@oneuptime/common 14.0.9 → 14.0.11

package/Server/Services/VMwareVCenterService.ts

@@ -3,7 +3,15 @@ import VMwareVCenterLabelRuleEngineService from "./VMwareVCenterLabelRuleEngineS
 import VMwareVCenterOwnerRuleEngineService from "./VMwareVCenterOwnerRuleEngineService";
 import Model from "../../Models/DatabaseModels/VMwareVCenter";
 import Label from "../../Models/DatabaseModels/Label";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import ResourceAiAccessSettings, {
+  ResourceAiAccessFeedItem,
+} from "../Utils/AI/ResourceAccess/ResourceAiAccessSettings";
+import ResourceAiDeleteCleanup from "../Utils/AI/ResourceAccess/ResourceAiDeleteCleanup";
+import AiResourceType from "../../Types/ResourceAiAgent/AiResourceType";
 import VMwareVCenterFeedService from "./VMwareVCenterFeedService";
 import { VMwareVCenterFeedEventType } from "../../Models/DatabaseModels/VMwareVCenterFeed";
 import ResourceFeedUtil from "../Utils/ResourceFeed/ResourceFeedUtil";
@@ -513,6 +521,79 @@ export class Service extends DatabaseService<Model> {
     });
   }
 
+  /*
+   * Deleting a vCenter settles its in-flight AI remediation rounds and removes
+   * its resource AI agent — read before the delete, done after it for the
+   * vCenters actually deleted (ResourceAiDeleteCleanup, shared by every
+   * resource AI agent's resource).
+   */
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    return {
+      deleteBy,
+      carryForward: await ResourceAiDeleteCleanup.beforeDelete({
+        resourceType: AiResourceType.VMwareVCenter,
+        service: this,
+        deleteBy,
+      }),
+    };
+  }
+
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<Model>,
+    deletedItemIds: Array<ObjectID>,
+  ): Promise<OnDelete<Model>> {
+    await ResourceAiDeleteCleanup.afterDelete({
+      resourceType: AiResourceType.VMwareVCenter,
+      onDelete,
+      deletedItemIds,
+    });
+
+    return onDelete;
+  }
+
+  /*
+   * A create is held to the same AI access rules as an update, judged
+   * against the never-configured defaults a new vCenter starts from: an
+   * unusable mode or allowlist is refused for every caller, and the
+   * server-only aiAccess* columns for every caller but root (a master admin
+   * included, whom the create column ACLs never check).
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    ResourceAiAccessSettings.checkCreate({
+      resourceType: AiResourceType.VMwareVCenter,
+      createBy,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  /*
+   * An operator's write of an AI access setting (the investigation switch, the
+   * remediation mode, the command allowlist) is validated and checked against
+   * who may make AI do more on this vCenter — the rules every resource AI
+   * agent's resource shares (ResourceAiAccessSettings).
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    return {
+      updateBy,
+      carryForward: await ResourceAiAccessSettings.checkUpdate({
+        resourceType: AiResourceType.VMwareVCenter,
+        service: this,
+        updateBy,
+      }),
+    };
+  }
+
   @CaptureSpan()
   protected override async onUpdateSuccess(
     onUpdate: OnUpdate<Model>,
@@ -524,6 +605,34 @@ export class Service extends DatabaseService<Model> {
       },
     );
 
+    /*
+     * An operator's AI access write: recorded on the feed, and the vCenter
+     * marked AI-configured.
+     */
+    await ResourceAiAccessSettings.afterUpdate({
+      service: this,
+      onUpdate,
+      updatedItemIds,
+      getResourceMarkdownLink: (
+        projectId: ObjectID,
+        vmwareVCenterId: ObjectID,
+      ): Promise<string> => {
+        return this.getVMwareVCenterMarkdownLink(projectId, vmwareVCenterId);
+      },
+      createFeedItem: async (item: ResourceAiAccessFeedItem): Promise<void> => {
+        await VMwareVCenterFeedService.createVMwareVCenterFeedItem({
+          vmwareVCenterId: item.resourceId,
+          projectId: item.projectId,
+          vmwareVCenterFeedEventType:
+            VMwareVCenterFeedEventType.VMwareVCenterUpdated,
+          displayColor: item.displayColor,
+          feedInfoInMarkdown: item.feedInfoInMarkdown,
+          moreInformationInMarkdown: item.moreInformationInMarkdown,
+          userId: item.userId,
+        });
+      },
+    });
+
     return onUpdate;
   }
 

package/Server/Services/WorkspaceNotificationSummaryService.ts

@@ -812,8 +812,16 @@ export class Service extends DatabaseService<WorkspaceNotificationSummary> {
           .toString();
         const td: TimelineData | undefined = tlMap.get(id);
 
