@oneuptime/common 14.0.11 → 14.0.12

package/Server/Services/TeamMemberService.ts

@@ -184,6 +184,38 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       );
     }
 
+    /*
+     * An invitation by email is for whoever has that address. They are only
+     * looked up here, so that the member limits below can tell whether they
+     * are in the project already. Someone with no account yet gets one
+     * further down, once the invitation has been allowed, so a refused
+     * invitation never leaves a user behind.
+     *
+     * `password` comes back too, because whether this person has finished
+     * registering decides both which link the invitation carries and whether
+     * that link needs a registration token. UserService.findByEmail selects
+     * only the id, so it cannot answer that.
+     */
+    const invitedEmail: Email | null =
+      createBy.miscDataProps && createBy.miscDataProps["email"]
+        ? new Email(createBy.miscDataProps["email"] as string)
+        : null;
+
+    const userWithInvitedEmail: User | null = invitedEmail
+      ? await UserService.findOneBy({
+          query: {
+            email: invitedEmail,
+          },
+          select: {
+            _id: true,
+            password: true,
+          },
+          props: {
+            isRoot: true,
+          },
+        })
+      : null;
+
     // check if this project can have more members.
     if (IsBillingEnabled && createBy.data.projectId) {
       const project: Project | null = await ProjectService.findOneById({
@@ -196,32 +228,51 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
         },
       });
 
+      const hasMemberLimit: boolean = Boolean(
+        project &&
+          (project.seatLimit || createBy.props.currentPlan === PlanType.Free),
+      );
+
+      const invitedUserId: ObjectID | null | undefined = invitedEmail
+        ? userWithInvitedEmail?.id
+        : createBy.data.userId;
+
       /*
-       * Billing can lag after a provider outage. Admission limits must use
-       * persisted memberships, including pending invitations.
+       * Both limits count people, not memberships, and a pending invitation
+       * counts as much as an accepted one (see
+       * getUniqueTeamMemberCountInProject). Someone who already has either in
+       * this project is in that count already: adding them to another team
+       * leaves it where it was, so neither limit applies to them.
        */
-      const numberOfMembers: number =
-        project &&
-        (project.seatLimit || createBy.props.currentPlan === PlanType.Free)
-          ? await this.getUniqueTeamMemberCountInProject(projectId)
-          : 0;
+      const isInvitedUserAlreadyCounted: boolean = Boolean(
+        hasMemberLimit &&
+          invitedUserId &&
+          (await this.hasMembershipInProject({
+            projectId: projectId,
+            userId: invitedUserId,
+          })),
+      );
 
-      if (
-        project &&
-        project.seatLimit &&
-        numberOfMembers >= project.seatLimit
-      ) {
-        throw new BadDataException(Errors.TeamMemberService.LIMIT_REACHED);
-      }
+      if (project && hasMemberLimit && !isInvitedUserAlreadyCounted) {
+        /*
+         * Billing can lag after a provider outage. Admission limits must use
+         * persisted memberships, including pending invitations.
+         */
+        const numberOfMembers: number =
+          await this.getUniqueTeamMemberCountInProject(projectId);
 
-      if (
-        createBy.props.currentPlan === PlanType.Free &&
-        project &&
-        numberOfMembers >= 1
-      ) {
-        throw new BadDataException(
-          Errors.TeamMemberService.LIMIT_REACHED_FOR_FREE_PLAN,
-        );
+        if (project.seatLimit && numberOfMembers >= project.seatLimit) {
+          throw new BadDataException(Errors.TeamMemberService.LIMIT_REACHED);
+        }
+
+        if (
+          createBy.props.currentPlan === PlanType.Free &&
+          numberOfMembers >= 1
+        ) {
+          throw new BadDataException(
+            Errors.TeamMemberService.LIMIT_REACHED_FOR_FREE_PLAN,
+          );
+        }
       }
     }
 
