@oneuptime/common 10.0.33 → 10.0.35

package/Server/Infrastructure/Postgres/SchemaMigrations/1773761409952-MigrationName.ts

@@ -0,0 +1,137 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1773761409952 implements MigrationInterface {
+  public name = "MigrationName1773761409952";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_kubernetes_cluster_projectId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_kubernetes_cluster_createdByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_kubernetes_cluster_deletedByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" DROP CONSTRAINT "FK_kubernetes_cluster_label_clusterId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" DROP CONSTRAINT "FK_kubernetes_cluster_label_labelId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_projectId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_clusterIdentifier"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_slug"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_label_clusterId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_label_labelId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyScheduleLayer" ALTER COLUMN "rotation" SET DEFAULT '{"_type":"Recurring","value":{"intervalType":"Day","intervalCount":{"_type":"PositiveNumber","value":1}}}'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyScheduleLayer" ALTER COLUMN "restrictionTimes" SET DEFAULT '{"_type":"RestrictionTimes","value":{"restictionType":"None","dayRestrictionTimes":null,"weeklyRestrictionTimes":[]}}'`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5ae5bbb0c93c048b0b76b1d426" ON "KubernetesCluster" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_b9259f6741a7965a518e258f61" ON "KubernetesCluster" ("clusterIdentifier") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_ed1b53bd041aa21b44ca8cdab5" ON "KubernetesClusterLabel" ("kubernetesClusterId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_2ec82ad068e84cf762c32ad7c7" ON "KubernetesClusterLabel" ("labelId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_5ae5bbb0c93c048b0b76b1d4268" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_1bee392c44b1aebe754932133a8" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_b0f6c98aac521060f8b68fe5c87" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" ADD CONSTRAINT "FK_ed1b53bd041aa21b44ca8cdab5e" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" ADD CONSTRAINT "FK_2ec82ad068e84cf762c32ad7c76" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" DROP CONSTRAINT "FK_2ec82ad068e84cf762c32ad7c76"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" DROP CONSTRAINT "FK_ed1b53bd041aa21b44ca8cdab5e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_b0f6c98aac521060f8b68fe5c87"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_1bee392c44b1aebe754932133a8"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_5ae5bbb0c93c048b0b76b1d4268"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_2ec82ad068e84cf762c32ad7c7"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ed1b53bd041aa21b44ca8cdab5"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b9259f6741a7965a518e258f61"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5ae5bbb0c93c048b0b76b1d426"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyScheduleLayer" ALTER COLUMN "restrictionTimes" SET DEFAULT '{"_type": "RestrictionTimes", "value": {"restictionType": "None", "dayRestrictionTimes": null, "weeklyRestrictionTimes": []}}'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyScheduleLayer" ALTER COLUMN "rotation" SET DEFAULT '{"_type": "Recurring", "value": {"intervalType": "Day", "intervalCount": {"_type": "PositiveNumber", "value": 1}}}'`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_kubernetes_cluster_label_labelId" ON "KubernetesClusterLabel" ("labelId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_kubernetes_cluster_label_clusterId" ON "KubernetesClusterLabel" ("kubernetesClusterId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_kubernetes_cluster_slug" ON "KubernetesCluster" ("slug") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_kubernetes_cluster_clusterIdentifier" ON "KubernetesCluster" ("clusterIdentifier") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_kubernetes_cluster_projectId" ON "KubernetesCluster" ("projectId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" ADD CONSTRAINT "FK_kubernetes_cluster_label_labelId" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" ADD CONSTRAINT "FK_kubernetes_cluster_label_clusterId" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_kubernetes_cluster_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_kubernetes_cluster_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_kubernetes_cluster_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1774000000000-MigrationName.ts

