@oneuptime/common 12.0.32 → 12.0.34

package/Server/Services/EnterpriseLicenseInstanceService.ts

@@ -1,10 +1,207 @@
 import DatabaseService from "./DatabaseService";
 import EnterpriseLicenseInstance from "../../Models/DatabaseModels/EnterpriseLicenseInstance";
+import EnterpriseLicense from "../../Models/DatabaseModels/EnterpriseLicense";
+import EnterpriseLicenseService from "./EnterpriseLicenseService";
+import EnterpriseLicenseUsageUtil, {
+  EffectiveEnterpriseLicenseUserCount,
+} from "../../Utils/EnterpriseLicense/EnterpriseLicenseUsage";
+import EnterpriseLicenseUserCountSource from "../../Types/EnterpriseLicense/EnterpriseLicenseUserCountSource";
+import DeleteById from "../Types/Database/DeleteById";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import OneUptimeDate from "../../Types/Date";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import ObjectID from "../../Types/ObjectID";
+import PartialEntity from "../../Types/Database/PartialEntity";
+import ModelPermission from "../Types/Database/Permissions/Index";
 
 export class Service extends DatabaseService<EnterpriseLicenseInstance> {
   public constructor() {
     super(EnterpriseLicenseInstance);
   }
+
+  public override async deleteOneById(deleteById: DeleteById): Promise<number> {
+    /*
+     * A source marker is written before deleting some upgrade-era rows. Check
+     * permission first so a refused delete can never produce that write. The
+     * inherited deletion below deliberately performs its normal check again.
+     */
+    await ModelPermission.checkDeletePermissionByModel({
+      modelType: this.modelType,
+      fetchModelWithAccessControlIds: async () => {
+        return await this.findOneById({
+          id: deleteById.id,
+          select: {},
+          props: {
+            isRoot: true,
+          },
+        });
+      },
+      props: deleteById.props,
+    });
+
+    /*
+     * Resolve the owning license before taking its lock. The actual delete
+     * still goes through DatabaseService below with the caller's original
+     * props, so this root read does not bypass delete permission checks.
+     */
+    const instance: EnterpriseLicenseInstance | null = await this.findOneById({
+      id: deleteById.id,
+      select: {
+        enterpriseLicenseId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+    const licenseId: ObjectID | undefined = instance?.enterpriseLicenseId;
+
+    if (!licenseId) {
+      return await super.deleteOneById(deleteById);
+    }
+
+    return await EnterpriseLicenseService.runWithUsageAggregationLock({
+      licenseId,
+      fn: async (): Promise<number> => {
+        /*
+         * A report for this row uses the same lock. Re-read its provenance in
+         * the critical section so the fallback decision cannot race a report.
+         */
+        const lockedInstance: EnterpriseLicenseInstance | null =
+          await this.findOneById({
+            id: deleteById.id,
+            select: {
+              lastReportedAt: true,
+            },
+            props: {
+              isRoot: true,
+            },
+          });
+        const deletedTargetHadReportedUsage: boolean = Boolean(
+          lockedInstance?.lastReportedAt,
+        );
+
+        if (deletedTargetHadReportedUsage) {
+          const sourceLicense: EnterpriseLicense | null =
+            await EnterpriseLicenseService.findOneById({
+              id: licenseId,
+              select: {
+                userCountSource: true,
+              },
+              props: {
+                isRoot: true,
+              },
+            });
+
+          /*
+           * Old rows predate the persisted provenance column. Mark the stored
+           * aggregate before deleting its last evidence, so even a later
+           * aggregate-write failure cannot resurrect it as legacy usage.
+           */
+          if (sourceLicense && !sourceLicense.userCountSource) {
+            await EnterpriseLicenseService.updateOneById({
+              id: licenseId,
+              data: {
+                userCountSource: EnterpriseLicenseUserCountSource.Instance,
+              },
+              props: {
+                isRoot: true,
+                ignoreHooks: true,
+              },
+            });
+          }
+        }
+
+        const deletedCount: number = await super.deleteOneById(deleteById);
+
+        /*
+         * The row may have disappeared between the ownership lookup and lock
+         * acquisition. Preserve DatabaseService's zero-row result and avoid
+         * changing an aggregate for a deletion this call did not perform.
+         */
+        if (deletedCount === 0) {
+          return 0;
+        }
+
+        const now: Date = OneUptimeDate.getCurrentDate();
+        const remainingInstances: Array<EnterpriseLicenseInstance> =
+          await this.findBy({
+            query: {
+              enterpriseLicenseId: licenseId,
+            },
+            select: {
+              createdAt: true,
+              userCount: true,
+              userEmailHashes: true,
+              lastReportedAt: true,
+            },
+            sort: {
+              createdAt: SortOrder.Ascending,
+            },
+            skip: 0,
+            limit: LIMIT_MAX,
+            props: {
+              isRoot: true,
+            },
+          });
+        const license: EnterpriseLicense | null =
+          await EnterpriseLicenseService.findOneById({
+            id: licenseId,
+            select: {
+              currentUserCount: true,
+              userCountUpdatedAt: true,
+              userCountSource: true,
+              legacyUserCount: true,
+              legacyUserCountUpdatedAt: true,
+            },
+            props: {
+              isRoot: true,
+            },
+          });
+
+        if (!license) {
+          return deletedCount;
+        }
+
+        const effectiveUsage: EffectiveEnterpriseLicenseUserCount =
+          EnterpriseLicenseUsageUtil.getEffectiveUserCountAndSource({
+            instances: remainingInstances,
+            storedUserCount: license.currentUserCount,
+            storedUserCountUpdatedAt: license.userCountUpdatedAt,
+            storedUserCountSource:
+              license.userCountSource ||
+              (deletedTargetHadReportedUsage
+                ? EnterpriseLicenseUserCountSource.Instance
+                : undefined),
+            legacyUserCount: license.legacyUserCount,
+            legacyUserCountUpdatedAt: license.legacyUserCountUpdatedAt,
+            allowStoredUserCountAsLegacyFallback:
+              !deletedTargetHadReportedUsage,
+            now,
+          });
+
+        if (effectiveUsage.userCount !== null) {
+          const usageUpdate: PartialEntity<EnterpriseLicense> = {
+            currentUserCount: effectiveUsage.userCount,
+          };
+
+          if (effectiveUsage.source !== null) {
+            usageUpdate.userCountSource = effectiveUsage.source;
+          }
+
+          await EnterpriseLicenseService.updateOneById({
+            id: licenseId,
+            data: usageUpdate,
+            props: {
+              isRoot: true,
+              ignoreHooks: true,
+            },
+          });
+        }
+
+        return deletedCount;
+      },
+    });
+  }
 }
 
