@oneuptime/common 11.7.3 → 12.0.0

package/build/dist/Utils/Rum/Masking.js

@@ -0,0 +1,143 @@
+/*
+ * Text and input masking for session replay.
+ *
+ * Applied in the browser, before an event is buffered — the server never
+ * receives the unmasked value, so nothing here can be repaired after the
+ * fact.
+ *
+ * The central correctness point: rrweb's built-in mask replaces a value
+ * with `'*'.repeat(value.length)`, which preserves the exact character
+ * count. For a password, a one-time code, or a card number that is a
+ * length oracle — it narrows a password search space, and it identifies a
+ * 16-digit PAN as a PAN. So this module never emits length-preserving
+ * output for input values.
+ *
+ * Must stay dependency-free — this is bundled into the browser recorder.
+ */
+const MASK_CHARACTER = "•";
+/*
+ * Input values collapse to a constant-width block regardless of input
+ * length. Three characters is enough to render as "something was typed
+ * here" without hinting at how much.
+ */
+const FIXED_INPUT_MASK_LENGTH = 3;
+/*
+ * Static text nodes get bucketed rather than fixed width, because a
+ * paragraph collapsed to three characters destroys the layout that makes
+ * a wireframe replay readable at all. The bucket leaks only which of
+ * three coarse size classes the text fell into.
+ */
+const TEXT_BUCKET_SHORT_MAX = 8;
+const TEXT_BUCKET_MEDIUM_MAX = 32;
+const TEXT_BUCKET_SHORT_LENGTH = 4;
+const TEXT_BUCKET_MEDIUM_LENGTH = 16;
+const TEXT_BUCKET_LONG_LENGTH = 40;
+/*
+ * autocomplete tokens that mark a field as high-sensitivity regardless of
+ * its input type. A "show password" toggle flips type="password" to
+ * type="text", so type alone is not a durable signal — see
+ * isStickySensitiveAutocomplete and the recorder's per-node WeakSet.
+ */
+const SENSITIVE_AUTOCOMPLETE_TOKENS = [
+    "current-password",
+    "new-password",
+    "one-time-code",
+    "cc-number",
+    "cc-csc",
+    "cc-exp",
+    "cc-exp-month",
+    "cc-exp-year",
+    "cc-name",
+];
+/*
+ * Input types whose *value* is masked in every mode. Kept separate from
+ * the mode-dependent set so a MaskInputsOnly application still cannot
+ * leak a password.
+ */
+const ALWAYS_SENSITIVE_INPUT_TYPES = ["password"];
+export default class Masking {
+    /*
+     * Mask an input value. Constant width — never derived from the input
+     * length. Returns the mask even for an empty value so that "field was
+     * cleared" and "field was never touched" are not distinguishable in a
+     * way that leaks.
+     */
+    static maskInputValue() {
+        return MASK_CHARACTER.repeat(FIXED_INPUT_MASK_LENGTH);
+    }
+    /*
+     * Mask a static text node, preserving a coarse size class so layout
+     * survives. Whitespace-only text is returned untouched: masking it
+     * would collapse spacing without protecting anything.
+     */
+    static maskText(value) {
+        if (!value) {
+            return value;
+        }
+        if (value.trim().length === 0) {
+            return value;
+        }
+        const length = value.trim().length;
+        let maskedLength = TEXT_BUCKET_LONG_LENGTH;
+        if (length <= TEXT_BUCKET_SHORT_MAX) {
+            maskedLength = TEXT_BUCKET_SHORT_LENGTH;
+        }
+        else if (length <= TEXT_BUCKET_MEDIUM_MAX) {
+            maskedLength = TEXT_BUCKET_MEDIUM_LENGTH;
+        }
+        return MASK_CHARACTER.repeat(maskedLength);
+    }
+    /*
+     * True when a file input's value must be blanked. Always true: the DOM
+     * value of a file input is `C:\fakepath\<real filename>`, and filenames
+     * are routinely personal ("passport-scan.pdf", "payslip-march.pdf").
+     * The recorder records that a file was chosen, never which one.
+     */
+    static maskFileInputValue() {
+        return "";
+    }
+    /* Does this input type carry a value that must be masked in every mode? */
+    static isAlwaysSensitiveInputType(inputType) {
+        return ALWAYS_SENSITIVE_INPUT_TYPES.includes((inputType || "").toLowerCase());
+    }
+    /*
+     * Does this autocomplete attribute mark the field as permanently
+     * sensitive? Once true for a node, the recorder keeps masking it even
+     * if the attribute or the input type later changes, and suppresses the
+     * type mutation itself so playback cannot reveal the switch.
