@oneuptime/common 14.0.11 → 14.0.12

package/Tests/Utils/StatusPage/ArchivedMonitorResources.test.ts

@@ -0,0 +1,99 @@
+import ArchivedMonitorResources, {
+  ResourceWithMonitor,
+} from "../../../Utils/StatusPage/ArchivedMonitorResources";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * A status page resource whose monitor is archived is left out of every
+ * public read of the page, and an archived monitor no longer counts towards
+ * a monitor group's status. These are the two answers every one of those
+ * reads relies on.
+ */
+
+interface Row extends ResourceWithMonitor {
+  name: string;
+}
+
+function monitorRow(name: string, isArchived?: boolean): Row {
+  return {
+    name,
+    monitorId: `${name}-id`,
+    monitor: isArchived === undefined ? {} : { isArchived },
+  };
+}
+
+function groupRow(name: string): Row {
+  return { name };
+}
+
+describe("ArchivedMonitorResources.isMonitorArchived", () => {
+  test("a resource whose monitor is archived", () => {
+    expect(
+      ArchivedMonitorResources.isMonitorArchived(monitorRow("api", true)),
+    ).toBe(true);
+  });
+
+  test("a resource whose monitor is live", () => {
+    expect(
+      ArchivedMonitorResources.isMonitorArchived(monitorRow("api", false)),
+    ).toBe(false);
+  });
+
+  test("a monitor read without the flag counts as live, never as archived", () => {
+    expect(
+      ArchivedMonitorResources.isMonitorArchived(monitorRow("api", undefined)),
+    ).toBe(false);
+  });
+
+  test("a resource with no monitor (a monitor group row) is never archived", () => {
+    expect(ArchivedMonitorResources.isMonitorArchived(groupRow("group"))).toBe(
+      false,
+    );
+  });
+});
+
+describe("ArchivedMonitorResources.withoutArchivedMonitors", () => {
+  test("drops only the rows whose monitor is archived, keeping the order", () => {
+    const rows: Array<Row> = [
+      monitorRow("checkout", false),
+      monitorRow("legacy", true),
+      groupRow("payments group"),
+      monitorRow("search", undefined),
+      monitorRow("old-cron", true),
+    ];
+
+    expect(
+      ArchivedMonitorResources.withoutArchivedMonitors(rows).map(
+        (row: Row): string => {
+          return row.name;
+        },
+      ),
+    ).toEqual(["checkout", "payments group", "search"]);
+  });
+
+  test("returns the same row objects, so callers keep every field they read", () => {
+    const live: Row = monitorRow("checkout", false);
+
+    expect(ArchivedMonitorResources.withoutArchivedMonitors([live])[0]).toBe(
+      live,
+    );
+  });
+
+  test("leaves the input untouched", () => {
+    const rows: Array<Row> = [monitorRow("legacy", true)];
+
+    ArchivedMonitorResources.withoutArchivedMonitors(rows);
+
+    expect(rows).toHaveLength(1);
+  });
+
+  test("an empty list stays empty, and a list of only archived monitors empties", () => {
+    expect(ArchivedMonitorResources.withoutArchivedMonitors([])).toEqual([]);
+    expect(
+      ArchivedMonitorResources.withoutArchivedMonitors([
+        monitorRow("a", true),
+        monitorRow("b", true),
+      ]),
+    ).toEqual([]);
+  });
+});

package/Types/AI/AIRunType.ts

@@ -22,12 +22,13 @@ enum AIRunType {
    * investigates read-only and proposes a command plan for one-click
    * approval; in FullAuto mode it may also execute commands inline, but
    * only ones that pass the structural policy guard and match the rule's
-   * operator-authored allowlist (or the cluster's Fixes mode). Rule runs
-   * require Project.enableAiCommandExecution (Bash/SSH on Runners, and any
-   * kubectl a rule composes) and a target Runner with canRunAiCommands. A
-   * cluster round's consent is the cluster's Fixes mode plus the Kubernetes
-   * agent chart's write access; it needs the project opt-in only when the
-   * cluster is reached through a Runner with a Kubernetes credential.
+   * operator-authored allowlist (or the cluster's Fixes mode). Every run
+   * requires Project.enableAi, the project's only AI switch. Rule runs also
+   * need a target Runner with canRunAiCommands (Bash/SSH on Runners, and
+   * any kubectl a rule composes). A cluster round's consent is the
+   * cluster's Fixes mode plus the write access of whatever reaches the
+   * cluster: the Kubernetes agent chart's RBAC, or the Kubernetes
+   * credential of a Runner bound to the cluster.
    */
   RemediationExecution = "RemediationExecution",
 }

