@oneuptime/common 12.0.32 → 12.0.34

package/Server/Services/UserTelegramService.ts

@@ -4,6 +4,7 @@ import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import ProjectService from "./ProjectService";
+import TeamMemberService from "./TeamMemberService";
 import UserNotificationRuleService, {
   NotificationDeletionImpact,
   NotificationMethodChannel,
@@ -11,10 +12,29 @@ import UserNotificationRuleService, {
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
-import Text from "../../Types/Text";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
 import Project from "../../Models/DatabaseModels/Project";
+import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import Model from "../../Models/DatabaseModels/UserTelegram";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import TelegramVerificationToken from "../Utils/TelegramVerificationToken";
+import {
+  QueryDeepPartialEntity,
+  UpdateQueryBuilder,
+  UpdateResult,
+} from "typeorm";
+
+export enum TelegramVerificationOutcome {
+  Verified = "verified",
+  Invalid = "invalid",
+  Expired = "expired",
+  AlreadyClaimed = "already-claimed",
+}
+
+export interface TelegramVerificationResult {
+  outcome: TelegramVerificationOutcome;
+  item?: Model | undefined;
+}
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -90,6 +110,59 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("telegramChatId cannot be set directly");
     }
 
+    /*
+     * DatabaseService stamps props.tenantId only AFTER this hook. Until then,
+     * both projectId and project are request data. Policy checks performed
+     * against either request value would therefore be a confused-deputy bug:
+     * the caller could pass an enabled/funded project here, pass this hook, and
+     * have DatabaseService persist the row under a different authenticated
+     * tenant afterwards.
+     *
+     * Canonicalize both spellings to the authenticated request tenant before
+     * any lookup. Root jobs have no request tenant, so they retain the existing
+     * internal-call behaviour and use the project explicitly carried by data.
+     */
+    const suppliedProjectId: ObjectID | undefined = createBy.data.projectId;
+    const relationProjectId: ObjectID | null | undefined =
+      createBy.data.project?.id ||
+      (createBy.data.project?._id
+        ? new ObjectID(createBy.data.project._id)
+        : undefined);
+    const requestTenantId: ObjectID | undefined = createBy.props.tenantId;
+
+    if (!createBy.props.isRoot && !requestTenantId) {
+      throw new BadDataException("Project ID is required");
+    }
+
+    const authoritativeProjectId: ObjectID | undefined = createBy.props.isRoot
+      ? suppliedProjectId
+      : requestTenantId;
+
+    if (!authoritativeProjectId) {
+      throw new BadDataException("Project ID is required");
+    }
+
+    if (
+      suppliedProjectId &&
+      !suppliedProjectId.equals(authoritativeProjectId)
+    ) {
+      throw new BadDataException("Project ID does not match request tenant");
+    }
+
+    if (
+      relationProjectId &&
+      !relationProjectId.equals(authoritativeProjectId)
+    ) {
+      throw new BadDataException(
+        createBy.props.isRoot
+          ? "Project relation does not match projectId"
+          : "Project relation does not match request tenant",
+      );
+    }
+
+    createBy.data.projectId = authoritativeProjectId;
+    delete createBy.data.project;
+
     const project: Project | null = await ProjectService.findOneById({
       id: createBy.data.projectId!,
       props: {
@@ -120,6 +193,13 @@ export class Service extends DatabaseService<Model> {
       );
     }
 
+    /*
+     * Never accept a caller-selected bearer token. This hook runs before the
+     * required-field and permission checks, so every ordinary create gets a
+     * server-minted 256-bit capability and no API input can choose it.
+     */
+    createBy.data.verificationCode = TelegramVerificationToken.mint();
+
     return {
       createBy,
       carryForward: null,
@@ -127,7 +207,7 @@ export class Service extends DatabaseService<Model> {
   }
 
   @CaptureSpan()
-  public async regenerateVerificationCode(itemId: ObjectID): Promise<void> {
+  public async regenerateVerificationCode(itemId: ObjectID): Promise<string> {
     const item: Model | null = await this.findOneById({
       id: itemId,
       props: {
@@ -135,6 +215,9 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         isVerified: true,
+        verificationCode: true,
+        projectId: true,
+        userId: true,
       },
     });
 
