@oneuptime/common 12.0.28 → 12.0.30

package/Server/Utils/Workspace/MicrosoftTeams/Actions/Authorization.ts

@@ -0,0 +1,158 @@
+import Alert from "../../../../../Models/DatabaseModels/Alert";
+import Incident from "../../../../../Models/DatabaseModels/Incident";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import AlertService from "../../../../Services/AlertService";
+import IncidentService from "../../../../Services/IncidentService";
+import ModelPermission from "../../../../Types/Database/Permissions/Index";
+import Query from "../../../../Types/Database/Query";
+import { applyAlertSelfPrivacyFilter } from "../../../Alert/AlertPrivacyFilter";
+import { applyIncidentSelfPrivacyFilter } from "../../../Incident/IncidentPrivacyFilter";
+import CaptureSpan from "../../../Telemetry/CaptureSpan";
+
+export default class MicrosoftTeamsActionAuthorization {
+  @CaptureSpan()
+  public static async assertCanUpdateIncident(data: {
+    incidentId: ObjectID;
+    projectId: ObjectID;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    const incident: Incident | null = await IncidentService.findOneBy({
+      query: {
+        _id: data.incidentId,
+        projectId: data.projectId,
+      },
+      select: {
+        _id: true,
+        labels: {
+          _id: true,
+          name: true,
+        },
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!incident) {
+      throw new NotAuthorizedException(
+        "You do not have permission to update this incident.",
+      );
+    }
+
+    await ModelPermission.checkUpdatePermissionByModel({
+      modelType: Incident,
+      fetchModelWithAccessControlIds: async (): Promise<Incident> => {
+        return incident;
+      },
+      props: data.props,
+    });
+
+    const permittedQuery: Query<Incident> =
+      await ModelPermission.checkUpdateQueryPermissions(
+        Incident,
+        {
+          _id: data.incidentId,
+          projectId: data.projectId,
+        },
+        {
+          currentIncidentStateId: ObjectID.getZeroObjectID(),
+        },
+        data.props,
+      );
+
+    const privacyScopedQuery: Query<Incident> = applyIncidentSelfPrivacyFilter(
+      permittedQuery,
+      data.props,
+    );
+
+    const permittedIncident: Incident | null = await IncidentService.findOneBy({
+      query: privacyScopedQuery,
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!permittedIncident) {
+      throw new NotAuthorizedException(
+        "You do not have permission to update this incident.",
+      );
+    }
+  }
+
+  @CaptureSpan()
+  public static async assertCanUpdateAlert(data: {
+    alertId: ObjectID;
+    projectId: ObjectID;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    const alert: Alert | null = await AlertService.findOneBy({
+      query: {
+        _id: data.alertId,
+        projectId: data.projectId,
+      },
+      select: {
+        _id: true,
+        labels: {
+          _id: true,
+          name: true,
+        },
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!alert) {
+      throw new NotAuthorizedException(
+        "You do not have permission to update this alert.",
+      );
+    }
+
+    await ModelPermission.checkUpdatePermissionByModel({
+      modelType: Alert,
+      fetchModelWithAccessControlIds: async (): Promise<Alert> => {
+        return alert;
+      },
+      props: data.props,
+    });
+
+    const permittedQuery: Query<Alert> =
+      await ModelPermission.checkUpdateQueryPermissions(
+        Alert,
+        {
+          _id: data.alertId,
+          projectId: data.projectId,
+        },
+        {
+          currentAlertStateId: ObjectID.getZeroObjectID(),
+        },
+        data.props,
+      );
+
+    const privacyScopedQuery: Query<Alert> = applyAlertSelfPrivacyFilter(
+      permittedQuery,
+      data.props,
+    );
+
+    const permittedAlert: Alert | null = await AlertService.findOneBy({
+      query: privacyScopedQuery,
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!permittedAlert) {
+      throw new NotAuthorizedException(
+        "You do not have permission to update this alert.",
+      );
+    }
+  }
+}

package/Server/Utils/Workspace/MicrosoftTeams/Actions/Incident.ts

@@ -31,6 +31,8 @@ import SortOrder from "../../../../../Types/BaseDatabase/SortOrder";
 import { LIMIT_PER_PROJECT } from "../../../../../Types/Database/LimitMax";
 import BadDataException from "../../../../../Types/Exception/BadDataException";
 import URL from "../../../../../Types/API/URL";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import MicrosoftTeamsActionAuthorization from "./Authorization";
 
 export default class MicrosoftTeamsIncidentActions {
   @CaptureSpan()
@@ -296,6 +298,7 @@ export default class MicrosoftTeamsIncidentActions {
     value: JSONObject;
     projectId: ObjectID;
     oneUptimeUserId: ObjectID;
+    databaseProps: DatabaseCommonInteractionProps;
     turnContext: TurnContext;
   }): Promise<void> {
     const {
@@ -304,6 +307,7 @@ export default class MicrosoftTeamsIncidentActions {
       value,
       projectId,
       oneUptimeUserId,
+      databaseProps,
       turnContext,
     } = data;
 
