upright 0.2.0 → 0.4.0

data/app/controllers/upright/alertmanager_proxy_controller.rb

@@ -1,16 +1,24 @@
 class Upright::AlertmanagerProxyController < Upright::ApplicationController
-  skip_forgery_protection
+  include Upright::ProxyAuthentication
 
   def show
   end
 
   def proxy
-    proxy_to_alertmanager request.fullpath.delete_prefix("/alertmanager"), body: request.body&.read
+    url = upstream_url(alertmanager_url, request.fullpath.delete_prefix("/alertmanager"))
+
+    if url.nil?
+      head :bad_request
+    elsif token_forbidden_path?(url.path)
+      head :forbidden
+    else
+      proxy_to_alertmanager url, body: request.body&.read
+    end
   end
 
   private
-    def proxy_to_alertmanager(path, method: request.method, body: nil)
-      response = Faraday.new(url: alertmanager_url).run_request(method.downcase.to_sym, path, body, { "Content-Type" => request.content_type })
+    def proxy_to_alertmanager(url, method: request.method, body: nil)
+      response = Faraday.new(url: alertmanager_url).run_request(method.downcase.to_sym, url.to_s, body, { "Content-Type" => request.content_type })
 
       render body: response.body, status: response.status, content_type: response.headers["content-type"]
     end

data/app/controllers/upright/artifacts_controller.rb

@@ -1,5 +1,5 @@
 class Upright::ArtifactsController < Upright::ApplicationController
   def show
-    @artifact = ActiveStorage::Attachment.find(params[:id])
+    @artifact = ActiveStorage::Attachment.where(record_type: "Upright::ProbeResult").find(params[:id])
   end
 end

data/app/controllers/upright/incidents/updates_controller.rb

@@ -0,0 +1,13 @@
+class Upright::Incidents::UpdatesController < Upright::ApplicationController
+  def create
+    @incident = Upright::Incident.find(params[:incident_id])
+    update = @incident.record_update(incident_update_params)
+    redirect_to edit_incident_path(@incident),
+      flash: update.persisted? ? { notice: "Update posted." } : { alert: "Couldn't post update — check the status and message." }
+  end
+
+  private
+    def incident_update_params
+      params.expect(incident_update: [ :status, :body ])
+    end
+end

data/app/controllers/upright/incidents_controller.rb

@@ -0,0 +1,53 @@
+class Upright::IncidentsController < Upright::ApplicationController
+  before_action :set_incident, only: %i[ edit update destroy ]
+
+  def index
+    @current  = Upright::Incident.active.order(starts_at: :desc)
+    @upcoming = Upright::Maintenance.upcoming.order(:starts_at)
+    @past     = Upright::Incident.past.limit(50)
+  end
+
+  def new
+    @incident = incident_class.new(starts_at: Time.current)
+  end
+
+  def create
+    @incident = incident_class.new(incident_params)
+
+    if @incident.save
+      redirect_to incidents_path, notice: "#{@incident.model_name.human} created."
+    else
+      render :new, status: :unprocessable_entity
+    end
+  end
+
+  def edit
+  end
+
+  def update
+    if @incident.update(incident_params)
+      redirect_to incidents_path, notice: "Saved."
+    else
+      render :edit, status: :unprocessable_entity
+    end
+  end
+
+  def destroy
+    @incident.destroy
+    redirect_to incidents_path, notice: "Deleted."
+  end
+
+  private
+    def set_incident
+      @incident = Upright::Incident.find(params[:id])
+    end
+
+    def incident_class
+      maintenance = ActiveModel::Type::Boolean.new.cast(params[:maintenance])
+      maintenance ? Upright::Maintenance : Upright::Incident
+    end
+
+    def incident_params
+      params.expect(incident: [ :title, :impact, :starts_at, :ends_at, :body, service_codes: [] ])
+    end
+end

data/app/controllers/upright/probe_results_controller.rb

@@ -12,6 +12,7 @@ class Upright::ProbeResultsController < Upright::ApplicationController
         .by_type(params[:probe_type])
         .by_status(params[:status])
         .by_name(params[:probe_name])
+        .by_date(params[:date])
         .with_attached_artifacts
     end
 end

data/app/controllers/upright/prometheus_proxy_controller.rb

@@ -1,8 +1,9 @@
 class Upright::PrometheusProxyController < Upright::ApplicationController
-  skip_forgery_protection
+  include Upright::ProxyAuthentication
 
   skip_before_action :authenticate_user, only: :otlp
-  before_action :authenticate_otlp_token, only: :otlp
+  skip_before_action :block_cross_site_session_requests, only: :otlp
+  before_action :authenticate_proxy_token, only: :otlp
 
