@oneuptime/common 14.0.0 → 14.0.2

package/Types/API/Route.ts

@@ -7,13 +7,30 @@ import { FindOperator } from "typeorm";
 export default class Route extends DatabaseProperty {
   private static readonly SCHEME_PREFIX: RegExp = /^[a-zA-Z][a-zA-Z\d+.-]*:/;
 
+  /*
+   * True when the value, read on its own as a relative reference, would start
+   * with a scheme (RFC 3986 4.2): "javascript:alert(1)", but equally
+   * "bot123:ABC/sendMessage". Route refuses such values so a scheme can never
+   * reach a navigation sink; URL uses this to know when a path it parsed has
+   * to keep its leading "/".
+   */
+  public static hasSchemePrefix(route: string): boolean {
+    return Route.SCHEME_PREFIX.test(route);
+  }
+
   private static validateRoute(route: string): void {
-    if (Route.SCHEME_PREFIX.test(route)) {
+    if (Route.hasSchemePrefix(route)) {
       throw new BadDataException(`Invalid route: ${route}`);
     }
 
+    /*
+     * RFC 3986 path characters: unreserved (which includes "~"), sub-delims,
+     * ":" and "@", plus "/", "?", "#", "[", "]" and "%" for the rest of a
+     * path-and-query. "~" was missing, so "https://example.com/~user" could
+     * not be parsed at all.
+     */
     const matchRouteCharacters: RegExp =
-      /^[a-zA-Z_\d\-!#$%&'()*+,./:;=?@[\]]*$/;
+      /^[a-zA-Z_\d\-!#$%&'()*+,./:;=?@[\]~]*$/;
 
     if (route && !matchRouteCharacters.test(route)) {
       throw new BadDataException(`Invalid route: ${route}`);

package/Types/API/URL.ts

@@ -459,7 +459,26 @@ export default class URL extends DatabaseProperty {
     const path: string = pathSegments.join("/");
 
     if (path || fragment) {
-      route = new Route(path + fragment);
+      /*
+       * The route is held without the "/" that separates it from the
+       * authority ("api/v1/items"), and toString puts it back. Dropping it is
+       * only harmless while the first segment has no ":" — once it does, the
+       * bare path reads as a scheme ("bot123:ABC/sendMessage" is scheme
+       * "bot123", RFC 3986 4.2) and Route rejects it. Telegram puts the bot
+       * token, which always contains a ":", in exactly that segment, so every
+       * https://api.telegram.org/bot<token>/... URL failed to parse — which
+       * broke the Telegram workflow component, the API components, and the
+       * SSRF check on every sandboxed axios call to Telegram.
+       *
+       * Keep the "/" for those paths only. It is the path as written, it
+       * cannot be read as a scheme, and toString produces the same string
+       * either way; every path that parsed before parses to the same Route.
+       */
+      const routeValue: string = path + fragment;
+
+      route = new Route(
+        Route.hasSchemePrefix(routeValue) ? "/" + routeValue : routeValue,
+      );
     }
 
     const queryString: string = URL.queryStringOf(url);
@@ -535,8 +554,13 @@ export default class URL extends DatabaseProperty {
   }
 
   public addRoute(route: Route | string): URL {
+    /*
+     * A string goes to Route.addRoute as-is, which prefixes the "/" before
+     * validating. Wrapping it in a Route first validated the bare form, so
+     * addRoute("bot123:ABC/sendMessage") threw for the same reason as above.
+     */
     if (typeof route === Typeof.String) {
-      this.route.addRoute(new Route(route.toString()));
+      this.route.addRoute(route.toString());
     }
 
     if (route instanceof Route) {

package/Types/AutoRemediation/AiRemediationCommandPlan.ts

@@ -1,5 +1,9 @@
 import RunbookStepType from "../Runbook/RunbookStepType";
 import { JSONObject } from "../JSON";
+import {
+  KubectlCommandTier,
+  PROTECTED_KUBERNETES_NAMESPACES,
+} from "../Kubernetes/KubernetesClusterAiAccess";
 
 /*
  * The AI-composed command plan stored on
@@ -11,14 +15,15 @@ import { JSONObject } from "../JSON";
  */
 
