@oneuptime/common 14.0.0 → 14.0.2

package/Server/Utils/Database/ProjectScopedReferenceValidator.ts

@@ -2,7 +2,7 @@ import DatabaseService from "../../Services/DatabaseService";
 import Query from "../../Types/Database/Query";
 import QueryHelper from "../../Types/Database/QueryHelper";
 import Select from "../../Types/Database/Select";
-import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import ServerException from "../../../Types/Exception/ServerException";
@@ -56,6 +56,26 @@ export interface ProjectScopedReference {
   mustExist?: boolean | undefined;
 }
 
+/*
+ * A many-to-many list on the record being written (an incident's `monitors`,
+ * say) and the model its ids point at. Nothing in DatabaseService or the
+ * permission layer checks relation ids against the tenant, so each service
+ * that accepts such a list names it here and runs it through the same check
+ * as its scalar references.
+ */
+export interface ProjectScopedRelation {
+  // Property on the record being written, e.g. "monitors".
+  column: string;
+  modelName: string;
+  service: DatabaseService<DatabaseBaseModel>;
+}
+
+/*
+ * Per project the update touches (normalized id), per relation column, the
+ * normalized ids that every matched record in that project already holds.
+ */
+export type HeldRelationIds = Map<string, Dictionary<Set<string>>>;
+
 interface ForeignReference {
   modelName: string;
   name: string;
@@ -117,6 +137,31 @@ export function resolveReferenceId(
   return relation._id || relation.id || undefined;
 }
 
+/*
+ * The list form of resolveReferenceId, for many-to-many payloads. The list
+ * reaches a hook as model instances (API create, workers), `{ _id }` objects,
+ * ObjectIDs or bare uuid strings (API update), and an entry with no id cannot
+ * link anything, so it is skipped.
+ */
+export function resolveReferenceIds(value: unknown): Array<ObjectID | string> {
+  if (value === undefined || value === null) {
+    return [];
+  }
+
+  const entries: Array<unknown> = Array.isArray(value) ? value : [value];
+  const ids: Array<ObjectID | string> = [];
+
+  for (const entry of entries) {
+    const id: ObjectID | string | undefined = resolveReferenceId(entry);
+
+    if (id && id.toString().trim()) {
+      ids.push(id);
+    }
+  }
+
+  return ids;
+}
+
 export default class ProjectScopedReferenceValidator {
   public static async validateReferencesBelongToProject(data: {
     projectId: ObjectID | undefined;
@@ -314,6 +359,147 @@ export default class ProjectScopedReferenceValidator {
     );
   }
 
