@oneuptime/common 13.0.5 → 13.0.7

package/Server/Services/IncidentPrivacyRuleEngineService.ts

@@ -8,14 +8,53 @@ import IncidentPrivacyRuleService from "./IncidentPrivacyRuleService";
 import IncidentService from "./IncidentService";
 import { IncidentFeedEventType } from "../../Models/DatabaseModels/IncidentFeed";
 import { Red500 } from "../../Types/BrandColors";
+import Select from "../Types/Database/Select";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import MonitorRuleCriteriaCache from "../Utils/Rules/MonitorRuleCriteriaCache";
+import {
+  ApplyRulesToExistingResourceData,
+  RuleApplicationResult,
+  RuleApplicationResultUtil,
+  RuleRunEngine,
+} from "../Utils/Rules/RuleRun/RuleApplication";
+
+class IncidentPrivacyRuleEngineServiceClass
+  implements RuleRunEngine<Incident, IncidentPrivacyRule>
+{
+  public readonly ruleSelect: Select<IncidentPrivacyRule> = {
+    _id: true,
+    name: true,
+    criteria: true,
+    monitors: { _id: true },
+    incidentSeverities: { _id: true },
+    incidentLabels: { _id: true },
+    monitorLabels: { _id: true },
+    incidentTitlePattern: true,
+    incidentDescriptionPattern: true,
+    monitorNamePattern: true,
+    monitorDescriptionPattern: true,
+  };
+
+  /*
+   * Evaluation reads these straight off the incident it is handed (monitor
+   * names, descriptions and labels are then re-read per monitor id), and a
+   * run must see isPrivate to report an incident that is already private.
+   */
+  public readonly resourceSelectForRuleRun: Select<Incident> = {
+    _id: true,
+    projectId: true,
+    isPrivate: true,
+    title: true,
+    description: true,
+    incidentSeverityId: true,
+    monitors: { _id: true },
+    labels: { _id: true },
+  };
 
-class IncidentPrivacyRuleEngineServiceClass {
   /**
    * Evaluates IncidentPrivacyRule rows for the given incident. If any enabled
    * rule matches, the incident is marked private (isPrivate=true) and the
@@ -43,19 +82,7 @@ class IncidentPrivacyRuleEngineServiceClass {
             isEnabled: true,
           },
           props: { isRoot: true },
-          select: {
-            _id: true,
-            name: true,
-            criteria: true,
-            monitors: { _id: true },
-            incidentSeverities: { _id: true },
-            incidentLabels: { _id: true },
-            monitorLabels: { _id: true },
-            incidentTitlePattern: true,
-            incidentDescriptionPattern: true,
-            monitorNamePattern: true,
-            monitorDescriptionPattern: true,
-          },
+          select: this.ruleSelect,
           limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
@@ -70,38 +97,12 @@ class IncidentPrivacyRuleEngineServiceClass {
         return false;
       }
 
-      const matchedRules: Array<IncidentPrivacyRule> = [];
-      for (const rule of rules) {
-        const matches: boolean = await this.doesIncidentMatchRule(
-          incident,
-          rule,
-        );
-        if (matches) {
-          matchedRules.push(rule);
-        }
-      }
-
-      if (matchedRules.length === 0) {
-        return false;
-      }
-
-      await IncidentService.updateOneById({
-        id: incident.id,
-        data: { isPrivate: true },
-        props: { isRoot: true },
+      const result: RuleApplicationResult = await this.applyRules({
+        incident: incident,
+        rules: rules,
       });
 
-      // Mirror in memory so downstream onCreateSuccess steps see the change.
-      incident.isPrivate = true;
-
-      logger.debug(
-        `IncidentPrivacyRuleEngine marked incident ${incident.id} private`,
-        { projectId: incident.projectId.toString() } as LogAttributes,
-      );
-
-      await this.createRuleExecutedFeedItem({ incident, matchedRules });
-
-      return true;
+      return result.updated;
     } catch (error) {
       logger.error(`Error applying incident privacy rules: ${error}`, {
         projectId: incident.projectId?.toString(),
@@ -111,6 +112,78 @@ class IncidentPrivacyRuleEngineServiceClass {
     }
   }
 
