@oneuptime/common 14.0.10 → 14.0.12

package/Server/Services/AIService.ts

@@ -188,7 +188,7 @@ export const LEGACY_AUTONOMOUS_AI_FEATURES: Array<string> = [
 /*
  * Features that run WITHOUT a human in the loop. Incident-linked and
  * alert-linked calls use their respective daily token limits; subjectless
- * calls use Project.aiDailyAutonomousTokenLimit. Interactive chat and
+ * calls have no daily token limit. Interactive chat and
  * explicitly user-triggered AI are never budget-blocked.
  * Auto-postmortem is deliberately excluded for now: it is one call per
  * resolved incident, not storm-shaped; include it when it moves to the queue.
@@ -571,24 +571,23 @@ export class Service extends BaseService {
   ): Promise<AutonomousBudgetStatus> {
     this.assertSingleSubject(subject);
 
+    // Subjectless autonomous work has no daily token limit.
+    if (!subject?.incidentId && !subject?.alertId) {
+      return { exhausted: false, limitInTokens: null, usedTokensToday: 0 };
+    }
+
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
       select: {
-        aiDailyAutonomousTokenLimit: true,
         incidentAiDailyAutonomousTokenLimit: true,
         alertAiDailyAutonomousTokenLimit: true,
       },
       props: { isRoot: true },
     });
 
-    let limitInTokens: number | null =
-      project?.aiDailyAutonomousTokenLimit ?? null;
-
-    if (subject?.incidentId) {
-      limitInTokens = project?.incidentAiDailyAutonomousTokenLimit ?? null;
-    } else if (subject?.alertId) {
-      limitInTokens = project?.alertAiDailyAutonomousTokenLimit ?? null;
-    }
+    const limitInTokens: number | null = subject?.incidentId
+      ? project?.incidentAiDailyAutonomousTokenLimit ?? null
+      : project?.alertAiDailyAutonomousTokenLimit ?? null;
 
     if (limitInTokens === null) {
       return { exhausted: false, limitInTokens: null, usedTokensToday: 0 };
@@ -782,10 +781,8 @@ export class Service extends BaseService {
 
       if (budget.exhausted) {
         const settingsLocation: string = request.incidentId
-          ? "Incidents > AI > Investigation"
-          : request.alertId
-            ? "Alerts > AI > Investigation"
-            : "Project Settings > AI > AI Guardrails";
+          ? "Incidents > Settings > AI"
+          : "Alerts > Settings > AI";
         const budgetMessage: string = `Daily autonomous AI token budget exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Autonomous AI requests resume tomorrow (UTC) — raise or unset the limit under ${settingsLocation}.`;
 
         logEntry.status = LlmLogStatus.BudgetExceeded;

package/Server/Services/AnalyticsDatabaseService.ts

@@ -56,6 +56,7 @@ import Route from "../../Types/API/Route";
 import URL from "../../Types/API/URL";
 import AnalyticsTableColumn from "../../Types/AnalyticsDatabase/TableColumn";
 import TableColumnType from "../../Types/AnalyticsDatabase/TableColumnType";
+import DatabaseCommonInteractionPropsUtil from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import OneUptimeDate from "../../Types/Date";
 import BadDataException from "../../Types/Exception/BadDataException";
@@ -1200,13 +1201,16 @@ export default class AnalyticsDatabaseService<
   }
 
   /**
-   * Read-side retention filter. TTL is `retentionDate DELETE` with
-   * ttl_only_drop_parts=1, so a part survives until EVERY row in it has
-   * expired — rows past their per-service retention stay on disk (and
-   * were queryable) for up to a partition's worth of extra time. For
+   * Read-side retention filter. TTL deletes rows by `retentionDate`, and
+   * ClickHouse applies it only when it merges: on a table with
+   * ttl_only_drop_parts=1 a part survives until EVERY row in it has
+   * expired, and on the metric and log tables, whose TTL is rounded up
+   * to the midnight after retentionDate (RetentionTtl), an expired row
+   * survives until that midnight - up to a day. Either way rows past
+   * their retention stay on disk (and were queryable) for a while. For
    * models that carry a retentionDate column, every centrally generated
    * read appends this predicate so expired rows become invisible the
-   * moment they expire rather than when their part finally drops.
+   * moment they expire rather than when they are finally removed.
    *
    * Returns the raw SQL fragment (server-evaluated now(), no parameter)
    * or "" when the model has no retentionDate column.
@@ -1904,6 +1908,11 @@ export default class AnalyticsDatabaseService<
 
