@oneuptime/common 11.5.2 → 11.5.4

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -871,5 +871,5 @@ export default [
   AddIoTDeviceCredentialTable1783780000000,
   AddSnmpV3AuthColumnsToNetworkDevice1783790000000,
   AddAdditionalParamsToLlmProvider1783650000000,
-  MigrationName1783937343400
+  MigrationName1783937343400,
 ];

package/Server/Services/DashboardService.ts

@@ -214,11 +214,20 @@ export class Service extends DatabaseService<Model> {
       const shouldEnforceMasterPassword: boolean = Boolean(
         dashboard &&
           dashboard.isPublicDashboard &&
-          dashboard.enableMasterPassword &&
-          dashboard.masterPassword,
+          dashboard.enableMasterPassword,
       );
 
       if (shouldEnforceMasterPassword) {
+        // Fail closed if protection was enabled before a password was set.
+        if (!dashboard?.masterPassword) {
+          return {
+            hasReadAccess: false,
+            error: new MasterPasswordRequiredException(
+              DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
+            ),
+          };
+        }
+
         const hasValidMasterPassword: boolean =
           this.hasValidMasterPasswordCookie({
             req,

package/Server/Utils/Execute.ts

@@ -27,22 +27,30 @@ export default class Execute {
           {
             ...options,
           },
-          (err: ExecException | null, stdout: string, stderr: string) => {
+          (
+            err: ExecException | null,
+            stdout: string | Buffer,
+            stderr: string | Buffer,
+          ) => {
+            // See executeCommandFile: string | Buffer for @types/node drift.
+            const stdoutText: string = stdout.toString();
+            const stderrText: string = stderr.toString();
+
             if (err) {
               logger.error(`Error executing command: ${command}`);
               logger.error(err);
-              logger.error(stdout);
-              if (stderr) {
-                logger.error(stderr);
+              logger.error(stdoutText);
+              if (stderrText) {
+                logger.error(stderrText);
               }
               return reject(err);
             }
 
-            if (stderr) {
-              logger.debug(stderr);
+            if (stderrText) {
+              logger.debug(stderrText);
             }
 
-            return resolve(stdout);
+            return resolve(stdoutText);
           },
         );
       },
@@ -81,22 +89,34 @@ export default class Execute {
               ? { timeout: data.timeoutInMS, killSignal: "SIGKILL" }
               : {}),
           },
-          (err: ExecException | null, stdout: string, stderr: string) => {
+          (
+            err: ExecException | null,
+            stdout: string | Buffer,
+            stderr: string | Buffer,
+          ) => {
+            /*
+             * Newer @types/node type execFile's callback output as
+             * string | Buffer — coerce so this compiles on both the pinned
+             * and freshly-resolved typings (caret ranges drift in CI).
+             */
+            const stdoutText: string = stdout.toString();
+            const stderrText: string = stderr.toString();
+
             if (err) {
               logger.error(
                 `Error executing command: ${data.command} ${data.args.join(" ")}`,
               );
               logger.error(err);
-              logger.error(stdout);
-              logger.error(stderr);
+              logger.error(stdoutText);
+              logger.error(stderrText);
               return reject(err);
             }
 
-            if (stderr) {
-              logger.debug(stderr);
+            if (stderrText) {
+              logger.debug(stderrText);
             }
 
-            return resolve(stdout);
+            return resolve(stdoutText);
           },
         );
       },

package/Server/Utils/Telemetry/LlmSpan.ts

@@ -1,4 +1,17 @@
 import Dictionary from "../../../Types/Dictionary";
+import {
+  LlmAgentNameAttributeKeys,
+  LlmAttributeNamespacePrefixes,
+  LlmCostAttributeKeys,
+  LlmInputTokenAttributeKeys,
+  LlmOperationAttributeKeys,
+  LlmOutputTokenAttributeKeys,
+  LlmRequestModelAttributeKeys,
+  LlmResponseModelAttributeKeys,
+  LlmSystemAttributeKeys,
+  LlmToolNameAttributeKeys,
+  LlmTotalTokenAttributeKeys,
+} from "../../../Types/Telemetry/LlmConventions";
 import { AttributeType } from "./Telemetry";
 
