@oneuptime/common 14.0.1 → 14.0.2

package/Server/Services/TeamMemberService.ts

@@ -58,6 +58,10 @@ import ProjectOnCallCalendarFeedService from "./ProjectOnCallCalendarFeedService
 import OnCallCalendarFeedCache from "../Infrastructure/OnCallCalendarFeedCache";
 import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
 import OnCallDutyPolicyScheduleLayerUser from "../../Models/DatabaseModels/OnCallDutyPolicyScheduleLayerUser";
+import ProjectLeaveResourceCleanup, {
+  ProjectLeaveResourceCleanupResult,
+} from "../Utils/TeamMember/ProjectLeaveResourceCleanup";
+import WorkspaceUserAuthTokenService from "./WorkspaceUserAuthTokenService";
 
 /*
  * What cleanupOnCallAssignmentsForUserLeavingProject did, for logging and
@@ -403,6 +407,7 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
             subject: isInvitationAcceptedOnCreate
               ? "You have been added to " + project.name
               : "You have been invited to " + project.name,
+            isSubjectLiteral: true,
           },
           {
             projectId: createBy.data.projectId!,
@@ -722,9 +727,9 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     /*
      * remove-user-from-project deletes every membership of one user in one
      * deleteBy, so the same (user, project) can appear several times here;
-     * the on-call cleanup is idempotent but not free, so run it once.
+     * the leave cleanups are idempotent but not free, so run them once.
      */
-    const onCallCleanupDone: Set<string> = new Set<string>();
+    const leaveCleanupDone: Set<string> = new Set<string>();
 
     /*
      * Whether ANY of the deleted rows for a (user, project) was an ACCEPTED
@@ -743,23 +748,86 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       }
     }
 
+    /*
+     * Revoke first, once per (user, project), each on its own. A delete can
+     * cover several users - a team, a SCIM group - and a failure in one
+     * user's cleanup below must not leave a later one with the permissions of
+     * the membership that was just removed: their cached entries would still
+     * list the project, and nothing would refresh them again. A failure is
+     * reported once everything else has run.
+     */
+    const refreshedKeys: Set<string> = new Set<string>();
+    let refreshError: Error | null = null;
+
+    for (const item of onDelete.carryForward as Array<TeamMember>) {
+      if (!item.userId || !item.projectId) {
+        continue;
+      }
+
+      const refreshKey: string = `${item.userId.toString()}:${item.projectId.toString()}`;
+
+      if (refreshedKeys.has(refreshKey)) {
+        continue;
+      }
+
+      refreshedKeys.add(refreshKey);
+
+      try {
+        await this.refreshTokens(item.userId, item.projectId);
+      } catch (err) {
+        refreshError = refreshError || (err as Error);
+
+        logger.error(
+          err as Error,
+          {
+            projectId: item.projectId.toString(),
+            userId: item.userId.toString(),
+          } as LogAttributes,
+        );
+
+        // Fall back to dropping the cached entries: a missing entry is rebuilt from the memberships.
+        await AccessTokenService.clearCachedPermissions(
+          item.userId,
+          item.projectId,
+        ).catch((clearError: Error) => {
+          logger.error(clearError, {
+            projectId: item.projectId?.toString(),
+            userId: item.userId?.toString(),
+          } as LogAttributes);
+        });
+      }
+    }
+
     for (const item of onDelete.carryForward as Array<TeamMember>) {
-      await this.refreshTokens(item.userId!, item.projectId!);
       await this.syncSubscriptionSeatsAfterMembershipChange(item.projectId!);
 
       /*
        * Before the notification settings go: the "removed from on-call
        * policy" notices the cleanup triggers should still reach the person,
-       * exactly as they would for a manual removal.
+       * exactly as they would for a manual removal. Then their roles on open
+       * incidents and their owner rows (see
+       * cleanupResourceAssignmentsIfUserLeftProject).
        */
       const cleanupKey: string = `${item.userId?.toString()}:${item.projectId?.toString()}`;
-      if (!onCallCleanupDone.has(cleanupKey) && item.userId && item.projectId) {
-        onCallCleanupDone.add(cleanupKey);
+      if (!leaveCleanupDone.has(cleanupKey) && item.userId && item.projectId) {
+        leaveCleanupDone.add(cleanupKey);
         await this.cleanupOnCallAssignmentsIfUserLeftProject({
           projectId: item.projectId,
           userId: item.userId,
           hadAcceptedMembership: acceptedMembershipKeys.has(cleanupKey),
         });
+        await this.cleanupResourceAssignmentsIfUserLeftProject({
+          projectId: item.projectId,
+          userId: item.userId,
+        });
+        /*
+         * After the resource cleanup: its "removed as owner / role" workspace
+         * posts can still mention the person through their chat account link.
+         */
+        await this.removeWorkspaceAccountLinksIfUserLeftProject({
+          projectId: item.projectId,
+          userId: item.userId,
+        });
       }
 
       await UserNotificationSettingService.removeDefaultNotificationSettingsForUser(
@@ -768,6 +836,10 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       );
     }
 
