@oneuptime/common 12.0.29 → 12.0.31

package/build/dist/Server/API/OnCallCalendarAPI.js

@@ -0,0 +1,1371 @@
+import { DisableOnCallCalendarFeed, Host, HttpProtocol, ProvisionSsl, TrustedProxyHops, } from "../EnvironmentConfig";
+import OnCallCalendarFeedCache from "../Infrastructure/OnCallCalendarFeedCache";
+import Semaphore from "../Infrastructure/Semaphore";
+import OnCallCalendarFeedRateLimit from "../Middleware/OnCallCalendarFeedRateLimit";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import OnCallDutyPolicyScheduleCalendarFeedService from "../Services/OnCallDutyPolicyScheduleCalendarFeedService";
+import OnCallDutyPolicyScheduleService from "../Services/OnCallDutyPolicyScheduleService";
+import ProjectOnCallCalendarFeedService from "../Services/ProjectOnCallCalendarFeedService";
+import UserOnCallCalendarFeedService from "../Services/UserOnCallCalendarFeedService";
+import Express from "../Utils/Express";
+import logger from "../Utils/Logger";
+import CalendarFeedToken from "../Utils/OnCall/CalendarFeedToken";
+import OnCallCalendarFeedRenderer, { FEED_DISABLED_REASON, FeedRenderStatus, TOKEN_ROTATED_REASON, } from "../Utils/OnCall/OnCallCalendarFeedRenderer";
+import OnCallCalendarFeedUrls from "../Utils/OnCall/OnCallCalendarFeedUrls";
+import Response from "../Utils/Response";
+import CommonAPI from "./CommonAPI";
+import OnCallDutyPolicyScheduleCalendarFeed from "../../Models/DatabaseModels/OnCallDutyPolicyScheduleCalendarFeed";
+import ProjectOnCallCalendarFeed from "../../Models/DatabaseModels/ProjectOnCallCalendarFeed";
+import Protocol from "../../Types/API/Protocol";
+import OneUptimeDate from "../../Types/Date";
+import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import ServiceUnavailableException from "../../Types/Exception/ServiceUnavailableException";
+import ObjectID from "../../Types/ObjectID";
+import { DEFAULT_FUTURE_DAYS, DEFAULT_PAST_DAYS, MAX_FUTURE_DAYS, MAX_PAST_DAYS, } from "../../Types/OnCallDutyPolicy/CalendarFeedWindow";
+import MaterializedShiftUtil from "../../Types/OnCallDutyPolicy/MaterializedShift";
+import { OnCallCalendarFeedKind } from "../../Types/OnCallDutyPolicy/OnCallCalendarFeedUtil";
+/*
+ * The HTTP face of the on-call calendar feeds.
+ *
+ * Two very different kinds of route share this router, and the difference is
+ * the whole design:
+ *
+ * PUBLIC CAPABILITY ROUTES (no UserMiddleware). A calendar client sends no
+ * cookie and no bearer token; the 43-character token in the path IS the
+ * credential. UserMiddleware is deliberately absent: with no cookie it would
+ * add nothing, but a browser holding an expired session cookie would be
+ * answered 401 before the token was even read, and an `apikey` header -- even
+ * an empty one -- would hijack the request into API-key authentication. The
+ * pipeline is, in order: kill switch -> scheme guard -> rate limit -> shape
+ * guard -> token lookup (current hash, then the rotated-out hash inside its
+ * grace) -> the renderer, which re-derives authorisation on every fetch
+ * (a valid token is not authorisation) -> response -> bookkeeping.
+ *
+ * ONE RESPONSE RULE, applied everywhere:
+ *   unknown / malformed / expired token          -> 404, generic body
+ *   disabled, rotated-out-in-grace, below plan,
+ *   no eligible schedule                          -> 200, EMPTY VCALENDAR
+ *   kill switch, or render cap with nothing cached -> 503 + Retry-After
+ * The empty-calendar cases are 200 on purpose: a client that gets 404 keeps
+ * showing the last copy it downloaded (or drops the subscription with an
+ * error), whereas an empty calendar makes it clear its copy.
+ *
+ * SESSION ROUTES (UserMiddleware + requireUserAuthentication). The settings
+ * pages and the mobile app read and rotate feeds here. /current is the ONLY
+ * place the encrypted `token` column is ever read back; the public routes
+ * never select it, so a rotated ENCRYPTION_SECRET can break the settings page
+ * (which says "Regenerate link") but never the subscribed calendars.
+ *
+ * The token never reaches a log line, an error message, a span attribute or
+ * a cache key. Everything that identifies a request in logs is the feed kind
+ * and the row id.
+ */
+const router = Express.getRouter();
+// -- Routes (exported so tests and the dashboard pin the same strings) ------
+export const PERSONAL_FEED_ROUTE = "/on-call-calendar/user/:token/shifts.ics";
+export const SCHEDULE_FEED_ROUTE = "/on-call-calendar/schedule/:token/schedule.ics";
+export const PROJECT_FEED_ROUTE = "/on-call-calendar/project/:token/project.ics";
+/*
+ * Anything else under a token-bearing prefix: a link pasted without the
+ * trailing `shifts.ics`, a typo in the filename, a client or a scanner
+ * sending POST/PUT/DELETE to a feed URL. Without these the request falls
+ * through to the application's own catch-alls, which answer
+ * `Page not found - ${req.url}` -- the plaintext token, at ERROR level, in
+ * stdout, in the master-admin support bundle's recent-log buffer and in the
+ * OTel log exporter. The token is the credential; it must never be logged.
+ */
+export const PERSONAL_FEED_FALLBACK_ROUTE = "/on-call-calendar/user/*";
+export const SCHEDULE_FEED_FALLBACK_ROUTE = "/on-call-calendar/schedule/*";
+export const PROJECT_FEED_FALLBACK_ROUTE = "/on-call-calendar/project/*";
+export const FEED_CURRENT_ROUTE = "/on-call-calendar/feed/current";
+export const FEED_ROTATE_ROUTE = "/on-call-calendar/feed/rotate";
+export const SCHEDULE_FEED_CURRENT_ROUTE = "/on-call-calendar/schedule-feed/:scheduleId/current";
+export const SCHEDULE_FEED_PUBLISH_ROUTE = "/on-call-calendar/schedule-feed/:scheduleId/publish";
+export const SCHEDULE_FEED_ROTATE_ROUTE = "/on-call-calendar/schedule-feed/:scheduleId/rotate";
+export const PROJECT_FEED_CURRENT_ROUTE = "/on-call-calendar/project-feed/current";
+export const PROJECT_FEED_PUBLISH_ROUTE = "/on-call-calendar/project-feed/publish";
+export const PROJECT_FEED_ROTATE_ROUTE = "/on-call-calendar/project-feed/rotate";
+export const MY_SHIFTS_ROUTE = "/on-call-calendar/my-shifts";
+// -- Constants --------------------------------------------------------------
+export const KILL_SWITCH_RETRY_AFTER_SECONDS = 3600;
+/* Bookkeeping is written at most this often per feed. */
+export const BOOKKEEPING_INTERVAL_MS = 5 * 60 * 1000;
+export const MY_SHIFTS_DEFAULT_DAYS = 30;
+export const MY_SHIFTS_MAX_DAYS = 120;
+export const ROTATE_LOCK_NAMESPACE = "OnCallCalendarFeed.rotate";
+export const ROTATE_LOCK_TIMEOUT_MS = 10000;
+const STALE_WARNING_HEADER = '110 - "Response is Stale"';
+/* The body of every 404 on the public routes. Says nothing. */
+const NOT_FOUND_MESSAGE = "Not found.";
+/*
+ * 415. ExceptionCode has no member named for it; the numeric value is what
+ * res.status() needs and what the client sees.
