@oneuptime/common 14.0.1 → 14.0.3

package/Server/API/StatusPageAPI.ts

@@ -28,8 +28,10 @@ import StatusPageResourceService from "../Services/StatusPageResourceService";
 import StatusPageService, {
   Service as StatusPageServiceType,
 } from "../Services/StatusPageService";
+import { MergedDowntimeTotals } from "../Services/MonitorStatusTimelineService";
 import { UptimeDailyAggregate } from "../../Types/StatusPage/UptimeDailyAggregate";
 import UptimeDailyAggregateUtil from "../../Utils/StatusPage/UptimeDailyAggregateUtil";
+import MonitorGroupMergedDowntimeUtil from "../../Utils/StatusPage/MonitorGroupMergedDowntimeUtil";
 import StatusPageSsoService from "../Services/StatusPageSsoService";
 import StatusPageOidcService from "../Services/StatusPageOidcService";
 import StatusPageSubscriberService from "../Services/StatusPageSubscriberService";
@@ -1462,6 +1464,7 @@ export default class StatusPageAPI extends BaseAPI<
             statusPageResources,
             statusPage,
             monitorStatusTimelines,
+            uptimeDailyAggregate,
             statusPageGroups,
             monitorsInGroup,
           } = await this.getStatusPageResourcesAndTimelines({
@@ -1484,6 +1487,23 @@ export default class StatusPageAPI extends BaseAPI<
             endDate: endDate,
           };
 
+          /*
+           * A monitor group is down whenever at least one of its monitors
+           * is, which the per-monitor aggregate cannot say, so its uptime is
+           * merged over its monitors by the database - not from
+           * monitorStatusTimelines, which arrive under one 10,000 row cap
+           * across every monitor on the page, newest first. Asked here,
+           * because the walk below is synchronous.
+           */
+          const mergedDowntimeByMonitorGroupId: Dictionary<MergedDowntimeTotals> =
+            await this.getMergedDowntimeByMonitorGroupId({
+              statusPageResources: statusPageResources,
+              monitorsInGroup: monitorsInGroup,
+              downtimeMonitorStatuses: downtimeMonitorStatuses,
+              startDate: startDate,
+              endDate: endDate,
+            });
+
           type ResourceUptime = {
             statusPageResourceId: ObjectID;
             uptimePercent: number | null;
@@ -1576,31 +1596,31 @@ export default class StatusPageAPI extends BaseAPI<
                       resourceUptime.currentStatus = null;
                     }
 
-                    const resourceStatusTimelines: Array<MonitorStatusTimeline> =
-                      StatusPageResourceUptimeUtil.getMonitorStatusTimelineForResource(
+                    /*
+                     * From the per-day aggregate, not monitorStatusTimelines:
+                     * those rows come back under one 10,000 row cap across
+                     * every monitor on the page, newest first, and on a page
+                     * with a flapping monitor that is the last few days of the
+                     * range - so the percentage would cover only those days.
+                     * Null when the resource does not show its uptime.
+                     */
+                    resourceUptime.uptimePercent =
+                      StatusPageResourceUptimeUtil.calculateUptimePercentOfResource(
                         {
                           statusPageResource: resource,
                           monitorStatusTimelines: monitorStatusTimelines,
+                          precision: precision,
+                          downtimeMonitorStatuses: downtimeMonitorStatuses,
                           monitorsInGroup: monitorsInGroup,
+                          uptimeWindow: uptimeWindow,
+                          uptimeDailyAggregate: uptimeDailyAggregate,
                         },
                       );
 
-                    if (resource.showUptimePercent) {
-                      const uptimePercent: number =
-                        UptimeUtil.calculateUptimePercentage(
-                          resourceStatusTimelines,
-                          precision,
-                          downtimeMonitorStatuses,
-                          uptimeWindow,
-                        );
-
-                      resourceUptime.uptimePercent = uptimePercent;
-                    }
-
                     groupUptime.statusPageResourceUptimes.push(resourceUptime);
                   }
 
-                  // if its a monitor group, then...
+                  // if its a monitor group, then its uptime is merged over its monitors.
 
