@oneuptime/common 12.0.28 → 12.0.30

package/Server/Services/LogPipelineProcessorService.ts

@@ -1,10 +1,98 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/LogPipelineProcessor";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import { JSONObject } from "../../Types/JSON";
+import { validateLogPipelineProcessor } from "../Utils/LogPipelineProcessorValidation";
+
+/*
+ * `PartialEntity` values may be `() => string` raw SQL expressions rather
+ * than literals. One cannot be evaluated here, so an update that sets a
+ * validated field to an expression is skipped - validating a stringified
+ * function would be worse than not validating at all. Nothing in the
+ * product writes processor fields this way.
+ */
+function isSqlExpressionValue(value: unknown): boolean {
+  return typeof value === "function";
+}
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    validateLogPipelineProcessor({
+      processorType: createBy.data.processorType,
+      configuration: createBy.data.configuration as JSONObject | undefined,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * An edit can break a row without naming both fields: switching
+     * `processorType` to GrokParser while the stored configuration is
+     * still a severity-remapper blob, or replacing the pattern on a row
+     * that is already a GrokParser. So validate the MERGED row.
+     *
+     * Only pay for the SELECT when the update touches one of them.
+     * Processor edits are rare, human-driven config changes - this is
+     * not a hot path.
+     */
+    const incomingProcessorType: unknown = updateBy.data.processorType;
+    const incomingConfiguration: unknown = updateBy.data.configuration;
+
+    if (
+      incomingProcessorType === undefined &&
+      incomingConfiguration === undefined
+    ) {
+      return { updateBy, carryForward: null };
+    }
+
+    if (
+      isSqlExpressionValue(incomingProcessorType) ||
+      isSqlExpressionValue(incomingConfiguration)
+    ) {
+      return { updateBy, carryForward: null };
+    }
+
+    const existingRows: Array<Model> = await this.findBy({
+      query: updateBy.query,
+      skip: 0,
+      limit: LIMIT_MAX,
+      select: {
+        _id: true,
+        processorType: true,
+        configuration: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const existing of existingRows) {
+      validateLogPipelineProcessor({
+        processorType:
+          incomingProcessorType !== undefined
+            ? (incomingProcessorType as string | null)
+            : existing.processorType,
+        configuration:
+          incomingConfiguration !== undefined
+            ? (incomingConfiguration as JSONObject | string | null)
+            : (existing.configuration as JSONObject | undefined),
+      });
+    }
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();

package/Server/Services/MonitorTemplateService.ts

@@ -6,6 +6,7 @@ import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import MonitorStepsProjectValidator from "../Utils/Monitor/MonitorStepsProjectValidator";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
+import Includes from "../../Types/BaseDatabase/Includes";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import { JSONObject } from "../../Types/JSON";
 import MonitorSteps from "../../Types/Monitor/MonitorSteps";
@@ -275,7 +276,7 @@ export class Service extends DatabaseService<Model> {
             monitorSteps: true,
             autoProvisionedNetworkDeviceId: true,
           },
-          sort: { createdAt: SortOrder.Ascending },
+          sort: { createdAt: SortOrder.Ascending, _id: SortOrder.Ascending },
           limit: LIMIT_MAX,
           skip: skip,
           props: { isRoot: true },
@@ -321,16 +322,74 @@ export class Service extends DatabaseService<Model> {
       return { totalLinkedMonitors, syncedMonitors };
     }
 
