@oneuptime/common 11.7.2 → 11.7.4

package/Models/DatabaseModels/WorkflowVariable.ts

@@ -298,7 +298,11 @@ export default class WorkflowVariable extends BaseModel {
       Permission.CreateWorkflowVariable,
     ],
     read: [],
-    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditWorkflowVariable,
+    ],
   })
   @TableColumn({
     required: true,

package/Server/API/AlertAPI.ts

@@ -1,6 +1,9 @@
 import Alert from "../../Models/DatabaseModels/Alert";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import BadDataException from "../../Types/Exception/BadDataException";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../Types/ObjectID";
 import AlertService, {
   Service as AlertServiceType,
@@ -21,7 +24,7 @@ import AlertAIContextBuilder, {
   AlertContextData,
 } from "../Utils/AI/AlertAIContextBuilder";
 import JSONFunctions from "../../Types/JSONFunctions";
-import Permission from "../../Types/Permission";
+import Permission, { UserPermission } from "../../Types/Permission";
 
 export default class AlertAPI extends BaseAPI<Alert, AlertServiceType> {
   public constructor() {
@@ -62,22 +65,34 @@ export default class AlertAPI extends BaseAPI<Alert, AlertServiceType> {
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    // Verify user has permission
-    const permissions: Array<Permission> | undefined = props
-      .userTenantAccessPermission?.["permissions"] as
-      | Array<Permission>
-      | undefined;
-
-    const hasPermission: boolean = permissions
-      ? permissions.some((p: Permission) => {
-          return (
-            p === Permission.ProjectOwner ||
-            p === Permission.ProjectAdmin ||
-            p === Permission.EditAlert ||
-            p === Permission.CreateAlertInternalNote
-          );
-        })
-      : false;
+    CommonAPI.assertTenantScoped(props);
+
+    /*
+     * Read through getUserPermissions(Allow) rather than off
+     * userTenantAccessPermission directly. That dictionary is keyed by project
+     * id and its entries hold GRANTS AND DENIALS together, discriminated only
+     * by isBlockPermission, so the previous
+     * `userTenantAccessPermission["permissions"]` read was always undefined
+     * and denied every caller who was not a master admin. Mapping the array
+     * raw would swing the other way and count a team's explicit block
+     * entry for one of these permissions as a grant of it.
+     */
+    const permissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    const hasPermission: boolean = permissions.some((p: Permission) => {
+      return (
+        p === Permission.ProjectOwner ||
+        p === Permission.ProjectAdmin ||
+        p === Permission.EditAlert ||
+        p === Permission.CreateAlertInternalNote
+      );
+    });
 
     if (!hasPermission && !props.isMasterAdmin) {
       throw new BadDataException(

package/Server/API/BaseAPI.ts

@@ -22,9 +22,10 @@ import {
   LIMIT_PER_PROJECT,
 } from "../../Types/Database/LimitMax";
 import PartialEntity from "../../Types/Database/PartialEntity";
+import BadDataException from "../../Types/Exception/BadDataException";
 import BadRequestException from "../../Types/Exception/BadRequestException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
-import { JSONObject } from "../../Types/JSON";
+import { JSONObject, JSONValue } from "../../Types/JSON";
 import JSONFunctions from "../../Types/JSONFunctions";
 import ObjectID from "../../Types/ObjectID";
 import { UserPermission } from "../../Types/Permission";
@@ -398,15 +399,43 @@ export default class BaseAPI<
     const objectId: ObjectID = new ObjectID(idParam);
     const objectIdString: string = objectId.toString();
     const body: JSONObject = req.body;
+    const dataInBody: JSONValue | undefined = body["data"];
+
+    /*
+     * The update payload has to be wrapped as { "data": { ...columns... } }.
+     * A flat body has no "data" key, and deserializing that undefined handed
+     * back an empty object: the update then matched the row, wrote no columns
+     * at all, and still answered 200. Callers were told the write succeeded
+     * while their fields were dropped on the floor.
+     */
+    if (
+      !dataInBody ||
+      typeof dataInBody !== "object" ||
+      Array.isArray(dataInBody)
+    ) {
+      throw new BadDataException(
+        'Invalid request body. The update payload should be an object of the form { "data": { ...fields to update... } }.',
+      );
+    }
 
     const item: PartialEntity<TBaseModel> = JSONFunctions.deserialize(
-      body["data"] as JSONObject,
+      dataInBody as JSONObject,
     ) as PartialEntity<TBaseModel>;
 
     delete (item as any)["_id"];
     delete (item as any)["createdAt"];
     delete (item as any)["updatedAt"];
 
