@oneuptime/common 11.0.1 → 11.0.2

package/Models/DatabaseModels/ScheduledMaintenance.ts

@@ -1,3 +1,4 @@
+import CephCluster from "./CephCluster";
 import DockerHost from "./DockerHost";
 import Host from "./Host";
 import KubernetesCluster from "./KubernetesCluster";
@@ -5,6 +6,7 @@ import Label from "./Label";
 import Monitor from "./Monitor";
 import MonitorStatus from "./MonitorStatus";
 import Project from "./Project";
+import ProxmoxCluster from "./ProxmoxCluster";
 import ScheduledMaintenanceState from "./ScheduledMaintenanceState";
 import Service from "./Service";
 import StatusPage from "./StatusPage";
@@ -652,6 +654,114 @@ export default class ScheduledMaintenance extends BaseModel {
   })
   public dockerHosts?: Array<DockerHost> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.CreateProjectScheduledMaintenance,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.ScheduledMaintenanceViewer,
+      Permission.ReadProjectScheduledMaintenance,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.EditProjectScheduledMaintenance,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: ProxmoxCluster,
+    title: "Proxmox Clusters",
+    description: "List of Proxmox clusters affected by this event.",
+  })
+  @ManyToMany(
+    () => {
+      return ProxmoxCluster;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "ScheduledMaintenanceProxmoxCluster",
+    inverseJoinColumn: {
+      name: "proxmoxClusterId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "scheduledMaintenanceId",
+      referencedColumnName: "_id",
+    },
+  })
+  public proxmoxClusters?: Array<ProxmoxCluster> = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.CreateProjectScheduledMaintenance,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.ScheduledMaintenanceViewer,
+      Permission.ReadProjectScheduledMaintenance,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.EditProjectScheduledMaintenance,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: CephCluster,
+    title: "Ceph Clusters",
+    description: "List of Ceph clusters affected by this event.",
+  })
+  @ManyToMany(
+    () => {
+      return CephCluster;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "ScheduledMaintenanceCephCluster",
+    inverseJoinColumn: {
+      name: "cephClusterId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "scheduledMaintenanceId",
+      referencedColumnName: "_id",
+    },
+  })
+  public cephClusters?: Array<CephCluster> = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Server/API/BillingInvoiceAPI.ts

@@ -41,7 +41,9 @@ export default class UserAPI extends BaseAPI<
           }
 
           if (req.body["projectId"]) {
-            throw new BadDataException("projectId is required in request body");
+            throw new BadDataException(
+              "projectId should not be passed in the request body. The project is resolved from the tenantid header.",
+            );
           }
 
           const userPermissions: Array<UserPermission> = (
@@ -102,20 +104,57 @@ export default class UserAPI extends BaseAPI<
             throw new BadDataException("Invoice ID not found");
           }
 
-          if (!item.paymentProviderCustomerId) {
-            throw new BadDataException("Customer ID not found");
+          /*
+           * Never trust the customer id from the request body — always
+           * charge the authenticated project's own Stripe customer. A
+           * mismatch means the caller is trying to pay against another
+           * tenant's customer.
+           */
+          if (
+            item.paymentProviderCustomerId &&
+            item.paymentProviderCustomerId !== project.paymentProviderCustomerId
+          ) {
+            throw new BadDataException(
+              "Customer ID does not belong to this project",
+            );
+          }
+
+          // the invoice must belong to this project.
+          const billingInvoice: BillingInvoice | null =
+            await BillingInvoiceService.findOneBy({
+              query: {
+                projectId: project.id!,
+                paymentProviderInvoiceId: item.paymentProviderInvoiceId,
+              },
+              select: {
+                _id: true,
+              },
+              props: {
+                isRoot: true,
+                /*
+                 * skip onBeforeFind: it requires props.tenantId and would
+                 * re-sync all invoices from Stripe on every pay attempt.
+                 * The query above is already scoped to the project.
+                 */
+                ignoreHooks: true,
+              },
+            });
+
+          if (!billingInvoice) {
+            throw new BadDataException("Invoice not found for this project");
           }
+
           let invoice: Invoice | null = null;
 