+ */
+class UnsupportedMediaTypeException extends Exception {
+    constructor(message) {
+        super(415, message);
+    }
+}
+/* 405, same reasoning as the 415 above. */
+class MethodNotAllowedException extends Exception {
+    constructor(message) {
+        super(405, message);
+    }
+}
+// -- Public-route middleware ----------------------------------------------
+/*
+ * Kill switch. Answered BEFORE the rate limiter so a switched-off install
+ * spends no Redis round trips per poll. 503 + Retry-After: clients keep the
+ * copy they have and come back later, which is the point of a switch that
+ * says "not now" rather than "never".
+ */
+export function killSwitchMiddleware(req, res, next) {
+    if (DisableOnCallCalendarFeed) {
+        res.set("Retry-After", String(KILL_SWITCH_RETRY_AFTER_SECONDS));
+        return Response.sendErrorResponse(req, res, new ServiceUnavailableException("On-call calendar feeds are disabled on this OneUptime instance."));
+    }
+    return next();
+}
+/*
+ * The X-Forwarded-Proto entry written by OUR proxy, read the way ClientIp
+ * reads X-Forwarded-For: counting in from the right by TRUSTED_PROXY_HOPS,
+ * never the leftmost (caller-supplied) entry. With no trusted proxies there
+ * is no trustworthy header at all, and undefined is returned.
+ */
+export function resolveTrustedForwardedProto(req, options) {
+    var _a;
+    const configuredHops = (options === null || options === void 0 ? void 0 : options.trustedProxyHops) === undefined
+        ? TrustedProxyHops
+        : options.trustedProxyHops;
+    const hops = Number.isFinite(configuredHops) && configuredHops > 0
+        ? Math.floor(configuredHops)
+        : 0;
+    if (hops === 0) {
+        return undefined;
+    }
+    const header = (_a = req.headers) === null || _a === void 0 ? void 0 : _a["x-forwarded-proto"];
+    if (header === undefined || header === null) {
+        return undefined;
+    }
+    const raw = Array.isArray(header) ? header.join(",") : header;
+    if (!raw.trim()) {
+        return undefined;
+    }
+    const entries = raw.split(",");
+    if (entries.length < hops) {
+        return undefined;
+    }
+    const entry = entries[entries.length - hops];
+    return entry ? entry.trim().toLowerCase() : undefined;
+}
+/*
+ * Scheme guard. An https instance whose proxy reports the request arrived
+ * over plain http answers 301 to the https URL, so a link pasted without the
+ * "s" is corrected once instead of served in the clear forever. The target
+ * is built from HOST, never from the request's own Host header (an open
+ * redirect otherwise). Nginx only does this itself when billing is on.
+ *
+ * It only fires when OUR nginx terminates TLS (PROVISION_SSL=true). Every
+ * proxying location in Nginx/default.conf.template sets
+ * `X-Forwarded-Proto $scheme`, REPLACING whatever an outer proxy sent, so on
+ * an install that terminates TLS on an external reverse proxy
+ * (PROVISION_SSL=false with HTTP_PROTOCOL=https -- the topology
+ * config.example.env documents) nginx always reports `http` even though the
+ * client spoke https. Redirecting there would 301 to the very URL the client
+ * just asked for: an endless loop, ERR_TOO_MANY_REDIRECTS in a browser and a
+ * dead subscription in every calendar client. Serving the feed is the right
+ * answer; the settings page still shows `protocolWarning` when the install
+ * really is plain http.
+ */
+export function schemeGuardMiddleware(req, res, next) {
+    if (HttpProtocol !== Protocol.HTTPS) {
+        return next();
+    }
+    if (!ProvisionSsl) {
+        return next();
+    }
+    const forwardedProto = resolveTrustedForwardedProto(req);
+    if (forwardedProto !== "http") {
+        return next();
+    }
+    const host = OnCallCalendarFeedUrls.normalizeHost(Host);
+    if (!host) {
+        return next();
+    }
+    const originalUrl = req.originalUrl || req.url || "/";
+    res.set("Cache-Control", "no-store");
+    res.redirect(301, `${Protocol.HTTPS}${host}${originalUrl}`);
+}
+// -- Helpers ----------------------------------------------------------------
+function sendNotFound(req, res) {
+    return Response.sendErrorResponse(req, res, new NotFoundException(NOT_FOUND_MESSAGE));
+}
+function sendUnavailable(req, res, retryAfterSeconds) {
+    res.set("Retry-After", String(retryAfterSeconds));
+    return Response.sendErrorResponse(req, res, new ServiceUnavailableException("The calendar feed cannot be rendered right now. Please try again later."));
+}
+/*
+ * The answer to every near miss on a token-bearing path. It says nothing
+ * about the URL it was asked for: the message is a constant, so neither the
+ * response body nor the error log line sendErrorResponse writes can carry
+ * the token. OPTIONS is answered the way OPTIONS should be; any other wrong
+ * method gets 405 + Allow (a client can fix that); a wrong or missing
+ * filename gets the same generic 404 an unknown token gets.
+ */
+export const FEED_ALLOWED_METHODS = "GET, HEAD, OPTIONS";
+export function feedFallbackHandler(req, res) {
+    const method = (req.method || "GET").toUpperCase();
+    if (method === "OPTIONS") {
+        res.set("Allow", FEED_ALLOWED_METHODS);
+        return Response.sendEmptySuccessResponse(req, res);
+    }
+    if (method !== "GET" && method !== "HEAD") {
+        res.set("Allow", FEED_ALLOWED_METHODS);
+        return Response.sendErrorResponse(req, res, new MethodNotAllowedException("Calendar feeds are read with GET on the full feed URL."));
+    }
+    return sendNotFound(req, res);
+}
+/*
+ * The `?schedule=` filter of the personal feed. Absent -> no filter. Present
+ * but not a UUID -> null, which the route answers 404: a URL the user
+ * believed was filtered must never quietly render the whole feed.
+ */
+export function readScheduleFilter(req) {
+    var _a, _b;
+    const raw = (_a = req.query) === null || _a === void 0 ? void 0 : _a["schedule"];
+    if (raw === undefined || raw === null) {
+        return undefined;
+    }
+    const value = Array.isArray(raw) ? String((_b = raw[0]) !== null && _b !== void 0 ? _b : "") : String(raw);
+    const trimmed = value.trim();
+    if (!trimmed) {
+        return undefined;
+    }
+    if (!ObjectID.isValidUUID(trimmed)) {
+        return null;
+    }
+    return new ObjectID(trimmed);
+}
+/*
+ * Coarse client family only, from the User-Agent. The raw string is never
+ * stored: it is high-cardinality, occasionally carries device identifiers,
+ * and the settings page only wants to say "Google Calendar, 12 minutes ago".