@@ -233,7 +284,8 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
      * Everyone else invites, and the invited person accepts for themselves. A
      * project admin who could accept on someone's behalf would be able to pull
      * an account into their project - and into whatever the team's permissions
-     * grant - without that person ever agreeing to it.
+     * grant - without that person ever agreeing to it. The one exception is a
+     * person who has already accepted joining this project, further down.
      */
     const canCreateAcceptedInvitation: boolean = Boolean(
       createBy.props.isRoot || createBy.props.isMasterAdmin,
@@ -243,60 +295,31 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       createBy.data.hasAcceptedInvitation = false;
     }
 
-    const isInvitationAcceptedOnCreate: boolean = Boolean(
-      createBy.data.hasAcceptedInvitation,
-    );
-
     /*
-     * The acceptance timestamp is stamped here rather than taken from the
-     * request, so it can never disagree with hasAcceptedInvitation - a row that
-     * says "Member" with no accepted-at date, or an accepted-at date on a row
-     * that is still only invited.
+     * Set when the member is invited by email: the account the address belongs
+     * to, and whether this invite just created it. The invitation email is sent
+     * once everything below has decided what this membership is.
      */
-    if (isInvitationAcceptedOnCreate) {
-      createBy.data.invitationAcceptedAt = OneUptimeDate.getCurrentDate();
-    } else {
-      delete createBy.data.invitationAcceptedAt;
-    }
-
-    if (createBy.miscDataProps && createBy.miscDataProps["email"]) {
-      const email: Email = new Email(createBy.miscDataProps["email"] as string);
+    let invitedUser: User | null = null;
+    let isNewUser: boolean = false;
 
+    if (invitedEmail) {
       /*
        * Optional name supplied on the invite form. Used only to set the name on
        * a brand-new user, or to backfill an existing user who has no name yet —
        * we never overwrite a name the user has already set.
        */
-      const nameValue: string | undefined = createBy.miscDataProps["name"]
+      const nameValue: string | undefined = createBy.miscDataProps?.["name"]
         ? (createBy.miscDataProps["name"] as string).trim()
         : undefined;
 
-      /*
-       * `password` comes back too, because whether this person has finished
-       * registering decides both which link the invitation carries and whether
-       * that link needs a registration token. UserService.findByEmail selects
-       * only the id, so it cannot answer that.
-       */
-      let user: User | null = await UserService.findOneBy({
-        query: {
-          email: email,
-        },
-        select: {
-          _id: true,
-          password: true,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
-
-      let isNewUser: boolean = false;
+      let user: User | null = userWithInvitedEmail;
 
       if (!user) {
         isNewUser = true;
 
         user = await UserService.createByEmail({
-          email,
+          email: invitedEmail,
           name: nameValue ? new Name(nameValue) : undefined,
           // Record who invited this brand-new user, so it can be surfaced later.
           createdByUserId: createBy.props.userId,
@@ -334,6 +357,76 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
 
       createBy.data.userId = user.id!;
 
