@oneuptime/common 12.0.5 → 12.0.6

package/build/dist/Server/API/DashboardAPI.js

@@ -11,6 +11,7 @@ import ObjectID from "../../Types/ObjectID";
 import Dashboard from "../../Models/DatabaseModels/Dashboard";
 import { DASHBOARD_MASTER_PASSWORD_INVALID_MESSAGE } from "../../Types/Dashboard/MasterPassword";
 import JSONFunctions from "../../Types/JSONFunctions";
+import PublicDashboardViewConfig from "../Utils/Dashboard/PublicDashboardViewConfig";
 import TelemetryAttributeService from "../Services/TelemetryAttributeService";
 import TelemetryType from "../../Types/Telemetry/TelemetryType";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
@@ -50,8 +51,9 @@ import SpanService from "../Services/SpanService";
 import LogService from "../Services/LogService";
 import DashboardComponentType from "../../Types/Dashboard/DashboardComponentType";
 import { DashboardVariableType } from "../../Types/Dashboard/DashboardVariable";
-import Includes from "../../Types/BaseDatabase/Includes";
-const DEFAULT_DASHBOARD_RESOURCE_LIMIT = 100;
+import PublicDashboardResourceListPolicy from "../Utils/Dashboard/PublicDashboardResourceListPolicy";
+import { applyIncidentSelfPrivacyFilter } from "../Utils/Incident/IncidentPrivacyFilter";
+import { applyAlertSelfPrivacyFilter } from "../Utils/Alert/AlertPrivacyFilter";
 const PUBLIC_DASHBOARD_RESOURCES = {
     incident: {
         modelType: Incident,
@@ -59,20 +61,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.IncidentList]: null,
         },
-        allowedQueryKeys: [
-            "currentIncidentState",
-            "currentIncidentStateId",
-            "incidentSeverityId",
-            "monitors",
-            "labels",
-        ],
-        select: {
-            _id: true,
-            title: true,
-            createdAt: true,
-            currentIncidentState: { name: true, color: true },
-            incidentSeverity: { name: true, color: true },
-        },
     },
     alert: {
         modelType: Alert,
@@ -80,20 +68,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.AlertList]: null,
         },
-        allowedQueryKeys: [
-            "currentAlertState",
-            "currentAlertStateId",
-            "alertSeverityId",
-            "monitorId",
-            "labels",
-        ],
-        select: {
-            _id: true,
-            title: true,
-            createdAt: true,
-            currentAlertState: { name: true, color: true },
-            alertSeverity: { name: true, color: true },
-        },
     },
     monitor: {
         modelType: Monitor,
@@ -101,18 +75,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.MonitorList]: null,
         },
-        allowedQueryKeys: [
-            "currentMonitorStatus",
-            "currentMonitorStatusId",
-            "monitorType",
-            "labels",
-        ],
-        select: {
-            _id: true,
-            name: true,
-            monitorType: true,
-            currentMonitorStatus: { name: true, color: true },
-        },
     },
     "network-site": {
         modelType: NetworkSite,
@@ -120,36 +82,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.NetworkMap]: null,
         },
-        /*
-         * The map filters by site type and by whether the rolled-up status is
-         * operational — nothing else. Notably NOT `parentSiteId` or
-         * `materializedPath`: the widget draws a flat set of pins rather than
-         * walking a hierarchy, so exposing the tree shape here would hand an
-         * anonymous viewer a structure the map never shows them.
-         */
-        allowedQueryKeys: [
-            "networkSiteTypeId",
-            "currentMonitorStatus",
-            "currentMonitorStatusId",
-        ],
-        select: {
-            _id: true,
-            name: true,
-            /*
-             * The type NAME comes from the networkSiteType relation. NetworkSite
-             * .siteType is the deprecated pre-lookup-table string and is dropped
-             * in a follow-up PR, so it must not be read from new code.
