@oneuptime/common 14.0.11 → 14.0.12

package/Types/Mcp/McpOAuthScope.ts

@@ -0,0 +1,180 @@
+/*
+ * What an MCP client that signed in with OAuth may do.
+ *
+ * Two levels, because that is the one distinction every MCP tool already
+ * declares about itself (readOnlyHint): a client holding `mcp:read` can call
+ * the get/list/count tools and nothing else; `mcp:write` adds the tools that
+ * create, update, delete, acknowledge and resolve.
+ *
+ * WRITE IMPLIES READ
+ *
+ * A client that steps up after an `insufficient_scope` challenge is allowed
+ * to request only the scope the challenge named (the MCP TypeScript SDK does
+ * exactly that), so a token carrying `mcp:write` alone has to keep reading.
+ * The specification asks resource servers to honour such hierarchies; here it
+ * is also the only reading that makes sense - nothing can sensibly resolve an
+ * incident it is not allowed to look at.
+ *
+ * NEITHER SCOPE IS A PERMISSION
+ *
+ * A scope narrows what the token may be used for. What the caller may touch
+ * is still decided, on every request, by the permissions the signed-in user
+ * holds in the project - a read-and-write token for a user whose teams grant
+ * Monitor Viewer and nothing else can still only view monitors.
+ *
+ * `offline_access` is accepted because clients that follow OpenID Connect
+ * convention ask for it to get a refresh token. It changes nothing: a refresh
+ * token is issued with every authorization.
+ */
+enum McpOAuthScope {
+  Read = "mcp:read",
+  Write = "mcp:write",
+  OfflineAccess = "offline_access",
+}
+
+export default McpOAuthScope;
+
+export interface ParsedMcpOAuthScope {
+  scopes: Array<McpOAuthScope>;
+
+  /* Tokens in the request that this server does not issue. */
+  unknownScopes: Array<string>;
+}
+
+/*
+ * The order scopes are written in, everywhere: stored on a grant, returned by
+ * the token endpoint, named in a challenge. One order means two grants with
+ * the same access always carry the same string.
+ */
+const CANONICAL_ORDER: Array<McpOAuthScope> = [
+  McpOAuthScope.Read,
+  McpOAuthScope.Write,
+  McpOAuthScope.OfflineAccess,
+];
+
+/* RFC 6749 section 3.3: scope-token = 1*( %x21 / %x23-5B / %x5D-7E ). */
+const SCOPE_TOKEN_PATTERN: RegExp = /^[\x21\x23-\x5B\x5D-\x7E]+$/;
+
+export class McpOAuthScopeUtil {
+  /* The scopes a resource owner is asked about. `offline_access` is not one. */
+  public static readonly ACCESS_SCOPES: Array<McpOAuthScope> = [
+    McpOAuthScope.Read,
+    McpOAuthScope.Write,
+  ];
+
+  public static readonly ALL_SCOPES: Array<McpOAuthScope> = [
+    ...CANONICAL_ORDER,
+  ];
+
+  /*
+   * Splits a space-delimited scope string. Never throws: a value that is not
+   * a string, or is empty, is simply no scopes. Duplicates collapse.
+   */
+  public static parse(value: unknown): ParsedMcpOAuthScope {
+    const scopes: Array<McpOAuthScope> = [];
+    const unknownScopes: Array<string> = [];
+
+    if (typeof value !== "string") {
+      return { scopes, unknownScopes };
+    }
+
+    for (const token of value.split(" ")) {
+      if (!token) {
+        continue;
+      }
+
+      const known: McpOAuthScope | undefined = CANONICAL_ORDER.find(
+        (scope: McpOAuthScope) => {
+          return scope === token;
+        },
+      );
+
+      if (known) {
+        if (!scopes.includes(known)) {
+          scopes.push(known);
+        }
+        continue;
+      }
+
+      if (!unknownScopes.includes(token)) {
+        unknownScopes.push(token);
+      }
+    }
+
+    return {
+      scopes: McpOAuthScopeUtil.sort(scopes),
+      unknownScopes,
+    };
+  }
+
+  /* Whether every token in the string is syntactically a scope token. */
+  public static isWellFormed(value: string): boolean {
+    return value.split(" ").every((token: string) => {
+      return token.length > 0 && SCOPE_TOKEN_PATTERN.test(token);
+    });
+  }
+
+  public static sort(scopes: Array<McpOAuthScope>): Array<McpOAuthScope> {
+    return CANONICAL_ORDER.filter((scope: McpOAuthScope) => {
+      return scopes.includes(scope);
+    });
+  }
+
+  public static toString(scopes: Array<McpOAuthScope>): string {
+    return McpOAuthScopeUtil.sort(scopes).join(" ");
+  }
+
+  /*
+   * The set a grant stores: write is spelled out as read + write so that the
+   * string on the grant, in the token response and on the consent screen all
+   * say the same thing, whichever of the two the client asked for.
+   */
+  public static normalize(scopes: Array<McpOAuthScope>): Array<McpOAuthScope> {
+    const normalized: Array<McpOAuthScope> = [...scopes];
+
+    if (
+      normalized.includes(McpOAuthScope.Write) &&
+      !normalized.includes(McpOAuthScope.Read)
+    ) {
+      normalized.push(McpOAuthScope.Read);
+    }
+
+    return McpOAuthScopeUtil.sort(normalized);
+  }
+
+  public static canRead(scopes: Array<McpOAuthScope>): boolean {
+    return (
+      scopes.includes(McpOAuthScope.Read) ||
+      scopes.includes(McpOAuthScope.Write)
+    );
+  }
+
+  public static canWrite(scopes: Array<McpOAuthScope>): boolean {
+    return scopes.includes(McpOAuthScope.Write);
+  }
+
+  /* Whether `granted` covers everything in `required`, hierarchy included. */
+  public static satisfies(
+    granted: Array<McpOAuthScope>,
+    required: Array<McpOAuthScope>,
+  ): boolean {
+    return required.every((scope: McpOAuthScope) => {
+      if (scope === McpOAuthScope.Read) {
+        return McpOAuthScopeUtil.canRead(granted);
+      }
+
+      return granted.includes(scope);
+    });
+  }
+
+  /*
+   * True when `candidate` asks for nothing `granted` does not already cover.
+   * Used by the refresh grant, which may narrow a token but never widen it.
+   */
+  public static isSubset(
+    candidate: Array<McpOAuthScope>,
+    granted: Array<McpOAuthScope>,
+  ): boolean {
+    return McpOAuthScopeUtil.satisfies(granted, candidate);
+  }
+}

