@oneuptime/common 11.7.3 → 12.0.0

package/Server/API/IncidentEpisodeAPI.ts

@@ -1,6 +1,9 @@
 import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../Types/ObjectID";
 import IncidentEpisodeService, {
   Service as IncidentEpisodeServiceType,
@@ -21,7 +24,7 @@ import IncidentEpisodeAIContextBuilder, {
 } from "../Utils/AI/IncidentEpisodeAIContextBuilder";
 import { AIGenerationContext } from "../Utils/AI/IncidentAIContextBuilder";
 import JSONFunctions from "../../Types/JSONFunctions";
-import Permission from "../../Types/Permission";
+import Permission, { UserPermission } from "../../Types/Permission";
 
 export default class IncidentEpisodeAPI extends BaseAPI<
   IncidentEpisode,
@@ -67,21 +70,33 @@ export default class IncidentEpisodeAPI extends BaseAPI<
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    // Verify user has permission to edit the episode
-    const permissions: Array<Permission> | undefined = props
-      .userTenantAccessPermission?.["permissions"] as
-      | Array<Permission>
-      | undefined;
-
-    const hasPermission: boolean = permissions
-      ? permissions.some((p: Permission) => {
-          return (
-            p === Permission.ProjectOwner ||
-            p === Permission.ProjectAdmin ||
-            p === Permission.EditIncidentEpisode
-          );
-        })
-      : false;
+    CommonAPI.assertTenantScoped(props);
+
+    /*
+     * Read through getUserPermissions(Allow) rather than off
+     * userTenantAccessPermission directly. That dictionary is keyed by project
+     * id and its entries hold GRANTS AND DENIALS together, discriminated only
+     * by isBlockPermission, so the previous
+     * `userTenantAccessPermission["permissions"]` read was always undefined
+     * and denied every caller who was not a master admin. Mapping the array
+     * raw would swing the other way and count a team's explicit block
+     * entry for one of these permissions as a grant of it.
+     */
+    const permissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    const hasPermission: boolean = permissions.some((p: Permission) => {
+      return (
+        p === Permission.ProjectOwner ||
+        p === Permission.ProjectAdmin ||
+        p === Permission.EditIncidentEpisode
+      );
+    });
 
     if (!hasPermission && !props.isMasterAdmin) {
       throw new BadDataException(

package/Server/API/MonitorAPI.ts

@@ -9,6 +9,8 @@ import {
 } from "../Utils/Express";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import ObjectID from "../../Types/ObjectID";
 
@@ -21,10 +23,38 @@ export default class MonitorAPI extends BaseAPI<Monitor, MonitorServiceType> {
       UserMiddleware.getUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
+          const databaseProps: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          /*
+           * getUserMiddleware lets unauthenticated requests through as
+           * "public", and refreshMonitorCurrentStatus reads and writes the
+           * monitor as root. Require an authenticated member of the
+           * monitor's own project — the caller-supplied tenant says nothing
+           * about which project the monitor id in the path belongs to.
+           */
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(databaseProps);
+
           const monitorId: ObjectID = new ObjectID(
             req.params["monitorId"] as string,
           );
 
+          const monitor: Monitor | null = await MonitorService.findOneById({
+            id: monitorId,
+            select: {
+              projectId: true,
+            },
+            props: {
+              isRoot: true,
+            },
+          });
+
+          CommonAPI.assertResourceBelongsToProject({
+            resourceProjectId: monitor?.projectId,
+            projectId: projectId,
+          });
+
           await MonitorService.refreshMonitorCurrentStatus(monitorId);
           return Response.sendEmptySuccessResponse(req, res);
         } catch (e) {

package/Server/API/MonitorTemplateAPI.ts

@@ -61,6 +61,8 @@ export default class MonitorTemplateAPI extends BaseAPI<
           const props: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          CommonAPI.assertTenantScoped(props);
+
           const fields: Array<string> | undefined = readSyncFields(req);
 
           const result: SyncLinkedMonitorsResult =
@@ -98,6 +100,8 @@ export default class MonitorTemplateAPI extends BaseAPI<
           const props: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          CommonAPI.assertTenantScoped(props);
+
           const fields: Array<string> | undefined = readSyncFields(req);
 
           await MonitorTemplateService.syncToMonitor({
@@ -133,6 +137,8 @@ export default class MonitorTemplateAPI extends BaseAPI<
           const props: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          CommonAPI.assertTenantScoped(props);
+
           await MonitorTemplateService.linkMonitor({
             monitorTemplateId,
             monitorId,
@@ -165,6 +171,8 @@ export default class MonitorTemplateAPI extends BaseAPI<
           const props: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
+          CommonAPI.assertTenantScoped(props);
+
           await MonitorTemplateService.unlinkMonitor({
             monitorTemplateId,
             monitorId,

