@oneuptime/common 14.0.11 → 14.0.12

package/Server/Utils/AI/Toolbox/OnCallTools.ts

@@ -293,6 +293,14 @@ function formatEscalationChain(
     .join(" | ");
 }
 
+/*
+ * An archived on-call policy pages no one. The list leaves archived policies
+ * out (as the On-Call Policies page does), so the model never suggests paging
+ * one; read by id, one is still returned, flagged, with this said alongside.
+ */
+export const ARCHIVED_ON_CALL_POLICY_NOTE: string =
+  "This on-call policy is archived, so it pages no one: incidents and alerts that list it notify nobody through it. Unarchive it to use it again.";
+
 /*
  * ---------------------------------------------------------------------------
  * query_on_call_policies — discover policies and their escalation chains.
@@ -301,7 +309,7 @@ function formatEscalationChain(
 export const QueryOnCallPoliciesTool: ObservabilityTool = {
   name: "query_on_call_policies",
   description:
-    "Query on-call duty policies in this project — who gets paged and in what order. List mode returns each policy (id, name, description) with its escalation rule chain: rule order plus the users, teams and schedules each rule pages. Pass onCallPolicyId to get full details of one policy. Use this to find the id to pass to page_on_call_policy, get_on_call_status or query_on_call_pages.",
+    "Query on-call duty policies in this project — who gets paged and in what order. List mode returns each policy (id, name, description) with its escalation rule chain: rule order plus the users, teams and schedules each rule pages. Pass onCallPolicyId to get full details of one policy. Archived policies page no one and are left out of the list. Use this to find the id to pass to page_on_call_policy, get_on_call_status or query_on_call_pages.",
   inputSchema: {
     type: "object",
     properties: {
@@ -343,6 +351,7 @@ export const QueryOnCallPoliciesTool: ObservabilityTool = {
             description: true,
             repeatPolicyIfNoOneAcknowledges: true,
             repeatPolicyIfNoOneAcknowledgesNoOfTimes: true,
+            isArchived: true,
             labels: {
               name: true,
             },
@@ -390,6 +399,7 @@ export const QueryOnCallPoliciesTool: ObservabilityTool = {
                 rules,
                 escalation.targetsByRuleId,
               ),
+              archived: policy.isArchived === true ? true : undefined,
             },
           ]
         : [];
@@ -413,7 +423,10 @@ export const QueryOnCallPoliciesTool: ObservabilityTool = {
       );
 
       return {
-        dataForLlm: serialized.text,
+        dataForLlm:
+          policy?.isArchived === true
+            ? `${ARCHIVED_ON_CALL_POLICY_NOTE}\n${serialized.text}`
+            : serialized.text,
         rowCount: serialized.rowCount,
         citationLabel: `On-call policy '${policy?.name || onCallPolicyId.toString()}'`,
         citationTarget: {
@@ -428,15 +441,19 @@ export const QueryOnCallPoliciesTool: ObservabilityTool = {
               resourceType: "On-Call Policy",
               heading: policy.name || onCallPolicyId.toString(),
               subheading: policy.description,
-              fields:
-                ruleFields.length > 0
+              fields: [
+                ...(policy.isArchived === true
+                  ? [{ label: "Archived", value: "Yes - pages no one" }]
+                  : []),
+                ...(ruleFields.length > 0
                   ? ruleFields
                   : [
                       {
                         label: "Escalation rules",
                         value: "None configured",
                       },
-                    ],
+                    ]),
+              ],
               link: {
                 type: AIChatCitationTargetType.OnCallPolicyView,
                 params: { onCallDutyPolicyId: onCallPolicyId.toString() },
@@ -457,14 +474,19 @@ export const QueryOnCallPoliciesTool: ObservabilityTool = {
       max: 500,
     });
 
+    /*
+     * Archived policies page no one and are hidden from the On-Call Policies
+     * list, so they are left out here too: the assistant should not suggest
+     * paging one. A single archived policy is still readable by its id above.
+     */
     const totalCount: PositiveNumber = await OnCallDutyPolicyService.countBy({
-      query: {},
+      query: { isArchived: false },
       props: ctx.props,
     });
 
     const policies: Array<OnCallDutyPolicy> =
       await OnCallDutyPolicyService.findBy({
-        query: {},
+        query: { isArchived: false },
         select: {
           _id: true,
           name: true,
@@ -755,6 +777,7 @@ export const GetOnCallStatusTool: ObservabilityTool = {
           select: {
             _id: true,
             name: true,
+            isArchived: true,
           },
           props: ctx.props,
         });
@@ -882,8 +905,17 @@ export const GetOnCallStatusTool: ObservabilityTool = {
       const serialized: SerializedResult =
         ToolResultSerializer.serializeRows(rows);
 
