@oneuptime/common 13.0.4 → 13.0.6

package/Server/Services/PodmanHostOwnerRuleEngineService.ts

@@ -11,13 +11,43 @@ import PodmanHostFeedService from "./PodmanHostFeedService";
 import { PodmanHostFeedEventType } from "../../Models/DatabaseModels/PodmanHostFeed";
 import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
+import Select from "../Types/Database/Select";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
 import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
+import OwnerRuleAssignment, {
+  OwnersToAssign,
+} from "../Utils/Rules/OwnerRuleAssignment";
+import {
+  ApplyRulesToExistingResourceData,
+  RuleApplicationResult,
+  RuleApplicationResultUtil,
+  RuleRunEngine,
+} from "../Utils/Rules/RuleRun/RuleApplication";
+
+class PodmanHostOwnerRuleEngineServiceClass
+  implements RuleRunEngine<PodmanHost, PodmanHostOwnerRule>
+{
+  public readonly ruleSelect: Select<PodmanHostOwnerRule> = {
+    _id: true,
+    name: true,
+    criteria: true,
+    notifyOwners: true,
+    podmanHostLabels: { _id: true },
+    podmanHostNamePattern: true,
+    podmanHostDescriptionPattern: true,
+    ownerUsers: { _id: true },
+    ownerTeams: { _id: true },
+  };
+
+  // Evaluation re-reads the Podman host, so a run only has to name it.
+  public readonly resourceSelectForRuleRun: Select<PodmanHost> = {
+    _id: true,
+    projectId: true,
+  };
 
-class PodmanHostOwnerRuleEngineServiceClass {
   /**
    * Evaluates PodmanHostOwnerRule rows for the given Podman host and adds matched
    * owner users / teams via PodmanHostOwnerUserService / PodmanHostOwnerTeamService. Rules
@@ -38,17 +68,7 @@ class PodmanHostOwnerRuleEngineServiceClass {
             isEnabled: true,
           },
           props: { isRoot: true },
-          select: {
-            _id: true,
-            name: true,
-            criteria: true,
-            notifyOwners: true,
-            podmanHostLabels: { _id: true },
-            podmanHostNamePattern: true,
-            podmanHostDescriptionPattern: true,
-            ownerUsers: { _id: true },
-            ownerTeams: { _id: true },
-          },
+          select: this.ruleSelect,
           limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
@@ -63,122 +83,222 @@ class PodmanHostOwnerRuleEngineServiceClass {
         return;
       }
 
-      const podmanHostWithDetails: PodmanHost | null =
-        await PodmanHostService.findOneById({
-          id: podmanHost.id,
-          select: {
-            name: true,
-            description: true,
-            labels: { _id: true },
-          },
-          props: { isRoot: true },
-        });
+      await this.applyRules({
+        podmanHost: podmanHost,
+        rules: rules,
+        allowOwnerNotification: true,
+      });
+    } catch (error) {
+      logger.error(`Error applying Podman host owner rules: ${error}`, {
+        projectId: podmanHost.projectId?.toString(),
+        podmanHostId: podmanHost.id?.toString(),
+      } as LogAttributes);
+    }
+  }
 
-      if (!podmanHostWithDetails) {
-        return;
-      }
+  /*
+   * "Run now": the same evaluation, for a Podman host that already exists and
+   * only the rules being run.
+   */
+  @CaptureSpan()
+  public async applyRulesToExistingResource(
+    data: ApplyRulesToExistingResourceData<PodmanHost, PodmanHostOwnerRule>,
+  ): Promise<RuleApplicationResult> {
+    try {
+      return await this.applyRules({
+        podmanHost: data.resource,
+        rules: data.rules,
+        allowOwnerNotification: data.allowOwnerNotification,
+      });
+    } catch (error) {
+      logger.error(`Error running Podman host owner rules: ${error}`, {
+        projectId: data.resource.projectId?.toString(),
+        podmanHostId: data.resource.id?.toString(),
+      } as LogAttributes);
+
+      return RuleApplicationResultUtil.failed();
+    }
+  }
 
-      const usersByNotify: Map<boolean, Set<string>> = new Map([
-        [true, new Set()],
-        [false, new Set()],
-      ]);
-      const teamsByNotify: Map<boolean, Set<string>> = new Map([
-        [true, new Set()],
-        [false, new Set()],
-      ]);
+  private async applyRules(data: {
+    podmanHost: PodmanHost;
+    rules: Array<PodmanHostOwnerRule>;
+    allowOwnerNotification: boolean;
+  }): Promise<RuleApplicationResult> {
+    const { podmanHost, rules } = data;
 