 /*
- * The only step types an AI remediation run may compose. Kubernetes stays
- * runbook-only: its structured restart/scale actions cannot express an
- * arbitrary command, which is the whole point of this lane, and operators
- * who want kubectl can expose it to a Bash command instead.
+ * The only step types an AI remediation run may compose. The structured
+ * Kubernetes step (restart/scale) stays runbook-only; AI reaches a cluster
+ * through the Kubectl step instead, whose argv is tiered by KubectlPolicy
+ * and which targets a Runner the cluster's AI page bound.
  */
 export const AI_COMMAND_STEP_TYPES: Array<RunbookStepType> = [
   RunbookStepType.Bash,
   RunbookStepType.SSH,
+  RunbookStepType.Kubectl,
 ];
 
 export enum AiRemediationCommandPolicyVerdict {
@@ -41,7 +46,12 @@ export enum AiRemediationCommandExecutionStatus {
   Running = "Running",
   Succeeded = "Succeeded",
   Failed = "Failed",
-  // An earlier command in the plan failed, so this one never ran.
+  /*
+   * Never ran: an earlier command in the plan failed, the remediation was
+   * settled before this command's turn, or — for a rollback — the cluster
+   * no longer allowed the undo to run unattended, so a human was told to
+   * undo it instead.
+   */
   Skipped = "Skipped",
 }
 
@@ -79,6 +89,14 @@ export interface AiRemediationCommand {
   runnerNameSnapshot: string;
   credentialId?: string | undefined;
   credentialNameSnapshot?: string | undefined;
+  /*
+   * Kubectl only: the cluster the command runs against and the tier
+   * KubectlPolicy assigned when the plan was composed. The tier is
+   * informational on the card; execution re-evaluates it.
+   */
+  kubernetesClusterId?: string | undefined;
+  kubernetesClusterNameSnapshot?: string | undefined;
+  kubectlTier?: KubectlCommandTier | undefined;
   command: string;
   timeoutInMs: number;
   // Why the AI wants to run this — shown verbatim on the approval card.
@@ -108,6 +126,62 @@ export interface AiRemediationCommandPlan {
   executionStartedAt?: string | undefined;
   executionCompletedAt?: string | undefined;
   rollbackStatus?: AiRemediationRollbackStatus | undefined;
+  /*
+   * ISO 8601. Written by the rollback arm when it starts and refreshed
+   * before every step it waits on, until rollbackStatus settles. A Failed
+   * verification whose rollback never settled and whose heartbeat went
+   * stale was interrupted (a Worker restart mid-rollback): the verifier's
+   * recovery sweep resumes it instead of leaving the cluster half-reverted.
+   */
+  rollbackHeartbeatAt?: string | undefined;
+}
+
+/*
+ * A command's execution record has reached an outcome. Pending and Running
+ * records may still change: the job they name can finish later.
+ */
+export function isSettledCommandExecutionStatus(
+  status: AiRemediationCommandExecutionStatus | undefined,
+): boolean {
+  return (
+    status === AiRemediationCommandExecutionStatus.Succeeded ||
+    status === AiRemediationCommandExecutionStatus.Failed ||
+    status === AiRemediationCommandExecutionStatus.Skipped
+  );
+}
+
+/*
+ * RunnerJob.stepId prefixes of the three ways a plan's commands reach a
+ * Runner: executed INLINE by a FullAuto run while it plans, executed by the
+ * approved-plan executor after a human's click, or run by the rollback arm
+ * after verification failed. The per-cluster circuit breaker counts inline
+ * kubectl jobs by the first; the rollback arm resolves an interrupted
+ * command through the prefix its lane used when the job id never reached
+ * the command's record. Spelled out here, once, so the lanes never drift.
+ */
+export const INLINE_COMMAND_STEP_ID_PREFIX: string = "ai-command-";
+export const APPROVED_COMMAND_STEP_ID_PREFIX: string = "ai-approved-";
+export const ROLLBACK_COMMAND_STEP_ID_PREFIX: string = "ai-rollback-";
+
+/*
+ * The stepId the FORWARD job of a command carries: inline when a FullAuto
+ * run executed it while planning, approved otherwise. Unique per suggestion
+ * — a plan executes at most once and a retried run never re-executes.
+ */
+export function getForwardCommandStepId(
+  command: Pick<AiRemediationCommand, "sequence" | "wasAutoExecuted">,
+): string {
+  return `${
+    command.wasAutoExecuted === true
+      ? INLINE_COMMAND_STEP_ID_PREFIX
+      : APPROVED_COMMAND_STEP_ID_PREFIX
+  }${command.sequence}`;
+}
+
+export function getRollbackCommandStepId(
+  command: Pick<AiRemediationCommand, "sequence">,
+): string {
+  return `${ROLLBACK_COMMAND_STEP_ID_PREFIX}${command.sequence}`;
 }
 
