@oneuptime/common 14.0.10 → 14.0.12

package/Server/Services/IncidentFormSubmissionService.ts

@@ -0,0 +1,97 @@
+import PositiveNumber from "../../Types/PositiveNumber";
+import CountBy from "../Types/Database/CountBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import FindBy from "../Types/Database/FindBy";
+import { OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/IncidentFormSubmission";
+import { applyIncidentRelatedRecordPrivacyFilter } from "../Utils/Incident/IncidentPrivacyFilter";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * Incident form submissions are written by the form's submit route, as
+ * root; nothing here creates them.
+ *
+ * A submission names its incident, so it must not show a private incident
+ * to someone who cannot see it: every read, count and delete is narrowed to
+ * submissions whose incident the caller can see, as incident notes are.
+ * (The incident's labels and owners narrow them too - see the model's
+ * CanAccessIfCanReadOn and OwnedThrough.)
+ *
+ * The strict filter, not the null-tolerant one, although the incident link
+ * is cleared when the incident is deleted. A submission holds the reporter's
+ * name and address - the same facts as the private note the incident takes
+ * with it - and once the incident is gone nothing records whether it was
+ * private. Letting such a row through would show a private report's
+ * reporter to everyone in the project the moment the incident was deleted,
+ * by any path (the API, a workflow, retention, raw SQL). So a submission
+ * with no incident is listed only for callers who see every incident anyway:
+ * project owners and admins, root and master admins, who are not narrowed
+ * at all (see shouldBypassIncidentPrivacy).
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeFind(
+    findBy: FindBy<Model>,
+  ): Promise<OnFind<Model>> {
+    findBy.query = applyIncidentRelatedRecordPrivacyFilter(
+      findBy.query,
+      findBy.props,
+    );
+
+    return { findBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  public override async countBy(
+    countBy: CountBy<Model>,
+  ): Promise<PositiveNumber> {
+    countBy.query = applyIncidentRelatedRecordPrivacyFilter(
+      countBy.query,
+      countBy.props,
+    );
+
+    return super.countBy(countBy);
+  }
+
+  /*
+   * Nobody but root may update a submission today (the update list is
+   * empty), and root is never narrowed. Filtered anyway, so granting update
+   * later cannot reach the submissions of hidden incidents.
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    updateBy.query = applyIncidentRelatedRecordPrivacyFilter(
+      updateBy.query,
+      updateBy.props,
+    );
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * An incident admin cannot delete what they cannot list, including a
+   * submission whose incident is gone: a project owner or admin can, or the
+   * submission can be deleted before its incident is.
+   */
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    deleteBy.query = applyIncidentRelatedRecordPrivacyFilter(
+      deleteBy.query,
+      deleteBy.props,
+    );
+
+    return { deleteBy, carryForward: null };
+  }
+}
+
+export default new Service();

package/Server/Services/IncidentGroupingEngineService.ts

@@ -42,6 +42,29 @@ export interface GroupingResult {
   wasReopened?: boolean;
 }
 
+type ReplaceAllLiterallyFunction = (
+  text: string,
+  placeholder: RegExp,
+  value: string,
+) => string;
+
+/*
+ * Puts `value` in for every match of `placeholder`, exactly as written. A
+ * string replacement reads "$&", "$`", "$'" and "$1" in it as patterns, so an
+ * incident titled "Price $& up" - or a title typed on an incident form - came
+ * out of an episode template mangled, or with other parts of the template
+ * copied into it.
+ */
+export const replaceAllLiterally: ReplaceAllLiterallyFunction = (
+  text: string,
+  placeholder: RegExp,
+  value: string,
+): string => {
+  return text.replace(placeholder, (): string => {
+    return value;
+  });
+};
+
 class IncidentGroupingEngineServiceClass {
   @CaptureSpan()
   public async processIncident(incident: Incident): Promise<GroupingResult> {
@@ -1153,12 +1176,17 @@ class IncidentGroupingEngineServiceClass {
      * {{incidentTitle}}
      */
     if (incident.title) {
-      result = result.replace(/\{\{incidentTitle\}\}/g, incident.title);
+      result = replaceAllLiterally(
+        result,
+        /\{\{incidentTitle\}\}/g,
+        incident.title,
+      );
     }
 
