@oneuptime/common 12.0.5 → 12.0.6

package/Models/DatabaseModels/Index.ts

@@ -189,6 +189,7 @@ import AIRunEvent from "./AIRunEvent";
 import AIInsight from "./AIInsight";
 import LlmProvider from "./LlmProvider";
 import LlmLog from "./LlmLog";
+import DataSource from "./DataSource";
 import Project from "./Project";
 import ProjectCallSMSConfig from "./ProjectCallSMSConfig";
 import ProjectUserProfile from "./ProjectUserProfile";
@@ -764,6 +765,8 @@ const AllModelTypes: Array<{
   LlmProvider,
   LlmLog,
 
+  DataSource,
+
   UserSession,
   UserTotpAuth,
   UserWebAuthn,

package/Models/DatabaseModels/ProjectCallSMSConfig.ts

@@ -413,11 +413,18 @@ export default class ProjectCallSMSConfig extends BaseModel {
     description: "Account SID for your Twilio Account",
     example: "ACxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
   })
+  /*
+   * NOT unique. One Twilio account legitimately backs more than one config —
+   * a project splitting SMS and Voice across two numbers on the same account,
+   * or two projects on a shared instance using the same account. A global
+   * UNIQUE here made the second such config fail with a bare 500 (issue #3020),
+   * across the tenant boundary as well as within a project.
+   */
   @Column({
     type: ColumnType.ShortText,
     length: ColumnLength.ShortText,
     nullable: true,
-    unique: true,
+    unique: false,
   })
   public twilioAccountSID?: string = undefined;
 
@@ -449,11 +456,12 @@ export default class ProjectCallSMSConfig extends BaseModel {
     description: "Auth Token for your Twilio Account",
     example: "your-twilio-auth-token",
   })
+  /* NOT unique, for the same reason as twilioAccountSID above. */
   @Column({
     type: ColumnType.ShortText,
     length: ColumnLength.ShortText,
     nullable: true,
-    unique: true,
+    unique: false,
   })
   public twilioAuthToken?: string = undefined;
 

package/Models/DatabaseModels/User.ts

@@ -6,6 +6,7 @@ import JobRole from "../../Types/Company/JobRole";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import AllowUserQueryWithoutTenant from "../../Types/Database/AllowUserQueryWithoutTenant";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
@@ -48,6 +49,7 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
   icon: IconProp.User,
   tableDescription: "A signed up or invited OneUptime user.",
 })
+@AllowUserQueryWithoutTenant(true)
 @CurrentUserCanAccessRecordBy("_id")
 class User extends UserModel {
   @ColumnAccessControl({

package/Models/DatabaseModels/UserOnCallLog.ts

@@ -18,6 +18,7 @@ import CanAccessIfCanReadOn from "../../Types/Database/CanAccessIfCanReadOn";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import CurrentUserCanAccessRecordBy from "../../Types/Database/CurrentUserCanAccessRecordBy";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
@@ -36,6 +37,7 @@ import Alert from "./Alert";
 
 @EnableDocumentation()
 @CanAccessIfCanReadOn("onCallDutyPolicy")
+@CurrentUserCanAccessRecordBy("userId")
 @TenantColumn("projectId")
 @TableBillingAccessControl({
   create: PlanType.Growth,

package/Models/DatabaseModels/UserOnCallLogTimeline.ts

@@ -29,6 +29,7 @@ import CanAccessIfCanReadOn from "../../Types/Database/CanAccessIfCanReadOn";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import CurrentUserCanAccessRecordBy from "../../Types/Database/CurrentUserCanAccessRecordBy";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
@@ -49,6 +50,7 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 })
 @EnableDocumentation()
 @CanAccessIfCanReadOn("onCallDutyPolicy")
+@CurrentUserCanAccessRecordBy("userId")
 @TenantColumn("projectId")
 @TableAccessControl({
   create: [],

