@oneuptime/common 14.0.6 → 14.0.7

package/build/dist/Server/Utils/AffectedResources/LinkedAffectedResources.js

@@ -0,0 +1,405 @@
+import QueryHelper from "../../Types/Database/QueryHelper";
+import Alert from "../../../Models/DatabaseModels/Alert";
+import Incident from "../../../Models/DatabaseModels/Incident";
+import ScheduledMaintenance from "../../../Models/DatabaseModels/ScheduledMaintenance";
+import URL from "../../../Types/API/URL";
+import { escapeMarkdownInline } from "../../../Utils/Markdown/MarkdownEscape";
+import { getSloAffectedResourceMarkdownLines, } from "../../../Utils/Slo/SloAffectedResourceMarkdown";
+/*
+ * What an incident, alert or scheduled maintenance event affects, for the
+ * text the server writes about it: the "Resources Affected" section of its
+ * feed items, the Resources Affected row of its emails, and the workspace
+ * summaries.
+ *
+ * The dashboard's Affected Resources cards (AffectedResourcesDisplay) list
+ * every relation the record carries - monitors, hosts, clusters, container
+ * hosts, databases, services, SLOs. The server used to name the monitors
+ * only, so an SLO burn-rate alert's card named its SLO while its on-call
+ * email read "Resources Affected: No resources identified", and an incident
+ * raised against a host named nothing at all. Every one of those writers now
+ * reads the list from here, so they name what the cards show.
+ *
+ * Reads run as root - an owner or on-call email has no user session behind
+ * it - and are held to the record's own project twice: the record is only
+ * read inside that project, and a related row of any other project is left
+ * out. The write hooks reject cross-project links now, but rows saved before
+ * that check existed may still hold one, and naming it would put another
+ * project's resource into this project's feed, Slack and email.
+ *
+ * The caller hands over the service to read with, and the dashboard URL to
+ * link from. Those services import this module, and the owner-notification
+ * workers' tests replace them wholesale; importing them here would drag the
+ * whole service graph into every one of those suites.
+ */
+export var LinkedAffectedResourceType;
+(function (LinkedAffectedResourceType) {
+    LinkedAffectedResourceType["Monitor"] = "Monitor";
+    LinkedAffectedResourceType["Host"] = "Host";
+    LinkedAffectedResourceType["KubernetesCluster"] = "KubernetesCluster";
+    LinkedAffectedResourceType["DockerHost"] = "DockerHost";
+    LinkedAffectedResourceType["PodmanHost"] = "PodmanHost";
+    LinkedAffectedResourceType["ProxmoxCluster"] = "ProxmoxCluster";
+    LinkedAffectedResourceType["VMwareVCenter"] = "VMwareVCenter";
+    LinkedAffectedResourceType["CephCluster"] = "CephCluster";
+    LinkedAffectedResourceType["DockerSwarmCluster"] = "DockerSwarmCluster";
+    LinkedAffectedResourceType["IoTFleet"] = "IoTFleet";
+    LinkedAffectedResourceType["DatabaseServer"] = "DatabaseServer";
+    LinkedAffectedResourceType["NetworkSite"] = "NetworkSite";
+    LinkedAffectedResourceType["Service"] = "Service";
+    LinkedAffectedResourceType["ServiceLevelObjective"] = "ServiceLevelObjective";
+})(LinkedAffectedResourceType || (LinkedAffectedResourceType = {}));
+/*
+ * The categories AffectedResourcesDisplay renders, in the order it renders
+ * them, so a feed item lists resources the way the cards beside it do. The
+ * routes are the ones each resource's own getXLinkInDashboard builds (a test
+ * pins every one that exists); IoT fleets and network sites have none on the
+ * server, so theirs follow the dashboard's RouteMap.
+ *
+ * An alert has a single `monitor`; incidents and scheduled maintenance events
+ * have `monitors`. Each record kind is read for the columns its model has.
+ */
+export const LINKED_AFFECTED_RESOURCE_RELATIONS = [
+    {
+        column: "monitors",
+        type: LinkedAffectedResourceType.Monitor,
+        label: "Monitor",
+        dashboardRoute: "monitors",
+    },
+    {
+        column: "monitor",
+        type: LinkedAffectedResourceType.Monitor,
+        label: "Monitor",
+        dashboardRoute: "monitors",
+    },
+    {
+        column: "hosts",
+        type: LinkedAffectedResourceType.Host,
+        label: "Host",
+        dashboardRoute: "host",
+    },
+    {
+        column: "kubernetesClusters",
+        type: LinkedAffectedResourceType.KubernetesCluster,
+        label: "Kubernetes Cluster",
+        dashboardRoute: "kubernetes",
+    },
+    {
+        column: "dockerHosts",
+        type: LinkedAffectedResourceType.DockerHost,
+        label: "Docker Host",
+        dashboardRoute: "docker",
+    },
+    {
+        column: "podmanHosts",
+        type: LinkedAffectedResourceType.PodmanHost,
+        label: "Podman Host",
+        dashboardRoute: "podman",
+    },
+    {
+        column: "proxmoxClusters",
+        type: LinkedAffectedResourceType.ProxmoxCluster,
+        label: "Proxmox Cluster",
+        dashboardRoute: "proxmox",
+    },
+    {
+        column: "vmwareVCenters",
+        type: LinkedAffectedResourceType.VMwareVCenter,
+        label: "VMware vCenter",
+        dashboardRoute: "vmware",
+    },
+    {
+        column: "cephClusters",
+        type: LinkedAffectedResourceType.CephCluster,
+        label: "Ceph Cluster",
+        dashboardRoute: "ceph",
+    },
+    {
+        column: "dockerSwarmClusters",
+        type: LinkedAffectedResourceType.DockerSwarmCluster,
+        label: "Docker Swarm Cluster",
+        dashboardRoute: "docker-swarm",
+    },
+    {
+        column: "iotFleets",
+        type: LinkedAffectedResourceType.IoTFleet,
+        label: "IoT Fleet",
+        dashboardRoute: "iot",
+    },
+    {
+        column: "databaseServers",
+        type: LinkedAffectedResourceType.DatabaseServer,
+        label: "Database",
+        dashboardRoute: "databases",
+    },
+    {
+        column: "networkSites",
+        type: LinkedAffectedResourceType.NetworkSite,
+        label: "Network Site",
+        dashboardRoute: "network-sites/view",
+    },
+    {
+        column: "services",
+        type: LinkedAffectedResourceType.Service,
+        label: "Service",
+        dashboardRoute: "service",
+    },
+    /*
+     * Last, as on the cards: an SLO is the objective measured over the
+     * resources above it rather than one of them.