-             */
-            networkSiteType: { name: true },
-            latitude: true,
-            longitude: true,
-            currentMonitorStatus: {
-                name: true,
-                color: true,
-                priority: true,
-                isOperationalState: true,
-            },
-        },
     },
     host: {
         modelType: Host,
@@ -157,23 +89,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.HostList]: null,
         },
-        allowedQueryKeys: [
-            "name",
-            "hostIdentifier",
-            "otelCollectorStatus",
-            "osType",
-        ],
-        select: {
-            _id: true,
-            name: true,
-            hostIdentifier: true,
-            otelCollectorStatus: true,
-            osType: true,
-            osVersion: true,
-            cpuCores: true,
-            totalMemoryBytes: true,
-            lastSeenAt: true,
-        },
     },
     "kubernetes-resource": {
         modelType: KubernetesResource,
@@ -188,33 +103,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
             [DashboardComponentType.KubernetesJobList]: "Job",
             [DashboardComponentType.KubernetesCronJobList]: "CronJob",
         },
-        allowedQueryKeys: [
-            "kubernetesClusterId",
-            "namespaceKey",
-            "name",
-            "phase",
-            "isReady",
-        ],
-        select: {
-            _id: true,
-            name: true,
-            namespaceKey: true,
-            kind: true,
-            phase: true,
-            isReady: true,
-            hasMemoryPressure: true,
-            hasDiskPressure: true,
-            hasPidPressure: true,
-            containerCount: true,
-            latestCpuPercent: true,
-            latestMemoryBytes: true,
-            controllerDeploymentName: true,
-            controllerCronJobName: true,
-            resourceCreationTimestamp: true,
-            lastSeenAt: true,
-            kubernetesClusterId: true,
-            kubernetesCluster: { name: true },
-        },
     },
     "docker-host": {
         modelType: DockerHost,
@@ -222,17 +110,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.DockerHostList]: null,
         },
-        allowedQueryKeys: ["name", "otelCollectorStatus"],
-        select: {
-            _id: true,
-            name: true,
-            otelCollectorStatus: true,
-            containersRunning: true,
-            containersStopped: true,
-            containersPaused: true,
-            osType: true,
-            osVersion: true,
-        },
     },
     "docker-container": {
         modelType: DockerResource,
@@ -240,17 +117,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.DockerContainerList]: "Container",
         },
-        allowedQueryKeys: ["dockerHostId", "name", "imageName"],
-        select: {
-            _id: true,
-            name: true,
-            imageName: true,
-            state: true,
-            latestCpuPercent: true,
-            latestMemoryBytes: true,
-            dockerHostId: true,
-            dockerHost: { name: true },
-        },
     },
     "docker-image": {
         modelType: DockerResource,
@@ -258,14 +124,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.DockerImageList]: "Image",
         },
-        allowedQueryKeys: ["dockerHostId", "name"],
-        select: {
-            _id: true,
-            name: true,
-            containerId: true,
-            dockerHostId: true,
-            dockerHost: { name: true },
-        },
     },
     "docker-network": {
         modelType: DockerResource,
@@ -273,14 +131,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.DockerNetworkList]: "Network",
         },
-        allowedQueryKeys: ["dockerHostId"],
-        select: {
-            _id: true,
-            name: true,
-            state: true,
-            dockerHostId: true,
-            dockerHost: { name: true },
-        },
     },
     "docker-volume": {
         modelType: DockerResource,
@@ -288,14 +138,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.DockerVolumeList]: "Volume",
         },
-        allowedQueryKeys: ["dockerHostId"],
-        select: {
-            _id: true,
-            name: true,
-            state: true,
-            dockerHostId: true,
-            dockerHost: { name: true },
-        },
     },
     "podman-host": {
         modelType: PodmanHost,
@@ -303,17 +145,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.PodmanHostList]: null,
