@oneuptime/common 14.0.8 → 14.0.10

package/Server/Infrastructure/GlobalCache.ts

@@ -136,6 +136,38 @@ export default abstract class GlobalCache {
     return value;
   }
 
+  /*
+   * Several keys of one namespace in a single round-trip (MGET). The result
+   * is positional: one entry per requested key, null where the key is
+   * missing or empty.
+   */
+  @CaptureSpan()
+  public static async getStrings(
+    namespace: string,
+    keys: Array<string>,
+  ): Promise<Array<string | null>> {
+    if (keys.length === 0) {
+      return [];
+    }
+
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const values: Array<string | null> = await client.mget(
+      keys.map((key: string) => {
+        return `${namespace}-${key}`;
+      }),
+    );
+
+    return keys.map((_key: string, index: number) => {
+      const value: string | null | undefined = values[index];
+      return value ? value : null;
+    });
+  }
+
   @CaptureSpan()
   public static async setJSON(
     namespace: string,

package/Server/Infrastructure/Postgres/SchemaMigrations/1796000000000-AddTeamComplianceRuleScope.ts

@@ -0,0 +1,99 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Team compliance rules scoped by severity and channel.
+ *
+ * - "notificationChannel": the channel an on-call compliance rule insists on
+ *   (Call, Push, ...). Nullable with no default, so every existing rule reads
+ *   as "any channel" - exactly what it checked before.
+ * - "TeamComplianceSettingIncidentSeverity" / "...AlertSeverity": the
+ *   severities an on-call compliance rule is scoped to. Empty means every
+ *   severity, which is again what every existing rule already checked. Both
+ *   cascade from the rule and from the severity.
+ * - The unique ("teamId", "ruleType") index goes: "Call for Critical
+ *   incidents" and "Push for Critical incidents" are both
+ *   HasIncidentOnCallRules on one team. TeamComplianceSettingService rejects
+ *   exact duplicates instead. Existing data cannot violate the change - it only
+ *   relaxes a constraint.
+ */
+export class AddTeamComplianceRuleScope1796000000000
+  implements MigrationInterface
+{
+  public name: string = "AddTeamComplianceRuleScope1796000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ef7342919ff02501c2b0ddc029"`,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "TeamComplianceSettingIncidentSeverity" ("teamComplianceSettingId" uuid NOT NULL, "incidentSeverityId" uuid NOT NULL, CONSTRAINT "PK_0071a6d21730a2ed9e098873b2e" PRIMARY KEY ("teamComplianceSettingId", "incidentSeverityId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_013768788937d0e484fb3c1bcb" ON "TeamComplianceSettingIncidentSeverity" ("teamComplianceSettingId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6e477b60ddefe41bfdee3e6142" ON "TeamComplianceSettingIncidentSeverity" ("incidentSeverityId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "TeamComplianceSettingAlertSeverity" ("teamComplianceSettingId" uuid NOT NULL, "alertSeverityId" uuid NOT NULL, CONSTRAINT "PK_ba665b5e7d6413db2be11bf2f09" PRIMARY KEY ("teamComplianceSettingId", "alertSeverityId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_c01a8eeea98cb41a45806fe5c7" ON "TeamComplianceSettingAlertSeverity" ("teamComplianceSettingId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_573637e6a2df47b516b0f955d9" ON "TeamComplianceSettingAlertSeverity" ("alertSeverityId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSetting" ADD "notificationChannel" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingIncidentSeverity" ADD CONSTRAINT "FK_013768788937d0e484fb3c1bcb8" FOREIGN KEY ("teamComplianceSettingId") REFERENCES "TeamComplianceSetting"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingIncidentSeverity" ADD CONSTRAINT "FK_6e477b60ddefe41bfdee3e61424" FOREIGN KEY ("incidentSeverityId") REFERENCES "IncidentSeverity"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingAlertSeverity" ADD CONSTRAINT "FK_c01a8eeea98cb41a45806fe5c77" FOREIGN KEY ("teamComplianceSettingId") REFERENCES "TeamComplianceSetting"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingAlertSeverity" ADD CONSTRAINT "FK_573637e6a2df47b516b0f955d96" FOREIGN KEY ("alertSeverityId") REFERENCES "AlertSeverity"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingAlertSeverity" DROP CONSTRAINT "FK_573637e6a2df47b516b0f955d96"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingAlertSeverity" DROP CONSTRAINT "FK_c01a8eeea98cb41a45806fe5c77"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingIncidentSeverity" DROP CONSTRAINT "FK_6e477b60ddefe41bfdee3e61424"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingIncidentSeverity" DROP CONSTRAINT "FK_013768788937d0e484fb3c1bcb8"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSetting" DROP COLUMN "notificationChannel"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_573637e6a2df47b516b0f955d9"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_c01a8eeea98cb41a45806fe5c7"`,
+    );
+    await queryRunner.query(`DROP TABLE "TeamComplianceSettingAlertSeverity"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6e477b60ddefe41bfdee3e6142"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_013768788937d0e484fb3c1bcb"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE "TeamComplianceSettingIncidentSeverity"`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_ef7342919ff02501c2b0ddc029" ON "TeamComplianceSetting" ("teamId", "ruleType") `,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1796100000000-AddKubernetesAiAgentAndAiDefaults.ts