package/Server/API/ProbeAPI.ts

@@ -2,6 +2,9 @@ import UserMiddleware from "../Middleware/UserAuthorization";
 import ProbeService, {
   Service as ProbeServiceType,
 } from "../Services/ProbeService";
+import Query from "../Types/Database/Query";
+import Select from "../Types/Database/Select";
+import Sort from "../Types/Database/Sort";
 import {
   ExpressRequest,
   ExpressResponse,
@@ -9,10 +12,48 @@ import {
 } from "../Utils/Express";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
-import LIMIT_MAX from "../../Types/Database/LimitMax";
+import MultiSearch from "../../Types/BaseDatabase/MultiSearch";
+import {
+  DEFAULT_LIMIT,
+  LIMIT_PER_PROJECT,
+} from "../../Types/Database/LimitMax";
+import Dictionary from "../../Types/Dictionary";
+import BadDataException from "../../Types/Exception/BadDataException";
+import BadRequestException from "../../Types/Exception/BadRequestException";
+import { JSONObject, JSONValue } from "../../Types/JSON";
+import JSONFunctions from "../../Types/JSONFunctions";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Probe from "../../Models/DatabaseModels/Probe";
 
+// What a caller that asks for no fields in particular gets back.
+const DEFAULT_GLOBAL_PROBE_SELECT: Select<Probe> = {
+  name: true,
+  description: true,
+  lastAlive: true,
+  iconFileId: true,
+  connectionStatus: true,
+  // The monitor create form pre-selects the auto-enabled probes.
+  shouldAutoEnableProbeOnNewMonitors: true,
+};
+
+/*
+ * Global probes are not project rows, so this endpoint has to read them as
+ * root - which means none of the usual per-column permission checks run.
+ * Every field a caller may select, filter or sort on is therefore listed
+ * here, and nothing else is reachable: `key` in particular is a probe's
+ * shared secret, and a root-privileged query on it would be an oracle for
+ * reading it back one character at a time.
+ */
+const GLOBAL_PROBE_FIELDS: Array<string> = [
+  ...Object.keys(DEFAULT_GLOBAL_PROBE_SELECT),
+  "_id",
+  /*
+   * Readable, but not something a caller can steer: the query below pins it
+   * to true whatever the caller sent.
+   */
+  "isGlobalProbe",
+];
+
 export default class ProbeAPI extends BaseAPI<Probe, ProbeServiceType> {
   public constructor() {
     super(Probe, ProbeService);
@@ -22,31 +63,72 @@ export default class ProbeAPI extends BaseAPI<Probe, ProbeServiceType> {
       UserMiddleware.getUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
+          const body: JSONObject = (req.body as JSONObject) || {};
+
+          const skip: PositiveNumber = new PositiveNumber(
+            ProbeAPI.getPaginationValue(req, "skip", 0),
+          );
+
+          const limit: PositiveNumber = new PositiveNumber(
+            ProbeAPI.getPaginationValue(req, "limit", DEFAULT_LIMIT),
+          );
+
+          if (limit.toNumber() > LIMIT_PER_PROJECT) {
+            throw new BadRequestException(
+              "Limit should be less than " + LIMIT_PER_PROJECT,
+            );
+          }
+
+          if (skip.toNumber() < 0) {
+            throw new BadRequestException(
+              "Skip should be greater than or equal to 0",
+            );
+          }
+
+          if (limit.toNumber() <= 0) {
+            throw new BadRequestException("Limit should be greater than 0");
+          }
+
+          const query: Query<Probe> = {
+            ...ProbeAPI.getQuery(body["query"] as JSONObject),
+            /*
+             * Last, so a caller cannot widen the read past the global probes
+             * by sending isGlobalProbe themselves.
+             */
+            isGlobalProbe: true,
+          };
+
+          const select: Select<Probe> = ProbeAPI.getSelect(
+            body["select"] as JSONObject,
+          );
+
+          const sort: Sort<Probe> = ProbeAPI.getSort(
+            body["sort"] as JSONObject,
+          );
+
           const probes: Array<Probe> = await ProbeService.findBy({
-            query: {
-              isGlobalProbe: true,
-            },
-            select: {
-              name: true,
-              description: true,
-              lastAlive: true,
-              iconFileId: true,
-              connectionStatus: true,
-              // The monitor create form pre-selects the auto-enabled probes.
-              shouldAutoEnableProbeOnNewMonitors: true,
+            query,
+            select,
+            sort,
+            props: {
+              isRoot: true,
             },
+            skip,
+            limit,
+          });
+
+          const count: PositiveNumber = await ProbeService.countBy({
+            query,
             props: {
               isRoot: true,
             },
-            skip: 0,
-            limit: LIMIT_MAX,
           });
 
