@oneuptime/common 14.0.8 → 14.0.9

package/Types/Team/ComplianceRule.ts

@@ -0,0 +1,434 @@
+import ComplianceNotificationChannel from "./ComplianceNotificationChannel";
+import ComplianceRuleType from "./ComplianceRuleType";
+import NotificationRuleType from "../NotificationRule/NotificationRuleType";
+
+/*
+ * The catalog of team compliance rules: what each ComplianceRuleType means,
+ * which options it takes, and how to say it in a sentence. The server (which
+ * evaluates rules), the settings service (which validates them) and the
+ * Dashboard (which builds and describes them) all read this one table, so the
+ * three can never disagree about whether, say, an alert rule takes incident
+ * severities.
+ *
+ * Pure data and pure functions only - this file is bundled into the Dashboard.
+ */
+
+export enum ComplianceRuleCategory {
+  // The member has a verified notification method on one channel.
+  NotificationMethod = "NotificationMethod",
+  /*
+   * The member has on-call notification rules for a set of severities,
+   * optionally on one specific channel.
+   */
+  OnCallRule = "OnCallRule",
+}
+
+export enum ComplianceSeverityKind {
+  Incident = "Incident",
+  Alert = "Alert",
+}
+
+export interface ComplianceChannelDefinition {
+  channel: ComplianceNotificationChannel;
+  // "Call", "Push notification", ...
+  label: string;
+  // What a member has to add: "phone number for calls", "push device", ...
+  methodNoun: string;
+  /*
+   * False only for webhooks, which have no verification step: a configured
+   * webhook is usable as it stands, and the runtime treats it that way.
+   */
+  hasVerification: boolean;
+}
+
+export interface ComplianceRuleDefinition {
+  ruleType: ComplianceRuleType;
+  category: ComplianceRuleCategory;
+  // Short name for the rule kind, used on builder cards.
+  title: string;
+  // One sentence on what the rule checks.
+  description: string;
+  // NotificationMethod rules: the channel whose verified method is required.
+  methodChannel?: ComplianceNotificationChannel | undefined;
+  // OnCallRule rules: the notification rule type the member must have.
+  notificationRuleType?: NotificationRuleType | undefined;
+  // OnCallRule rules: which severity list scopes the rule.
+  severityKind?: ComplianceSeverityKind | undefined;
+  // OnCallRule rules: "incident", "alert", "incident episode", "alert episode".
+  subject?: string | undefined;
+}
+
+export const COMPLIANCE_CHANNEL_DEFINITIONS: ReadonlyArray<ComplianceChannelDefinition> =
+  [
+    {
+      channel: ComplianceNotificationChannel.Call,
+      label: "Call",
+      methodNoun: "phone number for calls",
+      hasVerification: true,
+    },
+    {
+      channel: ComplianceNotificationChannel.SMS,
+      label: "SMS",
+      methodNoun: "phone number for SMS",
+      hasVerification: true,
+    },
+    {
+      channel: ComplianceNotificationChannel.Push,
+      label: "Push notification",
+      methodNoun: "push notification device",
+      hasVerification: true,
+    },
+    {
+      channel: ComplianceNotificationChannel.Email,
+      label: "Email",
+      methodNoun: "email address",
+      hasVerification: true,
+    },
+    {
+      channel: ComplianceNotificationChannel.WhatsApp,
+      label: "WhatsApp",
+      methodNoun: "WhatsApp number",
+      hasVerification: true,
+    },
+    {
+      channel: ComplianceNotificationChannel.Telegram,
+      label: "Telegram",
+      methodNoun: "Telegram account",
+      hasVerification: true,
+    },
+    {
+      channel: ComplianceNotificationChannel.Slack,
+      label: "Slack",
+      methodNoun: "Slack account",
+      hasVerification: true,
+    },
+    {
+      channel: ComplianceNotificationChannel.MicrosoftTeams,
+      label: "Microsoft Teams",
+      methodNoun: "Microsoft Teams account",
