@oneuptime/common 11.7.2 → 11.7.4

package/Server/API/ProbeAPI.ts

@@ -2,6 +2,9 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import ProbeService, {
   Service as ProbeServiceType,
 } from "../Services/ProbeService";
+import Query from "../Types/Database/Query";
+import Select from "../Types/Database/Select";
+import Sort from "../Types/Database/Sort";
 import {
   ExpressRequest,
   ExpressResponse,
@@ -9,10 +12,48 @@ import {
 } from "../Utils/Express";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
-import LIMIT_MAX from "../../Types/Database/LimitMax";
+import MultiSearch from "../../Types/BaseDatabase/MultiSearch";
+import {
+  DEFAULT_LIMIT,
+  LIMIT_PER_PROJECT,
+} from "../../Types/Database/LimitMax";
+import Dictionary from "../../Types/Dictionary";
+import BadDataException from "../../Types/Exception/BadDataException";
+import BadRequestException from "../../Types/Exception/BadRequestException";
+import { JSONObject, JSONValue } from "../../Types/JSON";
+import JSONFunctions from "../../Types/JSONFunctions";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Probe from "../../Models/DatabaseModels/Probe";
 
+// What a caller that asks for no fields in particular gets back.
+const DEFAULT_GLOBAL_PROBE_SELECT: Select<Probe> = {
+  name: true,
+  description: true,
+  lastAlive: true,
+  iconFileId: true,
+  connectionStatus: true,
+  // The monitor create form pre-selects the auto-enabled probes.
+  shouldAutoEnableProbeOnNewMonitors: true,
+};
+
+/*
+ * Global probes are not project rows, so this endpoint has to read them as
+ * root - which means none of the usual per-column permission checks run.
+ * Every field a caller may select, filter or sort on is therefore listed
+ * here, and nothing else is reachable: `key` in particular is a probe's
+ * shared secret, and a root-privileged query on it would be an oracle for
+ * reading it back one character at a time.
+ */
+const GLOBAL_PROBE_FIELDS: Array<string> = [
+  ...Object.keys(DEFAULT_GLOBAL_PROBE_SELECT),
+  "_id",
+  /*
+   * Readable, but not something a caller can steer: the query below pins it
+   * to true whatever the caller sent.
+   */
+  "isGlobalProbe",
+];
+
 export default class ProbeAPI extends BaseAPI<Probe, ProbeServiceType> {
   public constructor() {
     super(Probe, ProbeService);
@@ -22,31 +63,72 @@ export default class ProbeAPI extends BaseAPI<Probe, ProbeServiceType> {
       UserMiddleware.getUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
+          const body: JSONObject = (req.body as JSONObject) || {};
+
+          const skip: PositiveNumber = new PositiveNumber(
+            ProbeAPI.getPaginationValue(req, "skip", 0),
+          );
+
+          const limit: PositiveNumber = new PositiveNumber(
+            ProbeAPI.getPaginationValue(req, "limit", DEFAULT_LIMIT),
+          );
+
+          if (limit.toNumber() > LIMIT_PER_PROJECT) {
+            throw new BadRequestException(
+              "Limit should be less than " + LIMIT_PER_PROJECT,
+            );
+          }
+
+          if (skip.toNumber() < 0) {
+            throw new BadRequestException(
+              "Skip should be greater than or equal to 0",
+            );
+          }
+
+          if (limit.toNumber() <= 0) {
+            throw new BadRequestException("Limit should be greater than 0");
+          }
+
+          const query: Query<Probe> = {
+            ...ProbeAPI.getQuery(body["query"] as JSONObject),
+            /*
+             * Last, so a caller cannot widen the read past the global probes
+             * by sending isGlobalProbe themselves.
+             */
+            isGlobalProbe: true,
+          };
+
+          const select: Select<Probe> = ProbeAPI.getSelect(
+            body["select"] as JSONObject,
+          );
+
+          const sort: Sort<Probe> = ProbeAPI.getSort(
+            body["sort"] as JSONObject,
+          );
+
           const probes: Array<Probe> = await ProbeService.findBy({
-            query: {
-              isGlobalProbe: true,
-            },
-            select: {
-              name: true,
-              description: true,
-              lastAlive: true,
-              iconFileId: true,
-              connectionStatus: true,
-              // The monitor create form pre-selects the auto-enabled probes.
-              shouldAutoEnableProbeOnNewMonitors: true,
+            query,
+            select,
+            sort,
+            props: {
+              isRoot: true,
             },
+            skip,
+            limit,
+          });
+
+          const count: PositiveNumber = await ProbeService.countBy({
+            query,
             props: {
               isRoot: true,
             },
-            skip: 0,
-            limit: LIMIT_MAX,
           });
 
