@oneuptime/common 14.0.9 → 14.0.11

package/build/dist/Server/Services/ResourceAiAccessService.js

@@ -0,0 +1,1028 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import OneUptimeDate from "../../Types/Date";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../Types/ObjectID";
+import AiResourceType, { AI_RESOURCE_TYPE_INFO, ALL_AI_RESOURCE_TYPES, isAiResourceType, } from "../../Types/ResourceAiAgent/AiResourceType";
+import { RESOURCE_AI_AGENT_IMAGE_REPOSITORY, RESOURCE_AI_AGENT_RESOURCE_TYPE_ENV, RESOURCE_AI_ALLOW_WRITES_ENV, RESOURCE_AI_WRITE_TARGETS_ENV, ResourceAiRemediationMode, parseResourceAiRemediationMode, } from "../../Types/ResourceAiAgent/ResourceAiAccess";
+import ModelPermission from "../Types/Database/Permissions/Index";
+import QueryHelper from "../Types/Database/QueryHelper";
+import MonitorResourceContextUtil from "../Utils/Monitor/MonitorResourceContext";
+import logger from "../Utils/Logger";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import AlertService from "./AlertService";
+import CephClusterService from "./CephClusterService";
+import DatabaseServerService from "./DatabaseServerService";
+import DockerHostService from "./DockerHostService";
+import DockerSwarmClusterService from "./DockerSwarmClusterService";
+import HostService from "./HostService";
+import IncidentService from "./IncidentService";
+import KubernetesClusterAiAccessService, { AI_BALANCE_INSUFFICIENT_NEXT_STEP, } from "./KubernetesClusterAiAccessService";
+import MonitorService from "./MonitorService";
+import PodmanHostService from "./PodmanHostService";
+import ProxmoxClusterService from "./ProxmoxClusterService";
+import ResourceAiAgentService from "./ResourceAiAgentService";
+import VMwareVCenterService from "./VMwareVCenterService";
+// The most resources one incident or alert offers an investigation.
+export const MAX_RESOURCES_PER_SUBJECT = 10;
+/*
+ * How many of a subject's linked resources are read per query while
+ * looking for its unarchived ones (getResourcesForSubject): one read covers
+ * any ordinary subject, and a subject linked to many archived resources is
+ * read on in batches until the cap is reached.
+ */
+const SUBJECT_RESOURCE_READ_BATCH_SIZE = MAX_RESOURCES_PER_SUBJECT * 5;
+// The columns every resource model carries for AI access.
+const AI_ACCESS_COLUMNS = {
+    _id: true,
+    projectId: true,
+    name: true,
+    isArchived: true,
+    isAiInvestigationEnabled: true,
+    aiRemediationMode: true,
+    aiCommandAllowlist: true,
+    aiAccessConfiguredAt: true,
+    aiAccessLastVerifiedAt: true,
+    aiAccessLastError: true,
+};
+const MODEL_SPECS = {
+    [AiResourceType.DockerHost]: {
+        service: DockerHostService,
+        identityColumns: { hostIdentifier: true },
+        subjectRelation: "dockerHosts",
+        resolvedIdsKey: "dockerHostIds",
+    },
+    [AiResourceType.PodmanHost]: {
+        service: PodmanHostService,
+        identityColumns: { hostIdentifier: true },
+        subjectRelation: "podmanHosts",
+        resolvedIdsKey: "podmanHostIds",
+    },
+    [AiResourceType.DockerSwarmCluster]: {
+        service: DockerSwarmClusterService,
+        identityColumns: {},
+        subjectRelation: "dockerSwarmClusters",
+        resolvedIdsKey: "dockerSwarmClusterIds",
+    },
+    [AiResourceType.ProxmoxCluster]: {
+        service: ProxmoxClusterService,
+        identityColumns: {},
+        subjectRelation: "proxmoxClusters",
+        resolvedIdsKey: "proxmoxClusterIds",
+    },
+    [AiResourceType.VMwareVCenter]: {
+        service: VMwareVCenterService,
+        identityColumns: {},
+        subjectRelation: "vmwareVCenters",
+        resolvedIdsKey: "vmwareVCenterIds",
+    },
+    [AiResourceType.CephCluster]: {
+        service: CephClusterService,
+        identityColumns: {},
+        subjectRelation: "cephClusters",
+        resolvedIdsKey: "cephClusterIds",
+    },
+    [AiResourceType.DatabaseServer]: {
+        service: DatabaseServerService,
+        identityColumns: {
+            dbSystem: true,
+            serverAddress: true,
+            serverPort: true,
+        },
+        subjectRelation: "databaseServers",
+        resolvedIdsKey: "databaseServerIds",
+    },
+    [AiResourceType.Host]: {
+        service: HostService,
+        identityColumns: { hostIdentifier: true },
+        subjectRelation: "hosts",
+        resolvedIdsKey: "hostIds",
+    },
+};
+/*
+ * What an operator checks when the agent is online but cannot reach its
+ * resource: the one thing each agent needs besides the network.
