@oneuptime/common 14.0.9 → 14.0.11

package/Models/DatabaseModels/StatusPageSso.ts

@@ -9,7 +9,6 @@ import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccess
 import OwnedThrough from "../../Types/Database/AccessControl/OwnedThrough";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
 import TableBillingAccessControl from "../../Types/Database/AccessControl/TableBillingAccessControl";
-import TableEditionAccessControl from "../../Types/Database/AccessControl/TableEditionAccessControl";
 import CanAccessIfCanReadOn from "../../Types/Database/CanAccessIfCanReadOn";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
@@ -29,9 +28,6 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
 @EnableDocumentation()
 @CanAccessIfCanReadOn("statusPage")
-@TableEditionAccessControl({
-  requiresEnterprise: true,
-})
 @TableBillingAccessControl({
   create: PlanType.Scale,
   read: PlanType.Scale,

package/Models/DatabaseModels/TeamComplianceSetting.ts

@@ -75,7 +75,7 @@ import {
  * No unique (teamId, ruleType) index: one team can hold several rules of the
  * same type - "Call for Critical incidents" and "Push for Critical incidents"
  * are both HasIncidentOnCallRules. TeamComplianceSettingService rejects exact
- * duplicates (same type, channel and severities) instead.
+ * duplicates (same type, channels and severities) instead.
  */
 @Entity({
   name: "TeamComplianceSetting",
@@ -450,12 +450,24 @@ export default class TeamComplianceSetting extends BaseModel {
       Permission.EditProjectTeam,
     ],
   })
+  /*
+   * Deprecated in favour of notificationChannels, and kept for everything
+   * that only knows this column: API clients written before a rule could
+   * require several channels, and a replica of an older build still running
+   * during an upgrade (or after a downgrade). TeamComplianceSettingService
+   * keeps it equal to the first of notificationChannels on every write, so
+   * such a build checks one of the rule's channels rather than "any
+   * channel"; a payload that sends only this column sets the list to that
+   * one channel; and a row whose list it disagrees with was last written by
+   * an older build, which is how the rule is then read
+   * (TeamComplianceSettingService.getStoredChannels).
+   */
   @TableColumn({
     required: false,
     type: TableColumnType.ShortText,
     title: "Notification Channel",
     description:
-      "On-call rules only: the channel the member's rule must notify them on (Call, SMS, Push, Email, WhatsApp, Telegram, Slack, MicrosoftTeams or Webhook). Leave empty to accept any channel.",
+      "Deprecated: use notificationChannels. The first of the rule's notification channels, or empty when it accepts any channel. Sending this field without notificationChannels sets the rule to that one channel (Call, SMS, Push, Email, WhatsApp, Telegram, Slack, MicrosoftTeams or Webhook).",
   })
   @Column({
     nullable: true,
@@ -464,6 +476,39 @@ export default class TeamComplianceSetting extends BaseModel {
   })
   public notificationChannel?: ComplianceNotificationChannel = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProjectTeam,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditProjectTeam,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.JSON,
+    title: "Notification Channels",
+    description:
+      "On-call rules only: the channels members must be notified on, as a list - each member needs a rule on every one of them (Call, SMS, Push, Email, WhatsApp, Telegram, Slack, MicrosoftTeams or Webhook). Leave empty to accept any channel.",
+  })
+  @Column({
+    type: ColumnType.JSON,
+    nullable: true,
+  })
+  public notificationChannels?: Array<ComplianceNotificationChannel> =
+    undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/VMwareVCenter.ts

@@ -1,3 +1,5 @@
+import { PlanType } from "../../Types/Billing/SubscriptionPlan";
+import ColumnBillingAccessControl from "../../Types/Database/AccessControl/ColumnBillingAccessControl";
 import Label from "./Label";
 import Project from "./Project";
 import User from "./User";
@@ -19,6 +21,7 @@ import UniqueColumnBy from "../../Types/Database/UniqueColumnBy";
 import IconProp from "../../Types/Icon/IconProp";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import { ResourceAiRemediationMode } from "../../Types/ResourceAiAgent/ResourceAiAccess";
 import TelemetryRetentionConfig from "../../Types/Telemetry/TelemetryRetentionConfig";
 import {
   Column,
@@ -1077,6 +1080,11 @@ export default class VMwareVCenter extends BaseModel {
     nullable: true,
     unique: false,
   })
+  @ColumnBillingAccessControl({
+    read: PlanType.Free,
+    update: PlanType.Scale,
+    create: PlanType.Scale,
+  })
   public retainTelemetryDataForDays?: number = undefined;
 
