@oneuptime/common 11.7.4 → 12.0.0

package/Utils/Rum/SessionSampling.ts

@@ -0,0 +1,108 @@
+/*
+ * Deterministic session sampling.
+ *
+ * The decision MUST be a pure function of the session id, computed
+ * identically in the browser and at the ingest gate. A per-event or
+ * per-chunk random draw (which is what the log drop-filter path does)
+ * would shred a single session into an unplayable set of fragments —
+ * some chunks kept, some dropped, no full snapshot where the player
+ * needs one.
+ *
+ * This file must stay dependency-free: it is bundled into the browser
+ * recorder as well as imported by the server.
+ */
+
+/*
+ * FNV-1a, 32-bit. Chosen over a cryptographic hash because it is ~20
+ * lines, has no platform dependency (no SubtleCrypto, no node:crypto),
+ * is synchronous, and distributes hex session ids evenly. Sampling is
+ * not a security boundary — see the note on tampering below.
+ */
+const FNV_OFFSET_BASIS_32: number = 0x811c9dc5;
+const FNV_PRIME_32: number = 0x01000193;
+
+/* Resolution of the sample percentage: two decimal places. */
+const SAMPLING_BUCKETS: number = 10000;
+
+export default class SessionSampling {
+  /*
+   * 32-bit FNV-1a hash of a string, returned as an unsigned integer.
+   *
+   * Math.imul is used for the multiply so the intermediate stays in
+   * 32-bit integer space; a plain `*` would overflow into a float and
+   * lose the low bits, which is the classic way this hash silently
+   * stops distributing.
+   */
+  public static fnv1a32(value: string): number {
+    let hash: number = FNV_OFFSET_BASIS_32;
+
+    for (let i: number = 0; i < value.length; i++) {
+      hash ^= value.charCodeAt(i);
+      hash = Math.imul(hash, FNV_PRIME_32);
+    }
+
+    /* Coerce to unsigned 32-bit. */
+    return hash >>> 0;
+  }
+
+  /*
+   * Which of the 10,000 sampling buckets a session falls into.
+   * Stable for the lifetime of the session id.
+   */
+  public static getBucket(sessionId: string): number {
+    return SessionSampling.fnv1a32(sessionId) % SAMPLING_BUCKETS;
+  }
+
+  /*
+   * True when this session is inside the sample.
+   *
+   * samplePercentage is 0..100 and may carry two decimal places. 0 means
+   * nothing is sampled; 100 means everything is. Values outside the range
+   * are clamped rather than rejected, because a bad config value must not
+   * be able to turn sampling into an exception on the ingest hot path.
+   *
+   * Note honestly: because the input is a client-generated id, a
+   * determined client can regenerate ids until one passes. This function
+   * protects against misconfiguration and gives stable, reproducible
+   * decisions — it is not an anti-abuse control. The origin allowlist,
+   * the rate limiter and the per-project byte budget are.
+   */
+  public static isSampled(
+    sessionId: string,
+    samplePercentage: number,
+  ): boolean {
+    const clamped: number = SessionSampling.clampPercentage(samplePercentage);
+
+    if (clamped <= 0) {
+      return false;
+    }
+
+    if (clamped >= 100) {
+      return true;
+    }
+
+    /*
+     * Rounded rather than truncated so a percentage like 33.335 maps to
+     * the nearer bucket boundary instead of always downward.
+     */
+    const threshold: number = Math.round(clamped * (SAMPLING_BUCKETS / 100));
+
+    return SessionSampling.getBucket(sessionId) < threshold;
+  }
+
+  public static clampPercentage(samplePercentage: number): number {
+    if (!Number.isFinite(samplePercentage)) {
+      return 0;
+    }
+
+    if (samplePercentage < 0) {
+      return 0;
+    }
+
+    if (samplePercentage > 100) {
+      return 100;
+    }
+
+    return samplePercentage;
+  }
+}