+     */
+    static isStickySensitiveAutocomplete(autocompleteValue) {
+        if (!autocompleteValue) {
+            return false;
+        }
+        /*
+         * autocomplete accepts space-separated tokens with optional section
+         * and billing/shipping prefixes ("section-payment billing cc-number"),
+         * so every token is checked rather than the whole string compared.
+         */
+        const tokens = autocompleteValue
+            .toLowerCase()
+            .split(/\s+/)
+            .filter((token) => {
+            return token.length > 0;
+        });
+        return tokens.some((token) => {
+            return SENSITIVE_AUTOCOMPLETE_TOKENS.includes(token);
+        });
+    }
+    /*
+     * Quantise an input event timestamp into coarse buckets.
+     *
+     * A masked password field still leaks inter-keystroke timing, which is
+     * a published side channel for inferring typed content. Bucketing the
+     * timestamps removes the signal while keeping playback smooth enough
+     * that typing still looks like typing.
+     */
+    static quantiseTimestamp(timestampMs, bucketMs = 250) {
+        if (!Number.isFinite(timestampMs) || bucketMs <= 0) {
+            return timestampMs;
+        }
+        return Math.floor(timestampMs / bucketMs) * bucketMs;
+    }
+}
+//# sourceMappingURL=Masking.js.map

package/build/dist/Utils/Rum/Masking.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Masking.js","sourceRoot":"","sources":["../../../../Utils/Rum/Masking.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,cAAc,GAAW,GAAG,CAAC;AAEnC;;;;GAIG;AACH,MAAM,uBAAuB,GAAW,CAAC,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAW,CAAC,CAAC;AACxC,MAAM,sBAAsB,GAAW,EAAE,CAAC;AAE1C,MAAM,wBAAwB,GAAW,CAAC,CAAC;AAC3C,MAAM,yBAAyB,GAAW,EAAE,CAAC;AAC7C,MAAM,uBAAuB,GAAW,EAAE,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,6BAA6B,GAAkB;IACnD,kBAAkB;IAClB,cAAc;IACd,eAAe;IACf,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,aAAa;IACb,SAAS;CACV,CAAC;AAEF;;;;GAIG;AACH,MAAM,4BAA4B,GAAkB,CAAC,UAAU,CAAC,CAAC;AAEjE,MAAM,CAAC,OAAO,OAAO,OAAO;IAC1B;;;;;OAKG;IACI,MAAM,CAAC,cAAc;QAC1B,OAAO,cAAc,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC;IACxD,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,QAAQ,CAAC,KAAa;QAClC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAW,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC;QAE3C,IAAI,YAAY,GAAW,uBAAuB,CAAC;QAEnD,IAAI,MAAM,IAAI,qBAAqB,EAAE,CAAC;YACpC,YAAY,GAAG,wBAAwB,CAAC;QAC1C,CAAC;aAAM,IAAI,MAAM,IAAI,sBAAsB,EAAE,CAAC;YAC5C,YAAY,GAAG,yBAAyB,CAAC;QAC3C,CAAC;QAED,OAAO,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,kBAAkB;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,2EAA2E;IACpE,MAAM,CAAC,0BAA0B,CAAC,SAAiB;QACxD,OAAO,4BAA4B,CAAC,QAAQ,CAC1C,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAChC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,6BAA6B,CACzC,iBAAyB;QAEzB,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;WAIG;QACH,MAAM,MAAM,GAAkB,iBAAiB;aAC5C,WAAW,EAAE;aACb,KAAK,CAAC,KAAK,CAAC;aACZ,MAAM,CAAC,CAAC,KAAa,EAAW,EAAE;YACjC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEL,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAa,EAAW,EAAE;YAC5C,OAAO,6BAA6B,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,iBAAiB,CAC7B,WAAmB,EACnB,WAAmB,GAAG;QAEtB,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YACnD,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAO,IAAI,CAAC,KAAK,CAAC,WAAW,GAAG,QAAQ,CAAC,GAAG,QAAQ,CAAC;IACvD,CAAC;CACF"}

package/build/dist/Utils/Rum/SessionIdentity.js

@@ -0,0 +1,161 @@
+import { SESSION_REPLAY_IDLE_ROLLOVER_MS, SESSION_REPLAY_MAX_SESSION_MS, } from "../../Types/Rum/SessionReplay";
+/*
+ * Session identity lifecycle, expressed as pure functions of timestamps
+ * so it can be tested exhaustively without a browser, a clock, or storage.
+ *
+ * The recorder owns the storage (localStorage for the session, sessionStorage
+ * for the tab); this module owns the *decisions*.
+ *
+ * Must stay dependency-free apart from the shared constants — bundled
+ * into the browser recorder.
