@oneuptime/common 13.0.0 → 13.0.1

package/Models/DatabaseModels/Alert.ts

@@ -17,6 +17,7 @@ import OnCallDutyPolicy from "./OnCallDutyPolicy";
 import Probe from "./Probe";
 import Project from "./Project";
 import ProxmoxCluster from "./ProxmoxCluster";
+import VMwareVCenter from "./VMwareVCenter";
 import IoTFleet from "./IoTFleet";
 import DockerSwarmCluster from "./DockerSwarmCluster";
 import Service from "./Service";
@@ -979,6 +980,60 @@ export default class Alert extends BaseModel {
   })
   public proxmoxClusters?: Array<ProxmoxCluster> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.AlertAdmin,
+      Permission.AlertMember,
+      Permission.CreateAlert,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.AlertAdmin,
+      Permission.AlertMember,
+      Permission.AlertViewer,
+      Permission.ReadAlert,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.AlertAdmin,
+      Permission.AlertMember,
+      Permission.EditAlert,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: VMwareVCenter,
+    title: "vCenters",
+    description: "List of vCenters affected by this alert.",
+  })
+  @ManyToMany(
+    () => {
+      return VMwareVCenter;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "AlertVMwareVCenter",
+    inverseJoinColumn: {
+      name: "vmwareVCenterId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "alertId",
+      referencedColumnName: "_id",
+    },
+  })
+  public vmwareVCenters?: Array<VMwareVCenter> = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/CloudResource.ts

@@ -201,8 +201,9 @@ export default class CloudResource extends BaseModel {
     type: TableColumnType.ShortText,
     canReadOnRelationQuery: true,
     title: "Name",
-    description: "Friendly name for this cloud resource",
-    example: "checkout-service",
+    description:
+      "Friendly name for this cloud environment. Ingest names a discovered environment after its platform, region and account.",
+    example: "AWS ECS · us-east-1 · 123456789012",
   })
   @Column({
     nullable: false,
@@ -317,7 +318,7 @@ export default class CloudResource extends BaseModel {
     canReadOnRelationQuery: true,
     title: "Resource Identifier",
     description:
-      "Stable identifier for this managed-compute workload (service.name, falling back to host.name). Identity key for this resource.",
+      "Environment key: the cloud.platform, cloud.account.id and cloud.region OpenTelemetry resource attributes joined with '|' (e.g. aws_ecs|123456789012|us-east-1; missing parts stay as empty segments). Built by buildCloudEnvironmentKey in Common/Types/Cloud/CloudPlatform. An environment created by hand must carry the same key for ingest to find it instead of creating a duplicate.",
   })
   /* Case-insensitive uniqueness; see RumApplication.appIdentifier. */
   @UniqueColumnBy("projectId")
@@ -328,8 +329,24 @@ export default class CloudResource extends BaseModel {
   })
   public resourceIdentifier?: string = undefined;
 
+  /*
+   * cloudPlatform / cloudProvider / cloudRegion / cloudAccountId are
+   * creatable so a person can register an environment before its first
+   * telemetry arrives (the create form derives the key above from them),
+   * but never updatable: after creation they are ingest-owned — the
+   * heartbeat (CloudResourceService.updateLastSeen) backfills and refreshes
+   * them from the cloud.* resource attributes, and a hand edit would only
+   * drift from what the collector actually reports.
+   */
   @ColumnAccessControl({
-    create: [],
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateCloudResource,
+    ],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -358,7 +375,14 @@ export default class CloudResource extends BaseModel {
   public cloudPlatform?: string = undefined;
 
   @ColumnAccessControl({
-    create: [],
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateCloudResource,
+    ],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -387,7 +411,14 @@ export default class CloudResource extends BaseModel {
   public cloudProvider?: string = undefined;
 
   @ColumnAccessControl({
-    create: [],
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateCloudResource,
+    ],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,
@@ -416,7 +447,14 @@ export default class CloudResource extends BaseModel {
   public cloudRegion?: string = undefined;
 
   @ColumnAccessControl({
-    create: [],
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateCloudResource,
+    ],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,

package/Models/DatabaseModels/CodeRepository.ts

@@ -613,6 +613,91 @@ export default class CodeRepository extends BaseModel {
   })
   public maxOpenFixPullRequests?: number = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateCodeRepository,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadCodeRepository,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditCodeRepository,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Boolean,
+    title: "Respond to GitHub Commands",
+    description:
+      "Whether the OneUptime GitHub App acts on mentions, assignments and trigger labels in this repository. Only people with write access to the repository can command it, and it never merges anything. Unset means enabled.",
+    example: true,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Boolean,
+  })
+  public isGitHubCommandsEnabled?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.CreateCodeRepository,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadCodeRepository,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditCodeRepository,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "GitHub Trigger Label",
+    description:
+      "The issue label that hands an issue to the OneUptime GitHub App. Adding this label to an issue starts the same work an '@mention implement this' would, which is how you assign work to the app from the GitHub UI. Unset means 'oneuptime'.",
+    example: "oneuptime",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public gitHubTriggerLabel?: string = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/GoogleSecOpsConnection.ts