package/Utils/Rum/UrlScrubber.ts

@@ -0,0 +1,185 @@
+/*
+ * URL scrubbing for session replay.
+ *
+ * This is the one PII channel that text masking does not cover. Masking
+ * every text node still leaves `?email=someone@example.com`,
+ * `/reset-password?token=...`, and magic-link URLs intact — and URLs are
+ * *worse* than a payload leak, because entryUrl / exitUrl sit in the
+ * wider session-metadata ACL and render directly in the session list,
+ * where anyone who can see the list sees them.
+ *
+ * Applied in the browser, before anything is uploaded: to the chunk url,
+ * entryUrl, exitUrl, the rrweb Meta event hrefs, and every network-event
+ * URL.
+ *
+ * Must stay dependency-free — this is bundled into the browser recorder.
+ */
+
+/*
+ * Path segments that look like identifiers are replaced wholesale. A
+ * bare numeric id is left alone (it is rarely PII on its own and is
+ * often needed to tell one route from another), but anything that looks
+ * like a uuid, an email, a long digit run (card / phone / account) or a
+ * long opaque token is replaced.
+ */
+const UUID_SEGMENT: RegExp =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/* 24-char Mongo/BSON-style object id, which is what OneUptime itself uses. */
+const OBJECT_ID_SEGMENT: RegExp = /^[0-9a-f]{24}$/i;
+
+const EMAIL_SEGMENT: RegExp = /^[^@\s/]+@[^@\s/]+\.[^@\s/]+$/;
+
+/* 9 or more consecutive digits: card numbers, phone numbers, SSNs. */
+const LONG_DIGIT_SEGMENT: RegExp = /^\d{9,}$/;
+
+/*
+ * Long high-entropy strings: session tokens, JWT parts, signed links.
+ * Deliberately conservative at 32 characters so ordinary slugs survive.
+ */
+const OPAQUE_TOKEN_SEGMENT: RegExp = /^[A-Za-z0-9_-]{32,}$/;
+
+const REDACTED: string = "[redacted]";
+
+export default class UrlScrubber {
+  /*
+   * Reduce a URL to origin + scrubbed path. Query and fragment are
+   * dropped entirely unless a parameter is explicitly allowlisted, in
+   * which case its *name* is kept and its value is redacted — enough to
+   * tell "this page was loaded with a coupon code" from "it wasn't",
+   * without recording which code.
+   *
+   * Never throws: a URL that will not parse is reduced to a constant
+   * rather than propagating an exception into the recorder's hot path or
+   * being passed through unscrubbed. Failing closed matters more here
+   * than fidelity.
+   */
+  public static scrub(
+    rawUrl: string,
+    allowlistedQueryParams?: Array<string> | undefined,
+  ): string {
+    if (!rawUrl) {
+      return "";
+    }
+
+    let parsed: URL | undefined = undefined;
+
+    try {
+      /*
+       * A base is supplied so relative URLs (which rrweb Meta events can
+       * carry) still parse. The base origin is never emitted, because a
+       * relative input yields a relative output below.
+       */
+      parsed = new URL(rawUrl, "https://redacted.invalid");
+    } catch {
+      return REDACTED;
+    }
+
+    const isRelativeInput: boolean =
+      parsed.origin === "https://redacted.invalid" &&
+      !rawUrl.startsWith("https://redacted.invalid");
+
+    const scrubbedPath: string = UrlScrubber.scrubPath(parsed.pathname);
+
+    const query: string = UrlScrubber.scrubQuery(
+      parsed.searchParams,
+      allowlistedQueryParams,
+    );
+
+    const base: string = isRelativeInput
+      ? scrubbedPath
+      : `${parsed.origin}${scrubbedPath}`;
+
+    return query ? `${base}?${query}` : base;
+  }
+
+  /* Replace identifier-shaped segments, preserving route structure. */
+  public static scrubPath(pathname: string): string {
+    if (!pathname || pathname === "/") {
+      return pathname || "/";
+    }
+
+    const segments: Array<string> = pathname.split("/");
+
+    const scrubbed: Array<string> = segments.map((segment: string): string => {
+      if (!segment) {
+        return segment;
+      }
+
+      let decoded: string = segment;
+
+      /*
+       * Decode before matching so a percent-encoded email
+       * (name%40example.com) is still recognised. A malformed escape
+       * sequence throws, in which case the raw segment is matched.
+       */
+      try {
+        decoded = decodeURIComponent(segment);
+      } catch {
+        decoded = segment;
+      }
+
+      if (
+        UUID_SEGMENT.test(decoded) ||
+        OBJECT_ID_SEGMENT.test(decoded) ||
+        EMAIL_SEGMENT.test(decoded) ||
+        LONG_DIGIT_SEGMENT.test(decoded) ||
+        OPAQUE_TOKEN_SEGMENT.test(decoded)
+      ) {
+        return REDACTED;
+      }
+
+      return segment;
+    });
+
+    return scrubbed.join("/");
+  }
+
+  /*
+   * Keep only allowlisted parameter names, with redacted values. An
+   * empty or missing allowlist drops the query string entirely.
+   */
+  public static scrubQuery(
+    params: URLSearchParams,
+    allowlistedQueryParams?: Array<string> | undefined,
+  ): string {
+    if (!allowlistedQueryParams || allowlistedQueryParams.length === 0) {
+      return "";
+    }
+
+    const allowed: Set<string> = new Set(
+      allowlistedQueryParams.map((param: string): string => {
+        return param.toLowerCase();
+      }),
+    );
+
+    const kept: Array<string> = [];
+
+    params.forEach((_value: string, key: string): void => {
+      if (allowed.has(key.toLowerCase())) {
+        kept.push(`${encodeURIComponent(key)}=${REDACTED}`);
+      }
+    });
+
+    return kept.join("&");
+  }
+
+  /*
+   * Path-only form, used for the refresh-rage detector, which needs to
+   * compare "the same page" across reloads without the origin.
+   */
+  public static getScrubbedPathname(rawUrl: string): string {
+    const scrubbed: string = UrlScrubber.scrub(rawUrl);
+
+    if (!scrubbed || scrubbed === REDACTED) {
+      return REDACTED;
+    }
+
+    try {
+      const parsed: URL = new URL(scrubbed, "https://redacted.invalid");
+      return parsed.pathname;
+    } catch {
+      return REDACTED;
+    }
+  }
+}