-      const matchedRules: Array<PodmanHostOwnerRule> = [];
+    if (!podmanHost.id || !podmanHost.projectId || rules.length === 0) {
+      return RuleApplicationResultUtil.noMatch();
+    }
 
-      for (const rule of rules) {
-        const matches: boolean = this.doesPodmanHostMatchRule(
-          podmanHostWithDetails,
-          rule,
-        );
-        if (!matches) {
-          continue;
-        }
-        let ruleAddedAny: boolean = false;
-        const notify: boolean = rule.notifyOwners !== false;
-        for (const user of rule.ownerUsers || []) {
-          if (user.id) {
-            usersByNotify.get(notify)!.add(user.id.toString());
-            ruleAddedAny = true;
-          }
-        }
-        for (const team of rule.ownerTeams || []) {
-          if (team.id) {
-            teamsByNotify.get(notify)!.add(team.id.toString());
-            ruleAddedAny = true;
-          }
+    const podmanHostWithDetails: PodmanHost | null =
+      await PodmanHostService.findOneById({
+        id: podmanHost.id,
+        select: {
+          name: true,
+          description: true,
+          labels: { _id: true },
+        },
+        props: { isRoot: true },
+      });
+
+    if (!podmanHostWithDetails) {
+      return RuleApplicationResultUtil.noMatch();
+    }
+
+    const usersByNotify: Map<boolean, Set<string>> = new Map([
+      [true, new Set()],
+      [false, new Set()],
+    ]);
+    const teamsByNotify: Map<boolean, Set<string>> = new Map([
+      [true, new Set()],
+      [false, new Set()],
+    ]);
+
+    const matchedRules: Array<PodmanHostOwnerRule> = [];
+    const allUserIds: Set<string> = new Set();
+    const allTeamIds: Set<string> = new Set();
+    let anyRuleMatched: boolean = false;
+
+    for (const rule of rules) {
+      const matches: boolean = this.doesPodmanHostMatchRule(
+        podmanHostWithDetails,
+        rule,
+      );
+      if (!matches) {
+        continue;
+      }
+      anyRuleMatched = true;
+      let ruleAddedAny: boolean = false;
+      const notify: boolean =
+        rule.notifyOwners !== false && data.allowOwnerNotification;
+      for (const user of rule.ownerUsers || []) {
+        if (user.id) {
+          usersByNotify.get(notify)!.add(user.id.toString());
+          allUserIds.add(user.id.toString());
+          ruleAddedAny = true;
         }
-        if (ruleAddedAny) {
-          matchedRules.push(rule);
+      }
+      for (const team of rule.ownerTeams || []) {
+        if (team.id) {
+          teamsByNotify.get(notify)!.add(team.id.toString());
+          allTeamIds.add(team.id.toString());
+          ruleAddedAny = true;
         }
       }
-
-      if (matchedRules.length === 0) {
-        return;
+      if (ruleAddedAny) {
+        matchedRules.push(rule);
       }
+    }
 
-      for (const notify of [true, false]) {
-        const userIds: Set<string> = usersByNotify.get(notify)!;
-        const teamIds: Set<string> = teamsByNotify.get(notify)!;
-
-        for (const userId of userIds) {
-          const owner: PodmanHostOwnerUser = new PodmanHostOwnerUser();
-          owner.podmanHostId = podmanHost.id;
-          owner.projectId = podmanHost.projectId;
-          owner.userId = new ObjectID(userId);
-          owner.isOwnerNotified = !notify;
-          await PodmanHostOwnerUserService.create({
-            data: owner,
-            props: { isRoot: true },
-          });
-        }
+    if (!anyRuleMatched) {
+      return RuleApplicationResultUtil.noMatch();
+    }
 
-        for (const teamId of teamIds) {
-          const owner: PodmanHostOwnerTeam = new PodmanHostOwnerTeam();
-          owner.podmanHostId = podmanHost.id;
-          owner.projectId = podmanHost.projectId;
-          owner.teamId = new ObjectID(teamId);
-          owner.isOwnerNotified = !notify;
-          await PodmanHostOwnerTeamService.create({
-            data: owner,
-            props: { isRoot: true },
-          });
-        }
-      }
+    if (
+      matchedRules.length === 0 ||
+      (allUserIds.size === 0 && allTeamIds.size === 0)
+    ) {
+      return RuleApplicationResultUtil.alreadyApplied();
+    }
 