package/Types/Mcp/McpOAuthTicket.ts

@@ -0,0 +1,21 @@
+/*
+ * The ticket: the signed description of an MCP authorization request that
+ * travels through the browser - from the authorization endpoint to the
+ * consent screen in the URL, across a sign-in in a cookie, and back to the
+ * server in the request that approves it.
+ *
+ * Its size limit lives here because both ends have to agree on it. The server
+ * issues tickets and the consent screen receives them; when each kept its own
+ * number, the server would issue a ticket (up to 6000 characters) that the
+ * page then turned away as no request at all (it stopped at 3500). With one
+ * limit, a request too large to carry is refused where it is made, with a
+ * message that says so.
+ *
+ * The limit is what fits in a cookie: browsers cap one at about 4 KB including
+ * its name and attributes. An ordinary request's ticket is well under 1 KB.
+ */
+export const MCP_OAUTH_TICKET_MAX_LENGTH: number = 3500;
+
+// "v1.<payload>.<signature>", all base64url (McpOAuthSignedToken).
+export const MCP_OAUTH_TICKET_PATTERN: RegExp =
+  /^v1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{43}$/;

package/Types/Mcp/McpOAuthTokenType.ts

@@ -0,0 +1,18 @@
+/*
+ * The three credentials the MCP authorization server hands out. They live in
+ * one table because they share everything that matters about a secret - it is
+ * stored only as a digest, it expires, and it belongs to exactly one grant -
+ * and differ only in how long they last and whether they can be used twice.
+ */
+enum McpOAuthTokenType {
+  // Exchanged once, within minutes, for the first access and refresh token.
+  AuthorizationCode = "authorization_code",
+
+  // What an MCP request carries. Short-lived and usable until it expires.
+  AccessToken = "access_token",
+
+  // Exchanged once for a new access token and a new refresh token.
+  RefreshToken = "refresh_token",
+}
+
+export default McpOAuthTokenType;

