@oneuptime/common 14.0.1 → 14.0.3

package/Types/AutoRemediation/AiRemediationCommandPlan.ts

@@ -1,5 +1,9 @@
 import RunbookStepType from "../Runbook/RunbookStepType";
 import { JSONObject } from "../JSON";
+import {
+  KubectlCommandTier,
+  PROTECTED_KUBERNETES_NAMESPACES,
+} from "../Kubernetes/KubernetesClusterAiAccess";
 
 /*
  * The AI-composed command plan stored on
@@ -11,14 +15,15 @@ import { JSONObject } from "../JSON";
  */
 
 /*
- * The only step types an AI remediation run may compose. Kubernetes stays
- * runbook-only: its structured restart/scale actions cannot express an
- * arbitrary command, which is the whole point of this lane, and operators
- * who want kubectl can expose it to a Bash command instead.
+ * The only step types an AI remediation run may compose. The structured
+ * Kubernetes step (restart/scale) stays runbook-only; AI reaches a cluster
+ * through the Kubectl step instead, whose argv is tiered by KubectlPolicy
+ * and which targets a Runner the cluster's AI page bound.
  */
 export const AI_COMMAND_STEP_TYPES: Array<RunbookStepType> = [
   RunbookStepType.Bash,
   RunbookStepType.SSH,
+  RunbookStepType.Kubectl,
 ];
 
 export enum AiRemediationCommandPolicyVerdict {
@@ -41,7 +46,12 @@ export enum AiRemediationCommandExecutionStatus {
   Running = "Running",
   Succeeded = "Succeeded",
   Failed = "Failed",
-  // An earlier command in the plan failed, so this one never ran.
+  /*
+   * Never ran: an earlier command in the plan failed, the remediation was
+   * settled before this command's turn, or — for a rollback — the cluster
+   * no longer allowed the undo to run unattended, so a human was told to
+   * undo it instead.
+   */
   Skipped = "Skipped",
 }
 
@@ -79,6 +89,14 @@ export interface AiRemediationCommand {
   runnerNameSnapshot: string;
   credentialId?: string | undefined;
   credentialNameSnapshot?: string | undefined;
+  /*
+   * Kubectl only: the cluster the command runs against and the tier
+   * KubectlPolicy assigned when the plan was composed. The tier is
+   * informational on the card; execution re-evaluates it.
+   */
+  kubernetesClusterId?: string | undefined;
+  kubernetesClusterNameSnapshot?: string | undefined;
+  kubectlTier?: KubectlCommandTier | undefined;
   command: string;
   timeoutInMs: number;
   // Why the AI wants to run this — shown verbatim on the approval card.
@@ -108,6 +126,62 @@ export interface AiRemediationCommandPlan {
   executionStartedAt?: string | undefined;
   executionCompletedAt?: string | undefined;
   rollbackStatus?: AiRemediationRollbackStatus | undefined;
+  /*
+   * ISO 8601. Written by the rollback arm when it starts and refreshed
+   * before every step it waits on, until rollbackStatus settles. A Failed
+   * verification whose rollback never settled and whose heartbeat went
+   * stale was interrupted (a Worker restart mid-rollback): the verifier's
+   * recovery sweep resumes it instead of leaving the cluster half-reverted.
+   */
+  rollbackHeartbeatAt?: string | undefined;
+}
+
+/*
+ * A command's execution record has reached an outcome. Pending and Running
+ * records may still change: the job they name can finish later.
+ */
+export function isSettledCommandExecutionStatus(
+  status: AiRemediationCommandExecutionStatus | undefined,
+): boolean {
+  return (
+    status === AiRemediationCommandExecutionStatus.Succeeded ||
+    status === AiRemediationCommandExecutionStatus.Failed ||
+    status === AiRemediationCommandExecutionStatus.Skipped
+  );
+}
+
+/*
+ * RunnerJob.stepId prefixes of the three ways a plan's commands reach a
+ * Runner: executed INLINE by a FullAuto run while it plans, executed by the
+ * approved-plan executor after a human's click, or run by the rollback arm
+ * after verification failed. The per-cluster circuit breaker counts inline
+ * kubectl jobs by the first; the rollback arm resolves an interrupted
+ * command through the prefix its lane used when the job id never reached
+ * the command's record. Spelled out here, once, so the lanes never drift.
+ */
+export const INLINE_COMMAND_STEP_ID_PREFIX: string = "ai-command-";
+export const APPROVED_COMMAND_STEP_ID_PREFIX: string = "ai-approved-";
+export const ROLLBACK_COMMAND_STEP_ID_PREFIX: string = "ai-rollback-";
+
+/*
+ * The stepId the FORWARD job of a command carries: inline when a FullAuto
+ * run executed it while planning, approved otherwise. Unique per suggestion
+ * — a plan executes at most once and a retried run never re-executes.
+ */
+export function getForwardCommandStepId(
+  command: Pick<AiRemediationCommand, "sequence" | "wasAutoExecuted">,
+): string {
+  return `${
+    command.wasAutoExecuted === true
+      ? INLINE_COMMAND_STEP_ID_PREFIX
+      : APPROVED_COMMAND_STEP_ID_PREFIX
+  }${command.sequence}`;
+}
+
+export function getRollbackCommandStepId(
+  command: Pick<AiRemediationCommand, "sequence">,
+): string {
+  return `${ROLLBACK_COMMAND_STEP_ID_PREFIX}${command.sequence}`;
 }
 