   UNSUPPORTED_PATHS = %w[/api/v1/notifications]
 
@@ -10,12 +11,16 @@ class Upright::PrometheusProxyController < Upright::ApplicationController
   end
 
   def proxy
-    path = request.fullpath.sub(%r{^/prometheus}, "")
+    url = upstream_url(Upright.configuration.prometheus_url, request.fullpath.delete_prefix("/prometheus"))
 
-    if path.start_with?(*UNSUPPORTED_PATHS)
+    if url.nil?
+      head :bad_request
+    elsif url.path.start_with?(*UNSUPPORTED_PATHS)
       head :not_found
+    elsif token_forbidden_path?(url.path)
+      head :forbidden
     else
-      proxy_to_prometheus(path)
+      proxy_to_prometheus(url)
     end
   end
 
@@ -29,10 +34,10 @@ class Upright::PrometheusProxyController < Upright::ApplicationController
   end
 
   private
-    def proxy_to_prometheus(path, method: request.method, body: nil)
+    def proxy_to_prometheus(url, method: request.method, body: nil)
       response = prometheus_connection.run_request(
         method.downcase.to_sym,
-        path,
+        url.to_s,
         body,
         { "Content-Type" => request.content_type }
       )
@@ -45,18 +50,8 @@ class Upright::PrometheusProxyController < Upright::ApplicationController
     end
 
     def prometheus_connection
-      @prometheus_connection ||= Faraday.new(url: prometheus_url) do |f|
+      @prometheus_connection ||= Faraday.new(url: Upright.configuration.prometheus_url) do |f|
         f.options.timeout = 30
       end
     end
-
-    def prometheus_url
-      ENV.fetch("PROMETHEUS_URL", "http://localhost:9090")
-    end
-
-    def authenticate_otlp_token
-      authenticate_or_request_with_http_token do |token|
-        ActiveSupport::SecurityUtils.secure_compare(token, ENV.fetch("PROMETHEUS_OTLP_TOKEN", ""))
-      end
-    end
 end

data/app/controllers/upright/public/base_controller.rb

@@ -0,0 +1,16 @@
+# TODO: Throttle the public status routes (e.g. with Rack::Attack) if the 15s
+# Prometheus result cache (Upright::Services::LiveStatus::CACHE_TTL) proves
+# insufficient against anonymous request bursts. rack-attack isn't a dependency
+# yet, so we lean on caching for now.
+class Upright::Public::BaseController < ActionController::Base
+  layout "upright/public"
+
+  helper :all
+  protect_from_forgery with: :exception
+  rescue_from FrozenRecord::RecordNotFound, with: -> { head :not_found }
+
+  private
+    def default_url_options
+      Rails.application.routes.default_url_options
+    end
+end

data/app/controllers/upright/public/incidents_controller.rb

@@ -0,0 +1,6 @@
+class Upright::Public::IncidentsController < Upright::Public::BaseController
+  def show
+    @incident = Upright::Incident.public_facing.find(params[:id])
+    expires_in 15.seconds, public: true
+  end
+end

data/app/controllers/upright/public/service_incidents_controller.rb

@@ -0,0 +1,7 @@
+class Upright::Public::ServiceIncidentsController < Upright::Public::BaseController
+  def index
+    service = Upright::Service.public_facing.find_by!(code: params[:service_code])
+    @incident_history = service.incident_history(page: params[:page])
+    expires_in 15.seconds, public: true
+  end
+end

data/app/controllers/upright/public/services_controller.rb

@@ -0,0 +1,6 @@
+class Upright::Public::ServicesController < Upright::Public::BaseController
+  def index
+    @status_page = Upright::Service::StatusPage.current
+    expires_in 15.seconds, public: true
+  end
+end