-    const syncedMonitors: number = await MonitorService.updateBy({
-      query: {
-        monitorTemplateId: template.id!,
-        projectId: template.projectId,
-      },
-      data: updateData as any,
-      limit: LIMIT_MAX,
-      skip: 0,
-      props: data.props,
-    });
+    /*
+     * A single updateBy is capped at its `limit`, so a template with more
+     * linked monitors than LIMIT_MAX used to leave the remainder on the old
+     * config and still return success. Offset paging cannot fix that here:
+     * updateBy takes no sort, and rewriting a row moves its tuple, so a
+     * second page at a higher skip can step over rows the first page moved.
+     * Page the ids first instead, then update by id batch.
+     *
+     * `_id` rides along in the sort because skip/limit paging is only stable
+     * over a total order: a fleet provisioned by one auto-import run shares a
+     * createdAt, and without the tiebreaker a tie straddling a page boundary
+     * returns one row twice and another never — which here would inflate
+     * syncedMonitors by exactly the number of rows it dropped.
+     */
+    const linkedMonitorIds: Array<ObjectID> = [];
+
+    for (let skip: number = 0; ; skip += LIMIT_MAX) {
+      const monitors: Array<Monitor> = await MonitorService.findBy({
+        query: {
+          monitorTemplateId: template.id!,
+          projectId: template.projectId,
+        },
+        select: { _id: true },
+        sort: { createdAt: SortOrder.Ascending, _id: SortOrder.Ascending },
+        limit: LIMIT_MAX,
+        skip: skip,
+        props: { isRoot: true },
+      });
+
+      for (const monitor of monitors) {
+        linkedMonitorIds.push(monitor.id!);
+      }
+
+      if (monitors.length < LIMIT_MAX) {
+        break;
+      }
+    }
+
+    let syncedMonitors: number = 0;
+
+    for (
+      let batchStart: number = 0;
+      batchStart < linkedMonitorIds.length;
+      batchStart += LIMIT_MAX
+    ) {
+      const batch: Array<ObjectID> = linkedMonitorIds.slice(
+        batchStart,
+        batchStart + LIMIT_MAX,
+      );
+
+      /*
+       * Still scoped by template and project, so a stale id from the paging
+       * read above cannot widen the write beyond this template's fleet.
+       * props stays the caller's — updateBy narrows each batch to what they
+       * may actually update.
+       */
+      syncedMonitors += await MonitorService.updateBy({
+        query: {
+          _id: new Includes(batch),
+          monitorTemplateId: template.id!,
+          projectId: template.projectId,
+        },
+        data: updateData as any,
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: data.props,
+      });
+    }
 
     return {
       totalLinkedMonitors,

package/Server/Services/OnCallDutyPolicyEscalationRuleScheduleService.ts

@@ -25,12 +25,35 @@ import { WhatsAppMessagePayload } from "../../Types/WhatsApp/WhatsAppMessage";
 import OnCallDutyPolicyTimeLogService from "./OnCallDutyPolicyTimeLogService";
 import OneUptimeDate from "../../Types/Date";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /**
+   * Attaching to / detaching from a policy changes the schedule's policy
+   * context (which overrides apply, and which policies its calendar events
+   * list), so it is a configuration change for the calendar feeds and the
+   * reminders: bump shiftConfigVersion, purge the feed caches, notify the
+   * listeners. Runs after the roster refresh; never throws.
+   */
+  private async propagateAttachmentChange(
+    onCallDutyPolicyScheduleId: ObjectID | null | undefined,
+    projectId: ObjectID | null | undefined,
+  ): Promise<void> {
+    if (!onCallDutyPolicyScheduleId) {
+      return;
+    }
+
+    await OnCallDutyPolicyScheduleService.propagateShiftConfigChange({
+      scheduleIds: [onCallDutyPolicyScheduleId],
+      projectId: projectId || null,
+      reason: OnCallShiftChangeReason.PolicyAttachmentChanged,
+    });
+  }
+
   /**
    * Re-resolve and persist the schedule's roster after it is attached to, or
    * detached from, an on-call policy.
@@ -123,6 +146,11 @@ export class Service extends DatabaseService<Model> {
      */
     await this.refreshScheduleRoster(createdModel.onCallDutyPolicyScheduleId);
 
+    await this.propagateAttachmentChange(
+      createdModel.onCallDutyPolicyScheduleId,
+      createdModel.projectId,
+    );
+
     // send notification to the new current user.
 