+  /*
+   * "Run now": the same evaluation, for an incident that already exists and
+   * only the rules being run.
+   */
+  @CaptureSpan()
+  public async applyRulesToExistingResource(
+    data: ApplyRulesToExistingResourceData<Incident, IncidentPrivacyRule>,
+  ): Promise<RuleApplicationResult> {
+    try {
+      return await this.applyRules({
+        incident: data.resource,
+        rules: data.rules,
+      });
+    } catch (error) {
+      logger.error(`Error running incident privacy rules: ${error}`, {
+        projectId: data.resource.projectId?.toString(),
+        incidentId: data.resource.id?.toString(),
+      } as LogAttributes);
+
+      return RuleApplicationResultUtil.failed();
+    }
+  }
+
+  private async applyRules(data: {
+    incident: Incident;
+    rules: Array<IncidentPrivacyRule>;
+  }): Promise<RuleApplicationResult> {
+    const { incident, rules } = data;
+
+    if (!incident.id || !incident.projectId || rules.length === 0) {
+      return RuleApplicationResultUtil.noMatch();
+    }
+
+    const matchedRules: Array<IncidentPrivacyRule> = [];
+    for (const rule of rules) {
+      const matches: boolean = await this.doesIncidentMatchRule(incident, rule);
+      if (matches) {
+        matchedRules.push(rule);
+      }
+    }
+
+    if (matchedRules.length === 0) {
+      return RuleApplicationResultUtil.noMatch();
+    }
+
+    /*
+     * The create hook returns before evaluating an already-private incident;
+     * a run evaluates it anyway so it can report the rule as already applied.
+     */
+    if (incident.isPrivate === true) {
+      return RuleApplicationResultUtil.alreadyApplied();
+    }
+
+    await IncidentService.updateOneById({
+      id: incident.id,
+      data: { isPrivate: true },
+      props: { isRoot: true },
+    });
+
+    // Mirror in memory so downstream onCreateSuccess steps see the change.
+    incident.isPrivate = true;
+
+    logger.debug(
+      `IncidentPrivacyRuleEngine marked incident ${incident.id} private`,
+      { projectId: incident.projectId.toString() } as LogAttributes,
+    );
+
+    await this.createRuleExecutedFeedItem({ incident, matchedRules });
+
+    return RuleApplicationResultUtil.updated(1);
+  }
+
   @CaptureSpan()
   private async createRuleExecutedFeedItem(data: {
     incident: Incident;

package/Server/Services/IncidentPublicNoteService.ts

@@ -1,4 +1,5 @@
 import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import OneUptimeDate from "../../Types/Date";
@@ -12,6 +13,7 @@ import IncidentService from "./IncidentService";
 import Incident from "../../Models/DatabaseModels/Incident";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
+import SubscriberUpdateNotification from "../../Types/StatusPage/SubscriberUpdateNotification";
 import File from "../../Models/DatabaseModels/File";
 import FileAttachmentMarkdownUtil from "../Utils/FileAttachmentMarkdownUtil";
 import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
@@ -109,6 +111,28 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  /*
+   * An edit tells subscribers nothing unless the editor asked for it on this
+   * edit (see SubscriberUpdateNotification). When they did, queue the update
+   * notification; the IncidentPublicNote worker job sends it.
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (SubscriberUpdateNotification.isRequested(updateBy.miscDataProps)) {
+      updateBy.data.subscriberNotificationStatusOnNoteUpdated =
+        StatusPageSubscriberNotificationStatus.Pending;
+      updateBy.data.subscriberNotificationStatusMessageOnNoteUpdated =
+        SubscriberUpdateNotification.queuedMessage;
+    }
+
+    return {
+      updateBy: updateBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   public override async onCreateSuccess(
     _onCreate: OnCreate<Model>,

package/Server/Services/IncidentService.ts

@@ -24,6 +24,7 @@ import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import TeamMemberService from "./TeamMemberService";
 import UserService from "./UserService";
 import URL from "../../Types/API/URL";
+import { getSloAffectedResourceMarkdownLines } from "../../Utils/Slo/SloAffectedResourceMarkdown";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
@@ -31,11 +32,11 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import PositiveNumber from "../../Types/PositiveNumber";
-import Typeof from "../../Types/Typeof";
 import { applyIncidentSelfPrivacyFilter } from "../Utils/Incident/IncidentPrivacyFilter";
 import ProjectScopedReferenceValidator, {
   resolveReferenceId,
 } from "../Utils/Database/ProjectScopedReferenceValidator";
+import SloRecordReferenceValidator from "../Utils/Slo/SloRecordReferenceValidator";
 import UserNotificationEventType from "../../Types/UserNotification/UserNotificationEventType";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
 import DockerHost from "../../Models/DatabaseModels/DockerHost";
@@ -49,6 +50,7 @@ import IncidentOwnerUser from "../../Models/DatabaseModels/IncidentOwnerUser";
 import IncidentState from "../../Models/DatabaseModels/IncidentState";
 import IncidentStateTimeline from "../../Models/DatabaseModels/IncidentStateTimeline";
 import Monitor from "../../Models/DatabaseModels/Monitor";
+import ServiceLevelObjective from "../../Models/DatabaseModels/ServiceLevelObjective";
 import MonitorStatus from "../../Models/DatabaseModels/MonitorStatus";
 import User from "../../Models/DatabaseModels/User";
 import { IsBillingEnabled } from "../EnvironmentConfig";
@@ -97,6 +99,7 @@ import IncidentTemplateService from "./IncidentTemplateService";
 import IncidentTemplate from "../../Models/DatabaseModels/IncidentTemplate";
 import AIService, { AILogResponse } from "./AIService";
 import AIIncidentInvestigationRunner from "../Utils/AI/SRE/IncidentInvestigationRunner";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import IncidentAIContextBuilder, {
   AIGenerationContext,
   IncidentContextData,
@@ -597,7 +600,22 @@ export class Service extends DatabaseService<Model> {
       resolveReferenceId(updateBy.data.changeMonitorStatusToId) ||
       resolveReferenceId(updateBy.data.changeMonitorStatusTo);
 