data/app/controllers/upright/sessions_controller.rb

@@ -1,16 +1,24 @@
 class Upright::SessionsController < Upright::ApplicationController
   skip_before_action :authenticate_user, only: [ :new, :create ]
+  # External identity providers (OpenID Connect, including
+  # `response_mode=form_post`) return to the callback without a Rails authenticity
+  # token and are validated by the provider's own state nonce, so Rails' automatic
+  # token check is skipped here. The static_credentials callback is same-origin and
+  # MUST present a token — enforced explicitly in verify_credential_callback.
   skip_forgery_protection only: :create
 
   before_action :ensure_not_signed_in, only: [ :new, :create ]
+  before_action :verify_credential_callback, only: :create
 
   def new
   end
 
   def create
+    return_to = safe_return_to(session[:return_to])
+    reset_session
     user = Upright::User.from_omniauth(request.env["omniauth.auth"])
     session[:user_info] = { email: user.email, name: user.name }
-    redirect_to upright.root_path
+    redirect_to return_to || upright.root_path, allow_other_host: true
   end
 
   def destroy
@@ -23,6 +31,34 @@ class Upright::SessionsController < Upright::ApplicationController
       redirect_to upright.site_root_path if session[:user_info].present?
     end
 
+    # The static_credentials callback must arrive as a POST carrying a valid
+    # authenticity token: any other verb (a Lax-cookie GET, or a HEAD that CSRF
+    # skips) or a missing/foreign token could otherwise plant an attacker-chosen
+    # session (CVE-2026-67993). External providers are validated by their own
+    # state nonce (see skip_forgery_protection above) and are exempt.
+    def verify_credential_callback
+      return unless params[:provider].to_s == "static_credentials"
+
+      if !request.post?
+        head :not_found
+      elsif !verified_request?
+        raise ActionController::InvalidAuthenticityToken
+      end
+    end
+
+    # `allow_other_host: true` is needed to return across our own subdomains
+    # (app → a site), so bound it: only honour a stored return_to whose host is
+    # this deployment's hostname or a subdomain of it, never a foreign host (F-15).
+    def safe_return_to(url)
+      return nil if url.blank?
+
+      host = URI.parse(url).host
+      hostname = Upright.configuration.hostname
+      url if host && hostname.present? && (host == hostname || host.end_with?(".#{hostname}"))
+    rescue URI::InvalidURIError
+      nil
+    end
+
     def upright
       Upright::Engine.routes.url_helpers
     end

data/app/controllers/upright/traces_controller.rb

@@ -0,0 +1,88 @@
+class Upright::TracesController < Upright::ApplicationController
+  include ActiveStorage::DisableSession
+
+  PURPOSE = :upright_trace
+  EXPIRES_IN = 24.hours
+
+  skip_before_action :authenticate_user
+
+  prepend_before_action :answer_preflight, if: -> { request.options? }
+
+  before_action :allow_trace_viewer_origin
+  before_action :set_trace
+
+  def self.signed_id_for(attachment)
+    attachment.signed_id(purpose: PURPOSE, expires_in: EXPIRES_IN)
+  end
+
+  def show
+    expires_in EXPIRES_IN, public: false
+    response.headers["Accept-Ranges"] = "bytes"
+
+    if request.head?
+      send_trace_size
+    elsif (range = request.headers["Range"]).present?
+      send_trace_range range
+    else
+      send_trace @trace.download
+    end
+  end
+
+  private
+    def allow_trace_viewer_origin
+      origin = Upright.configuration.trace_viewer_origin
+      return head :not_found if origin.blank?
+
+      response.headers["Access-Control-Allow-Origin"] = origin
+      response.headers["Access-Control-Expose-Headers"] = "Accept-Ranges, Content-Range"
+      response.headers["Vary"] = "Origin"
+    end
+
+    def answer_preflight
+      allow_trace_viewer_origin
+      return if performed?
+
+      response.headers["Access-Control-Allow-Methods"] = "GET, HEAD, OPTIONS"
+      response.headers["Access-Control-Allow-Headers"] = request.headers["Access-Control-Request-Headers"].to_s
+      response.headers["Access-Control-Max-Age"] = 1.day.to_i.to_s
+      response.headers["Vary"] = "Origin, Access-Control-Request-Headers"
+
+      head :no_content
+    end
+
+    def send_trace_size
+      response.headers["Content-Length"] = @trace.byte_size.to_s
+      response.headers["Content-Type"] = @trace.content_type_for_serving
+
+      head :ok
+    end
+
+    def send_trace_range(header)
+      ranges = Rack::Utils.get_byte_ranges(header, @trace.byte_size)
+      return head :range_not_satisfiable unless ranges&.one?
+
+      range = ranges.first
+      response.headers["Content-Range"] = "bytes #{range.begin}-#{range.end}/#{@trace.byte_size}"
+
+      send_trace @trace.download_chunk(range), status: :partial_content
+    end
+
+    def send_trace(data, status: :ok)
+      send_data data,
+        status: status,
+        type: @trace.content_type_for_serving,
+        disposition: :inline,
+        filename: @trace.filename.sanitized
+    end
+
+    def set_trace
+      @trace = ActiveStorage::Blob.find_signed(params[:signed_id], purpose: PURPOSE)
+
+      head :not_found unless @trace && probe_result_trace?
+    end
+
+    def probe_result_trace?
+      @trace.filename.to_s.end_with?(".zip") &&
+        @trace.attachments.exists?(record_type: "Upright::ProbeResult")
+    end
+end

