@oneuptime/common 14.0.10 → 14.0.11

package/Server/Types/Database/Permissions/CreatePermission.ts

@@ -18,9 +18,10 @@ export default class CreatePermission {
   ): void {
     /*
      * Master admins skip every table-level check below, but not the edition
-     * check: creating enterprise configuration (global SSO/OIDC providers
-     * are only ever created by master admins) needs the license for them
-     * too. Everyone else gets the same check through TablePermission.
+     * check: creating enterprise configuration (a master admin can create
+     * SCIM configuration and team compliance settings on any project) needs
+     * the license for them too. Everyone else gets the same check through
+     * TablePermission.
      */
     if (props.isMasterAdmin && !props.isRoot) {
       EditionPermissions.checkEditionPermissions(
@@ -28,6 +29,12 @@ export default class CreatePermission {
         props,
         DatabaseRequestType.Create,
       );
+      EditionPermissions.checkEnterpriseColumnPermissions(
+        modelType,
+        props,
+        DatabaseRequestType.Create,
+        data,
+      );
     }
 
     // If system is making this query then let the query run!
@@ -44,6 +51,13 @@ export default class CreatePermission {
       DatabaseRequestType.Create,
     );
 
+    EditionPermissions.checkEnterpriseColumnPermissions(
+      modelType,
+      props,
+      DatabaseRequestType.Create,
+      data,
+    );
+
     ColumnPermissions.checkDataColumnPermissions(
       modelType,
       data,

package/Server/Types/Database/Permissions/EditionPermission.ts

@@ -13,15 +13,6 @@ import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 // Whether one column value of an update can only tighten security.
 export type TightenOnlyColumnRule = (value: unknown) => boolean;
 
-/*
- * Switching an identity provider off (isEnabled: false). Switching one on is
- * configuration and needs the license; only the literal false counts, so a
- * value the database might coerce ("false", 0) is judged by the full check.
- */
-const isSwitchingOff: TightenOnlyColumnRule = (value: unknown): boolean => {
-  return value === false;
-};
-
 /*
  * The shortest SCIM bearer token a rotation may set without the license. The
  * Dashboard's "Reset token" generates a UUID (36 characters) and services
@@ -46,10 +37,8 @@ const isRotatedBearerToken: TightenOnlyColumnRule = (
  * incident-response moves. Keyed by table name, like the facade's feature
  * map; a model that is not listed has none.
  *
- *   isEnabled: false   disable an SSO/OIDC provider (project, status page or
- *                      global), or a global provider's attachment to a
- *                      project.
- *   bearerToken        rotate a leaked SCIM bearer token.
+ *   bearerToken        rotate a leaked SCIM bearer token (project or status
+ *                      page SCIM).
  *
  * TeamComplianceSetting has no entry: switching a compliance rule off
  * relaxes it.
@@ -58,14 +47,6 @@ const TIGHTEN_ONLY_UPDATES: ReadonlyMap<
   string,
   Readonly<Record<string, TightenOnlyColumnRule>>
 > = new Map<string, Readonly<Record<string, TightenOnlyColumnRule>>>([
-  ["GlobalSSO", { isEnabled: isSwitchingOff }],
-  ["GlobalOIDC", { isEnabled: isSwitchingOff }],
-  ["GlobalSSOProject", { isEnabled: isSwitchingOff }],
-  ["GlobalOIDCProject", { isEnabled: isSwitchingOff }],
-  ["ProjectSSO", { isEnabled: isSwitchingOff }],
-  ["ProjectOIDC", { isEnabled: isSwitchingOff }],
-  ["StatusPageSSO", { isEnabled: isSwitchingOff }],
-  ["StatusPageOIDC", { isEnabled: isSwitchingOff }],
   ["ProjectSCIM", { bearerToken: isRotatedBearerToken }],
   ["StatusPageSCIM", { bearerToken: isRotatedBearerToken }],
 ]);
@@ -73,29 +54,28 @@ const TIGHTEN_ONLY_UPDATES: ReadonlyMap<
 export default class EditionPermissions {
   /*
    * Gates the enterprise CONFIGURATION models, the ones marked with
-   * @TableEditionAccessControl({ requiresEnterprise: true }): project, global
-   * and status page SSO/OIDC providers, SCIM configurations and team
-   * compliance settings.
+   * @TableEditionAccessControl({ requiresEnterprise: true }): project and
+   * status page SCIM configurations and team compliance settings.
    *
    * Only creating and updating them needs the license. Reading and deleting
    * are always allowed, so an install that dropped to the Community Edition,
    * or whose license lapsed, can still see what it has configured and remove
    * it. Only configuration is gated here, and none of it is ever deleted.
    * Whether what exists RUNS is decided at runtime by
-   * EnterpriseEdition.isFeatureActive: SSO, SCIM and audit logging stop while
-   * a self-hosted license is lapsed and resume when a license is activated.
+   * EnterpriseEdition.isFeatureActive: SCIM and audit logging stop while a
+   * self-hosted license is lapsed and resume when a license is activated.
    *
    * The one kind of update that needs no license either is a TIGHTEN-ONLY
    * update (see TIGHTEN_ONLY_UPDATES): every column it writes is on the
-   * model's list with a value that can only tighten security - disabling an
-   * identity provider, rotating a leaked SCIM bearer token. A lapsed license
-   * must never stand between an administrator and those moves during an
-   * incident. The same holds on the Community Edition, deliberately and for
-   * the same reason reads and deletes do: the move can only reduce what the
-   * configuration allows, and a provider disabled (or a token rotated) there
-   * stays so when the install returns to the Enterprise Edition, instead of
-   * coming back live. Anything else in the same update - even one more
-   * column - makes it an ordinary update, which needs the license.
+   * model's list with a value that can only tighten security - rotating a
+   * leaked SCIM bearer token. A lapsed license must never stand between an
+   * administrator and that move during an incident. The same holds on the
+   * Community Edition, deliberately and for the same reason reads and deletes
+   * do: the move can only reduce what the configuration allows, and a token
+   * rotated there stays rotated when the install returns to the Enterprise
+   * Edition, instead of the leaked one coming back live. Anything else in the
+   * same update - even one more column - makes it an ordinary update, which
+   * needs the license.
    *
    * `updateData` is what the update writes. Only UpdatePermission, which has
    * it, passes it; without it an update is judged by the full check (fail
@@ -103,9 +83,10 @@ export default class EditionPermissions {
    * reason.
    *
    * Master admins are subject to this check - Create/UpdatePermission call it
-   * before their master-admin early return - because the global SSO/OIDC
-   * models are only ever written by master admins and would otherwise never
-   * be gated. Internal root writes (props.isRoot) are never checked.
+   * before their master-admin early return - because a master admin can
+   * write any project's SCIM configuration and team compliance settings, and
+   * those writes would otherwise never be gated. Internal root writes
+   * (props.isRoot) are never checked.
    *
    * On the cloud / billing-enabled deployment enforcement is left to
    * BillingPermission: it already gates these models by the plan tier in
@@ -170,6 +151,127 @@ export default class EditionPermissions {
     }
   }
 