+      invitedUser = user;
+    }
+
+    /*
+     * Check if this user is already invited. Before the invitation email
+     * below, so a repeated invite fails without mailing anybody or minting a
+     * registration token for a membership that is never created.
+     */
+    const member: TeamMember | null = await this.findOneBy({
+      query: {
+        userId: createBy.data.userId!,
+        teamId: createBy.data.teamId || new ObjectID(createBy.data.team!._id!),
+      },
+      props: {
+        isRoot: true,
+      },
+      select: {
+        _id: true,
+      },
+    });
+
+    if (member) {
+      throw new BadDataException(Errors.TeamMemberService.ALREADY_INVITED);
+    }
+
+    /*
+     * Acceptance is per project, not per team. Someone who has accepted an
+     * invitation to any team of this project has already agreed to be in it,
+     * so adding them to another of its teams is a change to their teams - the
+     * project admins' call, like changing what a team they are already on may
+     * do - and not a new invitation for them to accept. Without this they were
+     * asked to accept the same project again for every team they were added
+     * to. The permission and SCIM checks above have already run, so this
+     * grants nothing the inviter could not grant to an existing teammate.
+     *
+     * A pending invitee is not a member yet (see isUserMemberOfProject), so a
+     * second team they are invited to stays an invitation, and accepting
+     * either one accepts both (acceptPendingInvitationsInProject).
+     */
+    if (
+      !createBy.data.hasAcceptedInvitation &&
+      createBy.data.userId &&
+      (await this.isUserMemberOfProject({
+        projectId: projectId,
+        userId: createBy.data.userId,
+      }))
+    ) {
+      createBy.data.hasAcceptedInvitation = true;
+    }
+
+    const isInvitationAcceptedOnCreate: boolean = Boolean(
+      createBy.data.hasAcceptedInvitation,
+    );
+
+    /*
+     * The acceptance timestamp is stamped here rather than taken from the
+     * request, so it can never disagree with hasAcceptedInvitation - a row that
+     * says "Member" with no accepted-at date, or an accepted-at date on a row
+     * that is still only invited.
+     */
+    if (isInvitationAcceptedOnCreate) {
+      createBy.data.invitationAcceptedAt = OneUptimeDate.getCurrentDate();
+    } else {
+      delete createBy.data.invitationAcceptedAt;
+    }
+
+    if (invitedUser && invitedEmail) {
+      const user: User = invitedUser;
+      const email: Email = invitedEmail;
+
       const project: Project | null = await ProjectService.findOneById({
         id: createBy.data.projectId!,
         select: {
@@ -396,9 +489,10 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
               registerLink: registerLink,
               isNewUser: needsRegistration.toString(),
               /*
-               * An auto-accepted member has nothing left to accept, so the
-               * template drops the "sign in to accept your invitation" framing
-               * and tells them they are already in.
+               * An auto-accepted member - accepted by a master admin, or
+               * already in the project through another team - has nothing
+               * left to accept, so the template drops the "sign in to accept
+               * your invitation" framing and tells them they are already in.
                */
               isInvitationAccepted: isInvitationAcceptedOnCreate.toString(),
               projectName: project.name!,
@@ -416,31 +510,12 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
         ).catch((err: Error) => {
           logger.error(err, {
             projectId: createBy.data.projectId?.toString(),
-            userId: user?.id?.toString(),
+            userId: user.id?.toString(),
           } as LogAttributes);
         });
       }
     }
 
-    //check if this user is already invited.
-
-    const member: TeamMember | null = await this.findOneBy({
-      query: {
-        userId: createBy.data.userId!,
-        teamId: createBy.data.teamId || new ObjectID(createBy.data.team!._id!),
-      },
-      props: {
-        isRoot: true,
-      },
-      select: {
-        _id: true,
-      },
-    });
-
-    if (member) {
-      throw new BadDataException(Errors.TeamMemberService.ALREADY_INVITED);
-    }
-
     return { createBy, carryForward: null };
   }
 
@@ -549,11 +624,155 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     }
   }
 
