@oneuptime/common 14.0.7 → 14.0.9

package/build/dist/Server/Services/StatusPageSubscriberNotificationTemplateService.js

@@ -1,27 +1,208 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/StatusPageSubscriberNotificationTemplate";
+import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import QueryHelper from "../Types/Database/QueryHelper";
+import SubscriberTemplateIncidentRecordAccess from "../Utils/StatusPage/SubscriberTemplateIncidentRecordAccess";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import StatusPageSubscriberNotificationTemplateStatusPageService from "./StatusPageSubscriberNotificationTemplateStatusPageService";
 import SubscriberNotificationTemplateVariables from "../../Types/StatusPage/SubscriberNotificationTemplateVariables";
+import SubscriberNotificationTemplateCompiler from "../../Types/StatusPage/SubscriberNotificationTemplateCompiler";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /*
+     * A template's body and subject may place values from the team's incident
+     * records - {{incidentLabels}} and {{customFields.<key>}} - only when
+     * whoever writes them may read those records: the status page roles that
+     * may write templates may not (SubscriberTemplateIncidentRecordAccess).
+     */
+    async onBeforeCreate(createBy) {
+        SubscriberTemplateIncidentRecordAccess.assertCanPlace({
+            placeholders: SubscriberNotificationTemplateVariables.getIncidentRecordPlaceholders([
+                createBy.data.templateBody,
+                createBy.data.emailSubject,
+            ]),
+            props: createBy.props,
+        });
+        return { createBy, carryForward: null };
+    }
+    /*
+     * On an update, only what the write adds is checked: a placeholder the
+     * template already holds was allowed when it was written, so someone
+     * without incident access can still fix a typo, rename the template or
+     * move a placeholder from the subject to the body - but not add one.
+     *
+     * Pointing a template somewhere else counts as placing everything it
+     * holds: changing its channel or event type makes an admin's template
+     * send its incident records to wherever the new channel goes, and a
+     * status page role can add a Slack, Teams or webhook subscriber of its
+     * own. (Linking it to another status page is checked by
+     * StatusPageSubscriberNotificationTemplateStatusPageService.)
+     */
+    async onBeforeUpdate(updateBy) {
+        SubscriberTemplateIncidentRecordAccess.assertCanPlace({
+            placeholders: await this.getIncidentRecordPlaceholdersToCheck(updateBy),
+            props: updateBy.props,
+        });
+        return { updateBy, carryForward: null };
+    }
+    /*
+     * The incident record placeholders this update must be allowed to place,
+     * across every template it would change: those it writes into a body or
+     * subject that the template did not hold before, and, when it changes
+     * where the template is sent (its channel or event type), every one the
+     * template will hold once written. The templates are read as root and
+     * limited to the caller's project, like other update hooks: the update's
+     * own permission check has not run yet, and only narrows the rows further.
+     */
+    async getIncidentRecordPlaceholdersToCheck(updateBy) {
+        if (updateBy.props.isRoot || updateBy.props.isMasterAdmin) {
+            return [];
+        }
+        const data = updateBy.data;
+        const writesBody = data.templateBody !== undefined;
+        const writesSubject = data.emailSubject !== undefined;
+        const writesTarget = data.eventType !== undefined || data.notificationMethod !== undefined;
+        if (!writesBody && !writesSubject && !writesTarget) {
+            return [];
+        }
+        // Anything but text places nothing: the column check refuses it anyway.
+        const writtenBody = writesBody && typeof data.templateBody === "string"
+            ? data.templateBody
+            : null;
+        const writtenSubject = writesSubject && typeof data.emailSubject === "string"
+            ? data.emailSubject
+            : null;
+        const written = SubscriberNotificationTemplateVariables.getIncidentRecordPlaceholders([
+            writtenBody,
+            writtenSubject,
+        ]);
+        if (written.length === 0 && !writesTarget) {
+            return [];
+        }
+        const query = updateBy.props.tenantId
+            ? Object.assign(Object.assign({}, updateBy.query), { projectId: updateBy.props.tenantId }) : updateBy.query;
+        const templates = await this.findBy({
+            query: query,
+            select: {
+                templateBody: true,
+                emailSubject: true,
+                eventType: true,
+                notificationMethod: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const added = new Set();
+        for (const template of templates) {
+            const held = SubscriberNotificationTemplateVariables.getIncidentRecordPlaceholders([
+                template.templateBody,
+                template.emailSubject,
+            ]);
+            /*
+             * Only a real change: the edit form sends the channel and event type
+             * back as they were, and a typo fix must still go through.
