@oneuptime/common 13.0.7 → 13.0.8

package/Models/DatabaseModels/OnCallDutyPolicyScheduleCalendarFeed.ts

@@ -298,7 +298,7 @@ export default class OnCallDutyPolicyScheduleCalendarFeed extends BaseModel {
 
   @ColumnAccessControl({
     create: [],
-    read: [],
+    read: readPermissions,
     update: [],
   })
   @TableColumn({

package/Models/DatabaseModels/ProjectOnCallCalendarFeed.ts

@@ -230,7 +230,7 @@ export default class ProjectOnCallCalendarFeed extends BaseModel {
 
   @ColumnAccessControl({
     create: [],
-    read: [],
+    read: readPermissions,
     update: [],
   })
   @TableColumn({

package/Models/DatabaseModels/UserOnCallCalendarFeed.ts

@@ -258,7 +258,7 @@ export default class UserOnCallCalendarFeed extends BaseModel {
 
   @ColumnAccessControl({
     create: [],
-    read: [],
+    read: [Permission.CurrentUser],
     update: [],
   })
   @TableColumn({

package/Server/API/AIBillingAPI.ts

@@ -20,6 +20,7 @@ const router: ExpressRouter = Express.getRouter();
 router.post(
   "/ai/recharge",
   UserMiddleware.getUserMiddleware,
+  UserMiddleware.requireUserAuthentication,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     try {
       if (!IsBillingEnabled) {

package/Server/API/AIInsightAPI.ts

@@ -10,7 +10,6 @@ import Response from "../Utils/Response";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
 import BadDataException from "../../Types/Exception/BadDataException";
-import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import { JSONArray, JSONObject } from "../../Types/JSON";
 import AIInsightStatus from "../../Types/AI/AIInsightStatus";
 import AIInsightHumanVerdict from "../../Types/AI/AIInsightHumanVerdict";
@@ -42,9 +41,7 @@ async function getLoggedInProps(
   const props: DatabaseCommonInteractionProps =
     await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-  if (!props.userId) {
-    throw new NotAuthorizedException("A logged-in user session is required.");
-  }
+  CommonAPI.assertAuthenticatedUser(props);
 
   return props;
 }

package/Server/API/AIInvestigationAPI.ts

@@ -11,7 +11,6 @@ import Response from "../Utils/Response";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
 import BadDataException from "../../Types/Exception/BadDataException";
-import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import Query from "../../Types/BaseDatabase/Query";
 import { JSONArray, JSONObject } from "../../Types/JSON";
@@ -184,9 +183,7 @@ async function getLoggedInProps(
   const props: DatabaseCommonInteractionProps =
     await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-  if (!props.userId) {
-    throw new NotAuthorizedException("A logged-in user session is required.");
-  }
+  CommonAPI.assertAuthenticatedUser(props);
 
   return props;
 }

package/Server/API/AIReadinessAPI.ts

@@ -49,11 +49,10 @@ router.post(
        * because it loads the exception with the caller's props first, and
        * derives the project from that authorized row.
        */
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI readiness requires a logged-in user session.",
-        );
-      }
+      CommonAPI.assertAuthenticatedUser(
+        props,
+        "AI readiness requires a logged-in user session.",
+      );
 
       if (!props.tenantId) {
         throw new BadDataException("Project ID is required (tenantid header).");

package/Server/API/AlertAPI.ts

@@ -38,6 +38,7 @@ export default class AlertAPI extends BaseAPI<Alert, AlertServiceType> {
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/generate-note-from-ai/:alertId`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.generateNoteFromAI(req, res);

package/Server/API/AutoRemediationAPI.ts

@@ -11,7 +11,6 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import BadDataException from "../../Types/Exception/BadDataException";
-import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import AutoRemediationSuggestionStatus from "../../Types/AutoRemediation/AutoRemediationSuggestionStatus";
 import AutoRemediationSuggestionType from "../../Types/AutoRemediation/AutoRemediationSuggestionType";
 import AutoRemediationVerificationStatus from "../../Types/AutoRemediation/AutoRemediationVerificationStatus";
@@ -65,9 +64,7 @@ async function getLoggedInProps(
   const props: DatabaseCommonInteractionProps =
     await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-  if (!props.userId) {
-    throw new NotAuthorizedException("A logged-in user session is required.");
-  }
+  CommonAPI.assertAuthenticatedUser(props);
 
   return props;
 }

package/Server/API/BaseAPI.ts

@@ -553,6 +553,19 @@ export default class BaseAPI<
       this.entityType,
     ) as TBaseModel;
 
