@oneuptime/common 14.0.13 → 14.0.14

package/Server/Services/IoTFleetService.ts

@@ -5,6 +5,11 @@ import Model from "../../Models/DatabaseModels/IoTFleet";
 import Label from "../../Models/DatabaseModels/Label";
 import { OnCreate } from "../Types/Database/Hooks";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import DiscoveredResourceUpdate, {
+  MatchColumn,
+  matchedOnName,
+} from "../Utils/Telemetry/DiscoveredResourceUpdate";
+import UpdateBy from "../Types/Database/UpdateBy";
 import ResourceHeartbeat from "../Utils/Telemetry/ResourceHeartbeat";
 import ObjectID from "../../Types/ObjectID";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -20,11 +25,32 @@ const LAST_SEEN_THROTTLE_SECONDS: number = 60;
 const LABELS_APPLIED_CACHE_NAMESPACE: string = "iot-fleet-labels-applied";
 const LABELS_APPLIED_CACHE_TTL_SECONDS: number = 60;
 
+/*
+ * An IoT fleet is matched to its telemetry by its name (iot.fleet.name),
+ * so a rename is held to the rules a new IoT fleet is: no spaces around
+ * it, never blank, and never another IoT fleet's name
+ * (DiscoveredResourceUpdate).
+ */
+const IOT_FLEET_MATCH_COLUMN: MatchColumn = matchedOnName({
+  resourceName: "IoT fleet",
+});
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  @CaptureSpan()
+  protected override async onBeforeUpdateUniqueCheck(
+    updateBy: UpdateBy<Model>,
+  ): Promise<void> {
+    await DiscoveredResourceUpdate.checkMatchColumn({
+      service: this,
+      updateBy,
+      matchColumn: IOT_FLEET_MATCH_COLUMN,
+    });
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<Model>,

package/Server/Services/KubernetesClusterService.ts

@@ -47,6 +47,15 @@ import { JSONObject } from "../../Types/JSON";
 import URL from "../../Types/API/URL";
 import DatabaseConfig from "../DatabaseConfig";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import DiscoveredResourceCreate, {
+  DiscoveredResourceNaming,
+  NamedAfterIdentityOptions,
+  namedAfterIdentity,
+} from "../Utils/Telemetry/DiscoveredResourceCreate";
+import DiscoveredResourceUpdate, {
+  MatchColumn,
+  matchedOnIdentifier,
+} from "../Utils/Telemetry/DiscoveredResourceUpdate";
 import ResourceHeartbeat from "../Utils/Telemetry/ResourceHeartbeat";
 import ObjectID from "../../Types/ObjectID";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -243,6 +252,24 @@ export interface AiAccessLoosening {
   bindsCredential: boolean;
 }
 
+/*
+ * A cluster is matched to its telemetry by the clusterName its
+ * kubernetes-agent reports (k8s.cluster.name), and named after it unless
+ * somebody gives it a display name of their own (DiscoveredResourceCreate).
+ */
+const KUBERNETES_CLUSTER_IDENTITY: NamedAfterIdentityOptions = {
+  identityColumn: "clusterIdentifier",
+  resourceName: "Kubernetes cluster",
+  identityName: "cluster name",
+};
+
+const KUBERNETES_CLUSTER_NAMING: DiscoveredResourceNaming<Model> =
+  namedAfterIdentity<Model>(KUBERNETES_CLUSTER_IDENTITY);
+
+const KUBERNETES_CLUSTER_MATCH_COLUMN: MatchColumn = matchedOnIdentifier(
+  KUBERNETES_CLUSTER_IDENTITY,
+);
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -258,6 +285,12 @@ export class Service extends DatabaseService<Model> {
       createBy.props.tenantId ||
       undefined;
 