     // {{incidentDescription}}
     if (incident.description) {
-      result = result.replace(
+      result = replaceAllLiterally(
+        result,
         /\{\{incidentDescription\}\}/g,
         incident.description,
       );
@@ -1170,7 +1198,8 @@ class IncidentGroupingEngineServiceClass {
       incident.monitors.length > 0 &&
       incident.monitors[0]?.name
     ) {
-      result = result.replace(
+      result = replaceAllLiterally(
+        result,
         /\{\{monitorName\}\}/g,
         incident.monitors[0].name,
       );
@@ -1178,7 +1207,8 @@ class IncidentGroupingEngineServiceClass {
 
     // {{incidentSeverity}}
     if (incident.incidentSeverity?.name) {
-      result = result.replace(
+      result = replaceAllLiterally(
+        result,
         /\{\{incidentSeverity\}\}/g,
         incident.incidentSeverity.name,
       );
@@ -1208,12 +1238,17 @@ class IncidentGroupingEngineServiceClass {
      * {{incidentTitle}}
      */
     if (incident.title) {
-      result = result.replace(/\{\{incidentTitle\}\}/g, incident.title);
+      result = replaceAllLiterally(
+        result,
+        /\{\{incidentTitle\}\}/g,
+        incident.title,
+      );
     }
 
     // {{incidentDescription}}
     if (incident.description) {
-      result = result.replace(
+      result = replaceAllLiterally(
+        result,
         /\{\{incidentDescription\}\}/g,
         incident.description,
       );
@@ -1225,7 +1260,8 @@ class IncidentGroupingEngineServiceClass {
       incident.monitors.length > 0 &&
       incident.monitors[0]?.name
     ) {
-      result = result.replace(
+      result = replaceAllLiterally(
+        result,
         /\{\{monitorName\}\}/g,
         incident.monitors[0].name,
       );
@@ -1233,7 +1269,8 @@ class IncidentGroupingEngineServiceClass {
 
     // {{incidentSeverity}}
     if (incident.incidentSeverity?.name) {
-      result = result.replace(
+      result = replaceAllLiterally(
+        result,
         /\{\{incidentSeverity\}\}/g,
         incident.incidentSeverity.name,
       );

package/Server/Services/IncidentService.ts

@@ -93,7 +93,10 @@ import ServiceType from "../../Types/Telemetry/ServiceType";
 import OneUptimeDate from "../../Types/Date";
 import TelemetryUtil from "../Utils/Telemetry/Telemetry";
 import MetricResourceAttributeUtil from "../../Utils/Metrics/MetricResourceAttributeUtil";
-import { escapeMarkdownInline } from "../../Utils/Markdown/MarkdownEscape";
+import {
+  escapeMarkdownInline,
+  escapeMarkdownValue,
+} from "../../Utils/Markdown/MarkdownEscape";
 import logger, { LogAttributes } from "../Utils/Logger";
 import ProductAnalytics from "../Utils/ProductAnalytics";
 import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
@@ -2111,6 +2114,23 @@ export class Service extends DatabaseService<Model> {
         false;
     }
 
+    /*
+     * Owners handed over to be notified are added by onCreateSuccess's
+     * chain, once the incident's Slack / Microsoft Teams channels exist -
+     * seconds after the incident is written, with a workspace connected. The
+     * owners' "Incident Created" notification is sent by a job that runs
+     * every minute and takes every incident not yet marked as notified: run
+     * in between, it would find no owners, tell the project's owners
+     * instead, and mark the incident done, and the owners the create named
+     * would hear nothing of it ("owner added" is off by default). So such an
+     * incident is written as notified already, and the chain marks it not
+     * notified once it has added them (releaseCreatedNotificationHeldForOwners):
+     * the job then tells them on its next run.
+     */
+    if (this.isCreatedNotificationHeldForOwners(createBy)) {
+      createBy.data.isOwnerNotifiedOfResourceCreation = true;
+    }
+
     const projectId: ObjectID =
       createBy.props.tenantId || createBy.data.projectId!;
 
