@oneuptime/common 12.0.5 → 12.0.6

package/Server/Types/Database/Permissions/BasePermission.ts

@@ -32,6 +32,13 @@ export default class BasePermission {
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
   ): Promise<CheckPermissionBaseInterface<TBaseModel>> {
+    /*
+     * Permission checks add predicates and QueryUtil serializes values in
+     * place. Callers such as BaseAPI intentionally reuse the original query
+     * for list and count, so work on a fresh top-level object.
+     */
+    query = { ...query };
+
     const model: BaseModel = new modelType();
 
     if (props.isRoot || props.isMasterAdmin) {

package/Server/Types/Database/Permissions/DeletePermission.ts

@@ -34,6 +34,8 @@ export default class DeletePermission {
     query: Query<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    query = { ...query };
+
     if (props.isRoot || props.isMasterAdmin) {
       query = await PermissionUtil.addTenantScopeToQueryAsRoot(
         modelType,

package/Server/Types/Database/Permissions/ReadPermission.ts

@@ -29,6 +29,9 @@ export default class ReadPermission {
     select: Select<TBaseModel> | null,
     props: DatabaseCommonInteractionProps,
   ): Promise<CheckReadPermissionType<TBaseModel>> {
+    // Block and base permission checks both add predicates to the query.
+    query = { ...query };
+
     // check block permission first.
     await this.checkReadBlockPermission(modelType, query, props);
 

package/Server/Types/Database/Permissions/TenantPermission.ts

@@ -45,6 +45,40 @@ export default class TenantPermission {
       );
     }
 
+    const isAccessGrantedOnlyByCurrentUser: boolean =
+      TenantPermission.isAccessGrantedOnlyByCurrentUser(modelType, props, type);
+    const userColumn: string | null = model.getUserColumn();
+
+    /*
+     * CurrentUser is an auto-granted permission, not a tenant-wide role. A
+     * query operation that relies on it must declare an ownership column so
+     * the permission can be converted into a row predicate.
+     */
+    if (
+      isAccessGrantedOnlyByCurrentUser &&
+      type !== DatabaseRequestType.Create &&
+      !userColumn
+    ) {
+      throw new NotAuthorizedException(
+        `Current user scope is not configured for ${model.singularName}.`,
+      );
+    }
+
+    const shouldScopeQueryByCurrentUser: boolean =
+      isAccessGrantedOnlyByCurrentUser && Boolean(userColumn);
+
+    /*
+     * API keys and other non-user callers can carry the auto-granted
+     * CurrentUser permission without having a userId. Such a grant can never
+     * be converted into an ownership filter, so reject it instead of running
+     * the caller's query without a user scope.
+     */
+    if (shouldScopeQueryByCurrentUser && !props.userId) {
+      throw new NotAuthorizedException(
+        `A user session is required to ${type} ${model.singularName}.`,
+      );
+    }
+
     // If this model has a tenantColumn, and request has tenantId, and is multiTenantQuery null then add tenantId to query.
     if (tenantColumn && props.tenantId && !props.isMultiTenantRequest) {
       (query as any)[tenantColumn] = props.tenantId;
@@ -56,13 +90,12 @@ export default class TenantPermission {
        * row in the project (CVE-class issue when CurrentUser appears in a
        * model's delete/update list alongside admin permissions).
        */
-      if (
-        TenantPermission.shouldScopeQueryByCurrentUser(modelType, props, type)
-      ) {
-        const userColumn: string | null = model.getUserColumn();
-        if (userColumn) {
-          (query as any)[userColumn] = props.userId;
-        }
+      if (shouldScopeQueryByCurrentUser) {
+        TenantPermission.addCurrentUserScopeToQuery(
+          model,
+          query,
+          props.userId as ObjectID,
+        );
       }
     }
     // if model allows user query without tenant, and user column is present, and userId is present, then add userId to query.
@@ -71,7 +104,7 @@ export default class TenantPermission {
       model.getUserColumn() &&
       props.userId
     ) {
-      (query as any)[model.getUserColumn() as string] = props.userId;
+      TenantPermission.addCurrentUserScopeToQuery(model, query, props.userId);
     } else if (
       tenantColumn &&
       props.userGlobalAccessPermission &&
@@ -114,6 +147,7 @@ export default class TenantPermission {
       }
 
       let lastException: Error | null = null;
+      const queryForEachProject: Query<TBaseModel> = { ...query };
 
       for (const projectId of projectIDs) {
         if (!props.userId) {
@@ -124,7 +158,7 @@ export default class TenantPermission {
           const checkBasePermissions: CheckPermissionBaseInterface<TBaseModel> =
             await BasePermission.checkPermissions(
               modelType,
-              query,
+              { ...queryForEachProject },
               select,
               {
                 ...props,
@@ -154,25 +188,76 @@ export default class TenantPermission {
       return queries as any;
     }
 
