@oneuptime/common 12.0.29 → 12.0.31

package/Server/Services/UserOnCallShiftReminderLogService.ts

@@ -0,0 +1,151 @@
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model, {
+  UserOnCallShiftReminderLogKind,
+} from "../../Models/DatabaseModels/UserOnCallShiftReminderLog";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../Types/ObjectID";
+import OneUptimeDate from "../../Types/Date";
+
+const MILLISECONDS_PER_MINUTE: number = 60 * 1000;
+
+const ALLOWED_KINDS: Set<string> = new Set<string>(
+  Object.values(UserOnCallShiftReminderLogKind),
+);
+
+/*
+ * The shift-reminder ledger. Root only, in every direction: a claim row is
+ * the thing that makes "send exactly once" true, so nothing outside the
+ * worker may insert, edit or remove one.
+ *
+ * The create hook normalises the idempotency key so two workers that compute
+ * the same shift a few milliseconds apart still collide on the unique index:
+ * shiftStartsAt is truncated to the minute here as well as by the worker
+ * (belt and braces - the seam normalisation upstream already makes starts
+ * minute-granular, this makes it a guarantee of the table rather than of one
+ * caller), and minutesBeforeShift defaults to 0 for change notices.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Shift reminder logs are written by the reminder worker only.",
+      );
+    }
+
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    if (!createBy.data.userId) {
+      throw new BadDataException("userId is required");
+    }
+
+    if (!createBy.data.onCallDutyPolicyScheduleId) {
+      throw new BadDataException("onCallDutyPolicyScheduleId is required");
+    }
+
+    if (!createBy.data.shiftStartsAt) {
+      throw new BadDataException("shiftStartsAt is required");
+    }
+
+    if (
+      !createBy.data.kind ||
+      !ALLOWED_KINDS.has(createBy.data.kind as string)
+    ) {
+      throw new BadDataException(
+        `kind must be one of: ${Object.values(UserOnCallShiftReminderLogKind).join(", ")}`,
+      );
+    }
+
+    createBy.data.projectId = projectId;
+
+    createBy.data.shiftStartsAt = Service.truncateToMinute(
+      OneUptimeDate.fromString(createBy.data.shiftStartsAt),
+    );
+
+    createBy.data.minutesBeforeShift = Service.validateMinutesBeforeShift(
+      createBy.data.minutesBeforeShift,
+    );
+
+    if (!createBy.data.claimedAt) {
+      createBy.data.claimedAt = OneUptimeDate.getCurrentDate();
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (!updateBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Shift reminder logs are written by the reminder worker only.",
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    if (!deleteBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Shift reminder logs are written by the reminder worker only.",
+      );
+    }
+
+    return { deleteBy, carryForward: null };
+  }
+
+  // Zero the seconds and milliseconds. Part of the idempotency key.
+  public static truncateToMinute(date: Date): Date {
+    return new Date(
+      Math.floor(date.getTime() / MILLISECONDS_PER_MINUTE) *
+        MILLISECONDS_PER_MINUTE,
+    );
+  }
+
+  /*
+   * 0 (a change notice) or a positive whole number of minutes. Missing means
+   * 0. Anything else is a caller bug, not a value to store.
+   */
+  public static validateMinutesBeforeShift(value: unknown): number {
+    if (value === undefined || value === null) {
+      return 0;
+    }
+
+    const parsed: number =
+      typeof value === "string" && value.trim() !== ""
+        ? Number(value)
+        : (value as number);
+
+    if (typeof parsed !== "number" || !Number.isInteger(parsed) || parsed < 0) {
+      throw new BadDataException(
+        "minutesBeforeShift must be a whole number of minutes, 0 or more.",
+      );
+    }
+
+    return parsed;
+  }
+}
+
+export default new Service();