 // Hard caps — enforced at plan acceptance, not just in the prompt.
@@ -117,6 +191,103 @@ export const MIN_COMMAND_TIMEOUT_MS: number = 1000;
 export const MAX_COMMAND_TIMEOUT_MS: number = 5 * 60 * 1000;
 export const DEFAULT_COMMAND_TIMEOUT_MS: number = 60 * 1000;
 
+/*
+ * The kubectl tiers and the unattended cluster modes in the words every
+ * remediation prompt, tool description and feed item uses. They restate the
+ * KubectlCommandTier and KubernetesAiRemediationMode doc comments in
+ * Types/Kubernetes/KubernetesClusterAiAccess and must keep matching them —
+ * and the policy (KubectlPolicy), which is what actually decides. One copy,
+ * so a prompt can never describe a tier the policy no longer has.
+ */
+
+/*
+ * Each summary that names a node operation also comes without it, for a
+ * cluster whose Runner reported node operations off
+ * (aiAccess.remediation.nodeOperations=false): that Runner refuses every
+ * node operation, approved or not, so the model is never offered one there
+ * (list_command_targets and the cluster round's prompt). The constants are
+ * the full wording.
+ */
+export interface KubectlChangeSummaryOptions {
+  allowNodeOperations: boolean;
+}
+
+// SafeWrite: what an Automatic cluster runs without a human.
+export function getKubectlSafeChangesSummary(
+  options: KubectlChangeSummaryOptions,
+): string {
+  return `rollout restart/undo/pause/resume of one workload, scale of one workload to a non-zero replica count, delete of one named pod, ${
+    options.allowNodeOperations ? "cordon/uncordon of one node, " : ""
+  }and label/annotate of one pod or workload with unreserved keys — each on exactly ONE named object (TYPE/NAME, e.g. deployment/web), never a selector, --all, several names or a bare kind`;
+}
+
+// RiskyWrite: needs a human unless the allowlist names it or approvals are bypassed.
+export function getKubectlRiskierChangesSummary(
+  options: KubectlChangeSummaryOptions,
+): string {
+  return `patch, set image/env/resources, ${
+    options.allowNodeOperations ? "drain, taint, " : ""
+  }scale to zero, deleting a workload or a job, create job --from=cronjob/<name>, and any change that touches several objects at once`;
+}
+
+/*
+ * Asks a human whatever the cluster's mode, allowlist included: a
+ * protected-namespace write, and — where the Runner may change nodes at
+ * all — a node drain, a node taint and a patch of a Node (the canonical
+ * mode text in KubernetesClusterAiAccess).
+ */
+export function getKubectlAlwaysAsksSummary(
+  options: KubectlChangeSummaryOptions,
+): string {
+  return `a write in a protected namespace (${PROTECTED_KUBERNETES_NAMESPACES.join(
+    ", ",
+  )})${
+    options.allowNodeOperations
+      ? ", a node drain, a node taint and a patch of a Node always need"
+      : " always needs"
+  } a human, in every mode — Bypass approval and the allowlist included`;
+}
+
+export const KUBECTL_SAFE_CHANGES_SUMMARY: string =
