@oneuptime/common 12.0.28 → 12.0.30

package/Server/Services/OnCallDutyPolicyUserOverrideService.ts

@@ -18,12 +18,124 @@ import Timezone from "../../Types/Timezone";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import logger from "../Utils/Logger";
+import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
+
+/*
+ * The (project, overridden user, substitute) triple an override names; the
+ * hooks capture it before an update / delete so the schedules of the OLD
+ * users can be refreshed and re-versioned once the row has changed.
+ */
+interface OverrideUserPair {
+  projectId: ObjectID;
+  overrideUserId: ObjectID;
+  routeAlertsToUserId?: ObjectID | undefined;
+}
+
+/*
+ * The subset of OnCallDutyPolicyScheduleService the override hooks call.
+ * Lazily required (see refreshRostersForOverrideUser) because that service
+ * imports this one.
+ */
+interface ScheduleServiceForOverrides {
+  refreshRostersForUserInProject: (d: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }) => Promise<void>;
+  getScheduleIdsForUsersInProject: (d: {
+    projectId: ObjectID;
+    userIds: Array<ObjectID>;
+  }) => Promise<Array<ObjectID>>;
+  propagateShiftConfigChange: (d: {
+    scheduleIds: Array<ObjectID>;
+    projectId?: ObjectID | null | undefined;
+    userIds?: Array<ObjectID> | undefined;
+    reason: OnCallShiftChangeReason;
+  }) => Promise<void>;
+}
 
 export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
   public constructor() {
     super(OnCallDutyPolicyUserOverride);
   }
 
+  private getScheduleService(): ScheduleServiceForOverrides {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+    return require("./OnCallDutyPolicyScheduleService").default;
+  }
+
+  /**
+   * An override changes who is on call on every schedule that contains the
+   * overridden user, and it changes the SUBSTITUTE's personal calendar too.
+   * Find those schedules with the same layer-user query the roster refresh
+   * uses (for every overridden user, old and new), then bump their
+   * shiftConfigVersion, drop the feed caches — the substitutes' personal
+   * caches included — and let the shift-change listeners re-plan reminders.
+   * One call per project; best-effort, never throws into the CRUD path.
+   */
+  private async propagateShiftChangeForOverrides(
+    pairs: Array<OverrideUserPair>,
+  ): Promise<void> {
+    const byProject: Map<
+      string,
+      {
+        projectId: ObjectID;
+        overrideUserIds: Array<ObjectID>;
+        allUserIds: Array<ObjectID>;
+      }
+    > = new Map();
+
+    for (const pair of pairs) {
+      if (!pair.projectId || !pair.overrideUserId) {
+        continue;
+      }
+
+      const key: string = pair.projectId.toString();
+      const entry: {
+        projectId: ObjectID;
+        overrideUserIds: Array<ObjectID>;
+        allUserIds: Array<ObjectID>;
+      } = byProject.get(key) || {
+        projectId: pair.projectId,
+        overrideUserIds: [],
+        allUserIds: [],
+      };
+
+      entry.overrideUserIds.push(pair.overrideUserId);
+      entry.allUserIds.push(pair.overrideUserId);
+
+      if (pair.routeAlertsToUserId) {
+        entry.allUserIds.push(pair.routeAlertsToUserId);
+      }
+
+      byProject.set(key, entry);
+    }
+
+    for (const entry of byProject.values()) {
+      try {
+        const scheduleService: ScheduleServiceForOverrides =
+          this.getScheduleService();
+
+        const scheduleIds: Array<ObjectID> =
+          await scheduleService.getScheduleIdsForUsersInProject({
+            projectId: entry.projectId,
+            userIds: entry.overrideUserIds,
+          });
+
+        await scheduleService.propagateShiftConfigChange({
+          scheduleIds,
+          projectId: entry.projectId,
+          userIds: entry.allUserIds,
+          reason: OnCallShiftChangeReason.OverrideChanged,
+        });
+      } catch (err) {
+        logger.error(
+          "Error propagating a user override change to the calendar feeds (best-effort).",
+        );
+        logger.error(err);
+      }
+    }
+  }
+
   /**
    * Re-resolve the persisted roster of every schedule in the project that
    * contains the override user, so a created / updated / deleted override is
@@ -41,13 +153,8 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
     }
 
     try {
-      const scheduleService: {
-        refreshRostersForUserInProject: (d: {
-          projectId: ObjectID;
-          userId: ObjectID;
-        }) => Promise<void>;
-        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
-      } = require("./OnCallDutyPolicyScheduleService").default;
+      const scheduleService: ScheduleServiceForOverrides =
+        this.getScheduleService();
 
       await scheduleService.refreshRostersForUserInProject({
         projectId: data.projectId,
@@ -190,6 +297,16 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       overrideUserId,
     });
 