           try {
             invoice = await BillingService.payInvoice(
-              item.paymentProviderCustomerId!,
-              item.paymentProviderInvoiceId!,
+              project.paymentProviderCustomerId,
+              item.paymentProviderInvoiceId,
             );
           } catch (err) {
             invoice = await BillingService.getInvoice(
-              item.paymentProviderCustomerId!,
-              item.paymentProviderInvoiceId!,
+              project.paymentProviderCustomerId,
+              item.paymentProviderInvoiceId,
             );
 
             // check if this invoice needs more authentication like 3ds secure.
@@ -142,6 +181,7 @@ export default class UserAPI extends BaseAPI<
 
           await this.service.updateOneBy({
             query: {
+              projectId: project.id!,
               paymentProviderInvoiceId: invoice.id!,
             },
             props: {

package/Server/API/CephResourceAPI.ts

@@ -0,0 +1,134 @@
+import CephResource from "../../Models/DatabaseModels/CephResource";
+import CephCluster from "../../Models/DatabaseModels/CephCluster";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import CephResourceService, {
+  CephInventorySummary,
+  Service as CephResourceServiceType,
+} from "../Services/CephResourceService";
+import CephClusterService from "../Services/CephClusterService";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import Response from "../Utils/Response";
+import BaseAPI from "./BaseAPI";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import CommonAPI from "./CommonAPI";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import { JSONObject } from "../../Types/JSON";
+
+/*
+ * ------------------------------------------------------------------
+ * CephResourceAPI
+ *
+ * Augments the auto-generated CRUD router with a single custom
+ * endpoint the Ceph layout/overview pages use to fetch sidebar badge
+ * counts in one round-trip:
+ *
+ *   POST /ceph-resource/inventory-summary/:clusterId
+ *
+ * The standard CRUD endpoints (list / get) are still registered by
+ * BaseAPI; the UI uses them via ModelAPI for list/detail reads.
+ * Write endpoints reject (@TableAccessControl create/update/delete
+ * = []); ingest writes go through CephResourceService as root.
+ * ------------------------------------------------------------------
+ */
+export default class CephResourceAPI extends BaseAPI<
+  CephResource,
+  CephResourceServiceType
+> {
+  public constructor() {
+    super(CephResource, CephResourceService);
+
+    this.router.post(
+      `${new this.entityType()
+        .getCrudApiPath()
+        ?.toString()}/inventory-summary/:clusterId`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          await this.getInventorySummary(req, res);
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+
+  /*
+   * Cluster + auth resolution for the cluster-scoped sub-route.
+   * Returns the (projectId, cephClusterId) tuple after enforcing the
+   * standard ACL chain. Throws NotFound when the cluster is missing
+   * or the caller lacks read access (indistinguishable on purpose).
+   */
+  private async resolveClusterForRequest(req: ExpressRequest): Promise<{
+    projectId: ObjectID;
+    cephClusterId: ObjectID;
+  }> {
+    const clusterIdParam: string | undefined = req.params["clusterId"];
+    if (!clusterIdParam) {
+      throw new BadDataException("Cluster ID is required");
+    }
+
+    let cephClusterId: ObjectID;
+    try {
+      cephClusterId = new ObjectID(clusterIdParam);
+    } catch {
+      throw new BadDataException("Invalid Cluster ID");
+    }
+
+    const props: DatabaseCommonInteractionProps =
+      await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+    const cluster: CephCluster | null = await CephClusterService.findOneById({
+      id: cephClusterId,
+      select: {
+        _id: true,
+        projectId: true,
+      },
+      props,
+    });
+
+    if (!cluster || !cluster.projectId) {
+      throw new NotFoundException("Ceph Cluster not found");
+    }
+
+    return {
+      projectId: cluster.projectId,
+      cephClusterId,
+    };
+  }
+
+  private async getInventorySummary(
+    req: ExpressRequest,
+    res: ExpressResponse,
+  ): Promise<void> {
+    const { projectId, cephClusterId } =
+      await this.resolveClusterForRequest(req);
+
+    const summary: CephInventorySummary =
+      await this.service.getInventorySummary({
+        projectId,
+        cephClusterId,
+      });
+
+    const responseBody: JSONObject = {
+      countsByKind: summary.countsByKind as unknown as JSONObject,
+      // Convenience fields so the UI doesn't have to repeat COALESCE:
+      osdCount: summary.countsByKind["Osd"] || 0,
+      poolCount: summary.countsByKind["Pool"] || 0,
+      monCount: summary.countsByKind["Mon"] || 0,
+      mgrCount: summary.countsByKind["Mgr"] || 0,
+      mdsCount: summary.countsByKind["Mds"] || 0,
+      rgwCount: summary.countsByKind["Rgw"] || 0,
+      osdUpCount: summary.osdUpCount,
+      osdInCount: summary.osdInCount,
+      monInQuorumCount: summary.monInQuorumCount,
+    };
+
+    return Response.sendJsonObjectResponse(req, res, responseBody);
+  }
+}