           return Response.sendEntityArrayResponse(
             req,
             res,
             probes,
-            new PositiveNumber(probes.length),
+            count,
             Probe,
           );
         } catch (err) {
@@ -55,4 +137,103 @@ export default class ProbeAPI extends BaseAPI<Probe, ProbeServiceType> {
       },
     );
   }
+
+  /*
+   * skip/limit arrive as query params from ModelAPI.getList and in the body
+   * from anything hand-rolled, so both are read - same precedence as
+   * BaseAPI.getList.
+   */
+  private static getPaginationValue(
+    req: ExpressRequest,
+    key: "skip" | "limit",
+    defaultValue: number,
+  ): number {
+    if (req.query && req.query[key]) {
+      return parseInt(req.query[key] as string, 10) || defaultValue;
+    }
+
+    if (req.body && (req.body as JSONObject)[key] !== undefined) {
+      return (
+        parseInt((req.body as JSONObject)[key] as string, 10) || defaultValue
+      );
+    }
+
+    return defaultValue;
+  }
+
+  private static getQuery(query: JSONObject | undefined): Query<Probe> {
+    const deserialized: JSONObject = JSONFunctions.deserialize(
+      query as JSONObject,
+    );
+
+    for (const key in deserialized) {
+      const value: JSONValue = deserialized[key] as JSONValue;
+
+      /*
+       * MultiSearch is the free-text search operator. Its key is synthetic -
+       * the columns it reads are the ones it carries - so those are what get
+       * checked against the allow-list.
+       */
+      if (value instanceof MultiSearch) {
+        for (const field of value.fields) {
+          if (!GLOBAL_PROBE_FIELDS.includes(field)) {
+            throw new BadDataException(
+              `Global probes cannot be searched on ${field}.`,
+            );
+          }
+        }
+
+        continue;
+      }
+
+      if (!GLOBAL_PROBE_FIELDS.includes(key)) {
+        throw new BadDataException(
+          `Global probes cannot be filtered on ${key}.`,
+        );
+      }
+    }
+
+    return deserialized as Query<Probe>;
+  }
+
+  private static getSelect(select: JSONObject | undefined): Select<Probe> {
+    const requested: Dictionary<boolean> = {};
+
+    for (const key in select) {
+      if (!GLOBAL_PROBE_FIELDS.includes(key) || !select[key]) {
+        continue;
+      }
+
+      /*
+       * Coerced rather than copied: every selectable field here is a scalar,
+       * so a nested (relation) select on one of them is not something the
+       * caller gets to ask for.
+       */
+      requested[key] = true;
+    }
+
+    /*
+     * A caller that asks for nothing gets what this endpoint returned before
+     * it honoured select at all.
+     */
+    if (Object.keys(requested).length === 0) {
+      return { ...DEFAULT_GLOBAL_PROBE_SELECT };
+    }
+
+    return requested as Select<Probe>;
+  }
+
+  private static getSort(sort: JSONObject | undefined): Sort<Probe> {
+    const deserialized: JSONObject = JSONFunctions.deserialize(
+      sort as JSONObject,
+    );
+
+    for (const key in deserialized) {
+      if (!GLOBAL_PROBE_FIELDS.includes(key)) {
+        throw new BadDataException(`Global probes cannot be sorted on ${key}.`);
+      }
+    }
+
+    return deserialized as Sort<Probe>;
+  }
 }

package/Server/API/ProjectAPI.ts

@@ -1,4 +1,5 @@
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import ProjectService, {
   ProjectService as ProjectServiceType,
@@ -13,6 +14,7 @@ import {
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BillingService from "../Services/BillingService";
@@ -24,9 +26,10 @@ import Project from "../../Models/DatabaseModels/Project";
 import Reseller from "../../Models/DatabaseModels/Reseller";
 import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import BadDataException from "../../Types/Exception/BadDataException";
+import OneUptimeDate from "../../Types/Date";
 import Permission, { UserPermission } from "../../Types/Permission";
 import ObjectID from "../../Types/ObjectID";
-import { JSONObject } from "../../Types/JSON";
+import { JSONObject, JSONValue } from "../../Types/JSON";
 
 export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
   public constructor() {
@@ -134,6 +137,81 @@ export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
       },
     );
 