@@ -16,6 +16,7 @@ import TenantColumn from "../../Types/Database/TenantColumn";
 import IconProp from "../../Types/Icon/IconProp";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import { JSONObject } from "../../Types/JSON";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
@@ -241,8 +242,60 @@ export default class GoogleSecOpsConnection extends BaseModel {
   })
   public pollIntervalInMinutes?: number = undefined;
 
+  @ColumnAccessControl({
+    create: adminPermissions,
+    read: readPermissions,
+    update: adminPermissions,
+  })
+  @TableColumn({
+    type: TableColumnType.Boolean,
+    required: true,
+    title: "Include Non-alerting Detections",
+    description:
+      "Include detections that have not been marked as alerts in Google SecOps.",
+    defaultValue: false,
+    canReadOnRelationQuery: true,
+  })
+  @Column({ type: ColumnType.Boolean, nullable: false, default: false })
+  public includeNonAlertingDetections?: boolean = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Last Successful Poll",
+    description:
+      "When a complete poll last finished successfully, including an empty result.",
+    canReadOnRelationQuery: true,
+  })
+  @Column({ type: ColumnType.Date, nullable: true })
+  public lastSuccessfulPollAt?: Date = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Last Event Imported",
+    description:
+      "When a new security event was last imported, independently of its detection time.",
+    canReadOnRelationQuery: true,
+  })
+  @Column({ type: ColumnType.Date, nullable: true })
+  public lastEventIngestedAt?: Date = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.JSON,
+    required: false,
+    title: "Last Poll Result",
+    description:
+      "The latest scheduled or on-demand poll result with counts and warnings.",
+  })
+  @Column({ type: ColumnType.JSON, nullable: true })
+  public lastPollResult?: JSONObject = undefined;
+
   /*
-   * Poller-owned state. Written only by the Workers cron.
+   * Poller-owned state. Written only by the connection worker.
    */
   @ColumnAccessControl({
     create: [],
@@ -274,7 +327,7 @@ export default class GoogleSecOpsConnection extends BaseModel {
     type: TableColumnType.LongText,
     canReadOnRelationQuery: true,
     description:
-      "Poll cursor: the newest detection timestamp already ingested, as an ISO string.",
+      "Poll cursor: the end of the last completely processed window, or the boundary retained for retry, as an ISO string.",
   })
   @Column({
     type: ColumnType.LongText,
@@ -292,11 +345,8 @@ export default class GoogleSecOpsConnection extends BaseModel {
     title: "Last Error",
     required: false,
     /*
-     * Unbounded text, not LongText's varchar(500): a Google SecOps API
-     * failure is a prefix plus up to 500 characters of echoed response
-     * body, which overflows 500 and made the poller's own error-recording
-     * write throw — leaving this column, and lastPolledAt with it, null
-     * forever. The poller still clamps what it stores.
+     * Keep complete diagnostic messages so customers can copy them for
+     * support. The poller redacts credentials before storing the error.
      */
     type: TableColumnType.VeryLongText,
     canReadOnRelationQuery: true,

