@oneuptime/common 13.0.7 → 13.0.8

package/Server/Services/OnCallDutyPolicyChildService.ts

@@ -0,0 +1,261 @@
+import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import OnCallDutyPolicy from "../../Models/DatabaseModels/OnCallDutyPolicy";
+import OnCallDutyPolicyEscalationRule from "../../Models/DatabaseModels/OnCallDutyPolicyEscalationRule";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../Types/ObjectID";
+import Permission, {
+  PermissionHelper,
+  UserPermission,
+} from "../../Types/Permission";
+import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
+import CreateBy from "../Types/Database/CreateBy";
+import CreatePermission from "../Types/Database/Permissions/CreatePermission";
+import TablePermission from "../Types/Database/Permissions/TablePermission";
+import Query from "../Types/Database/Query";
+import RelationValueUtil from "../Utils/Database/RelationValueUtil";
+import DatabaseService from "./DatabaseService";
+
+/** Authorize escalation configuration before any create hook can change it. */
+export default class OnCallDutyPolicyChildService<
+  TBaseModel extends BaseModel,
+> extends DatabaseService<TBaseModel> {
+  public override async create(
+    createBy: CreateBy<TBaseModel>,
+  ): Promise<TBaseModel> {
+    const { data, props }: CreateBy<TBaseModel> = createBy;
+
+    if (props.isRoot || props.isMasterAdmin) {
+      return super.create(createBy);
+    }
+
+    /*
+     * Check the original columns before normalizing relations. In particular,
+     * a read-only caller must not reach the rule-ordering create hook.
+     */
+    CreatePermission.checkCreatePermissions(this.modelType, data, props);
+
+    if (!props.tenantId || props.isMultiTenantRequest) {
+      throw new NotAuthorizedException(
+        "A project is required to create on-call configuration.",
+      );
+    }
+
+    /*
+     * DatabaseService uses save(), which can update when an ID is supplied.
+     * A create grant must never replace an existing (possibly hidden) child.
+     */
+    if (data._id !== undefined && data._id !== null) {
+      throw new BadDataException(
+        "An ID cannot be supplied when creating on-call configuration.",
+      );
+    }
+
+    const projectId: ObjectID = props.tenantId;
+    const suppliedProjectId: ObjectID | null = this.normalizeReference(
+      data,
+      "project",
+    );
+    if (
+      suppliedProjectId &&
+      suppliedProjectId.toString() !== projectId.toString().toLowerCase()
+    ) {
+      throw new NotAuthorizedException(
+        "The on-call configuration must belong to the current project.",
+      );
+    }
+    data.setColumnValue("projectId", projectId);
+
+    const policyId: ObjectID | null = this.normalizeReference(
+      data,
+      "onCallDutyPolicy",
+    );
+    if (!policyId) {
+      throw new BadDataException("An on-call policy is required.");
+    }
+
+    const policyQuery: Query<OnCallDutyPolicy> = {
+      _id: policyId.toString(),
+      projectId,
+    };
+    const policyService: DatabaseService<OnCallDutyPolicy> =
+      new DatabaseService(OnCallDutyPolicy);
+    const policy: OnCallDutyPolicy | null = await policyService.findOneBy({
+      query: policyQuery,
+      select: { _id: true },
+      props,
+    });
+    if (!policy) {
+      throw new NotAuthorizedException(
+        "You do not have permission to create configuration for this on-call policy.",
+      );
+    }
+
+    /*
+     * Read access alone is insufficient: a broad viewer grant must not widen
+     * a Labels/Owned create grant or bypass a label-scoped create block. Apply
+     * the create grants to the already verified parent using the normal read
+     * scope machinery, which handles labels, ownership, and deny precedence.
+     */
+    const creatablePolicy: OnCallDutyPolicy | null =
+      await policyService.findOneBy({
+        query: policyQuery,
+        select: { _id: true },
+        props: this.getCreateScopeProps(props),
+      });
+    if (!creatablePolicy) {
+      throw new NotAuthorizedException(
+        "You do not have permission to create configuration for this on-call policy.",
+      );
+    }
+
+    if (data.hasColumn("onCallDutyPolicyEscalationRuleId")) {
+      const ruleId: ObjectID | null = this.normalizeReference(
+        data,
+        "onCallDutyPolicyEscalationRule",
