@oneuptime/common 14.0.9 → 14.0.11

package/Server/Services/StatusPagePrivateUserService.ts

@@ -4,7 +4,6 @@ import { EncryptionSecret } from "../EnvironmentConfig";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
-import EditionEnforcement from "../Utils/EditionEnforcement";
 import logger from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import MailService from "./MailService";
@@ -190,10 +189,8 @@ export class Service extends DatabaseService<Model> {
     /*
      * SCIM and admin-created users must follow the page's login policy too.
      * Do not create a password-reset credential when only SSO can be used.
-     * On the Community Edition there is no SSO login for status pages, so a
-     * leftover requirement is not enforced and the user gets a password link.
      */
-    if (EditionEnforcement.isSsoRequired(statusPage.requireSsoForLogin)) {
+    if (statusPage.requireSsoForLogin) {
       return createdItem;
     }
 

package/Server/Services/StatusPageService.ts

@@ -1,10 +1,9 @@
 import DatabaseConfig from "../DatabaseConfig";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnFind, OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import CookieUtil from "../Utils/Cookie";
-import EditionEnforcement from "../Utils/EditionEnforcement";
 import { ExpressRequest } from "../Utils/Express";
 import JSONWebToken from "../Utils/JsonWebToken";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -115,14 +114,6 @@ export {
   StatusPageReportRow,
 };
 
-/*
- * The status page column that holds its SSO requirement: the one
- * onFindSuccess masks and onBeforeUpdate guards while SSO is not active.
- */
-export const STATUS_PAGE_SSO_REQUIREMENT_COLUMNS: ReadonlyArray<string> = [
-  "requireSsoForLogin",
-];
-
 /*
  * What a report's incident counts read of the status page: which project's
  * incidents to count, and whether the page only shows incidents limited to
@@ -298,36 +289,6 @@ export class Service extends DatabaseService<StatusPage> {
     return this.getDefaultEmailFooterText();
   }
 
-  /*
-   * While SSO is not active a status page's SSO requirement is not enforced:
-   * on the Community Edition (status page SSO login is part of the
-   * Enterprise Edition), and on an Enterprise install whose license is
-   * lapsed or does not include SSO (the SSO routes refuse). Reads made for a
-   * caller then report the EFFECTIVE value: not required. Internal (root)
-   * reads and the stored row keep the real value, and onBeforeUpdate keeps a
-   * caller from writing the masked value back, so running the Enterprise
-   * Edition with a valid license (or in its trial or grace period) again
-   * restores enforcement exactly as configured. The public master-page route
-   * reads as root and applies the same rule itself.
-   */
-  @CaptureSpan()
-  protected override async onFindSuccess(
-    onFind: OnFind<StatusPage>,
-    items: Array<StatusPage>,
-  ): Promise<OnFind<StatusPage>> {
-    if (
-      EditionEnforcement.shouldMaskSsoRequirementOnRead(onFind.findBy.props)
-    ) {
-      for (const item of items) {
-        if (item.requireSsoForLogin !== undefined) {
-          item.requireSsoForLogin = false;
-        }
-      }
-    }
-
-    return { ...onFind, carryForward: items };
-  }
-
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<StatusPage>,
@@ -1130,17 +1091,6 @@ export class Service extends DatabaseService<StatusPage> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<StatusPage>,
   ): Promise<OnUpdate<StatusPage>> {
-    /*
-     * While SSO is not active this caller only ever read the requirement as
-     * off (see onFindSuccess), so a write of it must not switch the stored
-     * requirement off, or set one nobody could see. Drops or refuses it.
-     */
-    EditionEnforcement.guardSsoRequirementWrite({
-      props: updateBy.props,
-      data: updateBy.data as unknown as Record<string, unknown>,
-      columns: STATUS_PAGE_SSO_REQUIREMENT_COLUMNS,
-    });
-
     // is enabling SMS subscribers.
 
