@oneuptime/common 14.0.1 → 14.0.2

package/Server/Middleware/UserAuthorization.ts

@@ -18,6 +18,7 @@ import ProjectMiddleware from "./ProjectAuthorization";
 import SpanUtil from "../Utils/Telemetry/SpanUtil";
 import Dictionary from "../../Types/Dictionary";
 import Exception from "../../Types/Exception/Exception";
+import ExceptionMessages from "../../Types/Exception/ExceptionMessages";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
 import SsoAuthorizationException from "../../Types/Exception/SsoAuthorizationException";
 import TenantNotFoundException from "../../Types/Exception/TenantNotFoundException";
@@ -590,6 +591,42 @@ export default class UserMiddleware {
       );
     }
 
+    /*
+     * The access token is a stateless JWT that lives for 15 minutes, and
+     * blocking a user revokes their sessions but cannot recall a token already
+     * issued. Without this check a blocked user keeps full access until it
+     * expires. The answer is cached per node (UserService.isUserBlocked), so
+     * this is one primary-key lookup per user per minute, not per request.
+     *
+     * A 401, like an expired token: the client asks /refresh-token for a new
+     * one, which is refused for a blocked user, and signs them out. A lookup
+     * that fails is an error, not a pass.
+     */
+    let isUserBlocked: boolean;
+
+    try {
+      isUserBlocked = await UserService.isUserBlocked(
+        oneuptimeRequest.userAuthorization.userId,
+      );
+    } catch (err) {
+      return Response.sendErrorResponse(req, res, err as Exception);
+    }
+
+    if (isUserBlocked) {
+      if (options.treatInvalidAccessTokenAsAnonymous) {
+        // As for a token that does not decode: the public routes never read who is asking.
+        delete oneuptimeRequest.userAuthorization;
+        oneuptimeRequest.userType = UserType.Public;
+        return next();
+      }
+
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new NotAuthenticatedException(ExceptionMessages.UserBlocked),
+      );
+    }
+
     if (oneuptimeRequest.userAuthorization.isMasterAdmin) {
       oneuptimeRequest.userType = UserType.MasterAdmin;
     } else {
@@ -642,6 +679,7 @@ export default class UserMiddleware {
             req,
             tenantId,
             userId: new ObjectID(userId),
+            userGlobalAccessPermission: userGlobalAccessPermissionPromise,
           }),
           TeamMemberService.getTeamIdsForUser(new ObjectID(userId), tenantId),
         ]);
@@ -689,6 +727,7 @@ export default class UserMiddleware {
             req,
             new ObjectID(userId),
             userGlobalAccessPermission.projectIds,
+            userGlobalAccessPermission,
           );
 
         if (userTenantAccessPermission) {
@@ -876,8 +915,18 @@ export default class UserMiddleware {
     req: ExpressRequest;
     tenantId: ObjectID;
     userId: ObjectID;
+    /*
+     * The user's global permission, when the caller is already resolving it.
+     * AccessTokenService checks the project against it before serving a cached
+     * permission set.
+     */
+    userGlobalAccessPermission?:
+      | Promise<UserGlobalAccessPermission | null>
+      | UserGlobalAccessPermission
+      | null
+      | undefined;
   }): Promise<UserTenantAccessPermission | null> {
-    const { req, tenantId, userId } = data;
+    const { req, tenantId, userId, userGlobalAccessPermission } = data;
 
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
@@ -912,7 +961,9 @@ export default class UserMiddleware {
         }
         throw err;
       }),
-      AccessTokenService.getUserTenantAccessPermission(userId, tenantId),
+      AccessTokenService.getUserTenantAccessPermission(userId, tenantId, {
+        userGlobalAccessPermission,
+      }),
     ]);
 
     /*
@@ -962,6 +1013,8 @@ export default class UserMiddleware {
     req: ExpressRequest,
     userId: ObjectID,
     projectIds: ObjectID[],
+    // The global permission projectIds came from, so each project skips re-reading it.
+    userGlobalAccessPermission?: UserGlobalAccessPermission | null | undefined,
   ): Promise<Dictionary<UserTenantAccessPermission> | null> {
     if (!projectIds.length) {
       return null;
@@ -1042,6 +1095,7 @@ export default class UserMiddleware {
           permission: await AccessTokenService.getUserTenantAccessPermission(
             userId,
             projectId,
+            { userGlobalAccessPermission },
           ),
         };
       }),