+ */
+const REACH_HINTS = {
+    [AiResourceType.DockerHost]: "that the Docker socket (/var/run/docker.sock) is mounted into the agent's container",
+    [AiResourceType.PodmanHost]: "that the Podman socket (/run/podman/podman.sock) is mounted into the agent's container",
+    [AiResourceType.DockerSwarmCluster]: "that the agent runs on a swarm MANAGER node with the Docker socket mounted",
+    [AiResourceType.ProxmoxCluster]: "PVE_HOST and the agent's Proxmox API token",
+    [AiResourceType.VMwareVCenter]: "the vCenter URL and the credentials in the agent's environment",
+    [AiResourceType.CephCluster]: "the Ceph config and keyring mounted into the agent's container",
+    [AiResourceType.DatabaseServer]: "the database address and the read-only credentials in the agent's environment",
+    [AiResourceType.Host]: "that the agent runs privileged with the host's PID namespace (pid: host)",
+};
+// "Docker host", but "host" and "database server" for the generic nouns.
+export function describeResourceNoun(resourceType) {
+    if (resourceType === AiResourceType.Host) {
+        return "host";
+    }
+    if (resourceType === AiResourceType.DatabaseServer) {
+        return "database server";
+    }
+    return isAiResourceType(resourceType)
+        ? AI_RESOURCE_TYPE_INFO[resourceType].displayName
+        : "resource";
+}
+/*
+ * Where every next step sends an operator: the resource's AI agent page
+ * (AI → AI agent in its side menu). Shown verbatim in the investigation's
+ * report and panel, so it always names the page.
+ */
+export function getResourceAiAgentPage(resourceType) {
+    return `the ${describeResourceNoun(resourceType)}'s AI agent page (AI → AI agent)`;
+}
+/*
+ * How to install the resource's agent, as one sentence: the image, the
+ * type, and the identity to register with — spelled with this resource's
+ * own identity when it is known, so the agent lands on THIS row.
+ */
+export function getResourceAiAgentInstallNextStep(data) {
+    const info = AI_RESOURCE_TYPE_INFO[data.resourceType];
+    const noun = describeResourceNoun(data.resourceType);
+    let identity;
+    if (data.resourceType === AiResourceType.DatabaseServer) {
+        identity = data.resourceId
+            ? ` and DATABASE_SERVER_ID=${data.resourceId}`
+            : " and DATABASE_SERVER_ID set to this database server's id";
+    }
+    else {
+        const variable = info.identityEnvVars[0] || "the identity";
+        identity = data.identifier
+            ? ` and ${variable}=${data.identifier}`
+            : ` and ${variable} set to the name its collector reports`;
+    }
+    return `Install the ${info.agentDisplayName} next to this ${noun}'s telemetry collector: run the ${RESOURCE_AI_AGENT_IMAGE_REPOSITORY} image with ${RESOURCE_AI_AGENT_RESOURCE_TYPE_ENV}=${info.agentAlias}${identity}. The complete snippet is on ${getResourceAiAgentPage(data.resourceType)}.`;
+}
+function toDate(value) {
+    if (!value) {
+        return null;
+    }
+    const date = value instanceof Date ? value : new Date(value);
+    return Number.isNaN(date.getTime()) ? null : date;
+}
+function toIsoString(value) {
+    const date = toDate(value);
+    return date ? OneUptimeDate.toString(date) : undefined;
+}
+/*
+ * The allowlist column is jsonb; a client may save it as an array or as a
+ * JSON string. Anything unusable normalizes to empty — nothing risky
+ * auto-executes.
+ */
+export function normalizeResourceAllowlist(value) {
+    let raw = value;
+    if (typeof raw === "string") {
+        try {
+            raw = JSON.parse(raw);
+        }
+        catch (_a) {
+            raw = [value];
+        }
+    }
+    if (!Array.isArray(raw)) {
+        return [];
+    }
+    return raw
+        .filter((pattern) => {
+        return typeof pattern === "string" && pattern.trim().length > 0;
+    })
+        .map((pattern) => {
+        return pattern.trim();
+    });
+}
+function refKey(resourceType, resourceId) {
+    return `${resourceType}:${resourceId.toLowerCase()}`;
+}
+function readString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+export class ResourceAiAccessServiceClass {
+    /*
+     * ------------------------------------------------------------------
+     * Readiness
+     * ------------------------------------------------------------------
+     */
+    // The project-wide gates, read exactly as they are for clusters.
