@oneuptime/common 12.0.6 → 12.0.8

package/Server/Services/DeletedProjectService.ts

@@ -0,0 +1,138 @@
+import { IsBillingEnabled } from "../EnvironmentConfig";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import DatabaseService from "./DatabaseService";
+import UserService from "./UserService";
+import Model from "../../Models/DatabaseModels/DeletedProject";
+import Project from "../../Models/DatabaseModels/Project";
+import User from "../../Models/DatabaseModels/User";
+import OneUptimeDate from "../../Types/Date";
+import ObjectID from "../../Types/ObjectID";
+import Phone from "../../Types/Phone";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * Records a project that has just been deleted so the team can follow up with
+   * the customer. The project row is already gone by the time this runs, so
+   * everything written here has to come from the snapshot the caller took
+   * before the delete (ProjectService.onBeforeDelete).
+   *
+   * SaaS only. Self-hosted installs have no one to reach out to, and the
+   * gate lives here rather than at the call site so every caller gets it.
+   *
+   * Returns the row it wrote, or null when logging was skipped.
+   */
+  @CaptureSpan()
+  public async logProjectDeletion(data: {
+    project: Project;
+    deletedByUserId?: ObjectID | undefined;
+    deletionReason?: string | undefined;
+  }): Promise<Model | null> {
+    if (!IsBillingEnabled) {
+      return null;
+    }
+
+    const project: Project = data.project;
+
+    if (!project.id) {
+      return null;
+    }
+
+    /*
+     * Who to reach out to. The user who deleted the project is usually also
+     * the one who created it - reuse the snapshot in that case instead of
+     * spending a query on it.
+     */
+    let deletedByUser: User | null = null;
+
+    if (data.deletedByUserId) {
+      if (
+        project.createdByUser &&
+        project.createdByUserId?.toString() === data.deletedByUserId.toString()
+      ) {
+        deletedByUser = project.createdByUser;
+      } else {
+        deletedByUser = await UserService.findOneById({
+          id: data.deletedByUserId,
+          select: {
+            _id: true,
+            name: true,
+            email: true,
+            companyName: true,
+            companyPhoneNumber: true,
+            companySize: true,
+            jobRole: true,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+      }
+    }
+
+    const createdByUser: User | undefined = project.createdByUser;
+
+    const deletedProject: Model = new Model();
+
+    deletedProject.projectId = project.id;
+    deletedProject.projectName = project.name || "";
+    deletedProject.projectSlug = project.slug;
+    deletedProject.projectCreatedAt = project.createdAt;
+    deletedProject.projectDeletedAt = OneUptimeDate.getCurrentDate();
+    deletedProject.deletionReason = data.deletionReason;
+
+    deletedProject.projectDeletedByUserId = data.deletedByUserId;
+    deletedProject.projectDeletedByUserName = deletedByUser?.name?.toString();
+    deletedProject.projectDeletedByUserEmail = deletedByUser?.email;
+
+    deletedProject.projectCreatedByUserId = project.createdByUserId;
+    deletedProject.projectCreatedByUserName = createdByUser?.name?.toString();
+    deletedProject.projectCreatedByUserEmail = createdByUser?.email;
+
+    /*
+     * Company details are collected at signup and hang off the User, so take
+     * them from whoever created the project and fall back to whoever deleted
+     * it - between the two there is usually one filled-in answer.
+     */
+    const companyName: string | undefined =
+      createdByUser?.companyName || deletedByUser?.companyName;
+    const companyPhoneNumber: Phone | undefined =
+      createdByUser?.companyPhoneNumber || deletedByUser?.companyPhoneNumber;
+    const companySize: string | undefined =
+      createdByUser?.companySize || deletedByUser?.companySize;
+    const jobRole: string | undefined =
+      createdByUser?.jobRole || deletedByUser?.jobRole;
+
+    deletedProject.companyName = companyName;
+    deletedProject.companyPhoneNumber = companyPhoneNumber;
+    deletedProject.companySize = companySize;
+    deletedProject.jobRole = jobRole;
+
+    deletedProject.planName = project.planName;
+    deletedProject.paymentProviderPlanId = project.paymentProviderPlanId;
+    deletedProject.paymentProviderCustomerId =
+      project.paymentProviderCustomerId;
+    deletedProject.paymentProviderSubscriptionId =
+      project.paymentProviderSubscriptionId;
+    deletedProject.paymentProviderSubscriptionStatus =
+      project.paymentProviderSubscriptionStatus;
+    deletedProject.paymentProviderSubscriptionSeats =
+      project.paymentProviderSubscriptionSeats;
+    deletedProject.trialEndsAt = project.trialEndsAt;
+
+    deletedProject.activeMonitorCount = project.currentActiveMonitorsCount;
+    deletedProject.wasProjectBlocked = project.isBlocked ?? false;
+
+    return await this.create({
+      data: deletedProject,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+}
+
+export default new Service();

