@oneuptime/common 12.0.25 → 12.0.27

package/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.ts

@@ -108,6 +108,7 @@ import MicrosoftTeamsOnCallDutyActions from "./Actions/OnCallDutyPolicy";
  */
 import type { ObservabilityAssistantResult } from "../../AI/Chat/ObservabilityAssistant";
 import AccessTokenService from "../../../Services/AccessTokenService";
+import AIService, { AI_DISABLED_MESSAGE } from "../../../Services/AIService";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { AIChatCitation } from "../../../../Types/AI/AIChatTypes";
 
@@ -134,13 +135,33 @@ export interface MicrosoftTeamsTenantResolution {
  * Graph permission that deployments connected before it was documented have not
  * consented to, and a tenant that answers "I won't tell you" must never be
  * reported to an admin as "the app is not installed".
+ *
+ * PermissionDenied is that same "I won't tell you", separated out because it is
+ * the one flavour of Unknown the admin can fix in a minute — Microsoft is not
+ * failing, it is refusing, and it names the grant that would stop it. Folding it
+ * in with transport errors is what left admins reading a list of four possible
+ * causes when OneUptime could have told them which one it was.
  */
 export enum MicrosoftTeamsAppInstallState {
   Installed = "Installed",
   NotInstalled = "NotInstalled",
+  PermissionDenied = "PermissionDenied",
   Unknown = "Unknown",
 }
 
+/*
+ * The Graph application permission that lets OneUptime read a team's installed
+ * apps, and so tell "the app is missing" apart from "the app is there but is a
+ * different package".
+ *
+ * Server-side error text builds off this constant. The setup documentation and
+ * the docs site still spell it out literally, because prose there explains the
+ * permission rather than just naming it — if you rename it here, grep for the
+ * literal too.
+ */
+export const MICROSOFT_TEAMS_INSTALL_READ_PERMISSION: string =
+  "TeamsAppInstallation.ReadForTeam.All";
+
 /*
  * Microsoft's wording when the Bot Framework refuses a proactive post because
  * the app is not a member of the target conversation. Matched case-insensitively
@@ -1861,11 +1882,27 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
     channelName: string;
     membershipType?: string | undefined;
   }): string {
+    /*
+     * "Not installed" here means no installed app carries THIS deployment's
+     * app id — which is also what a OneUptime tile from the Teams store looks
+     * like. Saying only "add OneUptime" to an admin who is looking straight at
+     * a OneUptime tile reads as nonsense and sends them round the loop again,
+     * so name that case explicitly.
+     */
+    const wrongPackageNote: string = `If a tile named OneUptime is already listed there, it is a different package — the app from the Teams store points at OneUptime Cloud's bot and will never accept posts from this deployment. Remove it, then upload the manifest from Project Settings > Workspace > Microsoft Teams, which is the only package built with this deployment's MICROSOFT_TEAMS_APP_CLIENT_ID.`;
+
+    /*
+     * No wrong-package note for private channels. The install check reads
+     * /teams/{id}/installedApps — team scope — and a private channel needs its
+     * own channel-scope install, so a correct channel install still reads as
+     * "not installed" here. Telling that admin their package is the wrong one
+     * and to remove it would destroy a working install to fix nothing.
+     */
     if (data.membershipType === "private") {
       return `The OneUptime app is not installed in the private channel "${data.channelName}". In Microsoft Teams, open the channel, click the "..." menu, then Manage channel > Apps > Add an app, and add OneUptime. Installing OneUptime in the parent team does not cover private channels.`;
     }
 
-    return `The OneUptime app is not installed in the Microsoft Teams team that owns "${data.channelName}". In Microsoft Teams, click the "..." next to the team name, then Manage team > Apps > More apps, and add OneUptime. Installing OneUptime for yourself or in a chat is not the same as adding it to the team.`;
+    return `The OneUptime app is not installed in the Microsoft Teams team that owns "${data.channelName}". In Microsoft Teams, click the "..." next to the team name, then Manage team > Apps > More apps, and add OneUptime. Installing OneUptime for yourself or in a chat is not the same as adding it to the team. ${wrongPackageNote}`;
   }
 