+  getKubectlSafeChangesSummary({ allowNodeOperations: true });
+
+export const KUBECTL_RISKIER_CHANGES_SUMMARY: string =
+  getKubectlRiskierChangesSummary({ allowNodeOperations: true });
+
+export const KUBECTL_ALWAYS_ASKS_SUMMARY: string = getKubectlAlwaysAsksSummary({
+  allowNodeOperations: true,
+});
+
+// Denied: never runs, whoever approves it.
+export const KUBECTL_NEVER_RUNS_SUMMARY: string =
+  "destructive commands never run, even with approval: exec, cp, port-forward, run, apply, edit, deleting namespaces/volumes/nodes/secrets/CRDs, any write to RBAC, admission-webhook or API-extension objects, create deployment/cronjob/job with --image, and a patch whose body is not JSON or that changes a pod's identity, privileges, host access, Secrets or command";
+
+// How the cluster's allowlist is read.
+export const KUBECTL_ALLOWLIST_SUMMARY: string =
+  "the cluster's kubectl allowlist is matched token by token: a pattern must have exactly as many tokens as the command, a * matches within one token only, and a flag must be spelled as the pattern spells it";
+
+export function getKubectlAutomaticModeSummary(
+  options: KubectlChangeSummaryOptions,
+): string {
+  return `Automatic: safe changes run without a human (${getKubectlSafeChangesSummary(
+    options,
+  )}). A riskier change (${getKubectlRiskierChangesSummary(
+    options,
+  )}) never runs without one: when the round could only find riskier fixes it ends by proposing exactly those for one-click approval; when it also ran safe fixes, a riskier fix is proposed only if verification shows the safe ones did not recover the signal (the follow-up round, which asks). Shapes on the cluster's kubectl allowlist run on their own.`;
+}
+
+export const KUBECTL_AUTOMATIC_MODE_SUMMARY: string =
+  getKubectlAutomaticModeSummary({ allowNodeOperations: true });
+
+/*
+ * Interpolated into prompts and feed copy on its own, so it names the
+ * exceptions instead of pointing at a list "below".
+ */
+export const KUBECTL_BYPASS_MODE_SUMMARY: string =
+  "Bypass approval: AI does not ask. Every change the policy allows — safe AND riskier — runs on its own, follow-up rounds included, except for what always needs a human.";
+
+export const KUBECTL_EVERY_MODE_LIMITS_SUMMARY: string = `In every mode, Bypass approval included: ${KUBECTL_NEVER_RUNS_SUMMARY}; ${KUBECTL_ALWAYS_ASKS_SUMMARY}; the cluster's in-cluster Runner never changes its own namespace, nor a namespace outside the ones its chart lets it change, nor nodes when its chart turned node operations off; and an unattended run becomes a proposal when the hourly per-cluster circuit breaker trips or another unattended round already holds the cluster.`;
+
 export class AiRemediationCommandPlanUtil {
   /*
    * Parse a jsonb column value back into a typed plan. Fail-closed: any
@@ -171,6 +342,21 @@ export class AiRemediationCommandPlanUtil {
         return null;
       }
 
