@oneuptime/common 13.0.7 → 14.0.0

package/build/dist/Server/API/StatusPageAPI.js

@@ -33,14 +33,18 @@ import StatusPageHeaderLinkService from "../Services/StatusPageHeaderLinkService
 import StatusPageHistoryChartBarColorRuleService from "../Services/StatusPageHistoryChartBarColorRuleService";
 import StatusPageResourceService from "../Services/StatusPageResourceService";
 import StatusPageService, { Service as StatusPageServiceType, } from "../Services/StatusPageService";
+import UptimeDailyAggregateUtil from "../../Utils/StatusPage/UptimeDailyAggregateUtil";
 import StatusPageSsoService from "../Services/StatusPageSsoService";
 import StatusPageOidcService from "../Services/StatusPageOidcService";
 import StatusPageSubscriberService from "../Services/StatusPageSubscriberService";
+import ModelPermission from "../Types/Database/Permissions/Index";
 import QueryHelper from "../Types/Database/QueryHelper";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import { SEARCH_ENGINE_INDEXING_FLAG_NAME, isSearchEngineIndexingEnabled, } from "../../Types/StatusPage/SearchEngineIndexing";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import ArrayUtil from "../../Utils/Array";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
@@ -49,6 +53,7 @@ import OneUptimeDate from "../../Types/Date";
 import Email from "../../Types/Email";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import JSONFunctions from "../../Types/JSONFunctions";
 import ObjectID from "../../Types/ObjectID";
@@ -136,11 +141,44 @@ class StatusPageAPI extends BaseAPI {
         this.overviewResponseCache.clear();
         this.overviewResponseInFlight.clear();
     }
+    /*
+     * Holding one of StatusPage's update roles is not the same as being allowed
+     * to update a given page: team block rows, label-restricted grants and
+     * Owned-scoped grants all narrow it. Apply the checks a CRUD update of this
+     * page would run - block and label rules against the loaded page, then the
+     * query narrowing (tenant, labels, Owned scope) - and require the page to
+     * survive them. `statusPage` must have been loaded with its labels.
+     */
+    static async assertCanUpdateStatusPage(data) {
+        await ModelPermission.checkUpdatePermissionByModel({
+            modelType: StatusPage,
+            fetchModelWithAccessControlIds: async () => {
+                return data.statusPage;
+            },
+            props: data.props,
+        });
+        const permittedQuery = await ModelPermission.checkUpdateQueryPermissions(StatusPage, {
+            _id: data.statusPage.id,
+            projectId: data.projectId,
+        }, {}, data.props);
+        const permittedStatusPage = await StatusPageService.findOneBy({
+            query: permittedQuery,
+            select: {
+                _id: true,
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!permittedStatusPage) {
+            throw new NotAuthorizedException("You do not have permission to send this status page's report.");
+        }
+    }
     constructor() {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9;
         super(StatusPage, StatusPageService);
         // get title, description of the page.  This is used for SEO.
-        this.router.get(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/seo/:statusPageIdOrDomain`, UserMiddleware.getUserMiddleware, async (req, res) => {
+        this.router.get(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/seo/:statusPageIdOrDomain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res) => {
             var _a;
             const statusPageIdOrDomain = req.params["statusPageIdOrDomain"];
             // Shares the service resolver's custom-domain -> statusPageId cache.