+ */
+export function classifyCalendarClient(userAgent) {
+    const raw = (Array.isArray(userAgent) ? userAgent.join(" ") : userAgent || "").trim();
+    if (!raw) {
+        return null;
+    }
+    const value = raw.toLowerCase();
+    if (value.includes("google-calendar") || value.includes("googlecalendar")) {
+        return "Google Calendar";
+    }
+    if (value.includes("outlook") ||
+        value.includes("microsoft office") ||
+        value.includes("exchange") ||
+        value.includes("microsoft-cryptoapi")) {
+        return "Microsoft Outlook";
+    }
+    if (value.includes("calendaragent") ||
+        value.includes("dataaccessd") ||
+        value.includes("ios/") ||
+        value.includes("macos/") ||
+        value.includes("darwin") ||
+        value.includes("ical")) {
+        return "Apple Calendar";
+    }
+    if (value.includes("thunderbird") || value.includes("lightning")) {
+        return "Thunderbird";
+    }
+    if (value.includes("okhttp") || value.includes("android")) {
+        return "Android app";
+    }
+    if (value.includes("mozilla") ||
+        value.includes("chrome") ||
+        value.includes("safari") ||
+        value.includes("firefox") ||
+        value.includes("edge")) {
+        return "Browser";
+    }
+    if (value.includes("curl") || value.includes("wget")) {
+        return "Command line";
+    }
+    return "Other";
+}
+function toDate(value) {
+    if (value instanceof Date) {
+        return Number.isNaN(value.getTime()) ? null : value;
+    }
+    if (typeof value === "string" && value) {
+        const parsed = OneUptimeDate.fromString(value);
+        return Number.isNaN(parsed.getTime()) ? null : parsed;
+    }
+    return null;
+}
+function toIso(value) {
+    const date = toDate(value);
+    return date ? date.toISOString() : null;
+}
+/*
+ * Is a previousTokenHash match still honoured? Only while
+ * previousTokenExpiresAt lies in the future; a rotated-out hash past its
+ * grace is indistinguishable from an unknown one (404).
+ */
+export function isPreviousTokenInGrace(feed, now) {
+    const expiresAt = toDate(feed.previousTokenExpiresAt);
+    if (!expiresAt) {
+        return false;
+    }
+    return expiresAt.getTime() > now.getTime();
+}
+/*
+ * Bookkeeping is only worth a write once in a while, and only for a real
+ * fetch: a HEAD is a client checking whether anything changed, not a read.
+ */
+export function shouldRecordFetch(data) {
+    if ((data.method || "GET").toUpperCase() !== "GET") {
+        return false;
+    }
+    const last = toDate(data.lastFetchedAt);
+    if (!last) {
+        return true;
+    }
+    return data.now.getTime() - last.getTime() >= BOOKKEEPING_INTERVAL_MS;
+}
+function readObjectIdParam(req, name) {
+    var _a;
+    const raw = (_a = req.params) === null || _a === void 0 ? void 0 : _a[name];
+    if (typeof raw !== "string" || !ObjectID.isValidUUID(raw.trim())) {
+        throw new BadDataException(`${name} must be a valid id.`);
+    }
+    return new ObjectID(raw.trim());
+}
+/*
+ * POST bodies on the session routes must be application/json, else 415. The
+ * routes carry no payload, so this is not about parsing: a JSON content type
+ * cannot be produced by a cross-site form post, which is what keeps a
+ * "rotate my link" request from being triggered by a page the user did not
+ * mean to visit.
+ */
+export function assertJsonRequest(req) {
+    var _a;
+    const contentType = (_a = req.headers) === null || _a === void 0 ? void 0 : _a["content-type"];
+    const value = (Array.isArray(contentType) ? contentType[0] || "" : contentType || "")
+        .trim()
+        .toLowerCase();
+    if (!value.startsWith("application/json")) {
+        throw new UnsupportedMediaTypeException("This endpoint expects a JSON request (Content-Type: application/json).");
+    }
+}
+/*
+ * Parse ?from / ?to for /my-shifts. Defaults now -> +30 d; the span is
+ * capped at 120 d by moving `to` in, never by refusing the request.
+ *
+ * The window is then clamped into the same range the feeds themselves can
+ * address -- [now - MAX_PAST_DAYS, now + MAX_FUTURE_DAYS]. Without that,
+ * `?from=2500-01-01` was accepted: every distinct day-aligned window is a
+ * fresh schedule-cache entry AND a fresh LayerUtil expansion that walks one
+ * rotation period at a time from the layer's start to the window, which for a
+ * far-future start means the full 200,000-iteration cap per restricted layer
+ * -- seconds of synchronous CPU per request, holding one of the four
+ * per-process render slots the public feeds share. Clamping keeps a session
+ * request no more expensive than a feed poll and keeps it on the same cache
+ * keys.
+ */
+export function readMyShiftsWindow(req, now) {
+    var _a, _b;
+    const rawFrom = (_a = req.query) === null || _a === void 0 ? void 0 : _a["from"];
+    const rawTo = (_b = req.query) === null || _b === void 0 ? void 0 : _b["to"];
+    let from = now;
+    if (typeof rawFrom === "string" && rawFrom.trim()) {
+        if (!OneUptimeDate.isValidDateString(rawFrom.trim())) {
+            throw new BadDataException("from must be an ISO 8601 date.");
+        }
+        from = OneUptimeDate.fromString(rawFrom.trim());
+    }
+    let to = OneUptimeDate.addRemoveDays(from, MY_SHIFTS_DEFAULT_DAYS);
+    if (typeof rawTo === "string" && rawTo.trim()) {
+        if (!OneUptimeDate.isValidDateString(rawTo.trim())) {
+            throw new BadDataException("to must be an ISO 8601 date.");
+        }
+        to = OneUptimeDate.fromString(rawTo.trim());
+    }
+    if (Number.isNaN(from.getTime()) || Number.isNaN(to.getTime())) {
+        throw new BadDataException("from and to must be ISO 8601 dates.");
+    }
+    if (to.getTime() <= from.getTime()) {
+        throw new BadDataException("to must be after from.");
+    }
+    /*
+     * The addressable range. It is 240 days wide, so it always leaves room for
+     * a non-empty window whatever the caller asked for.
+     */
+    const earliestFrom = OneUptimeDate.addRemoveDays(now, -MAX_PAST_DAYS);
+    const latestTo = OneUptimeDate.addRemoveDays(now, MAX_FUTURE_DAYS);
+    const latestFrom = OneUptimeDate.addRemoveDays(latestTo, -1);
+    if (from.getTime() < earliestFrom.getTime()) {
+        from = earliestFrom;
+    }
+    if (from.getTime() > latestFrom.getTime()) {
+        from = latestFrom;
+    }
+    /*
+     * `to` was validated against the RAW `from`; once `from` has moved, a `to`
+     * that now lies at or before it is answered with the default span rather
+     * than an empty window.