+    /*
+     * An update that carries no columns writes nothing. Saying 200 to that is
+     * the same lie in a different shape, so ask for at least one field.
+     */
+    if (Object.keys(item).length === 0) {
+      throw new BadDataException(
+        'No fields to update. Please include at least one field to update in the "data" object of the request body.',
+      );
+    }
+
     const numberOfDocsAffected: number = await this.service.updateOneById({
       id: new ObjectID(objectIdString),
       data: item,

package/Server/API/BaseAnalyticsAPI.ts

@@ -21,8 +21,9 @@ import {
   DEFAULT_LIMIT,
   LIMIT_PER_PROJECT,
 } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
 import BadRequestException from "../../Types/Exception/BadRequestException";
-import { JSONObject } from "../../Types/JSON";
+import { JSONObject, JSONValue } from "../../Types/JSON";
 import JSONFunctions from "../../Types/JSONFunctions";
 import ObjectID from "../../Types/ObjectID";
 import { UserPermission } from "../../Types/Permission";
@@ -542,10 +543,43 @@ export default class BaseAnalyticsAPI<
     const objectId: ObjectID = new ObjectID(req.params["id"] as string);
     const objectIdString: string = objectId.toString();
     const body: JSONObject = req.body;
+    const dataInBody: JSONValue | undefined = body["data"];
+
+    /*
+     * Same contract as BaseAPI.updateItem: the payload has to be wrapped as
+     * { "data": { ...columns... } }. Reject anything else here rather than
+     * letting an empty model reach the service.
+     */
+    if (
+      !dataInBody ||
+      typeof dataInBody !== "object" ||
+      Array.isArray(dataInBody)
+    ) {
+      throw new BadDataException(
+        'Invalid request body. The update payload should be an object of the form { "data": { ...fields to update... } }.',
+      );
+    }
+
+    /*
+     * Count the fields on the raw payload, not on the model: an analytics
+     * model instance always carries its own internal properties, so
+     * Object.keys() on it is never empty.
+     */
+    const fieldsToUpdate: Array<string> = Object.keys(
+      dataInBody as JSONObject,
+    ).filter((key: string) => {
+      return key !== "_id" && key !== "createdAt" && key !== "updatedAt";
+    });
+
+    if (fieldsToUpdate.length === 0) {
+      throw new BadDataException(
+        'No fields to update. Please include at least one field to update in the "data" object of the request body.',
+      );
+    }
 
     const item: TAnalyticsDataModel =
       AnalyticsDataModel.fromJSON<TAnalyticsDataModel>(
-        body["data"] as JSONObject,
+        dataInBody as JSONObject,
         this.entityType,
       ) as TAnalyticsDataModel;
 

package/Server/API/CommonAPI.ts

@@ -11,6 +11,37 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 
 export default class CommonAPI {
+  /*
+   * Custom (non-CRUD) endpoints whose path carries only a resource id give
+   * getUserMiddleware no way to learn the project except the `tenantid`
+   * header. ModelAPI attaches that header to every request it makes, but a
+   * custom route reached with a raw API.post/API.get gets none unless the call
+   * site adds ModelAPI.getCommonHeaders() itself. When a caller forgets it,
+   * the request still reaches the handler — just with no tenant permissions —
+   * and the eventual tenant-scoped read fails as "You do not have permissions
+   * to read <model>", which reads like a missing role when it is really a
+   * missing header. Assert the scope up front so the caller gets the real
+   * cause.
+   *
+   * This deliberately checks the tenant only, not the user: API-key callers
+   * are authenticated by ProjectMiddleware and carry tenant permissions
+   * without ever setting `userId`. Use assertAuthenticatedProjectMember when
+   * an endpoint must additionally be a logged-in human member.
+   */
+  public static assertTenantScoped(
+    databaseProps: DatabaseCommonInteractionProps,
+  ): ObjectID {
+    const projectId: ObjectID | undefined = databaseProps.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException(
+        "Project ID is required. Please pass the project ID in the 'tenantid' header.",
+      );
+    }
+
+    return projectId;
+  }
+
   /*
    * getUserMiddleware lets unauthenticated requests through as "public" and
    * takes the tenant id from a caller-supplied header — custom endpoints
@@ -40,6 +71,32 @@ export default class CommonAPI {
     return projectId;
   }
 