-      logger.debug(
-        `PodmanHostOwnerRuleEngine added owners to Podman host ${podmanHost.id}`,
-        { projectId: podmanHost.projectId.toString() } as LogAttributes,
-      );
-      /*
-       * The individual OwnerUserAdded / OwnerTeamAdded items say who was added;
-       * this one says which rule is responsible, which is what somebody asking
-       * "why am I on the hook for this?" actually needs.
-       */
-      await PodmanHostFeedService.createPodmanHostFeedItem({
-        podmanHostId: podmanHost.id,
-        projectId: podmanHost.projectId,
-        podmanHostFeedEventType: PodmanHostFeedEventType.OwnerRuleExecuted,
-        displayColor: Purple500,
-        feedInfoInMarkdown: `👥 Owners were added to ${await PodmanHostService.getPodmanHostMarkdownLink(
-          podmanHost.projectId,
-          podmanHost.id,
-        )} by ${matchedRules.length} owner ${matchedRules.length === 1 ? "rule" : "rules"}.`,
-        moreInformationInMarkdown: `**Owner rules that matched**: ${matchedRules
-          .map((rule: PodmanHostOwnerRule) => {
-            return `\`${rule.name || rule.id?.toString() || "Unnamed rule"}\``;
-          })
-          .join(", ")}`,
+    // Owners already on the Podman host are skipped rather than duplicated.
+    const notYetAssigned: OwnersToAssign =
+      await OwnerRuleAssignment.getOwnersNotYetAssigned({
+        ownerUserService: PodmanHostOwnerUserService,
+        ownerTeamService: PodmanHostOwnerTeamService,
+        resourceIdColumn: "podmanHostId",
+        resourceId: podmanHost.id,
+        userIds: Array.from(allUserIds),
+        teamIds: Array.from(allTeamIds),
       });
-    } catch (error) {
-      logger.error(`Error applying Podman host owner rules: ${error}`, {
-        projectId: podmanHost.projectId?.toString(),
-        podmanHostId: podmanHost.id?.toString(),
-      } as LogAttributes);
+
+    const userIdsToAdd: Set<string> = new Set(
+      notYetAssigned.userIds.map((id: ObjectID) => {
+        return id.toString();
+      }),
+    );
+    const teamIdsToAdd: Set<string> = new Set(
+      notYetAssigned.teamIds.map((id: ObjectID) => {
+        return id.toString();
+      }),
+    );
+
+    let ownersAdded: number = 0;
+
+    /*
+     * The notifying set goes first, so an owner two matching rules disagree
+     * about is added once, and notified.
+     */
+    for (const notify of [true, false]) {
+      const userIds: Array<string> = Array.from(
+        usersByNotify.get(notify)!,
+      ).filter((id: string) => {
+        return userIdsToAdd.delete(id);
+      });
+      const teamIds: Array<string> = Array.from(
+        teamsByNotify.get(notify)!,
+      ).filter((id: string) => {
+        return teamIdsToAdd.delete(id);
+      });
+
+      for (const userId of userIds) {
+        const owner: PodmanHostOwnerUser = new PodmanHostOwnerUser();
+        owner.podmanHostId = podmanHost.id;
+        owner.projectId = podmanHost.projectId;
+        owner.userId = new ObjectID(userId);
+        owner.isOwnerNotified = !notify;
+        await PodmanHostOwnerUserService.create({
+          data: owner,
+          props: { isRoot: true },
+        });
+        ownersAdded++;
+      }
+
+      for (const teamId of teamIds) {
+        const owner: PodmanHostOwnerTeam = new PodmanHostOwnerTeam();
+        owner.podmanHostId = podmanHost.id;
+        owner.projectId = podmanHost.projectId;
+        owner.teamId = new ObjectID(teamId);
+        owner.isOwnerNotified = !notify;
+        await PodmanHostOwnerTeamService.create({
+          data: owner,
+          props: { isRoot: true },
+        });
+        ownersAdded++;
+      }
+    }
+
+    if (ownersAdded === 0) {
+      return RuleApplicationResultUtil.alreadyApplied();
     }
+
+    logger.debug(
+      `PodmanHostOwnerRuleEngine added owners to Podman host ${podmanHost.id}`,
+      { projectId: podmanHost.projectId.toString() } as LogAttributes,
+    );
+    /*
+     * The individual OwnerUserAdded / OwnerTeamAdded items say who was added;
+     * this one says which rule is responsible, which is what somebody asking
+     * "why am I on the hook for this?" actually needs.
+     */
+    await PodmanHostFeedService.createPodmanHostFeedItem({
+      podmanHostId: podmanHost.id,
+      projectId: podmanHost.projectId,
+      podmanHostFeedEventType: PodmanHostFeedEventType.OwnerRuleExecuted,
+      displayColor: Purple500,
+      feedInfoInMarkdown: `👥 Owners were added to ${await PodmanHostService.getPodmanHostMarkdownLink(
+        podmanHost.projectId,
+        podmanHost.id,
+      )} by ${matchedRules.length} owner ${matchedRules.length === 1 ? "rule" : "rules"}.`,
+      moreInformationInMarkdown: `**Owner rules that matched**: ${matchedRules
+        .map((rule: PodmanHostOwnerRule) => {
+          return `\`${rule.name || rule.id?.toString() || "Unnamed rule"}\``;
+        })
+        .join(", ")}`,
+    });
+
+    return RuleApplicationResultUtil.updated(ownersAdded);
   }
 