 /*
@@ -7,11 +20,9 @@ import { AttributeType } from "./Telemetry";
  * OneUptime ingests OpenTelemetry spans generically. To make LLM and agent
  * telemetry a first-class signal (filterable lists, token/cost/latency
  * rollups) we denormalize a small set of values out of the span attributes at
- * ingest time. We recognize the OpenTelemetry GenAI semantic conventions
- * (gen_ai.*) as primary, with cheap fallbacks for the two dominant
- * instrumentation libraries:
- *   - OpenLLMetry / Traceloop  (gen_ai.* + traceloop.*)
- *   - OpenInference / Arize    (llm.* + openinference.span.kind)
+ * ingest time. The set of recognized attribute keys lives in the shared
+ * Common/Types/Telemetry/LlmConventions module so this server-side extractor
+ * and the client-side display parser cannot drift out of sync.
  *
  * Prompt/completion CONTENT is intentionally NOT denormalized here — it stays
  * in the span's attributes/events map (already captured + scrubbed) and is
@@ -79,29 +90,19 @@ export default class LlmSpanUtil {
       return fields;
     }
 
-    fields.llmSystem = this.getString(attributes, [
-      "gen_ai.system",
-      "gen_ai.provider.name",
-      "llm.system",
-      "llm.provider",
-    ]);
-
-    fields.llmOperation = this.getString(attributes, [
-      "gen_ai.operation.name",
-      "llm.request.type",
-      "openinference.span.kind",
-    ]);
-
-    fields.llmRequestModel = this.getString(attributes, [
-      "gen_ai.request.model",
-      "llm.model_name",
-      "llm.request.model",
-    ]);
-
-    fields.llmResponseModel = this.getString(attributes, [
-      "gen_ai.response.model",
-      "llm.response.model",
-    ]);
+    fields.llmSystem = this.getString(attributes, LlmSystemAttributeKeys);
+
+    fields.llmOperation = this.getString(attributes, LlmOperationAttributeKeys);
+
+    fields.llmRequestModel = this.getString(
+      attributes,
+      LlmRequestModelAttributeKeys,
+    );
+
+    fields.llmResponseModel = this.getString(
+      attributes,
+      LlmResponseModelAttributeKeys,
+    );
 
     // Fall back to the response model when no request model was reported.
     if (!fields.llmRequestModel && fields.llmResponseModel) {
@@ -114,29 +115,15 @@ export default class LlmSpanUtil {
      * reject the row and fail the whole span batch.
      */
     fields.llmInputTokens = Math.trunc(
-      this.getNumber(attributes, [
-        "gen_ai.usage.input_tokens",
-        "gen_ai.usage.prompt_tokens",
-        "llm.token_count.prompt",
-        "llm.usage.prompt_tokens",
-      ]),
+      this.getNumber(attributes, LlmInputTokenAttributeKeys),
     );
 
     fields.llmOutputTokens = Math.trunc(
-      this.getNumber(attributes, [
-        "gen_ai.usage.output_tokens",
-        "gen_ai.usage.completion_tokens",
-        "llm.token_count.completion",
-        "llm.usage.completion_tokens",
-      ]),
+      this.getNumber(attributes, LlmOutputTokenAttributeKeys),
     );
 
     fields.llmTotalTokens = Math.trunc(
-      this.getNumber(attributes, [
-        "gen_ai.usage.total_tokens",
-        "llm.token_count.total",
-        "llm.usage.total_tokens",
-      ]),
+      this.getNumber(attributes, LlmTotalTokenAttributeKeys),
     );
 
     // Derive total when only the parts were reported.
@@ -147,22 +134,11 @@ export default class LlmSpanUtil {
       fields.llmTotalTokens = fields.llmInputTokens + fields.llmOutputTokens;
     }
 