+      hasVerification: true,
+    },
+    {
+      channel: ComplianceNotificationChannel.Webhook,
+      label: "Webhook",
+      methodNoun: "webhook",
+      hasVerification: false,
+    },
+  ];
+
+const methodRule: (data: {
+  ruleType: ComplianceRuleType;
+  channel: ComplianceNotificationChannel;
+  title: string;
+  description: string;
+}) => ComplianceRuleDefinition = (data: {
+  ruleType: ComplianceRuleType;
+  channel: ComplianceNotificationChannel;
+  title: string;
+  description: string;
+}): ComplianceRuleDefinition => {
+  return {
+    ruleType: data.ruleType,
+    category: ComplianceRuleCategory.NotificationMethod,
+    title: data.title,
+    description: data.description,
+    methodChannel: data.channel,
+  };
+};
+
+const onCallRule: (data: {
+  ruleType: ComplianceRuleType;
+  notificationRuleType: NotificationRuleType;
+  severityKind: ComplianceSeverityKind;
+  subject: string;
+  title: string;
+  description: string;
+}) => ComplianceRuleDefinition = (data: {
+  ruleType: ComplianceRuleType;
+  notificationRuleType: NotificationRuleType;
+  severityKind: ComplianceSeverityKind;
+  subject: string;
+  title: string;
+  description: string;
+}): ComplianceRuleDefinition => {
+  return {
+    ruleType: data.ruleType,
+    category: ComplianceRuleCategory.OnCallRule,
+    title: data.title,
+    description: data.description,
+    notificationRuleType: data.notificationRuleType,
+    severityKind: data.severityKind,
+    subject: data.subject,
+  };
+};
+
+/*
+ * In the order the Dashboard offers them: the on-call rules first, because
+ * "will this person actually be paged for a critical incident" is the question
+ * this page exists to answer, then the method rules.
+ */
+export const COMPLIANCE_RULE_DEFINITIONS: ReadonlyArray<ComplianceRuleDefinition> =
+  [
+    onCallRule({
+      ruleType: ComplianceRuleType.HasIncidentOnCallRules,
+      notificationRuleType: NotificationRuleType.ON_CALL_EXECUTED_INCIDENT,
+      severityKind: ComplianceSeverityKind.Incident,
+      subject: "incident",
+      title: "Incident on-call rules",
+      description:
+        "Members are notified when an incident on-call policy pages them - for the severities and channel you choose.",
+    }),
+    onCallRule({
+      ruleType: ComplianceRuleType.HasAlertOnCallRules,
+      notificationRuleType: NotificationRuleType.ON_CALL_EXECUTED_ALERT,
+      severityKind: ComplianceSeverityKind.Alert,
+      subject: "alert",
+      title: "Alert on-call rules",
+      description:
+        "Members are notified when an alert on-call policy pages them - for the severities and channel you choose.",
+    }),
+    onCallRule({
+      ruleType: ComplianceRuleType.HasIncidentEpisodeOnCallRules,
+      notificationRuleType:
+        NotificationRuleType.ON_CALL_EXECUTED_INCIDENT_EPISODE,
+      severityKind: ComplianceSeverityKind.Incident,
+      subject: "incident episode",
+      title: "Incident episode on-call rules",
+      description:
+        "Members are notified when an incident episode on-call policy pages them - for the severities and channel you choose.",
+    }),
+    onCallRule({
+      ruleType: ComplianceRuleType.HasAlertEpisodeOnCallRules,
+      notificationRuleType: NotificationRuleType.ON_CALL_EXECUTED_ALERT_EPISODE,
+      severityKind: ComplianceSeverityKind.Alert,
+      subject: "alert episode",
+      title: "Alert episode on-call rules",
+      description:
+        "Members are notified when an alert episode on-call policy pages them - for the severities and channel you choose.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationCallMethod,
+      channel: ComplianceNotificationChannel.Call,
+      title: "Verified phone for calls",
