@oneuptime/common 12.0.33 → 12.0.34

package/build/dist/Server/Services/GlobalConfigService.js

@@ -10,8 +10,16 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalConfig";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import BadDataException from "../../Types/Exception/BadDataException";
+import TelegramVerificationToken from "../Utils/TelegramVerificationToken";
+import GlobalCache from "../Infrastructure/GlobalCache";
+const TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE = "global-config-security";
+const TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY = "telegram-webhook-secret-generation";
+const TELEGRAM_WEBHOOK_SECRET_INITIAL_GENERATION = "initial";
+const TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE = "__not_configured__";
+const TELEGRAM_WEBHOOK_SECRET_CACHE_TTL_SECONDS = 5;
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
@@ -21,6 +29,13 @@ export class Service extends DatabaseService {
          * time. Refreshed at most once per 60s and invalidated on update below.
          */
         this.requireSsoForLoginCache = new InMemoryTTLCache(10000);
+        /*
+         * The public Telegram webhook is hit without a OneUptime session. The value
+         * cache lives in Redis so every app replica observes the same generation.
+         * Only the in-flight promise is process-local: it collapses a cache-miss
+         * burst to one Postgres read per replica without retaining a retired secret.
+         */
+        this.telegramWebhookSecretTokenLoad = undefined;
     }
     /*
      * Instance-wide: must every user sign in with SSO to access projects?
@@ -41,7 +56,115 @@ export class Service extends DatabaseService {
         this.requireSsoForLoginCache.set(key, value, 60000);
         return value;
     }
+    async getTelegramWebhookSecretToken() {
+        while (true) {
+            const generation = await this.getTelegramWebhookSecretTokenGeneration();
+            const cacheKey = this.getTelegramWebhookSecretTokenCacheKey(generation);
+            const cached = await GlobalCache.getString(TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE, cacheKey);
+            if (cached !== null) {
+                return cached === TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE
+                    ? undefined
+                    : cached;
+            }
+            const existingLoad = this.telegramWebhookSecretTokenLoad;
+            /*
+             * Cache expiry is visible to every public webhook request at once. Share
+             * the database read for that generation so a burst cannot turn one
+             * expiry into one root Postgres query per request.
+             */
+            const load = (existingLoad === null || existingLoad === void 0 ? void 0 : existingLoad.generation) === generation
+                ? existingLoad
+                : {
+                    generation,
+                    promise: this.loadTelegramWebhookSecretToken(generation, cacheKey),
+                };
+            if (load !== existingLoad) {
+                this.telegramWebhookSecretTokenLoad = load;
+            }
+            try {
+                const result = await load.promise;
+                /*
+                 * A rotation that completed during the database read makes the result
+                 * unreachable through the new generation key. Loop so this request
+                 * also joins the new generation instead of authenticating with the
+                 * value that was retired while it waited.
+                 */
+                if (result.isCurrentGeneration) {
+                    return result.value;
+                }
+            }
+            finally {
+                /*
+                 * An invalidation can start a newer-generation load while this one is
+                 * still pending. The older promise must not clear that newer flight.
+                 */
+                if (this.telegramWebhookSecretTokenLoad === load) {
+                    this.telegramWebhookSecretTokenLoad = undefined;
+                }
+            }
+        }
+    }
+    async getTelegramWebhookSecretTokenGeneration() {
+        return ((await GlobalCache.getString(TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE, TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY)) || TELEGRAM_WEBHOOK_SECRET_INITIAL_GENERATION);
+    }
+    getTelegramWebhookSecretTokenCacheKey(generation) {
+        return `telegram-webhook-secret:${generation}`;
+    }
+    async loadTelegramWebhookSecretToken(generation, cacheKey) {
+        var _a;
+        const config = await this.findOneBy({
+            query: {
+                _id: ObjectID.getZeroObjectID().toString(),
+            },
+            select: {
+                telegramWebhookSecretToken: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        const value = ((_a = config === null || config === void 0 ? void 0 : config.telegramWebhookSecretToken) === null || _a === void 0 ? void 0 : _a.trim()) || undefined;
+        /*
+         * A read begun before a rotation may return after the update has committed.
+         * Check the shared generation before populating Redis; an old replica can
+         * still finish its query, but it cannot republish the retired value under
+         * the generation every other replica now reads.