+    /*
+     * A create builds a brand-new row, so it must not carry the row's own
+     * primary key. getRepository().save() treats an entity that already has an
+     * id as an update of the existing row rather than an insert, so a stray
+     * `_id` (or the `id` spelling, which BaseModel.fromJSON has already folded
+     * into `_id`) would make a "create" modify an existing record instead.
+     * updateItem strips `_id` for a related reason; do it here too. Only the
+     * top-level primary key is removed - nested `_id`s inside relation
+     * objects/arrays reference existing related rows and are left untouched.
+     */
+    delete (item as any)["_id"];
+    delete (item as any)["id"];
+
     const miscDataProps: JSONObject = JSONFunctions.deserialize(
       body["miscDataProps"] as JSONObject,
     );

package/Server/API/BaseAnalyticsAPI.ts

@@ -3,6 +3,9 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import AnalyticsDatabaseService from "../Services/AnalyticsDatabaseService";
 import CreateBy from "../Types/AnalyticsDatabase/CreateBy";
 import GroupBy from "../Types/AnalyticsDatabase/GroupBy";
+import ModelPermission, {
+  CheckReadPermissionType,
+} from "../Types/AnalyticsDatabase/ModelPermission";
 import Query from "../Types/AnalyticsDatabase/Query";
 import Select from "../Types/AnalyticsDatabase/Select";
 import Sort from "../Types/AnalyticsDatabase/Sort";
@@ -39,11 +42,9 @@ import logger from "../Utils/Logger";
  * widgets loading on the same page) onto a single ClickHouse query
  * while still looking real-time to humans.
  *
- * Project-scoped only: analytics data is project-wide and the
- * service layer enforces project-scoped read permissions, so
- * caching across users within the same project is safe. Endpoints
- * with row-level access scoping should override `getAggregate` to
- * skip the cache (or shape the key to include the access scope).
+ * A cache hit never reaches the service, which is where the read
+ * check lives, so getAggregateCacheKey runs that check itself and
+ * keys the slot on the permission-scoped query — see there.
  */
 const ANALYTICS_AGGREGATE_CACHE_TTL_SECONDS: number = 8;
 
@@ -396,11 +397,11 @@ export default class BaseAnalyticsAPI<
      * burst. On cache outage (Redis down, parse error, …) we fall
      * through to a live query so behavior degrades to today's.
      */
-    const projectId: string | undefined = databaseProps.tenantId?.toString();
     const cacheNamespace: string = `${this.getEntityName()}-aggregate`;
-    const cacheKey: string | null = projectId
-      ? `${projectId}:${this.buildAggregateCacheKey(aggregateBy)}`
-      : null;
+    const cacheKey: string | null = await this.getAggregateCacheKey(
+      aggregateBy,
+      databaseProps,
+    );
 
     if (cacheKey) {
       try {
@@ -438,6 +439,76 @@ export default class BaseAnalyticsAPI<
     return Response.sendJsonObjectResponse(req, res, responseBody);
   }
 