+  /*
+   * Gates enterprise configuration kept in COLUMNS of core models (see
+   * EnterpriseEdition.getEnterpriseColumnsForTableName): the retention
+   * overrides on Project, Service and every telemetry resource.
+   *
+   * A create or update that writes an override - any value retention would
+   * use - needs the column's feature, like a write to an enterprise model
+   * (checkEditionPermissions). Clearing an override (null, an empty value,
+   * or a retention config with no retention in it) never does, for the same
+   * reason reads and deletes of enterprise models never do: an install that
+   * dropped to the Community Edition, or whose license lapsed, must still be
+   * able to remove what it configured. Every other column of the same write
+   * is left to the usual checks.
+   *
+   * Same rules as checkEditionPermissions otherwise: synchronous, internal
+   * root writes are never checked, master admins are, and with billing on
+   * (OneUptime Cloud) the plan gates these columns instead, through their
+   * @ColumnBillingAccessControl.
+   */
+  @CaptureSpan()
+  public static checkEnterpriseColumnPermissions(
+    modelType: DatabaseBaseModelType,
+    props: DatabaseCommonInteractionProps,
+    operation: DatabaseRequestType,
+    data: unknown,
+  ): void {
+    if (IsBillingEnabled) {
+      return;
+    }
+
+    if (props.isRoot) {
+      return;
+    }
+
+    if (
+      operation !== DatabaseRequestType.Create &&
+      operation !== DatabaseRequestType.Update
+    ) {
+      return;
+    }
+
+    for (const feature of EditionPermissions.getEnterpriseFeaturesWritten(
+      new modelType().tableName,
+      data,
+    )) {
+      EnterpriseEdition.assertFeatureAvailableSync(feature);
+    }
+  }
+
+  /*
+   * The features whose enterprise columns this write sets to a value that
+   * takes effect (see isEnterpriseColumnValueSet), without duplicates.
+   * Anything that is not a plain object of columns writes none.
+   */
+  public static getEnterpriseFeaturesWritten(
+    tableName: string | null | undefined,
+    data: unknown,
+  ): Array<EnterpriseFeature> {
+    const columns: Readonly<Record<string, EnterpriseFeature>> | null =
+      EnterpriseEdition.getEnterpriseColumnsForTableName(tableName);
+
+    if (!columns || !data || typeof data !== "object" || Array.isArray(data)) {
+      return [];
+    }
+
+    const features: Array<EnterpriseFeature> = [];
+
+    for (const [column, feature] of Object.entries(columns)) {
+      const value: unknown = (data as Record<string, unknown>)[column];
+
+      if (
+        EditionPermissions.isEnterpriseColumnValueSet(value) &&
+        !features.includes(feature)
+      ) {
+        features.push(feature);
+      }
+    }
+
+    return features;
+  }
+
+  /*
+   * Whether a value written to an enterprise column sets something, as
+   * opposed to clearing it. Retention only ever uses positive numbers
+   * (resolveTelemetryRetentionInDays skips everything else), so a value sets
+   * an override when it is, or contains at any depth, a positive number - or
+   * a string of one, which the API accepts for a number column. null, "",
+   * zero, {} and a retention config whose every entry is blank all clear.
+   */
+  public static isEnterpriseColumnValueSet(value: unknown): boolean {
+    if (value === null || value === undefined) {
+      return false;
+    }
+
+    if (typeof value === "number") {
+      return Number.isFinite(value) && value > 0;
+    }
+
+    if (typeof value === "string") {
+      const trimmed: string = value.trim();
+
+      if (!trimmed) {
+        return false;
+      }
+
+      const parsed: number = Number(trimmed);
+
+      return Number.isFinite(parsed) && parsed > 0;
+    }
+
+    if (typeof value === "object") {
+      return Object.values(value as Record<string, unknown>).some(
+        (entry: unknown): boolean => {
+          return EditionPermissions.isEnterpriseColumnValueSet(entry);
+        },
+      );
+    }
+
+    return false;
+  }
+
   /*
    * True when the update writes at least one column, and every column it
    * writes is on the table's tighten-only list with a value that passes the