+    /*
+     * A model that relies on CurrentUser must resolve that permission to the
+     * requester's exact ownership column. This catches missing decorators and
+     * prevents a future model misconfiguration from silently becoming an
+     * instance-wide query.
+     */
+    if (shouldScopeQueryByCurrentUser) {
+      const scopedUserId: unknown = (query as any)[userColumn as string];
+
+      if (
+        !TenantPermission.isExactUserScope(scopedUserId) ||
+        scopedUserId.toString() !== (props.userId as ObjectID).toString()
+      ) {
+        throw new NotAuthorizedException(
+          `Current user scope could not be applied to ${model.singularName}.`,
+        );
+      }
+    }
+
     return query;
   }
 
+  /**
+   * Add the authenticated user's ownership predicate without redirecting an
+   * operation that explicitly targeted another user. Rejecting a conflict is
+   * important because service hooks run before the final permission check;
+   * silently replacing the target would let a hook inspect one row and the
+   * database operation mutate a different one.
+   */
+  private static addCurrentUserScopeToQuery<TBaseModel extends BaseModel>(
+    model: BaseModel,
+    query: Query<TBaseModel>,
+    userId: ObjectID,
+  ): void {
+    const userColumn: string = model.getUserColumn() as string;
+    const existingUserScope: unknown = (query as any)[userColumn];
+
+    if (
+      existingUserScope !== undefined &&
+      (!TenantPermission.isExactUserScope(existingUserScope) ||
+        existingUserScope.toString() !== userId.toString())
+    ) {
+      throw new NotAuthorizedException(
+        `You do not have permission to access another user's ${model.singularName}.`,
+      );
+    }
+
+    (query as any)[userColumn] = userId;
+  }
+
+  /**
+   * Ownership filters must be exact scalar ids. Query operators such as
+   * NotEqual stringify to their wrapped id as well, so comparing only their
+   * string value would allow a broad hook query to masquerade as an exact
+   * current-user predicate.
+   */
+  private static isExactUserScope(value: unknown): value is string | ObjectID {
+    return typeof value === "string" || value instanceof ObjectID;
+  }
+
   /**
    * True if the only permission letting this user through the table-level
    * check for this op is Permission.CurrentUser. In that case the query must
    * be restricted to rows the user owns (via the model's user column).
    */
-  private static shouldScopeQueryByCurrentUser<TBaseModel extends BaseModel>(
+  private static isAccessGrantedOnlyByCurrentUser<TBaseModel extends BaseModel>(
     modelType: { new (): TBaseModel },
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
   ): boolean {
-    const model: BaseModel = new modelType();
-
-    if (!model.getUserColumn() || !props.userId) {
-      return false;
-    }
-
     const modelPermissions: Array<Permission> =
       TablePermission.getTablePermission(modelType, type);
 

package/Server/Utils/AI/CodeFix/FixRunBudget.ts

@@ -185,9 +185,9 @@ export default class FixRunBudget {
           : "Daily Other AI Fix Task Limit";
     const settingsLocation: string =
       lane === "incident"
-        ? "Incidents > Settings > AI"
+        ? "Incidents > AI > Investigation"
         : lane === "alert"
-          ? "Alerts > Settings > AI"
+          ? "Alerts > AI > Investigation"
           : "Project Settings > AI > AI Guardrails";
     const laneLabel: string = lane === "other" ? "other AI" : `${lane} AI`;
 