+      if (
+        stepType === RunbookStepType.Kubectl &&
+        (typeof obj["kubernetesClusterId"] !== "string" ||
+          !obj["kubernetesClusterId"].trim())
+      ) {
+        return null;
+      }
+
+      const kubectlTierRaw: string = String(obj["kubectlTier"] || "");
+      const kubectlTier: KubectlCommandTier | undefined = Object.values(
+        KubectlCommandTier,
+      ).includes(kubectlTierRaw as KubectlCommandTier)
+        ? (kubectlTierRaw as KubectlCommandTier)
+        : undefined;
+
       const verdict: string = String(obj["policyVerdict"] || "");
       if (
         verdict !== AiRemediationCommandPolicyVerdict.AutoApproved &&
@@ -208,6 +394,15 @@ export class AiRemediationCommandPlanUtil {
           typeof obj["credentialNameSnapshot"] === "string"
             ? obj["credentialNameSnapshot"]
             : undefined,
+        kubernetesClusterId:
+          typeof obj["kubernetesClusterId"] === "string"
+            ? obj["kubernetesClusterId"]
+            : undefined,
+        kubernetesClusterNameSnapshot:
+          typeof obj["kubernetesClusterNameSnapshot"] === "string"
+            ? obj["kubernetesClusterNameSnapshot"]
+            : undefined,
+        kubectlTier,
         command: command,
         timeoutInMs: timeoutInMs,
         rationale: typeof obj["rationale"] === "string" ? obj["rationale"] : "",
@@ -261,6 +456,9 @@ export class AiRemediationCommandPlanUtil {
     ) {
       plan.rollbackStatus = rollbackStatus as AiRemediationRollbackStatus;
     }
+    if (typeof json["rollbackHeartbeatAt"] === "string") {
+      plan.rollbackHeartbeatAt = json["rollbackHeartbeatAt"];
+    }
 
     return plan;
   }

package/Types/Date.ts

@@ -5,6 +5,7 @@ import { JSONObject, ObjectType } from "./JSON";
 import PositiveNumber from "./PositiveNumber";
 import moment from "moment-timezone";
 import Timezone from "./Timezone";
+import TimezoneAlias from "./TimezoneAlias";
 import Zod, { ZodSchema } from "../Utils/Schema/Zod";
 
 export const Moment: typeof moment = moment;
@@ -55,10 +56,30 @@ export default class OneUptimeDate {
   }
 
   private static getLocalShortMonthName(date: Date): string {
-    return date.toLocaleString("default", {
-      month: "short",
-      timeZone: this.getCurrentTimezone().toString(),
-    });
+    /*
+     * The browser's Intl can be older than the zone name: an engine with
+     * tzdata before 2022b throws a RangeError for "Europe/Kyiv", which is
+     * what getCurrentTimezone reports for a browser that says "Europe/Kiev".
+     * Try the zone's legacy spellings next, which such an engine knows, and
+     * finally moment, which carries its own zone data.
+     */
+    const timezone: Timezone = this.getCurrentTimezone();
+
+    for (const name of [
+      timezone,
+      ...TimezoneAlias.getLegacyNamesOf(timezone),
+    ]) {
+      try {
+        return date.toLocaleString("default", {
+          month: "short",
+          timeZone: name.toString(),
+        });
+      } catch {
+        // Unknown to this engine's Intl; try the next spelling.
+      }
+    }
+
+    return this.inCurrentTimezone(date).format("MMM");
   }
 
   public static getSchema(): ZodSchema {
@@ -487,6 +508,10 @@ export default class OneUptimeDate {
    * for the schedule's timezone even though the time picker captured it in the
    * viewer's own zone (audit F1). Inverse of
    * getLocalDateFromWallClockInTimezone.
+   *
+   * Only for widgets that read Dates through the current timezone, as the
+   * datetime-local Input and the TimePicker do. A widget that reads a Date's
+   * browser-local wall clock needs getInstantFromBrowserLocalWallClockInTimezone.
    */
   public static getInstantFromLocalWallClockInTimezone(
     date: Date | string,
@@ -513,6 +538,10 @@ export default class OneUptimeDate {
    * wall-clock IN THE CURRENT TIMEZONE equals `date`'s wall-clock as seen in
    * `timezone`. Used to display a stored schedule-timezone time inside a picker
    * that renders in the viewer's own zone (audit F1).
+   *
+   * Only for widgets that read Dates through the current timezone. A widget
+   * that draws a Date at its browser-local wall clock needs
+   * getBrowserLocalDateFromWallClockInTimezone.
    */
   public static getLocalDateFromWallClockInTimezone(
     date: Date | string,
@@ -535,6 +564,62 @@ export default class OneUptimeDate {
       .toDate();
   }
 