package/Server/Services/FileService.ts

@@ -4,15 +4,30 @@ import FindBy from "../Types/Database/FindBy";
 import { OnCreate, OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import DatabaseService from "./DatabaseService";
+import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import File from "../../Models/DatabaseModels/File";
+import MimeType from "../../Types/File/MimeType";
+import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger from "../Utils/Logger";
 import crypto from "crypto";
 
 const generateImageAccessToken: () => string = (): string => {
   return crypto.randomBytes(32).toString("hex");
 };
 
+/*
+ * fileType is declared as MimeType but persisted as a varchar, so the enum
+ * buys nothing at runtime - the API will happily store "text/html" if a client
+ * asks for it. Response.sendFileResponse refuses to echo an unknown type back,
+ * but keeping junk out of the column in the first place means the stored row
+ * matches what we are willing to serve.
+ */
+const ALLOWED_MIME_TYPES: Set<string> = new Set<string>(
+  Object.values(MimeType),
+);
+
 export class Service extends DatabaseService<File> {
   public constructor() {
     super(File);
@@ -22,6 +37,18 @@ export class Service extends DatabaseService<File> {
   protected override async onBeforeCreate(
     createBy: CreateBy<File>,
   ): Promise<OnCreate<File>> {
+    const fileType: string = (createBy.data.fileType || "")
+      .trim()
+      .toLowerCase();
+
+    if (!ALLOWED_MIME_TYPES.has(fileType)) {
+      throw new BadDataException(
+        "This file type is not supported. Please upload a supported file type.",
+      );
+    }
+
+    createBy.data.fileType = fileType as MimeType;
+
     /*
      * Always generate an unguessable access token server-side. The token
      * is the only safe way to address an inline-uploaded image in
@@ -56,6 +83,40 @@ export class Service extends DatabaseService<File> {
     return { deleteBy, carryForward: null };
   }
 
+  /*
+   * Marks a file as anonymously readable. Uploads from the file picker
+   * arrive private, so attaching one as an intentionally public asset
+   * (probe icon, AI agent icon) is the point at which it becomes public
+   * — those are served by the id-based image route, which serves only
+   * public files. Best-effort: a visibility sync failure must never fail
+   * the write the user actually asked for.
+   */
+  @CaptureSpan()
+  public async makeFilePublic(
+    fileId: ObjectID | undefined | null,
+  ): Promise<void> {
+    if (!fileId) {
+      return;
+    }
+
+    try {
+      await this.updateOneById({
+        id: fileId,
+        data: {
+          isPublic: true,
+        },
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+    } catch (err) {
+      logger.error(
+        `Failed to mark file ${fileId.toString()} public: ${String(err)}`,
+      );
+    }
+  }
+
   @CaptureSpan()
   protected override async onBeforeFind(
     findBy: FindBy<File>,

package/Server/Services/IncidentEpisodePublicNoteService.ts

@@ -14,6 +14,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
 import File from "../../Models/DatabaseModels/File";
 import FileAttachmentMarkdownUtil from "../Utils/FileAttachmentMarkdownUtil";
+import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -116,6 +117,17 @@ export class Service extends DatabaseService<Model> {
     const userId: ObjectID | null | undefined =
       createdItem.createdByUserId || createdItem.createdByUser?.id;
 