+    async getProjectGates(projectId) {
+        return await KubernetesClusterAiAccessService.getProjectGates(projectId);
+    }
+    async getStatusForResource(data) {
+        const statuses = await this.getStatusesForResources({
+            projectId: data.projectId,
+            resources: [
+                {
+                    resourceType: data.resourceType,
+                    resourceId: data.resourceId.toString(),
+                },
+            ],
+            gates: data.gates,
+        });
+        return statuses[0] || null;
+    }
+    /*
+     * The status of several resources of one project, in the order asked
+     * for, with every resource's agent row read in ONE query. A resource
+     * that does not exist in the project (or, with excludeArchived, is
+     * archived) has no status. When the agent read fails every status reads
+     * as having no agent, which can only make it say less is reachable.
+     */
+    async getStatusesForResources(data) {
+        const rows = await this.loadResources({
+            projectId: data.projectId,
+            resources: data.resources,
+            excludeArchived: data.excludeArchived,
+        });
+        if (rows.length === 0) {
+            return [];
+        }
+        const gates = data.gates || (await this.getProjectGates(data.projectId));
+        let agentRows = new Map();
+        try {
+            agentRows = await this.findAgentRows({
+                projectId: data.projectId,
+                resources: rows,
+            });
+        }
+        catch (error) {
+            logger.error(`ResourceAiAccess: could not read the resource AI agents of project ${data.projectId.toString()}; every resource reads as having none: ${error}`);
+        }
+        return rows.map((row) => {
+            return this.buildStatus({
+                resource: row,
+                agentRow: agentRows.get(refKey(row.resourceType, row.id.toString())) || null,
+                gates,
+            });
+        });
+    }
+    /*
+     * The readiness computation proper, for one resource row, its agent row
+     * (online or not; null when none ever registered) and the project gates.
+     * Pure: every read was done by the caller.
+     */
+    buildStatus(data) {
+        const { resource, agentRow, gates } = data;
+        const type = resource.resourceType;
+        const info = AI_RESOURCE_TYPE_INFO[type];
+        const noun = describeResourceNoun(type);
+        const page = getResourceAiAgentPage(type);
+        const gaps = [];
+        /*
+         * The agent as ResourceAiAgentService sees it: one online rule for the
+         * status and for the chokepoint (findOnlineAgentForResource).
+         */
+        const agent = agentRow
+            ? ResourceAiAgentService.getAgentSummary(agentRow, data.now)
+            : null;
+        const posture = (agent === null || agent === void 0 ? void 0 : agent.posture) || null;
+        const remediationMode = resource.aiRemediationMode;
+        if (!agent) {
+            gaps.push({
+                code: "ai_agent_not_connected",
+                title: `No ${info.agentDisplayName} is connected`,
+                nextStep: getResourceAiAgentInstallNextStep({
+                    resourceType: type,
+                    resourceId: resource.id.toString(),
+                    identifier: resource.identifier,
+                }),
+                blocksInvestigation: true,
+                blocksRemediation: true,
+            });
+        }
+        else if (!agent.isOnline) {
+            const lastAliveAt = toDate(agentRow === null || agentRow === void 0 ? void 0 : agentRow.lastAliveAt);
+            const lastAliveText = lastAliveAt
+                ? OneUptimeDate.getDateAsFormattedString(lastAliveAt)
+                : "an unknown time";
+            gaps.push({
+                code: "ai_agent_offline",
+                title: `The ${info.agentDisplayName} is offline`,
+                nextStep: `It last reported in at ${lastAliveText}${agent.connectionStatus === "disconnected"
+                    ? " and then signed off (it was stopped, restarted or reset)"
+                    : ""}. Check that its container is running and can reach your OneUptime URL (its logs say why it cannot).`,
+                blocksInvestigation: true,
+                blocksRemediation: true,
+            });
+        }
+        else if (!posture || posture.resourceType !== type) {
+            /*
+             * The agent always reports a posture for the type it serves; one
+             * that is missing, unreadable or for another type is not trusted
+             * with commands (the enqueue chokepoint refuses the same case).
