@oneuptime/common 13.0.7 → 14.0.0

package/Models/AnalyticsModels/AuditLog.ts

@@ -11,6 +11,14 @@ import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 
+/*
+ * Immutable audit trail. Nobody creates an entry through the API or as a
+ * project user: every entry is written by the Enterprise Edition's audit-log
+ * recorder, as root. So create is empty at table level and on every column,
+ * and AuditLogService refuses any create that is not root (a master admin's
+ * included, whom these lists do not bind). Update and delete are empty too;
+ * entries leave only through the retention TTL.
+ */
 export default class AuditLog extends AnalyticsBaseModel {
   public constructor() {
     const projectIdColumn: AnalyticsTableColumn = new AnalyticsTableColumn({
@@ -27,7 +35,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -46,7 +54,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -64,7 +72,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -82,7 +90,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -111,7 +119,7 @@ export default class AuditLog extends AnalyticsBaseModel {
             Permission.SettingsAdmin,
             Permission.ReadAuditLog,
           ],
-          create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+          create: [],
           update: [],
         },
       });
@@ -143,7 +151,7 @@ export default class AuditLog extends AnalyticsBaseModel {
             Permission.SettingsAdmin,
             Permission.ReadAuditLog,
           ],
-          create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+          create: [],
           update: [],
         },
       },
@@ -162,7 +170,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -180,7 +188,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -198,7 +206,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -216,7 +224,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -235,7 +243,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -254,7 +262,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -272,7 +280,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -293,7 +301,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
       },
     });
@@ -320,7 +328,7 @@ export default class AuditLog extends AnalyticsBaseModel {
           Permission.SettingsAdmin,
           Permission.ReadAuditLog,
         ],
-        create: [Permission.ProjectOwner, Permission.ProjectAdmin],
+        create: [],
         update: [],
         delete: [],
       },

package/Models/DatabaseModels/GlobalConfig.ts

@@ -948,6 +948,30 @@ export default class GlobalConfig extends GlobalConfigModel {
   })
   public enterpriseLicenseExpiryReminderDays?: number = undefined;
 
+  /*
+   * Set once, by the enterprise module, the first time this installation boots
+   * the Enterprise Edition. An Enterprise install with no license at all gets
+   * a 14-day evaluation trial counted from here (also the transition for
+   * installs that ran the Enterprise Edition on the IS_ENTERPRISE_EDITION
+   * variable alone). Written only by the server itself (isRoot).
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Date,
+    title: "Enterprise Edition First Seen At",
+    description:
+      "When this installation first booted the OneUptime Enterprise Edition. An unlicensed Enterprise installation gets a 14-day trial counted from this moment.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public enterpriseEditionFirstSeenAt?: Date = undefined;
+
   /*
    * The four latestRelease* columns cache the daily GitHub release check
    * (Workers/Jobs/InstanceUpdate/CheckForNewVersion). They are a cache, not

package/Models/DatabaseModels/Monitor.ts

@@ -1044,8 +1044,9 @@ export default class Monitor extends BaseModel {
     required: false,
     type: TableColumnType.ShortText,
     title: "Monitoring Interval",
-    description: "How often would you like OneUptime to monitor this resource?",
-    example: "Every 5 minutes",
+    description:
+      'How often would you like OneUptime to monitor this resource? A 5-field cron expression, not a label: "*/5 * * * *" is every five minutes.',
+    example: "*/5 * * * *",
   })
   @Column({
     nullable: true,

package/Models/DatabaseModels/MonitorTemplate.ts

@@ -490,7 +490,8 @@ export default class MonitorTemplate extends BaseModel {
     type: TableColumnType.ShortText,
     title: "Monitoring Interval",
     description:
-      "Default monitoring interval for monitors created from this template",
+      'Default monitoring interval for monitors created from this template. A 5-field cron expression, not a label: "*/5 * * * *" is every five minutes.',
+    example: "*/5 * * * *",
   })
   @Column({
     nullable: true,

package/Models/DatabaseModels/OnCallDutyPolicyScheduleCalendarFeed.ts

@@ -298,7 +298,7 @@ export default class OnCallDutyPolicyScheduleCalendarFeed extends BaseModel {
 