package/Types/AI/AIWorkloadLimits.ts

@@ -0,0 +1,82 @@
+/*
+ * The limits a project may put on how much autonomous AI work runs, and what
+ * each one means when it is left unset.
+ *
+ * Every one of them is opt-in, and unset means no limit, so AI works out of
+ * the box: every incident and alert is investigated whatever its severity, a
+ * repeat signal from the same monitor is investigated again, an investigation
+ * starts as soon as it is queued however many are already running, and fix
+ * tasks and their pull requests are opened as often as the work calls for. A
+ * project that wants a ceiling sets one — per lane under Incidents or Alerts →
+ * Settings → AI, and per repository for open AI pull requests. The
+ * investigation time limit (AIAgentRunLimits) and the daily token limits
+ * follow the same rule.
+ */
+
+// The longest re-investigation cooldown a project may set.
+export const MAX_AI_INVESTIGATION_COOLDOWN_IN_MINUTES: number = 24 * 60;
+
+/*
+ * The fewest concurrent investigations a set cap allows. Pausing has its own
+ * switches (the automatic investigation toggles, a daily token limit of 0),
+ * so a cap of 0 reads as 1 rather than as "never run".
+ */
+export const MIN_AI_MAX_CONCURRENT_INVESTIGATIONS: number = 1;
+
+export default class AIWorkloadLimits {
+  /*
+   * How many investigations one lane may run at once, from the project's
+   * stored value. Null means no cap. A set value is floored at
+   * MIN_AI_MAX_CONCURRENT_INVESTIGATIONS and otherwise kept: there is no
+   * ceiling on a cap a project asks for.
+   */
+  public static getMaxConcurrentInvestigations(
+    value: number | string | null | undefined,
+  ): number | null {
+    const configured: number | null = this.toNumber(value);
+
+    if (configured === null) {
+      return null;
+    }
+
+    return Math.max(
+      MIN_AI_MAX_CONCURRENT_INVESTIGATIONS,
+      Math.floor(configured),
+    );
+  }
+
+  /*
+   * How long, in minutes, a monitor that was just investigated is left alone
+   * before a repeat signal is investigated again. 0 means no cooldown, which
+   * is what unset, zero and negative values all read as; a set value is
+   * clamped to MAX_AI_INVESTIGATION_COOLDOWN_IN_MINUTES.
+   */
+  public static getCooldownInMinutes(
+    value: number | string | null | undefined,
+  ): number {
+    const configured: number | null = this.toNumber(value);
+
+    if (configured === null || configured <= 0) {
+      return 0;
+    }
+
+    return Math.min(
+      MAX_AI_INVESTIGATION_COOLDOWN_IN_MINUTES,
+      Math.floor(configured),
+    );
+  }
+
+  // A stored value as a usable number, or null when there is none.
+  private static toNumber(
+    value: number | string | null | undefined,
+  ): number | null {
+    if (value === null || value === undefined) {
+      return null;
+    }
+
+    const parsed: number =
+      typeof value === "number" ? value : Number.parseFloat(value);
+
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+}

package/Types/AnalyticsDatabase/AnalyticsTableName.ts

@@ -70,8 +70,8 @@ enum AnalyticsTableName {
    * (projectId, sloId, metricName, bucketStart) with a `version` column
    * so at-least-once evaluator writes and trailing re-writes dedupe to
    * the latest value. Deliberately NOT MetricItemV3: its own monthly
-   * partitions + 400-day TTL keep long-lived SLO rows from pinning the
-   * daily raw-telemetry partitions (ttl_only_drop_parts hazard).
+   * partitions + 400-day TTL keep long-lived SLO rows out of the daily
+   * raw-telemetry partitions.
    */
   SloHistory = "SloHistory",
   /*

