@oneuptime/common 13.0.0 → 13.0.1

package/Tests/Utils/Telemetry/EntityRelationship.test.ts

@@ -44,6 +44,72 @@ describe("inferRelationshipType", () => {
     ).toBe(EntityRelationshipType.MemberOf);
   });
 
+  test("infers the vmware topology (cluster/host/datastore → vcenter, host → cluster, vm → host/vcenter)", () => {
+    expect(
+      inferRelationshipType(EntityType.VMwareCluster, EntityType.VMwareVCenter),
+    ).toBe(EntityRelationshipType.MemberOf);
+    expect(
+      inferRelationshipType(EntityType.VMwareHost, EntityType.VMwareVCenter),
+    ).toBe(EntityRelationshipType.MemberOf);
+    expect(
+      inferRelationshipType(EntityType.VMwareHost, EntityType.VMwareCluster),
+    ).toBe(EntityRelationshipType.MemberOf);
+    expect(
+      inferRelationshipType(
+        EntityType.VMwareVirtualMachine,
+        EntityType.VMwareHost,
+      ),
+    ).toBe(EntityRelationshipType.RunsOn);
+    expect(
+      inferRelationshipType(
+        EntityType.VMwareVirtualMachine,
+        EntityType.VMwareVCenter,
+      ),
+    ).toBe(EntityRelationshipType.MemberOf);
+    expect(
+      inferRelationshipType(
+        EntityType.VMwareDatastore,
+        EntityType.VMwareVCenter,
+      ),
+    ).toBe(EntityRelationshipType.MemberOf);
+  });
+
+  test("declares exactly six vmware rules (vm → cluster is reached through the host)", () => {
+    const vmwareTypes: Array<EntityType> = [
+      EntityType.VMwareVCenter,
+      EntityType.VMwareCluster,
+      EntityType.VMwareHost,
+      EntityType.VMwareVirtualMachine,
+      EntityType.VMwareDatastore,
+    ];
+    let declared: number = 0;
+    for (const fromType of vmwareTypes) {
+      for (const toType of vmwareTypes) {
+        if (inferRelationshipType(fromType, toType)) {
+          declared++;
+        }
+      }
+    }
+    expect(declared).toBe(6);
+    // Deliberately not declared: a VM's cluster is its host's cluster.
+    expect(
+      inferRelationshipType(
+        EntityType.VMwareVirtualMachine,
+        EntityType.VMwareCluster,
+      ),
+    ).toBeNull();
+    // A datastore is mounted by hosts, not a member of one.
+    expect(
+      inferRelationshipType(EntityType.VMwareDatastore, EntityType.VMwareHost),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(
+        EntityType.VMwareVirtualMachine,
+        EntityType.VMwareDatastore,
+      ),
+    ).toBeNull();
+  });
+
   test("is directional (the reverse pair yields nothing)", () => {
     expect(
       inferRelationshipType(
@@ -57,6 +123,24 @@ describe("inferRelationshipType", () => {
     expect(
       inferRelationshipType(EntityType.ProxmoxCluster, EntityType.ProxmoxNode),
     ).toBeNull();
+    expect(
+      inferRelationshipType(EntityType.VMwareVCenter, EntityType.VMwareCluster),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(EntityType.VMwareCluster, EntityType.VMwareHost),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(
+        EntityType.VMwareHost,
+        EntityType.VMwareVirtualMachine,
+      ),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(
+        EntityType.VMwareVCenter,
+        EntityType.VMwareDatastore,
+      ),
+    ).toBeNull();
   });
 
   test("unrelated or self type pairs yield null", () => {
@@ -77,6 +161,27 @@ describe("inferRelationshipType", () => {
     expect(
       inferRelationshipType(EntityType.Host, EntityType.CephCluster),
     ).toBeNull();
+    /*
+     * Same for VMware: a collector running hostmetrics beside the vcenter
+     * receiver mints a `host` entity from host.name, and that host is the
+     * collector box, not an ESXi host — it is not a member of the vCenter,
+     * of any cluster, and is not the same thing as a vmware.host.
+     */
+    expect(
+      inferRelationshipType(EntityType.Host, EntityType.VMwareVCenter),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(EntityType.Host, EntityType.VMwareCluster),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(EntityType.Host, EntityType.VMwareHost),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(EntityType.VMwareHost, EntityType.Host),
+    ).toBeNull();
+    expect(
+      inferRelationshipType(EntityType.VMwareVirtualMachine, EntityType.Host),
+    ).toBeNull();
   });
 