   private async _deleteBy(deleteBy: DeleteBy<TBaseModel>): Promise<void> {
     try {
+      // Refused before any hook runs; see assertCredentialCanWrite.
+      DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(
+        deleteBy.props,
+      );
+
       const onDelete: OnDelete<TBaseModel> = deleteBy.props.ignoreHooks
         ? { deleteBy, carryForward: [] }
         : await this.onBeforeDelete(deleteBy);
@@ -1965,6 +1974,11 @@ export default class AnalyticsDatabaseService<
 
   private async _updateBy(updateBy: UpdateBy<TBaseModel>): Promise<void> {
     try {
+      // Refused before any hook runs; see assertCredentialCanWrite.
+      DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(
+        updateBy.props,
+      );
+
       const onUpdate: OnUpdate<TBaseModel> = updateBy.props.ignoreHooks
         ? { updateBy, carryForward: [] }
         : await this.onBeforeUpdate(updateBy);
@@ -2222,6 +2236,9 @@ export default class AnalyticsDatabaseService<
   public async createMany(
     createBy: CreateManyBy<TBaseModel>,
   ): Promise<Array<TBaseModel>> {
+    // Refused before any hook runs; see assertCredentialCanWrite.
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(createBy.props);
+
     // add tenantId if present.
     const tenantColumnName: string | null =
       this.model.getTenantColumn()?.key || null;

package/Server/Services/ApiKeyService.ts

@@ -25,12 +25,26 @@ const NEGATIVE_TTL_MS: number = 10 * 1000;
 interface CachedApiKey {
   id: string;
   projectId: string;
+  name: string | null;
+}
+
+export interface ResolvedApiKey {
+  id: ObjectID;
+  projectId: ObjectID;
+
+  /*
+   * The key's display name, for the audit trail: "which key did this" is
+   * answered by a name an administrator recognises, not by an id. Never part
+   * of an authorization decision. Up to a minute stale on other nodes after
+   * a rename, like everything else this cache holds.
+   */
+  name?: string | undefined;
 }
 
 export class Service extends DatabaseService<Model> {
   /*
-   * Cache of `apiKey -> { id, projectId }`. The project-auth middleware hits
-   * this on every API-key-authenticated request; without it that's a
+   * Cache of `apiKey -> { id, projectId, name }`. The project-auth middleware
+   * hits this on every API-key-authenticated request; without it that's a
    * Postgres findOneBy per request for automated callers.
    */
   private apiKeyCache: InMemoryTTLCache<CachedApiKey | null> =
@@ -75,9 +89,7 @@ export class Service extends DatabaseService<Model> {
    * calling `findOneBy` directly.
    */
   @CaptureSpan()
-  public async findApiKey(
-    apiKey: ObjectID,
-  ): Promise<{ id: ObjectID; projectId: ObjectID } | null> {
+  public async findApiKey(apiKey: ObjectID): Promise<ResolvedApiKey | null> {
     const cacheKey: string = apiKey.toString();
     const cached: CachedApiKey | null | undefined =
       this.apiKeyCache.get(cacheKey);
@@ -88,6 +100,7 @@ export class Service extends DatabaseService<Model> {
       return {
         id: new ObjectID(cached.id),
         projectId: new ObjectID(cached.projectId),
+        ...(cached.name ? { name: cached.name } : {}),
       };
     }
 
@@ -99,6 +112,7 @@ export class Service extends DatabaseService<Model> {
       select: {
         _id: true,
         projectId: true,
+        name: true,
       },
       props: { isRoot: true },
     });
@@ -108,12 +122,22 @@ export class Service extends DatabaseService<Model> {
       return null;
     }
 