+      description: "Members have a verified phone number that can be called.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationSMSMethod,
+      channel: ComplianceNotificationChannel.SMS,
+      title: "Verified phone for SMS",
+      description: "Members have a verified phone number that can receive SMS.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationPushMethod,
+      channel: ComplianceNotificationChannel.Push,
+      title: "Verified push device",
+      description:
+        "Members have the mobile app or a browser registered for push notifications.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationEmailMethod,
+      channel: ComplianceNotificationChannel.Email,
+      title: "Verified email",
+      description: "Members have a verified email address for notifications.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationWhatsAppMethod,
+      channel: ComplianceNotificationChannel.WhatsApp,
+      title: "Verified WhatsApp",
+      description: "Members have a verified WhatsApp number.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationTelegramMethod,
+      channel: ComplianceNotificationChannel.Telegram,
+      title: "Verified Telegram",
+      description: "Members have a verified Telegram account.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationSlackMethod,
+      channel: ComplianceNotificationChannel.Slack,
+      title: "Verified Slack",
+      description: "Members have a verified Slack account for direct messages.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationMicrosoftTeamsMethod,
+      channel: ComplianceNotificationChannel.MicrosoftTeams,
+      title: "Verified Microsoft Teams",
+      description: "Members have a verified Microsoft Teams account.",
+    }),
+    methodRule({
+      ruleType: ComplianceRuleType.HasNotificationWebhookMethod,
+      channel: ComplianceNotificationChannel.Webhook,
+      title: "Webhook configured",
+      description: "Members have a webhook notification method.",
+    }),
+  ];
+
+/*
+ * "A, B and C" - the severity lists in sentences read as prose, not as a
+ * comma-separated dump.
+ */
+export const joinAsProse: (items: Array<string>) => string = (
+  items: Array<string>,
+): string => {
+  if (items.length <= 1) {
+    return items[0] || "";
+  }
+
+  return `${items.slice(0, -1).join(", ")} and ${items[items.length - 1]}`;
+};
+
+export default class ComplianceRule {
+  public static getDefinition(
+    ruleType: string | undefined | null,
+  ): ComplianceRuleDefinition | undefined {
+    return COMPLIANCE_RULE_DEFINITIONS.find(
+      (definition: ComplianceRuleDefinition): boolean => {
+        return definition.ruleType === ruleType;
+      },
+    );
+  }
+
+  public static getChannelDefinition(
+    channel: string | undefined | null,
+  ): ComplianceChannelDefinition | undefined {
+    return COMPLIANCE_CHANNEL_DEFINITIONS.find(
+      (definition: ComplianceChannelDefinition): boolean => {
+        return definition.channel === channel;
+      },
+    );
+  }
+
+  public static isKnownRuleType(value: unknown): value is ComplianceRuleType {
+    return (
+      typeof value === "string" && Boolean(ComplianceRule.getDefinition(value))
+    );
+  }
+
+  public static isKnownChannel(
+    value: unknown,
+  ): value is ComplianceNotificationChannel {
+    return (
+      typeof value === "string" &&
+      Boolean(ComplianceRule.getChannelDefinition(value))
+    );
+  }
+
+  public static isOnCallRule(ruleType: string | undefined | null): boolean {
+    return (
+      ComplianceRule.getDefinition(ruleType)?.category ===
+      ComplianceRuleCategory.OnCallRule
+    );
+  }
+
+  /*
+   * Only on-call rules take a severity scope and a channel. A method rule
+   * ("has a verified email") has neither, and any that arrive with one are