   @ColumnAccessControl({
     create: [],
-    read: [],
+    read: readPermissions,
     update: [],
   })
   @TableColumn({

package/Models/DatabaseModels/ProjectOnCallCalendarFeed.ts

@@ -230,7 +230,7 @@ export default class ProjectOnCallCalendarFeed extends BaseModel {
 
   @ColumnAccessControl({
     create: [],
-    read: [],
+    read: readPermissions,
     update: [],
   })
   @TableColumn({

package/Models/DatabaseModels/UserOnCallCalendarFeed.ts

@@ -258,7 +258,7 @@ export default class UserOnCallCalendarFeed extends BaseModel {
 
   @ColumnAccessControl({
     create: [],
-    read: [],
+    read: [Permission.CurrentUser],
     update: [],
   })
   @TableColumn({

package/Scripts/generate-service-worker.js

@@ -16,6 +16,12 @@
 const fs = require("fs");
 const path = require("path");
 const crypto = require("crypto");
+const {
+  EDITION_COMMUNITY,
+  EDITION_ENTERPRISE,
+  readRequestedEdition,
+  getEnterpriseCandidates,
+} = require("../UI/esbuild-enterprise");
 
 // Default values
 const DEFAULT_APP_VERSION = "1.0.0";
@@ -64,6 +70,50 @@ function getGitSha() {
   }
 }
 
+/**
+ * The edition a frontend build bundles: "community" or "enterprise".
+ *
+ * The same decision esbuild makes for the frontend's Enterprise plugin (see
+ * Common/UI/esbuild-enterprise.js): ONEUPTIME_EDITION=community or
+ * enterprise decides outright, and "auto" (the default) means enterprise
+ * exactly when this frontend's ee plugin, ee/<frontend directory name>/
+ * Index.tsx, is on disk. A frontend with no ee plugin (Accounts, Status Page)
+ * is therefore always "community". An unknown ONEUPTIME_EDITION throws, like
+ * the build.
+ *
+ * The edition goes into the service worker's cache version: the Community and
+ * Enterprise images of one release share APP_VERSION and GIT_SHA, and without
+ * it a browser that cached one edition's assets would keep them after the
+ * deployment switched to the other.
+ * @param {string} frontendDir - The frontend's directory (where sw.js.template lives)
+ * @param {Object} [env] - Environment to read (defaults to process.env)
+ * @returns {string}
+ */
+function getEdition(frontendDir, env) {
+  const source = env || process.env;
+  const requested = readRequestedEdition(source);
+
+  if (requested === EDITION_COMMUNITY || requested === EDITION_ENTERPRISE) {
+    return requested;
+  }
+
+  const candidates = getEnterpriseCandidates(
+    frontendDir,
+    path.basename(frontendDir),
+    source,
+  );
+
+  const hasPlugin = candidates.some((candidate) => {
+    try {
+      return fs.statSync(candidate).isFile();
+    } catch (error) {
+      return false;
+    }
+  });
+
+  return hasPlugin ? EDITION_ENTERPRISE : EDITION_COMMUNITY;
+}
+
 /**
  * Generate service worker from template
  */
@@ -85,16 +135,19 @@ function generateServiceWorker(
   const packageJsonPath = path.join(path.dirname(templatePath), "package.json");
   const appVersion = getAppVersion(packageJsonPath);
   const gitSha = getGitSha();
+  const edition = getEdition(path.dirname(templatePath));
   const buildTimestamp = new Date().toISOString();
 
   console.log(`🔧 Generating service worker for ${serviceName}...`);
   console.log(`   App Version: ${appVersion}`);
+  console.log(`   Edition: ${edition}`);
   console.log(`   Git SHA: ${gitSha}`);
   console.log(`   Build Time: ${buildTimestamp}`);
 