 // Hard caps — enforced at plan acceptance, not just in the prompt.
@@ -117,6 +191,103 @@ export const MIN_COMMAND_TIMEOUT_MS: number = 1000;
 export const MAX_COMMAND_TIMEOUT_MS: number = 5 * 60 * 1000;
 export const DEFAULT_COMMAND_TIMEOUT_MS: number = 60 * 1000;
 
+/*
+ * The kubectl tiers and the unattended cluster modes in the words every
+ * remediation prompt, tool description and feed item uses. They restate the
+ * KubectlCommandTier and KubernetesAiRemediationMode doc comments in
+ * Types/Kubernetes/KubernetesClusterAiAccess and must keep matching them —
+ * and the policy (KubectlPolicy), which is what actually decides. One copy,
+ * so a prompt can never describe a tier the policy no longer has.
+ */
+
+/*
+ * Each summary that names a node operation also comes without it, for a
+ * cluster whose Runner reported node operations off
+ * (aiAccess.remediation.nodeOperations=false): that Runner refuses every
+ * node operation, approved or not, so the model is never offered one there
+ * (list_command_targets and the cluster round's prompt). The constants are
+ * the full wording.
+ */
+export interface KubectlChangeSummaryOptions {
+  allowNodeOperations: boolean;
+}
+
+// SafeWrite: what an Automatic cluster runs without a human.
+export function getKubectlSafeChangesSummary(
+  options: KubectlChangeSummaryOptions,
+): string {
+  return `rollout restart/undo/pause/resume of one workload, scale of one workload to a non-zero replica count, delete of one named pod, ${
+    options.allowNodeOperations ? "cordon/uncordon of one node, " : ""
+  }and label/annotate of one pod or workload with unreserved keys — each on exactly ONE named object (TYPE/NAME, e.g. deployment/web), never a selector, --all, several names or a bare kind`;
+}
+
+// RiskyWrite: needs a human unless the allowlist names it or approvals are bypassed.
+export function getKubectlRiskierChangesSummary(
+  options: KubectlChangeSummaryOptions,
+): string {
+  return `patch, set image/env/resources, ${
+    options.allowNodeOperations ? "drain, taint, " : ""
+  }scale to zero, deleting a workload or a job, create job --from=cronjob/<name>, and any change that touches several objects at once`;
+}
+
+/*
+ * Asks a human whatever the cluster's mode, allowlist included: a
+ * protected-namespace write, and — where the Runner may change nodes at
+ * all — a node drain, a node taint and a patch of a Node (the canonical
+ * mode text in KubernetesClusterAiAccess).
+ */
+export function getKubectlAlwaysAsksSummary(
+  options: KubectlChangeSummaryOptions,
+): string {
+  return `a write in a protected namespace (${PROTECTED_KUBERNETES_NAMESPACES.join(
+    ", ",
+  )})${
+    options.allowNodeOperations
+      ? ", a node drain, a node taint and a patch of a Node always need"
+      : " always needs"
+  } a human, in every mode — Bypass approval and the allowlist included`;
+}
+
+export const KUBECTL_SAFE_CHANGES_SUMMARY: string =
+  getKubectlSafeChangesSummary({ allowNodeOperations: true });
+
+export const KUBECTL_RISKIER_CHANGES_SUMMARY: string =
+  getKubectlRiskierChangesSummary({ allowNodeOperations: true });
+
+export const KUBECTL_ALWAYS_ASKS_SUMMARY: string = getKubectlAlwaysAsksSummary({
+  allowNodeOperations: true,
+});
+
+// Denied: never runs, whoever approves it.
+export const KUBECTL_NEVER_RUNS_SUMMARY: string =
+  "destructive commands never run, even with approval: exec, cp, port-forward, run, apply, edit, deleting namespaces/volumes/nodes/secrets/CRDs, any write to RBAC, admission-webhook or API-extension objects, create deployment/cronjob/job with --image, and a patch whose body is not JSON or that changes a pod's identity, privileges, host access, Secrets or command";
+
+// How the cluster's allowlist is read.
+export const KUBECTL_ALLOWLIST_SUMMARY: string =
+  "the cluster's kubectl allowlist is matched token by token: a pattern must have exactly as many tokens as the command, a * matches within one token only, and a flag must be spelled as the pattern spells it";
+
+export function getKubectlAutomaticModeSummary(
+  options: KubectlChangeSummaryOptions,
+): string {
+  return `Automatic: safe changes run without a human (${getKubectlSafeChangesSummary(
+    options,
+  )}). A riskier change (${getKubectlRiskierChangesSummary(
+    options,
+  )}) never runs without one: when the round could only find riskier fixes it ends by proposing exactly those for one-click approval; when it also ran safe fixes, a riskier fix is proposed only if verification shows the safe ones did not recover the signal (the follow-up round, which asks). Shapes on the cluster's kubectl allowlist run on their own.`;
+}
+
+export const KUBECTL_AUTOMATIC_MODE_SUMMARY: string =
+  getKubectlAutomaticModeSummary({ allowNodeOperations: true });
+
+/*
+ * Interpolated into prompts and feed copy on its own, so it names the
+ * exceptions instead of pointing at a list "below".
+ */
+export const KUBECTL_BYPASS_MODE_SUMMARY: string =
+  "Bypass approval: AI does not ask. Every change the policy allows — safe AND riskier — runs on its own, follow-up rounds included, except for what always needs a human.";
+
+export const KUBECTL_EVERY_MODE_LIMITS_SUMMARY: string = `In every mode, Bypass approval included: ${KUBECTL_NEVER_RUNS_SUMMARY}; ${KUBECTL_ALWAYS_ASKS_SUMMARY}; the cluster's in-cluster Runner never changes its own namespace, nor a namespace outside the ones its chart lets it change, nor nodes when its chart turned node operations off; and an unattended run becomes a proposal when the hourly per-cluster circuit breaker trips or another unattended round already holds the cluster.`;
+
 export class AiRemediationCommandPlanUtil {
   /*
    * Parse a jsonb column value back into a typed plan. Fail-closed: any
@@ -171,6 +342,21 @@ export class AiRemediationCommandPlanUtil {
         return null;
       }
 