+    /*
+     * Extends a project's trial. Master-admin only: this hands out free
+     * service and moves the customer's next invoice, so it is deliberately not
+     * reachable with project-level billing permissions - only OneUptime staff
+     * acting from the Admin Dashboard can call it.
+     */
+    this.router.put(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:id/extend-trial`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          if (!IsBillingEnabled) {
+            throw new BadDataException(
+              "Billing is not enabled for this server",
+            );
+          }
+
+          const projectId: ObjectID = new ObjectID(req.params["id"] as string);
+
+          const body: JSONObject = (req.body as JSONObject) || {};
+          const data: JSONObject = (body["data"] as JSONObject) || {};
+          const trialEndsAtValue: JSONValue = data["trialEndsAt"];
+
+          if (!trialEndsAtValue) {
+            throw new BadDataException(
+              "Trial end date is required to extend the trial",
+            );
+          }
+
+          /*
+           * OneUptimeDate.fromString only parses strings and Dates - anything
+           * else comes back as its own error text, not a Date - so reject a
+           * non-string body value here rather than letting it through.
+           */
+          if (typeof trialEndsAtValue !== "string") {
+            throw new BadDataException("Trial end date is not a valid date");
+          }
+
+          const trialEndsAt: Date = OneUptimeDate.fromString(trialEndsAtValue);
+
+          if (isNaN(trialEndsAt.getTime())) {
+            throw new BadDataException("Trial end date is not a valid date");
+          }
+
+          /*
+           * The master admin middleware verifies the token but does not put
+           * the decoded payload on the request, so read it again here - who
+           * granted the extension is the only audit trail this action has.
+           */
+          let extendedByUserId: ObjectID | undefined = undefined;
+
+          try {
+            const accessToken: string | undefined =
+              UserMiddleware.getAccessTokenFromExpressRequest(req);
+
+            if (accessToken) {
+              extendedByUserId = JSONWebToken.decode(accessToken).userId;
+            }
+          } catch {
+            // Only used for the log line - never block the extension on it.
+          }
+
+          await ProjectService.extendTrial({
+            projectId: projectId,
+            trialEndsAt: trialEndsAt,
+            extendedByUserId: extendedByUserId,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
     /*
      * This API lists all the projects where user is its team member.
      * This API is usually used to show project selector dropdown in the UI

package/Server/API/ScheduledMaintenanceAPI.ts

@@ -1,6 +1,9 @@
 import ScheduledMaintenance from "../../Models/DatabaseModels/ScheduledMaintenance";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import BadDataException from "../../Types/Exception/BadDataException";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../Types/ObjectID";
 import ScheduledMaintenanceService, {
   Service as ScheduledMaintenanceServiceType,
@@ -21,7 +24,7 @@ import ScheduledMaintenanceAIContextBuilder, {
   ScheduledMaintenanceContextData,
 } from "../Utils/AI/ScheduledMaintenanceAIContextBuilder";
 import JSONFunctions from "../../Types/JSONFunctions";
-import Permission from "../../Types/Permission";
+import Permission, { UserPermission } from "../../Types/Permission";
 
 export default class ScheduledMaintenanceAPI extends BaseAPI<
   ScheduledMaintenance,
@@ -68,23 +71,35 @@ export default class ScheduledMaintenanceAPI extends BaseAPI<
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    // Verify user has permission
-    const permissions: Array<Permission> | undefined = props
-      .userTenantAccessPermission?.["permissions"] as
-      | Array<Permission>
-      | undefined;
-
-    const hasPermission: boolean = permissions
-      ? permissions.some((p: Permission) => {
-          return (
-            p === Permission.ProjectOwner ||
-            p === Permission.ProjectAdmin ||
-            p === Permission.EditProjectScheduledMaintenance ||
-            p === Permission.CreateScheduledMaintenanceInternalNote ||
-            p === Permission.CreateScheduledMaintenancePublicNote
-          );
-        })
-      : false;
+    CommonAPI.assertTenantScoped(props);
+
+    /*
+     * Read through getUserPermissions(Allow) rather than off
+     * userTenantAccessPermission directly. That dictionary is keyed by project
+     * id and its entries hold GRANTS AND DENIALS together, discriminated only
+     * by isBlockPermission, so the previous
+     * `userTenantAccessPermission["permissions"]` read was always undefined
+     * and denied every caller who was not a master admin. Mapping the array
+     * raw would swing the other way and count a team's explicit block
+     * entry for one of these permissions as a grant of it.
+     */
+    const permissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    const hasPermission: boolean = permissions.some((p: Permission) => {
+      return (
+        p === Permission.ProjectOwner ||
+        p === Permission.ProjectAdmin ||
+        p === Permission.EditProjectScheduledMaintenance ||
+        p === Permission.CreateScheduledMaintenanceInternalNote ||
+        p === Permission.CreateScheduledMaintenancePublicNote
+      );
+    });
 
