@oneuptime/common 14.0.8 → 14.0.10

package/Models/DatabaseModels/TeamComplianceSetting.ts

@@ -1,3 +1,5 @@
+import AlertSeverity from "./AlertSeverity";
+import IncidentSeverity from "./IncidentSeverity";
 import Project from "./Project";
 import Team from "./Team";
 import User from "./User";
@@ -21,8 +23,17 @@ import IconProp from "../../Types/Icon/IconProp";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import ComplianceNotificationChannel from "../../Types/Team/ComplianceNotificationChannel";
 import ComplianceRuleType from "../../Types/Team/ComplianceRuleType";
-import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
+import {
+  Column,
+  Entity,
+  Index,
+  JoinColumn,
+  JoinTable,
+  ManyToMany,
+  ManyToOne,
+} from "typeorm";
 
 @TableEditionAccessControl({
   requiresEnterprise: true,
@@ -60,7 +71,12 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 })
 @TenantColumn("projectId")
 @CrudApiEndpoint(new Route("/team-compliance-setting"))
-@Index(["teamId", "ruleType"], { unique: true })
+/*
+ * No unique (teamId, ruleType) index: one team can hold several rules of the
+ * same type - "Call for Critical incidents" and "Push for Critical incidents"
+ * are both HasIncidentOnCallRules. TeamComplianceSettingService rejects exact
+ * duplicates (same type, channel and severities) instead.
+ */
 @Entity({
   name: "TeamComplianceSetting",
 })
@@ -414,4 +430,129 @@ export default class TeamComplianceSetting extends BaseModel {
     nullable: true,
   })
   public options?: JSONObject = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProjectTeam,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "Notification Channel",
+    description:
+      "On-call rules only: the channel the member's rule must notify them on (Call, SMS, Push, Email, WhatsApp, Telegram, Slack, MicrosoftTeams or Webhook). Leave empty to accept any channel.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public notificationChannel?: ComplianceNotificationChannel = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProjectTeam,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: IncidentSeverity,
+    title: "Incident Severities",
+    description:
+      "Incident and incident episode on-call rules only: the severities members must have a rule for. Leave empty to require every incident severity.",
+  })
+  @ManyToMany(
+    () => {
+      return IncidentSeverity;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "TeamComplianceSettingIncidentSeverity",
+    inverseJoinColumn: {
+      name: "incidentSeverityId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "teamComplianceSettingId",
+      referencedColumnName: "_id",
+    },
+  })
+  public incidentSeverities?: Array<IncidentSeverity> = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProjectTeam,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: AlertSeverity,
+    title: "Alert Severities",
+    description:
+      "Alert and alert episode on-call rules only: the severities members must have a rule for. Leave empty to require every alert severity.",
+  })
+  @ManyToMany(
+    () => {
+      return AlertSeverity;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "TeamComplianceSettingAlertSeverity",
+    inverseJoinColumn: {
+      name: "alertSeverityId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "teamComplianceSettingId",
+      referencedColumnName: "_id",
+    },
+  })
+  public alertSeverities?: Array<AlertSeverity> = undefined;
 }

