@oneuptime/common 14.0.9 → 14.0.11

package/Server/Middleware/TelemetryIngest.ts

@@ -74,8 +74,9 @@ const UNNAMED_SURFACE_READABLE_NAME: string = "this ingest endpoint";
 
 /*
  * The ceiling a server key gets on an identity registration surface
- * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner and the
- * Kubernetes AI agent) when its policy names none. Registration is a handful
+ * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner, the
+ * Kubernetes AI agent and the resource AI agents) when its policy names
+ * none. Registration is a handful
  * of calls per pod lifetime (start-up, then heartbeats through the minted
  * identity's own key), so a leaked ingestion key hammering it is abuse, not
  * traffic - unlike OTLP ingest, where "no limit" is the historical contract
@@ -90,11 +91,19 @@ export const DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE: number =
 /*
  * The refusal a service-pinned key gets on an identity registration surface.
  * Worded for whichever identity the surface mints, and it never names the
- * key, its pinned service or anything else about it.
+ * key, its pinned service or anything else about it. The Kubernetes
+ * surfaces keep their wording exactly; a resource AI agent (Docker, Proxmox,
+ * a database, a host, ...) is told about infrastructure instead.
  */
 export const getPinnedKeyRegistrationRefusalMessage: (
   surface: TelemetryIngestSurface,
 ) => string = (surface: TelemetryIngestSurface): string => {
+  if (surface === TelemetryIngestSurface.ResourceAiAgent) {
+    return `This telemetry ingestion key is pinned to a single service, so it cannot be used for ${getIngestSurfaceReadableName(
+      surface,
+    )}: that grants access to your infrastructure, not to one service's telemetry. Use an unpinned server ingestion key for the AI agent.`;
+  }
+
   return `This telemetry ingestion key is pinned to a single service, so it cannot be used for ${getIngestSurfaceReadableName(
     surface,
   )}: that grants access to a Kubernetes cluster, not to one service's telemetry. Use an unpinned server ingestion key for the Kubernetes agent.`;
@@ -121,8 +130,9 @@ type GetEffectiveRequestsPerMinuteLimitFunction = (
  * did not configure a limit" cannot be allowed to mean "unlimited" there.
  *
  * The one surface-dependent case is identity registration
- * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner and the
- * Kubernetes AI agent): a server key with no configured limit is held to a
+ * (IDENTITY_REGISTRATION_SURFACES: the Kubernetes agent Runner, the
+ * Kubernetes AI agent and the resource AI agents): a server key with no
+ * configured limit is held to a
  * conservative default there (see
  * DEFAULT_IDENTITY_REGISTRATION_REQUESTS_PER_MINUTE), because those
  * endpoints mint identities rather than accepting telemetry. Every other

package/Server/Middleware/UserAuthorization.ts

@@ -42,7 +42,6 @@ import Permission, {
 } from "../../Types/Permission";
 import UserType from "../../Types/UserType";
 import UserPermissionUtil from "../Utils/UserPermission/UserPermission";
-import EditionEnforcement from "../Utils/EditionEnforcement";
 
 export default class UserMiddleware {
   /*
@@ -931,21 +930,10 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
-    /*
-     * SSO requirements are enforced while SSO is active: the Enterprise
-     * Edition is loaded and its license covers SSO (or billing is on). The
-     * Community Edition, which has no SSO login routes, and an Enterprise
-     * install whose license lapsed, where those routes refuse, relax them.
-     * Errors and an unknown license state answer "enforce".
-     */
-    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
-
     /*
      * Resolve the SSO requirement and the tenant permission in parallel.
      * `getRequireSsoForLogin` is cached in-process for 60s, so this is
-     * usually free; the tenant permission lookup is the expensive call. It
-     * runs on the Community Edition too: it is also what turns an unknown
-     * project into TenantNotFoundException.
+     * usually free; the tenant permission lookup is the expensive call.
      */
     const [projectRequireSsoForLogin, tenantPermission]: [
       boolean,
@@ -972,9 +960,8 @@ export default class UserMiddleware {
      * can't lock them out — a project's own requireSsoForLogin still applies to
      * them. Only checked when the project doesn't already enforce SSO.
      */
-    let requireSsoForLogin: boolean =
-      isSsoEnforced && projectRequireSsoForLogin;
-    if (isSsoEnforced && !requireSsoForLogin && !isMasterAdmin) {
+    let requireSsoForLogin: boolean = projectRequireSsoForLogin;
+    if (!requireSsoForLogin && !isMasterAdmin) {
       requireSsoForLogin =
         await GlobalConfigService.getRequireSsoForLogin().catch(() => {
           return false;
@@ -1023,23 +1010,15 @@ export default class UserMiddleware {
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
 
