@oneuptime/common 14.0.11 → 14.0.12

package/Server/Infrastructure/Postgres/SchemaMigrations/1797100000000-AddMonitorSecretAccess.ts

@@ -0,0 +1,55 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Which monitors may use a monitor secret (issue #1467). A secret used to be
+ * usable only by the monitors listed on it; it now has one of three access
+ * modes - every monitor in the project, the listed monitors, or monitors with
+ * any of its labels - and a label list beside the monitor list.
+ *
+ * The column default is the old behaviour, so every existing secret becomes
+ * "Specific Monitors" and keeps exactly the monitors it had. The label list
+ * cascades both ways: deleting a secret or a label removes the link.
+ */
+export class AddMonitorSecretAccess1797100000000 implements MigrationInterface {
+  public name: string = "AddMonitorSecretAccess1797100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "MonitorSecretLabel" ("monitorSecretId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_7bbefc5a8eb14ddb14a0c19d054" PRIMARY KEY ("monitorSecretId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_53812c47353639b995ba4772f4" ON "MonitorSecretLabel" ("monitorSecretId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_b0fdc52c7519e4e09190d31711" ON "MonitorSecretLabel" ("labelId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorSecret" ADD "monitorAccess" character varying(100) NOT NULL DEFAULT 'Specific Monitors'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorSecretLabel" ADD CONSTRAINT "FK_53812c47353639b995ba4772f4e" FOREIGN KEY ("monitorSecretId") REFERENCES "MonitorSecret"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorSecretLabel" ADD CONSTRAINT "FK_b0fdc52c7519e4e09190d317113" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "MonitorSecretLabel" DROP CONSTRAINT "FK_b0fdc52c7519e4e09190d317113"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorSecretLabel" DROP CONSTRAINT "FK_53812c47353639b995ba4772f4e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorSecret" DROP COLUMN "monitorAccess"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b0fdc52c7519e4e09190d31711"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_53812c47353639b995ba4772f4"`,
+    );
+    await queryRunner.query(`DROP TABLE "MonitorSecretLabel"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1797200000000-AddArchiveToMoreResources.ts

@@ -0,0 +1,167 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration, then renumbered after
+ * the last registered migration.
+ *
+ * Archive for the resources people create and keep that could not be archived
+ * yet: workflows, monitors, status pages, dashboards and on-call policies.
+ * Each gets the same three columns every archivable resource already has
+ * (1782600000000-AddArchiveToResources): "isArchived" (NOT NULL DEFAULT
+ * false, so every existing row stays live), "archivedAt" and
+ * "archivedByUserId" (stamped by the server from the isArchived write, NULL
+ * while not archived, SET NULL when that user is deleted), plus the
+ * ("projectId", "isArchived") index every list query filters on.
+ *
+ * Adding a NOT NULL column with a constant default does not rewrite the table
+ * on Postgres 11+, so this is cheap even on a large Monitor table.
