@oneuptime/common 13.0.0 → 13.0.3

package/Models/DatabaseModels/ServiceLevelObjectiveBurnRateRule.ts

@@ -1,4 +1,5 @@
 import AlertSeverity from "./AlertSeverity";
+import IncidentSeverity from "./IncidentSeverity";
 import OnCallDutyPolicy from "./OnCallDutyPolicy";
 import Project from "./Project";
 import ServiceLevelObjective from "./ServiceLevelObjective";
@@ -100,7 +101,7 @@ const decimalTransformer: ValueTransformer = {
   pluralName: "SLO Burn Rate Rules",
   icon: IconProp.Fire,
   tableDescription:
-    "Configure multi-window burn rate rules that raise alerts when a Service Level Objective consumes its error budget too quickly",
+    "Configure multi-window burn rate rules that raise alerts and/or declare incidents when a Service Level Objective consumes its error budget too quickly",
 })
 export default class ServiceLevelObjectiveBurnRateRule extends BaseModel {
   @ColumnAccessControl({
@@ -463,7 +464,7 @@ export default class ServiceLevelObjectiveBurnRateRule extends BaseModel {
     type: TableColumnType.Number,
     title: "Re-fire Suppression (Minutes)",
     description:
-      "Minimum number of minutes after an alert resolves before this rule can fire again. Defaults to the long window length when not set.",
+      "Minimum number of minutes after an alert or incident resolves before this rule can declare that same record again. Each output is suppressed independently, from its own resolve. Defaults to the long window length when not set.",
   })
   @Column({
     type: ColumnType.Number,
@@ -471,6 +472,92 @@ export default class ServiceLevelObjectiveBurnRateRule extends BaseModel {
   })
   public refireSuppressionMinutes?: number = undefined;
 
+  /*
+   * What the rule DECLARES when it fires. A rule may raise an Alert, declare
+   * an Incident, or both — ServiceLevelObjectiveBurnRateRuleService rejects a
+   * rule that does neither, because a rule with no output is indistinguishable
+   * from a disabled one while still consuming a worker evaluation a minute.
+   *
+   * Named for DetectionRule.shouldCreateAlert / shouldCreateIncident, which
+   * model the same choice, and read with the same asymmetry the detection-rule
+   * evaluator documents: the alert gate is `!== false` and the incident gate is
+   * `=== true`, so a rule fetched without the column selected keeps alerting
+   * and never declares an incident by accident.
+   *
+   * `shouldCreateAlert` defaults to TRUE so every rule that existed before
+   * incidents were an option keeps behaving exactly as it did.
+   */
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateServiceLevelObjectiveBurnRateRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadServiceLevelObjectiveBurnRateRule,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditServiceLevelObjectiveBurnRateRule,
+    ],
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Create Alert",
+    description:
+      "Raise an Alert when this burn rate rule fires. Enabled by default.",
+    defaultValue: true,
+    isDefaultValueColumn: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: true,
+  })
+  public shouldCreateAlert?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateServiceLevelObjectiveBurnRateRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadServiceLevelObjectiveBurnRateRule,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditServiceLevelObjectiveBurnRateRule,
+    ],
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Declare Incident",
+    description:
+      "Declare an Incident when this burn rate rule fires. Disabled by default.",
+    defaultValue: false,
+    isDefaultValueColumn: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: false,
+  })
+  public shouldCreateIncident?: boolean = undefined;
+
   // Alert Configuration
 
   @ColumnAccessControl({
@@ -571,9 +658,9 @@ export default class ServiceLevelObjectiveBurnRateRule extends BaseModel {
     required: false,
     type: TableColumnType.EntityArray,
     modelType: OnCallDutyPolicy,
-    title: "On-Call Duty Policies",
+    title: "Alert On-Call Duty Policies",
     description:
-      "On-call duty policies attached to alerts created by this burn rate rule.",
+      "On-call duty policies attached to alerts created by this burn rate rule. Incidents have their own list.",
   })
   @ManyToMany(
     () => {
@@ -594,9 +681,153 @@ export default class ServiceLevelObjectiveBurnRateRule extends BaseModel {
   })
   public onCallDutyPolicies?: Array<OnCallDutyPolicy> = undefined;
 