     const userOnSchedule: ObjectID | null =
@@ -387,6 +415,10 @@ export class Service extends DatabaseService<Model> {
       }
       refreshedScheduleIds.add(scheduleId);
       await this.refreshScheduleRoster(deletedItem.onCallDutyPolicyScheduleId);
+      await this.propagateAttachmentChange(
+        deletedItem.onCallDutyPolicyScheduleId,
+        deletedItem.projectId,
+      );
     }
 
     for (const deletedItem of deletedItems) {

package/Server/Services/OnCallDutyPolicyScheduleCalendarFeedService.ts

@@ -0,0 +1,260 @@
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
+import CalendarFeedToken, {
+  CalendarFeedRotation,
+} from "../Utils/OnCall/CalendarFeedToken";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model from "../../Models/DatabaseModels/OnCallDutyPolicyScheduleCalendarFeed";
+import OnCallDutyPolicySchedule from "../../Models/DatabaseModels/OnCallDutyPolicySchedule";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import CalendarFeedWindow from "../../Types/OnCallDutyPolicy/CalendarFeedWindow";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+
+/*
+ * Bounds for the coverage-gap threshold: a gap shorter than a minute is a
+ * seam artefact, and a threshold longer than a week would never emit.
+ */
+export const MIN_MINIMUM_GAP_MINUTES: number = 1;
+export const MAX_MINIMUM_GAP_MINUTES: number = 7 * 24 * 60;
+
+/*
+ * The shared, project-owned calendar feed of one on-call schedule.
+ *
+ * WHAT THE HOOKS GUARANTEE
+ *
+ *   - The schedule exists in the caller's project. The foreign key alone
+ *     would accept a schedule from another project (the FK does not know
+ *     about tenants), and a feed that renders another project's roster to
+ *     whoever holds this project's link is exactly the leak the tenant column
+ *     exists to prevent.
+ *   - One feed per schedule. The unique index enforces it at the database;
+ *     the hook turns the constraint violation into a message a person can
+ *     act on.
+ *   - The token is minted HERE, on every create, whatever the request
+ *     carried. Publishing a feed is a normal, permission-checked create
+ *     (the schedule's Edit list), and the plaintext is then read back by the
+ *     calendar API's `/current` route through the encrypted `token` column.
+ *   - pastDays / futureDays are clamped and minimumGapMinutes is bounded on
+ *     every write.
+ *
+ * rotateTokenById and rotateFeedsForMemberLeave are root writes for the
+ * calendar API and the team-member cleanup respectively; cache purging stays
+ * with the caller.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    const scheduleId: ObjectID | undefined =
+      createBy.data.onCallDutyPolicyScheduleId;
+
+    if (!scheduleId) {
+      throw new BadDataException("onCallDutyPolicyScheduleId is required");
+    }
+
+    createBy.data.projectId = projectId;
+
+    const schedule: OnCallDutyPolicySchedule | null =
+      await OnCallDutyPolicyScheduleService.findOneBy({
+        query: {
+          _id: scheduleId,
+          projectId: projectId,
+        },
+        select: {
+          _id: true,
+        },
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+
+    if (!schedule) {
+      throw new BadDataException("On-call schedule not found in this project.");
+    }
+
+    const existing: PositiveNumber = await this.countBy({
+      query: {
+        onCallDutyPolicyScheduleId: scheduleId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (existing.toNumber() > 0) {
+      throw new BadDataException(
+        "This schedule already has a shared calendar feed. Regenerate or edit the existing one instead.",
+      );
+    }
+
+    /*
+     * A request body never chooses the secret. Root callers (the calendar
+     * API) may pass a token they minted so they can answer with the URL in
+     * the same response; everyone else gets a fresh mint.
+     */
+    CalendarFeedToken.applyTokenColumnsOnCreate(createBy.data, {