+      if (
+        stepType === RunbookStepType.Kubectl &&
+        (typeof obj["kubernetesClusterId"] !== "string" ||
+          !obj["kubernetesClusterId"].trim())
+      ) {
+        return null;
+      }
+
+      const kubectlTierRaw: string = String(obj["kubectlTier"] || "");
+      const kubectlTier: KubectlCommandTier | undefined = Object.values(
+        KubectlCommandTier,
+      ).includes(kubectlTierRaw as KubectlCommandTier)
+        ? (kubectlTierRaw as KubectlCommandTier)
+        : undefined;
+
       const verdict: string = String(obj["policyVerdict"] || "");
       if (
         verdict !== AiRemediationCommandPolicyVerdict.AutoApproved &&
@@ -208,6 +394,15 @@ export class AiRemediationCommandPlanUtil {
           typeof obj["credentialNameSnapshot"] === "string"
             ? obj["credentialNameSnapshot"]
             : undefined,
+        kubernetesClusterId:
+          typeof obj["kubernetesClusterId"] === "string"
+            ? obj["kubernetesClusterId"]
+            : undefined,
+        kubernetesClusterNameSnapshot:
+          typeof obj["kubernetesClusterNameSnapshot"] === "string"
+            ? obj["kubernetesClusterNameSnapshot"]
+            : undefined,
+        kubectlTier,
         command: command,
         timeoutInMs: timeoutInMs,
         rationale: typeof obj["rationale"] === "string" ? obj["rationale"] : "",
@@ -261,6 +456,9 @@ export class AiRemediationCommandPlanUtil {
     ) {
       plan.rollbackStatus = rollbackStatus as AiRemediationRollbackStatus;
     }
+    if (typeof json["rollbackHeartbeatAt"] === "string") {
+      plan.rollbackHeartbeatAt = json["rollbackHeartbeatAt"];
+    }
 
     return plan;
   }

package/Types/Date.ts

@@ -5,6 +5,7 @@ import { JSONObject, ObjectType } from "./JSON";
 import PositiveNumber from "./PositiveNumber";
 import moment from "moment-timezone";
 import Timezone from "./Timezone";
+import TimezoneAlias from "./TimezoneAlias";
 import Zod, { ZodSchema } from "../Utils/Schema/Zod";
 
