@oneuptime/common 12.0.29 → 12.0.31

package/Server/Services/OnCallDutyPolicyScheduleCalendarFeedService.ts

@@ -0,0 +1,260 @@
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
+import CalendarFeedToken, {
+  CalendarFeedRotation,
+} from "../Utils/OnCall/CalendarFeedToken";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model from "../../Models/DatabaseModels/OnCallDutyPolicyScheduleCalendarFeed";
+import OnCallDutyPolicySchedule from "../../Models/DatabaseModels/OnCallDutyPolicySchedule";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import CalendarFeedWindow from "../../Types/OnCallDutyPolicy/CalendarFeedWindow";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+
+/*
+ * Bounds for the coverage-gap threshold: a gap shorter than a minute is a
+ * seam artefact, and a threshold longer than a week would never emit.
+ */
+export const MIN_MINIMUM_GAP_MINUTES: number = 1;
+export const MAX_MINIMUM_GAP_MINUTES: number = 7 * 24 * 60;
+
+/*
+ * The shared, project-owned calendar feed of one on-call schedule.
+ *
+ * WHAT THE HOOKS GUARANTEE
+ *
+ *   - The schedule exists in the caller's project. The foreign key alone
+ *     would accept a schedule from another project (the FK does not know
+ *     about tenants), and a feed that renders another project's roster to
+ *     whoever holds this project's link is exactly the leak the tenant column
+ *     exists to prevent.
+ *   - One feed per schedule. The unique index enforces it at the database;
+ *     the hook turns the constraint violation into a message a person can
+ *     act on.
+ *   - The token is minted HERE, on every create, whatever the request
+ *     carried. Publishing a feed is a normal, permission-checked create
+ *     (the schedule's Edit list), and the plaintext is then read back by the
+ *     calendar API's `/current` route through the encrypted `token` column.
+ *   - pastDays / futureDays are clamped and minimumGapMinutes is bounded on
+ *     every write.
+ *
+ * rotateTokenById and rotateFeedsForMemberLeave are root writes for the
+ * calendar API and the team-member cleanup respectively; cache purging stays
+ * with the caller.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    const scheduleId: ObjectID | undefined =
+      createBy.data.onCallDutyPolicyScheduleId;
+
+    if (!scheduleId) {
+      throw new BadDataException("onCallDutyPolicyScheduleId is required");
+    }
+
+    createBy.data.projectId = projectId;
+
+    const schedule: OnCallDutyPolicySchedule | null =
+      await OnCallDutyPolicyScheduleService.findOneBy({
+        query: {
+          _id: scheduleId,
+          projectId: projectId,
+        },
+        select: {
+          _id: true,
+        },
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+
+    if (!schedule) {
+      throw new BadDataException("On-call schedule not found in this project.");
+    }
+
+    const existing: PositiveNumber = await this.countBy({
+      query: {
+        onCallDutyPolicyScheduleId: scheduleId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (existing.toNumber() > 0) {
+      throw new BadDataException(
+        "This schedule already has a shared calendar feed. Regenerate or edit the existing one instead.",
+      );
+    }
+
+    /*
+     * A request body never chooses the secret. Root callers (the calendar
+     * API) may pass a token they minted so they can answer with the URL in
+     * the same response; everyone else gets a fresh mint.
+     */
+    CalendarFeedToken.applyTokenColumnsOnCreate(createBy.data, {
+      trustSuppliedToken: createBy.props.isRoot === true,
+    });
+
+    createBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+      createBy.data.pastDays,
+    );
+    createBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+      createBy.data.futureDays,
+    );
+
+    if (createBy.data.minimumGapMinutes !== undefined) {
+      createBy.data.minimumGapMinutes = Service.validateMinimumGapMinutes(
+        createBy.data.minimumGapMinutes,
+      );
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.pastDays !== undefined) {
+      updateBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+        updateBy.data.pastDays,
+      );
+    }
+
+    if (updateBy.data.futureDays !== undefined) {
+      updateBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+        updateBy.data.futureDays,
+      );
+    }
+
+    if (updateBy.data.minimumGapMinutes !== undefined) {
+      updateBy.data.minimumGapMinutes = Service.validateMinimumGapMinutes(
+        updateBy.data.minimumGapMinutes,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * A whole number of minutes between MIN_MINIMUM_GAP_MINUTES and
+   * MAX_MINIMUM_GAP_MINUTES. Numeric strings are accepted because a root
+   * caller may hand over what a form posted; anything else is a 400.
+   */
+  public static validateMinimumGapMinutes(value: unknown): number {
+    const parsed: number =
+      typeof value === "string" && value.trim() !== ""
+        ? Number(value)
+        : (value as number);
+
+    if (
+      typeof parsed !== "number" ||
+      !Number.isInteger(parsed) ||
+      parsed < MIN_MINIMUM_GAP_MINUTES ||
+      parsed > MAX_MINIMUM_GAP_MINUTES
+    ) {
+      throw new BadDataException(
+        `Minimum gap must be a whole number of minutes between ${MIN_MINIMUM_GAP_MINUTES} and ${MAX_MINIMUM_GAP_MINUTES}.`,
+      );
+    }
+
+    return parsed;
+  }
+
+  /**
+   * Rotate the token of an existing feed: mint a new one, move the current
+   * hash into the 30-day grace slot, stamp rotatedAt. Returns the new
+   * plaintext token ONCE. Root write; the caller purges caches.
+   */
+  @CaptureSpan()
+  public async rotateTokenById(data: {
+    id: ObjectID;
+  }): Promise<CalendarFeedRotation> {
+    const existing: Model | null = await this.findOneBy({
+      query: { _id: data.id },
+      select: { _id: true, tokenHash: true },
+      props: { isRoot: true, ignoreHooks: true },
+    });
+
+    if (!existing) {
+      throw new NotFoundException("Calendar feed not found.");
+    }
+
+    const rotation: CalendarFeedRotation = CalendarFeedToken.buildRotation({
+      currentTokenHash: existing.tokenHash,
+    });
+
+    await this.updateOneById({
+      id: data.id,
+      data: CalendarFeedToken.toRotationUpdateData(rotation),
+      props: { isRoot: true },
+    });
+
+    return rotation;
+  }
+
+  /**
+   * Rotate every ENABLED feed in the project that opted into
+   * rotateWhenMemberLeaves. Called by the team-member cleanup when a user's
+   * last team membership in the project goes away. Returns the ids rotated
+   * so the caller can purge their caches. A disabled feed is left alone: it
+   * already serves an empty calendar, and rotating it would only reset the
+   * grace clock on a link nobody should be refreshing anyway.
+   */
+  @CaptureSpan()
+  public async rotateFeedsForMemberLeave(data: {
+    projectId: ObjectID;
+  }): Promise<Array<ObjectID>> {
+    const feeds: Array<Model> = await this.findBy({
+      query: {
+        projectId: data.projectId,
+        isEnabled: true,
+        rotateWhenMemberLeaves: true,
+      },
+      select: {
+        _id: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+        ignoreHooks: true,
+      },
+    });
+
+    const rotated: Array<ObjectID> = [];
+
+    for (const feed of feeds) {
+      if (!feed.id) {
+        continue;
+      }
+
+      await this.rotateTokenById({ id: feed.id });
+      rotated.push(feed.id);
+    }
+
+    return rotated;
+  }
+}
+
+export default new Service();