     if (updateBy.data.enableSmsSubscribers) {

package/Server/Services/TeamComplianceSettingService.ts

@@ -24,18 +24,25 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 /*
  * The part of a compliance rule that decides what it checks: its type, the
- * channel it insists on (null = any) and the severities it is scoped to
+ * channels it insists on (empty = any) and the severities it is scoped to
  * (empty = every severity of its kind). Two rules with the same scope check
  * exactly the same thing, which is what "duplicate" means here.
  */
 export interface ComplianceRuleScope {
   ruleType: ComplianceRuleType;
-  notificationChannel: ComplianceNotificationChannel | null;
+  // In catalog order, each once (ComplianceRule.normaliseChannels).
+  notificationChannels: Array<ComplianceNotificationChannel>;
   severityKind: ComplianceSeverityKind | null;
   // Sorted, de-duplicated ids of the severity list the rule's kind uses.
   severityIds: Array<string>;
 }
 
+// The two columns a rule's channels are stored in.
+export interface StoredChannelColumns {
+  notificationChannels?: unknown;
+  notificationChannel?: unknown;
+}
+
 // A severity about to be deleted, as the severity services read it.
 export interface DeletedSeverity {
   _id?: string | undefined;
@@ -122,10 +129,10 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
       createBy.data.ruleType,
     );
 
-    this.assertValidChannel(createBy.data.notificationChannel);
+    TeamComplianceSettingService.normaliseChannelFields(createBy.data);
 
     /*
-     * Normalise before anything is stored: a method rule carries no channel
+     * Normalise before anything is stored: a method rule carries no channels
      * or severities, and an incident rule carries no alert severities. The
      * form hides the fields that do not apply, but the API accepts whatever it
      * is sent, and a stray alert severity on an incident rule would otherwise
@@ -150,7 +157,9 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
     const scope: ComplianceRuleScope = TeamComplianceSettingService.getScope({
       ruleType: ruleType,
-      notificationChannel: createBy.data.notificationChannel,
+      notificationChannels: TeamComplianceSettingService.getStoredChannels(
+        createBy.data,
+      ),
       incidentSeverities: createBy.data.incidentSeverities,
       alertSeverities: createBy.data.alertSeverities,
     });
@@ -183,6 +192,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
     const changesScope: boolean =
       data["ruleType"] !== undefined ||
+      data["notificationChannels"] !== undefined ||
       data["notificationChannel"] !== undefined ||
       data["incidentSeverities"] !== undefined ||
       data["alertSeverities"] !== undefined;
@@ -211,7 +221,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
         ? this.assertKnownRuleType(data["ruleType"])
         : undefined;
 
-    this.assertValidChannel(data["notificationChannel"]);
+    TeamComplianceSettingService.normaliseChannelFields(data);
 
     if (newRuleType) {
       /*
@@ -237,6 +247,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
         teamId: true,
         projectId: true,
         ruleType: true,
+        notificationChannels: true,
         notificationChannel: true,
         options: true,
         incidentSeverities: {
@@ -328,10 +339,10 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
       const scope: ComplianceRuleScope = TeamComplianceSettingService.getScope({
         ruleType: ruleType,
-        notificationChannel:
-          data["notificationChannel"] !== undefined
-            ? data["notificationChannel"]
-            : existing.notificationChannel,
+        // Sent as a pair by normaliseChannelFields, or not at all.
+        notificationChannels: TeamComplianceSettingService.getStoredChannels(
+          data["notificationChannels"] !== undefined ? data : existing,
+        ),
         incidentSeverities:
           data["incidentSeverities"] !== undefined
             ? data["incidentSeverities"]
@@ -727,7 +738,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
     for (const group of toPause.values()) {
       /*
-       * Neither the type, the channel nor a severity list: the update hook
+       * Neither the type, the channels nor a severity list: the update hook
        * reads nothing for it. (Cast: the write type of a JSON column is too
        * deep for the compiler to spell out.)
        */
@@ -754,23 +765,24 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
   /*
    * What a rule checks, from its stored (or about-to-be-stored) fields. Only
-   * the options its type uses count: a channel on a method rule, or alert
+   * the options its type uses count: channels on a method rule, or alert
    * severities on an incident rule, change nothing about what is checked.
+   * `notificationChannels` is a list; see getStoredChannels for reading one
+   * off a row.
    */
   public static getScope(data: {
     ruleType: ComplianceRuleType;
-    notificationChannel: unknown;
+    notificationChannels: unknown;
     incidentSeverities: unknown;
     alertSeverities: unknown;
   }): ComplianceRuleScope {
     const severityKind: ComplianceSeverityKind | undefined =
       ComplianceRule.getSeverityKind(data.ruleType);
 