+  /**
+   * Accept every invitation still pending for this user in this project.
+   *
+   * Acceptance is per project, not per team: a person who accepts one
+   * invitation into a project has agreed to be in it, and must not be asked
+   * again for each of the other teams of that project they were invited to.
+   * Both hooks call this whenever a membership becomes accepted - the invitee
+   * accepting one, a master admin creating one accepted, SSO or SCIM adding
+   * one - so a member of a project never has invitations left there.
+   *
+   * Written with ignoreHooks: every caller refreshes this user's permissions
+   * in this project and adds their notification defaults right after, which
+   * is all onUpdateSuccess would do for these rows. Call it before that
+   * refresh, so the permissions include these teams. Best effort: the
+   * membership that triggered it is already committed, and an invitation left
+   * pending can still be accepted by hand. Returns how many were accepted.
+   */
+  @CaptureSpan()
+  public async acceptPendingInvitationsInProject(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<number> {
+    try {
+      return await this.updateBy({
+        query: {
+          userId: data.userId,
+          projectId: data.projectId,
+          hasAcceptedInvitation: false,
+        },
+        data: {
+          hasAcceptedInvitation: true,
+          invitationAcceptedAt: OneUptimeDate.getCurrentDate(),
+        },
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+    } catch (err) {
+      logger.error(
+        err as Error,
+        {
+          projectId: data.projectId.toString(),
+          userId: data.userId.toString(),
+        } as LogAttributes,
+      );
+
+      return 0;
+    }
+  }
+
+  /**
+   * Accept the invitations left pending for people who had already joined
+   * that project through another team - what adding them to those teams
+   * does now (see onBeforeCreate). Somebody who is only invited is left
+   * alone: they still have to accept. Run once by the data migration that
+   * came with acceptance becoming per project.
+   *
+   * The (person, project) pairs are walked in key order, a batch at a time,
+   * and each is handled as an acceptance is: its invitations accepted, then
+   * the person's cached permissions in the project refreshed. Best effort per
+   * pair - a failure is logged and the walk goes on. Idempotent, since an
+   * accepted invitation is no longer pending, and safe to run twice at once
+   * as the data migration runner requires. Returns how many invitations it
+   * accepted.
+   */
+  @CaptureSpan()
+  public async acceptPendingInvitationsOfProjectMembers(options?: {
+    batchSize?: number | undefined;
+  }): Promise<number> {
+    const batchSize: number = Math.max(
+      1,
+      Math.floor(options?.batchSize || 500),
+    );
+
+    let acceptedCount: number = 0;
+    let lastPair: { userId: string; projectId: string } | null = null;
+
+    for (;;) {
+      const pairs: Array<{ userId: string; projectId: string }> =
+        await this.getRepository().manager.query(
+          `SELECT DISTINCT pending."userId", pending."projectId"
+             FROM "TeamMember" pending
+            WHERE pending."hasAcceptedInvitation" = false
+              AND pending."deletedAt" IS NULL
+              AND ($2::uuid IS NULL OR (pending."userId", pending."projectId") > ($2::uuid, $3::uuid))
+              AND EXISTS (
+                    SELECT 1
+                      FROM "TeamMember" accepted
+                     WHERE accepted."userId" = pending."userId"
+                       AND accepted."projectId" = pending."projectId"
+                       AND accepted."hasAcceptedInvitation" = true
+                       AND accepted."deletedAt" IS NULL
+                  )
+            ORDER BY pending."userId" ASC, pending."projectId" ASC
+            LIMIT $1`,
+          [batchSize, lastPair?.userId || null, lastPair?.projectId || null],
+        );
+
+      for (const pair of pairs) {
+        const userId: ObjectID = new ObjectID(pair.userId);
+        const projectId: ObjectID = new ObjectID(pair.projectId);
+
+        acceptedCount += await this.acceptPendingInvitationsInProject({
+          userId: userId,
+          projectId: projectId,
+        });
+
+        try {
+          await this.refreshTokens(userId, projectId);
+        } catch (err) {
+          logger.error(
+            err as Error,
+            {
+              projectId: projectId.toString(),
+              userId: userId.toString(),
+            } as LogAttributes,
+          );
+        }
+      }
+
+      if (pairs.length < batchSize) {
+        break;
+      }
+
+      lastPair = pairs[pairs.length - 1]!;
+    }
+
+    return acceptedCount;
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     onCreate: OnCreate<TeamMember>,
     createdItem: TeamMember,
   ): Promise<TeamMember> {
+    /*
+     * An accepted membership puts the person in the project, so whatever else
+     * they were invited to there is accepted with it.
+     */
+    if (createdItem.hasAcceptedInvitation) {
+      await this.acceptPendingInvitationsInProject({
+        userId: onCreate.createBy.data.userId!,
+        projectId: onCreate.createBy.data.projectId!,
+      });
+    }
+
     await this.refreshTokens(
       onCreate.createBy.data.userId!,
       onCreate.createBy.data.projectId!,
@@ -614,7 +833,32 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       },
     });
 
