@oneuptime/common 14.0.10 → 14.0.11

package/Server/Middleware/UserAuthorization.ts

@@ -42,7 +42,6 @@ import Permission, {
 } from "../../Types/Permission";
 import UserType from "../../Types/UserType";
 import UserPermissionUtil from "../Utils/UserPermission/UserPermission";
-import EditionEnforcement from "../Utils/EditionEnforcement";
 
 export default class UserMiddleware {
   /*
@@ -931,21 +930,10 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
-    /*
-     * SSO requirements are enforced while SSO is active: the Enterprise
-     * Edition is loaded and its license covers SSO (or billing is on). The
-     * Community Edition, which has no SSO login routes, and an Enterprise
-     * install whose license lapsed, where those routes refuse, relax them.
-     * Errors and an unknown license state answer "enforce".
-     */
-    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
-
     /*
      * Resolve the SSO requirement and the tenant permission in parallel.
      * `getRequireSsoForLogin` is cached in-process for 60s, so this is
-     * usually free; the tenant permission lookup is the expensive call. It
-     * runs on the Community Edition too: it is also what turns an unknown
-     * project into TenantNotFoundException.
+     * usually free; the tenant permission lookup is the expensive call.
      */
     const [projectRequireSsoForLogin, tenantPermission]: [
       boolean,
@@ -972,9 +960,8 @@ export default class UserMiddleware {
      * can't lock them out — a project's own requireSsoForLogin still applies to
      * them. Only checked when the project doesn't already enforce SSO.
      */
-    let requireSsoForLogin: boolean =
-      isSsoEnforced && projectRequireSsoForLogin;
-    if (isSsoEnforced && !requireSsoForLogin && !isMasterAdmin) {
+    let requireSsoForLogin: boolean = projectRequireSsoForLogin;
+    if (!requireSsoForLogin && !isMasterAdmin) {
       requireSsoForLogin =
         await GlobalConfigService.getRequireSsoForLogin().catch(() => {
           return false;
@@ -1023,23 +1010,15 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
-    /*
-     * Same rule as the single-tenant path: SSO requirements are enforced
-     * while SSO is active and relaxed on the Community Edition and while the
-     * license does not cover SSO. Decided once for the whole fan-out.
-     */
-    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
-
     /*
      * Instance-wide "Require SSO for Login" forces SSO on every project. Master
      * admins are exempt. Resolved once (cached) rather than per project.
      */
-    const globalRequireSsoForLogin: boolean =
-      isMasterAdmin || !isSsoEnforced
-        ? false
-        : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
-            return false;
-          });
+    const globalRequireSsoForLogin: boolean = isMasterAdmin
+      ? false
+      : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
+          return false;
+        });
 
     /*
      * Resolve permissions for every project in parallel. A project's own
@@ -1051,15 +1030,14 @@ export default class UserMiddleware {
       permission: UserTenantAccessPermission | null;
     }> = await Promise.all(
       projectIds.map(async (projectId: ObjectID) => {
-        const projectRequireSsoForLogin: boolean = !isSsoEnforced
-          ? false
-          : await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
-              /*
-               * Unknown/inaccessible project: do not enforce SSO here. Actual
-               * access is still gated by AccessTokenService below.
-               */
-              return false;
-            });
+        const projectRequireSsoForLogin: boolean =
+          await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
+            /*
+             * Unknown/inaccessible project: do not enforce SSO here. Actual
+             * access is still gated by AccessTokenService below.
+             */
+            return false;
+          });
 
         const requireSsoForLogin: boolean =
           projectRequireSsoForLogin || globalRequireSsoForLogin;

package/Server/Services/AIService.ts

@@ -188,7 +188,7 @@ export const LEGACY_AUTONOMOUS_AI_FEATURES: Array<string> = [
 /*
  * Features that run WITHOUT a human in the loop. Incident-linked and
  * alert-linked calls use their respective daily token limits; subjectless
- * calls use Project.aiDailyAutonomousTokenLimit. Interactive chat and
+ * calls have no daily token limit. Interactive chat and
  * explicitly user-triggered AI are never budget-blocked.
  * Auto-postmortem is deliberately excluded for now: it is one call per
  * resolved incident, not storm-shaped; include it when it moves to the queue.
@@ -571,24 +571,23 @@ export class Service extends BaseService {
   ): Promise<AutonomousBudgetStatus> {
     this.assertSingleSubject(subject);
 