package/Models/DatabaseModels/UserSession.ts

@@ -4,6 +4,7 @@ import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import AllowUserQueryWithoutTenant from "../../Types/Database/AllowUserQueryWithoutTenant";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
@@ -41,6 +42,7 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
   tableDescription:
     "Active user sessions with refresh tokens and device metadata for enhanced authentication security.",
 })
+@AllowUserQueryWithoutTenant(true)
 @CurrentUserCanAccessRecordBy("userId")
 class UserSession extends BaseModel {
   @ColumnAccessControl({

package/Models/DatabaseModels/UserTotpAuth.ts

@@ -4,6 +4,7 @@ import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import AllowUserQueryWithoutTenant from "../../Types/Database/AllowUserQueryWithoutTenant";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
@@ -38,6 +39,7 @@ import { Column, Entity, JoinColumn, ManyToOne } from "typeorm";
   icon: IconProp.ShieldCheck,
   tableDescription: "TOTP Authentication for users",
 })
+@AllowUserQueryWithoutTenant(true)
 @CurrentUserCanAccessRecordBy("userId")
 class UserTotpAuth extends BaseModel {
   @ColumnAccessControl({
@@ -98,7 +100,7 @@ class UserTotpAuth extends BaseModel {
   @ColumnAccessControl({
     create: [Permission.CurrentUser],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     type: TableColumnType.Boolean,
@@ -163,9 +165,9 @@ class UserTotpAuth extends BaseModel {
   public deletedByUserId?: ObjectID = undefined;
 
   @ColumnAccessControl({
-    create: [Permission.CurrentUser],
+    create: [],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     manyToOneRelationColumn: "userId",
@@ -191,7 +193,7 @@ class UserTotpAuth extends BaseModel {
   @ColumnAccessControl({
     create: [Permission.CurrentUser],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     type: TableColumnType.ObjectID,

package/Models/DatabaseModels/UserWebAuthn.ts

@@ -4,6 +4,7 @@ import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import AllowUserQueryWithoutTenant from "../../Types/Database/AllowUserQueryWithoutTenant";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
@@ -38,6 +39,7 @@ import { Column, Entity, JoinColumn, ManyToOne } from "typeorm";
   icon: IconProp.ShieldCheck,
   tableDescription: "WebAuthn credentials for users (security keys)",
 })
+@AllowUserQueryWithoutTenant(true)
 @CurrentUserCanAccessRecordBy("userId")
 class UserWebAuthn extends BaseModel {
   @ColumnAccessControl({
@@ -198,9 +200,9 @@ class UserWebAuthn extends BaseModel {
   public deletedByUserId?: ObjectID = undefined;
 
   @ColumnAccessControl({
-    create: [Permission.CurrentUser],
+    create: [],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     manyToOneRelationColumn: "userId",
@@ -226,7 +228,7 @@ class UserWebAuthn extends BaseModel {
   @ColumnAccessControl({
     create: [Permission.CurrentUser],
     read: [Permission.CurrentUser],
-    update: [Permission.CurrentUser],
+    update: [],
   })
   @TableColumn({
     type: TableColumnType.ObjectID,