+    if (projectId && overrideUserId) {
+      await this.propagateShiftChangeForOverrides([
+        {
+          projectId,
+          overrideUserId,
+          routeAlertsToUserId: routeAlertsToUserId || undefined,
+        },
+      ]);
+    }
+
     return createdItem;
   }
 
@@ -207,10 +324,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
      * schedules by the NEW user only (audit M2). Mirrors the onBeforeDelete
      * carry-forward pattern used by the delete path.
      */
-    const previous: Array<{
-      projectId: ObjectID;
-      overrideUserId: ObjectID;
-    }> = [];
+    const previous: Array<OverrideUserPair> = [];
 
     try {
       const rows: Array<OnCallDutyPolicyUserOverride> = await this.findBy({
@@ -218,6 +332,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
         select: {
           projectId: true,
           overrideUserId: true,
+          routeAlertsToUserId: true,
         },
         props: {
           isRoot: true,
@@ -231,8 +346,14 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
           row.projectId || row.project?.id;
         const overrideUserId: ObjectID | undefined | null =
           row.overrideUserId || row.overrideUser?.id;
+        const routeAlertsToUserId: ObjectID | undefined | null =
+          row.routeAlertsToUserId || row.routeAlertsToUser?.id;
         if (projectId && overrideUserId) {
-          previous.push({ projectId, overrideUserId });
+          previous.push({
+            projectId,
+            overrideUserId,
+            routeAlertsToUserId: routeAlertsToUserId || undefined,
+          });
         }
       }
     } catch (err) {
@@ -279,11 +400,11 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
     };
 
     // OLD override users captured before the update.
-    const previous: Array<{ projectId: ObjectID; overrideUserId: ObjectID }> =
-      (onUpdate.carryForward as Array<{
-        projectId: ObjectID;
-        overrideUserId: ObjectID;
-      }>) || [];
+    const previous: Array<OverrideUserPair> =
+      (onUpdate.carryForward as Array<OverrideUserPair>) || [];
+
+    // Everyone the edit touched, old and new, for the feed / reminder pass.
+    const affectedPairs: Array<OverrideUserPair> = [...previous];
 
     for (const entry of previous) {
       await refreshPair(entry.projectId, entry.overrideUserId);
@@ -296,6 +417,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
         select: {
           projectId: true,
           overrideUserId: true,
+          routeAlertsToUserId: true,
         },
         props: {
           isRoot: true,
@@ -306,12 +428,26 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
         continue;
       }
 
-      await refreshPair(
-        item.projectId || item.project?.id,
-        item.overrideUserId || item.overrideUser?.id,
-      );
+      const newProjectId: ObjectID | undefined | null =
+        item.projectId || item.project?.id;
+      const newOverrideUserId: ObjectID | undefined | null =
+        item.overrideUserId || item.overrideUser?.id;
+      const newRouteAlertsToUserId: ObjectID | undefined | null =
+        item.routeAlertsToUserId || item.routeAlertsToUser?.id;
+
+      await refreshPair(newProjectId, newOverrideUserId);
+
+      if (newProjectId && newOverrideUserId) {
+        affectedPairs.push({
+          projectId: newProjectId,
+          overrideUserId: newOverrideUserId,
+          routeAlertsToUserId: newRouteAlertsToUserId || undefined,
+        });
+      }
     }
 
+    await this.propagateShiftChangeForOverrides(affectedPairs);
+
     return onUpdate;
   }
 
@@ -326,11 +462,8 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
      * than waiting for the next natural handoff (audit F4). The affected
      * project/user pairs were captured in onBeforeDelete (the rows are gone now).
      */
-    const affected: Array<{ projectId: ObjectID; overrideUserId: ObjectID }> =
-      (onDelete.carryForward as Array<{
-        projectId: ObjectID;
-        overrideUserId: ObjectID;
-      }>) || [];
+    const affected: Array<OverrideUserPair> =
+      (onDelete.carryForward as Array<OverrideUserPair>) || [];
 
     for (const entry of affected) {
       await this.refreshRostersForOverrideUser({
@@ -339,6 +472,8 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       });
     }
 
