@oneuptime/common 14.0.7 → 14.0.8

package/build/dist/Server/Utils/StatusPage/SubscriberNotificationResendAccess.js

@@ -0,0 +1,278 @@
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import StatusPageSubscriberNotificationStatus from "../../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
+import SubscriberNotificationResend from "../../../Types/StatusPage/SubscriberNotificationResend";
+import DatabaseRequestType from "../../Types/BaseDatabase/DatabaseRequestType";
+import ColumnPermissions from "../../Types/Database/Permissions/ColumnPermission";
+import ModelPermission from "../../Types/Database/Permissions/Index";
+import TablePermission from "../../Types/Database/Permissions/TablePermission";
+/*
+ * Who may send a status page subscriber notification again, and when.
+ *
+ * Sending one again is a write: its status goes back to Pending, and the
+ * job that sends it picks it up. So the update's own permission check - the
+ * table's update access control and each written column's - already decides
+ * who may. For a public note that is not enough: the note's edit permission
+ * is granted on its own, and editing a note does not make someone its
+ * poster. Sending a note's notification again tells every subscriber of the
+ * incident's status pages what the note says, which is what posting it did,
+ * so it also needs the permission to post a note that notifies subscribers.
+ * The same goes for telling subscribers about an edit (the note's 'updated'
+ * notification): an editor can change the text first, so with the edit
+ * permission alone it would be a way to message every subscriber.
+ *
+ * When: never while the notification is being sent. The send settles its
+ * own status when it finishes, so a Pending written over a running send
+ * either lets a second run send it at the same time - the same subscribers
+ * messaged twice, each run then overwriting the other's status - or is
+ * overwritten and lost without a word. That holds for every notification a
+ * user can send again (assertNotQueuedWhileBeingSent).
+ *
+ * These checks run in the services' onBeforeUpdate, before the update's own
+ * check (DatabaseService runs that after the hooks), so each one checks
+ * permissions before it reads anything: a caller who may not send a
+ * notification again is told only that, never what state the notification
+ * is in. Rows are then read with the caller's own permissions, so nothing
+ * they cannot read decides the answer either.
+ *
+ * Root callers - the workers and other internal writes - are trusted and
+ * never checked. Master admins skip the permission checks, as they do
+ * everywhere, but not the checks on the notification's state.
+ */
+class SubscriberNotificationResendAccess {
+    static isPermissionChecked(props) {
+        return !props.isRoot && !props.isMasterAdmin;
+    }
+    /*
+     * Throws `refusal` unless the caller may write these columns of the model:
+     * the table's update access control, then each column's. A request that
+     * fails for any other reason - an expired session, an unpaid plan - keeps
+     * its own error.
+     */
+    static assertCallerMayUpdateColumns(data) {
+        if (!this.isPermissionChecked(data.props)) {
+            return;
+        }
+        this.withRefusal(data.refusal, () => {
+            TablePermission.checkTableLevelPermissions(data.modelType, data.props, DatabaseRequestType.Update);
+            ColumnPermissions.checkDataColumnPermissions(data.modelType, data.columns, data.props, DatabaseRequestType.Update);
+        });
+    }
+    /*
+     * Throws `refusal` unless the caller may post a new note of this type
+     * that notifies subscribers: the create check a post with Notify Status
+     * Page Subscribers ticked goes through, on a note carrying only that
+     * choice.
+     */
+    static assertCallerMayPostNotifyingNote(data) {
+        if (!this.isPermissionChecked(data.props)) {
+            return;
+        }
+        const probe = new data.modelType();
+        probe["shouldStatusPageSubscribersBeNotifiedOnNoteCreated"] = true;
+        this.withRefusal(data.refusal, () => {
+            ModelPermission.checkCreatePermissions(data.modelType, probe, data.props);
+        });
+    }
+    /*
+     * A user's or an API key's request to send a public note's 'posted'
+     * notification again - an update writing Pending into
+     * subscriberNotificationStatusOnNoteCreated, which is what the dashboard's
+     * Retry and Resend do. Shared by the incident, incident episode and
+     * scheduled maintenance public notes.
+     *
+     * - The caller must be able to edit the note's notification status and to
+     *   post a note that notifies subscribers (see the header).
+     * - Every note the update matches must be one whose notification can be
+     *   sent again (SubscriberNotificationResend.getPublicNoteResendRefusal):
+     *   not a note posted without notifying subscribers, which the job never
+     *   sends, and not one being sent right now, whose send would overwrite
+     *   the request when it finishes.
+     *
+     * An update that does not ask for it is not looked at.
+     */
+    static async assertPublicNoteResendAllowed(data) {
+        const updateBy = data.updateBy;
+        if (updateBy.props.isRoot ||
+            !SubscriberNotificationResend.isPublicNoteResendRequested(updateBy.data)) {
+            return;
+        }
+        this.assertCallerMayUpdateColumns({
+            modelType: data.modelType,
+            columns: this.PUBLIC_NOTE_RESEND_COLUMNS,
+            props: updateBy.props,
+            refusal: SubscriberNotificationResend.noPermissionToResendNoteMessage,
+        });
+        this.assertCallerMayPostNotifyingNote({
+            modelType: data.modelType,
+            props: updateBy.props,
+            refusal: SubscriberNotificationResend.noPermissionToResendNoteMessage,
+        });
+        const notes = await data.service.findBy({
+            query: updateBy.query,
+            select: {
+                _id: true,
+                subscriberNotificationStatusOnNoteCreated: true,
+                shouldStatusPageSubscribersBeNotifiedOnNoteCreated: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: updateBy.props,
+        });
+        for (const note of notes) {
+            const record = note;
+            const refusal = SubscriberNotificationResend.getPublicNoteResendRefusal({
+                status: record["subscriberNotificationStatusOnNoteCreated"],
+                shouldStatusPageSubscribersBeNotifiedOnNoteCreated: record["shouldStatusPageSubscribersBeNotifiedOnNoteCreated"],
+            });
+            if (refusal) {
+                throw new BadDataException(refusal);
+            }
+        }
+    }
+    /*
+     * A user's or an API key's request to tell subscribers about an edit to a
+     * public note: the edit carries the notify-on-edit misc data prop
+     * (SubscriberUpdateNotification, which the service has turned into a
+     * Pending by now), or writes Pending into
+     * subscriberNotificationStatusOnNoteUpdated itself, as the dashboard's
+     * Retry of a failed update does. Shared by the incident, incident episode
+     * and scheduled maintenance public notes.
