@oneuptime/common 14.0.2 → 14.0.5

package/Server/Infrastructure/Postgres/SchemaMigrations/1795100000000-AddUserProjectSsoConsent.ts

@@ -0,0 +1,51 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * UserProjectSsoConsent: the record that an account's mailbox owner agreed a
+ * project's single sign-on may sign them in. See the model for why.
+ */
+export class AddUserProjectSsoConsent1795100000000
+  implements MigrationInterface
+{
+  public name: string = "AddUserProjectSsoConsent1795100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "UserProjectSsoConsent" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "userId" uuid NOT NULL, "projectId" uuid NOT NULL, CONSTRAINT "PK_7f176a58f5067976acd5e16e673" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_85301f3927aa92cacc08edce68" ON "UserProjectSsoConsent" ("userId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_d44fac24de1873c9ebd3d25d29" ON "UserProjectSsoConsent" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_UserProjectSsoConsent_userId_projectId" ON "UserProjectSsoConsent" ("userId", "projectId") WHERE "deletedAt" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserProjectSsoConsent" ADD CONSTRAINT "FK_85301f3927aa92cacc08edce68d" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserProjectSsoConsent" ADD CONSTRAINT "FK_d44fac24de1873c9ebd3d25d299" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserProjectSsoConsent" DROP CONSTRAINT "FK_d44fac24de1873c9ebd3d25d299"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserProjectSsoConsent" DROP CONSTRAINT "FK_85301f3927aa92cacc08edce68d"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_UserProjectSsoConsent_userId_projectId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_d44fac24de1873c9ebd3d25d29"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_85301f3927aa92cacc08edce68"`,
+    );
+    await queryRunner.query(`DROP TABLE "UserProjectSsoConsent"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -8,6 +8,10 @@ import { AddKubernetesClusterAiAccess1794400000000 } from "./1794400000000-AddKu
 import { AddIncomingEmailCustomAddressToMonitor1794500000000 } from "./1794500000000-AddIncomingEmailCustomAddressToMonitor";
 import { AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000 } from "./1794600000000-AddAuthTokenExpiresAtToWorkspaceProjectAuthToken";
 import { RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000 } from "./1794700000000-RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData";
+import { AddSessionReplaySameOriginTracePropagation1794800000000 } from "./1794800000000-AddSessionReplaySameOriginTracePropagation";
+import { AddIncidentAlert1794900000000 } from "./1794900000000-AddIncidentAlert";
+import { AddDatabaseServerTables1795000000000 } from "./1795000000000-AddDatabaseServerTables";
+import { AddUserProjectSsoConsent1795100000000 } from "./1795100000000-AddUserProjectSsoConsent";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1216,4 +1220,8 @@ export default [
   AddIncomingEmailCustomAddressToMonitor1794500000000,
   AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000,
   RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000,
+  AddSessionReplaySameOriginTracePropagation1794800000000,
+  AddIncidentAlert1794900000000,
+  AddDatabaseServerTables1795000000000,
+  AddUserProjectSsoConsent1795100000000,
 ];

package/Server/Middleware/MultipartFormData.ts

@@ -21,7 +21,7 @@ import { RequestHandler } from "express";
  *
  * The sizes match the 50 MiB body-parser limit the rest of the app uses,
  * and nginx cuts the shipped deployment lower still (50M on
- * /incoming-email, its 1M default on /pyroscope). The COUNTS are the part
+ * /incoming-email, 16M on /pyroscope). The COUNTS are the part
  * that was genuinely missing: without them a body of ten thousand
  * one-byte parts costs ten thousand allocations and passes every size
  * check.

package/Server/Middleware/TelemetryIngest.ts

@@ -313,6 +313,11 @@ export default class TelemetryIngest {
          * error in their own logs instead of retry-storming. A silent
          * 200 here would make the client believe the data landed and
          * leave the user staring at empty dashboards with no clue why.
+         *
+         * The gRPC OTLP server sends this sentence and the invalid-token
+         * one below word for word (GrpcServer keeps copies, and
+         * GrpcServerAuthStatusLive.test.ts fails if they drift), so
+         * reword them together.
          */
         return Response.sendErrorResponse(
           req,
@@ -365,10 +370,11 @@ export default class TelemetryIngest {
        * turning a leaked key off is the one action guaranteed to stop it
        * regardless of which surface it is hitting or what its allowlist says.
        *
-       * 403 rather than 401: the credential was recognised, it is simply not
-       * permitted to write. That distinction is what lets a customer tell
-       * "I pasted the wrong key" apart from "someone switched my key off",
-       * which are very different Tuesday afternoons.
+       * 422 (NotAuthorizedException) rather than 401: the credential was
+       * recognised, it is simply not permitted to write. That distinction is
+       * what lets a customer tell "I pasted the wrong key" apart from
+       * "someone switched my key off", which are very different Tuesday
+       * afternoons. Like 401, 422 is non-retryable under the OTLP spec.
        */
       if (policy.isEnabled === false) {
         return Response.sendErrorResponse(
@@ -381,10 +387,11 @@ export default class TelemetryIngest {
       }
 
       /*
-       * Expiry. 401 here rather than 403 for the same reason as the branches
-       * above: OTLP treats 401 as non-retryable, so a collector holding an
-       * expired key logs the failure once instead of retry-storming an
-       * endpoint that will never accept it again.
+       * Expiry. 401, like the missing- and invalid-token branches above,
+       * rather than the kill switch's 422: an expired key no longer
+       * authenticates anyone. OTLP treats 401 as non-retryable, so a
+       * collector holding an expired key logs the failure instead of
+       * retry-storming an endpoint that will never accept it again.
        *
        * The exact expiry timestamp is deliberately kept out of the response.
        * The caller has failed to authenticate; the key's configuration is

package/Server/Services/AlertReminderRuleService.ts

@@ -101,10 +101,33 @@ export class Service extends DatabaseService<Model> {
     return onDelete;
   }
 