+  // Incident Configuration
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateServiceLevelObjectiveBurnRateRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadServiceLevelObjectiveBurnRateRule,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditServiceLevelObjectiveBurnRateRule,
+    ],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "incidentSeverityId",
+    type: TableColumnType.Entity,
+    modelType: IncidentSeverity,
+    title: "Incident Severity",
+    description:
+      "Severity of the incident declared when this burn rate rule fires.",
+  })
+  @ManyToOne(
+    () => {
+      return IncidentSeverity;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "SET NULL",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "incidentSeverityId" })
+  public incidentSeverity?: IncidentSeverity = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateServiceLevelObjectiveBurnRateRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadServiceLevelObjectiveBurnRateRule,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditServiceLevelObjectiveBurnRateRule,
+    ],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    title: "Incident Severity ID",
+    description:
+      "ID of the Incident Severity of the incident declared when this burn rate rule fires",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public incidentSeverityId?: ObjectID = undefined;
+
+  /*
+   * Deliberately a SEPARATE list from `onCallDutyPolicies` above, mirroring
+   * how a monitor criteria keeps CriteriaAlert.onCallPolicyIds apart from
+   * CriteriaIncident.onCallPolicyIds: "page the team rotation for the alert,
+   * the major-incident rotation for the incident" is otherwise unexpressible.
+   *
+   * Note this does NOT by itself prevent double-paging a rule that does both —
+   * project-level on-call rules are merged in afterwards by
+   * IncidentOnCallRuleEngineService and AlertOnCallRuleEngineService, so a
+   * project pointing both rule sets at one rotation still pages twice. Two
+   * lists are about expressiveness, not about suppression.
+   */
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateServiceLevelObjectiveBurnRateRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadServiceLevelObjectiveBurnRateRule,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditServiceLevelObjectiveBurnRateRule,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: OnCallDutyPolicy,
+    title: "Incident On-Call Duty Policies",
+    description:
+      "On-call duty policies attached to incidents declared by this burn rate rule.",
+  })
+  @ManyToMany(
+    () => {
+      return OnCallDutyPolicy;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "ServiceLevelObjectiveBurnRateRuleIncidentOnCallDutyPolicy",
+    inverseJoinColumn: {
+      name: "onCallDutyPolicyId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "serviceLevelObjectiveBurnRateRuleId",
+      referencedColumnName: "_id",
+    },
+  })
+  public incidentOnCallDutyPolicies?: Array<OnCallDutyPolicy> = undefined;
+
   /*
    * Worker-owned state. These columns are set by the SLO evaluation worker
    * and cannot be created or updated through the API.
+   *
+   * The alert pair and the incident pair are kept SEPARATE on purpose. They
+   * are two independent lifecycles: one create can fail while the other
+   * succeeds, a responder can resolve the incident by hand while the alert
+   * stays open, and each output's re-fire suppression has to be measured from
+   * its own resolve. Folding both into one pair meant an incident create that
+   * kept failing would still consume the alert's "fired" stamp — and the
+   * alert, once opened, would never be resolved again.
    */
 
   @ColumnAccessControl({
@@ -647,6 +878,54 @@ export default class ServiceLevelObjectiveBurnRateRule extends BaseModel {
   })
   public lastAlertResolvedAt?: Date = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadServiceLevelObjectiveBurnRateRule,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Last Incident Declared At",
+    description:
+      "The last time an incident was declared by this burn rate rule. Computed by the worker.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public lastIncidentCreatedAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadServiceLevelObjectiveBurnRateRule,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Date,
+    required: false,
+    title: "Last Incident Resolved At",
+    description:
+      "The last time an incident declared by this burn rate rule was resolved. Computed by the worker.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public lastIncidentResolvedAt?: Date = undefined;
+
   // Created By / Deleted By User Relations
 
   @ColumnAccessControl({

package/Models/DatabaseModels/ServiceOwnerRule.ts

@@ -2,7 +2,7 @@ import Label from "./Label";
 import Project from "./Project";
 import Team from "./Team";
 import User from "./User";
-import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import RuleBaseModel from "./DatabaseBaseModel/RuleBaseModel";
 import Route from "../../Types/API/Route";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
@@ -72,7 +72,7 @@ import {
   tableDescription:
     "Configure rules for automatically assigning owner users and teams when matching services are created",
 })
-export default class ServiceOwnerRule extends BaseModel {
+export default class ServiceOwnerRule extends RuleBaseModel {
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/StatusPageLabelRule.ts

@@ -1,7 +1,7 @@
 import Label from "./Label";
 import Project from "./Project";
 import User from "./User";
-import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import RuleBaseModel from "./DatabaseBaseModel/RuleBaseModel";
 import Route from "../../Types/API/Route";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
@@ -74,7 +74,7 @@ import {
   tableDescription:
     "Configure rules for automatically attaching labels to status pages when matching status pages are created",
 })
-export default class StatusPageLabelRule extends BaseModel {
+export default class StatusPageLabelRule extends RuleBaseModel {
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/StatusPageMonitorRule.ts