+     */
+    {
+        column: "serviceLevelObjectives",
+        type: LinkedAffectedResourceType.ServiceLevelObjective,
+        label: "SLO",
+        dashboardRoute: "slos",
+    },
+];
+function isSameProject(projectId, expected) {
+    if (!projectId) {
+        return false;
+    }
+    return (projectId.toString().trim().toLowerCase() ===
+        expected.toString().trim().toLowerCase());
+}
+export default class LinkedAffectedResources {
+    // The relations `model` carries, in display order.
+    static getRelations(model) {
+        return LINKED_AFFECTED_RESOURCE_RELATIONS.filter((relation) => {
+            return model.hasColumn(relation.column);
+        });
+    }
+    static async readForIncident(data) {
+        return await LinkedAffectedResources.readForIncidents({
+            service: data.service,
+            projectId: data.projectId,
+            incidentIds: [data.incidentId],
+        });
+    }
+    static async readForIncidents(data) {
+        return await LinkedAffectedResources.read({
+            service: data.service,
+            model: new Incident(),
+            projectId: data.projectId,
+            recordIds: data.incidentIds,
+        });
+    }
+    static async readForAlert(data) {
+        return await LinkedAffectedResources.readForAlerts({
+            service: data.service,
+            projectId: data.projectId,
+            alertIds: [data.alertId],
+        });
+    }
+    static async readForAlerts(data) {
+        return await LinkedAffectedResources.read({
+            service: data.service,
+            model: new Alert(),
+            projectId: data.projectId,
+            recordIds: data.alertIds,
+        });
+    }
+    static async readForScheduledMaintenance(data) {
+        return await LinkedAffectedResources.read({
+            service: data.service,
+            model: new ScheduledMaintenance(),
+            projectId: data.projectId,
+            recordIds: [data.scheduledMaintenanceId],
+        });
+    }
+    /*
+     * The resources linked to any of `recordIds`, merged into one list.
+     *
+     * One query per relation rather than one query selecting them all: the
+     * relations are many-to-many, and joining a dozen of them at once returns
+     * the product of their sizes - an incident on 50 monitors and 50 hosts
+     * would come back as 2,500 rows. Read one at a time, the rows add up.
+     */
+    static async read(data) {
+        const recordIds = [];
+        const seenRecordIds = new Set();
+        for (const recordId of data.recordIds) {
+            const key = (recordId === null || recordId === void 0 ? void 0 : recordId.toString()) || "";
+            if (!key || seenRecordIds.has(key)) {
+                continue;
+            }
+            seenRecordIds.add(key);
+            recordIds.push(recordId);
+        }
+        if (recordIds.length === 0) {
+            return [];
+        }
+        const rowsPerRelation = await Promise.all(LinkedAffectedResources.getRelations(data.model).map((relation) => {
+            return data.service.findAllBy({
+                query: {
+                    _id: QueryHelper.any(recordIds),
+                    projectId: data.projectId,
+                },
+                select: {
+                    _id: true,
+                    projectId: true,
+                    [relation.column]: {
+                        _id: true,
+                        name: true,
+                        projectId: true,
+                    },
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+        }));
+        return LinkedAffectedResources.collect({
+            projectId: data.projectId,
+            records: rowsPerRelation.flatMap((rows) => {
+                return rows || [];
+            }),
+        });
+    }
+    /*
+     * The resources on already-read records, in display order and without
+     * repeats. A related row is kept only when it has an id and belongs to
+     * `projectId`; a row whose project was not read cannot be shown to belong
+     * here, so it is left out too - which also makes a caller that drops
+     * projectId from its select fail loudly in tests rather than quietly
+     * print nothing.
+     */
+    static collect(data) {
+        var _a, _b;
+        const resources = [];
+        const seen = new Set();
+        const records = data.records.filter((record) => {
+            if (!record) {
+                return false;
+            }
+            // A record read without its project is taken to be the caller's.