@@ -0,0 +1,137 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The Kubernetes AI agent, and AI on by default.
+ *
+ * Schema (generated):
+ *   - KubernetesAiAgent: one row per cluster for the slim in-cluster kubectl
+ *     executor the kubernetes-agent chart now installs (its own identity,
+ *     never a Runner). Unique per cluster; cascades with its project and
+ *     cluster.
+ *   - RunnerJob.targetKubernetesAiAgentId: the agent an AI kubectl job is
+ *     targeted at (SET NULL when the agent row goes).
+ *   - Project.enableAutomaticPostmortemDraft: drafting a postmortem on
+ *     resolve, split off enableAutomaticIncidentInvestigation.
+ *   - KubernetesCluster.isAiInvestigationEnabled now defaults to true.
+ *
+ * Data (hand-added after the DDL, in this order):
+ *   1. Postmortem drafts keep working exactly where they worked: the new
+ *      flag is copied from the investigation flag it used to ride on. The
+ *      column was just added as NOT NULL DEFAULT false, so setting it to true
+ *      where investigation is on is the whole copy, and it rewrites only
+ *      those rows.
+ *   2. Clusters nobody ever configured AI access for (aiAccessConfiguredAt
+ *      IS NULL) get investigation on, like a new cluster. A cluster an
+ *      operator configured keeps its switch, whatever it is.
+ *   3. Revocations carry over. Before the AI agent, unbinding or deleting a
+ *      cluster's Runner was the off switch: the cluster has no Runner now
+ *      but one was bound once, or AI already ran (or failed to run) kubectl
+ *      on it. The agent must not quietly switch AI back on there, so
+ *      investigation goes off and remediation goes to Disabled. Runs after
+ *      2, so a revocation always wins.
+ *   4. No unattended surprise. Cluster rounds through the in-cluster agent
+ *      no longer need the project's "Enable AI command execution" opt-in, so
+ *      a cluster left in Automatic or Bypass approval in a project that never
+ *      opted in would start changing the cluster without a human on upgrade.
+ *      Those clusters drop to RequireApproval: fixes are proposed, a human
+ *      approves each.
+ *
+ * down() reverts the defaults and the schema only. The data updates are not
+ * reverted: afterwards those rows are indistinguishable from choices an
+ * operator made, and flipping them back could switch AI on or off for
+ * somebody who chose it.
+ */
+export class AddKubernetesAiAgentAndAiDefaults1796100000000
+  implements MigrationInterface
+{
+  public name: string = "AddKubernetesAiAgentAndAiDefaults1796100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "KubernetesAiAgent" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "kubernetesClusterId" uuid NOT NULL, "keyHash" character varying(100), "agentVersion" character varying(100), "posture" jsonb, "lastAliveAt" TIMESTAMP WITH TIME ZONE, "connectionStatus" character varying(100) NOT NULL DEFAULT 'disconnected', "lastRegisteredAt" TIMESTAMP WITH TIME ZONE, "registeredWithIngestionKeyId" uuid, "lastRefusedRegistrationAt" TIMESTAMP WITH TIME ZONE, "lastRefusedRegistrationReason" character varying(100), CONSTRAINT "PK_7d9287fc069699b2f22ad4f88ee" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_33622e9406d3bffee1ca9c3a6a" ON "KubernetesAiAgent" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_KubernetesAiAgent_kubernetesClusterId" ON "KubernetesAiAgent" ("kubernetesClusterId") WHERE "deletedAt" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutomaticPostmortemDraft" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "targetKubernetesAiAgentId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ALTER COLUMN "isAiInvestigationEnabled" SET DEFAULT true`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_df20ccc2683c9be5fbc8399e09" ON "RunnerJob" ("targetKubernetesAiAgentId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesAiAgent" ADD CONSTRAINT "FK_33622e9406d3bffee1ca9c3a6a9" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesAiAgent" ADD CONSTRAINT "FK_d6ed70c680c438a5ea3080071ca" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD CONSTRAINT "FK_df20ccc2683c9be5fbc8399e098" FOREIGN KEY ("targetKubernetesAiAgentId") REFERENCES "KubernetesAiAgent"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    // 1. Postmortem drafts stay on wherever investigations were on.