data/app/helpers/upright/application_helper.rb

@@ -7,14 +7,34 @@ module Upright::ApplicationHelper
     "#{country_flag(site.country)} #{site.city}"
   end
 
+  def metrics_subdomain
+    if Upright::Current.site.nil? || metrics_sites.none?
+      Upright.configuration.global_subdomain
+    elsif Upright::Current.site.stores_metrics?
+      Upright::Current.site.code
+    end
+  end
+
+  def metrics_sites_sentence
+    metrics_sites.map(&:city).to_sentence
+  end
+
+  def page_title_tag(app_name = "Upright")
+    tag.title [ @page_title, app_name ].compact.join(" · ")
+  end
+
   def upright_stylesheet_link_tag(**options)
-    Upright::Engine.root.join("app/assets/stylesheets/upright").glob("*.css")
+    engine_stylesheets = Upright::Engine.root.join("app/assets/stylesheets/upright").glob("*.css")
       .map { |f| "upright/#{f.basename('.css')}" }.sort
-      .then { |stylesheets| stylesheet_link_tag(*stylesheets, **options) }
+    stylesheet_link_tag(*engine_stylesheets, *Upright.configuration.public_stylesheets, **options)
   end
 
   private
 
+  def metrics_sites
+    Upright.sites.select(&:stores_metrics?)
+  end
+
   def country_flag(country_code)
     country_code&.upcase&.gsub(/[A-Z]/) { |c| (c.ord + 0x1F1A5).chr(Encoding::UTF_8) }
   end

data/app/helpers/upright/artifacts_helper.rb

@@ -0,0 +1,20 @@
+module Upright::ArtifactsHelper
+  def trace?(artifact)
+    artifact.filename.to_s.end_with?(".zip")
+  end
+
+  def trace_viewer_url_for(artifact)
+    viewer = Upright.configuration.trace_viewer_url
+    return if viewer.blank?
+
+    URI(viewer).tap do |url|
+      query = Rack::Utils.parse_query(url.query).except("trace")
+      url.query = query.merge("trace" => trace_url_for(artifact)).to_query
+    end.to_s
+  end
+
+  private
+    def trace_url_for(artifact)
+      site_trace_url(signed_id: Upright::TracesController.signed_id_for(artifact), host: request.host)
+    end
+end

data/app/helpers/upright/probe_results_helper.rb

@@ -1,15 +1,7 @@
 module Upright::ProbeResultsHelper
-  PROBE_TYPE_ICONS = {
-    http: "🌐",
-    playwright: "🎭",
-    ping: "📶",
-    smtp: "✉️",
-    traceroute: "🛤️"
-  }
-
   def probe_type_icon(probe_type)
-    icon = PROBE_TYPE_ICONS.fetch(probe_type.to_s.downcase.to_sym)
-    content_tag(:span, icon, title: probe_type.titleize)
+    registered = Upright.probe_types.find(probe_type)
+    content_tag(:span, registered.icon, title: registered.name)
   end
 