+         */
+        if (generation !== (await this.getTelegramWebhookSecretTokenGeneration())) {
+            return {
+                value: undefined,
+                isCurrentGeneration: false,
+            };
+        }
+        await GlobalCache.setString(TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE, cacheKey, value || TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE, { expiresInSeconds: TELEGRAM_WEBHOOK_SECRET_CACHE_TTL_SECONDS });
+        return {
+            value,
+            isCurrentGeneration: generation === (await this.getTelegramWebhookSecretTokenGeneration()),
+        };
+    }
+    async rotateTelegramWebhookSecretTokenGeneration() {
+        await GlobalCache.setString(TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE, TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY, ObjectID.generate().toString());
+    }
     async onBeforeUpdate(updateBy) {
+        if (updateBy.data.telegramWebhookSecretToken !== undefined) {
+            const secret = updateBy.data.telegramWebhookSecretToken;
+            if (secret !== null &&
+                secret !== "" &&
+                !TelegramVerificationToken.isWebhookSecretStrong(secret)) {
+                throw new BadDataException("Telegram webhook secret token must be 32-100 characters and contain only letters, numbers, underscores, or hyphens.");
+            }
+            if (typeof secret === "string") {
+                updateBy.data.telegramWebhookSecretToken = secret.trim();
+            }
+            /*
+             * Move every replica to a fresh shared generation before the write. A
+             * request during the transaction may still read the currently committed
+             * secret, but it cannot repopulate the generation used before rotation.
+             * The success hook rotates once more after commit. If the write fails,
+             * this generation simply continues to cache the still-valid old value.
+             */
+            await this.rotateTelegramWebhookSecretTokenGeneration();
+        }
         const capacitySettingKeys = [
             "clickhouseCapacityNotificationEnabled",
             "clickhouseCapacityNotificationThresholdPercent",
@@ -123,6 +246,10 @@ export class Service extends DatabaseService {
             .requireSsoForLogin !== undefined) {
             this.requireSsoForLoginCache.clear();
         }
+        if (onUpdate.updateBy.data
+            .telegramWebhookSecretToken !== undefined) {
+            await this.rotateTelegramWebhookSecretTokenGeneration();
+        }
         return onUpdate;
     }
 }
@@ -132,6 +259,12 @@ __decorate([
     __metadata("design:paramtypes", []),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "getRequireSsoForLogin", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getTelegramWebhookSecretToken", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Services/GlobalConfigService.js.map

@@ -1 +1 @@
-{"version":3,"file":"GlobalConfigService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalConfigService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,0CAA0C,CAAC;AAC7D,OAAO,gBAAgB,MAAM,oCAAoC,CAAC;AAGlE,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAEtE,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IASjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;QATf;;;;WAIG;QACK,4BAAuB,GAC7B,IAAI,gBAAgB,CAAC,KAAM,CAAC,CAAC;IAI/B,CAAC;IAED;;;OAGG;IAEU,AAAN,KAAK,CAAC,qBAAqB;QAChC,MAAM,GAAG,GAAW,QAAQ,CAAC;QAC7B,MAAM,MAAM,GAAwB,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;YACpC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAY,OAAO,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB,CAAC,CAAC;QAC3D,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAM,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,mBAAmB,GAAuB;YAC9C,uCAAuC;YACvC,gDAAgD;YAChD,8BAA8B;YAC9B,uCAAuC;YACvC,oCAAoC;SACrC,CAAC;QAEF,MAAM,uBAAuB,GAAY,mBAAmB,CAAC,IAAI,CAC/D,CAAC,GAAgB,EAAW,EAAE;YAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAC1C,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,OAAO;gBACL,QAAQ;gBACR,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,MAAM,aAAa,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YACvD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE;gBACN,8CAA8C,EAAE,IAAI;gBACpD,qCAAqC,EAAE,IAAI;gBAC3C,kCAAkC,EAAE,IAAI;aACzC;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAkD,CACtE,KAAc,EACd,SAAiB,EACT,EAAE;YACV,IAAI,eAAe,GAAY,KAAK,CAAC;YAErC,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,YAAY,GAAW,eAAe,CAAC,IAAI,EAAE,CAAC;gBACpD,eAAe;oBACb,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;YAED,IACE,OAAO,eAAe,KAAK,QAAQ;gBACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACjC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC;gBAClC,eAAe,GAAG,CAAC;gBACnB,eAAe,GAAG,GAAG,EACrB,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,GAAG,SAAS,wCAAwC,CACrD,CAAC;YACJ,CAAC;YAED,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC;QAEF,IACE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,KAAK,SAAS,EAC1E,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,8CAA8C;gBAC1D,gBAAgB,CACd,QAAQ,CAAC,IAAI;qBACV,8CAAyD,EAC5D,4CAA4C,CAC7C,CAAC;QACN,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,qCAAqC,KAAK,SAAS,EAAE,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC,qCAAqC,GAAG,gBAAgB,CACpE,QAAQ,CAAC,IAAI,CAAC,qCAAgD,EAC9D,mCAAmC,CACpC,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,kCAAkC,KAAK,SAAS,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,GAAG,gBAAgB,CACjE,QAAQ,CAAC,IAAI,CAAC,kCAA6C,EAC3D,gCAAgC,CACjC,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAKX,CACZ,YAAqB,EACrB,YAAgC,EAChC,YAAoB,EACpB,SAAiB,EACT,EAAE;YACV,MAAM,KAAK,GACT,YAAY,KAAK,SAAS;gBACxB,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,YAAY,CAAC;YAEnC,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC,CAAC;QAEF,mBAAmB,CACjB,QAAQ,CAAC,IAAI,CAAC,8CAA8C,EAC5D,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,8CAA8C,EAC7D,EAAE,EACF,4CAA4C,CAC7C,CAAC;QAEF,MAAM,uBAAuB,GAAW,mBAAmB,CACzD,QAAQ,CAAC,IAAI,CAAC,qCAAqC,EACnD,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,qCAAqC,EACpD,EAAE,EACF,mCAAmC,CACpC,CAAC;QAEF,MAAM,oBAAoB,GAAW,mBAAmB,CACtD,QAAQ,CAAC,IAAI,CAAC,kCAAkC,EAChD,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,kCAAkC,EACjD,EAAE,EACF,gCAAgC,CACjC,CAAC;QAEF,IAAI,oBAAoB,IAAI,uBAAuB,EAAE,CAAC;YACpD,MAAM,IAAI,gBAAgB,CACxB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,IACG,QAAQ,CAAC,QAAQ,CAAC,IAAyC;aACzD,kBAAkB,KAAK,SAAS,EACnC,CAAC;YACD,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvC,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAlLc;IADZ,WAAW,EAAE;;;;oDAiBb;AAGwB;IADxB,WAAW,EAAE;;;;6CAgJb;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAUvB;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"GlobalConfigService.js","sourceRoot":"","sources":["../../../../Server/Services/GlobalConfigService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,0CAA0C,CAAC;AAC7D,OAAO,gBAAgB,MAAM,oCAAoC,CAAC;AAClE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAE5C,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,yBAAyB,MAAM,oCAAoC,CAAC;AAC3E,OAAO,WAAW,MAAM,+BAA+B,CAAC;AAExD,MAAM,uCAAuC,GAC3C,wBAAwB,CAAC;AAC3B,MAAM,sCAAsC,GAC1C,oCAAoC,CAAC;AACvC,MAAM,0CAA0C,GAAW,SAAS,CAAC;AACrE,MAAM,qCAAqC,GAAW,oBAAoB,CAAC;AAC3E,MAAM,yCAAyC,GAAW,CAAC,CAAC;AAY5D,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IAkBjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;QAlBf;;;;WAIG;QACK,4BAAuB,GAC7B,IAAI,gBAAgB,CAAC,KAAM,CAAC,CAAC;QAC/B;;;;;WAKG;QACK,mCAA8B,GAEtB,SAAS,CAAC;IAI1B,CAAC;IAED;;;OAGG;IAEU,AAAN,KAAK,CAAC,qBAAqB;QAChC,MAAM,GAAG,GAAW,QAAQ,CAAC;QAC7B,MAAM,MAAM,GAAwB,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,MAAM,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;YACpC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,MAAM,KAAK,GAAY,OAAO,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB,CAAC,CAAC;QAC3D,IAAI,CAAC,uBAAuB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,KAAM,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC;IACf,CAAC;IAGY,AAAN,KAAK,CAAC,6BAA6B;QACxC,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,UAAU,GACd,MAAM,IAAI,CAAC,uCAAuC,EAAE,CAAC;YACvD,MAAM,QAAQ,GACZ,IAAI,CAAC,qCAAqC,CAAC,UAAU,CAAC,CAAC;YACzD,MAAM,MAAM,GAAkB,MAAM,WAAW,CAAC,SAAS,CACvD,uCAAuC,EACvC,QAAQ,CACT,CAAC;YAEF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,OAAO,MAAM,KAAK,qCAAqC;oBACrD,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC;YACb,CAAC;YAED,MAAM,YAAY,GAChB,IAAI,CAAC,8BAA8B,CAAC;YAEtC;;;;eAIG;YACH,MAAM,IAAI,GACR,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,UAAU,MAAK,UAAU;gBACrC,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC;oBACE,UAAU;oBACV,OAAO,EAAE,IAAI,CAAC,8BAA8B,CAC1C,UAAU,EACV,QAAQ,CACT;iBACF,CAAC;YAER,IAAI,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC1B,IAAI,CAAC,8BAA8B,GAAG,IAAI,CAAC;YAC7C,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,GAAyC,MAAM,IAAI,CAAC,OAAO,CAAC;gBAExE;;;;;mBAKG;gBACH,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC/B,OAAO,MAAM,CAAC,KAAK,CAAC;gBACtB,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT;;;mBAGG;gBACH,IAAI,IAAI,CAAC,8BAA8B,KAAK,IAAI,EAAE,CAAC;oBACjD,IAAI,CAAC,8BAA8B,GAAG,SAAS,CAAC;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,uCAAuC;QACnD,OAAO,CACL,CAAC,MAAM,WAAW,CAAC,SAAS,CAC1B,uCAAuC,EACvC,sCAAsC,CACvC,CAAC,IAAI,0CAA0C,CACjD,CAAC;IACJ,CAAC;IAEO,qCAAqC,CAAC,UAAkB;QAC9D,OAAO,2BAA2B,UAAU,EAAE,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,8BAA8B,CAC1C,UAAkB,EAClB,QAAgB;;QAEhB,MAAM,MAAM,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YAChD,KAAK,EAAE;gBACL,GAAG,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,QAAQ,EAAE;aAC3C;YACD,MAAM,EAAE;gBACN,0BAA0B,EAAE,IAAI;aACjC;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QACH,MAAM,KAAK,GACT,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,0BAA0B,0CAAE,IAAI,EAAE,KAAI,SAAS,CAAC;QAE1D;;;;;WAKG;QACH,IAAI,UAAU,KAAK,CAAC,MAAM,IAAI,CAAC,uCAAuC,EAAE,CAAC,EAAE,CAAC;YAC1E,OAAO;gBACL,KAAK,EAAE,SAAS;gBAChB,mBAAmB,EAAE,KAAK;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,CAAC,SAAS,CACzB,uCAAuC,EACvC,QAAQ,EACR,KAAK,IAAI,qCAAqC,EAC9C,EAAE,gBAAgB,EAAE,yCAAyC,EAAE,CAChE,CAAC;QAEF,OAAO;YACL,KAAK;YACL,mBAAmB,EACjB,UAAU,KAAK,CAAC,MAAM,IAAI,CAAC,uCAAuC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,0CAA0C;QACtD,MAAM,WAAW,CAAC,SAAS,CACzB,uCAAuC,EACvC,sCAAsC,EACtC,QAAQ,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAC/B,CAAC;IACJ,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,QAAQ,CAAC,IAAI,CAAC,0BAA0B,KAAK,SAAS,EAAE,CAAC;YAC3D,MAAM,MAAM,GAAY,QAAQ,CAAC,IAAI,CAAC,0BAA0B,CAAC;YAEjE,IACE,MAAM,KAAK,IAAI;gBACf,MAAM,KAAK,EAAE;gBACb,CAAC,yBAAyB,CAAC,qBAAqB,CAAC,MAAM,CAAC,EACxD,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,qHAAqH,CACtH,CAAC;YACJ,CAAC;YAED,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC,0BAA0B,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC3D,CAAC;YAED;;;;;;eAMG;YACH,MAAM,IAAI,CAAC,0CAA0C,EAAE,CAAC;QAC1D,CAAC;QAED,MAAM,mBAAmB,GAAuB;YAC9C,uCAAuC;YACvC,gDAAgD;YAChD,8BAA8B;YAC9B,uCAAuC;YACvC,oCAAoC;SACrC,CAAC;QAEF,MAAM,uBAAuB,GAAY,mBAAmB,CAAC,IAAI,CAC/D,CAAC,GAAgB,EAAW,EAAE;YAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAC1C,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,uBAAuB,EAAE,CAAC;YAC7B,OAAO;gBACL,QAAQ;gBACR,YAAY,EAAE,IAAI;aACnB,CAAC;QACJ,CAAC;QAED;;;;WAIG;QACH,MAAM,aAAa,GAAiB,MAAM,IAAI,CAAC,SAAS,CAAC;YACvD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE;gBACN,8CAA8C,EAAE,IAAI;gBACpD,qCAAqC,EAAE,IAAI;gBAC3C,kCAAkC,EAAE,IAAI;aACzC;YACD,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,gBAAgB,GAAkD,CACtE,KAAc,EACd,SAAiB,EACT,EAAE;YACV,IAAI,eAAe,GAAY,KAAK,CAAC;YAErC,IAAI,OAAO,eAAe,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,YAAY,GAAW,eAAe,CAAC,IAAI,EAAE,CAAC;gBACpD,eAAe;oBACb,YAAY,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC5D,CAAC;YAED,IACE,OAAO,eAAe,KAAK,QAAQ;gBACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACjC,CAAC,MAAM,CAAC,SAAS,CAAC,eAAe,CAAC;gBAClC,eAAe,GAAG,CAAC;gBACnB,eAAe,GAAG,GAAG,EACrB,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,GAAG,SAAS,wCAAwC,CACrD,CAAC;YACJ,CAAC;YAED,OAAO,eAAe,CAAC;QACzB,CAAC,CAAC;QAEF,IACE,QAAQ,CAAC,IAAI,CAAC,8CAA8C,KAAK,SAAS,EAC1E,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,8CAA8C;gBAC1D,gBAAgB,CACd,QAAQ,CAAC,IAAI;qBACV,8CAAyD,EAC5D,4CAA4C,CAC7C,CAAC;QACN,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,qCAAqC,KAAK,SAAS,EAAE,CAAC;YACtE,QAAQ,CAAC,IAAI,CAAC,qCAAqC,GAAG,gBAAgB,CACpE,QAAQ,CAAC,IAAI,CAAC,qCAAgD,EAC9D,mCAAmC,CACpC,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,kCAAkC,KAAK,SAAS,EAAE,CAAC;YACnE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,GAAG,gBAAgB,CACjE,QAAQ,CAAC,IAAI,CAAC,kCAA6C,EAC3D,gCAAgC,CACjC,CAAC;QACJ,CAAC;QAED,MAAM,mBAAmB,GAKX,CACZ,YAAqB,EACrB,YAAgC,EAChC,YAAoB,EACpB,SAAiB,EACT,EAAE;YACV,MAAM,KAAK,GACT,YAAY,KAAK,SAAS;gBACxB,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,YAAY,CAAC;YAEnC,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5C,CAAC,CAAC;QAEF,mBAAmB,CACjB,QAAQ,CAAC,IAAI,CAAC,8CAA8C,EAC5D,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,8CAA8C,EAC7D,EAAE,EACF,4CAA4C,CAC7C,CAAC;QAEF,MAAM,uBAAuB,GAAW,mBAAmB,CACzD,QAAQ,CAAC,IAAI,CAAC,qCAAqC,EACnD,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,qCAAqC,EACpD,EAAE,EACF,mCAAmC,CACpC,CAAC;QAEF,MAAM,oBAAoB,GAAW,mBAAmB,CACtD,QAAQ,CAAC,IAAI,CAAC,kCAAkC,EAChD,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,kCAAkC,EACjD,EAAE,EACF,gCAAgC,CACjC,CAAC;QAEF,IAAI,oBAAoB,IAAI,uBAAuB,EAAE,CAAC;YACpD,MAAM,IAAI,gBAAgB,CACxB,0EAA0E,CAC3E,CAAC;QACJ,CAAC;QAED,OAAO;YACL,QAAQ;YACR,YAAY,EAAE,IAAI;SACnB,CAAC;IACJ,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,eAAgC;QAEhC,IACG,QAAQ,CAAC,QAAQ,CAAC,IAAyC;aACzD,kBAAkB,KAAK,SAAS,EACnC,CAAC;YACD,IAAI,CAAC,uBAAuB,CAAC,KAAK,EAAE,CAAC;QACvC,CAAC;QAED,IACG,QAAQ,CAAC,QAAQ,CAAC,IAAiD;aACjE,0BAA0B,KAAK,SAAS,EAC3C,CAAC;YACD,MAAM,IAAI,CAAC,0CAA0C,EAAE,CAAC;QAC1D,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF;AAvVc;IADZ,WAAW,EAAE;;;;oDAiBb;AAGY;IADZ,WAAW,EAAE;;;;4DA+Db;AAqEwB;IADxB,WAAW,EAAE;;;;6CA2Kb;AAGwB;IADxB,WAAW,EAAE;;6CAGK,KAAK;;8CAiBvB;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/IncidentCustomFieldService.js

@@ -1,9 +1,102 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/IncidentCustomField";
+import { backfillMappedCustomFieldValues } from "../Utils/CustomField/CustomFieldDefinitionMappingHooks";
+import { validateCustomFieldMappingOnCreate, validateCustomFieldMappingOnUpdate, } from "../Utils/CustomField/CustomFieldMappingValidator";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+/*
+ * An incident custom field can take its value from the same field on the
+ * incident's monitors instead of being typed in again
+ * (OneUptime/oneuptime#3549). These hooks are the two halves of that
