@oneuptime/common 12.0.4 → 12.0.6

package/Server/Types/Database/Permissions/BasePermission.ts

@@ -32,6 +32,13 @@ export default class BasePermission {
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
   ): Promise<CheckPermissionBaseInterface<TBaseModel>> {
+    /*
+     * Permission checks add predicates and QueryUtil serializes values in
+     * place. Callers such as BaseAPI intentionally reuse the original query
+     * for list and count, so work on a fresh top-level object.
+     */
+    query = { ...query };
+
     const model: BaseModel = new modelType();
 
     if (props.isRoot || props.isMasterAdmin) {

package/Server/Types/Database/Permissions/DeletePermission.ts

@@ -34,6 +34,8 @@ export default class DeletePermission {
     query: Query<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    query = { ...query };
+
     if (props.isRoot || props.isMasterAdmin) {
       query = await PermissionUtil.addTenantScopeToQueryAsRoot(
         modelType,

package/Server/Types/Database/Permissions/ReadPermission.ts

@@ -29,6 +29,9 @@ export default class ReadPermission {
     select: Select<TBaseModel> | null,
     props: DatabaseCommonInteractionProps,
   ): Promise<CheckReadPermissionType<TBaseModel>> {
+    // Block and base permission checks both add predicates to the query.
+    query = { ...query };
+
     // check block permission first.
     await this.checkReadBlockPermission(modelType, query, props);
 

package/Server/Types/Database/Permissions/TenantPermission.ts

@@ -45,6 +45,40 @@ export default class TenantPermission {
       );
     }
 
+    const isAccessGrantedOnlyByCurrentUser: boolean =
+      TenantPermission.isAccessGrantedOnlyByCurrentUser(modelType, props, type);
+    const userColumn: string | null = model.getUserColumn();
+
+    /*
+     * CurrentUser is an auto-granted permission, not a tenant-wide role. A
+     * query operation that relies on it must declare an ownership column so
+     * the permission can be converted into a row predicate.
+     */
+    if (
+      isAccessGrantedOnlyByCurrentUser &&
+      type !== DatabaseRequestType.Create &&
+      !userColumn
+    ) {
+      throw new NotAuthorizedException(
+        `Current user scope is not configured for ${model.singularName}.`,
+      );
+    }
+
+    const shouldScopeQueryByCurrentUser: boolean =
+      isAccessGrantedOnlyByCurrentUser && Boolean(userColumn);
+
+    /*
+     * API keys and other non-user callers can carry the auto-granted
+     * CurrentUser permission without having a userId. Such a grant can never
+     * be converted into an ownership filter, so reject it instead of running
+     * the caller's query without a user scope.
+     */
+    if (shouldScopeQueryByCurrentUser && !props.userId) {
+      throw new NotAuthorizedException(
+        `A user session is required to ${type} ${model.singularName}.`,
+      );
+    }
+
     // If this model has a tenantColumn, and request has tenantId, and is multiTenantQuery null then add tenantId to query.
     if (tenantColumn && props.tenantId && !props.isMultiTenantRequest) {
       (query as any)[tenantColumn] = props.tenantId;
@@ -56,13 +90,12 @@ export default class TenantPermission {
        * row in the project (CVE-class issue when CurrentUser appears in a
        * model's delete/update list alongside admin permissions).
        */
-      if (
-        TenantPermission.shouldScopeQueryByCurrentUser(modelType, props, type)
-      ) {
-        const userColumn: string | null = model.getUserColumn();
-        if (userColumn) {
-          (query as any)[userColumn] = props.userId;
-        }
+      if (shouldScopeQueryByCurrentUser) {
+        TenantPermission.addCurrentUserScopeToQuery(
+          model,
+          query,
+          props.userId as ObjectID,
+        );
       }
     }
     // if model allows user query without tenant, and user column is present, and userId is present, then add userId to query.
@@ -71,7 +104,7 @@ export default class TenantPermission {
       model.getUserColumn() &&
       props.userId
     ) {
-      (query as any)[model.getUserColumn() as string] = props.userId;
+      TenantPermission.addCurrentUserScopeToQuery(model, query, props.userId);
     } else if (
       tenantColumn &&
       props.userGlobalAccessPermission &&
@@ -114,6 +147,7 @@ export default class TenantPermission {
       }
 
       let lastException: Error | null = null;
+      const queryForEachProject: Query<TBaseModel> = { ...query };
 
       for (const projectId of projectIDs) {
         if (!props.userId) {
@@ -124,7 +158,7 @@ export default class TenantPermission {
           const checkBasePermissions: CheckPermissionBaseInterface<TBaseModel> =
             await BasePermission.checkPermissions(
               modelType,
-              query,
+              { ...queryForEachProject },
               select,
               {
                 ...props,
@@ -154,25 +188,76 @@ export default class TenantPermission {
       return queries as any;
     }
 