package/Types/AnalyticsDatabase/RetentionTtl.ts

@@ -0,0 +1,57 @@
+/*
+ * Row TTL for the telemetry tables whose partitions mix retentions -
+ * MetricItemV3, its minute rollup MetricItemAggMV1m and LogItemV3 - and so
+ * expire row by row rather than a whole part at a time (no
+ * ttl_only_drop_parts; DropTtlOnlyDropPartsFromMixedRetentionTables says
+ * why).
+ *
+ * `retentionDate` is stamped per row at ingest (the ingest time plus the
+ * row's retention), so one day's rows reach it spread over a whole day.
+ * With `TTL retentionDate DELETE` ClickHouse rewrites the partition every
+ * time merge_with_ttl_timeout (4 hours) lets it while they do: six or seven
+ * rewrites per retention a daily partition holds, writing about three times
+ * the partition in all, and six a day for a month on the monthly rollup.
+ *
+ * Rounded up to the next midnight instead, a day's rows of one retention
+ * all expire at the same instant. ClickHouse tries dropping whole parts
+ * before rewriting any (with or without ttl_only_drop_parts), so the last
+ * retention a partition holds goes as a free drop, and each one before it
+ * costs a single merge that writes only the rows that outlive it. On the
+ * monthly rollup it is one merge a day instead of six.
+ *
+ * The cost is disk: an expired row stays up to a day longer, half a day on
+ * average. Reads filter it out (`retentionDate >= now()`:
+ * AnalyticsDatabaseService.getRetentionReadFilter, and the aggregation
+ * services' own filters), and the TTL is always later than `retentionDate`,
+ * so no row is deleted while a read can still return it. The exception is
+ * the project-wide log histogram: it reads an aggregate projection that
+ * cannot filter on retentionDate, so a window reaching back past the
+ * retention counts, at its far edge, up to a day of rows the list no longer
+ * shows (LogAggregationService.buildHistogramStatement).
+ *
+ * Boot schema-sync does not reconcile TTL: RoundTtlToDayOnMixedRetentionTables
+ * applies these to the tables an existing install already has.
+ */
+export const RETENTION_TTL_ROUNDED_UP_TO_DAY: string =
+  "toStartOfDay(retentionDate) + INTERVAL 1 DAY DELETE";
+
+/*
+ * The same for the raw tables, which partition by the day the event
+ * happened (`toYYYYMMDD(time)`) while `retentionDate` counts from the
+ * moment the row was ingested (`createdAt`). An event stamped ahead of the
+ * clock that ingested it - a host clock running fast, a syslog device's
+ * local time read as UTC - lands in a later day's partition than its
+ * stamp. Rounded on `retentionDate` alone it would expire a day before the
+ * rest of that partition, and removing a handful of such rows would cost a
+ * rewrite of the whole partition. Shifting its expiry by how far ahead it
+ * is (at most a day, which bounds what a broken clock can keep on disk)
+ * lines it up with the day of its partition. A late event is left alone:
+ * lining it up would delete it before its retentionDate.
+ *
+ * It relies on every writer stamping `createdAt` and `retentionDate` from
+ * the same instant, which they do; a row without its `createdAt` only
+ * reaches the cap. And `createdAt` cannot be dropped or retyped while this
+ * TTL reads it.
+ */
+export const RETENTION_TTL_ROUNDED_UP_TO_EVENT_DAY: string =
+  "toStartOfDay(retentionDate + toIntervalSecond(least(greatest(dateDiff('second', createdAt, time), 0), 86400))) + INTERVAL 1 DAY DELETE";