+      );
+      if (!ruleId) {
+        throw new BadDataException("An on-call escalation rule is required.");
+      }
+
+      /*
+       * Escalation selects recipients by rule ID. Checking only policyId would
+       * let a caller pair an allowed policy with another policy's rule. This
+       * is an integrity lookup after authorizing the policy, not a new grant.
+       */
+      const rule: OnCallDutyPolicyEscalationRule | null =
+        await new DatabaseService(OnCallDutyPolicyEscalationRule).findOneBy({
+          query: {
+            _id: ruleId.toString(),
+            projectId,
+            onCallDutyPolicyId: policyId,
+          },
+          select: { _id: true },
+          props: { isRoot: true },
+        });
+      if (!rule) {
+        throw new NotAuthorizedException(
+          "The escalation rule is not available in this on-call policy.",
+        );
+      }
+    }
+
+    return super.create(createBy);
+  }
+
+  private getCreateScopeProps(
+    props: DatabaseCommonInteractionProps,
+  ): DatabaseCommonInteractionProps {
+    const createPermissions: Array<Permission> =
+      TablePermission.getTablePermission(
+        this.modelType,
+        DatabaseRequestType.Create,
+      );
+    const permissions: Array<UserPermission> = [
+      ...DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ),
+      ...DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Block,
+      ),
+    ]
+      .filter((row: UserPermission): boolean => {
+        return createPermissions.includes(row.permission);
+      })
+      .map((row: UserPermission): UserPermission => {
+        return {
+          ...row,
+          permission: Permission.OnCallMember,
+          scope: PermissionHelper.isScopeApplicable(row.permission)
+            ? row.scope
+            : PermissionScope.All,
+        };
+      });
+    const projectId: ObjectID = props.tenantId!;
+    return {
+      ...props,
+      userGlobalAccessPermission: {
+        _type: "UserGlobalAccessPermission",
+        globalPermissions: [],
+        projectIds: [projectId],
+      },
+      userTenantAccessPermission: {
+        [projectId.toString()]: {
+          _type: "UserTenantAccessPermission",
+          projectId,
+          permissions,
+        },
+      },
+    };
+  }
+
+  private normalizeReference(
+    data: TBaseModel,
+    relation: string,
+  ): ObjectID | null {
+    const column: string = `${relation}Id`;
+    const values: Record<string, unknown> = data as Record<string, unknown>;
+    const scalarValue: unknown = values[column];
+    const relationValue: unknown = values[relation];
+    const scalarId: string | null = this.referenceId(scalarValue);
+    const relationId: string | null = this.referenceId(relationValue);
+
+    if (scalarId && relationId && scalarId !== relationId) {
+      throw new BadDataException(
+        `${column} and ${relation} must refer to the same record.`,
+      );
+    }
+
+    const id: string | null = scalarId || relationId;
+    // A null relation must not override a tenant ID supplied by the request.
+    data.setColumnValue(relation, undefined);
+    if (!id) {
+      return null;
+    }
+
+    const objectId: ObjectID = new ObjectID(id);
+    data.setColumnValue(column, objectId);
+    // Leave one authoritative value for TypeORM and for downstream hooks.
+    return objectId;
+  }
+
+  private referenceId(value: unknown): string | null {
+    if (value === undefined || value === null) {
+      return null;
+    }
+
+    const id: string | null = RelationValueUtil.getRelationId(value);
+    if (!id) {
+      throw new BadDataException("A valid related record ID is required.");
+    }
+    ObjectID.validateUUID(id);
+
+    if (typeof value === "object" && !(value instanceof ObjectID)) {
+      const reference: Record<string, unknown> = value as Record<
+        string,
+        unknown
+      >;
+      if (
+        reference["_id"] !== undefined &&
+        reference["_id"] !== null &&
+        reference["id"] !== undefined &&
+        reference["id"] !== null &&
+        String(reference["_id"]).toLowerCase() !==
+          String(reference["id"]).toLowerCase()
+      ) {
+        throw new BadDataException(
+          "Conflicting related record IDs are not allowed.",
+        );
+      }
+    }
+
+    return id.toLowerCase();
+  }
+}