@@ -279,7 +317,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_e = new this.entityType()
-            .getCrudApiPath()) === null || _e === void 0 ? void 0 : _e.toString()}/incident-public-note/attachment/:statusPageId/:incidentId/:noteId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _e === void 0 ? void 0 : _e.toString()}/incident-public-note/attachment/:statusPageId/:incidentId/:noteId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getIncidentPublicNoteAttachment(req, res);
             }
@@ -288,7 +326,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_f = new this.entityType()
-            .getCrudApiPath()) === null || _f === void 0 ? void 0 : _f.toString()}/incident-episode-public-note/attachment/:statusPageId/:episodeId/:noteId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _f === void 0 ? void 0 : _f.toString()}/incident-episode-public-note/attachment/:statusPageId/:episodeId/:noteId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getIncidentEpisodePublicNoteAttachment(req, res);
             }
@@ -297,7 +335,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_g = new this.entityType()
-            .getCrudApiPath()) === null || _g === void 0 ? void 0 : _g.toString()}/incident/postmortem/attachment/:statusPageId/:incidentId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _g === void 0 ? void 0 : _g.toString()}/incident/postmortem/attachment/:statusPageId/:incidentId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getIncidentPostmortemAttachment(req, res);
             }
@@ -306,7 +344,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_h = new this.entityType()
-            .getCrudApiPath()) === null || _h === void 0 ? void 0 : _h.toString()}/scheduled-maintenance-public-note/attachment/:statusPageId/:scheduledMaintenanceId/:noteId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _h === void 0 ? void 0 : _h.toString()}/scheduled-maintenance-public-note/attachment/:statusPageId/:scheduledMaintenanceId/:noteId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getScheduledMaintenancePublicNoteAttachment(req, res);
             }
@@ -315,7 +353,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.get(`${(_j = new this.entityType()
-            .getCrudApiPath()) === null || _j === void 0 ? void 0 : _j.toString()}/status-page-announcement/attachment/:statusPageId/:announcementId/:fileId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _j === void 0 ? void 0 : _j.toString()}/status-page-announcement/attachment/:statusPageId/:announcementId/:fileId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.getStatusPageAnnouncementAttachment(req, res);
             }
@@ -530,10 +568,54 @@ class StatusPageAPI extends BaseAPI {
             }
             return Response.sendTextResponse(req, res, challenge.challenge);
         });
-        this.router.post(`${(_p = new this.entityType().getCrudApiPath()) === null || _p === void 0 ? void 0 : _p.toString()}/test-email-report`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        /*
+         * Sends the status page's report to an address the caller chooses, so it
+         * is gated like editing the status page: an authenticated member of the
+         * project that owns it who could update this particular page.
+         */
+        this.router.post(`${(_p = new this.entityType().getCrudApiPath()) === null || _p === void 0 ? void 0 : _p.toString()}/test-email-report`, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
             try {
+                /*
+                 * This route acts on one page in one project, and the permission
+                 * checks below must be evaluated for that single tenant, so the
+                 * request is never treated as multi-tenant.
+                 */
+                const props = Object.assign(Object.assign({}, (await CommonAPI.getDatabaseCommonInteractionProps(req))), { isMultiTenantRequest: false });
+                const projectId = CommonAPI.assertAuthenticatedProjectMember(props);
+                CommonAPI.assertPermittedInProject({
+                    databaseProps: props,
+                    allowedPermissions: new StatusPage().getUpdatePermissions(),
+                    errorMessage: "You do not have permission to send this status page's report.",
+                });
+                if (!req.body["statusPageId"] ||
+                    !ObjectID.isValidUUID(req.body["statusPageId"].toString())) {
+                    throw new BadDataException("A valid statusPageId is required.");
+                }
                 const email = new Email(req.body["email"]);
                 const statusPageId = new ObjectID(req.body["statusPageId"].toString());
+                const statusPage = await StatusPageService.findOneById({
+                    id: statusPageId,
+                    select: {
+                        _id: true,
+                        projectId: true,
+                        labels: {
+                            _id: true,
+                            name: true,
+                        },
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+                CommonAPI.assertResourceBelongsToProject({
+                    resourceProjectId: statusPage === null || statusPage === void 0 ? void 0 : statusPage.projectId,
+                    projectId,
+                });
+                await StatusPageAPI.assertCanUpdateStatusPage({
+                    statusPage: statusPage,
+                    projectId,
+                    props,
+                });
                 await StatusPageService.sendEmailReport({
                     email: email,
                     statusPageId,
@@ -544,7 +626,7 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_q = new this.entityType().getCrudApiPath()) === null || _q === void 0 ? void 0 : _q.toString()}/domain`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_q = new this.entityType().getCrudApiPath()) === null || _q === void 0 ? void 0 : _q.toString()}/domain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 if (!req.body["domain"]) {
                     throw new BadDataException("domain is required in request body");
@@ -577,7 +659,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_r = new this.entityType()
-            .getCrudApiPath()) === null || _r === void 0 ? void 0 : _r.toString()}/master-page/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _r === void 0 ? void 0 : _r.toString()}/master-page/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const statusPageIdParam = req.params["statusPageId"];
                 ObjectID.validateUUID(statusPageIdParam);
@@ -638,15 +720,23 @@ class StatusPageAPI extends BaseAPI {
                     select.headerHTML = true;
                     select.footerHTML = true;
                 }
-                const hasEnabledSSO = await StatusPageSsoService.countBy({
-                    query: {
-                        isEnabled: true,
-                        statusPageId: objectId,
-                    },
-                    props: {
-                        isRoot: true,
-                    },
-                });
+                /*
+                 * The status page app offers SSO sign-in when this is non-zero.
+                 * While SSO is not active - the Community Edition serves no status
+                 * page SSO routes, and on a lapsed Enterprise license they refuse -
+                 * it reports none rather than send visitors into a dead end.
+                 */
+                const hasEnabledSSO = EditionEnforcement.areSsoRoutesServed()
+                    ? await StatusPageSsoService.countBy({
+                        query: {
+                            isEnabled: true,
+                            statusPageId: objectId,
+                        },
+                        props: {
+                            isRoot: true,
+                        },
+                    })
+                    : new PositiveNumber(0);
                 const item = await this.service.findOneById({
                     id: objectId,
                     select,
@@ -670,6 +760,18 @@ class StatusPageAPI extends BaseAPI {
                     delete item.headerHTML;
                     delete item.footerHTML;
                 }
+                /*
+                 * The status page app forces SSO sign-in from this flag. Report
+                 * the EFFECTIVE requirement: while SSO is not active (the
+                 * Community Edition, or a lapsed Enterprise license) it is not
+                 * enforced and password sign-in works, so the page must not send
+                 * visitors into an SSO flow that does not exist or refuses. The
+                 * stored value is untouched and applies again as soon as SSO is
+                 * active.
+                 */
+                if (!EditionEnforcement.isSsoEnforced()) {
+                    item.requireSsoForLogin = false;
+                }
                 const footerLinks = await StatusPageFooterLinkService.findBy({
                     query: {
                         statusPageId: objectId,
@@ -729,7 +831,7 @@ class StatusPageAPI extends BaseAPI {
          * PublicDashboardRateLimit for the budget and why it fails closed.
          */
         this.router.post(`${(_s = new this.entityType()
-            .getCrudApiPath()) === null || _s === void 0 ? void 0 : _s.toString()}/master-password/:statusPageId`, PublicDashboardRateLimit.getMiddleware(PublicDashboardRateLimitBucket.StatusPageMasterPassword), UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _s === void 0 ? void 0 : _s.toString()}/master-password/:statusPageId`, PublicDashboardRateLimit.getMiddleware(PublicDashboardRateLimitBucket.StatusPageMasterPassword), UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 if (!req.params["statusPageId"]) {
                     throw new BadDataException("Status Page ID not found");
@@ -780,51 +882,63 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_t = new this.entityType().getCrudApiPath()) === null || _t === void 0 ? void 0 : _t.toString()}/sso/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_t = new this.entityType().getCrudApiPath()) === null || _t === void 0 ? void 0 : _t.toString()}/sso/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = new ObjectID(req.params["statusPageId"]);
-                const sso = await StatusPageSsoService.findBy({
-                    query: {
-                        statusPageId: objectId,
-                        isEnabled: true,
-                    },
-                    select: {
-                        signOnURL: true,
-                        name: true,
-                        description: true,
-                        _id: true,
-                    },
-                    limit: LIMIT_PER_PROJECT,
-                    skip: 0,
-                    props: {
-                        isRoot: true,
-                    },
-                });
+                /*
+                 * Only list providers a visitor can actually sign in with: the
+                 * Community Edition serves no status page SSO login routes.
+                 */
+                const sso = EditionEnforcement.areSsoRoutesServed()
+                    ? await StatusPageSsoService.findBy({
+                        query: {
+                            statusPageId: objectId,
+                            isEnabled: true,
+                        },
+                        select: {
+                            signOnURL: true,
+                            name: true,
+                            description: true,
+                            _id: true,
+                        },
+                        limit: LIMIT_PER_PROJECT,
+                        skip: 0,
+                        props: {
+                            isRoot: true,
+                        },
+                    })
+                    : [];
                 return Response.sendEntityArrayResponse(req, res, sso, new PositiveNumber(sso.length), StatusPageSSO);
             }
             catch (err) {
                 next(err);
             }
         });
-        this.router.post(`${(_u = new this.entityType().getCrudApiPath()) === null || _u === void 0 ? void 0 : _u.toString()}/oidc/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_u = new this.entityType().getCrudApiPath()) === null || _u === void 0 ? void 0 : _u.toString()}/oidc/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = new ObjectID(req.params["statusPageId"]);
-                const oidc = await StatusPageOidcService.findBy({
-                    query: {
-                        statusPageId: objectId,
-                        isEnabled: true,
-                    },
-                    select: {
-                        name: true,
-                        description: true,
-                        _id: true,
-                    },
-                    limit: LIMIT_PER_PROJECT,
-                    skip: 0,
-                    props: {
-                        isRoot: true,
-                    },
-                });
+                /*
+                 * Only list providers a visitor can actually sign in with: the
+                 * Community Edition serves no status page OIDC login routes.
+                 */
+                const oidc = EditionEnforcement.areSsoRoutesServed()
+                    ? await StatusPageOidcService.findBy({
+                        query: {
+                            statusPageId: objectId,
+                            isEnabled: true,
+                        },
+                        select: {
+                            name: true,
+                            description: true,
+                            _id: true,
+                        },
+                        limit: LIMIT_PER_PROJECT,
+                        skip: 0,
+                        props: {
+                            isRoot: true,
+                        },
+                    })
+                    : [];
                 return Response.sendEntityArrayResponse(req, res, oidc, new PositiveNumber(oidc.length), StatusPageOIDC);
             }
             catch (err) {
@@ -833,7 +947,7 @@ class StatusPageAPI extends BaseAPI {
         });
         // Get all status page resources for subscriber to subscribe to.
         this.router.post(`${(_v = new this.entityType()
-            .getCrudApiPath()) === null || _v === void 0 ? void 0 : _v.toString()}/resources/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _v === void 0 ? void 0 : _v.toString()}/resources/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const statusPageId = new ObjectID(req.params["statusPageId"]);
                 await this.checkHasReadAccess({
@@ -867,7 +981,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_w = new this.entityType()
-            .getCrudApiPath()) === null || _w === void 0 ? void 0 : _w.toString()}/uptime/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _w === void 0 ? void 0 : _w.toString()}/uptime/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             var _a, _b;
             try {
                 // This reosurce ID can be of a status page resource OR a status page group.
@@ -1151,15 +1265,15 @@ class StatusPageAPI extends BaseAPI {
         };
         const overviewApiPath = `${(_x = new this.entityType()
             .getCrudApiPath()) === null || _x === void 0 ? void 0 : _x.toString()}/overview/:statusPageIdOrDomain`;
-        this.router.post(overviewApiPath, UserMiddleware.getUserMiddleware, overviewHandler);
+        this.router.post(overviewApiPath, UserMiddleware.getPublicRouteUserMiddleware, overviewHandler);
         /*
          * GET variant of the overview endpoint. Same middleware and same handler
          * as the POST route above — private status pages are rejected for
          * unauthenticated callers exactly as they are on POST.
          */
-        this.router.get(overviewApiPath, UserMiddleware.getUserMiddleware, overviewHandler);
+        this.router.get(overviewApiPath, UserMiddleware.getPublicRouteUserMiddleware, overviewHandler);
         this.router.put(`${(_y = new this.entityType()
-            .getCrudApiPath()) === null || _y === void 0 ? void 0 : _y.toString()}/update-subscription/:statusPageId/:subscriberId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _y === void 0 ? void 0 : _y.toString()}/update-subscription/:statusPageId/:subscriberId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.subscribeToStatusPage(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1169,7 +1283,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_z = new this.entityType()
-            .getCrudApiPath()) === null || _z === void 0 ? void 0 : _z.toString()}/get-subscription/:statusPageId/:subscriberId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _z === void 0 ? void 0 : _z.toString()}/get-subscription/:statusPageId/:subscriberId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const subscriber = await this.getSubscriber(req);
                 return Response.sendEntityResponse(req, res, subscriber, StatusPageSubscriber);
@@ -1179,7 +1293,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_0 = new this.entityType()
-            .getCrudApiPath()) === null || _0 === void 0 ? void 0 : _0.toString()}/subscribe/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _0 === void 0 ? void 0 : _0.toString()}/subscribe/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.subscribeToStatusPage(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1189,7 +1303,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_1 = new this.entityType()
-            .getCrudApiPath()) === null || _1 === void 0 ? void 0 : _1.toString()}/manage-subscription/:statusPageId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _1 === void 0 ? void 0 : _1.toString()}/manage-subscription/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.manageExistingSubscription(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1216,8 +1330,8 @@ class StatusPageAPI extends BaseAPI {
         };
         const incidentsListApiPath = `${(_2 = new this.entityType()
             .getCrudApiPath()) === null || _2 === void 0 ? void 0 : _2.toString()}/incidents/:statusPageIdOrDomain`;
-        this.router.post(incidentsListApiPath, UserMiddleware.getUserMiddleware, incidentsListHandler);
-        this.router.get(incidentsListApiPath, UserMiddleware.getUserMiddleware, incidentsListHandler);
+        this.router.post(incidentsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, incidentsListHandler);
+        this.router.get(incidentsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, incidentsListHandler);
         /*
          * Shared handler for the scheduled maintenance events list endpoint.
          * Registered for both POST and GET (same auth path). It does not read
@@ -1237,8 +1351,8 @@ class StatusPageAPI extends BaseAPI {
         };
         const scheduledMaintenanceEventsListApiPath = `${(_3 = new this.entityType()
             .getCrudApiPath()) === null || _3 === void 0 ? void 0 : _3.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain`;
-        this.router.post(scheduledMaintenanceEventsListApiPath, UserMiddleware.getUserMiddleware, scheduledMaintenanceEventsListHandler);
-        this.router.get(scheduledMaintenanceEventsListApiPath, UserMiddleware.getUserMiddleware, scheduledMaintenanceEventsListHandler);
+        this.router.post(scheduledMaintenanceEventsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, scheduledMaintenanceEventsListHandler);
+        this.router.get(scheduledMaintenanceEventsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, scheduledMaintenanceEventsListHandler);
         /*
          * Shared handler for the announcements list endpoint. Registered for
          * both POST and GET (same auth path). It does not read req.body.
@@ -1257,10 +1371,10 @@ class StatusPageAPI extends BaseAPI {
         };
         const announcementsListApiPath = `${(_4 = new this.entityType()
             .getCrudApiPath()) === null || _4 === void 0 ? void 0 : _4.toString()}/announcements/:statusPageIdOrDomain`;
-        this.router.post(announcementsListApiPath, UserMiddleware.getUserMiddleware, announcementsListHandler);
-        this.router.get(announcementsListApiPath, UserMiddleware.getUserMiddleware, announcementsListHandler);
+        this.router.post(announcementsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, announcementsListHandler);
+        this.router.get(announcementsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, announcementsListHandler);
         this.router.post(`${(_5 = new this.entityType()
-            .getCrudApiPath()) === null || _5 === void 0 ? void 0 : _5.toString()}/incidents/:statusPageIdOrDomain/:incidentId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _5 === void 0 ? void 0 : _5.toString()}/incidents/:statusPageIdOrDomain/:incidentId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const incidentId = new ObjectID(req.params["incidentId"]);
@@ -1272,7 +1386,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_6 = new this.entityType()
-            .getCrudApiPath()) === null || _6 === void 0 ? void 0 : _6.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain/:scheduledMaintenanceId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _6 === void 0 ? void 0 : _6.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain/:scheduledMaintenanceId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const scheduledMaintenanceId = new ObjectID(req.params["scheduledMaintenanceId"]);
@@ -1284,7 +1398,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_7 = new this.entityType()
-            .getCrudApiPath()) === null || _7 === void 0 ? void 0 : _7.toString()}/announcements/:statusPageIdOrDomain/:announcementId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _7 === void 0 ? void 0 : _7.toString()}/announcements/:statusPageIdOrDomain/:announcementId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const announcementId = new ObjectID(req.params["announcementId"]);
@@ -1297,7 +1411,7 @@ class StatusPageAPI extends BaseAPI {
         });
         // Episodes endpoints
         this.router.post(`${(_8 = new this.entityType()
-            .getCrudApiPath()) === null || _8 === void 0 ? void 0 : _8.toString()}/episodes/:statusPageIdOrDomain`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _8 === void 0 ? void 0 : _8.toString()}/episodes/:statusPageIdOrDomain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const response = await this.getEpisodes(objectId, null, req);
@@ -1308,7 +1422,7 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         this.router.post(`${(_9 = new this.entityType()
-            .getCrudApiPath()) === null || _9 === void 0 ? void 0 : _9.toString()}/episodes/:statusPageIdOrDomain/:episodeId`, UserMiddleware.getUserMiddleware, async (req, res, next) => {
+            .getCrudApiPath()) === null || _9 === void 0 ? void 0 : _9.toString()}/episodes/:statusPageIdOrDomain/:episodeId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const episodeId = new ObjectID(req.params["episodeId"]);
@@ -2258,6 +2372,18 @@ class StatusPageAPI extends BaseAPI {
         }
         return statusPageSubscriber;
     }
+    serializeIncidentsForStatusPage(incidents) {
+        return incidents.map((incident) => {
+            const incidentJson = BaseModel.toJSON(incident, Incident);
+            // Enforce postmortem visibility before sending or caching status-page JSON.
+            if (incident.showPostmortemOnStatusPage !== true) {
+                delete incidentJson["postmortemNote"];
+                delete incidentJson["postmortemPostedAt"];
+                delete incidentJson["postmortemAttachments"];
+            }
+            return incidentJson;
+        });
+    }
     async getIncidents(statusPageId, incidentId, req) {
         await this.checkHasReadAccess({
             statusPageId: statusPageId,
@@ -2465,7 +2591,7 @@ class StatusPageAPI extends BaseAPI {
         const response = {
             incidentPublicNotes: BaseModel.toJSONArray(incidentPublicNotes, IncidentPublicNote),
             incidentStates: BaseModel.toJSONArray(incidentStates, IncidentState),
-            incidents: BaseModel.toJSONArray(incidents, Incident),
+            incidents: this.serializeIncidentsForStatusPage(incidents),
             statusPageResources: BaseModel.toJSONArray(statusPageResources, StatusPageResource),
             incidentStateTimelines: BaseModel.toJSONArray(incidentStateTimelines, IncidentStateTimeline),
             monitorsInGroup: JSONFunctions.serialize(monitorsInGroup),
@@ -3069,6 +3195,20 @@ class StatusPageAPI extends BaseAPI {
             startDate: startDateForMonitorTimeline,
             endDate: endDateForMonitorTimeline,
         });
+        /*
+         * What the uptime bars are actually painted from.
+         *
+         * `monitorStatusTimelines` above stays in the response - it is documented
+         * public API and the E2E helpers read it for current status - but it must
+         * NOT drive the bars. It is capped at LIMIT_MAX across every monitor on
+         * the page and sorted newest-first, so on a page with churny monitors it
+         * returns a few recent days and silently drops the rest.
+         */
+        const uptimeDailyAggregate = await StatusPageService.getUptimeDailyAggregateForStatusPage({
+            monitorIds: monitorsOnStatusPageForTimeline,
+            startDate: startDateForMonitorTimeline,
+            endDate: endDateForMonitorTimeline,
+        });
         // return everything.
         return {
             statusPageResources,
@@ -3076,6 +3216,7 @@ class StatusPageAPI extends BaseAPI {
             monitorGroupCurrentStatuses,
             statusPageGroups: groups,
             monitorStatusTimelines,
+            uptimeDailyAggregate,
             statusPage,
             monitorsOnStatusPage,
             monitorsInGroup,
@@ -3099,7 +3240,7 @@ class StatusPageAPI extends BaseAPI {
          * (clamped to 1..90 days, ending now) instead of issuing a separate
          * StatusPage query here just to read that one column.
          */
-        const { monitorStatuses, monitorGroupCurrentStatuses, statusPageResources, statusPage, monitorsOnStatusPage, monitorStatusTimelines, statusPageGroups, monitorsInGroup, startDateForMonitorTimeline: startDate, endDateForMonitorTimeline: endDate, } = await this.getStatusPageResourcesAndTimelines({
+        const { monitorStatuses, monitorGroupCurrentStatuses, statusPageResources, statusPage, monitorsOnStatusPage, monitorStatusTimelines, uptimeDailyAggregate, statusPageGroups, monitorsInGroup, startDateForMonitorTimeline: startDate, endDateForMonitorTimeline: endDate, } = await this.getStatusPageResourcesAndTimelines({
             statusPageId: statusPageId,
         });
         // check if status page has active incident.
@@ -3745,11 +3886,12 @@ class StatusPageAPI extends BaseAPI {
             scheduledMaintenanceEvents: BaseModel.toJSONArray(scheduledMaintenanceEvents, ScheduledMaintenance),
             activeAnnouncements: BaseModel.toJSONArray(activeAnnouncements, StatusPageAnnouncement),
             incidentPublicNotes: BaseModel.toJSONArray(incidentPublicNotes, IncidentPublicNote),
-            activeIncidents: BaseModel.toJSONArray(activeIncidents, Incident),
+            activeIncidents: this.serializeIncidentsForStatusPage(activeIncidents),
             activeEpisodes: activeEpisodesJson,
             episodePublicNotes: BaseModel.toJSONArray(episodePublicNotes, IncidentEpisodePublicNote),
             episodeStateTimelines: BaseModel.toJSONArray(episodeStateTimelines, IncidentEpisodeStateTimeline),
             monitorStatusTimelines: BaseModel.toJSONArray(monitorStatusTimelines, MonitorStatusTimeline),
+            uptimeDailyAggregate: UptimeDailyAggregateUtil.toJSON(uptimeDailyAggregate),
             resourceGroups: BaseModel.toJSONArray(statusPageGroups, StatusPageGroup),
             monitorStatuses: BaseModel.toJSONArray(monitorStatuses, MonitorStatus),
             statusPageResources: BaseModel.toJSONArray(statusPageResources, StatusPageResource),