+      /*
+       * The rules still say who they would page, but an archived policy
+       * runs none of them - said first, so the rows are not read as "who
+       * gets paged now".
+       */
+      const isArchivedPolicy: boolean = policy.isArchived === true;
+
       return {
-        dataForLlm: serialized.text,
+        dataForLlm: isArchivedPolicy
+          ? `${ARCHIVED_ON_CALL_POLICY_NOTE}\n${serialized.text}`
+          : serialized.text,
         rowCount: serialized.rowCount,
         citationLabel: `On-call now for '${policy.name || onCallPolicyId.toString()}' (${respondersLabel(countResponders(rows))})`,
         citationTarget: {
@@ -896,7 +928,9 @@ export const GetOnCallStatusTool: ObservabilityTool = {
           rows.length > 0
             ? WidgetBuilder.table({
                 title: `On-call now: ${policy.name || ""}`.trim(),
-                description: "Who each escalation rule pages, in order",
+                description: isArchivedPolicy
+                  ? ARCHIVED_ON_CALL_POLICY_NOTE
+                  : "Who each escalation rule pages, in order",
                 columns: onCallStatusColumns,
                 rows: rows,
                 link: {

package/Server/Utils/AI/Toolbox/StatusPageTools.ts

@@ -14,6 +14,7 @@ import StatusPageSubscriberService from "../../../Services/StatusPageSubscriberS
 import Query from "../../../Types/Database/Query";
 import QueryHelper from "../../../Types/Database/QueryHelper";
 import OneUptimeDate from "../../../../Types/Date";
+import ArchivedMonitorResources from "../../../../Utils/StatusPage/ArchivedMonitorResources";
 import ToolResultSerializer, { SerializedResult } from "./Serializer";
 import WidgetBuilder from "./WidgetBuilder";
 import {
@@ -49,6 +50,15 @@ const resolveAnnouncementReadPermissions: () => Array<Permission> =
     return cachedAnnouncementReadPermissions;
   };
 
+/*
+ * An archived status page is offline: its public page is not served and its
+ * subscribers are sent nothing. The list leaves archived pages out (as the
+ * Status Pages page does), so the model never plans a post around one; read
+ * by id, one is still returned, flagged, with this said alongside.
+ */
+export const ARCHIVED_STATUS_PAGE_NOTE: string =
+  "This status page is archived: its public page is not served and its subscribers are sent nothing, so an update reaches no one through it. Unarchive it to publish it again.";
+
 // Resources a detail view lists — enough for any real page, still bounded.
 const MAX_RESOURCES_PER_PAGE: number = 50;
 
@@ -120,7 +130,7 @@ function buildPagingPrefix(data: {
 export const QueryStatusPagesTool: ObservabilityTool = {
   name: "query_status_pages",
   description:
-    "List the status pages in this project and what each one shows to the outside world. Use this BEFORE post_incident_status_update so you know which status pages exist, what an incident affects publicly, and how many subscribers a post will reach. List mode returns every page's id, name, description, visibility and public URL. Pass statusPageId (an id from the list) for detail mode: the monitors/resources displayed on that page and the count of active (confirmed, not unsubscribed) email/SMS/webhook subscribers a public post notifies. Use query_status_page_announcements to see what has already been announced.",
+    "List the status pages in this project and what each one shows to the outside world. Use this BEFORE post_incident_status_update so you know which status pages exist, what an incident affects publicly, and how many subscribers a post will reach. List mode returns every page's id, name, description, visibility and public URL; archived status pages are left out, as they are offline. Pass statusPageId (an id from the list) for detail mode: the monitors/resources displayed on that page and the count of active (confirmed, not unsubscribed) email/SMS/webhook subscribers a public post notifies. Use query_status_page_announcements to see what has already been announced.",
   inputSchema: {
     type: "object",
     properties: {
@@ -163,6 +173,7 @@ export const QueryStatusPagesTool: ObservabilityTool = {
             pageTitle: true,
             pageDescription: true,
             isPublicStatusPage: true,
+            isArchived: true,
           },
           props: ctx.props,
         },
@@ -207,6 +218,7 @@ export const QueryStatusPagesTool: ObservabilityTool = {
             displayName: true,
             monitor: {
               name: true,
+              isArchived: true,
             },
             monitorGroup: {
               name: true,
@@ -231,7 +243,14 @@ export const QueryStatusPagesTool: ObservabilityTool = {
         resolvePublicUrl(statusPageId),
       ]);
 