package/Server/Services/OnCallDutyPolicyEscalationRuleScheduleService.ts

@@ -1,7 +1,7 @@
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import { OnCreate, OnDelete } from "../Types/Database/Hooks";
-import DatabaseService from "./DatabaseService";
+import OnCallDutyPolicyChildService from "./OnCallDutyPolicyChildService";
 import Model from "../../Models/DatabaseModels/OnCallDutyPolicyEscalationRuleSchedule";
 import Dictionary from "../../Types/Dictionary";
 import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
@@ -27,7 +27,7 @@ import OneUptimeDate from "../../Types/Date";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
 
-export class Service extends DatabaseService<Model> {
+export class Service extends OnCallDutyPolicyChildService<Model> {
   public constructor() {
     super(Model);
   }

package/Server/Services/OnCallDutyPolicyEscalationRuleService.ts

@@ -5,7 +5,7 @@ import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import Query from "../Types/Database/Query";
 import QueryHelper from "../Types/Database/QueryHelper";
 import UpdateBy from "../Types/Database/UpdateBy";
-import DatabaseService from "./DatabaseService";
+import OnCallDutyPolicyChildService from "./OnCallDutyPolicyChildService";
 import OnCallDutyPolicyEscalationRuleScheduleService from "./OnCallDutyPolicyEscalationRuleScheduleService";
 import OnCallDutyPolicyEscalationRuleTeamService from "./OnCallDutyPolicyEscalationRuleTeamService";
 import OnCallDutyPolicyEscalationRuleUserService from "./OnCallDutyPolicyEscalationRuleUserService";
@@ -36,7 +36,7 @@ import OnCallDutyPolicyUserOverride from "../../Models/DatabaseModels/OnCallDuty
 import OnCallDutyPolicyUserOverrideService from "./OnCallDutyPolicyUserOverrideService";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
-export class Service extends DatabaseService<Model> {
+export class Service extends OnCallDutyPolicyChildService<Model> {
   @CaptureSpan()
   public async getRouteAlertToUserId(data: {
     userId: ObjectID;

package/Server/Services/OnCallDutyPolicyEscalationRuleTeamService.ts

@@ -1,7 +1,7 @@
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import { OnCreate, OnDelete } from "../Types/Database/Hooks";
-import DatabaseService from "./DatabaseService";
+import OnCallDutyPolicyChildService from "./OnCallDutyPolicyChildService";
 import Model from "../../Models/DatabaseModels/OnCallDutyPolicyEscalationRuleTeam";
 import Dictionary from "../../Types/Dictionary";
 import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
@@ -26,7 +26,7 @@ import Team from "../../Models/DatabaseModels/Team";
 import OnCallDutyPolicyTimeLogService from "./OnCallDutyPolicyTimeLogService";
 import OneUptimeDate from "../../Types/Date";
 
-export class Service extends DatabaseService<Model> {
+export class Service extends OnCallDutyPolicyChildService<Model> {
   public constructor() {
     super(Model);
   }

package/Server/Services/OnCallDutyPolicyEscalationRuleUserService.ts

@@ -1,7 +1,7 @@
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import { OnCreate, OnDelete } from "../Types/Database/Hooks";
-import DatabaseService from "./DatabaseService";
+import OnCallDutyPolicyChildService from "./OnCallDutyPolicyChildService";
 import Model from "../../Models/DatabaseModels/OnCallDutyPolicyEscalationRuleUser";
 import Dictionary from "../../Types/Dictionary";
 import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
@@ -26,7 +26,7 @@ import { createWhatsAppMessageFromTemplate } from "../Utils/WhatsAppTemplateUtil
 import logger, { LogAttributes } from "../Utils/Logger";
 import { WhatsAppMessagePayload } from "../../Types/WhatsApp/WhatsAppMessage";
 
-export class Service extends DatabaseService<Model> {
+export class Service extends OnCallDutyPolicyChildService<Model> {
   public constructor() {
     super(Model);
   }

package/Server/Services/PayAsYouGoBillingService.ts

@@ -15,7 +15,7 @@ import Stripe from "stripe";
 export const PAY_AS_YOU_GO_PAYMENT_REQUIRED_MESSAGE: string =
   "Add a payment method in Project Settings > Billing before using paid monitoring or telemetry. These features have usage charges even on the Free plan. Manual monitors remain free.";
 
-type PaymentAuthorization = "payment-method" | "invoice" | "reseller";
+type PaymentAuthorization = "payment-method" | "paid-plan" | "reseller";
 
 type NotAuthorized = "none";
 const NOT_AUTHORIZED: NotAuthorized = "none";
@@ -24,9 +24,8 @@ const NOT_AUTHORIZED: NotAuthorized = "none";
  * A denial is the expensive answer. An authorized project answers from the
  * positive cache and costs one provider read a minute; an unauthorized one
  * re-ran the full check every time, and that check costs a payment-method
- * read per supported type, plus - on a paid plan - the subscription read that
- * rules out an invoice agreement. On the telemetry admission path - which
- * runs for every ingested batch over OTLP, gRPC, MQTT and session replay, and
+ * read per supported type on the Free plan. On the telemetry admission path -
+ * which runs for every ingested batch over OTLP, gRPC, MQTT and session replay, and
  * which deliberately re-checks even on a key-cache hit - that is a provider
  * read storm proportional to ingest traffic, for exactly the projects that
  * are not paying. It is enough on its own to hold a Stripe account at its
@@ -78,16 +77,15 @@ export class Service {
   /*
    * Whether a project bills under an agreement that already covers its earlier
    * telemetry, and so takes no cutoff. Kept apart from authorizedProjects,
-   * which records only what authorized the project first - and for an invoice
-   * customer who also keeps a card on file, that is the card.
+   * which records plan eligibility separately from payment and invoice terms.
    */
   private noCutoffAgreements: InMemoryTTLCache<boolean> = new InMemoryTTLCache(
     10_000,
   );
 