+             */
+            gaps.push({
+                code: "ai_agent_unreachable_resource",
+                title: `The ${info.agentDisplayName} has not reported that it can reach this ${noun}`,
+                nextStep: `Wait for its next report (within a minute), or reset the agent on ${page}.`,
+                blocksInvestigation: true,
+                blocksRemediation: true,
+            });
+        }
+        else if (posture.reachable !== true) {
+            gaps.push({
+                code: "ai_agent_unreachable_resource",
+                title: `The ${info.agentDisplayName} cannot reach this ${noun}`,
+                nextStep: `Its last check failed${posture.reachError ? `: ${posture.reachError}` : ""}. Check ${REACH_HINTS[type]}, then use "Test connection" on ${page}.`,
+                blocksInvestigation: true,
+                blocksRemediation: true,
+            });
+        }
+        if (!resource.isAiInvestigationEnabled) {
+            gaps.push({
+                code: "investigation_disabled",
+                title: `AI investigation is turned off for this ${noun}`,
+                nextStep: `Turn on AI investigation on ${page}.`,
+                blocksInvestigation: true,
+                blocksRemediation: false,
+            });
+        }
+        if (remediationMode === ResourceAiRemediationMode.Disabled) {
+            gaps.push({
+                code: "remediation_disabled",
+                title: `AI fixes are turned off for this ${noun}`,
+                nextStep: `Set "Fixes" to "Ask for approval", "Automatic" or "Bypass approval" on ${page}.`,
+                blocksInvestigation: false,
+                blocksRemediation: true,
+            });
+        }
+        else if (agent && (posture === null || posture === void 0 ? void 0 : posture.allowWrites) !== true) {
+            gaps.push({
+                code: "remediation_write_access_missing",
+                title: `The ${info.agentDisplayName} is read-only`,
+                nextStep: `Set ${RESOURCE_AI_ALLOW_WRITES_ENV}=true on the ${info.agentDisplayName} and restart it (${RESOURCE_AI_WRITE_TARGETS_ENV} limits what it may change).`,
+                blocksInvestigation: false,
+                blocksRemediation: true,
+            });
+        }
+        if (!gates.isAiEnabled) {
+            gaps.push({
+                code: "ai_disabled_for_project",
+                title: "AI is disabled for this project",
+                nextStep: "Enable AI under Project Settings → AI Features.",
+                blocksInvestigation: true,
+                blocksRemediation: true,
+            });
+        }
+        if (!gates.hasLlmProvider) {
+            gaps.push({
+                code: "llm_provider_missing",
+                title: "No AI provider is configured",
+                nextStep: "Add a provider under Project Settings → AI → LLM Providers (or use OneUptime AI credits).",
+                blocksInvestigation: true,
+                blocksRemediation: true,
+            });
+        }
+        if (gates.aiBalanceBlocker) {
+            gaps.push({
+                code: "ai_balance_insufficient",
+                title: "The project is out of AI credits",
+                nextStep: AI_BALANCE_INSUFFICIENT_NEXT_STEP,
+                blocksInvestigation: true,
+                blocksRemediation: true,
+            });
+        }
+        if (!gates.isAutoRemediationEnabled) {
+            gaps.push({
+                code: "auto_remediation_disabled_for_project",
+                title: "Auto-remediation is disabled for this project",
+                nextStep: "Enable auto-remediation under Project Settings → AI Features.",
+                blocksInvestigation: false,
+                blocksRemediation: true,
+            });
+        }
+        const blocksInvestigation = gaps.some((gap) => {
+            return gap.blocksInvestigation;
+        });
+        const blocksRemediation = gaps.some((gap) => {
+            return gap.blocksRemediation;
+        });
+        return {
+            resourceType: type,
+            resourceId: resource.id.toString(),
+            resourceName: resource.name,
+            isAiInvestigationEnabled: resource.isAiInvestigationEnabled,
+            aiRemediationMode: remediationMode,
+            aiCommandAllowlist: resource.aiCommandAllowlist,
+            aiAccessConfiguredAt: toIsoString(resource.aiAccessConfiguredAt) || null,
+            aiAccessLastVerifiedAt: toIsoString(resource.aiAccessLastVerifiedAt) || null,
+            aiAccessLastError: resource.aiAccessLastError || null,
+            agent,
+            gaps,
+            isInvestigationReady: resource.isAiInvestigationEnabled && !blocksInvestigation,
+            isRemediationReady: remediationMode !== ResourceAiRemediationMode.Disabled &&
+                !blocksRemediation,
+        };
+    }
+    /*
+     * ------------------------------------------------------------------
+     * Rows
+     * ------------------------------------------------------------------
+     */
+    /*
+     * One resource of the project (as root: the caller scopes by project),
+     * or null when it is not the project's. Lookup failures propagate: the
+     * enqueue chokepoint must fail closed on a resource it could not read.
+     */
+    async loadResource(data) {
+        if (!isAiResourceType(data.resourceType)) {
+            return null;
+        }
+        const rows = await this.loadResources({
+            projectId: data.projectId,
+            resources: [
+                {
+                    resourceType: data.resourceType,
+                    resourceId: data.resourceId.toString(),
+                },
+            ],
+        });
+        return rows[0] || null;
+    }
+    /*
+     * Several resources of one project, one query per resource type, in the
+     * order asked for (duplicates and unknown types dropped).