+  /*
+   * A cached aggregate is answered BEFORE service.aggregateBy runs, and
+   * service.aggregateBy is where the read check lives. So a hit has to
+   * clear that same check first — otherwise anyone who can name a project
+   * in the `tenantid` header (getUserMiddleware accepts it even from an
+   * anonymous caller) reads whatever someone else aggregated there in the
+   * last few seconds.
+   *
+   * checkReadPermission runs here on a copy of the query, with the same
+   * select the service passes. It throws for an anonymous caller (401) and
+   * for one without read permission on the model or the queried columns
+   * (422), and it returns the query the live path would send to
+   * ClickHouse. That scoped query goes into the key because it carries
+   * everything that makes one caller's result differ from another's: the
+   * tenant, the Owned / label-restricted `IN (...)` filter on the owning
+   * resource, and for a multi-tenant request the caller's own list of
+   * projects.
+   *
+   * The caller's raw query stays in the key next to it. Scoping overwrites
+   * projectId, but a service can still plan from the raw query —
+   * MetricService picks point-type and rollup routing from the projectId
+   * the caller sent, before its own check rewrites it — so two requests
+   * that scope to the same query can still compute different results.
+   * Callers share a slot only when both their request and their access
+   * scope are identical.
+   *
+   * Returns null (skip the cache) without a tenant, and for a request the
+   * service's own validation is about to reject, so that request gets the
+   * service's error message rather than one from the check here.
+   */
+  protected async getAggregateCacheKey(
+    aggregateBy: AggregateBy<AnalyticsDataModel>,
+    props: DatabaseCommonInteractionProps,
+  ): Promise<string | null> {
+    if (!props.tenantId) {
+      return null;
+    }
+
+    const aggregateColumnName: string | undefined =
+      aggregateBy.aggregateColumnName?.toString();
+    const timestampColumnName: string | undefined =
+      aggregateBy.aggregationTimestampColumnName?.toString();
+    const model: TAnalyticsDataModel = new this.entityType();
+
+    if (
+      !aggregateColumnName ||
+      !timestampColumnName ||
+      !model.getTableColumn(aggregateColumnName) ||
+      !model.getTableColumn(timestampColumnName)
+    ) {
+      return null;
+    }
+
+    const scoped: CheckReadPermissionType<TAnalyticsDataModel> =
+      await ModelPermission.checkReadPermission(
+        this.entityType,
+        { ...(aggregateBy.query || {}) } as Query<TAnalyticsDataModel>,
+        {
+          [aggregateColumnName]: true,
+          [timestampColumnName]: true,
+        } as Select<TAnalyticsDataModel>,
+        props,
+      );
+
+    return `${props.tenantId.toString()}:${this.buildAggregateCacheKey({
+      ...aggregateBy,
+      scopedQuery: scoped.query,
+    } as AggregateBy<AnalyticsDataModel>)}`;
+  }
+
   /*
    * Stable serialization for the aggregate cache key. Date instances
    * are normalized to ISO so two logically-equal time windows hit

package/Server/API/BillingAPI.ts

@@ -126,6 +126,7 @@ export default class BillingAPI {
     this.router.get(
       `/billing/pay-as-you-go-status`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const projectId: ObjectID | null = this.getTenantId(req);
@@ -158,6 +159,7 @@ export default class BillingAPI {
     this.router.get(
       `/billing/customer-balance`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {

package/Server/API/BillingInvoiceAPI.ts

@@ -137,6 +137,7 @@ export default class UserAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/pay`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {

package/Server/API/BillingPaymentMethodAPI.ts

@@ -44,6 +44,7 @@ export default class UserAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/setup`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {
@@ -121,6 +122,7 @@ export default class UserAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/set-default`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {

package/Server/API/CodeFixRunAPI.ts

@@ -358,9 +358,7 @@ export default class CodeFixRunAPI {
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    if (!props.userId) {
-      throw new NotAuthorizedException("A logged-in user session is required.");
-    }
+    CommonAPI.assertAuthenticatedUser(props);
 
     if (!props.tenantId) {
       throw new BadDataException("Project ID is required (tenantid header).");

package/Server/API/CommonAPI.ts

@@ -31,14 +31,19 @@ export default class CommonAPI {
    * missing header. Assert the scope up front so the caller gets the real
    * cause.
    *
-   * This deliberately checks the tenant only, not the user: API-key callers
-   * are authenticated by ProjectMiddleware and carry tenant permissions
-   * without ever setting `userId`. Use assertAuthenticatedProjectMember when
-   * an endpoint must additionally be a logged-in human member.
+   * This deliberately checks the tenant, not the user: API-key callers are
+   * authenticated by ProjectMiddleware and carry tenant permissions without
+   * ever setting `userId`. It does refuse a caller with no credentials at all
+   * (401, see assertCredentialsPresent), because a tenant header on its own
+   * proves nothing and usually means an expired session. Use
+   * assertAuthenticatedProjectMember when an endpoint must additionally be a
+   * logged-in human member.
    */
   public static assertTenantScoped(
     databaseProps: DatabaseCommonInteractionProps,
   ): ObjectID {
+    CommonAPI.assertCredentialsPresent(databaseProps);
+
     const projectId: ObjectID | undefined = databaseProps.tenantId;
 
     if (!projectId) {
@@ -64,6 +69,8 @@ export default class CommonAPI {
   public static assertAuthenticatedProjectPrincipal(
     databaseProps: DatabaseCommonInteractionProps,
   ): ObjectID {
+    CommonAPI.assertCredentialsPresent(databaseProps);
+
     const projectId: ObjectID | undefined = databaseProps.tenantId;
 
     if (!projectId) {
@@ -85,6 +92,59 @@ export default class CommonAPI {
     return projectId;
   }
 