+    /*
+     * A model that relies on CurrentUser must resolve that permission to the
+     * requester's exact ownership column. This catches missing decorators and
+     * prevents a future model misconfiguration from silently becoming an
+     * instance-wide query.
+     */
+    if (shouldScopeQueryByCurrentUser) {
+      const scopedUserId: unknown = (query as any)[userColumn as string];
+
+      if (
+        !TenantPermission.isExactUserScope(scopedUserId) ||
+        scopedUserId.toString() !== (props.userId as ObjectID).toString()
+      ) {
+        throw new NotAuthorizedException(
+          `Current user scope could not be applied to ${model.singularName}.`,
+        );
+      }
+    }
+
     return query;
   }
 
+  /**
+   * Add the authenticated user's ownership predicate without redirecting an
+   * operation that explicitly targeted another user. Rejecting a conflict is
+   * important because service hooks run before the final permission check;
+   * silently replacing the target would let a hook inspect one row and the
+   * database operation mutate a different one.
+   */
+  private static addCurrentUserScopeToQuery<TBaseModel extends BaseModel>(
+    model: BaseModel,
+    query: Query<TBaseModel>,
+    userId: ObjectID,
+  ): void {
+    const userColumn: string = model.getUserColumn() as string;
+    const existingUserScope: unknown = (query as any)[userColumn];
+
+    if (
+      existingUserScope !== undefined &&
+      (!TenantPermission.isExactUserScope(existingUserScope) ||
+        existingUserScope.toString() !== userId.toString())
+    ) {
+      throw new NotAuthorizedException(
+        `You do not have permission to access another user's ${model.singularName}.`,
+      );
+    }
+
+    (query as any)[userColumn] = userId;
+  }
+
+  /**
+   * Ownership filters must be exact scalar ids. Query operators such as
+   * NotEqual stringify to their wrapped id as well, so comparing only their
+   * string value would allow a broad hook query to masquerade as an exact
+   * current-user predicate.
+   */
+  private static isExactUserScope(value: unknown): value is string | ObjectID {
+    return typeof value === "string" || value instanceof ObjectID;
+  }
+
   /**
    * True if the only permission letting this user through the table-level
    * check for this op is Permission.CurrentUser. In that case the query must
    * be restricted to rows the user owns (via the model's user column).
    */
-  private static shouldScopeQueryByCurrentUser<TBaseModel extends BaseModel>(
+  private static isAccessGrantedOnlyByCurrentUser<TBaseModel extends BaseModel>(
     modelType: { new (): TBaseModel },
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
   ): boolean {
-    const model: BaseModel = new modelType();
-
-    if (!model.getUserColumn() || !props.userId) {
-      return false;
-    }
-
     const modelPermissions: Array<Permission> =
       TablePermission.getTablePermission(modelType, type);
 

package/Server/Utils/AI/Chat/ObservabilityAssistant.ts

@@ -59,6 +59,9 @@ export interface ObservabilityAssistantStep {
 export interface ObservabilityAssistantRequest {
   projectId: ObjectID;
   userId?: ObjectID | undefined;
+  incidentId?: ObjectID | undefined;
+  alertId?: ObjectID | undefined;
+  aiRunId?: ObjectID | undefined;
   // The requesting user's real permission props — tools run under these.
   props: DatabaseCommonInteractionProps;
   question: string;
@@ -230,6 +233,9 @@ export default class ObservabilityAssistant {
       const response: AILogResponse = await AIService.executeWithLogging({
         projectId: request.projectId,
         userId: request.userId,
+        incidentId: request.incidentId,
+        alertId: request.alertId,
+        aiRunId: request.aiRunId,
         llmProviderId: request.llmProviderId,
         feature: request.feature,
         messages: messages,

package/Server/Utils/AI/CodeFix/CodeFixAgentCompletion.ts

@@ -130,6 +130,8 @@ export default class CodeFixAgentCompletion {
         runType: true,
         status: true,
         aiAgentId: true,
+        triggeredByIncidentId: true,
+        triggeredByAlertId: true,
       },
       props: {
         isRoot: true,
@@ -198,6 +200,8 @@ export default class CodeFixAgentCompletion {
       projectId: run.projectId,
       feature: AI_CODE_FIX_FEATURE,
       aiRunId: request.aiRunId,
+      incidentId: run.triggeredByIncidentId,
+      alertId: run.triggeredByAlertId,
       llmProviderId: llmProvider.id,
       messages: request.messages,
       tools: request.tools,