package/Server/Services/AIAgentService.ts

@@ -454,6 +454,7 @@ export class Service extends DatabaseService<Model> {
           templateType: EmailTemplateType.AIAgentConnectionStatusChange,
           vars: vars,
           subject: `[AI Agent ${connectionStatus}] ${aiAgent.name}`,
+          isSubjectLiteral: true,
         };
 
         const sms: SMSMessage = {

package/Server/Services/AccessTokenService.ts

@@ -25,39 +25,11 @@ export class AccessTokenService extends BaseService {
 
   @CaptureSpan()
   public async refreshUserAllPermissions(userId: ObjectID): Promise<void> {
-    await this.refreshUserGlobalAccessPermission(userId);
+    const userGlobalAccessPermission: UserGlobalAccessPermission =
+      await this.refreshUserGlobalAccessPermission(userId);
 
-    // query for all projects user belongs to.
-    let teamMembers: Array<TeamMember> = await TeamMemberService.findBy({
-      query: {
-        userId: userId,
-        hasAcceptedInvitation: true,
-      },
-      select: {
-        projectId: true,
-      },
-      limit: LIMIT_MAX,
-      skip: 0,
-      props: {
-        isRoot: true,
-      },
-    });
-
-    if (!teamMembers) {
-      teamMembers = [];
-    }
-
-    if (teamMembers.length === 0) {
-      return;
-    }
-
-    const projectIds: Array<ObjectID> = teamMembers.map(
-      (teamMember: TeamMember) => {
-        return teamMember.projectId!;
-      },
-    );
-
-    for (const projectId of projectIds) {
+    // every project the user belongs to.
+    for (const projectId of userGlobalAccessPermission.projectIds) {
       await this.refreshUserTenantAccessPermission(userId, projectId);
     }
   }
@@ -66,8 +38,13 @@ export class AccessTokenService extends BaseService {
   public async refreshUserGlobalAccessPermission(
     userId: ObjectID,
   ): Promise<UserGlobalAccessPermission> {
-    // query for all projects user belongs to.
-    let teamMembers: Array<TeamMember> = await TeamMemberService.findBy({
+    /*
+     * Every project the user belongs to - all of them, not a first page.
+     * getUserTenantAccessPermission only serves a cached permission set for a
+     * project on this list, so a project cut off it would have its set rebuilt
+     * on every request.
+     */
+    let teamMembers: Array<TeamMember> = await TeamMemberService.findAllBy({
       query: {
         userId: userId,
         hasAcceptedInvitation: true,
@@ -75,8 +52,6 @@ export class AccessTokenService extends BaseService {
       select: {
         projectId: true,
       },
-      limit: LIMIT_MAX,
-      skip: 0,
       props: {
         isRoot: true,
       },
@@ -86,11 +61,18 @@ export class AccessTokenService extends BaseService {
       teamMembers = [];
     }
 
-    const projectIds: Array<ObjectID> = teamMembers.map(
-      (teamMember: TeamMember) => {
-        return teamMember.projectId!;
-      },
-    );
+    // One row per team, so a project comes back once for each team in it.
+    const projectIds: Array<ObjectID> = [];
+    const seenProjectIds: Set<string> = new Set<string>();
+
+    for (const teamMember of teamMembers) {
+      const projectId: ObjectID | undefined = teamMember.projectId;
+
+      if (projectId && !seenProjectIds.has(projectId.toString())) {
+        seenProjectIds.add(projectId.toString());
+        projectIds.push(projectId);
+      }
+    }
 
     const permissionToStore: UserGlobalAccessPermission = {
       projectIds,
@@ -125,6 +107,14 @@ export class AccessTokenService extends BaseService {
   public async refreshUserTenantAccessPermission(
     userId: ObjectID,
     projectId: ObjectID,
+    options?: {
+      /*
+       * Whether to clear the cached entry when the user turns out not to be a
+       * member. Default true. False only when the caller has just seen there
+       * is no entry, so a non-member probing a project costs no cache write.
+       */
+      clearCacheIfNotMember?: boolean | undefined;
+    },
   ): Promise<UserTenantAccessPermission | null> {
     // query for all projects user belongs to.
     const teamMembers: Array<TeamMember> = await TeamMemberService.findBy({
@@ -150,6 +140,20 @@ export class AccessTokenService extends BaseService {
     );
 
     if (teamIds.length === 0) {
+      /*
+       * Not a member of this project. Clear the cached entry rather than just
+       * returning: when the user's last membership has just been removed, it
+       * still holds everything they could do as a member, and nothing else
+       * ever overwrites it - the request middleware would keep serving it
+       * until it expired, 30 days later.
+       */
+      if (options?.clearCacheIfNotMember !== false) {
+        await GlobalCache.deleteKey(
+          PermissionNamespace.ProjectPermission,
+          UserPermissionUtil.buildTenantPermissionCacheKey(userId, projectId),
+        );
+      }
+
       return null;
     }
 