+            return (!record.projectId || isSameProject(record.projectId, data.projectId));
+        });
+        for (const relation of LINKED_AFFECTED_RESOURCE_RELATIONS) {
+            for (const record of records) {
+                const value = record[relation.column];
+                const rows = Array.isArray(value)
+                    ? value
+                    : value
+                        ? [value]
+                        : [];
+                for (const row of rows) {
+                    const id = ((_a = row === null || row === void 0 ? void 0 : row._id) === null || _a === void 0 ? void 0 : _a.toString()) || "";
+                    if (!row || !id || !isSameProject(row.projectId, data.projectId)) {
+                        continue;
+                    }
+                    const key = `${relation.type}:${id}`;
+                    if (seen.has(key)) {
+                        continue;
+                    }
+                    seen.add(key);
+                    resources.push({
+                        type: relation.type,
+                        id: id,
+                        name: ((_b = row.name) === null || _b === void 0 ? void 0 : _b.toString()) || "",
+                    });
+                }
+            }
+        }
+        return resources;
+    }
+    /*
+     * The names, for plain-text surfaces: emails and workspace summaries.
+     *
+     * `seriesSummary` is an alert's series identity - the pod or container a
+     * grouped monitor raised it for (SeriesLabelDisplay.buildInlineSummary).
+     * It names what broke more precisely than the monitor does, so it takes
+     * the monitor's place at the head of the list rather than joining it.
+     *
+     * A name that repeats (a monitor and a host both called "web-01") is
+     * printed once: this is a sentence, not a table.
+     */
+    static getNames(data) {
+        var _a;
+        const names = [];
+        const seenNames = new Set();
+        const seriesSummary = ((_a = data.seriesSummary) === null || _a === void 0 ? void 0 : _a.trim()) || "";
+        const addName = (name) => {
+            const trimmed = name.trim();
+            if (!trimmed || seenNames.has(trimmed)) {
+                return;
+            }
+            seenNames.add(trimmed);
+            names.push(trimmed);
+        };
+        addName(seriesSummary);
+        for (const resource of data.resources) {
+            if (seriesSummary &&
+                resource.type === LinkedAffectedResourceType.Monitor) {
+                continue;
+            }
+            addName(resource.name);
+        }
+        return names;
+    }
+    // getNames joined with ", ", or `fallback` when there are none.
+    static getText(data) {
+        return (LinkedAffectedResources.getNames({
+            resources: data.resources,
+            seriesSummary: data.seriesSummary,
+        }).join(", ") || data.fallback);
+    }
+    static getDashboardUrl(data) {
+        const relation = LinkedAffectedResources.getRelationForType(data.resource.type);
+        // URL.addRoute mutates, and the caller reuses its dashboard URL.
+        return URL.fromString(data.dashboardUrl.toString()).addRoute(`/${data.projectId.toString()}/${relation.dashboardRoute}/${data.resource.id}`);
+    }
+    /*
+     * The bullets under a feed item's "🌎 Resources Affected" header.
+     *
+     * A monitor keeps the bullet the created feeds have always printed,
+     * `- [<name>](<monitor link>)`, and an SLO keeps `- [SLO <name>](<link>)`
+     * from getSloAffectedResourceMarkdownLines. Every other resource follows
+     * the SLO's shape, `- [Host <name>](<link>)`, so the reader can tell a host
+     * from a cluster from a service.
+     *
+     * Those names are escaped: feeds render without safe mode and the same
+     * markdown goes to Slack and Teams, and a host or cluster name can come
+     * from an agent rather than from someone typing it.
+     */
+    static getMarkdownLines(data) {
+        const lines = [];
+        const slos = [];
+        for (const resource of data.resources) {
+            if (resource.type === LinkedAffectedResourceType.ServiceLevelObjective) {
+                slos.push({
+                    _id: resource.id,
+                    name: resource.name,
+                    // Already held to this project by collect.
+                    projectId: data.projectId,
+                });
+                continue;
+            }
+            const link = LinkedAffectedResources.getDashboardUrl({
+                dashboardUrl: data.dashboardUrl,
+                projectId: data.projectId,
+                resource: resource,
+            }).toString();
+            if (resource.type === LinkedAffectedResourceType.Monitor) {
+                lines.push(`- [${resource.name}](${link})`);
+                continue;
+            }
+            const label = LinkedAffectedResources.getRelationForType(resource.type).label;
+            const escapedName = escapeMarkdownInline(resource.name).trim();
+            lines.push(`- [${escapedName ? `${label} ${escapedName}` : label}](${link})`);
+        }
+        // SLOs are last in the table, so appending them keeps the order.
+        lines.push(...getSloAffectedResourceMarkdownLines({
+            dashboardUrl: data.dashboardUrl,
+            projectId: data.projectId,
+            serviceLevelObjectives: slos,
+        }));
+        return lines;
+    }
+    static getRelationForType(type) {
+        // Every type has at least one entry, so this always finds one.
