@oneuptime/common 12.0.4 → 12.0.6

package/Models/DatabaseModels/UserOnCallLogTimeline.ts

@@ -29,6 +29,7 @@ import CanAccessIfCanReadOn from "../../Types/Database/CanAccessIfCanReadOn";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import CurrentUserCanAccessRecordBy from "../../Types/Database/CurrentUserCanAccessRecordBy";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
@@ -49,6 +50,7 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 })
 @EnableDocumentation()
 @CanAccessIfCanReadOn("onCallDutyPolicy")
+@CurrentUserCanAccessRecordBy("userId")
 @TenantColumn("projectId")
 @TableAccessControl({
   create: [],

package/Models/DatabaseModels/UserSession.ts

@@ -4,6 +4,7 @@ import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import AllowUserQueryWithoutTenant from "../../Types/Database/AllowUserQueryWithoutTenant";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
@@ -41,6 +42,7 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
   tableDescription:
     "Active user sessions with refresh tokens and device metadata for enhanced authentication security.",
 })
+@AllowUserQueryWithoutTenant(true)
 @CurrentUserCanAccessRecordBy("userId")
 class UserSession extends BaseModel {
   @ColumnAccessControl({

package/Models/DatabaseModels/UserTotpAuth.ts

@@ -4,6 +4,7 @@ import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import AllowUserQueryWithoutTenant from "../../Types/Database/AllowUserQueryWithoutTenant";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
@@ -38,6 +39,7 @@ import { Column, Entity, JoinColumn, ManyToOne } from "typeorm";
   icon: IconProp.ShieldCheck,
   tableDescription: "TOTP Authentication for users",
 })
+@AllowUserQueryWithoutTenant(true)
 @CurrentUserCanAccessRecordBy("userId")
 class UserTotpAuth extends BaseModel {
   @ColumnAccessControl({
@@ -98,7 +100,7 @@ class UserTotpAuth extends BaseModel {
   @ColumnAccessControl({
     create: [Permission.CurrentUser],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     type: TableColumnType.Boolean,
@@ -163,9 +165,9 @@ class UserTotpAuth extends BaseModel {
   public deletedByUserId?: ObjectID = undefined;
 
   @ColumnAccessControl({
-    create: [Permission.CurrentUser],
+    create: [],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     manyToOneRelationColumn: "userId",
@@ -191,7 +193,7 @@ class UserTotpAuth extends BaseModel {
   @ColumnAccessControl({
     create: [Permission.CurrentUser],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     type: TableColumnType.ObjectID,

package/Models/DatabaseModels/UserWebAuthn.ts

@@ -4,6 +4,7 @@ import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import AllowUserQueryWithoutTenant from "../../Types/Database/AllowUserQueryWithoutTenant";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
@@ -38,6 +39,7 @@ import { Column, Entity, JoinColumn, ManyToOne } from "typeorm";
   icon: IconProp.ShieldCheck,
   tableDescription: "WebAuthn credentials for users (security keys)",
 })
+@AllowUserQueryWithoutTenant(true)
 @CurrentUserCanAccessRecordBy("userId")
 class UserWebAuthn extends BaseModel {
   @ColumnAccessControl({
@@ -198,9 +200,9 @@ class UserWebAuthn extends BaseModel {
   public deletedByUserId?: ObjectID = undefined;
 
   @ColumnAccessControl({
-    create: [Permission.CurrentUser],
+    create: [],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     manyToOneRelationColumn: "userId",
@@ -226,7 +228,7 @@ class UserWebAuthn extends BaseModel {
   @ColumnAccessControl({
     create: [Permission.CurrentUser],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     type: TableColumnType.ObjectID,

