@oneuptime/common 12.0.6 → 12.0.8

package/Server/Services/WorkspaceNotificationRuleService.ts

@@ -309,6 +309,20 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
 
             // Check for errors in the response
             if (res.errors && res.errors.length > 0) {
+              /*
+               * Record the failure before throwing. Test sends used to throw
+               * straight out of here, so a failed test left no trace in
+               * Notification Logs and support had no way to see what Microsoft
+               * or Slack actually said.
+               */
+              await this.logTestSendFailures({
+                projectId: data.projectId,
+                workspaceType: res.workspaceType,
+                errors: res.errors,
+                message: messageSummary,
+                userId: data.testByUserId,
+              });
+
               const errorMessages: Array<string> = res.errors.map(
                 (error: { channel: WorkspaceChannel; error: string }) => {
                   return `Channel ${error.channel.name}: ${error.error}`;
@@ -408,6 +422,20 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
 
             // Check for errors in the response
             if (res.errors && res.errors.length > 0) {
+              /*
+               * Record the failure before throwing. Test sends used to throw
+               * straight out of here, so a failed test left no trace in
+               * Notification Logs and support had no way to see what Microsoft
+               * or Slack actually said.
+               */
+              await this.logTestSendFailures({
+                projectId: data.projectId,
+                workspaceType: res.workspaceType,
+                errors: res.errors,
+                message: messageSummary,
+                userId: data.testByUserId,
+              });
+
               const errorMessages: Array<string> = res.errors.map(
                 (error: { channel: WorkspaceChannel; error: string }) => {
                   return `Channel ${error.channel.name}: ${error.error}`;
@@ -540,6 +568,47 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
     }
   }
 
+  /*
+   * Persist per-destination failures from a test send so they show up in
+   * Settings > Notification Logs alongside real notification failures. Real
+   * sends already log; test sends threw before reaching any logging, which
+   * meant the one action an admin takes to diagnose a broken integration was
+   * also the only one that recorded nothing.
+   *
+   * Best-effort: a logging failure must never mask the underlying send error.
+   */
+  @CaptureSpan()
+  private async logTestSendFailures(data: {
+    projectId: ObjectID;
+    workspaceType: WorkspaceType;
+    errors: Array<{ channel: WorkspaceChannel; error: string }>;
+    message: string;
+    userId: ObjectID;
+  }): Promise<void> {
+    for (const error of data.errors) {
+      try {
+        const log: WorkspaceNotificationLog = new WorkspaceNotificationLog();
+        log.projectId = data.projectId;
+        log.workspaceType = data.workspaceType;
+        log.channelId = error.channel.id;
+        log.channelName = error.channel.name;
+        log.message = data.message;
+        log.status = WorkspaceNotificationStatus.Error;
+        log.statusMessage = error.error;
+        log.userId = data.userId;
+        log.actionType = WorkspaceNotificationActionType.SendMessage;
+
+        await WorkspaceNotificationLogService.create({
+          data: log,
+          props: { isRoot: true },
+        });
+      } catch (err) {
+        logger.error("Could not write test-send failure to notification log:");
+        logger.error(err);
+      }
+    }
+  }
+
   @CaptureSpan()
   public async archiveWorkspaceChannels(data: {
     projectId: ObjectID;

package/Server/Services/WorkspaceProjectAuthTokenService.ts

@@ -1,5 +1,7 @@
 import ObjectID from "../../Types/ObjectID";
-import WorkspaceType from "../../Types/Workspace/WorkspaceType";
+import WorkspaceType, {
+  getWorkspaceTypeDisplayName,
+} from "../../Types/Workspace/WorkspaceType";
 import DatabaseService from "./DatabaseService";
 import Model, {
   WorkspaceMiscData,
@@ -7,6 +9,7 @@ import Model, {
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -112,12 +115,45 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         _id: true,
+        workspaceProjectId: true,
       },
       props: {
         isRoot: true,
       },
     });
 