-    const notificationChannel: ComplianceNotificationChannel | null =
-      ComplianceRule.supportsChannel(data.ruleType) &&
-      ComplianceRule.isKnownChannel(data.notificationChannel)
-        ? data.notificationChannel
-        : null;
+    const notificationChannels: Array<ComplianceNotificationChannel> =
+      ComplianceRule.supportsChannel(data.ruleType)
+        ? ComplianceRule.normaliseChannels(data.notificationChannels)
+        : [];
 
     let severityIds: Array<string> = [];
 
@@ -784,23 +796,144 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
     return {
       ruleType: data.ruleType,
-      notificationChannel: notificationChannel,
+      notificationChannels: notificationChannels,
       severityKind: severityKind || null,
       severityIds: severityIds,
     };
   }
 
+  /*
+   * Both lists are canonical - channels in catalog order, severity ids sorted
+   * - so the same selection compares equal however it was picked.
+   */
   public static isSameScope(
     a: ComplianceRuleScope,
     b: ComplianceRuleScope,
   ): boolean {
     return (
       a.ruleType === b.ruleType &&
-      a.notificationChannel === b.notificationChannel &&
+      a.notificationChannels.join(",") === b.notificationChannels.join(",") &&
       a.severityIds.join(",") === b.severityIds.join(",")
     );
   }
 
+  /*
+   * CHANNELS. What a rule insists on is the list in notificationChannels -
+   * every one of them - and the older notificationChannel column holds the
+   * first of that list, for everything that only knows the one column (see
+   * the model). What follows keeps the two in step.
+   */
+
+  /*
+   * The channels a row holds, from its two columns. Every build that knows
+   * the list writes the pair together, the single column always the list's
+   * first channel. A build that does not - an older replica still serving
+   * during an upgrade, or a downgrade - writes only the single column and
+   * leaves the list as it was. So a row with no list, or whose list the
+   * single column no longer agrees with, was last written by such a build,
+   * and its single column is what the rule says; otherwise the list is.
+   * Rows from before the list existed have it backfilled by
+   * AddTeamComplianceRuleNotificationChannels.
+   *
+   * The comparison is on the stored values, before anything unknown is
+   * dropped, so a list a newer build wrote with a channel this one does not
+   * know still counts - for the channels it does know.
+   */
+  public static getStoredChannels(
+    row: StoredChannelColumns,
+  ): Array<ComplianceNotificationChannel> {
+    const single: unknown = row.notificationChannel ?? null;
+
+    if (Array.isArray(row.notificationChannels)) {
+      const first: unknown = row.notificationChannels[0] ?? null;
+
+      if (first === single) {
+        return ComplianceRule.normaliseChannels(row.notificationChannels);
+      }
+    }
+
+    return ComplianceRule.isKnownChannel(single) ? [single] : [];
+  }
+
+  /*
+   * The channels a SENT list asks for, as the list that will be stored:
+   * catalog order, each once (the order they were picked in is not part of
+   * the rule). Null is no channels - any channel. Anything else that is not
+   * a list of channels this build knows is refused rather than dropped: a
+   * list that silently lost a channel checks less than the admin asked for,
+   * and one that lost its only channel checks every channel.
+   */
+  public static resolveSentChannels(
+    value: unknown,
+  ): Array<ComplianceNotificationChannel> {
+    if (value === null) {
+      return [];
+    }
+
+    if (!Array.isArray(value)) {
+      throw new BadDataException(
+        "The notification channels of a compliance rule must be a list of channels.",
+      );
+    }
+
+    for (const item of value) {
+      TeamComplianceSettingService.assertKnownChannel(item);
+    }
+
+    return ComplianceRule.normaliseChannels(value);
+  }
+
+  /*
+   * Rewrites whichever channel column a payload sends into the pair that is
+   * stored: the list, and the single column set to its first channel. A
+   * payload that sends the list is taken at its list, whatever single
+   * channel rides along - a client that read a rule and sends it back sends
+   * both, and after the list changes the single one it holds is stale. One
+   * that sends only the single column (a client from before the list, or an
+   * older Dashboard) asks for exactly that channel, or for any channel when
+   * it is null. A payload that sends neither leaves both unsent.
+   */
+  public static normaliseChannelFields(data: Model | JSONObject): void {
+    const target: JSONObject = data as JSONObject;
+    const sentList: unknown = target["notificationChannels"];
+    const sentSingle: unknown = target["notificationChannel"];
+
+    if (sentList === undefined && sentSingle === undefined) {
+      return;
+    }
+
+    // Null / undefined is "any channel"; anything else must be a channel.
+    if (sentSingle !== undefined && sentSingle !== null) {
+      TeamComplianceSettingService.assertKnownChannel(sentSingle);
+    }
+
+    let channels: Array<ComplianceNotificationChannel> = [];
+
+    if (sentList !== undefined) {
+      channels = TeamComplianceSettingService.resolveSentChannels(sentList);
+    } else if (ComplianceRule.isKnownChannel(sentSingle)) {
+      channels = [sentSingle];
+    }
+
+    TeamComplianceSettingService.setChannels(target, channels);
+  }
+
+  private static setChannels(
+    target: JSONObject,
+    channels: Array<ComplianceNotificationChannel>,
+  ): void {
+    target["notificationChannels"] = channels;
+    target["notificationChannel"] = channels[0] ?? null;
+  }
+
+  private static assertKnownChannel(value: unknown): void {
+    if (!ComplianceRule.isKnownChannel(value)) {
+      throw new BadDataException(
+        `"${String(value)}" is not a notification channel a compliance rule can require.`,
+      );
+    }
+  }
+
   /*
    * Severity ids from a severity list as it is STORED (or once a payload has
    * been through normaliseSeverityLists): an id string, an ObjectID, a model,
@@ -992,22 +1125,10 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
     return value;
   }
 
