@oneuptime/common 11.7.3 → 12.0.0

package/Server/Utils/Database/ProjectScopedReferenceValidator.ts

@@ -0,0 +1,212 @@
+import DatabaseService from "../../Services/DatabaseService";
+import Query from "../../Types/Database/Query";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import Select from "../../Types/Database/Select";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+
+/*
+ * Incidents, alerts and scheduled maintenance events point at project-scoped
+ * records — the current state, the severity, the monitor status to switch to.
+ * Nothing checked that those ids belonged to the row's own project, so an id
+ * taken from a second project (an API call, a template, a monitor criteria)
+ * could be persisted.
+ *
+ * That is what makes the *referenced* project undeletable: deleting a Project
+ * cascades into its IncidentState / IncidentSeverity / MonitorStatus rows, but
+ * the Incident row owned by a different project still points at them and those
+ * FKs are ON DELETE NO ACTION, so Postgres raises 23503 and the API answers
+ * "This item cannot be deleted because Incident records still reference it."
+ *
+ * The check below is deliberately narrow, for the same reason
+ * MonitorStepsProjectValidator is: it only rejects an id that really is
+ * another project's record. An id that matches no row at all is left alone —
+ * refusing it would block users from saving their way out of a record that
+ * already references something deleted, and the not-null/foreign-key checks
+ * report that case on their own.
+ */
+
+export interface ProjectScopedReference {
+  // Human readable name of the referenced model, e.g. "Incident Severity".
+  modelName: string;
+  id: ObjectID | string | undefined | null;
+  // The service that owns the referenced model, e.g. IncidentSeverityService.
+  service: DatabaseService<DatabaseBaseModel>;
+}
+
+interface ForeignReference {
+  modelName: string;
+  name: string;
+}
+
+/*
+ * The same reference reaches a service hook in several shapes: the id column
+ * (`incidentSeverityId`), a relation object (`incidentSeverity: { _id }`), an
+ * ObjectID in either slot, or — on the update path — a bare uuid string in the
+ * relation slot, which DatabaseService.sanitizeCreateOrUpdate only turns into
+ * a relation entity *after* onBeforeUpdate has run. Reading `?._id` alone
+ * misses the string shape and the guard would silently pass.
+ */
+export function resolveReferenceId(
+  value: unknown,
+): ObjectID | string | undefined {
+  if (!value) {
+    return undefined;
+  }
+
+  if (typeof value === "string") {
+    return value;
+  }
+
+  if (value instanceof ObjectID) {
+    return value;
+  }
+
+  const relation: { _id?: string | undefined; id?: ObjectID | undefined } =
+    value as { _id?: string | undefined; id?: ObjectID | undefined };
+
+  return relation._id || relation.id || undefined;
+}
+
+export default class ProjectScopedReferenceValidator {
+  public static async validateReferencesBelongToProject(data: {
+    projectId: ObjectID | undefined;
+    references: Array<ProjectScopedReference>;
+    // Used in the error message, e.g. "incident" -> "This incident references…".
+    subject?: string | undefined;
+  }): Promise<void> {
+    if (!data.projectId) {
+      /*
+       * Root/internal writes do not always carry a project. Callers resolve the
+       * project themselves where they can; when they cannot there is nothing to
+       * compare against and the check is a no-op.
+       */
+      return;
+    }
+
+    /*
+     * One lookup per referenced model rather than one per id — an incident
+     * carries three of these and they are on the create path.
+     */
+    const idsByService: Map<
+      DatabaseService<DatabaseBaseModel>,
+      Map<string, string>
+    > = new Map();
+
+    for (const reference of data.references) {
+      const id: string = reference.id?.toString() || "";
+
+      if (!id) {
+        continue;
+      }
+
+      if (!idsByService.has(reference.service)) {
+        idsByService.set(reference.service, new Map());
+      }
+
+      idsByService.get(reference.service)!.set(id, reference.modelName);
+    }
+
+    if (idsByService.size === 0) {
+      return;
+    }
+
+    const foreignReferences: Array<ForeignReference> = [];
+
+    for (const [service, idToModelName] of idsByService) {
+      const records: Array<DatabaseBaseModel> = await service.findBy({
+        query: {
+          _id: QueryHelper.any(Array.from(idToModelName.keys())),
+        },
+        /*
+         * `name` and `projectId` are not on DatabaseBaseModel, but every model
+         * passed here is project scoped and named, so the cast is safe.
+         */
+        select: {
+          _id: true,
+          name: true,
+          projectId: true,
+        } as Select<DatabaseBaseModel>,
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      for (const record of records) {
+        const recordProjectId: ObjectID | undefined =
+          record.getValue<ObjectID>("projectId") || undefined;
+
+        if (recordProjectId?.toString() === data.projectId.toString()) {
+          continue;
+        }
+
+        const id: string = record._id?.toString() || "";
+
+        foreignReferences.push({
+          modelName: idToModelName.get(id) || "Record",
+          name: record.getValue<string>("name")?.toString() || id,
+        });
+      }
+    }
+
+    if (foreignReferences.length === 0) {
+      return;
+    }
+
+    const described: string = foreignReferences
+      .map((reference: ForeignReference) => {
+        return `${reference.modelName} "${reference.name}"`;
+      })
+      .join(", ");
+
+    throw new BadDataException(
+      `This ${
+        data.subject || "request"
+      } references records that belong to a different project: ${described}. Please pick values from this project and try again.`,
+    );
+  }
+
+  /*
+   * "Can this project actually use this record?" — for callers that must not
+   * throw. The probe and telemetry ingest workers build incidents and alerts
+   * from monitor criteria, whose stored ids may still point at another
+   * project (monitorSteps repair could not always resolve them). Throwing
+   * there fails the whole ingest job for that monitor, so those callers ask
+   * this instead and fall back to their project's own default.
+   *
+   * Note the deliberate difference from validateReferencesBelongToProject: an
+   * id that matches NO record is unusable here (false), while the write guard
+   * lets it pass so a record already pointing at something deleted stays
+   * saveable.
+   */
+  public static async isUsableInProject(data: {
+    projectId: ObjectID | undefined;
+    id: ObjectID | string | undefined | null;
+    service: DatabaseService<DatabaseBaseModel>;
+  }): Promise<boolean> {
+    const id: string = data.id?.toString() || "";
+
+    if (!id || !data.projectId) {
+      return false;
+    }
+
+    const record: DatabaseBaseModel | null = await data.service.findOneBy({
+      query: {
+        _id: id,
+        projectId: data.projectId,
+      } as Query<DatabaseBaseModel>,
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return Boolean(record);
+  }
+}