@@ -148,15 +231,253 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Telegram account already verified");
     }
 
-    await this.updateOneById({
+    if (
+      !item.projectId ||
+      !item.userId ||
+      !(await this.hasActiveProjectMembership({
+        projectId: item.projectId,
+        userId: item.userId,
+      }))
+    ) {
+      throw new BadDataException("Item not found");
+    }
+
+    const retryAfterSeconds: number =
+      TelegramVerificationToken.getResendRetryAfterSeconds({
+        token: item.verificationCode,
+      });
+
+    if (
+      !TelegramVerificationToken.isExpired({
+        token: item.verificationCode,
+      }) &&
+      retryAfterSeconds > 0
+    ) {
+      throw new TooManyRequestsException(
+        `Please wait ${retryAfterSeconds} seconds before rotating the Telegram verification code.`,
+      );
+    }
+
+    const verificationCode: string = TelegramVerificationToken.mint();
+
+    await this.updateColumnsByIdWithoutHooks({
+      id: itemId,
+      data: {
+        verificationCode,
+      },
+      expectedData: {
+        isVerified: false,
+        ...(item.verificationCode !== undefined
+          ? { verificationCode: item.verificationCode }
+          : {}),
+      },
+    });
+
+    const updatedItem: Model | null = await this.findOneById({
+      id: itemId,
+      props: {
+        isRoot: true,
+      },
+      select: {
+        isVerified: true,
+        verificationCode: true,
+      },
+    });
+
+    if (!updatedItem) {
+      throw new BadDataException(
+        "Item with ID " + itemId.toString() + " not found",
+      );
+    }
+
+    if (updatedItem.isVerified) {
+      throw new BadDataException("Telegram account already verified");
+    }
+
+    if (updatedItem.verificationCode !== verificationCode) {
+      throw new TooManyRequestsException(
+        "The Telegram verification code changed in another request. Please refresh and try again.",
+      );
+    }
+
+    return verificationCode;
+  }
+
+  @CaptureSpan()
+  public async getVerificationCode(itemId: ObjectID): Promise<string> {
+    const item: Model | null = await this.findOneById({
       id: itemId,
       props: {
         isRoot: true,
       },
-      data: {
-        verificationCode: Text.generateRandomNumber(6),
+      select: {
+        isVerified: true,
+        verificationCode: true,
+      },
+    });
+
+    if (!item) {
+      throw new BadDataException("Item not found");
+    }
+
+    if (item.isVerified) {
+      return "";
+    }
+
+    if (
+      TelegramVerificationToken.isValidShape(item.verificationCode) &&
+      !TelegramVerificationToken.isExpired({ token: item.verificationCode })
+    ) {
+      return item.verificationCode;
+    }
+
+    /*
+     * Rows created before this fix hold a six-digit value with no timestamp.
+     * Expired rows also arrive here. Rotate both on the owner's next view so
+     * upgrades fail closed without leaving the user stranded.
+     */
+    return this.regenerateVerificationCode(itemId);
+  }
+
+  @CaptureSpan()
+  public async hasActiveProjectMembership(data: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }): Promise<boolean> {
+    const membership: TeamMember | null = await TeamMemberService.findOneBy({
+      query: {
+        projectId: data.projectId,
+        userId: data.userId,
+        hasAcceptedInvitation: true,
+      },
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return Boolean(membership);
+  }
+
+  @CaptureSpan()
+  public async claimVerificationCode(data: {
+    verificationCode: string;
+    telegramChatId: string;
+  }): Promise<TelegramVerificationResult> {
+    if (!TelegramVerificationToken.isValidShape(data.verificationCode)) {
+      return { outcome: TelegramVerificationOutcome.Invalid };
+    }
+
+    if (
+      TelegramVerificationToken.isExpired({
+        token: data.verificationCode,
+      })
+    ) {
+      return { outcome: TelegramVerificationOutcome.Expired };
+    }
+
+    const item: Model | null = await this.findOneBy({
+      query: {
+        verificationCode: data.verificationCode,
+        isVerified: false,
+      },
+      select: {
+        _id: true,
+        userId: true,
+        projectId: true,
+      },
+      props: {
+        isRoot: true,
       },
     });
+
+    if (!item?.id || !item.projectId || !item.userId) {
+      return { outcome: TelegramVerificationOutcome.Invalid };
+    }
+
+    if (
+      !(await this.hasActiveProjectMembership({
+        projectId: item.projectId,
+        userId: item.userId,
+      }))
+    ) {
+      return { outcome: TelegramVerificationOutcome.Invalid };
+    }
+
+    /*
+     * Compare-and-set is essential here. Two chats can submit one leaked link
+     * at the same time; only the UPDATE whose expected token and unverified
+     * state still match may bind the row. The winner burns the capability in
+     * the same statement, so replay is impossible.
+     */
+    const queryBuilder: UpdateQueryBuilder<Model> = this.getRepository()
+      .createQueryBuilder()
+      .update(Model)
+      .set({
+        isVerified: true,
+        telegramChatId: data.telegramChatId,
+        verificationCode: TelegramVerificationToken.mintUnusableValue(),
+      } as QueryDeepPartialEntity<Model>)
+      .where('"_id" = :itemId', { itemId: item.id.toString() })
+      .andWhere('"isVerified" = :isVerified', { isVerified: false })
+      .andWhere('"verificationCode" = :verificationCode', {
+        verificationCode: data.verificationCode,
+      })
+      .andWhere(
+        `EXISTS (
+          SELECT 1
+          FROM "TeamMember"
+          WHERE "projectId" = :projectId
+            AND "userId" = :userId
+            AND "hasAcceptedInvitation" = TRUE
+            AND "deletedAt" IS NULL
+          FOR KEY SHARE
+        )`,
+        {
+          projectId: item.projectId.toString(),
+          userId: item.userId.toString(),
+        },
+      );
+
+    const updateResult: UpdateResult = await queryBuilder.execute();
+
+    /*
+     * The affected-row result is the only reliable winner signal. Re-reading
+     * the row cannot distinguish the winner from a simultaneous replay by the
+     * same Telegram chat, because both requests observe the same final chat
+     * id. Only the statement that changed the row may trigger follow-up work.
+     */
+    if (updateResult.affected !== 1) {
+      return { outcome: TelegramVerificationOutcome.AlreadyClaimed };
+    }
+
+    const claimedItem: Model | null = await this.findOneById({
+      id: item.id,
+      props: {
+        isRoot: true,
+      },
+      select: {
+        _id: true,
+        userId: true,
+        projectId: true,
+        isVerified: true,
+        telegramChatId: true,
+      },
+    });
+
+    if (
+      !claimedItem?.isVerified ||
+      claimedItem.telegramChatId !== data.telegramChatId
+    ) {
+      return { outcome: TelegramVerificationOutcome.AlreadyClaimed };
+    }
+
+    return {
+      outcome: TelegramVerificationOutcome.Verified,
+      item: claimedItem,
+    };
   }
 }
 