+ */
+export class AddArchiveToMoreResources1797200000000
+  implements MigrationInterface
+{
+  public name: string = "AddArchiveToMoreResources1797200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD "isArchived" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD "archivedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD "archivedByUserId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicy" ADD "isArchived" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicy" ADD "archivedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicy" ADD "archivedByUserId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "isArchived" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "archivedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "archivedByUserId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" ADD "isArchived" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" ADD "archivedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" ADD "archivedByUserId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" ADD "isArchived" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" ADD "archivedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" ADD "archivedByUserId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_cdc971b41d78e4bed90a1d611b" ON "Monitor" ("projectId", "isArchived") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_c538a124340d6df2474d178f7e" ON "OnCallDutyPolicy" ("projectId", "isArchived") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_2574818e18375c4e77199e09e4" ON "StatusPage" ("projectId", "isArchived") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_84ee6949e41b09ca3b2728f76b" ON "Workflow" ("projectId", "isArchived") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_43fd45f385e6620444df61ae9e" ON "Dashboard" ("projectId", "isArchived") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD CONSTRAINT "FK_3e1a5a33af8c38b49ff26a08688" FOREIGN KEY ("archivedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicy" ADD CONSTRAINT "FK_30540eb00f5264500c246a4656f" FOREIGN KEY ("archivedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD CONSTRAINT "FK_30e313a8df89c8b4e904913a2de" FOREIGN KEY ("archivedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" ADD CONSTRAINT "FK_a3645d531917a7236432c7caeb4" FOREIGN KEY ("archivedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" ADD CONSTRAINT "FK_a1238cc4415cdf9b099a755fac2" FOREIGN KEY ("archivedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" DROP CONSTRAINT "FK_a1238cc4415cdf9b099a755fac2"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" DROP CONSTRAINT "FK_a3645d531917a7236432c7caeb4"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP CONSTRAINT "FK_30e313a8df89c8b4e904913a2de"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicy" DROP CONSTRAINT "FK_30540eb00f5264500c246a4656f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP CONSTRAINT "FK_3e1a5a33af8c38b49ff26a08688"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_43fd45f385e6620444df61ae9e"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_84ee6949e41b09ca3b2728f76b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_2574818e18375c4e77199e09e4"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_c538a124340d6df2474d178f7e"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_cdc971b41d78e4bed90a1d611b"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Dashboard" DROP COLUMN "archivedByUserId"`,
+    );
+    await queryRunner.query(`ALTER TABLE "Dashboard" DROP COLUMN "archivedAt"`);
+    await queryRunner.query(`ALTER TABLE "Dashboard" DROP COLUMN "isArchived"`);
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" DROP COLUMN "archivedByUserId"`,
+    );
+    await queryRunner.query(`ALTER TABLE "Workflow" DROP COLUMN "archivedAt"`);
+    await queryRunner.query(`ALTER TABLE "Workflow" DROP COLUMN "isArchived"`);
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "archivedByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "archivedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "isArchived"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicy" DROP COLUMN "archivedByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicy" DROP COLUMN "archivedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicy" DROP COLUMN "isArchived"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP COLUMN "archivedByUserId"`,
+    );
+    await queryRunner.query(`ALTER TABLE "Monitor" DROP COLUMN "archivedAt"`);
+    await queryRunner.query(`ALTER TABLE "Monitor" DROP COLUMN "isArchived"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -28,6 +28,11 @@ import { AddIncidentForms1796400000000 } from "./1796400000000-AddIncidentForms"
 import { AddTeamComplianceRuleNotificationChannels1796500000000 } from "./1796500000000-AddTeamComplianceRuleNotificationChannels";
 import { AddAIInvestigationConversationAndTimeLimits1796600000000 } from "./1796600000000-AddAIInvestigationConversationAndTimeLimits";