         },
-        allowedQueryKeys: ["name", "otelCollectorStatus"],
-        select: {
-            _id: true,
-            name: true,
-            otelCollectorStatus: true,
-            containersRunning: true,
-            containersStopped: true,
-            containersPaused: true,
-            osType: true,
-            osVersion: true,
-        },
     },
     "podman-container": {
         modelType: PodmanResource,
@@ -321,17 +152,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.PodmanContainerList]: "Container",
         },
-        allowedQueryKeys: ["podmanHostId", "name", "imageName"],
-        select: {
-            _id: true,
-            name: true,
-            imageName: true,
-            state: true,
-            latestCpuPercent: true,
-            latestMemoryBytes: true,
-            podmanHostId: true,
-            podmanHost: { name: true },
-        },
     },
     "podman-image": {
         modelType: PodmanResource,
@@ -339,14 +159,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.PodmanImageList]: "Image",
         },
-        allowedQueryKeys: ["podmanHostId", "name"],
-        select: {
-            _id: true,
-            name: true,
-            containerId: true,
-            podmanHostId: true,
-            podmanHost: { name: true },
-        },
     },
     "podman-network": {
         modelType: PodmanResource,
@@ -354,14 +166,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.PodmanNetworkList]: "Network",
         },
-        allowedQueryKeys: ["podmanHostId"],
-        select: {
-            _id: true,
-            name: true,
-            state: true,
-            podmanHostId: true,
-            podmanHost: { name: true },
-        },
     },
     "podman-volume": {
         modelType: PodmanResource,
@@ -369,14 +173,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.PodmanVolumeList]: "Volume",
         },
-        allowedQueryKeys: ["podmanHostId"],
-        select: {
-            _id: true,
-            name: true,
-            state: true,
-            podmanHostId: true,
-            podmanHost: { name: true },
-        },
     },
     "proxmox-resource": {
         modelType: ProxmoxResource,
@@ -385,23 +181,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
             [DashboardComponentType.ProxmoxNodeList]: "Node",
             [DashboardComponentType.ProxmoxGuestList]: "Guest",
         },
-        allowedQueryKeys: ["proxmoxClusterId", "guestType", "isUp", "name"],
-        select: {
-            _id: true,
-            name: true,
-            externalId: true,
-            kind: true,
-            vmid: true,
-            guestType: true,
-            parentNodeName: true,
-            isUp: true,
-            haState: true,
-            latestCpuPercent: true,
-            latestMemoryPercent: true,
-            lastSeenAt: true,
-            proxmoxClusterId: true,
-            proxmoxCluster: { name: true },
-        },
     },
     "ceph-resource": {
         modelType: CephResource,
@@ -410,25 +189,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
             [DashboardComponentType.CephOsdList]: "Osd",
             [DashboardComponentType.CephPoolList]: "Pool",
         },
-        allowedQueryKeys: ["cephClusterId", "isUp", "isIn", "externalId"],
-        select: {
-            _id: true,
-            name: true,
-            externalId: true,
-            kind: true,
-            hostname: true,
-            deviceClass: true,
-            isUp: true,
-            isIn: true,
-            statBytes: true,
-            statBytesUsed: true,
-            storedBytes: true,
-            maxAvailBytes: true,
-            objects: true,
-            lastSeenAt: true,
-            cephClusterId: true,
-            cephCluster: { name: true },
-        },
     },
     "docker-swarm-resource": {
         modelType: DockerSwarmResource,
@@ -437,30 +197,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
             [DashboardComponentType.DockerSwarmNodeList]: "Node",
             [DashboardComponentType.DockerSwarmServiceList]: "Service",
         },
-        allowedQueryKeys: [
-            "dockerSwarmClusterId",
-            "role",
-            "serviceMode",
-            "isReady",
-        ],
-        select: {
-            _id: true,
-            name: true,
-            externalId: true,
-            kind: true,
-            role: true,
-            state: true,