+    /*
+     * A project stores exactly one workspace (one Microsoft tenant / one Slack
+     * team). Re-running the connect flow from a DIFFERENT workspace used to
+     * silently repoint the project, which breaks every existing notification
+     * rule and orphans the bot conversations captured under the old workspace —
+     * with no error and nothing in the logs.
+     *
+     * Refuse instead, and tell the admin to disconnect first if the change is
+     * deliberate.
+     */
+    if (
+      projectAuth &&
+      projectAuth.workspaceProjectId &&
+      projectAuth.workspaceProjectId !== data.workspaceProjectId
+    ) {
+      logger.error(
+        `Refusing to repoint ${data.workspaceType} for project ${data.projectId.toString()} from workspace ${projectAuth.workspaceProjectId} to ${data.workspaceProjectId}.`,
+        {
+          projectId: data.projectId.toString(),
+          workspaceType: data.workspaceType,
+        },
+      );
+
+      const workspaceName: string = getWorkspaceTypeDisplayName(
+        data.workspaceType,
+      );
+
+      throw new BadDataException(
+        `This OneUptime project is already connected to a different ${workspaceName} workspace. Disconnect the existing ${workspaceName} connection in Project Settings before connecting a new one.`,
+      );
+    }
+
     if (!projectAuth) {
       projectAuth = new Model();
 

package/Server/Types/Database/DeleteById.ts

@@ -5,5 +5,7 @@ import User from "../../../Models/DatabaseModels/User";
 export default interface DeleteById {
   id: ObjectID;
   deletedByUser?: User;
+  // See DeleteOneBy.deletionReason - passed straight through to the hooks.
+  deletionReason?: string | undefined;
   props: DatabaseCommonInteractionProps;
 }

package/Server/Types/Database/DeleteOneBy.ts

@@ -6,5 +6,11 @@ import User from "../../../Models/DatabaseModels/User";
 export default interface DeleteOneBy<TBaseModel extends BaseModel> {
   query: Query<TBaseModel>;
   deletedByUser?: User | undefined;
+  /*
+   * Free-text reason the caller gave for the delete. Never persisted on the
+   * row being deleted (it is about to be gone) - it rides through to the
+   * delete hooks, which are the last place that can record it anywhere.
+   */
+  deletionReason?: string | undefined;
   props: DatabaseCommonInteractionProps;
 }

package/Server/Types/Domain.ts

@@ -4,8 +4,49 @@ import { PromiseRejectErrorFunction } from "../../Types/FunctionTypes";
 import dns from "dns";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import BadDataException from "../../Types/Exception/BadDataException";
+import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
+import HTTPResponse from "../../Types/API/HTTPResponse";
+import { JSONObject } from "../../Types/JSON";
+import URL from "../../Types/API/URL";
+import API from "../../Utils/API";
+import DataSourceEgressGuard from "../Utils/DataSource/EgressGuard";
 
 export default class Domain extends DomainCommon {
+  /*
+   * GET a domain-verification URL built from a tenant-supplied domain.
+   *
+   * Both the status page and the dashboard build these URLs by interpolating
+   * a customer domain into a string, and the certificate cron re-fetches them
+   * unattended every 15 minutes — so the target has to be validated on every
+   * call, not just when the row was written. The address that was validated
+   * is pinned into the socket, and redirects are refused so a 3xx cannot
+   * bounce the request to a host that was never checked. (The callers try
+   * http first and https second, so the ordinary http→https redirect a
+   * customer proxy emits is still covered by the https attempt.)
+   *
+   * Private ranges stay reachable on self-hosted installs, where a status page
+   * domain legitimately resolves inside the corporate network.
+   */
+  @CaptureSpan()
+  public static async getForDomainVerification(data: {
+    url: string;
+    targetLabel: string;
+  }): Promise<HTTPErrorResponse | HTTPResponse<JSONObject>> {
+    const { httpAgent, httpsAgent } =
+      await DataSourceEgressGuard.assertUrlAllowedAndPin(data.url, {
+        targetLabel: data.targetLabel,
+      });
+
+    return API.get<JSONObject>({
+      url: URL.fromString(data.url),
+      options: {
+        doNotFollowRedirects: true,
+        httpAgent,
+        httpsAgent,
+      },
+    });
+  }
+
   @CaptureSpan()
   public static getCnameRecords(data: { domain: string }): Promise<string[]> {
     return new Promise(

package/Server/Types/Workflow/Components/API/Delete.ts

@@ -37,7 +37,7 @@ export default class ApiDelete extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -46,6 +46,7 @@ export default class ApiDelete extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       /*