+     */
+    async loadResources(data) {
+        const wanted = [];
+        const seen = new Set();
+        for (const ref of data.resources) {
+            if (!ref ||
+                !isAiResourceType(ref.resourceType) ||
+                typeof ref.resourceId !== "string" ||
+                !ObjectID.isValidUUID(ref.resourceId)) {
+                continue;
+            }
+            const key = refKey(ref.resourceType, ref.resourceId);
+            if (seen.has(key)) {
+                continue;
+            }
+            seen.add(key);
+            wanted.push(ref);
+        }
+        const byKey = new Map();
+        for (const type of ALL_AI_RESOURCE_TYPES) {
+            const ids = wanted
+                .filter((ref) => {
+                return ref.resourceType === type;
+            })
+                .map((ref) => {
+                return ref.resourceId;
+            });
+            if (ids.length === 0) {
+                continue;
+            }
+            const spec = MODEL_SPECS[type];
+            const models = (await spec.service.findBy({
+                query: Object.assign({ projectId: data.projectId, _id: QueryHelper.any(ids.map((id) => {
+                        return new ObjectID(id);
+                    })) }, (data.excludeArchived ? { isArchived: false } : {})),
+                select: Object.assign(Object.assign({}, AI_ACCESS_COLUMNS), spec.identityColumns),
+                limit: ids.length,
+                skip: 0,
+                props: { isRoot: true },
+            }));
+            for (const model of models) {
+                const row = this.toRow(type, model, data);
+                if (row) {
+                    byKey.set(refKey(type, row.id.toString()), row);
+                }
+            }
+        }
+        const rows = [];
+        for (const ref of wanted) {
+            const row = byKey.get(refKey(ref.resourceType, ref.resourceId));
+            if (row) {
+                rows.push(row);
+            }
+        }
+        return rows;
+    }
+    // A resource model read through its service, as the status reads it.
+    toRow(resourceType, model, scope) {
+        const idValue = model["_id"] || model["id"];
+        const id = idValue instanceof ObjectID
+            ? idValue.toString()
+            : readString(idValue);
+        if (!id || !ObjectID.isValidUUID(id)) {
+            return null;
+        }
+        const projectIdValue = model["projectId"];
+        const projectId = projectIdValue instanceof ObjectID
+            ? projectIdValue.toString()
+            : readString(projectIdValue);
+        // The query was project-scoped; a row that says otherwise is not used.
+        if (projectId && projectId !== scope.projectId.toString()) {
+            return null;
+        }
+        const isArchived = model["isArchived"] === true;
+        if (scope.excludeArchived && isArchived) {
+            return null;
+        }
+        const identifier = this.readIdentifier(resourceType, model);
+        return {
+            resourceType,
+            id: new ObjectID(id),
+            projectId: scope.projectId,
+            name: readString(model["name"]) ||
+                identifier ||
+                AI_RESOURCE_TYPE_INFO[resourceType].displayName,
+            identifier,
+            isAiInvestigationEnabled: model["isAiInvestigationEnabled"] === true,
+            aiRemediationMode: parseResourceAiRemediationMode(model["aiRemediationMode"]),
+            aiCommandAllowlist: normalizeResourceAllowlist(model["aiCommandAllowlist"]),
+            aiAccessConfiguredAt: toDate(model["aiAccessConfiguredAt"]) || undefined,
+            aiAccessLastVerifiedAt: toDate(model["aiAccessLastVerifiedAt"]) || undefined,
+            aiAccessLastError: readString(model["aiAccessLastError"]),
+            isArchived,
+        };
+    }
+    /*
+     * The identity the resource's collector reports: hostIdentifier for
+     * hosts, the name for clusters and vCenters, and system|host:port for a
+     * database server.
+     */
+    readIdentifier(resourceType, model) {
+        if (resourceType === AiResourceType.DockerHost ||
+            resourceType === AiResourceType.PodmanHost ||
+            resourceType === AiResourceType.Host) {
+            return readString(model["hostIdentifier"]);
+        }
+        if (resourceType === AiResourceType.DatabaseServer) {
+            const address = readString(model["serverAddress"]);
+            if (!address) {
+                return undefined;
+            }
+            const port = model["serverPort"];
+            const system = readString(model["dbSystem"]);
+            return `${system ? `${system}|` : ""}${address}${typeof port === "number" && Number.isFinite(port) ? `:${port}` : ""}`;
+        }
+        return readString(model["name"]);
+    }
+    /*
+     * The agent rows of these resources (online or not), keyed by
+     * type:resourceId — one query per resource type present
+     * (ResourceAiAgentService.findAgentsForResources). Never reads the key
+     * hash.