     if (!hasPermission && !props.isMasterAdmin) {
       throw new BadDataException(

package/Server/API/StatusPageAPI.ts

@@ -85,6 +85,7 @@ import StatusPageOIDC from "../../Models/DatabaseModels/StatusPageOidc";
 import StatusPageSubscriber from "../../Models/DatabaseModels/StatusPageSubscriber";
 import StatusPageEventType from "../../Types/StatusPage/StatusPageEventType";
 import StatusPageResourceUptimeUtil from "../../Utils/StatusPage/ResourceUptime";
+import StatusPageGroupTreeUtil from "../../Utils/StatusPage/GroupTree";
 import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
 import { Green } from "../../Types/BrandColors";
 import UptimeUtil, { UptimeWindow } from "../../Utils/Uptime/UptimeUtil";
@@ -1225,6 +1226,7 @@ export default class StatusPageAPI extends BaseAPI<
 
           type StatusPageGroupUptime = {
             statusPageGroupId: ObjectID | null;
+            parentStatusPageGroupId: ObjectID | null;
             uptimePercent: number | null;
             statusPageResourceUptimes: Array<ResourceUptime>;
             statusPageGroupName: string | null;
@@ -1244,6 +1246,8 @@ export default class StatusPageAPI extends BaseAPI<
                   data && data.statusPageGroup
                     ? data.statusPageGroup?.id
                     : null,
+                parentStatusPageGroupId:
+                  data.statusPageGroup?.parentStatusPageGroupId || null,
                 uptimePercent: null,
                 statusPageResourceUptimes: [],
                 statusPageGroupName: data.statusPageGroup?.name || null,
@@ -1382,43 +1386,6 @@ export default class StatusPageAPI extends BaseAPI<
                 }
               }
 
-              if (group?.showUptimePercent) {
-                // calculate uptime percent for the group.
-                const avgUptimePercent: number =
-                  UptimeUtil.calculateAvgUptimePercentage({
-                    uptimePercentages: groupUptime.statusPageResourceUptimes
-                      .filter((resource: ResourceUptime) => {
-                        return resource.uptimePercent !== null;
-                      })
-                      .map((resource: ResourceUptime) => {
-                        return resource.uptimePercent || 0;
-                      }),
-                    precision:
-                      group.uptimePercentPrecision ||
-                      UptimePrecision.ONE_DECIMAL,
-                  });
-
-                groupUptime.uptimePercent = avgUptimePercent;
-              }
-
-              if (group?.showCurrentStatus) {
-                const currentStatuses: Array<MonitorStatus> =
-                  groupUptime.statusPageResourceUptimes
-                    .filter((resourceUptime: ResourceUptime) => {
-                      return resourceUptime.currentStatus !== null;
-                    })
-                    .map((resourceUptime: ResourceUptime) => {
-                      return resourceUptime.currentStatus!;
-                    });
-
-                const worstStatus: MonitorStatus | null =
-                  StatusPageResourceUptimeUtil.getWorstMonitorStatus({
-                    monitorStatuses: currentStatuses,
-                  });
-
-                groupUptime.currentStatus = worstStatus;
-              }
-
               return groupUptime;
             };
 
@@ -1430,6 +1397,75 @@ export default class StatusPageAPI extends BaseAPI<
             );
           }
 