+      trustSuppliedToken: createBy.props.isRoot === true,
+    });
+
+    createBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+      createBy.data.pastDays,
+    );
+    createBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+      createBy.data.futureDays,
+    );
+
+    if (createBy.data.minimumGapMinutes !== undefined) {
+      createBy.data.minimumGapMinutes = Service.validateMinimumGapMinutes(
+        createBy.data.minimumGapMinutes,
+      );
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.pastDays !== undefined) {
+      updateBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+        updateBy.data.pastDays,
+      );
+    }
+
+    if (updateBy.data.futureDays !== undefined) {
+      updateBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+        updateBy.data.futureDays,
+      );
+    }
+
+    if (updateBy.data.minimumGapMinutes !== undefined) {
+      updateBy.data.minimumGapMinutes = Service.validateMinimumGapMinutes(
+        updateBy.data.minimumGapMinutes,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * A whole number of minutes between MIN_MINIMUM_GAP_MINUTES and
+   * MAX_MINIMUM_GAP_MINUTES. Numeric strings are accepted because a root
+   * caller may hand over what a form posted; anything else is a 400.
+   */
+  public static validateMinimumGapMinutes(value: unknown): number {
+    const parsed: number =
+      typeof value === "string" && value.trim() !== ""
+        ? Number(value)
+        : (value as number);
+
+    if (
+      typeof parsed !== "number" ||
+      !Number.isInteger(parsed) ||
+      parsed < MIN_MINIMUM_GAP_MINUTES ||
+      parsed > MAX_MINIMUM_GAP_MINUTES
+    ) {
+      throw new BadDataException(
+        `Minimum gap must be a whole number of minutes between ${MIN_MINIMUM_GAP_MINUTES} and ${MAX_MINIMUM_GAP_MINUTES}.`,
+      );
+    }
+
+    return parsed;
+  }
+
+  /**
+   * Rotate the token of an existing feed: mint a new one, move the current
+   * hash into the 30-day grace slot, stamp rotatedAt. Returns the new
+   * plaintext token ONCE. Root write; the caller purges caches.
+   */
+  @CaptureSpan()
+  public async rotateTokenById(data: {
+    id: ObjectID;
+  }): Promise<CalendarFeedRotation> {
+    const existing: Model | null = await this.findOneBy({
+      query: { _id: data.id },
+      select: { _id: true, tokenHash: true },
+      props: { isRoot: true, ignoreHooks: true },
+    });
+
+    if (!existing) {
+      throw new NotFoundException("Calendar feed not found.");
+    }
+
+    const rotation: CalendarFeedRotation = CalendarFeedToken.buildRotation({
+      currentTokenHash: existing.tokenHash,
+    });
+
+    await this.updateOneById({
+      id: data.id,
+      data: CalendarFeedToken.toRotationUpdateData(rotation),
+      props: { isRoot: true },
+    });
+
+    return rotation;
+  }
+
+  /**
+   * Rotate every ENABLED feed in the project that opted into
+   * rotateWhenMemberLeaves. Called by the team-member cleanup when a user's
+   * last team membership in the project goes away. Returns the ids rotated
+   * so the caller can purge their caches. A disabled feed is left alone: it
+   * already serves an empty calendar, and rotating it would only reset the
+   * grace clock on a link nobody should be refreshing anyway.
+   */
+  @CaptureSpan()
+  public async rotateFeedsForMemberLeave(data: {
+    projectId: ObjectID;
+  }): Promise<Array<ObjectID>> {
+    const feeds: Array<Model> = await this.findBy({
+      query: {
+        projectId: data.projectId,
+        isEnabled: true,
+        rotateWhenMemberLeaves: true,
+      },
+      select: {
+        _id: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+        ignoreHooks: true,
+      },
+    });
+
+    const rotated: Array<ObjectID> = [];
+
+    for (const feed of feeds) {
+      if (!feed.id) {
+        continue;
+      }
+
+      await this.rotateTokenById({ id: feed.id });
+      rotated.push(feed.id);
+    }
+
+    return rotated;
+  }
+}
+
+export default new Service();