-        // Title line with link
-        let text: string = `${Service.bold(Service.link(linkUrl, `${display} — ${inc.title || "Untitled"}`))}`;
+        /*
+         * Title line with link. The title - plain text, which anyone
+         * holding an incident form's link may have typed - sits inside the
+         * link's text, so it is escaped like the names in these summaries:
+         * a "]" cannot end that text early and point the rest somewhere
+         * else, and "![...](...)" is no image. (Escaping brackets alone is
+         * not enough inside a link's text: marked, for one, undoes "\[" and
+         * "\]" there before reading it.)
+         */
+        let text: string = `${Service.bold(Service.link(linkUrl, `${display} — ${escapeMarkdownInline(inc.title || "Untitled")}`))}`;
 
         // Meta line
         const meta: Array<string> = [];
@@ -998,7 +1006,8 @@ export class Service extends DatabaseService<WorkspaceNotificationSummary> {
           .addRoute(`/${projectId.toString()}/incidents/episodes/${id}`)
           .toString();
 
-        let text: string = `${Service.bold(Service.link(linkUrl, ep.title || "Untitled Episode"))}`;
+        // The title inside the link's text, escaped as an incident's is.
+        let text: string = `${Service.bold(Service.link(linkUrl, escapeMarkdownInline(ep.title || "Untitled Episode")))}`;
         const meta: Array<string> = [];
         if (ep.incidentSeverity?.name) {
           meta.push(`Severity: ${Service.bold(ep.incidentSeverity.name)}`);

package/Server/Types/Database/Permissions/CreatePermission.ts

@@ -18,9 +18,10 @@ export default class CreatePermission {
   ): void {
     /*
      * Master admins skip every table-level check below, but not the edition
-     * check: creating enterprise configuration (global SSO/OIDC providers
-     * are only ever created by master admins) needs the license for them
-     * too. Everyone else gets the same check through TablePermission.
+     * check: creating enterprise configuration (a master admin can create
+     * SCIM configuration and team compliance settings on any project) needs
+     * the license for them too. Everyone else gets the same check through
+     * TablePermission.
      */
     if (props.isMasterAdmin && !props.isRoot) {
       EditionPermissions.checkEditionPermissions(
@@ -28,6 +29,12 @@ export default class CreatePermission {
         props,
         DatabaseRequestType.Create,
       );
+      EditionPermissions.checkEnterpriseColumnPermissions(
+        modelType,
+        props,
+        DatabaseRequestType.Create,
+        data,
+      );
     }
 
     // If system is making this query then let the query run!
@@ -44,6 +51,13 @@ export default class CreatePermission {
       DatabaseRequestType.Create,
     );
 
+    EditionPermissions.checkEnterpriseColumnPermissions(
+      modelType,
+      props,
+      DatabaseRequestType.Create,
+      data,
+    );
+
     ColumnPermissions.checkDataColumnPermissions(
       modelType,
       data,

package/Server/Types/Database/Permissions/EditionPermission.ts

@@ -13,15 +13,6 @@ import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 // Whether one column value of an update can only tighten security.
 export type TightenOnlyColumnRule = (value: unknown) => boolean;
 
