@oneuptime/common 14.0.12 → 14.0.14

package/Server/Services/DashboardService.ts

@@ -16,6 +16,7 @@ import { IsBillingEnabled } from "../EnvironmentConfig";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import DashboardViewConfigUtil from "../../Utils/Dashboard/DashboardViewConfig";
 import {
+  DASHBOARD_TEMPLATE_MISC_DATA_KEY,
   DashboardTemplateType,
   getTemplateConfig,
 } from "../../Types/Dashboard/DashboardTemplates";
@@ -29,6 +30,12 @@ import {
   DASHBOARD_MASTER_PASSWORD_COOKIE_IDENTIFIER,
   DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
 } from "../../Types/Dashboard/MasterPassword";
+import {
+  DashboardAccessState,
+  isDashboardLockedWithoutPassword,
+  isDashboardMasterPasswordRequired,
+  isDashboardPublic,
+} from "../../Types/Dashboard/DashboardAccess";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -65,7 +72,7 @@ export class Service extends DatabaseService<Model> {
 
     // Check if a template type was provided via miscDataProps
     const templateType: string | undefined = createBy.miscDataProps?.[
-      "dashboardTemplateType"
+      DASHBOARD_TEMPLATE_MISC_DATA_KEY
     ] as string | undefined;
 
     if (
@@ -158,12 +165,25 @@ export class Service extends DatabaseService<Model> {
         },
       });
 
+      /*
+       * Who can view it, by the one rule the Sharing page shows and writes
+       * (Types/Dashboard/DashboardAccess).
+       */
+      const accessState: DashboardAccessState = {
+        isPublicDashboard: dashboard?.isPublicDashboard,
+        enableMasterPassword: dashboard?.enableMasterPassword,
+        hasMasterPassword: Boolean(dashboard?.masterPassword),
+      };
+
       /*
        * If dashboard is not public, deny access. An archived dashboard is
        * not public either, whatever its public setting says: the setting is
        * kept so unarchiving puts the public link back exactly as it was.
        */
-      if (dashboard && (!dashboard.isPublicDashboard || dashboard.isArchived)) {
+      if (
+        dashboard &&
+        (!isDashboardPublic(accessState) || dashboard.isArchived)
+      ) {
         return {
           hasReadAccess: false,
           error: new NotAuthenticatedException(
@@ -216,14 +236,16 @@ export class Service extends DatabaseService<Model> {
       }
 
       const shouldEnforceMasterPassword: boolean = Boolean(
-        dashboard &&
-          dashboard.isPublicDashboard &&
-          dashboard.enableMasterPassword,
+        dashboard && isDashboardMasterPasswordRequired(accessState),
       );
 
       if (shouldEnforceMasterPassword) {
-        // Fail closed if protection was enabled before a password was set.
-        if (!dashboard?.masterPassword) {
+        /*
+         * Fail closed if protection was enabled before a password was set.
+         * The Sharing page never writes this state (picking the password
+         * asks for one), but the API can, and so could the old page.
+         */
+        if (isDashboardLockedWithoutPassword(accessState)) {
           return {
             hasReadAccess: false,
             error: new MasterPasswordRequiredException(
@@ -253,7 +275,7 @@ export class Service extends DatabaseService<Model> {
       }
 
       // Public dashboard without master password - grant access
-      if (dashboard && dashboard.isPublicDashboard) {
+      if (dashboard && isDashboardPublic(accessState)) {
         return {
           hasReadAccess: true,
         };

package/Server/Services/DatabaseService.ts

@@ -102,6 +102,12 @@ import type AuditLogServiceType from "./AuditLogService";
 import EnableAuditLogOn from "../../Types/BaseDatabase/EnableAuditLogOn";
 import RelationValueUtil from "../Utils/Database/RelationValueUtil";
 import RelationIdUtil from "../Utils/Database/RelationIdUtil";
+import ListOrderMaintainer, {
+  ListOrderCreatePlan,
+  ListOrderScope,
+} from "../Utils/Database/ListOrderMaintainer";
+import { ListOrderSettings } from "../../Types/Database/ListOrderColumn";
+import { toListOrderNumber } from "../../Utils/ListOrder";
 
 const RULE_CRITERIA_RELATION_OPERATORS: ReadonlySet<RuleCriteriaOperator> =
   new Set<RuleCriteriaOperator>([
@@ -360,11 +366,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     createBy: CreateBy<TBaseModel>,
   ): Promise<OnCreate<TBaseModel>> {
     // Private method that runs before create.
-    const projectIdColumn: string | null = this.model.getTenantColumn();
-
-    if (projectIdColumn && createBy.props.tenantId) {
-      (createBy.data as any)[projectIdColumn] = createBy.props.tenantId;
-    }
+    this.stampTenantOnCreate(createBy.data, createBy.props);
 
     return await this.onBeforeCreate(createBy);
   }
@@ -717,6 +719,36 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     return Promise.resolve({ findBy, carryForward: null });
   }
 