package/Server/Utils/AI/SRE/AIInvestigationEngine.ts

@@ -17,6 +17,7 @@ import ProjectService from "../../../Services/ProjectService";
 import LlmProviderService from "../../../Services/LlmProviderService";
 import AIInvestigationQueue from "./InvestigationQueue";
 import AIConfidenceSignal, { ConfidenceSignal } from "./ConfidenceSignal";
+import InvestigationTldr from "./InvestigationTldr";
 import ObservabilityAssistant, {
   ObservabilityAssistantExtraTool,
   ObservabilityAssistantResult,
@@ -124,6 +125,13 @@ export interface InvestigationRequest {
    * remain NotRecommended throughout their lifecycle.
    */
   persistCodeFixRecommendation?: boolean | undefined;
+  /*
+   * Incident and alert RCA runs opt into the AI-written TL;DR that the
+   * dashboard panel shows above the report. Display-only and best-effort:
+   * a failed generation leaves the run without one and changes nothing else.
+   * Engine users with no panel (insight triage, remediation) omit it.
+   */
+  persistAnalysisTldr?: boolean | undefined;
   /*
    * Runs only after a Recommended decision and its exact analysis snapshot
    * have been durably committed. Incident/alert runners use this for the
@@ -407,17 +415,62 @@ export default class AIInvestigationEngine {
        * the WON Completed transition also means a falsely-requeued duplicate
        * attempt can never double-spend it.
        */
-      const confidence: ConfidenceSignal =
-        await AIConfidenceSignal.computeConfidenceSignal({
-          projectId,
-          aiRunId,
-          incidentId: request.incidentId,
-          alertId: request.alertId,
-          analysisMarkdown: analysis,
-          evidence: AIConfidenceSignal.evidenceFromCitations(
-            result.citations || [],
-          ),
-        });
+      /*
+       * The display-only TL;DR (see InvestigationTldr) runs CONCURRENTLY with
+       * the classification: both are post-loop calls over the same analysis,
+       * so serializing them would add their latencies to the delay before the
+       * RCA reaches the on-call engineer. Neither call throws — the TL;DR
+       * degrades to null and the report is published regardless.
+       */
+      const [confidence, analysisTldr]: [ConfidenceSignal, string | null] =
+        await Promise.all([
+          AIConfidenceSignal.computeConfidenceSignal({
+            projectId,
+            aiRunId,
+            incidentId: request.incidentId,
+            alertId: request.alertId,
+            analysisMarkdown: analysis,
+            evidence: AIConfidenceSignal.evidenceFromCitations(
+              result.citations || [],
+            ),
+          }),
+          request.persistAnalysisTldr === true
+            ? InvestigationTldr.generateTldr({
+                projectId,
+                aiRunId,
+                incidentId: request.incidentId,
+                alertId: request.alertId,
+                /*
+                 * Summarize the model's own analysis, not the branded form —
+                 * the branding wrapper is boilerplate plus an evidence list,
+                 * and a summary of it would waste the TL;DR on both.
+                 */
+                analysisMarkdown: analysis,
+              }).catch((error: unknown): null => {
+                /*
+                 * generateTldr is total by construction, but it sits in a
+                 * Promise.all inside the main try: a rejection would land in
+                 * the catch below AFTER the Completed transition was won, so
+                 * the run would be failed and the report never posted at all
+                 * — a cosmetic line of text destroying the whole RCA. Belt
+                 * and braces, because the blast radius is that asymmetric.
+                 */
+                logger.error(
+                  `AI: TL;DR generation threw for run ${aiRunId.toString()}; publishing the report without one: ${error}`,
+                );
+                return null;
+              })
+            : Promise.resolve(null),
+        ]);
+
+      /*
+       * Persist the TL;DR BEFORE the report is posted, so the panel can never
+       * render the report for a beat without its summary. Best-effort: a
+       * write failure is logged and the report still posts.
+       */
+      if (analysisTldr) {
+        await this.persistAnalysisTldr({ aiRunId, analysisTldr });
+      }
 
       /*
        * Build the posted form exactly once. The same immutable string is
@@ -579,6 +632,32 @@ export default class AIInvestigationEngine {
     }
   }
 
+  /*
+   * Store the display-only TL;DR on the run. Unlike the code-fix decision
+   * this authorizes nothing, so it is not retried: a failed write (or a run
+   * that is no longer Completed) simply leaves the panel showing the report
+   * with no summary above it.
+   */
+  private static async persistAnalysisTldr(data: {
+    aiRunId: ObjectID;
+    analysisTldr: string;
+  }): Promise<void> {
+    try {
+      const updatedCount: number =
+        await AIRunService.setInvestigationAnalysisTldr(data);
+
+      if (updatedCount === 0) {
+        logger.warn(
+          `AI: could not store the TL;DR for run ${data.aiRunId.toString()} — it was no longer Completed.`,
+        );
+      }
+    } catch (error) {
+      logger.error(
+        `AI: failed to store the TL;DR for run ${data.aiRunId.toString()}: ${error}`,
+      );
+    }
+  }
+
   /*
    * Resolve the recommendation exactly once. Pending is written by the
    * winning Completed CAS, so this conditional update cannot race a stale

package/Server/Utils/AI/SRE/AlertInvestigationRunner.ts

@@ -172,6 +172,7 @@ export default class AIAlertInvestigationRunner {
         alertId,
         contextSummary,
         persistCodeFixRecommendation: true,
+        persistAnalysisTldr: true,
         postAnalysis: async (postData: {
           analysisMarkdown: string;
           confidence: ConfidenceSignal;