-            serviceMode: true,
-            desiredReplicas: true,
-            runningReplicas: true,
-            image: true,
-            isReady: true,
-            latestCpuPercent: true,
-            latestMemoryPercent: true,
-            lastSeenAt: true,
-            dockerSwarmClusterId: true,
-            dockerSwarmCluster: { name: true },
-        },
     },
     span: {
         modelType: Span,
@@ -468,17 +204,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.TraceList]: null,
         },
-        allowedQueryKeys: ["startTime", "statusCode"],
-        select: {
-            startTime: true,
-            name: true,
-            statusCode: true,
-            durationUnixNano: true,
-            traceId: true,
-            spanId: true,
-            kind: true,
-            primaryEntityId: true,
-        },
     },
     log: {
         modelType: Log,
@@ -486,16 +211,6 @@ const PUBLIC_DASHBOARD_RESOURCES = {
         widgets: {
             [DashboardComponentType.LogStream]: null,
         },
-        allowedQueryKeys: ["time", "severityText", "body", "attributes"],
-        select: {
-            time: true,
-            severityText: true,
-            body: true,
-            primaryEntityId: true,
-            traceId: true,
-            spanId: true,
-            attributes: true,
-        },
     },
 };
 /*
@@ -646,18 +361,20 @@ export default class DashboardAPI extends BaseAPI {
                 /*
                  * Everything below is derived from columns the public /metadata and
                  * /view-config endpoints already serve to anonymous viewers — the
-                 * overview only reshapes them into a single GET-able document.
+                 * overview only reshapes them into a single GET-able document, and
+                 * applies the same external-Data-Source strip /view-config does.
                  */
+                const publicViewConfig = PublicDashboardViewConfig.sanitize(dashboard.dashboardViewConfig);
                 return Response.sendJsonObjectResponse(req, res, {
                     _id: ((_a = dashboard._id) === null || _a === void 0 ? void 0 : _a.toString()) || "",
                     name: dashboard.name || "Dashboard",
                     description: dashboard.description || "",
                     pageTitle: dashboard.pageTitle || "",
                     pageDescription: dashboard.pageDescription || "",
-                    components: DashboardAPI.buildPublicComponentSummaries(dashboard.dashboardViewConfig),
-                    metricsUsed: Array.from(DashboardAPI.collectDashboardMetricNames(dashboard.dashboardViewConfig)).sort(),
-                    dashboardViewConfig: dashboard.dashboardViewConfig
-                        ? JSONFunctions.serialize(dashboard.dashboardViewConfig)
+                    components: DashboardAPI.buildPublicComponentSummaries(publicViewConfig),
+                    metricsUsed: Array.from(DashboardAPI.collectDashboardMetricNames(publicViewConfig)).sort(),
+                    dashboardViewConfig: publicViewConfig
+                        ? JSONFunctions.serialize(publicViewConfig)
                         : null,
                 });
             }
@@ -791,6 +508,7 @@ export default class DashboardAPI extends BaseAPI {
                 if (!dashboard) {
                     throw new NotFoundException("Dashboard not found");
                 }
+                const publicViewConfig = PublicDashboardViewConfig.sanitize(dashboard.dashboardViewConfig);
                 return Response.sendJsonObjectResponse(req, res, {
                     _id: ((_a = dashboard._id) === null || _a === void 0 ? void 0 : _a.toString()) || "",
                     name: dashboard.name || "Dashboard",
@@ -798,8 +516,19 @@ export default class DashboardAPI extends BaseAPI {
                     pageTitle: dashboard.pageTitle || "",
                     pageDescription: dashboard.pageDescription || "",
                     logoFile: DashboardAPI.getFileAsBase64JSONObject(dashboard.logoFile),
-                    dashboardViewConfig: dashboard.dashboardViewConfig
-                        ? JSONFunctions.serialize(dashboard.dashboardViewConfig)
+                    /*
+                     * External Data Source widgets are stripped: they cannot render
+                     * for an anonymous viewer, and their config IS the query — raw
+                     * SQL / PromQL naming internal tables, jobs, and instances.