+ */
+export var SessionRotationReason;
+(function (SessionRotationReason) {
+    /* No prior session, or storage was cleared. */
+    SessionRotationReason["New"] = "new";
+    /* More than the idle window elapsed since the last recorded activity. */
+    SessionRotationReason["Idle"] = "idle";
+    /* The session hit its absolute duration ceiling. */
+    SessionRotationReason["DurationCap"] = "duration-cap";
+    /* Stored state was unreadable or inconsistent; fail into a fresh session. */
+    SessionRotationReason["Corrupt"] = "corrupt";
+})(SessionRotationReason || (SessionRotationReason = {}));
+export default class SessionIdentity {
+    /*
+     * Should the recorder mint a new session id?
+     *
+     * Two independent conditions, checked in this order because the idle
+     * check is the common case and the duration cap is the backstop:
+     *
+     *  - idle: the user walked away and came back. A single "session" that
+     *    spans a lunch break is not a session, and stitching one produces a
+     *    recording with a 40-minute dead zone in the middle.
+     *  - duration cap: a tab left open for days would otherwise accumulate
+     *    an unbounded chunk sequence under one sort-key prefix.
+     *
+     * Inconsistent stored state (missing id, non-finite or future-dated
+     * timestamps, start after last activity) rotates rather than being
+     * repaired — a fresh session loses at most a little context, whereas
+     * trusting corrupt state can attribute one user's chunks to another
+     * user's session id.
+     */
+    static shouldRotateSession(stored, nowUnixMs, idleRolloverMs = SESSION_REPLAY_IDLE_ROLLOVER_MS, maxSessionMs = SESSION_REPLAY_MAX_SESSION_MS) {
+        if (!stored) {
+            return { shouldRotate: true, reason: SessionRotationReason.New };
+        }
+        if (!SessionIdentity.isStoredStateValid(stored, nowUnixMs)) {
+            return { shouldRotate: true, reason: SessionRotationReason.Corrupt };
+        }
+        if (nowUnixMs - stored.lastActivityUnixMs >= idleRolloverMs) {
+            return { shouldRotate: true, reason: SessionRotationReason.Idle };
+        }
+        if (nowUnixMs - stored.sessionStartUnixMs >= maxSessionMs) {
+            return {
+                shouldRotate: true,
+                reason: SessionRotationReason.DurationCap,
+            };
+        }
+        return { shouldRotate: false };
+    }
+    static isStoredStateValid(stored, nowUnixMs) {
+        if (!stored.sessionId) {
+            return false;
+        }
+        if (!Number.isFinite(stored.sessionStartUnixMs) ||
+            !Number.isFinite(stored.lastActivityUnixMs)) {
+            return false;
+        }
+        if (stored.sessionStartUnixMs <= 0 || stored.lastActivityUnixMs <= 0) {
+            return false;
+        }
+        /* Activity cannot precede the session start. */
+        if (stored.lastActivityUnixMs < stored.sessionStartUnixMs) {
+            return false;
+        }
+        /*
+         * Tolerate a small amount of forward skew (the device clock may have
+         * been corrected between writes) but reject state stamped far in the
+         * future, which indicates either a clock jump or tampering.
+         */
+        const forwardToleranceMs = 5 * 60 * 1000;
+        if (stored.sessionStartUnixMs > nowUnixMs + forwardToleranceMs) {
+            return false;
+        }
+        return true;
+    }
+    /*
+     * Clamp a client-reported session start against the server's own clock.
+     *
+     * End-user device clocks are wrong constantly — by minutes, by hours,
+     * occasionally by years. An unclamped client timestamp lands in the
+     * partition key and the TTL expression, so a device clock set to 2035
+     * would create a partition that never expires, and one set to 2015
+     * would create a row that is deleted on arrival.
+     *
+     * The clamp is one-directional in effect: the returned value is always
+     * within [serverNow - maxBackwardMs, serverNow]. A session cannot start
+     * in the future, and cannot claim to have started before the window we
+     * are willing to accept.
+     */
+    static clampSessionStart(clientReportedStartUnixMs, serverNowUnixMs, maxBackwardMs = SESSION_REPLAY_MAX_SESSION_MS) {
+        if (!Number.isFinite(clientReportedStartUnixMs)) {
+            return serverNowUnixMs;
+        }
+        if (clientReportedStartUnixMs > serverNowUnixMs) {
+            return serverNowUnixMs;
+        }
+        const earliestAcceptable = serverNowUnixMs - maxBackwardMs;
+        if (clientReportedStartUnixMs < earliestAcceptable) {
+            return earliestAcceptable;
+        }
+        return clientReportedStartUnixMs;
+    }
+    /*
+     * Observed clock skew, stored on the session header so a support
+     * engineer can see "this recording's timings are 40 minutes off"
+     * instead of being quietly misled by them.
+     *
+     * Positive means the client clock runs ahead of the server.
