@oneuptime/common 14.0.2 → 14.0.5

package/Models/DatabaseModels/Project.ts

@@ -1653,6 +1653,66 @@ export default class Project extends TenantModel {
   })
   public enableAutomaticAlertInvestigation?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: true,
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Acknowledge Linked Alerts When Incident Is Acknowledged",
+    description:
+      "When enabled, acknowledging an incident also acknowledges every alert linked to it. This stops those alerts' on-call escalations, and their reminders only when the alert reminder rule is set to stop on Acknowledged. Alerts linked to an incident that is already acknowledged are acknowledged as they are linked.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    nullable: false,
+    default: false,
+    type: ColumnType.Boolean,
+  })
+  public acknowledgeLinkedAlertsWhenIncidentAcknowledged?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: true,
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Resolve Linked Alerts When Incident Is Resolved",
+    description:
+      "When enabled, resolving an incident also resolves every alert linked to it, except alerts that are still linked to another incident that is not resolved yet. Alerts linked to an incident that is already resolved are resolved as they are linked.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    nullable: false,
+    default: false,
+    type: ColumnType.Boolean,
+  })
+  public resolveLinkedAlertsWhenIncidentResolved?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [

package/Models/DatabaseModels/RumApplication.ts

@@ -915,7 +915,7 @@ export default class RumApplication extends BaseModel {
     type: TableColumnType.JSON,
     title: "Session Replay Trace Propagation Origins",
     description:
-      "Origins the recorder may inject a W3C traceparent header into, linking recordings to the backend traces of their requests without any OpenTelemetry browser setup. Empty means never inject: adding a header makes cross-origin requests preflighted, so each listed origin is an explicit statement that its API allows the traceparent header.",
+      "APIs on OTHER origins than the page (for example https://api.example.com) that the recorder may inject a W3C traceparent header into, linking recordings to the backend traces of their requests without any OpenTelemetry browser setup. Requests to the page's own origin need no entry here: Same-origin trace propagation covers them. Empty (the default) injects nothing cross-origin: adding a header makes a cross-origin request preflighted, so each listed origin is an explicit statement that its API allows traceparent in Access-Control-Allow-Headers. Listed origins get traceparent only, never the session id.",
   })
   @Column({
     type: ColumnType.JSON,
@@ -926,6 +926,57 @@ export default class RumApplication extends BaseModel {
   })
   public sessionReplayTracePropagationOrigins?: Array<string> = undefined;
 
+  /*
+   * On for existing applications as well as new ones: the column is added
+   * with DEFAULT true, and the recorder and its config are served no-store,
+   * so every installed recorder starts linking on its next page load. This
+   * switch is the way back that needs no redeploy on the customer's side.
+   *
+   * Same narrower create/update ACL as sessionReplayCaptureUserIdentity:
+   * linking a recording to backend telemetry that names the user identifies
+   * it, and the tracestate member carries the session id past the
+   * customer's backend to every service it calls.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SettingsAdmin,
+      Permission.CreateRumApplication,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadRumApplication,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SettingsAdmin,
+      Permission.EditRumApplication,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Same-origin trace propagation",
+    description:
+      "When enabled, the recorder adds a W3C traceparent and a tracestate member carrying the replay session id (oneuptime=sid:<session id>) to the fetch and XHR requests the page makes to its own origin while a session is uploading, so the backend spans, logs and exceptions those requests cause link to the recording automatically, with no code in your frontend or backend. Nothing is added before consent, after consent is revoked, or before an on-error trigger fires, and a request that already carries a traceparent or tracestate keeps its own. A traceparent the recorder generates is marked sampled, so ParentBased samplers in your backend keep every browser-originated trace (to keep ratio sampling, set a remoteParentSampled ratio delegate only on the service(s) your pages call directly, never on the services they call: ratio decisions differ between language SDKs; for one rate across services, use tail sampling in an OpenTelemetry Collector). Your backend's OpenTelemetry forwards the tracestate, and with it the session id, to every service it calls, third parties included; the visitor id is never sent. On by default. Narrower create/update ACL than the other replay settings: it links recordings to backend telemetry that may name the user.",
+    defaultValue: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: true,
+  })
+  public sessionReplaySameOriginTracePropagation?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/ScheduledMaintenance.ts