+        return LINKED_AFFECTED_RESOURCE_RELATIONS.find((relation) => {
+            return relation.type === type;
+        });
+    }
+}
+//# sourceMappingURL=LinkedAffectedResources.js.map

package/build/dist/Server/Utils/AffectedResources/LinkedAffectedResources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"LinkedAffectedResources.js","sourceRoot":"","sources":["../../../../../Server/Utils/AffectedResources/LinkedAffectedResources.ts"],"names":[],"mappings":"AAEA,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAE3D,OAAO,KAAK,MAAM,sCAAsC,CAAC;AAEzD,OAAO,QAAQ,MAAM,yCAAyC,CAAC;AAC/D,OAAO,oBAAoB,MAAM,qDAAqD,CAAC;AACvF,OAAO,GAAG,MAAM,wBAAwB,CAAC;AAEzC,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EACL,mCAAmC,GAEpC,MAAM,gDAAgD,CAAC;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,MAAM,CAAN,IAAY,0BAeX;AAfD,WAAY,0BAA0B;IACpC,iDAAmB,CAAA;IACnB,2CAAa,CAAA;IACb,qEAAuC,CAAA;IACvC,uDAAyB,CAAA;IACzB,uDAAyB,CAAA;IACzB,+DAAiC,CAAA;IACjC,6DAA+B,CAAA;IAC/B,yDAA2B,CAAA;IAC3B,uEAAyC,CAAA;IACzC,mDAAqB,CAAA;IACrB,+DAAiC,CAAA;IACjC,yDAA2B,CAAA;IAC3B,iDAAmB,CAAA;IACnB,6EAA+C,CAAA;AACjD,CAAC,EAfW,0BAA0B,KAA1B,0BAA0B,QAerC;AAkBD;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAC7C;IACE;QACE,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,0BAA0B,CAAC,OAAO;QACxC,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,UAAU;KAC3B;IACD;QACE,MAAM,EAAE,SAAS;QACjB,IAAI,EAAE,0BAA0B,CAAC,OAAO;QACxC,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,UAAU;KAC3B;IACD;QACE,MAAM,EAAE,OAAO;QACf,IAAI,EAAE,0BAA0B,CAAC,IAAI;QACrC,KAAK,EAAE,MAAM;QACb,cAAc,EAAE,MAAM;KACvB;IACD;QACE,MAAM,EAAE,oBAAoB;QAC5B,IAAI,EAAE,0BAA0B,CAAC,iBAAiB;QAClD,KAAK,EAAE,oBAAoB;QAC3B,cAAc,EAAE,YAAY;KAC7B;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,0BAA0B,CAAC,UAAU;QAC3C,KAAK,EAAE,aAAa;QACpB,cAAc,EAAE,QAAQ;KACzB;IACD;QACE,MAAM,EAAE,aAAa;QACrB,IAAI,EAAE,0BAA0B,CAAC,UAAU;QAC3C,KAAK,EAAE,aAAa;QACpB,cAAc,EAAE,QAAQ;KACzB;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,0BAA0B,CAAC,cAAc;QAC/C,KAAK,EAAE,iBAAiB;QACxB,cAAc,EAAE,SAAS;KAC1B;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,IAAI,EAAE,0BAA0B,CAAC,aAAa;QAC9C,KAAK,EAAE,gBAAgB;QACvB,cAAc,EAAE,QAAQ;KACzB;IACD;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,0BAA0B,CAAC,WAAW;QAC5C,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE,MAAM;KACvB;IACD;QACE,MAAM,EAAE,qBAAqB;QAC7B,IAAI,EAAE,0BAA0B,CAAC,kBAAkB;QACnD,KAAK,EAAE,sBAAsB;QAC7B,cAAc,EAAE,cAAc;KAC/B;IACD;QACE,MAAM,EAAE,WAAW;QACnB,IAAI,EAAE,0BAA0B,CAAC,QAAQ;QACzC,KAAK,EAAE,WAAW;QAClB,cAAc,EAAE,KAAK;KACtB;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,IAAI,EAAE,0BAA0B,CAAC,cAAc;QAC/C,KAAK,EAAE,UAAU;QACjB,cAAc,EAAE,WAAW;KAC5B;IACD;QACE,MAAM,EAAE,cAAc;QACtB,IAAI,EAAE,0BAA0B,CAAC,WAAW;QAC5C,KAAK,EAAE,cAAc;QACrB,cAAc,EAAE,oBAAoB;KACrC;IACD;QACE,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,0BAA0B,CAAC,OAAO;QACxC,KAAK,EAAE,SAAS;QAChB,cAAc,EAAE,SAAS;KAC1B;IACD;;;OAGG;IACH;QACE,MAAM,EAAE,wBAAwB;QAChC,IAAI,EAAE,0BAA0B,CAAC,qBAAqB;QACtD,KAAK,EAAE,KAAK;QACZ,cAAc,EAAE,MAAM;KACvB;CACF,CAAC;AAoBJ,SAAS,aAAa,CACpB,SAA+C,EAC/C,QAAkB;IAElB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,SAAS,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE;QACzC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACzC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,OAAO,OAAO,uBAAuB;IAC1C,mDAAmD;IAC5C,MAAM,CAAC,YAAY,CACxB,KAAwB;QAExB,OAAO,kCAAkC,CAAC,MAAM,CAC9C,CAAC,QAAwC,EAAE,EAAE;YAC3C,OAAO,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC,CACF,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAInC;QACC,OAAO,MAAM,uBAAuB,CAAC,gBAAgB,CAAC;YACpD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,WAAW,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAIpC;QACC,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,QAAQ,EAAE;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,WAAW;SAC5B,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,IAIhC;QACC,OAAO,MAAM,uBAAuB,CAAC,aAAa,CAAC;YACjD,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC;SACzB,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAIjC;QACC,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,KAAK,EAAE;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,IAAI,CAAC,QAAQ;SACzB,CAAC,CAAC;IACL,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,IAI/C;QACC,OAAO,MAAM,uBAAuB,CAAC,IAAI,CAAC;YACxC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,oBAAoB,EAAE;YACjC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,SAAS,EAAE,CAAC,IAAI,CAAC,sBAAsB,CAAC;SACzC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACK,MAAM,CAAC,KAAK,CAAC,IAAI,CAAuC,IAK/D;QACC,MAAM,SAAS,GAAoB,EAAE,CAAC;QACtC,MAAM,aAAa,GAAgB,IAAI,GAAG,EAAU,CAAC;QAErD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,MAAM,GAAG,GAAW,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