+    /*
+     * The (user, project) pairs whose remaining invitations have been
+     * accepted already. Accepting every invitation of a project at once
+     * updates several rows of the same pair, and one pass covers them all.
+     */
+    const acceptedProjectKeys: Set<string> = new Set<string>();
+
     for (const item of items) {
+      /*
+       * Accepting one invitation into a project accepts the person's other
+       * invitations there too: they have just agreed to be in the project.
+       */
+      const projectKey: string = `${item.userId?.toString()}:${item.projectId?.toString()}`;
+
+      if (
+        updateBy.data.hasAcceptedInvitation &&
+        !acceptedProjectKeys.has(projectKey)
+      ) {
+        acceptedProjectKeys.add(projectKey);
+
+        await this.acceptPendingInvitationsInProject({
+          userId: item.userId!,
+          projectId: item.projectId!,
+        });
+      }
+
       await this.refreshTokens(item.userId!, item.projectId!);
 
       if (updateBy.data.hasAcceptedInvitation) {
@@ -1397,6 +1641,30 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     return [...new Set(memberIds)].length; //get unique member ids.
   }
 
+  /*
+   * Whether the user has any membership in the project, a pending invitation
+   * included - which is what getUniqueTeamMemberCountInProject counts them
+   * by. isUserMemberOfProject answers the narrower question of whether they
+   * have accepted one.
+   */
+  @CaptureSpan()
+  private async hasMembershipInProject(data: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }): Promise<boolean> {
+    const count: PositiveNumber = await this.countBy({
+      query: {
+        projectId: data.projectId,
+        userId: data.userId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return count.toNumber() > 0;
+  }
+
   /**
    * Every member row of the teams, pending invitations included. Pass
    * acceptedOnly for the accepted rows alone - the only ones that grant the

package/Server/Services/UserNotificationSettingService.ts

@@ -791,6 +791,26 @@ export class Service extends DatabaseService<UserNotificationSetting> {
     await this.addIncidentEpisodeNotificationSettings(userId, projectId);
     await this.addScheduledMaintenanceNotificationSettings(userId, projectId);
     await this.addSloNotificationSettings(userId, projectId);
+    await this.addIncomingCallNotificationSettings(userId, projectId);
+  }
+
+  /*
+   * Email on by default: a missed call is a customer who could not reach
+   * anyone, and the owners are the people who can call them back.
+   * Idempotent - the AddIncomingCallMissedNotificationSettingsForUsers data
+   * migration calls this for every existing member, and the missed call
+   * notification seeds it too before sending.
+   */
+  @CaptureSpan()
+  public async addIncomingCallNotificationSettings(
+    userId: ObjectID,
+    projectId: ObjectID,
+  ): Promise<void> {
+    await this.addNotificationSettingIfNotExists(
+      userId,
+      projectId,
+      NotificationSettingEventType.SEND_INCOMING_CALL_MISSED_OWNER_NOTIFICATION,
+    );
   }
 