+    await this.propagateShiftChangeForOverrides(affected);
+
     return onDelete;
   }
 
@@ -368,10 +503,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
      * onDeleteSuccess can refresh those schedules' rosters AFTER the rows are
      * gone (audit F4). Collected for global overrides too (no policy id).
      */
-    const affectedRosters: Array<{
-      projectId: ObjectID;
-      overrideUserId: ObjectID;
-    }> = [];
+    const affectedRosters: Array<OverrideUserPair> = [];
 
     for (const item of itemsToDelete) {
       const onCallDutyPolicyId: ObjectID | undefined | null =
@@ -387,7 +519,11 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
         item.routeAlertsToUserId || item.routeAlertsToUser?.id;
 
       if (projectId && overrideUserId) {
-        affectedRosters.push({ projectId, overrideUserId });
+        affectedRosters.push({
+          projectId,
+          overrideUserId,
+          routeAlertsToUserId: routeAlertsToUserId || undefined,
+        });
       }
 
       if (

package/Server/Services/ProjectOnCallCalendarFeedService.ts

@@ -0,0 +1,192 @@
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import {
+  MAX_MINIMUM_GAP_MINUTES,
+  MIN_MINIMUM_GAP_MINUTES,
+} from "./OnCallDutyPolicyScheduleCalendarFeedService";
+import CalendarFeedToken, {
+  CalendarFeedRotation,
+} from "../Utils/OnCall/CalendarFeedToken";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model from "../../Models/DatabaseModels/ProjectOnCallCalendarFeed";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import CalendarFeedWindow from "../../Types/OnCallDutyPolicy/CalendarFeedWindow";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+
+/*
+ * The project-wide shared calendar feed: at most one row per project.
+ *
+ * The same guarantees as OnCallDutyPolicyScheduleCalendarFeedService minus
+ * the schedule check: one feed per project (unique index + a readable
+ * message), the token minted here on every create whatever the request
+ * carried, window and gap settings bounded on every write, root-only
+ * rotation with the 30-day grace hash.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    createBy.data.projectId = projectId;
+
+    const existing: PositiveNumber = await this.countBy({
+      query: {
+        projectId: projectId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (existing.toNumber() > 0) {
+      throw new BadDataException(
+        "This project already has a shared calendar feed. Regenerate or edit the existing one instead.",
+      );
+    }
+
+    // A request body never chooses the secret; only root may pre-mint one.
+    CalendarFeedToken.applyTokenColumnsOnCreate(createBy.data, {
+      trustSuppliedToken: createBy.props.isRoot === true,
+    });
+
+    createBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+      createBy.data.pastDays,
+    );
+    createBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+      createBy.data.futureDays,
+    );
+
+    if (createBy.data.minimumGapMinutes !== undefined) {
+      createBy.data.minimumGapMinutes = Service.validateMinimumGapMinutes(
+        createBy.data.minimumGapMinutes,
+      );
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.pastDays !== undefined) {
+      updateBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+        updateBy.data.pastDays,
+      );
+    }
+
+    if (updateBy.data.futureDays !== undefined) {
+      updateBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+        updateBy.data.futureDays,
+      );
+    }
+
+    if (updateBy.data.minimumGapMinutes !== undefined) {
+      updateBy.data.minimumGapMinutes = Service.validateMinimumGapMinutes(
+        updateBy.data.minimumGapMinutes,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  public static validateMinimumGapMinutes(value: unknown): number {
+    const parsed: number =
+      typeof value === "string" && value.trim() !== ""
+        ? Number(value)
+        : (value as number);
+
+    if (
+      typeof parsed !== "number" ||
+      !Number.isInteger(parsed) ||
+      parsed < MIN_MINIMUM_GAP_MINUTES ||
+      parsed > MAX_MINIMUM_GAP_MINUTES
+    ) {
+      throw new BadDataException(
+        `Minimum gap must be a whole number of minutes between ${MIN_MINIMUM_GAP_MINUTES} and ${MAX_MINIMUM_GAP_MINUTES}.`,
+      );
+    }
+
+    return parsed;
+  }
+
+  /**
+   * Rotate the token of an existing feed. Returns the new plaintext token
+   * ONCE. Root write; the caller purges caches.
+   */
+  @CaptureSpan()
+  public async rotateTokenById(data: {
+    id: ObjectID;
+  }): Promise<CalendarFeedRotation> {
+    const existing: Model | null = await this.findOneBy({
+      query: { _id: data.id },
+      select: { _id: true, tokenHash: true },
+      props: { isRoot: true, ignoreHooks: true },
+    });
+
+    if (!existing) {
+      throw new NotFoundException("Calendar feed not found.");
+    }
+
+    const rotation: CalendarFeedRotation = CalendarFeedToken.buildRotation({
+      currentTokenHash: existing.tokenHash,
+    });
+
+    await this.updateOneById({
+      id: data.id,
+      data: CalendarFeedToken.toRotationUpdateData(rotation),
+      props: { isRoot: true },
+    });
+
+    return rotation;
+  }
+
+  /**
+   * Rotate the project's feed when a member leaves, if it is enabled and
+   * opted in. Returns the rotated id (at most one) for cache purging.
+   */
+  @CaptureSpan()
+  public async rotateFeedsForMemberLeave(data: {
+    projectId: ObjectID;
+  }): Promise<Array<ObjectID>> {
+    const feed: Model | null = await this.findOneBy({
+      query: {
+        projectId: data.projectId,
+        isEnabled: true,
+        rotateWhenMemberLeaves: true,
+      },
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+        ignoreHooks: true,
+      },
+    });
+
+    if (!feed || !feed.id) {
+      return [];
+    }
+
+    await this.rotateTokenById({ id: feed.id });
+
+    return [feed.id];
+  }
+}
+
+export default new Service();