 export default new Service();

package/Server/Services/EnterpriseLicenseService.ts

@@ -5,12 +5,67 @@ import { MarketingEventType } from "../../Types/Marketing/MarketingEvent";
 import { OnCreate } from "../Types/Database/Hooks";
 import OneUptimeDate from "../../Types/Date";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ObjectID from "../../Types/ObjectID";
+import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
+import logger from "../Utils/Logger";
+
+export const ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_NAMESPACE: string =
+  "EnterpriseLicenseService.usageAggregation";
+
+export const ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_OPTIONS: Readonly<{
+  namespace: string;
+  lockTimeout: number;
+  acquireTimeout: number;
+}> = Object.freeze({
+  namespace: ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_NAMESPACE,
+  lockTimeout: 60_000,
+  acquireTimeout: 10_000,
+});
 
 export class Service extends DatabaseService<EnterpriseLicense> {
   public constructor() {
     super(EnterpriseLicense);
   }
 
+  /**
+   * Serialize usage aggregation for one enterprise license across every API
+   * and worker process. Callers must put the complete read-compute-write
+   * operation inside `fn`; locking only the write would leave the stale-read
+   * race intact.
+   */
+  public async runWithUsageAggregationLock<TResult>(data: {
+    licenseId: ObjectID;
+    fn: () => Promise<TResult>;
+  }): Promise<TResult> {
+    /*
+     * Acquisition is deliberately outside the callback try/finally. If Redis
+     * is unavailable or contention exceeds the bounded acquire timeout, the
+     * operation fails closed and there is no unowned mutex to release.
+     */
+    const mutex: SemaphoreMutex = await Semaphore.lock({
+      key: data.licenseId.toString(),
+      ...ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_OPTIONS,
+    });
+
+    try {
+      return await data.fn();
+    } finally {
+      try {
+        await Semaphore.release(mutex);
+      } catch (error) {
+        /*
+         * redis-semaphore refreshes held locks and lets them expire after the
+         * lock timeout if explicit release fails. Logging is best effort: a
+         * release error must not replace either the callback's value or its
+         * more useful error.
+         */
+        logger.error(
+          `Failed to release enterprise license usage aggregation lock for ${data.licenseId.toString()}; it will expire automatically: ${error}`,
+        );
+      }
+    }
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<EnterpriseLicense>,