+     */
+    async findAgentRows(data) {
+        const byKey = new Map();
+        for (const type of ALL_AI_RESOURCE_TYPES) {
+            const ids = data.resources
+                .filter((resource) => {
+                return resource.resourceType === type;
+            })
+                .map((resource) => {
+                return resource.id;
+            });
+            if (ids.length === 0) {
+                continue;
+            }
+            const rows = await ResourceAiAgentService.findAgentsForResources({
+                projectId: data.projectId,
+                resourceType: type,
+                resourceIds: ids,
+            });
+            for (const [resourceId, row] of rows) {
+                byKey.set(refKey(type, resourceId), row);
+            }
+        }
+        return byKey;
+    }
+    /*
+     * ------------------------------------------------------------------
+     * The access target
+     * ------------------------------------------------------------------
+     */
+    /*
+     * The resource and the agent a command for it goes to NOW: its online
+     * agent, or null. Lookup failures propagate: the enqueue chokepoint must
+     * fail closed on a target it could not check.
+     */
+    async loadAccessTarget(data) {
+        const resource = await this.loadResource(data);
+        if (!resource) {
+            return { resource: null, agent: null };
+        }
+        const agent = await ResourceAiAgentService.findOnlineAgentForResource({
+            projectId: data.projectId,
+            resourceType: resource.resourceType,
+            resourceId: resource.id,
+        });
+        return { resource, agent: agent || null };
+    }
+    /*
+     * ------------------------------------------------------------------
+     * Subjects
+     * ------------------------------------------------------------------
+     */
+    /*
+     * The unarchived resources of the project an incident or alert is linked
+     * to, in the order ALL_AI_RESOURCE_TYPES lists the types, at most
+     * MAX_RESOURCES_PER_SUBJECT. Linked means the subject's resource
+     * relations (written when it was created, from its series labels and its
+     * monitors' configuration); when none of those is an unarchived resource
+     * of the project, the subject's monitors' step configuration is resolved
+     * again now (the resource may have appeared after the subject was
+     * created, or replaced an archived one), matching names
+     * case-insensitively like the linker does.
+     *
+     * Archived and missing resources are dropped BEFORE the cap: capping
+     * first would let ten archived links hide an active one behind them.
+     */
+    async getResourcesForSubject(data) {
+        const linked = new Map();
+        const monitorIds = [];
+        if (data.alertId || data.incidentId) {
+            const relations = await Promise.all(ALL_AI_RESOURCE_TYPES.map(async (type) => {
+                return {
+                    type,
+                    ids: await this.readSubjectRelation({
+                        projectId: data.projectId,
+                        incidentId: data.incidentId,
+                        alertId: data.alertId,
+                        relation: MODEL_SPECS[type].subjectRelation,
+                    }),
+                };
+            }));
+            for (const relation of relations) {
+                linked.set(relation.type, relation.ids);
+            }
+            monitorIds.push(...(await this.readSubjectMonitorIds({
+                projectId: data.projectId,
+                incidentId: data.incidentId,
+                alertId: data.alertId,
+            })));
+        }
+        let refs = await this.keepUnarchivedRefs({
+            projectId: data.projectId,
+            refs: this.flattenRefs(linked),
+        });
+        if (refs.length === 0 && monitorIds.length > 0) {
+            refs = await this.keepUnarchivedRefs({
+                projectId: data.projectId,
+                refs: this.flattenRefs(await this.resolveMonitorResources({
+                    projectId: data.projectId,
+                    monitorIds,
+                })),
+            });
+        }
+        return refs;
+    }
+    /*
+     * The first MAX_RESOURCES_PER_SUBJECT of these refs (in their order) that
+     * are unarchived resources of the project, read in batches so a long
+     * list of archived links costs a few reads, not one per link.
+     */
+    async keepUnarchivedRefs(data) {
+        const kept = [];
+        for (let start = 0; start < data.refs.length && kept.length < MAX_RESOURCES_PER_SUBJECT; start += SUBJECT_RESOURCE_READ_BATCH_SIZE) {
+            const rows = await this.loadResources({
+                projectId: data.projectId,
+                resources: data.refs.slice(start, start + SUBJECT_RESOURCE_READ_BATCH_SIZE),
+                excludeArchived: true,
+            });
+            for (const row of rows) {
+                kept.push({
+                    resourceType: row.resourceType,
+                    resourceId: row.id.toString(),
+                });
+            }
+        }
+        return kept.slice(0, MAX_RESOURCES_PER_SUBJECT);
+    }
+    async getStatusesForSubject(data) {
+        const refs = await this.getResourcesForSubject(data);
+        if (refs.length === 0) {
+            return [];
+        }
+        return await this.getStatusesForResources({
+            projectId: data.projectId,
+            resources: refs,
+            excludeArchived: true,
+        });
+    }
+    // Types in priority order, each type's ids in relation order, deduped.