@@ -0,0 +1,80 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1774000000000 implements MigrationInterface {
+  public name = "MigrationName1774000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "KubernetesCluster" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "slug" character varying(100) NOT NULL, "description" character varying(500), "clusterIdentifier" character varying(100) NOT NULL, "provider" character varying(100) DEFAULT 'unknown', "otelCollectorStatus" character varying(100) DEFAULT 'disconnected', "lastSeenAt" TIMESTAMP WITH TIME ZONE, "nodeCount" integer DEFAULT '0', "podCount" integer DEFAULT '0', "namespaceCount" integer DEFAULT '0', "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_kubernetes_cluster_id" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_kubernetes_cluster_projectId" ON "KubernetesCluster" ("projectId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_kubernetes_cluster_clusterIdentifier" ON "KubernetesCluster" ("clusterIdentifier")`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_kubernetes_cluster_slug" ON "KubernetesCluster" ("slug")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_kubernetes_cluster_projectId" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_kubernetes_cluster_createdByUserId" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_kubernetes_cluster_deletedByUserId" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    // Label join table
+    await queryRunner.query(
+      `CREATE TABLE "KubernetesClusterLabel" ("kubernetesClusterId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_kubernetes_cluster_label" PRIMARY KEY ("kubernetesClusterId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_kubernetes_cluster_label_clusterId" ON "KubernetesClusterLabel" ("kubernetesClusterId")`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_kubernetes_cluster_label_labelId" ON "KubernetesClusterLabel" ("labelId")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" ADD CONSTRAINT "FK_kubernetes_cluster_label_clusterId" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" ADD CONSTRAINT "FK_kubernetes_cluster_label_labelId" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" DROP CONSTRAINT "FK_kubernetes_cluster_label_labelId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesClusterLabel" DROP CONSTRAINT "FK_kubernetes_cluster_label_clusterId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_label_labelId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_label_clusterId"`,
+    );
+    await queryRunner.query(`DROP TABLE "KubernetesClusterLabel"`);
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_kubernetes_cluster_deletedByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_kubernetes_cluster_createdByUserId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_kubernetes_cluster_projectId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_slug"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_clusterIdentifier"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_kubernetes_cluster_projectId"`,
+    );
+    await queryRunner.query(`DROP TABLE "KubernetesCluster"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -266,6 +266,8 @@ import { AddLogSavedView1772355000000 } from "./1772355000000-AddLogSavedView";
 import { MigrationName1773344537755 } from "./1773344537755-MigrationName";
 import { MigrationName1773402621107 } from "./1773402621107-MigrationName";
 import { MigrationName1773676206197 } from "./1773676206197-MigrationName";
+import { MigrationName1774000000000 } from "./1774000000000-MigrationName";
+import { MigrationName1773761409952 } from "./1773761409952-MigrationName";
 
 export default [
   InitialMigration,
@@ -536,4 +538,6 @@ export default [
   MigrationName1773344537755,
   MigrationName1773402621107,
   MigrationName1773676206197,
+  MigrationName1774000000000,
+  MigrationName1773761409952,
 ];