,EAAE,KAAI,EAAE,CAAC;YAE/C,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnC,SAAS;YACX,CAAC;YAED,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACvB,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3B,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,eAAe,GACnB,MAAM,OAAO,CAAC,GAAG,CACf,uBAAuB,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAClD,CACE,QAAwC,EACZ,EAAE;YAC9B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC;oBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;iBACM;gBACjC,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;oBACf,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;wBACjB,GAAG,EAAE,IAAI;wBACT,IAAI,EAAE,IAAI;wBACV,SAAS,EAAE,IAAI;qBAChB;iBAC+B;gBAClC,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;QACL,CAAC,CACF,CACF,CAAC;QAEJ,OAAO,uBAAuB,CAAC,OAAO,CAAC;YACrC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,eAAe,CAAC,OAAO,CAC9B,CAAC,IAAmC,EAAqB,EAAE;gBACzD,OAAO,IAAI,IAAI,EAAE,CAAC;YACpB,CAAC,CACuC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,OAAO,CAAC,IAGrB;;QACC,MAAM,SAAS,GAAkC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;QAE5C,MAAM,OAAO,GAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,CAC7D,CAAC,MAA8C,EAAW,EAAE;YAC1D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,KAAK,CAAC;YACf,CAAC;YAED,iEAAiE;YACjE,OAAO,CACL,CAAC,MAAM,CAAC,SAAS,IAAI,aAAa,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,CACrE,CAAC;QACJ,CAAC,CAC4B,CAAC;QAEhC,KAAK,MAAM,QAAQ,IAAI,kCAAkC,EAAE,CAAC;YAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAY,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAE/C,MAAM,IAAI,GAAyC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;oBACrE,CAAC,CAAE,KAA8C;oBACjD,CAAC,CAAC,KAAK;wBACL,CAAC,CAAC,CAAC,KAAmB,CAAC;wBACvB,CAAC,CAAC,EAAE,CAAC;gBAET,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;oBACvB,MAAM,EAAE,GAAW,CAAA,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,GAAG,0CAAE,QAAQ,EAAE,KAAI,EAAE,CAAC;oBAE9C,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;wBACjE,SAAS;oBACX,CAAC;oBAED,MAAM,GAAG,GAAW,GAAG,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;oBAE7C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClB,SAAS;oBACX,CAAC;oBAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAEd,SAAS,CAAC,IAAI,CAAC;wBACb,IAAI,EAAE,QAAQ,CAAC,IAAI;wBACnB,EAAE,EAAE,EAAE;wBACN,IAAI,EAAE,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,QAAQ,EAAE,KAAI,EAAE;qBACjC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,QAAQ,CAAC,IAGtB;;QACC,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,MAAM,SAAS,GAAgB,IAAI,GAAG,EAAU,CAAC;QACjD,MAAM,aAAa,GAAW,CAAA,MAAA,IAAI,CAAC,aAAa,0CAAE,IAAI,EAAE,KAAI,EAAE,CAAC;QAE/D,MAAM,OAAO,GAA2B,CAAC,IAAY,EAAQ,EAAE;YAC7D,MAAM,OAAO,GAAW,IAAI,CAAC,IAAI,EAAE,CAAC;YAEpC,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBACvC,OAAO;YACT,CAAC;YAED,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC,CAAC;QAEF,OAAO,CAAC,aAAa,CAAC,CAAC;QAEvB,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IACE,aAAa;gBACb,QAAQ,CAAC,IAAI,KAAK,0BAA0B,CAAC,OAAO,EACpD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gEAAgE;IACzD,MAAM,CAAC,OAAO,CAAC,IAIrB;QACC,OAAO,CACL,uBAAuB,CAAC,QAAQ,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAC/B,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,IAI7B;QACC,MAAM,QAAQ,GACZ,uBAAuB,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAEjE,iEAAiE;QACjE,OAAO,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAC1D,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,QAAQ,CAAC,cAAc,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAC/E,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,MAAM,CAAC,gBAAgB,CAAC,IAI9B;QACC,MAAM,KAAK,GAAkB,EAAE,CAAC;QAChC,MAAM,IAAI,GAA0C,EAAE,CAAC;QAEvD,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,0BAA0B,CAAC,qBAAqB,EAAE,CAAC;gBACvE,IAAI,CAAC,IAAI,CAAC;oBACR,GAAG,EAAE,QAAQ,CAAC,EAAE;oBAChB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,2CAA2C;oBAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;iBAC1B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YAED,MAAM,IAAI,GAAW,uBAAuB,CAAC,eAAe,CAAC;gBAC3D,YAAY,EAAE,IAAI,CAAC,YAAY;gBAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEd,IAAI,QAAQ,CAAC,IAAI,KAAK,0BAA0B,CAAC,OAAO,EAAE,CAAC;gBACzD,KAAK,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC,CAAC;gBAC5C,SAAS;YACX,CAAC;YAED,MAAM,KAAK,GAAW,uBAAuB,CAAC,kBAAkB,CAC9D,QAAQ,CAAC,IAAI,CACd,CAAC,KAAK,CAAC;YACR,MAAM,WAAW,GAAW,oBAAoB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAEvE,KAAK,CAAC,IAAI,CACR,MAAM,WAAW,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,GAAG,CAClE,CAAC;QACJ,CAAC;QAED,iEAAiE;QACjE,KAAK,CAAC,IAAI,CACR,GAAG,mCAAmC,CAAC;YACrC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,sBAAsB,EAAE,IAAI;SAC7B,CAAC,CACH,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,MAAM,CAAC,kBAAkB,CAC/B,IAAgC;QAEhC,+DAA+D;QAC/D,OAAO,kCAAkC,CAAC,IAAI,CAC5C,CAAC,QAAwC,EAAE,EAAE;YAC3C,OAAO,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC;QAChC,CAAC,CACD,CAAC;IACL,CAAC;CACF"}