+    if (refreshError) {
+      throw refreshError;
+    }
+
     return onDelete;
   }
 
@@ -824,6 +896,110 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     }
   }
 
+  /**
+   * Take a departed user off the project's open incidents and episodes (their
+   * roles) and off everything they own, under the same rule as
+   * cleanupOnCallAssignmentsIfUserLeftProject: only once they hold no
+   * accepted membership in any team of the project. A revoked invitation runs
+   * it too — a pending invitee has no business owning anything either.
+   * Best-effort: never throws into the delete path. See
+   * ProjectLeaveResourceCleanup.cleanupForUserLeavingProject for what goes.
+   */
+  @CaptureSpan()
+  public async cleanupResourceAssignmentsIfUserLeftProject(data: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }): Promise<ProjectLeaveResourceCleanupResult | null> {
+    try {
+      if (
+        await this.isUserMemberOfProject({
+          projectId: data.projectId,
+          userId: data.userId,
+        })
+      ) {
+        return null;
+      }
+
+      return await ProjectLeaveResourceCleanup.cleanupForUserLeavingProject({
+        projectId: data.projectId,
+        userId: data.userId,
+      });
+    } catch (err) {
+      logger.error(
+        err as Error,
+        {
+          projectId: data.projectId.toString(),
+          userId: data.userId.toString(),
+        } as LogAttributes,
+      );
+      return null;
+    }
+  }
+
+  /**
+   * A user who has left the project must stop acting in it from Slack or
+   * Microsoft Teams. Their WorkspaceUserAuthToken rows for the project are
+   * what map a chat account to them, and nothing removed those rows on leave:
+   * only uninstalling the app or disconnecting the workspace did. So once the
+   * user holds no accepted membership in ANY team of the project, delete them.
+   * Deleting through the service also removes the Slack / Teams notification
+   * methods that point at them (see WorkspaceUserAuthTokenService).
+   *
+   * The chat handlers check membership on every action as well; this keeps
+   * the table from holding links for people who are gone. Best-effort: never
+   * throws into the delete path. Returns how many links were removed.
+   */
+  @CaptureSpan()
+  public async removeWorkspaceAccountLinksIfUserLeftProject(data: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }): Promise<number> {
+    try {
+      const remaining: PositiveNumber = await this.countBy({
+        query: {
+          projectId: data.projectId,
+          userId: data.userId,
+          hasAcceptedInvitation: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+      if (remaining.toNumber() > 0) {
+        return 0;
+      }
+
+      return await WorkspaceUserAuthTokenService.deleteBy({
+        query: {
+          projectId: data.projectId,
+          userId: data.userId,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+    } catch (err) {
+      logger.error(
+        "Error removing the Slack / Microsoft Teams account links of a user who left the project (best-effort).",
+        {
+          projectId: data.projectId.toString(),
+          userId: data.userId.toString(),
+        } as LogAttributes,
+      );
+      logger.error(
+        err as Error,
+        {
+          projectId: data.projectId.toString(),
+          userId: data.userId.toString(),
+        } as LogAttributes,
+      );
+      return 0;
+    }
+  }
+
   /**
    * A user who has left the project must stop being paged and must stop
    * seeing the project's shifts. Nothing used to do this: their layer-user
@@ -1221,11 +1397,20 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     return [...new Set(memberIds)].length; //get unique member ids.
   }
 