+     *
+     * - The caller must be able to write the update notification's status and
+     *   to post a note that notifies subscribers (see the header).
+     * - It is refused while the update notification is being sent
+     *   (assertNotQueuedWhileBeingSent): the edit can be saved without it.
+     *
+     * An update that does not ask for it is not looked at.
+     */
+    static async assertPublicNoteUpdateNotificationAllowed(data) {
+        const updateBy = data.updateBy;
+        if (updateBy.props.isRoot ||
+            updateBy.data["subscriberNotificationStatusOnNoteUpdated"] !== StatusPageSubscriberNotificationStatus.Pending) {
+            return;
+        }
+        this.assertCallerMayUpdateColumns({
+            modelType: data.modelType,
+            columns: this.PUBLIC_NOTE_UPDATE_NOTIFICATION_COLUMNS,
+            props: updateBy.props,
+            refusal: SubscriberNotificationResend.noPermissionToNotifyAboutEditMessage,
+        });
+        this.assertCallerMayPostNotifyingNote({
+            modelType: data.modelType,
+            props: updateBy.props,
+            refusal: SubscriberNotificationResend.noPermissionToNotifyAboutEditMessage,
+        });
+        await this.assertNotQueuedWhileBeingSent({
+            modelType: data.modelType,
+            service: data.service,
+            updateBy: updateBy,
+            statusColumns: ["subscriberNotificationStatusOnNoteUpdated"],
+            refusal: SubscriberNotificationResend.updateBeingSentMessage,
+        });
+    }
+    /*
+     * A user's or an API key's update writing Pending into a notification's
+     * status column - Retry, Resend, or the API route of sending it again -
+     * while that notification is being sent (InProgress). Refused with
+     * `refusal` (SubscriberNotificationResend.beingSentMessage by default):
+     * see the header for why.
+     *
+     * Only the columns the update writes Pending into are looked at, so an
+     * edit that leaves the notification alone is never refused, and Pending
+     * written over Pending (queued already) changes nothing and is let
+     * through.
+     *
+     * Permission first: a caller who may not write those columns is left to
+     * the update's own check, which refuses them anyway, and never learns the
+     * notification's state from this one. The rows are then read with the
+     * caller's own permissions, so nothing they cannot read decides the
+     * answer. Root callers - the workers - are never checked.
+     */
+    static async assertNotQueuedWhileBeingSent(data) {
+        const updateBy = data.updateBy;
+        if (updateBy.props.isRoot) {
+            return;
+        }
+        const written = (updateBy.data || {});
+        const queuedColumns = data.statusColumns.filter((column) => {
+            return (written[column] === StatusPageSubscriberNotificationStatus.Pending);
+        });
+        if (queuedColumns.length === 0) {
+            return;
+        }
+        const pendingColumns = {};
+        const select = { _id: true };
+        for (const column of queuedColumns) {
+            pendingColumns[column] = StatusPageSubscriberNotificationStatus.Pending;
+            select[column] = true;
+        }
+        try {
+            this.assertCallerMayUpdateColumns({
+                modelType: data.modelType,
+                columns: pendingColumns,
+                props: updateBy.props,
+                refusal: "",
+            });
+        }
+        catch (err) {
+            if (err instanceof NotAuthorizedException) {
+                return;
+            }
+            throw err;
+        }
+        const rows = await data.service.findBy({
+            query: updateBy.query,
+            select: select,
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: updateBy.props,
+        });
+        for (const row of rows) {
+            const record = row;
+            for (const column of queuedColumns) {
+                if (record[column] === StatusPageSubscriberNotificationStatus.InProgress) {
+                    throw new BadDataException(data.refusal || SubscriberNotificationResend.beingSentMessage);
+                }
+            }
+        }
+    }
+    /*
+     * Runs a permission check and turns its refusal into `refusal`, which says
+     * what the caller was trying to do. A column refusal is a BadDataException
+     * ("User is not allowed to update on ... column"), a table refusal a
+     * NotAuthorizedException; both become a NotAuthorizedException. Anything
+     * else - an anonymous caller, an unpaid plan - passes through as it is.
+     */
+    static withRefusal(refusal, check) {
+        try {
+            check();
+        }
+        catch (err) {
+            if (err instanceof NotAuthorizedException ||
+                err instanceof BadDataException) {
+                throw new NotAuthorizedException(refusal);
+            }
+            throw err;
+        }
+    }
+}
+/*
+ * The columns of a public note that sending its 'posted' notification
+ * again writes.
+ */
+SubscriberNotificationResendAccess.PUBLIC_NOTE_RESEND_COLUMNS = {
+    subscriberNotificationStatusOnNoteCreated: StatusPageSubscriberNotificationStatus.Pending,
+    subscriberNotificationStatusMessage: "",
+};
+/*
+ * The columns of a public note that telling subscribers about an edit
+ * writes.