package/Server/Services/OnCallDutyPolicyScheduleLayerService.ts

@@ -17,12 +17,61 @@ import UpdateBy from "../Types/Database/UpdateBy";
 import Model from "../../Models/DatabaseModels/OnCallDutyPolicyScheduleLayer";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
+import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /*
+   * A layer edit changes who is on call and when for the whole schedule:
+   * bump its shiftConfigVersion, drop the calendar-feed caches and let the
+   * shift-change listeners re-plan. Runs AFTER the roster refresh so a
+   * listener that re-materializes sees the new configuration. Best-effort by
+   * construction (propagateShiftConfigChange never throws).
+   */
+  private async propagateLayerChange(
+    scheduleId: ObjectID | null | undefined,
+    projectId: ObjectID | null | undefined,
+  ): Promise<void> {
+    if (!scheduleId) {
+      return;
+    }
+
+    await OnCallDutyPolicyScheduleService.propagateShiftConfigChange({
+      scheduleIds: [scheduleId],
+      projectId: projectId || null,
+      reason: OnCallShiftChangeReason.LayerChanged,
+    });
+  }
+
+  /**
+   * Re-resolve and persist the schedule's roster after a layer change.
+   * Best-effort: the row is already committed when the success hooks run, so
+   * a throwing refresh (a concurrently-deleted schedule, a transient
+   * persistence or notification failure) must not abort the hook before
+   * propagateLayerChange bumps the shiftConfigVersion and purges the feed
+   * caches — otherwise the caches would keep serving the pre-edit roster for
+   * up to their TTL and the reminder change pass would be skipped. Mirrors
+   * OnCallDutyPolicyEscalationRuleScheduleService.refreshScheduleRoster.
+   */
+  private async refreshScheduleRosterBestEffort(
+    scheduleId: ObjectID,
+  ): Promise<void> {
+    try {
+      await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+        scheduleId,
+      );
+    } catch (err) {
+      logger.error(
+        "Error refreshing the schedule roster after a layer change (best-effort).",
+      );
+      logger.error(err);
+    }
+  }
+
   /*
    * A rotation interval count of 0 / NaN / negative breaks the handoff math
    * (division by zero, Invalid Date), so reject it at the persistence boundary.
@@ -153,6 +202,7 @@ export class Service extends DatabaseService<Model> {
       id: createdItem.id!,
       select: {
         onCallDutyPolicyScheduleId: true,
+        projectId: true,
       },
       props: {
         isRoot: true,
@@ -163,8 +213,13 @@ export class Service extends DatabaseService<Model> {
       return createdItem;
     }
 
-    await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+    await this.refreshScheduleRosterBestEffort(
+      resource.onCallDutyPolicyScheduleId,
+    );
+
+    await this.propagateLayerChange(
       resource.onCallDutyPolicyScheduleId,
+      resource.projectId,
     );
 
     return createdItem;
@@ -192,6 +247,7 @@ export class Service extends DatabaseService<Model> {
         id: item,
         select: {
           onCallDutyPolicyScheduleId: true,
+          projectId: true,
         },
         props: {
           isRoot: true,
@@ -202,8 +258,13 @@ export class Service extends DatabaseService<Model> {
         continue;
       }
 
-      await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+      await this.refreshScheduleRosterBestEffort(
+        resource.onCallDutyPolicyScheduleId,
+      );
+
+      await this.propagateLayerChange(
         resource.onCallDutyPolicyScheduleId,
+        resource.projectId,
       );
     }
 
@@ -245,6 +306,7 @@ export class Service extends DatabaseService<Model> {
         select: {
           order: true,
           onCallDutyPolicyScheduleId: true,
+          projectId: true,
         },
       });
     }
@@ -271,8 +333,13 @@ export class Service extends DatabaseService<Model> {
           false,
         );
 
-        await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+        await this.refreshScheduleRosterBestEffort(
+          resource.onCallDutyPolicyScheduleId,
+        );
+
+        await this.propagateLayerChange(
           resource.onCallDutyPolicyScheduleId,
+          resource.projectId,
         );
       }
     }