package/Server/Services/UserOnCallShiftReminderService.ts

@@ -0,0 +1,112 @@
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model, {
+  MAX_MINUTES_BEFORE_SHIFT,
+  MIN_MINUTES_BEFORE_SHIFT,
+} from "../../Models/DatabaseModels/UserOnCallShiftReminder";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+
+/*
+ * "Remind me N minutes before my shift" rows.
+ *
+ * The hooks keep the table honest for the reminder worker: every row has an
+ * owner (defaulted to the session user when the client did not send one, so
+ * the settings page can post `{ minutesBeforeShift }` and nothing else), a
+ * project, and a lead time inside 15 minutes ... 2 weeks. A duplicate lead
+ * is answered with a message rather than a unique-violation 500.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    if (!createBy.data.userId && createBy.props.userId) {
+      createBy.data.userId = createBy.props.userId;
+    }
+
+    if (!createBy.data.userId) {
+      throw new BadDataException("userId is required");
+    }
+
+    createBy.data.projectId = projectId;
+
+    createBy.data.minutesBeforeShift = Service.validateMinutesBeforeShift(
+      createBy.data.minutesBeforeShift,
+    );
+
+    const duplicates: PositiveNumber = await this.countBy({
+      query: {
+        projectId: projectId,
+        userId: createBy.data.userId,
+        minutesBeforeShift: createBy.data.minutesBeforeShift,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (duplicates.toNumber() > 0) {
+      throw new BadDataException(
+        `You already have a reminder ${createBy.data.minutesBeforeShift} minutes before your shifts.`,
+      );
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.minutesBeforeShift !== undefined) {
+      updateBy.data.minutesBeforeShift = Service.validateMinutesBeforeShift(
+        updateBy.data.minutesBeforeShift,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * A whole number of minutes between MIN_MINUTES_BEFORE_SHIFT and
+   * MAX_MINUTES_BEFORE_SHIFT. Numeric strings are accepted (a form may post
+   * one); missing, fractional, negative or out-of-range values are a 400.
+   */
+  public static validateMinutesBeforeShift(value: unknown): number {
+    const parsed: number =
+      typeof value === "string" && value.trim() !== ""
+        ? Number(value)
+        : (value as number);
+
+    if (
+      typeof parsed !== "number" ||
+      !Number.isInteger(parsed) ||
+      parsed < MIN_MINUTES_BEFORE_SHIFT ||
+      parsed > MAX_MINUTES_BEFORE_SHIFT
+    ) {
+      throw new BadDataException(
+        `Reminder lead time must be a whole number of minutes between ${MIN_MINUTES_BEFORE_SHIFT} and ${MAX_MINUTES_BEFORE_SHIFT} (two weeks).`,
+      );
+    }
+
+    return parsed;
+  }
+}
+
+export default new Service();

package/Server/Services/UserService.ts

@@ -58,6 +58,7 @@ import Name from "../../Types/Name";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Timezone from "../../Types/Timezone";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+import EnterpriseLicenseSeatUtil from "../Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil";
 
 /*
  * Names the Redis mutex that serializes the first-Master-Admin election across
@@ -184,6 +185,32 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
+    /*
+     * The enterprise seat limit, enforced here because this is the one place
+     * every new user passes through: team invitations, self-service signup,
+     * SSO/OIDC just-in-time provisioning, SCIM, and the Admin Dashboard all
+     * end up in `create`. Enforcing on the invitation instead would leave
+     * signup and SSO as open doors around it.
+     *
+     * No isRoot exemption on purpose — invitations create the invited user as
+     * root, so exempting root would exempt invitations, which is the exact
+     * thing this is here to bound. It is a no-op on Community Edition and on
+     * oneuptime.com (see EnterpriseLicenseSeatUtil.isSeatLimitEnforceable),
+     * and it never counts the User table on a licence with no seat limit.
+     */
+    await EnterpriseLicenseSeatUtil.assertSeatAvailableForNewUser({
+      getLocalUserCount: async (): Promise<number> => {
+        const userCount: PositiveNumber = await this.countBy({
+          query: {},
+          props: {
+            isRoot: true,
+          },
+        });
+
+        return userCount.toNumber();
+      },
+    });
+
     /*
      * clickIds / firstTouchAttribution are publicly creatable jsonb columns
      * (set during signup). Unlike the varchar(500) utm columns they have no