   test("depends-on is never inferred from co-occurrence (span-derived only)", () => {
@@ -176,6 +281,68 @@ describe("deriveRelationships", () => {
     expect(edges.length).toBe(3);
   });
 
+  test("derives the full directed edge set for a vmware VM resource", () => {
+    // What a clustered VM's resource resolves to: vcenter, cluster, host, vm.
+    const edges: Array<EntityRelationshipEdge> = deriveRelationships([
+      { entityType: EntityType.VMwareVCenter, entityKey: "vcenter" },
+      { entityType: EntityType.VMwareCluster, entityKey: "cluster" },
+      { entityType: EntityType.VMwareHost, entityKey: "host" },
+      { entityType: EntityType.VMwareVirtualMachine, entityKey: "vm" },
+    ]);
+
+    expect(
+      hasEdge(edges, "cluster", "vcenter", EntityRelationshipType.MemberOf),
+    ).toBe(true);
+    expect(
+      hasEdge(edges, "host", "vcenter", EntityRelationshipType.MemberOf),
+    ).toBe(true);
+    expect(
+      hasEdge(edges, "host", "cluster", EntityRelationshipType.MemberOf),
+    ).toBe(true);
+    expect(hasEdge(edges, "vm", "host", EntityRelationshipType.RunsOn)).toBe(
+      true,
+    );
+    expect(
+      hasEdge(edges, "vm", "vcenter", EntityRelationshipType.MemberOf),
+    ).toBe(true);
+    // No reverse edge, no vm → cluster shortcut.
+    expect(
+      hasEdge(edges, "vcenter", "cluster", EntityRelationshipType.MemberOf),
+    ).toBe(false);
+    expect(
+      hasEdge(edges, "vm", "cluster", EntityRelationshipType.MemberOf),
+    ).toBe(false);
+    expect(edges.length).toBe(5);
+  });
+
+  test("derives a single edge for a vmware datastore resource", () => {
+    const edges: Array<EntityRelationshipEdge> = deriveRelationships([
+      { entityType: EntityType.VMwareVCenter, entityKey: "vcenter" },
+      { entityType: EntityType.VMwareDatastore, entityKey: "ds" },
+    ]);
+    expect(edges).toEqual([
+      {
+        fromEntityKey: "ds",
+        toEntityKey: "vcenter",
+        relationshipType: EntityRelationshipType.MemberOf,
+      },
+    ]);
+  });
+
+  test("a collector host beside a vmware resource gains no vmware edges", () => {
+    const edges: Array<EntityRelationshipEdge> = deriveRelationships([
+      { entityType: EntityType.Host, entityKey: "collector" },
+      { entityType: EntityType.VMwareVCenter, entityKey: "vcenter" },
+      { entityType: EntityType.VMwareHost, entityKey: "esxi" },
+    ]);
+    expect(
+      edges.every((e: EntityRelationshipEdge) => {
+        return e.fromEntityKey !== "collector" && e.toEntityKey !== "collector";
+      }),
+    ).toBe(true);
+    expect(edges.length).toBe(1);
+  });
+
   test("empty / single-entity sets produce no edges", () => {
     expect(deriveRelationships([])).toEqual([]);
     expect(