+    await queryRunner.query(
+      `UPDATE "Project" SET "enableAutomaticPostmortemDraft" = true WHERE "enableAutomaticIncidentInvestigation" = true`,
+    );
+
+    // 2. Never-configured clusters investigate, like a new cluster.
+    await queryRunner.query(
+      `UPDATE "KubernetesCluster" SET "isAiInvestigationEnabled" = true WHERE "aiAccessConfiguredAt" IS NULL`,
+    );
+
+    /*
+     * 3. A cluster whose Runner was unbound or deleted stays off. It is also
+     * marked configured, so the Kubernetes AI agent's first-connection
+     * defaults (which only touch never-configured clusters) can never switch
+     * a revoked cluster back on.
+     */
+    await queryRunner.query(
+      `UPDATE "KubernetesCluster" SET "isAiInvestigationEnabled" = false, "aiRemediationMode" = 'Disabled', "aiAccessConfiguredAt" = COALESCE("aiAccessConfiguredAt", NOW()) WHERE "aiAccessRunnerId" IS NULL AND ("aiAccessRunnerBoundAt" IS NOT NULL OR "aiAccessLastVerifiedAt" IS NOT NULL OR "aiAccessLastError" IS NOT NULL)`,
+    );
+
+    // 4. No unattended mode goes live without the project's opt-in.
+    await queryRunner.query(
+      `UPDATE "KubernetesCluster" c SET "aiRemediationMode" = 'RequireApproval' FROM "Project" p WHERE c."projectId" = p."_id" AND p."enableAiCommandExecution" IS NOT TRUE AND c."aiRemediationMode" IN ('Automatic','BypassApproval')`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP CONSTRAINT "FK_df20ccc2683c9be5fbc8399e098"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesAiAgent" DROP CONSTRAINT "FK_d6ed70c680c438a5ea3080071ca"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesAiAgent" DROP CONSTRAINT "FK_33622e9406d3bffee1ca9c3a6a9"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_df20ccc2683c9be5fbc8399e09"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ALTER COLUMN "isAiInvestigationEnabled" SET DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "targetKubernetesAiAgentId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutomaticPostmortemDraft"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_KubernetesAiAgent_kubernetesClusterId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_33622e9406d3bffee1ca9c3a6a"`,
+    );
+    await queryRunner.query(`DROP TABLE "KubernetesAiAgent"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1796200000000-AddProxmoxResourceNativePushColumns.ts

@@ -0,0 +1,42 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Two ProxmoxResource columns for Proxmox VE's built-in OpenTelemetry push,
+ * where each node reports only itself:
+ *
+ * - "isNativePush": the row comes from the native push rather than the
+ *   Proxmox Agent. Such a Node row is kept — and reported Offline by the
+ *   nodes still alive — for the retention window instead of being pruned
+ *   after 15 minutes, because the native push carries no membership.
+ * - "notReportingMarkedAt": when the nodes still alive last reported this
+ *   node as having stopped reporting; cleared by its own next report. It
+ *   lets those reports carry on through a short gap in OneUptime's own
+ *   processing.
+ *
+ * Both nullable with no default: every existing row reads as an agent row
+ * that was never reported down, which keeps the behaviour it already had,
+ * and the next push of a native-push cluster sets them.
+ */
+export class AddProxmoxResourceNativePushColumns1796200000000
+  implements MigrationInterface
+{
+  public name: string = "AddProxmoxResourceNativePushColumns1796200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxResource" ADD "isNativePush" boolean`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxResource" ADD "notReportingMarkedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxResource" DROP COLUMN "notReportingMarkedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxResource" DROP COLUMN "isNativePush"`,
+    );
+  }
+}