-    fields.llmCost = this.getNumber(attributes, [
-      "gen_ai.usage.cost",
-      "gen_ai.usage.cost_usd",
-      "gen_ai.usage.total_cost",
-      "llm.usage.total_cost",
-    ]);
+    fields.llmCost = this.getNumber(attributes, LlmCostAttributeKeys);
 
-    fields.llmAgentName = this.getString(attributes, [
-      "gen_ai.agent.name",
-      "agent.name",
-    ]);
+    fields.llmAgentName = this.getString(attributes, LlmAgentNameAttributeKeys);
 
-    fields.llmToolName = this.getString(attributes, [
-      "gen_ai.tool.name",
-      "tool.name",
-    ]);
+    fields.llmToolName = this.getString(attributes, LlmToolNameAttributeKeys);
 
     fields.isLlmSpan = this.detectIsLlmSpan(keys, fields);
 
@@ -187,11 +163,9 @@ export default class LlmSpanUtil {
 
     // Last-resort: any GenAI/LLM-namespaced attribute at all.
     return keys.some((key: string) => {
-      return (
-        key.startsWith("gen_ai.") ||
-        key.startsWith("llm.") ||
-        key.startsWith("traceloop.")
-      );
+      return LlmAttributeNamespacePrefixes.some((prefix: string) => {
+        return key.startsWith(prefix);
+      });
     });
   }
 