+  /*
+   * Runs on a create once the caller has passed the permission checks, just
+   * before the @UniqueColumnBy and @UniqueColumnsTogether checks, which
+   * refuse a clash with an existing row as "<Model> with the same <column>
+   * already exists.". Override it to refuse a clash in words of your own:
+   * the caller may create the row, so a refusal may say what exists (see
+   * DiscoveredResourceCreate.refuseClash). Skipped with ignoreHooks.
+   */
+  protected async onBeforeCreateUniqueCheck(
+    _createBy: CreateBy<TBaseModel>,
+  ): Promise<void> {
+    // A place holder method used for overriding.
+    return Promise.resolve();
+  }
+
+  /*
+   * The same for an update: runs once the caller has passed the permission
+   * checks, with the query already narrowed to the rows they may write and
+   * before the data is serialized, so it may still adjust what is written.
+   * Unlike onBeforeUpdate - which runs before any check - a refusal here
+   * may say what exists (see DiscoveredResourceUpdate.checkMatchColumn).
+   * Skipped with ignoreHooks.
+   */
+  protected async onBeforeUpdateUniqueCheck(
+    _updateBy: UpdateBy<TBaseModel>,
+  ): Promise<void> {
+    // A place holder method used for overriding.
+    return Promise.resolve();
+  }
+
   protected async onCreateSuccess(
     _onCreate: OnCreate<TBaseModel>,
     createdItem: TBaseModel,
@@ -1087,6 +1119,100 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       RULE_CRITERIA_LEGACY_NEVER_MATCH_PATTERN;
   }
 
+  /*
+   * Whether this model's tenant column is its own primary key - true of
+   * Project alone (`@TenantColumn("_id")`). A project IS its tenant, so its
+   * reads, updates and deletes are scoped to the request's project by `_id`.
+   * A create is the exception: it mints a new tenant, and the request's
+   * tenant is some other project that already exists.
+   */
+  private isTenantColumnPrimaryKey(): boolean {
+    return this.model.getTenantColumn() === "_id";
+  }
+
+  /*
+   * Writes the request's tenant onto a row being created, so a create made in
+   * a project lands in that project whatever the payload said.
+   *
+   * Skipped for a model whose tenant column is its own primary key. There the
+   * stamp hands the new row the id of the project the request was made in,
+   * and save() takes an entity carrying an existing id as an UPDATE of that
+   * row: POST /api/project with a tenantid header answered 500 only because
+   * the stamped value was an ObjectID, which Postgres could not read as a
+   * uuid, instead of overwriting the project the header named.
+   *
+   * The tenant is ignored for that create, not refused. It names the project
+   * the caller is working in, which says nothing about a project that does
+   * not exist yet, and some callers cannot leave it off: an API key's or an
+   * MCP grant's tenant comes from the credential. Whether the caller may
+   * create a project at all is for the permission checks and ProjectService's
+   * hooks to answer. (The Dashboard sends no tenant for this create - see
+   * isMultiTenantRequest in ProjectPicker.)
+   */
+  private stampTenantOnCreate(
+    data: TBaseModel,
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    const tenantColumn: string | null = this.model.getTenantColumn();
+
+    if (!tenantColumn || !props.tenantId || this.isTenantColumnPrimaryKey()) {
+      return;
+    }
+
+    data.setColumnValue(tenantColumn, props.tenantId);
+  }
+
+  /*
+   * The last check a create makes before save(), on the entity save() is
+   * actually handed. save() chooses between INSERT and UPDATE by that
+   * entity's primary key: one carrying the id of an existing row is loaded
+   * and UPDATEd in place, so a create that reaches it with an id rewrites a
+   * record nobody asked to change.
+   *
+   * create() refuses a caller-supplied id up front, but the hooks, the tenant
+   * stamp and the rest of the pipeline all write to the same entity after
+   * that check - the tenant stamp is how a new Project came to carry the id
+   * of the project the request was made in. So, once more, here:
+   *
+   *  - a non-root create may not carry an id, whatever put it there;
+   *  - no create, root included, of a model whose tenant column is its own
+   *    primary key may carry the request tenant's id. Root callers may
+   *    assign ids, but this one can only come from a generic tenant stamp -
+   *    workflow components create as root WITH a tenant, after
+   *    applyTenantColumn has written the tenant column - and it would make
+   *    the create an update of the caller's own project.
+   *
+   * The ids are compared as text, case-insensitively: the id may be an
+   * ObjectID or a plain string, and Postgres reads a uuid in either case.
+   */
+  private assertCreateWillInsert(
+    data: TBaseModel,
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    const suppliedId: unknown = data._id;
+
+    if (!suppliedId) {
+      return;
+    }
+
+    if (!props.isRoot && !props.isMasterAdmin) {
+      throw new BadDataException(
+        `An id cannot be supplied when creating ${this.model.singularName}.`,
+      );
+    }
+
+    if (
+      this.isTenantColumnPrimaryKey() &&
+      props.tenantId &&
+      String(suppliedId).toLowerCase() ===
+        props.tenantId.toString().toLowerCase()
+    ) {
+      throw new BadDataException(
+        `A new ${this.model.singularName} cannot take the id of the ${this.model.singularName} this request is made in.`,
+      );
+    }
+  }
+
   /*
    * A tenant model declares its tenant TWICE: a scalar column (e.g.
    * `projectId`) AND a ManyToOne relation (`project`) whose @JoinColumn names
@@ -1582,7 +1708,9 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
      * this guards every other non-root caller (custom routes, workflow
      * components) too. Root/internal seeding legitimately assigns ids and is
      * exempt. Only the top-level primary key is checked - nested relation
-     * `_id`s reference existing related rows and are fine.
+     * `_id`s reference existing related rows and are fine. Asked again just
+     * before save(), once the hooks and the tenant stamp have had their turn
+     * (assertCreateWillInsert).
      */
     if (
       !createBy.props.isRoot &&
@@ -1611,12 +1739,8 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
     let data: TBaseModel = _createdBy.data;
 