package/Types/BaseDatabase/DatabaseCommonInteractionProps.ts

@@ -28,4 +28,25 @@ export default interface DatabaseCommonInteractionProps {
    * as `All`.
    */
   userTeamIds?: Array<ObjectID> | undefined;
+  /*
+   * Which credential the caller used, carried for the audit trail only: no
+   * permission check reads them. An API key request has no userId, so without
+   * these an audit entry could say that "an API key" made a change but not
+   * which; and a change an MCP client makes for a member would be
+   * indistinguishable from one the member made in the dashboard.
+   */
+  apiKeyId?: ObjectID | undefined;
+  apiKeyName?: string | undefined;
+  mcpOAuthGrantId?: ObjectID | undefined;
+  mcpClientName?: string | undefined;
+  /*
+   * The caller's credential was issued for reading only: an MCP client its
+   * user authorized as read-only. Every create, update and delete made with
+   * these props is refused, whatever the caller's permissions would allow
+   * (DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite). The MCP
+   * server already refuses the tools that change things for such a client;
+   * this is the same promise kept by the API itself, so it does not rest on
+   * every tool being classified correctly.
+   */
+  isReadOnlyCredential?: boolean | undefined;
 }

package/Types/BaseDatabase/DatabaseCommonInteractionPropsUtil.ts

@@ -1,6 +1,7 @@
 import Permission, { UserPermission } from "../Permission";
 import DatabaseCommonInteractionProps from "./DatabaseCommonInteractionProps";
 import NotAuthenticatedException from "../Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../Exception/NotAuthorizedException";
 import UserType from "../UserType";
 
 export enum PermissionType {
@@ -12,6 +13,29 @@ export default class DatabaseCommonInteractionPropsUtil {
   public static readonly AUTHENTICATION_REQUIRED_MESSAGE: string =
     "Authentication required. Please log in to access this resource.";
 
+  public static readonly READ_ONLY_CREDENTIAL_MESSAGE: string =
+    "This MCP client was connected with read-only access, so it cannot make changes. Connect it again and allow read and write access.";
+
+  /*
+   * Refuses a create, update or delete made with a read-only credential (see
+   * DatabaseCommonInteractionProps.isReadOnlyCredential). Asked ahead of every
+   * other permission check, because no permission the caller holds can make a
+   * read-only credential write.
+   *
+   * Root props are let through: those are the server's own writes - a hook
+   * that records something on the caller's behalf - and were never the
+   * caller's to be refused.
+   */
+  public static assertCredentialCanWrite(
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    if (props.isReadOnlyCredential && !props.isRoot) {
+      throw new NotAuthorizedException(
+        DatabaseCommonInteractionPropsUtil.READ_ONLY_CREDENTIAL_MESSAGE,
+      );
+    }
+  }
+
   /*
    * No credentials at all: no user, no project API key, no master key.
    *

package/Types/BaseDatabase/EnableWorkflowOn.ts

@@ -3,4 +3,12 @@ export default interface EnableWorkflowOn {
   update?: boolean | undefined;
   delete?: boolean | undefined;
   read?: boolean | undefined;
+  /*
+   * False for a table only OneUptime writes, such as a call log: create,
+   * update and delete then offer their On Create / On Update / On Delete
+   * triggers, but not the steps that write rows. Those steps run as root, so
+   * offering them would let a workflow forge or rewrite the log. Defaults to
+   * true.
+   */
+  writeSteps?: boolean | undefined;
 }

package/Types/Call/CallProvider.ts

@@ -51,6 +51,13 @@ export interface DialStatusData {
   callId: string;
   dialStatus: "completed" | "busy" | "no-answer" | "failed" | "canceled";
   dialDurationSeconds?: number;
+  /*
+   * The incoming call itself had already ended when the dial finished, so
+   * the caller is gone and nothing more can be played or dialed. A caller
+   * who hangs up while the dialed phone is still ringing ends the dial too,
+   * and dialStatus then looks like an unanswered dial.
+   */
+  callerHungUp: boolean;
 }
 