package/Tests/Utils/WebAuthnTestUtil.ts

@@ -0,0 +1,79 @@
+import { JSONObject } from "../../Types/JSON";
+
+export const authenticationOptions: JSONObject = {
+  challenge: "-_8A",
+  rpId: "localhost",
+  timeout: 60000,
+  userVerification: "required",
+};
+
+export const registrationOptions: JSONObject = {
+  ...authenticationOptions,
+  rp: { id: "localhost", name: "OneUptime" },
+  user: { id: "AQID", name: "ada@example.com", displayName: "Ada Lovelace" },
+  pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+  authenticatorSelection: {
+    residentKey: "required",
+    userVerification: "required",
+  },
+  excludeCredentials: [
+    { id: "-_8A", type: "public-key", transports: ["internal"] },
+  ],
+};
+
+export default class WebAuthnTestUtil {
+  public static buffer(...values: Array<number>): ArrayBuffer {
+    return new Uint8Array(values).buffer;
+  }
+
+  public static credential(
+    isRegistration: boolean = false,
+  ): PublicKeyCredential {
+    return {
+      id: "-_8A",
+      rawId: WebAuthnTestUtil.buffer(251, 255, 0),
+      type: "public-key",
+      authenticatorAttachment: "platform",
+      getClientExtensionResults: () => {
+        return { credProps: { rk: true } };
+      },
+      response: isRegistration
+        ? {
+            clientDataJSON: WebAuthnTestUtil.buffer(1, 2, 3),
+            attestationObject: WebAuthnTestUtil.buffer(4, 5, 6),
+            getTransports: () => {
+              return ["internal", "hybrid"];
+            },
+          }
+        : {
+            authenticatorData: WebAuthnTestUtil.buffer(4, 5, 6),
+            clientDataJSON: WebAuthnTestUtil.buffer(1, 2, 3),
+            signature: WebAuthnTestUtil.buffer(7, 8, 9),
+            userHandle: WebAuthnTestUtil.buffer(10, 11, 12),
+          },
+    } as unknown as PublicKeyCredential;
+  }
+
+  public static install(): void {
+    Object.defineProperty(window, "PublicKeyCredential", {
+      configurable: true,
+      value: class {},
+      writable: true,
+    });
+    Object.defineProperty(window, "isSecureContext", {
+      configurable: true,
+      value: true,
+    });
+    Object.defineProperty(navigator, "credentials", {
+      configurable: true,
+      value: {
+        get: async () => {
+          return WebAuthnTestUtil.credential();
+        },
+        create: async () => {
+          return WebAuthnTestUtil.credential(true);
+        },
+      },
+    });
+  }
+}

package/Tests/__mocks__/simplewebauthn.js

@@ -1,4 +1,26 @@
-// Mock for @simplewebauthn/server package
+/*
+ * Mock for the @simplewebauthn/server package, wired in through
+ * `moduleNameMapper` in Common/jest.config.json rather than through
+ * jest.mock(), so every Common test that reaches UserWebAuthnService gets it
+ * without asking.
+ *
+ * THE RETURN SHAPES MATTER. `registrationInfo.credential` is the v13 shape --
+ * v7 and earlier put `credentialID` / `credentialPublicKey` at the top of
+ * `registrationInfo`, and UserWebAuthnService reads the v13 one. A stub left
+ * on the old shape does not fail loudly; it hands the service `undefined` and
+ * the row is written with no credential id at all.
+ *
+ * WHAT THIS STUB CANNOT TELL YOU. It has no opinion about
+ * `requireUserVerification`, which is exactly the library default that caused
+ * issue #3652 -- so a test of that behaviour written against this stub would
+ * have passed before the fix and after it. The end-to-end test of that lives
+ * in App/Tests/FeatureSet/Identity/WebAuthnUserVerification.test.ts, where the
+ * REAL library runs; what belongs here is assertions about the arguments the
+ * service passes in.
+ */
+
+const MOCK_CREDENTIAL_ID = "mock-credential-id";
+
 module.exports = {
   generateRegistrationOptions: jest.fn().mockResolvedValue({
     challenge: "mock-challenge",
@@ -13,9 +35,14 @@ module.exports = {
   verifyRegistrationResponse: jest.fn().mockResolvedValue({
     verified: true,
     registrationInfo: {
-      credentialID: Buffer.from("mock-credential-id"),
-      credentialPublicKey: Buffer.from("mock-public-key"),
-      counter: 0,
+      credential: {
+        id: MOCK_CREDENTIAL_ID,
+        publicKey: Buffer.from("mock-public-key"),
+        counter: 0,
+        transports: ["internal"],
+      },
+      credentialDeviceType: "singleDevice",
+      credentialBackedUp: false,
     },
   }),
   generateAuthenticationOptions: jest.fn().mockResolvedValue({
@@ -29,6 +56,8 @@ module.exports = {
     verified: true,
     authenticationInfo: {
       newCounter: 1,
+      credentialID: MOCK_CREDENTIAL_ID,
+      userVerified: false,
     },
   }),
 };

