@oneuptime/common 14.0.0 → 14.0.2

package/Server/Utils/Workspace/Workspace.ts

@@ -1,5 +1,8 @@
 import WorkspaceType from "../../../Types/Workspace/WorkspaceType";
-import WorkspaceBase, { WorkspaceSendMessageResponse } from "./WorkspaceBase";
+import WorkspaceBase, {
+  WorkspaceChannel,
+  WorkspaceSendMessageResponse,
+} from "./WorkspaceBase";
 import SlackWorkspace from "./Slack/Slack";
 import MicrosoftTeamsUtil from "./MicrosoftTeams/MicrosoftTeams";
 import BadDataException from "../../../Types/Exception/BadDataException";
@@ -45,51 +48,11 @@ export default class WorkspaceUtil {
       let userStringToAppend: string = "";
 
       if (data.userId) {
-        const workspaceUserToken: WorkspaceUserAuthToken | null =
-          await WorkspaceUserAuthTokenService.getUserAuth({
-            userId: data.userId,
-            workspaceType: workspaceType,
-            projectId: data.projectId,
-          });
-
-        if (workspaceUserToken && workspaceUserToken.workspaceUserId) {
-          const projectAuthToken: WorkspaceProjectAuthToken | null =
-            await WorkspaceProjectAuthTokenService.getProjectAuth({
-              projectId: data.projectId,
-              workspaceType: workspaceType,
-            });
-
-          if (!projectAuthToken || !projectAuthToken.authToken) {
-            userStringToAppend = "";
-          } else {
-            const workspaceUsername: string | null =
-              await this.getUserNameFromWorkspace({
-                userId: workspaceUserToken.workspaceUserId,
-                workspaceType: workspaceType,
-                authToken: projectAuthToken.authToken,
-                projectId: data.projectId,
-              });
-
-            if (!workspaceUsername) {
-              const userstring: string =
-                await UserService.getUserMarkdownString({
-                  userId: data.userId,
-                  projectId: data.projectId,
-                });
-
-              userStringToAppend = `${userstring} `;
-            }
-
-            userStringToAppend = `@${workspaceUsername} `;
-          }
-        } else {
-          const userstring: string = await UserService.getUserMarkdownString({
-            userId: data.userId,
-            projectId: data.projectId,
-          });
-
-          userStringToAppend = `${userstring} `;
-        }
+        userStringToAppend = await this.getUserStringForWorkspace({
+          userId: data.userId,
+          projectId: data.projectId,
+          workspaceType: workspaceType,
+        });
       }
 
       messageBlocksByWorkspaceType.push({
@@ -106,6 +69,108 @@ export default class WorkspaceUtil {
     return messageBlocksByWorkspaceType;
   }
 
+  /*
+   * The "who did this" prefix of a workspace message: `@name ` when the user
+   * linked their account in that workspace, their OneUptime name otherwise.
+   *
+   * This must never throw. It runs before a message is posted anywhere, and a
+   * failed lookup used to abort the whole post — for every workspace, not just
+   * the one whose lookup failed. Microsoft Teams made that the common case:
+   * Graph's GET /users/{id} needs the User.Read.All application permission,
+   * which OneUptime does not ask for, so every note (a note always carries its
+   * author) from a user who had linked Teams was dropped from the incident and
+   * alert channels of Slack and Teams alike.
+   */
+  @CaptureSpan()
+  public static async getUserStringForWorkspace(data: {
+    // this is oneuptime user id.
+    userId: ObjectID;
+    projectId: ObjectID;
+    workspaceType: WorkspaceType;
+  }): Promise<string> {
+    let workspaceUsername: string | null = null;
+
+    try {
+      const workspaceUserToken: WorkspaceUserAuthToken | null =
+        await WorkspaceUserAuthTokenService.getUserAuth({
+          userId: data.userId,
+          workspaceType: data.workspaceType,
+          projectId: data.projectId,
+        });
+
+      if (workspaceUserToken && workspaceUserToken.workspaceUserId) {
+        workspaceUsername = await this.getWorkspaceUsernameForUserToken({
+          workspaceUserToken: workspaceUserToken,
+          workspaceType: data.workspaceType,
+          projectId: data.projectId,
+        });
+      }
+    } catch (err) {
+      logger.warn(
+        `Could not resolve the ${data.workspaceType} username of the user. Falling back to their OneUptime name.`,
+        { projectId: data.projectId?.toString() },
+      );
+      logger.warn(err, { projectId: data.projectId?.toString() });
+    }
+
+    if (workspaceUsername) {
+      return `@${workspaceUsername} `;
+    }
+
+    try {
+      const userString: string = await UserService.getUserMarkdownString({
+        userId: data.userId,
+        projectId: data.projectId,
+      });
+
+      return userString ? `${userString} ` : "";
+    } catch (err) {
+      logger.warn("Could not resolve the OneUptime name of the user.", {
+        projectId: data.projectId?.toString(),
+      });
+      logger.warn(err, { projectId: data.projectId?.toString() });
+      return "";
+    }
+  }
+
+  private static async getWorkspaceUsernameForUserToken(data: {
+    workspaceUserToken: WorkspaceUserAuthToken;
+    workspaceType: WorkspaceType;
+    projectId: ObjectID;
+  }): Promise<string | null> {
+    /*
+     * Teams: use the display name captured when the user linked their account
+     * (it came from Graph's /me with their own delegated token). Reading it
+     * back later through /users/{id} needs User.Read.All, which the app token
+     * does not have.
+     */
+    if (data.workspaceType === WorkspaceType.MicrosoftTeams) {
+      const displayName: unknown =
+        data.workspaceUserToken.miscData?.["displayName"];
+
+      if (typeof displayName === "string" && displayName.trim()) {
+        return displayName.trim();
+      }
+    }
+
+    const projectAuthToken: WorkspaceProjectAuthToken | null =
+      await WorkspaceProjectAuthTokenService.getProjectAuth({
+        projectId: data.projectId,
+        workspaceType: data.workspaceType,
+      });
+
+    if (!projectAuthToken || !projectAuthToken.authToken) {
+      return null;
+    }
+
+    return await this.getUserNameFromWorkspace({
+      userId: data.workspaceUserToken.workspaceUserId!,
+      workspaceType: data.workspaceType,
+      authToken: projectAuthToken.authToken,
+      projectId: data.projectId,
+    });
+  }
+
   @CaptureSpan()
   public static getAllWorkspaceTypes(): Array<WorkspaceType> {
     const workspaceTypes: Array<WorkspaceType> = [];
@@ -210,15 +275,44 @@ export default class WorkspaceUtil {
         continue;
       }
 