+  /*
+   * One reference per id in the write's many-to-many lists, to pass to
+   * validateReferencesBelongToProject alongside the scalar ones so a payload
+   * with several bad ids gets one answer.
+   *
+   * On an update, `heldIds` (from getHeldRelationIds) exempts the ids the
+   * matched records already hold in `projectId`. Records written before these
+   * lists were checked — or by a monitor whose criteria still carried a stale
+   * id — can hold another project's record, and refusing to save back the
+   * list they already have would lock the user out of editing it. Only ids
+   * the update adds are checked.
+   */
+  public static getRelationReferences(data: {
+    payload: unknown;
+    relations: Array<ProjectScopedRelation>;
+    projectId?: ObjectID | undefined;
+    heldIds?: HeldRelationIds | undefined;
+  }): Array<ProjectScopedReference> {
+    const payload: Dictionary<unknown> =
+      (data.payload as Dictionary<unknown>) || {};
+
+    const heldInProject: Dictionary<Set<string>> | undefined =
+      data.projectId && data.heldIds
+        ? data.heldIds.get(normalizeId(data.projectId.toString()))
+        : undefined;
+
+    const references: Array<ProjectScopedReference> = [];
+
+    for (const relation of data.relations) {
+      const held: Set<string> | undefined = heldInProject?.[relation.column];
+
+      for (const id of resolveReferenceIds(payload[relation.column])) {
+        if (held?.has(normalizeId(id.toString()))) {
+          continue;
+        }
+
+        references.push({
+          modelName: relation.modelName,
+          id: id,
+          service: relation.service,
+        });
+      }
+    }
+
+    return references;
+  }
+
+  /*
+   * What the records an update matches already hold in each of `columns`,
+   * grouped by project. Within a project an id counts as held only when
+   * EVERY matched record holds it: a bulk update writes the same list onto
+   * all of them, and a foreign id one record picked up long ago must not
+   * become a way to attach it to the rest.
+   *
+   * Read as root, like the services' own project fallback for updates, so the
+   * result is keyed by each record's project and a caller only ever gets the
+   * exemption for the project being checked.
+   *
+   * One read per column. A find that selects several many-to-many relations
+   * joins them all and returns a row for every combination of their ids, and
+   * an alert or incident can save sixteen lists in one update (the dashboard
+   * sends every affected-resource list back on each edit).
+   */
+  public static async getHeldRelationIds(data: {
+    service: DatabaseService<DatabaseBaseModel>;
+    query: Query<DatabaseBaseModel>;
+    columns: Array<string>;
+  }): Promise<HeldRelationIds> {
+    const heldIds: HeldRelationIds = new Map();
+
+    const tenantColumnName: string | null = data.service
+      .getModel()
+      .getTenantColumn();
+
+    if (!tenantColumnName || data.columns.length === 0) {
+      return heldIds;
+    }
+
+    for (const column of data.columns) {
+      const records: Array<DatabaseBaseModel> = await data.service.findBy({
+        query: data.query,
+        select: {
+          _id: true,
+          [tenantColumnName]: true,
+          [column]: {
+            _id: true,
+          },
+        } as Select<DatabaseBaseModel>,
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      // Per project, the ids every record read so far holds in this column.
+      const heldInColumn: Map<string, Set<string>> = new Map();
+
+      for (const record of records) {
+        const projectId: string = normalizeId(
+          record.getValue<ObjectID>(tenantColumnName)?.toString() || "",
+        );
+
+        if (!projectId) {
+          continue;
+        }
+
+        const heldByRecord: Set<string> = new Set(
+          resolveReferenceIds(record.getValue(column)).map(
+            (id: ObjectID | string) => {
+              return normalizeId(id.toString());
+            },
+          ),
+        );
+
+        const heldSoFar: Set<string> | undefined = heldInColumn.get(projectId);
+
+        heldInColumn.set(
+          projectId,
+          heldSoFar
+            ? new Set(
+                Array.from(heldSoFar).filter((id: string) => {
+                  return heldByRecord.has(id);
+                }),
+              )
+            : heldByRecord,
+        );
+      }
+
+      for (const [projectId, held] of heldInColumn) {
+        if (!heldIds.has(projectId)) {
+          heldIds.set(projectId, {});
+        }
+
+        heldIds.get(projectId)![column] = held;
+      }
+    }
+
+    return heldIds;
+  }
+
   /*
    * "Can this project actually use this record?" — for callers that must not
    * throw. The probe and telemetry ingest workers build incidents and alerts
@@ -356,4 +542,57 @@ export default class ProjectScopedReferenceValidator {
 