+ */
+SubscriberNotificationResendAccess.PUBLIC_NOTE_UPDATE_NOTIFICATION_COLUMNS = {
+    subscriberNotificationStatusOnNoteUpdated: StatusPageSubscriberNotificationStatus.Pending,
+    subscriberNotificationStatusMessageOnNoteUpdated: "",
+};
+export default SubscriberNotificationResendAccess;
+//# sourceMappingURL=SubscriberNotificationResendAccess.js.map

package/build/dist/Server/Utils/StatusPage/SubscriberNotificationResendAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriberNotificationResendAccess.js","sourceRoot":"","sources":["../../../../../Server/Utils/StatusPage/SubscriberNotificationResendAccess.ts"],"names":[],"mappings":"AAEA,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,gBAAgB,MAAM,2CAA2C,CAAC;AACzE,OAAO,sBAAsB,MAAM,iDAAiD,CAAC;AAErF,OAAO,sCAAsC,MAAM,kEAAkE,CAAC;AACtH,OAAO,4BAA4B,MAAM,wDAAwD,CAAC;AAElG,OAAO,mBAAmB,MAAM,8CAA8C,CAAC;AAI/E,OAAO,iBAAiB,MAAM,mDAAmD,CAAC;AAClF,OAAO,eAAe,MAAM,wCAAwC,CAAC;AACrE,OAAO,eAAe,MAAM,kDAAkD,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAqB,kCAAkC;IAsB9C,MAAM,CAAC,mBAAmB,CAC/B,KAAqC;QAErC,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC;IAC/C,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,4BAA4B,CAExC,IAKD;QACC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YAClC,eAAe,CAAC,0BAA0B,CACxC,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,KAAK,EACV,mBAAmB,CAAC,MAAM,CAC3B,CAAC;YAEF,iBAAiB,CAAC,0BAA0B,CAC1C,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,OAAgC,EACrC,IAAI,CAAC,KAAK,EACV,mBAAmB,CAAC,MAAM,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,gCAAgC,CAE5C,IAID;QACC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1C,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAU,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,KAA+B,CAC9B,oDAAoD,CACrD,GAAG,IAAI,CAAC;QAET,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YAClC,eAAe,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACI,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAE/C,IAID;QACC,MAAM,QAAQ,GAAoB,IAAI,CAAC,QAAQ,CAAC;QAEhD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM;YACrB,CAAC,4BAA4B,CAAC,2BAA2B,CACvD,QAAQ,CAAC,IAER,CACF,EACD,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,0BAA0B;YACxC,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,OAAO,EAAE,4BAA4B,CAAC,+BAA+B;SACtE,CAAC,CAAC;QAEH,IAAI,CAAC,gCAAgC,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,OAAO,EAAE,4BAA4B,CAAC,+BAA+B;SACtE,CAAC,CAAC;QAEH,MAAM,KAAK,GAAiB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACpD,KAAK,EAAE,QAAQ,CAAC,KAAqB;YACrC,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,yCAAyC,EAAE,IAAI;gBAC/C,kDAAkD,EAAE,IAAI;aAC7B;YAC7B,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAe,IAA6B,CAAC;YAEzD,MAAM,OAAO,GACX,4BAA4B,CAAC,0BAA0B,CAAC;gBACtD,MAAM,EAAE,MAAM,CAAC,2CAA2C,CAE7C;gBACb,kDAAkD,EAAE,MAAM,CACxD,oDAAoD,CAC9B;aACzB,CAAC,CAAC;YAEL,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACI,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAE3D,IAID;QACC,MAAM,QAAQ,GAAoB,IAAI,CAAC,QAAQ,CAAC;QAEhD,IACE,QAAQ,CAAC,KAAK,CAAC,MAAM;YACpB,QAAQ,CAAC,IAAmB,CAC3B,2CAA2C,CAC5C,KAAK,sCAAsC,CAAC,OAAO,EACpD,CAAC;YACD,OAAO;QACT,CAAC;QAED,IAAI,CAAC,4BAA4B,CAAC;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,uCAAuC;YACrD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,OAAO,EACL,4BAA4B,CAAC,oCAAoC;SACpE,CAAC,CAAC;QAEH,IAAI,CAAC,gCAAgC,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,OAAO,EACL,4BAA4B,CAAC,oCAAoC;SACpE,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,6BAA6B,CAAC;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,QAAQ;YAClB,aAAa,EAAE,CAAC,2CAA2C,CAAC;YAC5D,OAAO,EAAE,4BAA4B,CAAC,sBAAsB;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACI,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAE/C,IAMD;QACC,MAAM,QAAQ,GAAyB,IAAI,CAAC,QAAQ,CAAC;QAErD,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1B,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAe,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAe,CAAC;QAEhE,MAAM,aAAa,GAAkB,IAAI,CAAC,aAAa,CAAC,MAAM,CAC5D,CAAC,MAAc,EAAW,EAAE;YAC1B,OAAO,CACL,OAAO,CAAC,MAAM,CAAC,KAAK,sCAAsC,CAAC,OAAO,CACnE,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAe,EAAE,CAAC;QACtC,MAAM,MAAM,GAAe,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAEzC,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;YACnC,cAAc,CAAC,MAAM,CAAC,GAAG,sCAAsC,CAAC,OAAO,CAAC;YACxE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;QACxB,CAAC;QAED,IAAI,CAAC;YACH,IAAI,CAAC,4BAA4B,CAAC;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,cAAc;gBACvB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,OAAO,EAAE,EAAE;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,sBAAsB,EAAE,CAAC;gBAC1C,OAAO;YACT,CAAC;YAED,MAAM,GAAG,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAAsB,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACxD,KAAK,EAAE,QAAQ,CAAC,KAA0B;YAC1C,MAAM,EAAE,MAAuC;YAC/C,