@oneuptime/common 12.0.32 → 12.0.34

package/Models/DatabaseModels/TeamPermission.ts

@@ -42,7 +42,6 @@ import {
   create: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
-    Permission.CreateProjectTeam,
     Permission.EditProjectTeamPermissions,
   ],
   read: [
@@ -92,7 +91,6 @@ export default class TeamPermission extends BaseModel {
     create: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
       Permission.EditProjectTeamPermissions,
     ],
     read: [
@@ -133,7 +131,6 @@ export default class TeamPermission extends BaseModel {
     create: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
       Permission.EditProjectTeamPermissions,
     ],
     read: [
@@ -168,7 +165,6 @@ export default class TeamPermission extends BaseModel {
     create: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
       Permission.EditProjectTeamPermissions,
     ],
     read: [
@@ -209,7 +205,6 @@ export default class TeamPermission extends BaseModel {
     create: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
       Permission.EditProjectTeamPermissions,
     ],
     read: [
@@ -239,11 +234,7 @@ export default class TeamPermission extends BaseModel {
   public teamId?: ObjectID = undefined;
 
   @ColumnAccessControl({
-    create: [
-      Permission.ProjectOwner,
-      Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
-    ],
+    create: [Permission.ProjectOwner, Permission.ProjectAdmin],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -280,11 +271,7 @@ export default class TeamPermission extends BaseModel {
   public createdByUser?: User = undefined;
 
   @ColumnAccessControl({
-    create: [
-      Permission.ProjectOwner,
-      Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
-    ],
+    create: [Permission.ProjectOwner, Permission.ProjectAdmin],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -312,11 +299,7 @@ export default class TeamPermission extends BaseModel {
   public createdByUserId?: ObjectID = undefined;
 
   @ColumnAccessControl({
-    create: [
-      Permission.ProjectOwner,
-      Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
-    ],
+    create: [Permission.ProjectOwner, Permission.ProjectAdmin],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -376,7 +359,6 @@ export default class TeamPermission extends BaseModel {
     create: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
       Permission.EditProjectTeamPermissions,
     ],
     read: [
@@ -416,7 +398,6 @@ export default class TeamPermission extends BaseModel {
     create: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
       Permission.EditProjectTeamPermissions,
     ],
     read: [
@@ -467,7 +448,6 @@ export default class TeamPermission extends BaseModel {
     create: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
       Permission.EditProjectTeamPermissions,
     ],
     read: [
@@ -503,7 +483,6 @@ export default class TeamPermission extends BaseModel {
     create: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
-      Permission.CreateProjectTeam,
       Permission.EditProjectTeamPermissions,
     ],
     read: [

package/Models/DatabaseModels/TelemetryException.ts

@@ -17,6 +17,7 @@ import TenantColumn from "../../Types/Database/TenantColumn";
 import IconProp from "../../Types/Icon/IconProp";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import ErrorClass from "../../Types/Telemetry/ErrorClass";
 import ServiceType from "../../Types/Telemetry/ServiceType";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 import DatabaseBaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
@@ -1370,6 +1371,124 @@ export default class TelemetryException extends DatabaseBaseModel {
   })
   public aiClassification?: string = undefined;
 