package/Types/Monitor/MonitorSecretAccess.ts

@@ -0,0 +1,185 @@
+/*
+ * Which monitors may use a monitor secret (issue #1467).
+ *
+ * A secret has exactly one access mode, and the mode alone decides:
+ *
+ *   - All Monitors: every monitor in the secret's project, including monitors
+ *     created after the secret.
+ *   - Specific Monitors: the monitors in the secret's `monitors` list. This was
+ *     the only mode before #1467, so it is the default and every secret that
+ *     existed then has it.
+ *   - Monitors With Labels: monitors that carry at least one of the labels in
+ *     the secret's `labels` list. A monitor gains or loses the secret as its
+ *     labels change.
+ *
+ * Only the list that belongs to the mode is read. MonitorSecretService empties
+ * the other one whenever the mode is written, but a list written over the API
+ * without a mode can still sit there unused, and it must never grant anything:
+ * a forgotten `monitors` list on a label-scoped secret would hand the secret to
+ * monitors that carry none of the labels.
+ *
+ * No mode reaches across projects. The service checks that both lists name
+ * this project's records, but a row written before that check existed can hold
+ * another project's monitor or label, so a project mismatch denies whatever the
+ * lists say.
+ */
+enum MonitorSecretAccess {
+  AllMonitors = "All Monitors",
+  SpecificMonitors = "Specific Monitors",
+  MonitorsWithLabels = "Monitors With Labels",
+}
+
+// The relation lists a mode can read. Each mode reads at most one.
+export type MonitorSecretAccessList = "monitors" | "labels";
+
+export const MONITOR_SECRET_ACCESS_LISTS: ReadonlyArray<MonitorSecretAccessList> =
+  ["monitors", "labels"];
+
+/*
+ * The secret's side of the question, as plain ids so a caller can build it
+ * from whatever it read (a model, a raw row, a test fixture) without the
+ * matcher caring which.
+ */
+export interface MonitorSecretGrant {
+  projectId: string | undefined;
+  // As stored. Anything that is not a known mode grants nothing.
+  monitorAccess: string | undefined;
+  monitorIds: Array<string>;
+  labelIds: Array<string>;
+}
+
+/*
+ * The monitor's side. `monitorId` is undefined for a monitor that is not saved
+ * yet: a test run from the Create Monitor form, which belongs to a project but
+ * is nobody's listed monitor and carries no labels.
+ */
+export interface MonitorSecretGrantee {
+  monitorId: string | undefined;
+  projectId: string | undefined;
+  labelIds: Array<string>;
+}
+
+export class MonitorSecretAccessUtil {
+  // What a secret gets when nobody says otherwise. Matches the column default.
+  public static readonly DEFAULT_ACCESS: MonitorSecretAccess =
+    MonitorSecretAccess.SpecificMonitors;
+
+  public static readonly ALL_ACCESS_MODES: ReadonlyArray<MonitorSecretAccess> =
+    [
+      MonitorSecretAccess.AllMonitors,
+      MonitorSecretAccess.SpecificMonitors,
+      MonitorSecretAccess.MonitorsWithLabels,
+    ];
+
+  public static isValid(value: unknown): value is MonitorSecretAccess {
+    return (
+      typeof value === "string" &&
+      MonitorSecretAccessUtil.ALL_ACCESS_MODES.includes(
+        value as MonitorSecretAccess,
+      )
+    );
+  }
+
+  // The list a mode reads, or null for All Monitors, which reads neither.
+  public static getListUsedBy(
+    access: MonitorSecretAccess,
+  ): MonitorSecretAccessList | null {
+    switch (access) {
+      case MonitorSecretAccess.SpecificMonitors:
+        return "monitors";
+      case MonitorSecretAccess.MonitorsWithLabels:
+        return "labels";
+      default:
+        return null;
+    }
+  }
+
+  // The lists a mode leaves unread: what a write of that mode empties.
+  public static getListsUnusedBy(
+    access: MonitorSecretAccess,
+  ): Array<MonitorSecretAccessList> {
+    const used: MonitorSecretAccessList | null =
+      MonitorSecretAccessUtil.getListUsedBy(access);
+
+    return MONITOR_SECRET_ACCESS_LISTS.filter(
+      (list: MonitorSecretAccessList): boolean => {
+        return list !== used;
+      },
+    );
+  }
+
+  /*
+   * The rule itself. Project first, then the mode, then only the mode's own
+   * list. Ids are compared case-insensitively: Postgres reads uuids back in
+   * lower case, while an ObjectID keeps whatever case it was built from.
+   */
+  public static canMonitorUseSecret(data: {
+    secret: MonitorSecretGrant;
+    monitor: MonitorSecretGrantee;
+  }): boolean {
+    const secretProjectId: string | null = MonitorSecretAccessUtil.normalizeId(
+      data.secret.projectId,
+    );
+    const monitorProjectId: string | null = MonitorSecretAccessUtil.normalizeId(
+      data.monitor.projectId,
+    );
+
+    if (
+      !secretProjectId ||
+      !monitorProjectId ||
+      secretProjectId !== monitorProjectId
+    ) {
+      return false;
+    }
+
+    switch (data.secret.monitorAccess) {
+      case MonitorSecretAccess.AllMonitors:
+        return true;
+
+      case MonitorSecretAccess.SpecificMonitors: {
+        const monitorId: string | null = MonitorSecretAccessUtil.normalizeId(
+          data.monitor.monitorId,
+        );
+
+        if (!monitorId) {
+          return false;
+        }
+
+        return data.secret.monitorIds.some((id: string): boolean => {
+          return MonitorSecretAccessUtil.normalizeId(id) === monitorId;
+        });
+      }
+
+      case MonitorSecretAccess.MonitorsWithLabels: {
+        const monitorLabelIds: Set<string> = new Set();
+
+        for (const labelId of data.monitor.labelIds) {
+          const normalized: string | null =
+            MonitorSecretAccessUtil.normalizeId(labelId);
+
+          if (normalized) {
+            monitorLabelIds.add(normalized);
+          }
+        }
+
+        return data.secret.labelIds.some((id: string): boolean => {
+          const normalized: string | null =
+            MonitorSecretAccessUtil.normalizeId(id);
+
+          return normalized !== null && monitorLabelIds.has(normalized);
+        });
+      }
+
+      default:
+        return false;
+    }
+  }
+
+  private static normalizeId(id: string | undefined | null): string | null {
+    const normalized: string = (id || "").toString().trim().toLowerCase();
+
+    return normalized || null;
+  }
+}
+
+export default MonitorSecretAccess;