package/Server/Middleware/WhatsAppAuthorization.ts

@@ -0,0 +1,87 @@
+import {
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import BadDataException from "../../Types/Exception/BadDataException";
+import GlobalConfig from "../../Models/DatabaseModels/GlobalConfig";
+import GlobalConfigService from "../Services/GlobalConfigService";
+import ObjectID from "../../Types/ObjectID";
+import crypto from "crypto";
+import logger from "../Utils/Logger";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+export default class WhatsAppAuthorization {
+  @CaptureSpan()
+  public static async isAuthorizedWhatsAppRequest(
+    req: OneUptimeRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> {
+    logger.debug("Starting WhatsApp webhook signature verification");
+
+    const signature: string | undefined = req.headers["x-hub-signature-256"] as
+      | string
+      | undefined;
+
+    if (!signature) {
+      logger.error(
+        "WhatsApp webhook request missing X-Hub-Signature-256 header.",
+      );
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new BadDataException("Missing X-Hub-Signature-256 header."),
+      );
+    }
+
+    const globalConfig: GlobalConfig | null =
+      await GlobalConfigService.findOneBy({
+        query: {
+          _id: ObjectID.getZeroObjectID().toString(),
+        },
+        props: {
+          isRoot: true,
+        },
+        select: {
+          metaWhatsAppAppSecret: true,
+        },
+      });
+
+    const appSecret: string | undefined =
+      globalConfig?.metaWhatsAppAppSecret?.trim() || undefined;
+
+    if (!appSecret) {
+      logger.error(
+        "Meta WhatsApp App Secret is not configured. Cannot verify webhook signature.",
+      );
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new BadDataException("Meta WhatsApp App Secret is not configured."),
+      );
+    }
+
+    const rawBody: string = req.rawBody || "";
+
+    const expectedSignature: string = `sha256=${crypto.createHmac("sha256", appSecret).update(rawBody).digest("hex")}`;
+
+    if (
+      !crypto.timingSafeEqual(
+        Buffer.from(expectedSignature) as Uint8Array,
+        Buffer.from(signature) as Uint8Array,
+      )
+    ) {
+      logger.error("WhatsApp webhook signature verification failed.");
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new BadDataException("WhatsApp webhook signature verification failed."),
+      );
+    }
+
+    logger.debug("WhatsApp webhook signature verified successfully");
+    next();
+  }
+}

package/Server/Services/KubernetesClusterService.ts

@@ -0,0 +1,109 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/KubernetesCluster";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ObjectID from "../../Types/ObjectID";
+import QueryHelper from "../Types/Database/QueryHelper";
+import OneUptimeDate from "../../Types/Date";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  public async findOrCreateByClusterIdentifier(data: {
+    projectId: ObjectID;
+    clusterIdentifier: string;
+  }): Promise<Model> {
+    // Try to find existing cluster
+    const existingCluster: Model | null = await this.findOneBy({
+      query: {
+        projectId: data.projectId,
+        clusterIdentifier: data.clusterIdentifier,
+      },
+      select: {
+        _id: true,
+        projectId: true,
+        clusterIdentifier: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (existingCluster) {
+      return existingCluster;
+    }
+
+    // Create new cluster
+    const newCluster: Model = new Model();
+    newCluster.projectId = data.projectId;
+    newCluster.name = data.clusterIdentifier;
+    newCluster.clusterIdentifier = data.clusterIdentifier;
+    newCluster.otelCollectorStatus = "connected";
+    newCluster.lastSeenAt = OneUptimeDate.getCurrentDate();
+
+    const createdCluster: Model = await this.create({
+      data: newCluster,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return createdCluster;
+  }
+
+  @CaptureSpan()
+  public async updateLastSeen(clusterId: ObjectID): Promise<void> {
+    await this.updateOneById({
+      id: clusterId,
+      data: {
+        lastSeenAt: OneUptimeDate.getCurrentDate(),
+        otelCollectorStatus: "connected",
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
+  @CaptureSpan()
+  public async markDisconnectedClusters(): Promise<void> {
+    const fiveMinutesAgo: Date = OneUptimeDate.addRemoveMinutes(
+      OneUptimeDate.getCurrentDate(),
+      -5,
+    );
+
+    const connectedClusters: Array<Model> = await this.findBy({
+      query: {
+        otelCollectorStatus: "connected",
+        lastSeenAt: QueryHelper.lessThan(fiveMinutesAgo),
+      },
+      select: {
+        _id: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const cluster of connectedClusters) {
+      if (cluster._id) {
+        await this.updateOneById({
+          id: new ObjectID(cluster._id.toString()),
+          data: {
+            otelCollectorStatus: "disconnected",
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+      }
+    }
+  }
+}
+
+export default new Service();

