@oneuptime/common 14.0.0 → 14.0.2

package/Server/Utils/Workspace/Slack/Actions/AlertEpisode.ts

@@ -1,9 +1,11 @@
+import SlackReactionNoteActions, { SlackReactionData } from "./ReactionNote";
+import { WorkspaceNoteResourceType } from "../../WorkspaceReactionNote";
 import BadDataException from "../../../../../Types/Exception/BadDataException";
 import ObjectID from "../../../../../Types/ObjectID";
 import AlertEpisodeService from "../../../../Services/AlertEpisodeService";
 import { ExpressRequest, ExpressResponse } from "../../../Express";
 import SlackUtil from "../Slack";
-import SlackActionType, { PrivateNoteEmojis } from "./ActionTypes";
+import SlackActionType from "./ActionTypes";
 import { SlackAction, SlackRequest } from "./Auth";
 import Response from "../../../Response";
 import {
@@ -24,12 +26,11 @@ import logger from "../../../Logger";
 
 import CaptureSpan from "../../../Telemetry/CaptureSpan";
 import WorkspaceNotificationLogService from "../../../../Services/WorkspaceNotificationLogService";
-import WorkspaceUserAuthTokenService from "../../../../Services/WorkspaceUserAuthTokenService";
 import WorkspaceType from "../../../../../Types/Workspace/WorkspaceType";
-import WorkspaceProjectAuthTokenService from "../../../../Services/WorkspaceProjectAuthTokenService";
-import WorkspaceNotificationLog from "../../../../../Models/DatabaseModels/WorkspaceNotificationLog";
-import WorkspaceProjectAuthToken from "../../../../../Models/DatabaseModels/WorkspaceProjectAuthToken";
-import WorkspaceUserAuthToken from "../../../../../Models/DatabaseModels/WorkspaceUserAuthToken";
+import AlertEpisodeStateTimeline from "../../../../../Models/DatabaseModels/AlertEpisodeStateTimeline";
+import AlertEpisodeInternalNote from "../../../../../Models/DatabaseModels/AlertEpisodeInternalNote";
+import OnCallDutyPolicyExecutionLog from "../../../../../Models/DatabaseModels/OnCallDutyPolicyExecutionLog";
+import SlackActionAuthorization from "./Authorization";
 
 export default class SlackAlertEpisodeActions {
   @CaptureSpan()
@@ -106,6 +107,17 @@ export default class SlackAlertEpisodeActions {
         response_action: "clear",
       });
 
+      if (
+        !(await SlackActionAuthorization.authorize({
+          requester: slackRequest,
+          modelType: AlertEpisodeStateTimeline,
+          action: "acknowledge this alert episode",
+          resources: [{ service: AlertEpisodeService, id: episodeId }],
+        }))
+      ) {
+        return;
+      }
+
       const isAlreadyAcknowledged: boolean =
         await AlertEpisodeService.isEpisodeAcknowledged({
           episodeId: episodeId,
@@ -226,6 +238,17 @@ export default class SlackAlertEpisodeActions {
         response_action: "clear",
       });
 
+      if (
+        !(await SlackActionAuthorization.authorize({
+          requester: slackRequest,
+          modelType: AlertEpisodeStateTimeline,
+          action: "resolve this alert episode",
+          resources: [{ service: AlertEpisodeService, id: episodeId }],
+        }))
+      ) {
+        return;
+      }
+
       const isAlreadyResolved: boolean =
         await AlertEpisodeService.isEpisodeResolved(episodeId);
 
@@ -457,6 +480,17 @@ export default class SlackAlertEpisodeActions {
 
     const stateId: ObjectID = new ObjectID(stateString);
 
+    if (
+      !(await SlackActionAuthorization.authorize({
+        requester: data.slackRequest,
+        modelType: AlertEpisodeStateTimeline,
+        action: "change the state of this alert episode",
+        resources: [{ service: AlertEpisodeService, id: episodeId }],
+      }))
+    ) {
+      return;
+    }
+
     await AlertEpisodeService.changeEpisodeState({
       projectId: data.slackRequest.projectId!,
       episodeId: episodeId,
@@ -560,6 +594,37 @@ export default class SlackAlertEpisodeActions {
         response_action: "clear",
       });
 
+      if (
+        !data.slackRequest.viewValues ||
+        !data.slackRequest.viewValues["onCallPolicy"]
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid View Values"),
+        );
+      }
+
+      const onCallPolicyString: string =
+        data.slackRequest.viewValues["onCallPolicy"].toString();
+
+      // get the on-call policy id.
+      const onCallPolicyId: ObjectID = new ObjectID(onCallPolicyString);
+
+      if (
+        !(await SlackActionAuthorization.authorize({
+          requester: slackRequest,
+          modelType: OnCallDutyPolicyExecutionLog,
+          action: "execute an on-call policy for this alert episode",
+          resources: [
+            { service: AlertEpisodeService, id: episodeId },
+            { service: OnCallDutyPolicyService, id: onCallPolicyId },
+          ],
+        }))
+      ) {
+        return;
+      }
+
       const isAlreadyResolved: boolean =
         await AlertEpisodeService.isEpisodeResolved(episodeId);
 