package/Tests/Server/API/DashboardMasterPasswordAPI.test.ts

@@ -0,0 +1,225 @@
+import Dashboard from "../../../Models/DatabaseModels/Dashboard";
+import DashboardAPI from "../../../Server/API/DashboardAPI";
+import { EncryptionSecret } from "../../../Server/EnvironmentConfig";
+import DashboardService from "../../../Server/Services/DashboardService";
+import CookieUtil from "../../../Server/Utils/Cookie";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../../../Server/Utils/Express";
+import Response from "../../../Server/Utils/Response";
+import {
+  DASHBOARD_MASTER_PASSWORD_INVALID_MESSAGE,
+  DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
+} from "../../../Types/Dashboard/MasterPassword";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import MasterPasswordRequiredException from "../../../Types/Exception/MasterPasswordRequiredException";
+import HashedString from "../../../Types/HashedString";
+import ObjectID from "../../../Types/ObjectID";
+import { mockRouter } from "./Helpers";
+import {
+  afterEach,
+  beforeAll,
+  beforeEach,
+  describe,
+  expect,
+  it,
+} from "@jest/globals";
+
+jest.mock("../../../Server/Utils/Express", () => {
+  return {
+    getRouter: () => {
+      return mockRouter;
+    },
+  };
+});
+
+jest.mock("../../../Server/Utils/Response", () => {
+  return {
+    sendEntityArrayResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendJsonObjectResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendEmptySuccessResponse: jest.fn(),
+    sendEntityResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+    sendErrorResponse: jest.fn().mockImplementation((...args: []) => {
+      return args;
+    }),
+  };
+});
+
+describe("DashboardAPI master password", () => {
+  const password: string = "correct horse battery staple";
+
+  let dashboardId: ObjectID;
+  let dashboard: Dashboard;
+  let mockRequest: ExpressRequest;
+  let mockResponse: ExpressResponse;
+  let nextFunction: NextFunction;
+
+  beforeAll(() => {
+    mockRouter.routes.length = 0;
+    new DashboardAPI();
+  });
+
+  beforeEach(async () => {
+    jest.clearAllMocks();
+
+    dashboardId = ObjectID.generate();
+    dashboard = new Dashboard();
+    dashboard.id = dashboardId;
+    dashboard.isPublicDashboard = true;
+    dashboard.enableMasterPassword = true;
+    dashboard.masterPassword = new HashedString(
+      await HashedString.hashValue(password, EncryptionSecret),
+      true,
+    );
+
+    jest.spyOn(DashboardService, "findOneById").mockResolvedValue(dashboard);
+
+    mockRequest = {
+      params: {
+        dashboardId: dashboardId.toString(),
+      },
+      body: {
+        password,
+      },
+      cookies: {},
+      headers: {},
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    mockResponse = {
+      cookie: jest.fn(),
+      send: jest.fn(),
+      json: jest.fn(),
+      status: jest.fn().mockReturnThis(),
+    } as unknown as ExpressResponse;
+
+    nextFunction = jest.fn();
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("denies a protected public dashboard when no master-password cookie is present", async () => {
+    const result: Awaited<ReturnType<typeof DashboardService.hasReadAccess>> =
+      await DashboardService.hasReadAccess({
+        dashboardId,
+        req: mockRequest,
+      });
+
+    expect(result.hasReadAccess).toBe(false);
+    expect(result.error).toBeInstanceOf(MasterPasswordRequiredException);
+    expect(result.error?.message).toBe(
+      DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
+    );
+  });
+
+  it("fails closed when master-password protection is enabled without a stored password", async () => {
+    delete dashboard.masterPassword;
+
+    const result: Awaited<ReturnType<typeof DashboardService.hasReadAccess>> =
+      await DashboardService.hasReadAccess({
+        dashboardId,
+        req: mockRequest,
+      });
+
+    expect(result.hasReadAccess).toBe(false);
+    expect(result.error).toBeInstanceOf(MasterPasswordRequiredException);
+    expect(result.error?.message).toBe(
+      DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
+    );
+  });
+
+  it("issues a dashboard-scoped cookie for the correct password and unlocks only that dashboard", async () => {
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).not.toHaveBeenCalled();
+    expect(Response.sendEmptySuccessResponse).toHaveBeenCalledWith(
+      mockRequest,
+      mockResponse,
+    );
+    expect(mockResponse.cookie).toHaveBeenCalledTimes(1);
+
+    const cookieCall: Array<unknown> = (mockResponse.cookie as jest.Mock).mock
+      .calls[0] as Array<unknown>;
+    const cookieName: string = cookieCall[0] as string;
+    const cookieToken: string = cookieCall[1] as string;
+
+    expect(cookieName).toBe(
+      CookieUtil.getDashboardMasterPasswordKey(dashboardId),
+    );
+    expect(cookieToken).toEqual(expect.any(String));
+
+    const unlockedRequest: ExpressRequest = {
+      cookies: {
+        [cookieName]: cookieToken,
+      },
+      headers: {},
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    const unlockedResult: Awaited<
+      ReturnType<typeof DashboardService.hasReadAccess>
+    > = await DashboardService.hasReadAccess({
+      dashboardId,
+      req: unlockedRequest,
+    });
+
+    expect(unlockedResult.hasReadAccess).toBe(true);
+    expect(unlockedResult.error).toBeUndefined();
+
+    const otherDashboardId: ObjectID = ObjectID.generate();
+    const copiedCookieRequest: ExpressRequest = {
+      cookies: {
+        [CookieUtil.getDashboardMasterPasswordKey(otherDashboardId)]:
+          cookieToken,
+      },
+      headers: {},
+      socket: {},
+      ips: [],
+    } as unknown as ExpressRequest;
+
+    const isolatedResult: Awaited<
+      ReturnType<typeof DashboardService.hasReadAccess>
+    > = await DashboardService.hasReadAccess({
+      dashboardId: otherDashboardId,
+      req: copiedCookieRequest,
+    });
+
+    expect(isolatedResult.hasReadAccess).toBe(false);
+    expect(isolatedResult.error).toBeInstanceOf(
+      MasterPasswordRequiredException,
+    );
+  });
+
+  it("rejects an incorrect password without issuing a cookie", async () => {
+    mockRequest.body["password"] = "incorrect password";
+
+    await mockRouter
+      .match("post", "/dashboard/master-password/:dashboardId")
+      .handlerFunction(mockRequest, mockResponse, nextFunction);
+
+    expect(nextFunction).toHaveBeenCalledTimes(1);
+
+    const error: unknown = (nextFunction as jest.Mock).mock.calls[0]?.[0];
+
+    expect(error).toBeInstanceOf(BadDataException);
+    expect((error as BadDataException).message).toBe(
+      DASHBOARD_MASTER_PASSWORD_INVALID_MESSAGE,
+    );
+    expect(mockResponse.cookie).not.toHaveBeenCalled();
+    expect(Response.sendEmptySuccessResponse).not.toHaveBeenCalled();
+  });
+});