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QAEH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,MAAM,GAAe,GAA4B,CAAC;YAExD,KAAK,MAAM,MAAM,IAAI,aAAa,EAAE,CAAC;gBACnC,IACE,MAAM,CAAC,MAAM,CAAC,KAAK,sCAAsC,CAAC,UAAU,EACpE,CAAC;oBACD,MAAM,IAAI,gBAAgB,CACxB,IAAI,CAAC,OAAO,IAAI,4BAA4B,CAAC,gBAAgB,CAC9D,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,WAAW,CAAC,OAAe,EAAE,KAAiB;QAC3D,IAAI,CAAC;YACH,KAAK,EAAE,CAAC;QACV,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,GAAG,YAAY,sBAAsB;gBACrC,GAAG,YAAY,gBAAgB,EAC/B,CAAC;gBACD,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAC;YAC5C,CAAC;YAED,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;;AApVD;;;GAGG;AACqB,6DAA0B,GAAe;IAC/D,yCAAyC,EACvC,sCAAsC,CAAC,OAAO;IAChD,mCAAmC,EAAE,EAAE;CACxC,CAAC;AAEF;;;GAGG;AACqB,0EAAuC,GAC7D;IACE,yCAAyC,EACvC,sCAAsC,CAAC,OAAO;IAChD,gDAAgD,EAAE,EAAE;CACrD,CAAC;eApBe,kCAAkC"}

package/build/dist/Server/Utils/StatusPage/SubscriberNotificationRunLimit.js

@@ -0,0 +1,137 @@
+import OneUptimeDate from "../../../Types/Date";
+import Semaphore, { SemaphoreLockTimeoutError, } from "../../Infrastructure/Semaphore";
+import logger from "../Logger";
+const parsePositiveIntFromEnv = (envKey, fallback) => {
+    const rawValue = process.env[envKey];
+    if (!rawValue) {
+        return fallback;
+    }
+    const parsedValue = parseInt(rawValue, 10);
+    if (!Number.isFinite(parsedValue) || parsedValue <= 0) {
+        return fallback;
+    }
+    return parsedValue;
+};
+// Held when there is nothing to bound: no project, or no Redis.
+const NO_SLOT = {
+    release: async () => { },
+};
+class SubscriberNotificationRunLimit {
+    /*
+     * The job's run, run only while it holds one of the job's permits. For
+     * RunCron: RunCron("Job:Name", options, limit("Job:Name", async () => {})).
+     */
+    static limit(jobName, run) {
+        return async () => {
+            await SubscriberNotificationRunLimit.runWithinLimit(jobName, run);
+        };
+    }
+    /*
+     * One of the project's slots for this job, taken before a run claims one
+     * of the project's notifications; release it once that notification has
+     * settled. Null when the project already has
+     * MAX_CONCURRENT_SENDS_PER_PROJECT of this job's notifications being sent:
+     * leave this one Pending for a later run, and go on to the next. Never
+     * throws: without a project, or without Redis, the send goes ahead
+     * unbounded, as a run does without its permit.
+     */
+    static async takeProjectSlot(data) {
+        var _a;
+        const projectId = ((_a = data.projectId) === null || _a === void 0 ? void 0 : _a.toString().trim()) || "";
+        if (!projectId) {
+            return NO_SLOT;
+        }
+        let permit;
+        try {
+            permit = await Semaphore.acquirePermit({
+                key: `${data.jobName}:${projectId.toLowerCase()}`,
+                namespace: SubscriberNotificationRunLimit.PROJECT_NAMESPACE,
+                limit: SubscriberNotificationRunLimit.MAX_CONCURRENT_SENDS_PER_PROJECT,
+                lockTimeout: SubscriberNotificationRunLimit.PERMIT_TTL_IN_MS,
+                acquireAttemptsLimit: 1,
+                acquireTimeout: 5000,
+                retryInterval: 50,
+                onLockLost: (err) => {
+                    logger.warn(`${data.jobName}: lost the slot of project ${projectId} while sending: ${err.message}`);
+                },
+            });
+        }
+        catch (err) {
+            if (err instanceof SemaphoreLockTimeoutError) {
+                logger.debug(`${data.jobName}: project ${projectId} already has ${SubscriberNotificationRunLimit.MAX_CONCURRENT_SENDS_PER_PROJECT} notification(s) being sent; leaving this one Pending.`);
+                return null;
+            }
+            logger.warn(`${data.jobName}: could not take a slot for project ${projectId} (${err instanceof Error ? err.message : String(err)}); sending without one.`);
+            return NO_SLOT;
+        }
+        return {
+            release: async () => {
+                try {
+                    await Semaphore.releasePermit(permit);
+                }
+                catch (err) {
+                    // It lapses on its own after PERMIT_TTL_IN_MS.
+                    logger.warn(`${data.jobName}: could not release the slot of project ${projectId}: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            },
+        };
+    }
+    static async runWithinLimit(jobName, run) {
+        let permit = null;
+        try {
+            permit = await Semaphore.acquirePermit({
+                key: jobName,
+                namespace: SubscriberNotificationRunLimit.NAMESPACE,
+                limit: SubscriberNotificationRunLimit.MAX_CONCURRENT_RUNS_PER_JOB,
+                lockTimeout: SubscriberNotificationRunLimit.PERMIT_TTL_IN_MS,
+                // One look: a full set of permits means other runs are sending.