-    /*
-     * Same rule as the single-tenant path: SSO requirements are enforced
-     * while SSO is active and relaxed on the Community Edition and while the
-     * license does not cover SSO. Decided once for the whole fan-out.
-     */
-    const isSsoEnforced: boolean = EditionEnforcement.isSsoEnforced();
-
     /*
      * Instance-wide "Require SSO for Login" forces SSO on every project. Master
      * admins are exempt. Resolved once (cached) rather than per project.
      */
-    const globalRequireSsoForLogin: boolean =
-      isMasterAdmin || !isSsoEnforced
-        ? false
-        : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
-            return false;
-          });
+    const globalRequireSsoForLogin: boolean = isMasterAdmin
+      ? false
+      : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
+          return false;
+        });
 
     /*
      * Resolve permissions for every project in parallel. A project's own
@@ -1051,15 +1030,14 @@ export default class UserMiddleware {
       permission: UserTenantAccessPermission | null;
     }> = await Promise.all(
       projectIds.map(async (projectId: ObjectID) => {
-        const projectRequireSsoForLogin: boolean = !isSsoEnforced
-          ? false
-          : await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
-              /*
-               * Unknown/inaccessible project: do not enforce SSO here. Actual
-               * access is still gated by AccessTokenService below.
-               */
-              return false;
-            });
+        const projectRequireSsoForLogin: boolean =
+          await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
+            /*
+             * Unknown/inaccessible project: do not enforce SSO here. Actual
+             * access is still gated by AccessTokenService below.
+             */
+            return false;
+          });
 
         const requireSsoForLogin: boolean =
           projectRequireSsoForLogin || globalRequireSsoForLogin;

package/Server/Services/AIService.ts

@@ -188,7 +188,7 @@ export const LEGACY_AUTONOMOUS_AI_FEATURES: Array<string> = [
 /*
  * Features that run WITHOUT a human in the loop. Incident-linked and
  * alert-linked calls use their respective daily token limits; subjectless
- * calls use Project.aiDailyAutonomousTokenLimit. Interactive chat and
+ * calls have no daily token limit. Interactive chat and
  * explicitly user-triggered AI are never budget-blocked.
  * Auto-postmortem is deliberately excluded for now: it is one call per
  * resolved incident, not storm-shaped; include it when it moves to the queue.
@@ -571,24 +571,23 @@ export class Service extends BaseService {
   ): Promise<AutonomousBudgetStatus> {
     this.assertSingleSubject(subject);
 
+    // Subjectless autonomous work has no daily token limit.
+    if (!subject?.incidentId && !subject?.alertId) {
+      return { exhausted: false, limitInTokens: null, usedTokensToday: 0 };
+    }
+
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
       select: {
-        aiDailyAutonomousTokenLimit: true,
         incidentAiDailyAutonomousTokenLimit: true,
         alertAiDailyAutonomousTokenLimit: true,
       },
       props: { isRoot: true },
     });
 