package/Server/Services/OnCallDutyPolicyScheduleLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class OnCallDutyPolicyScheduleLabelRuleEngineServiceClass {
   @CaptureSpan()
@@ -32,10 +34,16 @@ class OnCallDutyPolicyScheduleLabelRuleEngineServiceClass {
             onCallDutyPolicyScheduleDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "OnCallDutyPolicyScheduleLabelRule",
+        projectId: schedule.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/OnCallDutyPolicyScheduleLayerService.ts

@@ -17,12 +17,61 @@ import UpdateBy from "../Types/Database/UpdateBy";
 import Model from "../../Models/DatabaseModels/OnCallDutyPolicyScheduleLayer";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
+import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /*
+   * A layer edit changes who is on call and when for the whole schedule:
+   * bump its shiftConfigVersion, drop the calendar-feed caches and let the
+   * shift-change listeners re-plan. Runs AFTER the roster refresh so a
+   * listener that re-materializes sees the new configuration. Best-effort by
+   * construction (propagateShiftConfigChange never throws).
+   */
+  private async propagateLayerChange(
+    scheduleId: ObjectID | null | undefined,
+    projectId: ObjectID | null | undefined,
+  ): Promise<void> {
+    if (!scheduleId) {
+      return;
+    }
+
+    await OnCallDutyPolicyScheduleService.propagateShiftConfigChange({
+      scheduleIds: [scheduleId],
+      projectId: projectId || null,
+      reason: OnCallShiftChangeReason.LayerChanged,
+    });
+  }
+
+  /**
+   * Re-resolve and persist the schedule's roster after a layer change.
+   * Best-effort: the row is already committed when the success hooks run, so
+   * a throwing refresh (a concurrently-deleted schedule, a transient
+   * persistence or notification failure) must not abort the hook before
+   * propagateLayerChange bumps the shiftConfigVersion and purges the feed
+   * caches — otherwise the caches would keep serving the pre-edit roster for
+   * up to their TTL and the reminder change pass would be skipped. Mirrors
+   * OnCallDutyPolicyEscalationRuleScheduleService.refreshScheduleRoster.
+   */
+  private async refreshScheduleRosterBestEffort(
+    scheduleId: ObjectID,
+  ): Promise<void> {
+    try {
+      await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+        scheduleId,
+      );
+    } catch (err) {
+      logger.error(
+        "Error refreshing the schedule roster after a layer change (best-effort).",
+      );
+      logger.error(err);
+    }
+  }
+
   /*
    * A rotation interval count of 0 / NaN / negative breaks the handoff math
    * (division by zero, Invalid Date), so reject it at the persistence boundary.
@@ -153,6 +202,7 @@ export class Service extends DatabaseService<Model> {
       id: createdItem.id!,
       select: {
         onCallDutyPolicyScheduleId: true,
+        projectId: true,
       },
       props: {
         isRoot: true,
@@ -163,8 +213,13 @@ export class Service extends DatabaseService<Model> {
       return createdItem;
     }
 