package/Server/Services/GlobalConfigService.ts

@@ -6,6 +6,26 @@ import { OnUpdate } from "../Types/Database/Hooks";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import UpdateBy from "../Types/Database/UpdateBy";
 import BadDataException from "../../Types/Exception/BadDataException";
+import TelegramVerificationToken from "../Utils/TelegramVerificationToken";
+import GlobalCache from "../Infrastructure/GlobalCache";
+
+const TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE: string =
+  "global-config-security";
+const TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY: string =
+  "telegram-webhook-secret-generation";
+const TELEGRAM_WEBHOOK_SECRET_INITIAL_GENERATION: string = "initial";
+const TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE: string = "__not_configured__";
+const TELEGRAM_WEBHOOK_SECRET_CACHE_TTL_SECONDS: number = 5;
+
+interface TelegramWebhookSecretTokenLoadResult {
+  value: string | undefined;
+  isCurrentGeneration: boolean;
+}
+
+interface TelegramWebhookSecretTokenLoad {
+  generation: string;
+  promise: Promise<TelegramWebhookSecretTokenLoadResult>;
+}
 
 export class Service extends DatabaseService<Model> {
   /*
@@ -15,6 +35,15 @@ export class Service extends DatabaseService<Model> {
    */
   private requireSsoForLoginCache: InMemoryTTLCache<boolean> =
     new InMemoryTTLCache(10_000);
+  /*
+   * The public Telegram webhook is hit without a OneUptime session. The value
+   * cache lives in Redis so every app replica observes the same generation.
+   * Only the in-flight promise is process-local: it collapses a cache-miss
+   * burst to one Postgres read per replica without retaining a retired secret.
+   */
+  private telegramWebhookSecretTokenLoad:
+    | TelegramWebhookSecretTokenLoad
+    | undefined = undefined;
 
   public constructor() {
     super(Model);
@@ -43,10 +72,168 @@ export class Service extends DatabaseService<Model> {
     return value;
   }
 