package/build/dist/Server/Utils/Alert/AlertStateChangeAuthorization.js

@@ -0,0 +1,112 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import Alert from "../../../Models/DatabaseModels/Alert";
+import AlertStateTimeline from "../../../Models/DatabaseModels/AlertStateTimeline";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../Types/ObjectID";
+import AlertService from "../../Services/AlertService";
+import ModelPermission from "../../Types/Database/Permissions/Index";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import { applyAlertSelfPrivacyFilter } from "./AlertPrivacyFilter";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+/*
+ * Whether a caller may change the state of a set of alerts - acknowledge
+ * them, say - when that change is going to be written for them as root.
+ *
+ * Changing an alert's state from its own page takes two writes as the caller:
+ * a new AlertStateTimeline row (table and column permissions only), and then
+ * the alert's currentAlertStateId, which is an Alert UPDATE and so is narrowed
+ * by the caller's label scope, Owned scope and alert privacy. Being able to
+ * read an alert is not enough: a Viewer who is also an AlertMember for one
+ * label can read every alert but change the state of only some. A root write
+ * skips both, so this checks both, for every alert, before anything is
+ * written - the same rule the Microsoft Teams acknowledge action applies to
+ * one alert.
+ */
+export default class AlertStateChangeAuthorization {
+    static async assertCanChangeStateOfAlerts(data) {
+        if (data.props.isRoot || data.alertIds.length === 0) {
+            return;
+        }
+        const probe = new AlertStateTimeline();
+        probe.projectId = data.projectId;
+        probe.alertId = data.alertIds[0];
+        probe.alertStateId = ObjectID.generate();
+        ModelPermission.checkCreatePermissions(AlertStateTimeline, probe, data.props);
+        const alertQuery = {
+            _id: QueryHelper.any(data.alertIds),
+            projectId: data.projectId,
+        };
+        /*
+         * Labelled block and allow rules are decided per record, from the
+         * record's labels.
+         */
+        const alerts = await AlertService.findBy({
+            query: alertQuery,
+            select: {
+                _id: true,
+                labels: {
+                    _id: true,
+                    name: true,
+                },
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        for (const alert of alerts) {
+            await ModelPermission.checkUpdatePermissionByModel({
+                modelType: Alert,
+                fetchModelWithAccessControlIds: async () => {
+                    return alert;
+                },
+                props: data.props,
+            });
+        }
+        /*
+         * The caller's own update scope (labels, Owned, privacy) as a query:
+         * every alert must still be in it.
+         */
+        const permittedQuery = await ModelPermission.checkUpdateQueryPermissions(Alert, alertQuery, {
+            currentAlertStateId: ObjectID.getZeroObjectID(),
+        }, data.props);
+        const permittedAlerts = await AlertService.findBy({
+            query: applyAlertSelfPrivacyFilter(permittedQuery, data.props),
+            select: {
+                _id: true,
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const permittedIds = new Set(permittedAlerts.map((alert) => {
+            var _a;
+            return ((_a = alert._id) === null || _a === void 0 ? void 0 : _a.toString().toLowerCase()) || "";
+        }));
+        const allPermitted = data.alertIds.every((alertId) => {
+            return permittedIds.has(alertId.toString().toLowerCase());
+        });
+        if (!allPermitted) {
+            throw new NotAuthorizedException("You do not have permission to change the state of one or more of these alerts.");
+        }
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AlertStateChangeAuthorization, "assertCanChangeStateOfAlerts", null);
+//# sourceMappingURL=AlertStateChangeAuthorization.js.map