package/Types/Telemetry/LlmConventions.ts

@@ -0,0 +1,182 @@
+/*
+ * Single source of truth for the OpenTelemetry GenAI (gen_ai.*) semantic
+ * convention attribute keys OneUptime recognizes when it detects and
+ * denormalizes LLM / GenAI / agent telemetry, plus cheap fallbacks for the two
+ * dominant instrumentation libraries:
+ *   - OpenLLMetry / Traceloop  (gen_ai.* + traceloop.*)
+ *   - OpenInference / Arize    (llm.* + openinference.span.kind)
+ *
+ * Both the server-side ingest extractor
+ * (Common/Server/Utils/Telemetry/LlmSpan.ts) and the client-side display parser
+ * (App/FeatureSet/Dashboard/src/Utils/LlmSpanDisplay.ts) import these lists so
+ * the two cannot silently drift apart when a new attribute is added — add a
+ * newly recognized key HERE, once.
+ *
+ * Order matters: within each list the preferred convention comes first and the
+ * lookup helpers return the first key that is present.
+ */
+
+// Provider / system, e.g. "openai", "anthropic", "aws.bedrock".
+export const LlmSystemAttributeKeys: Array<string> = [
+  "gen_ai.system",
+  "gen_ai.provider.name",
+  "llm.system",
+  "llm.provider",
+];
+
+// Operation, e.g. "chat", "embeddings", "execute_tool", "invoke_agent".
+export const LlmOperationAttributeKeys: Array<string> = [
+  "gen_ai.operation.name",
+  "llm.request.type",
+  "openinference.span.kind",
+];
+
+// Model requested by the caller.
+export const LlmRequestModelAttributeKeys: Array<string> = [
+  "gen_ai.request.model",
+  "llm.model_name",
+  "llm.request.model",
+];
+
+// Model the provider actually served (often the resolved/pinned model).
+export const LlmResponseModelAttributeKeys: Array<string> = [
+  "gen_ai.response.model",
+  "llm.response.model",
+];
+
+export const LlmInputTokenAttributeKeys: Array<string> = [
+  "gen_ai.usage.input_tokens",
+  "gen_ai.usage.prompt_tokens",
+  "llm.token_count.prompt",
+  "llm.usage.prompt_tokens",
+];
+
+export const LlmOutputTokenAttributeKeys: Array<string> = [
+  "gen_ai.usage.output_tokens",
+  "gen_ai.usage.completion_tokens",
+  "llm.token_count.completion",
+  "llm.usage.completion_tokens",
+];
+
+export const LlmTotalTokenAttributeKeys: Array<string> = [
+  "gen_ai.usage.total_tokens",
+  "llm.token_count.total",
+  "llm.usage.total_tokens",
+];
+
+// Cost in USD. Only populated when the SDK reports it (no built-in pricing).
+export const LlmCostAttributeKeys: Array<string> = [
+  "gen_ai.usage.cost",
+  "gen_ai.usage.cost_usd",
+  "gen_ai.usage.total_cost",
+  "llm.usage.total_cost",
+];
+
+export const LlmAgentNameAttributeKeys: Array<string> = [
+  "gen_ai.agent.name",
+  "agent.name",
+];
+
+export const LlmToolNameAttributeKeys: Array<string> = [
+  "gen_ai.tool.name",
+  "tool.name",
+];
+
+/*
+ * Request-parameter keys — surfaced only in the display panel, never
+ * denormalized to DB columns.
+ */
+export const LlmTemperatureAttributeKeys: Array<string> = [
+  "gen_ai.request.temperature",
+  "llm.request.temperature",
+];
+
+export const LlmMaxTokensAttributeKeys: Array<string> = [
+  "gen_ai.request.max_tokens",
+  "llm.request.max_tokens",
+];
+
+export const LlmTopPAttributeKeys: Array<string> = [
+  "gen_ai.request.top_p",
+  "llm.request.top_p",
+];
+