+             */
+            const changesTarget = writesTarget &&
+                ((data.eventType !== undefined &&
+                    data.eventType !== template.eventType) ||
+                    (data.notificationMethod !== undefined &&
+                        data.notificationMethod !== template.notificationMethod));
+            if (changesTarget) {
+                // Everything the template will hold goes to the new target.
+                for (const name of SubscriberNotificationTemplateVariables.getIncidentRecordPlaceholders([
+                    writesBody ? writtenBody : template.templateBody,
+                    writesSubject ? writtenSubject : template.emailSubject,
+                ])) {
+                    added.add(name);
+                }
+                continue;
+            }
+            for (const name of written) {
+                if (!held.includes(name)) {
+                    added.add(name);
+                }
+            }
+        }
+        return Array.from(added).sort();
+    }
+    /*
+     * The incident record placeholders the given templates hold, in the
+     * caller's project: what linking them to a status page places there
+     * (StatusPageSubscriberNotificationTemplateStatusPageService). Read as
+     * root, like the update hook above.
+     */
+    async getIncidentRecordPlaceholdersHeld(data) {
+        if (data.templateIds.length === 0) {
+            return [];
+        }
+        const templates = await this.findBy({
+            query: Object.assign({ _id: QueryHelper.any(data.templateIds) }, (data.projectId ? { projectId: data.projectId } : {})),
+            select: {
+                templateBody: true,
+                emailSubject: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const held = new Set();
+        for (const template of templates) {
+            for (const name of SubscriberNotificationTemplateVariables.getIncidentRecordPlaceholders([template.templateBody, template.emailSubject])) {
+                held.add(name);
+            }
+        }
+        return Array.from(held).sort();
+    }
     /**
      * Get template for a specific status page, event type, and notification method.
      * Returns null if no custom template is found (caller should use default template).
+     *
+     * Workers call this as root, so nothing but the query below keeps one
+     * project's page from reading another project's templates. The template
+     * query is therefore narrowed to the ids this page links to AND to the
+     * page's own project. It used to ask for every template of this event type
+     * and channel across all projects, 100 at a time, and look for the linked
+     * id in memory: once more than 100 such templates existed on a shared
+     * server, the linked one could fall outside those 100 and the page's
+     * subscribers silently got the default template instead of the branded one.
      */
     async getTemplateForStatusPage(data) {
+        var _a, _b;
         const { statusPageId, eventType, notificationMethod } = data;
-        // First find the template link for this status page
+        /*
+         * First find the template links for this status page. There is one per
+         * linked template, so a page has only a handful, but nothing enforces a
+         * cap - so read them all rather than risk the same truncation as above.
+         */
         const templateLinks = await StatusPageSubscriberNotificationTemplateStatusPageService.findBy({
             query: {
                 statusPageId: statusPageId,
             },
             select: {
                 statusPageSubscriberNotificationTemplateId: true,
+                projectId: true,
+                statusPage: {
+                    projectId: true,
+                },
             },
             skip: 0,
-            limit: 100,
+            limit: LIMIT_PER_PROJECT,
             props: {
                 isRoot: true,
             },
@@ -29,25 +210,47 @@ export class Service extends DatabaseService {
         if (templateLinks.length === 0) {
             return null;
         }
-        // Get the template IDs
+        const statusPageProjectId = ((_b = (_a = templateLinks.find((link) => {
+            var _a;
+            return Boolean((_a = link.statusPage) === null || _a === void 0 ? void 0 : _a.projectId);
+        })) === null || _a === void 0 ? void 0 : _a.statusPage) === null || _b === void 0 ? void 0 : _b.projectId) || undefined;
+        if (!statusPageProjectId) {
+            return null;
+        }
+        /*
+         * Only links the page's own project made count: a link row stamped with
+         * another project cannot pull that project's template onto this page.