+  /*
+   * Re-matches the reminder rule for every open alert in the project and
+   * rewrites its nextReminderNotificationAt.
+   *
+   * Without options that is one read of at most LIMIT_MAX open alerts, and it
+   * must stay one: the rule create, update and delete hooks run it inside the
+   * API request.
+   *
+   * `onlyWithoutNextReminder` narrows that to open alerts with no reminder
+   * scheduled at all, and reads every one of them, in `_id`-ordered pages of
+   * LIMIT_MAX. It exists for backfills (see the
+   * ScheduleRemindersMissedByReminderRuleLookup data migration), which run in a
+   * worker rather than a request and must reach every such alert of the
+   * project, however many there are. The pages are cursored by `_id`, not
+   * offset, because refreshing an alert can take it out of the set being paged.
+   * An alert that already has a timestamp is left alone, because re-scheduling
+   * it would push a reminder that is due, or overdue, one full interval later.
+   */
   @CaptureSpan()
   public async refreshSchedulesForOpenAlerts(
     projectId: ObjectID,
+    options?: { onlyWithoutNextReminder?: boolean | undefined } | undefined,
   ): Promise<void> {
+    const onlyWithoutNextReminder: boolean = Boolean(
+      options?.onlyWithoutNextReminder,
+    );
+
     try {
       const unresolvedStates: Array<AlertState> =
         await AlertStateService.findBy({
@@ -132,33 +155,48 @@ export class Service extends DatabaseService<Model> {
         return;
       }
 
-      const openAlerts: Array<Alert> = await AlertService.findBy({
-        query: {
+      let afterId: ObjectID | null = null;
+
+      while (true) {
+        const openAlerts: Array<Alert> = await this.findOpenAlerts({
           projectId: projectId,
-          currentAlertStateId: QueryHelper.any(unresolvedStateIds),
-        },
-        select: {
-          _id: true,
-        },
-        limit: LIMIT_MAX,
-        skip: 0,
-        props: {
-          isRoot: true,
-        },
-      });
+          unresolvedStateIds: unresolvedStateIds,
+          onlyWithoutNextReminder: onlyWithoutNextReminder,
+          afterId: afterId,
+        });
 
-      for (const alert of openAlerts) {
-        try {
-          await AlertService.refreshReminderSchedule({
-            alertId: alert.id!,
-            projectId: projectId,
-          });
-        } catch (error) {
-          logger.error(
-            `Failed to refresh reminder schedule for alert ${alert.id}: ${error}`,
-            { projectId: projectId?.toString() } as LogAttributes,
-          );
+        for (const alert of openAlerts) {
+          try {
+            await AlertService.refreshReminderSchedule({
+              alertId: alert.id!,
+              projectId: projectId,
+            });
+          } catch (error) {
+            logger.error(
+              `Failed to refresh reminder schedule for alert ${alert.id}: ${error}`,
+              { projectId: projectId?.toString() } as LogAttributes,
+            );
+          }
         }
+
+        // Without the option, the one read above is all there is.
+        if (!onlyWithoutNextReminder || openAlerts.length < LIMIT_MAX) {
+          return;
+        }
+
+        const lastId: ObjectID | null = openAlerts[openAlerts.length - 1]!.id;
+
+        if (!lastId || (afterId && lastId.toString() <= afterId.toString())) {
+          /*
+           * A full page whose last row does not move the cursor forward
+           * would be read again forever. Not reachable with `_id ASC` and a
+           * `> afterId` filter; guarded so a broken sort cannot hang the
+           * backfill.
+           */
+          throw new Error("the open alert page did not advance its _id cursor");
+        }
+
+        afterId = lastId;
       }
     } catch (error) {
       logger.error(
@@ -168,6 +206,44 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /*
+   * One read of the project's open alerts: those whose current state is one of
+   * `unresolvedStateIds`. Both paths of refreshSchedulesForOpenAlerts read
+   * through here, so what "open" means is written once.
+   *
+   * With `onlyWithoutNextReminder`, only those with no reminder scheduled,
+   * `_id` ascending and after `afterId` when there is one. Without it, no
+   * cursor and the default order: the read the rule hooks have always made.
+   */
+  private async findOpenAlerts(data: {
+    projectId: ObjectID;
+    unresolvedStateIds: Array<ObjectID>;
+    onlyWithoutNextReminder: boolean;
+    afterId: ObjectID | null;
+  }): Promise<Array<Alert>> {
+    return await AlertService.findBy({
+      query: {
+        projectId: data.projectId,
+        currentAlertStateId: QueryHelper.any(data.unresolvedStateIds),
+        ...(data.onlyWithoutNextReminder
+          ? { nextReminderNotificationAt: QueryHelper.isNull() }
+          : {}),
+        ...(data.afterId ? { _id: QueryHelper.greaterThan(data.afterId) } : {}),
+      },
+      select: {
+        _id: true,
+      },
+      ...(data.onlyWithoutNextReminder
+        ? { sort: { _id: SortOrder.Ascending } }
+        : {}),
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
   @CaptureSpan()
   public async findMatchingRule(data: {
     projectId: ObjectID;