package/Server/Types/Workflow/Components/API/Get.ts

@@ -37,7 +37,7 @@ export default class ApiGet extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -46,6 +46,7 @@ export default class ApiGet extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       /*

package/Server/Types/Workflow/Components/API/Patch.ts

@@ -37,7 +37,7 @@ export default class ApiPut extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -46,6 +46,7 @@ export default class ApiPut extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       /*

package/Server/Types/Workflow/Components/API/Post.ts

@@ -38,7 +38,7 @@ export default class ApiPost extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -77,6 +77,7 @@ export default class ApiPost extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       logger.debug("API Post Component is done.", workflowLogAttributes);

package/Server/Types/Workflow/Components/API/Put.ts

@@ -37,7 +37,7 @@ export default class ApiPut extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -46,6 +46,7 @@ export default class ApiPut extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       /*

package/Server/Types/Workflow/Components/API/Utils.ts

@@ -3,14 +3,27 @@ import HTTPErrorResponse from "../../../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../../../Types/API/HTTPResponse";
 import URL from "../../../../../Types/API/URL";
 import BadDataException from "../../../../../Types/Exception/BadDataException";
-import { JSONObject } from "../../../../../Types/JSON";
+import Exception from "../../../../../Types/Exception/Exception";
+import { JSONObject, JSONValue } from "../../../../../Types/JSON";
 import JSONFunctions from "../../../../../Types/JSONFunctions";
 import ComponentMetadata, {
   Port,
 } from "../../../../../Types/Workflow/Component";
+import { RequestOptions } from "../../../../../Utils/API";
+import SSRFProtection from "../../../../Utils/SSRFProtection";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
 
 export class ApiComponentUtils {
+  /*
+   * Every API component sends its request with these. Redirects MUST stay off:
+   * sanitizeArgs validates the URL before the request is dispatched, and a
+   * validated public host that answers 302 -> http://169.254.169.254/ would
+   * otherwise walk the server straight past that check.
+   */
+  public static readonly requestOptions: RequestOptions = {
+    doNotFollowRedirects: true,
+  };
+
   @CaptureSpan()
   public static getReturnValues(
     response: HTTPResponse<JSONObject> | HTTPErrorResponse,
@@ -33,11 +46,11 @@ export class ApiComponentUtils {
   }
 
   @CaptureSpan()
-  public static sanitizeArgs(
+  public static async sanitizeArgs(
     metadata: ComponentMetadata,
     args: JSONObject,
     options: RunOptions,
-  ): { args: JSONObject; successPort: Port; errorPort: Port } {
+  ): Promise<{ args: JSONObject; successPort: Port; errorPort: Port }> {
     const successPort: Port | undefined = metadata.outPorts.find((p: Port) => {
       return p.id === "success";
     });
@@ -69,6 +82,49 @@ export class ApiComponentUtils {
       );
     }
 
+    /*
+     * Headers reach here from a key/value grid that can emit numbers and
+     * booleans, from a JSON document someone typed, or from a {{...}}
+     * substitution — and every consumer below blind-casts the result to
+     * Dictionary<string> before spreading it into the outgoing request. An
+     * array or a bare scalar spreads into per-index junk headers rather than
+     * failing, so check the shape and flatten the values to strings here.
+     */
+    if (args["request-headers"]) {
+      const headers: JSONValue = args["request-headers"] as JSONValue;
+
+      if (
+        typeof headers !== "object" ||
+        headers === null ||
+        Array.isArray(headers)
+      ) {
+        throw options.onError(
+          new BadDataException(
+            "Request headers must be a JSON object of header names and values.",
+          ),
+        );
+      }
+
+      const stringifiedHeaders: JSONObject = {};
+
+      for (const headerName of Object.keys(headers as JSONObject)) {
+        const headerValue: JSONValue = (headers as JSONObject)[
+          headerName
+        ] as JSONValue;
+
+        if (headerValue === null || headerValue === undefined) {
+          continue;
+        }
+
+        stringifiedHeaders[headerName] =
+          typeof headerValue === "object"
+            ? JSON.stringify(headerValue)
+            : String(headerValue);
+      }
+
+      args["request-headers"] = stringifiedHeaders;
+    }
+
     if (!args["url"]) {
       throw options.onError(new BadDataException("URL not found"));
     }
@@ -77,6 +133,32 @@ export class ApiComponentUtils {
       throw options.onError(new BadDataException("URL is not type of string"));
     }
 