+  @ColumnAccessControl({
+    /*
+     * Server-written only (isRoot bypasses column ACL): this is derived state
+     * maintained by ingest / triage — a client PATCH must not be able to set
+     * it, because this is the column the Issues list filters on and a
+     * writable one would let a caller move its own exceptions out of the
+     * actionable view.
+     */
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.TelemetryAdmin,
+      Permission.TelemetryMember,
+      Permission.TelemetryViewer,
+      Permission.ReadTelemetryException,
+    ],
+    update: [],
+  })
+  /*
+   * The fault domain of this exception group — whose problem is it? Values
+   * come from ErrorClass, the single platform-wide vocabulary (the emit path
+   * stamps the same strings on the `error.class` span-event attribute, and
+   * aiClassification is the same enum under its older name).
+   *
+   * NOT NULL with a DEFAULT is load-bearing here, not tidiness. The Issues
+   * list scopes with `IncludesNone(NON_ACTIONABLE_ERROR_CLASSES)`, which
+   * compiles to SQL `"errorClass" NOT IN ('user-error', 'expected-denial')`.
+   * In SQL `NULL NOT IN (...)` evaluates to NULL — falsy, not true — so a
+   * NULLABLE column would make every unclassified row fail that predicate and
+   * silently disappear from the "show me the real failures" view: the exact
+   * inverse of the fail-safe this whole scheme is built on. With NOT NULL
+   * DEFAULT 'unknown', an unclassified row carries a value that is not in the
+   * suppressed set, so it is an Issue by construction. (QueryHelper.notInOrNull
+   * exists for exactly this trap; making the column NOT NULL means the Issues
+   * scope never has to reach for it.)
+   *
+   * Deliberately typed `string` rather than `ErrorClass` (same as
+   * aiClassification): rows written by an older release, or by a triage
+   * runner echoing an LLM, can hold a value outside the enum. Readers run it
+   * through toErrorClass(); an unrecognised value still fails the NOT IN
+   * check, which keeps it visible.
+   */
+  @TableColumn({
+    title: "Error Class",
+    description:
+      "Fault domain of this exception group (code-fault, user-error, expected-denial, infrastructure, unknown). Non-actionable classes are excluded from the Issues list.",
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.ShortText,
+    defaultValue: ErrorClass.Unknown,
+    example: "code-fault",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    nullable: false,
+    length: ColumnLength.ShortText,
+    default: ErrorClass.Unknown,
+  })
+  public errorClass?: string = undefined;
+
+  @ColumnAccessControl({
+    /*
+     * Server-written only (isRoot bypasses column ACL): this is derived state
+     * maintained by ingest / triage — a client PATCH must not be able to set
+     * it, because a forged 'declared' would pin errorClass against every
+     * later, better-informed writer.
+     */
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.TelemetryAdmin,
+      Permission.TelemetryMember,
+      Permission.TelemetryViewer,
+      Permission.ReadTelemetryException,
+    ],
+    update: [],
+  })
+  /*
+   * Where the errorClass above came from, so a weaker source can never
+   * silently overwrite a stronger one. Precedence is declared > manual (a
+   * human) > ai > default, mirroring ErrorClass's "several possible sources"
+   * note:
+   *
+   * - 'default'  — nobody classified it; errorClass is still 'unknown'.
+   * - 'declared' — the emitting code said so at the throw / log site and the
+   *                ingest carried it through on the span event.
+   * - 'ai'       — the insight triage runner's verdict.
+   * - 'manual'   — a human reclassified the group.
+   *
+   * Same NOT NULL DEFAULT reasoning as errorClass: a NULL source is
+   * indistinguishable from 'default' for every writer that has to compare
+   * precedence, and `NULL <> 'declared'` is NULL rather than true, so a
+   * nullable column would make those guards silently skip every legacy row.
+   */
+  @TableColumn({
+    title: "Error Class Source",
+    description:
+      "Where the error class came from: default (unclassified), declared (by the emitting code), ai (triage verdict) or manual (a human)",
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.ShortText,
+    defaultValue: "default",
+    example: "declared",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    nullable: false,
+    length: ColumnLength.ShortText,
+    default: "default",
+  })
+  public errorClassSource?: string = undefined;
+
   @ColumnAccessControl({
     /*
      * Server-written only (isRoot bypasses column ACL): this is derived