+                acquireAttemptsLimit: 1,
+                acquireTimeout: 5000,
+                retryInterval: 50,
+                onLockLost: (err) => {
+                    /*
+                     * Redis lost the permit (it could not be refreshed). The run goes
+                     * on - its claims keep its notifications its own - and another
+                     * run may take the freed slot meanwhile.
+                     */
+                    logger.warn(`${jobName}: lost its run permit while sending: ${err.message}`);
+                },
+            });
+        }
+        catch (err) {
+            if (err instanceof SemaphoreLockTimeoutError) {
+                logger.debug(`${jobName}: ${SubscriberNotificationRunLimit.MAX_CONCURRENT_RUNS_PER_JOB} runs are already sending; leaving the Pending notifications to the runs that follow.`);
+                return;
+            }
+            logger.warn(`${jobName}: could not take a run permit (${err instanceof Error ? err.message : String(err)}); running without one.`);
+            permit = null;
+        }
+        try {
+            await run();
+        }
+        finally {
+            if (permit) {
+                try {
+                    await Semaphore.releasePermit(permit);
+                }
+                catch (err) {
+                    // It lapses on its own after PERMIT_TTL_IN_MS.
+                    logger.warn(`${jobName}: could not release its run permit: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+        }
+    }
+}
+SubscriberNotificationRunLimit.MAX_CONCURRENT_RUNS_PER_JOB = parsePositiveIntFromEnv("SUBSCRIBER_NOTIFICATION_MAX_CONCURRENT_RUNS_PER_JOB", 4);
+/*
+ * Fewer than the runs of a job, so a project whose sends are slow always
+ * leaves some of them to everyone else.
+ */
+SubscriberNotificationRunLimit.MAX_CONCURRENT_SENDS_PER_PROJECT = Math.max(1, Math.min(parsePositiveIntFromEnv("SUBSCRIBER_NOTIFICATION_MAX_CONCURRENT_SENDS_PER_PROJECT", 2), SubscriberNotificationRunLimit.MAX_CONCURRENT_RUNS_PER_JOB - 1));
+// The per-project slots' Redis namespace; the key is the job and the project.
+SubscriberNotificationRunLimit.PROJECT_NAMESPACE = "subscriber-notification-project";
+SubscriberNotificationRunLimit.PERMIT_TTL_IN_MS = OneUptimeDate.convertMinutesToMilliseconds(2);
+// The permits' Redis namespace; the key is the job's name.
+SubscriberNotificationRunLimit.NAMESPACE = "subscriber-notification-run";
+export default SubscriberNotificationRunLimit;
+//# sourceMappingURL=SubscriberNotificationRunLimit.js.map

package/build/dist/Server/Utils/StatusPage/SubscriberNotificationRunLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriberNotificationRunLimit.js","sourceRoot":"","sources":["../../../../../Server/Utils/StatusPage/SubscriberNotificationRunLimit.ts"],"names":[],"mappings":"AAAA,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAEhD,OAAO,SAAS,EAAE,EAChB,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AACxC,OAAO,MAAM,MAAM,WAAW,CAAC;AAkD/B,MAAM,uBAAuB,GAAiD,CAC5E,MAAc,EACd,QAAgB,EACR,EAAE;IACV,MAAM,QAAQ,GAAuB,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEzD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,WAAW,GAAW,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAEnD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEF,gEAAgE;AAChE,MAAM,OAAO,GAAsC;IACjD,OAAO,EAAE,KAAK,IAAmB,EAAE,GAAE,CAAC;CACvC,CAAC;AAEF,MAAqB,8BAA8B;IAgCjD;;;OAGG;IACI,MAAM,CAAC,KAAK,CACjB,OAAe,EACf,GAAwB;QAExB,OAAO,KAAK,IAAmB,EAAE;YAC/B,MAAM,8BAA8B,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAGnC;;QACC,MAAM,SAAS,GAAW,CAAA,MAAA,IAAI,CAAC,SAAS,0CAAE,QAAQ,GAAG,IAAI,EAAE,KAAI,EAAE,CAAC;QAElE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,IAAI,MAAuB,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC;gBACrC,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,WAAW,EAAE,EAAE;gBACjD,SAAS,EAAE,8BAA8B,CAAC,iBAAiB;gBAC3D,KAAK,EAAE,8BAA8B,CAAC,gCAAgC;gBACtE,WAAW,EAAE,8BAA8B,CAAC,gBAAgB;gBAC5D,oBAAoB,EAAE,CAAC;gBACvB,cAAc,EAAE,IAAI;gBACpB,aAAa,EAAE,EAAE;gBACjB,UAAU,EAAE,CAAC,GAAU,EAAQ,EAAE;oBAC/B,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,OAAO,8BAA8B,SAAS,mBAAmB,GAAG,CAAC,OAAO,EAAE,CACvF,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,MAAM,CAAC,KAAK,CACV,GAAG,IAAI,CAAC,OAAO,aAAa,SAAS,gBAAgB,8BAA8B,CAAC,gCAAgC,wDAAwD,CAC7K,CAAC;gBACF,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,OAAO,uCAAuC,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAC9I,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO;YACL,OAAO,EAAE,KAAK,IAAmB,EAAE;gBACjC,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,+CAA+C;oBAC/C,MAAM,CAAC,IAAI,CACT,GAAG,IAAI,CAAC,OAAO,2CAA2C,SAAS,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3H,CAAC;gBACJ,CAAC;YACH,CAAC;SACF,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,cAAc,CAChC,OAAe,EACf,GAAwB