package/Types/NotificationSetting/NotificationEmailRollupCategory.ts

@@ -32,6 +32,7 @@ export enum RollupCategory {
   Probes = "probes",
   AIAgents = "ai-agents",
   Slos = "slos",
+  IncomingCalls = "incoming-calls",
   OnCall = "on-call",
   Other = "other",
 }
@@ -52,6 +53,7 @@ export const ROLLUP_CATEGORY_LABEL: Record<RollupCategory, string> = {
   [RollupCategory.Probes]: "Probes",
   [RollupCategory.AIAgents]: "AI Agents",
   [RollupCategory.Slos]: "SLOs",
+  [RollupCategory.IncomingCalls]: "Incoming Calls",
   [RollupCategory.OnCall]: "On Call",
   [RollupCategory.Other]: "Other",
 };
@@ -62,10 +64,10 @@ export const ROLLUP_CATEGORY_LABEL: Record<RollupCategory, string> = {
  * the same thing and a reader only has to learn one taxonomy.
  *
  * This is deliberately an exhaustive Record rather than a lookup with a
- * default: because the key type is the enum itself, adding a 48th member to
+ * default: because the key type is the enum itself, adding a 49th member to
  * NotificationSettingEventType is a COMPILE ERROR here until somebody decides
  * which bucket it belongs in. That is the same idiom the Dashboard's
- * EVENT_LIBRARY uses, and it is the whole reason to spell out 47 lines instead
+ * EVENT_LIBRARY uses, and it is the whole reason to spell out 48 lines instead
  * of matching on a name prefix - a prefix match would quietly file a new
  * resource type under the wrong heading, or under none, and nobody would
  * notice until a customer read the email.
@@ -174,6 +176,14 @@ export const ROLLUP_CATEGORY_BY_EVENT_TYPE: Record<
   [NotificationSettingEventType.SEND_SLO_OWNER_ADDED_NOTIFICATION]:
     RollupCategory.Slos,
 