package/Models/DatabaseModels/GoogleSecOpsConnectionRun.ts

@@ -0,0 +1,263 @@
+import Project from "./Project";
+import User from "./User";
+import GoogleSecOpsConnection from "./GoogleSecOpsConnection";
+import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import Route from "../../Types/API/Route";
+import { PlanType } from "../../Types/Billing/SubscriptionPlan";
+import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import TableBillingAccessControl from "../../Types/Database/AccessControl/TableBillingAccessControl";
+import ColumnLength from "../../Types/Database/ColumnLength";
+import ColumnType from "../../Types/Database/ColumnType";
+import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import EnableDocumentation from "../../Types/Database/EnableDocumentation";
+import TableColumn from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import TableMetadata from "../../Types/Database/TableMetadata";
+import TenantColumn from "../../Types/Database/TenantColumn";
+import IconProp from "../../Types/Icon/IconProp";
+import ObjectID from "../../Types/ObjectID";
+import Permission from "../../Types/Permission";
+import { JSONObject } from "../../Types/JSON";
+import {
+  GoogleSecOpsRunType,
+  GoogleSecOpsRunStatus,
+} from "../../Types/SecurityEvent/GoogleSecOpsDiagnostics";
+import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+
+const readPermissions: Array<Permission> = [
+  Permission.ProjectOwner,
+  Permission.ProjectAdmin,
+  Permission.SecurityAdmin,
+  Permission.SecurityMember,
+  Permission.SecurityViewer,
+];
+
+// Only the worker and authorized operations API write these records.
+@EnableDocumentation()
+@TableBillingAccessControl({
+  create: PlanType.Free,
+  read: PlanType.Free,
+  update: PlanType.Free,
+  delete: PlanType.Free,
+})
+@TenantColumn("projectId")
+@CrudApiEndpoint(new Route("/google-secops-connection-run"))
+@Entity({ name: "GoogleSecOpsConnectionRun" })
+@Index(["projectId", "googleSecOpsConnectionId", "createdAt"])
+@TableMetadata({
+  tableName: "GoogleSecOpsConnectionRun",
+  singularName: "Google SecOps Connection Run",
+  pluralName: "Google SecOps Connection Runs",
+  icon: IconProp.ShieldCheck,
+  tableDescription:
+    "History of connection tests, previews, scheduled polls and historical imports. Credentials are never included.",
+})
+@TableAccessControl({
+  create: [],
+  read: readPermissions,
+  update: [],
+  delete: [],
+})
+export default class GoogleSecOpsConnectionRun extends BaseModel {
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Entity,
+    modelType: Project,
+    manyToOneRelationColumn: "projectId",
+    title: "Project",
+    description: "Project for this run.",
+    required: true,
+  })
+  @ManyToOne(
+    () => {
+      return Project;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "projectId" })
+  public project?: Project = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Project ID",
+    description: "ID of the project for this run.",
+    required: true,
+    canReadOnRelationQuery: true,
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public projectId?: ObjectID = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Entity,
+    modelType: GoogleSecOpsConnection,
+    manyToOneRelationColumn: "googleSecOpsConnectionId",
+    title: "Connection",
+    description: "Connection for this run.",
+    required: true,
+  })
+  @ManyToOne(
+    () => {
+      return GoogleSecOpsConnection;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "googleSecOpsConnectionId" })
+  public googleSecOpsConnection?: GoogleSecOpsConnection = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Connection ID",
+    description: "ID of the connection for this run.",
+    required: true,
+    canReadOnRelationQuery: true,
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public googleSecOpsConnectionId?: ObjectID = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Entity,
+    modelType: User,
+    manyToOneRelationColumn: "requestedByUserId",
+    title: "Requested By",
+    description: "Requested By for this run.",
+    required: false,
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "requestedByUserId" })
+  public requestedByUser?: User = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    title: "Requested By ID",
+    description: "ID of the requested by for this run.",
+    required: false,
+    canReadOnRelationQuery: true,
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public requestedByUserId?: ObjectID = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    required: true,
+    title: "Operation",
+    description: "Operation of this connection run.",
+    canReadOnRelationQuery: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: false,
+  })
+  public type?: GoogleSecOpsRunType = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    required: true,
+    title: "Status",
+    description: "Status of this connection run.",
+    canReadOnRelationQuery: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: false,
+  })
+  public status?: GoogleSecOpsRunStatus = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Started At",
+    description: "When this run started.",
+    canReadOnRelationQuery: true,
+  })
+  @Column({ type: ColumnType.Date, nullable: true })
+  public startedAt?: Date = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Completed At",
+    description: "When this run completed.",
+    canReadOnRelationQuery: true,
+  })
+  @Column({ type: ColumnType.Date, nullable: true })
+  public completedAt?: Date = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.JSON,
+    required: false,
+    title: "Request",
+    description:
+      "Validated operation and selected time range. Contains no credentials.",
+  })
+  @Column({ type: ColumnType.JSON, nullable: true })
+  public request?: JSONObject = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.JSON,
+    required: false,
+    title: "Result",
+    description:
+      "Counts, requested time range, checks and a bounded preview of detections.",
+  })
+  @Column({ type: ColumnType.JSON, nullable: true })
+  public result?: JSONObject = undefined;
+
+  @ColumnAccessControl({ create: [], read: readPermissions, update: [] })
+  @TableColumn({
+    type: TableColumnType.VeryLongText,
+    required: false,
+    title: "Error",
+    description: "The run failure with credentials redacted.",
+  })
+  @Column({ type: ColumnType.VeryLongText, nullable: true })
+  public error?: string = undefined;
+}

package/Models/DatabaseModels/Incident.ts

@@ -17,6 +17,7 @@ import OnCallDutyPolicy from "./OnCallDutyPolicy";
 import Probe from "./Probe";
 import Project from "./Project";
 import ProxmoxCluster from "./ProxmoxCluster";
+import VMwareVCenter from "./VMwareVCenter";
 import IoTFleet from "./IoTFleet";
 import DockerSwarmCluster from "./DockerSwarmCluster";
 import Service from "./Service";
@@ -968,6 +969,60 @@ export default class Incident extends BaseModel {
   })
   public proxmoxClusters?: Array<ProxmoxCluster> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.IncidentAdmin,
+      Permission.IncidentMember,
+      Permission.CreateProjectIncident,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.IncidentAdmin,
+      Permission.IncidentMember,
+      Permission.IncidentViewer,
+      Permission.ReadProjectIncident,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.IncidentAdmin,
+      Permission.IncidentMember,
+      Permission.EditProjectIncident,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: VMwareVCenter,
+    title: "vCenters",
+    description: "List of vCenters affected by this incident.",
+  })
+  @ManyToMany(
+    () => {
+      return VMwareVCenter;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "IncidentVMwareVCenter",
+    inverseJoinColumn: {
+      name: "vmwareVCenterId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "incidentId",
+      referencedColumnName: "_id",
+    },
+  })
+  public vmwareVCenters?: Array<VMwareVCenter> = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,