package/build/dist/Server/Utils/Alert/AlertStateChangeAuthorization.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AlertStateChangeAuthorization.js","sourceRoot":"","sources":["../../../../../Server/Utils/Alert/AlertStateChangeAuthorization.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,KAAK,MAAM,sCAAsC,CAAC;AACzD,OAAO,kBAAkB,MAAM,mDAAmD,CAAC;AAEnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,sBAAsB,MAAM,iDAAiD,CAAC;AACrF,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,YAAY,MAAM,6BAA6B,CAAC;AACvD,OAAO,eAAe,MAAM,wCAAwC,CAAC;AAErE,OAAO,WAAW,MAAM,kCAAkC,CAAC;AAC3D,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,WAAW,MAAM,0BAA0B,CAAC;AAEnD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,OAAO,OAAO,6BAA6B;IAE5B,AAAb,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,IAIhD;QACC,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAuB,IAAI,kBAAkB,EAAE,CAAC;QAC3D,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACjC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC;QAClC,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;QAEzC,eAAe,CAAC,sBAAsB,CACpC,kBAAkB,EAClB,KAAK,EACL,IAAI,CAAC,KAAK,CACX,CAAC;QAEF,MAAM,UAAU,GAAiB;YAC/B,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC;QAEF;;;WAGG;QACH,MAAM,MAAM,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;YACrD,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,IAAI,EAAE,IAAI;iBACX;aACF;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,eAAe,CAAC,4BAA4B,CAAC;gBACjD,SAAS,EAAE,KAAK;gBAChB,8BAA8B,EAAE,KAAK,IAAoB,EAAE;oBACzD,OAAO,KAAK,CAAC;gBACf,CAAC;gBACD,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,MAAM,cAAc,GAClB,MAAM,eAAe,CAAC,2BAA2B,CAC/C,KAAK,EACL,UAAU,EACV;YACE,mBAAmB,EAAE,QAAQ,CAAC,eAAe,EAAE;SAChD,EACD,IAAI,CAAC,KAAK,CACX,CAAC;QAEJ,MAAM,eAAe,GAAiB,MAAM,YAAY,CAAC,MAAM,CAAC;YAC9D,KAAK,EAAE,2BAA2B,CAAC,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC;YAC9D,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;aACV;YACD,KAAK,EAAE,iBAAiB;YACxB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,YAAY,GAAgB,IAAI,GAAG,CACvC,eAAe,CAAC,GAAG,CAAC,CAAC,KAAY,EAAU,EAAE;;YAC3C,OAAO,CAAA,MAAA,KAAK,CAAC,GAAG,0CAAE,QAAQ,GAAG,WAAW,EAAE,KAAI,EAAE,CAAC;QACnD,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,YAAY,GAAY,IAAI,CAAC,QAAQ,CAAC,KAAK,CAC/C,CAAC,OAAiB,EAAW,EAAE;YAC7B,OAAO,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5D,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAC9B,gFAAgF,CACjF,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAnGqB;IADnB,WAAW,EAAE;;;;uEAmGb"}

package/build/dist/Server/Utils/Inventory/InventoryOverviewAggregation.js

@@ -0,0 +1,81 @@
+import AggregateResultUtil from "../../Types/Database/AggregateResultUtil";
+import EntitySource from "../../../Types/Telemetry/EntitySource";
+import { InventoryLiveness, getInventoryLivenessSql, } from "../../../Types/Telemetry/InventoryLiveness";
+/*
+ * The Inventory Overview's numbers: the five summary tiles and the per-type
+ * breakdown.
+ *
+ * These used to be folded in the browser from one list read capped at
+ * LIMIT_PER_PROJECT, so a project past ten thousand items saw tiles and a
+ * breakdown describing whichever ten thousand had been seen most recently,
+ * with nothing on the page saying so. They are counted in Postgres instead,
+ * in ONE grouped statement: the tiles are sums over the same per-type groups
+ * the breakdown lists, so the two are views of one snapshot and cannot
+ * disagree.
+ *
+ * Every tile drills into the Items list, and each filter below is the exact
+ * narrowing that tile's list applies — the source facet, or the source facet
+ * plus the Stale status facet, whose SQL is the same getInventoryLivenessSql
+ * the `inventoryStatus` virtual column is built from.
+ *
+ * Kept apart from InventoryItemService so the dashboard's tile tests and the
+ * Postgres test can use the same columns without loading the service.
+ */
+export const INVENTORY_OVERVIEW_GROUP_BY = [
+    { expression: `"InventoryItem"."entityType"`, alias: "entityType" },
+];
+export const INVENTORY_OVERVIEW_SELECT = [
+    { expression: `COUNT(*)`, alias: "itemCount" },
+    {
+        expression: `COUNT(*) FILTER (WHERE "InventoryItem"."source" = '${EntitySource.Discovered}')`,
+        alias: "discoveredCount",
+    },
+    {
+        expression: `COUNT(*) FILTER (WHERE "InventoryItem"."source" = '${EntitySource.Inventory}')`,
+        alias: "mirroredCount",
+    },
+    {
+        expression: `COUNT(*) FILTER (WHERE "InventoryItem"."source" = '${EntitySource.Manual}')`,
+        alias: "manualCount",
+    },
+    {
+        // Only discovered rows can be stale; the shared rule says NotTracked for the rest.
+        expression: `COUNT(*) FILTER (WHERE (${getInventoryLivenessSql(`"InventoryItem"`)}) = '${InventoryLiveness.Stale}')`,
+        alias: "staleCount",
+    },
+];
+/**
+ * Sum the per-type groups into the tile counts, and key the groups by type
+ * for the breakdown.
+ *
+ * `total` counts every row, including rows whose source this build does not
+ * recognise — they land in none of the three source buckets, which is why
+ * those are not expected to sum to the total. A group with no type still
+ * counts towards every tile; it is only left out of the breakdown, which has
+ * no row to put it in.