-    let limitInTokens: number | null =
-      project?.aiDailyAutonomousTokenLimit ?? null;
-
-    if (subject?.incidentId) {
-      limitInTokens = project?.incidentAiDailyAutonomousTokenLimit ?? null;
-    } else if (subject?.alertId) {
-      limitInTokens = project?.alertAiDailyAutonomousTokenLimit ?? null;
-    }
+    const limitInTokens: number | null = subject?.incidentId
+      ? project?.incidentAiDailyAutonomousTokenLimit ?? null
+      : project?.alertAiDailyAutonomousTokenLimit ?? null;
 
     if (limitInTokens === null) {
       return { exhausted: false, limitInTokens: null, usedTokensToday: 0 };
@@ -783,9 +782,7 @@ export class Service extends BaseService {
       if (budget.exhausted) {
         const settingsLocation: string = request.incidentId
           ? "Incidents > AI > Investigation"
-          : request.alertId
-            ? "Alerts > AI > Investigation"
-            : "Project Settings > AI > AI Guardrails";
+          : "Alerts > AI > Investigation";
         const budgetMessage: string = `Daily autonomous AI token budget exhausted (${budget.usedTokensToday.toLocaleString()} of ${budget.limitInTokens?.toLocaleString()} tokens used today). Autonomous AI requests resume tomorrow (UTC) — raise or unset the limit under ${settingsLocation}.`;
 
         logEntry.status = LlmLogStatus.BudgetExceeded;

package/Server/Services/AnalyticsDatabaseService.ts

@@ -685,6 +685,16 @@ export default class AnalyticsDatabaseService<
     timestampColumnName: keyof TBaseModel | string;
     startDate: Date;
     endDate: Date;
+    /*
+     * Row names left out of the scan entirely, for a table where OneUptime
+     * writes its own rows under the same (primaryEntityId, primaryEntityType)
+     * as the customer's, so the grouping cannot tell them apart and the
+     * caller's entity-type exclusion cannot either - the session replay
+     * budget series sit next to a RUM application's web vitals (see
+     * TELEMETRY_BILLING_EXCLUDED_METRIC_NAMES). Empty or absent leaves the
+     * statement exactly as it was.
+     */
+    excludeNames?: Array<string> | undefined;
   }): Promise<
     Array<{
       primaryEntityId: string;
@@ -701,6 +711,24 @@ export default class AnalyticsDatabaseService<
       );
     }
 
+    const excludeNames: Array<string> = data.excludeNames || [];
+
+    /*
+     * Names can only be excluded from a table whose `name` is a required
+     * column. Without one ClickHouse fails on the unknown column mid-billing
+     * run; with a Nullable one (Span's), `NULL NOT IN (...)` is not true, so
+     * every unnamed row would silently drop out of the bill. Either way the
+     * caller has a bug, so refuse before the scan.
+     */
+    if (
+      excludeNames.length > 0 &&
+      !this.model.getTableColumn("name")?.required
+    ) {
+      throw new BadDataException(
+        `excludeNames needs a required name column, and ${this.model.tableName} has none`,
+      );
+    }
+
     if (!this.database) {
       this.useDefaultDatabase();
     }
@@ -716,7 +744,23 @@ export default class AnalyticsDatabaseService<
     }} AND ${timestampColumnName} <= ${{
       type: TableColumnType.DateTime64,
       value: data.endDate,
-    }} GROUP BY primaryEntityId, primaryEntityType`;
+    }}`;
+
+    /*
+     * Inside the WHERE, before the grouping, so an excluded row is never
+     * counted or sized. The names travel as one Array(String) parameter,
+     * never as SQL text.
+     */
+    if (excludeNames.length > 0) {
+      statement.append(
+        SQL` AND name NOT IN ${{
+          type: TableColumnType.ArrayText,
+          value: excludeNames,
+        }}`,
+      );
+    }
+
+    statement.append(SQL` GROUP BY primaryEntityId, primaryEntityType`);
 
     /*
      * Billing scan: deliberately NO timeout_overflow_mode='break'. A