   private doesPodmanHostMatchRule(

package/Server/Services/ProjectService.ts

@@ -26,6 +26,7 @@ import {
 } from "../../Types/Marketing/Attribution";
 import SessionReplayGateCacheStore from "../Utils/SessionReplay/SessionReplayGateCacheStore";
 import AccessTokenService from "./AccessTokenService";
+import type AuditLogServiceType from "./AuditLogService";
 import BillingService from "./BillingService";
 import DatabaseService from "./DatabaseService";
 import DeletedProjectService from "./DeletedProjectService";
@@ -48,7 +49,9 @@ import UserService from "./UserService";
 import SubscriptionPlan, {
   PlanType,
 } from "../../Types/Billing/SubscriptionPlan";
-import SubscriptionStatus from "../../Types/Billing/SubscriptionStatus";
+import SubscriptionStatus, {
+  SubscriptionStatusUtil,
+} from "../../Types/Billing/SubscriptionStatus";
 import ProjectBalanceType from "../../Types/Billing/ProjectBalanceType";
 import BalanceAdjustmentType from "../../Types/Billing/BalanceAdjustmentType";
 import {
@@ -75,6 +78,7 @@ import IconProp from "../../Types/Icon/IconProp";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import DataResidencyUtil from "../../Utils/Project/DataResidency";
 import IncidentSeverity from "../../Models/DatabaseModels/IncidentSeverity";
 import IncidentState from "../../Models/DatabaseModels/IncidentState";
 import IncidentRole from "../../Models/DatabaseModels/IncidentRole";
@@ -183,6 +187,32 @@ export class ProjectService extends DatabaseService<Model> {
     return SubscriptionPlan.getPlanType(planId);
   }
 
+  /*
+   * Runs on every create and update that carries dataResidency, before the
+   * write. Who may write it is the column's access control (master admins
+   * only); this is what they may write: trimmed text, a blank stored as null,
+   * and nothing at all on a server without billing, where the label would
+   * describe nothing. Clearing is always allowed, so a project that picked up
+   * a value before billing was turned off can still be tidied.
+   */
+  public applyDataResidencyRules(data: { dataResidency?: unknown }): void {
+    if (data.dataResidency === undefined) {
+      return;
+    }
+
+    const dataResidency: string | null = DataResidencyUtil.normalize(
+      data.dataResidency,
+    );
+
+    if (dataResidency !== null && !IsBillingEnabled) {
+      throw new BadDataException(
+        "Data residency can only be set when billing is enabled.",
+      );
+    }
+
+    data.dataResidency = dataResidency;
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     data: CreateBy<Model>,
@@ -191,6 +221,8 @@ export class ProjectService extends DatabaseService<Model> {
       throw new BadDataException("Project name is required");
     }
 
+    this.applyDataResidencyRules(data.data);
+
     if (data.props.userId) {
       data.data.createdByUserId = data.props.userId;
     } else {
@@ -426,6 +458,8 @@ export class ProjectService extends DatabaseService<Model> {
     const updateData: Record<string, unknown> = onUpdate.updateBy
       .data as unknown as Record<string, unknown>;
 