+     */
+    if (to.getTime() <= from.getTime()) {
+        to = OneUptimeDate.addRemoveDays(from, MY_SHIFTS_DEFAULT_DAYS);
+    }
+    const spanCap = OneUptimeDate.addRemoveDays(from, MY_SHIFTS_MAX_DAYS);
+    if (to.getTime() > spanCap.getTime()) {
+        to = spanCap;
+    }
+    if (to.getTime() > latestTo.getTime()) {
+        to = latestTo;
+    }
+    return { from, to };
+}
+// -- FeedStatus -------------------------------------------------------------
+function defaultSettings(kind) {
+    if (kind === OnCallCalendarFeedKind.Personal) {
+        return {
+            includeCoveringShifts: true,
+            pastDays: DEFAULT_PAST_DAYS,
+            futureDays: DEFAULT_FUTURE_DAYS,
+        };
+    }
+    return {
+        includeCoverageGaps: false,
+        minimumGapMinutes: 60,
+        pastDays: DEFAULT_PAST_DAYS,
+        futureDays: DEFAULT_FUTURE_DAYS,
+        rotateWhenMemberLeaves: false,
+    };
+}
+/*
+ * FeedStatus for a feed that does not exist (yet).
+ */
+export function buildAbsentFeedStatus(kind) {
+    return {
+        exists: false,
+        feedId: null,
+        isEnabled: false,
+        needsRegeneration: false,
+        tokenHint: null,
+        rotatedAt: null,
+        previousTokenExpiresAt: null,
+        lastFetchedAt: null,
+        lastFetchedClient: null,
+        fetchCount: 0,
+        lastRenderTruncated: false,
+        settings: defaultSettings(kind),
+        urls: null,
+        hostWarning: OnCallCalendarFeedUrls.getHostWarning(),
+        protocolWarning: OnCallCalendarFeedUrls.getProtocolWarning(),
+    };
+}
+/*
+ * FeedStatus for an existing row. `plaintextToken` is the token just minted
+ * by a rotate/publish (known without a decrypt); otherwise `decryptedToken`
+ * is what the root read handed back, verified against the stored hash. A
+ * token that fails to decrypt or does not hash to tokenHash means the
+ * ENCRYPTION_SECRET changed under the row: the URL cannot be shown and the
+ * UI offers "Regenerate link".
+ *
+ * The hash the decrypted token is checked against is `verifiedTokenHash` --
+ * the one readTokenForStatus read alongside the token -- falling back to the
+ * row's own `tokenHash`. The status rows the routes read do NOT carry
+ * tokenHash (STATUS_SELECT cannot select it: the column's read access list is
+ * empty, so the non-root schedule/project reads would be refused), and
+ * requiring it here is what made every /current and /publish answer
+ * `needsRegeneration: true, urls: null` for a perfectly good feed.
+ */
+export function buildFeedStatus(data) {
+    var _a, _b, _c, _d, _e;
+    const feed = data.feed;
+    const expectedTokenHash = feed.tokenHash || data.verifiedTokenHash;
+    let token = null;
+    let needsRegeneration = false;
+    if (data.plaintextToken &&
+        CalendarFeedToken.isValidShape(data.plaintextToken)) {
+        token = data.plaintextToken;
+    }
+    else if (data.decryptFailed) {
+        needsRegeneration = true;
+    }
+    else if (data.decryptedToken &&
+        CalendarFeedToken.isValidShape(data.decryptedToken) &&
+        expectedTokenHash &&
+        CalendarFeedToken.isHashEqual(CalendarFeedToken.hash(data.decryptedToken), expectedTokenHash)) {
+        token = data.decryptedToken;
+    }
+    else {
+        needsRegeneration = true;
+    }
+    const settings = data.kind === OnCallCalendarFeedKind.Personal
+        ? {
+            includeCoveringShifts: feed.includeCoveringShifts !== false,
+            pastDays: (_a = feed.pastDays) !== null && _a !== void 0 ? _a : DEFAULT_PAST_DAYS,
+            futureDays: (_b = feed.futureDays) !== null && _b !== void 0 ? _b : DEFAULT_FUTURE_DAYS,
+        }
+        : {
+            includeCoverageGaps: feed.includeCoverageGaps === true,
+            minimumGapMinutes: (_c = feed.minimumGapMinutes) !== null && _c !== void 0 ? _c : 60,
+            pastDays: (_d = feed.pastDays) !== null && _d !== void 0 ? _d : DEFAULT_PAST_DAYS,
+            futureDays: (_e = feed.futureDays) !== null && _e !== void 0 ? _e : DEFAULT_FUTURE_DAYS,
+            rotateWhenMemberLeaves: feed.rotateWhenMemberLeaves === true,
+        };
+    const feedId = feed.id
+        ? feed.id.toString()
+        : feed._id
+            ? feed._id.toString()
+            : null;
+    return {
+        exists: true,
+        feedId,
+        isEnabled: feed.isEnabled !== false,
+        needsRegeneration,
+        tokenHint: feed.tokenHint || null,
+        rotatedAt: toIso(feed.rotatedAt),
+        previousTokenExpiresAt: toIso(feed.previousTokenExpiresAt),
+        lastFetchedAt: toIso(feed.lastFetchedAt),
+        lastFetchedClient: feed.lastFetchedClient || null,
+        fetchCount: typeof feed.fetchCount === "number" ? feed.fetchCount : 0,
+        lastRenderTruncated: feed.lastRenderTruncated === true,
+        settings,
+        urls: token
+            ? OnCallCalendarFeedUrls.buildFeedUrls({ kind: data.kind, token })
+            : null,
+        hostWarning: OnCallCalendarFeedUrls.getHostWarning(),
+        protocolWarning: OnCallCalendarFeedUrls.getProtocolWarning(),
+    };
+}
+/*
+ * The one decrypting read. Selecting `token` makes DatabaseService run
+ * Encryption.decrypt on the way out; with the wrong secret that either
+ * throws or yields bytes that do not hash to tokenHash. Both become
+ * needsRegeneration, never a 500.
+ */
+async function readTokenForStatus(data) {
+    try {
+        let row = null;
+        if (data.kind === OnCallCalendarFeedKind.Personal) {
+            row = await UserOnCallCalendarFeedService.findOneById({
+                id: data.id,
+                select: { _id: true, token: true, tokenHash: true },
+                props: { isRoot: true, ignoreHooks: true },
+            });
+        }
+        else if (data.kind === OnCallCalendarFeedKind.Schedule) {
+            row = await OnCallDutyPolicyScheduleCalendarFeedService.findOneById({
+                id: data.id,
+                select: { _id: true, token: true, tokenHash: true },
+                props: { isRoot: true, ignoreHooks: true },
+            });
+        }
+        else {
+            row = await ProjectOnCallCalendarFeedService.findOneById({
+                id: data.id,
+                select: { _id: true, token: true, tokenHash: true },
+                props: { isRoot: true, ignoreHooks: true },
+            });
+        }
+        if (!row || !row.token) {
+            return { decryptFailed: true };
+        }
+        if (!row.tokenHash ||
+            !CalendarFeedToken.isValidShape(row.token) ||
+            !CalendarFeedToken.isHashEqual(CalendarFeedToken.hash(row.token), row.tokenHash)) {
+            return { decryptFailed: true };
+        }
+        return {
+            decryptedToken: row.token,
+            verifiedTokenHash: row.tokenHash,
+            decryptFailed: false,
+        };
+    }
+    catch (err) {
+        logger.warn(`OnCallCalendarAPI: could not decrypt the ${data.kind} calendar feed token for feed ${data.id.toString()}; the link needs regenerating.`);
+        logger.warn(err);
+        return { decryptFailed: true };
+    }
+}
+async function buildStatusForRow(data) {
+    if (data.plaintextToken) {
+        return buildFeedStatus({
+            kind: data.kind,
+            feed: data.feed,
+            plaintextToken: data.plaintextToken,
+        });
+    }
+    if (!data.feed.id) {
+        return buildFeedStatus({
+            kind: data.kind,
+            feed: data.feed,
+            decryptFailed: true,
+        });
+    }
+    const decrypted = await readTokenForStatus({ kind: data.kind, id: data.feed.id });
+    return buildFeedStatus({
+        kind: data.kind,
+        feed: data.feed,
+        decryptedToken: decrypted.decryptedToken,
+        verifiedTokenHash: decrypted.verifiedTokenHash,
+        decryptFailed: decrypted.decryptFailed,
+    });
+}
+/* The non-secret columns a status read selects (any of the three models). */
+const STATUS_SELECT = {
+    _id: true,
+    projectId: true,
+    isEnabled: true,
+    tokenHint: true,
+    rotatedAt: true,
+    previousTokenExpiresAt: true,
+    lastFetchedAt: true,
+    lastFetchedClient: true,
+    fetchCount: true,
+    lastRenderTruncated: true,
+    pastDays: true,
+    futureDays: true,
+};
+// -- Public feed lookup -----------------------------------------------------
+/*
+ * The columns the PUBLIC path reads. `token` is never among them: the public
+ * routes must keep working after an ENCRYPTION_SECRET rotation, and a select
+ * that included the encrypted column would make DatabaseService decrypt it on
+ * every poll. Tests pin this.