-    // add tenantId if present.
-    const tenantColumnName: string | null = data.getTenantColumn();
-
-    if (tenantColumnName && _createdBy.props.tenantId) {
-      data.setColumnValue(tenantColumnName, _createdBy.props.tenantId);
-    }
+    // add tenantId if present, unless it is the row's own id. See the helper.
+    this.stampTenantOnCreate(data, _createdBy.props);
 
     /*
      * The tenant scalar has just been stamped to the request tenant, but the
@@ -1653,8 +1777,23 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       _createdBy.props,
     );
 
+    /*
+     * A drag-ordered list (@ListOrderColumn): the new row goes to the end of
+     * its list, or to the place the caller asked for. Planned after the
+     * permission check, so a number the server picks is not held against the
+     * caller's column permissions - a number the caller sent was checked as
+     * sent - and before the save, so the row is written with its number.
+     */
+    const listOrderPlan: ListOrderCreatePlan | null =
+      await this.planListOrderForCreate(data);
+
     createBy.data = data;
 
+    // A service's own words for a clash, before the generic checks below.
+    if (!createBy.props.ignoreHooks) {
+      await this.onBeforeCreateUniqueCheck(createBy);
+    }
+
     // check uniqueColumns by:
     createBy = await this.checkUniqueColumnBy(createBy);
 
@@ -1666,6 +1805,9 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       createBy.props,
     )) as TBaseModel;
 
+    // Whatever has written to it since the top of create(), this must INSERT.
+    this.assertCreateWillInsert(createBy.data, createBy.props);
+
     try {
       createBy.data = await this.getRepository().save(createBy.data);
       this.applyRuleCriteriaEffectiveEnabledToItem(createBy.data);
@@ -1673,6 +1815,9 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       // Seed telemetry context with projectId + <model>Id for this create.
       this.setTelemetryContextFromItem(createBy.data);
 
+      // The rows that make room for it, now that it exists.
+      await this.applyListOrderCreatePlan(listOrderPlan);
+
       if (!createBy.props.ignoreHooks) {
         createBy.data = await this.onCreateSuccess(
           {
@@ -1941,6 +2086,263 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     return data;
   }
 