-/*
- * Switching an identity provider off (isEnabled: false). Switching one on is
- * configuration and needs the license; only the literal false counts, so a
- * value the database might coerce ("false", 0) is judged by the full check.
- */
-const isSwitchingOff: TightenOnlyColumnRule = (value: unknown): boolean => {
-  return value === false;
-};
-
 /*
  * The shortest SCIM bearer token a rotation may set without the license. The
  * Dashboard's "Reset token" generates a UUID (36 characters) and services
@@ -46,10 +37,8 @@ const isRotatedBearerToken: TightenOnlyColumnRule = (
  * incident-response moves. Keyed by table name, like the facade's feature
  * map; a model that is not listed has none.
  *
- *   isEnabled: false   disable an SSO/OIDC provider (project, status page or
- *                      global), or a global provider's attachment to a
- *                      project.
- *   bearerToken        rotate a leaked SCIM bearer token.
+ *   bearerToken        rotate a leaked SCIM bearer token (project or status
+ *                      page SCIM).
  *
  * TeamComplianceSetting has no entry: switching a compliance rule off
  * relaxes it.
@@ -58,14 +47,6 @@ const TIGHTEN_ONLY_UPDATES: ReadonlyMap<
   string,
   Readonly<Record<string, TightenOnlyColumnRule>>
 > = new Map<string, Readonly<Record<string, TightenOnlyColumnRule>>>([
-  ["GlobalSSO", { isEnabled: isSwitchingOff }],
-  ["GlobalOIDC", { isEnabled: isSwitchingOff }],
-  ["GlobalSSOProject", { isEnabled: isSwitchingOff }],
-  ["GlobalOIDCProject", { isEnabled: isSwitchingOff }],
-  ["ProjectSSO", { isEnabled: isSwitchingOff }],
-  ["ProjectOIDC", { isEnabled: isSwitchingOff }],
-  ["StatusPageSSO", { isEnabled: isSwitchingOff }],
-  ["StatusPageOIDC", { isEnabled: isSwitchingOff }],
   ["ProjectSCIM", { bearerToken: isRotatedBearerToken }],
   ["StatusPageSCIM", { bearerToken: isRotatedBearerToken }],
 ]);
@@ -73,29 +54,28 @@ const TIGHTEN_ONLY_UPDATES: ReadonlyMap<
 export default class EditionPermissions {
   /*
    * Gates the enterprise CONFIGURATION models, the ones marked with
-   * @TableEditionAccessControl({ requiresEnterprise: true }): project, global
-   * and status page SSO/OIDC providers, SCIM configurations and team
-   * compliance settings.
+   * @TableEditionAccessControl({ requiresEnterprise: true }): project and
+   * status page SCIM configurations and team compliance settings.
    *
    * Only creating and updating them needs the license. Reading and deleting
    * are always allowed, so an install that dropped to the Community Edition,
    * or whose license lapsed, can still see what it has configured and remove
    * it. Only configuration is gated here, and none of it is ever deleted.
    * Whether what exists RUNS is decided at runtime by
-   * EnterpriseEdition.isFeatureActive: SSO, SCIM and audit logging stop while
-   * a self-hosted license is lapsed and resume when a license is activated.
+   * EnterpriseEdition.isFeatureActive: SCIM and audit logging stop while a
+   * self-hosted license is lapsed and resume when a license is activated.
    *
    * The one kind of update that needs no license either is a TIGHTEN-ONLY
    * update (see TIGHTEN_ONLY_UPDATES): every column it writes is on the
-   * model's list with a value that can only tighten security - disabling an
-   * identity provider, rotating a leaked SCIM bearer token. A lapsed license
-   * must never stand between an administrator and those moves during an
-   * incident. The same holds on the Community Edition, deliberately and for
-   * the same reason reads and deletes do: the move can only reduce what the
-   * configuration allows, and a provider disabled (or a token rotated) there
-   * stays so when the install returns to the Enterprise Edition, instead of
-   * coming back live. Anything else in the same update - even one more
-   * column - makes it an ordinary update, which needs the license.
+   * model's list with a value that can only tighten security - rotating a
+   * leaked SCIM bearer token. A lapsed license must never stand between an
+   * administrator and that move during an incident. The same holds on the
+   * Community Edition, deliberately and for the same reason reads and deletes
+   * do: the move can only reduce what the configuration allows, and a token
+   * rotated there stays rotated when the install returns to the Enterprise
+   * Edition, instead of the leaked one coming back live. Anything else in the
+   * same update - even one more column - makes it an ordinary update, which
+   * needs the license.
    *
    * `updateData` is what the update writes. Only UpdatePermission, which has
    * it, passes it; without it an update is judged by the full check (fail
@@ -103,9 +83,10 @@ export default class EditionPermissions {
    * reason.
    *
    * Master admins are subject to this check - Create/UpdatePermission call it
-   * before their master-admin early return - because the global SSO/OIDC
-   * models are only ever written by master admins and would otherwise never
-   * be gated. Internal root writes (props.isRoot) are never checked.
+   * before their master-admin early return - because a master admin can
+   * write any project's SCIM configuration and team compliance settings, and
+   * those writes would otherwise never be gated. Internal root writes
+   * (props.isRoot) are never checked.
    *
    * On the cloud / billing-enabled deployment enforcement is left to
    * BillingPermission: it already gates these models by the plan tier in
@@ -170,6 +151,127 @@ export default class EditionPermissions {
     }
   }
 