   private async addSloNotificationSettings(

package/Server/Services/WorkflowService.ts

@@ -16,6 +16,7 @@ import {
   NodeDataProp,
   NodeType,
 } from "../../Types/Workflow/Component";
+import ComponentID from "../../Types/Workflow/ComponentID";
 import API from "../../Utils/API";
 import Model from "../../Models/DatabaseModels/Workflow";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -191,6 +192,36 @@ export class Service extends DatabaseService<Model> {
         ignoreHooks: true,
       },
     });
+
+    if (trigger?.metadataId === ComponentID.IncomingEmail) {
+      await this.ensureIncomingEmailSecretKey(data.workflowId);
+    }
+  }
+
+  /*
+   * Gives a workflow the key its Incoming Email trigger's address is built
+   * from (workflow-{key}@{inbound domain}), unless it already has one. Called
+   * whenever a graph with that trigger is saved - from the builder, the API,
+   * an import or a duplicate - so a workflow that uses the trigger always has
+   * an address, however it got the trigger.
+   *
+   * A compare-and-set on "no key yet": two saves racing each other cannot
+   * leave the workflow with a key other than the one the first of them wrote,
+   * and a key the workflow already has - including one just reset - is never
+   * replaced. Returns whether a key was written.
+   */
+  public async ensureIncomingEmailSecretKey(
+    workflowId: ObjectID,
+  ): Promise<boolean> {
+    return await this.compareAndSetColumnsByIdWithoutHooks({
+      id: workflowId,
+      data: {
+        incomingEmailSecretKey: ObjectID.generate(),
+      } as any,
+      expectedData: {
+        incomingEmailSecretKey: null,
+      } as any,
+    });
   }
 
   private async notifyWorkflowService(workflowId: ObjectID): Promise<void> {

package/Server/Types/AnalyticsDatabase/ModelPermission.ts

@@ -80,6 +80,8 @@ export default class ModelPermission {
     query: Query<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(props);
+
     if (props.isRoot || props.isMasterAdmin) {
       query = await this.addTenantScopeToQueryAsRoot(modelType, query, props);
     }
@@ -110,6 +112,8 @@ export default class ModelPermission {
     data: TBaseModel,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(props);
+
     if (props.isRoot || props.isMasterAdmin) {
       return query;
     }
@@ -141,6 +145,8 @@ export default class ModelPermission {
     data: TBaseModel,
     props: DatabaseCommonInteractionProps,
   ): void {
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(props);
+
     // If system is making this query then let the query run!
     if (props.isRoot || props.isMasterAdmin) {
       return;

package/Server/Types/Database/Permissions/Index.ts

@@ -49,6 +49,8 @@ export default class ModelPermission {
     fetchModelWithAccessControlIds: () => Promise<TBaseModel | null>;
     props: DatabaseCommonInteractionProps;
   }): Promise<void> {
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(data.props);
+
     try {
       return await DeletePermission.checkDeletePermissionByModel(data);
     } catch (error) {
@@ -64,6 +66,8 @@ export default class ModelPermission {
     fetchModelWithAccessControlIds: () => Promise<TBaseModel | null>;
     props: DatabaseCommonInteractionProps;
   }): Promise<void> {
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(data.props);
+
     try {
       return await UpdatePermission.checkUpdatePermissionByModel(data);
     } catch (error) {
@@ -77,6 +81,8 @@ export default class ModelPermission {
     query: Query<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(props);
+
     try {
       return await DeletePermission.checkDeletePermission(
         modelType,
@@ -95,6 +101,8 @@ export default class ModelPermission {
     data: QueryDeepPartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(props);
+
     try {
       return await UpdatePermission.checkUpdatePermissions(
         modelType,
@@ -113,6 +121,8 @@ export default class ModelPermission {
     data: TBaseModel,
     props: DatabaseCommonInteractionProps,
   ): void {
+    DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(props);
+
     try {
       return CreatePermission.checkCreatePermissions(modelType, data, props);
     } catch (error) {

package/Server/Types/Workflow/Components/BaseModel/OnTriggerBaseModel.ts

@@ -212,6 +212,8 @@ export default class OnTriggerBaseModel<
         triggerId: this.getMetadata().id,
         projectId: new ObjectID(req.params["projectId"] as string),
         isEnabled: true,
+        // An archived workflow never runs, whatever its toggle says.
+        isArchived: false,
       },
       props: {
         isRoot: true,