@oneuptime/common 13.0.4 → 13.0.5

package/Server/Utils/AI/SRE/InvestigationReferences.ts

@@ -0,0 +1,324 @@
+import Alert from "../../../../Models/DatabaseModels/Alert";
+import Incident from "../../../../Models/DatabaseModels/Incident";
+import {
+  InvestigationEventReference,
+  InvestigationReferenceKind,
+} from "../../../../Types/AI/InvestigationEvidence";
+import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
+import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../Types/ObjectID";
+import {
+  ExtractedInvestigationEventReference,
+  extractEventReferences,
+  parseInvestigationReport,
+} from "../../../../Utils/AI/InvestigationReport";
+import AlertService from "../../../Services/AlertService";
+import IncidentService from "../../../Services/IncidentService";
+import QueryHelper from "../../../Types/Database/QueryHelper";
+import logger from "../../Logger";
+
+/*
+ * Resolves the incident/alert numbers an AI investigation report mentions
+ * ("recurrence of #6954") to the project's own records, so the panel can link
+ * them.
+ *
+ * The numbers come from model-authored text, so nothing about them is
+ * trusted: each lookup is pinned to the subject's project and runs under the
+ * VIEWER's permissions (a viewer never gets a link — or a title — for a
+ * record they could not open), and a number that matches more than one row
+ * (incident numbers carry no unique constraint) is skipped as ambiguous.
+ * Links are decoration: any failure is logged and resolves to no links.
+ */
+
+/*
+ * Rows fetched per kind. A report yields at most 25 references, so this only
+ * binds when numbers are duplicated; the tail group is then discarded because
+ * it may be incomplete (see indexUniqueRows).
+ */
+export const MAX_REFERENCE_LOOKUP_ROWS: number = 100;
+
+export interface ResolveInvestigationReferencesInput {
+  markdown: string;
+  subjectType: InvestigationReferenceKind;
+  projectId: ObjectID;
+  props: DatabaseCommonInteractionProps;
+}
+
+interface ResolvedRow {
+  number: number;
+  id: string;
+  displayNumber: string;
+  title: string;
+  stateName?: string | undefined;
+  stateColor?: string | undefined;
+}
+
+/*
+ * Numbers that map to exactly one row. Rows arrive sorted by number, so when
+ * the lookup hit its row limit the LAST number's group may have been cut
+ * short — a number that looks unique there could still be ambiguous, so it
+ * is dropped rather than guessed.
+ */
+function indexUniqueRows(
+  rows: Array<ResolvedRow>,
+  isLimitHit: boolean,
+): Map<number, ResolvedRow> {
+  const rowsByNumber: Map<number, Array<ResolvedRow>> = new Map();
+
+  for (const row of rows) {
+    const group: Array<ResolvedRow> = rowsByNumber.get(row.number) || [];
+    group.push(row);
+    rowsByNumber.set(row.number, group);
+  }
+
+  if (isLimitHit && rows.length > 0) {
+    rowsByNumber.delete(rows[rows.length - 1]!.number);
+  }
+
+  const unique: Map<number, ResolvedRow> = new Map();
+
+  for (const [number, group] of rowsByNumber) {
+    if (group.length === 1) {
+      unique.set(number, group[0]!);
+    }
+  }
+
+  return unique;
+}
+
+/*
+ * A viewer who cannot read the other table (an alert-only member reading
+ * "incident #5") is expected, and the panel polls the report every few
+ * seconds, so a permission denial is debug noise rather than an error.
+ */
+function logLookupFailure(
+  kind: InvestigationReferenceKind,
+  error: unknown,
+): void {
+  if (error instanceof NotAuthorizedException) {
+    logger.debug(
+      `AI: viewer may not read ${kind} references in an investigation report: ${error}`,
+    );
+    return;
+  }
+
+  logger.error(
+    `AI: could not resolve ${kind} references in an investigation report: ${error}`,
+  );
+}
+
+async function resolveIncidentNumbers(data: {
+  numbers: Array<number>;
+  projectId: ObjectID;
+  props: DatabaseCommonInteractionProps;
+}): Promise<Map<number, ResolvedRow>> {
+  if (data.numbers.length === 0) {
+    return new Map();
+  }
+
+  try {
+    const incidents: Array<Incident> = await IncidentService.findBy({
+      query: {
+        projectId: data.projectId,
+        incidentNumber: QueryHelper.any(data.numbers),
+      },
+      select: {
+        _id: true,
+        incidentNumber: true,
+        incidentNumberWithPrefix: true,
+        title: true,
+        currentIncidentState: {
+          name: true,
+          color: true,
+        },
+      },
+      sort: { incidentNumber: SortOrder.Ascending },
+      limit: MAX_REFERENCE_LOOKUP_ROWS,
+      skip: 0,
+      props: data.props,
+    });
+
+    const rows: Array<ResolvedRow> = [];
+
+    for (const incident of incidents) {
+      const number: number | undefined = incident.incidentNumber;
+      const id: string | undefined = incident.id?.toString();
+
+      if (typeof number !== "number" || !id) {
+        continue;
+      }
+
+      rows.push({
+        number,
+        id,