   /**
-   * A subscription created during signup is not permission to incur charges.
-   * Require a payment method, or a real invoice/reseller billing agreement.
+   * Free projects need a payment method before incurring usage charges.
+   * Paid plans and verified reseller agreements already authorize usage.
    * Short positive caching keeps the telemetry admission path affordable.
    *
    * `allowStaleDenial` additionally lets a recent denial answer without going
@@ -207,16 +205,14 @@ export class Service {
 
     const authorization: PaymentAuthorization | NotAuthorized | undefined =
       this.authorizedProjects.get(projectId.toString());
-    if (authorization === "invoice" || authorization === "reseller") {
+    if (authorization === "reseller") {
       return undefined;
     }
 
     /*
-     * "payment-method" is not the whole answer. The card is checked before the
-     * invoice agreement, so an invoice customer who also keeps a card on file
-     * is authorized by the card - and a cutoff stamped for them would waive
-     * telemetry their contract already bills. Ask about the agreement itself
-     * before any marker is written.
+     * Plan eligibility does not determine billing history. A cutoff stamped
+     * for an invoice customer would waive telemetry their contract already
+     * bills, so verify the agreement before writing a marker.
      */
     if (await this.hasNoCutoffAgreement(projectId)) {
       return undefined;
@@ -300,7 +296,7 @@ export class Service {
       return "reseller";
     }
 
-    if (!project.paymentProviderPlanId || !project.paymentProviderCustomerId) {
+    if (!project.paymentProviderPlanId) {
       return null;
     }
 
@@ -314,23 +310,22 @@ export class Service {
       return null;
     }
 
-    /*
-     * Card first, and a card holder's subscription is never read. Stripe
-     * rate-limits GET /v1/subscriptions/:id on its own, apart from the
-     * account-wide limit, and this check sits on synchronous paths - creating
-     * a monitor, the billing page's gate, every metered report. Reading the
-     * subscription first put that endpoint in front of every answer, three or
-     * four times per monitor create, and held it at its limit. Only a project
-     * with no card needs the subscription: it is what tells an invoice
-     * agreement apart from no agreement at all.
-     */
+    // The payment-method requirement applies only to the Free plan.
+    if (plan.getName() !== PlanType.Free) {
+      return "paid-plan";
+    }
+
+    if (!project.paymentProviderCustomerId) {
+      return null;
+    }
+
     if (
       await BillingService.hasPaymentMethods(project.paymentProviderCustomerId)
     ) {
       return "payment-method";
     }
 
-    return (await this.hasInvoiceAgreement(project)) ? "invoice" : null;
+    return null;
   }
 
   /*
@@ -404,8 +399,8 @@ export class Service {
 
   /*
    * A paid plan whose own subscription, billed to this project's own customer,
-   * is active and collected by invoice. The single definition behind both the
-   * "invoice" authorization and the telemetry cutoff exemption.
+   * is active and collected by invoice. This determines the telemetry cutoff
+   * exemption independently of the project's eligibility to use paid features.
    */
   private async hasInvoiceAgreement(project: Project): Promise<boolean> {
     if (

package/Server/Services/ProjectService.ts

@@ -1458,6 +1458,24 @@ These are no longer recorded against the project and have to be cancelled by han
         id: createdItem.id!,
       });
 
+      /*
+       * Written down before subscribing. subscribeToPlan reports metered
+       * usage for this project while it runs, and that path looks the
+       * project's billing customer up from this row: a paid-plan project with
+       * no customer on record is refused with 402, which failed every
+       * paid-plan signup. It also keeps the Stripe customer findable if the
+       * subscription step fails.
+       */
+      await this.updateOneById({
+        id: createdItem.id!,
+        data: {
+          paymentProviderCustomerId: customerId,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
       const plan: SubscriptionPlan | undefined =
         SubscriptionPlan.getSubscriptionPlanById(
           createdItem.paymentProviderPlanId!,