 import { AddMessageQueueTables1796700000000 } from "./1796700000000-AddMessageQueueTables";
+import { FoldAiSwitchesIntoEnableAi1796800000000 } from "./1796800000000-FoldAiSwitchesIntoEnableAi";
+import { AddMcpOAuthTables1796900000000 } from "./1796900000000-AddMcpOAuthTables";
+import { AddWorkflowIncomingEmailSecretKey1797000000000 } from "./1797000000000-AddWorkflowIncomingEmailSecretKey";
+import { AddMonitorSecretAccess1797100000000 } from "./1797100000000-AddMonitorSecretAccess";
+import { AddArchiveToMoreResources1797200000000 } from "./1797200000000-AddArchiveToMoreResources";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1256,4 +1261,9 @@ export default [
   AddTeamComplianceRuleNotificationChannels1796500000000,
   AddAIInvestigationConversationAndTimeLimits1796600000000,
   AddMessageQueueTables1796700000000,
+  FoldAiSwitchesIntoEnableAi1796800000000,
+  AddMcpOAuthTables1796900000000,
+  AddWorkflowIncomingEmailSecretKey1797000000000,
+  AddMonitorSecretAccess1797100000000,
+  AddArchiveToMoreResources1797200000000,
 ];

package/Server/Middleware/McpDelegationAuthorization.ts

@@ -0,0 +1,204 @@
+import AccessTokenService from "../Services/AccessTokenService";
+import ProjectService from "../Services/ProjectService";
+import TeamMemberService from "../Services/TeamMemberService";
+import UserService from "../Services/UserService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../Utils/Express";
+import McpDelegationToken, {
+  McpDelegationClaims,
+} from "../Utils/Mcp/McpDelegationToken";
+import McpOAuthConfig from "../Utils/Mcp/McpOAuthConfig";
+import Response from "../Utils/Response";
+import SpanUtil from "../Utils/Telemetry/SpanUtil";
+import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import ExceptionMessages from "../../Types/Exception/ExceptionMessages";
+import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
+import Name from "../../Types/Name";
+import ObjectID from "../../Types/ObjectID";
+import {
+  UserGlobalAccessPermission,
+  UserTenantAccessPermission,
+} from "../../Types/Permission";
+import UserType from "../../Types/UserType";
+
+/*
+ * How the API recognises a request the MCP server is making for a member who
+ * connected an MCP client with OAuth (see McpDelegationToken for why the
+ * client's own access token never reaches the API).
+ *
+ * The request is authorized AS THE MEMBER, in the one project the grant is
+ * for:
+ *
+ *   - the tenant is the grant's project, whatever `tenantid` or `projectid`
+ *     the request happens to carry - the same rule an API key gets, where the
+ *     project comes from the credential and never from the caller;
+ *   - the permissions are the member's own, read here from their teams on
+ *     every request, so a role change or a removal from the project applies
+ *     to the very next tool call;
+ *   - it is a User request, never a MasterAdmin one, even when the member is
+ *     a master admin. An agent acting for an instance administrator gets what
+ *     that person's teams grant in the project and nothing more;
+ *   - a grant that carries read access only is marked read-only, and the
+ *     permission layer then refuses every create, update and delete it makes,
+ *     whatever the member's own permissions allow.
+ *
+ * Everything about the GRANT - that it exists, has not been revoked or
+ * expired, still satisfies the project's SSO rules - was checked by the MCP
+ * server before it minted the token, a moment ago, and is not asked again
+ * here. What is asked again is the little that could matter for an API call
+ * and costs nothing to ask: the token verifies, and the member is not blocked.
+ */
+
+const MULTI_TENANT_QUERY_HEADER: string = "is-multi-tenant-query";
+const API_KEY_HEADER: string = "apikey";
+
+const INVALID_DELEGATION_MESSAGE: string =
+  "The MCP delegation token is invalid or has expired.";
+
+export default class McpDelegationAuthorization {
+  /*
+   * Presence, not validity - the reading ProjectMiddleware.hasApiKey makes of
+   * its own header, for the same reason: a request that carries the header is
+   * a caller attempting this kind of authentication, and it must be answered
+   * as that (a 401 saying so) rather than fall through to another credential
+   * or to the anonymous path.
+   */
+  public static hasDelegationToken(req: ExpressRequest): boolean {
+    return req.headers?.[McpDelegationToken.HEADER_NAME] !== undefined;
+  }
+
+  public static async authorize(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> {
+    const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
+
+    try {
+      if (!McpOAuthConfig.isEnabled()) {
+        throw new NotAuthenticatedException(INVALID_DELEGATION_MESSAGE);
+      }
+
+      /*
+       * Two credentials on one request is never something the MCP server
+       * sends. Refusing it outright means there is no order of precedence to
+       * get wrong.