+    /*
+     * A public note is always rendered on the status page, so any inline
+     * image the markdown editor uploaded as private must flip to public
+     * for anonymous status page viewers to be able to render it.
+     */
+    await syncIsPublicForMarkdownImages(
+      createdItem.note,
+      true,
+      `incident episode public note ${createdItem.id?.toString()}`,
+    );
+
     const incidentEpisodeId: ObjectID = createdItem.incidentEpisodeId!;
     const projectId: ObjectID = createdItem.projectId!;
     const episodeNumberResult: {
@@ -185,6 +197,12 @@ ${(createdItem.note || "") + attachmentsMarkdown}
       for (const updatedItem of updatedItems) {
         const episode: IncidentEpisode = updatedItem.incidentEpisode!;
 
+        await syncIsPublicForMarkdownImages(
+          updatedItem.note,
+          true,
+          `incident episode public note ${updatedItem.id?.toString()}`,
+        );
+
         const attachmentsMarkdown: string = await this.getAttachmentsMarkdown(
           updatedItem.id!,
           "/incident-episode-public-note/attachment",

package/Server/Services/IncidentPublicNoteService.ts

@@ -14,6 +14,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
 import File from "../../Models/DatabaseModels/File";
 import FileAttachmentMarkdownUtil from "../Utils/FileAttachmentMarkdownUtil";
+import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -116,6 +117,17 @@ export class Service extends DatabaseService<Model> {
     const userId: ObjectID | null | undefined =
       createdItem.createdByUserId || createdItem.createdByUser?.id;
 
+    /*
+     * A public note is always rendered on the status page, so any inline
+     * image the markdown editor uploaded as private must flip to public
+     * for anonymous status page viewers to be able to render it.
+     */
+    await syncIsPublicForMarkdownImages(
+      createdItem.note,
+      true,
+      `incident public note ${createdItem.id?.toString()}`,
+    );
+
     const incidentId: ObjectID = createdItem.incidentId!;
     const projectId: ObjectID = createdItem.projectId!;
     const incidentNumberResult: {
@@ -187,6 +199,12 @@ ${(createdItem.note || "") + attachmentsMarkdown}
       for (const updatedItem of updatedItems) {
         const incident: Incident = updatedItem.incident!;
 
+        await syncIsPublicForMarkdownImages(
+          updatedItem.note,
+          true,
+          `incident public note ${updatedItem.id?.toString()}`,
+        );
+
         const attachmentsMarkdown: string = await this.getAttachmentsMarkdown(
           updatedItem.id!,
           "/incident-public-note/attachment",

package/Server/Services/Index.ts

@@ -283,10 +283,12 @@ import NetworkFlowService from "./NetworkFlowService";
 import OnCallDutyPolicyTimeLogService from "./OnCallDutyPolicyTimeLogService";
 import ProjectSCIMLogService from "./ProjectSCIMLogService";
 import StatusPageSCIMLogService from "./StatusPageSCIMLogService";
+import DeletedProjectService from "./DeletedProjectService";
 
 const services: Array<BaseService> = [
   OnCallDutyPolicyTimeLogService,
   AcmeCertificateService,
+  DeletedProjectService,
   PromoCodeService,
   EnterpriseLicenseService,
   EnterpriseLicenseInstanceService,