+  @CaptureSpan()
+  public async getTelegramWebhookSecretToken(): Promise<string | undefined> {
+    while (true) {
+      const generation: string =
+        await this.getTelegramWebhookSecretTokenGeneration();
+      const cacheKey: string =
+        this.getTelegramWebhookSecretTokenCacheKey(generation);
+      const cached: string | null = await GlobalCache.getString(
+        TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+        cacheKey,
+      );
+
+      if (cached !== null) {
+        return cached === TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE
+          ? undefined
+          : cached;
+      }
+
+      const existingLoad: TelegramWebhookSecretTokenLoad | undefined =
+        this.telegramWebhookSecretTokenLoad;
+
+      /*
+       * Cache expiry is visible to every public webhook request at once. Share
+       * the database read for that generation so a burst cannot turn one
+       * expiry into one root Postgres query per request.
+       */
+      const load: TelegramWebhookSecretTokenLoad =
+        existingLoad?.generation === generation
+          ? existingLoad
+          : {
+              generation,
+              promise: this.loadTelegramWebhookSecretToken(
+                generation,
+                cacheKey,
+              ),
+            };
+
+      if (load !== existingLoad) {
+        this.telegramWebhookSecretTokenLoad = load;
+      }
+
+      try {
+        const result: TelegramWebhookSecretTokenLoadResult = await load.promise;
+
+        /*
+         * A rotation that completed during the database read makes the result
+         * unreachable through the new generation key. Loop so this request
+         * also joins the new generation instead of authenticating with the
+         * value that was retired while it waited.
+         */
+        if (result.isCurrentGeneration) {
+          return result.value;
+        }
+      } finally {
+        /*
+         * An invalidation can start a newer-generation load while this one is
+         * still pending. The older promise must not clear that newer flight.
+         */
+        if (this.telegramWebhookSecretTokenLoad === load) {
+          this.telegramWebhookSecretTokenLoad = undefined;
+        }
+      }
+    }
+  }
+
+  private async getTelegramWebhookSecretTokenGeneration(): Promise<string> {
+    return (
+      (await GlobalCache.getString(
+        TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+        TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY,
+      )) || TELEGRAM_WEBHOOK_SECRET_INITIAL_GENERATION
+    );
+  }
+
+  private getTelegramWebhookSecretTokenCacheKey(generation: string): string {
+    return `telegram-webhook-secret:${generation}`;
+  }
+
+  private async loadTelegramWebhookSecretToken(
+    generation: string,
+    cacheKey: string,
+  ): Promise<TelegramWebhookSecretTokenLoadResult> {
+    const config: Model | null = await this.findOneBy({
+      query: {
+        _id: ObjectID.getZeroObjectID().toString(),
+      },
+      select: {
+        telegramWebhookSecretToken: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+    const value: string | undefined =
+      config?.telegramWebhookSecretToken?.trim() || undefined;
+
+    /*
+     * A read begun before a rotation may return after the update has committed.
+     * Check the shared generation before populating Redis; an old replica can
+     * still finish its query, but it cannot republish the retired value under
+     * the generation every other replica now reads.
+     */
+    if (generation !== (await this.getTelegramWebhookSecretTokenGeneration())) {
+      return {
+        value: undefined,
+        isCurrentGeneration: false,
+      };
+    }
+
+    await GlobalCache.setString(
+      TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+      cacheKey,
+      value || TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE,
+      { expiresInSeconds: TELEGRAM_WEBHOOK_SECRET_CACHE_TTL_SECONDS },
+    );
+
+    return {
+      value,
+      isCurrentGeneration:
+        generation === (await this.getTelegramWebhookSecretTokenGeneration()),
+    };
+  }
+
+  private async rotateTelegramWebhookSecretTokenGeneration(): Promise<void> {
+    await GlobalCache.setString(
+      TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+      TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY,
+      ObjectID.generate().toString(),
+    );
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.telegramWebhookSecretToken !== undefined) {
+      const secret: unknown = updateBy.data.telegramWebhookSecretToken;
+
+      if (
+        secret !== null &&
+        secret !== "" &&
+        !TelegramVerificationToken.isWebhookSecretStrong(secret)
+      ) {
+        throw new BadDataException(
+          "Telegram webhook secret token must be 32-100 characters and contain only letters, numbers, underscores, or hyphens.",
+        );
+      }
+
+      if (typeof secret === "string") {
+        updateBy.data.telegramWebhookSecretToken = secret.trim();
+      }
+
+      /*
+       * Move every replica to a fresh shared generation before the write. A
+       * request during the transaction may still read the currently committed
+       * secret, but it cannot repopulate the generation used before rotation.
+       * The success hook rotates once more after commit. If the write fails,
+       * this generation simply continues to cache the still-valid old value.
+       */
+      await this.rotateTelegramWebhookSecretTokenGeneration();
+    }
+
     const capacitySettingKeys: Array<keyof Model> = [
       "clickhouseCapacityNotificationEnabled",
       "clickhouseCapacityNotificationThresholdPercent",
@@ -201,6 +388,13 @@ export class Service extends DatabaseService<Model> {
       this.requireSsoForLoginCache.clear();
     }
 
+    if (
+      (onUpdate.updateBy.data as { telegramWebhookSecretToken?: unknown })
+        .telegramWebhookSecretToken !== undefined
+    ) {
+      await this.rotateTelegramWebhookSecretTokenGeneration();
+    }
+
     return onUpdate;
   }
 }