           return Response.sendEntityArrayResponse(
             req,
             res,
             probes,
-            new PositiveNumber(probes.length),
+            count,
             Probe,
           );
         } catch (err) {
@@ -55,4 +137,103 @@ export default class ProbeAPI extends BaseAPI<Probe, ProbeServiceType> {
       },
     );
   }
+
+  /*
+   * skip/limit arrive as query params from ModelAPI.getList and in the body
+   * from anything hand-rolled, so both are read - same precedence as
+   * BaseAPI.getList.
+   */
+  private static getPaginationValue(
+    req: ExpressRequest,
+    key: "skip" | "limit",
+    defaultValue: number,
+  ): number {
+    if (req.query && req.query[key]) {
+      return parseInt(req.query[key] as string, 10) || defaultValue;
+    }
+
+    if (req.body && (req.body as JSONObject)[key] !== undefined) {
+      return (
+        parseInt((req.body as JSONObject)[key] as string, 10) || defaultValue
+      );
+    }
+
+    return defaultValue;
+  }
+
+  private static getQuery(query: JSONObject | undefined): Query<Probe> {
+    const deserialized: JSONObject = JSONFunctions.deserialize(
+      query as JSONObject,
+    );
+
+    for (const key in deserialized) {
+      const value: JSONValue = deserialized[key] as JSONValue;
+
+      /*
+       * MultiSearch is the free-text search operator. Its key is synthetic -
+       * the columns it reads are the ones it carries - so those are what get
+       * checked against the allow-list.
+       */
+      if (value instanceof MultiSearch) {
+        for (const field of value.fields) {
+          if (!GLOBAL_PROBE_FIELDS.includes(field)) {
+            throw new BadDataException(
+              `Global probes cannot be searched on ${field}.`,
+            );
+          }
+        }
+
+        continue;
+      }
+
+      if (!GLOBAL_PROBE_FIELDS.includes(key)) {
+        throw new BadDataException(
+          `Global probes cannot be filtered on ${key}.`,
+        );
+      }
+    }
+
+    return deserialized as Query<Probe>;
+  }
+
+  private static getSelect(select: JSONObject | undefined): Select<Probe> {
+    const requested: Dictionary<boolean> = {};
+
+    for (const key in select) {
+      if (!GLOBAL_PROBE_FIELDS.includes(key) || !select[key]) {
+        continue;
+      }
+
+      /*
+       * Coerced rather than copied: every selectable field here is a scalar,
+       * so a nested (relation) select on one of them is not something the
+       * caller gets to ask for.
+       */
+      requested[key] = true;
+    }
+
+    /*
+     * A caller that asks for nothing gets what this endpoint returned before
+     * it honoured select at all.
+     */
+    if (Object.keys(requested).length === 0) {
+      return { ...DEFAULT_GLOBAL_PROBE_SELECT };
+    }
+
+    return requested as Select<Probe>;
+  }
+
+  private static getSort(sort: JSONObject | undefined): Sort<Probe> {
+    const deserialized: JSONObject = JSONFunctions.deserialize(
+      sort as JSONObject,
+    );
+
+    for (const key in deserialized) {
+      if (!GLOBAL_PROBE_FIELDS.includes(key)) {
+        throw new BadDataException(`Global probes cannot be sorted on ${key}.`);
+      }
+    }
+
+    return deserialized as Sort<Probe>;
+  }
 }

package/Server/API/ProjectAPI.ts

@@ -1,4 +1,5 @@
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import ProjectService, {
   ProjectService as ProjectServiceType,
@@ -13,6 +14,7 @@ import {
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BillingService from "../Services/BillingService";
@@ -24,9 +26,10 @@ import Project from "../../Models/DatabaseModels/Project";
 import Reseller from "../../Models/DatabaseModels/Reseller";
 import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import BadDataException from "../../Types/Exception/BadDataException";
+import OneUptimeDate from "../../Types/Date";
 import Permission, { UserPermission } from "../../Types/Permission";
 import ObjectID from "../../Types/ObjectID";
-import { JSONObject } from "../../Types/JSON";
+import { JSONObject, JSONValue } from "../../Types/JSON";
 
 export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
   public constructor() {
@@ -134,6 +137,81 @@ export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
       },
     );
 