@@ -1,4 +1,5 @@
 import CephCluster from "./CephCluster";
+import DatabaseServer from "./DatabaseServer";
 import DockerHost from "./DockerHost";
 import PodmanHost from "./PodmanHost";
 import Host from "./Host";
@@ -1049,6 +1050,60 @@ export default class ScheduledMaintenance extends BaseModel {
   })
   public cephClusters?: Array<CephCluster> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.CreateProjectScheduledMaintenance,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.ScheduledMaintenanceViewer,
+      Permission.ReadProjectScheduledMaintenance,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.EditProjectScheduledMaintenance,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: DatabaseServer,
+    title: "Databases",
+    description: "List of databases affected by this event.",
+  })
+  @ManyToMany(
+    () => {
+      return DatabaseServer;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "ScheduledMaintenanceDatabaseServer",
+    inverseJoinColumn: {
+      name: "databaseServerId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "scheduledMaintenanceId",
+      referencedColumnName: "_id",
+    },
+  })
+  public databaseServers?: Array<DatabaseServer> = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/TelemetryException.ts

@@ -29,6 +29,7 @@ import KubernetesCluster from "./KubernetesCluster";
 import ServerlessFunction from "./ServerlessFunction";
 import CloudResource from "./CloudResource";
 import RumApplication from "./RumApplication";
+import DatabaseServer from "./DatabaseServer";
 
 @EnableDocumentation()
 @CanAccessIfCanReadOn("service")
@@ -87,6 +88,7 @@ import RumApplication from "./RumApplication";
     ServerlessFunction,
     CloudResource,
     RumApplication,
+    DatabaseServer,
   ],
   {
     includeProjectScope: true,

package/Models/DatabaseModels/UserProjectSsoConsent.ts

@@ -0,0 +1,146 @@
+import Project from "./Project";
+import User from "./User";
+import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
+import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
+import ColumnType from "../../Types/Database/ColumnType";
+import TableColumn from "../../Types/Database/TableColumn";
+import TableColumnType from "../../Types/Database/TableColumnType";
+import TableMetadata from "../../Types/Database/TableMetadata";
+import IconProp from "../../Types/Icon/IconProp";
+import ObjectID from "../../Types/ObjectID";
+import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+
+/*
+ * "The owner of this account's mailbox has agreed that this project's single
+ * sign-on may sign them in."
+ *
+ * A project's SAML or OIDC identity provider is configured by that project's
+ * admins, not by whoever runs this instance, so the email address it asserts
+ * is only that customer's word. On a multi-tenant instance that word cannot be
+ * enough to sign somebody in: an admin who controls their own IdP could assert
+ * any address and receive a session for the matching account -- an account
+ * whose other projects belong to other customers.
+ *
+ * So on the hosted service the first project-SSO sign-in to an account stops
+ * and emails the address instead, and one of these rows is written only when
+ * the link in that email is used. Nothing a project admin controls can write
+ * one: not the IdP, not SCIM (which can add an existing user to a project's
+ * teams), not an invitation. That is why this is its own table rather than an
+ * inference from team membership.
+ *
+ * Internal and root-only: there is no CRUD API.
+ */
+@TableAccessControl({
+  create: [],
+  read: [],
+  delete: [],
+  update: [],
+})
+@Index("IDX_UserProjectSsoConsent_userId_projectId", ["userId", "projectId"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
+@TableMetadata({
+  tableName: "UserProjectSsoConsent",
+  singularName: "Project SSO Consent",
+  pluralName: "Project SSO Consents",
+  icon: IconProp.Lock,
+  tableDescription:
+    "Records that a user confirmed, from their mailbox, that a project's single sign-on may sign them in.",
+})
+@Entity({
+  name: "UserProjectSsoConsent",
+})
+export default class UserProjectSsoConsent extends BaseModel {
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "userId",
+    type: TableColumnType.Entity,
+    modelType: User,
+    title: "User",
+    description: "The account that consented.",
+  })
+  @ManyToOne(
+    () => {
+      return User;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "userId" })
+  public user?: User = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: true,
+    title: "User ID",
+    description: "ID of the account that consented.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public userId?: ObjectID = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "projectId",
+    type: TableColumnType.Entity,
+    modelType: Project,
+    title: "Project",
+    description: "The project whose single sign-on may sign this user in.",
+  })
+  @ManyToOne(
+    () => {
+      return Project;
+    },
+    {
+      eager: false,
+      nullable: false,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "projectId" })
+  public project?: Project = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: true,
+    title: "Project ID",
+    description:
+      "ID of the project whose single sign-on may sign this user in.",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: false,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public projectId?: ObjectID = undefined;
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794800000000-AddSessionReplaySameOriginTracePropagation.ts