package/Server/Services/MonitorService.ts

@@ -464,9 +464,307 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    if (
+      updateBy.data.dependsOnMonitors !== undefined ||
+      updateBy.data.suppressAlertsWhenParentMonitorStatuses !== undefined
+    ) {
+      /*
+       * The matched monitors' own ids (self/cycle checks) and projects
+       * (parent scoping) are needed; root/API updates do not always carry
+       * a tenantId. Validation itself is hoisted: the proposed lists are
+       * identical for every matched monitor, so existence/project checks
+       * run once per distinct project and the cycle walk runs once for
+       * all targets — not once per monitor (a bulk update could match
+       * thousands).
+       */
+      const monitorsToValidate: Array<Model> = await this.findBy({
+        query: updateBy.query,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+
+      await this.validateDependencyConfiguration({
+        targets: monitorsToValidate.map((monitor: Model) => {
+          return {
+            monitorId: monitor.id || null,
+            projectId: updateBy.props.tenantId || monitor.projectId || null,
+          };
+        }),
+        proposedParents: updateBy.data.dependsOnMonitors,
+        proposedSuppressionStatuses:
+          updateBy.data.suppressAlertsWhenParentMonitorStatuses,
+      });
+    }
+
     return { updateBy, carryForward: null };
   }
 
+  /*
+   * Guards for the alert-dependency configuration. `undefined` means "not
+   * part of this write" and validates nothing; null or an empty array
+   * (clearing the config) is always valid. The proposed lists arrive in
+   * whatever shape the API produced — relation objects, ObjectIDs, or
+   * bare uuid strings (which DatabaseService.sanitizeCreateOrUpdate only
+   * converts to entities AFTER this hook has run) — so extraction goes
+   * through resolveReferenceId, and every id comparison is normalized to
+   * lower case because Postgres matches uuids case-insensitively while
+   * ObjectID preserves the caller's casing.
+   */
+  public async validateDependencyConfiguration(input: {
+    /**
+     * The monitors this write applies to. monitorId is null on create —
+     * a new monitor cannot be part of a cycle yet.
+     */
+    targets: Array<{
+      monitorId: ObjectID | null;
+      projectId: ObjectID | null;
+    }>;
+    proposedParents: unknown;
+    proposedSuppressionStatuses: unknown;
+  }): Promise<void> {
+    const distinctProjectIds: Array<ObjectID> = [];
+    const seenProjectIds: Set<string> = new Set<string>();
+
+    for (const target of input.targets) {
+      const key: string | undefined = target.projectId
+        ?.toString()
+        .trim()
+        .toLowerCase();
+
+      if (key && !seenProjectIds.has(key)) {
+        seenProjectIds.add(key);
+        distinctProjectIds.push(target.projectId!);
+      }
+    }
+
+    if (input.proposedParents !== undefined) {
+      const parentIds: Array<ObjectID> = this.extractRelationIds(
+        input.proposedParents,
+      );
+
+      if (parentIds.length > 0) {
+        const parentIdSet: Set<string> = new Set<string>(
+          parentIds.map((id: ObjectID) => {
+            return id.toString();
+          }),
+        );
+
+        for (const target of input.targets) {
+          const targetKey: string | undefined = target.monitorId
+            ?.toString()
+            .trim()
+            .toLowerCase();
+
+          if (targetKey && parentIdSet.has(targetKey)) {
+            throw new BadDataException("A monitor cannot depend on itself.");
+          }
+        }
+
+        /*
+         * Existence + same-project via the house validator (which owns
+         * the case normalization and message wording). Once per distinct
+         * project: parents must belong to every matched monitor's
+         * project, so a cross-project bulk update correctly fails.
+         */
+        for (const projectId of distinctProjectIds) {
+          await ProjectScopedReferenceValidator.validateReferencesBelongToProject(
+            {
+              projectId: projectId,
+              subject: "monitor",
+              references: parentIds.map((parentId: ObjectID) => {
+                return {
+                  modelName: "Monitor",
+                  id: parentId,
+                  service: this,
+                };
+              }),
+            },
+          );
+        }
+
+        const targetMonitorIds: Array<ObjectID> = input.targets
+          .map((target: { monitorId: ObjectID | null }) => {
+            return target.monitorId;
+          })
+          .filter((monitorId: ObjectID | null): monitorId is ObjectID => {
+            return Boolean(monitorId);
+          });
+
+        if (targetMonitorIds.length > 0) {
+          await this.throwIfDependencyCycle({
+            targetMonitorIds,
+            proposedParentIds: parentIds,
+          });
+        }
+      }
+    }
+
+    if (input.proposedSuppressionStatuses !== undefined) {
+      const statusIds: Array<ObjectID> = this.extractRelationIds(
+        input.proposedSuppressionStatuses,
+      );
+
+      if (statusIds.length > 0) {