+    // Named after its cluster name when nobody gave it a name.
+    DiscoveredResourceCreate.fillName({
+      createBy,
+      naming: KUBERNETES_CLUSTER_NAMING,
+    });
+
     const data: JSONObject = createBy.data as unknown as JSONObject;
 
     this.validateAiRemediationSettings(data);
@@ -309,6 +342,37 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  /*
+   * A cluster that is already there - discovered from its telemetry or
+   * added before - is refused by its cluster name, not as a clash of names.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreateUniqueCheck(
+    createBy: CreateBy<Model>,
+  ): Promise<void> {
+    await DiscoveredResourceCreate.refuseClash({
+      service: this,
+      createBy,
+      naming: KUBERNETES_CLUSTER_NAMING,
+    });
+  }
+
+  /*
+   * A cluster's cluster name - edited from the details card on its Settings page - is stored
+   * without the spaces around it, and refused when another one of the
+   * project already has it (DiscoveredResourceUpdate).
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdateUniqueCheck(
+    updateBy: UpdateBy<Model>,
+  ): Promise<void> {
+    await DiscoveredResourceUpdate.checkMatchColumn({
+      service: this,
+      updateBy,
+      matchColumn: KUBERNETES_CLUSTER_MATCH_COLUMN,
+    });
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,

package/Server/Services/LabelService.ts

@@ -11,8 +11,7 @@ import StatusPageMonitorRule from "../../Models/DatabaseModels/StatusPageMonitor
 import BadDataException from "../../Types/Exception/BadDataException";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
-import Color from "../../Types/Color";
-import { BrightColors } from "../../Types/BrandColors";
+import { pickColorForName } from "../../Utils/DistinctColor";
 import GlobalCache from "../Infrastructure/GlobalCache";
 import Model from "../../Models/DatabaseModels/Label";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -257,8 +256,10 @@ export class Service extends DatabaseService<Model> {
    * Names are matched case-insensitively, so an OTel attribute of
    * `production` will resolve to a manually-created `Production`
    * label rather than spawning a duplicate. New labels are colored
-   * deterministically from the BrightColors palette so re-creating
-   * the same label across processes lands on the same color.
+   * deterministically from the palette OneUptime picks new records'
+   * colours from (Utils/DistinctColor - no black or grey, every colour
+   * visible on both themes) so re-creating the same label across
+   * processes lands on the same color.
    *
    * Resolved IDs are cached per (project, name) for 24h, so the
    * common case (steady-state collector pushing the same labels
@@ -338,7 +339,7 @@ export class Service extends DatabaseService<Model> {
       const newLabel: Model = new Model();
       newLabel.projectId = projectId;
       newLabel.name = name;
-      newLabel.color = pickColorForLabelName(name);
+      newLabel.color = pickColorForName(name);
 
       const created: Model = await this.create({
         data: newLabel,
@@ -372,16 +373,4 @@ export class Service extends DatabaseService<Model> {
   }
 }
 
-function pickColorForLabelName(name: string): Color {
-  if (BrightColors.length === 0) {
-    return Color.fromString("#3686be");
-  }
-  let hash: number = 0;
-  for (let i: number = 0; i < name.length; i++) {
-    hash = (hash * 31 + name.charCodeAt(i)) | 0;
-  }
-  const idx: number = Math.abs(hash) % BrightColors.length;
-  return BrightColors[idx]!;
-}
-
 export default new Service();