+        displayNumber: incident.incidentNumberWithPrefix || `#${number}`,
+        title: incident.title || "",
+        stateName: incident.currentIncidentState?.name || undefined,
+        stateColor:
+          incident.currentIncidentState?.color?.toString() || undefined,
+      });
+    }
+
+    return indexUniqueRows(rows, incidents.length >= MAX_REFERENCE_LOOKUP_ROWS);
+  } catch (error) {
+    logLookupFailure("incident", error);
+    return new Map();
+  }
+}
+
+async function resolveAlertNumbers(data: {
+  numbers: Array<number>;
+  projectId: ObjectID;
+  props: DatabaseCommonInteractionProps;
+}): Promise<Map<number, ResolvedRow>> {
+  if (data.numbers.length === 0) {
+    return new Map();
+  }
+
+  try {
+    const alerts: Array<Alert> = await AlertService.findBy({
+      query: {
+        projectId: data.projectId,
+        alertNumber: QueryHelper.any(data.numbers),
+      },
+      select: {
+        _id: true,
+        alertNumber: true,
+        alertNumberWithPrefix: true,
+        title: true,
+        currentAlertState: {
+          name: true,
+          color: true,
+        },
+      },
+      sort: { alertNumber: SortOrder.Ascending },
+      limit: MAX_REFERENCE_LOOKUP_ROWS,
+      skip: 0,
+      props: data.props,
+    });
+
+    const rows: Array<ResolvedRow> = [];
+
+    for (const alert of alerts) {
+      const number: number | undefined = alert.alertNumber;
+      const id: string | undefined = alert.id?.toString();
+
+      if (typeof number !== "number" || !id) {
+        continue;
+      }
+
+      rows.push({
+        number,
+        id,
+        displayNumber: alert.alertNumberWithPrefix || `#${number}`,
+        title: alert.title || "",
+        stateName: alert.currentAlertState?.name || undefined,
+        stateColor: alert.currentAlertState?.color?.toString() || undefined,
+      });
+    }
+
+    return indexUniqueRows(rows, alerts.length >= MAX_REFERENCE_LOOKUP_ROWS);
+  } catch (error) {
+    logLookupFailure("alert", error);
+    return new Map();
+  }
+}
+
+function numbersOfKind(
+  references: Array<ExtractedInvestigationEventReference>,
+  kind: InvestigationReferenceKind,
+): Array<number> {
+  return references
+    .filter((reference: ExtractedInvestigationEventReference): boolean => {
+      return reference.kind === kind;
+    })
+    .map((reference: ExtractedInvestigationEventReference): number => {
+      return reference.number;
+    });
+}
+
+/*
+ * The report's incident/alert references that resolve to exactly one record
+ * the viewer can read, in the order the report first mentions them. An
+ * unqualified "#123" means the subject's own kind, unless the report also
+ * names 123 explicitly as the other kind. Numbers after words from another
+ * numbering ("scheduled maintenance #42", "PR #45") are never looked up.
+ */
+export async function resolveInvestigationReferences(
+  data: ResolveInvestigationReferencesInput,
+): Promise<Array<InvestigationEventReference>> {
+  try {
+    if (!data.markdown || !data.projectId) {
+      return [];
+    }
+
+    /*
+     * Only the model's note: the server-authored Evidence checked labels
+     * ("Incident #6954 timeline") and footer are not references the report
+     * makes, and the panel never renders them as prose.
+     */
+    const extracted: Array<ExtractedInvestigationEventReference> =
+      extractEventReferences(
+        parseInvestigationReport(data.markdown).bodyMarkdown,
+        data.subjectType,
+      );
+
+    if (extracted.length === 0) {
+      return [];
+    }
+
+    const [incidentRows, alertRows]: [
+      Map<number, ResolvedRow>,
+      Map<number, ResolvedRow>,
+    ] = await Promise.all([
+      resolveIncidentNumbers({
+        numbers: numbersOfKind(extracted, "incident"),
+        projectId: data.projectId,
+        props: data.props,
+      }),
+      resolveAlertNumbers({
+        numbers: numbersOfKind(extracted, "alert"),
+        projectId: data.projectId,
+        props: data.props,
+      }),
+    ]);
+
+    const references: Array<InvestigationEventReference> = [];
+
+    for (const reference of extracted) {
+      const row: ResolvedRow | undefined = (
+        reference.kind === "incident" ? incidentRows : alertRows
+      ).get(reference.number);
+
+      if (!row) {
+        continue;
+      }
+
+      const resolved: InvestigationEventReference = {
+        kind: reference.kind,
+        number: reference.number,
+        id: row.id,
+        displayNumber: row.displayNumber,
+        title: row.title,
+      };
+
+      if (row.stateName) {
+        resolved.stateName = row.stateName;
+      }
+
+      if (row.stateColor) {
+        resolved.stateColor = row.stateColor;
+      }
+
+      references.push(resolved);
+    }
+
+    return references;
+  } catch (error) {
+    logger.error(
+      `AI: could not resolve references in an investigation report: ${error}`,
+    );
+    return [];
+  }
+}