   // Replace placeholders
   const generatedContent = template
     .replace(/\{\{APP_VERSION\}\}/g, appVersion)
+    .replace(/\{\{EDITION\}\}/g, edition)
     .replace(/\{\{GIT_SHA\}\}/g, gitSha)
     .replace(/\{\{BUILD_TIMESTAMP\}\}/g, buildTimestamp)
     .replace(/\{\{SERVICE_NAME\}\}/g, serviceName);
@@ -102,11 +155,12 @@ function generateServiceWorker(
   // Add generation comment at the top
   const header = `/*
  * Generated Service Worker for ${serviceName}
- * 
+ *
  * Generated at: ${buildTimestamp}
  * App Version: ${appVersion}
+ * Edition: ${edition}
  * Git SHA: ${gitSha}
- * 
+ *
  * DO NOT EDIT THIS FILE DIRECTLY
  * Edit the template file instead and run the generator script
  */
@@ -125,7 +179,9 @@ function generateServiceWorker(
   fs.writeFileSync(outputPath, finalContent, "utf8");
 
   console.log("✅ Service worker generated successfully:", outputPath);
-  console.log(`   Cache version: oneuptime-v${appVersion}-${gitSha}`);
+  console.log(
+    `   Cache version: oneuptime-v${appVersion}-${edition}-${gitSha}`,
+  );
 }
 
 // Command line interface
@@ -151,4 +207,9 @@ if (require.main === module) {
   }
 }
 
-module.exports = { generateServiceWorker, getAppVersion, getGitSha };
+module.exports = {
+  generateServiceWorker,
+  getAppVersion,
+  getGitSha,
+  getEdition,
+};

package/Server/API/AIBillingAPI.ts

@@ -20,6 +20,7 @@ const router: ExpressRouter = Express.getRouter();
 router.post(
   "/ai/recharge",
   UserMiddleware.getUserMiddleware,
+  UserMiddleware.requireUserAuthentication,
   async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
     try {
       if (!IsBillingEnabled) {

package/Server/API/AIInsightAPI.ts

@@ -10,7 +10,6 @@ import Response from "../Utils/Response";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
 import BadDataException from "../../Types/Exception/BadDataException";
-import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import { JSONArray, JSONObject } from "../../Types/JSON";
 import AIInsightStatus from "../../Types/AI/AIInsightStatus";
 import AIInsightHumanVerdict from "../../Types/AI/AIInsightHumanVerdict";
@@ -42,9 +41,7 @@ async function getLoggedInProps(
   const props: DatabaseCommonInteractionProps =
     await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-  if (!props.userId) {
-    throw new NotAuthorizedException("A logged-in user session is required.");
-  }
+  CommonAPI.assertAuthenticatedUser(props);
 
   return props;
 }

package/Server/API/AIInvestigationAPI.ts

@@ -11,7 +11,6 @@ import Response from "../Utils/Response";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
 import BadDataException from "../../Types/Exception/BadDataException";
-import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import Query from "../../Types/BaseDatabase/Query";
 import { JSONArray, JSONObject } from "../../Types/JSON";
@@ -184,9 +183,7 @@ async function getLoggedInProps(
   const props: DatabaseCommonInteractionProps =
     await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-  if (!props.userId) {
-    throw new NotAuthorizedException("A logged-in user session is required.");
-  }
+  CommonAPI.assertAuthenticatedUser(props);
 
   return props;
 }

package/Server/API/AIReadinessAPI.ts

@@ -49,11 +49,10 @@ router.post(
        * because it loads the exception with the caller's props first, and
        * derives the project from that authorized row.
        */
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI readiness requires a logged-in user session.",
-        );
-      }
+      CommonAPI.assertAuthenticatedUser(
+        props,
+        "AI readiness requires a logged-in user session.",
+      );
 
       if (!props.tenantId) {
         throw new BadDataException("Project ID is required (tenantid header).");

package/Server/API/AlertAPI.ts

@@ -38,6 +38,7 @@ export default class AlertAPI extends BaseAPI<Alert, AlertServiceType> {
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/generate-note-from-ai/:alertId`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.generateNoteFromAI(req, res);

package/Server/API/AutoRemediationAPI.ts

@@ -11,7 +11,6 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
 import BadDataException from "../../Types/Exception/BadDataException";
-import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import AutoRemediationSuggestionStatus from "../../Types/AutoRemediation/AutoRemediationSuggestionStatus";
 import AutoRemediationSuggestionType from "../../Types/AutoRemediation/AutoRemediationSuggestionType";
 import AutoRemediationVerificationStatus from "../../Types/AutoRemediation/AutoRemediationVerificationStatus";
@@ -65,9 +64,7 @@ async function getLoggedInProps(
   const props: DatabaseCommonInteractionProps =
     await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-  if (!props.userId) {
-    throw new NotAuthorizedException("A logged-in user session is required.");
-  }
+  CommonAPI.assertAuthenticatedUser(props);
 
   return props;
 }

package/Server/API/BaseAPI.ts

@@ -553,6 +553,40 @@ export default class BaseAPI<
       this.entityType,
     ) as TBaseModel;
 