 // Express Request type for webhook parsing

package/Types/Database/TableMetadata.ts

@@ -9,6 +9,13 @@ export default (props: {
   icon: IconProp;
   tableDescription: string;
   enableRealtimeEventsOn?: EnableRealtimeEventsOn | undefined;
+  /*
+   * The column that names one record - what a delete confirmation calls it.
+   * Leave it out and the name is worked out from the model (its slug's source
+   * column, else name, title and the like; see UI/Utils/ModelDisplayName).
+   * Set it only where that would pick the wrong column, or none.
+   */
+  displayNameColumn?: string | undefined;
 }) => {
   return (ctr: GenericFunction) => {
     ctr.prototype.singularName = props.singularName;
@@ -19,5 +26,8 @@ export default (props: {
     if (props.enableRealtimeEventsOn) {
       ctr.prototype.enableRealtimeEventsOn = props.enableRealtimeEventsOn;
     }
+    if (props.displayNameColumn) {
+      ctr.prototype.displayNameColumn = props.displayNameColumn;
+    }
   };
 };

package/Types/DatabaseServer/DatabaseEndpoint.ts

@@ -1320,6 +1320,49 @@ export function getDatabaseEndpointScope(
   return "global";
 }
 
+/*
+ * The first port of the range an operating system picks the LOCAL port of
+ * an outgoing connection from: Linux's default `ip_local_port_range` is
+ * 32768-60999, and Windows, macOS and the BSDs use IANA's dynamic range,
+ * 49152-65535 (RFC 6335). A server is not normally configured to listen
+ * there, because any outgoing connection on its host may already hold the
+ * port. Docker's randomly published ports are the usual exception.
+ */
+export const EPHEMERAL_PORT_RANGE_START: number = 32768;
+
+/** True for a valid port at or above EPHEMERAL_PORT_RANGE_START. */
+export function isEphemeralPort(port: unknown): boolean {
+  const value: number | null = toValidPort(port);
+  return value !== null && value >= EPHEMERAL_PORT_RANGE_START;
+}
+
+/**
+ * True when the "server" a CLIENT span names is, in all likelihood, the
+ * client's own end of the connection: its port is ephemeral and is not the
+ * engine's own default port (Db2 listens on 50000).
+ *
+ * eBPF instrumentation (OpenTelemetry eBPF Instrumentation, Beyla) cannot
+ * see who opened a connection it joins mid-stream: a pooled client or a
+ * BullMQ worker that connected before the agent started, or a Redis server
+ * pushing a pub/sub message or answering a blocking pop. It then decides
+ * the direction from the bytes, and when it guesses wrong it swaps the two
+ * ends: the span names the client - `oneuptime-worker:46600` - as the
+ * server. Every new connection then names a new port, so every connection
+ * looks like a new database.
+ */
+export function isClientSocketDatabaseEndpoint(input: {
+  system: unknown;
+  endpoint: DatabaseEndpoint | null | undefined;
+}): boolean {
+  const port: number | null = toValidPort(input?.endpoint?.port);
+
+  if (port === null || port < EPHEMERAL_PORT_RANGE_START) {
+    return false;
+  }
+
+  return getDefaultDatabasePort(input.system) !== port;
+}
+
 /**
  * "host:port", "host" (unknown port), "[v6]:port", "host\instance"; plus
  * "@cluster" when qualified. The inverse is parseDatabaseEndpointString.

package/Types/Email/EmailTemplateType.ts

@@ -96,6 +96,8 @@ enum EmailTemplateType {
   UserOnCallShiftReminder = "UserOnCallShiftReminder.hbs",
   UserOnCallShiftReassigned = "UserOnCallShiftReassigned.hbs",
 
+  IncomingCallPolicyOwnerMissedCall = "IncomingCallPolicyOwnerMissedCall.hbs",
+
   ProjectSubscriptionOverdue = "ProjectSubscriptionOverdue.hbs",
   Invoice = "Invoice.hbs",
 

package/Types/Exception/ExceptionMessages.ts

@@ -1,6 +1,7 @@
 enum ExceptionMessages {
   MonitorNotFound = "Monitor not found.",
   MonitorDisabled = "Monitor is disabled. Please enable it to start monitoring again.",
+  MonitorArchived = "Monitor is archived. Unarchive it to start monitoring again.",
   UserBlocked = "Your account has been blocked. Please contact your administrator.",
 }
 