package/Server/Types/Database/Permissions/OwnerTableRegistry.ts

@@ -40,6 +40,8 @@ import VMwareVCenterOwnerTeamService from "../../../Services/VMwareVCenterOwnerT
 import VMwareVCenterOwnerUserService from "../../../Services/VMwareVCenterOwnerUserService";
 import DatabaseServerOwnerTeamService from "../../../Services/DatabaseServerOwnerTeamService";
 import DatabaseServerOwnerUserService from "../../../Services/DatabaseServerOwnerUserService";
+import MessageQueueOwnerTeamService from "../../../Services/MessageQueueOwnerTeamService";
+import MessageQueueOwnerUserService from "../../../Services/MessageQueueOwnerUserService";
 import IoTFleetOwnerTeamService from "../../../Services/IoTFleetOwnerTeamService";
 import IoTFleetOwnerUserService from "../../../Services/IoTFleetOwnerUserService";
 import NetworkDeviceOwnerTeamService from "../../../Services/NetworkDeviceOwnerTeamService";
@@ -324,6 +326,20 @@ const ownerTableRegistry: Map<string, OwnerTablePair> = new Map<
       modelService: DatabaseServerService,
     },
   ],
+  [
+    /*
+     * No canOwnTelemetry: a queue owns no telemetry row. Messaging spans and
+     * client metrics belong to the producing or consuming service, and a
+     * queue's telemetry is selected by its entity key (keyForMessageQueue),
+     * never by primaryEntityId - owning a queue grants the queue row alone.
+     */
+    "MessageQueue",
+    {
+      ownerUserService: MessageQueueOwnerUserService,
+      ownerTeamService: MessageQueueOwnerTeamService,
+      fkColumn: "messageQueueId",
+    },
+  ],
   [
     /*
      * IoT telemetry carries the fleet ID in primaryEntityId even though its

package/Server/Types/Database/Permissions/TablePermission.ts

@@ -61,9 +61,9 @@ export default class TablePermission {
      * edition or the license does not allow? (Reads and deletes always pass.)
      * Updates are checked by UpdatePermission.checkUpdatePermissions instead,
      * which every update runs and which sees what the update writes: an
-     * update that only tightens security (disabling an identity provider,
-     * rotating a SCIM token) needs no license, and this check, which is not
-     * handed the data, could only refuse it.
+     * update that only tightens security (rotating a SCIM token) needs no
+     * license, and this check, which is not handed the data, could only
+     * refuse it.
      */
     if (type !== DatabaseRequestType.Update) {
       EditionPermissions.checkEditionPermissions(modelType, props, type);