package/Server/Utils/Database/RelationIdUtil.ts

@@ -0,0 +1,68 @@
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * A many-to-one reference reaches a service hook under TWO different keys.
+ *
+ * The dashboard's forms post the RELATION object - `{ site: { _id: "..." } }`
+ * - because DatabaseBaseModel.toJSONObject serialises the entity column it
+ * was given (Common/Models/DatabaseModels/DatabaseBaseModel/
+ * DatabaseBaseModel.ts) and BaseAPI passes that body through to the service
+ * verbatim. Server-side callers, by contrast, write the FK column
+ * (`{ siteId: ... }`). onBeforeUpdate/onUpdateSuccess run BEFORE TypeORM
+ * resolves one into the other, so a hook that inspects only one spelling
+ * silently ignores every write made through the other - which is how a site
+ * picked in the UI could skip its tenancy check and its rollup refresh
+ * (OneUptime/oneuptime#2940).
+ *
+ * Give these helpers both spellings, FK column first.
+ */
+export default class RelationIdUtil {
+  // True when the payload writes the reference under any of `keys`.
+  public static isWritten(
+    dataKeys: Array<string>,
+    keys: Array<string>,
+  ): boolean {
+    return keys.some((key: string) => {
+      return dataKeys.includes(key);
+    });
+  }
+
+  /*
+   * The id the payload points the reference at, or null when it clears the
+   * reference (or carries nothing resolvable). Accepts an ObjectID, a plain
+   * id string, or a serialised relation carrying `_id` / `id`.
+   */
+  public static read(
+    data: Record<string, unknown> | undefined | null,
+    keys: Array<string>,
+  ): ObjectID | null {
+    for (const key of keys) {
+      const value: unknown = (data || {})[key];
+
+      if (!value) {
+        continue;
+      }
+
+      if (value instanceof ObjectID) {
+        return value;
+      }
+
+      if (typeof value === "string") {
+        return new ObjectID(value);
+      }
+
+      const relation: { _id?: unknown; id?: unknown } = value as {
+        _id?: unknown;
+        id?: unknown;
+      };
+
+      const relationId: unknown = relation._id || relation.id;
+
+      if (relationId) {
+        return new ObjectID(relationId.toString());
+      }
+    }
+
+    return null;
+  }
+}