+    const name: string | null = row.name ? row.name.toString() : null;
+
     this.apiKeyCache.set(
       cacheKey,
-      { id: row.id.toString(), projectId: row.projectId.toString() },
+      {
+        id: row.id.toString(),
+        projectId: row.projectId.toString(),
+        name,
+      },
       POSITIVE_TTL_MS,
     );
-    return { id: row.id, projectId: row.projectId };
+    return {
+      id: row.id,
+      projectId: row.projectId,
+      ...(name ? { name } : {}),
+    };
   }
 }
 

package/Server/Services/AutoRemediationRuleEngineService.ts

@@ -1160,20 +1160,20 @@ class AutoRemediationRuleEngineServiceClass {
     alert?: Alert | undefined;
   }): Promise<void> {
     /*
-     * Project-level kill switch. === false so a missing column (older rows,
-     * self-hosted defaults) counts as enabled — same semantics as enableAi.
+     * Project-level kill switch: Enable AI, the project's only AI switch,
+     * stops every lane below — cluster and resource rounds, AI rules and
+     * deterministic runbook rules alike. === false because the column is
+     * NOT NULL DEFAULT true: undefined means "not selected", never "off".
      */
     const project: Project | null = await ProjectService.findOneById({
       id: data.projectId,
       select: {
         enableAi: true,
-        enableAutoRemediation: true,
-        enableAiCommandExecution: true,
       },
       props: { isRoot: true },
     });
 
-    if (!project || project.enableAutoRemediation === false) {
+    if (!project || project.enableAi === false) {
       return;
     }
 
@@ -1326,7 +1326,10 @@ class AutoRemediationRuleEngineServiceClass {
         }),
     );
 
-    // Lazily evaluated once: AI rules need AI enabled and a provider.
+    /*
+     * Lazily evaluated once: AI rules need a provider. AI itself is on —
+     * the kill switch above already returned otherwise.
+     */
     let aiAvailable: boolean | null = null;
 
     for (const rule of matchedRules) {
@@ -1345,7 +1348,6 @@ class AutoRemediationRuleEngineServiceClass {
       if (rule.aiComposesCommands) {
         if (aiAvailable === null) {
           aiAvailable =
-            project.enableAi !== false &&
             (await LlmProviderService.getLLMProviderForProject(
               data.projectId,
             )) !== null;
@@ -1353,20 +1355,7 @@ class AutoRemediationRuleEngineServiceClass {
 
         if (!aiAvailable) {
           logger.debug(
-            `AutoRemediationRuleEngine: skipping AI command rule ${rule.id?.toString()} — AI disabled or no LLM provider configured.`,
-            { projectId: data.projectId.toString() } as LogAttributes,
-          );
-          continue;
-        }
-
-        /*
-         * Opt-in semantics (=== true): the project must have explicitly
-         * enabled AI command execution, on top of the AI/auto-remediation
-         * kill switches.
-         */
-        if (project.enableAiCommandExecution !== true) {
-          logger.debug(
-            `AutoRemediationRuleEngine: skipping AI command rule ${rule.id?.toString()} — the project has not enabled AI command execution.`,
+            `AutoRemediationRuleEngine: skipping AI command rule ${rule.id?.toString()} — no LLM provider configured.`,
             { projectId: data.projectId.toString() } as LogAttributes,
           );
           continue;
@@ -1384,7 +1373,6 @@ class AutoRemediationRuleEngineServiceClass {
       if (rule.aiSelectsRunbook) {
         if (aiAvailable === null) {
           aiAvailable =
-            project.enableAi !== false &&
             (await LlmProviderService.getLLMProviderForProject(
               data.projectId,
             )) !== null;
@@ -1392,7 +1380,7 @@ class AutoRemediationRuleEngineServiceClass {
 
         if (!aiAvailable) {
           logger.debug(
-            `AutoRemediationRuleEngine: skipping AI rule ${rule.id?.toString()} — AI disabled or no LLM provider configured.`,
+            `AutoRemediationRuleEngine: skipping AI rule ${rule.id?.toString()} — no LLM provider configured.`,
             { projectId: data.projectId.toString() } as LogAttributes,
           );
           continue;
@@ -1673,11 +1661,11 @@ class AutoRemediationRuleEngineServiceClass {
     try {
       const project: Project | null = await ProjectService.findOneById({
         id: data.projectId,
-        select: { enableAutoRemediation: true },
+        select: { enableAi: true },
         props: { isRoot: true },
       });
 
