@oneuptime/common 12.0.6 → 12.0.7

package/Server/Services/MonitorService.ts

@@ -464,9 +464,307 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    if (
+      updateBy.data.dependsOnMonitors !== undefined ||
+      updateBy.data.suppressAlertsWhenParentMonitorStatuses !== undefined
+    ) {
+      /*
+       * The matched monitors' own ids (self/cycle checks) and projects
+       * (parent scoping) are needed; root/API updates do not always carry
+       * a tenantId. Validation itself is hoisted: the proposed lists are
+       * identical for every matched monitor, so existence/project checks
+       * run once per distinct project and the cycle walk runs once for
+       * all targets — not once per monitor (a bulk update could match
+       * thousands).
+       */
+      const monitorsToValidate: Array<Model> = await this.findBy({
+        query: updateBy.query,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+
+      await this.validateDependencyConfiguration({
+        targets: monitorsToValidate.map((monitor: Model) => {
+          return {
+            monitorId: monitor.id || null,
+            projectId: updateBy.props.tenantId || monitor.projectId || null,
+          };
+        }),
+        proposedParents: updateBy.data.dependsOnMonitors,
+        proposedSuppressionStatuses:
+          updateBy.data.suppressAlertsWhenParentMonitorStatuses,
+      });
+    }
+
     return { updateBy, carryForward: null };
   }
 
