@oneuptime/common 10.0.92 → 10.0.94

package/Server/Types/Database/Permissions/TenantPermission.ts

@@ -2,14 +2,30 @@ import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
 import Query from "../Query";
 import Select from "../Select";
 import BasePermission, { CheckPermissionBaseInterface } from "./BasePermission";
+import TablePermission from "./TablePermission";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import Includes from "../../../../Types/BaseDatabase/Includes";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import BadDataException from "../../../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
 import ObjectID from "../../../../Types/ObjectID";
+import Permission from "../../../../Types/Permission";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 
+/*
+ * Permissions auto-granted to every logged-in tenant user. Holding only these
+ * (without an actual role permission) does not signal admin authority and so
+ * should not unlock cross-row access on models that scope by user.
+ */
+const AUTO_GRANTED_TENANT_PERMISSIONS: ReadonlyArray<Permission> = [
+  Permission.CurrentUser,
+  Permission.Public,
+  Permission.UnAuthorizedSsoUser,
+];
+
 export default class TenantPermission {
   @CaptureSpan()
   public static async addTenantScopeToQuery<TBaseModel extends BaseModel>(
@@ -32,6 +48,22 @@ export default class TenantPermission {
     // If this model has a tenantColumn, and request has tenantId, and is multiTenantQuery null then add tenantId to query.
     if (tenantColumn && props.tenantId && !props.isMultiTenantRequest) {
       (query as any)[tenantColumn] = props.tenantId;
+
+      /*
+       * If Permission.CurrentUser is the only thing letting the user through
+       * for this model+operation, also restrict the query to records they own.
+       * Otherwise the tenant filter alone leaves the user able to act on any
+       * row in the project (CVE-class issue when CurrentUser appears in a
+       * model's delete/update list alongside admin permissions).
+       */
+      if (
+        TenantPermission.shouldScopeQueryByCurrentUser(modelType, props, type)
+      ) {
+        const userColumn: string | null = model.getUserColumn();
+        if (userColumn) {
+          (query as any)[userColumn] = props.userId;
+        }
+      }
     }
     // if model allows user query without tenant, and user column is present, and userId is present, then add userId to query.
     else if (
@@ -124,4 +156,54 @@ export default class TenantPermission {
 
     return query;
   }
+
+  /**
+   * True if the only permission letting this user through the table-level
+   * check for this op is Permission.CurrentUser. In that case the query must
+   * be restricted to rows the user owns (via the model's user column).
+   */
+  private static shouldScopeQueryByCurrentUser<TBaseModel extends BaseModel>(
+    modelType: { new (): TBaseModel },
+    props: DatabaseCommonInteractionProps,
+    type: DatabaseRequestType,
+  ): boolean {
+    const model: BaseModel = new modelType();
+
+    if (!model.getUserColumn() || !props.userId) {
+      return false;
+    }
+
+    const modelPermissions: Array<Permission> =
+      TablePermission.getTablePermission(modelType, type);
+
+    if (!modelPermissions.includes(Permission.CurrentUser)) {
+      return false;
+    }
+
+    const userPermissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ).map((up: { permission: Permission }) => {
+        return up.permission;
+      });
+
+    const intersection: Array<Permission> = userPermissions.filter(
+      (p: Permission) => {
+        return modelPermissions.includes(p);
+      },
+    );
+
+    if (!intersection.includes(Permission.CurrentUser)) {
+      return false;
+    }
+
+    const adminMatch: Array<Permission> = intersection.filter(
+      (p: Permission) => {
+        return !AUTO_GRANTED_TENANT_PERMISSIONS.includes(p);
+      },
+    );
+
+    return adminMatch.length === 0;
+  }
 }

package/Types/Dashboard/DashboardComponentType.ts

@@ -9,6 +9,19 @@ enum DashboardComponentType {
   IncidentList = `IncidentList`,
   AlertList = `AlertList`,
   MonitorList = `MonitorList`,
+  KubernetesPodList = `KubernetesPodList`,
+  KubernetesNodeList = `KubernetesNodeList`,
+  KubernetesNamespaceList = `KubernetesNamespaceList`,
+  KubernetesDeploymentList = `KubernetesDeploymentList`,
+  KubernetesStatefulSetList = `KubernetesStatefulSetList`,
+  KubernetesDaemonSetList = `KubernetesDaemonSetList`,
+  KubernetesJobList = `KubernetesJobList`,
+  KubernetesCronJobList = `KubernetesCronJobList`,
+  DockerHostList = `DockerHostList`,
+  DockerContainerList = `DockerContainerList`,
+  DockerImageList = `DockerImageList`,
+  DockerNetworkList = `DockerNetworkList`,
+  DockerVolumeList = `DockerVolumeList`,
 }
 