package/Server/API/DashboardAPI.ts

@@ -45,6 +45,8 @@ import Host from "../../Models/DatabaseModels/Host";
 import KubernetesResource from "../../Models/DatabaseModels/KubernetesResource";
 import DockerHost from "../../Models/DatabaseModels/DockerHost";
 import DockerResource from "../../Models/DatabaseModels/DockerResource";
+import ProxmoxResource from "../../Models/DatabaseModels/ProxmoxResource";
+import CephResource from "../../Models/DatabaseModels/CephResource";
 import Span from "../../Models/AnalyticsModels/Span";
 import Log from "../../Models/AnalyticsModels/Log";
 import IncidentService from "../Services/IncidentService";
@@ -54,6 +56,8 @@ import HostService from "../Services/HostService";
 import KubernetesResourceService from "../Services/KubernetesResourceService";
 import DockerHostService from "../Services/DockerHostService";
 import DockerResourceService from "../Services/DockerResourceService";
+import ProxmoxResourceService from "../Services/ProxmoxResourceService";
+import CephResourceService from "../Services/CephResourceService";
 import SpanService from "../Services/SpanService";
 import LogService from "../Services/LogService";
 
@@ -211,6 +215,48 @@ const PUBLIC_DASHBOARD_RESOURCES: Record<
       dockerHost: { name: true },
     },
   },
+  "proxmox-resource": {
+    modelType: ProxmoxResource,
+    service: ProxmoxResourceService,
+    select: {
+      _id: true,
+      name: true,
+      externalId: true,
+      kind: true,
+      vmid: true,
+      guestType: true,
+      parentNodeName: true,
+      isUp: true,
+      haState: true,
+      latestCpuPercent: true,
+      latestMemoryPercent: true,
+      lastSeenAt: true,
+      proxmoxClusterId: true,
+      proxmoxCluster: { name: true },
+    },
+  },
+  "ceph-resource": {
+    modelType: CephResource,
+    service: CephResourceService,
+    select: {
+      _id: true,
+      name: true,
+      externalId: true,
+      kind: true,
+      hostname: true,
+      deviceClass: true,
+      isUp: true,
+      isIn: true,
+      statBytes: true,
+      statBytesUsed: true,
+      storedBytes: true,
+      maxAvailBytes: true,
+      objects: true,
+      lastSeenAt: true,
+      cephClusterId: true,
+      cephCluster: { name: true },
+    },
+  },
   span: {
     modelType: Span,
     service: SpanService,

package/Server/API/ProjectAPI.ts

@@ -45,6 +45,21 @@ export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
 
           const projectId: ObjectID = new ObjectID(req.params["id"] as string);
 