+    /*
+     * Extends a project's trial. Master-admin only: this hands out free
+     * service and moves the customer's next invoice, so it is deliberately not
+     * reachable with project-level billing permissions - only OneUptime staff
+     * acting from the Admin Dashboard can call it.
+     */
+    this.router.put(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:id/extend-trial`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          if (!IsBillingEnabled) {
+            throw new BadDataException(
+              "Billing is not enabled for this server",
+            );
+          }
+
+          const projectId: ObjectID = new ObjectID(req.params["id"] as string);
+
+          const body: JSONObject = (req.body as JSONObject) || {};
+          const data: JSONObject = (body["data"] as JSONObject) || {};
+          const trialEndsAtValue: JSONValue = data["trialEndsAt"];
+
+          if (!trialEndsAtValue) {
+            throw new BadDataException(
+              "Trial end date is required to extend the trial",
+            );
+          }
+
+          /*
+           * OneUptimeDate.fromString only parses strings and Dates - anything
+           * else comes back as its own error text, not a Date - so reject a
+           * non-string body value here rather than letting it through.
+           */
+          if (typeof trialEndsAtValue !== "string") {
+            throw new BadDataException("Trial end date is not a valid date");
+          }
+
+          const trialEndsAt: Date = OneUptimeDate.fromString(trialEndsAtValue);
+
+          if (isNaN(trialEndsAt.getTime())) {
+            throw new BadDataException("Trial end date is not a valid date");
+          }
+
+          /*
+           * The master admin middleware verifies the token but does not put
+           * the decoded payload on the request, so read it again here - who
+           * granted the extension is the only audit trail this action has.
+           */
+          let extendedByUserId: ObjectID | undefined = undefined;
+
+          try {
+            const accessToken: string | undefined =
+              UserMiddleware.getAccessTokenFromExpressRequest(req);
+
+            if (accessToken) {
+              extendedByUserId = JSONWebToken.decode(accessToken).userId;
+            }
+          } catch {
+            // Only used for the log line - never block the extension on it.
+          }
+
+          await ProjectService.extendTrial({
+            projectId: projectId,
+            trialEndsAt: trialEndsAt,
+            extendedByUserId: extendedByUserId,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
     /*
      * This API lists all the projects where user is its team member.
      * This API is usually used to show project selector dropdown in the UI

package/Server/API/ScheduledMaintenanceAPI.ts

@@ -1,6 +1,9 @@
 import ScheduledMaintenance from "../../Models/DatabaseModels/ScheduledMaintenance";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import BadDataException from "../../Types/Exception/BadDataException";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../Types/ObjectID";
 import ScheduledMaintenanceService, {
   Service as ScheduledMaintenanceServiceType,
@@ -21,7 +24,7 @@ import ScheduledMaintenanceAIContextBuilder, {
   ScheduledMaintenanceContextData,
 } from "../Utils/AI/ScheduledMaintenanceAIContextBuilder";
 import JSONFunctions from "../../Types/JSONFunctions";
-import Permission from "../../Types/Permission";
+import Permission, { UserPermission } from "../../Types/Permission";
 
 export default class ScheduledMaintenanceAPI extends BaseAPI<
   ScheduledMaintenance,
@@ -68,23 +71,35 @@ export default class ScheduledMaintenanceAPI extends BaseAPI<
     const props: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    // Verify user has permission
-    const permissions: Array<Permission> | undefined = props
-      .userTenantAccessPermission?.["permissions"] as
-      | Array<Permission>
-      | undefined;
-
-    const hasPermission: boolean = permissions
-      ? permissions.some((p: Permission) => {
-          return (
-            p === Permission.ProjectOwner ||
-            p === Permission.ProjectAdmin ||
-            p === Permission.EditProjectScheduledMaintenance ||
-            p === Permission.CreateScheduledMaintenanceInternalNote ||
-            p === Permission.CreateScheduledMaintenancePublicNote
-          );
-        })
-      : false;
+    CommonAPI.assertTenantScoped(props);
+
+    /*
+     * Read through getUserPermissions(Allow) rather than off
+     * userTenantAccessPermission directly. That dictionary is keyed by project
+     * id and its entries hold GRANTS AND DENIALS together, discriminated only
+     * by isBlockPermission, so the previous
+     * `userTenantAccessPermission["permissions"]` read was always undefined
+     * and denied every caller who was not a master admin. Mapping the array
+     * raw would swing the other way and count a team's explicit block
+     * entry for one of these permissions as a grant of it.
+     */
+    const permissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        props,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    const hasPermission: boolean = permissions.some((p: Permission) => {
+      return (
+        p === Permission.ProjectOwner ||
+        p === Permission.ProjectAdmin ||
+        p === Permission.EditProjectScheduledMaintenance ||
+        p === Permission.CreateScheduledMaintenanceInternalNote ||
+        p === Permission.CreateScheduledMaintenancePublicNote
+      );
+    });
 
     if (!hasPermission && !props.isMasterAdmin) {
       throw new BadDataException(