-      const resourceSummaries: string = resources
+      /*
+       * An archived monitor is left off the public page, so it is not
+       * among the resources the page shows.
+       */
+      const shownResources: Array<StatusPageResource> =
+        ArchivedMonitorResources.withoutArchivedMonitors(resources);
+
+      const resourceSummaries: string = shownResources
         .map((resource: StatusPageResource) => {
           return describeResource(resource);
         })
@@ -253,8 +272,9 @@ export const QueryStatusPagesTool: ObservabilityTool = {
           visibility: visibility,
           publicUrl: publicUrl,
           resourcesShown: resourceSummaries || undefined,
-          resourceCount: resources.length,
+          resourceCount: shownResources.length,
           activeSubscriberCount: activeSubscribers.toNumber(),
+          archived: statusPage.isArchived === true ? true : undefined,
         },
       ];
 
@@ -264,13 +284,19 @@ export const QueryStatusPagesTool: ObservabilityTool = {
       const cardFields: Array<{ label: string; value: string }> = [
         { label: "Visibility", value: visibility },
       ];
+      if (statusPage.isArchived === true) {
+        cardFields.push({
+          label: "Archived",
+          value: "Yes - offline, sends nothing",
+        });
+      }
       if (publicUrl) {
         cardFields.push({ label: "Public URL", value: publicUrl });
       }
       cardFields.push({
         label: "Resources shown",
         value: resourceSummaries
-          ? `${resources.length}: ${resourceSummaries}`
+          ? `${shownResources.length}: ${resourceSummaries}`
           : "0",
       });
       cardFields.push({
@@ -279,7 +305,10 @@ export const QueryStatusPagesTool: ObservabilityTool = {
       });
 
       return {
-        dataForLlm: serialized.text,
+        dataForLlm:
+          statusPage.isArchived === true
+            ? `${ARCHIVED_STATUS_PAGE_NOTE}\n${serialized.text}`
+            : serialized.text,
         rowCount: serialized.rowCount,
         citationLabel: `Status page "${statusPage.name || statusPageId.toString()}"`,
         citationTarget: {
@@ -316,7 +345,7 @@ export const QueryStatusPagesTool: ObservabilityTool = {
     const [statusPages, totalCount]: [Array<StatusPage>, PositiveNumber] =
       await Promise.all([
         StatusPageService.findBy({
-          query: {},
+          query: { isArchived: false },
           select: {
             _id: true,
             name: true,
@@ -331,7 +360,7 @@ export const QueryStatusPagesTool: ObservabilityTool = {
           props: ctx.props,
         }),
         StatusPageService.countBy({
-          query: {},
+          query: { isArchived: false },
           props: ctx.props,
         }),
       ]);

package/Server/Utils/AI/Toolbox/WorkflowProbeTools.ts

@@ -99,10 +99,18 @@ interface WorkflowRunOutcome {
   recentFailures: number;
 }
 
+/*
+ * An archived workflow never runs, whatever its enabled switch says. The list
+ * leaves archived workflows out (as the Workflows page does); read by id, one
+ * is still returned, flagged, so "why did this stop running?" has its answer.
+ */
+export const ARCHIVED_WORKFLOW_NOTE: string =
+  "This workflow is archived, so it does not run from any trigger. Unarchive it to run it again.";
+
 export const QueryWorkflowsTool: ObservabilityTool = {
   name: "query_workflows",
   description:
-    "Query automation workflows in this project. List mode returns each workflow (name, description, enabled) with its recent run outcomes — last run status/time and how many of the recent runs failed. Pass workflowId (from the list mode `id` field) to get detail mode: the workflow plus its most recent runs (status, startedAt, completedAt, duration) including the tail of the run log for failed runs — use that to answer 'why did this workflow fail?'.",
+    "Query automation workflows in this project. List mode returns each workflow (name, description, enabled) with its recent run outcomes — last run status/time and how many of the recent runs failed. Archived workflows are left out of the list, as they never run. Pass workflowId (from the list mode `id` field) to get detail mode: the workflow plus its most recent runs (status, startedAt, completedAt, duration) including the tail of the run log for failed runs — use that to answer 'why did this workflow fail?'.",
   inputSchema: {
     type: "object",
     properties: {
@@ -147,6 +155,7 @@ export const QueryWorkflowsTool: ObservabilityTool = {
           name: true,
           description: true,
           isEnabled: true,
+          isArchived: true,
           createdAt: true,
         },
         props: ctx.props,
@@ -207,6 +216,7 @@ export const QueryWorkflowsTool: ObservabilityTool = {
         name: workflow.name,
         description: workflow.description,
         enabled: Boolean(workflow.isEnabled),
+        archived: workflow.isArchived === true ? true : undefined,
         createdAt: workflow.createdAt,
       };
 