+         */
         const templateIds = templateLinks
+            .filter((link) => {
+            var _a;
+            return ((_a = link.projectId) === null || _a === void 0 ? void 0 : _a.toString()) === statusPageProjectId.toString();
+        })
             .map((link) => {
             return link.statusPageSubscriberNotificationTemplateId;
         })
             .filter((id) => {
-            return id !== undefined;
+            return id !== undefined && id !== null;
         });
         if (templateIds.length === 0) {
             return null;
         }
-        // Find the specific template matching the event type and notification method
+        /*
+         * Find the linked template for this event type and notification method.
+         * Several linked templates can match (nothing stops a page linking two
+         * for the same event and channel); the default sort returns the newest
+         * first, which is the one this method has always picked.
+         */
         const templates = await this.findBy({
             query: {
+                _id: QueryHelper.any(templateIds),
+                projectId: statusPageProjectId,
                 eventType: eventType,
                 notificationMethod: notificationMethod,
             },
             select: {
                 _id: true,
+                projectId: true,
                 templateName: true,
                 templateBody: true,
                 emailSubject: true,
@@ -55,21 +258,12 @@ export class Service extends DatabaseService {
                 notificationMethod: true,
             },
             skip: 0,
-            limit: 100,
+            limit: 1,
             props: {
                 isRoot: true,
             },
         });
-        // Find a template that matches one of the linked template IDs
-        for (const template of templates) {
-            if (templateIds.some((id) => {
-                var _a;
-                return id.toString() === ((_a = template._id) === null || _a === void 0 ? void 0 : _a.toString());
-            })) {
-                return template;
-            }
-        }
-        return null;
+        return templates[0] || null;
     }
     /**
      * Get available variables for a specific event type.
@@ -81,26 +275,37 @@ export class Service extends DatabaseService {
         return SubscriberNotificationTemplateVariables.getAvailableVariablesForEventType(eventType);
     }
     /**
-     * Compile a template with the given variables.
-     * Replaces {{variableName}} with the actual values.
+     * Compile a template for a channel that does not render HTML - an email
+     * subject, SMS, Slack or Microsoft Teams - replacing {{variableName}} with
+     * each value exactly as written.
      *
-     * One pass over the template, with a replacer function:
-     * - A replacement string would give "$&", "$$", "$`" and "$'" special
-     *   meaning, so a note mentioning "$$5" or a resource named "Store $&" was
-     *   rewritten on its way to subscribers.
-     * - Replacing one variable at a time also expanded placeholders that
-     *   appeared inside an earlier value, so a note containing
-     *   "{{unsubscribeUrl}}" came out as a link.
-     * A placeholder with no variable is left as written.
+     * Never use it for the body of an email template, which is HTML: use
+     * compileEmailBodyTemplate. See SubscriberNotificationTemplateCompiler.
      */
     static compileTemplate(template, variables) {
-        return template.replace(/{{\s*([\w.]+)\s*}}/g, (placeholder, name) => {
-            if (!Object.prototype.hasOwnProperty.call(variables, name)) {
-                return placeholder;
-            }
-            return variables[name] || "";
-        });
+        return SubscriberNotificationTemplateCompiler.compileTemplate(template, variables);
+    }
+    /**
+     * Compile the body of an EMAIL template, which is sent as HTML. Plain
+     * values are HTML-escaped; only a SafeHtml value (rendered Markdown, the
+     * date helper's HTML, the escaped resource list) is inserted as it is. See
+     * SubscriberNotificationTemplateCompiler.