;QAExB,IAAI,MAAM,GAA2B,IAAI,CAAC;QAE1C,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC;gBACrC,GAAG,EAAE,OAAO;gBACZ,SAAS,EAAE,8BAA8B,CAAC,SAAS;gBACnD,KAAK,EAAE,8BAA8B,CAAC,2BAA2B;gBACjE,WAAW,EAAE,8BAA8B,CAAC,gBAAgB;gBAC5D,gEAAgE;gBAChE,oBAAoB,EAAE,CAAC;gBACvB,cAAc,EAAE,IAAI;gBACpB,aAAa,EAAE,EAAE;gBACjB,UAAU,EAAE,CAAC,GAAU,EAAQ,EAAE;oBAC/B;;;;uBAIG;oBACH,MAAM,CAAC,IAAI,CACT,GAAG,OAAO,wCAAwC,GAAG,CAAC,OAAO,EAAE,CAChE,CAAC;gBACJ,CAAC;aACF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,yBAAyB,EAAE,CAAC;gBAC7C,MAAM,CAAC,KAAK,CACV,GAAG,OAAO,KAAK,8BAA8B,CAAC,2BAA2B,uFAAuF,CACjK,CAAC;gBACF,OAAO;YACT,CAAC;YAED,MAAM,CAAC,IAAI,CACT,GAAG,OAAO,kCAAkC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CACtH,CAAC;YACF,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,GAAG,EAAE,CAAC;QACd,CAAC;gBAAS,CAAC;YACT,IAAI,MAAM,EAAE,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,SAAS,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;gBACxC,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,+CAA+C;oBAC/C,MAAM,CAAC,IAAI,CACT,GAAG,OAAO,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACpG,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;;AAnKsB,0DAA2B,GAChD,uBAAuB,CACrB,qDAAqD,EACrD,CAAC,CACF,CAAC;AAEJ;;;GAGG;AACoB,+DAAgC,GAAW,IAAI,CAAC,GAAG,CACxE,CAAC,EACD,IAAI,CAAC,GAAG,CACN,uBAAuB,CACrB,0DAA0D,EAC1D,CAAC,CACF,EACD,8BAA8B,CAAC,2BAA2B,GAAG,CAAC,CAC/D,CACF,CAAC;AAEF,8EAA8E;AACvD,gDAAiB,GACtC,iCAAiC,CAAC;AAEb,+CAAgB,GACrC,aAAa,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC;AAEhD,2DAA2D;AACpC,wCAAS,GAAW,6BAA6B,CAAC;eA9BtD,8BAA8B"}

package/build/dist/Server/Utils/StatusPage/SubscriberNotificationTiming.js

@@ -0,0 +1,103 @@
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
+import OneUptimeDate from "../../../Types/Date";
+/*
+ * How long the incident and episode subscriber jobs may spend sending, and
+ * how long a notification may sit In progress before it is taken to have been
+ * interrupted.
+ *
+ * A job sends each notification - an incident created, a state change, a
+ * public note, a postmortem, or an episode's - by awaiting every message at a
+ * bounded concurrency, so a send takes as long as its slowest subscribers
+ * rather than returning the moment the messages are queued. These numbers
+ * keep that bounded, and tie the job's timeout, a notification's send window
+ * and the sweeper's threshold together so they cannot drift apart:
+ *
+ * - SEND_CONCURRENCY messages are in flight at once, per notification.
+ * - SUBSCRIBERS_PER_READ subscribers are read from a status page at a time:
+ *   LIMIT_MAX, the cap one read used to stop at silently. A page with more is
+ *   read in batches (SubscriberNotificationFanOut).
+ * - A message still unanswered after SEND_TIMEOUT_IN_MS is counted failed and
+ *   its slot freed. That is longer than any sender's own retries can take -
+ *   the Notification service tries SMTP three times with a 60 second connect
+ *   timeout each (about 3 minutes 5 seconds), and the Slack and webhook
+ *   senders retry three times with 2, 4 and 8 second backoffs - so it only
+ *   cuts off a request that hangs. The request itself is not cancelled.
+ * - A notification starts no new message once SEND_WINDOW_IN_MS has passed
+ *   since it was claimed. What it has not reached is recorded as not sent,
+ *   and the notification settles as Failed.
+ *
+ *   The math, for one full read of a status page: 10,000 subscribers at 20 in
+ *   flight is 500 rounds, and 20 minutes over 500 rounds allows 2.4 seconds a
+ *   message on average. An email, SMS or webhook through the Notification
+ *   service normally answers in well under a second, so a 10,000-subscriber
+ *   page fits with room to spare, and at half a second a message one
+ *   notification reaches about 48,000 subscribers in its window.
+ *
+ * - One notification can therefore take at most NOTIFICATION_MAX_IN_MS: its
+ *   send window, plus the timeout of the messages still in flight when the
+ *   window closes, plus a minute for the feed item and the status write.
+ * - JOB_TIMEOUT_IN_MS is each job's RunCron timeoutInMS. A run claims a new
+ *   notification only while that notification could still finish inside the
+ *   job's timeout (LATEST_CLAIM_IN_MS into the run), so a run never outlives
+ *   its timeout: a timed-out queue job is only stopped being waited for,
+ *   never cancelled, and would otherwise carry on sending untracked. The
+ *   notifications it leaves Pending are claimed by the runs that follow, one
+ *   a minute, which can run alongside it: a claim is atomic
+ *   (SubscriberNotificationClaim), so each notification is sent once. How
+ *   many runs of a job may be sending at once, across every worker, is
+ *   bounded too (SubscriberNotificationRunLimit), so slow sends cannot fill
+ *   the Worker queue every other cron shares.