+    flattenRefs(byType) {
+        const refs = [];
+        const seen = new Set();
+        for (const type of ALL_AI_RESOURCE_TYPES) {
+            for (const id of byType.get(type) || []) {
+                const key = refKey(type, id);
+                if (!ObjectID.isValidUUID(id) || seen.has(key)) {
+                    continue;
+                }
+                seen.add(key);
+                refs.push({ resourceType: type, resourceId: id });
+            }
+        }
+        return refs;
+    }
+    /*
+     * One of the subject's resource relations, read on its own: reading all
+     * eight many-to-many relations in one query would multiply their rows.
+     */
+    async readSubjectRelation(data) {
+        var _a;
+        const select = {
+            _id: true,
+            [data.relation]: { _id: true },
+        };
+        let linked = [];
+        if (data.alertId) {
+            const alert = await AlertService.findOneBy({
+                query: { _id: data.alertId.toString(), projectId: data.projectId },
+                select: select,
+                props: { isRoot: true },
+            });
+            linked = ((alert === null || alert === void 0 ? void 0 : alert[data.relation]) || []);
+        }
+        else if (data.incidentId) {
+            const incident = await IncidentService.findOneBy({
+                query: { _id: data.incidentId.toString(), projectId: data.projectId },
+                select: select,
+                props: { isRoot: true },
+            });
+            linked = ((incident === null || incident === void 0 ? void 0 : incident[data.relation]) || []);
+        }
+        const ids = [];
+        for (const resource of Array.isArray(linked) ? linked : []) {
+            const id = (_a = resource === null || resource === void 0 ? void 0 : resource.id) === null || _a === void 0 ? void 0 : _a.toString();
+            if (id) {
+                ids.push(id);
+            }
+        }
+        return ids;
+    }
+    async readSubjectMonitorIds(data) {
+        if (data.alertId) {
+            const alert = await AlertService.findOneBy({
+                query: { _id: data.alertId.toString(), projectId: data.projectId },
+                select: { _id: true, monitorId: true },
+                props: { isRoot: true },
+            });
+            return (alert === null || alert === void 0 ? void 0 : alert.monitorId) ? [alert.monitorId] : [];
+        }
+        if (data.incidentId) {
+            const incident = await IncidentService.findOneBy({
+                query: { _id: data.incidentId.toString(), projectId: data.projectId },
+                select: { _id: true, monitors: { _id: true } },
+                props: { isRoot: true },
+            });
+            return ((incident === null || incident === void 0 ? void 0 : incident.monitors) || [])
+                .map((monitor) => {
+                return monitor.id || undefined;
+            })
+                .filter((id) => {
+                return Boolean(id);
+            });
+        }
+        return [];
+    }
+    /*
+     * What the subject's monitors' step configuration names now, resolved
+     * the way the incident/alert creation path resolves it
+     * (MonitorResourceContext: MonitorStepResourceIdentity, then
+     * SeriesResourceLinker.resolveResourceRefs with case-insensitive
+     * names). Best effort per monitor: that resolution never throws.
+     */
+    async resolveMonitorResources(data) {
+        const byType = new Map();
+        const monitors = await MonitorService.findBy({
+            query: {
+                _id: QueryHelper.any(data.monitorIds.slice(0, MAX_RESOURCES_PER_SUBJECT)),
+                projectId: data.projectId,
+            },
+            select: {
+                _id: true,
+                projectId: true,
+                monitorType: true,
+                monitorSteps: true,
+            },
+            limit: MAX_RESOURCES_PER_SUBJECT,
+            skip: 0,
+            props: { isRoot: true },
+        });
+        for (const monitor of monitors) {
+            const resolved = await MonitorResourceContextUtil.resolveResourceContextForMonitor({
+                monitor,
+            });
+            for (const type of ALL_AI_RESOURCE_TYPES) {
+                const ids = resolved[MODEL_SPECS[type].resolvedIdsKey] || [];
+                if (ids.length > 0) {
+                    byType.set(type, [...(byType.get(type) || []), ...ids]);
+                }
+            }
+        }
+        return byType;
+    }
+    /*
+     * ------------------------------------------------------------------
+     * Who may change a resource
+     * ------------------------------------------------------------------
+     */
+    /*
+     * Throws unless the caller may EDIT this resource: its update ACL, with
+     * label-scoped allow and block rows decided from the row's own labels,
+     * and the caller's Owned scope — exactly what a CRUD update of the row
+     * would check. Approving an AI plan runs its commands on the resource as
+     * root, so being allowed to start runbooks in the project is not enough
+     * on its own: someone blocked from editing (or reading) a resource must
+     * not be able to change it by approving a plan. Root and master admins
+     * are not gated. A resource that does not exist in the project is
+     * refused like one the caller may not edit.