-      if (!project || project.enableAutoRemediation === false) {
+      if (!project || project.enableAi === false) {
         return false;
       }
 
@@ -2061,11 +2049,11 @@ class AutoRemediationRuleEngineServiceClass {
 
       const project: Project | null = await ProjectService.findOneById({
         id: data.projectId,
-        select: { enableAutoRemediation: true },
+        select: { enableAi: true },
         props: { isRoot: true },
       });
 
-      if (!project || project.enableAutoRemediation === false) {
+      if (!project || project.enableAi === false) {
         return false;
       }
 

package/Server/Services/AutoRemediationRuleService.ts

@@ -121,7 +121,7 @@ export class Service extends DatabaseService<Model> {
   }
 
   public static getAgentCommandRunnerRefusal(runner: Runner): string {
-    return `Runner "${runner.name}" is the in-cluster Runner the Kubernetes agent chart installed. It runs kubectl for its own cluster only, never the Bash or SSH commands a rule composes, so it cannot be one of this rule's Command Runners. OneUptime AI reaches that cluster through its Kubernetes AI agent instead (the cluster's AI → Agent page). Choose Runners you created under Project Settings → Runners, or leave Command Runners empty to allow any Runner with AI commands enabled.`;
+    return `Runner "${runner.name}" is the in-cluster Runner the Kubernetes agent chart installed. It runs kubectl for its own cluster only, never the Bash or SSH commands a rule composes, so it cannot be one of this rule's Command Runners. OneUptime AI reaches that cluster through its Kubernetes AI agent instead (the cluster's AI → Agent page). Choose Runners you created under Runbooks → Runners, or leave Command Runners empty to allow any Runner with AI commands enabled.`;
   }
 }
 

package/Server/Services/DashboardService.ts

@@ -154,11 +154,16 @@ export class Service extends DatabaseService<Model> {
           ipWhitelist: true,
           enableMasterPassword: true,
           masterPassword: true,
+          isArchived: true,
         },
       });
 
-      // If dashboard is not public, deny access
-      if (dashboard && !dashboard.isPublicDashboard) {
+      /*
+       * If dashboard is not public, deny access. An archived dashboard is
+       * not public either, whatever its public setting says: the setting is
+       * kept so unarchiving puts the public link back exactly as it was.
+       */
+      if (dashboard && (!dashboard.isPublicDashboard || dashboard.isArchived)) {
         return {
           hasReadAccess: false,
           error: new NotAuthenticatedException(

package/Server/Services/DatabaseServerService.ts

@@ -58,8 +58,10 @@ import {
   ManualDatabaseEndpoint,
   buildDatabaseServerDisplayName,
   buildDatabaseServerIdentifier,
+  EPHEMERAL_PORT_RANGE_START,
   formatDatabaseEndpoint,
   getDatabaseEndpointScope,
+  isClientSocketDatabaseEndpoint,
   isKubernetesServiceDnsHost,
   parseDatabaseEndpointString,
   parseManualDatabaseEndpoint,
@@ -119,6 +121,14 @@ const MIN_AUTO_ARCHIVE_DAYS: number = 1;
 // Rows archived per sweep; the rest wait for the next five-minute run.
 const AUTO_ARCHIVE_BATCH_SIZE: number = 500;
 
+/*
+ * The client-socket sweep (deleteClientSocketDatabaseServers): rows deleted
+ * per run, and how far it pages through candidates looking for them.
+ */
+const CLIENT_SOCKET_DELETE_BATCH_SIZE: number = 500;
+const CLIENT_SOCKET_SWEEP_PAGE_SIZE: number = 500;
+const CLIENT_SOCKET_SWEEP_MAX_PAGES: number = 20;
+
 /*
  * A person's Restore holds the sweep off this long (or the archive window,
  * if that is longer) unless discovery sees the database again first.
@@ -1337,6 +1347,135 @@ export class Service extends DatabaseService<Model> {
     return rows.length;
   }
 