+  /*
+   * ---------------------------------------------------------------------
+   * Drag-ordered lists (@ListOrderColumn)
+   * ---------------------------------------------------------------------
+   *
+   * A model marked with @ListOrderColumn is a list people put in order by
+   * dragging its rows, and its number column is kept here for every caller:
+   * a new row without a number goes to the end of its list, and a row given a
+   * number another row of its list holds takes that place while the rows in
+   * the way step aside. Numbers nobody collides with are kept as written. The
+   * arithmetic is Common/Utils/ListOrder, the database work
+   * ListOrderMaintainer. None of it runs for any other model.
+   */
+  private async planListOrderForCreate(
+    data: TBaseModel,
+  ): Promise<ListOrderCreatePlan | null> {
+    const settings: ListOrderSettings | null = ListOrderMaintainer.getSettings(
+      this.getModel(),
+    );
+
+    if (!settings) {
+      return null;
+    }
+
+    const plan: ListOrderCreatePlan | null =
+      await ListOrderMaintainer.planCreate({
+        service: this,
+        settings: settings,
+        row: data,
+      });
+
+    if (plan) {
+      data.setColumnValue(settings.column, plan.value);
+    }
+
+    return plan;
+  }
+
+  /*
+   * The new row is saved; now the rows in its way step aside. Never fails the
+   * create that already happened: a list left with a shared number still
+   * shows every row, and the next move in it sorts the pair out.
+   */
+  private async applyListOrderCreatePlan(
+    plan: ListOrderCreatePlan | null,
+  ): Promise<void> {
+    const settings: ListOrderSettings | null = ListOrderMaintainer.getSettings(
+      this.getModel(),
+    );
+
+    if (!plan || !settings || plan.siblingChanges.length === 0) {
+      return;
+    }
+
+    try {
+      await ListOrderMaintainer.writeChanges({
+        service: this,
+        settings: settings,
+        changes: plan.siblingChanges,
+      });
+    } catch (err) {
+      logger.error(
+        `Could not make room in the ${this.getModel().tableName || "list"} order for a new row: ${(err as Error)?.message || err}`,
+      );
+    }
+  }
+
+  /*
+   * The model's list settings when an update writes the number column or
+   * moves a row to another list, null otherwise - so an ordinary edit of a
+   * row costs nothing extra.
+   */
+  private getListOrderSettingsTouchedBy(
+    dataKeys: Array<string>,
+  ): ListOrderSettings | null {
+    const settings: ListOrderSettings | null = ListOrderMaintainer.getSettings(
+      this.getModel(),
+    );
+
+    if (!settings) {
+      return null;
+    }
+
+    if (dataKeys.includes(settings.column)) {
+      return settings;
+    }
+
+    const scopeKeys: Array<string> = [...settings.scopeColumns];
+
+    for (const column of this.getModel().getTableColumns().columns) {
+      const relationOf: string | undefined =
+        this.getModel().getTableColumnMetadata(column)?.manyToOneRelationColumn;
+
+      if (relationOf && settings.scopeColumns.includes(relationOf)) {
+        scopeKeys.push(column);
+      }
+    }
+
+    const movesToAnotherList: boolean = scopeKeys.some((key: string) => {
+      return dataKeys.includes(key);
+    });
+
+    return movesToAnotherList ? settings : null;
+  }
+
+  private addListOrderColumnsToSelect(
+    select: Dictionary<unknown>,
+    settings: ListOrderSettings,
+  ): void {
+    select[settings.column] = true;
+
+    for (const column of settings.scopeColumns) {
+      select[column] = true;
+    }
+  }
+
+  /*
+   * After an update wrote a row's number: the rows of its list that held that
+   * number step aside. A row that moved to another list takes the number it
+   * was given there (with the same stepping aside), or the end of that list
+   * when it was given none.
+   *
+   * Like the create, it never fails the update that already happened.
+   */
+  private async placeUpdatedRowsInListOrder(input: {
+    settings: ListOrderSettings;
+    rowsBeforeUpdate: Array<TBaseModel>;
+    data: PartialEntity<TBaseModel>;
+  }): Promise<void> {
+    const settings: ListOrderSettings = input.settings;
+    const dataRecord: Record<string, unknown> = input.data as Record<
+      string,
+      unknown
+    >;
+    const writesNumber: boolean = Object.prototype.hasOwnProperty.call(
+      dataRecord,
+      settings.column,
+    );
+
+    for (const rowBeforeUpdate of input.rowsBeforeUpdate) {
+      if (!rowBeforeUpdate._id) {
+        continue;
+      }
+
+      try {
+        const before: Record<string, unknown> =
+          rowBeforeUpdate as unknown as Record<string, unknown>;
+
+        const previousScope: ListOrderScope<TBaseModel> | null =
+          ListOrderMaintainer.getScope({
+            model: this.getModel(),
+            settings: settings,
+            row: before,
+          });
+
+        const nextScope: ListOrderScope<TBaseModel> | null =
+          ListOrderMaintainer.getScope({
+            model: this.getModel(),
+            settings: settings,
+            row: { ...before, ...dataRecord },
+          });
+
+        if (!nextScope) {
+          continue;
+        }
+
+        const id: ObjectID = new ObjectID(rowBeforeUpdate._id.toString());
+        const isNewToList: boolean = Boolean(
+          previousScope && previousScope.key !== nextScope.key,
+        );
+
+        if (isNewToList && !writesNumber) {
+          await ListOrderMaintainer.appendRow({
+            service: this,
+            settings: settings,
+            scope: nextScope,
+            id: id,
+          });
+
+          continue;
+        }
+
+        if (!writesNumber) {
+          continue;
+        }
+
+        const previousValue: unknown = isNewToList
+          ? null
+          : before[settings.column];
+
+        const requestedValue: unknown = dataRecord[settings.column];
+
+        if (
+          !isNewToList &&
+          toListOrderNumber(requestedValue) !== null &&
+          toListOrderNumber(requestedValue) === toListOrderNumber(previousValue)
+        ) {
+          // Saved where it already was - an edit form re-sending it, say.
+          continue;
+        }
+
+        if (toListOrderNumber(requestedValue) === null) {
+          /*
+           * The number was cleared: the row goes to the end of its list, as
+           * a row created without one does.
+           */
+          await ListOrderMaintainer.appendRow({
+            service: this,
+            settings: settings,
+            scope: nextScope,
+            id: id,
+          });
+
+          continue;
+        }
+
+        await ListOrderMaintainer.makeRoomForRow({
+          service: this,
+          settings: settings,
+          scope: nextScope,
+          id: id,
+          previousValue: previousValue,
+          requestedValue: requestedValue,
+        });
+      } catch (err) {
+        logger.error(
+          `Could not reorder the ${this.getModel().tableName || "list"} list after an update: ${(err as Error)?.message || err}`,
+        );
+      }
+    }
+  }
+
+  /*
+   * Numbers every list of this model that has rows without a number, or two
+   * rows sharing one, 1..n in the order it is shown in today; lists whose
+   * numbers are unique are left alone. Does nothing for a model that is not
+   * a drag-ordered list. Used by the NormalizeListOrder data migration.
+   */
+  @CaptureSpan()
+  public async normalizeListOrders(): Promise<{
+    lists: number;
+    rowsChanged: number;
+  }> {
+    const settings: ListOrderSettings | null = ListOrderMaintainer.getSettings(
+      this.getModel(),
+    );
+
+    if (!settings) {
+      return { lists: 0, rowsChanged: 0 };
+    }
+
+    return await ListOrderMaintainer.normalizeEveryList({
+      service: this,
+      settings: settings,
+    });
+  }
+
   private async checkTotalItemsBy(
     createdBy: CreateBy<TBaseModel>,
   ): Promise<void> {
@@ -3255,6 +3657,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         beforeUpdateBy.props,
       );
 