package/Server/Types/Database/QueryHelper.ts

@@ -10,6 +10,8 @@ import { toLikePattern } from "../../../Types/BaseDatabase/WildcardPattern";
 import CaptureSpan from "../../Utils/Telemetry/CaptureSpan";
 import buildJSONColumnQuery, { JSONColumnQuery } from "./JSONColumnQuery";
 
+export type { FindOperator };
+
 export default class QueryHelper {
   @CaptureSpan()
   public static modulo(
@@ -656,7 +658,7 @@ export default class QueryHelper {
   }
 
   @CaptureSpan()
-  public static greaterThan<T extends number | Date>(
+  public static greaterThan<T extends number | Date | ObjectID>(
     value: T,
   ): FindWhereProperty<any> {
     const rid: string = Text.generateRandomText(10);
@@ -665,7 +667,7 @@ export default class QueryHelper {
         return `(${alias} > :${rid})`;
       },
       {
-        [rid]: value,
+        [rid]: value instanceof ObjectID ? value.toString() : value,
       },
     ) as FindWhereProperty<any>;
   }

package/Server/Utils/AI/Chat/ObservabilityChatPrompt.ts

@@ -61,14 +61,25 @@ function buildEntityContextGuidance(context: AIChatPageContext): string {
   }
 }
 