+ */
+const PUBLIC_COMMON_SELECT = {
+    _id: true,
+    projectId: true,
+    isEnabled: true,
+    pastDays: true,
+    futureDays: true,
+    lastFetchedAt: true,
+    fetchCount: true,
+    previousTokenExpiresAt: true,
+};
+async function lookupPersonalFeed(tokenHash, now) {
+    const select = Object.assign(Object.assign({}, PUBLIC_COMMON_SELECT), { userId: true, includeCoveringShifts: true });
+    const current = await UserOnCallCalendarFeedService.findOneBy({
+        query: { tokenHash },
+        select,
+        props: { isRoot: true, ignoreHooks: true },
+    });
+    if (current) {
+        return { feed: current, viaPreviousToken: false };
+    }
+    const previous = await UserOnCallCalendarFeedService.findOneBy({
+        query: { previousTokenHash: tokenHash },
+        select,
+        props: { isRoot: true, ignoreHooks: true },
+    });
+    if (!previous || !isPreviousTokenInGrace(previous, now)) {
+        return null;
+    }
+    return { feed: previous, viaPreviousToken: true };
+}
+async function lookupScheduleFeed(tokenHash, now) {
+    const select = Object.assign(Object.assign({}, PUBLIC_COMMON_SELECT), { onCallDutyPolicyScheduleId: true, includeCoverageGaps: true, minimumGapMinutes: true });
+    const current = await OnCallDutyPolicyScheduleCalendarFeedService.findOneBy({
+        query: { tokenHash },
+        select,
+        props: { isRoot: true, ignoreHooks: true },
+    });
+    if (current) {
+        return { feed: current, viaPreviousToken: false };
+    }
+    const previous = await OnCallDutyPolicyScheduleCalendarFeedService.findOneBy({
+        query: { previousTokenHash: tokenHash },
+        select,
+        props: { isRoot: true, ignoreHooks: true },
+    });
+    if (!previous || !isPreviousTokenInGrace(previous, now)) {
+        return null;
+    }
+    return { feed: previous, viaPreviousToken: true };
+}
+async function lookupProjectFeed(tokenHash, now) {
+    const select = Object.assign(Object.assign({}, PUBLIC_COMMON_SELECT), { includeCoverageGaps: true, minimumGapMinutes: true });
+    const current = await ProjectOnCallCalendarFeedService.findOneBy({
+        query: { tokenHash },
+        select,
+        props: { isRoot: true, ignoreHooks: true },
+    });
+    if (current) {
+        return { feed: current, viaPreviousToken: false };
+    }
+    const previous = await ProjectOnCallCalendarFeedService.findOneBy({
+        query: { previousTokenHash: tokenHash },
+        select,
+        props: { isRoot: true, ignoreHooks: true },
+    });
+    if (!previous || !isPreviousTokenInGrace(previous, now)) {
+        return null;
+    }
+    return { feed: previous, viaPreviousToken: true };
+}
+// -- Bookkeeping ------------------------------------------------------------
+/*
+ * Fire-and-forget root update after a served GET: when it was fetched, by
+ * what kind of client, how many times (read-modify-write of the value the
+ * lookup already read, so approximate under concurrency and deliberately
+ * so), and whether the last render was cut. Never awaited by the route, never
+ * allowed to throw into it.
+ */
+function recordFetch(data) {
+    var _a;
+    if (!data.feed.id) {
+        return;
+    }
+    if (!shouldRecordFetch({
+        method: data.req.method,
+        lastFetchedAt: data.feed.lastFetchedAt,
+        now: data.now,
+    })) {
+        return;
+    }
+    const client = classifyCalendarClient((_a = data.req.headers) === null || _a === void 0 ? void 0 : _a["user-agent"]);
+    const previousCount = typeof data.feed.fetchCount === "number" &&
+        Number.isFinite(data.feed.fetchCount)
+        ? data.feed.fetchCount
+        : Number(data.feed.fetchCount) || 0;
+    const update = {
+        lastFetchedAt: data.now,
+        lastFetchedClient: client || "Other",
+        fetchCount: previousCount + 1,
+        lastRenderTruncated: data.truncated,
+    };
+    const id = data.feed.id;
+    let write;
+    if (data.kind === OnCallCalendarFeedKind.Personal) {
+        write = UserOnCallCalendarFeedService.updateOneById({
+            id,
+            data: update,
+            props: { isRoot: true, ignoreHooks: true },
+        });
+    }
+    else if (data.kind === OnCallCalendarFeedKind.Schedule) {
+        write = OnCallDutyPolicyScheduleCalendarFeedService.updateOneById({
+            id,
+            data: update,
+            props: { isRoot: true, ignoreHooks: true },
+        });
+    }
+    else {
+        write = ProjectOnCallCalendarFeedService.updateOneById({
+            id,
+            data: update,
+            props: { isRoot: true, ignoreHooks: true },
+        });
+    }
+    write.catch((err) => {
+        logger.warn(`OnCallCalendarAPI: bookkeeping for the ${data.kind} calendar feed ${id.toString()} failed.`);
+        logger.warn(err);
+    });
+}
+// -- Public routes ----------------------------------------------------------
+/*
+ * The shared tail of the three public routes, from "we have a lookup result"
+ * to "bytes went out". Everything kind-specific is in the render request.