+  /**
+   * Every member row of the teams, pending invitations included. Pass
+   * acceptedOnly for the accepted rows alone - the only ones that grant the
+   * team's permissions and come with notification settings.
+   */
   @CaptureSpan()
-  public async getUsersInTeams(teamIds: Array<ObjectID>): Promise<Array<User>> {
+  public async getUsersInTeams(
+    teamIds: Array<ObjectID>,
+    options?: { acceptedOnly?: boolean | undefined } | undefined,
+  ): Promise<Array<User>> {
     const members: Array<TeamMember> = await this.findBy({
       query: {
         teamId: QueryHelper.any(teamIds),
+        ...(options?.acceptedOnly ? { hasAcceptedInvitation: true } : {}),
       },
       props: {
         isRoot: true,
@@ -1446,6 +1631,123 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     );
     return teamIds;
   }
+
+  /*
+   * Whether the user holds an accepted membership in any team of the project.
+   * A pending invitee is not a member yet, and someone removed from every
+   * team is not one any more — their notification settings are gone, so
+   * nothing addressed to them from this project reaches them.
+   */
+  @CaptureSpan()
+  public async isUserMemberOfProject(data: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }): Promise<boolean> {
+    const count: PositiveNumber = await this.countBy({
+      query: {
+        projectId: data.projectId,
+        userId: data.userId,
+        hasAcceptedInvitation: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return count.toNumber() > 0;
+  }
+
+  /*
+   * The ids among `userIds` that belong to members of the project (see
+   * isUserMemberOfProject), in their input order, each once. Ids stored in
+   * saved configuration can arrive as plain strings; they come back as ids.
+   */
+  @CaptureSpan()
+  public async getProjectMemberUserIds(data: {
+    projectId: ObjectID;
+    userIds: Array<ObjectID | string>;
+  }): Promise<Array<ObjectID>> {
+    const requested: Map<string, ObjectID> = new Map<string, ObjectID>();
+
+    for (const userId of data.userIds) {
+      const value: string = userId?.toString() || "";
+
+      if (value && !requested.has(value.toLowerCase())) {
+        requested.set(value.toLowerCase(), new ObjectID(value));
+      }
+    }
+
+    if (requested.size === 0) {
+      return [];
+    }
+
+    const members: Array<TeamMember> = await this.findBy({
+      query: {
+        projectId: data.projectId,
+        userId: QueryHelper.any(Array.from(requested.values())),
+        hasAcceptedInvitation: true,
+      },
+      select: {
+        userId: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const memberIds: Set<string> = new Set<string>(
+      members.map((member: TeamMember): string => {
+        return member.userId?.toString().toLowerCase() || "";
+      }),
+    );
+
+    return Array.from(requested.entries())
+      .filter(([key]: [string, ObjectID]): boolean => {
+        return memberIds.has(key);
+      })
+      .map(([, userId]: [string, ObjectID]): ObjectID => {
+        return userId;
+      });
+  }
+
+  /*
+   * `users` without the ones who are not members of the project. Owner lists
+   * use it so an owner who left is neither notified nor reported as
+   * notified, and a resource whose owners have all left falls back to the
+   * project owners.
+   */
+  @CaptureSpan()
+  public async filterUsersToProjectMembers(data: {
+    projectId: ObjectID;
+    users: Array<User>;
+  }): Promise<Array<User>> {
+    if (data.users.length === 0) {
+      return [];
+    }
+
+    const memberIds: Set<string> = new Set<string>(
+      (
+        await this.getProjectMemberUserIds({
+          projectId: data.projectId,
+          userIds: data.users
+            .map((user: User): string => {
+              return user?.id?.toString() || "";
+            })
+            .filter(Boolean),
+        })
+      ).map((userId: ObjectID): string => {
+        return userId.toString().toLowerCase();
+      }),
+    );
+
+    return data.users.filter((user: User): boolean => {
+      return Boolean(
+        user?.id && memberIds.has(user.id.toString().toLowerCase()),
+      );
+    });
+  }
 }
 
 export default new TeamMemberService();

package/Server/Services/TraceAggregationService.ts

@@ -852,9 +852,13 @@ export class TraceAggregationService {
      * predicate references a column the aggregate projection does not store,
      * so ClickHouse rejects proj_hist_by_minute and full-scans the base table
      * (verified: 32M rows / ~220ms vs 1.5K rows / ~6ms with this form). The
-     * window edges round to the minute, which is consistent with the
-     * minute-bucketed output and only shifts the first/last bucket by the
-     * partial boundary minute when the range is not minute-aligned.
+     * start edge rounds down to the minute, which is consistent with the
+     * minute-bucketed output and only widens the first bucket by the partial
+     * boundary minute when the range is not minute-aligned. The end edge
+     * keeps every minute that STARTS before the window ends, so a
+     * minute-aligned end - what zooming into a bar produces - does not draw
+     * an extra bar of spans the list below it does not show (see the log
+     * histogram in LogAggregationService for the same rule).
      *
      * If any non-projection filter (kind, name, traceId, spanId,
      * nameSearchText, spanNameSearches, statusMessageSearchText,
@@ -886,10 +890,10 @@ export class TraceAggregationService {
             type: TableColumnType.Date,
             value: request.startTime,
           }})
-          AND toStartOfMinute(startTime) <= toStartOfMinute(${{
-            type: TableColumnType.Date,
+          AND toStartOfMinute(startTime) < ${{
+            type: TableColumnType.DateTime64,
             value: request.endTime,
-          }})
+          }}
     `;
 