+  /*
+   * Gates enterprise configuration kept in COLUMNS of core models (see
+   * EnterpriseEdition.getEnterpriseColumnsForTableName): the retention
+   * overrides on Project, Service and every telemetry resource.
+   *
+   * A create or update that writes an override - any value retention would
+   * use - needs the column's feature, like a write to an enterprise model
+   * (checkEditionPermissions). Clearing an override (null, an empty value,
+   * or a retention config with no retention in it) never does, for the same
+   * reason reads and deletes of enterprise models never do: an install that
+   * dropped to the Community Edition, or whose license lapsed, must still be
+   * able to remove what it configured. Every other column of the same write
+   * is left to the usual checks.
+   *
+   * Same rules as checkEditionPermissions otherwise: synchronous, internal
+   * root writes are never checked, master admins are, and with billing on
+   * (OneUptime Cloud) the plan gates these columns instead, through their
+   * @ColumnBillingAccessControl.
+   */
+  @CaptureSpan()
+  public static checkEnterpriseColumnPermissions(
+    modelType: DatabaseBaseModelType,
+    props: DatabaseCommonInteractionProps,
+    operation: DatabaseRequestType,
+    data: unknown,
+  ): void {
+    if (IsBillingEnabled) {
+      return;
+    }
+
+    if (props.isRoot) {
+      return;
+    }
+
+    if (
+      operation !== DatabaseRequestType.Create &&
+      operation !== DatabaseRequestType.Update
+    ) {
+      return;
+    }
+
+    for (const feature of EditionPermissions.getEnterpriseFeaturesWritten(
+      new modelType().tableName,
+      data,
+    )) {
+      EnterpriseEdition.assertFeatureAvailableSync(feature);
+    }
+  }
+
+  /*
+   * The features whose enterprise columns this write sets to a value that
+   * takes effect (see isEnterpriseColumnValueSet), without duplicates.
+   * Anything that is not a plain object of columns writes none.
+   */
+  public static getEnterpriseFeaturesWritten(
+    tableName: string | null | undefined,
+    data: unknown,
+  ): Array<EnterpriseFeature> {
+    const columns: Readonly<Record<string, EnterpriseFeature>> | null =
+      EnterpriseEdition.getEnterpriseColumnsForTableName(tableName);
+
+    if (!columns || !data || typeof data !== "object" || Array.isArray(data)) {
+      return [];
+    }
+
+    const features: Array<EnterpriseFeature> = [];
+
+    for (const [column, feature] of Object.entries(columns)) {
+      const value: unknown = (data as Record<string, unknown>)[column];
+
+      if (
+        EditionPermissions.isEnterpriseColumnValueSet(value) &&
+        !features.includes(feature)
+      ) {
+        features.push(feature);
+      }
+    }
+
+    return features;
+  }
+
+  /*
+   * Whether a value written to an enterprise column sets something, as
+   * opposed to clearing it. Retention only ever uses positive numbers
+   * (resolveTelemetryRetentionInDays skips everything else), so a value sets
+   * an override when it is, or contains at any depth, a positive number - or
+   * a string of one, which the API accepts for a number column. null, "",
+   * zero, {} and a retention config whose every entry is blank all clear.
+   */
+  public static isEnterpriseColumnValueSet(value: unknown): boolean {
+    if (value === null || value === undefined) {
+      return false;
+    }
+
+    if (typeof value === "number") {
+      return Number.isFinite(value) && value > 0;
+    }
+
+    if (typeof value === "string") {
+      const trimmed: string = value.trim();
+
+      if (!trimmed) {
+        return false;
+      }
+
+      const parsed: number = Number(trimmed);
+
+      return Number.isFinite(parsed) && parsed > 0;
+    }
+
+    if (typeof value === "object") {
+      return Object.values(value as Record<string, unknown>).some(
+        (entry: unknown): boolean => {
+          return EditionPermissions.isEnterpriseColumnValueSet(entry);
+        },
+      );
+    }
+
+    return false;
+  }
+
   /*
    * True when the update writes at least one column, and every column it
    * writes is on the table's tighten-only list with a value that passes the

