@oneuptime/common 11.0.3 → 11.0.5

package/Server/Services/DockerHostService.ts

@@ -192,21 +192,33 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    const cached: string | null = await GlobalCache.getString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-    );
+    let cached: string | null = null;
+    try {
+      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+    } catch {
+      /*
+       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
+       * cache error must never skip the DB write below, otherwise the
+       * resource is wrongly marked "disconnected" while telemetry is
+       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
+       */
+      cached = null;
+    }
 
     if (cached === extrasFingerprint) {
       return; // same data was written recently
     }
 
-    await GlobalCache.setString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-      extrasFingerprint,
-      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-    );
+    try {
+      await GlobalCache.setString(
+        LAST_SEEN_CACHE_NAMESPACE,
+        cacheKey,
+        extrasFingerprint,
+        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+      );
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const data: any = {

package/Server/Services/DockerSwarmClusterService.ts

@@ -202,21 +202,33 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    const cached: string | null = await GlobalCache.getString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-    );
+    let cached: string | null = null;
+    try {
+      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+    } catch {
+      /*
+       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
+       * cache error must never skip the DB write below, otherwise the
+       * resource is wrongly marked "disconnected" while telemetry is
+       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
+       */
+      cached = null;
+    }
 
     if (cached === extrasFingerprint) {
       return; // same data was written recently
     }
 
-    await GlobalCache.setString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-      extrasFingerprint,
-      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-    );
+    try {
+      await GlobalCache.setString(
+        LAST_SEEN_CACHE_NAMESPACE,
+        cacheKey,
+        extrasFingerprint,
+        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+      );
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const data: any = {

package/Server/Services/GlobalConfigService.ts

@@ -1,10 +1,60 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalConfig";
+import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+import ObjectID from "../../Types/ObjectID";
+import { OnUpdate } from "../Types/Database/Hooks";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 export class Service extends DatabaseService<Model> {
+  /*
+   * Caches the instance-wide "Require SSO for Login" flag. This is read on the
+   * authenticated request path (per project), so it must not hit Postgres every
+   * time. Refreshed at most once per 60s and invalidated on update below.
+   */
+  private requireSsoForLoginCache: InMemoryTTLCache<boolean> =
+    new InMemoryTTLCache(10_000);
+
   public constructor() {
     super(Model);
   }
+
+  /*
+   * Instance-wide: must every user sign in with SSO to access projects?
+   * (Master admins are exempted by the enforcement layer, not here.)
+   */
+  @CaptureSpan()
+  public async getRequireSsoForLogin(): Promise<boolean> {
+    const key: string = "global";
+    const cached: boolean | undefined = this.requireSsoForLoginCache.get(key);
+    if (cached !== undefined) {
+      return cached;
+    }
+
+    const config: Model | null = await this.findOneBy({
+      query: {},
+      select: { requireSsoForLogin: true },
+      props: { isRoot: true },
+    });
+
+    const value: boolean = Boolean(config?.requireSsoForLogin);
+    this.requireSsoForLoginCache.set(key, value, 60_000);
+    return value;
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    _updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    if (
+      (onUpdate.updateBy.data as { requireSsoForLogin?: unknown })
+        .requireSsoForLogin !== undefined
+    ) {
+      this.requireSsoForLoginCache.clear();
+    }
+
+    return onUpdate;
+  }
 }
 
 export default new Service();