package/Server/Types/Database/Permissions/UpdatePermission.ts

@@ -39,14 +39,15 @@ export default class UpdatePermission {
     /*
      * The edition check for updates runs here, the one permission entry
      * point that sees what the update writes: an update that only tightens
-     * security (disabling an identity provider, rotating a SCIM token) needs
-     * no license, anything else does (see EditionPermission). TablePermission
-     * leaves updates to this method for that reason.
+     * security (rotating a SCIM token) needs no license, anything else does
+     * (see EditionPermission). TablePermission leaves updates to this method
+     * for that reason.
      *
      * Master admins skip every table-level check below, but not the edition
-     * check: changing enterprise configuration (global SSO/OIDC providers are
-     * only ever edited by master admins) needs the license for them too.
-     * Everyone else gets it right after the table-level check.
+     * check: changing enterprise configuration (a master admin can edit any
+     * project's SCIM configuration and team compliance settings) needs the
+     * license for them too. Everyone else gets it right after the
+     * table-level check.
      */
     if (props.isMasterAdmin && !props.isRoot) {
       EditionPermissions.checkEditionPermissions(
@@ -55,6 +56,12 @@ export default class UpdatePermission {
         DatabaseRequestType.Update,
         data,
       );
+      EditionPermissions.checkEnterpriseColumnPermissions(
+        modelType,
+        props,
+        DatabaseRequestType.Update,
+        data,
+      );
     }
 
     if (props.isRoot || props.isMasterAdmin) {
@@ -75,6 +82,13 @@ export default class UpdatePermission {
       data,
     );
 
+    EditionPermissions.checkEnterpriseColumnPermissions(
+      modelType,
+      props,
+      DatabaseRequestType.Update,
+      data,
+    );
+
     const checkBasePermission: CheckPermissionBaseInterface<TBaseModel> =
       await BasePermission.checkPermissions(
         modelType,