package/Models/DatabaseModels/TelemetryIngestionKey.ts

@@ -15,6 +15,7 @@ import TenantColumn from "../../Types/Database/TenantColumn";
 import IconProp from "../../Types/Icon/IconProp";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import TelemetryIngestionKeyType from "../../Types/Telemetry/TelemetryIngestionKeyType";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
 @EnableDocumentation()
@@ -321,4 +322,263 @@ export default class TelemetryIngestionKey extends BaseModel {
     transformer: ObjectID.getDatabaseTransformer(),
   })
   public secretKey?: ObjectID = undefined;
+
+  /*
+   * Deliberately IMMUTABLE: create and read, but `update: []`.
+   *
+   * The type of a key is what every ingest-time guard keys off - which
+   * surfaces it may reach, whether an origin allowlist is enforced, whether a
+   * default rate limit applies. Editing it in place would silently change what
+   * a credential that is already deployed is allowed to do, in either
+   * direction: flipping Server -> Browser breaks a collector that has been
+   * shipping traces for a year the moment it sends from no Origin, and
+   * flipping Browser -> Server strips the origin binding off a key that is
+   * still sitting in a public page, which is the single control stopping
+   * anyone who scraped it from writing forged telemetry.
+   *
+   * Neither is a change anyone should be able to make by ticking a box in a
+   * form, and both have a safe alternative that is barely more work: create a
+   * second key of the right type, move traffic to it, delete the old one.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateTelemetryIngestionKey,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ReadTelemetryIngestionKey,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.ShortText,
+    title: "Key Type",
+    description:
+      "Server keys are for backend services and OpenTelemetry collectors: full ingest, no origin checks. Browser keys are meant to be published in a web page, so they are write-only, restricted to trace / log / metric / session replay ingest, and are only accepted from the origins you list below. This cannot be changed after the key is created - create a new key instead.",
+    defaultValue: TelemetryIngestionKeyType.Server,
+    example: TelemetryIngestionKeyType.Server,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: false,
+    default: TelemetryIngestionKeyType.Server,
+  })
+  public keyType?: TelemetryIngestionKeyType = undefined;
+
+  /*
+   * Required in practice on a Browser key even though the column itself is
+   * `required: false`. The database cannot express "non-empty only when
+   * keyType is Browser", so the emptiness rule is enforced on the write path
+   * and again at ingest time; the column keeps a '[]' default so that every
+   * pre-existing Server row backfills without a value and behaves exactly as
+   * it always has.
+   *
+   * Note the polarity is the OPPOSITE of
+   * RumApplication.sessionReplayAllowedOrigins, where an empty list accepts
+   * any origin. That column is an optional hardening control retrofitted onto
+   * a shipped feature and could not be tightened without breaking live
+   * installations. A Browser key is new, so it starts closed: a public
+   * credential with no origin binding is not a credential at all.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateTelemetryIngestionKey,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ReadTelemetryIngestionKey,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditTelemetryIngestionKey,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.JSON,
+    title: "Allowed Origins",
+    description:
+      "Browser origins (scheme + host + port, for example https://app.example.com, or https://*.example.com for one level of subdomain) that may use this key. Required and strictly enforced on a Browser key: a request from an unlisted origin, or with no Origin header at all, is refused. Ignored entirely on a Server key.",
+  })
+  @Column({
+    type: ColumnType.JSON,
+    nullable: false,
+    default: () => {
+      return "'[]'";
+    },
+  })
+  public allowedOrigins?: Array<string> = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateTelemetryIngestionKey,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ReadTelemetryIngestionKey,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditTelemetryIngestionKey,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "Pinned Service Name",
+    description:
+      "When set, every OpenTelemetry resource ingested with this key has its service.name REPLACED with this value. This is what stops data written with a scraped key from masquerading as another service: forged spans land in one service you can see and mute, instead of poisoning your backend services' dashboards and alerts.",
+    example: "checkout-web",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public pinnedServiceName?: string = undefined;
+
+  /*
+   * The kill switch. Separate from deleting the key because the response to
+   * "this key is being abused" and the response to "this key is no longer
+   * needed" are different: turning it off stops the writes in one edit and is
+   * reversible if you were wrong, while keeping the row (and its id) around so
+   * the ingest logs still name something that exists.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateTelemetryIngestionKey,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ReadTelemetryIngestionKey,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditTelemetryIngestionKey,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Enabled",
+    description:
+      "Turn this off to immediately stop accepting telemetry written with this key, without deleting it. Turn it back on to resume.",
+    defaultValue: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: true,
+  })
+  public isEnabled?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateTelemetryIngestionKey,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ReadTelemetryIngestionKey,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditTelemetryIngestionKey,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "Expires At",
+    description:
+      "Date and time after which this key stops being accepted. Empty means it never expires, which is how every key behaved before this column existed. Setting one on a Browser key bounds how long a scraped copy stays useful.",
+    example: "2025-12-31T23:59:59Z",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public expiresAt?: Date = undefined;
+
+  /*
+   * Written by the ingest path only, hence `create: []` and `update: []`: a
+   * value a customer could set by hand would be worthless for the one question
+   * it exists to answer - "is anything still using this key, and can I safely
+   * delete or rotate it?"
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ReadTelemetryIngestionKey,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "Last Used At",
+    description:
+      "The last time telemetry was accepted with this key. Empty means it has never been used since this was recorded. Use it to find keys that are safe to rotate or delete.",
+    example: "2025-12-31T23:59:59Z",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public lastUsedAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateTelemetryIngestionKey,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ReadTelemetryIngestionKey,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditTelemetryIngestionKey,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Number,
+    title: "Requests Per Minute Limit",
+    description:
+      "Maximum ingest requests per minute accepted with this key. Leave empty to use the shipped default for a Browser key, and to leave a Server key unlimited. The limit is per key, across every client using it, so it has to clear your whole fleet - see DEFAULT_BROWSER_KEY_REQUESTS_PER_MINUTE for the default and the reasoning behind its size.",
+    example: 6000,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: true,
+  })
+  public requestsPerMinuteLimit?: number = undefined;
 }