+  /*
+   * Guards for the alert-dependency configuration. `undefined` means "not
+   * part of this write" and validates nothing; null or an empty array
+   * (clearing the config) is always valid. The proposed lists arrive in
+   * whatever shape the API produced — relation objects, ObjectIDs, or
+   * bare uuid strings (which DatabaseService.sanitizeCreateOrUpdate only
+   * converts to entities AFTER this hook has run) — so extraction goes
+   * through resolveReferenceId, and every id comparison is normalized to
+   * lower case because Postgres matches uuids case-insensitively while
+   * ObjectID preserves the caller's casing.
+   */
+  public async validateDependencyConfiguration(input: {
+    /**
+     * The monitors this write applies to. monitorId is null on create —
+     * a new monitor cannot be part of a cycle yet.
+     */
+    targets: Array<{
+      monitorId: ObjectID | null;
+      projectId: ObjectID | null;
+    }>;
+    proposedParents: unknown;
+    proposedSuppressionStatuses: unknown;
+  }): Promise<void> {
+    const distinctProjectIds: Array<ObjectID> = [];
+    const seenProjectIds: Set<string> = new Set<string>();
+
+    for (const target of input.targets) {
+      const key: string | undefined = target.projectId
+        ?.toString()
+        .trim()
+        .toLowerCase();
+
+      if (key && !seenProjectIds.has(key)) {
+        seenProjectIds.add(key);
+        distinctProjectIds.push(target.projectId!);
+      }
+    }
+
+    if (input.proposedParents !== undefined) {
+      const parentIds: Array<ObjectID> = this.extractRelationIds(
+        input.proposedParents,
+      );
+
+      if (parentIds.length > 0) {
+        const parentIdSet: Set<string> = new Set<string>(
+          parentIds.map((id: ObjectID) => {
+            return id.toString();
+          }),
+        );
+
+        for (const target of input.targets) {
+          const targetKey: string | undefined = target.monitorId
+            ?.toString()
+            .trim()
+            .toLowerCase();
+
+          if (targetKey && parentIdSet.has(targetKey)) {
+            throw new BadDataException("A monitor cannot depend on itself.");
+          }
+        }
+
+        /*
+         * Existence + same-project via the house validator (which owns
+         * the case normalization and message wording). Once per distinct
+         * project: parents must belong to every matched monitor's
+         * project, so a cross-project bulk update correctly fails.
+         */
+        for (const projectId of distinctProjectIds) {
+          await ProjectScopedReferenceValidator.validateReferencesBelongToProject(
+            {
+              projectId: projectId,
+              subject: "monitor",
+              references: parentIds.map((parentId: ObjectID) => {
+                return {
+                  modelName: "Monitor",
+                  id: parentId,
+                  service: this,
+                };
+              }),
+            },
+          );
+        }
+
+        const targetMonitorIds: Array<ObjectID> = input.targets
+          .map((target: { monitorId: ObjectID | null }) => {
+            return target.monitorId;
+          })
+          .filter((monitorId: ObjectID | null): monitorId is ObjectID => {
+            return Boolean(monitorId);
+          });
+
+        if (targetMonitorIds.length > 0) {
+          await this.throwIfDependencyCycle({
+            targetMonitorIds,
+            proposedParentIds: parentIds,
+          });
+        }
+      }
+    }
+
+    if (input.proposedSuppressionStatuses !== undefined) {
+      const statusIds: Array<ObjectID> = this.extractRelationIds(
+        input.proposedSuppressionStatuses,
+      );
+
+      if (statusIds.length > 0) {
+        for (const projectId of distinctProjectIds) {
+          await ProjectScopedReferenceValidator.validateReferencesBelongToProject(
+            {
+              projectId: projectId,
+              subject: "monitor",
+              references: statusIds.map((statusId: ObjectID) => {
+                return {
+                  modelName: "Monitor Status",
+                  id: statusId,
+                  service: MonitorStatusService,
+                };
+              }),
+            },
+          );
+        }
+      }
+    }
+  }
+
+  /*
+   * Walk the dependency graph upward from the proposed parents; reaching
+   * any monitor being updated means the write would close a cycle, which
+   * would make suppression self-referential (A suppressed because of B,
+   * B suppressed because of A) and must be rejected. One BFS covers every
+   * target of a bulk update. The visited set bounds the walk even if a
+   * cycle already exists among ancestors, and the depth cap keeps the
+   * check cheap on degenerate graphs.
+   *
+   * This validates committed state, so two updates racing each other can
+   * still jointly commit a cycle this walk could not see; the runtime
+   * mutual-cycle guard in MonitorDependencySuppression fails open (pages
+   * instead of suppressing) if that ever happens.
+   */
+  private async throwIfDependencyCycle(input: {
+    targetMonitorIds: Array<ObjectID>;
+    proposedParentIds: Array<ObjectID>;
+  }): Promise<void> {
+    const maxDepth: number = 32;
+
+    const targetIdSet: Set<string> = new Set<string>(
+      input.targetMonitorIds.map((monitorId: ObjectID) => {
+        return monitorId.toString().trim().toLowerCase();
+      }),
+    );
+
+    const visited: Set<string> = new Set<string>();
+    let frontier: Array<ObjectID> = [...input.proposedParentIds];
+
+    for (let depth: number = 0; depth < maxDepth; depth++) {
+      if (frontier.length === 0) {
+        return;
+      }
+
+      if (
+        frontier.some((id: ObjectID) => {
+          return targetIdSet.has(id.toString().trim().toLowerCase());
+        })
+      ) {
+        throw new BadDataException(
+          "This dependency would create a cycle: one of the selected monitors (or a monitor it depends on) already depends on this monitor.",
+        );
+      }
+
+      for (const id of frontier) {
+        visited.add(id.toString().trim().toLowerCase());
+      }
+
+      const rows: Array<Model> = await this.findBy({
+        query: {
+          _id: QueryHelper.any(frontier),
+        },
+        select: {
+          _id: true,
+          dependsOnMonitors: {
+            _id: true,
+          },
+        },
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      /*
+       * Fail CLOSED on truncation: a frontier level wider than the query
+       * limit means ancestors were dropped and a real cycle routed
+       * through the remainder would be admitted. Refuse instead — the
+       * sibling existence check fails closed the same way.
+       */
+      if (rows.length >= LIMIT_PER_PROJECT) {
+        throw new BadDataException(
+          "This dependency graph is too large to verify for cycles. Please reduce the number of monitors sharing one dependency level.",
+        );
+      }
+
+      const next: Array<ObjectID> = [];
+
+      for (const row of rows) {
+        for (const grandParentId of this.extractRelationIds(
+          row.dependsOnMonitors || [],
+        )) {
+          if (!visited.has(grandParentId.toString())) {
+            next.push(grandParentId);
+            visited.add(grandParentId.toString());
+          }
+        }
+      }
+
+      frontier = next;
+    }
+
+    if (frontier.length > 0) {
+      throw new BadDataException(
+        `Monitor dependency chains deeper than ${maxDepth} levels are not supported.`,
+      );
+    }
+  }
+
+  /*
+   * Ids arrive as relation objects ({_id}), ObjectIDs, or bare uuid
+   * strings depending on which API path produced the payload —
+   * resolveReferenceId handles all three (reading only ._id/.id here
+   * silently missed the bare-string shape, which DatabaseService
+   * persists). Returned ids are normalized to lower case so every
+   * comparison downstream matches the way Postgres matches uuids. null /
+   * non-array input (explicit null is TypeORM's clear-all for relation
+   * columns) yields an empty list: nothing to validate.
+   */
+  private extractRelationIds(relationArray: unknown): Array<ObjectID> {
+    if (!Array.isArray(relationArray)) {
+      return [];
+    }
+
+    const ids: Array<ObjectID> = [];
+    const seen: Set<string> = new Set<string>();
+
+    for (const item of relationArray) {
+      const rawId: string | undefined = resolveReferenceId(item)
+        ?.toString()
+        .trim()
+        .toLowerCase();
+
+      if (rawId && !seen.has(rawId)) {
+        seen.add(rawId);
+        ids.push(new ObjectID(rawId));
+      }
+    }
+
+    return ids;
+  }
+
   private async getProjectIdsForUpdateQuery(
     updateBy: UpdateBy<Model>,
   ): Promise<Array<ObjectID>> {
@@ -781,6 +1079,19 @@ export class Service extends DatabaseService<Model> {
       projectId: createBy.props.tenantId,
     });
 