package/Server/Utils/AI/SRE/IncidentInvestigationRunner.ts

@@ -354,6 +354,7 @@ export default class AIIncidentInvestigationRunner {
         incidentId,
         contextSummary,
         persistCodeFixRecommendation: true,
+        persistAnalysisTldr: true,
         postAnalysis: async (postData: {
           analysisMarkdown: string;
           confidence: ConfidenceSignal;

package/Server/Utils/AI/SRE/Insights/Detectors/ExceptionIdentity.ts

@@ -0,0 +1,125 @@
+import ObjectID from "../../../../../../Types/ObjectID";
+import Crypto from "../../../../../../Utils/Crypto";
+import { normalizeExceptionText } from "../../../../Telemetry/ExceptionSanitizer";
+
+/*
+ * Shared exception identity for the two exception detectors (NewException and
+ * ExceptionSpike).
+ *
+ * THE PROBLEM THIS SOLVES. A TelemetryException GROUP is keyed at ingest on
+ * sha256(projectId + primaryEntityId + normalizedMessage + normalizedStackTrace
+ * + exceptionType) — the STACK TRACE is part of that key. One logical failure
+ * raised from several call sites is therefore several groups, and a detector
+ * that emits one insight per group files the same finding several times over.
+ * Worse, the insight TITLE used to be the exceptionType alone, so those rows
+ * were not merely duplicated, they were indistinguishable: a service whose
+ * instrumentation reports `exception.type = "401"` produced a wall of
+ * identical "New exception: 401 in api" rows.
+ *
+ * THE FAILURE MODE is the unit a human actually triages: one service, one
+ * exception type, one normalized message. Everything below that (which call
+ * stack it surfaced on) is detail that belongs inside the insight, not a
+ * separate row in the inbox.
+ */
+
+/*
+ * How much of the message rides in the insight title. Titles must stay
+ * scannable in a list, but they must also carry enough of the message to tell
+ * two findings apart — the type alone frequently cannot (HTTP status codes,
+ * bare `Error`, `Exception`).
+ */
+export const EXCEPTION_LABEL_MESSAGE_MAX_LENGTH: number = 80;
+
+/*
+ * Human label for an exception: the type AND the message, because either one
+ * alone collides. `TypeError` is not a finding; `TypeError: Cannot read
+ * properties of undefined (reading 'user')` is.
+ *
+ * Only the message is truncated (the type is short by construction), so a
+ * label is never longer than the type plus the cap plus the separator.
+ */
+export function buildExceptionLabel(
+  exceptionType: string | undefined,
+  message: string | undefined,
+  messageMaxLength: number = EXCEPTION_LABEL_MESSAGE_MAX_LENGTH,
+): string {
+  const type: string = (exceptionType || "").trim();
+  const fullMessage: string = (message || "").trim();
+
+  if (!type && !fullMessage) {
+    return "Unknown exception";
+  }
+
+  if (!fullMessage) {
+    return type;
+  }
+
+  const shortMessage: string =
+    fullMessage.length <= messageMaxLength
+      ? fullMessage
+      : `${fullMessage.slice(0, messageMaxLength)}…`;
+
+  if (!type) {
+    return shortMessage;
+  }
+
+  /*
+   * Runtimes routinely prefix the message with the type ("Error: connect
+   * ECONNREFUSED", "ValueError: invalid literal"), and some SDKs report the
+   * message as the type verbatim. Saying it twice reads as a bug.
+   */
+  const lowerType: string = type.toLowerCase();
+  const lowerMessage: string = fullMessage.toLowerCase();
+
+  if (
+    lowerMessage === lowerType ||
+    lowerMessage.startsWith(`${lowerType}:`) ||
+    lowerMessage.startsWith(`${lowerType} `)
+  ) {
+    return shortMessage;
+  }
+
+  return `${type}: ${shortMessage}`;
+}
+
+/*
+ * Stable identity of a FAILURE MODE — the dedupe key insights are filed under.
+ *
+ * (entity, type, normalized message) and deliberately NOT the stack trace:
+ * collapsing stack-trace-only variants of one failure into one insight is the
+ * entire point. The entity id stays in the clear so a fingerprint is greppable
+ * back to a service, and it guarantees the key can never collide across
+ * services; the type+message half is hashed so an unbounded telemetry string
+ * cannot blow past the fingerprint column.
+ *
+ * `${exceptionType}|${normalizeExceptionText(message)}` is the SAME signature
+ * TelemetryExceptionService.validateNoOpenFixForSimilarException already uses
+ * to stop the fix lane opening near-identical pull requests for one throw site
+ * ("observed: 15 near-identical PRs for one invalid-uuid throw site"). The
+ * insight lane had no equivalent — this is that same rule, applied one stage
+ * earlier so the duplicates never reach the inbox in the first place.
+ *
+ * The RAW message is normalized here rather than the sanitized one: the
+ * fingerprint is an identity that MUST stay byte-for-byte stable across ticks
+ * and releases (a key that drifts files a duplicate on every drift), and
+ * normalizeExceptionText carries exactly that stability contract, while the
+ * secret redactor layered on top of it for display does not.
+ */
+export function buildExceptionFailureModeKey(data: {
+  primaryEntityId: ObjectID | undefined;
+  exceptionType: string | undefined;
+  message: string | undefined;
+}): string {
+  const entityId: string =
+    data.primaryEntityId?.toString() || "unattributed-entity";
+  const type: string = (data.exceptionType || "").trim();
+  const normalizedMessage: string = normalizeExceptionText(
+    (data.message || "").trim(),
+  );
+
+  const contentHash: string = Crypto.getSha256Hash(
+    `${type}|${normalizedMessage}`,
+  );
+
+  return `${entityId}:${contentHash}`;
+}