                   if (resource.monitorGroupId) {
                     let currentStatus: MonitorStatus | undefined =
@@ -1628,22 +1648,37 @@ export default class StatusPageAPI extends BaseAPI<
                     }
 
                     if (resource.showUptimePercent) {
-                      const resourceStatusTimelines: Array<MonitorStatusTimeline> =
-                        StatusPageResourceUptimeUtil.getMonitorStatusTimelineForResource(
-                          {
-                            statusPageResource: resource,
-                            monitorStatusTimelines: monitorStatusTimelines,
-                            monitorsInGroup: monitorsInGroup,
-                          },
-                        );
-
-                      const uptimePercent: number =
-                        UptimeUtil.calculateUptimePercentage(
+                      const merged: MergedDowntimeTotals | undefined =
+                        mergedDowntimeByMonitorGroupId[
+                          resource.monitorGroupId.toString()
+                        ];
+
+                      let uptimePercent: number | null = merged
+                        ? UptimeUtil.calculateUptimePercentOfCoveredSeconds({
+                            coveredSeconds: merged.coveredSeconds,
+                            downtimeSeconds: merged.downtimeSeconds,
+                            precision: precision,
+                          })
+                        : null;
+
+                      // nothing recorded: fall back to the rows, as a monitor does.
+                      if (uptimePercent === null) {
+                        const resourceStatusTimelines: Array<MonitorStatusTimeline> =
+                          StatusPageResourceUptimeUtil.getMonitorStatusTimelineForResource(
+                            {
+                              statusPageResource: resource,
+                              monitorStatusTimelines: monitorStatusTimelines,
+                              monitorsInGroup: monitorsInGroup,
+                            },
+                          );
+
+                        uptimePercent = UptimeUtil.calculateUptimePercentage(
                           resourceStatusTimelines,
                           precision,
                           downtimeMonitorStatuses,
                           uptimeWindow,
                         );
+                      }
 
                       resourceUptime.uptimePercent = uptimePercent;
                     }
@@ -3071,6 +3106,7 @@ export default class StatusPageAPI extends BaseAPI<
                   body: compiledBody,
                 },
                 subject: compiledSubject,
+                isSubjectLiteral: true,
               },
               {
                 mailServer: ProjectSmtpConfigService.toEmailServer(
@@ -3107,6 +3143,7 @@ export default class StatusPageAPI extends BaseAPI<
                   manageSubscriptionUrl: manageUrlink,
                 },
                 subject: "Manage your Subscription for " + statusPageNameStr,
+                isSubjectLiteral: true,
               },
               {
                 mailServer: ProjectSmtpConfigService.toEmailServer(
@@ -4749,6 +4786,72 @@ export default class StatusPageAPI extends BaseAPI<
     };
   }
 
+  /*
+   * Merged downtime for every monitor group on the page whose resource shows
+   * its uptime, keyed by monitor group id: the time at least one of the
+   * group's monitors was in one of the page's downtime statuses, and the time
+   * at least one of them was recorded, over [startDate, endDate].
+   *
+   * A monitor group is down whenever one of its monitors is. The per-monitor
+   * day aggregate cannot say when that was, and monitorStatusTimelines arrive
+   * under one 10,000 row cap across every monitor on the page, newest first -
+   * on a page with a flapping monitor, the last few days of the window. So the
+   * database merges each group's monitors over every row, once per distinct
+   * set of monitors however many groups or resources share it.
+   *
+   * The overview ships the result and the uptime endpoint reads it, so both
+   * measure a monitor group the same way.
+   */
+  @CaptureSpan()
+  public async getMergedDowntimeByMonitorGroupId(data: {
+    statusPageResources: Array<StatusPageResource>;
+    monitorsInGroup: Dictionary<Array<ObjectID>>;
+    downtimeMonitorStatuses: Array<MonitorStatus>;
+    startDate: Date;
+    endDate: Date;
+  }): Promise<Dictionary<MergedDowntimeTotals>> {
+    const mergedDowntimeByMonitorGroupId: Dictionary<MergedDowntimeTotals> = {};
+    const mergedDowntimeByMonitorSet: Dictionary<MergedDowntimeTotals> = {};
+
+    const downtimeMonitorStatusIds: Array<string> = data.downtimeMonitorStatuses
+      .map((status: MonitorStatus): string => {
+        return status.id?.toString() || "";
+      })
+      .filter(Boolean);
+
+    for (const resource of data.statusPageResources) {
+      if (!resource.monitorGroupId || !resource.showUptimePercent) {
+        continue;
+      }
+
+      const monitorGroupId: string = resource.monitorGroupId.toString();
+
+      if (mergedDowntimeByMonitorGroupId[monitorGroupId]) {
+        continue;
+      }
+
+      const monitorIds: Array<ObjectID> =
+        data.monitorsInGroup[monitorGroupId] || [];
+      const monitorSetKey: string =
+        StatusPageServiceType.getMonitorSetKey(monitorIds);
+
+      if (!mergedDowntimeByMonitorSet[monitorSetKey]) {
+        mergedDowntimeByMonitorSet[monitorSetKey] =
+          await StatusPageService.getMergedDowntimeForStatusPage({
+            monitorIds: monitorIds,
+            downtimeMonitorStatusIds: downtimeMonitorStatusIds,
+            startDate: data.startDate,
+            endDate: data.endDate,
+          });
+      }
+
+      mergedDowntimeByMonitorGroupId[monitorGroupId] =
+        mergedDowntimeByMonitorSet[monitorSetKey]!;
+    }
+
+    return mergedDowntimeByMonitorGroupId;
+  }
+
   /*
    * Builds the full overview payload for one status page. Everything below
    * is a pure function of the statusPageId — every query runs with isRoot
@@ -4783,6 +4886,20 @@ export default class StatusPageAPI extends BaseAPI<
       statusPageId: statusPageId,
     });
 