package/Server/Services/StatusPageDomainService.ts

@@ -20,10 +20,24 @@ import Telemetry, { Span } from "../Utils/Telemetry";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { StatusPageCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
+import ArrayUtil from "../../Utils/Array";
+import OneUptimeDate from "../../Types/Date";
+import CertificateReissueUtil from "../../Utils/CertificateReissue";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import QueryHelper from "../Types/Database/QueryHelper";
 
 const STATUS_PAGE_DOMAIN_EGRESS_LABEL: string = "Status page domain";
 
 export class Service extends DatabaseService<StatusPageDomain> {
+  /*
+   * How many status pages the provisioning sweep checks at once. Each check is
+   * one bounded request out to a customer domain, so this is about not letting
+   * the sweep's length grow with the size of the fleet, rather than about local
+   * work. Kept modest so a sweep cannot look like a burst of traffic to any
+   * shared infrastructure sitting in front of those domains.
+   */
+  public static readonly SSL_PROVISIONING_CHECK_CONCURRENCY: number = 10;
+
   public constructor() {
     super(StatusPageDomain);
   }
@@ -248,6 +262,133 @@ export class Service extends DatabaseService<StatusPageDomain> {
     });
   }
 
+  /*
+   * Reissue this domain's Let's Encrypt certificate because a customer asked
+   * for it, rather than because it is close to expiring.
+   *
+   * Every order spends from a Let's Encrypt account that is shared by the
+   * whole installation - including by the cron that keeps everybody else's
+   * certificates alive - so this is throttled to one request per domain per
+   * CertificateReissueUtil.COOLDOWN_IN_HOURS.
+   *
+   * Throws with a customer-readable reason for every refusal, so the API layer
+   * can hand the message straight back without classifying the failure:
+   * BadDataException for a domain that is not eligible at all, and
+   * TooManyRequestsException (429) for one that is simply too soon.
+   */
+  @CaptureSpan()
+  public async reissueCert(domainId: ObjectID): Promise<void> {
+    const now: Date = OneUptimeDate.getCurrentDate();
+
+    const statusPageDomain: StatusPageDomain | null = await this.findOneBy({
+      query: {
+        _id: domainId.toString(),
+      },
+      select: {
+        _id: true,
+        fullDomain: true,
+        isCnameVerified: true,
+        isSslOrdered: true,
+        isCustomCertificate: true,
+        certificateReissueRequestedAt: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!statusPageDomain) {
+      throw new BadDataException("Domain not found.");
+    }
+
+    if (!statusPageDomain.fullDomain) {
+      throw new BadDataException(
+        "Unable to reissue certificate because domain is null",
+      );
+    }
+
+    /*
+     * Nothing to reissue: the certificate on a custom-certificate domain is
+     * the one the customer uploaded, and we have no way to obtain another.
+     */
+    if (statusPageDomain.isCustomCertificate) {
+      throw new BadDataException(
+        "This domain uses a certificate you uploaded yourself, so there is no Let's Encrypt certificate to reissue. Please edit this domain and upload a new certificate instead.",
+      );
+    }
+
+    if (!statusPageDomain.isCnameVerified) {
+      throw new BadDataException(
+        "CNAME is not verified. Please verify CNAME first before you reissue the SSL certificate.",
+      );
+    }
+
+    /*
+     * A domain that never ordered a certificate has nothing to reissue - the
+     * dashboard shows "Order Free SSL" for it, which is the correct button.
+     */
+    if (!statusPageDomain.isSslOrdered) {