+          /*
+           * Groups nest, so a group's own uptime % / current status has to
+           * cover every resource in its subtree, not just the resources
+           * attached directly to it. statusPageResourceUptimes stays the
+           * group's own resources - the nesting is reported through
+           * parentStatusPageGroupId so callers can rebuild the tree.
+           */
+          const resourceUptimesByGroupId: Dictionary<Array<ResourceUptime>> =
+            {};
+
+          for (const groupUptime of groupUptimes) {
+            resourceUptimesByGroupId[
+              groupUptime.statusPageGroupId?.toString() || ""
+            ] = groupUptime.statusPageResourceUptimes;
+          }
+
+          for (const group of statusPageGroups) {
+            const groupUptime: StatusPageGroupUptime | undefined =
+              groupUptimes.find((item: StatusPageGroupUptime) => {
+                return (
+                  item.statusPageGroupId?.toString() === group.id?.toString()
+                );
+              });
+
+            if (!groupUptime) {
+              continue;
+            }
+
+            const resourceUptimesInSubtree: Array<ResourceUptime> =
+              StatusPageGroupTreeUtil.getGroupAndDescendants({
+                statusPageGroup: group,
+                statusPageGroups: statusPageGroups,
+              }).flatMap((groupInSubtree: StatusPageGroup) => {
+                return (
+                  resourceUptimesByGroupId[
+                    groupInSubtree.id?.toString() || ""
+                  ] || []
+                );
+              });
+
+            if (group.showUptimePercent) {
+              groupUptime.uptimePercent =
+                UptimeUtil.calculateAvgUptimePercentage({
+                  uptimePercentages: resourceUptimesInSubtree
+                    .filter((resource: ResourceUptime) => {
+                      return resource.uptimePercent !== null;
+                    })
+                    .map((resource: ResourceUptime) => {
+                      return resource.uptimePercent || 0;
+                    }),
+                  precision:
+                    group.uptimePercentPrecision || UptimePrecision.ONE_DECIMAL,
+                });
+            }
+
+            if (group.showCurrentStatus) {
+              groupUptime.currentStatus =
+                StatusPageResourceUptimeUtil.getWorstMonitorStatus({
+                  monitorStatuses: resourceUptimesInSubtree
+                    .filter((resourceUptime: ResourceUptime) => {
+                      return resourceUptime.currentStatus !== null;
+                    })
+                    .map((resourceUptime: ResourceUptime) => {
+                      return resourceUptime.currentStatus!;
+                    }),
+                });
+            }
+          }
+
           return Response.sendJsonObjectResponse(req, res, {
             statusPageResourceUptimes: [
               ...getUptimeByStatusPageGroup({ statusPageGroup: null })
@@ -4920,6 +4956,7 @@ export default class StatusPageAPI extends BaseAPI<
         columnAxisLabel: true,
         rowAxisValues: true,
         columnAxisValues: true,
+        parentStatusPageGroupId: true,
       },
       sort: {
         order: SortOrder.Ascending,

package/Server/API/WorkspaceNotificationRuleAPI.ts

@@ -29,12 +29,42 @@ export default class WorkspaceNotificationRuleAPI extends BaseAPI<
           const databaseProps: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          /*
+           * getUserMiddleware lets unauthenticated requests through as
+           * "public", and testRule loads the rule as root and then posts a
+           * test message into that project's Slack / Teams channels — it can
+           * even create channels. Require an authenticated member of the
+           * project, and of the rule's own project at that: testRule takes
+           * the project from the rule it loaded, so the caller-supplied
+           * tenant alone proves nothing about the rule id in the path.
+           */
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+
+          const ruleId: ObjectID = new ObjectID(
+            req.params["workspaceNotifcationRuleId"] as string,
+          );
+
+          const rule: WorkspaceNotificationRule | null =
+            await this.service.findOneById({
+              id: ruleId,
+              select: {
+                projectId: true,
+              },
+              props: {
+                isRoot: true,
+              },
+            });
+
+          CommonAPI.assertResourceBelongsToProject({
+            resourceProjectId: rule?.projectId,
+            projectId: projectId,
+          });
+
           await this.service.testRule({
-            ruleId: new ObjectID(
-              req.params["workspaceNotifcationRuleId"] as string,
-            ),
+            ruleId: ruleId,
             props: databaseProps,
-            projectId: databaseProps.tenantId!,
+            projectId: projectId,
             testByUserId: databaseProps.userId!,
           });
 

package/Server/Infrastructure/Postgres/SchemaMigrations/1785241000000-AddColumnsToTableView.ts

@@ -0,0 +1,13 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddColumnsToTableView1785241000000 implements MigrationInterface {
+  public name: string = "AddColumnsToTableView1785241000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "TableView" ADD "columns" jsonb`);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "TableView" DROP COLUMN "columns"`);
+  }
+}