+      // A service's own words for a clash, now the caller may make the write.
+      if (!updateBy.props.ignoreHooks) {
+        await this.onBeforeUpdateUniqueCheck(beforeUpdateBy);
+      }
+
       const data: PartialEntity<TBaseModel> =
         (await this.sanitizeCreateOrUpdate(
           beforeUpdateBy.data,
@@ -3310,6 +3717,20 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         this.addAuditLogColumnsToUpdateSelect(selectColumns, dataKeys);
       }
 
+      /*
+       * A drag-ordered list needs each row's place and list as they were
+       * BEFORE this write, to move it from there afterwards.
+       */
+      const listOrderSettings: ListOrderSettings | null =
+        this.getListOrderSettingsTouchedBy(dataKeys);
+
+      if (listOrderSettings) {
+        this.addListOrderColumnsToSelect(
+          selectColumns as Dictionary<unknown>,
+          listOrderSettings,
+        );
+      }
+
       const items: Array<TBaseModel> = hasColumnsToUpdate
         ? await this._findBy({
             query: beforeUpdateBy.query,
@@ -3542,6 +3963,18 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
        *     ).affected || 0;
        */
 
+      /*
+       * Before onUpdateSuccess, so a service hook that reads the list (an
+       * escalation order, a roster) sees it in its new order.
+       */
+      if (listOrderSettings) {
+        await this.placeUpdatedRowsInListOrder({
+          settings: listOrderSettings,
+          rowsBeforeUpdate: affectedItems,
+          data: data,
+        });
+      }
+
       /*
        * onUpdateSuccess always fires — subclasses rely on it being called
        * even when nothing matched — but it is handed only the rows the write