+     */
+    async assertCallerMayChangeResource(data) {
+        if (data.props.isRoot || data.props.isMasterAdmin) {
+            return;
+        }
+        if (!isAiResourceType(data.resourceType)) {
+            throw new BadDataException(`"${String(data.resourceType)}" is not a resource type.`);
+        }
+        const noun = describeResourceNoun(data.resourceType);
+        const refusal = `You do not have permission to edit this ${noun}, so you cannot approve an AI plan that changes it. Ask someone who may edit the ${noun} to approve it, or dismiss the suggestion.`;
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const service = MODEL_SPECS[data.resourceType].service;
+        const query = {
+            _id: data.resourceId.toString(),
+            projectId: data.projectId,
+        };
+        /*
+         * The caller's permissions are read for the resource's own project —
+         * the permission layer reads the rows of props.tenantId.
+         */
+        const callerProps = Object.assign(Object.assign({}, data.props), { tenantId: data.projectId, isMultiTenantRequest: false });
+        /*
+         * The row's labels, read as root: label-scoped allow and block rows are
+         * decided per row, from them (DatabaseService.updateOneById's read).
+         */
+        const select = { _id: true };
+        const accessControlColumn = service
+            .getModel()
+            .getAccessControlColumn();
+        if (accessControlColumn) {
+            select[accessControlColumn] = {
+                _id: true,
+                name: true,
+            };
+        }
+        const row = (await service.findOneBy({
+            query,
+            select,
+            props: { isRoot: true },
+        }));
+        if (!row) {
+            throw new NotAuthorizedException(refusal);
+        }
+        try {
+            // Readable to the caller at all (a label-scoped read block refuses).
+            const readable = (await service.findOneBy({
+                query,
+                select: { _id: true },
+                props: callerProps,
+            }));
+            if (!readable) {
+                throw new NotAuthorizedException(refusal);
+            }
+            await ModelPermission.checkUpdatePermissionByModel({
+                modelType: service.modelType,
+                fetchModelWithAccessControlIds: async () => {
+                    return row;
+                },
+                props: callerProps,
+            });
+            /*
+             * The caller's whole update scope as a query (labels, Owned scope):
+             * the row must still be in it.
+             */
+            const permittedQuery = (await ModelPermission.checkUpdateQueryPermissions(service.modelType, query, {}, callerProps));
+            const permitted = (await service.findOneBy({
+                query: permittedQuery,
+                select: { _id: true },
+                props: { isRoot: true },
+            }));
+            if (!permitted) {
+                throw new NotAuthorizedException(refusal);
+            }
+        }
+        catch (error) {
+            if (error instanceof NotAuthorizedException ||
+                error instanceof NotAuthenticatedException) {
+                throw new NotAuthorizedException(refusal);
+            }
+            throw error;
+        }
+    }
+    /*
+     * ------------------------------------------------------------------
+     * Bookkeeping
+     * ------------------------------------------------------------------
+     */
+    /*
+     * Best effort: the resource's AI agent page shows "last verified" / "last
+     * error" from this. Written as root without the model's hooks — it is the
+     * server's own record of what a command did, not an operator's change to
+     * the resource's AI settings (the settings hooks stamp and police those).
+     */
+    async recordCommandOutcome(data) {
+        var _a;
+        try {
+            if (!isAiResourceType(data.resourceType)) {
+                throw new BadDataException(`"${String(data.resourceType)}" is not a resource type.`);
+            }
+            await MODEL_SPECS[data.resourceType].service.updateOneById({
+                id: data.resourceId,
+                data: (data.succeeded
+                    ? {
+                        aiAccessLastVerifiedAt: OneUptimeDate.getCurrentDate(),
+                        aiAccessLastError: null,
+                    }
+                    : {
+                        aiAccessLastError: (data.errorMessage || "Command failed.").slice(0, 2000),
+                    }),
+                props: { isRoot: true, ignoreHooks: true },
+            });
+        }
+        catch (error) {
+            logger.error(`ResourceAiAccess: could not record a command outcome for ${String(data.resourceType)} ${(_a = data.resourceId) === null || _a === void 0 ? void 0 : _a.toString()}: ${error}`);
+        }
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [ObjectID]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "getProjectGates", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "getStatusForResource", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "getStatusesForResources", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "loadResource", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "loadResources", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "findAgentRows", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "loadAccessTarget", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "getResourcesForSubject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "getStatusesForSubject", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "assertCallerMayChangeResource", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceAiAccessServiceClass.prototype, "recordCommandOutcome", null);
+const ResourceAiAccessService = new ResourceAiAccessServiceClass();
+export default ResourceAiAccessService;
+//# sourceMappingURL=ResourceAiAccessService.js.map