+ */
+async function serveFeed(data) {
+    let outcome;
+    if (data.lookup.viaPreviousToken) {
+        outcome = OnCallCalendarFeedRenderer.buildEmptyOutcome({
+            kind: data.kind,
+            reason: TOKEN_ROTATED_REASON,
+            now: data.now,
+        });
+    }
+    else if (data.lookup.feed.isEnabled === false) {
+        outcome = OnCallCalendarFeedRenderer.buildEmptyOutcome({
+            kind: data.kind,
+            reason: FEED_DISABLED_REASON,
+            now: data.now,
+        });
+    }
+    else {
+        outcome = await OnCallCalendarFeedRenderer.render(data.request);
+    }
+    if (outcome.status === FeedRenderStatus.Unavailable) {
+        return sendUnavailable(data.req, data.res, outcome.retryAfterSeconds || KILL_SWITCH_RETRY_AFTER_SECONDS);
+    }
+    if (outcome.stale) {
+        data.res.set("Warning", STALE_WARNING_HEADER);
+    }
+    Response.sendCalendarResponse(data.req, data.res, {
+        body: outcome.body,
+        etag: outcome.etag,
+        lastModified: outcome.lastModified,
+    });
+    /*
+     * Only a real, current, enabled feed is worth bookkeeping. An empty
+     * calendar served for a rotated-out link or a disabled feed is not a
+     * fetch the settings page should count -- the two conditions above say so
+     * exactly. Everything else that went out as a 200 IS a fetch, including the
+     * empty calendars the renderer produces for "you are not on a schedule yet"
+     * or "this project is below plan": those are precisely the users staring at
+     * an empty calendar and asking "is my calendar app even reaching the
+     * server?", which lastFetchedAt/lastFetchedClient exist to answer. Only an
+     * Unavailable outcome is skipped, and that one already returned above
+     * without sending a body.
+     */
+    if (!data.lookup.viaPreviousToken && data.lookup.feed.isEnabled !== false) {
+        recordFetch({
+            kind: data.kind,
+            feed: data.lookup.feed,
+            req: data.req,
+            now: data.now,
+            truncated: outcome.truncated || outcome.stale,
+        });
+    }
+}
+router.get(PERSONAL_FEED_ROUTE, killSwitchMiddleware, schemeGuardMiddleware, OnCallCalendarFeedRateLimit.getMiddleware(), async (req, res, next) => {
+    var _a, _b, _c;
+    try {
+        const token = (_a = req.params) === null || _a === void 0 ? void 0 : _a["token"];
+        if (!CalendarFeedToken.isValidShape(token)) {
+            return sendNotFound(req, res);
+        }
+        const scheduleFilter = readScheduleFilter(req);
+        if (scheduleFilter === null) {
+            return sendNotFound(req, res);
+        }
+        const now = OneUptimeDate.getCurrentDate();
+        const tokenHash = CalendarFeedToken.hash(token);
+        const lookup = await lookupPersonalFeed(tokenHash, now);
+        if (!lookup || !lookup.feed.id || !lookup.feed.projectId) {
+            return sendNotFound(req, res);
+        }
+        if (!lookup.feed.userId) {
+            return sendNotFound(req, res);
+        }
+        return await serveFeed({
+            kind: OnCallCalendarFeedKind.Personal,
+            req,
+            res,
+            lookup,
+            now,
+            request: {
+                kind: OnCallCalendarFeedKind.Personal,
+                feedId: lookup.feed.id,
+                projectId: lookup.feed.projectId,
+                userId: lookup.feed.userId,
+                tokenHash,
+                includeCoveringShifts: lookup.feed.includeCoveringShifts !== false,
+                pastDays: (_b = lookup.feed.pastDays) !== null && _b !== void 0 ? _b : DEFAULT_PAST_DAYS,
+                futureDays: (_c = lookup.feed.futureDays) !== null && _c !== void 0 ? _c : DEFAULT_FUTURE_DAYS,
+                scheduleFilterId: scheduleFilter,
+                now,
+            },
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
+router.get(SCHEDULE_FEED_ROUTE, killSwitchMiddleware, schemeGuardMiddleware, OnCallCalendarFeedRateLimit.getMiddleware(), async (req, res, next) => {
+    var _a, _b, _c, _d;
+    try {
+        const token = (_a = req.params) === null || _a === void 0 ? void 0 : _a["token"];
+        if (!CalendarFeedToken.isValidShape(token)) {
+            return sendNotFound(req, res);
+        }
+        const now = OneUptimeDate.getCurrentDate();
+        const tokenHash = CalendarFeedToken.hash(token);
+        const lookup = await lookupScheduleFeed(tokenHash, now);
+        if (!lookup ||
+            !lookup.feed.id ||
+            !lookup.feed.projectId ||
+            !lookup.feed.onCallDutyPolicyScheduleId) {
+            return sendNotFound(req, res);
+        }
+        return await serveFeed({
+            kind: OnCallCalendarFeedKind.Schedule,
+            req,
+            res,
+            lookup,
+            now,
+            request: {
+                kind: OnCallCalendarFeedKind.Schedule,
+                feedId: lookup.feed.id,
+                projectId: lookup.feed.projectId,
+                scheduleId: lookup.feed.onCallDutyPolicyScheduleId,
+                tokenHash,
+                includeCoverageGaps: lookup.feed.includeCoverageGaps === true,
+                minimumGapMinutes: (_b = lookup.feed.minimumGapMinutes) !== null && _b !== void 0 ? _b : 60,
+                pastDays: (_c = lookup.feed.pastDays) !== null && _c !== void 0 ? _c : DEFAULT_PAST_DAYS,
+                futureDays: (_d = lookup.feed.futureDays) !== null && _d !== void 0 ? _d : DEFAULT_FUTURE_DAYS,
+                now,
+            },
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
+router.get(PROJECT_FEED_ROUTE, killSwitchMiddleware, schemeGuardMiddleware, OnCallCalendarFeedRateLimit.getMiddleware(), async (req, res, next) => {
+    var _a, _b, _c, _d;
+    try {
+        const token = (_a = req.params) === null || _a === void 0 ? void 0 : _a["token"];
+        if (!CalendarFeedToken.isValidShape(token)) {
+            return sendNotFound(req, res);
+        }
+        const now = OneUptimeDate.getCurrentDate();
+        const tokenHash = CalendarFeedToken.hash(token);
+        const lookup = await lookupProjectFeed(tokenHash, now);
+        if (!lookup || !lookup.feed.id || !lookup.feed.projectId) {
+            return sendNotFound(req, res);
+        }
+        return await serveFeed({
+            kind: OnCallCalendarFeedKind.Project,
+            req,
+            res,
+            lookup,
+            now,
+            request: {
+                kind: OnCallCalendarFeedKind.Project,
+                feedId: lookup.feed.id,
+                projectId: lookup.feed.projectId,
+                tokenHash,
+                includeCoverageGaps: lookup.feed.includeCoverageGaps === true,
+                minimumGapMinutes: (_b = lookup.feed.minimumGapMinutes) !== null && _b !== void 0 ? _b : 60,
+                pastDays: (_c = lookup.feed.pastDays) !== null && _c !== void 0 ? _c : DEFAULT_PAST_DAYS,
+                futureDays: (_d = lookup.feed.futureDays) !== null && _d !== void 0 ? _d : DEFAULT_FUTURE_DAYS,
+                now,
+            },
+        });
+    }
+    catch (err) {
+        next(err);
+    }
+});
+/*
+ * Registered AFTER the three exact GET routes, so those still win, and
+ * before the session routes, whose paths (`feed/`, `schedule-feed/`,
+ * `project-feed/`, `my-shifts`) share no prefix with these.