+    /*
+     * What a monitor group's uptime percentage is read from in the browser,
+     * over the same window as the day aggregate. See
+     * getMergedDowntimeByMonitorGroupId.
+     */
+    const mergedDowntimeByMonitorGroupId: Dictionary<MergedDowntimeTotals> =
+      await this.getMergedDowntimeByMonitorGroupId({
+        statusPageResources: statusPageResources,
+        monitorsInGroup: monitorsInGroup,
+        downtimeMonitorStatuses: statusPage.downtimeMonitorStatuses || [],
+        startDate: startDate,
+        endDate: endDate,
+      });
+
     // check if status page has active incident.
     let activeIncidents: Array<Incident> = [];
     if (monitorsOnStatusPage.length > 0) {
@@ -5577,6 +5694,9 @@ export default class StatusPageAPI extends BaseAPI<
       ),
       uptimeDailyAggregate:
         UptimeDailyAggregateUtil.toJSON(uptimeDailyAggregate),
+      monitorGroupMergedDowntime: MonitorGroupMergedDowntimeUtil.toJSON(
+        mergedDowntimeByMonitorGroupId,
+      ),
       resourceGroups: BaseModel.toJSONArray(statusPageGroups, StatusPageGroup),
       monitorStatuses: BaseModel.toJSONArray(monitorStatuses, MonitorStatus),
       statusPageResources: BaseModel.toJSONArray(

package/Server/API/TelemetryAPI.ts

@@ -145,12 +145,19 @@ import SessionReplayReadService, {
   SessionReplayListFilters,
   SessionReplayListResult,
   SessionReplayManifest,
+  SessionReplayResolvedSession,
   SessionReplaySessionHeader,
   SessionReplaySessionIdentity,
   SessionReplaySummary,
   SessionReplayUsersCursor,
   SessionReplayUsersResult,
 } from "../Utils/SessionReplay/SessionReplayReadService";
+import SessionReplayUserFlowReadService from "../Utils/SessionReplay/SessionReplayUserFlowReadService";
+import {
+  USER_FLOW_DEFAULT_MAX_SESSIONS,
+  USER_FLOW_MAX_SESSIONS,
+  UserFlowJourneysResponseDto,
+} from "../../Types/Rum/UserFlow";
 import SessionReplayHealthCounters, {
   SessionReplayDropCount,
 } from "../Utils/SessionReplay/SessionReplayHealthCounters";
@@ -615,13 +622,20 @@ router.post(
 
       const body: JSONObject = req.body as JSONObject;
 