@@ -579,23 +644,6 @@ export default class SlackAlertEpisodeActions {
         return;
       }
 
-      if (
-        !data.slackRequest.viewValues ||
-        !data.slackRequest.viewValues["onCallPolicy"]
-      ) {
-        return Response.sendErrorResponse(
-          req,
-          res,
-          new BadDataException("Invalid View Values"),
-        );
-      }
-
-      const onCallPolicyString: string =
-        data.slackRequest.viewValues["onCallPolicy"].toString();
-
-      // get the on-call policy id.
-      const onCallPolicyId: ObjectID = new ObjectID(onCallPolicyString);
-
       await OnCallDutyPolicyService.executePolicy(onCallPolicyId, {
         triggeredByAlertEpisodeId: episodeId,
         userNotificationEventType: UserNotificationEventType.AlertCreated,
@@ -645,6 +693,17 @@ export default class SlackAlertEpisodeActions {
       response_action: "clear",
     });
 
+    if (
+      !(await SlackActionAuthorization.authorize({
+        requester: data.slackRequest,
+        modelType: AlertEpisodeInternalNote,
+        action: "add a private note to this alert episode",
+        resources: [{ service: AlertEpisodeService, id: episodeId }],
+      }))
+    ) {
+      return;
+    }
+
     await AlertEpisodeInternalNoteService.addNote({
       alertEpisodeId: episodeId!,
       note: note || "",
@@ -757,198 +816,18 @@ export default class SlackAlertEpisodeActions {
     );
   }
 