+        for (const projectId of distinctProjectIds) {
+          await ProjectScopedReferenceValidator.validateReferencesBelongToProject(
+            {
+              projectId: projectId,
+              subject: "monitor",
+              references: statusIds.map((statusId: ObjectID) => {
+                return {
+                  modelName: "Monitor Status",
+                  id: statusId,
+                  service: MonitorStatusService,
+                };
+              }),
+            },
+          );
+        }
+      }
+    }
+  }
+
+  /*
+   * Walk the dependency graph upward from the proposed parents; reaching
+   * any monitor being updated means the write would close a cycle, which
+   * would make suppression self-referential (A suppressed because of B,
+   * B suppressed because of A) and must be rejected. One BFS covers every
+   * target of a bulk update. The visited set bounds the walk even if a
+   * cycle already exists among ancestors, and the depth cap keeps the
+   * check cheap on degenerate graphs.
+   *
+   * This validates committed state, so two updates racing each other can
+   * still jointly commit a cycle this walk could not see; the runtime
+   * mutual-cycle guard in MonitorDependencySuppression fails open (pages
+   * instead of suppressing) if that ever happens.
+   */
+  private async throwIfDependencyCycle(input: {
+    targetMonitorIds: Array<ObjectID>;
+    proposedParentIds: Array<ObjectID>;
+  }): Promise<void> {
+    const maxDepth: number = 32;
+
+    const targetIdSet: Set<string> = new Set<string>(
+      input.targetMonitorIds.map((monitorId: ObjectID) => {
+        return monitorId.toString().trim().toLowerCase();
+      }),
+    );
+
+    const visited: Set<string> = new Set<string>();
+    let frontier: Array<ObjectID> = [...input.proposedParentIds];
+
+    for (let depth: number = 0; depth < maxDepth; depth++) {
+      if (frontier.length === 0) {
+        return;
+      }
+
+      if (
+        frontier.some((id: ObjectID) => {
+          return targetIdSet.has(id.toString().trim().toLowerCase());
+        })
+      ) {
+        throw new BadDataException(
+          "This dependency would create a cycle: one of the selected monitors (or a monitor it depends on) already depends on this monitor.",
+        );
+      }
+
+      for (const id of frontier) {
+        visited.add(id.toString().trim().toLowerCase());
+      }
+
+      const rows: Array<Model> = await this.findBy({
+        query: {
+          _id: QueryHelper.any(frontier),
+        },
+        select: {
+          _id: true,
+          dependsOnMonitors: {
+            _id: true,
+          },
+        },
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      /*
+       * Fail CLOSED on truncation: a frontier level wider than the query
+       * limit means ancestors were dropped and a real cycle routed
+       * through the remainder would be admitted. Refuse instead — the
+       * sibling existence check fails closed the same way.
+       */
+      if (rows.length >= LIMIT_PER_PROJECT) {
+        throw new BadDataException(
+          "This dependency graph is too large to verify for cycles. Please reduce the number of monitors sharing one dependency level.",
+        );
+      }
+
+      const next: Array<ObjectID> = [];
+
+      for (const row of rows) {
+        for (const grandParentId of this.extractRelationIds(
+          row.dependsOnMonitors || [],
+        )) {
+          if (!visited.has(grandParentId.toString())) {
+            next.push(grandParentId);
+            visited.add(grandParentId.toString());
+          }
+        }
+      }
+
+      frontier = next;
+    }
+
+    if (frontier.length > 0) {
+      throw new BadDataException(
+        `Monitor dependency chains deeper than ${maxDepth} levels are not supported.`,
+      );
+    }
+  }
+
+  /*
+   * Ids arrive as relation objects ({_id}), ObjectIDs, or bare uuid
+   * strings depending on which API path produced the payload —
+   * resolveReferenceId handles all three (reading only ._id/.id here
+   * silently missed the bare-string shape, which DatabaseService
+   * persists). Returned ids are normalized to lower case so every
+   * comparison downstream matches the way Postgres matches uuids. null /
+   * non-array input (explicit null is TypeORM's clear-all for relation
+   * columns) yields an empty list: nothing to validate.
+   */
+  private extractRelationIds(relationArray: unknown): Array<ObjectID> {
+    if (!Array.isArray(relationArray)) {
+      return [];
+    }
+
+    const ids: Array<ObjectID> = [];
+    const seen: Set<string> = new Set<string>();
+
+    for (const item of relationArray) {
+      const rawId: string | undefined = resolveReferenceId(item)
+        ?.toString()
+        .trim()
+        .toLowerCase();
+
+      if (rawId && !seen.has(rawId)) {
+        seen.add(rawId);
+        ids.push(new ObjectID(rawId));
+      }
+    }
+
+    return ids;
+  }
+
   private async getProjectIdsForUpdateQuery(
     updateBy: UpdateBy<Model>,
   ): Promise<Array<ObjectID>> {
@@ -781,6 +1079,19 @@ export class Service extends DatabaseService<Model> {
       projectId: createBy.props.tenantId,
     });
 