package/Server/Services/LogScrubRuleService.ts

@@ -1,10 +1,60 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/LogScrubRule";
+import CreateBy from "../Types/Database/CreateBy";
+import FindBy from "../Types/Database/FindBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate } from "../Types/Database/Hooks";
+import {
+  LOG_SCRUB_FIELDS,
+  LOG_SCRUB_PATTERN_TYPES,
+} from "../../Types/Telemetry/ScrubRule";
+import {
+  ScrubRuleValidationOptions,
+  validateScrubRuleCreate,
+  validateScrubRuleUpdate,
+} from "../Utils/ScrubRuleValidation";
+
+const VALIDATION_OPTIONS: ScrubRuleValidationOptions = {
+  recordNoun: "logs",
+  patternTypes: LOG_SCRUB_PATTERN_TYPES,
+  fieldsToScrub: LOG_SCRUB_FIELDS,
+};
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  /*
+   * A rule is refused unless ingest can scrub with it - a Custom Regex rule
+   * with no pattern, or one that does not compile, scrubbed nothing while it
+   * looked active. See Utils/ScrubRuleValidation.ts.
+   */
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    validateScrubRuleCreate(createBy.data, VALIDATION_OPTIONS);
+
+    return { createBy, carryForward: null };
+  }
+
+  /*
+   * An update is judged on the rows it matches, once the caller has passed
+   * the permission checks and the query is narrowed to the rows they may
+   * write - so the stored rows read to merge it over are never another
+   * project's.
+   */
+  protected override async onBeforeUpdateUniqueCheck(
+    updateBy: UpdateBy<Model>,
+  ): Promise<void> {
+    await validateScrubRuleUpdate<Model>({
+      updateBy: updateBy,
+      findBy: async (findBy: FindBy<Model>): Promise<Array<Model>> => {
+        return await this.findBy(findBy);
+      },
+      options: VALIDATION_OPTIONS,
+    });
+  }
 }
 
 export default new Service();

package/Server/Services/OnCallDutyPolicyScheduleService.ts

@@ -58,6 +58,19 @@ import OnCallShiftChangeListeners, {
   OnCallShiftChangeEvent,
   OnCallShiftChangeReason,
 } from "../Utils/OnCall/OnCallShiftChangeListeners";
+import CreateBy from "../Types/Database/CreateBy";
+import CreatePermission from "../Types/Database/Permissions/CreatePermission";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import TeamMember from "../../Models/DatabaseModels/TeamMember";
+import TeamMemberService from "./TeamMemberService";
+import {
+  readScheduleFirstLayer,
+  ScheduleFirstLayer,
+} from "../../Types/OnCallDutyPolicy/ScheduleFirstLayer";
+import {
+  buildNewScheduleLayer,
+  getLayerName,
+} from "../../Types/OnCallDutyPolicy/ScheduleLayerDefaults";
 
 /*
  * ---------------------------------------------------------------------------
@@ -164,6 +177,257 @@ export class Service extends DatabaseService<OnCallDutyPolicySchedule> {
     super(OnCallDutyPolicySchedule);
   }
 