+       */
+      if (req.headers[API_KEY_HEADER] !== undefined) {
+        throw new BadDataException(
+          "A request cannot carry both an API key and an MCP delegation token.",
+        );
+      }
+
+      const rawToken: string | Array<string> | undefined =
+        req.headers[McpDelegationToken.HEADER_NAME];
+
+      const claims: McpDelegationClaims | null = McpDelegationToken.verify(
+        Array.isArray(rawToken) ? undefined : rawToken,
+      );
+
+      if (!claims) {
+        throw new NotAuthenticatedException(INVALID_DELEGATION_MESSAGE);
+      }
+
+      if (await UserService.isUserBlocked(claims.userId)) {
+        throw new NotAuthenticatedException(ExceptionMessages.UserBlocked);
+      }
+
+      /*
+       * A delegated request is for exactly one project. Dropping the header
+       * (rather than merely not setting the flag) keeps every later reader of
+       * the raw request from widening it.
+       */
+      delete req.headers[MULTI_TENANT_QUERY_HEADER];
+
+      oneuptimeRequest.tenantId = claims.projectId;
+      oneuptimeRequest.userType = UserType.User;
+      oneuptimeRequest.userAuthorization = {
+        userId: claims.userId,
+        email: claims.userEmail,
+        name: new Name(claims.userName),
+        isMasterAdmin: false,
+        isGlobalLogin: false,
+      };
+      oneuptimeRequest.mcpOAuth = {
+        grantId: claims.grantId,
+        clientId: claims.clientId,
+        clientName: claims.clientName,
+        isReadOnly: !claims.canWrite,
+      };
+
+      SpanUtil.addAttributesToCurrentSpan({
+        userId: claims.userId.toString(),
+        userType: UserType.User,
+        projectId: claims.projectId.toString(),
+        mcpOAuthGrantId: claims.grantId.toString(),
+        ...(oneuptimeRequest.requestId
+          ? { requestId: oneuptimeRequest.requestId }
+          : {}),
+      });
+
+      // Fire-and-forget, debounced inside each service - as for a session.
+      void ProjectService.updateLastActive(claims.projectId);
+      void UserService.updateLastActive(claims.userId);
+
+      const userGlobalAccessPermissionPromise: Promise<UserGlobalAccessPermission | null> =
+        AccessTokenService.getUserGlobalAccessPermission(claims.userId);
+
+      const [
+        userGlobalAccessPermission,
+        userTenantAccessPermission,
+        userTeamIds,
+      ]: [
+        UserGlobalAccessPermission | null,
+        UserTenantAccessPermission | null,
+        Array<ObjectID>,
+      ] = await Promise.all([
+        userGlobalAccessPermissionPromise,
+        AccessTokenService.getUserTenantAccessPermission(
+          claims.userId,
+          claims.projectId,
+          { userGlobalAccessPermission: userGlobalAccessPermissionPromise },
+        ),
+        TeamMemberService.getTeamIdsForUser(claims.userId, claims.projectId),
+      ]);
+
+      /*
+       * No permission set means the member has left the project since the MCP
+       * server looked. Without this the request would carry on with no tenant
+       * permissions at all and fail later as a puzzling per-model refusal.
+       */
+      if (!userTenantAccessPermission) {
+        throw new NotAuthenticatedException(
+          "You are no longer a member of the project this MCP client is connected to.",
+        );
+      }
+
+      if (userGlobalAccessPermission) {
+        /*
+         * The global permission lists every project the member belongs to.
+         * This request is for one of them, so that is all it is told about.
+         */
+        oneuptimeRequest.userGlobalAccessPermission = {
+          ...userGlobalAccessPermission,
+          projectIds: [claims.projectId],
+        };
+      }
+
+      oneuptimeRequest.userTenantAccessPermission = {
+        [claims.projectId.toString()]: userTenantAccessPermission,
+      };
+      oneuptimeRequest.userTeamIds = userTeamIds;
+
+      return next();
+    } catch (err) {
+      SpanUtil.recordExceptionOnCurrentSpan(err);
+      return Response.sendErrorResponse(req, res, err as Exception);
+    }
+  }
+}