+ */
+router.all(PERSONAL_FEED_FALLBACK_ROUTE, feedFallbackHandler);
+router.all(SCHEDULE_FEED_FALLBACK_ROUTE, feedFallbackHandler);
+router.all(PROJECT_FEED_FALLBACK_ROUTE, feedFallbackHandler);
+// -- Session routes: personal feed -----------------------------------------
+/*
+ * The caller's own feed row in the tenant project. Root read: the row is
+ * addressed by (projectId, userId) where userId is the SESSION's user, so
+ * the model's CurrentUser predicate is satisfied by construction and a
+ * non-root read would only add a permission round trip.
+ */
+async function findPersonalFeed(data) {
+    return await UserOnCallCalendarFeedService.findOneBy({
+        query: {
+            projectId: data.projectId,
+            userId: data.userId,
+        },
+        select: Object.assign(Object.assign({}, STATUS_SELECT), { userId: true, includeCoveringShifts: true }),
+        props: { isRoot: true, ignoreHooks: true },
+    });
+}
+function requireUserId(props) {
+    if (!props.userId) {
+        throw new BadDataException("A logged-in user is required.");
+    }
+    return props.userId;
+}
+router.get(FEED_CURRENT_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+        const userId = requireUserId(props);
+        const feed = await findPersonalFeed({
+            projectId,
+            userId,
+        });
+        if (!feed) {
+            return Response.sendJsonObjectResponse(req, res, buildAbsentFeedStatus(OnCallCalendarFeedKind.Personal));
+        }
+        const status = await buildStatusForRow({
+            kind: OnCallCalendarFeedKind.Personal,
+            feed,
+        });
+        return Response.sendJsonObjectResponse(req, res, status);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+/*
+ * Mint-or-rotate under a per-(project, user) lock. The UNIQUE(projectId,
+ * userId) index is the backstop; the lock is what turns a double click into
+ * one new link rather than one new link and one 500. Without Redis the lock
+ * cannot be taken, and the index alone has to do -- logged, not fatal.
+ */
+async function withRotateLock(key, work) {
+    let mutex = null;
+    try {
+        mutex = await Semaphore.lock({
+            key,
+            namespace: ROTATE_LOCK_NAMESPACE,
+            lockTimeout: ROTATE_LOCK_TIMEOUT_MS,
+        });
+    }
+    catch (err) {
+        logger.warn("OnCallCalendarAPI: could not take the rotate lock; relying on the unique index.");
+        logger.warn(err);
+        mutex = null;
+    }
+    try {
+        return await work();
+    }
+    finally {
+        if (mutex) {
+            try {
+                await Semaphore.release(mutex);
+            }
+            catch (err) {
+                logger.warn("OnCallCalendarAPI: releasing the rotate lock failed.");
+                logger.warn(err);
+            }
+        }
+    }
+}
+router.post(FEED_ROTATE_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        assertJsonRequest(req);
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+        const userId = requireUserId(props);
+        const plaintextToken = await withRotateLock(`${projectId.toString()}-${userId.toString()}`, async () => {
+            const existing = await UserOnCallCalendarFeedService.findOneBy({
+                query: { projectId, userId },
+                select: { _id: true },
+                props: { isRoot: true, ignoreHooks: true },
+            });
+            if (!existing || !existing.id) {
+                const created = await UserOnCallCalendarFeedService.createForUser({
+                    projectId,
+                    userId,
+                });
+                return created.minted.token;
+            }
+            const rotation = await UserOnCallCalendarFeedService.rotateTokenById({
+                id: existing.id,
+            });
+            return rotation.token;
+        });
+        await OnCallCalendarFeedCache.purgeForUser(projectId.toString(), userId.toString());
+        const feed = await findPersonalFeed({
+            projectId,
+            userId,
+        });
+        if (!feed) {
+            throw new NotFoundException("Calendar feed not found.");
+        }
+        const status = await buildStatusForRow({
+            kind: OnCallCalendarFeedKind.Personal,
+            feed,
+            plaintextToken,
+        });
+        return Response.sendJsonObjectResponse(req, res, status);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+// -- Session routes: schedule feed -----------------------------------------
+/*
+ * NON-root read with the caller's props: the copied TableAccessControl and
+ * the @CanAccessIfCanReadOn label scoping decide whether this caller may see
+ * that the feed exists at all.
+ */
+async function findScheduleFeedAsCaller(data) {
+    return await OnCallDutyPolicyScheduleCalendarFeedService.findOneBy({
+        query: {
+            onCallDutyPolicyScheduleId: data.scheduleId,
+            projectId: data.projectId,
+        },
+        select: Object.assign(Object.assign({}, STATUS_SELECT), { onCallDutyPolicyScheduleId: true, includeCoverageGaps: true, minimumGapMinutes: true, rotateWhenMemberLeaves: true }),
+        props: data.props,
+    });
+}
+router.get(SCHEDULE_FEED_CURRENT_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+        const scheduleId = readObjectIdParam(req, "scheduleId");
+        const feed = await findScheduleFeedAsCaller({ scheduleId, projectId, props });
+        if (!feed) {
+            return Response.sendJsonObjectResponse(req, res, buildAbsentFeedStatus(OnCallCalendarFeedKind.Schedule));
+        }
+        const status = await buildStatusForRow({
+            kind: OnCallCalendarFeedKind.Schedule,
+            feed,
+        });
+        return Response.sendJsonObjectResponse(req, res, status);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+/*
+ * Publish = a NON-root create with the caller's props, so DatabaseService
+ * runs the schedule's Create permission check and the service hook mints the
+ * token (anything the request carried is discarded). A feed that already
+ * exists is re-enabled through a non-root update instead -- same permission
+ * gate, and the existing link keeps working for everyone who already has it.
+ */
+router.post(SCHEDULE_FEED_PUBLISH_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        assertJsonRequest(req);
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+        const scheduleId = readObjectIdParam(req, "scheduleId");
+        const existing = await findScheduleFeedAsCaller({ scheduleId, projectId, props });
+        if (existing && existing.id) {
+            await OnCallDutyPolicyScheduleCalendarFeedService.updateOneBy({
+                query: { _id: existing.id, projectId },
+                data: { isEnabled: true },
+                props,
+            });
+        }
+        else {
+            /*
+             * The create alone is not enough of a gate. Its permission check
+             * (CreatePermission) looks at table and column permissions and at
+             * ownership; @CanAccessIfCanReadOn -- the label scoping that decides
+             * WHICH schedules an editor may touch -- is only applied to query
+             * operations (read/update/delete), and the service's own check runs
+             * as root. So a label-restricted editor who knows a schedule's id
+             * could publish a feed for a schedule outside their labels. Reading
+             * the schedule with the caller's props first applies exactly the
+             * scoping /current and /rotate already get.