+  /*
+   * WHO TAKES TURNS.
+   *
+   * A schedule created with people in its misc data (the create form's "Who
+   * takes turns?", or an API caller) gets its first layer straight away:
+   * "Layer 1", on call from now, handing off once per rotation (a week
+   * unless the form picked another), around the clock, with those people
+   * taking turns in the order they were picked - what pressing Add Layer and
+   * adding them one by one on the Layers page would have made. With nobody
+   * picked, nothing changes: the schedule is created without layers, as it
+   * always was.
+   *
+   * The layer and its people are created as the caller, with the same
+   * checks, roster refresh and notifications as adding them by hand, once
+   * the schedule exists.
+   *
+   * What can be checked before anything is saved is checked first: the
+   * picks' shape, whether the caller may add layers and people to them, and
+   * whether every person is a member of this project. A refused pick refuses
+   * the create, so nobody gets a schedule that covers nobody when they asked
+   * for people to take turns. What fails after the schedule is saved is
+   * logged, and the schedule is kept: its Layers page shows what is missing.
+   */
+  @CaptureSpan()
+  public override async create(
+    createBy: CreateBy<OnCallDutyPolicySchedule>,
+  ): Promise<OnCallDutyPolicySchedule> {
+    const firstLayer: ScheduleFirstLayer | null = createBy.props.ignoreHooks
+      ? null
+      : readScheduleFirstLayer(createBy.miscDataProps);
+
+    if (firstLayer) {
+      await this.checkFirstLayerCanBeAdded({
+        firstLayer: firstLayer,
+        projectId: createBy.props.tenantId || createBy.data.projectId,
+        props: createBy.props,
+      });
+    }
+
+    const createdSchedule: OnCallDutyPolicySchedule = await super.create(
+      createBy,
+    );
+
+    if (firstLayer) {
+      await this.addFirstLayer({
+        schedule: createdSchedule,
+        firstLayer: firstLayer,
+        props: createBy.props,
+      });
+    }
+
+    return createdSchedule;
+  }
+
+  /*
+   * Refuses a first layer that could not be added, before the schedule is
+   * saved. Throws; returns nothing.
+   */
+  @CaptureSpan()
+  public async checkFirstLayerCanBeAdded(data: {
+    firstLayer: ScheduleFirstLayer;
+    projectId: ObjectID | undefined | null;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    if (!data.projectId) {
+      throw new BadDataException(
+        "A project is required to add people to a new on-call schedule.",
+      );
+    }
+
+    const projectId: ObjectID = new ObjectID(data.projectId.toString());
+
+    /*
+     * The caller adds the layer and its people themselves, so they need the
+     * permissions adding them by hand needs - checked now, on rows written
+     * as they will be, so a refusal saves nothing. Root and master admin
+     * callers pass through the check itself. Any schedule id checks the same
+     * column permissions; the real one is not known yet.
+     */
+    const placeholderId: ObjectID = ObjectID.getZeroObjectID();
+
+    const layer: OnCallDutyPolicyScheduleLayer = buildNewScheduleLayer({
+      onCallDutyPolicyScheduleId: placeholderId,
+      projectId: projectId,
+      name: getLayerName(1),
+      order: 1,
+      rotation: data.firstLayer.rotation,
+    });
+
+    CreatePermission.checkCreatePermissions(
+      OnCallDutyPolicyScheduleLayer,
+      layer,
+      data.props,
+    );
+
+    const layerUser: OnCallDutyPolicyScheduleLayerUser =
+      new OnCallDutyPolicyScheduleLayerUser();
+    layerUser.projectId = projectId;
+    layerUser.onCallDutyPolicyScheduleId = placeholderId;
+    layerUser.onCallDutyPolicyScheduleLayerId = placeholderId;
+    layerUser.userId = placeholderId;
+    layerUser.order = 1;
+
+    CreatePermission.checkCreatePermissions(
+      OnCallDutyPolicyScheduleLayerUser,
+      layerUser,
+      data.props,
+    );
+
+    await this.checkFirstLayerUsersAreMembers({
+      userIds: data.firstLayer.userIds,
+      projectId: projectId,
+    });
+  }
+
+  /*
+   * People who are members of this project (a TeamMember row of it, the
+   * list the people picker offers). Anyone else - a stranger, someone of
+   * another project - refuses the create rather than be put on call here.
+   */