+    /*
+     * The URL is authored by whoever built the workflow - i.e. any member of
+     * any project - and the request goes out from the server, which sits
+     * inside the cluster and next to the cloud metadata endpoint. Without this
+     * check the API components are an authenticated request proxy into the
+     * private network: GET http://169.254.169.254/latest/meta-data/iam/... and
+     * the credentials come back in the component's "response-body" return
+     * value, in plain sight in the workflow log. Resolve and blocklist the
+     * target the same way outbound webhooks already do.
+     *
+     * Validate the RAW string, before URL.fromString - that parser defaults an
+     * unrecognized scheme to https, so "file:///etc/passwd" would reach the
+     * check already rewritten as host "file".
+     */
+    try {
+      await SSRFProtection.validateWebhookTargetIsSafe(args["url"] as string);
+    } catch (err) {
+      throw options.onError(
+        new BadDataException(
+          err instanceof Exception
+            ? err.message
+            : "URL points to an address that is not allowed.",
+        ),
+      );
+    }
+
     args["url"] = URL.fromString(args["url"] as string);
 
     return { args, successPort, errorPort };

package/Server/Types/Workflow/Components/BaseModel/CreateManyBaseModel.ts

@@ -10,6 +10,7 @@ import ComponentMetadata, {
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { applyTenantColumn } from "./ModelArguments";
 
 export default class CreateManyBaseModel<
   TBaseModel extends BaseModel,
@@ -91,25 +92,30 @@ export default class CreateManyBaseModel<
 
       const array: Array<TBaseModel> = [];
 
-      if (this.modelService.getModel().getTenantColumn()) {
-        for (const item of args["json-array"]) {
-          (item as JSONObject)[
-            this.modelService.getModel().getTenantColumn() as string
-          ] = options.projectId;
-
-          array.push(
-            (await this.modelService.create({
-              data: BaseModel.fromJSON<TBaseModel>(
-                (item as JSONObject) || {},
-                this.modelService.modelType,
-              ) as TBaseModel,
-              props: {
-                isRoot: true,
-                tenantId: options.projectId,
-              },
-            })) as TBaseModel,
-          );
-        }
+      /*
+       * This loop used to sit inside an `if (getTenantColumn())` check that
+       * was only meant to guard the projectId stamping, so a model without a
+       * tenant column created nothing at all and still reported success.
+       */
+      for (const item of args["json-array"]) {
+        const json: JSONObject = applyTenantColumn(
+          (item as JSONObject) || {},
+          this.modelService.getModel(),
+          options.projectId,
+        );
+
+        array.push(
+          (await this.modelService.create({
+            data: BaseModel.fromJSON<TBaseModel>(
+              json,
+              this.modelService.modelType,
+            ) as TBaseModel,
+            props: {
+              isRoot: true,
+              tenantId: options.projectId,
+            },
+          })) as TBaseModel,
+        );
       }
 
       return {

package/Server/Types/Workflow/Components/BaseModel/CreateOneBaseModel.ts

@@ -12,6 +12,7 @@ import ComponentMetadata, {
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { applyTenantColumn } from "./ModelArguments";
 
 export default class CreateOneBaseModel<
   TBaseModel extends BaseModel,
@@ -90,11 +91,11 @@ export default class CreateOneBaseModel<
         );
       }
 
-      if (this.modelService.getModel().getTenantColumn()) {
-        (args["json"] as JSONObject)[
-          this.modelService.getModel().getTenantColumn() as string
-        ] = options.projectId;
-      }
+      args["json"] = applyTenantColumn(
+        args["json"] as JSONObject,
+        this.modelService.getModel(),
+        options.projectId,
+      );
 
       const model: TBaseModel = (await this.modelService.create({
         data: BaseModel.fromJSON<TBaseModel>(

package/Server/Types/Workflow/Components/BaseModel/DeleteManyBaseModel.ts

@@ -12,6 +12,8 @@ import ComponentMetadata, {
   Port,
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
+import { normalizeModelKeys } from "./ModelArguments";
+import logComponentError from "./LogComponentError";
 
 export default class DeleteManyBaseModel<
   TBaseModel extends BaseModel,
@@ -114,22 +116,26 @@ export default class DeleteManyBaseModel<
         args["limit"] = LIMIT_PER_PROJECT;
       }
 