@@ -3,7 +3,7 @@ import Project from "./Project";
 import StatusPage from "./StatusPage";
 import StatusPageGroup from "./StatusPageGroup";
 import User from "./User";
-import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import RuleBaseModel from "./DatabaseBaseModel/RuleBaseModel";
 import Route from "../../Types/API/Route";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
@@ -88,7 +88,7 @@ import {
   tableDescription:
     "Configure rules that automatically add matching monitors to a status page group, instead of picking every monitor by hand",
 })
-export default class StatusPageMonitorRule extends BaseModel {
+export default class StatusPageMonitorRule extends RuleBaseModel {
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/StatusPageOwnerRule.ts

@@ -2,7 +2,7 @@ import Label from "./Label";
 import Project from "./Project";
 import Team from "./Team";
 import User from "./User";
-import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import RuleBaseModel from "./DatabaseBaseModel/RuleBaseModel";
 import Route from "../../Types/API/Route";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
@@ -75,7 +75,7 @@ import {
   tableDescription:
     "Configure rules for automatically assigning owner users and teams when matching status pages are created",
 })
-export default class StatusPageOwnerRule extends BaseModel {
+export default class StatusPageOwnerRule extends RuleBaseModel {
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/User.ts

@@ -384,6 +384,55 @@ class User extends UserModel {
   })
   public resetPasswordExpires?: Date = undefined;
 
+  /*
+   * TWO challenge slots, not one, and the split is the whole point.
+   *
+   * A WebAuthn challenge is a one-shot value: the server issues it, the
+   * authenticator signs it, and the server compares what came back against
+   * what it stored. Registration and signing in are separate flows that each
+   * need one, and they used to share a single `webauthnChallenge` column --
+   * so whichever flow wrote last silently destroyed the other's.
+   *
+   * That is not a theoretical race. Registration is keyed by the session's
+   * user and signing in is keyed by an email address, so both land on the
+   * SAME row: a user adding a second key in one tab while a stale sign-in page
+   * in another asks for a fresh challenge loses the registration they were
+   * halfway through, and gets "No pending WebAuthn challenge found" for a key
+   * they are holding and touching. The anonymous
+   * /generate-authentication-options route made it reachable by strangers as
+   * well as by the user's own second tab.
+   *
+   * Named for their purposes rather than one being left as the bare
+   * `webauthnChallenge`, because a slot whose name does not say which flow
+   * owns it is exactly how the two came to share one.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({ type: TableColumnType.ShortText })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+    unique: false,
+  })
+  public webauthnRegistrationChallenge?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({ type: TableColumnType.Date })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+    unique: false,
+  })
+  public webauthnRegistrationChallengeExpiresAt?: Date = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],
@@ -396,7 +445,7 @@ class User extends UserModel {
     nullable: true,
     unique: false,
   })
-  public webauthnChallenge?: string = undefined;
+  public webauthnAuthenticationChallenge?: string = undefined;
 
   @ColumnAccessControl({
     create: [],
@@ -409,7 +458,7 @@ class User extends UserModel {
     nullable: true,
     unique: false,
   })
-  public webauthnChallengeExpiresAt?: Date = undefined;
+  public webauthnAuthenticationChallengeExpiresAt?: Date = undefined;
 
   @ColumnAccessControl({
     create: [],

package/Models/DatabaseModels/UserNotificationEmailRollupItem.ts

@@ -40,8 +40,9 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
  * this customer" without adding telemetry.
  *
  * WHAT IS DELIBERATELY NOT STORED: the envelope vars, the template type, and
- * any rendered body. A rollup line is eventType + subject + an optional deep
- * link. Storing envelopes would multiply row size roughly fiftyfold, add a
+ * any rendered body. A rollup line stores eventType, subject, an optional deep
+ * link, and the severity and state names shown in alert/incident emails.
+ * Storing envelopes would multiply row size roughly fiftyfold, add a
  * stale-template bug class the moment a template changes under a queued row,
  * and buy nothing a reader of the rollup email ever sees.
  *
@@ -291,6 +292,46 @@ export default class UserNotificationEmailRollupItem extends BaseModel {
   })
   public subject?: string = undefined;
 
+  /*
+   * Snapshot the labels in the original notification so a later state change
+   * or rename cannot make a queued event describe a different point in time.
+   * Nullable for older queue items and notification families without these
+   * details. These names use the same length as severity and state models.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    title: "Severity",
+    description: "Severity name when this notification was queued",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public severity?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    title: "Current State",
+    description: "State name when this notification was queued",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public currentState?: string = undefined;
+
   /*
    * The deep link back into the dashboard, lifted out of the envelope vars,
    * and also the key rows are folded on when the rollup is rendered - two

package/Models/DatabaseModels/UserWebAuthn.ts

@@ -153,6 +153,23 @@ class UserWebAuthn extends BaseModel {
   })
   public isVerified?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Boolean,
+    title: "Registered as a Passkey",
+    description:
+      "Whether this credential was registered for passwordless sign-in. Older credentials have no recorded purpose.",
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: true,
+  })
+  public isPasskey?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],