+                     *
+                     * The null stays null. JSONFunctions.serialize(null) returns
+                     * `{}`, and the public page falls back to a default config only
+                     * on a FALSY value — an empty object is truthy, so it would sail
+                     * through and the canvas would read `.components.length` off
+                     * undefined.
+                     */
+                    dashboardViewConfig: publicViewConfig
+                        ? JSONFunctions.serialize(publicViewConfig)
                         : null,
                 });
             }
@@ -1155,8 +884,8 @@ export default class DashboardAPI extends BaseAPI {
          * Public resource lists for non-metric dashboard widgets (incident /
          * alert / monitor / trace / log / kubernetes / docker / host lists).
          *
-         * Each widget renders a fixed set of columns; the server pins the select
-         * to exactly those columns (see PUBLIC_DASHBOARD_RESOURCES) and forces the
+         * Each widget renders a fixed set of columns; the server-owned widget
+         * policy pins the select to exactly those columns and forces the
          * project scope to the dashboard's project, so a public viewer can only
          * read the data the widget was built to show, for this dashboard's
          * project. Authorization reuses DashboardService.hasReadAccess.
@@ -1471,84 +1200,75 @@ export default class DashboardAPI extends BaseAPI {
         return groupByColumns;
     }
     /*
-     * Walk a stored dashboard view config and collect every widget type it
-     * renders. Used to build an allowlist for the public resource-list
-     * endpoint so an anonymous viewer can only read the resources this
-     * dashboard was actually built to show — a dashboard with a monitor list
-     * on it must not double as a project-wide log or incident reader.
+     * Read only the real, top-level dashboard components. Recursively scanning
+     * arbitrary widget arguments would let a nested object carrying a
+     * `componentType` masquerade as a widget and become an authorization input.
      */
-    static collectDashboardComponentTypes(dashboardViewConfig) {
-        const componentTypes = new Set();
-        const walk = (node) => {
-            if (!node || typeof node !== "object") {
-                return;
-            }
-            if (Array.isArray(node)) {
-                for (const item of node) {
-                    walk(item);
-                }
-                return;
-            }
-            const obj = node;
-            const componentType = obj["componentType"];
-            if (typeof componentType === "string" && componentType.length > 0) {
-                componentTypes.add(componentType);
-            }
-            for (const key of Object.keys(obj)) {
-                walk(obj[key]);
-            }
-        };
-        walk(dashboardViewConfig);
-        return componentTypes;
+    static collectDashboardWidgets(dashboardViewConfig) {
+        if (!dashboardViewConfig ||
+            typeof dashboardViewConfig !== "object" ||
+            Array.isArray(dashboardViewConfig)) {
+            return [];
+        }
+        const components = dashboardViewConfig["components"];
+        if (!Array.isArray(components)) {
+            return [];
+        }
+        return components.filter((component) => {
+            return Boolean(component && typeof component === "object" && !Array.isArray(component));
+        });
     }
-    /*
-     * Reduce a client-supplied query to the filter keys the widget is allowed
-     * to narrow by. Anything else the client sends — a foreign projectId, a
-     * filter on a column the widget never renders, an operator on a secret
-     * column used as a blind oracle — is dropped rather than merged.
-     */
-    static sanitizePublicResourceQuery(data) {
-        const { query, allowedQueryKeys } = data;
-        const sanitized = {};
-        if (!query || typeof query !== "object" || Array.isArray(query)) {
-            return sanitized;
+    static readDashboardWidgetComponentId(widget) {
+        const componentId = widget["componentId"];
+        if (componentId instanceof ObjectID) {
+            return componentId.toString();
         }
-        const queryObject = query;
-        for (const key of allowedQueryKeys) {
-            if (Object.prototype.hasOwnProperty.call(queryObject, key) &&
-                queryObject[key] !== undefined) {
-                sanitized[key] = queryObject[key];
+        if (typeof componentId === "string" && componentId.length > 0) {
+            return componentId;
+        }
+        if (componentId &&
+            typeof componentId === "object" &&
+            !Array.isArray(componentId)) {
+            const value = componentId["value"];
+            if (typeof value === "string" && value.length > 0) {
+                return value;
             }
         }
-        return sanitized;
+        return null;
     }
     /*
-     * Reduce a client-supplied sort to the columns the widget already renders
-     * (the registry's fixed select). Sorting by a column the viewer cannot see
-     * would otherwise order rows by a hidden value and leak it.