+      const query: Query<TBaseModel> = JSONFunctions.deserialize(
+        normalizeModelKeys(
+          args["query"] as JSONObject,
+          this.modelService.getModel(),
+        ),
+      ) as Query<TBaseModel>;
+
+      /*
+       * The tenant column goes on the deserialized query, not on args["query"]
+       * - JSONFunctions.deserialize returns a new object, so anything written
+       * to args after it runs never reaches the database.
+       */
       if (this.modelService.getModel().getTenantColumn()) {
-        (args["query"] as JSONObject)[
+        (query as JSONObject)[
           this.modelService.getModel().getTenantColumn() as string
         ] = options.projectId;
       }
 
-      let query: Query<TBaseModel> = args["query"] as Query<TBaseModel>;
-
-      if (query) {
-        query = JSONFunctions.deserialize(
-          args["query"] as JSONObject,
-        ) as Query<TBaseModel>;
-      }
-
-      await this.modelService.deleteBy({
-        query: query || {},
+      const itemsDeleted: number = await this.modelService.deleteBy({
+        query: query,
         limit: new PositiveNumber(args["limit"] as number),
         skip: new PositiveNumber(args["skip"] as number),
         props: {
@@ -138,13 +144,25 @@ export default class DeleteManyBaseModel<
         },
       });
 
+      options.log(
+        `Deleted ${itemsDeleted} ${
+          this.modelService.getModel().singularName || "record"
+        }(s).`,
+      );
+
       return {
-        returnValues: {},
+        returnValues: {
+          "items-deleted": itemsDeleted,
+        },
         executePort: successPort,
       };
     } catch (err: any) {
-      options.log("Error running component");
-      options.log(err.message ? err.message : JSON.stringify(err, null, 2));
+      logComponentError({
+        error: err,
+        model: this.modelService?.getModel() || null,
+        log: options.log,
+      });
+
       return {
         returnValues: {},
         executePort: errorPort,

package/Server/Types/Workflow/Components/BaseModel/DeleteOneBaseModel.ts

@@ -11,6 +11,8 @@ import ComponentMetadata, {
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { normalizeModelKeys } from "./ModelArguments";
+import logComponentError from "./LogComponentError";
 
 export default class DeleteOneBaseModel<
   TBaseModel extends BaseModel,
@@ -89,35 +91,51 @@ export default class DeleteOneBaseModel<
         );
       }
 
-      let query: Query<TBaseModel> = args["query"] as Query<TBaseModel>;
-
-      if (query) {
-        query = JSONFunctions.deserialize(
+      const query: Query<TBaseModel> = JSONFunctions.deserialize(
+        normalizeModelKeys(
           args["query"] as JSONObject,
-        ) as Query<TBaseModel>;
-      }
-
+          this.modelService.getModel(),
+        ),
+      ) as Query<TBaseModel>;
+
+      /*
+       * The tenant column goes on the deserialized query, not on args["query"]
+       * - JSONFunctions.deserialize returns a new object, so anything written
+       * to args after it runs never reaches the database.
+       */
       if (this.modelService.getModel().getTenantColumn()) {
-        (args["query"] as JSONObject)[
+        (query as JSONObject)[
           this.modelService.getModel().getTenantColumn() as string
         ] = options.projectId;
       }
 
-      await this.modelService.deleteOneBy({
-        query: (query as Query<TBaseModel>) || {},
+      const itemsDeleted: number = await this.modelService.deleteOneBy({
+        query: query,
         props: {
           isRoot: true,
           tenantId: options.projectId,
         },
       });
 
+      options.log(
+        `Deleted ${itemsDeleted} ${
+          this.modelService.getModel().singularName || "record"
+        }(s).`,
+      );
+
       return {
-        returnValues: {},
+        returnValues: {
+          "items-deleted": itemsDeleted,
+        },
         executePort: successPort,
       };
     } catch (err: any) {
-      options.log("Error running component");
-      options.log(err.message ? err.message : JSON.stringify(err, null, 2));
+      logComponentError({
+        error: err,
+        model: this.modelService?.getModel() || null,
+        log: options.log,
+      });
+
       return {
         returnValues: {},
         executePort: errorPort,