package/Server/Utils/DropFilterValidation.ts

@@ -0,0 +1,127 @@
+import BadDataException from "../../Types/Exception/BadDataException";
+import {
+  MAX_SAMPLE_PERCENTAGE,
+  MIN_SAMPLE_PERCENTAGE,
+} from "../../Types/Telemetry/DropFilterSampling";
+
+/*
+ * Shared save-time validation for log and trace drop filters.
+ *
+ * Both drop-filter models have historically accepted configurations the
+ * ingest engine could not honour, and both failed silently and
+ * destructively:
+ *
+ *   - A blank `filterQuery` compiles to "match every record", so a drop
+ *     filter saved with an empty query discards 100% of a project's
+ *     telemetry. Nothing warned, and nothing recorded the drops.
+ *
+ *   - `samplePercentage` is nullable with no default and the form field is
+ *     optional, so `action = "sample"` could be saved with no percentage at
+ *     all. The engine then fell back to a hardcoded 50, i.e. "silently
+ *     throw away half of it", while the UI rendered the unset value as
+ *     "0% kept".
+ *
+ * Rejecting both at the API boundary is the only place a human is present
+ * to read the error. The ingest path additionally fails *safe* on rows that
+ * predate this validation (see DropFilterSampling.resolveSamplePercentage
+ * and LogDropFilterService.loadDropFilters).
+ *
+ * Deliberately not validated here: whether `filterQuery` actually parses.
+ * The parser lives in the App feature set, which Common must not import,
+ * and an unparsable query compiles to "match nothing" — a harmless no-op
+ * rather than a data-destroying one.
+ */
+
+/*
+ * Both LogDropFilterAction and TraceDropFilterAction spell this "sample";
+ * comparing the raw string keeps this validator usable from both services
+ * without either enum leaking in.
+ */
+export const SAMPLE_ACTION: string = "sample";
+
+export interface DropFilterCandidate {
+  action: string | undefined | null;
+  samplePercentage: number | undefined | null;
+  filterQuery: string | undefined | null;
+}
+
+export interface DropFilterValidationOptions {
+  /*
+   * "logs" or "spans" — only used to make the error message read like the
+   * product surface the user is actually on.
+   */
+  recordNoun: string;
+}
+
+export function validateDropFilterFilterQuery(
+  filterQuery: string | undefined | null,
+  options: DropFilterValidationOptions,
+): void {
+  if (
+    filterQuery === undefined ||
+    filterQuery === null ||
+    filterQuery.trim().length === 0
+  ) {
+    throw new BadDataException(
+      `Filter query is required. A drop filter with an empty query matches every record, which would discard all of this project's ${options.recordNoun}. Add a condition, or delete the filter.`,
+    );
+  }
+}
+
+export function validateDropFilterSamplePercentage(
+  candidate: DropFilterCandidate,
+  options: DropFilterValidationOptions,
+): void {
+  if (candidate.action !== SAMPLE_ACTION) {
+    return;
+  }
+
+  const samplePercentage: number | undefined | null =
+    candidate.samplePercentage;
+
+  if (
+    typeof samplePercentage !== "number" ||
+    !Number.isFinite(samplePercentage)
+  ) {
+    throw new BadDataException(
+      `Sample percentage is required when the action is "Sample". Enter the percentage of matching ${options.recordNoun} to keep, between ${MIN_SAMPLE_PERCENTAGE} and ${MAX_SAMPLE_PERCENTAGE}.`,
+    );
+  }
+
+  if (
+    samplePercentage < MIN_SAMPLE_PERCENTAGE ||
+    samplePercentage > MAX_SAMPLE_PERCENTAGE
+  ) {
+    throw new BadDataException(
+      `Sample percentage must be between ${MIN_SAMPLE_PERCENTAGE} and ${MAX_SAMPLE_PERCENTAGE}. Use the "Drop" action to discard every matching record, or disable the filter to keep every one.`,
+    );
+  }
+}
+
+/*
+ * Validate a fully-resolved candidate row. Callers building this from an
+ * update must merge the incoming partial over the stored row first, so a
+ * request that flips `action` to "sample" without supplying a percentage is
+ * still caught.
+ */
+export function validateDropFilter(
+  candidate: DropFilterCandidate,
+  options: DropFilterValidationOptions,
+): void {
+  validateDropFilterFilterQuery(candidate.filterQuery, options);
+  validateDropFilterSamplePercentage(candidate, options);
+}
+
+/*
+ * `PartialEntity` values may be `() => string` raw SQL expressions rather
+ * than literals. We cannot evaluate one here, so an update that sets a
+ * validated field to an expression cannot be checked — validating a
+ * stringified function would be worse than not validating at all.
+ *
+ * Nothing in the product writes drop-filter fields this way; the branch
+ * exists so the types stay honest and a future caller that does it gets
+ * skipped rather than spuriously rejected.
+ */
+export function isSqlExpressionValue(value: unknown): boolean {
+  return typeof value === "function";
+}