+/*
+ * Per-area guidance for list and explorer pages. This text is the only
+ * capability claim in the request that is scoped to the page the user is on,
+ * so the model weighs it against the tool schemas — which means it must never
+ * describe a tool as NARROWER than it is. It previously summarised
+ * query_incidents as "recent incidents, or one by incidentId", and the model
+ * paraphrased that back as "I have no tool to list active incidents, give me
+ * an incidentId" on the very page whose own suggested prompt card asks
+ * "which incidents are currently active or unresolved?". Every affordance an
+ * area page's suggested prompts depend on has to be named here.
+ */
 function buildAreaContextGuidance(type: AIChatPageContextType): string {
   switch (type) {
     case AIChatPageContextType.IncidentsList:
-      return `the incidents list. Questions about "these incidents" or incident activity are answered with query_incidents (recent incidents, or one by incidentId) and search_incidents (free-text search over past incidents).`;
+      return `the incidents list. Questions about "these incidents" or incident activity are answered with query_incidents: pass state="active" to list every incident that is unresolved RIGHT NOW (this drops the time window, so incidents opened weeks ago are still returned), leave state unset for recent activity in a window, or pass incidentId for one incident's full details. search_incidents does free-text search over past incidents.`;
     case AIChatPageContextType.AlertsList:
-      return `the alerts list. Questions about alert activity are answered with query_alerts.`;
+      return `the alerts list. Questions about alert activity are answered with query_alerts: pass state="active" to list every alert that is unresolved RIGHT NOW regardless of age, leave state unset for recent activity in a window, or pass alertId for one alert's full details.`;
     case AIChatPageContextType.MonitorsList:
-      return `the monitors list. Questions about monitors and their status are answered with query_monitors.`;
+      return `the monitors list. Questions about monitors and their status are answered with query_monitors: pass problemsOnly=true to list the monitors that are NOT operational right now, or monitorId for one monitor's details and its recent status timeline.`;
     case AIChatPageContextType.ScheduledMaintenanceList:
       return `the scheduled maintenance list. Questions about maintenance windows are answered with query_scheduled_maintenance (past, ongoing and upcoming events; one event by scheduledMaintenanceId). recent_changes also merges maintenance into a chronological feed alongside other changes.`;
     case AIChatPageContextType.LogsExplorer:

package/Server/Utils/AI/SRE/Insights/Detectors/ExceptionSpikeDetector.ts

@@ -4,6 +4,8 @@ import SortOrder from "../../../../../../Types/BaseDatabase/SortOrder";
 import InBetween from "../../../../../../Types/BaseDatabase/InBetween";
 import PositiveNumber from "../../../../../../Types/PositiveNumber";
 import { JSONObject } from "../../../../../../Types/JSON";
+import IncludesNone from "../../../../../../Types/BaseDatabase/IncludesNone";
+import { NON_ACTIONABLE_ERROR_CLASSES } from "../../../../../../Types/Telemetry/ErrorClass";
 import { LIMIT_PER_PROJECT } from "../../../../../../Types/Database/LimitMax";
 import AIInsightType from "../../../../../../Types/AI/AIInsightType";
 import AIInsightSeverity from "../../../../../../Types/AI/AIInsightSeverity";
@@ -176,6 +178,14 @@ export default class ExceptionSpikeDetector implements InsightDetector {
       firstSeenAt: QueryHelper.lessThan(establishedBefore),
       isResolved: false,
       isArchived: false,
+      /*
+       * Muted fault domains never file an insight. A spike in rejected
+       * logins or malformed input is a traffic story, not a code defect —
+       * and each candidate costs two ClickHouse counts before it can even
+       * be dropped, so excluding them here saves the scan as well as the
+       * LLM budget. Mirrors the Issues list scope.
+       */
+      errorClass: new IncludesNone([...NON_ACTIONABLE_ERROR_CLASSES]),
     };
 