package/Server/Utils/AI/Toolbox/Index.ts

@@ -218,6 +218,31 @@ export default class AIToolbox {
     return definitions;
   }
 
+  /*
+   * The grants hasPermissionForTool consults are the caller's grants in
+   * props.tenantId, while every tool scopes its query by ctx.projectId — and
+   * for the raw-SQL aggregation tools that projectId is the ONLY scope. So
+   * for a non-root caller the two must name the same single project, or one
+   * project's grants would authorize a query against another. A multi-tenant
+   * request is refused for the same reason: its tenant permissions span every
+   * project the user belongs to rather than the one the tool will query.
+   */
+  public static isContextScopedToOneProject(ctx: ToolContext): boolean {
+    if (ctx.props.isRoot || ctx.props.isMasterAdmin) {
+      return true;
+    }
+
+    if (ctx.props.isMultiTenantRequest) {
+      return false;
+    }
+
+    if (!ctx.props.tenantId || !ctx.projectId) {
+      return false;
+    }
+
+    return ctx.props.tenantId.toString() === ctx.projectId.toString();
+  }
+
   public static hasPermissionForTool(
     tool: ObservabilityTool,
     ctx: ToolContext,
@@ -226,6 +251,10 @@ export default class AIToolbox {
       return true;
     }
 