+     */
+    static getClockSkewMs(clientSendUnixMs, serverReceiveUnixMs) {
+        if (!Number.isFinite(clientSendUnixMs) ||
+            !Number.isFinite(serverReceiveUnixMs)) {
+            return 0;
+        }
+        return clientSendUnixMs - serverReceiveUnixMs;
+    }
+    /*
+     * Clamp a retention day count to the allowed closed set, rounding *up*
+     * to the next allowed value.
+     *
+     * Rounding up rather than to the nearest is deliberate: silently
+     * shortening a customer's configured retention destroys evidence they
+     * expected to keep, whereas keeping it slightly longer costs only disk.
+     */
+    static clampRetentionDays(requestedDays, allowedDays, fallbackDays) {
+        if (allowedDays.length === 0) {
+            return fallbackDays;
+        }
+        const sorted = [...allowedDays].sort((a, b) => {
+            return a - b;
+        });
+        const smallest = sorted[0];
+        const largest = sorted[sorted.length - 1];
+        if (smallest === undefined || largest === undefined) {
+            return fallbackDays;
+        }
+        if (!Number.isFinite(requestedDays) || requestedDays <= 0) {
+            return fallbackDays;
+        }
+        if (requestedDays >= largest) {
+            return largest;
+        }
+        for (const allowed of sorted) {
+            if (requestedDays <= allowed) {
+                return allowed;
+            }
+        }
+        return fallbackDays;
+    }
+}
+//# sourceMappingURL=SessionIdentity.js.map

package/build/dist/Utils/Rum/SessionIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionIdentity.js","sourceRoot":"","sources":["../../../../Utils/Rum/SessionIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,+BAA+B,EAC/B,6BAA6B,GAC9B,MAAM,+BAA+B,CAAC;AAEvC;;;;;;;;;GASG;AAEH,MAAM,CAAN,IAAY,qBAYX;AAZD,WAAY,qBAAqB;IAC/B,+CAA+C;IAC/C,oCAAW,CAAA;IAEX,yEAAyE;IACzE,sCAAa,CAAA;IAEb,oDAAoD;IACpD,qDAA4B,CAAA;IAE5B,6EAA6E;IAC7E,4CAAmB,CAAA;AACrB,CAAC,EAZW,qBAAqB,KAArB,qBAAqB,QAYhC;AAaD,MAAM,CAAC,OAAO,OAAO,eAAe;IAClC;;;;;;;;;;;;;;;;;OAiBG;IACI,MAAM,CAAC,mBAAmB,CAC/B,MAAiC,EACjC,SAAiB,EACjB,iBAAyB,+BAA+B,EACxD,eAAuB,6BAA6B;QAEpD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,GAAG,EAAE,CAAC;QACnE,CAAC;QAED,IAAI,CAAC,eAAe,CAAC,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,OAAO,EAAE,CAAC;QACvE,CAAC;QAED,IAAI,SAAS,GAAG,MAAM,CAAC,kBAAkB,IAAI,cAAc,EAAE,CAAC;YAC5D,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC;QAED,IAAI,SAAS,GAAG,MAAM,CAAC,kBAAkB,IAAI,YAAY,EAAE,CAAC;YAC1D,OAAO;gBACL,YAAY,EAAE,IAAI;gBAClB,MAAM,EAAE,qBAAqB,CAAC,WAAW;aAC1C,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAEM,MAAM,CAAC,kBAAkB,CAC9B,MAA0B,EAC1B,SAAiB;QAEjB,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC;YAC3C,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAC3C,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC,IAAI,MAAM,CAAC,kBAAkB,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,KAAK,CAAC;QACf,CAAC;QAED,gDAAgD;QAChD,IAAI,MAAM,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QAED;;;;WAIG;QACH,MAAM,kBAAkB,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAEjD,IAAI,MAAM,CAAC,kBAAkB,GAAG,SAAS,GAAG,kBAAkB,EAAE,CAAC;YAC/D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,iBAAiB,CAC7B,yBAAiC,EACjC,eAAuB,EACvB,gBAAwB,6BAA6B;QAErD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,EAAE,CAAC;YAChD,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,IAAI,yBAAyB,GAAG,eAAe,EAAE,CAAC;YAChD,OAAO,eAAe,CAAC;QACzB,CAAC;QAED,MAAM,kBAAkB,GAAW,eAAe,GAAG,aAAa,CAAC;QAEnE,IAAI,yBAAyB,GAAG,kBAAkB,EAAE,CAAC;YACnD,OAAO,kBAAkB,CAAC;QAC5B,CAAC;QAED,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,cAAc,CAC1B,gBAAwB,EACxB,mBAA2B;QAE3B,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAClC,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EACrC,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,OAAO,gBAAgB,GAAG,mBAAmB,CAAC;IAChD,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,kBAAkB,CAC9B,aAAqB,EACrB,WAA0B,EAC1B,YAAoB;QAEpB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,MAAM,MAAM,GAAkB,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CACjD,CAAC,CAAS,EAAE,CAAS,EAAU,EAAE;YAC/B,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CACF,CAAC;QAEF,MAAM,QAAQ,GAAuB,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,OAAO,GAAuB,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAE9D,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;YAC1D,OAAO,YAAY,CAAC;QACtB,CAAC;QAED,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,MAAM,OAAO,IAAI,MAAM,EAAE,CAAC;YAC7B,IAAI,aAAa,IAAI,OAAO,EAAE,CAAC;gBAC7B,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QAED,OAAO,YAAY,CAAC;IACtB,CAAC;CACF"}

package/build/dist/Utils/Rum/SessionSampling.js

@@ -0,0 +1,91 @@
+/*
+ * Deterministic session sampling.