-    if (!incidentStateId && !incidentSeverityId && !changeMonitorStatusToId) {
+    /*
+     * The SLOs this incident affects: a relation list the API accepts on
+     * update. Checked for the same reason as on create; see
+     * SloRecordReferenceValidator.
+     */
+    const hasServiceLevelObjectiveIds: boolean =
+      SloRecordReferenceValidator.getReferencedIds(
+        updateBy.data.serviceLevelObjectives,
+      ).length > 0;
+
+    if (
+      !incidentStateId &&
+      !incidentSeverityId &&
+      !changeMonitorStatusToId &&
+      !hasServiceLevelObjectiveIds
+    ) {
       return;
     }
 
@@ -610,6 +628,20 @@ export class Service extends DatabaseService<Model> {
       : await this.getProjectIdsForUpdateQuery(updateBy);
 
     for (const projectId of projectIds) {
+      if (hasServiceLevelObjectiveIds) {
+        await SloRecordReferenceValidator.validateServiceLevelObjectivesBelongToProject(
+          {
+            projectId: projectId,
+            subject: "incident",
+            serviceLevelObjectives: updateBy.data.serviceLevelObjectives,
+          },
+        );
+      }
+
+      if (!incidentStateId && !incidentSeverityId && !changeMonitorStatusToId) {
+        continue;
+      }
+
       await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
         projectId: projectId,
         subject: "incident",
@@ -974,6 +1006,21 @@ export class Service extends DatabaseService<Model> {
       ],
     });
 
+    /*
+     * The SLOs this incident affects. The burn-rate worker links its own
+     * same-project SLO as root, but the column is writable by API callers too.
+     * Another project's SLO would put that SLO's name into this project's
+     * feed, lists and metrics. Before the counter increment, like the check
+     * above.
+     */
+    await SloRecordReferenceValidator.validateServiceLevelObjectivesBelongToProject(
+      {
+        projectId: projectId,
+        subject: "incident",
+        serviceLevelObjectives: createBy.data.serviceLevelObjectives,
+      },
+    );
+
     const incidentCounterResult: {
       counter: number;
       prefix: string | undefined;
@@ -1105,6 +1152,16 @@ export class Service extends DatabaseService<Model> {
           name: true,
           _id: true,
         },
+        /*
+         * Named under "Resources Affected" in the created feed item. This read
+         * runs as root, so projectId comes along and the feed names only this
+         * project's SLOs (getSloAffectedResourceMarkdownLines).
+         */
+        serviceLevelObjectives: {
+          name: true,
+          _id: true,
+          projectId: true,
+        },
       },
       props: {
         isRoot: true,
@@ -1560,13 +1617,38 @@ ${incident.description || "No description provided."}
         feedInfoInMarkdown += `⚠️ **Severity**: ${incident.incidentSeverity.name} \n\n`;
       }
 
-      if (incident.monitors && incident.monitors.length > 0) {
+      /*
+       * Monitors, then the SLOs this incident is linked to. A burn-rate
+       * incident carries no monitors on purpose, so its SLO is the only
+       * resource there is to name - and the feed's only way back to the
+       * objective that declared it. The SLO link is built inline:
+       * ServiceLevelObjectiveService cannot be imported here (it reaches
+       * this service through the burn-rate rule service).
+       */
+      const sloLines: Array<string> =
+        incident.serviceLevelObjectives &&
+        incident.serviceLevelObjectives.length > 0
+          ? getSloAffectedResourceMarkdownLines({
+              dashboardUrl: await DatabaseConfig.getDashboardUrl(),
+              projectId: incident.projectId!,
+              serviceLevelObjectives: incident.serviceLevelObjectives,
+            })
+          : [];
+
+      if (
+        (incident.monitors && incident.monitors.length > 0) ||
+        sloLines.length > 0
+      ) {
         feedInfoInMarkdown += `🌎 **Resources Affected**:\n`;
 