@@ -227,36 +231,105 @@ export class AccessTokenService extends BaseService {
   }): Promise<DatabaseCommonInteractionProps> {
     const { userId, projectId } = data;
 
+    const userGlobalAccessPermission: UserGlobalAccessPermission | null =
+      await this.getUserGlobalAccessPermission(userId);
+
     return {
       userId: userId,
-      userGlobalAccessPermission:
-        (await this.getUserGlobalAccessPermission(userId)) || undefined,
+      userGlobalAccessPermission: userGlobalAccessPermission || undefined,
       userTenantAccessPermission: {
         [projectId.toString()]: (await this.getUserTenantAccessPermission(
           userId,
           projectId,
+          { userGlobalAccessPermission },
         ))!,
       },
       tenantId: projectId,
     };
   }
 
+  /*
+   * The user's permission set in one project, or null if they are not a member
+   * of it.
+   *
+   * A cached set is only served while the user's global permission still lists
+   * the project. The two are written together whenever a membership changes, so
+   * they disagree only when the cached set is left over from a membership that
+   * has since been removed - or, the other way round, when the global list is
+   * the stale one. The memberships decide which: the set is rebuilt from them,
+   * which also clears it if the user is not a member.
+   *
+   * Pass `userGlobalAccessPermission` when the caller already has it, or is
+   * already fetching it, to save a second read of the same cache key.
+   */
   @CaptureSpan()
   public async getUserTenantAccessPermission(
     userId: ObjectID,
     projectId: ObjectID,
+    options?: {
+      userGlobalAccessPermission?:
+        | UserGlobalAccessPermission
+        | null
+        | Promise<UserGlobalAccessPermission | null>
+        | undefined;
+    },
   ): Promise<UserTenantAccessPermission | null> {
-    const json: UserTenantAccessPermission | null =
-      await UserPermissionUtil.getUserTenantAccessPermissionFromCache(
+    const [json, userGlobalAccessPermission]: [
+      UserTenantAccessPermission | null,
+      UserGlobalAccessPermission | null,
+    ] = await Promise.all([
+      UserPermissionUtil.getUserTenantAccessPermissionFromCache(
         userId,
         projectId,
-      );
+      ),
+      options?.userGlobalAccessPermission !== undefined
+        ? options.userGlobalAccessPermission
+        : this.getUserGlobalAccessPermission(userId),
+    ]);
 
     if (!json) {
-      return await this.refreshUserTenantAccessPermission(userId, projectId);
+      return await this.refreshUserTenantAccessPermission(userId, projectId, {
+        clearCacheIfNotMember: false,
+      });
     }
 
-    return json;
+    if (
+      UserPermissionUtil.isProjectInGlobalAccessPermission(
+        userGlobalAccessPermission,
+        projectId,
+      )
+    ) {
+      return json;
+    }
+
+    const permission: UserTenantAccessPermission | null =
+      await this.refreshUserTenantAccessPermission(userId, projectId);
+
+    if (permission) {
+      // Still a member: it was the global list that was out of date.
+      await this.refreshUserGlobalAccessPermission(userId);
+    }
+
+    return permission;
+  }
+
+  /*
+   * Drops the user's cached global permission and their cached permission set
+   * in one project, so both are rebuilt from their memberships the next time
+   * they are read. The fallback for when refreshing them has failed.
+   */
+  @CaptureSpan()
+  public async clearCachedPermissions(
+    userId: ObjectID,
+    projectId: ObjectID,
+  ): Promise<void> {
+    await Promise.all([
+      GlobalCache.deleteKey("user", userId.toString()),
+      GlobalCache.deleteKey(
+        PermissionNamespace.ProjectPermission,
+        UserPermissionUtil.buildTenantPermissionCacheKey(userId, projectId),
+      ),
+    ]);
   }
 }
 

package/Server/Services/AlertEpisodeMemberService.ts

@@ -40,6 +40,15 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("alertId is required");
     }
 