+     */
+    static compileEmailBodyTemplate(template, variables) {
+        return SubscriberNotificationTemplateCompiler.compileEmailBodyTemplate(template, variables);
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
 export default new Service();
 //# sourceMappingURL=StatusPageSubscriberNotificationTemplateService.js.map

package/build/dist/Server/Services/StatusPageSubscriberNotificationTemplateService.js.map

@@ -1 +1 @@
-{"version":3,"file":"StatusPageSubscriberNotificationTemplateService.js","sourceRoot":"","sources":["../../../../Server/Services/StatusPageSubscriberNotificationTemplateService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,sEAAsE,CAAC;AAKzF,OAAO,yDAAyD,MAAM,6DAA6D,CAAC;AACpI,OAAO,uCAEN,MAAM,gEAAgE,CAAC;AAExE,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,wBAAwB,CAAC,IAIrC;QACC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAE7D,oDAAoD;QACpD,MAAM,aAAa,GACjB,MAAM,yDAAyD,CAAC,MAAM,CAAC;YACrE,KAAK,EAAE;gBACL,YAAY,EAAE,YAAY;aAC3B;YACD,MAAM,EAAE;gBACN,0CAA0C,EAAE,IAAI;aACjD;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,GAAG;YACV,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,uBAAuB;QACvB,MAAM,WAAW,GAAoB,aAAa;aAC/C,GAAG,CAAC,CAAC,IAAwD,EAAE,EAAE;YAChE,OAAO,IAAI,CAAC,0CAA0C,CAAC;QACzD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,EAAwB,EAAkB,EAAE;YACnD,OAAO,EAAE,KAAK,SAAS,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEL,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,6EAA6E;QAC7E,MAAM,SAAS,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAChD,KAAK,EAAE;gBACL,SAAS,EAAE,SAAS;gBACpB,kBAAkB,EAAE,kBAAkB;aACvC;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,kBAAkB,EAAE,IAAI;aACzB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,GAAG;YACV,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,8DAA8D;QAC9D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IACE,WAAW,CAAC,IAAI,CAAC,CAAC,EAAY,EAAE,EAAE;;gBAChC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAK,MAAA,QAAQ,CAAC,GAAG,0CAAE,QAAQ,EAAE,CAAA,CAAC;YACpD,CAAC,CAAC,EACF,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,iCAAiC,CAC7C,SAAoD;QAEpD,OAAO,uCAAuC,CAAC,iCAAiC,CAC9E,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,MAAM,CAAC,eAAe,CAC3B,QAAgB,EAChB,SAAiC;QAEjC,OAAO,QAAQ,CAAC,OAAO,CACrB,qBAAqB,EACrB,CAAC,WAAmB,EAAE,IAAY,EAAU,EAAE;YAC5C,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;gBAC3D,OAAO,WAAW,CAAC;YACrB,CAAC;YAED,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,CAAC,CACF,CAAC;IACJ,CAAC;CACF;AAED,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"StatusPageSubscriberNotificationTemplateService.js","sourceRoot":"","sources":["../../../../Server/Services/StatusPageSubscriberNotificationTemplateService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,sEAAsE,CAAC;AAGzF,OAAO,SAAS,EAAE,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAI7E,OAAO,WAAW,MAAM,+BAA+B,CAAC;AAExD,OAAO,sCAAsC,MAAM,4DAA4D,CAAC;AAChH,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAGzD,OAAO,yDAAyD,MAAM,6DAA6D,CAAC;AACpI,OAAO,uCAEN,MAAM,gEAAgE,CAAC;AACxE,OAAO,sCAGN,MAAM,+DAA+D,CAAC;AAOvE,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;OAKG;IAEsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,sCAAsC,CAAC,cAAc,CAAC;YACpD,YAAY,EACV,uCAAuC,CAAC,6BAA6B,CAAC;gBACpE,QAAQ,CAAC,IAAI,CAAC,YAAY;gBAC1B,QAAQ,CAAC,IAAI,CAAC,YAAY;aAC3B,CAAC;YACJ,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;;;;;;;;;OAYG;IAEsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,sCAAsC,CAAC,cAAc,CAAC;YACpD,YAAY,EAAE,MAAM,IAAI,CAAC,oCAAoC,CAAC,QAAQ,CAAC;YACvE,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,oCAAoC,CAChD,QAAyB;QAEzB,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1D,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GAKN,QAAQ,CAAC,IAKZ,CAAC;QACF,MAAM,UAAU,GAAY,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;QAC5D,MAAM,aAAa,GAAY,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;QAC/D,