+   * ignored rather than half-applied.
+   */
+  public static supportsSeverityScope(
+    ruleType: string | undefined | null,
+  ): boolean {
+    return ComplianceRule.isOnCallRule(ruleType);
+  }
+
+  public static supportsChannel(ruleType: string | undefined | null): boolean {
+    return ComplianceRule.isOnCallRule(ruleType);
+  }
+
+  public static getSeverityKind(
+    ruleType: string | undefined | null,
+  ): ComplianceSeverityKind | undefined {
+    return ComplianceRule.getDefinition(ruleType)?.severityKind;
+  }
+
+  public static getMethodRuleTypeForChannel(
+    channel: ComplianceNotificationChannel,
+  ): ComplianceRuleType | undefined {
+    return COMPLIANCE_RULE_DEFINITIONS.find(
+      (definition: ComplianceRuleDefinition): boolean => {
+        return (
+          definition.category === ComplianceRuleCategory.NotificationMethod &&
+          definition.methodChannel === channel
+        );
+      },
+    )?.ruleType;
+  }
+
+  /*
+   * The rule's name as a list row shows it: "Call for incidents",
+   * "Incident on-call rules", "Verified push device".
+   */
+  public static getTitle(data: {
+    ruleType: string | undefined | null;
+    notificationChannel?: string | undefined | null;
+  }): string {
+    const definition: ComplianceRuleDefinition | undefined =
+      ComplianceRule.getDefinition(data.ruleType);
+
+    if (!definition) {
+      return data.ruleType || "Unknown rule";
+    }
+
+    const channel: ComplianceChannelDefinition | undefined =
+      ComplianceRule.getChannelDefinition(data.notificationChannel);
+
+    if (definition.category === ComplianceRuleCategory.OnCallRule && channel) {
+      return `${channel.label} for ${definition.subject}s`;
+    }
+
+    return definition.title;
+  }
+
+  /*
+   * The rule as one sentence about what every member must have, e.g.
+   * "Every member has an incident on-call rule that notifies them by Call for
+   * Critical Incident and Major Incident."
+   *
+   * `severityNames` is the rule's scope. Empty means every severity, which is
+   * what a rule with no severities selected enforces.
+   */
+  public static describe(data: {
+    ruleType: string | undefined | null;
+    notificationChannel?: string | undefined | null;
+    severityNames?: Array<string> | undefined;
+  }): string {
+    const definition: ComplianceRuleDefinition | undefined =
+      ComplianceRule.getDefinition(data.ruleType);
+
+    if (!definition) {
+      return `Unknown compliance rule "${data.ruleType || ""}".`;
+    }
+
+    if (definition.category === ComplianceRuleCategory.NotificationMethod) {
+      const channel: ComplianceChannelDefinition | undefined =
+        ComplianceRule.getChannelDefinition(definition.methodChannel);
+
+      if (channel && !channel.hasVerification) {
+        return `Every member has a ${channel.methodNoun} notification method.`;
+      }
+
+      return `Every member has a verified ${channel?.methodNoun || "notification method"}.`;
+    }
+
+    const severityNames: Array<string> = data.severityNames || [];
+    const scope: string =
+      severityNames.length === 0
+        ? `every ${definition.subject} severity`
+        : joinAsProse(severityNames);
+
+    const channel: ComplianceChannelDefinition | undefined =
+      ComplianceRule.getChannelDefinition(data.notificationChannel);
+
+    if (channel) {
+      return `Every member has ${ComplianceRule.withArticle(definition.subject || "")} on-call rule that notifies them by ${channel.label} for ${scope}.`;
+    }
+
+    return `Every member has ${ComplianceRule.withArticle(definition.subject || "")} on-call rule for ${scope}.`;
+  }
+
+  private static withArticle(noun: string): string {
+    return "aeiou".includes(noun.charAt(0).toLowerCase())
+      ? `an ${noun}`
+      : `a ${noun}`;
+  }
+}