package/Types/IncomingCall/MissedIncomingCall.ts

@@ -0,0 +1,72 @@
+import IncomingCallStatus from "./IncomingCallStatus";
+
+/*
+ * The status messages the incoming call webhook stores on a call log when
+ * it ends the call itself, before ringing anyone. They are stored text, so
+ * existing rows keep these exact values.
+ */
+export enum IncomingCallStatusMessage {
+  PolicyDisabled = "Policy is disabled",
+  NoOneAvailable = "No on-call user available in any escalation rule",
+}
+
+/*
+ * Why a call reached nobody. NoAnswer and CallerHungUp happen after people
+ * were rung; NoOneAvailable and PolicyDisabled before anyone was.
+ */
+export enum MissedIncomingCallReason {
+  NoAnswer = "NoAnswer",
+  CallerHungUp = "CallerHungUp",
+  NoOneAvailable = "NoOneAvailable",
+  PolicyDisabled = "PolicyDisabled",
+  Failed = "Failed",
+}
+
+/*
+ * A call log is missed when it ended without connecting the caller to
+ * anyone: nobody answered, the caller hung up first, or the call could not
+ * be routed at all. Completed is the only other final status.
+ */
+export const MISSED_INCOMING_CALL_STATUSES: ReadonlyArray<IncomingCallStatus> =
+  Object.freeze([
+    IncomingCallStatus.NoAnswer,
+    IncomingCallStatus.CallerHungUp,
+    IncomingCallStatus.Failed,
+  ]);
+
+export default class MissedIncomingCall {
+  public static isMissed(
+    status: IncomingCallStatus | undefined | null,
+  ): boolean {
+    if (!status) {
+      return false;
+    }
+
+    return MISSED_INCOMING_CALL_STATUSES.includes(status);
+  }
+
+  // Null when the call was not missed.
+  public static getReason(data: {
+    status: IncomingCallStatus | undefined | null;
+    statusMessage?: string | undefined | null;
+  }): MissedIncomingCallReason | null {
+    switch (data.status) {
+      case IncomingCallStatus.NoAnswer:
+        return MissedIncomingCallReason.NoAnswer;
+      case IncomingCallStatus.CallerHungUp:
+        return MissedIncomingCallReason.CallerHungUp;
+      case IncomingCallStatus.Failed:
+        if (data.statusMessage === IncomingCallStatusMessage.PolicyDisabled) {
+          return MissedIncomingCallReason.PolicyDisabled;
+        }
+
+        if (data.statusMessage === IncomingCallStatusMessage.NoOneAvailable) {
+          return MissedIncomingCallReason.NoOneAvailable;
+        }
+
+        return MissedIncomingCallReason.Failed;
+      default:
+        return null;
+    }
+  }
+}

package/Types/Kubernetes/KubernetesClusterAiAccess.ts

@@ -124,6 +124,11 @@ export type KubernetesAiAccessGapCode =
   | "remediation_disabled"
   | "remediation_write_access_missing"
   | "project_ai_disabled"
+  /*
+   * Retired: the project's "Enable auto-remediation" and "Enable AI command
+   * execution" switches, both folded into Enable AI (project_ai_disabled).
+   * The server no longer produces either; they stay for compatibility.
+   */
   | "project_auto_remediation_disabled"
   | "project_ai_command_execution_disabled"
   | "llm_provider_missing"

package/Types/Mcp/McpOAuthClientAuthMethod.ts

@@ -0,0 +1,17 @@
+/*
+ * How a registered MCP client proves itself at the token endpoint
+ * (RFC 7591 `token_endpoint_auth_method`).
+ *
+ * Almost every MCP client is a public client: a desktop app, a CLI or a hosted
+ * agent that cannot keep a secret per installation, so it authenticates with
+ * PKCE alone (`none`). The two secret-based methods exist for the clients that
+ * ask for them when they register; a client identified by a Client ID Metadata
+ * Document is always public.
+ */
+enum McpOAuthClientAuthMethod {
+  None = "none",
+  ClientSecretPost = "client_secret_post",
+  ClientSecretBasic = "client_secret_basic",
+}
+
+export default McpOAuthClientAuthMethod;