package/Server/Utils/AI/CodeFix/CodeFixReadiness.ts

@@ -102,9 +102,12 @@ export default class CodeFixReadiness {
      * self-hosted too, where a project-owned provider makes the balance gate
      * moot and this becomes the ONLY thing that can kill a run.
      *
-     * A limit of 0 is a documented kill-switch ("pause AI entirely"), i.e.
-     * durable config — so without this a paused project would read "ready"
-     * forever while every run died at its first completion call.
+     * These readiness surfaces create subjectless exception/general tasks, so
+     * they use the "Other AI Workload" token lane. Incident/alert fix paths
+     * enforce their own lane when they are triggered and on every completion.
+     * A limit of 0 is a documented kill-switch for this lane, so without this
+     * a paused project would read "ready" forever while every subjectless run
+     * died at its first completion call.
      */
     const budget: AutonomousBudgetStatus =
       await AIService.getAutonomousDailyBudgetStatus(params.projectId);
@@ -116,8 +119,8 @@ export default class CodeFixReadiness {
         title: "LLM provider",
         detail:
           budget.limitInTokens !== null && budget.limitInTokens <= 0
-            ? "AI is paused for this project: the daily autonomous AI token limit is set to 0. Raise or unset it in the AI settings pages to let fix tasks run."
-            : `The daily autonomous AI token budget is exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Fix tasks resume tomorrow (UTC) — raise or unset the limit in the AI settings pages.`,
+            ? "Other autonomous AI work is paused for this project: the daily background AI token limit is set to 0. Raise or unset it under Project Settings > AI > AI Guardrails to let subjectless fix tasks run."
+            : `The daily background AI token budget is exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Subjectless fix tasks resume tomorrow (UTC) — raise or unset the limit under Project Settings > AI > AI Guardrails.`,
       };
     }
 

package/Server/Utils/AI/CodeFix/FixRunBudget.ts

@@ -11,13 +11,10 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
 /*
  * Per-project daily fix-run budget (Preventive-lane X guardrail, G11).
  *
- * Every CodeFix AIRun — regardless of recipe or trigger — counts against
- * one per-project daily cap: `Project.aiDailyFixTaskLimit` fix runs per UTC
- * day (null/unset = the default below, 0 = fix tasks paused — the same
- * semantics as `aiDailyAutonomousTokenLimit`). The cap bounds the blast
- * radius of ANY runaway trigger: a click-happy user, a buggy automation, or
- * a future auto-created-fix fan-out can never open more than the budget's
- * worth of agent runs (and therefore PRs) in a day.
+ * Every CodeFix AIRun counts against the daily cap for its lane: incident,
+ * alert, or subjectless. Incident and alert runs use their independent
+ * settings; recipes with neither subject retain `Project.aiDailyFixTaskLimit`
+ * as a fallback. Null/unset means the default below and 0 pauses that lane.
  *
  * Enforced centrally at BOTH creation paths:
  *   - TelemetryExceptionService.createCodeFixRunForException (the
@@ -43,6 +40,13 @@ export interface FixRunBudgetDecision {
   runsToday: number;
 }
 
+export interface FixRunBudgetSubject {
+  incidentId?: ObjectID | undefined;
+  alertId?: ObjectID | undefined;
+}
+
+type FixRunBudgetLane = "incident" | "alert" | "other";
+
 export default class FixRunBudget {
   /*
    * The pure budget decision, separated from IO so it can be tested
@@ -85,14 +89,27 @@ export default class FixRunBudget {
   @CaptureSpan()
   public static async getBudgetStatus(
     projectId: ObjectID,
+    subject?: FixRunBudgetSubject | undefined,
   ): Promise<FixRunBudgetDecision> {
+    const lane: FixRunBudgetLane = this.getLane(subject);
+
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
-      select: { aiDailyFixTaskLimit: true },
+      select:
+        lane === "incident"
+          ? { incidentAiDailyFixTaskLimit: true }
+          : lane === "alert"
+            ? { alertAiDailyFixTaskLimit: true }
+            : { aiDailyFixTaskLimit: true },
       props: { isRoot: true },
     });
 
-    const configuredLimit: number | null = project?.aiDailyFixTaskLimit ?? null;
+    const configuredLimit: number | null =
+      lane === "incident"
+        ? project?.incidentAiDailyFixTaskLimit ?? null
+        : lane === "alert"
+          ? project?.alertAiDailyFixTaskLimit ?? null
+          : project?.aiDailyFixTaskLimit ?? null;
 
     // Paused short-circuits the count query (mirrors the token budget).
     const pausedCheck: FixRunBudgetDecision = this.evaluate({
@@ -109,6 +126,20 @@ export default class FixRunBudget {
         query: {
           projectId,
           runType: AIRunType.CodeFix,
+          ...(lane === "incident"
+            ? {
+                triggeredByIncidentId: QueryHelper.notNull(),
+                triggeredByAlertId: QueryHelper.isNull(),
+              }
+            : lane === "alert"
+              ? {
+                  triggeredByIncidentId: QueryHelper.isNull(),
+                  triggeredByAlertId: QueryHelper.notNull(),
+                }
+              : {
+                  triggeredByIncidentId: QueryHelper.isNull(),
+                  triggeredByAlertId: QueryHelper.isNull(),
+                }),
           createdAt: QueryHelper.greaterThanEqualTo(
             OneUptimeDate.getStartOfDay(OneUptimeDate.getCurrentDate(), "UTC"),
           ),
@@ -120,13 +151,51 @@ export default class FixRunBudget {
     return this.evaluate({ configuredLimit, runsToday });
   }
 