   @ColumnAccessControl({
@@ -1118,5 +1126,222 @@ export default class VMwareVCenter extends BaseModel {
     type: ColumnType.JSON,
     nullable: true,
   })
+  @ColumnBillingAccessControl({
+    read: PlanType.Free,
+    update: PlanType.Scale,
+    create: PlanType.Scale,
+  })
   public telemetryRetentionConfig?: TelemetryRetentionConfig = undefined;
+
+  /*
+   * OneUptime AI access to this vCenter through its VMware AI agent (a resource AI
+   * agent, ResourceAiAgent). The settings are plain columns written through
+   * ordinary CRUD, so they exist before any agent registers. The columns
+   * keep the vCenter's own update ACL: anyone who may edit the vCenter may make
+   * AI do LESS; making it do MORE is refused by the service unless the
+   * caller may author a FullAuto auto-remediation rule. The aiAccess*
+   * columns are written only by the server.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditVMwareVCenter,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.Boolean,
+    title: "Let AI Investigate With Read-Only Commands",
+    description:
+      "When on, OneUptime AI runs read-only commands (govc about, ls, vm.info, host.info, events) on this vCenter, through its VMware AI agent, while investigating incidents and alerts linked to it, and uses their output, with secret values redacted, as evidence. Nothing is ever changed by an investigation. Off by default. Anyone who may edit the vCenter can turn it on or off.",
+    defaultValue: false,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: false,
+    default: false,
+  })
+  public isAiInvestigationEnabled?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditVMwareVCenter,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    required: true,
+    type: TableColumnType.ShortText,
+    title: "AI Remediation Mode",
+    /*
+     * The API and Terraform docs for the mode: the same semantics as the
+     * ResourceAiRemediationMode doc comment in
+     * Types/ResourceAiAgent/ResourceAiAccess.ts (the canonical text).
+     */
+    description:
+      "Disabled: AI never proposes or runs a change on this vCenter. RequireApproval: AI composes a command plan and a human approves it with one click before anything runs. Automatic: safe changes (SafeWrite) run without a human; a riskier change is proposed for approval unless the vCenter's allowlist names its exact shape. BypassApproval: every change the policy allows — safe AND riskier — runs on its own, except what always needs a human. In EVERY mode: Denied commands never run, commands the policy marks requiresHuman always ask, and the agent itself refuses every write unless it was started with ONEUPTIME_AI_ALLOW_WRITES=true (and then only on the targets ONEUPTIME_AI_WRITE_TARGETS allows, never its protected targets). Anyone who may edit the vCenter can lower the mode; raising it needs Project Owner, Project Admin or Edit Auto Remediation Rule.",
+    defaultValue: ResourceAiRemediationMode.Disabled,
+    example: ResourceAiRemediationMode.RequireApproval,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: false,
+    default: ResourceAiRemediationMode.Disabled,
+  })
+  public aiRemediationMode?: ResourceAiRemediationMode = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.EditVMwareVCenter,
+    ],
+  })
+  @TableColumn({
+    type: TableColumnType.JSON,
+    required: false,
+    title: "AI Command Allowlist",
+    description:
+      "Optional JSON array of command patterns that Automatic mode may run on this vCenter without approval even though they are riskier changes. Each pattern is one command line for this vCenter's agent (govc) and is compared with the command word by word: * stands for exactly one word (a name, an id), never for extra words or flags, and every flag the command uses must be written out in the pattern. At most 50 patterns of at most 500 characters each; a pattern that is not one valid write command for this vCenter is refused. Destructive commands (Denied tier) never run regardless, and a command that always needs a human still asks. Adding a pattern needs Project Owner, Project Admin or Edit Auto Remediation Rule; anyone who may edit the vCenter can remove patterns or clear the list.",
+  })
+  @Column({
+    type: ColumnType.JSON,
+    nullable: true,
+  })
+  public aiCommandAllowlist?: Array<string> = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "AI Access Last Verified At",
+    description:
+      "When a command from OneUptime AI last succeeded on this vCenter through its VMware AI agent. Set by the server.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public aiAccessLastVerifiedAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.LongText,
+    title: "AI Access Last Error",
+    description:
+      "The most recent failure OneUptime AI hit while running a command on this vCenter, kept until the next successful command. Set by the server.",
+  })
+  @Column({
+    type: ColumnType.LongText,
+    nullable: true,
+  })
+  public aiAccessLastError?: string = undefined;
+
+  /*
+   * When this vCenter's AI access was first configured — by anyone writing an
+   * AI access setting. Only the server writes it, and nothing ever clears
+   * it. A registering VMware AI agent reads it to tell "never configured" (it may
+   * apply its first-connection defaults) from "an operator chose settings,
+   * perhaps before installing the agent" (every setting stays as chosen).
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadVMwareVCenter,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "AI Access Configured At",
+    description:
+      "When OneUptime AI access to this vCenter was first configured by anyone saving an AI access setting. Set by the server; never cleared, so a VMware AI agent that registers later never overwrites a setting an operator chose.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public aiAccessConfiguredAt?: Date = undefined;
 }