+    // Subjectless autonomous work has no daily token limit.
+    if (!subject?.incidentId && !subject?.alertId) {
+      return { exhausted: false, limitInTokens: null, usedTokensToday: 0 };
+    }
+
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
       select: {
-        aiDailyAutonomousTokenLimit: true,
         incidentAiDailyAutonomousTokenLimit: true,
         alertAiDailyAutonomousTokenLimit: true,
       },
       props: { isRoot: true },
     });
 
-    let limitInTokens: number | null =
-      project?.aiDailyAutonomousTokenLimit ?? null;
-
-    if (subject?.incidentId) {
-      limitInTokens = project?.incidentAiDailyAutonomousTokenLimit ?? null;
-    } else if (subject?.alertId) {
-      limitInTokens = project?.alertAiDailyAutonomousTokenLimit ?? null;
-    }
+    const limitInTokens: number | null = subject?.incidentId
+      ? project?.incidentAiDailyAutonomousTokenLimit ?? null
+      : project?.alertAiDailyAutonomousTokenLimit ?? null;
 
     if (limitInTokens === null) {
       return { exhausted: false, limitInTokens: null, usedTokensToday: 0 };
@@ -783,9 +782,7 @@ export class Service extends BaseService {
       if (budget.exhausted) {
         const settingsLocation: string = request.incidentId
           ? "Incidents > AI > Investigation"
-          : request.alertId
-            ? "Alerts > AI > Investigation"
-            : "Project Settings > AI > AI Guardrails";
+          : "Alerts > AI > Investigation";
         const budgetMessage: string = `Daily autonomous AI token budget exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Autonomous AI requests resume tomorrow (UTC) — raise or unset the limit under ${settingsLocation}.`;
 
         logEntry.status = LlmLogStatus.BudgetExceeded;

package/Server/Services/IncidentCustomFieldService.ts

@@ -1,4 +1,5 @@
 import DatabaseService from "./DatabaseService";
+import IncidentFormService from "./IncidentFormService";
 import IncidentService from "./IncidentService";
 import IncidentTemplateService from "./IncidentTemplateService";
 import Model from "../../Models/DatabaseModels/IncidentCustomField";
@@ -9,10 +10,12 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import Dictionary from "../../Types/Dictionary";
 import ObjectID from "../../Types/ObjectID";
 import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
 import QueryHelper from "../Types/Database/QueryHelper";
 import Query from "../Types/Database/Query";
 import UpdateBy from "../Types/Database/UpdateBy";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import logger, { LogAttributes } from "../Utils/Logger";
 import { backfillMappedCustomFieldValues } from "../Utils/CustomField/CustomFieldDefinitionMappingHooks";
 import {
   validateCustomFieldMappingOnCreate,
@@ -33,7 +36,9 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
  *
  *   - its template key (variableKey), made from the name on create and never
  *     changed afterwards, so templates that use {{customFields.<key>}} keep
- *     working whatever the field is renamed to;
+ *     working whatever the field is renamed to - and taken off every
+ *     incident form's questions when the field is deleted (see
+ *     onDeleteSuccess);
  *   - its name, which is what incidents store its values under. Renaming a
  *     field moves those values, and the saved views that name it, to the new
  *     name (see onUpdateSuccess).
@@ -48,6 +53,17 @@ type RenameCarryForward = Dictionary<{
   projectId: ObjectID;
 }> | null;
 
+/*
+ * What onBeforeDelete hands to onDeleteSuccess: each field the delete may
+ * remove, with the project and template key it is known by - read before
+ * the rows are gone.
+ */
+type DeleteCarryForward = Array<{
+  id: string;
+  projectId: ObjectID;
+  variableKey: string;
+}> | null;
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -89,6 +105,100 @@ export class Service extends DatabaseService<Model> {
     return { updateBy, carryForward: carryForward };
   }
 