+  /*
+   * A note emoji on a message, looked up among alert episode channels only.
+   * Slack events go to SlackReactionNoteActions directly, which works out
+   * what the channel belongs to first.
+   */
   @CaptureSpan()
-  public static async handleEmojiReaction(data: {
-    teamId: string;
-    reaction: string;
-    userId: string;
-    channelId: string;
-    messageTs: string;
-  }): Promise<void> {
-    logger.debug("Handling emoji reaction for Alert Episode with data:", {
-      channelId: data.channelId,
+  public static async handleEmojiReaction(
+    data: SlackReactionData,
+  ): Promise<void> {
+    await SlackReactionNoteActions.handleEmojiReaction({
+      ...data,
+      resourceTypes: [WorkspaceNoteResourceType.AlertEpisode],
     });
-    logger.debug(data);
-
-    const { teamId, reaction, userId, channelId, messageTs } = data;
-
-    // Alert Episodes only support private notes
-    const isPrivateNoteEmoji: boolean = PrivateNoteEmojis.includes(reaction);
-
-    if (!isPrivateNoteEmoji) {
-      logger.debug(
-        `Emoji "${reaction}" is not a supported private note emoji for alert episodes. Ignoring.`,
-      );
-      return;
-    }
-
-    // Get the project auth token using the team ID
-    const projectAuth: WorkspaceProjectAuthToken | null =
-      await WorkspaceProjectAuthTokenService.findOneBy({
-        query: {
-          workspaceProjectId: teamId,
-        },
-        select: {
-          projectId: true,
-          authToken: true,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
-
-    if (!projectAuth || !projectAuth.projectId || !projectAuth.authToken) {
-      logger.debug(
-        "No project auth found for team ID. Ignoring emoji reaction.",
-      );
-      return;
-    }
-
-    const projectId: ObjectID = projectAuth.projectId;
-    const authToken: string = projectAuth.authToken;
-
-    // Find the alert episode linked to this channel
-    const workspaceLog: WorkspaceNotificationLog | null =
-      await WorkspaceNotificationLogService.findOneBy({
-        query: {
-          channelId: channelId,
-          workspaceType: WorkspaceType.Slack,
-          projectId: projectId,
-        },
-        select: {
-          alertEpisodeId: true,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
-
-    if (!workspaceLog || !workspaceLog.alertEpisodeId) {
-      logger.debug(
-        "No alert episode found linked to this channel. Ignoring emoji reaction.",
-      );
-      return;
-    }
-
-    const episodeId: ObjectID = workspaceLog.alertEpisodeId;
-
-    // Get the user ID in OneUptime based on Slack user ID
-    const userAuth: WorkspaceUserAuthToken | null =
-      await WorkspaceUserAuthTokenService.findOneBy({
-        query: {
-          workspaceUserId: userId,
-          workspaceType: WorkspaceType.Slack,
-          projectId: projectId,
-        },
-        select: {
-          userId: true,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
-
-    if (!userAuth || !userAuth.userId) {
-      logger.debug(
-        "No OneUptime user found for Slack user. Ignoring emoji reaction.",
-      );
-      return;
-    }
-
-    const oneUptimeUserId: ObjectID = userAuth.userId;
-
-    // Fetch the message text using the timestamp
-    let messageText: string | null = null;
-    try {
-      messageText = await SlackUtil.getMessageByTimestamp({
-        authToken: authToken,
-        channelId: channelId,
-        messageTs: messageTs,
-      });
-    } catch (err) {
-      logger.error("Error fetching message text:", {
-        projectId: projectId.toString(),
-        alertEpisodeId: episodeId.toString(),
-        channelId: channelId,
-      });
-      logger.error(err);
-      return;
-    }
-
-    if (!messageText) {
-      logger.debug("No message text found. Ignoring emoji reaction.", {
-        projectId: projectId.toString(),
-        alertEpisodeId: episodeId.toString(),
-        channelId: channelId,
-      });
-      return;
-    }
-
-    // Create a unique identifier for this Slack message to prevent duplicate notes
-    const postedFromSlackMessageId: string = `${channelId}:${messageTs}`;
-
-    // Check if a note from this Slack message already exists
-    const hasExistingNote: boolean =
-      await AlertEpisodeInternalNoteService.hasNoteFromSlackMessage({
-        alertEpisodeId: episodeId,
-        postedFromSlackMessageId: postedFromSlackMessageId,
-      });
-
-    if (hasExistingNote) {
-      logger.debug(
-        "Private note from this Slack message already exists. Skipping duplicate.",
-      );
-      return;
-    }
-
-    // Save as private note
-    try {
-      await AlertEpisodeInternalNoteService.addNote({
-        alertEpisodeId: episodeId,
-        note: messageText,
-        projectId: projectId,
-        userId: oneUptimeUserId,
-        postedFromSlackMessageId: postedFromSlackMessageId,
-      });
-      logger.debug("Private note added to alert episode successfully.", {
-        projectId: projectId.toString(),
-        alertEpisodeId: episodeId.toString(),
-      });
-    } catch (err) {
-      logger.error("Error saving note:", {
-        projectId: projectId.toString(),
-        alertEpisodeId: episodeId.toString(),
-      });
-      logger.error(err);
-      return;
-    }
-
-    // Send confirmation message as a reply to the original message thread
-    try {
-      const episodeLink: string = (
-        await AlertEpisodeService.getEpisodeLinkInDashboard(
-          projectId,
-          episodeId,
-        )
-      ).toString();
-
-      const confirmationMessage: string = `✅ Message saved as *private note* to <${episodeLink}|Alert Episode>.`;
-
-      await SlackUtil.sendMessageToThread({
-        authToken: authToken,
-        channelId: channelId,
-        threadTs: messageTs,
-        text: confirmationMessage,
-      });
-
-      logger.debug("Confirmation message sent successfully.");
-    } catch (err) {
-      logger.error("Error sending confirmation message:", {
-        projectId: projectId.toString(),
-        alertEpisodeId: episodeId.toString(),
-      });
-      logger.error(err);
-      // Don't throw - note was saved successfully, confirmation is best effort
-    }
   }
 }

package/Server/Utils/Workspace/Slack/Actions/Auth.ts

@@ -13,6 +13,7 @@ import logger from "../../../Logger";
 import { JSONArray, JSONObject } from "../../../../../Types/JSON";
 import CaptureSpan from "../../../Telemetry/CaptureSpan";
 import Dictionary from "../../../../../Types/Dictionary";
+import WorkspaceActionAuthorization from "../../WorkspaceActionAuthorization";
 
 export interface SlackAction {
   actionValue?: string | undefined;
@@ -187,7 +188,31 @@ export default class SlackAuthAction {
       projectAuth.miscData as SlackMiscData
     )?.botUserId;
 