+ *
+ * The decision MUST be a pure function of the session id, computed
+ * identically in the browser and at the ingest gate. A per-event or
+ * per-chunk random draw (which is what the log drop-filter path does)
+ * would shred a single session into an unplayable set of fragments —
+ * some chunks kept, some dropped, no full snapshot where the player
+ * needs one.
+ *
+ * This file must stay dependency-free: it is bundled into the browser
+ * recorder as well as imported by the server.
+ */
+/*
+ * FNV-1a, 32-bit. Chosen over a cryptographic hash because it is ~20
+ * lines, has no platform dependency (no SubtleCrypto, no node:crypto),
+ * is synchronous, and distributes hex session ids evenly. Sampling is
+ * not a security boundary — see the note on tampering below.
+ */
+const FNV_OFFSET_BASIS_32 = 0x811c9dc5;
+const FNV_PRIME_32 = 0x01000193;
+/* Resolution of the sample percentage: two decimal places. */
+const SAMPLING_BUCKETS = 10000;
+export default class SessionSampling {
+    /*
+     * 32-bit FNV-1a hash of a string, returned as an unsigned integer.
+     *
+     * Math.imul is used for the multiply so the intermediate stays in
+     * 32-bit integer space; a plain `*` would overflow into a float and
+     * lose the low bits, which is the classic way this hash silently
+     * stops distributing.
+     */
+    static fnv1a32(value) {
+        let hash = FNV_OFFSET_BASIS_32;
+        for (let i = 0; i < value.length; i++) {
+            hash ^= value.charCodeAt(i);
+            hash = Math.imul(hash, FNV_PRIME_32);
+        }
+        /* Coerce to unsigned 32-bit. */
+        return hash >>> 0;
+    }
+    /*
+     * Which of the 10,000 sampling buckets a session falls into.
+     * Stable for the lifetime of the session id.
+     */
+    static getBucket(sessionId) {
+        return SessionSampling.fnv1a32(sessionId) % SAMPLING_BUCKETS;
+    }
+    /*
+     * True when this session is inside the sample.
+     *
+     * samplePercentage is 0..100 and may carry two decimal places. 0 means
+     * nothing is sampled; 100 means everything is. Values outside the range
+     * are clamped rather than rejected, because a bad config value must not
+     * be able to turn sampling into an exception on the ingest hot path.
+     *
+     * Note honestly: because the input is a client-generated id, a
+     * determined client can regenerate ids until one passes. This function
+     * protects against misconfiguration and gives stable, reproducible
+     * decisions — it is not an anti-abuse control. The origin allowlist,
+     * the rate limiter and the per-project byte budget are.
+     */
+    static isSampled(sessionId, samplePercentage) {
+        const clamped = SessionSampling.clampPercentage(samplePercentage);
+        if (clamped <= 0) {
+            return false;
+        }
+        if (clamped >= 100) {
+            return true;
+        }
+        /*
+         * Rounded rather than truncated so a percentage like 33.335 maps to
+         * the nearer bucket boundary instead of always downward.