+ * configuration being saved: refusing a mapping that could never resolve, and
+ * filling in the incidents that already exist once one is saved.
+ */
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    async onBeforeCreate(createBy) {
+        await validateCustomFieldMappingOnCreate({
+            definitionModelType: Model,
+            createBy: createBy,
+        });
+        return { createBy, carryForward: null };
+    }
+    async onBeforeUpdate(updateBy) {
+        await validateCustomFieldMappingOnUpdate({
+            definitionModelType: Model,
+            definitionService: this,
+            updateBy: updateBy,
+        });
+        return { updateBy, carryForward: null };
+    }
+    async onCreateSuccess(_onCreate, createdItem) {
+        backfillMappedCustomFieldValues({
+            definitionModelType: Model,
+            projectId: createdItem.projectId,
+            definitionName: "incident custom field",
+        });
+        return createdItem;
+    }
+    async onUpdateSuccess(onUpdate, updatedItemIds) {
+        if (updatedItemIds.length > 0) {
+            backfillMappedCustomFieldValues({
+                definitionModelType: Model,
+                projectId: await this.getProjectIdForBackfill(onUpdate, updatedItemIds),
+                definitionName: "incident custom field",
+            });
+        }
+        return onUpdate;
+    }
+    /*
+     * `props.tenantId` is set on every dashboard write but not on internal
+     * root-scoped ones, so fall back to the row itself rather than skipping the
+     * backfill for a mapping that was changed by a script.
+     */
+    async getProjectIdForBackfill(onUpdate, updatedItemIds) {
+        const tenantId = onUpdate.updateBy.props.tenantId;
+        if (tenantId) {
+            return tenantId;
+        }
+        const item = await this.findOneById({
+            id: updatedItemIds[0],
+            select: { projectId: true },
+            props: { isRoot: true },
+        });
+        return item === null || item === void 0 ? void 0 : item.projectId;
+    }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onCreateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
 export default new Service();
 //# sourceMappingURL=IncidentCustomFieldService.js.map

package/build/dist/Server/Services/IncidentCustomFieldService.js.map

@@ -1 +1 @@
-{"version":3,"file":"IncidentCustomFieldService.js","sourceRoot":"","sources":["../../../../Server/Services/IncidentCustomFieldService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,iDAAiD,CAAC;AAEpE,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;CACF;AACD,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"IncidentCustomFieldService.js","sourceRoot":"","sources":["../../../../Server/Services/IncidentCustomFieldService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,iDAAiD,CAAC;AAKpE,OAAO,EAAE,+BAA+B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EACL,kCAAkC,EAClC,kCAAkC,GACnC,MAAM,kDAAkD,CAAC;AAC1D,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,kCAAkC,CAAC;YACvC,mBAAmB,EAAE,KAAK;YAC1B,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,kCAAkC,CAAC;YACvC,mBAAmB,EAAE,KAAK;YAC1B,iBAAiB,EAAE,IAAI;YACvB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,SAA0B,EAC1B,WAAkB;QAElB,+BAA+B,CAAC;YAC9B,mBAAmB,EAAE,KAAK;YAC1B,SAAS,EAAE,WAAW,CAAC,SAAS;YAChC,cAAc,EAAE,uBAAuB;SACxC,CAAC,CAAC;QAEH,OAAO,WAAW,CAAC;IACrB,CAAC;IAGwB,AAAN,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,cAA+B;QAE/B,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,+BAA+B,CAAC;gBAC9B,mBAAmB,EAAE,KAAK;gBAC1B,SAAS,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,EAAE,cAAc,CAAC;gBACvE,cAAc,EAAE,uBAAuB;aACxC,