+    await this.validateDependencyConfiguration({
+      // A new monitor cannot be part of a cycle yet, hence monitorId null.
+      targets: [
+        {
+          monitorId: null,
+          projectId: createBy.props.tenantId,
+        },
+      ],
+      proposedParents: createBy.data.dependsOnMonitors,
+      proposedSuppressionStatuses:
+        createBy.data.suppressAlertsWhenParentMonitorStatuses,
+    });
+
     /*
      * A new monitor starts in the project's operational status. A project can
      * hold MORE than one operational state (a user - or an E2E fixture - can

package/Server/Services/ProbeService.ts

@@ -29,6 +29,7 @@ import DatabaseConfig from "../DatabaseConfig";
 import URL from "../../Types/API/URL";
 import UpdateBy from "../Types/Database/UpdateBy";
 import MonitorService from "./MonitorService";
+import FileService from "./FileService";
 import PushNotificationMessage from "../../Types/PushNotification/PushNotificationMessage";
 import PushNotificationUtil from "../Utils/PushNotificationUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -435,6 +436,21 @@ export class Service extends DatabaseService<Model> {
     return { createBy: createBy, carryForward: [] };
   }
 
+  /*
+   * A probe icon is rendered by the id-based image route, which serves
+   * only public files. The file picker uploads it private, so attaching
+   * it to a probe is the point at which it becomes public.
+   */
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    await FileService.makeFilePublic(createdItem.iconFileId);
+
+    return createdItem;
+  }
+
   /*
    * Only global probes and probes belonging to this project may be attached to
    * that project's monitors. Probe ids reach the server from the browser - the
@@ -626,6 +642,10 @@ export class Service extends DatabaseService<Model> {
       await this.invalidateProbeAuthCache(updatedItemIds);
     }
 
+    await FileService.makeFilePublic(
+      onUpdate.updateBy.data.iconFileId as ObjectID | undefined,
+    );
+
     if (
       onUpdate.carryForward &&
       onUpdate.carryForward.probesToNotifyOwners.length > 0