package/Types/AI/CodeFixTaskContext.ts

@@ -1,3 +1,5 @@
+import GitHubCommandType from "../CodeRepository/GitHubCommand";
+
 /*
  * The JSON persisted on AIRun.taskContext for tasks whose exact working
  * context must survive until a worker claims them. Some recipes have no
@@ -85,6 +87,72 @@ export interface InvestigationCodeFixTaskSnapshot {
   investigationAnalysisMarkdown: string;
 }
 
+/*
+ * The GitHub conversation a run was started from, and everything the agent
+ * worker needs to work it without re-deriving anything from a webhook it can
+ * no longer see.
+ *
+ * Two fields carry the trust boundary and must be read with it in mind:
+ *
+ *   - `instruction` is UNTRUSTED text, written by whoever commented. It is
+ *     quoted into an LLM prompt, so every consumer treats it as data about
+ *     what the human wants and never as instructions that widen what the run
+ *     may do. The run's repository, its issue/pull request, and its command
+ *     are all fixed HERE, at trigger time, by code that verified them.
+ *
+ *   - `installationId` was taken from the SIGNED webhook payload and checked
+ *     against the CodeRepository row it names, so it is a GitHub-vouched
+ *     binding rather than a client assertion. Nothing downstream may swap it.
+ */
+export interface GitHubTaskContext {
+  // The OneUptime CodeRepository row this conversation belongs to.
+  codeRepositoryId: string;
+  installationId: string;
+  organizationName: string;
+  repositoryName: string;
+  commandType: GitHubCommandType;
+  // UNTRUSTED. What the human wrote after the mention. May be empty.
+  instruction: string;
+  /*
+   * Exactly one of these is set, and it decides the recipe: an issue is
+   * implemented, a pull request is revised or reviewed.
+   */
+  issueNumber?: number | undefined;
+  pullRequestNumber?: number | undefined;
+  /*
+   * The head branch of the pull request, captured at trigger time. The
+   * revision pushes to THIS branch and opens nothing new, and the review
+   * checks it out so it can read the code as changed.
+   *
+   * DELIBERATELY ABSENT for a pull request from a fork: that branch does not
+   * exist in the repository this installation can reach, so a run that tried
+   * to check it out would silently land on the default branch instead. A
+   * review of a fork works from the base branch plus the diff; a revision of
+   * one is refused outright.
+   */
+  pullRequestHeadRefName?: string | undefined;
+  // Whether the pull request's branch lives in a different repository.
+  isPullRequestFromFork?: boolean | undefined;
+  // The comment that triggered the run, so the app can react on it.
+  triggerCommentId?: number | undefined;
+  // The GitHub login that issued the command. Attribution, never authority.
+  triggeredByLogin?: string | undefined;
+  /*
+   * The app's own acknowledgement comment. Edited in place as the run
+   * progresses so one command produces one comment, not a status log.
+   */
+  acknowledgementCommentId?: number | undefined;
+  // The X-GitHub-Delivery of the webhook that started this run.
+  webhookDeliveryId?: string | undefined;
+  /*
+   * When the run's OUTCOME was reported back into the thread. Set by the
+   * sweeper that posts it, and the only thing stopping the next sweep from
+   * posting again — see GitHubRunReply for why the report is swept for rather
+   * than posted by whoever finalized the run.
+   */
+  reportedToGitHubAt?: string | undefined;
+}
+
 export interface CodeFixTaskContext {
   /*
    * FixFromIncident: the exact investigation whose published RootCause is
@@ -112,6 +180,11 @@ export interface CodeFixTaskContext {
    * name for repository resolution and PR wording).
    */
   telemetryServiceId?: string | undefined;
+  /*
+   * The GitHub Implement / Revise / Review recipes: the conversation the run
+   * came from and must report back to.
+   */
+  github?: GitHubTaskContext | undefined;
 }
 