package/Server/Services/GlobalOidcProjectService.ts

@@ -0,0 +1,85 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/GlobalOidcProject";
+import Team from "../../Models/DatabaseModels/Team";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import ObjectID from "../../Types/ObjectID";
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import validateGlobalProviderProjectTeams, {
+  resolveAttachmentProjectId,
+} from "../Utils/ValidateGlobalProviderProjectTeams";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    /*
+     * The attach form submits the project via the `project` relation, so the
+     * `projectId` FK is not set yet. Resolve it and persist it (the column is
+     * required / NOT NULL) before validating the default teams against it.
+     */
+    const projectId: ObjectID | undefined = resolveAttachmentProjectId(
+      createBy.data,
+    );
+
+    if (projectId) {
+      createBy.data.projectId = projectId;
+    }
+
+    await validateGlobalProviderProjectTeams({
+      teams: createBy.data.teams,
+      projectId,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    // `updateBy.data` is a partial-entity shape; narrow the relation/id here.
+    const teams: Array<Team> | undefined = updateBy.data.teams as unknown as
+      | Array<Team>
+      | undefined;
+
+    if (teams && teams.length > 0) {
+      const explicitProjectId: ObjectID | undefined = updateBy.data
+        .projectId as unknown as ObjectID | undefined;
+
+      if (explicitProjectId) {
+        await validateGlobalProviderProjectTeams({
+          teams,
+          projectId: explicitProjectId,
+        });
+      } else {
+        // projectId is immutable here; resolve it from the row(s) being updated.
+        const rows: Array<Model> = await this.findBy({
+          query: updateBy.query,
+          select: { _id: true, projectId: true },
+          limit: LIMIT_PER_PROJECT,
+          skip: 0,
+          props: { isRoot: true },
+        });
+
+        for (const row of rows) {
+          await validateGlobalProviderProjectTeams({
+            teams,
+            projectId: row.projectId,
+          });
+        }
+      }
+    }
+
+    return { updateBy, carryForward: null };
+  }
+}
+
+export default new Service();

package/Server/Services/GlobalOidcService.ts

@@ -0,0 +1,10 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/GlobalOidc";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+
+export default new Service();

package/Server/Services/GlobalSsoProjectService.ts

@@ -0,0 +1,85 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/GlobalSsoProject";
+import Team from "../../Models/DatabaseModels/Team";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import ObjectID from "../../Types/ObjectID";
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import validateGlobalProviderProjectTeams, {
+  resolveAttachmentProjectId,
+} from "../Utils/ValidateGlobalProviderProjectTeams";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    /*
+     * The attach form submits the project via the `project` relation, so the
+     * `projectId` FK is not set yet. Resolve it and persist it (the column is
+     * required / NOT NULL) before validating the default teams against it.
+     */
+    const projectId: ObjectID | undefined = resolveAttachmentProjectId(
+      createBy.data,
+    );
+
+    if (projectId) {
+      createBy.data.projectId = projectId;
+    }
+
+    await validateGlobalProviderProjectTeams({
+      teams: createBy.data.teams,
+      projectId,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    // `updateBy.data` is a partial-entity shape; narrow the relation/id here.
+    const teams: Array<Team> | undefined = updateBy.data.teams as unknown as
+      | Array<Team>
+      | undefined;
+
+    if (teams && teams.length > 0) {
+      const explicitProjectId: ObjectID | undefined = updateBy.data
+        .projectId as unknown as ObjectID | undefined;
+
+      if (explicitProjectId) {
+        await validateGlobalProviderProjectTeams({
+          teams,
+          projectId: explicitProjectId,
+        });
+      } else {
+        // projectId is immutable here; resolve it from the row(s) being updated.
+        const rows: Array<Model> = await this.findBy({
+          query: updateBy.query,
+          select: { _id: true, projectId: true },
+          limit: LIMIT_PER_PROJECT,
+          skip: 0,
+          props: { isRoot: true },
+        });
+
+        for (const row of rows) {
+          await validateGlobalProviderProjectTeams({
+            teams,
+            projectId: row.projectId,
+          });
+        }
+      }
+    }
+
+    return { updateBy, carryForward: null };
+  }
+}
+
+export default new Service();

package/Server/Services/GlobalSsoService.ts

@@ -0,0 +1,10 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/GlobalSso";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+}
+
+export default new Service();

package/Server/Services/HostService.ts

@@ -214,21 +214,33 @@ export class Service extends DatabaseService<Model> {
      */
     const cacheKey: string = hostId.toString();
     const extrasFingerprint: string = this.fingerprintExtras(extra);
-    const cached: string | null = await GlobalCache.getString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-    );
+    let cached: string | null = null;
+    try {
+      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+    } catch {
+      /*
+       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
+       * cache error must never skip the DB write below, otherwise the
+       * resource is wrongly marked "disconnected" while telemetry is
+       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
+       */
+      cached = null;
+    }
 
     if (cached === extrasFingerprint) {
       return; // same data was written recently
     }
 