     const exceptions: Array<TelemetryException> =

package/Server/Utils/AI/SRE/Insights/Detectors/NewExceptionDetector.ts

@@ -2,6 +2,8 @@ import ObjectID from "../../../../../../Types/ObjectID";
 import OneUptimeDate from "../../../../../../Types/Date";
 import SortOrder from "../../../../../../Types/BaseDatabase/SortOrder";
 import { JSONObject } from "../../../../../../Types/JSON";
+import IncludesNone from "../../../../../../Types/BaseDatabase/IncludesNone";
+import { NON_ACTIONABLE_ERROR_CLASSES } from "../../../../../../Types/Telemetry/ErrorClass";
 import AIInsightType from "../../../../../../Types/AI/AIInsightType";
 import AIInsightSeverity from "../../../../../../Types/AI/AIInsightSeverity";
 import TelemetryException from "../../../../../../Models/DatabaseModels/TelemetryException";
@@ -171,6 +173,14 @@ export default class NewExceptionDetector implements InsightDetector {
       firstSeenAt: QueryHelper.greaterThanEqualTo(firstSeenSince),
       isResolved: false,
       isArchived: false,
+      /*
+       * Muted fault domains never file an insight. A user-error or an
+       * expected-denial group is not a defect in this code, so triaging it
+       * would spend an LLM budget grant to be told exactly what the
+       * emitting code already declared. Mirrors the Issues list scope, so
+       * the inbox and the list agree on what counts as a real failure.
+       */
+      errorClass: new IncludesNone([...NON_ACTIONABLE_ERROR_CLASSES]),
       occuranceCount: QueryHelper.greaterThanEqualTo(
         NEW_EXCEPTION_MIN_OCCURRENCE_COUNT,
       ),

package/Server/Utils/AI/SRE/Insights/InsightTriageRunner.ts

@@ -215,7 +215,9 @@ export default class InsightTriageRunner {
    *
    * 1. Stamp the verdict onto the exception group row (aiClassification)
    *    so the exceptions list can filter on it and the fix lane can skip
-   *    known-non-defects without re-triaging.
+   *    known-non-defects without re-triaging, and PROMOTE it into the
+   *    platform-wide errorClass when nothing better has claimed that field
+   *    yet (see below).
    * 2. code-fault → route the automatic fix (InsightFixRouting owns every
    *    gate: enableAi, enableInsightFixTasks, budget, readiness, dedupe)
    *    and flip the insight to FixOpened when a run was queued.
@@ -244,6 +246,12 @@ export default class InsightTriageRunner {
      * meantime gets no PR and keeps its terminal status.
      */
     if (insight.telemetryExceptionId) {
+      /*
+       * aiClassification is the AUDIT RECORD of what the LLM said and is
+       * written unconditionally — it must stay readable even when a
+       * stronger source owns errorClass, so a human comparing the two can
+       * see where the model disagreed.
+       */
       await TelemetryExceptionService.updateOneById({
         id: insight.telemetryExceptionId,
         data: {
@@ -251,6 +259,59 @@ export default class InsightTriageRunner {
         },
         props: { isRoot: true },
       });
+
+      /*
+       * errorClass is the ACTED-ON field (Issues scope, emit-path
+       * suppression, fix routing), and its precedence is
+       * declared > manual > ai > default. A class the throwing code
+       * declared for itself is a site-level statement by a developer, and
+       * 'manual' is a human's verdict on this exact group; a probabilistic
+       * LLM answer outranks neither. So the promotion is guarded on the
+       * source still being 'default' — nobody has classified this group.
+       *
+       * The guard is a WHERE clause rather than a read-then-write: the
+       * triage run has been in flight for minutes, so a 'declared' event
+       * ingesting or a human reclassifying between a read and this write
+       * is a real race, and a conditional UPDATE cannot clobber either.
+       * (Same conditional-flip idiom as the ActionRequired -> FixOpened
+       * write below.)
+       */
+      try {
+        const promotedRowCount: number =
+          await TelemetryExceptionService.updateOneBy({
+            query: {
+              _id: insight.telemetryExceptionId.toString(),
+              errorClassSource: "default",
+            },
+            data: {
+              errorClass: classification,
+              errorClassSource: "ai",
+            },
+            props: { isRoot: true },
+          });
+
+        if (promotedRowCount === 0) {
+          logger.debug(
+            `AI insights: kept the existing error class on exception ${insight.telemetryExceptionId.toString()} — a declared or manual classification outranks the AI verdict ${classification}.`,
+          );
+        }
+      } catch (err) {
+        /*
+         * Non-fatal on purpose. This is a secondary, self-healing write: the
+         * audit record above already landed, and live traffic re-stamps
+         * errorClass from the declared class on the group's next occurrence.
+         *
+         * The auto-archive decision below IS user-visible and irreversible by
+         * comparison, so it must not be lost to a failure here. Without this
+         * guard the two are coupled only by statement order, which is exactly
+         * the kind of coupling nobody notices until an incident.
+         */
+        logger.warn(
+          `AI insights: could not promote the error class on exception ${insight.telemetryExceptionId.toString()}: ${
+            err instanceof Error ? err.message : String(err)
+          }`,
+        );
+      }
     }
 