+    if (
+      !createBy.props.isRoot &&
+      createBy.data.isOwnerNotifiedOfAlertAdded !== undefined
+    ) {
+      throw new BadDataException(
+        "isOwnerNotifiedOfAlertAdded cannot be set directly",
+      );
+    }
+
     // Check if this alert is already in the episode
     const existingMember: Model | null = await this.findOneBy({
       query: {

package/Server/Services/AlertEpisodeService.ts

@@ -1174,6 +1174,7 @@ export class Service extends DatabaseService<Model> {
         },
         select: {
           _id: true,
+          projectId: true,
           user: {
             _id: true,
             email: true,
@@ -1196,6 +1197,7 @@ export class Service extends DatabaseService<Model> {
         },
         select: {
           _id: true,
+          projectId: true,
           teamId: true,
         },
         props: {
@@ -1236,7 +1238,18 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
-    return users;
+    const projectId: ObjectID | undefined =
+      ownerUsers[0]?.projectId || ownerTeams[0]?.projectId;
+
+    if (!projectId) {
+      return [];
+    }
+
+    // Owners who left the project are not notified, nor listed as notified.
+    return await TeamMemberService.filterUsersToProjectMembers({
+      projectId: projectId,
+      users: users,
+    });
   }
 
   @CaptureSpan()

package/Server/Services/AlertService.ts

@@ -35,8 +35,15 @@ import AlertOwnerUser from "../../Models/DatabaseModels/AlertOwnerUser";
 import AlertState from "../../Models/DatabaseModels/AlertState";
 import MonitorStatusService from "./MonitorStatusService";
 import ProjectScopedReferenceValidator, {
+  HeldRelationIds,
+  ProjectScopedReference,
+  ProjectScopedRelation,
   resolveReferenceId,
+  resolveReferenceIds,
 } from "../Utils/Database/ProjectScopedReferenceValidator";
+import { getAffectedResourceRelations } from "../Utils/Database/AffectedResourceRelations";
+import Query from "../Types/Database/Query";
+import DatabaseBaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import SloRecordReferenceValidator from "../Utils/Slo/SloRecordReferenceValidator";
 import AlertStateTimeline from "../../Models/DatabaseModels/AlertStateTimeline";
 import User from "../../Models/DatabaseModels/User";
@@ -315,6 +322,10 @@ export class Service extends DatabaseService<Model> {
       ) ||
       resolveReferenceId(updateBy.data.monitorStatusWhenThisAlertWasCreated);
 
+    const monitorId: ObjectID | string | undefined =
+      resolveReferenceId(updateBy.data.monitorId) ||
+      resolveReferenceId(updateBy.data.monitor);
+
     /*
      * The SLOs this alert affects: a relation list the API accepts on update.
      * Checked for the same reason as on create; see
@@ -325,11 +336,29 @@ export class Service extends DatabaseService<Model> {
         updateBy.data.serviceLevelObjectives,
       ).length > 0;
 
+    /*
+     * The on-call policies, labels and affected-resource lists, when the
+     * update rewrites them. An empty list only removes rows and needs no
+     * check.
+     */
+    const relations: Array<ProjectScopedRelation> =
+      this.getProjectScopedRelations().filter(
+        (relation: ProjectScopedRelation) => {
+          return (
+            resolveReferenceIds(
+              (updateBy.data as Dictionary<unknown>)[relation.column],
+            ).length > 0
+          );
+        },
+      );
+
     if (
       !alertStateId &&
       !alertSeverityId &&
       !monitorStatusId &&
-      !hasServiceLevelObjectiveIds
+      !monitorId &&
+      !hasServiceLevelObjectiveIds &&
+      relations.length === 0
     ) {
       return;
     }
@@ -342,6 +371,17 @@ export class Service extends DatabaseService<Model> {
       ? [updateBy.props.tenantId]
       : await this.getProjectIdsForUpdateQuery(updateBy);
 
+    const heldIds: HeldRelationIds | undefined =
+      relations.length > 0
+        ? await ProjectScopedReferenceValidator.getHeldRelationIds({
+            service: this as unknown as DatabaseService<DatabaseBaseModel>,
+            query: updateBy.query as Query<DatabaseBaseModel>,
+            columns: relations.map((relation: ProjectScopedRelation) => {
+              return relation.column;
+            }),
+          })
+        : undefined;
+
     for (const projectId of projectIds) {
       if (hasServiceLevelObjectiveIds) {
         await SloRecordReferenceValidator.validateServiceLevelObjectivesBelongToProject(
@@ -353,34 +393,73 @@ export class Service extends DatabaseService<Model> {
         );
       }
 