+          /*
+           * The permission check below is bound to the authenticated tenant
+           * (resolved from the tenantid header), so the project being
+           * mutated must be that same tenant — otherwise permissions on one
+           * project would authorize changing the plan (and charging the
+           * payment method) of another.
+           */
+          const tenantId: ObjectID | null = this.getTenantId(req);
+
+          if (!tenantId || tenantId.toString() !== projectId.toString()) {
+            throw new BadDataException(
+              "Project ID in the URL does not match the project the request is authenticated for",
+            );
+          }
+
           const body: JSONObject = (req.body as JSONObject) || {};
           const data: JSONObject = (body["data"] as JSONObject) || {};
           const paymentProviderPlanId: string | undefined = data[

package/Server/API/ProxmoxResourceAPI.ts

@@ -0,0 +1,132 @@
+import ProxmoxResource from "../../Models/DatabaseModels/ProxmoxResource";
+import ProxmoxCluster from "../../Models/DatabaseModels/ProxmoxCluster";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import ProxmoxResourceService, {
+  ProxmoxInventorySummary,
+  Service as ProxmoxResourceServiceType,
+} from "../Services/ProxmoxResourceService";
+import ProxmoxClusterService from "../Services/ProxmoxClusterService";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import Response from "../Utils/Response";
+import BaseAPI from "./BaseAPI";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import CommonAPI from "./CommonAPI";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import { JSONObject } from "../../Types/JSON";
+
+/*
+ * ------------------------------------------------------------------
+ * ProxmoxResourceAPI
+ *
+ * Augments the auto-generated CRUD router with a single custom
+ * endpoint the Proxmox layout/overview pages use to fetch sidebar
+ * badge counts in one round-trip:
+ *
+ *   POST /proxmox-resource/inventory-summary/:clusterId
+ *
+ * The standard CRUD endpoints (list / get) are still registered by
+ * BaseAPI; the UI uses them via ModelAPI for list/detail reads.
+ * Write endpoints reject (@TableAccessControl create/update/delete
+ * = []); ingest writes go through ProxmoxResourceService as root.
+ * ------------------------------------------------------------------
+ */
+export default class ProxmoxResourceAPI extends BaseAPI<
+  ProxmoxResource,
+  ProxmoxResourceServiceType
+> {
+  public constructor() {
+    super(ProxmoxResource, ProxmoxResourceService);
+
+    this.router.post(
+      `${new this.entityType()
+        .getCrudApiPath()
+        ?.toString()}/inventory-summary/:clusterId`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          await this.getInventorySummary(req, res);
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+
+  /*
+   * Cluster + auth resolution for the cluster-scoped sub-route.
+   * Returns the (projectId, proxmoxClusterId) tuple after enforcing
+   * the standard ACL chain. Throws NotFound when the cluster is
+   * missing or the caller lacks read access (indistinguishable on
+   * purpose).
+   */
+  private async resolveClusterForRequest(req: ExpressRequest): Promise<{
+    projectId: ObjectID;
+    proxmoxClusterId: ObjectID;
+  }> {
+    const clusterIdParam: string | undefined = req.params["clusterId"];
+    if (!clusterIdParam) {
+      throw new BadDataException("Cluster ID is required");
+    }
+
+    let proxmoxClusterId: ObjectID;
+    try {
+      proxmoxClusterId = new ObjectID(clusterIdParam);
+    } catch {
+      throw new BadDataException("Invalid Cluster ID");
+    }
+
+    const props: DatabaseCommonInteractionProps =
+      await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+    const cluster: ProxmoxCluster | null =
+      await ProxmoxClusterService.findOneById({
+        id: proxmoxClusterId,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        props,
+      });
+
+    if (!cluster || !cluster.projectId) {
+      throw new NotFoundException("Proxmox Cluster not found");
+    }
+
+    return {
+      projectId: cluster.projectId,
+      proxmoxClusterId,
+    };
+  }
+
+  private async getInventorySummary(
+    req: ExpressRequest,
+    res: ExpressResponse,
+  ): Promise<void> {
+    const { projectId, proxmoxClusterId } =
+      await this.resolveClusterForRequest(req);
+
+    const summary: ProxmoxInventorySummary =
+      await this.service.getInventorySummary({
+        projectId,
+        proxmoxClusterId,
+      });
+
+    const responseBody: JSONObject = {
+      countsByKind: summary.countsByKind as unknown as JSONObject,
+      // Convenience fields so the UI doesn't have to repeat COALESCE:
+      nodeCount: summary.countsByKind["Node"] || 0,
+      guestCount: summary.countsByKind["Guest"] || 0,
+      storageCount: summary.countsByKind["Storage"] || 0,
+      nodeOnlineCount: summary.nodeOnlineCount,
+      guestRunningCount: summary.guestRunningCount,
+    };
+
+    return Response.sendJsonObjectResponse(req, res, responseBody);
+  }
+}