+  /*
+   * The fields this delete may remove, read while they still exist: once
+   * they are gone, nothing says which forms asked them. As root, and limited
+   * to the caller's project, as prepareRename reads - the delete's own
+   * permission check has not run yet; onDeleteSuccess only acts on the rows
+   * it actually removed.
+   */
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    const query: Query<Model> =
+      !deleteBy.props.isRoot && deleteBy.props.tenantId
+        ? {
+            ...deleteBy.query,
+            projectId: deleteBy.props.tenantId,
+          }
+        : deleteBy.query;
+
+    const fields: Array<Model> = await this.findBy({
+      query: query,
+      select: {
+        _id: true,
+        projectId: true,
+        variableKey: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const carryForward: DeleteCarryForward = [];
+
+    for (const field of fields) {
+      if (field.id && field.projectId && field.variableKey) {
+        carryForward.push({
+          id: field.id.toString(),
+          projectId: field.projectId,
+          variableKey: field.variableKey,
+        });
+      }
+    }
+
+    return { deleteBy, carryForward: carryForward };
+  }
+
+  /*
+   * A deleted field is taken off every incident form of its project (see
+   * IncidentFormService.removeCustomFieldFromQuestions): otherwise a field
+   * created later under the same key would appear on those public forms at
+   * once. Incident templates keep their settings for it, on purpose.
+   *
+   * The field is already gone, so a failure here is logged rather than
+   * thrown: the delete stands either way.
+   */
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<Model>,
+    itemIdsBeforeDelete: Array<ObjectID>,
+  ): Promise<OnDelete<Model>> {
+    const deletedIds: Set<string> = new Set<string>(
+      itemIdsBeforeDelete.map((id: ObjectID): string => {
+        return id.toString();
+      }),
+    );
+
+    for (const field of (onDelete.carryForward as DeleteCarryForward) || []) {
+      if (!deletedIds.has(field.id)) {
+        continue;
+      }
+
+      try {
+        await IncidentFormService.removeCustomFieldFromQuestions({
+          projectId: field.projectId,
+          variableKey: field.variableKey,
+        });
+      } catch (err) {
+        logger.error(
+          `IncidentCustomFieldService: could not take the deleted incident custom field "${field.variableKey}" off the incident forms of project ${field.projectId.toString()}; a field created later with the same key would be asked on them.`,
+          {
+            projectId: field.projectId.toString(),
+          } as LogAttributes,
+        );
+        logger.error(err, {
+          projectId: field.projectId.toString(),
+        } as LogAttributes);
+      }
+    }
+
+    return onDelete;
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<Model>,

package/Server/Services/IncidentEpisodeMemberService.ts

@@ -17,9 +17,29 @@ import { IncidentEpisodeFeedEventType } from "../../Models/DatabaseModels/Incide
 import { IncidentFeedEventType } from "../../Models/DatabaseModels/IncidentFeed";
 import { Yellow500, Green500 } from "../../Types/BrandColors";
 import OneUptimeDate from "../../Types/Date";
+import { escapeMarkdownValue } from "../../Utils/Markdown/MarkdownEscape";
 import IncidentService from "./IncidentService";
 import IncidentEpisodeService from "./IncidentEpisodeService";
 