+    this.invalidateAuditLogSettingsCache(updateData, updatedItemIds);
+
     if (!("isSessionReplayAllowed" in updateData)) {
       return onUpdate;
     }
@@ -456,6 +490,58 @@ export class ProjectService extends DatabaseService<Model> {
     return onUpdate;
   }
 
+  /*
+   * AuditLogService caches each project's audit settings for a minute, and
+   * nothing invalidated that cache - so for up to a minute after someone
+   * turned audit logging on, the process that saved it kept recording nothing
+   * (and kept recording after it was turned off). Drop the entry as soon as a
+   * column that decides what gets recorded changes: the three audit settings,
+   * and the plan, which decides eligibility when billing is on. Only this
+   * process's cache is reachable from here; other processes still wait out the
+   * TTL. Compared against undefined rather than with `in`, because a Project
+   * model instance carries every column as an own property.
+   */
+  private invalidateAuditLogSettingsCache(
+    updateData: Record<string, unknown>,
+    updatedItemIds: Array<ObjectID>,
+  ): void {
+    const auditLogSettingColumns: Array<string> = [
+      "enableAuditLogs",
+      "storeSystemEventsInAuditLogs",
+      "auditLogsRetentionInDays",
+      "planName",
+    ];
+
+    const hasAuditLogSettingChanged: boolean = auditLogSettingColumns.some(
+      (column: string): boolean => {
+        return updateData[column] !== undefined;
+      },
+    );
+
+    if (!hasAuditLogSettingChanged) {
+      return;
+    }
+
+    try {
+      /*
+       * Lazy require: AuditLogService imports ProjectService, so a top-level
+       * import here would be circular.
+       */
+      const auditLogService: typeof AuditLogServiceType =
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+        require("./AuditLogService").default;
+
+      for (const projectId of updatedItemIds) {
+        auditLogService.invalidateProjectSettings(projectId);
+      }
+    } catch (err) {
+      logger.warn(
+        "ProjectService: could not invalidate the audit log settings cache",
+      );
+      logger.warn(err);
+    }
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
@@ -472,6 +558,8 @@ export class ProjectService extends DatabaseService<Model> {
       this.requireSsoWithSsoProviderIdCache.clear();
     }
 
+    this.applyDataResidencyRules(updateBy.data);
+
     if (IsBillingEnabled) {
       if (
         updateBy.data.businessDetails ||
@@ -2899,17 +2987,30 @@ These are no longer recorded against the project and have to be cancelled by han
     await this.sendSubscriptionChangeWebhookSlackNotification(projectId);
   }
 
+  /*
+   * Projects that are still served: monitors fetched and evaluated, heartbeat
+   * and online sweeps run, SLOs evaluated, server-monitor reports accepted.
+   *
+   * The statuses come from SubscriptionStatusUtil.getActiveSubscriptionStatuses
+   * rather than being listed here, so this query cannot disagree with
+   * isSubscriptionActive again. It used to list only active and trialing,
+   * which dropped a past_due project out of every monitoring path the moment
+   * one autopay attempt failed - while Stripe was still retrying the invoice
+   * and the dashboard still called the project active. past_due projects keep
+   * being monitored; only a subscription Stripe has given up on (unpaid,
+   * canceled, incomplete, incomplete_expired, expired, paused) stops it.
+   *
+   * NULL stays admitted: that is a project with no subscription at all
+   * (self-hosted, or created before billing was enabled).
+   */
   public getActiveProjectStatusQuery(): Query<Model> {
     return {
-      // get only active projects
-      paymentProviderSubscriptionStatus: QueryHelper.equalToOrNull([
-        SubscriptionStatus.Active,
-        SubscriptionStatus.Trialing,
-      ]),
-      paymentProviderMeteredSubscriptionStatus: QueryHelper.equalToOrNull([
-        SubscriptionStatus.Active,
-        SubscriptionStatus.Trialing,
-      ]),
+      paymentProviderSubscriptionStatus: QueryHelper.equalToOrNull(
+        SubscriptionStatusUtil.getActiveSubscriptionStatuses(),
+      ),
+      paymentProviderMeteredSubscriptionStatus: QueryHelper.equalToOrNull(
+        SubscriptionStatusUtil.getActiveSubscriptionStatuses(),
+      ),
     };
   }