+             */
+            const schedule = await OnCallDutyPolicyScheduleService.findOneBy({
+                query: { _id: scheduleId, projectId },
+                select: { _id: true },
+                props,
+            });
+            if (!schedule) {
+                throw new NotFoundException("On-call schedule not found.");
+            }
+            const model = new OnCallDutyPolicyScheduleCalendarFeed();
+            model.projectId = projectId;
+            model.onCallDutyPolicyScheduleId = scheduleId;
+            await OnCallDutyPolicyScheduleCalendarFeedService.create({
+                data: model,
+                props,
+            });
+        }
+        await OnCallCalendarFeedCache.purgeForSchedule(scheduleId.toString());
+        const feed = await findScheduleFeedAsCaller({ scheduleId, projectId, props });
+        if (!feed) {
+            throw new NotFoundException("Calendar feed not found.");
+        }
+        const status = await buildStatusForRow({
+            kind: OnCallCalendarFeedKind.Schedule,
+            feed,
+        });
+        return Response.sendJsonObjectResponse(req, res, status);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+/*
+ * Rotate = a NON-root update of an updatable column (isEnabled, written back
+ * with its current value) so the Edit permission check runs, THEN the root
+ * mint. The token columns themselves are root-only on update, which is why
+ * the permission probe cannot be the rotation write itself.
+ */
+router.post(SCHEDULE_FEED_ROTATE_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        assertJsonRequest(req);
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+        const scheduleId = readObjectIdParam(req, "scheduleId");
+        const existing = await findScheduleFeedAsCaller({ scheduleId, projectId, props });
+        if (!existing || !existing.id) {
+            throw new NotFoundException("This schedule has no shared calendar feed yet. Publish one first.");
+        }
+        await OnCallDutyPolicyScheduleCalendarFeedService.updateOneBy({
+            query: { _id: existing.id, projectId },
+            data: { isEnabled: existing.isEnabled !== false },
+            props,
+        });
+        const rotation = await OnCallDutyPolicyScheduleCalendarFeedService.rotateTokenById({
+            id: existing.id,
+        });
+        await OnCallCalendarFeedCache.purgeForSchedule(scheduleId.toString());
+        const feed = await findScheduleFeedAsCaller({ scheduleId, projectId, props });
+        if (!feed) {
+            throw new NotFoundException("Calendar feed not found.");
+        }
+        const status = await buildStatusForRow({
+            kind: OnCallCalendarFeedKind.Schedule,
+            feed,
+            plaintextToken: rotation.token,
+        });
+        return Response.sendJsonObjectResponse(req, res, status);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+// -- Session routes: project feed ------------------------------------------
+async function findProjectFeedAsCaller(data) {
+    return await ProjectOnCallCalendarFeedService.findOneBy({
+        query: {
+            projectId: data.projectId,
+        },
+        select: Object.assign(Object.assign({}, STATUS_SELECT), { includeCoverageGaps: true, minimumGapMinutes: true, rotateWhenMemberLeaves: true }),
+        props: data.props,
+    });
+}
+router.get(PROJECT_FEED_CURRENT_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+        const feed = await findProjectFeedAsCaller({ projectId, props });
+        if (!feed) {
+            return Response.sendJsonObjectResponse(req, res, buildAbsentFeedStatus(OnCallCalendarFeedKind.Project));
+        }
+        const status = await buildStatusForRow({
+            kind: OnCallCalendarFeedKind.Project,
+            feed,
+        });
+        return Response.sendJsonObjectResponse(req, res, status);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+router.post(PROJECT_FEED_PUBLISH_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        assertJsonRequest(req);
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+        const existing = await findProjectFeedAsCaller({ projectId, props });
+        if (existing && existing.id) {
+            await ProjectOnCallCalendarFeedService.updateOneBy({
+                query: { _id: existing.id, projectId },
+                data: { isEnabled: true },
+                props,
+            });
+        }
+        else {
+            const model = new ProjectOnCallCalendarFeed();
+            model.projectId = projectId;
+            await ProjectOnCallCalendarFeedService.create({
+                data: model,
+                props,
+            });
+        }
+        await OnCallCalendarFeedCache.purgeForProject(projectId.toString());
+        const feed = await findProjectFeedAsCaller({ projectId, props });
+        if (!feed) {
+            throw new NotFoundException("Calendar feed not found.");
+        }
+        const status = await buildStatusForRow({
+            kind: OnCallCalendarFeedKind.Project,
+            feed,
+        });
+        return Response.sendJsonObjectResponse(req, res, status);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+router.post(PROJECT_FEED_ROTATE_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        assertJsonRequest(req);
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+        const existing = await findProjectFeedAsCaller({ projectId, props });
+        if (!existing || !existing.id) {
+            throw new NotFoundException("This project has no shared calendar feed yet. Publish one first.");
+        }
+        await ProjectOnCallCalendarFeedService.updateOneBy({
+            query: { _id: existing.id, projectId },
+            data: { isEnabled: existing.isEnabled !== false },
+            props,
+        });
+        const rotation = await ProjectOnCallCalendarFeedService.rotateTokenById({
+            id: existing.id,
+        });
+        await OnCallCalendarFeedCache.purgeForProject(projectId.toString());
+        const feed = await findProjectFeedAsCaller({ projectId, props });
+        if (!feed) {
+            throw new NotFoundException("Calendar feed not found.");
+        }
+        const status = await buildStatusForRow({
+            kind: OnCallCalendarFeedKind.Project,
+            feed,
+            plaintextToken: rotation.token,
+        });
+        return Response.sendJsonObjectResponse(req, res, status);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+// -- Session route: /my-shifts ---------------------------------------------
+/*
+ * The caller's own upcoming shifts as JSON. Scoped to the tenant project
+ * when a `tenantid` header is present (the dashboard), to every project the
+ * caller is rostered in otherwise (the mobile app). Same resolver and
+ * schedule-level cache as the feeds; the per-process render cap applies, and
+ * a capped request is a 503 the mobile app answers by falling back to its
+ * roster-derived list.
+ */
+router.get(MY_SHIFTS_ROUTE, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+    try {
+        const props = await CommonAPI.getDatabaseCommonInteractionProps(req);
+        const userId = requireUserId(props);
+        let projectIds = undefined;
+        if (props.tenantId) {
+            projectIds = [CommonAPI.assertAuthenticatedProjectMember(props)];
+        }
+        const now = OneUptimeDate.getCurrentDate();
+        const window = readMyShiftsWindow(req, now);
+        /*
+         * Session renders leave slots free for the public feeds. /my-shifts is
+         * called by a logged-in client that can retry and that falls back to
+         * its roster list; a calendar client that gets a 503 shows a stale or
+         * empty calendar to somebody who may be on call. With the default
+         * concurrency of 4 this route may hold at most 2 slots at once.
+         */
+        if (!OnCallCalendarFeedCache.tryAcquireRenderSlot({
+            leaveFreeSlots: Math.floor(OnCallCalendarFeedCache.getRenderConcurrency() / 2),
+        })) {
+            return sendUnavailable(req, res, 60);
+        }
+        let result;
+        try {
+            result = await OnCallCalendarFeedRenderer.materializeUserShifts({
+                userId,
+                projectIds,
+                from: window.from,
+                to: window.to,
+                now,
+            });
+        }
+        finally {
+            OnCallCalendarFeedCache.releaseRenderSlot();
+        }
+        const payload = {
+            shifts: MaterializedShiftUtil.toJSONArray(result.shifts),
+            truncated: result.truncated,
+            generatedAt: result.generatedAt.toISOString(),
+        };
+        return Response.sendJsonObjectResponse(req, res, payload);
+    }
+    catch (err) {
+        next(err);
+    }
+});
+export default router;
+//# sourceMappingURL=OnCallCalendarAPI.js.map