     return Boolean(record);
   }
+
+  /*
+   * isUsableInProject over a list, for workers that copy stored id lists
+   * (monitor criteria, templates, rules) onto a new record. The service hooks
+   * refuse a record from another project — or one that no longer exists — in
+   * those lists, and a worker has nobody to show that error to: it would fail
+   * the whole job, every time it ran. So the worker keeps the usable ids and
+   * drops the rest, and says which it dropped so the log can name them.
+   *
+   * A value that is not a uuid is dropped without a lookup: Postgres would
+   * reject the cast and fail the job just the same.
+   */
+  public static async filterUsableInProject(data: {
+    projectId: ObjectID | undefined;
+    ids: Array<ObjectID | string>;
+    service: DatabaseService<DatabaseBaseModel>;
+  }): Promise<{
+    usableIds: Array<ObjectID | string>;
+    droppedIds: Array<ObjectID | string>;
+  }> {
+    const usableIds: Array<ObjectID | string> = [];
+    const droppedIds: Array<ObjectID | string> = [];
+    const seen: Set<string> = new Set();
+
+    for (const id of data.ids) {
+      const key: string = normalizeId(id?.toString() || "");
+
+      if (!key || seen.has(key)) {
+        continue;
+      }
+
+      seen.add(key);
+
+      const isUsable: boolean =
+        ObjectID.isValidUUID(key) &&
+        (await ProjectScopedReferenceValidator.isUsableInProject({
+          projectId: data.projectId,
+          id: id,
+          service: data.service,
+        }));
+
+      if (isUsable) {
+        usableIds.push(id);
+      } else {
+        droppedIds.push(id);
+      }
+    }
+
+    return {
+      usableIds: usableIds,
+      droppedIds: droppedIds,
+    };
+  }
 }

package/Server/Utils/EmailRollup/EmailRollupFlushRunner.ts

@@ -792,6 +792,7 @@ export default class EmailRollupFlushRunner {
           {
             toEmail: bucket.toEmail,
             subject: built.subject,
+            isSubjectLiteral: true,
             templateType: EmailTemplateType.NotificationRollup,
             vars: built.vars,
           },

package/Server/Utils/Monitor/AffectedResourceList.ts

@@ -1,4 +1,8 @@
 import { escapeMarkdownInline } from "../../../Utils/Markdown/MarkdownEscape";
+import RootCauseList, {
+  RootCauseListDetail,
+  RootCauseListItem,
+} from "./RootCauseList";
 
 /*
  * The "Affected Resources" block of a platform monitor's root cause.
@@ -30,10 +34,8 @@ import { escapeMarkdownInline } from "../../../Utils/Markdown/MarkdownEscape";
  * and the rest of its identity sits underneath as labelled bullets. A
  * missing attribute is simply left out, where the table had to print "-".
  *
- * Plain markdown, deliberately: marked (email), react-markdown (dashboard),
- * slackify-markdown (Slack), the dashboard editor's WYSIWYG converters and
- * Markdown.convertToPlainText all understand a nested list, so nothing
- * downstream needs to know this block exists.
+ * The list itself is a RootCauseList, the shape the Breaching Samples block
+ * of a metric monitor's root cause uses too.
  */
 
 export interface AffectedResourceListDetail {
@@ -67,46 +69,36 @@ export default class AffectedResourceList {
     // The resources to show, already sorted worst first.
     entries: Array<AffectedResourceListEntry>;
   }): string {
-    const lines: Array<string> = [];
-
-    input.entries.forEach(
-      (entry: AffectedResourceListEntry, index: number): void => {
-        const marker: string = `${index + 1}.`;
-
-        /*
-         * A nested bullet belongs to its item only when it is indented to
-         * the item's content column, which is one past the marker — three
-         * spaces under "1.", four under "10.". A fixed three-space indent
-         * would push item 10's details out into a separate top-level list.
-         */
-        const indent: string = " ".repeat(marker.length + 1);
-
+    const items: Array<RootCauseListItem> = input.entries.map(
+      (entry: AffectedResourceListEntry): RootCauseListItem => {
         /*
          * The kind is bold so each item's first line stands out from the
          * detail bullets under it — the value at the end of the line is
          * bold too, so the eye lands on what it is and how bad it is.
          */
         const kind: string = escapeMarkdownInline(entry.kind).trim();
-        const title: string = [kind ? `**${kind}**` : "", entry.name.trim()]
-          .filter((part: string): boolean => {
-            return part.length > 0;
-          })
-          .join(" ");
 