package/Types/Team/ComplianceRuleType.ts

@@ -1,10 +1,31 @@
+/*
+ * The kinds of rule a team's compliance settings can enforce. The string
+ * values are stored in TeamComplianceSetting.ruleType, so existing values must
+ * never be renamed - add new ones instead.
+ *
+ * Two families (see ComplianceRule.ts for the catalog that describes each):
+ *
+ *  - HasNotification<Channel>Method: the member has a verified notification
+ *    method on that channel.
+ *  - Has<Incident|Alert>[Episode]OnCallRules: the member has an on-call
+ *    notification rule for the chosen severities (all of them when none are
+ *    chosen), optionally on one specific channel - "call me for Critical
+ *    incidents" is HasIncidentOnCallRules + Call + [Critical].
+ */
 enum ComplianceRuleType {
   HasNotificationEmailMethod = "HasNotificationEmailMethod",
   HasNotificationSMSMethod = "HasNotificationSMSMethod",
   HasNotificationCallMethod = "HasNotificationCallMethod",
   HasNotificationPushMethod = "HasNotificationPushMethod",
+  HasNotificationWhatsAppMethod = "HasNotificationWhatsAppMethod",
+  HasNotificationTelegramMethod = "HasNotificationTelegramMethod",
+  HasNotificationSlackMethod = "HasNotificationSlackMethod",
+  HasNotificationMicrosoftTeamsMethod = "HasNotificationMicrosoftTeamsMethod",
+  HasNotificationWebhookMethod = "HasNotificationWebhookMethod",
   HasIncidentOnCallRules = "HasIncidentOnCallRules",
   HasAlertOnCallRules = "HasAlertOnCallRules",
+  HasIncidentEpisodeOnCallRules = "HasIncidentEpisodeOnCallRules",
+  HasAlertEpisodeOnCallRules = "HasAlertEpisodeOnCallRules",
 }
 
 export default ComplianceRuleType;

package/Types/Team/TeamComplianceStatus.ts

@@ -0,0 +1,81 @@
+import ComplianceNotificationChannel from "./ComplianceNotificationChannel";
+import { ComplianceSeverityKind } from "./ComplianceRule";
+import ComplianceRuleType from "./ComplianceRuleType";
+
+/*
+ * The JSON body of GET /team/compliance-status/:teamId (OneUptime Enterprise).
+ *
+ * The server (ee/Server/TeamCompliance) builds exactly this shape and the
+ * Dashboard page (ee/Dashboard/TeamCompliance) renders exactly this shape, so
+ * it is declared once, here, as plain JSON types - ids are strings, never
+ * ObjectIDs, because this is what crosses the wire.
+ */
+
+export interface TeamComplianceSeverityJSON {
+  id: string;
+  name: string;
+  // Hex colour of the severity, when it has one.
+  color?: string | undefined;
+}
+
+export interface TeamComplianceRuleJSON {
+  // TeamComplianceSetting._id. A team may hold several rules of one type.
+  settingId: string;
+  ruleType: ComplianceRuleType;
+  enabled: boolean;
+  // Null means "any channel" (and is always null for method rules).
+  notificationChannel: ComplianceNotificationChannel | null;
+  // Which severity list scopes the rule; null for method rules.
+  severityKind: ComplianceSeverityKind | null;
+  /*
+   * True when the rule applies to every severity of its kind - an on-call
+   * rule with no severities selected. Always false for method rules.
+   */
+  appliesToAllSeverities: boolean;
+  /*
+   * The severities the rule is scoped to, in severity order (most severe
+   * first). Empty when appliesToAllSeverities, and for method rules.
+   */
+  severities: Array<TeamComplianceSeverityJSON>;
+  /*
+   * Members who pass / fail this rule. Both are 0 for a disabled rule, which
+   * is not evaluated at all.
+   */
+  compliantCount: number;
+  nonCompliantCount: number;
+  /*
+   * Problems with the rule itself rather than with any member - e.g. the
+   * project has the rule's channel switched off, so nobody can pass it.
+   */
+  warnings: Array<string>;
+}
+
+export interface TeamComplianceIssueJSON {
+  // The rule this member fails.
+  settingId: string;
+  ruleType: ComplianceRuleType;
+  // What is wrong, as a sentence an admin can act on.
+  reason: string;
+}
+
+export interface TeamMemberComplianceJSON {
+  userId: string;
+  userName: string;
+  userEmail: string;
+  userProfilePictureId?: string | undefined;
+  // False when the member fails at least one enabled rule.
+  isCompliant: boolean;
+  nonCompliantRules: Array<TeamComplianceIssueJSON>;
+}
+
+export interface TeamComplianceStatusJSON {
+  teamId: string;
+  teamName: string;
+  // ISO-8601 time the status was computed.
+  evaluatedAt: string;
+  /*
+   * Every rule on the team, enabled or not, in the order they were created.
+   */
+  complianceSettings: Array<TeamComplianceRuleJSON>;
+  userComplianceStatuses: Array<TeamMemberComplianceJSON>;
+}