package/Server/API/AIInsightAPI.ts

@@ -26,8 +26,12 @@ const router: ExpressRouter = Express.getRouter();
  * Human-action endpoints for the AI insights inbox. Insight rows are
  * server-authored (empty create/update table permissions) — humans act on
  * them only through these routes: a one-click Confirm / Dismiss verdict
- * (the G11 precision measurement), Resolve, and the live triage panel
- * read. Each route access-checks the insight under the USER's permissions
+ * (the G11 precision measurement), Resolve, Reopen (the undo for both
+ * terminal states), and the live triage panel read. Every human action an
+ * insight can reach must be reversible from here, or a misclick is
+ * permanent — a dismissal in particular also suppresses the fingerprint
+ * for the InsightStore cooldown.
+ * Each route access-checks the insight under the USER's permissions
  * first (project membership + the AIInsight read ACL), then the
  * service performs the root read/write — the AIInvestigationAPI idiom.
  */
@@ -82,9 +86,10 @@ async function findAccessibleInsight(
  * One-click human verdict (the G11 precision measurement — confirm/dismiss
  * rates per insight type gate future automation). Overwriting an existing
  * verdict is allowed: the latest verdict wins. Dismissed also closes the
- * insight; Confirmed leaves its status untouched.
+ * insight; Confirmed leaves its status untouched unless the insight was
+ * closed AS Dismissed, in which case it is reopened — see the service.
  * Body: { insightId, verdict: "Confirmed" | "Dismissed" }.
- * Response: { insightId, verdict }.
+ * Response: { insightId, verdict, status }.
  */
 router.post(
   "/ai-insight/verdict",
@@ -115,6 +120,7 @@ router.post(
       const result: {
         insightId: ObjectID;
         verdict: AIInsightHumanVerdict;
+        status: AIInsightStatus | null;
       } = await AIInsightService.applyHumanVerdict({
         insightId: insight.id!,
         verdict: verdict as AIInsightHumanVerdict,
@@ -124,6 +130,7 @@ router.post(
       Response.sendJsonObjectResponse(req, res, {
         insightId: result.insightId.toString(),
         verdict: result.verdict,
+        status: result.status,
       });
       return;
     } catch (err) {
@@ -169,6 +176,42 @@ router.post(
   },
 );
 
+/*
+ * Undo a terminal action: puts a Resolved or Dismissed insight back in the
+ * open queue and clears the human verdict that closed it. Reopening an
+ * already-open insight is a no-op that reports the current status.
+ * Body: { insightId }. Response: { insightId, status }.
+ */
+router.post(
+  "/ai-insight/reopen",
+  UserMiddleware.getUserMiddleware,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const props: DatabaseCommonInteractionProps = await getLoggedInProps(req);
+
+      const insight: AIInsight = await findAccessibleInsight(req, props);
+
+      const result: { insightId: ObjectID; status: AIInsightStatus } =
+        await AIInsightService.reopenInsight({
+          insightId: insight.id!,
+        });
+
+      Response.sendJsonObjectResponse(req, res, {
+        insightId: result.insightId.toString(),
+        status: result.status,
+      });
+      return;
+    } catch (err) {
+      next(err);
+      return;
+    }
+  },
+);
+
 /*
  * Live triage panel data: the insight's triage AIRun + its ordered event
  * trail (capped — see MAX_TRIAGE_RUN_EVENTS on the service). Triage runs

package/Server/API/AIInvestigationAPI.ts

@@ -195,6 +195,8 @@ async function sendLatestInvestigation(
       totalTokens: true,
       createdAt: true,
       codeFixRecommendation: true,
+      // The AI-written summary the panel shows above the report.
+      analysisTldr: true,
       // Measurement layer: the panel renders verdict/grade state from these.
       humanVerdict: true,
       humanVerdictAt: true,
@@ -214,6 +216,7 @@ async function sendLatestInvestigation(
       run: null,
       events: [],
       analysisMarkdown: null,
+      analysisTldr: null,
       isAnalysisPending: false,
     });
     return;
@@ -263,10 +266,32 @@ async function sendLatestInvestigation(
     analysisMarkdown,
   });
 
+  /*
+   * The TL;DR summarizes the report, so it is only meaningful alongside one.
+   * A run whose report is still settling (or which never published one) must
+   * not show a summary of something the reader cannot yet see, and the
+   * trimmed empty string is normalized to null so the panel has exactly one
+   * "no TL;DR" shape to render.
+   */
+  const analysisTldr: string | null = analysisMarkdown
+    ? (run.analysisTldr || "").trim() || null
+    : null;
+
+  /*
+   * The selected column also travels inside the serialized run, so the gate
+   * above has to be applied there too — otherwise a client reading
+   * run.analysisTldr would show a summary of a report the payload does not
+   * carry. One field, one rule: the summary exists only next to its report.
+   */
+  if (runJson) {
+    runJson["analysisTldr"] = analysisTldr;
+  }
+
   Response.sendJsonObjectResponse(req, res, {
     run: runJson || null,
     events: eventsJson,
     analysisMarkdown,
+    analysisTldr,
     isAnalysisPending,
   });
 }