     TraceAggregationService.appendCommonFilters(statement, request);

package/Server/Services/UserEmailService.ts

@@ -224,6 +224,7 @@ export class Service extends DatabaseService<Model> {
           subject: "Verify this email address",
         },
         subject: "Verify this email address",
+        isSubjectLiteral: true,
       },
       {
         projectId: item.projectId!,

package/Server/Services/UserNotificationMethodAdminService.ts

@@ -1647,6 +1647,7 @@ export class UserNotificationMethodAdminService extends BaseService {
         templateType: EmailTemplateType.SimpleMessage,
         vars: vars,
         subject: subject,
+        isSubjectLiteral: true,
       },
       {
         projectId: data.projectId,

package/Server/Services/UserNotificationRuleAdminService.ts

@@ -1175,6 +1175,7 @@ export class UserNotificationRuleAdminService extends BaseService {
         templateType: EmailTemplateType.SimpleMessage,
         vars: vars,
         subject: subject,
+        isSubjectLiteral: true,
       },
       {
         projectId: data.projectId,

package/Server/Services/UserNotificationRuleService.ts

@@ -4635,6 +4635,7 @@ export class Service extends DatabaseService<Model> {
       templateType: EmailTemplateType.AcknowledgeAlert,
       vars: vars,
       subject: `ACTION REQUIRED: Alert ${alertNumber} created - ${alert.title!}`,
+      isSubjectLiteral: true,
     };
 
     return emailMessage;
@@ -4696,6 +4697,7 @@ export class Service extends DatabaseService<Model> {
       templateType: EmailTemplateType.AcknowledgeIncident,
       vars: vars,
       subject: `ACTION REQUIRED: Incident ${incidentNumber} created - ${incident.title!}`,
+      isSubjectLiteral: true,
     };
 
     return emailMessage;
@@ -4866,6 +4868,7 @@ export class Service extends DatabaseService<Model> {
       templateType: EmailTemplateType.AcknowledgeAlertEpisode,
       vars: vars,
       subject: `ACTION REQUIRED: Alert Episode ${episodeNumber} created - ${alertEpisode.title!}`,
+      isSubjectLiteral: true,
     };
 
     return emailMessage;
@@ -5051,6 +5054,7 @@ export class Service extends DatabaseService<Model> {
       templateType: EmailTemplateType.AcknowledgeIncidentEpisode,
       vars: vars,
       subject: `ACTION REQUIRED: Incident Episode ${episodeNumber} created - ${incidentEpisode.title!}`,
+      isSubjectLiteral: true,
     };
 
     return emailMessage;

package/Server/Services/UserService.ts

@@ -93,6 +93,17 @@ const FIRST_MASTER_ADMIN_ELECTION_LOCK_TIMEOUT_MS: number = 10_000;
  */
 const FIRST_MASTER_ADMIN_ELECTION_ACQUIRE_TIMEOUT_MS: number = 5_000;
 
+/*
+ * How long one API node trusts its answer to "is this user blocked?".
+ *
+ * This bounds how long a block takes to reach a session that is already open
+ * on ANOTHER node. The node that wrote the block drops its own entry at once
+ * (onUpdateSuccess), and the block revokes every session, so a refresh token
+ * is refused immediately everywhere; what this governs is the stateless
+ * 15-minute access token, which would otherwise run to expiry.
+ */
+export const BLOCKED_USER_CACHE_TTL_MS: number = 60_000;
+
 export class Service extends DatabaseService<Model> {
   /*
    * Suppresses repeated `lastActive` UPDATEs from a single API node. 60s of
@@ -102,10 +113,93 @@ export class Service extends DatabaseService<Model> {
     10_000,
   );
 
+  /*
+   * `isUserBlocked` answers, per node. Read with an explicit `undefined`
+   * check: a cached "not blocked" is `false` and must not look like a miss.
+   */
+  private blockedUserCache: InMemoryTTLCache<boolean> = new InMemoryTTLCache(
+    10_000,
+  );
+
+  /*
+   * One lookup per user in flight. A dashboard load fires a burst of
+   * concurrent requests, and without this a cold cache turns the burst into
+   * the same number of identical queries.
+   */
+  private blockedUserLookups: Map<string, Promise<boolean>> = new Map();
+
   public constructor() {
     super(Model);
   }
 