+     * Select the exact stored widget whose policy will be executed. A legacy
+     * caller may omit componentId only when there is exactly one matching
+     * widget, so two differently-filtered widgets are never conflated.
      */
-    static sanitizePublicResourceSort(data) {
-        const { sort, select } = data;
-        const sanitized = {};
-        if (!sort || typeof sort !== "object" || Array.isArray(sort)) {
-            return sanitized;
+    static selectPublicResourceWidget(data) {
+        const matchingWidgets = DashboardAPI.collectDashboardWidgets(data.dashboardViewConfig).filter((widget) => {
+            const componentType = widget["componentType"];
+            return (typeof componentType === "string" &&
+                Object.prototype.hasOwnProperty.call(data.config.widgets, componentType));
+        });
+        if (matchingWidgets.length === 0) {
+            throw new BadDataException("This resource is not part of this dashboard.");
         }
-        const sortObject = sort;
-        for (const key of Object.keys(sortObject)) {
-            // Only scalar columns of the fixed select are sortable.
-            if (select[key] !== true) {
-                continue;
-            }
-            const order = sortObject[key];
-            if (typeof order === "string" &&
-                order.toUpperCase() === SortOrder.Descending) {
-                sanitized[key] = SortOrder.Descending;
-            }
-            else {
-                sanitized[key] = SortOrder.Ascending;
+        if (data.requestedComponentId === undefined ||
+            data.requestedComponentId === null) {
+            if (matchingWidgets.length === 1) {
+                return matchingWidgets[0];
             }
+            throw new BadDataException("A componentId is required to read this resource from this dashboard.");
+        }
+        if (typeof data.requestedComponentId !== "string") {
+            throw new BadDataException("componentId must be a string UUID.");
+        }
+        ObjectID.validateUUID(data.requestedComponentId);
+        const selectedWidget = matchingWidgets.find((widget) => {
+            return (DashboardAPI.readDashboardWidgetComponentId(widget) ===
+                data.requestedComponentId);
+        });
+        if (!selectedWidget) {
+            throw new BadDataException("This resource is not part of this dashboard.");
         }
-        return sanitized;
+        return selectedWidget;
     }
     /*
      * Shared handler for the public resource-list endpoint. Loads the
@@ -1579,84 +1299,50 @@ export default class DashboardAPI extends BaseAPI {
         if (!dashboard || !dashboard.projectId) {
             throw new NotFoundException("Dashboard not found");
         }
-        /*
-         * Security: the dashboard must actually contain a widget that renders
-         * this resource. Without this check, knowing any public dashboard ID
-         * would be enough to read every resource type in its project — the
-         * dashboard's own widgets are the owner's opt-in, so they are the
-         * allowlist.