   def type_filter_link(label, probe_type = nil)
@@ -27,6 +19,7 @@ module Upright::ProbeResultsHelper
     when /^request\.log$/ then "📤"
     when /^response\./    then "📥"
     when /^smtp\.log$/    then "📧"
+    when /\.zip$/         then "🎭"
     else "📎"
     end
   end
@@ -44,6 +37,7 @@ module Upright::ProbeResultsHelper
     parts << "for #{params[:probe_type].titleize} probes" if params[:probe_type].present?
     parts << "named #{params[:probe_name]}" if params[:probe_name].present?
     parts << "with status #{params[:status]}" if params[:status].present?
+    parts << "on #{Date.parse(params[:date]).to_fs(:long)}" if params[:date].present?
     parts.join(" ")
   end
 end

data/app/helpers/upright/public/services_helper.rb

@@ -0,0 +1,70 @@
+module Upright::Public::ServicesHelper
+  include LocalTimeHelper
+
+  OVERALL_STATUS_LABELS = {
+    operational:    "All Systems Operational",
+    degraded:       "Some Systems Degraded",
+    partial_outage: "Partial Outage",
+    major_outage:   "Major Outage",
+    maintenance:    "Service Under Maintenance"
+  }
+
+  def overall_status_label(status)
+    OVERALL_STATUS_LABELS.fetch(status)
+  end
+
+  def maintenance_window_description(maintenance)
+    start, finish = maintenance.starts_at, maintenance.ends_at
+    same_day = finish && start.to_date == finish.to_date
+
+    if same_day
+      "#{start.to_fs(:month_day_at)}–#{finish.to_fs(:clock_zone)}"
+    elsif finish
+      "#{start.to_fs(:month_day_at)} – #{finish.to_fs(:month_day_at_zone)}"
+    else
+      start.to_fs(:month_day_at_zone)
+    end
+  end
+
+  def local_maintenance_window(event)
+    if event.ends_at
+      safe_join([ local_time(event.starts_at, format: :month_day_at),
+                  local_time(event.ends_at, format: :month_day_at_zone) ], " – ")
+    else
+      local_time(event.starts_at, format: :month_day_at_zone)
+    end
+  end
+
+  def status_label(status)
+    status.to_s.humanize
+  end
+
+  def outage_duration_description(started_at:)
+    if started_at
+      "for #{distance_of_time_in_words(started_at, Time.current)}"
+    else
+      "for 24 hours+"
+    end
+  end
+
+  # Stable per-outage id so feed readers treat one ongoing outage as a single
+  # item. Falls back to the service code alone when the outage predates the live
+  # lookback window and has no known start time.
+  def feed_item_guid(outage)
+    [ outage.service.code, outage.started_at&.to_i ].compact.join("-")
+  end
+
+  def uptime_percentage_label(fractions)
+    if fractions.present?
+      percentage = fractions.sum.fdiv(fractions.size) * 100
+      # A flawless window is a bare "100%". Otherwise round down (so a real
+      # outage never reads as 100%) and always show three decimals for a
+      # consistent, precise read: "99.990%", "99.800%".
+      if percentage >= 100
+        number_to_percentage(100, precision: 0)
+      else
+        number_to_percentage(percentage, precision: 3, round_mode: :down)
+      end
+    end
+  end
+end

data/app/javascript/upright/application.js

@@ -1,2 +1,5 @@
 import "@hotwired/turbo-rails"
 import "upright/controllers"
+import LocalTime from "local-time"
+
+LocalTime.start()

data/app/javascript/upright/controllers/sites_map_controller.js

@@ -14,20 +14,28 @@ export default class extends Controller {
 
       L.marker([site.lat, site.lon])
         .addTo(map)
-        .bindPopup(`<strong>${site.hostname}</strong><br>${site.city}`)
+        .bindPopup(this.popupContent(site))
         .on("mouseover", function() { this.openPopup() })
         .on("mouseout", function() { this.closePopup() })
         .on("click", () => window.location.href = site.url)
     }
   }
 