package/Server/Utils/AI/Chat/AgentContextCompactor.ts

@@ -0,0 +1,200 @@
+import { LLMMessage } from "../../LLM/LLMService";
+
+/*
+ * Keeps a long-running agent loop inside the model's context window.
+ *
+ * With no small step budget, an investigation can make many tool calls, and
+ * each result stays in the transcript it resends to the model. Rather than
+ * cap the run, the oldest tool RESULTS are elided once the transcript grows
+ * past a size: the model keeps every question, every call it made (with its
+ * arguments) and every conclusion it wrote, plus the newest results in
+ * full. An elided result keeps its citation id, so a [C#] the model already
+ * wrote stays valid, and the note says how to get the data back (re-run the
+ * call, or read_tool_output for a stored long output).
+ *
+ * Everything here is pure over the message array.
+ */
+
+// Roughly 75–90k tokens of transcript before older results are elided.
+export const DEFAULT_MAX_CONTEXT_CHARS: number = 300_000;
+
+/*
+ * Results are elided oldest first, so the newest stay whole for as long as
+ * the transcript fits with them; the very newest few are never elided.
+ */
+export const MIN_KEEP_RECENT_TOOL_RESULTS: number = 2;
+
+export const ELIDED_TOOL_RESULT_PREFIX: string = "[Earlier tool result elided";
+
+const CITATION_ATTRIBUTE_PATTERN: RegExp = /citation="(C\d+)"/;
+
+export function measureMessageChars(message: LLMMessage): number {
+  let chars: number = (message.content || "").length;
+
+  for (const toolCall of message.toolCalls || []) {
+    try {
+      chars += JSON.stringify(toolCall.arguments || {}).length;
+    } catch {
+      // Unserializable arguments are rare; count the name only.
+    }
+    chars += toolCall.name.length;
+  }
+
+  return chars;
+}
+
+export function measureContextChars(messages: Array<LLMMessage>): number {
+  return messages.reduce((total: number, message: LLMMessage): number => {
+    return total + measureMessageChars(message);
+  }, 0);
+}
+
+export function buildElidedToolResult(originalContent: string): string {
+  const citationMatch: RegExpMatchArray | null = originalContent.match(
+    CITATION_ATTRIBUTE_PATTERN,
+  );
+  const citation: string | undefined = citationMatch?.[1];
+
+  return `${ELIDED_TOOL_RESULT_PREFIX}${
+    citation ? ` (${citation})` : ""
+  } to keep this investigation within the model's context window — it was ${originalContent.length.toLocaleString(
+    "en-US",
+  )} characters. ${
+    citation ? `Citations to ${citation} you already wrote stay valid. ` : ""
+  }If you need this data again, run the call again (or read_tool_output for a long command output).]`;
+}
+
+export interface CompactionResult {
+  elidedCount: number;
+  charsBefore: number;
+  charsAfter: number;
+}
+
+/*
+ * Elide the oldest tool results, in place, until the transcript fits
+ * `maxChars` — never the newest `minKeepRecentToolResults`. System and user
+ * messages and assistant turns are never touched.
+ */
+export function compactAgentContext(
+  messages: Array<LLMMessage>,
+  options?: {
+    maxChars?: number | undefined;
+    minKeepRecentToolResults?: number | undefined;
+  },
+): CompactionResult {
+  const maxChars: number = options?.maxChars ?? DEFAULT_MAX_CONTEXT_CHARS;
+  const minKeep: number = Math.max(
+    0,
+    options?.minKeepRecentToolResults ?? MIN_KEEP_RECENT_TOOL_RESULTS,
+  );
+
+  const charsBefore: number = measureContextChars(messages);
+  let chars: number = charsBefore;
+
+  if (chars <= maxChars) {
+    return { elidedCount: 0, charsBefore, charsAfter: chars };
+  }
+
+  const toolIndexes: Array<number> = [];
+  messages.forEach((message: LLMMessage, index: number): void => {
+    if (message.role === "tool") {
+      toolIndexes.push(index);
+    }
+  });
+
+  // Oldest first, so the newest stay whole as long as they fit.
+  const elidable: Array<number> = toolIndexes.slice(
+    0,
+    Math.max(0, toolIndexes.length - minKeep),
+  );
+
+  let elidedCount: number = 0;
+
+  for (const index of elidable) {
+    if (chars <= maxChars) {
+      break;
+    }
+
+    const message: LLMMessage | undefined = messages[index];
+
+    if (!message || message.content.startsWith(ELIDED_TOOL_RESULT_PREFIX)) {
+      continue;
+    }
+
+    const replacement: string = buildElidedToolResult(message.content);
+
+    // Never "elide" into something longer than what was there.
+    if (replacement.length >= message.content.length) {
+      continue;
+    }
+
+    chars -= message.content.length - replacement.length;
+    messages[index] = { ...message, content: replacement };
+    elidedCount++;
+  }
+
+  return { elidedCount, charsBefore, charsAfter: chars };
+}
+
+/*
+ * When a final answer stops at the output-token limit, the loops ask the
+ * model to continue and join the parts. This is the instruction they send,
+ * and the join keeps the seam clean (no duplicated whitespace, and a part
+ * that restarts with the tail of the previous one is trimmed).
+ */
+export const CONTINUE_ANSWER_INSTRUCTION: string =
+  "Your previous message was cut off by the output length limit. Continue it from EXACTLY where it stopped — do not repeat anything already written, do not add a preamble, and do not request tools.";
+
+export const MAX_ANSWER_CONTINUATIONS: number = 4;
+
+export function joinAnswerContinuation(
+  previous: string,
+  continuation: string,
+): string {
+  if (!previous) {
+    return continuation;
+  }
+
+  if (!continuation) {
+    return previous;
+  }
+
+  /*
+   * Models sometimes restart with the last few words they already wrote.
+   * Trim the longest overlap (bounded) between the end of the previous part
+   * and the start of the continuation.
+   */
+  const maxOverlap: number = Math.min(
+    200,
+    previous.length,
+    continuation.length,
+  );
+
+  for (let overlap: number = maxOverlap; overlap >= 12; overlap--) {
+    if (previous.endsWith(continuation.slice(0, overlap))) {
+      return previous + continuation.slice(overlap);
+    }
+  }
+
+  return previous + continuation;
+}
+
+/*
+ * Why a run is being asked to answer now. "time_limit" only happens when a
+ * project configured one; "step_limit" is the runaway guard.
+ */
+export type AgentWrapUpReason = "time_limit" | "step_limit";
+
+export function buildWrapUpInstruction(reason: AgentWrapUpReason): string {
+  if (reason === "time_limit") {
+    return "The time limit configured for this investigation has been reached. Answer now with the findings so far, clearly stating what you could and could not verify and what you would check next. Do not request more tools.";
+  }
+
+  return "You have made a very large number of calls in this run. Answer now with the findings so far, clearly stating what you could and could not verify and what you would check next. Do not request more tools.";
+}
+
+export function buildSkippedToolCallText(reason: AgentWrapUpReason): string {
+  return reason === "time_limit"
+    ? "Skipped: the time limit configured for this investigation has been reached. Answer with the data you already have."
+    : "Skipped: this run has made a very large number of calls. Answer with the data you already have.";
+}