@@ -2847,12 +2867,32 @@ export class Service extends DatabaseService<Model> {
         }
       })
       .then(async () => {
+        /*
+         * Owners handed over with the create: a template's owners, from the
+         * dashboard's Declare Incident page or from an incident form. Added
+         * here - after the incident's Slack / Microsoft Teams channels
+         * exist, which is when the owners' own hooks can invite them to
+         * those channels, and after "Incident Created" - rather than by the
+         * caller once the create returns, while this chain may still be
+         * creating the channels.
+         *
+         * Whether they are notified is the caller's to say, but only an
+         * internal (root) caller's: an incident form asks for its
+         * template's owners to be notified - they are the people a report
+         * through it is meant to reach. A user's request cannot: the
+         * dashboard's declare has always added them quietly, and misc data
+         * is whatever the request body says.
+         */
         try {
           if (
             onCreate.createBy.miscDataProps &&
             (onCreate.createBy.miscDataProps["ownerTeams"] ||
               onCreate.createBy.miscDataProps["ownerUsers"])
           ) {
+            const notifyOwners: boolean =
+              onCreate.createBy.props.isRoot === true &&
+              onCreate.createBy.miscDataProps["notifyOwners"] === true;
+
             return await this.addOwners(
               createdItem.projectId!,
               createdItem.id!,
@@ -2862,7 +2902,7 @@ export class Service extends DatabaseService<Model> {
               (onCreate.createBy.miscDataProps[
                 "ownerTeams"
               ] as Array<ObjectID>) || [],
-              false,
+              notifyOwners,
               onCreate.createBy.props,
             );
           }
@@ -2877,6 +2917,15 @@ export class Service extends DatabaseService<Model> {
             } as LogAttributes,
           );
           return Promise.resolve();
+        } finally {
+          /*
+           * The owners the create handed over exist now - or could not be
+           * added, and this chain will not try again: either way the
+           * "Incident Created" notification held for them may go out.
+           */
+          if (this.isCreatedNotificationHeldForOwners(onCreate.createBy)) {
+            await this.releaseCreatedNotificationHeldForOwners(createdItem);
+          }
         }
       })
       .then(async () => {
@@ -3299,6 +3348,63 @@ export class Service extends DatabaseService<Model> {
       });
   }
 
+  /*
+   * Whether a create hands owners to its own onCreateSuccess chain to be
+   * notified, and so holds the incident's "Incident Created" notification
+   * until the chain has added them (see onBeforeCreate). Only an internal
+   * (root) caller can ask for owners to be notified - misc data is whatever
+   * a user's request body says - and today only an incident form does, for
+   * its template's owners. Every other create is written and notified as it
+   * always was. One predicate for the hold and the release alike, so the
+   * chain never releases an incident nobody held: the job may already have
+   * notified that one, and would do it again.
+   */
+  private isCreatedNotificationHeldForOwners(
+    createBy: CreateBy<Model>,
+  ): boolean {
+    const miscDataProps: JSONObject | undefined = createBy.miscDataProps;
+
+    return (
+      createBy.props.isRoot === true &&
+      miscDataProps?.["notifyOwners"] === true &&
+      Boolean(miscDataProps["ownerUsers"] || miscDataProps["ownerTeams"])
+    );
+  }
+
+  /*
+   * Marks an incident whose create held its "Incident Created" notification
+   * as not notified, so the owners' job sends it on its next run - to the
+   * owners the chain has just added. Without the update hooks, as the other
+   * notification markers on an incident are written: nothing they react to
+   * changed. It never throws, so the chain's later steps (the owner rules,
+   * on-call) still run; a failure is logged, and leaves the notification
+   * unsent.
+   */
+  private async releaseCreatedNotificationHeldForOwners(
+    incident: Model,
+  ): Promise<void> {
+    try {
+      await this.updateOneById({
+        id: incident.id!,
+        data: {
+          isOwnerNotifiedOfResourceCreation: false,
+        },
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+    } catch (error) {
+      logger.error(
+        `Releasing the Incident Created notification held for the owners failed in IncidentService.onCreateSuccess: ${error}`,
+        {
+          projectId: incident.projectId?.toString(),
+          incidentId: incident.id?.toString(),
+        } as LogAttributes,
+      );
+    }
+  }
+
   @CaptureSpan()
   private async handleIncidentWorkspaceOperationsAsync(
     createdItem: Model,
@@ -3399,9 +3505,19 @@ export class Service extends DatabaseService<Model> {
         incident.incidentNumberWithPrefix ||
         "#" + incident.incidentNumber?.toString();
 