-        for (const monitor of incident.monitors) {
+        for (const monitor of incident.monitors || []) {
           feedInfoInMarkdown += `- [${monitor.name}](${(await MonitorService.getMonitorLinkInDashboard(incident.projectId!, monitor.id!)).toString()})\n`;
         }
 
+        for (const sloLine of sloLines) {
+          feedInfoInMarkdown += `${sloLine}\n`;
+        }
+
         feedInfoInMarkdown += `\n\n`;
       }
 
@@ -1893,37 +1975,18 @@ ${incident.remediationNotes || "No remediation notes provided."}
     notifyOwners: boolean,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: IncidentOwnerTeam = new IncidentOwnerTeam();
-      teamOwner.incidentId = incidentId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-
-      await IncidentOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: IncidentOwnerUser = new IncidentOwnerUser();
-      teamOwner.incidentId = incidentId;
-      teamOwner.projectId = projectId;
-      teamOwner.userId = userId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-      await IncidentOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the incident are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: IncidentOwnerUserService,
+      ownerTeamService: IncidentOwnerTeamService,
+      resourceIdColumn: "incidentId",
+      resourceId: incidentId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      isOwnerNotified: !notifyOwners,
+      props: props,
+    });
   }
 
   @CaptureSpan()
@@ -3117,6 +3180,15 @@ ${incidentSeverity.name}
           _id: true,
           name: true,
         },
+        /*
+         * The SLOs this incident affects, stamped below so an SLO's Metrics
+         * page can chart the incidents that hit it. Only _id and name, which
+         * the SLO model allows on relation reads.
+         */
+        serviceLevelObjectives: {
+          _id: true,
+          name: true,
+        },
         incidentSeverity: {
           _id: true,
           name: true,
@@ -3238,6 +3310,26 @@ ${incidentSeverity.name}
           })
           .filter(Boolean) || []
       ).join(", "),
+      /*
+       * Comma-joined like monitorIds: one incident can affect several SLOs.
+       * The SLO Metrics page filters its Incident tab on
+       * serviceLevelObjectiveIds (SERVICE_LEVEL_OBJECTIVE_IDS_METRIC_ATTRIBUTE
+       * in Common/Utils/Slo/SloMetricType), so the key must not be renamed.
+       */
+      serviceLevelObjectiveIds: (
+        incident.serviceLevelObjectives
+          ?.map((serviceLevelObjective: ServiceLevelObjective) => {
+            return serviceLevelObjective._id?.toString();
+          })
+          .filter(Boolean) || []
+      ).join(", "),
+      serviceLevelObjectiveNames: (
+        incident.serviceLevelObjectives
+          ?.map((serviceLevelObjective: ServiceLevelObjective) => {
+            return serviceLevelObjective.name?.toString();
+          })
+          .filter(Boolean) || []
+      ).join(", "),
       incidentSeverityId: incident.incidentSeverity?._id?.toString(),
       incidentSeverityName: incident.incidentSeverity?.name?.toString(),
       ownerUserIds: ownerUserIds.join(", "),

package/Server/Services/IncidentTemplateService.ts

@@ -11,15 +11,13 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import Dictionary from "../../Types/Dictionary";
 import ObjectID from "../../Types/ObjectID";
-import Typeof from "../../Types/Typeof";
 import Model from "../../Models/DatabaseModels/IncidentTemplate";
-import IncidentTemplateOwnerTeam from "../../Models/DatabaseModels/IncidentTemplateOwnerTeam";
-import IncidentTemplateOwnerUser from "../../Models/DatabaseModels/IncidentTemplateOwnerUser";
 import ProjectScopedReferenceValidator, {
   ProjectScopedReference,
   resolveReferenceId,
 } from "../Utils/Database/ProjectScopedReferenceValidator";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import QueryDeepPartialEntity from "../../Types/Database/PartialEntity";
 
 export class Service extends DatabaseService<Model> {
@@ -175,39 +173,18 @@ export class Service extends DatabaseService<Model> {
     notifyOwners: boolean,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: IncidentTemplateOwnerTeam =
-        new IncidentTemplateOwnerTeam();
-      teamOwner.incidentTemplateId = incidentTemplateId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-
-      await IncidentTemplateOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: IncidentTemplateOwnerUser =
-        new IncidentTemplateOwnerUser();
-      teamOwner.incidentTemplateId = incidentTemplateId;
-      teamOwner.projectId = projectId;
-      teamOwner.userId = userId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-      await IncidentTemplateOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the template are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: IncidentTemplateOwnerUserService,
+      ownerTeamService: IncidentTemplateOwnerTeamService,
+      resourceIdColumn: "incidentTemplateId",
+      resourceId: incidentTemplateId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      isOwnerNotified: !notifyOwners,
+      props: props,
+    });
   }
 }
 export default new Service();