 /*
@@ -151,4 +224,53 @@ export function getInvestigationCodeFixTaskSnapshot(
   };
 }
 
+/*
+ * Treat partial, empty and malformed JSON as no GitHub context. Shared by the
+ * trigger, the task-details endpoint and the reply helper so none of those
+ * boundaries can fall back to a half-built conversation — a run that cannot
+ * name its repository AND its issue-or-pull-request is not executable, and
+ * one that names both is a bug, not a convenience.
+ */
+export function getGitHubTaskContext(
+  taskContext: CodeFixTaskContext | null | undefined,
+): GitHubTaskContext | null {
+  const github: GitHubTaskContext | undefined = taskContext?.github;
+
+  if (!github) {
+    return null;
+  }
+
+  const requiredStrings: Array<unknown> = [
+    github.codeRepositoryId,
+    github.installationId,
+    github.organizationName,
+    github.repositoryName,
+    github.commandType,
+  ];
+
+  for (const value of requiredStrings) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+      return null;
+    }
+  }
+
+  const hasIssue: boolean = typeof github.issueNumber === "number";
+  const hasPullRequest: boolean = typeof github.pullRequestNumber === "number";
+
+  if (hasIssue === hasPullRequest) {
+    return null;
+  }
+
+  return github;
+}
+
+/*
+ * The issue or pull request number this run is about. GitHub numbers both in
+ * the same sequence per repository, and the conversation API addresses both
+ * as `/issues/{n}` — so the app's replies always go here, whichever it is.
+ */
+export function getGitHubConversationNumber(github: GitHubTaskContext): number {
+  return (github.pullRequestNumber ?? github.issueNumber)!;
+}
+
 export default CodeFixTaskContext;

package/Types/AI/CodeFixTaskType.ts

@@ -71,6 +71,30 @@ enum CodeFixTaskType {
    * Common/Server/Utils/AI/SRE/FixFromIncidentTaskTrigger.ts).
    */
   FixFromIncident = "FixFromIncident",
+  /*
+   * Work a GitHub ISSUE and open a pull request that closes it. Triggered
+   * from GitHub itself — an "@oneuptime implement this" mention, an
+   * assignment to the app's bot user, or the repository's trigger label —
+   * never from the OneUptime UI. Its entire context (repository, issue
+   * number, the commenter's instruction) is captured into
+   * AIRun.taskContext.github at trigger time; see
+   * Common/Server/Utils/CodeRepository/GitHub/GitHubAgentTaskTrigger.ts.
+   */
+  GitHubIssueFix = "GitHubIssueFix",
+  /*
+   * Revise an EXISTING pull request in place: new commits pushed to the same
+   * head branch, no second pull request. Triggered by "@oneuptime revise
+   * this because ..." on the pull request. The head branch is captured into
+   * AIRun.taskContext.github at trigger time so a later force-push cannot
+   * silently redirect the run at another branch.
+   */
+  GitHubPullRequestRevision = "GitHubPullRequestRevision",
+  /*
+   * Review a pull request and post the review as a COMMENT. Changes nothing
+   * and pushes nothing — the one recipe that never touches the repository.
+   * Triggered by "@oneuptime review" or by requesting a review from the app.
+   */
+  GitHubPullRequestReview = "GitHubPullRequestReview",
 }
 
 export default CodeFixTaskType;
@@ -134,6 +158,9 @@ export class CodeFixTaskTypeHelper {
       case CodeFixTaskType.FixPerformance:
       case CodeFixTaskType.ImproveLogging:
       case CodeFixTaskType.ImproveTracing:
+      case CodeFixTaskType.GitHubIssueFix:
+      case CodeFixTaskType.GitHubPullRequestRevision:
+      case CodeFixTaskType.GitHubPullRequestReview:
         return CodeFixContextKind.TaskContext;
       default:
         return CodeFixContextKind.TelemetryException;
@@ -152,6 +179,41 @@ export class CodeFixTaskTypeHelper {
     );
   }
 