+      /*
+       * The title is plain text - one line, typed by whoever declared the
+       * incident, which is anyone holding an incident form's link - placed
+       * into Markdown that is rendered without the viewer's safe mode and
+       * posted to Slack and Teams. Escaped as MarkdownEscape says a title
+       * must be, so "[Reset your password](...)" arrives as those
+       * characters, "![](https://tracker...)" is not fetched and "<!here>"
+       * is not a mention, while "Site 03 - payments (EU)" reads unchanged.
+       * The description stays Markdown: that is what it is written in.
+       */
       let feedInfoInMarkdown: string = `#### 🚨 Incident ${incidentNumberDisplay} Created:
         
-**${incident.title || "No title provided."}**:
+**${escapeMarkdownValue(incident.title || "No title provided.")}**:
 
 ${incident.description || "No description provided."}
 
@@ -4137,8 +4253,10 @@ ${incident.remediationNotes || "No remediation notes provided."}
         if (
           Object.prototype.hasOwnProperty.call(updatedIncidentData, "title")
         ) {
-          const title: string =
-            (updatedIncidentData.title as string) || "No title provided.";
+          // Plain text, escaped as in the "Incident Created" item.
+          const title: string = escapeMarkdownValue(
+            (updatedIncidentData.title as string) || "No title provided.",
+          );
           feedInfoInMarkdown += `\n\n**Title**: \n${title}\n`;
           shouldAddIncidentFeed = true;
         }

package/Server/Services/IncidentTemplateService.ts

@@ -12,8 +12,10 @@ import MonitorStatusService from "./MonitorStatusService";
 import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import StatusPageService from "./StatusPageService";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { validateCustomFieldCreateSettings } from "../../Types/CustomField/CustomFieldCreateSettings";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import Dictionary from "../../Types/Dictionary";
+import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import Model from "../../Models/DatabaseModels/IncidentTemplate";
 import DatabaseBaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
@@ -55,6 +57,8 @@ export class Service extends DatabaseService<Model> {
     const projectId: ObjectID | undefined =
       createBy.props.tenantId || createBy.data.projectId;
 
+    this.assertValidCustomFieldSettings(createBy.data.customFieldSettings);
+
     // Derived from the list, whatever the caller sent (see the column).
     createBy.data.isScopedToStatusPages =
       IncidentScopeAddedPagesNotification.normalizeStatusPageIds(
@@ -109,6 +113,8 @@ export class Service extends DatabaseService<Model> {
         ).length > 0;
     }
 
+    this.assertValidCustomFieldSettings(data["customFieldSettings"]);
+
     const references: Array<ProjectScopedReference> =
       this.getProjectScopedReferences(updateBy.data);
 
@@ -175,6 +181,22 @@ export class Service extends DatabaseService<Model> {
     return { updateBy, carryForward: null };
   }
 
+  /*
+   * customFieldSettings is only read by the dashboard's Declare Incident
+   * form, and leniently, so a malformed value would not break anything - it
+   * would silently do nothing, which is worse for whoever wrote it. It is
+   * refused where it comes in instead, root writes included (a workflow can
+   * send it too). A valid value is stored exactly as sent: see
+   * validateCustomFieldCreateSettings for why nothing is rewritten.
+   */
+  private assertValidCustomFieldSettings(value: unknown): void {
+    const problem: string | null = validateCustomFieldCreateSettings(value);
+
+    if (problem) {
+      throw new BadDataException(problem);
+    }
+  }
+
   /*
    * The status pages an update adds to a template must be pages the caller
    * can read (see StatusPageReadAccess). Pages the template already holds are