+ * - STUCK_AFTER_IN_MS is when the sweeper
+ *   (StatusPageSubscriber:TimeoutStuckNotifications) takes a notification
+ *   still In progress to have been interrupted - its worker crashed, was
+ *   redeployed or lost its database connection - and marks it Failed. A
+ *   running send is never In progress that long, so the margin over the job
+ *   timeout only has to cover clock skew between the worker and the database.
+ */
+class SubscriberNotificationTiming {
+    // The clock of one job run, started when the run starts.
+    static startRun(now) {
+        return new SubscriberNotificationRunClock(now !== null && now !== void 0 ? now : Date.now());
+    }
+    // The send window of one notification, started when it is claimed.
+    static startSendWindow(now) {
+        return new SubscriberNotificationSendWindow((now !== null && now !== void 0 ? now : Date.now()) + SubscriberNotificationTiming.SEND_WINDOW_IN_MS);
+    }
+}
+SubscriberNotificationTiming.SEND_CONCURRENCY = 20;
+SubscriberNotificationTiming.SUBSCRIBERS_PER_READ = LIMIT_MAX;
+SubscriberNotificationTiming.SEND_TIMEOUT_IN_MS = OneUptimeDate.convertMinutesToMilliseconds(4);
+SubscriberNotificationTiming.SEND_WINDOW_IN_MS = OneUptimeDate.convertMinutesToMilliseconds(20);
+SubscriberNotificationTiming.SETTLE_ALLOWANCE_IN_MS = OneUptimeDate.convertMinutesToMilliseconds(1);
+SubscriberNotificationTiming.NOTIFICATION_MAX_IN_MS = SubscriberNotificationTiming.SEND_WINDOW_IN_MS +
+    SubscriberNotificationTiming.SEND_TIMEOUT_IN_MS +
+    SubscriberNotificationTiming.SETTLE_ALLOWANCE_IN_MS;
+SubscriberNotificationTiming.JOB_TIMEOUT_IN_MS = OneUptimeDate.convertMinutesToMilliseconds(30);
+SubscriberNotificationTiming.LATEST_CLAIM_IN_MS = SubscriberNotificationTiming.JOB_TIMEOUT_IN_MS -
+    SubscriberNotificationTiming.NOTIFICATION_MAX_IN_MS;
+SubscriberNotificationTiming.STUCK_AFTER_IN_MS = SubscriberNotificationTiming.JOB_TIMEOUT_IN_MS +
+    OneUptimeDate.convertMinutesToMilliseconds(10);
+export default SubscriberNotificationTiming;
+export class SubscriberNotificationRunClock {
+    constructor(startedAt) {
+        this.startedAt = startedAt;
+    }
+    /*
+     * Whether this run may still claim a notification: one claimed now could
+     * finish before the run's timeout.
+     */
+    canClaimAnotherNotification(now) {
+        return ((now !== null && now !== void 0 ? now : Date.now()) - this.startedAt <=
+            SubscriberNotificationTiming.LATEST_CLAIM_IN_MS);
+    }
+}
+export class SubscriberNotificationSendWindow {
+    constructor(closesAt) {
+        this.closesAt = closesAt;
+    }
+    // Whether a new message may still be started.
+    isOpen(now) {
+        return (now !== null && now !== void 0 ? now : Date.now()) < this.closesAt;
+    }
+}
+//# sourceMappingURL=SubscriberNotificationTiming.js.map

package/build/dist/Server/Utils/StatusPage/SubscriberNotificationTiming.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriberNotificationTiming.js","sourceRoot":"","sources":["../../../../../Server/Utils/StatusPage/SubscriberNotificationTiming.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,kCAAkC,CAAC;AACzD,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAEhD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqDG;AACH,MAAqB,4BAA4B;IA8B/C,yDAAyD;IAClD,MAAM,CAAC,QAAQ,CAAC,GAAY;QACjC,OAAO,IAAI,8BAA8B,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,mEAAmE;IAC5D,MAAM,CAAC,eAAe,CAC3B,GAAY;QAEZ,OAAO,IAAI,gCAAgC,CACzC,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,4BAA4B,CAAC,iBAAiB,CACrE,CAAC;IACJ,CAAC;;AAzCsB,6CAAgB,GAAW,EAAE,CAAC;AAE9B,iDAAoB,GAAW,SAAS,CAAC;AAEzC,+CAAkB,GACvC,aAAa,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC;AAEzB,8CAAiB,GACtC,aAAa,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;AAE1B,mDAAsB,GAC3C,aAAa,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC;AAEzB,mDAAsB,GAC3C,4BAA4B,CAAC,iBAAiB;IAC9C,4BAA4B,CAAC,kBAAkB;IAC/C,4BAA4B,CAAC,sBAAsB,CAAC;AAE/B,8CAAiB,GACtC,aAAa,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;AAE1B,+CAAkB,GACvC,4BAA4B,CAAC,iBAAiB;IAC9C,4BAA4B,CAAC,sBAAsB,CAAC;AAE/B,8CAAiB,GACtC,4BAA4B,CAAC,iBAAiB;IAC9C,aAAa,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;eA5B9B,4BAA4B;AA6CjD,MAAM,OAAO,8BAA8B;IAGzC,YAAmB,SAAiB;QAClC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACI,2BAA2B,CAAC,GAAY;QAC7C,OAAO,CACL,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS;YACpC,4BAA4B,CAAC,kBAAkB,CAChD,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,gCAAgC;IAG3C,YAAmB,QAAgB;QACjC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED,8CAA8C;IACvC,MAAM,CAAC,GAAY;QACxB,OAAO,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC7C,CAAC;CACF"}

package/build/dist/Server/Utils/StatusPage/SubscriberTemplateIncidentRecordAccess.js

@@ -0,0 +1,114 @@
+import Incident from "../../../Models/DatabaseModels/Incident";
+import IncidentCustomField from "../../../Models/DatabaseModels/IncidentCustomField";
+import DatabaseCommonInteractionPropsUtil, { PermissionType, } from "../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import { CUSTOM_FIELD_TEMPLATE_VARIABLE_PREFIX } from "../../../Types/CustomField/CustomFieldVariableKey";
+import PermissionScope from "../../../Types/Database/AccessControl/PermissionScope";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import Permission, { PermissionHelper, } from "../../../Types/Permission";
+export default class SubscriberTemplateIncidentRecordAccess {
+    /**
+     * Refuses a write that places these placeholders (from
+     * getIncidentRecordPlaceholders) unless the caller may read what they
+     * read, for every incident of the project. Does nothing when there are
+     * none, or for root and master admin.