package/Server/API/AIChatAPI.ts

@@ -32,7 +32,6 @@ import {
   AIChatToolActionStatus,
 } from "../../Types/AI/AIChatTypes";
 import { JSONArray, JSONObject } from "../../Types/JSON";
-import AIRunEventType from "../../Types/AI/AIRunEventType";
 import AIRunStatus from "../../Types/AI/AIRunStatus";
 import AIRunType from "../../Types/AI/AIRunType";
 import AIConversation from "../../Models/DatabaseModels/AIConversation";
@@ -40,11 +39,9 @@ import AIConversationMessage, {
   AIConversationMessageFeedback,
 } from "../../Models/DatabaseModels/AIConversationMessage";
 import AIRun from "../../Models/DatabaseModels/AIRun";
-import AIRunEvent from "../../Models/DatabaseModels/AIRunEvent";
 import Project from "../../Models/DatabaseModels/Project";
 import AIConversationService from "../Services/AIConversationService";
 import AIConversationMessageService from "../Services/AIConversationMessageService";
-import AIRunEventService from "../Services/AIRunEventService";
 import AIRunService from "../Services/AIRunService";
 import ProjectService from "../Services/ProjectService";
 import { AI_DISABLED_MESSAGE } from "../Services/AIService";
@@ -54,21 +51,14 @@ import ChatAgentRunner, {
   ResumeToolDecision,
 } from "../Utils/AI/Chat/ChatAgentRunner";
 import QueryHelper from "../Types/Database/QueryHelper";
+import ChatRunCancellation, {
+  ChatRunCancellationResult,
+} from "../Utils/AI/Chat/ChatRunCancellation";
 import logger from "../Utils/Logger";
 
 const MAX_USER_MESSAGE_LENGTH: number = 8000;
 const MAX_CONCURRENT_RUNS_PER_PROJECT: number = 3;
 
-// Final message content and run error for a turn the user stopped.
-const STOPPED_BY_USER_TEXT: string = "Stopped by user.";
-
-/*
- * Cancel's terminal event must sort after every progress event the runner
- * emitted — same convention as the runner's own failure finalizer, which
- * starts its event sequence at 100000.
- */
-const CANCEL_EVENT_SEQUENCE: number = 100000;
-
 const router: ExpressRouter = Express.getRouter();
 
 /*
@@ -806,115 +796,24 @@ router.post(
         throw new BadDataException("Conversation not found.");
       }
 
-      /*
-       * The conversation's live run: actively generating (Running) or paused
-       * for the user's approval (WaitingForApproval). The per-conversation
-       * governor allows at most one, so no sort is needed.
-       */
-      const activeRun: AIRun | null = await AIRunService.findOneBy({
-        query: {
-          conversationId: conversationId,
-          projectId: projectId,
-          status: QueryHelper.any([
-            AIRunStatus.Running,
-            AIRunStatus.WaitingForApproval,
-          ]),
-        },
-        select: { _id: true },
-        props: { isRoot: true },
-      });
+      // The shared, status-guarded stop (see ChatRunCancellation).
+      const cancellation: ChatRunCancellationResult | null =
+        await ChatRunCancellation.cancelActiveRun({
+          projectId,
+          conversationId,
+          userId,
+        });
 
-      if (!activeRun) {
+      if (!cancellation) {
         throw new BadDataException(
           "No response is being generated in this conversation.",
         );
       }
 