+  /**
+   * The browser-zone twin of getLocalDateFromWallClockInTimezone: return a Date
+   * whose BROWSER-LOCAL wall clock (getHours() and so on) equals `date`'s wall
+   * clock in `timezone`.
+   *
+   * For widgets that draw a Date at its browser-local wall clock and know
+   * nothing of the user's configured zone, such as react-big-calendar with the
+   * plain moment localizer. getLocalDateFromWallClockInTimezone builds the wall
+   * clock in the CURRENT timezone, which is the user's User Settings zone when
+   * one is set. When that differs from the browser's zone, the widget draws
+   * every Date off by the difference between the two. Inverse of
+   * getInstantFromBrowserLocalWallClockInTimezone.
+   */
+  public static getBrowserLocalDateFromWallClockInTimezone(
+    date: Date | string,
+    timezone: string,
+  ): Date {
+    date = this.fromString(date);
+    const zoned: moment.Moment = moment.tz(date, timezone);
+    return new Date(
+      zoned.year(),
+      zoned.month(),
+      zoned.date(),
+      zoned.hour(),
+      zoned.minute(),
+      zoned.second(),
+    );
+  }
+
+  /**
+   * The browser-zone twin of getInstantFromLocalWallClockInTimezone: read
+   * `date`'s BROWSER-LOCAL wall clock and return the instant that same wall
+   * clock names in `timezone`. For turning a Date a browser-local widget
+   * reported (a range react-big-calendar shows, say) back into an instant.
+   * Inverse of getBrowserLocalDateFromWallClockInTimezone.
+   */
+  public static getInstantFromBrowserLocalWallClockInTimezone(
+    date: Date | string,
+    timezone: string,
+  ): Date {
+    date = this.fromString(date);
+    return moment
+      .tz(
+        {
+          year: date.getFullYear(),
+          month: date.getMonth(),
+          day: date.getDate(),
+          hour: date.getHours(),
+          minute: date.getMinutes(),
+          second: date.getSeconds(),
+        },
+        timezone,
+      )
+      .toDate();
+  }
+
   public static isOverlapping(
     start: Date,
     end: Date,
@@ -2139,26 +2224,55 @@ export default class OneUptimeDate {
    * the timezone they configured — even when the machine, OS or VPN they are
    * on reports a different one. Pass null to fall back to the browser zone
    * (signed-out surfaces, or a user who has not picked a timezone).
+   *
+   * A legacy name is kept as its current name ("Asia/Calcutta" as
+   * "Asia/Kolkata" — see TimezoneAlias), which is the name the picker
+   * offers and the one getUserTimezone reports.
    */
   public static setUserTimezone(timezone: Timezone | null | undefined): void {
+    if (!timezone || typeof timezone !== "string") {
+      this.userTimezone = null;
+      return;
+    }
+
+    /*
+     * Translate before checking with moment. The saved value can be one an
+     * older build cached in the browser, and one of those, US/Pacific-New,
+     * has been removed from tzdata: moment no longer resolves it, but it is
+     * still Los Angeles, not a reason to drop the user's zone.
+     */
+    const currentTimezone: Timezone =
+      TimezoneAlias.getCanonicalTimezone(timezone);
+
     /*
      * Ignore anything moment does not recognise as an IANA zone. A stale or
      * corrupt saved value must not take every date in the UI down with it.
      */
-    if (!timezone || !moment.tz.zone(timezone.toString())) {
+    if (!moment.tz.zone(currentTimezone.toString())) {
       this.userTimezone = null;
       return;
     }
 
-    this.userTimezone = timezone;
+    this.userTimezone = currentTimezone;
   }
 
   public static getUserTimezone(): Timezone | null {
     return this.userTimezone;
   }
 