+  /*
+   * Incoming Call Policies. A category of its own so a burst of on-call
+   * configuration notices (one admin click can fan out a hundred) is never
+   * what pushes a missed customer call over the rollup threshold.
+   */
+  [NotificationSettingEventType.SEND_INCOMING_CALL_MISSED_OWNER_NOTIFICATION]:
+    RollupCategory.IncomingCalls,
+
   /*
    * On Call Notifications, including the two shift reminders. Five of these
    * seven are never rolled up at all (see NotificationEmailRollupPolicy); they
@@ -223,6 +233,7 @@ export const ROLLUP_CATEGORY_ORDER: ReadonlyArray<RollupCategory> = [
   RollupCategory.IncidentEpisodes,
   RollupCategory.Alerts,
   RollupCategory.AlertEpisodes,
+  RollupCategory.IncomingCalls,
   RollupCategory.Slos,
   RollupCategory.Monitors,
   RollupCategory.ScheduledMaintenance,

package/Types/NotificationSetting/NotificationEmailRollupPolicy.ts

@@ -63,7 +63,7 @@ export const ROLLUP_ELIGIBLE_ON_CALL_ADMIN_EVENT_TYPES: ReadonlySet<Notification
   ]);
 
 /*
- * Everything else - the other 42 members. Derived from the enum by exclusion
+ * Everything else - the other 43 members. Derived from the enum by exclusion
  * rather than listed by hand, so the two sets are a partition by construction
  * and cannot drift: there is no edit that adds a member to both, and no edit
  * that drops one from both.

package/Types/NotificationSetting/NotificationSettingEventType.ts

@@ -62,6 +62,9 @@ enum NotificationSettingEventType {
   SEND_SLO_OWNER_STATUS_CHANGE_NOTIFICATION = "Send SLO status change notification when I am the owner of the SLO",
   SEND_SLO_OWNER_ADDED_NOTIFICATION = "Send notification when I am added as a owner to the SLO",
 
+  // Incoming Call Policies
+  SEND_INCOMING_CALL_MISSED_OWNER_NOTIFICATION = "Send missed call notification when I am the owner of the incoming call policy",
+
   // On Call Notifications
   SEND_WHEN_USER_IS_ON_CALL_ROSTER = "When user is on-call roster",
   SEND_WHEN_USER_IS_NEXT_ON_CALL_ROSTER = "When user is next on-call roster",

package/Types/OnCallDutyPolicy/OnCallDutyPolicyArchive.ts

@@ -0,0 +1,19 @@
+/*
+ * What an archived on-call policy leaves behind when something asks it to
+ * page people.
+ *
+ * An archived policy pages no one. An incident, alert or episode that still
+ * lists it - or a person running it from Slack, Microsoft Teams or the AI
+ * assistant - gets an execution log that says so, rather than nothing at all,
+ * so "why was nobody paged?" has an answer on the incident itself. An
+ * execution that was already escalating when the policy was archived stops
+ * at its next step.
+ */
+
+// The execution log of a run that was refused because the policy is archived.
+export const ON_CALL_POLICY_ARCHIVED_NOT_EXECUTED_MESSAGE: string =
+  "Not executed: this on-call policy is archived, so it paged no one. Unarchive it to use it again.";
+
+// The execution log of a run that was escalating when the policy was archived.
+export const ON_CALL_POLICY_ARCHIVED_EXECUTION_STOPPED_MESSAGE: string =
+  "Execution stopped because the on-call policy was archived. The remaining escalation rules were not run.";

package/Types/Permission.ts

@@ -154,6 +154,20 @@ enum Permission {
   EditProjectApiKey = "EditProjectApiKey",
   EditProjectApiKeyPermissions = "EditProjectApiKeyPermissions",
 