-    await GlobalCache.setString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-      extrasFingerprint,
-      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-    );
+    try {
+      await GlobalCache.setString(
+        LAST_SEEN_CACHE_NAMESPACE,
+        cacheKey,
+        extrasFingerprint,
+        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+      );
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const data: any = {

package/Server/Services/Index.ts

@@ -106,6 +106,10 @@ import ProfileSampleService from "./ProfileSampleService";
 import ProjectSmtpConfigService from "./ProjectSmtpConfigService";
 import ProjectSsoService from "./ProjectSsoService";
 import ProjectOidcService from "./ProjectOidcService";
+import GlobalSsoService from "./GlobalSsoService";
+import GlobalOidcService from "./GlobalOidcService";
+import GlobalSsoProjectService from "./GlobalSsoProjectService";
+import GlobalOidcProjectService from "./GlobalOidcProjectService";
 import PromoCodeService from "./PromoCodeService";
 import EnterpriseLicenseService from "./EnterpriseLicenseService";
 import OpenSourceDeploymentService from "./OpenSourceDeploymentService";
@@ -343,6 +347,10 @@ const services: Array<BaseService> = [
   AIAgentTaskPullRequestService,
   ProjectSsoService,
   ProjectOidcService,
+  GlobalSsoService,
+  GlobalOidcService,
+  GlobalSsoProjectService,
+  GlobalOidcProjectService,
 
   ScheduledMaintenanceCustomFieldService,
   ScheduledMaintenanceInternalNoteService,

package/Server/Services/KubernetesClusterService.ts

@@ -155,21 +155,33 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    const cached: string | null = await GlobalCache.getString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-    );
+    let cached: string | null = null;
+    try {
+      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+    } catch {
+      /*
+       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
+       * cache error must never skip the DB write below, otherwise the
+       * resource is wrongly marked "disconnected" while telemetry is
+       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
+       */
+      cached = null;
+    }
 
     if (cached === extrasFingerprint) {
       return; // same data was written recently
     }
 
-    await GlobalCache.setString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-      extrasFingerprint,
-      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-    );
+    try {
+      await GlobalCache.setString(
+        LAST_SEEN_CACHE_NAMESPACE,
+        cacheKey,
+        extrasFingerprint,
+        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+      );
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const data: any = {

package/Server/Services/PodmanHostService.ts

@@ -192,21 +192,33 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    const cached: string | null = await GlobalCache.getString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-    );
+    let cached: string | null = null;
+    try {
+      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+    } catch {
+      /*
+       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
+       * cache error must never skip the DB write below, otherwise the
+       * resource is wrongly marked "disconnected" while telemetry is
+       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
+       */
+      cached = null;
+    }
 
     if (cached === extrasFingerprint) {
       return; // same data was written recently
     }
 
-    await GlobalCache.setString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-      extrasFingerprint,
-      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-    );
+    try {
+      await GlobalCache.setString(
+        LAST_SEEN_CACHE_NAMESPACE,
+        cacheKey,
+        extrasFingerprint,
+        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+      );
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const data: any = {

package/Server/Services/ProjectService.ts

@@ -103,6 +103,14 @@ export class ProjectService extends DatabaseService<Model> {
    */
   private requireSsoForLoginCache: InMemoryTTLCache<boolean> =
     new InMemoryTTLCache(10_000);
+  /*
+   * Caches the `requireSsoWithSsoProviderId` discriminator per project so the
+   * enforce-SSO middleware can require that the SSO token was issued by a
+   * specific provider. Stored as a string id (or null when unset). Populated
+   * alongside `getRequireSsoForLogin` so the common path stays a single query.
+   */
+  private requireSsoWithSsoProviderIdCache: InMemoryTTLCache<string | null> =
+    new InMemoryTTLCache(10_000);
   /*
    * Caches the current billing plan per project. `getCurrentPlan` is hit
    * by `CommonAPI.getDatabaseCommonInteractionProps` on every
@@ -351,6 +359,10 @@ export class ProjectService extends DatabaseService<Model> {
       this.requireSsoForLoginCache.clear();
     }
 