-        lines.push(`${marker} ${title} — ${entry.value}`);
-
-        for (const detail of entry.details) {
-          if (!detail.value || detail.value.trim().length === 0) {
-            continue;
-          }
-
-          lines.push(
-            `${indent}- ${escapeMarkdownInline(detail.label)}: ${detail.value}`,
-          );
-        }
+        return {
+          title: [kind ? `**${kind}**` : "", entry.name.trim()]
+            .filter((part: string): boolean => {
+              return part.length > 0;
+            })
+            .join(" "),
+          value: entry.value,
+          details: entry.details.map(
+            (detail: AffectedResourceListDetail): RootCauseListDetail => {
+              return {
+                label: escapeMarkdownInline(detail.label),
+                value: detail.value,
+              };
+            },
+          ),
+        };
       },
     );
 
+    const lines: Array<string> = [RootCauseList.render(items)];
+
     const hiddenCount: number = input.totalCount - input.entries.length;
 
     if (hiddenCount > 0) {
@@ -125,47 +117,13 @@ export default class AffectedResourceList {
   }
 
   /*
-   * A resource identifier as an inline code span.
-   *
-   * The identifiers come from telemetry attributes, and a VMware VM or a
-   * Proxmox guest can be named anything. Wrapping a name that contains a
-   * backtick in single backticks closes the span early and spills the rest
-   * of the name — and whatever markdown it contains — into the list. So the
-   * fence is always one backtick longer than the longest run inside the
-   * value, and padded with a space on each side when the value has any
-   * backticks at all (CommonMark strips exactly one from each side, so the
-   * padding never shows). Line breaks become spaces: a newline inside a
-   * list item would end the item.
+   * A resource identifier as an inline code span. The identifiers come from
+   * telemetry attributes, and a VMware VM or a Proxmox guest can be named
+   * anything — RootCauseList.code keeps a name with backticks or line breaks
+   * inside its span.
    */
   public static code(value: string | undefined | null): string {
-    if (value === undefined || value === null) {
-      return "";
-    }
-
-    const text: string = String(value)
-      .replace(/\s*[\r\n]+\s*/g, " ")
-      .trim();
-
-    if (text.length === 0) {
-      return "";
-    }
-
-    const backtickRuns: Array<string> = text.match(/`+/g) || [];
-
-    const longestRun: number = backtickRuns.reduce(
-      (longest: number, run: string): number => {
-        return Math.max(longest, run.length);
-      },
-      0,
-    );
-
-    if (longestRun === 0) {
-      return `\`${text}\``;
-    }
-
-    const fence: string = "`".repeat(longestRun + 1);
-
-    return `${fence} ${text} ${fence}`;
+    return RootCauseList.code(value);
   }
 
   /*

package/Server/Utils/Monitor/Criteria/CompareCriteria.ts

@@ -984,7 +984,7 @@ export default class CompareCriteria {
        * reads naturally ("is 42, 55, 60"). For larger arrays, summarize
        * — dumping 30+ numbers on one line makes the root cause unreadable
        * and the detailed breakdown is shown in the Breaching Samples
-       * table below.
+       * list below.
        */
       const MAX_INLINE: number = 5;
 

package/Server/Utils/Monitor/Criteria/MetricMonitorCriteria.ts

@@ -1004,7 +1004,7 @@ export default class MetricMonitorCriteria {
     const sigmaAbs: number = Math.abs(firstBreach.sigma);
 
     /*
-     * Same rendering as the breaching-samples table and the comparison
+     * Same rendering as the breaching-samples list and the comparison
      * sentence — an anomaly on a memory metric reads "1.07 GB", not
      * "1073741824.000 By". σ is a count of standard deviations, not a
      * quantity in the metric's unit, so it stays a bare number; the

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -16,6 +16,10 @@ import { TelemetryQuery } from "../../../Types/Telemetry/TelemetryQuery";
 import { DisableAutomaticAlertCreation } from "../../EnvironmentConfig";
 import AlertService from "../../Services/AlertService";
 import AlertSeverityService from "../../Services/AlertSeverityService";
+import LabelService from "../../Services/LabelService";
+import OnCallDutyPolicyService from "../../Services/OnCallDutyPolicyService";
+import DatabaseService from "../../Services/DatabaseService";
+import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import ProjectScopedReferenceValidator from "../Database/ProjectScopedReferenceValidator";
 import AlertStateTimelineService from "../../Services/AlertStateTimelineService";
 import NetworkDeviceOwnerUserService, {
@@ -701,20 +705,45 @@ export default class MonitorAlert {
             resolved: resourceContext,
           });
 