+/*
+ * An incident's or an episode's title is plain text - an incident's is typed
+ * by whoever declared it, which is anyone holding an incident form's link,
+ * and an episode's is often copied from its first incident's - and the feed
+ * items below place it into Markdown that the dashboard renders without its
+ * safe mode and that is posted to Slack and Teams. Escaped as MarkdownEscape
+ * says a title must be (as the incident's own "Incident Created" item does),
+ * so "![](https://tracker...)" is not fetched and "[Reset your password](...)"
+ * is not a link that hides where it goes, while an ordinary title reads as
+ * typed.
+ */
+type GetFeedTitleFunction = (title: string | undefined | null) => string;
+
+const getFeedTitle: GetFeedTitleFunction = (
+  title: string | undefined | null,
+): string => {
+  return escapeMarkdownValue(title || "No title");
+};
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -174,7 +194,7 @@ export class Service extends DatabaseService<Model> {
       projectId: createdItem.projectId,
       incidentEpisodeFeedEventType: IncidentEpisodeFeedEventType.IncidentAdded,
       displayColor: Yellow500,
-      feedInfoInMarkdown: `**Incident ${incident?.incidentNumberWithPrefix || "#" + (incident?.incidentNumber || "N/A")}** added to episode: ${incident?.title || "No title"}`,
+      feedInfoInMarkdown: `**Incident ${incident?.incidentNumberWithPrefix || "#" + (incident?.incidentNumber || "N/A")}** added to episode: ${getFeedTitle(incident?.title)}`,
       userId: createdItem.addedByUserId || undefined,
       workspaceNotification: {
         sendWorkspaceNotification: true,
@@ -188,7 +208,7 @@ export class Service extends DatabaseService<Model> {
       projectId: createdItem.projectId,
       incidentFeedEventType: IncidentFeedEventType.IncidentUpdated,
       displayColor: Yellow500,
-      feedInfoInMarkdown: `Added to **Episode ${episode?.episodeNumberWithPrefix || "#" + (episode?.episodeNumber || "N/A")}**: ${episode?.title || "No title"}`,
+      feedInfoInMarkdown: `Added to **Episode ${episode?.episodeNumberWithPrefix || "#" + (episode?.episodeNumber || "N/A")}**: ${getFeedTitle(episode?.title)}`,
       userId: createdItem.addedByUserId || undefined,
     });
 
@@ -277,7 +297,7 @@ export class Service extends DatabaseService<Model> {
               incidentEpisodeFeedEventType:
                 IncidentEpisodeFeedEventType.IncidentRemoved,
               displayColor: Green500,
-              feedInfoInMarkdown: `**Incident ${incident?.incidentNumberWithPrefix || "#" + (incident?.incidentNumber || "N/A")}** removed from episode: ${incident?.title || "No title"}`,
+              feedInfoInMarkdown: `**Incident ${incident?.incidentNumberWithPrefix || "#" + (incident?.incidentNumber || "N/A")}** removed from episode: ${getFeedTitle(incident?.title)}`,
               workspaceNotification: {
                 sendWorkspaceNotification: true,
               },
@@ -289,7 +309,7 @@ export class Service extends DatabaseService<Model> {
               projectId: member.projectId,
               incidentFeedEventType: IncidentFeedEventType.IncidentUpdated,
               displayColor: Green500,
-              feedInfoInMarkdown: `Removed from **Episode ${episode?.episodeNumberWithPrefix || "#" + (episode?.episodeNumber || "N/A")}**: ${episode?.title || "No title"}`,
+              feedInfoInMarkdown: `Removed from **Episode ${episode?.episodeNumberWithPrefix || "#" + (episode?.episodeNumber || "N/A")}**: ${getFeedTitle(episode?.title)}`,
             });
           }
         }

package/Server/Services/IncidentEpisodeService.ts

@@ -14,6 +14,7 @@ import Model from "../../Models/DatabaseModels/IncidentEpisode";
 import IncidentState from "../../Models/DatabaseModels/IncidentState";
 import IncidentSeverity from "../../Models/DatabaseModels/IncidentSeverity";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import { escapeMarkdownValue } from "../../Utils/Markdown/MarkdownEscape";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import SubscriberNotificationResendAccess from "../Utils/StatusPage/SubscriberNotificationResendAccess";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -468,9 +469,17 @@ export class Service extends DatabaseService<Model> {
       return;
     }
 
+    /*
+     * The title is plain text, often copied from the episode's first
+     * incident - whose title anyone holding an incident form's link may
+     * have typed - placed into Markdown the dashboard renders without its
+     * safe mode and posts to Slack and Teams. Escaped as MarkdownEscape
+     * says a title must be, so it cannot become an image, raw HTML or a
+     * link that hides where it goes. The description stays Markdown.
+     */
     let feedInfoInMarkdown: string = `#### Episode ${episode.episodeNumberWithPrefix || "#" + episode.episodeNumber?.toString()} Created
 
-**${episode.title || "No title provided."}**
+**${escapeMarkdownValue(episode.title || "No title provided.")}**
 
 `;