+  /**
+   * The zone every "local" helper reads: the user's own, else the one the
+   * browser / process reports, in its current name. Chromium reports the
+   * ICU spelling of many zones (Asia/Calcutta, Europe/Kiev, Asia/Saigon),
+   * and this guess is what the dashboard saves to a new user's profile and
+   * pre-selects in the on-call schedule pickers — neither of which offers
+   * the legacy name. Called on every date format, so it stays a lookup:
+   * moment caches its guess, and the translation is a map read.
+   */
   public static getCurrentTimezone(): Timezone {
-    return this.userTimezone || (moment.tz.guess() as Timezone);
+    return (
+      this.userTimezone || TimezoneAlias.getCanonicalTimezone(moment.tz.guess())
+    );
   }
 
   /**

package/Types/Email/EmailMessage.ts

@@ -5,6 +5,14 @@ import EmailTemplateType from "./EmailTemplateType";
 
 export interface EmailEnvelope {
   subject: string;
+  /*
+   * The subject is final text, not a Handlebars template. Without this the
+   * mailer compiles the subject against `vars`, which is what a template
+   * subject needs but breaks a subject already rendered from user-authored
+   * text: an incident description quoting "{{ .Values.image.tag }}" fails to
+   * parse, so the email is never sent, and "{{ x }}" renders as nothing.
+   */
+  isSubjectLiteral?: boolean | undefined;
   templateType?: EmailTemplateType;
   vars: Dictionary<string | JSONObject>;
   body?: string;

package/Types/Email/EmailTemplateType.ts

@@ -37,6 +37,7 @@ enum EmailTemplateType {
   MonitorOwnerAdded = "MonitorOwnerAdded.hbs",
   MonitorOwnerResourceCreated = "MonitorOwnerResourceCreated.hbs",
   MonitorProbesStatus = "MonitorProbesStatus.hbs",
+  MonitorsAffectedByProbeStatus = "MonitorsAffectedByProbeStatus.hbs",
   MonitorOwnerStatusChanged = "MonitorOwnerStatusChanged.hbs",
 
   SloOwnerStatusChanged = "SloOwnerStatusChanged.hbs",

package/Types/Exception/ExceptionMessages.ts

@@ -1,6 +1,7 @@
 enum ExceptionMessages {
   MonitorNotFound = "Monitor not found.",
   MonitorDisabled = "Monitor is disabled. Please enable it to start monitoring again.",
+  UserBlocked = "Your account has been blocked. Please contact your administrator.",
 }
 
 export default ExceptionMessages;

package/Types/Incident/IncidentAlertLink.ts

@@ -0,0 +1,38 @@
+/*
+ * Shared between the dashboard and the server for linking alerts to incidents
+ * (the IncidentAlert model).
+ */
+
+/*
+ * Declaring an incident from alerts sends the alert ids along with the
+ * incident as `miscDataProps[INCIDENT_ALERT_IDS_TO_LINK_KEY]` (an array of id
+ * strings). IncidentService validates them before the incident is created and
+ * links them once it exists, so API clients get the same one-request flow as
+ * the dashboard.
+ */
+export const INCIDENT_ALERT_IDS_TO_LINK_KEY: string = "alertIdsToLink";
+
+/*
+ * The create-incident page reads the alerts to declare an incident from out of
+ * this query string parameter, as a comma separated list of alert ids.
+ */
+export const INCIDENT_CREATE_ALERT_IDS_QUERY_PARAM: string = "alertIds";
+
+/*
+ * The most alerts one action can link to an incident: declaring an incident
+ * from alerts, or linking a selection of alerts from the alerts table. Every
+ * link writes a feed entry on the incident and the alert, and the incident's
+ * entry is posted to its Slack / Microsoft Teams channels, so an unbounded
+ * "select all" would flood both. It also keeps the alert ids within what a URL
+ * can carry.
+ */
+export const MAX_ALERTS_PER_INCIDENT_LINK_ACTION: number = 50;
+
+/*
+ * What linking a pair that is already linked answers with - whether the
+ * duplicate is caught by the model's unique-together check or, when two
+ * requests race past it, by the unique index itself. The dashboard counts a
+ * link that fails with this message as done.
+ */
+export const INCIDENT_ALERT_ALREADY_LINKED_MESSAGE: string =
+  "This alert is already linked to this incident.";