+  public static readonly AUTHENTICATION_REQUIRED_MESSAGE: string =
+    DatabaseCommonInteractionPropsUtil.AUTHENTICATION_REQUIRED_MESSAGE;
+
+  // See DatabaseCommonInteractionPropsUtil.isAnonymous.
+  public static isAnonymous(
+    databaseProps: DatabaseCommonInteractionProps,
+  ): boolean {
+    return DatabaseCommonInteractionPropsUtil.isAnonymous(databaseProps);
+  }
+
+  /*
+   * "Who are you?" comes before "may you?".
+   *
+   * An anonymous caller has to get 401, never 422 or 400. The browser client
+   * (Common/UI/Utils/API/API.ts) refreshes the session and replays the request
+   * on a 401 and on nothing else, so answering an expired session with "you
+   * are not authorized to access this project's data" leaves a signed-in user
+   * looking at an authorization error until something else happens to trigger
+   * a 401. Every guard below calls this first, and so should any custom route
+   * that checks its caller by hand.
+   *
+   * Callers that ARE authenticated but lack access keep whatever refusal the
+   * route already gives them.
+   */
+  public static assertCredentialsPresent(
+    databaseProps: DatabaseCommonInteractionProps,
+  ): void {
+    DatabaseCommonInteractionPropsUtil.assertCredentialsPresent(databaseProps);
+  }
+
+  /*
+   * For routes that act as a person (they record who approved, who asked,
+   * whose settings changed) and so cannot run on an API key.
+   *
+   * No credentials is 401, as above. A project API key IS authenticated, so it
+   * gets the route's own refusal (422) rather than a 401 its client would
+   * answer by trying to refresh a session it never had.
+   */
+  public static assertAuthenticatedUser(
+    databaseProps: DatabaseCommonInteractionProps,
+    notAUserMessage?: string,
+  ): ObjectID {
+    CommonAPI.assertCredentialsPresent(databaseProps);
+
+    if (!databaseProps.userId) {
+      throw new NotAuthorizedException(
+        notAUserMessage || "A logged-in user session is required.",
+      );
+    }
+
+    return databaseProps.userId;
+  }
+
   /*
    * getUserMiddleware lets unauthenticated requests through as "public" and
    * takes the tenant id from a caller-supplied header — custom endpoints
@@ -95,6 +155,8 @@ export default class CommonAPI {
   public static assertAuthenticatedProjectMember(
     databaseProps: DatabaseCommonInteractionProps,
   ): ObjectID {
+    CommonAPI.assertCredentialsPresent(databaseProps);
+
     const projectId: ObjectID | undefined = databaseProps.tenantId;
 
     if (!projectId) {
@@ -179,6 +241,8 @@ export default class CommonAPI {
     allowedPermissions: Array<Permission>;
     errorMessage?: string | undefined;
   }): void {
+    CommonAPI.assertCredentialsPresent(data.databaseProps);
+
     if (data.databaseProps.isMasterAdmin) {
       return;
     }

package/Server/API/DashboardAPI.ts

@@ -415,7 +415,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/seo/:dashboardIdOrDomain`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const dashboardIdOrDomain: string = req.params[
@@ -596,7 +596,7 @@ export default class DashboardAPI extends BaseAPI<
     this.router.post(
       overviewApiPath,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       overviewHandler,
     );
 
@@ -608,7 +608,7 @@ export default class DashboardAPI extends BaseAPI<
     this.router.get(
       overviewApiPath,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       overviewHandler,
     );
 
@@ -616,7 +616,7 @@ export default class DashboardAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/domain`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!req.body["domain"]) {
@@ -662,7 +662,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/metadata/:dashboardId`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const dashboardId: ObjectID = new ObjectID(
@@ -725,7 +725,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/view-config/:dashboardId`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const dashboardId: ObjectID = new ObjectID(
@@ -827,7 +827,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/attribute-values/:dashboardId`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const dashboardId: ObjectID = new ObjectID(
@@ -941,7 +941,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/metric-types/:dashboardId`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const dashboardId: ObjectID = new ObjectID(
@@ -1051,7 +1051,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/metrics-aggregate/:dashboardId`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const dashboardId: ObjectID = new ObjectID(
@@ -1328,7 +1328,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resource-list/:dashboardId/:resourceType`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const resourceType: string = req.params["resourceType"] as string;
@@ -1368,7 +1368,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/slo-history-aggregate/:dashboardId`,
       publicDashboardRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const dashboardId: ObjectID = new ObjectID(
@@ -1506,7 +1506,7 @@ export default class DashboardAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/master-password/:dashboardId`,
       masterPasswordRateLimit,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!req.params["dashboardId"]) {