-    const userId: ObjectID | undefined = userAuth?.userId;
+    let userId: ObjectID | undefined = userAuth?.userId;
+
+    /*
+     * A connected Slack account outlives the membership it was connected
+     * under. Someone removed from the project acts here as a Slack user with
+     * no OneUptime account, never as the OneUptime user they used to be.
+     */
+    let isRemovedFromProject: boolean = false;
+
+    if (
+      userId &&
+      !(await WorkspaceActionAuthorization.isProjectMember({
+        userId: userId,
+        projectId: projectId,
+      }))
+    ) {
+      logger.debug(
+        "Slack user is linked to a user who is no longer a project member.",
+        {
+          projectId: projectId.toString(),
+        },
+      );
+      userId = undefined;
+      isRemovedFromProject = true;
+    }
 
     const view: JSONObject | undefined =
       (payload["view"] as JSONObject) || undefined;
@@ -245,7 +270,9 @@ export default class SlackAuthAction {
         ) {
           const markdwonPayload: WorkspacePayloadMarkdown = {
             _type: "WorkspacePayloadMarkdown",
-            text: `@${slackUsername}, Unfortunately your slack account is not connected to OneUptime. Please log into your OneUptime account, click on User Settings and then connect your Slack account. `,
+            text: isRemovedFromProject
+              ? `@${slackUsername}, ${WorkspaceActionAuthorization.NOT_A_PROJECT_MEMBER_MESSAGE}`
+              : `@${slackUsername}, Unfortunately your slack account is not connected to OneUptime. Please log into your OneUptime account, click on User Settings and then connect your Slack account. `,
           };
 
           await SlackUtil.sendDirectMessageToUser({
@@ -271,7 +298,7 @@ export default class SlackAuthAction {
       userId: userId,
       projectId: projectId,
       projectAuthToken: projectAuth.authToken!,
-      userAuthToken: userAuth?.authToken,
+      userAuthToken: userId ? userAuth?.authToken : undefined,
       botUserId: botUserId,
       slackChannelId: slackChannelId,
       slackUsername: slackUsername,

package/Server/Utils/Workspace/Slack/Actions/Authorization.ts

@@ -0,0 +1,99 @@
+import { DatabaseBaseModelType } from "../../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import { WorkspacePayloadMarkdown } from "../../../../../Types/Workspace/WorkspaceMessagePayload";
+import logger from "../../../Logger";
+import CaptureSpan from "../../../Telemetry/CaptureSpan";
+import WorkspaceActionAuthorization, {
+  WorkspaceActionResource,
+} from "../../WorkspaceActionAuthorization";
+import SlackUtil from "../Slack";
+import { SlackRequest } from "./Auth";
+
+export type SlackActionRequester = Pick<
+  SlackRequest,
+  "userId" | "projectId" | "projectAuthToken" | "slackUserId" | "slackUsername"
+>;
+
+export default class SlackActionAuthorization {
+  /*
+   * Runs WorkspaceActionAuthorization.authorize for the Slack user behind a
+   * request. When they may not act, tells them why in a direct message and
+   * returns null: the caller must stop without writing anything. Slack has
+   * already been answered by then, so a DM is the only way left to reach them.
+   */
+  @CaptureSpan()
+  public static async authorize(data: {
+    requester: SlackActionRequester;
+    modelType: DatabaseBaseModelType;
+    action: string;
+    resources?: Array<WorkspaceActionResource> | undefined;
+  }): Promise<DatabaseCommonInteractionProps | null> {
+    const { requester } = data;
+
+    try {
+      if (!requester.userId || !requester.projectId) {
+        throw new NotAuthorizedException(
+          `You do not have permission to ${data.action}.`,
+        );
+      }
+
+      return await WorkspaceActionAuthorization.authorize({
+        userId: requester.userId,
+        projectId: requester.projectId,
+        modelType: data.modelType,
+        action: data.action,
+        resources: data.resources,
+      });
+    } catch (err) {
+      if (!(err instanceof NotAuthorizedException)) {
+        throw err;
+      }
+
+      logger.debug("Slack action refused: " + err.message, {
+        projectId: requester.projectId?.toString(),
+        userId: requester.userId?.toString(),
+      });
+
+      await this.sendRefusal({
+        requester: requester,
+        message: err.message,
+      });
+
+      return null;
+    }
+  }
+
+  @CaptureSpan()
+  public static async sendRefusal(data: {
+    requester: SlackActionRequester;
+    message: string;
+  }): Promise<void> {
+    const { requester } = data;
+
+    if (!requester.projectAuthToken || !requester.slackUserId) {
+      return;
+    }
+
+    const markdownPayload: WorkspacePayloadMarkdown = {
+      _type: "WorkspacePayloadMarkdown",
+      text: requester.slackUsername
+        ? `@${requester.slackUsername}, ${data.message}`
+        : data.message,
+    };
+
+    try {
+      await SlackUtil.sendDirectMessageToUser({
+        authToken: requester.projectAuthToken,
+        workspaceUserId: requester.slackUserId,
+        messageBlocks: [markdownPayload],
+      });
+    } catch (err) {
+      // The refusal stands whether or not Slack delivered the explanation.
+      logger.error("Error sending Slack authorization refusal:", {
+        projectId: requester.projectId?.toString(),
+      });
+      logger.error(err);
+    }
+  }
+}