+  /**
+   * Whether a master admin has blocked this user. For the checks that run on
+   * every authenticated request (UserAuthorization, MasterAdminAuthorization),
+   * so it is cached per node for BLOCKED_USER_CACHE_TTL_MS.
+   *
+   * The sign-in and refresh-token routes do NOT use this. They load the user
+   * row anyway, and they are where a block has to take effect immediately, so
+   * they read `isBlocked` straight from it.
+   *
+   * A user that does not exist is reported as not blocked. This answers the
+   * blocked question only; what a deleted account may still do is out of its
+   * scope (/refresh-token refuses one).
+   */
+  @CaptureSpan()
+  public async isUserBlocked(userId: ObjectID): Promise<boolean> {
+    const key: string = userId.toString();
+
+    const cached: boolean | undefined = this.blockedUserCache.get(key);
+
+    if (cached !== undefined) {
+      return cached;
+    }
+
+    const inFlight: Promise<boolean> | undefined =
+      this.blockedUserLookups.get(key);
+
+    if (inFlight) {
+      return inFlight;
+    }
+
+    const lookup: Promise<boolean> = this.findOneById({
+      id: userId,
+      select: { isBlocked: true },
+      props: { isRoot: true },
+    })
+      .then((user: Model | null): boolean => {
+        const isBlocked: boolean = Boolean(user?.isBlocked);
+
+        /*
+         * Only cached if this lookup is still the current one. A block written
+         * while it was on the wire clears the slot (forgetBlockedStatus), and
+         * the answer this lookup read may predate that write.
+         */
+        if (this.blockedUserLookups.get(key) === lookup) {
+          this.blockedUserCache.set(key, isBlocked, BLOCKED_USER_CACHE_TTL_MS);
+        }
+
+        return isBlocked;
+      })
+      .finally((): void => {
+        if (this.blockedUserLookups.get(key) === lookup) {
+          this.blockedUserLookups.delete(key);
+        }
+      });
+
+    this.blockedUserLookups.set(key, lookup);
+
+    return lookup;
+  }
+
+  // Drops this node's cached answer, so the next request reads the row.
+  public forgetBlockedStatus(userId: ObjectID): void {
+    const key: string = userId.toString();
+
+    this.blockedUserCache.delete(key);
+    this.blockedUserLookups.delete(key);
+  }
+
   /**
    * Debounced fire-and-forget update of `User.lastActive`. The auth
    * middleware calls this on every authenticated request; without the cache
@@ -516,8 +610,32 @@ export class Service extends DatabaseService<Model> {
   @CaptureSpan()
   protected override async onUpdateSuccess(
     onUpdate: OnUpdate<Model>,
-    _updatedItemIds: ObjectID[],
+    updatedItemIds: ObjectID[],
   ): Promise<OnUpdate<Model>> {
+    /*
+     * A block has to end the sessions the user already holds, not only stop
+     * the next sign-in. Revoking them makes /refresh-token refuse at once; the
+     * access token already in the browser is refused by UserAuthorization,
+     * which reads the flag through `isUserBlocked`.
+     *
+     * Unblocking only drops the cached answer. The revoked sessions stay
+     * revoked, and the user signs in again.
+     *
+     * Hook-only, like the password revocation below: a write made with
+     * `ignoreHooks: true` has to revoke the sessions itself.
+     */
+    if (onUpdate && onUpdate.updateBy.data.isBlocked !== undefined) {
+      for (const userId of updatedItemIds) {
+        this.forgetBlockedStatus(userId);
+
+        if (onUpdate.updateBy.data.isBlocked) {
+          await UserSessionService.revokeAllSessionsByUserId(userId, {
+            reason: "User blocked",
+          });
+        }
+      }
+    }
+
     if (onUpdate && onUpdate.updateBy.data.password) {
       const host: Hostname = await DatabaseConfig.getHost();
       const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
@@ -532,6 +650,7 @@ export class Service extends DatabaseService<Model> {
         MailService.sendMail({
           toEmail: user.email!,
           subject: "Password Changed.",
+          isSubjectLiteral: true,
           templateType: EmailTemplateType.PasswordChanged,
           vars: {
             homeURL: new URL(httpProtocol, host).toString(),
@@ -635,6 +754,7 @@ export class Service extends DatabaseService<Model> {
           MailService.sendMail({
             toEmail: newUser.email!,
             subject: "You have changed your email. Please verify your email.",
+            isSubjectLiteral: true,
             templateType: EmailTemplateType.EmailChanged,
             vars: {
               name: newUser.name!.toString(),
@@ -1341,6 +1461,7 @@ export class Service extends DatabaseService<Model> {
         await MailService.sendMail({
           toEmail: user.email,
           subject: "Password Reset Request for OneUptime",
+          isSubjectLiteral: true,
           templateType: EmailTemplateType.ForgotPassword,
           vars: {
             homeURL: new URL(httpProtocol, host).toString(),