+         */
+        const threshold = Math.round(clamped * (SAMPLING_BUCKETS / 100));
+        return SessionSampling.getBucket(sessionId) < threshold;
+    }
+    static clampPercentage(samplePercentage) {
+        if (!Number.isFinite(samplePercentage)) {
+            return 0;
+        }
+        if (samplePercentage < 0) {
+            return 0;
+        }
+        if (samplePercentage > 100) {
+            return 100;
+        }
+        return samplePercentage;
+    }
+}
+//# sourceMappingURL=SessionSampling.js.map

package/build/dist/Utils/Rum/SessionSampling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SessionSampling.js","sourceRoot":"","sources":["../../../../Utils/Rum/SessionSampling.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;GAKG;AACH,MAAM,mBAAmB,GAAW,UAAU,CAAC;AAC/C,MAAM,YAAY,GAAW,UAAU,CAAC;AAExC,8DAA8D;AAC9D,MAAM,gBAAgB,GAAW,KAAK,CAAC;AAEvC,MAAM,CAAC,OAAO,OAAO,eAAe;IAClC;;;;;;;OAOG;IACI,MAAM,CAAC,OAAO,CAAC,KAAa;QACjC,IAAI,IAAI,GAAW,mBAAmB,CAAC;QAEvC,KAAK,IAAI,CAAC,GAAW,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC9C,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACvC,CAAC;QAED,gCAAgC;QAChC,OAAO,IAAI,KAAK,CAAC,CAAC;IACpB,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,SAAS,CAAC,SAAiB;QACvC,OAAO,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,gBAAgB,CAAC;IAC/D,CAAC;IAED;;;;;;;;;;;;;OAaG;IACI,MAAM,CAAC,SAAS,CACrB,SAAiB,EACjB,gBAAwB;QAExB,MAAM,OAAO,GAAW,eAAe,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QAE1E,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;WAGG;QACH,MAAM,SAAS,GAAW,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,gBAAgB,GAAG,GAAG,CAAC,CAAC,CAAC;QAEzE,OAAO,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC;IAC1D,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,gBAAwB;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,gBAAgB,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;QAED,IAAI,gBAAgB,GAAG,GAAG,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC;QACb,CAAC;QAED,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF"}

package/build/dist/Utils/Rum/UrlScrubber.js

@@ -0,0 +1,144 @@
+/*
+ * URL scrubbing for session replay.
+ *
+ * This is the one PII channel that text masking does not cover. Masking
+ * every text node still leaves `?email=someone@example.com`,
+ * `/reset-password?token=...`, and magic-link URLs intact — and URLs are
+ * *worse* than a payload leak, because entryUrl / exitUrl sit in the
+ * wider session-metadata ACL and render directly in the session list,
+ * where anyone who can see the list sees them.
+ *
+ * Applied in the browser, before anything is uploaded: to the chunk url,
+ * entryUrl, exitUrl, the rrweb Meta event hrefs, and every network-event
+ * URL.
+ *
+ * Must stay dependency-free — this is bundled into the browser recorder.
+ */
+/*
+ * Path segments that look like identifiers are replaced wholesale. A
+ * bare numeric id is left alone (it is rarely PII on its own and is
+ * often needed to tell one route from another), but anything that looks
+ * like a uuid, an email, a long digit run (card / phone / account) or a
+ * long opaque token is replaced.
+ */
+const UUID_SEGMENT = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/* 24-char Mongo/BSON-style object id, which is what OneUptime itself uses. */
+const OBJECT_ID_SEGMENT = /^[0-9a-f]{24}$/i;
+const EMAIL_SEGMENT = /^[^@\s/]+@[^@\s/]+\.[^@\s/]+$/;
+/* 9 or more consecutive digits: card numbers, phone numbers, SSNs. */
+const LONG_DIGIT_SEGMENT = /^\d{9,}$/;
+/*
+ * Long high-entropy strings: session tokens, JWT parts, signed links.
+ * Deliberately conservative at 32 characters so ordinary slugs survive.
+ */
+const OPAQUE_TOKEN_SEGMENT = /^[A-Za-z0-9_-]{32,}$/;
+const REDACTED = "[redacted]";
+export default class UrlScrubber {
+    /*
+     * Reduce a URL to origin + scrubbed path. Query and fragment are
+     * dropped entirely unless a parameter is explicitly allowlisted, in
+     * which case its *name* is kept and its value is redacted — enough to
+     * tell "this page was loaded with a coupon code" from "it wasn't",
+     * without recording which code.
+     *
+     * Never throws: a URL that will not parse is reduced to a constant
+     * rather than propagating an exception into the recorder's hot path or
+     * being passed through unscrubbed. Failing closed matters more here
+     * than fidelity.
+     */
+    static scrub(rawUrl, allowlistedQueryParams) {
+        if (!rawUrl) {
+            return "";
+        }
+        let parsed = undefined;
+        try {
+            /*
+             * A base is supplied so relative URLs (which rrweb Meta events can
+             * carry) still parse. The base origin is never emitted, because a
+             * relative input yields a relative output below.