-      if (!alertStateId && !alertSeverityId && !monitorStatusId) {
+      const references: Array<ProjectScopedReference> = [
+        {
+          modelName: "Alert State",
+          id: alertStateId,
+          service: AlertStateService,
+        },
+        {
+          modelName: "Alert Severity",
+          id: alertSeverityId,
+          service: AlertSeverityService,
+        },
+        {
+          modelName: "Monitor Status",
+          id: monitorStatusId,
+          service: MonitorStatusService,
+        },
+        {
+          modelName: "Monitor",
+          id: monitorId,
+          service: MonitorService,
+        },
+        ...ProjectScopedReferenceValidator.getRelationReferences({
+          payload: updateBy.data,
+          relations: relations,
+          projectId: projectId,
+          heldIds: heldIds,
+        }),
+      ];
+
+      if (
+        references.every((reference: ProjectScopedReference) => {
+          return !reference.id;
+        })
+      ) {
         continue;
       }
 
       await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
         projectId: projectId,
         subject: "alert",
-        references: [
-          {
-            modelName: "Alert State",
-            id: alertStateId,
-            service: AlertStateService,
-          },
-          {
-            modelName: "Alert Severity",
-            id: alertSeverityId,
-            service: AlertSeverityService,
-          },
-          {
-            modelName: "Monitor Status",
-            id: monitorStatusId,
-            service: MonitorStatusService,
-          },
-        ],
+        references: references,
       });
     }
   }
 
+  /*
+   * The many-to-many lists whose ids must belong to the alert's project.
+   * Built per call rather than at module load: these services sit in an
+   * import graph that loops back to this one, and a module-level table would
+   * capture whichever of them had not finished loading yet as undefined.
+   */
+  private getProjectScopedRelations(): Array<ProjectScopedRelation> {
+    return [
+      {
+        column: "labels",
+        modelName: "Label",
+        service: LabelService,
+      },
+      {
+        column: "onCallDutyPolicies",
+        modelName: "On-Call Policy",
+        service: OnCallDutyPolicyService,
+      },
+      ...getAffectedResourceRelations(this.getModel()),
+    ];
+  }
+
   private async getProjectIdsForUpdateQuery(
     updateBy: UpdateBy<Model>,
   ): Promise<Array<ObjectID>> {
@@ -443,8 +522,17 @@ export class Service extends DatabaseService<Model> {
      * The severity and the monitor status stamped on the alert come from the
      * monitor criteria or the API caller, neither of which checked that the
      * record belongs to this project. Persisting another project's id leaves
-     * that project undeletable. Runs before the counter increment so a
-     * rejected create does not burn an alert number.
+     * that project undeletable, so reject it here.
+     *
+     * The monitor, on-call policies and labels are checked too, for a worse
+     * reason: onCreateSuccess executes every listed on-call policy, so
+     * another project's policy here would page that project's on-call for
+     * this project's alert, and the alert's feed (read as root) would name
+     * another project's monitor. The affected-resource lists likewise: see
+     * getAffectedResourceRelations.
+     *
+     * Runs before the counter increment so a rejected create does not burn an
+     * alert number.
      */
     await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
       projectId: projectId,
@@ -468,6 +556,17 @@ export class Service extends DatabaseService<Model> {
             ),
           service: MonitorStatusService,
         },
+        {
+          modelName: "Monitor",
+          id:
+            resolveReferenceId(createBy.data.monitorId) ||
+            resolveReferenceId(createBy.data.monitor),
+          service: MonitorService,
+        },
+        ...ProjectScopedReferenceValidator.getRelationReferences({
+          payload: createBy.data,
+          relations: this.getProjectScopedRelations(),
+        }),
       ],
     });
 
@@ -1194,6 +1293,7 @@ ${alert.remediationNotes || "No remediation notes provided."}
         },
         select: {
           _id: true,
+          projectId: true,
           user: {
             _id: true,
             email: true,
@@ -1215,6 +1315,7 @@ ${alert.remediationNotes || "No remediation notes provided."}
         },
         select: {
           _id: true,
+          projectId: true,
           teamId: true,
         },
         skip: 0,
@@ -1252,7 +1353,18 @@ ${alert.remediationNotes || "No remediation notes provided."}
       }
     }
 
-    return users;
+    const projectId: ObjectID | undefined =
+      ownerUsers[0]?.projectId || ownerTeams[0]?.projectId;
+
+    if (!projectId) {
+      return [];
+    }
+
+    // Owners who left the project are not notified, nor listed as notified.
+    return await TeamMemberService.filterUsersToProjectMembers({
+      projectId: projectId,
+      users: users,
+    });
   }
 
   @CaptureSpan()