-          alert.onCallDutyPolicies =
-            criteriaAlert.onCallPolicyIds?.map((id: ObjectID) => {
+          /*
+           * On-call policies and labels from the criteria. AlertService
+           * rejects any that belong to another project or no longer exist,
+           * and monitorSteps can still hold such ids (see the severity above).
+           * Drop those here rather than fail the alert for this series; a
+           * criteria with a stale policy still pages its remaining ones.
+           */
+          const onCallPolicyIds: Array<ObjectID | string> =
+            await this.getCriteriaIdsUsableInProject({
+              monitor: input.monitor,
+              criteriaName: input.criteriaInstance.data?.name,
+              modelName: "on-call policy",
+              ids: criteriaAlert.onCallPolicyIds,
+              service: OnCallDutyPolicyService,
+            });
+
+          alert.onCallDutyPolicies = onCallPolicyIds.map(
+            (id: ObjectID | string) => {
               const onCallPolicy: OnCallDutyPolicy = new OnCallDutyPolicy();
               onCallPolicy._id = id.toString();
               return onCallPolicy;
-            }) || [];
+            },
+          );
 
           // Set labels from criteria
-          alert.labels =
-            criteriaAlert.labelIds?.map((id: ObjectID) => {
-              const label: Label = new Label();
-              label._id = id.toString();
-              return label;
-            }) || [];
+          const labelIds: Array<ObjectID | string> =
+            await this.getCriteriaIdsUsableInProject({
+              monitor: input.monitor,
+              criteriaName: input.criteriaInstance.data?.name,
+              modelName: "label",
+              ids: criteriaAlert.labelIds,
+              service: LabelService,
+            });
+
+          alert.labels = labelIds.map((id: ObjectID | string) => {
+            const label: Label = new Label();
+            label._id = id.toString();
+            return label;
+          });
 
           alert.isCreatedAutomatically = true;
 
@@ -834,6 +863,51 @@ export default class MonitorAlert {
     }
   }
 
+  /*
+   * The ids in a criteria list that this monitor's project can use, logging
+   * the ones it drops. See ProjectScopedReferenceValidator.filterUsableInProject.
+   */
+  private static async getCriteriaIdsUsableInProject(input: {
+    monitor: Monitor;
+    criteriaName: string | undefined;
+    modelName: string;
+    ids: Array<ObjectID> | undefined;
+    service: DatabaseService<DatabaseBaseModel>;
+  }): Promise<Array<ObjectID | string>> {
+    if (!input.ids || input.ids.length === 0) {
+      return [];
+    }
+
+    const result: {
+      usableIds: Array<ObjectID | string>;
+      droppedIds: Array<ObjectID | string>;
+    } = await ProjectScopedReferenceValidator.filterUsableInProject({
+      projectId: input.monitor.projectId,
+      ids: input.ids,
+      service: input.service,
+    });
+
+    if (result.droppedIds.length > 0) {
+      logger.error(
+        `${input.monitor.id?.toString()} - Criteria "${
+          input.criteriaName
+        }" references ${input.modelName} ${result.droppedIds
+          .map((id: ObjectID | string) => {
+            return id.toString();
+          })
+          .join(
+            ", ",
+          )}, which does not exist in project ${input.monitor.projectId?.toString()}. Creating the alert without it.`,
+        {
+          projectId: input.monitor.projectId?.toString(),
+          monitorId: input.monitor.id?.toString(),
+        } as LogAttributes,
+      );
+    }
+
+    return result.usableIds;
+  }
+
   /*
    * Merges two owner id lists, deduping by string value. Criteria-authored
    * ids can arrive as plain strings from stored JSON, so normalise through