+  private static getLane(
+    subject?: FixRunBudgetSubject | undefined,
+  ): FixRunBudgetLane {
+    if (subject?.incidentId && subject.alertId) {
+      throw new BadDataException(
+        "A fix task cannot belong to both an incident and an alert.",
+      );
+    }
+
+    if (subject?.incidentId) {
+      return "incident";
+    }
+
+    if (subject?.alertId) {
+      return "alert";
+    }
+
+    return "other";
+  }
+
   // Human-readable rejection naming the cap and the setting that controls it.
-  public static describeRejection(decision: FixRunBudgetDecision): string {
+  public static describeRejection(
+    decision: FixRunBudgetDecision,
+    subject?: FixRunBudgetSubject | undefined,
+  ): string {
+    const lane: FixRunBudgetLane = this.getLane(subject);
+    const settingTitle: string =
+      lane === "incident"
+        ? "Daily Incident AI Fix Task Limit"
+        : lane === "alert"
+          ? "Daily Alert AI Fix Task Limit"
+          : "Daily Other AI Fix Task Limit";
+    const settingsLocation: string =
+      lane === "incident"
+        ? "Incidents > AI > Investigation"
+        : lane === "alert"
+          ? "Alerts > AI > Investigation"
+          : "Project Settings > AI > AI Guardrails";
+    const laneLabel: string = lane === "other" ? "other AI" : `${lane} AI`;
+
     if (decision.paused) {
-      return `AI fix tasks are paused for this project — the "Daily AI Fix Task Limit" is set to 0. Raise or unset the limit in the AI settings pages (Settings > Incidents/Alerts > AI) to resume.`;
+      return `${laneLabel} fix tasks are paused for this project — the "${settingTitle}" is set to 0. Raise or unset it under ${settingsLocation} to resume.`;
     }
 
-    return `The project's daily AI fix task limit has been reached (${decision.runsToday} of ${decision.limit} fix tasks created today, UTC). New fix tasks can be created tomorrow — or raise the "Daily AI Fix Task Limit" in the AI settings pages (unset means the default of ${DEFAULT_DAILY_FIX_RUN_LIMIT}/day).`;
+    return `The project's ${laneLabel} fix task limit has been reached (${decision.runsToday} of ${decision.limit} fix tasks created today, UTC). New fix tasks can be created tomorrow — or raise the "${settingTitle}" under ${settingsLocation} (unset means the default of ${DEFAULT_DAILY_FIX_RUN_LIMIT}/day).`;
   }
 
   /*
@@ -135,14 +204,19 @@ export default class FixRunBudget {
    * a CodeFix AIRun row is written.
    */
   @CaptureSpan()
-  public static async assertWithinBudget(projectId: ObjectID): Promise<void> {
-    const decision: FixRunBudgetDecision =
-      await this.getBudgetStatus(projectId);
+  public static async assertWithinBudget(
+    projectId: ObjectID,
+    subject?: FixRunBudgetSubject | undefined,
+  ): Promise<void> {
+    const decision: FixRunBudgetDecision = await this.getBudgetStatus(
+      projectId,
+      subject,
+    );
 
     if (decision.allowed) {
       return;
     }
 
-    throw new BadDataException(this.describeRejection(decision));
+    throw new BadDataException(this.describeRejection(decision, subject));
   }
 }

package/Server/Utils/AI/Remediation/RemediationExecutionRunner.ts

@@ -321,6 +321,8 @@ export default class RemediationExecutionRunner {
       attemptCount,
       request: {
         feature: AI_REMEDIATION_EXECUTION_FEATURE,
+        incidentId: suggestion!.incidentId,
+        alertId: suggestion!.alertId,
         contextSummary,
         personaOverride:
           resolvedMode === "FullAuto" ? FULLAUTO_PERSONA : SUGGEST_PERSONA,

package/Server/Utils/AI/Remediation/RemediationPlanRunner.ts

@@ -264,6 +264,8 @@ export default class RemediationPlanRunner {
       attemptCount,
       request: {
         feature: AI_REMEDIATION_PLANNING_FEATURE,
+        incidentId: suggestion!.incidentId,
+        alertId: suggestion!.alertId,
         contextSummary,
         postAnalysis: async (postData: {
           analysisMarkdown: string;