+  private async checkFirstLayerUsersAreMembers(data: {
+    userIds: Array<string>;
+    projectId: ObjectID;
+  }): Promise<void> {
+    const memberships: Array<TeamMember> = await TeamMemberService.findBy({
+      query: {
+        userId: QueryHelper.any(data.userIds),
+        projectId: data.projectId,
+      },
+      select: {
+        userId: true,
+      },
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const members: Set<string> = new Set<string>(
+      memberships
+        .map((membership: TeamMember): string => {
+          return membership.userId?.toString().toLowerCase() || "";
+        })
+        .filter(Boolean),
+    );
+
+    const strangers: Array<string> = data.userIds.filter(
+      (userId: string): boolean => {
+        return !members.has(userId);
+      },
+    );
+
+    if (strangers.length > 0) {
+      throw new BadDataException(
+        "Some of the people picked to take turns are not members of this project.",
+      );
+    }
+  }
+
+  /*
+   * Adds the first layer of a schedule just created, with the people who
+   * take turns in it, in order. Never throws: the schedule is saved already.
+   * A person who cannot be added is logged and skipped, so the others still
+   * take their turns.
+   */
+  @CaptureSpan()
+  public async addFirstLayer(data: {
+    schedule: OnCallDutyPolicySchedule;
+    firstLayer: ScheduleFirstLayer;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    const scheduleId: ObjectID | null | undefined = data.schedule.id;
+    const projectId: ObjectID | undefined = data.schedule.projectId;
+
+    const logAttributes: LogAttributes = {
+      projectId: projectId?.toString(),
+      onCallDutyPolicyScheduleId: scheduleId?.toString(),
+    } as LogAttributes;
+
+    let layerId: ObjectID;
+
+    try {
+      if (!scheduleId || !projectId) {
+        throw new BadDataException(
+          "The new on-call schedule has no id or project.",
+        );
+      }
+
+      /*
+       * No order: the layer service puts it first, as the schedule has no
+       * layers yet.
+       */
+      const createdLayer: OnCallDutyPolicyScheduleLayer =
+        await OnCallDutyPolicyScheduleLayerService.create({
+          data: buildNewScheduleLayer({
+            onCallDutyPolicyScheduleId: new ObjectID(scheduleId.toString()),
+            projectId: new ObjectID(projectId.toString()),
+            name: getLayerName(1),
+            rotation: data.firstLayer.rotation,
+            timezone: data.schedule.timezone?.toString() || undefined,
+          }),
+          props: data.props,
+        });
+
+      if (!createdLayer.id) {
+        throw new BadDataException("The new layer has no id.");
+      }
+
+      layerId = new ObjectID(createdLayer.id.toString());
+    } catch (error) {
+      logger.error(
+        `Error adding the first layer of a new on-call schedule in OnCallDutyPolicyScheduleService.addFirstLayer: ${error}`,
+        logAttributes,
+      );
+      return;
+    }
+
+    /*
+     * One at a time, in the order they take turns: with no order given, the
+     * layer user service puts each one last, so the order of these creates
+     * is the order of the rotation.
+     */
+    for (const userId of data.firstLayer.userIds) {
+      try {
+        const layerUser: OnCallDutyPolicyScheduleLayerUser =
+          new OnCallDutyPolicyScheduleLayerUser();
+        layerUser.projectId = new ObjectID(projectId.toString());
+        layerUser.onCallDutyPolicyScheduleId = new ObjectID(
+          scheduleId.toString(),
+        );
+        layerUser.onCallDutyPolicyScheduleLayerId = layerId;
+        layerUser.userId = new ObjectID(userId);
+
+        await OnCallDutyPolicyScheduleLayerUserService.create({
+          data: layerUser,
+          props: data.props,
+        });
+      } catch (error) {
+        logger.error(
+          `Error adding a person to the first layer of a new on-call schedule in OnCallDutyPolicyScheduleService.addFirstLayer: ${error}`,
+          {
+            ...logAttributes,
+            onCallDutyPolicyScheduleLayerId: layerId.toString(),
+            userId: userId,
+          } as LogAttributes,
+        );
+      }
+    }
+  }
+
   protected override async onCreateSuccess(
     _onCreate: OnCreate<OnCallDutyPolicySchedule>,
     createdItem: OnCallDutyPolicySchedule,