   /*
@@ -1889,8 +1926,18 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
         `"${data.channelName}" is a private channel, which needs the app installed into the channel itself (channel "..." > Manage channel > Apps > Add an app) — a team-level install does not cover it`,
       );
     } else if (data.installState === MicrosoftTeamsAppInstallState.Installed) {
+      /*
+       * Graph confirmed a package carrying THIS deployment's app id is in the
+       * team, so the usual suspect — a OneUptime package from somewhere else —
+       * is largely ruled out and should not lead. "Largely", not "entirely":
+       * the check matches teamsApp.externalId, which is the manifest id, and
+       * only OneUptime's own generator guarantees that equals the bot id. A
+       * hand-edited manifest can satisfy this and still carry a foreign bot, so
+       * the wording stays probabilistic rather than promising the admin the
+       * package is fine.
+       */
       causes.push(
-        "the app is installed in this team, so the bot behind it may not be the one this OneUptime deployment uses — check that the Teams app package was built from this deployment (Project Settings > Workspace > Microsoft Teams) and that its bot id matches MICROSOFT_TEAMS_APP_CLIENT_ID",
+        "the app installed in this team already matches this deployment's MICROSOFT_TEAMS_APP_CLIENT_ID, so the package is probably not the problem — the most likely remaining cause is the Azure Bot resource, below",
       );
     } else {
       causes.push(
@@ -1902,6 +1949,23 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
       "the Azure Bot resource for this deployment does not have the Microsoft Teams channel enabled",
     );
 
+    /*
+     * The list above is a guess, and it only has to be a guess because Graph
+     * would not tell us. Say so, and say what turns it into an answer — this is
+     * the single cheapest step an admin reading this can take.
+     *
+     * The promise is hedged for private channels: the grant unlocks a
+     * team-scope read, and for a private channel the deciding fact is the
+     * channel-scope install, which that read cannot see. Worth granting anyway,
+     * just not worth promising it settles this particular send.
+     */
+    const suffixHint: string =
+      data.installState === MicrosoftTeamsAppInstallState.PermissionDenied
+        ? data.membershipType === "private"
+          ? ` OneUptime could not narrow this down because Microsoft Graph denied the installed-apps check: granting the ${MICROSOFT_TEAMS_INSTALL_READ_PERMISSION} application permission to this deployment's app registration restores that check for team-level installs, though a private channel's own install still has to be confirmed in Microsoft Teams.`
+          : ` OneUptime could not narrow this down because Microsoft Graph denied the installed-apps check: grant the ${MICROSOFT_TEAMS_INSTALL_READ_PERMISSION} application permission to this deployment's app registration, re-grant admin consent, and try again to be told which cause it is.`
+        : "";
+
     const microsoftMessage: string =
       data.microsoftError instanceof Error
         ? data.microsoftError.message
@@ -1911,7 +1975,43 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
       ? ` Microsoft's response was: "${microsoftMessage}"`
       : "";
 
-    return `Microsoft Teams refused the message to "${data.channelName}" because the OneUptime bot is not a member of that conversation. Likely causes: ${causes.join("; ")}.${suffix}`;
+    return `Microsoft Teams refused the message to "${data.channelName}" because the OneUptime bot is not a member of that conversation. Likely causes: ${causes.join("; ")}.${suffixHint}${suffix}`;
+  }
+
+  /*
+   * True when Graph refused a read rather than failing it.
+   *
+   * 403 only, deliberately. Graph answers a missing application permission with
+   * 403 and reserves 401 for a token it would not accept — an expired secret, a
+   * cached app token we did not re-check (see getValidAccessToken, which returns
+   * a stored token unvalidated when miscData carries no expiry). Treating 401 as
+   * a permission problem would send an admin off to grant a Graph permission
+   * when their credential had simply gone stale, which is the same species of
+   * wrong-but-confident answer this whole diagnostic exists to stop producing.
+   *
+   * The error codes are still matched at any status, so a permission refusal
+   * that arrives with an unexpected status is not missed.
+   */
+  public static isGraphPermissionDeniedResponse(
+    response: HTTPErrorResponse,
+  ): boolean {
+    if (response.statusCode === 403) {
+      return true;
+    }
+
+    const message: string = (response.message || "").toLowerCase();
+
+    if (!message) {
+      return false;
+    }
+
+    return [
+      "authorization_requestdenied",
+      "accessdenied",
+      "insufficient privileges",
+    ].some((fragment: string) => {
+      return message.includes(fragment);
+    });
   }
 