package/Server/Services/WorkflowLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import WorkflowService from "./WorkflowService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class WorkflowLabelRuleEngineServiceClass {
   /**
@@ -35,10 +37,16 @@ class WorkflowLabelRuleEngineServiceClass {
             workflowDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "WorkflowLabelRule",
+        projectId: workflow.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/WorkflowOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import WorkflowService from "./WorkflowService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class WorkflowOwnerRuleEngineServiceClass {
   /**
@@ -42,10 +44,16 @@ class WorkflowOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "WorkflowOwnerRule",
+        projectId: workflow.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil.ts

@@ -0,0 +1,186 @@
+import GlobalConfig from "../../../Models/DatabaseModels/GlobalConfig";
+import EnterpriseLicenseInstanceSummary from "../../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import EnterpriseLicenseSeatsUtil, {
+  SeatUsage,
+} from "../../../Utils/EnterpriseLicense/EnterpriseLicenseSeats";
+import { IsBillingEnabled, IsEnterpriseEdition } from "../../EnvironmentConfig";
+import GlobalConfigService from "../../Services/GlobalConfigService";
+
+/*
+ * Counts the users on THIS installation. Passed in rather than called
+ * directly so this util never has to import UserService — and, more usefully,
+ * so the count is only paid for on the installations that actually enforce a
+ * limit. On Community Edition and on oneuptime.com itself the callbacks below
+ * are never invoked.
+ */
+export type GetLocalUserCountFunction = () => Promise<number>;
+
+/*
+ * Enforcement of the enterprise license seat limit on a self-hosted
+ * installation.
+ *
+ * The limit itself is set on oneuptime.com and mirrored into GlobalConfig by
+ * the daily report job (and by validating or refreshing the license by hand).
+ * This is the half that acts on it: it is the only thing standing between a
+ * customer's license terms and an unbounded User table.
+ *
+ * The seat arithmetic lives in Common/Utils/EnterpriseLicense/EnterpriseLicenseSeats
+ * as a pure function; everything here is about reading the license state and
+ * deciding whether the installation is one that enforces at all.
+ */
+export default class EnterpriseLicenseSeatUtil {
+  /*
+   * Whether this process is an installation whose users are governed by an
+   * enterprise license at all.
+   *
+   * Community Edition has no license and no limit. oneuptime.com runs with
+   * billing enabled and bounds seats through subscriptions instead
+   * (TeamMemberService.onBeforeCreate) — enforcing a license limit there as
+   * well would be a second, wrong answer to the same question.
+   */
+  public static isSeatLimitEnforceable(): boolean {
+    return IsEnterpriseEdition && !IsBillingEnabled;
+  }
+
+  /*
+   * Seat usage derived from an already-loaded GlobalConfig row. Kept separate
+   * from the loading so a caller that has the row in hand — the license
+   * endpoint, which has just read it — does not read it a second time.
+   *
+   * A null config (a fresh installation whose GlobalConfig has not been seeded
+   * yet) yields no limit, which is the same answer as a licence with no seat
+   * limit set.
+   */
+  public static getSeatUsageFromGlobalConfig(data: {
+    config: GlobalConfig | null;
+    localUserCount: number;
+  }): SeatUsage {
+    const config: GlobalConfig | null = data.config;
+
+    const instances: Array<EnterpriseLicenseInstanceSummary> = Array.isArray(
+      config?.enterpriseLicenseInstances,
+    )
+      ? config.enterpriseLicenseInstances
+      : [];
+
+    return EnterpriseLicenseSeatsUtil.getSeatUsage({
+      userLimit: config?.enterpriseLicenseUserLimit,
+      localUserCount: data.localUserCount,
+      aggregatedUserCount: config?.enterpriseLicenseCurrentUserCount,