-      const result: WorkspaceSendMessageResponse =
-        await WorkspaceUtil.getWorkspaceTypeUtil(workspaceType).sendMessage({
-          userId: botUserId || "",
-          authToken: projectAuthToken.authToken,
-          projectId: data.projectId,
-          workspaceMessagePayload: messagePayloadByWorkspace,
-        });
+      /*
+       * One destination failing outright (a Teams rule with no team picked,
+       * a revoked token) must not stop the payloads after it: each payload is
+       * a different channel, often in a different workspace.
+       */
+      try {
+        const result: WorkspaceSendMessageResponse =
+          await WorkspaceUtil.getWorkspaceTypeUtil(workspaceType).sendMessage({
+            userId: botUserId || "",
+            authToken: projectAuthToken.authToken,
+            projectId: data.projectId,
+            workspaceMessagePayload: messagePayloadByWorkspace,
+          });
+
+        responses.push(result);
+      } catch (err) {
+        logger.error(
+          `Error posting message to ${workspaceType} as bot`,
+          workspaceLogAttributes,
+        );
+        logger.error(err, workspaceLogAttributes);
 
-      responses.push(result);
+        responses.push({
+          workspaceType: workspaceType,
+          threads: [],
+          errors: [
+            {
+              channel: WorkspaceUtil.describePayloadDestination(
+                messagePayloadByWorkspace,
+              ),
+              error:
+                err instanceof Error
+                  ? err.message
+                  : String(err || "Failed to send message"),
+            },
+          ],
+        });
+      }
     }
 
     logger.debug(
@@ -231,6 +325,29 @@ export default class WorkspaceUtil {
     return responses;
   }
 
+  // The destination a payload was addressed to, for error logs.
+  public static describePayloadDestination(
+    payload: WorkspaceMessagePayload,
+  ): WorkspaceChannel {
+    const destination: string =
+      payload.channelIds?.[0] ||
+      payload.channelNames?.[0] ||
+      payload.chatIds?.[0] ||
+      "";
+
+    const channel: WorkspaceChannel = {
+      id: payload.channelIds?.[0] || payload.chatIds?.[0] || "",
+      name: destination,
+      workspaceType: payload.workspaceType,
+    };
+
+    if (payload.teamId) {
+      channel.teamId = payload.teamId;
+    }
+
+    return channel;
+  }
+
   @CaptureSpan()
   public static async postToWorkspaceChannels(data: {
     workspaceUserId: string;