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,uBAAuB,CACnC,QAAyB,EACzB,cAA+B;QAE/B,MAAM,QAAQ,GAAyB,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,QAElD,CAAC;QAEd,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,WAAW,CAAC;YAChD,EAAE,EAAE,cAAc,CAAC,CAAC,CAAE;YACtB,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;YAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;SACxB,CAAC,CAAC;QAEH,OAAO,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,SAAS,CAAC;IACzB,CAAC;CACF;AA/E0B;IADxB,WAAW,EAAE;;;;6CAUb;AAGwB;IADxB,WAAW,EAAE;;;;6CAWb;AAGwB;IADxB,WAAW,EAAE;;6CAGC,KAAK;;8CASnB;AAGwB;IADxB,WAAW,EAAE;;6CAGI,KAAK;;8CAWtB;AA4BH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/IncidentService.js

@@ -12,6 +12,8 @@ import MeasurementMetricWriter from "../Utils/Measurement/MeasurementMetricWrite
 import IncidentMeasurementService from "./IncidentMeasurementService";
 import QueryHelper from "../Types/Database/QueryHelper";
 import DatabaseService from "./DatabaseService";
+import IncidentCustomField from "../../Models/DatabaseModels/IncidentCustomField";
+import CustomFieldMappingService from "./CustomFieldMappingService";
 import AIRunService from "./AIRunService";
 import AIRunType from "../../Types/AI/AIRunType";
 import AIRunStatus from "../../Types/AI/AIRunStatus";
@@ -396,6 +398,17 @@ export class Service extends DatabaseService {
                     StatusPageSubscriberNotificationStatus.Pending;
             }
         }
+        /*
+         * Re-apply mapped custom field values. Covers the Custom Fields modal
+         * saving the whole bag back over a mapped value, and the incident's
+         * monitors being added or removed — both change what a mapped field should
+         * hold, and folding the answer into this payload keeps it one write with a
+         * truthful audit entry.
+         */
+        await CustomFieldMappingService.applyMappingsToUpdate({
+            definitionModelType: IncidentCustomField,
+            updateBy: updateBy,
+        });
         return {
             updateBy: updateBy,
             carryForward: carryForward,
@@ -747,6 +760,20 @@ export class Service extends DatabaseService {
             createBy.data.subscriberNotificationStatusOnIncidentCreated =
                 StatusPageSubscriberNotificationStatus.Pending;
         }
+        /*
+         * Last, because the incident template copy above can still be adding
+         * monitors and mapped custom fields are resolved from the final set.
+         *
+         * In onBeforeCreate rather than onCreateSuccess because `customFields` is
+         * a column on this row and the onCreateSuccess chain is un-awaited — a
+         * value written there would be missing from the incident the caller gets
+         * back. Written not to throw: a custom field failing to inherit must not
+         * stop an incident from being declared.
+         */
+        await CustomFieldMappingService.applyMappingsToCreate({
+            definitionModelType: IncidentCustomField,
+            createBy: createBy,
+        });
         return {
             createBy,
             carryForward: null,
@@ -1463,6 +1490,11 @@ ${incident.remediationNotes || "No remediation notes provided."}
     }
     async onUpdateSuccess(onUpdate, updatedItemIds) {
         var _a, _b, _c, _d, _e;
+        CustomFieldMappingService.restampAfterMultiRowUpdate({
+            definitionModelType: IncidentCustomField,
+            updateBy: onUpdate.updateBy,
+            updatedItemIds: updatedItemIds,
+        });
         /*
          * Correcting a timestamp is the whole point of making these fields
          * editable, so the numbers derived from them have to move. Without this