-      /*
-       * Status-guarded finalization, the same shape as the runner's own
-       * finalizer: only a still-in-flight run is flipped, so a run the runner
-       * completed (or errored) inside the race window is never overwritten.
-       * updateOneBy returns the matched-row count — zero from both guards
-       * means the other side won and already wrote the final state.
-       */
-      let cancelledRunCount: number = 0;
-
-      for (const inFlightRunStatus of [
-        AIRunStatus.Running,
-        AIRunStatus.WaitingForApproval,
-      ]) {
-        cancelledRunCount += await AIRunService.updateOneBy({
-          query: {
-            _id: activeRun.id!.toString(),
-            status: inFlightRunStatus,
-          },
-          data: {
-            status: AIRunStatus.Cancelled,
-            completedAt: OneUptimeDate.getCurrentDate(),
-            errorMessage: STOPPED_BY_USER_TEXT,
-            // A cancelled turn must never be resumable.
-            pausedState: null,
-          } as never,
-          props: { isRoot: true },
-        });
-      }
-
-      /*
-       * Finalize the run's in-flight assistant message the same guarded way:
-       * a message another path already finalized — completed with its full
-       * answer, or errored — keeps what it has.
-       */
-      for (const inFlightMessageStatus of [
-        AIChatMessageStatus.InProgress,
-        AIChatMessageStatus.WaitingForApproval,
-      ]) {
-        await AIConversationMessageService.updateOneBy({
-          query: {
-            aiRunId: activeRun.id!,
-            status: inFlightMessageStatus,
-          },
-          data: {
-            status: AIChatMessageStatus.Cancelled,
-            contentInMarkdown: STOPPED_BY_USER_TEXT,
-          } as never,
-          props: { isRoot: true },
-        });
-      }
-
-      /*
-       * Terminal event, only when this request actually took the run —
-       * emitting closure over a turn the runner finished would tell the UI a
-       * completed answer failed. RunFailed is the event enum's terminal
-       * "did not finish" member; the summary carries the human reason.
-       */
-      if (cancelledRunCount > 0) {
-        try {
-          const cancelEvent: AIRunEvent = new AIRunEvent();
-          cancelEvent.projectId = projectId;
-          cancelEvent.aiRunId = activeRun.id!;
-          cancelEvent.userId = userId;
-          cancelEvent.sequence = CANCEL_EVENT_SEQUENCE;
-          cancelEvent.eventType = AIRunEventType.RunFailed;
-          cancelEvent.resultSummary = { errorMessage: STOPPED_BY_USER_TEXT };
-
-          await AIRunEventService.create({
-            data: cancelEvent,
-            props: { isRoot: true },
-          });
-        } catch (error) {
-          // Events are progress telemetry — never fail the cancel over them.
-          logger.error(
-            `Failed to emit AI chat cancel event: ${
-              error instanceof Error ? error.message : String(error)
-            }`,
-          );
-        }
-      }
-
       Response.sendJsonObjectResponse(req, res, {
         conversationId: conversationId.toString(),
-        aiRunId: activeRun.id!.toString(),
-        cancelled: cancelledRunCount > 0,
+        aiRunId: cancellation.aiRunId.toString(),
+        cancelled: cancellation.cancelled,
       });
       return;
     } catch (err) {

package/Server/API/AIInvestigationAPI.ts

@@ -194,7 +194,7 @@ export function isAnalysisPendingForRun(data: {
  * incident/alert under THEIR permissions, then read the run + events as root.
  */
 
-async function getLoggedInProps(
+export async function getLoggedInProps(
   req: ExpressRequest,
 ): Promise<DatabaseCommonInteractionProps> {
   const props: DatabaseCommonInteractionProps =
@@ -215,7 +215,7 @@ async function getLoggedInProps(
  * and the subject is then asserted to belong to it, so "whose grants were
  * checked" and "which project was queried" can never diverge.
  */
-function pinPropsToTenant(
+export function pinPropsToTenant(
   props: DatabaseCommonInteractionProps,
 ): DatabaseCommonInteractionProps {
   return { ...props, isMultiTenantRequest: false };
@@ -225,7 +225,7 @@ function pinPropsToTenant(
  * Access check under the VIEWER's tenant-pinned permissions: throws unless
  * they can read the incident/alert AND it belongs to the tenant.
  */
-async function assertSubjectReadableInTenant(data: {
+export async function assertSubjectReadableInTenant(data: {
   subjectType: InvestigationReferenceKind;
   subjectId: ObjectID;
   tenantId: ObjectID;