   /*
@@ -1924,9 +2024,11 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
    * not the weaker one an admin can answer by eye ("is something called
    * OneUptime in the app list?").
    *
-   * Every failure is Unknown. The call needs TeamsAppInstallation.ReadForTeam.All,
-   * which deployments connected before it was documented have not granted, and a
-   * missing permission must not be reported as a missing install.
+   * No failure is ever reported as NotInstalled. The call needs
+   * TeamsAppInstallation.ReadForTeam.All, which deployments connected before it
+   * was documented have not granted, and a missing permission must not be
+   * reported as a missing install. A refusal comes back as PermissionDenied so
+   * the admin is told which grant to add; everything else is Unknown.
    */
   @CaptureSpan()
   public static async isAppInstalledInTeam(data: {
@@ -1968,6 +2070,19 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
           });
 
         if (response instanceof HTTPErrorResponse) {
+          /*
+           * A refusal is not a failure. That distinction is the whole value of
+           * this call: it is the difference between "we cannot tell you which of
+           * four causes this is" and "grant this one permission and we will tell
+           * you".
+           */
+          if (this.isGraphPermissionDeniedResponse(response)) {
+            logger.warn(
+              `Cannot read installed apps for team ${data.teamId}: Microsoft Graph denied the request. Grant the ${MICROSOFT_TEAMS_INSTALL_READ_PERMISSION} application permission to this app registration and re-grant admin consent so OneUptime can verify Teams app installs.`,
+            );
+            return MicrosoftTeamsAppInstallState.PermissionDenied;
+          }
+
           logger.debug(
             `Could not read installed apps for team ${data.teamId}; treating installation as unknown.`,
           );
@@ -3232,6 +3347,21 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
       return;
     }
 
+    /*
+     * The project's AI kill switch, read before we acknowledge. The catch
+     * around the assistant below answers every failure with the same generic
+     * "I ran into a problem" — true for a provider outage, actively wrong for
+     * a setting somebody chose on purpose. Reading the switch here lets us
+     * say what actually happened, and where to undo it.
+     */
+    if (!(await AIService.isProjectAIEnabled(projectId))) {
+      logger.debug("AI Ops declined: AI is disabled for this project", {
+        projectId: projectId.toString(),
+      });
+      await turnContext.sendActivity(AI_DISABLED_MESSAGE);
+      return;
+    }
+
     /*
      * Let the user know we're working on it. The assistant runs a bounded,
      * tool-grounded agent loop and can take several seconds, so send a quick

package/Server/Views/AcknowledgeUserOnCallNotification.ejs

@@ -9,29 +9,31 @@
 
     <div class="h-full">
 
-        <main class="mx-auto max-w-7xl pb-10 lg:py-12 lg:px-8">
-            
+        <main class="mx-auto max-w-3xl pb-10 lg:py-12 lg:px-8">
+
             <div class="sm:mx-auto sm:w-full sm:max-w-md flex justify-center mt-10 mb-10">
                 <img
                     class="mx-auto h-12 w-auto"
-                    src="/img/3-transparent.svg"
+                    src="/oneuptime-assets/brand/oneuptime-logo.svg"
                     alt="OneUptime"
                 />
             </div>
 