+  // Build the popup as DOM nodes so hostname and city render as text,
+  // never as HTML.
+  popupContent(site) {
+    const content = document.createElement("div")
+    const hostname = document.createElement("strong")
+    hostname.textContent = site.hostname
+    content.append(hostname, document.createElement("br"), site.city ?? "")
+    return content
+  }
+
   get tileUrl() {
-    return window.matchMedia("(prefers-color-scheme: dark)").matches
-      ? "https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png"
-      : "https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png"
+    return "https://{s}.tile.openstreetmap.org/{z}/{x}/{y}.png"
   }
 
   get attribution() {
-    return '&copy; <a href="https://www.openstreetmap.org/copyright">OpenStreetMap</a> &copy; <a href="https://carto.com/attributions">CARTO</a>'
+    return '&copy; <a href="https://www.openstreetmap.org/copyright">OpenStreetMap</a>'
   }
 }

data/app/javascript/upright/controllers/template_controller.js

@@ -0,0 +1,11 @@
+import { Controller } from "@hotwired/stimulus"
+
+export default class extends Controller {
+  static targets = [ "body" ]
+
+  fill({ params: { body } }) {
+    this.bodyTarget.value = body
+    this.bodyTarget.dispatchEvent(new Event("input", { bubbles: true }))
+    this.bodyTarget.focus()
+  }
+}

data/app/javascript/upright/public.js

@@ -0,0 +1,5 @@
+// Entry point for the public status page. It loads only what that page uses:
+// local-time converts the server-rendered UTC timestamps to the visitor's zone.
+import LocalTime from "local-time"
+
+LocalTime.start()

data/app/jobs/upright/health_metrics_job.rb

@@ -0,0 +1,27 @@
+class Upright::HealthMetricsJob < Upright::ApplicationJob
+  queue_as :default
+
+  def perform
+    Yabeda.upright_primary_site.set({}, primary? ? 1 : 0)
+
+    # Probe-only sites are firewalled off the persistent database, where a
+    # connection attempt hangs rather than being refused and ties up this worker.
+    if stores_metrics?
+      if Upright::PersistentRecord.up?
+        Yabeda.upright_persistent_db_up.set({}, 1)
+        Upright::Rollups::ProbeRollup.export_metrics
+      else
+        Yabeda.upright_persistent_db_up.set({}, 0)
+      end
+    end
+  end
+
+  private
+    def primary?
+      Upright.current_site&.primary?
+    end
+
+    def stores_metrics?
+      Upright.current_site&.stores_metrics?
+    end
+end

data/app/jobs/upright/incident_reporter_job.rb

@@ -0,0 +1,7 @@
+class Upright::IncidentReporterJob < Upright::ApplicationJob
+  queue_as :default
+
+  def perform
+    Upright::Incident.report_downtime
+  end
+end

data/app/jobs/upright/maintenance_advance_job.rb

@@ -0,0 +1,8 @@
+class Upright::MaintenanceAdvanceJob < Upright::ApplicationJob
+  queue_as :default
+
+  def perform
+    Upright::Maintenance.unresolved.find_each(&:auto_advance_status)
+    Upright::Maintenance.export_service_metrics
+  end
+end

data/app/jobs/upright/playwright_video_sweep_job.rb

@@ -0,0 +1,21 @@
+# Playwright source recordings are deleted right after they're saved as
+# artifacts, but a crashed run can still strand them. Sweep any video files
+# old enough that no probe run could still be using them.
+class Upright::PlaywrightVideoSweepJob < Upright::ApplicationJob
+  queue_as :default
+
+  MAX_AGE = 1.hour
+
+  def perform
+    stray_videos.each do |path|
+      File.delete(path) if File.mtime(path) < MAX_AGE.ago
+    rescue Errno::ENOENT
+      # Already gone
+    end
+  end
+
+  private
+    def stray_videos
+      Dir.glob(Upright.configuration.video_storage_dir.join("*.webm").to_s)
+    end
+end