@@ -240,7 +250,10 @@ export const QueryWorkflowsTool: ObservabilityTool = {
         ToolResultSerializer.serializeRows(rows);
 
       return {
-        dataForLlm: serialized.text,
+        dataForLlm:
+          workflow.isArchived === true
+            ? `${ARCHIVED_WORKFLOW_NOTE}\n${serialized.text}`
+            : serialized.text,
         rowCount: serialized.rowCount,
         citationLabel: `Workflow "${workflow.name}" (${runs.length} recent runs)`,
         citationTarget: {
@@ -253,9 +266,12 @@ export const QueryWorkflowsTool: ObservabilityTool = {
           runRows.length > 0
             ? WidgetBuilder.table({
                 title: `Workflow "${workflow.name}" — recent runs`,
-                description: workflow.isEnabled
-                  ? undefined
-                  : "This workflow is disabled.",
+                description:
+                  workflow.isArchived === true
+                    ? ARCHIVED_WORKFLOW_NOTE
+                    : workflow.isEnabled
+                      ? undefined
+                      : "This workflow is disabled.",
                 columns: [
                   { key: "status", title: "Status", type: "text" },
                   { key: "startedAt", title: "Started", type: "date" },
@@ -282,6 +298,9 @@ export const QueryWorkflowsTool: ObservabilityTool = {
                     label: "Enabled",
                     value: workflow.isEnabled ? "Yes" : "No",
                   },
+                  ...(workflow.isArchived === true
+                    ? [{ label: "Archived", value: "Yes - does not run" }]
+                    : []),
                   { label: "Recent runs", value: "0" },
                 ],
                 link: {
@@ -304,7 +323,7 @@ export const QueryWorkflowsTool: ObservabilityTool = {
     });
 
     const workflows: Array<Workflow> = await WorkflowService.findBy({
-      query: {},
+      query: { isArchived: false },
       select: {
         _id: true,
         name: true,
@@ -322,7 +341,7 @@ export const QueryWorkflowsTool: ObservabilityTool = {
 
     const totalCount: number = (
       await WorkflowService.countBy({
-        query: {},
+        query: { isArchived: false },
         props: ctx.props,
       })
     ).toNumber();

package/Server/Utils/AnalyticsDatabase/ClusterConfig.ts

@@ -79,7 +79,9 @@ export function getDistributedDdlTaskTimeoutSeconds(): number {
  * DROP / RENAME) so the object is created or dropped on every node of the
  * cluster. Per-table ALTERs and data mutations on ReplicatedMergeTree propagate
  * through Keeper automatically; emitting ON CLUSTER on them too is harmless and
- * keeps the reconcilers deterministic across replicas.
+ * keeps the reconcilers deterministic across replicas. The exception is a
+ * settings change (`ALTER TABLE … MODIFY SETTING`): each replica applies it to
+ * its own copy only, so it reaches every replica only through ON CLUSTER.
  */
 export function onClusterClause(): string {
   return ` ON CLUSTER '${getClickhouseClusterName()}'`;

package/Server/Utils/Express.ts

@@ -53,6 +53,29 @@ export interface OneUptimeRequest extends express.Request {
    * the `Owned` permission scope. Absent for non-user callers.
    */
   userTeamIds?: Array<ObjectID>;
+  /*
+   * WHICH credential made the request, for the audit trail. The permission
+   * layer never reads these - who may do what is decided by userType and the
+   * permission sets above - they only let an audit entry say more than "an
+   * API key" or "this member".
+   *
+   * `apiKeyId` / `apiKeyName` are set by ProjectMiddleware for a project API
+   * key (and the name alone for the instance master key, which has no row).
+   * `mcpOAuth` is set by McpDelegationAuthorization when the request is made
+   * by the MCP server for a member who connected an MCP client with OAuth.
+   *
+   * The one field here that IS enforced is `mcpOAuth.isReadOnly`: a client
+   * its user authorized as read-only cannot create, update or delete (see
+   * DatabaseCommonInteractionProps.isReadOnlyCredential).
+   */
+  apiKeyId?: ObjectID;
+  apiKeyName?: string;
+  mcpOAuth?: {
+    grantId: ObjectID;
+    clientId: string;
+    clientName: string;
+    isReadOnly: boolean;
+  };
   rawFormUrlEncodedBody?: string;
   rawBody?: string; // Raw body for signature verification (JSON or URL-encoded)
 }