+      throw new BadDataException(
+        "No SSL certificate has been ordered for this domain yet. Please order one first.",
+      );
+    }
+
+    /*
+     * Claim the cooldown before ordering anything, and claim it by putting the
+     * cooldown condition in the WHERE clause rather than in an `if` above the
+     * write. Two clicks that arrive together both read a row that is not
+     * cooling down; only the write can decide which one of them gets to spend
+     * the CA's allowance.
+     *
+     * The stamp goes down BEFORE the order and is never rolled back on
+     * failure. A rejected order still costs a validation attempt against the
+     * shared account, and a domain whose order fails is exactly the domain
+     * somebody presses again - so a failed attempt has to start the clock the
+     * same way a successful one does.
+     */
+    const claimedRowCount: number = await this.updateOneBy({
+      query: {
+        _id: domainId.toString(),
+        certificateReissueRequestedAt: QueryHelper.lessThanEqualToOrNull(
+          CertificateReissueUtil.getCooldownCutoff(now),
+        ),
+      },
+      data: {
+        certificateReissueRequestedAt: now,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (claimedRowCount === 0) {
+      if (statusPageDomain.certificateReissueRequestedAt) {
+        throw new TooManyRequestsException(
+          CertificateReissueUtil.getCooldownMessage(
+            statusPageDomain.certificateReissueRequestedAt,
+            now,
+          ),
+        );
+      }
+
+      /*
+       * The row matched the cooldown a moment ago and does not now: another
+       * request claimed it in between, or the domain was deleted. Either way
+       * the caller must not order.
+       */
+      throw new BadDataException(
+        "Could not start a certificate reissue for this domain. Please refresh the page and try again.",
+      );
+    }
+
+    logger.debug(
+      "Reissuing SSL certificate for domain: " + statusPageDomain.fullDomain,
+      { fullDomain: statusPageDomain.fullDomain } as LogAttributes,
+    );
+
+    await this.orderCert(statusPageDomain);
+  }
+
   @CaptureSpan()
   public async updateSslProvisioningStatusForAllDomains(): Promise<void> {
     const domains: Array<StatusPageDomain> = await this.findBy({
@@ -257,6 +398,7 @@ export class Service extends DatabaseService<StatusPageDomain> {
       },
       select: {
         _id: true,
+        fullDomain: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -265,9 +407,27 @@ export class Service extends DatabaseService<StatusPageDomain> {
       },
     });
 
-    for (const domain of domains) {
-      await this.updateSslProvisioningStatus(domain);
-    }
+    /*
+     * Each domain costs a request out to the customer's status page, so walking
+     * the fleet one at a time makes the sweep as long as the fleet is slow.
+     * That length is the delay before an expired certificate is noticed and
+     * reordered, so it is the outage a customer sees when renewal has not
+     * already happened - it must stay well inside the sweep's own interval.
+     */
+    await ArrayUtil.forEachWithConcurrency(
+      domains,
+      Service.SSL_PROVISIONING_CHECK_CONCURRENCY,
+      async (domain: StatusPageDomain): Promise<void> => {
+        try {
+          await this.updateSslProvisioningStatus(domain);
+        } catch (err) {
+          // one unreachable domain must not end the sweep for the rest.
+          logger.error(err, {
+            fullDomain: domain.fullDomain,
+          } as LogAttributes);
+        }
+      },
+    );
   }
 
   private async isSSLProvisioned(