package/Server/Services/UserService.ts

@@ -13,6 +13,7 @@ import MailService from "./MailService";
 import TeamMemberService from "./TeamMemberService";
 import UserNotificationRuleService from "./UserNotificationRuleService";
 import UserNotificationSettingService from "./UserNotificationSettingService";
+import UserSessionService from "./UserSessionService";
 import { AccountsRoute } from "../../ServiceRoute";
 import Hostname from "../../Types/API/Hostname";
 import Protocol from "../../Types/API/Protocol";
@@ -252,6 +253,11 @@ export class Service extends DatabaseService<Model> {
       const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
 
       for (const user of onUpdate.carryForward) {
+        // Revoke all active sessions for this user on password change
+        await UserSessionService.revokeAllSessionsByUserId(user.id!, {
+          reason: "Password changed",
+        });
+
         // password changed, send password changed mail
         MailService.sendMail({
           toEmail: user.email!,

package/Server/Services/UserSessionService.ts

@@ -1,6 +1,7 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/UserSession";
 import ObjectID from "../../Types/ObjectID";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
 import { JSONObject } from "../../Types/JSON";
 import HashedString from "../../Types/HashedString";
 import { EncryptionSecret } from "../EnvironmentConfig";
@@ -275,6 +276,28 @@ export class Service extends DatabaseService<Model> {
     await this.revokeSessionById(session.id, options);
   }
 
+  public async revokeAllSessionsByUserId(
+    userId: ObjectID,
+    options?: RevokeSessionOptions,
+  ): Promise<void> {
+    await this.updateBy({
+      query: {
+        userId: userId,
+        isRevoked: false,
+      },
+      data: {
+        isRevoked: true,
+        revokedAt: OneUptimeDate.getCurrentDate(),
+        revokedReason: options?.reason ?? null,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
   private buildSessionModel(
     options: CreateSessionOptions,
     tokenMeta: { refreshToken: string; refreshTokenExpiresAt: Date },

package/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

@@ -503,6 +503,10 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
 
     let first: boolean = true;
     for (const key in groupBy) {
+      if (!this.model.getTableColumn(key)) {
+        throw new BadDataException(`Unknown column: ${key}`);
+      }
+
       if (first) {
         first = false;
       } else {
@@ -518,6 +522,10 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
     const sortStatement: Statement = new Statement();
 
     for (const key in sort) {
+      if (!this.model.getTableColumn(key)) {
+        throw new BadDataException(`Unknown column: ${key}`);
+      }
+
       const value: SortOrder = sort[key]!;
       sortStatement.append(SQL`${key} `).append(
         {
@@ -541,6 +549,10 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
     for (const key in select) {
       const value: any = select[key];
       if (value) {
+        if (!this.model.getTableColumn(key)) {
+          throw new BadDataException(`Unknown column: ${key}`);
+        }
+
         columns.push(key);
         if (first) {
           first = false;

package/Server/Utils/Express.ts

@@ -13,7 +13,6 @@ import UserType from "../../Types/UserType";
 import "ejs";
 import express from "express";
 import { Server, createServer } from "http";
-import CaptureSpan from "./Telemetry/CaptureSpan";
 
 export type RequestHandler = express.RequestHandler;
 export type NextFunction = express.NextFunction;
@@ -61,22 +60,18 @@ class Express {
   private static app: express.Application;
   private static httpServer: Server;
 
-  @CaptureSpan()
   public static getRouter(): express.Router {
     return express.Router();
   }
 
-  @CaptureSpan()
   public static setupExpress(): void {
     this.app = express();
   }
 
-  @CaptureSpan()
   public static getHttpServer(): Server {
     return this.httpServer;
   }
 
-  @CaptureSpan()
   public static getExpressApp(): express.Application {
     if (!this.app) {
       this.setupExpress();
@@ -85,7 +80,6 @@ class Express {
     return this.app;
   }
 