package/Server/API/GlobalConfigAPI.ts

@@ -26,6 +26,7 @@ import {
 import EnterpriseLicenseInstanceSummary from "../../Types/EnterpriseLicense/EnterpriseLicenseInstanceSummary";
 import VersionUtil from "../../Utils/VersionUtil";
 import UserMiddleware from "../Middleware/UserAuthorization";
+import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
 import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import EnterpriseLicenseSeatUtil from "../Utils/EnterpriseLicense/EnterpriseLicenseSeatUtil";
 import { SeatUsage } from "../../Utils/EnterpriseLicense/EnterpriseLicenseSeats";
@@ -70,6 +71,22 @@ export default class GlobalConfigAPI extends BaseAPI<
       UserMiddleware.getUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
+          /*
+           * This route also serves the login page, so a caller with no session
+           * normally gets the reduced anonymous payload below. Unless it says
+           * it is signed in (the dashboards do): then no session means an
+           * expired one, and the anonymous payload would read as "unlicensed".
+           * Answer 401 so the client refreshes and asks again.
+           */
+          if (
+            req.query["signedIn"] === "true" &&
+            UserMiddleware.isAnonymousRequest(req as OneUptimeRequest)
+          ) {
+            throw new NotAuthenticatedException(
+              UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+            );
+          }
+
           const config: GlobalConfig | null =
             await GlobalConfigService.findOneById({
               id: ObjectID.getZeroObjectID(),

package/Server/API/IncidentAPI.ts

@@ -58,6 +58,7 @@ export default class IncidentAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/generate-postmortem-from-ai/:incidentId`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.generatePostmortemFromAI(req, res);
@@ -73,6 +74,7 @@ export default class IncidentAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/generate-note-from-ai/:incidentId`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.generateNoteFromAI(req, res);

package/Server/API/IncidentEpisodeAPI.ts

@@ -43,6 +43,7 @@ export default class IncidentEpisodeAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/generate-postmortem-from-ai/:episodeId`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.generatePostmortemFromAI(req, res);

package/Server/API/NotificationAPI.ts

@@ -19,6 +19,7 @@ const router: ExpressRouter = Express.getRouter();
 router.post(
   "/notification/recharge",
   UserMiddleware.getUserMiddleware,
+  UserMiddleware.requireUserAuthentication,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     try {
       let amount: number | PositiveNumber = JSONFunctions.deserializeValue(

package/Server/API/OnCallCalendarAPI.ts

@@ -1500,11 +1500,10 @@ async function findPersonalFeed(data: {
 }
 
 function requireUserId(props: DatabaseCommonInteractionProps): ObjectID {
-  if (!props.userId) {
-    throw new BadDataException("A logged-in user is required.");
-  }
-
-  return props.userId;
+  return CommonAPI.assertAuthenticatedUser(
+    props,
+    "A logged-in user is required.",
+  );
 }
 
 router.get(

package/Server/API/OnCallDutyPolicyAPI.ts

@@ -35,6 +35,13 @@ export default class OnCallDutyPolicyAPI extends BaseAPI<
           const databaseProps: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          /*
+           * The header polls this on every dashboard page, so it is usually
+           * the first request to notice an expired session. It must answer
+           * 401 so the client refreshes, not "Invalid userId.".
+           */
+          CommonAPI.assertCredentialsPresent(databaseProps);
+
           const projectId: ObjectID = databaseProps.tenantId as ObjectID;
 
           const userId: ObjectID = databaseProps.userId as ObjectID;

package/Server/API/OnCallReadinessAPI.ts

@@ -68,7 +68,10 @@ import TeamMember from "../../Models/DatabaseModels/TeamMember";
  * header before any authorisation runs. So each route asserts, itself:
  *
  *   1. the caller is a logged-in member of the project it named
- *      (CommonAPI.assertAuthenticatedProjectMember), and
+ *      (CommonAPI.assertAuthenticatedProjectMember). A caller with no session
+ *      at all gets 401, not the 422 a non-member gets: in practice that caller
+ *      is an admin whose access-token cookie expired while the page sat open,
+ *      and only a 401 makes the dashboard refresh the session and resend, and
  *   2. the resource in the path - the policy, or the user - actually belongs to
  *      that same project, because otherwise a member of project A reads project
  *      B's data simply by sending their own `tenantid` header alongside a