 
             <div class="">
-                <!-- Payment details -->
                 <div class="space-y-6 sm:px-6 lg:col-span-9 lg:px-0">
-                    <section aria-labelledby="payment-details-heading">
-                       
+                    <section aria-labelledby="acknowledge-heading">
+
                             <div class="shadow sm:overflow-hidden sm:rounded-md">
                                 <div class="bg-white py-6 px-4 sm:p-6">
                                     <div>
-                                        <h2 id="payment-details-heading"
+                                        <h2 id="acknowledge-heading"
                                             class="text-lg font-medium leading-6 text-gray-900"><%= title %></h2>
                                         <p class="mt-1 text-sm text-gray-500"><%= message %></p>
                                     </div>
+
+                                    <%- include('./Partials/OnCallNotificationDetails.ejs') -%>
+
                                     <div>
                                         <div class="mt-6">
                                             <a href="<%= acknowledgeUrl %>"
@@ -42,7 +44,7 @@
                                     </div>
                                 </div>
                             </div>
-                        
+
                     </section>
 
 
@@ -53,4 +55,4 @@
 
 </body>
 
-</html>
+</html>

package/Server/Views/Partials/Head.ejs

@@ -74,15 +74,15 @@
 
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
-<link rel="shortcut icon" href="/img/favicons/favicon.ico">
-<link rel="apple-touch-icon" sizes="180x180" href="/img/favicons/apple-touch-icon.png">
-<link rel="icon" type="image/png" sizes="32x32" href="/img/favicons/favicon-32x32.png">
-<link rel="icon" type="image/png" sizes="16x16" href="/img/favicons/favicon-16x16.png">
-<link rel="mask-icon" href="/img/favicons/safari-pinned-tab.svg" color="#32335b">
+<link rel="shortcut icon" href="/oneuptime-assets/brand/favicons/favicon.ico">
+<link rel="apple-touch-icon" sizes="180x180" href="/oneuptime-assets/brand/favicons/apple-touch-icon.png">
+<link rel="icon" type="image/png" sizes="32x32" href="/oneuptime-assets/brand/favicons/favicon-32x32.png">
+<link rel="icon" type="image/png" sizes="16x16" href="/oneuptime-assets/brand/favicons/favicon-16x16.png">
+<link rel="mask-icon" href="/oneuptime-assets/brand/favicons/safari-pinned-tab.svg" color="#32335b">
 <meta name="msapplication-TileColor" content="#32335b">
-<link rel="apple-touch-icon-precomposed" href="/img/ou-wb.svg">
-<link rel="icon" href="/img/ou-wb.svg">
-<link rel="image_src" type="image/png" href="/img/hou-wb.svg">
+<link rel="apple-touch-icon-precomposed" href="/oneuptime-assets/brand/ou-wb.svg">
+<link rel="icon" href="/oneuptime-assets/brand/ou-wb.svg">
+<link rel="image_src" type="image/png" href="/oneuptime-assets/brand/hou-wb.svg">
 <link rel="manifest" href="/manifest.json">
 <meta property="og:title" content="OneUptime - One Complete Observability platform.">
 <meta property="og:url" content="https://oneuptime.com">
@@ -93,7 +93,7 @@
 
 <meta name="twitter:card" content="summary">
 <meta name="theme-color" content="#000000">
-<meta name="twitter:image" content="/img/ou-wb.svg">
+<meta name="twitter:image" content="/oneuptime-assets/brand/ou-wb.svg">
 <meta name="twitter:site" content="@oneuptimeinc">
 <meta name="twitter:title" content="OneUptime - One Complete Observability platform.">
 <meta name="twitter:description"