-  // Null / undefined is "any channel" and always valid.
-  private assertValidChannel(value: unknown): void {
-    if (value === undefined || value === null) {
-      return;
-    }
-
-    if (!ComplianceRule.isKnownChannel(value)) {
-      throw new BadDataException(
-        `"${String(value)}" is not a notification channel a compliance rule can require.`,
-      );
-    }
-  }
-
   /*
    * `clearUnsentOptions` also clears the options `data` does not mention, so
    * an update writes them empty on the row instead of leaving what is stored.
+   * Channels arrive here already paired by normaliseChannelFields.
    */
   private clearOptionsThatDoNotApply(
     data: Model | JSONObject,
@@ -1018,14 +1139,12 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
     const severityKind: ComplianceSeverityKind | undefined =
       ComplianceRule.getSeverityKind(ruleType);
 
-    if (!ComplianceRule.supportsChannel(ruleType)) {
-      if (
-        options.clearUnsentOptions ||
-        (target["notificationChannel"] !== undefined &&
-          target["notificationChannel"] !== null)
-      ) {
-        target["notificationChannel"] = null;
-      }
+    if (
+      !ComplianceRule.supportsChannel(ruleType) &&
+      (options.clearUnsentOptions ||
+        target["notificationChannels"] !== undefined)
+    ) {
+      TeamComplianceSettingService.setChannels(target, []);
     }
 
     if (
@@ -1112,6 +1231,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
       select: {
         _id: true,
         ruleType: true,
+        notificationChannels: true,
         notificationChannel: true,
         options: true,
         incidentSeverities: {
@@ -1142,7 +1262,8 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
       const siblingScope: ComplianceRuleScope =
         TeamComplianceSettingService.getScope({
           ruleType: data.scope.ruleType,
-          notificationChannel: sibling.notificationChannel,
+          notificationChannels:
+            TeamComplianceSettingService.getStoredChannels(sibling),
           incidentSeverities: sibling.incidentSeverities,
           alertSeverities: sibling.alertSeverities,
         });

package/Server/Services/TelemetryUsageBillingService.ts

@@ -44,6 +44,7 @@ import IoTFleet from "../../Models/DatabaseModels/IoTFleet";
 import CephCluster from "../../Models/DatabaseModels/CephCluster";
 import DatabaseServer from "../../Models/DatabaseModels/DatabaseServer";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import SessionReplayBudgetMetricTypeUtil from "../../Utils/SessionReplay/SessionReplayBudgetMetricType";
 import {
   AverageSpanRowSizeInBytes,
   AverageLogRowSizeInBytes,
@@ -96,6 +97,27 @@ export const isTelemetryBillingExcludedEntityType: IsTelemetryBillingExcludedEnt
     );
   };
 