package/Server/API/AIAgentDataAPI.ts

@@ -7,8 +7,7 @@ import AIRunService from "../Services/AIRunService";
 import AIRunEventService from "../Services/AIRunEventService";
 import IncidentService from "../Services/IncidentService";
 import AlertService from "../Services/AlertService";
-import IncidentFeedService from "../Services/IncidentFeedService";
-import AlertFeedService from "../Services/AlertFeedService";
+import PostedRootCause from "../Utils/AI/SRE/PostedRootCause";
 import Express, {
   ExpressRequest,
   ExpressResponse,
@@ -27,12 +26,6 @@ import AIAgentTaskPullRequest from "../../Models/DatabaseModels/AIAgentTaskPullR
 import AIRun from "../../Models/DatabaseModels/AIRun";
 import Incident from "../../Models/DatabaseModels/Incident";
 import Alert from "../../Models/DatabaseModels/Alert";
-import IncidentFeed, {
-  IncidentFeedEventType,
-} from "../../Models/DatabaseModels/IncidentFeed";
-import AlertFeed, {
-  AlertFeedEventType,
-} from "../../Models/DatabaseModels/AlertFeed";
 import AIRunEventType from "../../Types/AI/AIRunEventType";
 import AIRunType from "../../Types/AI/AIRunType";
 import FixVerificationStatus from "../../Types/AI/FixVerificationStatus";
@@ -41,7 +34,9 @@ import CodeFixTaskType, {
   CodeFixTaskTypeHelper,
 } from "../../Types/AI/CodeFixTaskType";
 import CodeFixTaskContext, {
+  getInvestigationCodeFixTaskSnapshot,
   ImplicatedSpan,
+  InvestigationCodeFixTaskSnapshot,
   PerformanceCodeLocation,
   PerformanceFinding,
 } from "../../Types/AI/CodeFixTaskContext";
@@ -62,7 +57,6 @@ import {
   LLMToolCall,
   LLMToolDefinition,
 } from "../Utils/LLM/LLMService";
-import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
@@ -496,14 +490,12 @@ export default class AIAgentDataAPI {
      * The route name predates the newer recipes and is kept for agent
      * compatibility. Two context kinds are served:
      *
-     *  - Incident/alert-subject recipes (ImproveInstrumentation,
-     *    FixFromIncident): the investigation's posted analysis + subject
-     *    metadata + the repository resolved without a stack trace. The
-     *    analysis text comes from the subject's latest RootCause feed item:
-     *    the AI's postAnalysis is the only writer of RootCause feed
-     *    events, it writes them for BOTH subjects and BOTH confidence
-     *    outcomes (quiet mode only mutes the workspace ping), so the feed
-     *    item IS the investigation run's persisted output.
+     *  - Incident/alert-subject recipes: subject metadata + the repository
+     *    resolved without a stack trace. ImproveInstrumentation reads the
+     *    subject's latest RootCause feed item. FixFromIncident instead reads
+     *    the immutable investigation snapshot captured in AIRun.taskContext;
+     *    a later re-investigation must never replace the Recommended analysis
+     *    that authorized a code-fix task.
      *
      *  - Trace-evidence recipes (FixPerformance): the deterministic
      *    span-tree findings stored on AIRun.taskContext at trigger time
@@ -581,6 +573,10 @@ export default class AIAgentDataAPI {
             CodeFixTaskTypeHelper.fromDatabaseValue(run.codeFixTaskType);
           const contextKind: CodeFixContextKind =
             CodeFixTaskTypeHelper.getContextKind(taskType);
+          const investigationSnapshot: InvestigationCodeFixTaskSnapshot | null =
+            taskType === CodeFixTaskType.FixFromIncident
+              ? getInvestigationCodeFixTaskSnapshot(run.taskContext)
+              : null;
 
           if (
             run.runType !== AIRunType.CodeFix ||
@@ -595,6 +591,25 @@ export default class AIAgentDataAPI {
             );
           }
 
+          /*
+           * FixFromIncident authorization covered one exact Recommended
+           * investigation. Never substitute the subject's current RootCause:
+           * a re-investigation may have posted a different, non-code analysis
+           * while this task waited in the queue.
+           */
+          if (
+            taskType === CodeFixTaskType.FixFromIncident &&
+            !investigationSnapshot
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "This fix-from-incident task has no complete pinned investigation analysis snapshot — it cannot be executed safely.",
+              ),
+            );
+          }
+
           /*
            * Service-scoped instrumentation recipes (ImproveLogging /
            * ImproveTracing): the context is just the service — resolve the
@@ -864,7 +879,8 @@ export default class AIAgentDataAPI {
            * fine when the subject has no monitor.
            */
           let serviceName: string | null = null;
-          let analysisMarkdown: string | null = null;
+          let analysisMarkdown: string | null =
+            investigationSnapshot?.investigationAnalysisMarkdown || null;
 
           if (run.triggeredByIncidentId) {
             const incident: Incident | null = await IncidentService.findOneById(
@@ -900,24 +916,11 @@ export default class AIAgentDataAPI {
                 })
                 .filter(Boolean)[0] || null;
 
-            const feedItem: IncidentFeed | null =
-              await IncidentFeedService.findOneBy({
-                query: {
-                  incidentId: run.triggeredByIncidentId,
-                  incidentFeedEventType: IncidentFeedEventType.RootCause,
-                },
-                select: {
-                  feedInfoInMarkdown: true,
-                },
-                sort: {
-                  createdAt: SortOrder.Descending,
-                },
-                props: {
-                  isRoot: true,
-                },
-              });
-
-            analysisMarkdown = feedItem?.feedInfoInMarkdown || null;
+            if (taskType !== CodeFixTaskType.FixFromIncident) {
+              analysisMarkdown = await PostedRootCause.getForIncident(
+                run.triggeredByIncidentId,
+              );
+            }
           } else {
             const alert: Alert | null = await AlertService.findOneById({
               id: run.triggeredByAlertId!,
@@ -945,25 +948,11 @@ export default class AIAgentDataAPI {
             subjectTitle = alert.title || "Untitled alert";
             serviceName = alert.monitor?.name || null;
 