+export const LlmFinishReasonAttributeKeys: Array<string> = [
+  "gen_ai.response.finish_reasons",
+  "gen_ai.response.finish_reason",
+  "llm.response.finish_reason",
+];
+
+/*
+ * Attribute-key namespace prefixes. Any span carrying an attribute in one of
+ * these namespaces is treated as an LLM/GenAI span as a last resort.
+ */
+export const LlmAttributeNamespacePrefixes: Array<string> = [
+  "gen_ai.",
+  "llm.",
+  "traceloop.",
+];
+
+/*
+ * Indexed prompt/completion message conventions of the shape
+ * `${prefix}.${i}.${contentSuffix}` / `${prefix}.${i}.${roleSuffix}`. Used only
+ * by the display parser to reconstruct message content for rendering.
+ */
+export interface LlmIndexedMessageConvention {
+  prefix: string;
+  contentSuffix: string;
+  roleSuffix: string;
+}
+
+export const LlmPromptIndexedMessageConventions: Array<LlmIndexedMessageConvention> =
+  [
+    // OpenLLMetry indexed prompts.
+    { prefix: "gen_ai.prompt", contentSuffix: "content", roleSuffix: "role" },
+    // OpenInference indexed input messages.
+    {
+      prefix: "llm.input_messages",
+      contentSuffix: "message.content",
+      roleSuffix: "message.role",
+    },
+  ];
+
+export const LlmCompletionIndexedMessageConventions: Array<LlmIndexedMessageConvention> =
+  [
+    // OpenLLMetry indexed completions.
+    {
+      prefix: "gen_ai.completion",
+      contentSuffix: "content",
+      roleSuffix: "role",
+    },
+    // OpenInference indexed output messages.
+    {
+      prefix: "llm.output_messages",
+      contentSuffix: "message.content",
+      roleSuffix: "message.role",
+    },
+  ];
+
+// JSON-encoded message-array attribute keys (checked in order).
+export const LlmPromptJsonAttributeKeys: Array<string> = [
+  "gen_ai.input.messages",
+  "gen_ai.prompt",
+  "input.value",
+];
+
+export const LlmCompletionJsonAttributeKeys: Array<string> = [
+  "gen_ai.output.messages",
+  "gen_ai.completion",
+  "output.value",
+];
+
+// Span-event names carrying prompt/completion content.
+export const LlmPromptEventNames: Array<string> = [
+  "gen_ai.system.message",
+  "gen_ai.user.message",
+  "gen_ai.tool.message",
+];
+
+export const LlmCompletionEventNames: Array<string> = [
+  "gen_ai.assistant.message",
+  "gen_ai.choice",
+];

package/UI/Components/Detail/PlaceholderText.tsx

@@ -11,20 +11,7 @@ const PlaceholderText: FunctionComponent<ComponentProps> = (
   const { translateString } = useTranslateValue();
   const translatedText: string = translateString(props.text) ?? props.text;
   return (
-    <span className="inline-flex items-center gap-1.5 text-gray-400 italic text-sm select-none px-2 py-0.5 rounded-md bg-gray-50 border border-dashed border-gray-200">
-      <svg
-        className="w-3.5 h-3.5 text-gray-300"
-        fill="none"
-        viewBox="0 0 24 24"
-        stroke="currentColor"
-      >
-        <path
-          strokeLinecap="round"
-          strokeLinejoin="round"
-          strokeWidth={1.5}
-          d="M20 12H4"
-        />
-      </svg>
+    <span className="inline-flex items-center whitespace-nowrap rounded-md border border-dashed border-gray-300 bg-gray-50 px-2 py-0.5 align-middle text-sm font-normal text-gray-500 select-none">
       {translatedText}
     </span>
   );