 export default DashboardComponentType;

package/Types/Dashboard/DashboardComponents/ComponentArgument.ts

@@ -12,6 +12,21 @@ export enum ComponentInputType {
   MetricsQueryConfigs = "MetricsQueryConfigs",
   LongText = "Long Text",
   Dropdown = "Dropdown",
+  MultiSelectDropdown = "MultiSelectDropdown",
+  EntityDropdown = "EntityDropdown",
+  EntityMultiSelectDropdown = "EntityMultiSelectDropdown",
+}
+
+export enum EntityFilterModelType {
+  IncidentSeverity = "IncidentSeverity",
+  AlertSeverity = "AlertSeverity",
+  IncidentState = "IncidentState",
+  AlertState = "AlertState",
+  MonitorStatus = "MonitorStatus",
+  Monitor = "Monitor",
+  Label = "Label",
+  KubernetesCluster = "KubernetesCluster",
+  DockerHost = "DockerHost",
 }
 
 export interface ComponentArgumentSection {
@@ -32,4 +47,5 @@ export interface ComponentArgument<T extends DashboardBaseComponent> {
   placeholder?: string | undefined;
   dropdownOptions?: Array<DropdownOption> | undefined;
   section?: ComponentArgumentSection | undefined;
+  entityFilterModelType?: EntityFilterModelType | undefined;
 }

package/Types/Dashboard/DashboardComponents/DashboardAlertListComponent.ts

@@ -9,5 +9,9 @@ export default interface DashboardAlertListComponent extends BaseComponent {
     title?: string | undefined;
     maxRows?: number | undefined;
     stateFilter?: string | undefined;
+    severityIds?: Array<string> | undefined;
+    stateIds?: Array<string> | undefined;
+    monitorIds?: Array<string> | undefined;
+    labelIds?: Array<string> | undefined;
   };
 }

package/Types/Dashboard/DashboardComponents/DashboardDockerContainerListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerContainerListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerContainerList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    dockerHostIds?: Array<string> | undefined;
+    imageName?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardDockerHostListComponent.ts

@@ -0,0 +1,14 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerHostListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerHostList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    statusFilter?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardDockerImageListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerImageListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerImageList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    dockerHostIds?: Array<string> | undefined;
+    nameSearch?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardDockerNetworkListComponent.ts

@@ -0,0 +1,14 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerNetworkListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerNetworkList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    dockerHostIds?: Array<string> | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardDockerVolumeListComponent.ts

@@ -0,0 +1,14 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardDockerVolumeListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.DockerVolumeList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    dockerHostIds?: Array<string> | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardIncidentListComponent.ts

@@ -9,5 +9,9 @@ export default interface DashboardIncidentListComponent extends BaseComponent {
     title?: string | undefined;
     maxRows?: number | undefined;
     stateFilter?: string | undefined;
+    severityIds?: Array<string> | undefined;
+    stateIds?: Array<string> | undefined;
+    monitorIds?: Array<string> | undefined;
+    labelIds?: Array<string> | undefined;
   };
 }

package/Types/Dashboard/DashboardComponents/DashboardKubernetesCronJobListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesCronJobListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesCronJobList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesDaemonSetListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesDaemonSetListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesDaemonSetList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesDeploymentListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesDeploymentListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesDeploymentList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesJobListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesJobListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesJobList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesNamespaceListComponent.ts

@@ -0,0 +1,14 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesNamespaceListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesNamespaceList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesNodeListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesNodeListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesNodeList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    readinessFilter?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesPodListComponent.ts

@@ -0,0 +1,16 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesPodListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesPodList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+    podPhases?: Array<string> | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardKubernetesStatefulSetListComponent.ts

@@ -0,0 +1,15 @@
+import ObjectID from "../../ObjectID";
+import DashboardComponentType from "../DashboardComponentType";
+import BaseComponent from "./DashboardBaseComponent";
+
+export default interface DashboardKubernetesStatefulSetListComponent
+  extends BaseComponent {
+  componentType: DashboardComponentType.KubernetesStatefulSetList;
+  componentId: ObjectID;
+  arguments: {
+    title?: string | undefined;
+    maxRows?: number | undefined;
+    kubernetesClusterIds?: Array<string> | undefined;
+    namespaces?: string | undefined;
+  };
+}

package/Types/Dashboard/DashboardComponents/DashboardMonitorListComponent.ts

@@ -9,5 +9,8 @@ export default interface DashboardMonitorListComponent extends BaseComponent {
     title?: string | undefined;
     maxRows?: number | undefined;
     statusFilter?: string | undefined;
+    monitorStatusIds?: Array<string> | undefined;
+    monitorTypes?: Array<string> | undefined;
+    labelIds?: Array<string> | undefined;
   };
 }