@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration, then renumbered after
+ * the last registered migration. The per-application switch for the browser
+ * recorder's same-origin trace propagation (traceparent plus a tracestate
+ * member carrying the replay session id on requests to the page's own
+ * origin). DEFAULT true turns it on for existing applications as well as new
+ * ones; the column is the way to turn it off without a customer redeploy.
+ */
+export class AddSessionReplaySameOriginTracePropagation1794800000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddSessionReplaySameOriginTracePropagation1794800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ADD "sessionReplaySameOriginTracePropagation" boolean NOT NULL DEFAULT true`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" DROP COLUMN "sessionReplaySameOriginTracePropagation"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794900000000-AddIncidentAlert.ts

@@ -0,0 +1,89 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration, then renumbered after
+ * the last registered migration. Adds the IncidentAlert link table (alerts
+ * linked to incidents, many-to-many, one row per incident/alert pair) and the
+ * two project switches that let an incident's acknowledge and resolve carry
+ * over to the alerts linked to it. Both switches default to false, so no
+ * existing project changes behaviour.
+ */
+export class AddIncidentAlert1794900000000 implements MigrationInterface {
+  public name: string = "AddIncidentAlert1794900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "IncidentAlert" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "incidentId" uuid NOT NULL, "alertId" uuid NOT NULL, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_cadb02bcf16f34fb6b131ad3a56" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_2456e245d2ac16087057be57ea" ON "IncidentAlert" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_f38346a69539fb7a363ee39e69" ON "IncidentAlert" ("incidentId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_828188b356c5335f78af09466f" ON "IncidentAlert" ("alertId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_b836b78cef9ce62e4d8f2cc586" ON "IncidentAlert" ("incidentId", "alertId", "projectId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "acknowledgeLinkedAlertsWhenIncidentAcknowledged" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "resolveLinkedAlertsWhenIncidentResolved" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_2456e245d2ac16087057be57ea5" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_f38346a69539fb7a363ee39e698" FOREIGN KEY ("incidentId") REFERENCES "Incident"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_828188b356c5335f78af09466fa" FOREIGN KEY ("alertId") REFERENCES "Alert"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_ad078609e5bacad1f7861f92176" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_572a63b76f7053f4fd28e666295" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_572a63b76f7053f4fd28e666295"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_ad078609e5bacad1f7861f92176"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_828188b356c5335f78af09466fa"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_f38346a69539fb7a363ee39e698"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_2456e245d2ac16087057be57ea5"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "resolveLinkedAlertsWhenIncidentResolved"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "acknowledgeLinkedAlertsWhenIncidentAcknowledged"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b836b78cef9ce62e4d8f2cc586"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_828188b356c5335f78af09466f"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_f38346a69539fb7a363ee39e69"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_2456e245d2ac16087057be57ea"`,
+    );
+    await queryRunner.query(`DROP TABLE "IncidentAlert"`);
+  }
+}