+  /*
+   * assertAuthenticatedProjectMember only proves the caller belongs to the
+   * project it *claimed* in the `tenantid` header — it never looks at the
+   * resource the path names. A custom route that then reads or mutates that
+   * resource as root must also confirm the resource's own projectId is the
+   * project the caller was authorized for, otherwise a member of project A
+   * reaches project B's resource id just by sending their own header.
+   *
+   * A resource that does not exist (or carries no projectId) is rejected the
+   * same way, so the endpoint cannot be used to confirm which ids exist in
+   * other projects.
+   */
+  public static assertResourceBelongsToProject(data: {
+    resourceProjectId: ObjectID | undefined | null;
+    projectId: ObjectID;
+  }): void {
+    if (
+      !data.resourceProjectId ||
+      data.resourceProjectId.toString() !== data.projectId.toString()
+    ) {
+      throw new NotAuthorizedException(
+        "You are not authorized to access this project's data.",
+      );
+    }
+  }
+
   @CaptureSpan()
   public static async getDatabaseCommonInteractionProps(
     req: ExpressRequest,

package/Server/API/IncidentAPI.ts

@@ -2,6 +2,9 @@ import Incident from "../../Models/DatabaseModels/Incident";
 import File from "../../Models/DatabaseModels/File";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import BadDataException from "../../Types/Exception/BadDataException";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../Types/ObjectID";
 import IncidentService, {
   Service as IncidentServiceType,
@@ -22,7 +25,7 @@ import IncidentAIContextBuilder, {
   IncidentContextData,
 } from "../Utils/AI/IncidentAIContextBuilder";
 import JSONFunctions from "../../Types/JSONFunctions";
-import Permission from "../../Types/Permission";
+import Permission, { UserPermission } from "../../Types/Permission";
 
 export default class IncidentAPI extends BaseAPI<
   Incident,
@@ -163,21 +166,33 @@ export default class IncidentAPI extends BaseAPI<
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    // Verify user has permission to edit the incident
-    const permissions: Array<Permission> | undefined = props
-      .userTenantAccessPermission?.["permissions"] as
-      | Array<Permission>
-      | undefined;
-
-    const hasPermission: boolean = permissions
-      ? permissions.some((p: Permission) => {
-          return (
-            p === Permission.ProjectOwner ||
-            p === Permission.ProjectAdmin ||
-            p === Permission.EditProjectIncident
-          );
-        })
-      : false;
+    CommonAPI.assertTenantScoped(props);
+
+    /*
+     * Read through getUserPermissions(Allow) rather than off
+     * userTenantAccessPermission directly. That dictionary is keyed by project
+     * id and its entries hold GRANTS AND DENIALS together, discriminated only
+     * by isBlockPermission, so the previous
+     * `userTenantAccessPermission["permissions"]` read was always undefined
+     * and denied every caller who was not a master admin. Mapping the array
+     * raw would swing the other way and count a team's explicit block
+     * entry for one of these permissions as a grant of it.
+     */
+    const permissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    const hasPermission: boolean = permissions.some((p: Permission) => {
+      return (
+        p === Permission.ProjectOwner ||
+        p === Permission.ProjectAdmin ||
+        p === Permission.EditProjectIncident
+      );
+    });
 
     if (!hasPermission && !props.isMasterAdmin) {
       throw new BadDataException(
@@ -271,23 +286,35 @@ export default class IncidentAPI extends BaseAPI<
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    // Verify user has permission to edit the incident
-    const permissions: Array<Permission> | undefined = props
-      .userTenantAccessPermission?.["permissions"] as
-      | Array<Permission>
-      | undefined;
-
-    const hasPermission: boolean = permissions
-      ? permissions.some((p: Permission) => {
-          return (
-            p === Permission.ProjectOwner ||
-            p === Permission.ProjectAdmin ||
-            p === Permission.EditProjectIncident ||
-            p === Permission.CreateIncidentInternalNote ||
-            p === Permission.CreateIncidentPublicNote
-          );
-        })
-      : false;
+    CommonAPI.assertTenantScoped(props);
+
+    /*
+     * Read through getUserPermissions(Allow) rather than off
+     * userTenantAccessPermission directly. That dictionary is keyed by project
+     * id and its entries hold GRANTS AND DENIALS together, discriminated only
+     * by isBlockPermission, so the previous
+     * `userTenantAccessPermission["permissions"]` read was always undefined
+     * and denied every caller who was not a master admin. Mapping the array
+     * raw would swing the other way and count a team's explicit block
+     * entry for one of these permissions as a grant of it.
+     */
+    const permissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    const hasPermission: boolean = permissions.some((p: Permission) => {
+      return (
+        p === Permission.ProjectOwner ||
+        p === Permission.ProjectAdmin ||
+        p === Permission.EditProjectIncident ||
+        p === Permission.CreateIncidentInternalNote ||
+        p === Permission.CreateIncidentPublicNote
+      );
+    });
 