-            const feedItem: AlertFeed | null = await AlertFeedService.findOneBy(
-              {
-                query: {
-                  alertId: run.triggeredByAlertId!,
-                  alertFeedEventType: AlertFeedEventType.RootCause,
-                },
-                select: {
-                  feedInfoInMarkdown: true,
-                },
-                sort: {
-                  createdAt: SortOrder.Descending,
-                },
-                props: {
-                  isRoot: true,
-                },
-              },
-            );
-
-            analysisMarkdown = feedItem?.feedInfoInMarkdown || null;
+            if (taskType !== CodeFixTaskType.FixFromIncident) {
+              analysisMarkdown = await PostedRootCause.getForAlert(
+                run.triggeredByAlertId!,
+              );
+            }
           }
 
           if (!analysisMarkdown) {

package/Server/API/AIInsightAPI.ts

@@ -26,8 +26,12 @@ const router: ExpressRouter = Express.getRouter();
  * Human-action endpoints for the AI insights inbox. Insight rows are
  * server-authored (empty create/update table permissions) — humans act on
  * them only through these routes: a one-click Confirm / Dismiss verdict
- * (the G11 precision measurement), Resolve, and the live triage panel
- * read. Each route access-checks the insight under the USER's permissions
+ * (the G11 precision measurement), Resolve, Reopen (the undo for both
+ * terminal states), and the live triage panel read. Every human action an
+ * insight can reach must be reversible from here, or a misclick is
+ * permanent — a dismissal in particular also suppresses the fingerprint
+ * for the InsightStore cooldown.
+ * Each route access-checks the insight under the USER's permissions
  * first (project membership + the AIInsight read ACL), then the
  * service performs the root read/write — the AIInvestigationAPI idiom.
  */
@@ -82,9 +86,10 @@ async function findAccessibleInsight(
  * One-click human verdict (the G11 precision measurement — confirm/dismiss
  * rates per insight type gate future automation). Overwriting an existing
  * verdict is allowed: the latest verdict wins. Dismissed also closes the
- * insight; Confirmed leaves its status untouched.
+ * insight; Confirmed leaves its status untouched unless the insight was
+ * closed AS Dismissed, in which case it is reopened — see the service.
  * Body: { insightId, verdict: "Confirmed" | "Dismissed" }.
- * Response: { insightId, verdict }.
+ * Response: { insightId, verdict, status }.
  */
 router.post(
   "/ai-insight/verdict",
@@ -115,6 +120,7 @@ router.post(
       const result: {
         insightId: ObjectID;
         verdict: AIInsightHumanVerdict;
+        status: AIInsightStatus | null;
       } = await AIInsightService.applyHumanVerdict({
         insightId: insight.id!,
         verdict: verdict as AIInsightHumanVerdict,
@@ -124,6 +130,7 @@ router.post(
       Response.sendJsonObjectResponse(req, res, {
         insightId: result.insightId.toString(),
         verdict: result.verdict,
+        status: result.status,
       });
       return;
     } catch (err) {
@@ -169,6 +176,42 @@ router.post(
   },
 );
 
+/*
+ * Undo a terminal action: puts a Resolved or Dismissed insight back in the
+ * open queue and clears the human verdict that closed it. Reopening an
+ * already-open insight is a no-op that reports the current status.
+ * Body: { insightId }. Response: { insightId, status }.
+ */
+router.post(
+  "/ai-insight/reopen",
+  UserMiddleware.getUserMiddleware,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const props: DatabaseCommonInteractionProps = await getLoggedInProps(req);
+
+      const insight: AIInsight = await findAccessibleInsight(req, props);
+
+      const result: { insightId: ObjectID; status: AIInsightStatus } =
+        await AIInsightService.reopenInsight({
+          insightId: insight.id!,
+        });
+
+      Response.sendJsonObjectResponse(req, res, {
+        insightId: result.insightId.toString(),
+        status: result.status,
+      });
+      return;
+    } catch (err) {
+      next(err);
+      return;
+    }
+  },
+);
+
 /*
  * Live triage panel data: the insight's triage AIRun + its ordered event
  * trail (capped — see MAX_TRIAGE_RUN_EVENTS on the service). Triage runs