+    if (!this.isContextScopedToOneProject(ctx)) {
+      return false;
+    }
+
     /*
      * Fail closed on block permissions: if any of the tool's permissions is
      * block-listed for this user, deny the tool outright. This is coarser
@@ -283,6 +312,15 @@ export default class AIToolbox {
       };
     }
 
+    // Checked first so the refusal names the real problem, not a permission.
+    if (!this.isContextScopedToOneProject(data.ctx)) {
+      return {
+        success: false,
+        textForLlm: `Error: ${data.name} can only run inside the single project this request is authorized for. Answer with the data you already have.`,
+        errorMessage: `Permission denied for tool: ${data.name} (the request is not scoped to this project)`,
+      };
+    }
+
     if (!this.hasPermissionForTool(tool, data.ctx)) {
       return {
         success: false,

package/Server/Utils/AI/Toolbox/TimelineTools.ts

@@ -117,6 +117,13 @@ const keepNewestChronological: (
   return newestFirst.slice(0, limit).reverse();
 };
 
+// "1 entry" / "12 entries", for the citation label a responder reads.
+export const formatTimelineEntryCount: (count: number) => string = (
+  count: number,
+): string => {
+  return `${count} ${count === 1 ? "entry" : "entries"}`;
+};
+
 const timelineWidgetColumns: Array<AIChatWidgetColumn> = [
   { key: "at", title: "When", type: "date" },
   { key: "type", title: "Type" },
@@ -368,7 +375,7 @@ export const GetIncidentTimelineTool: ObservabilityTool = {
     return {
       dataForLlm: dataForLlm,
       rowCount: serialized.rowCount,
-      citationLabel: `Incident ${incidentLabel} timeline (${serialized.rowCount} entries)`,
+      citationLabel: `Incident ${incidentLabel} timeline (${formatTimelineEntryCount(serialized.rowCount)})`,
       citationTarget: {
         type: AIChatCitationTargetType.IncidentView,
         params: { incidentId: incidentId.toString() },
@@ -590,7 +597,7 @@ export const GetAlertTimelineTool: ObservabilityTool = {
     return {
       dataForLlm: dataForLlm,
       rowCount: serialized.rowCount,
-      citationLabel: `Alert ${alertLabel} timeline (${serialized.rowCount} entries)`,
+      citationLabel: `Alert ${alertLabel} timeline (${formatTimelineEntryCount(serialized.rowCount)})`,
       citationTarget: {
         type: AIChatCitationTargetType.AlertView,
         params: { alertId: alertId.toString() },

package/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

@@ -1,4 +1,10 @@
 import ClickhouseDatabase from "../../Infrastructure/ClickhouseDatabase";
+import AnalyticsTableName from "../../../Types/AnalyticsDatabase/AnalyticsTableName";
+import {
+  EXCEPTION_SPAN_SCOPE_QUERY_KEY,
+  ExceptionSpanScope,
+  parseExceptionSpanScope,
+} from "../../../Types/Telemetry/ExceptionSpanScope";
 import GroupBy from "../../Types/AnalyticsDatabase/GroupBy";
 import Query from "../../Types/AnalyticsDatabase/Query";
 import Select from "../../Types/AnalyticsDatabase/Select";
@@ -689,6 +695,80 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
         continue;
       }
 