+ */
+export function readInventoryOverviewGroups(rows) {
+    const counts = {
+        total: 0,
+        discovered: 0,
+        mirrored: 0,
+        manual: 0,
+        stale: 0,
+        countsByType: {},
+    };
+    for (const row of rows) {
+        const itemCount = AggregateResultUtil.toNumber(row, "itemCount");
+        counts.total += itemCount;
+        counts.discovered += AggregateResultUtil.toNumber(row, "discoveredCount");
+        counts.mirrored += AggregateResultUtil.toNumber(row, "mirroredCount");
+        counts.manual += AggregateResultUtil.toNumber(row, "manualCount");
+        counts.stale += AggregateResultUtil.toNumber(row, "staleCount");
+        const entityType = AggregateResultUtil.toStringOrNull(row, "entityType");
+        if (entityType && itemCount > 0) {
+            counts.countsByType[entityType] =
+                (counts.countsByType[entityType] || 0) + itemCount;
+        }
+    }
+    return counts;
+}
+//# sourceMappingURL=InventoryOverviewAggregation.js.map

package/build/dist/Server/Utils/Inventory/InventoryOverviewAggregation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"InventoryOverviewAggregation.js","sourceRoot":"","sources":["../../../../../Server/Utils/Inventory/InventoryOverviewAggregation.ts"],"names":[],"mappings":"AAIA,OAAO,mBAAmB,MAAM,0CAA0C,CAAC;AAE3E,OAAO,YAAY,MAAM,uCAAuC,CAAC;AACjE,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,4CAA4C,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAA2B;IACjE,EAAE,UAAU,EAAE,8BAA8B,EAAE,KAAK,EAAE,YAAY,EAAE;CACpE,CAAC;AAEF,MAAM,CAAC,MAAM,yBAAyB,GAA2B;IAC/D,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE;IAC9C;QACE,UAAU,EAAE,sDAAsD,YAAY,CAAC,UAAU,IAAI;QAC7F,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,UAAU,EAAE,sDAAsD,YAAY,CAAC,SAAS,IAAI;QAC5F,KAAK,EAAE,eAAe;KACvB;IACD;QACE,UAAU,EAAE,sDAAsD,YAAY,CAAC,MAAM,IAAI;QACzF,KAAK,EAAE,aAAa;KACrB;IACD;QACE,mFAAmF;QACnF,UAAU,EAAE,2BAA2B,uBAAuB,CAAC,iBAAiB,CAAC,QAAQ,iBAAiB,CAAC,KAAK,IAAI;QACpH,KAAK,EAAE,YAAY;KACpB;CACF,CAAC;AAYF;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,IAAyB;IAEzB,MAAM,MAAM,GAA4B;QACtC,KAAK,EAAE,CAAC;QACR,UAAU,EAAE,CAAC;QACb,QAAQ,EAAE,CAAC;QACX,MAAM,EAAE,CAAC;QACT,KAAK,EAAE,CAAC;QACR,YAAY,EAAE,EAAE;KACjB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,SAAS,GAAW,mBAAmB,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;QAEzE,MAAM,CAAC,KAAK,IAAI,SAAS,CAAC;QAC1B,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QAC1E,MAAM,CAAC,QAAQ,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClE,MAAM,CAAC,KAAK,IAAI,mBAAmB,CAAC,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAEhE,MAAM,UAAU,GAAkB,mBAAmB,CAAC,cAAc,CAClE,GAAG,EACH,YAAY,CACb,CAAC;QAEF,IAAI,UAAU,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;gBAC7B,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,SAAS,CAAC;QACvD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/build/dist/Server/Utils/Response.js

@@ -275,6 +275,30 @@ export default class Response {
             .status((options === null || options === void 0 ? void 0 : options.statusCode) ? options === null || options === void 0 ? void 0 : options.statusCode.toNumber() : 200)
             .send(item);
     }
+    /*
+     * Send a body that is ALREADY serialized JSON, as is.
+     *
+     * For responses built once and handed out many times (the Topology maps
+     * cache their serialized payload): sendJsonObjectResponse would parse
+     * nothing but re-stringify a multi-megabyte object on every hit, and
+     * res.send would hash the whole body for an ETag nobody can use on a POST.
+     * writeHead + end skips both, the way sendHtmlResponse does.
+     *
+     * no-store: the body is one project's inventory, read under the caller's
+     * permissions. The audit log gets its size, never the payload.
+     */
+    static sendJsonStringResponse(_req, res, json) {
+        const oneUptimeResponse = res;
+        Response.setNoCacheHeaders(oneUptimeResponse);
+        oneUptimeResponse.logBody = {
+            contentType: "application/json",
+            characters: json.length,
+        };
+        oneUptimeResponse.writeHead(200, {
+            "Content-Type": "application/json; charset=utf-8",
+        });
+        oneUptimeResponse.end(json);
+    }
     static sendTextResponse(_req, res, text) {
         const oneUptimeResponse = res;
         oneUptimeResponse.logBody = { text: text };
@@ -457,6 +481,12 @@ __decorate([
     __metadata("design:paramtypes", [Object, Object, Object, Object]),
     __metadata("design:returntype", void 0)
 ], Response, "sendJsonObjectResponse", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object, String]),
+    __metadata("design:returntype", void 0)
+], Response, "sendJsonStringResponse", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),