@@ -315,10 +319,15 @@ export default class MicrosoftTeamsIncidentActions {
         return;
       }
 
-      await IncidentService.acknowledgeIncident(
-        new ObjectID(actionValue),
-        oneUptimeUserId,
-      );
+      const incidentId: ObjectID = new ObjectID(actionValue);
+
+      await MicrosoftTeamsActionAuthorization.assertCanUpdateIncident({
+        incidentId: incidentId,
+        projectId: projectId,
+        props: databaseProps,
+      });
+
+      await IncidentService.acknowledgeIncident(incidentId, oneUptimeUserId);
       await turnContext.sendActivity("✅ Incident acknowledged.");
       return;
     }
@@ -331,10 +340,15 @@ export default class MicrosoftTeamsIncidentActions {
         return;
       }
 
-      await IncidentService.resolveIncident(
-        new ObjectID(actionValue),
-        oneUptimeUserId,
-      );
+      const incidentId: ObjectID = new ObjectID(actionValue);
+
+      await MicrosoftTeamsActionAuthorization.assertCanUpdateIncident({
+        incidentId: incidentId,
+        projectId: projectId,
+        props: databaseProps,
+      });
+
+      await IncidentService.resolveIncident(incidentId, oneUptimeUserId);
       await turnContext.sendActivity("✅ Incident resolved.");
       return;
     }
@@ -574,9 +588,7 @@ export default class MicrosoftTeamsIncidentActions {
           data: {
             currentIncidentStateId: new ObjectID(incidentStateId.toString()),
           },
-          props: {
-            isRoot: true,
-          },
+          props: databaseProps,
         });
 
         await turnContext.sendActivity(

package/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.ts

@@ -111,6 +111,7 @@ import AccessTokenService from "../../../Services/AccessTokenService";
 import AIService, { AI_DISABLED_MESSAGE } from "../../../Services/AIService";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { AIChatCitation } from "../../../../Types/AI/AIChatTypes";
+import TeamMemberService from "../../../Services/TeamMemberService";
 
 // Microsoft Teams apps should always be single-tenant
 const MICROSOFT_TEAMS_APP_TYPE: string = "SingleTenant";
@@ -3999,27 +4000,48 @@ All monitoring checks are passing normally.`;
           userLookupParamsRes,
         );
 
-      // Handle incident actions
-      if (MicrosoftTeamsIncidentActions.isIncidentAction({ actionType })) {
-        await MicrosoftTeamsIncidentActions.handleBotIncidentAction({
-          actionType,
-          actionValue,
-          value,
-          projectId,
+      const isIncidentAction: boolean =
+        MicrosoftTeamsIncidentActions.isIncidentAction({ actionType });
+      const isAlertAction: boolean = MicrosoftTeamsAlertActions.isAlertAction({
+        actionType,
+      });
+
+      if (isIncidentAction || isAlertAction) {
+        const databaseProps: DatabaseCommonInteractionProps =
+          await AccessTokenService.getDatabaseCommonInteractionPropsByUserAndProject(
+            {
+              userId: oneUptimeUserId,
+              projectId: projectId,
+            },
+          );
+
+        databaseProps.userTeamIds = await TeamMemberService.getTeamIdsForUser(
           oneUptimeUserId,
-          turnContext: data.turnContext,
-        });
-        return;
-      }
+          projectId,
+        );
+
+        // Handle incident actions
+        if (isIncidentAction) {
+          await MicrosoftTeamsIncidentActions.handleBotIncidentAction({
+            actionType,
+            actionValue,
+            value,
+            projectId,
+            oneUptimeUserId,
+            databaseProps,
+            turnContext: data.turnContext,
+          });
+          return;
+        }
 
-      // Handle alert actions
-      if (MicrosoftTeamsAlertActions.isAlertAction({ actionType })) {
+        // Handle alert actions
         await MicrosoftTeamsAlertActions.handleBotAlertAction({
           actionType,
           actionValue,
           value,
           projectId,
           oneUptimeUserId,
+          databaseProps,
           turnContext: data.turnContext,
         });
         return;