class="mx-auto max-w-3xl pb-10 lg:py-12 lg:px-8">
+
             <div class="sm:mx-auto sm:w-full sm:max-w-md flex justify-center mt-10 mb-10">
                 <img
                     class="mx-auto h-12 w-auto"
-                    src="/img/3-transparent.svg"
+                    src="/oneuptime-assets/brand/oneuptime-logo.svg"
                     alt="OneUptime"
                 />
             </div>
 
 
             <div class="">
-                <!-- Payment details -->
                 <div class="space-y-6 sm:px-6 lg:col-span-9 lg:px-0">
-                    <section aria-labelledby="payment-details-heading">
-                       
+                    <section aria-labelledby="message-heading">
+
                             <div class="shadow sm:overflow-hidden sm:rounded-md">
                                 <div class="bg-white py-6 px-4 sm:p-6">
                                     <div>
-                                        <h2 id="payment-details-heading"
+                                        <h2 id="message-heading"
                                             class="text-lg font-medium leading-6 text-gray-900"><%= title %></h2>
                                         <p class="mt-1 text-sm text-gray-500"><%= message %></p>
                                     </div>
+
+                                    <%- include('./Partials/OnCallNotificationDetails.ejs') -%>
+
                                     <div>
                                         <div class="mt-6">
                                             <a href="<%= viewDetailsUrl %>"
@@ -42,7 +44,7 @@
                                     </div>
                                 </div>
                             </div>
-                        
+
                     </section>
 
 
@@ -53,4 +55,4 @@
 
 </body>
 
-</html>
+</html>