+    await this.validateDependencyConfiguration({
+      // A new monitor cannot be part of a cycle yet, hence monitorId null.
+      targets: [
+        {
+          monitorId: null,
+          projectId: createBy.props.tenantId,
+        },
+      ],
+      proposedParents: createBy.data.dependsOnMonitors,
+      proposedSuppressionStatuses:
+        createBy.data.suppressAlertsWhenParentMonitorStatuses,
+    });
+
     /*
      * A new monitor starts in the project's operational status. A project can
      * hold MORE than one operational state (a user - or an E2E fixture - can

package/Server/Services/ProbeService.ts

@@ -29,6 +29,7 @@ import DatabaseConfig from "../DatabaseConfig";
 import URL from "../../Types/API/URL";
 import UpdateBy from "../Types/Database/UpdateBy";
 import MonitorService from "./MonitorService";
+import FileService from "./FileService";
 import PushNotificationMessage from "../../Types/PushNotification/PushNotificationMessage";
 import PushNotificationUtil from "../Utils/PushNotificationUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -435,6 +436,21 @@ export class Service extends DatabaseService<Model> {
     return { createBy: createBy, carryForward: [] };
   }
 
+  /*
+   * A probe icon is rendered by the id-based image route, which serves
+   * only public files. The file picker uploads it private, so attaching
+   * it to a probe is the point at which it becomes public.
+   */
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    await FileService.makeFilePublic(createdItem.iconFileId);
+
+    return createdItem;
+  }
+
   /*
    * Only global probes and probes belonging to this project may be attached to
    * that project's monitors. Probe ids reach the server from the browser - the
@@ -626,6 +642,10 @@ export class Service extends DatabaseService<Model> {
       await this.invalidateProbeAuthCache(updatedItemIds);
     }
 
+    await FileService.makeFilePublic(
+      onUpdate.updateBy.data.iconFileId as ObjectID | undefined,
+    );
+
     if (
       onUpdate.carryForward &&
       onUpdate.carryForward.probesToNotifyOwners.length > 0