package/Server/Types/Database/Permissions/OwnerTableRegistry.ts

@@ -40,6 +40,8 @@ import VMwareVCenterOwnerTeamService from "../../../Services/VMwareVCenterOwnerT
 import VMwareVCenterOwnerUserService from "../../../Services/VMwareVCenterOwnerUserService";
 import DatabaseServerOwnerTeamService from "../../../Services/DatabaseServerOwnerTeamService";
 import DatabaseServerOwnerUserService from "../../../Services/DatabaseServerOwnerUserService";
+import MessageQueueOwnerTeamService from "../../../Services/MessageQueueOwnerTeamService";
+import MessageQueueOwnerUserService from "../../../Services/MessageQueueOwnerUserService";
 import IoTFleetOwnerTeamService from "../../../Services/IoTFleetOwnerTeamService";
 import IoTFleetOwnerUserService from "../../../Services/IoTFleetOwnerUserService";
 import NetworkDeviceOwnerTeamService from "../../../Services/NetworkDeviceOwnerTeamService";
@@ -324,6 +326,20 @@ const ownerTableRegistry: Map<string, OwnerTablePair> = new Map<
       modelService: DatabaseServerService,
     },
   ],
+  [
+    /*
+     * No canOwnTelemetry: a queue owns no telemetry row. Messaging spans and
+     * client metrics belong to the producing or consuming service, and a
+     * queue's telemetry is selected by its entity key (keyForMessageQueue),
+     * never by primaryEntityId - owning a queue grants the queue row alone.
+     */
+    "MessageQueue",
+    {
+      ownerUserService: MessageQueueOwnerUserService,
+      ownerTeamService: MessageQueueOwnerTeamService,
+      fkColumn: "messageQueueId",
+    },
+  ],
   [
     /*
      * IoT telemetry carries the fleet ID in primaryEntityId even though its

package/Server/Types/Database/Permissions/TablePermission.ts

@@ -61,9 +61,9 @@ export default class TablePermission {
      * edition or the license does not allow? (Reads and deletes always pass.)
      * Updates are checked by UpdatePermission.checkUpdatePermissions instead,
      * which every update runs and which sees what the update writes: an
-     * update that only tightens security (disabling an identity provider,
-     * rotating a SCIM token) needs no license, and this check, which is not
-     * handed the data, could only refuse it.
+     * update that only tightens security (rotating a SCIM token) needs no
+     * license, and this check, which is not handed the data, could only
+     * refuse it.
      */
     if (type !== DatabaseRequestType.Update) {
       EditionPermissions.checkEditionPermissions(modelType, props, type);

package/Server/Types/Database/Permissions/UpdatePermission.ts

@@ -39,14 +39,15 @@ export default class UpdatePermission {
     /*
      * The edition check for updates runs here, the one permission entry
      * point that sees what the update writes: an update that only tightens
-     * security (disabling an identity provider, rotating a SCIM token) needs
-     * no license, anything else does (see EditionPermission). TablePermission
-     * leaves updates to this method for that reason.
+     * security (rotating a SCIM token) needs no license, anything else does
+     * (see EditionPermission). TablePermission leaves updates to this method
+     * for that reason.
      *
      * Master admins skip every table-level check below, but not the edition
-     * check: changing enterprise configuration (global SSO/OIDC providers are
-     * only ever edited by master admins) needs the license for them too.
-     * Everyone else gets it right after the table-level check.
+     * check: changing enterprise configuration (a master admin can edit any
+     * project's SCIM configuration and team compliance settings) needs the
+     * license for them too. Everyone else gets it right after the
+     * table-level check.
      */
     if (props.isMasterAdmin && !props.isRoot) {
       EditionPermissions.checkEditionPermissions(
@@ -55,6 +56,12 @@ export default class UpdatePermission {
         DatabaseRequestType.Update,
         data,
       );
+      EditionPermissions.checkEnterpriseColumnPermissions(
+        modelType,
+        props,
+        DatabaseRequestType.Update,
+        data,
+      );
     }
 
     if (props.isRoot || props.isMasterAdmin) {
@@ -75,6 +82,13 @@ export default class UpdatePermission {
       data,
     );
 
+    EditionPermissions.checkEnterpriseColumnPermissions(
+      modelType,
+      props,
+      DatabaseRequestType.Update,
+      data,
+    );
+
     const checkBasePermission: CheckPermissionBaseInterface<TBaseModel> =
       await BasePermission.checkPermissions(
         modelType,