     const currentInsight: AIInsight | null = await AIInsightService.findOneById(

package/Server/Utils/AI/Toolbox/AlertTools.ts

@@ -42,7 +42,7 @@ type AlertStateFilter = "active" | "resolved" | "any";
 export const QueryAlertsTool: ObservabilityTool = {
   name: "query_alerts",
   description:
-    "Query alerts in this project with their current state and severity. To answer 'which alerts are active/firing right now?' pass state='active' — it returns every unresolved alert regardless of age (no time window unless createdWithinHours is passed explicitly). state='resolved' returns only resolved alerts; the default 'any' returns both, limited to the createdWithinHours window. Results are newest-first; the result reports the total match count — pass skip to page through more. Pass alertId to get full details of one alert, including its description and its owners (teams and users).",
+    "Query alerts in this project with their current state and severity. Every row also carries the monitor the alert was raised for, so counting rows by monitor answers 'which monitor or source is the noisiest?'. To answer 'which alerts are active/firing right now?' pass state='active' — it returns every unresolved alert regardless of age (no time window unless createdWithinHours is passed explicitly). state='resolved' returns only resolved alerts; the default 'any' returns both, limited to the createdWithinHours window. Results are newest-first; the result reports the total match count — pass skip to page through more. Pass alertId to get full details of one alert, including its description and its owners (teams and users).",
   inputSchema: {
     type: "object",
     properties: {
@@ -97,6 +97,9 @@ export const QueryAlertsTool: ObservabilityTool = {
           alertSeverity: {
             name: true,
           },
+          monitor: {
+            name: true,
+          },
         },
         props: ctx.props,
       });
@@ -177,6 +180,7 @@ export const QueryAlertsTool: ObservabilityTool = {
               description: alert.description,
               state: alert.currentAlertState?.name,
               severity: alert.alertSeverity?.name,
+              monitor: alert.monitor?.name,
               createdAt: alert.createdAt,
               ownerTeams: ownerTeamNames || undefined,
               ownerUsers: ownerUserNames || undefined,
@@ -286,6 +290,15 @@ export const QueryAlertsTool: ObservabilityTool = {
         alertSeverity: {
           name: true,
         },
+        /*
+         * The monitor an alert was raised for is what turns a list of alerts
+         * into "which source is noisiest" — the question the alerts page
+         * offers as a first-class suggested prompt. Without it the model can
+         * only guess a source from alert titles.
+         */
+        monitor: {
+          name: true,
+        },
       },
       sort: {
         createdAt: SortOrder.Descending,
@@ -309,6 +322,7 @@ export const QueryAlertsTool: ObservabilityTool = {
         title: alert.title,
         state: alert.currentAlertState?.name,
         severity: alert.alertSeverity?.name,
+        monitor: alert.monitor?.name,
         createdAt: alert.createdAt,
       };
     });

package/Server/Utils/APIKey/AccessPermission.ts

@@ -91,9 +91,12 @@ export default class APIKeyAccessPermission {
     projectId: ObjectID,
     apiKeyId: ObjectID,
   ): Promise<UserTenantAccessPermission> {
-    // get team permissions (cached — see ApiKeyPermissionService).
+    // Get only this key's permissions in this project (cached by both ids).
     const apiKeyPermissionRows: Array<ApiKeyPermissionRow> =
-      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(
+        apiKeyId,
+        projectId,
+      );
 
     const userPermissions: Array<UserPermission> = apiKeyPermissionRows.map(
       (row: ApiKeyPermissionRow): UserPermission => {