-    await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+    await this.refreshScheduleRosterBestEffort(
+      resource.onCallDutyPolicyScheduleId,
+    );
+
+    await this.propagateLayerChange(
       resource.onCallDutyPolicyScheduleId,
+      resource.projectId,
     );
 
     return createdItem;
@@ -192,6 +247,7 @@ export class Service extends DatabaseService<Model> {
         id: item,
         select: {
           onCallDutyPolicyScheduleId: true,
+          projectId: true,
         },
         props: {
           isRoot: true,
@@ -202,8 +258,13 @@ export class Service extends DatabaseService<Model> {
         continue;
       }
 
-      await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+      await this.refreshScheduleRosterBestEffort(
+        resource.onCallDutyPolicyScheduleId,
+      );
+
+      await this.propagateLayerChange(
         resource.onCallDutyPolicyScheduleId,
+        resource.projectId,
       );
     }
 
@@ -245,6 +306,7 @@ export class Service extends DatabaseService<Model> {
         select: {
           order: true,
           onCallDutyPolicyScheduleId: true,
+          projectId: true,
         },
       });
     }
@@ -271,8 +333,13 @@ export class Service extends DatabaseService<Model> {
           false,
         );
 
-        await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+        await this.refreshScheduleRosterBestEffort(
+          resource.onCallDutyPolicyScheduleId,
+        );
+
+        await this.propagateLayerChange(
           resource.onCallDutyPolicyScheduleId,
+          resource.projectId,
         );
       }
     }