+  /*
+   * MCP clients that sign in with OAuth (Settings -> MCP Server).
+   *
+   * AuthorizeMcpClient is unlike the others in this file: every member of a
+   * project may connect an MCP client by signing in, so nobody has to be
+   * granted it. It exists to be BLOCKED - a block row for it on a team stops
+   * that team's members from authorizing clients for the project, and stops
+   * the tokens they already issued. The other two let somebody other than the
+   * member see, and revoke, what members have connected.
+   */
+  AuthorizeMcpClient = "AuthorizeMcpClient",
+  ReadMcpClientAuthorization = "ReadMcpClientAuthorization",
+  DeleteMcpClientAuthorization = "DeleteMcpClientAuthorization",
+
   CreateTelemetryIngestionKey = "CreateTelemetryIngestionKey",
   DeleteTelemetryIngestionKey = "DeleteTelemetryIngestionKey",
   ReadTelemetryIngestionKey = "ReadTelemetryIngestionKey",
@@ -16896,6 +16910,36 @@ export class PermissionHelper {
         isRolePermission: false,
         group: PermissionGroup.Project,
       },
+      {
+        permission: Permission.AuthorizeMcpClient,
+        title: "Authorize MCP Client",
+        description:
+          "Every project member can connect an MCP client (an AI agent) to this project by signing in. Add this as a block permission on a team to stop its members from connecting MCP clients and to stop the clients they already connected.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Settings,
+      },
+      {
+        permission: Permission.ReadMcpClientAuthorization,
+        title: "Read MCP Client Authorization",
+        description:
+          "This permission can see which MCP clients every member has connected to this project. Members can always see their own.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Settings,
+      },
+      {
+        permission: Permission.DeleteMcpClientAuthorization,
+        title: "Revoke MCP Client Authorization",
+        description:
+          "This permission can revoke an MCP client any member has connected to this project. Members can always revoke their own.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Settings,
+      },
     ];
 
     return [...permissions, ...morePermissionProps];

package/Types/ResourceAiAgent/ResourceAiAccess.ts

@@ -395,8 +395,13 @@ export function parseResourceAiAgentPosture(
  * remediation_disabled:          the remediation mode is Disabled.
  * remediation_write_access_missing: the agent runs read-only
  *                                (RESOURCE_AI_ALLOW_WRITES_ENV is not true).
- * ai_disabled_for_project / auto_remediation_disabled_for_project /
- * llm_provider_missing / ai_balance_insufficient: the project-wide gates.
+ * ai_disabled_for_project / llm_provider_missing / ai_balance_insufficient:
+ *                                the project-wide gates.
+ * auto_remediation_disabled_for_project: retired. It was the project's
+ *                                "Enable auto-remediation" switch, folded
+ *                                into Enable AI (ai_disabled_for_project);
+ *                                the status no longer produces it and the
+ *                                code stays for compatibility.
  */
 export type ResourceAiAccessGapCode =
   | "ai_agent_not_connected"

package/Types/StatusPage/StatusPageArchive.ts

@@ -0,0 +1,20 @@
+/*
+ * What an archived status page says, to its visitors and to the team.
+ *
+ * An archived status page is offline: every public route answers as if the
+ * page did not exist (so a visitor cannot tell "archived" from "never
+ * existed"), and its subscribers are sent nothing - no incident or
+ * maintenance updates, no announcements, no reports. The team still sees
+ * and edits it in the dashboard, where the reasons below are given in full.
+ */
+
+// What a visitor (or a public API call) gets for an archived page.
+export const STATUS_PAGE_NOT_FOUND_MESSAGE: string = "Status Page not found";
+
+// A test report or a manual send from the dashboard for an archived page.
+export const STATUS_PAGE_ARCHIVED_SENDS_NOTHING_MESSAGE: string =
+  "This status page is archived, so it sends nothing to its subscribers. Unarchive it first.";
+
+// Adding a subscriber to an archived page.
+export const STATUS_PAGE_ARCHIVED_NO_NEW_SUBSCRIBERS_MESSAGE: string =
+  "This status page is archived, so it takes no new subscribers. Unarchive it first.";