+    if (updateBy.data.requireSsoWithSsoProviderId !== undefined) {
+      this.requireSsoWithSsoProviderIdCache.clear();
+    }
+
     if (IsBillingEnabled) {
       if (
         updateBy.data.businessDetails ||
@@ -1338,7 +1350,7 @@ export class ProjectService extends DatabaseService<Model> {
 
     const project: Model | null = await this.findOneById({
       id: projectId,
-      select: { requireSsoForLogin: true },
+      select: { requireSsoForLogin: true, requireSsoWithSsoProviderId: true },
       props: { isRoot: true },
     });
 
@@ -1349,9 +1361,40 @@ export class ProjectService extends DatabaseService<Model> {
 
     const value: boolean = Boolean(project.requireSsoForLogin);
     this.requireSsoForLoginCache.set(key, value, 60_000);
+    this.requireSsoWithSsoProviderIdCache.set(
+      key,
+      project.requireSsoWithSsoProviderId
+        ? project.requireSsoWithSsoProviderId.toString()
+        : null,
+      60_000,
+    );
     return value;
   }
 
+  /**
+   * Returns the specific SSO provider id a project requires for SSO-enforced
+   * login, or null when any trusted provider is acceptable. Cached for 60s and
+   * populated by `getRequireSsoForLogin`, so the enforce path stays one query.
+   */
+  @CaptureSpan()
+  public async getRequireSsoWithSsoProviderId(
+    projectId: ObjectID,
+  ): Promise<ObjectID | null> {
+    const key: string = projectId.toString();
+    const cached: string | null | undefined =
+      this.requireSsoWithSsoProviderIdCache.get(key);
+    if (cached !== undefined) {
+      return cached ? new ObjectID(cached) : null;
+    }
+
+    // Populate both caches via the existing single-query path.
+    await this.getRequireSsoForLogin(projectId);
+
+    const populated: string | null | undefined =
+      this.requireSsoWithSsoProviderIdCache.get(key);
+    return populated ? new ObjectID(populated) : null;
+  }
+
   @CaptureSpan()
   public async getOwners(projectId: ObjectID): Promise<Array<User>> {
     if (!projectId) {

package/Server/Services/ProxmoxClusterService.ts

@@ -193,21 +193,33 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    const cached: string | null = await GlobalCache.getString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-    );
+    let cached: string | null = null;
+    try {
+      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+    } catch {
+      /*
+       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
+       * cache error must never skip the DB write below, otherwise the
+       * resource is wrongly marked "disconnected" while telemetry is
+       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
+       */
+      cached = null;
+    }
 
     if (cached === extrasFingerprint) {
       return; // same data was written recently
     }
 
-    await GlobalCache.setString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-      extrasFingerprint,
-      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-    );
+    try {
+      await GlobalCache.setString(
+        LAST_SEEN_CACHE_NAMESPACE,
+        cacheKey,
+        extrasFingerprint,
+        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+      );
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const data: any = {

package/Server/Services/RumApplicationService.ts

@@ -141,21 +141,33 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    const cached: string | null = await GlobalCache.getString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-    );
+    let cached: string | null = null;
+    try {
+      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
+    } catch {
+      /*
+       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
+       * cache error must never skip the DB write below, otherwise the
+       * resource is wrongly marked "disconnected" while telemetry is
+       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
+       */
+      cached = null;
+    }
 
     if (cached === extrasFingerprint) {
       return; // same data was written recently
     }
 
-    await GlobalCache.setString(
-      LAST_SEEN_CACHE_NAMESPACE,
-      cacheKey,
-      extrasFingerprint,
-      { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-    );
+    try {
+      await GlobalCache.setString(
+        LAST_SEEN_CACHE_NAMESPACE,
+        cacheKey,
+        extrasFingerprint,
+        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
+      );
+    } catch {
+      // Best-effort throttle write; proceed with the DB update regardless.
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const data: any = {