+/*
+ * Metric names whose rows are never billed as ingested volume. The session
+ * replay budget sweep posts its oneuptime.rum.session.replay.budget.*
+ * readings every five minutes: OneUptime's own operational data about the
+ * customer's replay budget, like the SLO rows above, and billing them would
+ * charge a project for having recorded a replay.
+ *
+ * Left out by NAME, not by type: the rows keep primaryEntityType =
+ * RealUserMonitor, keyed to the application, so monitors scoped to that
+ * application see them - and the application's real web-vitals rows share
+ * that id and type, so an entity-type exclusion would stop billing those
+ * too. That is only safe because nothing but the budget sweep can write a
+ * name under the session replay prefix (isReservedMetricName in
+ * Common/Utils/SessionReplay/SessionReplayBudgetMetricType): OTLP ingest drops them,
+ * and a metric or trace recording rule cannot be saved with one as its
+ * output. So no customer telemetry can be stored under one of these names to
+ * be kept for free.
+ */
+export const TELEMETRY_BILLING_EXCLUDED_METRIC_NAMES: ReadonlyArray<string> =
+  SessionReplayBudgetMetricTypeUtil.getAll();
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -329,12 +351,18 @@ export class Service extends DatabaseService<Model> {
           averageRowSizeInBytes,
         );
       } else if (data.productType === ProductType.Metrics) {
+        /*
+         * The session replay budget rows share their RUM application's
+         * (primaryEntityId, primaryEntityType) with its web vitals, so they
+         * can only be told apart - and left out - inside the scan.
+         */
         addUsage(
           await MetricService.groupTelemetryUsageByService({
             projectId: data.projectId,
             timestampColumnName: "time",
             startDate: startOfDay,
             endDate: endOfDay,
+            excludeNames: [...TELEMETRY_BILLING_EXCLUDED_METRIC_NAMES],
           }),
           averageRowSizeInBytes,
         );

package/Server/Services/TraceRecordingRuleService.ts

@@ -1,10 +1,43 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/TraceRecordingRule";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { Service as MetricRecordingRuleService } from "./MetricRecordingRuleService";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  /*
+   * A trace recording rule writes a metric too, and straight into the metric
+   * store: it may not claim a reserved session replay name any more than a
+   * metric recording rule may (MetricRecordingRuleService).
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    MetricRecordingRuleService.assertOutputMetricNameAllowed(
+      createBy.data.outputMetricName,
+    );
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    // Only an update that sets the name can make it reserved.
+    MetricRecordingRuleService.assertOutputMetricNameAllowed(
+      (updateBy.data as unknown as Record<string, unknown>)["outputMetricName"],
+    );
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();

package/Server/Services/UserNotificationRuleService.ts

@@ -7,6 +7,7 @@ import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import TenantPermission from "../Types/Database/Permissions/TenantPermission";
 import Markdown, { MarkdownContentType } from "../Types/Markdown";
+import { escapeMarkdownValue } from "../../Utils/Markdown/MarkdownEscape";
 import CallService from "./CallService";
 import DatabaseService from "./DatabaseService";
 import IncidentService from "./IncidentService";
@@ -4218,7 +4219,13 @@ export class Service extends DatabaseService<Model> {
     const lines: Array<string> = [
       `🚨 **${data.headline}**`,
       "",
-      `📋 **${data.identifier}**`,
+      /*
+       * The identifier ends with a title - plain text, which anyone holding
+       * an incident form's link may have typed - escaped as MarkdownEscape
+       * says a title must be, so it cannot become an image or a link that
+       * hides where it goes.
+       */
+      `📋 **${escapeMarkdownValue(data.identifier)}**`,
       "",
       "👤 You're getting this because you're on call.",
     ];