+      /*
+       * "exceptionScope" is a synthetic query key (not a column) that narrows
+       * spans to the ones an exception group's occurrences were raised in:
+       *   (traceId, spanId) GLOBAL IN (SELECT traceId, spanId FROM <occurrences>
+       *     WHERE projectId = ... AND fingerprint = ... [AND primaryEntityId = ...])
+       * The subquery is pinned to the query's own projectId. Without one — or
+       * with a malformed scope — the predicate matches nothing rather than
+       * silently widening back to every span. Ignored for models without
+       * traceId / spanId columns.
+       *
+       * GLOBAL IN, not plain IN: both tables are Distributed, and multi-shard
+       * ClickHouse rejects a plain IN subquery over a Distributed table inside
+       * a query on another one (Code 288). It would also be wrong shard-locally,
+       * because spans shard by traceId and occurrences by fingerprint, so the
+       * occurrence set has to be computed once, globally.
+       */
+      if (key === EXCEPTION_SPAN_SCOPE_QUERY_KEY) {
+        const traceIdColumn: AnalyticsTableColumn | null =
+          this.model.getTableColumn("traceId");
+        const spanIdColumn: AnalyticsTableColumn | null =
+          this.model.getTableColumn("spanId");
+
+        if (!traceIdColumn || !spanIdColumn) {
+          continue;
+        }
+
+        const scope: ExceptionSpanScope | null = parseExceptionSpanScope(value);
+        const projectIdValue: unknown = (query as Record<string, unknown>)[
+          "projectId"
+        ];
+        const projectId: string =
+          projectIdValue instanceof ObjectID
+            ? projectIdValue.toString()
+            : typeof projectIdValue === "string"
+              ? projectIdValue
+              : "";
+
+        if (first) {
+          first = false;
+        } else {
+          whereStatement.append(SQL` `);
+        }
+
+        if (!scope || !projectId) {
+          whereStatement.append(SQL`AND 0`);
+          continue;
+        }
+
+        const exceptionScopeStatement: Statement = SQL`AND (${columnRef(
+          traceIdColumn.key,
+        )}, ${columnRef(spanIdColumn.key)}) GLOBAL IN (SELECT traceId, spanId FROM ${
+          AnalyticsTableName.ExceptionInstance
+        } WHERE projectId = ${{
+          value: new ObjectID(projectId),
+          type: TableColumnType.ObjectID,
+        }} AND fingerprint = ${{
+          value: scope.fingerprint,
+          type: TableColumnType.Text,
+        }}`;
+
+        if (scope.primaryEntityId) {
+          exceptionScopeStatement.append(
+            SQL` AND primaryEntityId = ${{
+              value: new ObjectID(scope.primaryEntityId),
+              type: TableColumnType.ObjectID,
+            }}`,
+          );
+        }
+
+        exceptionScopeStatement.append(SQL`)`);
+        whereStatement.append(exceptionScopeStatement);
+        continue;
+      }
+
       /*
        * "resourceEntityScopes" is a synthetic query key (not a column): an
        * array of already-resolved resource-facet selections. Each element

package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts

@@ -198,7 +198,7 @@ export default class MonitorCriteriaEvaluator {
        */
       if (criteriaInstance.data?.isEnabled === false) {
         const skipReason: string =
-          "This criteria is disabled and was not evaluated.";
+          "This criterion is disabled, so it was not evaluated.";
         const skippedCriteriaResult: MonitorEvaluationCriteriaResult = {
           criteriaId: criteriaInstance.data?.id,
           criteriaName: criteriaInstance.data?.name,
@@ -209,6 +209,7 @@ export default class MonitorCriteriaEvaluator {
           filters: [],
           skipped: true,
           skipReason: skipReason,
+          skipCause: "disabled",
         };
 
         input.evaluationSummary.criteriaResults.push(skippedCriteriaResult);
@@ -469,8 +470,8 @@ ${contextBlock}
     evaluationSummary: MonitorEvaluationSummary;
   }): void {
     const skipReason: string =
-      "An earlier criteria already matched. This monitor raises a single " +
-      "alert for the whole monitor, so evaluation stops at the first match.";
+      "An earlier criterion already matched. Criteria are evaluated in order " +
+      "for this monitor, so evaluation stopped at the first match.";
 
     input.evaluationSummary.criteriaResults.push({
       criteriaId: input.criteriaInstance.data?.id,
@@ -482,6 +483,7 @@ ${contextBlock}
       filters: [],
       skipped: true,
       skipReason: skipReason,
+      skipCause: "earlier-criterion-matched",
     });
   }