-  @CaptureSpan()
   public static async launchApplication(
     appName: string,
     port?: Port,

package/Server/Utils/StartServer.ts

@@ -37,6 +37,7 @@ import Typeof from "../../Types/Typeof";
 import CookieParser from "cookie-parser";
 import cors from "cors";
 import zlib from "zlib";
+import path from "path";
 import "ejs";
 // Make sure we have stack trace for debugging.
 Error.stackTraceLimit = Infinity;
@@ -240,12 +241,15 @@ const init: InitFunction = async (
       },
     );
 
-    app.use(`/${appName}`, ExpressStatic("/usr/src/app/public"));
+    app.use(
+      `/${appName}`,
+      ExpressStatic(path.resolve(process.cwd(), "public")),
+    );
 
     app.get(
       `/${appName}/dist/Index.js`,
       (_req: ExpressRequest, res: ExpressResponse) => {
-        res.sendFile("/usr/src/app/public/dist/Index.js");
+        res.sendFile(path.resolve(process.cwd(), "public/dist/Index.js"));
       },
     );
 
@@ -285,7 +289,7 @@ const init: InitFunction = async (
             return;
           }
 
-          return res.render("/usr/src/app/views/index.ejs", {
+          return res.render(path.resolve(process.cwd(), "views/index.ejs"), {
             enableGoogleTagManager: IsBillingEnabled || false,
             ...variables,
           });

package/Server/Utils/VM/VMRunner.ts

@@ -28,9 +28,12 @@ const BLOCKED_SANDBOX_PROPERTIES: ReadonlySet<string> = new Set([
    * and traversal via page.context().browser().browserType().launch(...)
    */
   "browserType", // Browser → BrowserType (which has launch/connect)
+  "_browserType", // Internal alias for browserType — same escape vector
   "launch", // BrowserType.launch() spawns a child process
+  "launchServer", // BrowserType.launchServer() spawns a browser server process
   "launchPersistentContext", // BrowserType.launchPersistentContext() spawns a child process
   "connectOverCDP", // BrowserType.connectOverCDP() connects via Chrome DevTools Protocol
+  "connect", // BrowserType.connect() connects to a remote browser
   "newCDPSession", // BrowserContext/Page.newCDPSession() opens raw CDP sessions
 ]);
 

package/Types/Icon/IconProp.ts

@@ -320,6 +320,7 @@ enum IconProp {
   TableCellsIcon = "TableCellsIcon",
   UserIcon = "UserIcon",
   XCircle = "XCircle",
+  Kubernetes = "Kubernetes",
 }
 
 export default IconProp;

package/Types/Permission.ts

@@ -705,6 +705,11 @@ enum Permission {
   DeleteAlertSeverity = "DeleteAlertSeverity",
   ReadAlertSeverity = "ReadAlertSeverity",
 
+  CreateKubernetesCluster = "CreateKubernetesCluster",
+  DeleteKubernetesCluster = "DeleteKubernetesCluster",
+  EditKubernetesCluster = "EditKubernetesCluster",
+  ReadKubernetesCluster = "ReadKubernetesCluster",
+
   CreateService = "CreateService",
   DeleteService = "DeleteService",
   EditService = "EditService",
@@ -4324,6 +4329,43 @@ export class PermissionHelper {
         group: PermissionGroup.AIAgent,
       },
 
+      {
+        permission: Permission.CreateKubernetesCluster,
+        title: "Create Kubernetes Cluster",
+        description:
+          "This permission can create Kubernetes Cluster in this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: true,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.DeleteKubernetesCluster,
+        title: "Delete Kubernetes Cluster",
+        description:
+          "This permission can delete Kubernetes Cluster of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.EditKubernetesCluster,
+        title: "Edit Kubernetes Cluster",
+        description:
+          "This permission can edit Kubernetes Cluster of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+      {
+        permission: Permission.ReadKubernetesCluster,
+        title: "Read Kubernetes Cluster",
+        description:
+          "This permission can read Kubernetes Cluster of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        group: PermissionGroup.Telemetry,
+      },
+
       {
         permission: Permission.CreateService,
         title: "Create Service",