package/Types/Telemetry/TelemetryIngestSurface.ts

@@ -34,8 +34,34 @@ enum TelemetryIngestSurface {
    * mint a Runner credential.
    */
   KubernetesAgentRunner = "kubernetes-agent-runner",
+  /*
+   * The Kubernetes AI agent the kubernetes-agent chart installs registers
+   * itself with the same project ingestion key the collector uses, and
+   * receives an agent key that every kubectl job for its cluster is claimed
+   * with. Server keys only, for the same reason as the Runner above.
+   */
+  KubernetesAiAgent = "kubernetes-ai-agent",
 }
 
+/*
+ * Surfaces that mint an IDENTITY (a key that kubectl jobs for a cluster are
+ * targeted at) rather than accept telemetry. The ingest middleware holds
+ * every one of them to the same two extra rules, keyed on this set so a new
+ * identity surface cannot quietly miss one:
+ *
+ *   - a server key with no configured limit gets a conservative default
+ *     requests-per-minute ceiling instead of "unlimited";
+ *   - a key pinned to a single service is refused: its owner scoped it to
+ *     one service's telemetry, not to standing up cluster access.
+ *
+ * None of them is browser-allowed (see the allowlist below).
+ */
+export const IDENTITY_REGISTRATION_SURFACES: ReadonlySet<TelemetryIngestSurface> =
+  new Set<TelemetryIngestSurface>([
+    TelemetryIngestSurface.KubernetesAgentRunner,
+    TelemetryIngestSurface.KubernetesAiAgent,
+  ]);
+
 /*
  * The only surfaces a Browser key may write to. This is an ALLOWLIST, not a
  * denylist, on purpose: a surface added later is refused to browser keys until
@@ -81,6 +107,8 @@ const INGEST_SURFACE_READABLE_NAMES: Record<TelemetryIngestSurface, string> = {
   [TelemetryIngestSurface.Mqtt]: "MQTT ingest",
   [TelemetryIngestSurface.KubernetesAgentRunner]:
     "Kubernetes agent Runner registration",
+  [TelemetryIngestSurface.KubernetesAiAgent]:
+    "Kubernetes AI agent registration",
 };
 
 type GetIngestSurfaceReadableNameFunction = (

package/UI/Components/ActionButton/ActionButtonSchema.ts

@@ -3,6 +3,26 @@ import { ErrorFunction, VoidFunction } from "../../../Types/FunctionTypes";
 import GenericObject from "../../../Types/GenericObject";
 import IconProp from "../../../Types/Icon/IconProp";
 
+/*
+ * A row shows one action as a button and puts every other action in a ⋯ menu
+ * beside it (see SplitActionButtons). Most actions never need to say where they
+ * go - the split reads it off their style - so this is only for the ones whose
+ * style tells the wrong story.
+ */
+export enum ActionButtonPlacement {
+  /*
+   * The row's button, ahead of anything the style would have picked. The first
+   * visible Primary action wins; any other Primary action goes in the menu.
+   */
+  Primary = "Primary",
+  /*
+   * Always in the ⋯ menu, never the row's button - even when it is the only
+   * action the row has. For utilities like "Show ID" that every row carries
+   * but nobody reaches for first.
+   */
+  MoreMenu = "MoreMenu",
+}
+
 interface ActionButtonSchema<T extends GenericObject> {
   title: string;
   icon?: undefined | IconProp;
@@ -17,6 +37,7 @@ interface ActionButtonSchema<T extends GenericObject> {
    */
   disabled?: boolean | undefined;
   tooltip?: string | undefined;
+  placement?: ActionButtonPlacement | undefined;
   onClick: (
     item: T,
     onCompleteAction: VoidFunction,