package/Server/Utils/Errors.ts

@@ -14,6 +14,11 @@ export default {
     SUBSCRIPTION_NOT_FOUND: "Subscription not found.",
     INVOICE_NOT_FOUND: "Invoice not found.",
     PAYMENT_INTENT_NOT_FOUND: "Payment intent not found.",
+    TRIAL_END_DATE_IN_PAST: "Trial end date must be in the future.",
+    TRIAL_END_DATE_TOO_FAR_IN_FUTURE:
+      "Trial end date cannot be more than 730 days (two years) in the future. This is a limit imposed by the payment provider.",
+    CANNOT_EXTEND_TRIAL_ON_CANCELLED_SUBSCRIPTION:
+      "This subscription has been cancelled. Its trial cannot be extended.",
   },
   TeamMemberService: {
     ALREADY_INVITED: "This user has already been invited to this team",

package/Server/Utils/Incident/IncidentPrivacyFilter.ts

@@ -153,3 +153,63 @@ export function applyIncidentRelatedRecordPrivacyFilter<T>(
   );
   return query;
 }
+
+/*
+ * Null-tolerant variant of the related-record filter for child tables whose
+ * incident link is OPTIONAL (e.g. AutoRemediationSuggestion, which links an
+ * incident OR an alert). In SQL, `NULL IN (subquery)` evaluates to NULL, so
+ * the strict clause above would hide every row whose incidentId is NULL —
+ * this variant lets NULL-linked rows through and defers to the sibling
+ * column's own filter.
+ */
+export function getOptionalIncidentRelatedRecordPrivacyRaw(
+  props: DatabaseCommonInteractionProps,
+): FindWhereProperty<any> | undefined {
+  if (shouldBypassIncidentPrivacy(props)) {
+    return undefined;
+  }
+
+  if (!props.userId) {
+    return Raw((alias: string): string => {
+      return `(${alias} IS NULL OR ${alias} IN (SELECT i."_id" FROM "Incident" i WHERE i."deletedAt" IS NULL AND (i."isPrivate" IS NULL OR i."isPrivate" = FALSE)))`;
+    });
+  }
+
+  const uidRid: string = "uidRelOpt_" + Text.generateRandomText(10);
+
+  return Raw(
+    (alias: string): string => {
+      return (
+        `(${alias} IS NULL OR ${alias} IN (SELECT i."_id" FROM "Incident" i WHERE i."deletedAt" IS NULL AND (` +
+        `i."isPrivate" IS NULL OR i."isPrivate" = FALSE OR ` +
+        `i."_id" IN (SELECT iou."incidentId" FROM "IncidentOwnerUser" iou WHERE iou."userId" = :${uidRid} AND iou."deletedAt" IS NULL) OR ` +
+        `i."_id" IN (SELECT iot."incidentId" FROM "IncidentOwnerTeam" iot INNER JOIN "TeamMember" tm ON tm."teamId" = iot."teamId" WHERE tm."userId" = :${uidRid} AND tm."deletedAt" IS NULL AND iot."deletedAt" IS NULL))))`
+      );
+    },
+    {
+      [uidRid]: props.userId.toString(),
+    },
+  );
+}
+
+export function applyOptionalIncidentRelatedRecordPrivacyFilter<T>(
+  query: T,
+  props: DatabaseCommonInteractionProps,
+): T {
+  const rawClause: FindWhereProperty<any> | undefined =
+    getOptionalIncidentRelatedRecordPrivacyRaw(props);
+
+  if (!rawClause) {
+    return query;
+  }
+
+  if (!query) {
+    return { incidentId: rawClause } as unknown as T;
+  }
+
+  (query as any).incidentId = combineWithPrivacyClause(
+    (query as any).incidentId,
+    rawClause,
+  );
+  return query;
+}