package/Server/Services/OnCallDutyPolicyScheduleLayerUserService.ts

@@ -12,12 +12,123 @@ import PositiveNumber from "../../Types/PositiveNumber";
 import Model from "../../Models/DatabaseModels/OnCallDutyPolicyScheduleLayerUser";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
+import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /*
+   * Adding, removing or re-ordering a layer user rewrites the rotation of the
+   * whole schedule (the engine derives every position from the current user
+   * list), so the schedule's shiftConfigVersion is bumped, its feed caches
+   * dropped, and the listeners told — naming the user the row belongs to so
+   * their personal feed and reminders are refreshed even when they are no
+   * longer a member. Runs after the roster refresh; never throws.
+   */
+  private async propagateLayerUserChange(
+    scheduleId: ObjectID | null | undefined,
+    projectId: ObjectID | null | undefined,
+    userId: ObjectID | null | undefined,
+  ): Promise<void> {
+    if (!scheduleId) {
+      return;
+    }
+
+    await OnCallDutyPolicyScheduleService.propagateShiftConfigChange({
+      scheduleIds: [scheduleId],
+      projectId: projectId || null,
+      userIds: userId ? [userId] : [],
+      reason: OnCallShiftChangeReason.LayerUserChanged,
+    });
+  }
+
+  /**
+   * Re-resolve and persist the schedule's roster after a layer-user change.
+   * Best-effort: the row is already committed when the success hooks run, so
+   * a throwing refresh (a concurrently-deleted schedule, a transient
+   * persistence or notification failure) must not abort the hook before
+   * propagateLayerUserChange bumps the shiftConfigVersion and purges the
+   * feed caches — otherwise the caches would keep serving the pre-edit
+   * roster for up to their TTL and the reminder change pass would be
+   * skipped. Mirrors
+   * OnCallDutyPolicyEscalationRuleScheduleService.refreshScheduleRoster.
+   */
+  private async refreshScheduleRosterBestEffort(
+    scheduleId: ObjectID,
+  ): Promise<void> {
+    try {
+      await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+        scheduleId,
+      );
+    } catch (err) {
+      logger.error(
+        "Error refreshing the schedule roster after a layer-user change (best-effort).",
+      );
+      logger.error(err);
+    }
+  }
+
+  /**
+   * Renumber the users of a layer 1..n by their current order. Used by the
+   * team-member cleanup, which deletes layer-user rows as root (the per-row
+   * re-sequencing in onDeleteSuccess only runs for non-root deletes) and
+   * must restore the contiguous 1-based order the create-default (count + 1)
+   * and delete paths rely on. Idempotent.
+   */
+  @CaptureSpan()
+  public async resequenceOrderInLayer(
+    onCallDutyPolicyScheduleLayerId: ObjectID,
+  ): Promise<void> {
+    const rows: Array<Model> = await this.findBy({
+      query: {
+        onCallDutyPolicyScheduleLayerId: onCallDutyPolicyScheduleLayerId,
+      },
+      select: {
+        _id: true,
+        order: true,
+      },
+      sort: {
+        order: SortOrder.Ascending,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    let expectedOrder: number = 1;
+
+    for (const row of rows) {
+      if (row.order !== expectedOrder && row._id) {
+        /*
+         * ignoreHooks: renumbering is bookkeeping, not a roster change — the
+         * caller (the team-member cleanup) refreshes and propagates once per
+         * schedule itself. With hooks on, every renumbered row would run a
+         * full onUpdateSuccess (semaphore-locked roster refresh + version
+         * bump + cache purge + listener pass), i.e. N-1 redundant refreshes
+         * per layer, and any hook throw would abort the remaining renumbering.
+         */
+        await this.updateOneBy({
+          query: {
+            _id: row._id,
+          },
+          data: {
+            order: expectedOrder,
+          },
+          props: {
+            isRoot: true,
+            ignoreHooks: true,
+          },
+        });
+      }
+      expectedOrder++;
+    }
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
@@ -82,8 +193,14 @@ export class Service extends DatabaseService<Model> {
         );
 
         if (resource.onCallDutyPolicyScheduleId) {
-          await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+          await this.refreshScheduleRosterBestEffort(
+            resource.onCallDutyPolicyScheduleId,
+          );
+
+          await this.propagateLayerUserChange(
             resource.onCallDutyPolicyScheduleId,
+            resource.projectId,
+            resource.userId,
           );
         }
       }
@@ -117,6 +234,8 @@ export class Service extends DatabaseService<Model> {
           order: true,
           onCallDutyPolicyScheduleLayerId: true,
           onCallDutyPolicyScheduleId: true,
+          projectId: true,
+          userId: true,
         },
       });
     }
@@ -135,6 +254,8 @@ export class Service extends DatabaseService<Model> {
       id: createdItem.id!,
       select: {
         onCallDutyPolicyScheduleId: true,
+        projectId: true,
+        userId: true,
       },
       props: {
         isRoot: true,
@@ -145,10 +266,16 @@ export class Service extends DatabaseService<Model> {
       return createdItem;
     }
 
-    await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+    await this.refreshScheduleRosterBestEffort(
       resource.onCallDutyPolicyScheduleId,
     );
 
+    await this.propagateLayerUserChange(
+      resource.onCallDutyPolicyScheduleId,
+      resource.projectId,
+      resource.userId,
+    );
+
     return createdItem;
   }
 
@@ -161,6 +288,8 @@ export class Service extends DatabaseService<Model> {
         id: item,
         select: {
           onCallDutyPolicyScheduleId: true,
+          projectId: true,
+          userId: true,
         },
         props: {
           isRoot: true,
@@ -171,8 +300,14 @@ export class Service extends DatabaseService<Model> {
         continue;
       }
 
-      await OnCallDutyPolicyScheduleService.refreshCurrentUserIdAndHandoffTimeInSchedule(
+      await this.refreshScheduleRosterBestEffort(
+        resource.onCallDutyPolicyScheduleId,
+      );
+
+      await this.propagateLayerUserChange(
         resource.onCallDutyPolicyScheduleId,
+        resource.projectId,
+        resource.userId,
       );
     }
 

package/Server/Services/OnCallDutyPolicyScheduleOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import OnCallDutyPolicyScheduleService from "./OnCallDutyPolicyScheduleService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class OnCallDutyPolicyScheduleOwnerRuleEngineServiceClass {
   @CaptureSpan()
@@ -38,10 +40,16 @@ class OnCallDutyPolicyScheduleOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "OnCallDutyPolicyScheduleOwnerRule",
+        projectId: schedule.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }