@oneuptime/common 14.0.0 → 14.0.1

package/Server/Services/ServiceLevelObjectiveOwnerRuleEngineService.ts

@@ -0,0 +1,521 @@
+import Label from "../../Models/DatabaseModels/Label";
+import ServiceLevelObjective from "../../Models/DatabaseModels/ServiceLevelObjective";
+import { ServiceLevelObjectiveFeedEventType } from "../../Models/DatabaseModels/ServiceLevelObjectiveFeed";
+import ServiceLevelObjectiveOwnerRule from "../../Models/DatabaseModels/ServiceLevelObjectiveOwnerRule";
+import ServiceLevelObjectiveOwnerTeam from "../../Models/DatabaseModels/ServiceLevelObjectiveOwnerTeam";
+import ServiceLevelObjectiveOwnerUser from "../../Models/DatabaseModels/ServiceLevelObjectiveOwnerUser";
+import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { Purple500 } from "../../Types/BrandColors";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import { escapeMarkdownInline } from "../../Utils/Markdown/MarkdownEscape";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
+import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
+import Select from "../Types/Database/Select";
+import logger, { LogAttributes } from "../Utils/Logger";
+import OwnerRuleAssignment, {
+  OwnersToAssign,
+} from "../Utils/Rules/OwnerRuleAssignment";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
+import {
+  ApplyRulesToExistingResourceData,
+  RuleApplicationResult,
+  RuleApplicationResultUtil,
+  RuleRunEngine,
+} from "../Utils/Rules/RuleRun/RuleApplication";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import DatabaseService from "./DatabaseService";
+import ServiceLevelObjectiveFeedService from "./ServiceLevelObjectiveFeedService";
+import ServiceLevelObjectiveOwnerRuleService from "./ServiceLevelObjectiveOwnerRuleService";
+import ServiceLevelObjectiveOwnerTeamService from "./ServiceLevelObjectiveOwnerTeamService";
+import ServiceLevelObjectiveOwnerUserService from "./ServiceLevelObjectiveOwnerUserService";
+import ServiceLevelObjectiveService from "./ServiceLevelObjectiveService";
+
+// What adding one owner row did.
+enum OwnerWriteOutcome {
+  Added = "Added",
+  AlreadyOwner = "AlreadyOwner",
+  Rejected = "Rejected",
+}
+
+class ServiceLevelObjectiveOwnerRuleEngineServiceClass
+  implements
+    RuleRunEngine<ServiceLevelObjective, ServiceLevelObjectiveOwnerRule>
+{
+  public readonly ruleSelect: Select<ServiceLevelObjectiveOwnerRule> = {
+    _id: true,
+    name: true,
+    criteria: true,
+    notifyOwners: true,
+    serviceLevelObjectiveLabels: { _id: true },
+    serviceLevelObjectiveNamePattern: true,
+    serviceLevelObjectiveDescriptionPattern: true,
+    ownerUsers: { _id: true },
+    ownerTeams: { _id: true },
+  };
+
+  // Evaluation re-reads the SLO, so a run only has to name it.
+  public readonly resourceSelectForRuleRun: Select<ServiceLevelObjective> = {
+    _id: true,
+    projectId: true,
+  };
+
+  /**
+   * Evaluates ServiceLevelObjectiveOwnerRule rows for the given SLO and adds
+   * matched owner users / teams through the SLO owner services, so each one
+   * gets the usual owner-added feed item and notification. Rules with
+   * notifyOwners set notify the added owners; rules with notifyOwners off add
+   * silently.
+   */
+  @CaptureSpan()
+  public async applyRulesToServiceLevelObjective(
+    serviceLevelObjective: ServiceLevelObjective,
+  ): Promise<void> {
+    if (!serviceLevelObjective.id || !serviceLevelObjective.projectId) {
+      return;
+    }
+
+    try {
+      const rules: Array<ServiceLevelObjectiveOwnerRule> =
+        await ServiceLevelObjectiveOwnerRuleService.findBy({
+          query: {
+            projectId: serviceLevelObjective.projectId,
+            isEnabled: true,
+          },
+          props: { isRoot: true },
+          select: this.ruleSelect,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
+          skip: 0,
+        });
+
+      logIfRuleReadWasTruncated({
+        ruleKind: "ServiceLevelObjectiveOwnerRule",
+        projectId: serviceLevelObjective.projectId,
+        rulesRead: rules.length,
+      });
+
+      if (rules.length === 0) {
+        return;
+      }
+
+      await this.applyRules({
+        serviceLevelObjective: serviceLevelObjective,
+        rules: rules,
+        allowOwnerNotification: true,
+      });
+    } catch (error) {
+      logger.error(`Error applying SLO owner rules: ${error}`, {
+        projectId: serviceLevelObjective.projectId?.toString(),
+        serviceLevelObjectiveId: serviceLevelObjective.id?.toString(),
+      } as LogAttributes);
+    }
+  }
+
+  /*
+   * "Run now": the same evaluation, for an SLO that already exists and only
+   * the rules being run.
+   */
+  @CaptureSpan()
+  public async applyRulesToExistingResource(
+    data: ApplyRulesToExistingResourceData<
+      ServiceLevelObjective,
+      ServiceLevelObjectiveOwnerRule
+    >,
+  ): Promise<RuleApplicationResult> {
+    try {
+      return await this.applyRules({
+        serviceLevelObjective: data.resource,
+        rules: data.rules,
+        allowOwnerNotification: data.allowOwnerNotification,
+      });
+    } catch (error) {
+      logger.error(`Error running SLO owner rules: ${error}`, {
+        projectId: data.resource.projectId?.toString(),
+        serviceLevelObjectiveId: data.resource.id?.toString(),
+      } as LogAttributes);
+
+      return RuleApplicationResultUtil.failed();
+    }
+  }
+
+  private async applyRules(data: {
+    serviceLevelObjective: ServiceLevelObjective;
+    rules: Array<ServiceLevelObjectiveOwnerRule>;
+    allowOwnerNotification: boolean;
+  }): Promise<RuleApplicationResult> {
+    const { serviceLevelObjective, rules } = data;
+
+    if (
+      !serviceLevelObjective.id ||
+      !serviceLevelObjective.projectId ||
+      rules.length === 0
+    ) {
+      return RuleApplicationResultUtil.noMatch();
+    }
+
+    const sloWithDetails: ServiceLevelObjective | null =
+      await ServiceLevelObjectiveService.findOneById({
+        id: serviceLevelObjective.id,
+        select: {
+          name: true,
+          description: true,
+          labels: { _id: true },
+        },
+        props: { isRoot: true },
+      });
+
+    if (!sloWithDetails) {
+      return RuleApplicationResultUtil.noMatch();
+    }
+
+    const usersByNotify: Map<boolean, Set<string>> = new Map([
+      [true, new Set()],
+      [false, new Set()],
+    ]);
+    const teamsByNotify: Map<boolean, Set<string>> = new Map([
+      [true, new Set()],
+      [false, new Set()],
+    ]);
+
+    const matchedRules: Array<ServiceLevelObjectiveOwnerRule> = [];
+    const allUserIds: Set<string> = new Set();
+    const allTeamIds: Set<string> = new Set();
+    let anyRuleMatched: boolean = false;
+
+    for (const rule of rules) {
+      if (!this.doesServiceLevelObjectiveMatchRule(sloWithDetails, rule)) {
+        continue;
+      }
+      anyRuleMatched = true;
+      let ruleAddedAny: boolean = false;
+      const notify: boolean =
+        rule.notifyOwners !== false && data.allowOwnerNotification;
+      for (const user of rule.ownerUsers || []) {
+        if (user.id) {
+          usersByNotify.get(notify)!.add(user.id.toString());
+          allUserIds.add(user.id.toString());
+          ruleAddedAny = true;
+        }
+      }
+      for (const team of rule.ownerTeams || []) {
+        if (team.id) {
+          teamsByNotify.get(notify)!.add(team.id.toString());
+          allTeamIds.add(team.id.toString());
+          ruleAddedAny = true;
+        }
+      }
+      if (ruleAddedAny) {
+        matchedRules.push(rule);
+      }
+    }
+
+    if (!anyRuleMatched) {
+      return RuleApplicationResultUtil.noMatch();
+    }
+
+    // The rules that matched name no owners, so there is nothing to add.
+    if (matchedRules.length === 0) {
+      return RuleApplicationResultUtil.alreadyApplied();
+    }
+
+    // Owners already on the SLO are skipped rather than duplicated.
+    const notYetAssigned: OwnersToAssign =
+      await OwnerRuleAssignment.getOwnersNotYetAssigned({
+        ownerUserService: ServiceLevelObjectiveOwnerUserService,
+        ownerTeamService: ServiceLevelObjectiveOwnerTeamService,
+        resourceIdColumn: "serviceLevelObjectiveId",
+        resourceId: serviceLevelObjective.id,
+        userIds: Array.from(allUserIds),
+        teamIds: Array.from(allTeamIds),
+      });
+
+    const userIdsToAdd: Set<string> = new Set(
+      notYetAssigned.userIds.map((id: ObjectID): string => {
+        return id.toString();
+      }),
+    );
+    const teamIdsToAdd: Set<string> = new Set(
+      notYetAssigned.teamIds.map((id: ObjectID): string => {
+        return id.toString();
+      }),
+    );
+
+    let ownersAdded: number = 0;
+    let ownersRejected: number = 0;
+
+    const count: (outcome: OwnerWriteOutcome) => void = (
+      outcome: OwnerWriteOutcome,
+    ): void => {
+      if (outcome === OwnerWriteOutcome.Added) {
+        ownersAdded++;
+      } else if (outcome === OwnerWriteOutcome.Rejected) {
+        ownersRejected++;
+      }
+    };
+
+    /*
+     * The notifying set goes first, so an owner two matching rules disagree
+     * about is added once, and notified.
+     */
+    for (const notify of [true, false]) {
+      const userIds: Array<string> = Array.from(
+        usersByNotify.get(notify)!,
+      ).filter((id: string): boolean => {
+        return userIdsToAdd.delete(id);
+      });
+      const teamIds: Array<string> = Array.from(
+        teamsByNotify.get(notify)!,
+      ).filter((id: string): boolean => {
+        return teamIdsToAdd.delete(id);
+      });
+
+      for (const userId of userIds) {
+        const owner: ServiceLevelObjectiveOwnerUser =
+          new ServiceLevelObjectiveOwnerUser();
+        owner.serviceLevelObjectiveId = serviceLevelObjective.id;
+        owner.projectId = serviceLevelObjective.projectId;
+        owner.userId = new ObjectID(userId);
+        owner.isOwnerNotified = !notify;
+        count(
+          await this.addOwner({
+            ownerService: ServiceLevelObjectiveOwnerUserService,
+            owner: owner,
+            serviceLevelObjective: serviceLevelObjective,
+          }),
+        );
+      }
+
+      for (const teamId of teamIds) {
+        const owner: ServiceLevelObjectiveOwnerTeam =
+          new ServiceLevelObjectiveOwnerTeam();
+        owner.serviceLevelObjectiveId = serviceLevelObjective.id;
+        owner.projectId = serviceLevelObjective.projectId;
+        owner.teamId = new ObjectID(teamId);
+        owner.isOwnerNotified = !notify;
+        count(
+          await this.addOwner({
+            ownerService: ServiceLevelObjectiveOwnerTeamService,
+            owner: owner,
+            serviceLevelObjective: serviceLevelObjective,
+          }),
+        );
+      }
+    }
+
+    if (ownersAdded === 0) {
+      /*
+       * Every owner the rules name was refused - a user who has since left the
+       * project, say. Nothing was added, and "already applied" would claim the
+       * SLO has owners it does not, so report the SLO as one the run could not
+       * update.
+       */
+      return ownersRejected > 0
+        ? RuleApplicationResultUtil.failed()
+        : RuleApplicationResultUtil.alreadyApplied();
+    }
+
+    logger.debug(
+      `ServiceLevelObjectiveOwnerRuleEngine added owners to SLO ${serviceLevelObjective.id}`,
+      {
+        projectId: serviceLevelObjective.projectId.toString(),
+      } as LogAttributes,
+    );
+
+    await this.postOwnerRuleFeedItem({
+      serviceLevelObjectiveId: serviceLevelObjective.id,
+      projectId: serviceLevelObjective.projectId,
+      sloName: sloWithDetails.name,
+      matchedRules: matchedRules,
+    });
+
+    return RuleApplicationResultUtil.updated(ownersAdded);
+  }
+
+  /*
+   * SLO owner services refuse a user who is not a member of the project, or a
+   * team from another one (see SloOwnerReferenceValidator) - which a rule can
+   * still name after the user left, or when it was written through the API.
+   * That owner is skipped so the rule's other owners are still added; any
+   * other failure is thrown as before.
+   */
+  private async addOwner<TOwner extends BaseModel>(data: {
+    ownerService: DatabaseService<TOwner>;
+    owner: TOwner;
+    serviceLevelObjective: ServiceLevelObjective;
+  }): Promise<OwnerWriteOutcome> {
+    try {
+      const added: boolean = await OwnerRuleAssignment.createOwner({
+        ownerService: data.ownerService,
+        owner: data.owner,
+        props: { isRoot: true },
+      });
+
+      return added ? OwnerWriteOutcome.Added : OwnerWriteOutcome.AlreadyOwner;
+    } catch (error) {
+      if (!(error instanceof BadDataException)) {
+        throw error;
+      }
+
+      logger.warn(
+        `SLO owner rule could not add an owner to SLO ${data.serviceLevelObjective.id?.toString()}: ${error.message}`,
+        {
+          projectId: data.serviceLevelObjective.projectId?.toString(),
+        } as LogAttributes,
+      );
+
+      return OwnerWriteOutcome.Rejected;
+    }
+  }
+
+  /*
+   * The individual OwnerUserAdded / OwnerTeamAdded items say who was added;
+   * this one says which rule is responsible, which is what somebody asking
+   * "why am I on the hook for this SLO?" actually needs. The owners are
+   * already added by now, so a feed failure is logged, never thrown.
+   */
+  private async postOwnerRuleFeedItem(data: {
+    serviceLevelObjectiveId: ObjectID;
+    projectId: ObjectID;
+    sloName: string | undefined;
+    matchedRules: Array<ServiceLevelObjectiveOwnerRule>;
+  }): Promise<void> {
+    try {
+      const sloLink: string =
+        await ServiceLevelObjectiveService.getSloMarkdownLink({
+          projectId: data.projectId,
+          sloId: data.serviceLevelObjectiveId,
+          sloName: data.sloName,
+        });
+
+      await ServiceLevelObjectiveFeedService.createServiceLevelObjectiveFeedItem(
+        {
+          serviceLevelObjectiveId: data.serviceLevelObjectiveId,
+          projectId: data.projectId,
+          serviceLevelObjectiveFeedEventType:
+            ServiceLevelObjectiveFeedEventType.OwnerRuleExecuted,
+          displayColor: Purple500,
+          feedInfoInMarkdown: `👥 Owners were added to ${sloLink} by ${data.matchedRules.length} owner ${data.matchedRules.length === 1 ? "rule" : "rules"}.`,
+          moreInformationInMarkdown: `**Owner rules that matched**: ${data.matchedRules
+            .map((rule: ServiceLevelObjectiveOwnerRule): string => {
+              // Rule names are user-controlled and the feed renders markdown.
+              return `**${escapeMarkdownInline(
+                rule.name || rule.id?.toString() || "Unnamed rule",
+              )}**`;
+            })
+            .join(", ")}`,
+        },
+      );
+    } catch (error) {
+      logger.error(
+        `Error writing the owner rule feed item for SLO ${data.serviceLevelObjectiveId.toString()}: ${error}`,
+        { projectId: data.projectId.toString() } as LogAttributes,
+      );
+    }
+  }
+
+  private doesServiceLevelObjectiveMatchRule(
+    serviceLevelObjective: ServiceLevelObjective,
+    rule: ServiceLevelObjectiveOwnerRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule,
+      legacyFields: [
+        "serviceLevelObjectiveLabels",
+        "serviceLevelObjectiveNamePattern",
+        "serviceLevelObjectiveDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (
+        legacyRule: ServiceLevelObjectiveOwnerRule,
+      ): boolean => {
+        return this.doesServiceLevelObjectiveMatchLegacyRule(
+          serviceLevelObjective,
+          legacyRule,
+        );
+      },
+    });
+  }
+
+  private doesServiceLevelObjectiveMatchLegacyRule(
+    serviceLevelObjective: ServiceLevelObjective,
+    rule: ServiceLevelObjectiveOwnerRule,
+  ): boolean {
+    if (
+      rule.serviceLevelObjectiveLabels &&
+      rule.serviceLevelObjectiveLabels.length > 0
+    ) {
+      if (
+        !serviceLevelObjective.labels ||
+        serviceLevelObjective.labels.length === 0
+      ) {
+        return false;
+      }
+      const ruleLabelIds: Array<string> = rule.serviceLevelObjectiveLabels.map(
+        (l: Label) => {
+          return l.id?.toString() || "";
+        },
+      );
+      const labelIds: Array<string> = serviceLevelObjective.labels.map(
+        (l: Label) => {
+          return l.id?.toString() || "";
+        },
+      );
+      if (
+        !ruleLabelIds.some((id: string) => {
+          return labelIds.includes(id);
+        })
+      ) {
+        return false;
+      }
+    }
+
+    if (
+      rule.serviceLevelObjectiveNamePattern &&
+      (!serviceLevelObjective.name ||
+        !this.testPattern(
+          rule.serviceLevelObjectiveNamePattern,
+          serviceLevelObjective.name,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    if (
+      rule.serviceLevelObjectiveDescriptionPattern &&
+      (!serviceLevelObjective.description ||
+        !this.testPattern(
+          rule.serviceLevelObjectiveDescriptionPattern,
+          serviceLevelObjective.description,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    return true;
+  }
+
+  /*
+   * Patterns are regexes, with a '*' wildcard fallback - the same two syntaxes
+   * the SLO monitor rules take. SloRulePatternValidator rejects anything else
+   * on save, so this only warns about a rule written before that check.
+   */
+  private testPattern(
+    pattern: string,
+    value: string,
+    rule: ServiceLevelObjectiveOwnerRule,
+  ): boolean {
+    if (!RulePatternMatchUtil.isSupportedPattern(pattern)) {
+      logger.warn(
+        `Invalid pattern in SLO owner rule ${rule.id}: ${pattern}. It is neither a valid regular expression nor a wildcard pattern, so it will never match.`,
+      );
+      return false;
+    }
+
+    return RulePatternMatchUtil.matches(value, pattern);
+  }
+}
+
+export default new ServiceLevelObjectiveOwnerRuleEngineServiceClass();

package/Server/Services/ServiceLevelObjectiveOwnerRuleService.ts

@@ -0,0 +1,51 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/ServiceLevelObjectiveOwnerRule";
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import SloRulePatternValidator from "../Utils/Slo/SloRulePatternValidator";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * No hard-delete retention: a rule is configuration, not an event log, so it
+ * stays until somebody deletes it.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * A pattern that is neither a valid regex nor a wildcard can only ever match
+   * nothing, and the rule engine has no way to say so - it just quietly stops
+   * assigning owners. Reject it while the user is still looking at the form.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    SloRulePatternValidator.validate({
+      namePattern: createBy.data.serviceLevelObjectiveNamePattern,
+      descriptionPattern: createBy.data.serviceLevelObjectiveDescriptionPattern,
+    });
+
+    return { createBy: createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    SloRulePatternValidator.validate({
+      namePattern: updateBy.data.serviceLevelObjectiveNamePattern as
+        | string
+        | undefined,
+      descriptionPattern: updateBy.data
+        .serviceLevelObjectiveDescriptionPattern as string | undefined,
+    });
+
+    return { updateBy: updateBy, carryForward: null };
+  }
+}
+
+export default new Service();

package/Server/Services/ServiceLevelObjectiveService.ts

@@ -27,6 +27,8 @@ import DatabaseService from "./DatabaseService";
 import MonitorStatusService from "./MonitorStatusService";
 import ProjectService from "./ProjectService";
 import ServiceLevelObjectiveBurnRateRuleService from "./ServiceLevelObjectiveBurnRateRuleService";
+import ServiceLevelObjectiveLabelRuleEngineService from "./ServiceLevelObjectiveLabelRuleEngineService";
+import ServiceLevelObjectiveOwnerRuleEngineService from "./ServiceLevelObjectiveOwnerRuleEngineService";
 import ServiceLevelObjectiveMonitorRuleEngineService from "./ServiceLevelObjectiveMonitorRuleEngineService";
 import ServiceLevelObjectiveMonitorRuleService from "./ServiceLevelObjectiveMonitorRuleService";
 import ServiceLevelObjectiveOwnerTeamService from "./ServiceLevelObjectiveOwnerTeamService";
@@ -287,6 +289,32 @@ export class Service extends DatabaseService<Model> {
       );
     }
 
+    /*
+     * Label rules first, so the labels they attach are persisted - and on
+     * createdItem - before owner rules run: an owner rule can then key on a
+     * rule-added label. Fire-and-forget, like every other resource's rules: a
+     * rule must never slow down or fail the create.
+     */
+    if (createdItem.projectId && createdItem.id) {
+      Promise.resolve()
+        .then(async () => {
+          await ServiceLevelObjectiveLabelRuleEngineService.applyRulesToServiceLevelObjective(
+            createdItem,
+          );
+        })
+        .then(async () => {
+          await ServiceLevelObjectiveOwnerRuleEngineService.applyRulesToServiceLevelObjective(
+            createdItem,
+          );
+        })
+        .catch((err: Error) => {
+          logger.error(
+            `Error applying the label and owner rules for SLO ${createdItem.id?.toString()}: ${err}`,
+            { projectId: createdItem.projectId?.toString() } as LogAttributes,
+          );
+        });
+    }
+
     /*
      * Fire-and-forget, like ServiceService's created item: the SLO exists
      * whether or not its feed item does, and the create request should not

package/Server/Types/Workflow/Components/Telegram/SendMessageToChat.ts

@@ -13,7 +13,17 @@ import TelegramComponents from "../../../../../Types/Workflow/Components/Telegra
 import API from "../../../../../Utils/API";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
 
+/*
+ * https://core.telegram.org/bots/api#authorizing-your-bot — a numeric bot id,
+ * a ":", then the secret, e.g. "123456:ABC-DEF1234ghIkl-zyx57W2v1u123ew11".
+ */
+const TELEGRAM_BOT_TOKEN_REGEX: RegExp = /^\d+:[A-Za-z0-9_-]+$/;
+
 export default class SendMessageToChat extends ComponentCode {
+  public static isValidBotToken(botToken: string): boolean {
+    return TELEGRAM_BOT_TOKEN_REGEX.test(botToken);
+  }
+
   public constructor() {
     super();
 
@@ -69,10 +79,26 @@ export default class SendMessageToChat extends ComponentCode {
       throw options.onError(new BadDataException("Telegram message not found"));
     }
 
-    const botToken: string = args["bot-token"]?.toString() as string;
+    // A token pasted or stored with a trailing newline is still the token.
+    const botToken: string = (args["bot-token"]?.toString() || "").trim();
     const chatId: string = args["chat-id"]?.toString() as string;
     const text: string = args["text"]?.toString() as string;
 
+    /*
+     * The token becomes a path segment of the request URL, so anything other
+     * than Telegram's "<bot id>:<secret>" shape is refused before it gets
+     * there. The message deliberately does not quote the value: the step's
+     * error is written to the run log, and the token is a credential. Before
+     * this check, a URL parse failure put the whole token into the log.
+     */
+    if (!SendMessageToChat.isValidBotToken(botToken)) {
+      throw options.onError(
+        new BadDataException(
+          "Telegram Bot Token is not in a valid format. It should look like 123456789:ABCdefGhIJKlmnoPQRstuVWxyz, exactly as BotFather issued it.",
+        ),
+      );
+    }
+
     const telegramApiUrl: URL = URL.fromString(
       `https://api.telegram.org/bot${botToken}/sendMessage`,
     );

package/Server/Utils/AI/Toolbox/SloTools.ts

@@ -382,6 +382,7 @@ export const QuerySlosTool: ObservabilityTool = {
                     _id: true,
                     name: true,
                   },
+                  monitorType: true,
                   monitorNamePattern: true,
                   monitorDescriptionPattern: true,
                   criteria: true,