     if (!hasPermission && !props.isMasterAdmin) {
       throw new BadDataException(

package/Server/API/IncidentEpisodeAPI.ts

@@ -1,6 +1,9 @@
 import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../Types/ObjectID";
 import IncidentEpisodeService, {
   Service as IncidentEpisodeServiceType,
@@ -21,7 +24,7 @@ import IncidentEpisodeAIContextBuilder, {
 } from "../Utils/AI/IncidentEpisodeAIContextBuilder";
 import { AIGenerationContext } from "../Utils/AI/IncidentAIContextBuilder";
 import JSONFunctions from "../../Types/JSONFunctions";
-import Permission from "../../Types/Permission";
+import Permission, { UserPermission } from "../../Types/Permission";
 
 export default class IncidentEpisodeAPI extends BaseAPI<
   IncidentEpisode,
@@ -67,21 +70,33 @@ export default class IncidentEpisodeAPI extends BaseAPI<
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    // Verify user has permission to edit the episode
-    const permissions: Array<Permission> | undefined = props
-      .userTenantAccessPermission?.["permissions"] as
-      | Array<Permission>
-      | undefined;
-
-    const hasPermission: boolean = permissions
-      ? permissions.some((p: Permission) => {
-          return (
-            p === Permission.ProjectOwner ||
-            p === Permission.ProjectAdmin ||
-            p === Permission.EditIncidentEpisode
-          );
-        })
-      : false;
+    CommonAPI.assertTenantScoped(props);
+
+    /*
+     * Read through getUserPermissions(Allow) rather than off
+     * userTenantAccessPermission directly. That dictionary is keyed by project
+     * id and its entries hold GRANTS AND DENIALS together, discriminated only
+     * by isBlockPermission, so the previous
+     * `userTenantAccessPermission["permissions"]` read was always undefined
+     * and denied every caller who was not a master admin. Mapping the array
+     * raw would swing the other way and count a team's explicit block
+     * entry for one of these permissions as a grant of it.
+     */
+    const permissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    const hasPermission: boolean = permissions.some((p: Permission) => {
+      return (
+        p === Permission.ProjectOwner ||
+        p === Permission.ProjectAdmin ||
+        p === Permission.EditIncidentEpisode
+      );
+    });
 
     if (!hasPermission && !props.isMasterAdmin) {
       throw new BadDataException(

package/Server/API/MonitorAPI.ts

@@ -9,6 +9,8 @@ import {
 } from "../Utils/Express";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import ObjectID from "../../Types/ObjectID";
 
@@ -21,10 +23,38 @@ export default class MonitorAPI extends BaseAPI<Monitor, MonitorServiceType> {
       UserMiddleware.getUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
+          const databaseProps: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          /*
+           * getUserMiddleware lets unauthenticated requests through as
+           * "public", and refreshMonitorCurrentStatus reads and writes the
+           * monitor as root. Require an authenticated member of the
+           * monitor's own project — the caller-supplied tenant says nothing
+           * about which project the monitor id in the path belongs to.
+           */
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+
           const monitorId: ObjectID = new ObjectID(
             req.params["monitorId"] as string,
           );
 
+          const monitor: Monitor | null = await MonitorService.findOneById({
+            id: monitorId,
+            select: {
+              projectId: true,
+            },
+            props: {
+              isRoot: true,
+            },
+          });
+
+          CommonAPI.assertResourceBelongsToProject({
+            resourceProjectId: monitor?.projectId,
+            projectId: projectId,
+          });
+
           await MonitorService.refreshMonitorCurrentStatus(monitorId);
           return Response.sendEmptySuccessResponse(req, res);
         } catch (e) {

package/Server/API/MonitorTemplateAPI.ts

@@ -61,6 +61,8 @@ export default class MonitorTemplateAPI extends BaseAPI<
           const props: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          CommonAPI.assertTenantScoped(props);
+
           const fields: Array<string> | undefined = readSyncFields(req);
 
           const result: SyncLinkedMonitorsResult =
@@ -98,6 +100,8 @@ export default class MonitorTemplateAPI extends BaseAPI<
           const props: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          CommonAPI.assertTenantScoped(props);
+
           const fields: Array<string> | undefined = readSyncFields(req);
 
           await MonitorTemplateService.syncToMonitor({
@@ -133,6 +137,8 @@ export default class MonitorTemplateAPI extends BaseAPI<
           const props: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          CommonAPI.assertTenantScoped(props);
+
           await MonitorTemplateService.linkMonitor({
             monitorTemplateId,
             monitorId,
@@ -165,6 +171,8 @@ export default class MonitorTemplateAPI extends BaseAPI<
           const props: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          CommonAPI.assertTenantScoped(props);
+
           await MonitorTemplateService.unlinkMonitor({
             monitorTemplateId,
             monitorId,