MAAM,YAAY,GAChB,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS,CAAC;QAExE,IAAI,CAAC,UAAU,IAAI,CAAC,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,wEAAwE;QACxE,MAAM,WAAW,GACf,UAAU,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACjD,CAAC,CAAC,IAAI,CAAC,YAAY;YACnB,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,cAAc,GAClB,aAAa,IAAI,OAAO,IAAI,CAAC,YAAY,KAAK,QAAQ;YACpD,CAAC,CAAC,IAAI,CAAC,YAAY;YACnB,CAAC,CAAC,IAAI,CAAC;QAEX,MAAM,OAAO,GACX,uCAAuC,CAAC,6BAA6B,CAAC;YACpE,WAAW;YACX,cAAc;SACf,CAAC,CAAC;QAEL,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAC1C,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAiB,QAAQ,CAAC,KAAK,CAAC,QAAQ;YACjD,CAAC,iCAAM,QAAQ,CAAC,KAAK,KAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,IACzD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAEnB,MAAM,SAAS,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAChD,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE;gBACN,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,kBAAkB,EAAE,IAAI;aACzB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,KAAK,GAAgB,IAAI,GAAG,EAAU,CAAC;QAE7C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,GACR,uCAAuC,CAAC,6BAA6B,CAAC;gBACpE,QAAQ,CAAC,YAAY;gBACrB,QAAQ,CAAC,YAAY;aACtB,CAAC,CAAC;YAEL;;;eAGG;YACH,MAAM,aAAa,GACjB,YAAY;gBACZ,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS;oBAC5B,IAAI,CAAC,SAAS,KAAK,QAAQ,CAAC,SAAS,CAAC;oBACtC,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;wBACpC,IAAI,CAAC,kBAAkB,KAAK,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;YAEhE,IAAI,aAAa,EAAE,CAAC;gBAClB,4DAA4D;gBAC5D,KAAK,MAAM,IAAI,IAAI,uCAAuC,CAAC,6BAA6B,CACtF;oBACE,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY;oBAChD,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY;iBACvD,CACF,EAAE,CAAC;oBACF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;gBAED,SAAS;YACX,CAAC;YAED,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;gBAC3B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACI,KAAK,CAAC,iCAAiC,CAAC,IAG9C;QACC,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,SAAS,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAChD,KAAK,kBACH,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,IACnC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACzD;YACD,MAAM,EAAE;gBACN,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,IAAI;aACnB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,IAAI,GAAgB,IAAI,GAAG,EAAU,CAAC;QAE5C,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,KAAK,MAAM,IAAI,IAAI,uCAAuC,CAAC,6BAA6B,CACtF,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,YAAY,CAAC,CAC/C,EAAE,CAAC;gBACF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;OAYG;IACI,KAAK,CAAC,wBAAwB,CAAC,IAIrC;;QACC,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;QAE7D;;;;WAIG;QACH,MAAM,aAAa,GACjB,MAAM,yDAAyD,CAAC,MAAM,CAAC;YACrE,KAAK,EAAE;gBACL,YAAY,EAAE,YAAY;aAC3B;YACD,MAAM,EAAE;gBACN,0CAA0C,EAAE,IAAI;gBAChD,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE;oBACV,SAAS,EAAE,IAAI;iBAChB;aACF;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,iBAAiB;YACxB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEL,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,mBAAmB,GACvB,CAAA,MAAA,MAAA,aAAa,CAAC,IAAI,CAChB,CAAC,IAAwD,EAAE,EAAE;;YAC3D,OAAO,OAAO,CAAC,MAAA,IAAI,CAAC,UAAU,0CAAE,SAAS,CAAC,CAAC;QAC7C,CAAC,CACF,0CAAE,UAAU,0CAAE,SAAS,KAAI,SAAS,CAAC;QAExC,IAAI,CAAC,mBAAmB,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;WAGG;QACH,MAAM,WAAW,GAAoB,aAAa;aAC/C,MAAM,CAAC,CAAC,IAAwD,EAAE,EAAE;;YACnE,OAAO,CAAA,MAAA,IAAI,CAAC,SAAS,0CAAE,QAAQ,EAAE,MAAK,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QACvE,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,IAAwD,EAAE,EAAE;YAChE,OAAO,IAAI,CAAC,0CAA0C,CAAC;QACzD,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,EAAwB,EAAkB,EAAE;YACnD,OAAO,EAAE,KAAK,SAAS,IAAI,EAAE,KAAK,IAAI,CAAC;QACzC,CAAC,CAAC,CAAC;QAEL,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