+  /**
+   * Delete the databases application traces created for the CLIENT end of
+   * a connection (isClientSocketDatabaseEndpoint): eBPF instrumentation
+   * swapped the connection's two ends, and before the create policy refused
+   * such endpoints, every connection became a database named after its
+   * ephemeral port. They were never databases. They fill the list, use up
+   * the project's auto-create budget, and stay "seen" for as long as their
+   * connection lives.
+   *
+   * Deleted, not archived. An archived row keeps its endpoints, so the next
+   * swapped span to name one would restore it. A deleted row frees them, and
+   * the create policy no longer makes anything of them.
+   *
+   * Only rows that nothing but that mistake explains are deleted. Each one
+   * was created by application traces (never a workload's row) and still
+   * has the name discovery gave it, with no description. A person never
+   * archived or restored it, and nobody invested in it
+   * (UNTOUCHED_DATABASE_SERVER_PREDICATE). Every endpoint it has, its own
+   * address and port included, is a client socket of its engine
+   * (isClientSocketDatabaseServerRow). A real database on an ephemeral port
+   * that someone looked after stays. Pages through candidates by id, so the
+   * rows SQL cannot rule out (a renamed one, Db2 on its default 50000) never
+   * hide the rest. Bounded per run. Returns how many rows were deleted.
+   */
+  @CaptureSpan()
+  public async deleteClientSocketDatabaseServers(): Promise<number> {
+    let deleted: number = 0;
+    let afterId: string | null = null;
+
+    for (let page: number = 0; page < CLIENT_SOCKET_SWEEP_MAX_PAGES; page++) {
+      const candidates: unknown = await this.getRepository().manager.query(
+        `SELECT ds."_id" AS "_id", ds."projectId" AS "projectId", ds."name" AS "name",
+            ds."dbSystem" AS "dbSystem", ds."serverAddress" AS "serverAddress",
+            ds."serverPort" AS "serverPort",
+            ARRAY(
+              SELECT e."endpoint"::text FROM "DatabaseServerEndpoint" e
+              WHERE e."databaseServerId" = ds."_id"
+                AND e."projectId" = ds."projectId"
+                AND e."deletedAt" IS NULL
+            ) AS "endpoints"
+          FROM "DatabaseServer" ds
+          WHERE ds."deletedAt" IS NULL
+            AND ds."discoverySource" = $1
+            AND ds."workloadIdentifier" IS NULL
+            AND ds."serverPort" >= $2
+            AND ds."manuallyRestoredAt" IS NULL
+            AND (ds."isArchived" = false OR ds."autoArchivedAt" IS NOT NULL)
+            AND COALESCE(BTRIM(ds."description"), '') = ''
+            AND ($4::uuid IS NULL OR ds."_id" > $4::uuid)
+            AND ${UNTOUCHED_DATABASE_SERVER_PREDICATE}
+          ORDER BY ds."_id" ASC
+          LIMIT $3`,
+        [
+          DatabaseServerDiscoverySource.ClientSpans,
+          EPHEMERAL_PORT_RANGE_START,
+          CLIENT_SOCKET_SWEEP_PAGE_SIZE,
+          afterId,
+        ],
+      );
+
+      const rows: Array<ClientSocketDatabaseServerRow> = Array.isArray(
+        candidates,
+      )
+        ? (candidates as Array<ClientSocketDatabaseServerRow>)
+        : [];
+
+      for (const row of rows) {
+        if (deleted >= CLIENT_SOCKET_DELETE_BATCH_SIZE) {
+          return deleted;
+        }
+
+        if (!row || !row._id || !row.projectId) {
+          continue;
+        }
+
+        if (!isClientSocketDatabaseServerRow(row)) {
+          continue;
+        }
+
+        const projectId: ObjectID = new ObjectID(row.projectId.toString());
+
+        let count: number = 0;
+
+        try {
+          // With hooks: the delete also removes the row's resource AI agent.
+          count = await this.deleteBy({
+            query: {
+              _id: row._id.toString(),
+              projectId: projectId,
+            },
+            limit: 1,
+            skip: 0,
+            props: {
+              isRoot: true,
+            },
+          });
+        } catch (error) {
+          // One row that cannot be deleted never holds up the rest.
+          logger.warn(
+            `DatabaseServerService: could not delete database ${row._id.toString()}, which application traces created for the client end of a connection: ${
+              error instanceof Error ? error.message : String(error)
+            }`,
+            { projectId: projectId.toString() } as LogAttributes,
+          );
+          continue;
+        }
+
+        if (count > 0) {
+          deleted++;
+
+          logger.info(
+            `DatabaseServerService: deleted database ${row._id.toString()} (${String(
+              row.name || "",
+            )}): application traces created it for the client end of a connection, not for a database server.`,
+            { projectId: projectId.toString() } as LogAttributes,
+          );
+        }
+      }
+
+      if (rows.length < CLIENT_SOCKET_SWEEP_PAGE_SIZE) {
+        break;
+      }
+
+      afterId = String(rows[rows.length - 1]!._id);
+    }
+
+    return deleted;
+  }
+
   /*
    * How many discovered databases (collector, client spans, Kubernetes,
    * Docker, Podman) a project may accumulate before discovery stops creating
@@ -4577,6 +4716,86 @@ function findGeneratedNameForm(
   return null;
 }
 