package/Server/Utils/Workspace/WorkspaceActionAuthorization.ts

@@ -0,0 +1,252 @@
+import DatabaseBaseModel, {
+  DatabaseBaseModelType,
+} from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../Types/ObjectID";
+import {
+  UserGlobalAccessPermission,
+  UserTenantAccessPermission,
+} from "../../../Types/Permission";
+import AccessTokenService from "../../Services/AccessTokenService";
+import DatabaseService from "../../Services/DatabaseService";
+import TeamMemberService from "../../Services/TeamMemberService";
+import ModelPermission from "../../Types/Database/Permissions/Index";
+import Query from "../../Types/Database/Query";
+import Select from "../../Types/Database/Select";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+
+/*
+ * A resource a chat action is performed against: the incident being
+ * acknowledged, the on-call policy being executed.
+ */
+export interface WorkspaceActionResource {
+  // The service that owns the resource, e.g. IncidentService.
+  service: DatabaseService<DatabaseBaseModel>;
+  id: ObjectID;
+}
+
+/*
+ * Slack and Microsoft Teams actions (buttons, modals, cards, emoji reactions)
+ * are signed by the workspace, not by a OneUptime session. The only link to a
+ * OneUptime user is the WorkspaceUserAuthToken row written when that user
+ * connected their chat account, and that row says nothing about what they may
+ * do in the project today: it survives a downgrade to a read-only role, and it
+ * used to survive removal from the project as well.
+ *
+ * The services those actions call (acknowledgeIncident, addNote,
+ * executePolicy, ...) write as root. So a chat action that changes data asks
+ * this class first, and gets the answer the dashboard would give the same
+ * user for the same change:
+ *
+ *   1. the user holds an accepted membership in the project, read from the
+ *      database rather than from the permission cache,
+ *   2. their project permissions allow creating the row the action writes.
+ *      The dashboard writes that same row through the API with those
+ *      permissions: an IncidentStateTimeline to acknowledge, resolve or change
+ *      state, an IncidentPublicNote for a public note, an
+ *      OnCallDutyPolicyExecutionLog to page an on-call policy, and so on,
+ *   3. every resource the action names is one the user can read in THIS
+ *      project, under their label, owner and privacy scoping. This also keeps
+ *      an id from another project out, since the services look rows up by id
+ *      alone.
+ */
+export default class WorkspaceActionAuthorization {
+  public static readonly NOT_A_PROJECT_MEMBER_MESSAGE: string =
+    "Your OneUptime account is not a member of this project. Ask a project admin to invite you, then try again.";
+
+  @CaptureSpan()
+  public static async isProjectMember(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<boolean> {
+    const teamIds: Array<ObjectID> = await this.getAcceptedTeamIds(data);
+    return teamIds.length > 0;
+  }
+
+  /*
+   * The props a chat user acts with in a project, built the way the dashboard
+   * builds them for a signed-in request: global permission, tenant permission
+   * and accepted team ids (for the Owned permission scope). Throws
+   * NotAuthorizedException when the user is not a member of the project.
+   */
+  @CaptureSpan()
+  public static async getProjectMemberProps(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<DatabaseCommonInteractionProps> {
+    const { userId, projectId } = data;
+
+    /*
+     * Membership comes straight from TeamMember. Neither the tenant permission
+     * cache (Redis) nor TeamMemberService.getTeamIdsForUser (in-process) is
+     * guaranteed to have seen a removal made through another process.
+     */
+    const userTeamIds: Array<ObjectID> = await this.getAcceptedTeamIds(data);
+
+    if (userTeamIds.length === 0) {
+      throw new NotAuthorizedException(
+        WorkspaceActionAuthorization.NOT_A_PROJECT_MEMBER_MESSAGE,
+      );
+    }
+
+    const userGlobalAccessPermission: UserGlobalAccessPermission | null =
+      await AccessTokenService.getUserGlobalAccessPermission(userId);
+
+    const userTenantAccessPermission: UserTenantAccessPermission | null =
+      await AccessTokenService.getUserTenantAccessPermission(
+        userId,
+        projectId,
+        {
+          userGlobalAccessPermission: userGlobalAccessPermission,
+        },
+      );
+
+    if (!userTenantAccessPermission) {
+      throw new NotAuthorizedException(
+        WorkspaceActionAuthorization.NOT_A_PROJECT_MEMBER_MESSAGE,
+      );
+    }
+
+    return {
+      userId: userId,
+      tenantId: projectId,
+      userGlobalAccessPermission: userGlobalAccessPermission || undefined,
+      userTenantAccessPermission: {
+        [projectId.toString()]: userTenantAccessPermission,
+      },
+      userTeamIds: userTeamIds,
+    };
+  }
+
+  /*
+   * Throws NotAuthorizedException, with a message fit to show the user in
+   * chat, unless `props` may create a `modelType` row and read every one of
+   * `resources` in props.tenantId. `action` completes "You do not have
+   * permission to ...", e.g. "acknowledge this incident".
+   */
+  @CaptureSpan()
+  public static async assertCanCreate(data: {
+    props: DatabaseCommonInteractionProps;
+    modelType: DatabaseBaseModelType;
+    action: string;
+    resources?: Array<WorkspaceActionResource> | undefined;
+  }): Promise<void> {
+    const { props, modelType, action } = data;
+    const projectId: ObjectID | undefined = props.tenantId;
+
+    if (!props.userId || !projectId) {
+      throw new NotAuthorizedException(
+        `You do not have permission to ${action}.`,
+      );
+    }
+
+    try {
+      ModelPermission.checkCreatePermissions(modelType, new modelType(), props);
+    } catch (err) {
+      if (err instanceof NotAuthorizedException) {
+        throw new NotAuthorizedException(
+          `You do not have permission to ${action}. ${err.message}`,
+        );
+      }
+
+      throw err;
+    }
+
+    for (const resource of data.resources || []) {
+      let readableResource: DatabaseBaseModel | null = null;
+
+      try {
+        readableResource = await resource.service.findOneBy({
+          query: {
+            _id: resource.id.toString(),
+            projectId: projectId,
+          } as Query<DatabaseBaseModel>,
+          select: {
+            _id: true,
+          } as Select<DatabaseBaseModel>,
+          props: props,
+        });
+      } catch (err) {
+        if (!(err instanceof NotAuthorizedException)) {
+          throw err;
+        }
+      }
+
+      if (!readableResource) {
+        const resourceName: string = (
+          resource.service.getModel().singularName || "resource"
+        ).toLowerCase();
+
+        throw new NotAuthorizedException(
+          `You do not have permission to ${action}: the ${resourceName} was not found in this project, or you do not have access to it.`,
+        );
+      }
+    }
+  }
+
+  /*
+   * getProjectMemberProps followed by assertCanCreate. Returns the user's
+   * props so the caller can pass them on to anything else it writes.
+   */
+  @CaptureSpan()
+  public static async authorize(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+    modelType: DatabaseBaseModelType;
+    action: string;
+    resources?: Array<WorkspaceActionResource> | undefined;
+  }): Promise<DatabaseCommonInteractionProps> {
+    const props: DatabaseCommonInteractionProps =
+      await this.getProjectMemberProps({
+        userId: data.userId,
+        projectId: data.projectId,
+      });
+
+    await this.assertCanCreate({
+      props: props,
+      modelType: data.modelType,
+      action: data.action,
+      resources: data.resources,
+    });
+
+    return props;
+  }
+
+  private static async getAcceptedTeamIds(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<Array<ObjectID>> {
+    const memberships: Array<TeamMember> = await TeamMemberService.findBy({
+      query: {
+        userId: data.userId,
+        projectId: data.projectId,
+        hasAcceptedInvitation: true,
+      },
+      select: {
+        teamId: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const teamIds: Array<ObjectID> = [];
+    const seen: Set<string> = new Set<string>();
+
+    for (const membership of memberships) {
+      const teamId: ObjectID | undefined = membership.teamId;
+
+      if (teamId && !seen.has(teamId.toString())) {
+        seen.add(teamId.toString());
+        teamIds.push(teamId);
+      }
+    }
+
+    return teamIds;
+  }
+}