+      /*
+       * One reading of the clock for both default edges. Two readings can
+       * land a millisecond apart, making the default hour 60m + 1ms long -
+       * which tips the bucket size from one minute to five.
+       */
+      const now: Date = OneUptimeDate.getCurrentDate();
+
       const startTime: Date = body["startTime"]
         ? OneUptimeDate.fromString(body["startTime"] as string)
-        : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
+        : OneUptimeDate.addRemoveHours(now, -1);
 
       const endTime: Date = body["endTime"]
         ? OneUptimeDate.fromString(body["endTime"] as string)
-        : OneUptimeDate.getCurrentDate();
+        : now;
 
       const bucketSizeInMinutes: number =
         (body["bucketSizeInMinutes"] as number) ||
@@ -683,8 +697,14 @@ router.post(
       const buckets: Array<HistogramBucket> =
         await LogAggregationService.getHistogram(request);
 
+      /*
+       * Each bucket is labelled with its start only. The chart needs the
+       * width too: without it a click on one bar could only zoom into a
+       * window zero seconds wide.
+       */
       return Response.sendJsonObjectResponse(req, res, {
         buckets: buckets as unknown as JSONObject,
+        bucketSizeInMinutes: bucketSizeInMinutes,
       });
     } catch (err: unknown) {
       next(err);
@@ -3589,6 +3609,40 @@ const requireSessionReplaySummaryAccess: Array<RequestHandler> = [
   }),
 ];
 
+/*
+ * Resolving a session id to its application, for the replay links on the
+ * log, span and exception surfaces. Those surfaces are open to every
+ * telemetry reader, most of whom hold no replay grant, so this guard admits
+ * the telemetry read tiers as well as the session-list permissions: a 422
+ * here would reject the Dashboard's lookup on every row a Viewer expands,
+ * and a rejection is the one answer that lookup does not cache.
+ *
+ * The guard is not what protects the data. The handler resolves the
+ * caller's session-list label scope and filters every row to it, so a
+ * caller holding no list grant reaches no application and receives an
+ * empty success - the same fail-closed shape /summaries gives an audit-only
+ * reviewer. It projects only what /list already shows to a list-capable
+ * caller: the application and the start time.
+ */
+const SESSION_REPLAY_RESOLVE_PERMISSIONS: Array<Permission> = [
+  ...SESSION_REPLAY_LIST_PERMISSIONS,
+  Permission.ProjectMember,
+  Permission.Viewer,
+  Permission.TelemetryMember,
+  Permission.TelemetryViewer,
+  Permission.ReadTelemetryServiceLog,
+  Permission.ReadTelemetryServiceTraces,
+  Permission.ReadTelemetryException,
+];
+
+const requireSessionReplayResolveAccess: Array<RequestHandler> = [
+  UserMiddleware.getUserMiddleware,
+  UserMiddleware.requireUserAuthentication,
+  UserMiddleware.requirePermission({
+    permissions: SESSION_REPLAY_RESOLVE_PERMISSIONS,
+  }),
+];
+
 const SESSION_REPLAY_PAYLOAD_PERMISSIONS: Array<Permission> = [
   Permission.ProjectOwner,
   Permission.ProjectAdmin,
@@ -4573,9 +4627,10 @@ const readSessionIdFromBody: ReadSessionIdFromBodyFunction = (
 type ReadSessionIdsFromBodyFunction = (body: JSONObject) => Array<string>;
 
 /*
- * The summaries route accepts one audit-table page at a time. Validate the
- * raw array before de-duplicating it so repeated values cannot be used to
- * bypass the request-size ceiling, then preserve first-occurrence order.
+ * The summaries and resolve routes accept one page of ids at a time.
+ * Validate the raw array before de-duplicating it so repeated values cannot
+ * be used to bypass the request-size ceiling, then preserve first-occurrence
+ * order.
  */
 const readSessionIdsFromBody: ReadSessionIdsFromBodyFunction = (
   body: JSONObject,
@@ -5242,6 +5297,72 @@ router.post(
   },
 );
 