+      instances: instances,
+      thisInstanceId: config?.instanceId ? config.instanceId.toString() : null,
+    });
+  }
+
+  /*
+   * Seat usage for this installation right now, or null on an installation
+   * that does not enforce a seat limit.
+   *
+   * Null rather than an unenforced SeatUsage so callers cannot accidentally
+   * present Community Edition with a seat report it has no business having,
+   * and so the user count is never queried there.
+   */
+  public static async getSeatUsage(data: {
+    getLocalUserCount: GetLocalUserCountFunction;
+  }): Promise<SeatUsage | null> {
+    if (!this.isSeatLimitEnforceable()) {
+      return null;
+    }
+
+    const config: GlobalConfig | null = await GlobalConfigService.findOneById({
+      id: ObjectID.getZeroObjectID(),
+      select: {
+        enterpriseLicenseUserLimit: true,
+        enterpriseLicenseCurrentUserCount: true,
+        enterpriseLicenseInstances: true,
+        instanceId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return this.getSeatUsageForLoadedGlobalConfig({
+      config: config,
+      getLocalUserCount: data.getLocalUserCount,
+    });
+  }
+
+  /*
+   * The same answer as getSeatUsage, for a caller that has already loaded the
+   * GlobalConfig row (the license endpoint reads it to build its response, and
+   * reading it twice per request would be silly).
+   *
+   * The row must have been selected with enterpriseLicenseUserLimit,
+   * enterpriseLicenseCurrentUserCount, enterpriseLicenseInstances and
+   * instanceId, or the numbers here are a fiction built from missing columns.
+   */
+  public static async getSeatUsageForLoadedGlobalConfig(data: {
+    config: GlobalConfig | null;
+    getLocalUserCount: GetLocalUserCountFunction;
+  }): Promise<SeatUsage | null> {
+    if (!this.isSeatLimitEnforceable()) {
+      return null;
+    }
+
+    /*
+     * The seat limit is read before the users are counted, and the count is
+     * skipped entirely when there is no limit. An unlimited licence is the
+     * common case on a large installation, and that is exactly the
+     * installation where counting the User table on every user creation would
+     * be worth avoiding.
+     */
+    const withoutLocalUsers: SeatUsage = this.getSeatUsageFromGlobalConfig({
+      config: data.config,
+      localUserCount: 0,
+    });
+
+    if (!withoutLocalUsers.isEnforced) {
+      return withoutLocalUsers;
+    }
+
+    return this.getSeatUsageFromGlobalConfig({
+      config: data.config,
+      localUserCount: await data.getLocalUserCount(),
+    });
+  }
+
+  /*
+   * Throws if this installation cannot take another user.
+   *
+   * Called from UserService.onBeforeCreate, which every path that creates a
+   * user goes through — team invitations, self-service signup, SSO and OIDC
+   * just-in-time provisioning, SCIM, and the Admin Dashboard. Enforcing on the
+   * User row rather than on the invitation is what makes that true: a seat is
+   * consumed by a person existing on the installation, not by the particular
+   * door they came through.
+   *
+   * It is also why this deliberately does NOT exempt root/internal writes.
+   * Team invitations create the invited user with `isRoot: true`, so an
+   * isRoot escape hatch here would exempt the single most important path.
+   */
+  public static async assertSeatAvailableForNewUser(data: {
+    getLocalUserCount: GetLocalUserCountFunction;
+  }): Promise<void> {
+    const seatUsage: SeatUsage | null = await this.getSeatUsage({
+      getLocalUserCount: data.getLocalUserCount,
+    });
+
+    if (!seatUsage || !seatUsage.isEnforced) {
+      return;
+    }
+
+    if (seatUsage.hasSeatForNewUser) {
+      return;
+    }
+
+    throw new BadDataException(
+      EnterpriseLicenseSeatsUtil.getSeatLimitReachedMessage({
+        seatsInUse: seatUsage.seatsInUse,
+        userLimit: seatUsage.userLimit as number,
+      }),
+    );
+  }
+}