package/Server/Services/OnCallDutyPolicyUserOverrideService.ts

@@ -202,7 +202,15 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       throw new BadDataException("Route alerts to user is required");
     }
 
-    if (overrideUserId.toString() === routeAlertsToUserId.toString()) {
+    /*
+     * Ids are compared without case, as Postgres compares uuids: the same
+     * person written twice in different case is still one person, and an
+     * override from someone to themselves reroutes nothing.
+     */
+    if (
+      overrideUserId.toString().toLowerCase() ===
+      routeAlertsToUserId.toString().toLowerCase()
+    ) {
       throw new BadDataException(
         "Override user and route alerts to user cannot be the same",
       );

package/Server/Services/OnCallNotificationAlertingService.ts

@@ -15,6 +15,10 @@ import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import Dictionary from "../../Types/Dictionary";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
 import NotificationRuleType from "../../Types/NotificationRule/NotificationRuleType";
+import {
+  OnCallRulesLink,
+  getUserSettingsOnCallRulesLink,
+} from "../../Types/NotificationRule/OnCallRuleKind";
 import ObjectID from "../../Types/ObjectID";
 import OnCallDutyPolicyOwnerTeam from "../../Models/DatabaseModels/OnCallDutyPolicyOwnerTeam";
 import OnCallDutyPolicyOwnerUser from "../../Models/DatabaseModels/OnCallDutyPolicyOwnerUser";
@@ -697,43 +701,34 @@ export class OnCallNotificationAlertingService extends BaseService {
   }
 
   /*
-   * The four severity-scoped rule types each have their own settings page, and sending
-   * someone to the wrong one is how a "fix your rules" email gets ignored. The two shift
-   * rule types are configured on the incident page alongside everything else.
+   * The person's On-Call Rules page, opened on the tab for the rule type they were paged
+   * without: sending someone to the wrong tab is how a "fix your rules" email gets ignored.
+   * The two shift rule types have no tab of their own and open the first one.
    *
-   * These path segments mirror UserSettingsRoutePath in the Dashboard's RouteMap. They are
-   * duplicated rather than imported because Common/Server cannot reach App sources — the
-   * same reason OnCallDutyPolicyService.getOnCallDutyPolicyLinkInDashboard spells its
-   * route out by hand.
+   * The address comes from Common's OnCallRuleKind, which the dashboard's routes and the
+   * setup reminder read too. A rule type this build has not heard of goes to
+   * Notification Methods, the one page that matters for every gap.
    */
-  private getUserSettingsPathForRuleType(
-    ruleType: NotificationRuleType,
-  ): string {
-    switch (ruleType) {
-      case NotificationRuleType.ON_CALL_EXECUTED_ALERT:
-        return "alert-on-call-rules";
-      case NotificationRuleType.ON_CALL_EXECUTED_ALERT_EPISODE:
-        return "alert-episode-on-call-rules";
-      case NotificationRuleType.ON_CALL_EXECUTED_INCIDENT_EPISODE:
-        return "incident-episode-on-call-rules";
-      case NotificationRuleType.ON_CALL_EXECUTED_INCIDENT:
-      case NotificationRuleType.WHEN_USER_GOES_ON_CALL:
-      case NotificationRuleType.WHEN_USER_GOES_OFF_CALL:
-        return "incident-on-call-rules";
-      default:
-        return "notification-methods";
-    }
-  }
-
   private async getNotificationRulesLinkInDashboard(
     projectId: ObjectID,
     ruleType: NotificationRuleType,
   ): Promise<URL> {
     const dashboardUrl: URL = await DatabaseConfig.getDashboardUrl();
 
-    return URL.fromString(dashboardUrl.toString()).addRoute(
-      `/${projectId.toString()}/user-settings/${this.getUserSettingsPathForRuleType(ruleType)}`,
-    );
+    const rulesLink: OnCallRulesLink | null = getUserSettingsOnCallRulesLink({
+      projectId: projectId.toString(),
+      ruleType: ruleType,
+    });
+
+    if (!rulesLink) {
+      return URL.fromString(dashboardUrl.toString()).addRoute(
+        `/${projectId.toString()}/user-settings/notification-methods`,
+      );
+    }
+
+    return URL.fromString(dashboardUrl.toString())
+      .addRoute(rulesLink.path)
+      .addQueryParams(rulesLink.query);
   }
 
   private formatChannelList(channels: Array<string>): string {