package/Models/DatabaseModels/VMwareVCenter.ts

@@ -19,6 +19,7 @@ import UniqueColumnBy from "../../Types/Database/UniqueColumnBy";
 import IconProp from "../../Types/Icon/IconProp";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import { ResourceAiRemediationMode } from "../../Types/ResourceAiAgent/ResourceAiAccess";
 import TelemetryRetentionConfig from "../../Types/Telemetry/TelemetryRetentionConfig";
 import {
   Column,
@@ -1119,4 +1120,216 @@ export default class VMwareVCenter extends BaseModel {
     nullable: true,
   })
   public telemetryRetentionConfig?: TelemetryRetentionConfig = undefined;
+
+  /*
+   * OneUptime AI access to this vCenter through its VMware AI agent (a resource AI
+   * agent, ResourceAiAgent). The settings are plain columns written through
+   * ordinary CRUD, so they exist before any agent registers. The columns
+   * keep the vCenter's own update ACL: anyone who may edit the vCenter may make
+   * AI do LESS; making it do MORE is refused by the service unless the
+   * caller may author a FullAuto auto-remediation rule. The aiAccess*
+   * columns are written only by the server.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditVMwareVCenter,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Let AI Investigate With Read-Only Commands",
+    description:
+      "When on, OneUptime AI runs read-only commands (govc about, ls, vm.info, host.info, events) on this vCenter, through its VMware AI agent, while investigating incidents and alerts linked to it, and uses their output, with secret values redacted, as evidence. Nothing is ever changed by an investigation. Off by default. Anyone who may edit the vCenter can turn it on or off.",
+    defaultValue: false,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: false,
+  })
+  public isAiInvestigationEnabled?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditVMwareVCenter,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.ShortText,
+    title: "AI Remediation Mode",
+    /*
+     * The API and Terraform docs for the mode: the same semantics as the
+     * ResourceAiRemediationMode doc comment in
+     * Types/ResourceAiAgent/ResourceAiAccess.ts (the canonical text).
+     */
+    description:
+      "Disabled: AI never proposes or runs a change on this vCenter. RequireApproval: AI composes a command plan and a human approves it with one click before anything runs. Automatic: safe changes (SafeWrite) run without a human; a riskier change is proposed for approval unless the vCenter's allowlist names its exact shape. BypassApproval: every change the policy allows — safe AND riskier — runs on its own, except what always needs a human. In EVERY mode: Denied commands never run, commands the policy marks requiresHuman always ask, and the agent itself refuses every write unless it was started with ONEUPTIME_AI_ALLOW_WRITES=true (and then only on the targets ONEUPTIME_AI_WRITE_TARGETS allows, never its protected targets). Anyone who may edit the vCenter can lower the mode; raising it needs Project Owner, Project Admin or Edit Auto Remediation Rule.",
+    defaultValue: ResourceAiRemediationMode.Disabled,
+    example: ResourceAiRemediationMode.RequireApproval,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: false,
+    default: ResourceAiRemediationMode.Disabled,
+  })
+  public aiRemediationMode?: ResourceAiRemediationMode = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditVMwareVCenter,
+    ],
+  })
+  @TableColumn({
+    type: TableColumnType.JSON,
+    required: false,
+    title: "AI Command Allowlist",
+    description:
+      "Optional JSON array of command patterns that Automatic mode may run on this vCenter without approval even though they are riskier changes. Each pattern is one command line for this vCenter's agent (govc) and is compared with the command word by word: * stands for exactly one word (a name, an id), never for extra words or flags, and every flag the command uses must be written out in the pattern. At most 50 patterns of at most 500 characters each; a pattern that is not one valid write command for this vCenter is refused. Destructive commands (Denied tier) never run regardless, and a command that always needs a human still asks. Adding a pattern needs Project Owner, Project Admin or Edit Auto Remediation Rule; anyone who may edit the vCenter can remove patterns or clear the list.",
+  })
+  @Column({
+    type: ColumnType.JSON,
+    nullable: true,
+  })
+  public aiCommandAllowlist?: Array<string> = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "AI Access Last Verified At",
+    description:
+      "When a command from OneUptime AI last succeeded on this vCenter through its VMware AI agent. Set by the server.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public aiAccessLastVerifiedAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.LongText,
+    title: "AI Access Last Error",
+    description:
+      "The most recent failure OneUptime AI hit while running a command on this vCenter, kept until the next successful command. Set by the server.",
+  })
+  @Column({
+    type: ColumnType.LongText,
+    nullable: true,
+  })
+  public aiAccessLastError?: string = undefined;
+
+  /*
+   * When this vCenter's AI access was first configured — by anyone writing an
+   * AI access setting. Only the server writes it, and nothing ever clears
+   * it. A registering VMware AI agent reads it to tell "never configured" (it may
+   * apply its first-connection defaults) from "an operator chose settings,
+   * perhaps before installing the agent" (every setting stays as chosen).
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "AI Access Configured At",
+    description:
+      "When OneUptime AI access to this vCenter was first configured by anyone saving an AI access setting. Set by the server; never cleared, so a VMware AI agent that registers later never overwrites a setting an operator chose.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public aiAccessConfiguredAt?: Date = undefined;
 }

package/Models/DatabaseModels/WorkspaceProjectAuthToken.ts

@@ -43,6 +43,23 @@ export interface MicrosoftTeamsChat {
    * shipped.
    */
   memberAadObjectIds?: Array<string> | undefined;
+  /*
+   * The chat's name in Teams (Graph's "topic"), as last read. `name` is built
+   * from it; it is kept separately so a lookup that fails later can keep the
+   * chat's real name instead of falling back to member names. Absent when the
+   * chat has no name, or its name has never been readable.
+   */
+  topic?: string | undefined;
+  /*
+   * The first few human members' display names — only what a chat named
+   * after its members shows — and how many members have a name. Kept so the
+   * name can be rebuilt when a group chat's Teams name is removed, without a
+   * roster call. miscData is readable by every project Viewer, so the full
+   * roster is deliberately not stored. Absent on records captured before this
+   * shipped (a group chat without memberCount is re-captured once).
+   */
+  memberNames?: Array<string> | undefined;
+  memberCount?: number | undefined;
 }
 