+// --- Session Replay Resolve Endpoint ---
+
+/*
+ * Session id -> the application that recorded it, project-wide. A log line,
+ * a span and an exception occurrence each carry a sessionId but not the RUM
+ * application, and the player route needs both. RumSession has no
+ * crudApiPath (see the note above the guards), so the Dashboard cannot ask
+ * the generic analytics API; this is its one read for it.
+ *
+ * There is no application to assert access to - finding it is the point -
+ * so the query is restricted to the applications the caller's session-list
+ * labels reach, exactly as /for-exception is. A caller whose grant reaches
+ * none gets an empty success without a query; an Owned-scoped grant is
+ * refused, as on every other replay route. Ids recorded under more than one
+ * application are left out rather than guessed (see resolveSessions).
+ */
+router.post(
+  "/telemetry/rum/session-replay/resolve",
+  ...requireSessionReplayResolveAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      assertSessionReplayPlan(databaseProps);
+
+      const projectId: ObjectID = databaseProps.tenantId;
+      const body: JSONObject = req.body as JSONObject;
+      const sessionIds: Array<string> = readSessionIdsFromBody(body);
+
+      const accessibleApplications: AccessibleRumApplications =
+        await resolveAccessibleRumApplicationIds({
+          projectId: projectId,
+          databaseProps: databaseProps,
+          permissions: SESSION_REPLAY_LIST_PERMISSIONS,
+        });
+
+      const sessions: Array<SessionReplayResolvedSession> =
+        await SessionReplayReadService.resolveSessions({
+          projectId: projectId,
+          sessionIds: sessionIds,
+          accessibleRumApplicationIds: accessibleApplications.applicationIds,
+        });
+
+      return Response.sendJsonObjectResponse(req, res, {
+        sessions: sessions as unknown as JSONArray,
+        isApplicationScopeTruncated: accessibleApplications.isTruncated,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 // --- Session Replay Users Endpoint ---
 
 /*
@@ -5418,6 +5539,96 @@ router.post(
   },
 );
 
+/*
+ * User Flows: the ordered page journey of each recorded session in the
+ * window, for the flow map, paths and drop-off views (see
+ * SessionReplayUserFlowReadService for where the order comes from).
+ *
+ * Same guard, plan gate and label-scoped application check as /users: it
+ * projects only manifest-level columns the session list already shows -
+ * pages, device facts and signal counts - never a payload, and no
+ * identity column at all.
+ */
+router.post(
+  "/telemetry/rum/session-replay/user-flow",
+  ...requireSessionReplayListAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      assertSessionReplayPlan(databaseProps);
+
+      const projectId: ObjectID = databaseProps.tenantId;
+      const body: JSONObject = req.body as JSONObject;
+
+      const rumApplicationId: ObjectID = readObjectIdFromBody(
+        body,
+        "rumApplicationId",
+      );
+
+      await assertSessionReplayApplicationAccess({
+        projectId: projectId,
+        rumApplicationId: rumApplicationId,
+        databaseProps: databaseProps,
+        permissions: SESSION_REPLAY_LIST_PERMISSIONS,
+      });
+
+      const startTime: Date =
+        readOptionalDateFromBody(body, "startTime") ||
+        OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), -7);
+
+      const endTime: Date =
+        readOptionalDateFromBody(body, "endTime") ||
+        OneUptimeDate.getCurrentDate();
+
+      if (startTime.getTime() > endTime.getTime()) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("startTime must not be after endTime"),
+        );
+      }
+
+      /* `limit` caps the SESSIONS read, newest first. */
+      const maxSessions: number = readLimitFromBody(
+        body,
+        USER_FLOW_DEFAULT_MAX_SESSIONS,
+        USER_FLOW_MAX_SESSIONS,
+      );
+
+      const result: UserFlowJourneysResponseDto =
+        await SessionReplayUserFlowReadService.readJourneys({
+          projectId: projectId,
+          rumApplicationId: rumApplicationId,
+          startTime: startTime,
+          endTime: endTime,
+          maxSessions: maxSessions,
+        });
+
+      return Response.sendJsonObjectResponse(
+        req,
+        res,
+        result as unknown as JSONObject,
+      );
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 // --- Session Replay Manifest Endpoint ---
 
 router.post(

package/Server/API/UserTwoFactorBackupCodeAPI.ts

@@ -219,6 +219,7 @@ export default class UserTwoFactorBackupCodeAPI extends BaseAPI<
     await MailService.sendMail({
       toEmail: user.email,
       subject: "Your OneUptime two factor backup codes were replaced",
+      isSubjectLiteral: true,
       templateType: EmailTemplateType.TwoFactorBackupCodesRegenerated,
       vars: {
         generatedAt: OneUptimeDate.getCurrentDateAsFormattedString(),