;;WAKG;QACH,MAAM,SAAS,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAChD,KAAK,EAAE;gBACL,GAAG,EAAE,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;gBACjC,SAAS,EAAE,mBAAmB;gBAC9B,SAAS,EAAE,SAAS;gBACpB,kBAAkB,EAAE,kBAAkB;aACvC;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,SAAS,EAAE,IAAI;gBACf,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,IAAI;gBAClB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,IAAI;gBACf,kBAAkB,EAAE,IAAI;aACzB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,CAAC;YACR,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,iCAAiC,CAC7C,SAAoD;QAEpD,OAAO,uCAAuC,CAAC,iCAAiC,CAC9E,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,eAAe,CAC3B,QAAgB,EAChB,SAAsD;QAEtD,OAAO,sCAAsC,CAAC,eAAe,CAC3D,QAAQ,EACR,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,wBAAwB,CACpC,QAAgB,EAChB,SAA2D;QAE3D,OAAO,sCAAsC,CAAC,wBAAwB,CACpE,QAAQ,EACR,SAAS,CACV,CAAC;IACJ,CAAC;CACF;AAvW0B;IADxB,WAAW,EAAE;;;;6CAcb;AAgBwB;IADxB,WAAW,EAAE;;;;6CAUb;AAmUH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/StatusPageSubscriberNotificationTemplateStatusPageService.js

@@ -1,9 +1,118 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 import DatabaseService from "./DatabaseService";
+import StatusPageSubscriberNotificationTemplateService from "./StatusPageSubscriberNotificationTemplateService";
 import Model from "../../Models/DatabaseModels/StatusPageSubscriberNotificationTemplateStatusPage";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import ObjectID from "../../Types/ObjectID";
+import SubscriberTemplateIncidentRecordAccess from "../Utils/StatusPage/SubscriberTemplateIncidentRecordAccess";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+/*
+ * Linking a custom subscriber notification template to a status page sends
+ * that page's subscribers whatever the template places. A template may place
+ * values from the team's incident records ({{incidentLabels}},
+ * {{customFields.<key>}}), which only someone who may read them may put in a
+ * template (SubscriberTemplateIncidentRecordAccess) - and the status page
+ * roles that may link templates may also add a Slack, Teams or webhook
+ * subscriber of their own to a page. So linking such a template, or moving a
+ * link to another template or page, is checked as placing everything the
+ * template holds. Root and master admin writes are not checked.
+ */
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    async onBeforeCreate(createBy) {
+        var _a;
+        if (!createBy.props.isRoot && !createBy.props.isMasterAdmin) {
+            const templateId = createBy.data.statusPageSubscriberNotificationTemplateId ||
+                ((_a = createBy.data.statusPageSubscriberNotificationTemplate) === null || _a === void 0 ? void 0 : _a.id) ||
+                undefined;
+            await this.assertCanLink({
+                templateIds: templateId ? [templateId] : [],
+                createBy: createBy,
+            });
+        }
+        return { createBy, carryForward: null };
+    }
+    async onBeforeUpdate(updateBy) {
+        if (updateBy.props.isRoot || updateBy.props.isMasterAdmin) {
+            return { updateBy, carryForward: null };
+        }
+        const data = updateBy.data;
+        const writesTemplate = data.statusPageSubscriberNotificationTemplateId !== undefined &&
+            data.statusPageSubscriberNotificationTemplateId !== null;
+        const writesStatusPage = data.statusPageId !== undefined;
+        if (!writesTemplate && !writesStatusPage) {
+            return { updateBy, carryForward: null };
+        }
+        let templateIds = [];
+        if (writesTemplate) {
+            templateIds = [
+                new ObjectID(String(data.statusPageSubscriberNotificationTemplateId)),
+            ];
+        }
+        else {
+            // Moved to another page: the templates the links already point at.