 export const Moment: typeof moment = moment;
@@ -55,10 +56,30 @@ export default class OneUptimeDate {
   }
 
   private static getLocalShortMonthName(date: Date): string {
-    return date.toLocaleString("default", {
-      month: "short",
-      timeZone: this.getCurrentTimezone().toString(),
-    });
+    /*
+     * The browser's Intl can be older than the zone name: an engine with
+     * tzdata before 2022b throws a RangeError for "Europe/Kyiv", which is
+     * what getCurrentTimezone reports for a browser that says "Europe/Kiev".
+     * Try the zone's legacy spellings next, which such an engine knows, and
+     * finally moment, which carries its own zone data.
+     */
+    const timezone: Timezone = this.getCurrentTimezone();
+
+    for (const name of [
+      timezone,
+      ...TimezoneAlias.getLegacyNamesOf(timezone),
+    ]) {
+      try {
+        return date.toLocaleString("default", {
+          month: "short",
+          timeZone: name.toString(),
+        });
+      } catch {
+        // Unknown to this engine's Intl; try the next spelling.
+      }
+    }
+
+    return this.inCurrentTimezone(date).format("MMM");
   }
 
   public static getSchema(): ZodSchema {
@@ -487,6 +508,10 @@ export default class OneUptimeDate {
    * for the schedule's timezone even though the time picker captured it in the
    * viewer's own zone (audit F1). Inverse of
    * getLocalDateFromWallClockInTimezone.
+   *
+   * Only for widgets that read Dates through the current timezone, as the
+   * datetime-local Input and the TimePicker do. A widget that reads a Date's
+   * browser-local wall clock needs getInstantFromBrowserLocalWallClockInTimezone.
    */
   public static getInstantFromLocalWallClockInTimezone(
     date: Date | string,
@@ -513,6 +538,10 @@ export default class OneUptimeDate {
    * wall-clock IN THE CURRENT TIMEZONE equals `date`'s wall-clock as seen in
    * `timezone`. Used to display a stored schedule-timezone time inside a picker
    * that renders in the viewer's own zone (audit F1).
+   *
+   * Only for widgets that read Dates through the current timezone. A widget
+   * that draws a Date at its browser-local wall clock needs
+   * getBrowserLocalDateFromWallClockInTimezone.
    */
   public static getLocalDateFromWallClockInTimezone(
     date: Date | string,
@@ -535,6 +564,62 @@ export default class OneUptimeDate {
       .toDate();
   }
 
+  /**
+   * The browser-zone twin of getLocalDateFromWallClockInTimezone: return a Date
+   * whose BROWSER-LOCAL wall clock (getHours() and so on) equals `date`'s wall
+   * clock in `timezone`.
+   *
+   * For widgets that draw a Date at its browser-local wall clock and know
+   * nothing of the user's configured zone, such as react-big-calendar with the
+   * plain moment localizer. getLocalDateFromWallClockInTimezone builds the wall
+   * clock in the CURRENT timezone, which is the user's User Settings zone when
+   * one is set. When that differs from the browser's zone, the widget draws
+   * every Date off by the difference between the two. Inverse of
+   * getInstantFromBrowserLocalWallClockInTimezone.
+   */
+  public static getBrowserLocalDateFromWallClockInTimezone(
+    date: Date | string,
+    timezone: string,
+  ): Date {
+    date = this.fromString(date);
+    const zoned: moment.Moment = moment.tz(date, timezone);
+    return new Date(
+      zoned.year(),
+      zoned.month(),
+      zoned.date(),
+      zoned.hour(),
+      zoned.minute(),
+      zoned.second(),
+    );
+  }
+
+  /**
+   * The browser-zone twin of getInstantFromLocalWallClockInTimezone: read
+   * `date`'s BROWSER-LOCAL wall clock and return the instant that same wall
+   * clock names in `timezone`. For turning a Date a browser-local widget
+   * reported (a range react-big-calendar shows, say) back into an instant.
+   * Inverse of getBrowserLocalDateFromWallClockInTimezone.
+   */
+  public static getInstantFromBrowserLocalWallClockInTimezone(
+    date: Date | string,
+    timezone: string,
+  ): Date {
+    date = this.fromString(date);
+    return moment
+      .tz(
+        {
+          year: date.getFullYear(),
+          month: date.getMonth(),
+          day: date.getDate(),
+          hour: date.getHours(),
+          minute: date.getMinutes(),
+          second: date.getSeconds(),
+        },
+        timezone,
+      )
+      .toDate();
+  }
+
   public static isOverlapping(
     start: Date,
     end: Date,
@@ -2139,26 +2224,55 @@ export default class OneUptimeDate {
    * the timezone they configured — even when the machine, OS or VPN they are
    * on reports a different one. Pass null to fall back to the browser zone
    * (signed-out surfaces, or a user who has not picked a timezone).
+   *
+   * A legacy name is kept as its current name ("Asia/Calcutta" as
+   * "Asia/Kolkata" — see TimezoneAlias), which is the name the picker
+   * offers and the one getUserTimezone reports.
    */
   public static setUserTimezone(timezone: Timezone | null | undefined): void {
+    if (!timezone || typeof timezone !== "string") {
+      this.userTimezone = null;
+      return;
+    }
+
+    /*
+     * Translate before checking with moment. The saved value can be one an
+     * older build cached in the browser, and one of those, US/Pacific-New,
+     * has been removed from tzdata: moment no longer resolves it, but it is
+     * still Los Angeles, not a reason to drop the user's zone.
+     */
+    const currentTimezone: Timezone =
+      TimezoneAlias.getCanonicalTimezone(timezone);
+
     /*
      * Ignore anything moment does not recognise as an IANA zone. A stale or
      * corrupt saved value must not take every date in the UI down with it.
      */
-    if (!timezone || !moment.tz.zone(timezone.toString())) {
+    if (!moment.tz.zone(currentTimezone.toString())) {
       this.userTimezone = null;
       return;
     }
 