+             */
+            parsed = new URL(rawUrl, "https://redacted.invalid");
+        }
+        catch (_a) {
+            return REDACTED;
+        }
+        const isRelativeInput = parsed.origin === "https://redacted.invalid" &&
+            !rawUrl.startsWith("https://redacted.invalid");
+        const scrubbedPath = UrlScrubber.scrubPath(parsed.pathname);
+        const query = UrlScrubber.scrubQuery(parsed.searchParams, allowlistedQueryParams);
+        const base = isRelativeInput
+            ? scrubbedPath
+            : `${parsed.origin}${scrubbedPath}`;
+        return query ? `${base}?${query}` : base;
+    }
+    /* Replace identifier-shaped segments, preserving route structure. */
+    static scrubPath(pathname) {
+        if (!pathname || pathname === "/") {
+            return pathname || "/";
+        }
+        const segments = pathname.split("/");
+        const scrubbed = segments.map((segment) => {
+            if (!segment) {
+                return segment;
+            }
+            let decoded = segment;
+            /*
+             * Decode before matching so a percent-encoded email
+             * (name%40example.com) is still recognised. A malformed escape
+             * sequence throws, in which case the raw segment is matched.
+             */
+            try {
+                decoded = decodeURIComponent(segment);
+            }
+            catch (_a) {
+                decoded = segment;
+            }
+            if (UUID_SEGMENT.test(decoded) ||
+                OBJECT_ID_SEGMENT.test(decoded) ||
+                EMAIL_SEGMENT.test(decoded) ||
+                LONG_DIGIT_SEGMENT.test(decoded) ||
+                OPAQUE_TOKEN_SEGMENT.test(decoded)) {
+                return REDACTED;
+            }
+            return segment;
+        });
+        return scrubbed.join("/");
+    }
+    /*
+     * Keep only allowlisted parameter names, with redacted values. An
+     * empty or missing allowlist drops the query string entirely.
+     */
+    static scrubQuery(params, allowlistedQueryParams) {
+        if (!allowlistedQueryParams || allowlistedQueryParams.length === 0) {
+            return "";
+        }
+        const allowed = new Set(allowlistedQueryParams.map((param) => {
+            return param.toLowerCase();
+        }));
+        const kept = [];
+        params.forEach((_value, key) => {
+            if (allowed.has(key.toLowerCase())) {
+                kept.push(`${encodeURIComponent(key)}=${REDACTED}`);
+            }
+        });
+        return kept.join("&");
+    }
+    /*
+     * Path-only form, used for the refresh-rage detector, which needs to
+     * compare "the same page" across reloads without the origin.
+     */
+    static getScrubbedPathname(rawUrl) {
+        const scrubbed = UrlScrubber.scrub(rawUrl);
+        if (!scrubbed || scrubbed === REDACTED) {
+            return REDACTED;
+        }
+        try {
+            const parsed = new URL(scrubbed, "https://redacted.invalid");
+            return parsed.pathname;
+        }
+        catch (_a) {
+            return REDACTED;
+        }
+    }
+}
+//# sourceMappingURL=UrlScrubber.js.map

package/build/dist/Utils/Rum/UrlScrubber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"UrlScrubber.js","sourceRoot":"","sources":["../../../../Utils/Rum/UrlScrubber.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;;;;GAMG;AACH,MAAM,YAAY,GAChB,iEAAiE,CAAC;AAEpE,8EAA8E;AAC9E,MAAM,iBAAiB,GAAW,iBAAiB,CAAC;AAEpD,MAAM,aAAa,GAAW,+BAA+B,CAAC;AAE9D,sEAAsE;AACtE,MAAM,kBAAkB,GAAW,UAAU,CAAC;AAE9C;;;GAGG;AACH,MAAM,oBAAoB,GAAW,sBAAsB,CAAC;AAE5D,MAAM,QAAQ,GAAW,YAAY,CAAC;AAEtC,MAAM,CAAC,OAAO,OAAO,WAAW;IAC9B;;;;;;;;;;;OAWG;IACI,MAAM,CAAC,KAAK,CACjB,MAAc,EACd,sBAAkD;QAElD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,IAAI,MAAM,GAAoB,SAAS,CAAC;QAExC,IAAI,CAAC;YACH;;;;eAIG;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;QACvD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,MAAM,eAAe,GACnB,MAAM,CAAC,MAAM,KAAK,0BAA0B;YAC5C,CAAC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC;QAEjD,MAAM,YAAY,GAAW,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEpE,MAAM,KAAK,GAAW,WAAW,CAAC,UAAU,CAC1C,MAAM,CAAC,YAAY,EACnB,sBAAsB,CACvB,CAAC;QAEF,MAAM,IAAI,GAAW,eAAe;YAClC,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QAEtC,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC;IAED,qEAAqE;IAC9D,MAAM,CAAC,SAAS,CAAC,QAAgB;QACtC,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YAClC,OAAO,QAAQ,IAAI,GAAG,CAAC;QACzB,CAAC;QAED,MAAM,QAAQ,GAAkB,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEpD,MAAM,QAAQ,GAAkB,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAe,EAAU,EAAE;YACvE,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,IAAI,OAAO,GAAW,OAAO,CAAC;YAE9B;;;;eAIG;YACH,IAAI,CAAC;gBACH,OAAO,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YACxC,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,GAAG,OAAO,CAAC;YACpB,CAAC;YAED,IACE,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC1B,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC/B,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;gBAC3B,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC;gBAChC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAClC,CAAC;gBACD,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,UAAU,CACtB,MAAuB,EACvB,sBAAkD;QAElD,IAAI,CAAC,sBAAsB,IAAI,sBAAsB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,OAAO,GAAgB,IAAI,GAAG,CAClC,sBAAsB,CAAC,GAAG,CAAC,CAAC,KAAa,EAAU,EAAE;YACnD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;QAC7B,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,IAAI,GAAkB,EAAE,CAAC;QAE/B,MAAM,CAAC,OAAO,CAAC,CAAC,MAAc,EAAE,GAAW,EAAQ,EAAE;YACnD,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACnC,IAAI,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,mBAAmB,CAAC,MAAc;QAC9C,MAAM,QAAQ,GAAW,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEnD,IAAI,CAAC,QAAQ,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAQ,IAAI,GAAG,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;YAClE,OAAO,MAAM,CAAC,QAAQ,CAAC;QACzB,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;CACF"}

package/build/dist/Utils/Schema/ModelSchema.js

@@ -14,6 +14,8 @@ import Name from "../../Types/Name";
 import IP from "../../Types/IP/IP";
 import Port from "../../Types/Port";
 import MonitorSteps from "../../Types/Monitor/MonitorSteps";
+import MonitorType from "../../Types/Monitor/MonitorType";
+import WorkflowStatus from "../../Types/Workflow/WorkflowStatus";
 import OneUptimeDate from "../../Types/Date";
 export class ModelSchema extends BaseSchema {
     /**
@@ -95,9 +97,15 @@ export class ModelSchema extends BaseSchema {
                 zodType = Email.getSchema();
             }
             else if (column.type === TableColumnType.HashedString) {
-                zodType = z
-                    .string()
-                    .openapi({ type: "string", example: "hashed_string_value" });
+                /*
+                 * format: password marks the field as a secret for spec consumers
+                 * (the Terraform provider generator emits Sensitive: true for it).
+                 */
+                zodType = z.string().openapi({
+                    type: "string",
+                    format: "password",
+                    example: "hashed_string_value",
+                });
             }
             else if (column.type === TableColumnType.Slug) {
                 zodType = z
@@ -274,12 +282,14 @@ export class ModelSchema extends BaseSchema {
             else if (column.type === TableColumnType.MonitorType) {
                 zodType = z.string().openapi({
                     type: "string",
+                    enum: Object.values(MonitorType),
                     example: "Manual",
                 });
             }
             else if (column.type === TableColumnType.WorkflowStatus) {
                 zodType = z.string().openapi({
                     type: "string",
+                    enum: Object.values(WorkflowStatus),
                     example: "In Progress",
                 });
             }
@@ -996,6 +1006,14 @@ export class ModelSchema extends BaseSchema {
                 // should be optional
                 zodType = zodType.optional();
             }
+            else if (column.type === TableColumnType.Slug) {
+                /*
+                 * Slugs are generated by the server from the slugify column. Some
+                 * models mark the column required at the database level, but API
+                 * clients never supply it.
+                 */
+                zodType = zodType.optional();
+            }
             else if (((_a = column.title) === null || _a === void 0 ? void 0 : _a.toLowerCase()) === "project id" &&
                 column.type === TableColumnType.ObjectID) {
                 // this is optional in the API as well as it's derived from API key
@@ -1092,8 +1110,13 @@ export class ModelSchema extends BaseSchema {
             zodType = Email.getSchema();
         }
         else if (column.type === TableColumnType.HashedString) {
+            /*
+             * format: password marks the field as a secret for spec consumers
+             * (the Terraform provider generator emits Sensitive: true for it).
+             */
             zodType = applyOpenApi(z.string(), {
                 type: "string",
+                format: "password",
                 example: "hashed_string_value",
             });
         }
@@ -1252,12 +1275,14 @@ export class ModelSchema extends BaseSchema {
         else if (column.type === TableColumnType.MonitorType) {
             zodType = applyOpenApi(z.string(), {
                 type: "string",
+                enum: Object.values(MonitorType),
                 example: "HTTP",
             });
         }
         else if (column.type === TableColumnType.WorkflowStatus) {
             zodType = applyOpenApi(z.string(), {
                 type: "string",
+                enum: Object.values(WorkflowStatus),
                 example: "In Progress",
             });
         }