package/Server/Utils/AI/SRE/Insights/Detectors/ExceptionSpikeDetector.ts

@@ -14,6 +14,10 @@ import ExceptionInstanceService from "../../../../../Services/ExceptionInstanceS
 import ServiceService from "../../../../../Services/ServiceService";
 import QueryHelper from "../../../../../Types/Database/QueryHelper";
 import { sanitizeExceptionMessage } from "../../../../Telemetry/ExceptionSanitizer";
+import {
+  EXCEPTION_LABEL_MESSAGE_MAX_LENGTH,
+  buildExceptionLabel,
+} from "./ExceptionIdentity";
 import {
   InsightCandidate,
   InsightDetector,
@@ -65,7 +69,8 @@ export const EXCEPTION_SPIKE_HIGH_SEVERITY_MULTIPLIER: number = 10;
 export const EXCEPTION_SPIKE_CANDIDATE_LIMIT: number = 25;
 
 // Titles must stay scannable in a list — truncate long exception messages.
-export const EXCEPTION_SPIKE_TITLE_MESSAGE_MAX_LENGTH: number = 80;
+export const EXCEPTION_SPIKE_TITLE_MESSAGE_MAX_LENGTH: number =
+  EXCEPTION_LABEL_MESSAGE_MAX_LENGTH;
 
 export interface ExceptionSpikeDecision {
   isSpike: boolean;
@@ -114,27 +119,32 @@ export default class ExceptionSpikeDetector implements InsightDetector {
   }
 
   /*
-   * Human label for the exception: the type when present, else the first
-   * EXCEPTION_SPIKE_TITLE_MESSAGE_MAX_LENGTH characters of the message.
+   * Human label for the exception: the type AND the message, because either
+   * one alone collides across findings (see ExceptionIdentity).
    */
   public static buildExceptionLabel(
     exceptionType: string | undefined,
     message: string | undefined,
   ): string {
-    if (exceptionType && exceptionType.trim().length > 0) {
-      return exceptionType.trim();
-    }
-    const trimmedMessage: string = (message || "").trim();
-    if (trimmedMessage.length === 0) {
-      return "Unknown exception";
-    }
-    if (trimmedMessage.length <= EXCEPTION_SPIKE_TITLE_MESSAGE_MAX_LENGTH) {
-      return trimmedMessage;
-    }
-    return `${trimmedMessage.slice(0, EXCEPTION_SPIKE_TITLE_MESSAGE_MAX_LENGTH)}…`;
+    return buildExceptionLabel(
+      exceptionType,
+      message,
+      EXCEPTION_SPIKE_TITLE_MESSAGE_MAX_LENGTH,
+    );
   }
 
-  // Stable dedupe key, keyed on the exception GROUP id (ingest dedupe unit).
+  /*
+   * Stable dedupe key, keyed on the exception GROUP id (ingest dedupe unit).
+   *
+   * DELIBERATELY NOT the failure-mode key NewExceptionDetector files under.
+   * That detector's evidence is a Postgres column it can simply add up across
+   * the groups of one failure mode; a spike is a RATE, measured per ingest
+   * fingerprint in ClickHouse. Rolling several fingerprints into one insight
+   * would mean summing their windows and re-deciding the spike on the total —
+   * which changes what counts as a spike, not just how many rows it files.
+   * The title carries the type, the message and the multiplier, so sibling
+   * groups read as distinct rows rather than as copies.
+   */
   public static buildFingerprint(telemetryExceptionId: string): string {
     return `exception-spike:${telemetryExceptionId}`;
   }