-    this.userTimezone = timezone;
+    this.userTimezone = currentTimezone;
   }
 
   public static getUserTimezone(): Timezone | null {
     return this.userTimezone;
   }
 
+  /**
+   * The zone every "local" helper reads: the user's own, else the one the
+   * browser / process reports, in its current name. Chromium reports the
+   * ICU spelling of many zones (Asia/Calcutta, Europe/Kiev, Asia/Saigon),
+   * and this guess is what the dashboard saves to a new user's profile and
+   * pre-selects in the on-call schedule pickers — neither of which offers
+   * the legacy name. Called on every date format, so it stays a lookup:
+   * moment caches its guess, and the translation is a map read.
+   */
   public static getCurrentTimezone(): Timezone {
-    return this.userTimezone || (moment.tz.guess() as Timezone);
+    return (
+      this.userTimezone || TimezoneAlias.getCanonicalTimezone(moment.tz.guess())
+    );
   }
 
   /**

package/Types/Email/EmailMessage.ts

@@ -5,6 +5,14 @@ import EmailTemplateType from "./EmailTemplateType";
 
 export interface EmailEnvelope {
   subject: string;
+  /*
+   * The subject is final text, not a Handlebars template. Without this the
+   * mailer compiles the subject against `vars`, which is what a template
+   * subject needs but breaks a subject already rendered from user-authored
+   * text: an incident description quoting "{{ .Values.image.tag }}" fails to
+   * parse, so the email is never sent, and "{{ x }}" renders as nothing.
+   */
+  isSubjectLiteral?: boolean | undefined;
   templateType?: EmailTemplateType;
   vars: Dictionary<string | JSONObject>;
   body?: string;

package/Types/Email/EmailTemplateType.ts

@@ -37,6 +37,7 @@ enum EmailTemplateType {
   MonitorOwnerAdded = "MonitorOwnerAdded.hbs",
   MonitorOwnerResourceCreated = "MonitorOwnerResourceCreated.hbs",
   MonitorProbesStatus = "MonitorProbesStatus.hbs",
+  MonitorsAffectedByProbeStatus = "MonitorsAffectedByProbeStatus.hbs",
   MonitorOwnerStatusChanged = "MonitorOwnerStatusChanged.hbs",
 
   SloOwnerStatusChanged = "SloOwnerStatusChanged.hbs",

package/Types/Exception/ExceptionMessages.ts

@@ -1,6 +1,7 @@
 enum ExceptionMessages {
   MonitorNotFound = "Monitor not found.",
   MonitorDisabled = "Monitor is disabled. Please enable it to start monitoring again.",
+  UserBlocked = "Your account has been blocked. Please contact your administrator.",
 }
 
 export default ExceptionMessages;