package/Server/Services/IncidentCustomFieldService.ts

@@ -1,9 +1,107 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/IncidentCustomField";
+import ObjectID from "../../Types/ObjectID";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { backfillMappedCustomFieldValues } from "../Utils/CustomField/CustomFieldDefinitionMappingHooks";
+import {
+  validateCustomFieldMappingOnCreate,
+  validateCustomFieldMappingOnUpdate,
+} from "../Utils/CustomField/CustomFieldMappingValidator";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * An incident custom field can take its value from the same field on the
+ * incident's monitors instead of being typed in again
+ * (OneUptime/oneuptime#3549). These hooks are the two halves of that
+ * configuration being saved: refusing a mapping that could never resolve, and
+ * filling in the incidents that already exist once one is saved.
+ */
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    await validateCustomFieldMappingOnCreate({
+      definitionModelType: Model,
+      createBy: createBy,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    await validateCustomFieldMappingOnUpdate({
+      definitionModelType: Model,
+      definitionService: this,
+      updateBy: updateBy,
+    });
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    backfillMappedCustomFieldValues({
+      definitionModelType: Model,
+      projectId: createdItem.projectId,
+      definitionName: "incident custom field",
+    });
+
+    return createdItem;
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    if (updatedItemIds.length > 0) {
+      backfillMappedCustomFieldValues({
+        definitionModelType: Model,
+        projectId: await this.getProjectIdForBackfill(onUpdate, updatedItemIds),
+        definitionName: "incident custom field",
+      });
+    }
+
+    return onUpdate;
+  }
+
+  /*
+   * `props.tenantId` is set on every dashboard write but not on internal
+   * root-scoped ones, so fall back to the row itself rather than skipping the
+   * backfill for a mapping that was changed by a script.
+   */
+  private async getProjectIdForBackfill(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<ObjectID | undefined> {
+    const tenantId: ObjectID | undefined = onUpdate.updateBy.props.tenantId as
+      | ObjectID
+      | undefined;
+
+    if (tenantId) {
+      return tenantId;
+    }
+
+    const item: Model | null = await this.findOneById({
+      id: updatedItemIds[0]!,
+      select: { projectId: true },
+      props: { isRoot: true },
+    });
+
+    return item?.projectId;
+  }
 }
 export default new Service();

package/Server/Services/IncidentService.ts

@@ -8,6 +8,8 @@ import FindBy from "../Types/Database/FindBy";
 import { OnCreate, OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
 import DatabaseService from "./DatabaseService";
+import IncidentCustomField from "../../Models/DatabaseModels/IncidentCustomField";
+import CustomFieldMappingService from "./CustomFieldMappingService";
 import AIRunService from "./AIRunService";
 import AIRunType from "../../Types/AI/AIRunType";
 import AIRunStatus from "../../Types/AI/AIRunStatus";
@@ -556,6 +558,18 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * Re-apply mapped custom field values. Covers the Custom Fields modal
+     * saving the whole bag back over a mapped value, and the incident's
+     * monitors being added or removed — both change what a mapped field should
+     * hold, and folding the answer into this payload keeps it one write with a
+     * truthful audit entry.
+     */
+    await CustomFieldMappingService.applyMappingsToUpdate({
+      definitionModelType: IncidentCustomField,
+      updateBy: updateBy,
+    });
+
     return {
       updateBy: updateBy,
       carryForward: carryForward,
@@ -1014,6 +1028,21 @@ export class Service extends DatabaseService<Model> {
         StatusPageSubscriberNotificationStatus.Pending;
     }
 
+    /*
+     * Last, because the incident template copy above can still be adding
+     * monitors and mapped custom fields are resolved from the final set.
+     *
+     * In onBeforeCreate rather than onCreateSuccess because `customFields` is
+     * a column on this row and the onCreateSuccess chain is un-awaited — a
+     * value written there would be missing from the incident the caller gets
+     * back. Written not to throw: a custom field failing to inherit must not
+     * stop an incident from being declared.
+     */
+    await CustomFieldMappingService.applyMappingsToCreate({
+      definitionModelType: IncidentCustomField,
+      createBy: createBy,
+    });
+
     return {
       createBy,
       carryForward: null,
@@ -1914,6 +1943,12 @@ ${incident.remediationNotes || "No remediation notes provided."}
     onUpdate: OnUpdate<Model>,
     updatedItemIds: ObjectID[],
   ): Promise<OnUpdate<Model>> {
+    CustomFieldMappingService.restampAfterMultiRowUpdate({
+      definitionModelType: IncidentCustomField,
+      updateBy: onUpdate.updateBy,
+      updatedItemIds: updatedItemIds,
+    });
+
     /*
      * Correcting a timestamp is the whole point of making these fields
      * editable, so the numbers derived from them have to move. Without this