-         */
-        const dashboardComponentTypes = DashboardAPI.collectDashboardComponentTypes(dashboard.dashboardViewConfig);
-        const presentWidgets = Object.keys(config.widgets).filter((componentType) => {
-            return dashboardComponentTypes.has(componentType);
+        const widget = DashboardAPI.selectPublicResourceWidget({
+            dashboardViewConfig: dashboard.dashboardViewConfig,
+            config,
+            requestedComponentId: req.body ? req.body["componentId"] : undefined,
         });
-        if (presentWidgets.length === 0) {
-            throw new BadDataException("This resource is not part of this dashboard.");
-        }
-        const clientQuery = req.body && req.body["query"]
+        const requestedQuery = req.body && req.body["query"]
             ? JSONFunctions.deserialize(req.body["query"])
             : {};
-        const query = DashboardAPI.sanitizePublicResourceQuery({
-            query: clientQuery,
-            allowedQueryKeys: config.allowedQueryKeys,
+        const policy = PublicDashboardResourceListPolicy.build({
+            widget,
+            dashboardViewConfig: dashboard.dashboardViewConfig,
+            requestedVariables: req.body ? req.body["variables"] : undefined,
+            requestedQuery,
         });
+        const requestedResourceType = req.params["resourceType"];
+        if (policy.resourceType !== requestedResourceType) {
+            throw new BadDataException("This resource is not part of this dashboard.");
+        }
+        let query = Object.assign({}, policy.query);
         /*
-         * Security: pin to the dashboard's project; never trust a client-supplied
-         * projectId on a public, unauthenticated endpoint.
+         * IncidentService and AlertService normally apply privacy in their
+         * onBeforeFind hooks. The root read below intentionally bypasses those
+         * hooks' user context, so apply the anonymous form explicitly first:
+         * public dashboards may show public rows, never private tenant rows.
          */
-        query["projectId"] = dashboard.projectId;
+        if (requestedResourceType === "incident") {
+            query = applyIncidentSelfPrivacyFilter(query, {});
+        }
+        else if (requestedResourceType === "alert") {
+            query = applyAlertSelfPrivacyFilter(query, {});
+        }
         /*
-         * Models that pack several resource kinds into one table (Kubernetes,
-         * Docker, Podman, Proxmox, Ceph, Swarm) are constrained to the kinds the
-         * dashboard's widgets render, so a "volumes" widget cannot be used to
-         * list containers. A widget may pick one of those kinds; anything else is
-         * rejected, and a request that names no kind gets all of them.
+         * Project scope is the final query invariant. Neither the request nor a
+         * future policy builder may redirect this root read to another project.
+         * Resource kind, where applicable, comes solely from the selected
+         * widget's policy query.
          */
-        const allowedKinds = presentWidgets
-            .map((componentType) => {
-            return config.widgets[componentType];
-        })
-            .filter((kind) => {
-            return Boolean(kind);
-        });
-        if (allowedKinds.length > 0) {
-            const requestedKind = clientQuery["kind"];
-            if (requestedKind !== undefined && requestedKind !== null) {
-                if (typeof requestedKind !== "string" ||
-                    !allowedKinds.includes(requestedKind)) {
-                    throw new BadDataException("This resource is not part of this dashboard.");
-                }
-                query["kind"] = requestedKind;
-            }
-            else if (allowedKinds.length === 1) {
-                query["kind"] = allowedKinds[0];
-            }
-            else {
-                query["kind"] = new Includes(allowedKinds);
-            }
-        }
-        const sort = DashboardAPI.sanitizePublicResourceSort({
-            sort: req.body && req.body["sort"]
-                ? JSONFunctions.deserialize(req.body["sort"])
-                : {},
-            select: config.select,
-        });
-        const requestedLimit = req.query["limit"]
-            ? parseInt(req.query["limit"], 10)
-            : DEFAULT_DASHBOARD_RESOURCE_LIMIT;
-        const limit = Math.min(Number.isFinite(requestedLimit) && requestedLimit > 0
-            ? requestedLimit
-            : DEFAULT_DASHBOARD_RESOURCE_LIMIT, LIMIT_PER_PROJECT);
-        const requestedSkip = req.query["skip"]
-            ? parseInt(req.query["skip"], 10)
-            : 0;
-        const skip = Number.isFinite(requestedSkip) && requestedSkip > 0 ? requestedSkip : 0;
+        query["projectId"] = dashboard.projectId;
         const list = await config.service.findBy({
             query: query,
-            select: config.select,
-            sort: sort,
-            limit: limit,
-            skip: skip,
+            select: policy.select,
+            sort: policy.sort,
+            limit: policy.limit,
+            skip: 0,
             props: {
                 isRoot: true,
             },