+            const query = updateBy.props.tenantId
+                ? Object.assign(Object.assign({}, updateBy.query), { projectId: updateBy.props.tenantId }) : updateBy.query;
+            const links = await this.findBy({
+                query: query,
+                select: {
+                    statusPageSubscriberNotificationTemplateId: true,
+                },
+                limit: LIMIT_MAX,
+                skip: 0,
+                props: {
+                    isRoot: true,
+                },
+            });
+            templateIds = links
+                .map((link) => {
+                return link.statusPageSubscriberNotificationTemplateId;
+            })
+                .filter((id) => {
+                return Boolean(id);
+            });
+        }
+        SubscriberTemplateIncidentRecordAccess.assertCanPlace({
+            placeholders: await StatusPageSubscriberNotificationTemplateService.getIncidentRecordPlaceholdersHeld({
+                templateIds: templateIds,
+                projectId: updateBy.props.tenantId,
+            }),
+            props: updateBy.props,
+        });
+        return { updateBy, carryForward: null };
+    }
+    async assertCanLink(data) {
+        SubscriberTemplateIncidentRecordAccess.assertCanPlace({
+            placeholders: await StatusPageSubscriberNotificationTemplateService.getIncidentRecordPlaceholdersHeld({
+                templateIds: data.templateIds,
+                projectId: data.createBy.props.tenantId ||
+                    data.createBy.data.projectId,
+            }),
+            props: data.createBy.props,
+        });
+    }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
 export default new Service();
 //# sourceMappingURL=StatusPageSubscriberNotificationTemplateStatusPageService.js.map

package/build/dist/Server/Services/StatusPageSubscriberNotificationTemplateStatusPageService.js.map

@@ -1 +1 @@
-{"version":3,"file":"StatusPageSubscriberNotificationTemplateStatusPageService.js","sourceRoot":"","sources":["../../../../Server/Services/StatusPageSubscriberNotificationTemplateStatusPageService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,gFAAgF,CAAC;AAEnG,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;CACF;AAED,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"StatusPageSubscriberNotificationTemplateStatusPageService.js","sourceRoot":"","sources":["../../../../Server/Services/StatusPageSubscriberNotificationTemplateStatusPageService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,+CAA+C,MAAM,mDAAmD,CAAC;AAChH,OAAO,KAAK,MAAM,gFAAgF,CAAC;AACnG,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAK5C,OAAO,sCAAsC,MAAM,4DAA4D,CAAC;AAChH,OAAO,WAAW,MAAM,gCAAgC,CAAC;AAEzD;;;;;;;;;;GAUG;AACH,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;;QAEzB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC5D,MAAM,UAAU,GACd,QAAQ,CAAC,IAAI,CAAC,0CAA0C;iBACxD,MAAA,QAAQ,CAAC,IAAI,CAAC,wCAAwC,0CAAE,EAAE,CAAA;gBAC1D,SAAS,CAAC;YAEZ,MAAM,IAAI,CAAC,aAAa,CAAC;gBACvB,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC3C,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC1D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAGN,QAAQ,CAAC,IAGZ,CAAC;QAEF,MAAM,cAAc,GAClB,IAAI,CAAC,0CAA0C,KAAK,SAAS;YAC7D,IAAI,CAAC,0CAA0C,KAAK,IAAI,CAAC;QAC3D,MAAM,gBAAgB,GAAY,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;QAElE,IAAI,CAAC,cAAc,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACzC,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;QAED,IAAI,WAAW,GAAoB,EAAE,CAAC;QAEtC,IAAI,cAAc,EAAE,CAAC;YACnB,WAAW,GAAG;gBACZ,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;aACtE,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,mEAAmE;YACnE,MAAM,KAAK,GAAiB,QAAQ,CAAC,KAAK,CAAC,QAAQ;gBACjD,CAAC,iCAAM,QAAQ,CAAC,KAAK,KAAE,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,IACzD,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;YAEnB,MAAM,KAAK,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAC5C,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE;oBACN,0CAA0C,EAAE,IAAI;iBACjD;gBACD,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,WAAW,GAAG,KAAK;iBAChB,GAAG,CAAC,CAAC,IAAW,EAAwB,EAAE;gBACzC,OAAO,IAAI,CAAC,0CAA0C,CAAC;YACzD,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,EAAwB,EAAkB,EAAE;gBACnD,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACP,CAAC;QAED,sCAAsC,CAAC,cAAc,CAAC;YACpD,YAAY,EACV,MAAM,+CAA+C,CAAC,iCAAiC,CACrF;gBACE,WAAW,EAAE,WAAW;gBACxB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAgC;aAC3D,CACF;YACH,KAAK,EAAE,QAAQ,CAAC,KAAK;SACtB,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAG3B;QACC,sCAAsC,CAAC,cAAc,CAAC;YACpD,YAAY,EACV,MAAM,+CAA+C,CAAC,iCAAiC,CACrF;gBACE,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,SAAS,EACN,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAiC;oBACtD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,SAAS;aAC/B,CACF;YACH,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK;SAC3B,CAAC,CAAC;IACL,CAAC;CACF;AA3G0B;IADxB,WAAW,EAAE;;;;6CAiBb;AAGwB;IADxB,WAAW,EAAE;;;;6CAsEb;AAqBH,eAAe,IAAI,OAAO,EAAE,CAAC"}