+     */
+    static assertCanPlace(data) {
+        if (data.placeholders.length === 0 ||
+            data.props.isRoot ||
+            data.props.isMasterAdmin) {
+            return;
+        }
+        const unrestricted = SubscriberTemplateIncidentRecordAccess.getUnrestrictedPermissions(data.props);
+        const blocked = DatabaseCommonInteractionPropsUtil.getUserPermissions(data.props, PermissionType.Block).map((row) => {
+            return row.permission;
+        });
+        for (const requirement of SubscriberTemplateIncidentRecordAccess.getRequirements(data.placeholders)) {
+            const isGranted = PermissionHelper.doesPermissionsIntersect(unrestricted, requirement.permissions);
+            const isBlocked = PermissionHelper.doesPermissionsIntersect(blocked, requirement.permissions);
+            if (isGranted && !isBlocked) {
+                continue;
+            }
+            const placeholders = data.placeholders
+                .map((name) => {
+                return `{{${name}}}`;
+            })
+                .join(", ");
+            throw new NotAuthorizedException(`Placing ${placeholders} in a subscriber notification template needs permission to ${requirement.description} for every incident in the project: these values come from your team's incident records, which the status page does not show. You need one of these permissions, not limited to some labels or to incidents you own: ${PermissionHelper.getPermissionTitles(requirement.permissions).join(", ")}.`);
+        }
+    }
+    /*
+     * What these placeholders need: reading incidents, and the column each
+     * one reads - Incident.labels for {{incidentLabels}}; Incident.customFields
+     * and the field definitions for {{customFields.<key>}}.
+     */
+    static getRequirements(placeholders) {
+        const requirements = [
+            {
+                description: "read incidents",
+                permissions: this.getTableReadPermissions(Incident),
+            },
+        ];
+        if (placeholders.some((name) => {
+            return name.startsWith(CUSTOM_FIELD_TEMPLATE_VARIABLE_PREFIX);
+        })) {
+            requirements.push({
+                description: "read incident custom field values",
+                permissions: this.getColumnReadPermissions(Incident, "customFields"),
+            }, {
+                description: "read incident custom fields",
+                permissions: this.getTableReadPermissions(IncidentCustomField),
+            });
+        }
+        if (placeholders.some((name) => {
+            return !name.startsWith(CUSTOM_FIELD_TEMPLATE_VARIABLE_PREFIX);
+        })) {
+            requirements.push({
+                description: "read incident labels",
+                permissions: this.getColumnReadPermissions(Incident, "labels"),
+            });
+        }
+        return requirements;
+    }
+    /*
+     * The caller's granted permissions that reach every record, read as the
+     * read checks read them (PermissionHelper.getNonAccessControlPermissions,
+     * OwnedScopePermission): a row scoped to All, or a Labels (or legacy
+     * unscoped) row with no labels. A row limited to labels does not, nor one
+     * limited to owned records - except for a project-wide role that cannot
+     * be scoped (Project Owner, Project Admin), whose stray Owned scope the
+     * read checks ignore too.
+     */
+    static getUnrestrictedPermissions(props) {
+        return DatabaseCommonInteractionPropsUtil.getUserPermissions(props, PermissionType.Allow)
+            .filter((row) => {
+            if (row.scope === PermissionScope.All) {
+                return true;
+            }
+            if (row.scope === PermissionScope.Owned) {
+                return !PermissionHelper.isScopeApplicable(row.permission);
+            }
+            return !row.labelIds || row.labelIds.length === 0;
+        })
+            .map((row) => {
+            return row.permission;
+        });
+    }
+    // As the table check reads them, the operational resource wildcard included.
+    static getTableReadPermissions(modelType) {
+        const model = new modelType();
+        const permissions = [...model.readRecordPermissions];
+        if (model.isOperationalResource &&
+            !permissions.includes(Permission.ReadAllOperationalResources)) {
+            permissions.push(Permission.ReadAllOperationalResources);
+        }
+        return permissions;
+    }
+    // As the select check reads them: no wildcard reaches a column.
+    static getColumnReadPermissions(modelType, columnName) {
+        var _a;
+        return [
+            ...(((_a = new modelType().getColumnAccessControlFor(columnName)) === null || _a === void 0 ? void 0 : _a.read) || []),
+        ];
+    }
+}
+//# sourceMappingURL=SubscriberTemplateIncidentRecordAccess.js.map