package/Server/Views/Partials/OnCallNotificationDetails.ejs

@@ -0,0 +1,48 @@
+<%
+/*
+ * Context for the resource an on-call notification was raised for, so the
+ * person following an acknowledge link from an SMS at 3am can see what they
+ * are acknowledging before they acknowledge it.
+ * See https://github.com/OneUptime/oneuptime/issues/3457.
+ *
+ * Every local is optional: these pages still render when the resource has been
+ * deleted, and a missing description must never block the acknowledgement.
+ */
+var hasResourceNumber = typeof resourceNumber !== 'undefined' && resourceNumber;
+var hasResourceTitle = typeof resourceTitle !== 'undefined' && resourceTitle;
+var hasResourceDescription = typeof resourceDescription !== 'undefined' && resourceDescription;
+var resourceDetails = (typeof details !== 'undefined' && details) ? details : [];
+var hasAnyContext = hasResourceTitle || hasResourceDescription || resourceDetails.length > 0;
+%>
+<% if (hasAnyContext) { %>
+<div class="mt-6 border-t border-gray-200 pt-6">
+    <% if (hasResourceTitle) { %>
+    <div class="flex flex-wrap items-center">
+        <% if (hasResourceNumber) { %>
+        <span class="mr-2 inline-flex items-center rounded-md bg-gray-100 px-2 py-1 text-xs font-medium text-gray-600"><%= resourceNumber %></span>
+        <% } %>
+        <h3 class="text-base font-semibold leading-6 text-gray-900"><%= resourceTitle %></h3>
+    </div>
+    <% } %>
+
+    <% if (hasResourceDescription) { %>
+    <p class="mt-2 whitespace-pre-line text-sm text-gray-600"><%= resourceDescription %></p>
+    <% } %>
+
+    <% if (resourceDetails.length > 0) { %>
+    <dl class="mt-5 grid grid-cols-1 gap-x-6 gap-y-4 sm:grid-cols-2">
+        <% resourceDetails.forEach(function (detail) { %>
+        <div>
+            <dt class="text-xs font-medium uppercase tracking-wide text-gray-500"><%= detail.label %></dt>
+            <dd class="mt-1 flex items-center text-sm text-gray-900">
+                <% if (detail.color) { %>
+                <span class="mr-2 inline-block h-2.5 w-2.5 flex-none rounded-full" style="background-color: <%= detail.color %>"></span>
+                <% } %>
+                <span><%= detail.value %></span>
+            </dd>
+        </div>
+        <% }); %>
+    </dl>
+    <% } %>
+</div>
+<% } %>

package/Server/Views/ViewMessage.ejs

@@ -9,29 +9,31 @@
 
     <div class="h-full">
 
-        <main class="mx-auto max-w-7xl pb-10 lg:py-12 lg:px-8">
-            
+        <main class="mx-auto max-w-3xl pb-10 lg:py-12 lg:px-8">
+
             <div class="sm:mx-auto sm:w-full sm:max-w-md flex justify-center mt-10 mb-10">
                 <img
                     class="mx-auto h-12 w-auto"
-                    src="/img/3-transparent.svg"
+                    src="/oneuptime-assets/brand/oneuptime-logo.svg"
                     alt="OneUptime"
                 />
             </div>
 
 
             <div class="">
-                <!-- Payment details -->
                 <div class="space-y-6 sm:px-6 lg:col-span-9 lg:px-0">
-                    <section aria-labelledby="payment-details-heading">
-                       
+                    <section aria-labelledby="message-heading">
+
                             <div class="shadow sm:overflow-hidden sm:rounded-md">
                                 <div class="bg-white py-6 px-4 sm:p-6">
                                     <div>
-                                        <h2 id="payment-details-heading"
+                                        <h2 id="message-heading"
                                             class="text-lg font-medium leading-6 text-gray-900"><%= title %></h2>
                                         <p class="mt-1 text-sm text-gray-500"><%= message %></p>
                                     </div>
+
+                                    <%- include('./Partials/OnCallNotificationDetails.ejs') -%>
+
                                     <div>
                                         <div class="mt-6">
                                             <a href="<%= viewDetailsUrl %>"
@@ -42,7 +44,7 @@
                                     </div>
                                 </div>
                             </div>
-                        
+
                     </section>
 
 
@@ -53,4 +55,4 @@
 
 </body>
 
-</html>
+</html>