package/Server/Utils/Workspace/WorkspaceBase.ts

@@ -52,6 +52,45 @@ export interface WorkspaceChannel {
 }
 
 export default class WorkspaceBase {
+  /*
+   * A readable, non-empty message for whatever a send path threw. The
+   * providers do not only throw Errors: Slack's sendPayloadBlocksToChannel,
+   * joinChannel and isUserInChannel `throw response`, an HTTPErrorResponse,
+   * which is not an Error but exposes a `message` getter. Stringifying that
+   * gave "[object Object]" in user-facing test errors and in Notification
+   * Logs, so each shape is unwrapped here, and a response with no message
+   * still reports its HTTP status rather than nothing.
+   */
+  public static getSendErrorMessage(err: unknown): string {
+    const unknownErrorMessage: string = "Unknown error";
+
+    if (err === null || err === undefined) {
+      return unknownErrorMessage;
+    }
+
+    if (err instanceof Error) {
+      return err.message || unknownErrorMessage;
+    }
+
+    if (err instanceof HTTPErrorResponse) {
+      return err.message || `Request failed with HTTP status ${err.statusCode}`;
+    }
+
+    if (typeof err === "string") {
+      return err || unknownErrorMessage;
+    }
+
+    if (typeof err === "object") {
+      const message: unknown = (err as { message?: unknown }).message;
+
+      if (typeof message === "string" && message) {
+        return message;
+      }
+    }
+
+    return String(err);
+  }
+
   @CaptureSpan()
   public static async isUserInDirectMessageChannel(_data: {
     authToken: string;