+  /*
+   * The recipes triggered from a GitHub conversation rather than from
+   * OneUptime. They share a context shape (AIRun.taskContext.github), a
+   * task-details endpoint, and the rule that their outcome is reported back
+   * into the thread they came from.
+   */
+  public static getGitHubTaskTypes(): Array<CodeFixTaskType> {
+    return [
+      CodeFixTaskType.GitHubIssueFix,
+      CodeFixTaskType.GitHubPullRequestRevision,
+      CodeFixTaskType.GitHubPullRequestReview,
+    ];
+  }
+
+  public static isGitHubTaskType(taskType: CodeFixTaskType): boolean {
+    return this.getGitHubTaskTypes().includes(taskType);
+  }
+
+  /*
+   * Whether a recipe can open a NEW pull request. The per-repository open-PR
+   * cap exists to bound how many unreviewed AI pull requests a reviewer has
+   * to wade through, so it applies to recipes that ADD to that queue.
+   *
+   * A revision pushes to a pull request that is already open and already
+   * counted; a review writes nothing at all. Counting either against the cap
+   * would mean a repository at its cap could never have its existing AI pull
+   * requests improved or reviewed — the exact work that clears the cap.
+   */
+  public static opensNewPullRequest(taskType: CodeFixTaskType): boolean {
+    return (
+      taskType !== CodeFixTaskType.GitHubPullRequestRevision &&
+      taskType !== CodeFixTaskType.GitHubPullRequestReview
+    );
+  }
+
   public static isValidTaskType(value: string): value is CodeFixTaskType {
     return Object.values(CodeFixTaskType).includes(value as CodeFixTaskType);
   }

package/Types/Accounts/AccountsLanguage.ts

@@ -31,6 +31,7 @@ export const SUPPORTED_ACCOUNTS_LANGUAGES: Array<AccountsLanguage> = [
     englishName: "Chinese (Traditional)",
   },
   { code: "hi", nativeName: "हिन्दी", englishName: "Hindi" },
+  { code: "fa", nativeName: "فارسی", englishName: "Persian" },
 ];
 
 export const SUPPORTED_ACCOUNTS_LANGUAGE_CODES: Array<string> =

package/Types/AdminDashboard/AdminDashboardLanguage.ts

@@ -32,6 +32,7 @@ export const SUPPORTED_ADMIN_DASHBOARD_LANGUAGES: Array<AdminDashboardLanguage>
       englishName: "Chinese (Traditional)",
     },
     { code: "hi", nativeName: "हिन्दी", englishName: "Hindi" },
+    { code: "fa", nativeName: "فارسی", englishName: "Persian" },
   ];
 
 export const SUPPORTED_ADMIN_DASHBOARD_LANGUAGE_CODES: Array<string> =

package/Types/Calendar/CalendarEvent.ts

@@ -9,4 +9,20 @@ export default interface CalendarEvent extends JSONObject {
   desc?: string | undefined;
   color?: string | undefined;
   textColor?: string | undefined;
+  /*
+   * A SECOND colour for the block, painted as a stripe down its leading edge.
+   * Used when a block is about two people rather than one — an on-call shift
+   * covered by a substitute is drawn in the substitute's colour with the
+   * overridden person's colour on the edge, so the swap is legible at a glance
+   * and, crucially, survives the label being truncated to nothing in a narrow
+   * week-view column.
+   */
+  accentColor?: string | undefined;
+  /*
+   * Extra class names for the rendered block. The calendar itself defines no
+   * semantics for these; it forwards them so a caller can attach its own
+   * treatment (see .oneuptime-calendar-event--override in Calendar.css) without
+   * the generic component learning what an override is.
+   */
+  className?: string | undefined;
 }