+    /*
+     * A create builds a brand-new row, so it must not carry the row's own
+     * primary key. getRepository().save() treats an entity that already has an
+     * id as an update of the existing row rather than an insert, so a stray
+     * `_id` (or the `id` spelling, which BaseModel.fromJSON has already folded
+     * into `_id`) would make a "create" modify an existing record instead.
+     *
+     * CLEARED, NOT DELETED, and that distinction is load-bearing: `item` is a
+     * live model instance that the service then asks for its own column list
+     * (DatabaseService.generateDefaultValues -> data.getTableColumns()), and
+     * that lookup used to enumerate this very instance's own keys and cache
+     * the result for the whole CLASS. Deleting `_id` here therefore taught the
+     * process that this model has no `_id` column, and every later response
+     * for it - to any caller, including reads - was serialized without one.
+     * TableColumn.ts no longer reads the caller's instance, so this is now
+     * defence in depth rather than the fix; the trap is removed all the same.
+     * DatabaseService.sanitizeUpdateData skips these keys the same way instead
+     * of deleting them off a model.
+     *
+     * `undefined` is what an unset column holds anyway, so nothing downstream
+     * can tell it from an absent key: TypeORM reads primary keys through
+     * ColumnMetadata.getEntityValue and treats undefined as "no id"
+     * (EntityMetadata.getValueMap skips it, so the Subject gets no identifier
+     * and must be INSERTed), the create path's own "an id cannot be supplied"
+     * guard tests `data._id` for truthiness, ColumnPermissions skips data keys
+     * whose value is undefined, and toJSONObject omits them from responses.
+     *
+     * Only the top-level primary key is cleared - nested `_id`s inside
+     * relation objects/arrays reference existing related rows and are left
+     * untouched. `id` needs no handling: it is a prototype accessor derived
+     * from `_id` (never an own property), and its setter ignores falsy values.
+     */
+    (item as any)["_id"] = undefined;
+
     const miscDataProps: JSONObject = JSONFunctions.deserialize(
       body["miscDataProps"] as JSONObject,
     );

package/Server/API/BaseAnalyticsAPI.ts

@@ -3,6 +3,9 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import AnalyticsDatabaseService from "../Services/AnalyticsDatabaseService";
 import CreateBy from "../Types/AnalyticsDatabase/CreateBy";
 import GroupBy from "../Types/AnalyticsDatabase/GroupBy";
+import ModelPermission, {
+  CheckReadPermissionType,
+} from "../Types/AnalyticsDatabase/ModelPermission";
 import Query from "../Types/AnalyticsDatabase/Query";
 import Select from "../Types/AnalyticsDatabase/Select";
 import Sort from "../Types/AnalyticsDatabase/Sort";
@@ -39,11 +42,9 @@ import logger from "../Utils/Logger";
  * widgets loading on the same page) onto a single ClickHouse query
  * while still looking real-time to humans.
  *
- * Project-scoped only: analytics data is project-wide and the
- * service layer enforces project-scoped read permissions, so
- * caching across users within the same project is safe. Endpoints
- * with row-level access scoping should override `getAggregate` to
- * skip the cache (or shape the key to include the access scope).
+ * A cache hit never reaches the service, which is where the read
+ * check lives, so getAggregateCacheKey runs that check itself and
+ * keys the slot on the permission-scoped query — see there.
  */
 const ANALYTICS_AGGREGATE_CACHE_TTL_SECONDS: number = 8;
 
@@ -396,11 +397,11 @@ export default class BaseAnalyticsAPI<
      * burst. On cache outage (Redis down, parse error, …) we fall
      * through to a live query so behavior degrades to today's.
      */
-    const projectId: string | undefined = databaseProps.tenantId?.toString();
     const cacheNamespace: string = `${this.getEntityName()}-aggregate`;
-    const cacheKey: string | null = projectId
-      ? `${projectId}:${this.buildAggregateCacheKey(aggregateBy)}`
-      : null;
+    const cacheKey: string | null = await this.getAggregateCacheKey(
+      aggregateBy,
+      databaseProps,
+    );
 
     if (cacheKey) {
       try {
@@ -438,6 +439,76 @@ export default class BaseAnalyticsAPI<
     return Response.sendJsonObjectResponse(req, res, responseBody);
   }
 
+  /*
+   * A cached aggregate is answered BEFORE service.aggregateBy runs, and
+   * service.aggregateBy is where the read check lives. So a hit has to
+   * clear that same check first — otherwise anyone who can name a project
+   * in the `tenantid` header (getUserMiddleware accepts it even from an
+   * anonymous caller) reads whatever someone else aggregated there in the
+   * last few seconds.
+   *
+   * checkReadPermission runs here on a copy of the query, with the same
+   * select the service passes. It throws for an anonymous caller (401) and
+   * for one without read permission on the model or the queried columns
+   * (422), and it returns the query the live path would send to
+   * ClickHouse. That scoped query goes into the key because it carries
+   * everything that makes one caller's result differ from another's: the
+   * tenant, the Owned / label-restricted `IN (...)` filter on the owning
+   * resource, and for a multi-tenant request the caller's own list of
+   * projects.
+   *
+   * The caller's raw query stays in the key next to it. Scoping overwrites
+   * projectId, but a service can still plan from the raw query —
+   * MetricService picks point-type and rollup routing from the projectId
+   * the caller sent, before its own check rewrites it — so two requests
+   * that scope to the same query can still compute different results.
+   * Callers share a slot only when both their request and their access
+   * scope are identical.
+   *
+   * Returns null (skip the cache) without a tenant, and for a request the
+   * service's own validation is about to reject, so that request gets the
+   * service's error message rather than one from the check here.
+   */
+  protected async getAggregateCacheKey(
+    aggregateBy: AggregateBy<AnalyticsDataModel>,
+    props: DatabaseCommonInteractionProps,
+  ): Promise<string | null> {
+    if (!props.tenantId) {
+      return null;
+    }
+
+    const aggregateColumnName: string | undefined =
+      aggregateBy.aggregateColumnName?.toString();
+    const timestampColumnName: string | undefined =
+      aggregateBy.aggregationTimestampColumnName?.toString();
+    const model: TAnalyticsDataModel = new this.entityType();
+
+    if (
+      !aggregateColumnName ||
+      !timestampColumnName ||
+      !model.getTableColumn(aggregateColumnName) ||
+      !model.getTableColumn(timestampColumnName)
+    ) {
+      return null;
+    }
+
+    const scoped: CheckReadPermissionType<TAnalyticsDataModel> =
+      await ModelPermission.checkReadPermission(
+        this.entityType,
+        { ...(aggregateBy.query || {}) } as Query<TAnalyticsDataModel>,
+        {
+          [aggregateColumnName]: true,
+          [timestampColumnName]: true,
+        } as Select<TAnalyticsDataModel>,
+        props,
+      );
+
+    return `${props.tenantId.toString()}:${this.buildAggregateCacheKey({
+      ...aggregateBy,
+      scopedQuery: scoped.query,
+    } as AggregateBy<AnalyticsDataModel>)}`;
+  }
+
   /*
    * Stable serialization for the aggregate cache key. Date instances
    * are normalized to ISO so two logically-equal time windows hit

package/Server/API/BillingAPI.ts

@@ -126,6 +126,7 @@ export default class BillingAPI {
     this.router.get(
       `/billing/pay-as-you-go-status`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const projectId: ObjectID | null = this.getTenantId(req);
@@ -158,6 +159,7 @@ export default class BillingAPI {
     this.router.get(
       `/billing/customer-balance`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {

package/Server/API/BillingInvoiceAPI.ts

@@ -137,6 +137,7 @@ export default class UserAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/pay`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {

package/Server/API/BillingPaymentMethodAPI.ts

@@ -44,6 +44,7 @@ export default class UserAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/setup`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {
@@ -121,6 +122,7 @@ export default class UserAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/set-default`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {

package/Server/API/CodeFixRunAPI.ts

@@ -358,9 +358,7 @@ export default class CodeFixRunAPI {
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    if (!props.userId) {
-      throw new NotAuthorizedException("A logged-in user session is required.");
-    }
+    CommonAPI.assertAuthenticatedUser(props);
 
     if (!props.tenantId) {
       throw new BadDataException("Project ID is required (tenantid header).");