package/Server/API/ResellerPlanAPI.ts

@@ -77,6 +77,7 @@ export default class ResellerPlanAPI extends BaseAPI<
                 _id: true,
                 planId: true,
                 reseller: {
+                  _id: true,
                   resellerId: true,
                 },
                 teamMemberLimit: true,
@@ -98,6 +99,13 @@ export default class ResellerPlanAPI extends BaseAPI<
             );
           }
 
+          const resellerObjectId: ObjectID | undefined =
+            resellerPlan.reseller?.id || undefined;
+
+          if (!resellerObjectId) {
+            throw new BadDataException("Invalid reseller plan id.");
+          }
+
           const licenseKey: string | undefined = req.body.uuid;
 
           if (!licenseKey) {
@@ -166,6 +174,12 @@ export default class ResellerPlanAPI extends BaseAPI<
             const project: Project | null = await ProjectService.findOneBy({
               query: {
                 resellerLicenseId: licenseKey,
+                /*
+                 * license keys are not globally unique — scope to the
+                 * authenticated reseller so one reseller cannot modify
+                 * another reseller's customer project.
+                 */
+                resellerId: resellerObjectId,
               },
               select: {
                 _id: true,
@@ -207,6 +221,8 @@ export default class ResellerPlanAPI extends BaseAPI<
             const project: Project | null = await ProjectService.findOneBy({
               query: {
                 resellerLicenseId: licenseKey,
+                // scope to the authenticated reseller — see enhance_tier.
+                resellerId: resellerObjectId,
               },
               select: {
                 _id: true,
@@ -226,6 +242,7 @@ export default class ResellerPlanAPI extends BaseAPI<
             await ProjectService.deleteOneBy({
               query: {
                 resellerLicenseId: licenseKey,
+                resellerId: resellerObjectId,
                 _id: project.id?.toString() as string,
               },
               props: {

package/Server/Infrastructure/GlobalCache.ts

@@ -164,9 +164,15 @@ export default abstract class GlobalCache {
       throw new DatabaseNotConnectedException("Cache is not connected");
     }
 
-    await client.set(`${namespace}-${key}`, value);
     const expiresInSeconds: number =
       options?.expiresInSeconds ?? OneUptimeDate.getSecondsInDays(30);
-    await client.expire(`${namespace}-${key}`, expiresInSeconds);
+
+    /*
+     * Atomic SET ... EX — a separate SET followed by EXPIRE can crash
+     * in between and leave the key with no TTL. For fence / throttle
+     * keys (e.g. otel-maintenance-fence) a TTL-less key never expires
+     * and permanently suppresses the work it gates.
+     */
+    await client.set(`${namespace}-${key}`, value, "EX", expiresInSeconds);
   }
 }