+/*
+ * A candidate row of the client-socket sweep, as its SQL reads it:
+ * `endpoints` holds every live endpoint the row owns, formatted.
+ */
+export interface ClientSocketDatabaseServerRow {
+  _id?: unknown;
+  projectId?: unknown;
+  name?: unknown;
+  dbSystem?: unknown;
+  serverAddress?: unknown;
+  serverPort?: unknown;
+  endpoints?: unknown;
+}
+
+/**
+ * True when a trace-created row describes nothing but the client end of a
+ * connection: it still has the name discovery generated for it (nobody
+ * renamed it), and its own address and port, and every endpoint it owns,
+ * are client sockets of its engine (isClientSocketDatabaseEndpoint). An
+ * endpoint that does not parse, or a row with no address at all, is never
+ * one. The sweep's SQL has already checked everything else
+ * (deleteClientSocketDatabaseServers).
+ */
+export function isClientSocketDatabaseServerRow(
+  row: ClientSocketDatabaseServerRow | null | undefined,
+): boolean {
+  if (!row) {
+    return false;
+  }
+
+  const dbSystem: string =
+    typeof row.dbSystem === "string" ? row.dbSystem.trim() : "";
+  const serverAddress: string =
+    typeof row.serverAddress === "string" ? row.serverAddress.trim() : "";
+  const serverPort: number = Number(row.serverPort);
+
+  if (!dbSystem || !serverAddress || !Number.isInteger(serverPort)) {
+    return false;
+  }
+
+  if (
+    !hasDiscoveryGeneratedName({
+      name: typeof row.name === "string" ? row.name : undefined,
+      dbSystem: dbSystem,
+      serverAddress: serverAddress,
+      serverPort: serverPort,
+    })
+  ) {
+    return false;
+  }
+
+  const endpoints: Array<DatabaseEndpoint> = [
+    { host: serverAddress, port: serverPort },
+  ];
+
+  const stored: Array<unknown> = Array.isArray(row.endpoints)
+    ? row.endpoints
+    : [];
+
+  for (const value of stored) {
+    const endpoint: DatabaseEndpoint | null = parseDatabaseEndpointString(
+      value,
+      { system: dbSystem },
+    );
+
+    if (!endpoint) {
+      return false;
+    }
+
+    endpoints.push(endpoint);
+  }
+
+  return endpoints.every((endpoint: DatabaseEndpoint): boolean => {
+    return isClientSocketDatabaseEndpoint({
+      system: dbSystem,
+      endpoint: endpoint,
+    });
+  });
+}
+
 /*
  * Every catalogued engine of `system`'s family, the family's own engine
  * first ("valkey" -> redis, valkey, keydb, ...). An engine outside the