 /*

package/Server/API/AIChatAPI.ts

@@ -47,6 +47,7 @@ import AIConversationMessageService from "../Services/AIConversationMessageServi
 import AIRunEventService from "../Services/AIRunEventService";
 import AIRunService from "../Services/AIRunService";
 import ProjectService from "../Services/ProjectService";
+import { AI_DISABLED_MESSAGE } from "../Services/AIService";
 import LlmProviderService from "../Services/LlmProviderService";
 import LlmProvider from "../../Models/DatabaseModels/LlmProvider";
 import ChatAgentRunner, {
@@ -217,10 +218,12 @@ router.post(
           }),
         ]);
 
+      /*
+       * The shared kill-switch sentence, so Ask AI names the same settings
+       * page as every other AI surface that refuses.
+       */
       if (project && project.enableAi === false) {
-        throw new BadDataException(
-          "AI features are disabled for this project. Enable them in Project Settings > AI Credits.",
-        );
+        throw new BadDataException(AI_DISABLED_MESSAGE);
       }
 
       if (runningRunsInProject >= MAX_CONCURRENT_RUNS_PER_PROJECT) {

package/Server/API/AIInvestigationAPI.ts

@@ -49,6 +49,7 @@ import {
   KubernetesAiAccessGapCode,
   KubernetesAiAccessRunnerSummary,
   KubernetesClusterAiAccessStatus,
+  getKubernetesAiAccessTargetKind,
 } from "../../Types/Kubernetes/KubernetesClusterAiAccess";
 import { KUBERNETES_AI_ACCESS_CREDENTIAL_PERMISSIONS } from "../../Types/Kubernetes/KubernetesClusterAiAccessPermissions";
 import CodeFixTaskType from "../../Types/AI/CodeFixTaskType";
@@ -544,22 +545,21 @@ export type InvestigationPanelClusterAccess = Pick<
  * identifier the Runner reported.
  */
 export const RESTRICTED_GAP_DESCRIPTION: string =
-  "Someone who can view this Kubernetes cluster can see the details on its AI page.";
+  "Someone who can view this Kubernetes cluster can see the details on its AI agent page (AI → Agent).";
 
 /*
  * Stand in for a gap's next step on a row whose viewer cannot read the
- * cluster. The service's next steps are written for the cluster's AI page
- * and may name the Runner to select ('Select the kubernetes-agent Runner
- * "kubernetes-agent/<cluster identifier>" …'), the credential, or the
- * cluster identifier — none of which such a viewer is shown — and point at
- * a page they cannot open. A project-level gap is fixed in Project
- * Settings instead.
+ * cluster. The service's next steps are written for the cluster's AI agent
+ * page and may name the Runner, the credential, the agent's namespace or
+ * the cluster identifier — none of which such a viewer is shown — and
+ * point at a page they cannot open. A project-level gap is fixed in
+ * Project Settings instead.
  */
 export const RESTRICTED_GAP_NEXT_STEP: string =
-  "Ask someone who can edit this Kubernetes cluster's AI access to fix it on the cluster's AI page.";
+  "Ask someone who can edit this Kubernetes cluster's AI access to fix it on the cluster's AI agent page (AI → Agent).";
 
 export const RESTRICTED_PROJECT_GAP_NEXT_STEP: string =
-  "Ask a project admin to change this under Project Settings → AI.";
+  "Ask a project owner or admin to change this in Project Settings (AI Features, AI Credits or LLM Providers).";
 
 /*
  * The gaps fixed in Project Settings rather than on the cluster. Every
@@ -571,6 +571,7 @@ const PROJECT_LEVEL_GAP_CODES: ReadonlyArray<KubernetesAiAccessGapCode> = [
   "project_auto_remediation_disabled",
   "project_ai_command_execution_disabled",
   "llm_provider_missing",
+  "ai_balance_insufficient",
 ];
 
 // The next step a viewer who cannot read the cluster sees for a gap.
@@ -586,7 +587,7 @@ export function getRestrictedGapNextStep(code: string): string {
  * credential.
  */
 export const RESTRICTED_CREDENTIAL_GAP_DESCRIPTION: string =
-  "The Kubernetes credential this cluster's Runner needs is missing or cannot be used. Someone who can view Runner credentials can see which one on the cluster's AI page.";
+  "The Kubernetes credential this cluster's Runner needs is missing or cannot be used. Someone who can view Runner credentials can see which one on the cluster's AI agent page (AI → Agent).";
 
 function toPanelRunnerSummary(
   runner: KubernetesAiAccessRunnerSummary | null,
@@ -598,6 +599,12 @@ function toPanelRunnerSummary(
   return {
     id: runner.id,
     name: runner.name,
+    /*
+     * Which kind of target it is: the panel names the Kubernetes AI agent
+     * and a Runner differently, and accessMethod ("in_cluster" for both
+     * the agent and the previous in-cluster Runner) cannot tell them apart.
+     */
+    kind: getKubernetesAiAccessTargetKind(runner) || undefined,
     isOnline: runner.isOnline,
     lastAliveAt: runner.lastAliveAt,
     canRunAiCommands: runner.canRunAiCommands,