package/Utils/Schema/ModelSchema.ts

@@ -21,6 +21,8 @@ import Name from "../../Types/Name";
 import IP from "../../Types/IP/IP";
 import Port from "../../Types/Port";
 import MonitorSteps from "../../Types/Monitor/MonitorSteps";
+import MonitorType from "../../Types/Monitor/MonitorType";
+import WorkflowStatus from "../../Types/Workflow/WorkflowStatus";
 import OneUptimeDate from "../../Types/Date";
 
 export type ModelSchemaType = ZodSchema;
@@ -137,9 +139,15 @@ export class ModelSchema extends BaseSchema {
       } else if (column.type === TableColumnType.Email) {
         zodType = Email.getSchema();
       } else if (column.type === TableColumnType.HashedString) {
-        zodType = z
-          .string()
-          .openapi({ type: "string", example: "hashed_string_value" });
+        /*
+         * format: password marks the field as a secret for spec consumers
+         * (the Terraform provider generator emits Sensitive: true for it).
+         */
+        zodType = z.string().openapi({
+          type: "string",
+          format: "password",
+          example: "hashed_string_value",
+        });
       } else if (column.type === TableColumnType.Slug) {
         zodType = z
           .string()
@@ -289,11 +297,13 @@ export class ModelSchema extends BaseSchema {
       } else if (column.type === TableColumnType.MonitorType) {
         zodType = z.string().openapi({
           type: "string",
+          enum: Object.values(MonitorType),
           example: "Manual",
         });
       } else if (column.type === TableColumnType.WorkflowStatus) {
         zodType = z.string().openapi({
           type: "string",
+          enum: Object.values(WorkflowStatus),
           example: "In Progress",
         });
       } else if (column.type === TableColumnType.Boolean) {
@@ -1166,6 +1176,13 @@ export class ModelSchema extends BaseSchema {
       if (column.isDefaultValueColumn) {
         // should be optional
         zodType = zodType.optional();
+      } else if (column.type === TableColumnType.Slug) {
+        /*
+         * Slugs are generated by the server from the slugify column. Some
+         * models mark the column required at the database level, but API
+         * clients never supply it.
+         */
+        zodType = zodType.optional();
       } else if (
         column.title?.toLowerCase() === "project id" &&
         column.type === TableColumnType.ObjectID
@@ -1279,8 +1296,13 @@ export class ModelSchema extends BaseSchema {
     } else if (column.type === TableColumnType.Email) {
       zodType = Email.getSchema();
     } else if (column.type === TableColumnType.HashedString) {
+      /*
+       * format: password marks the field as a secret for spec consumers
+       * (the Terraform provider generator emits Sensitive: true for it).
+       */
       zodType = applyOpenApi(z.string(), {
         type: "string",
+        format: "password",
         example: "hashed_string_value",
       });
     } else if (column.type === TableColumnType.Slug) {
@@ -1424,11 +1446,13 @@ export class ModelSchema extends BaseSchema {
     } else if (column.type === TableColumnType.MonitorType) {
       zodType = applyOpenApi(z.string(), {
         type: "string",
+        enum: Object.values(MonitorType),
         example: "HTTP",
       });
     } else if (column.type === TableColumnType.WorkflowStatus) {
       zodType = applyOpenApi(z.string(), {
         type: "string",
+        enum: Object.values(WorkflowStatus),
         example: "In Progress",
       });
     } else if (column.type === TableColumnType.Boolean) {

package/Utils/StatusPage/Report.ts

@@ -0,0 +1,304 @@
+import StatusPageGroup from "../../Models/DatabaseModels/StatusPageGroup";
+import StatusPageResource from "../../Models/DatabaseModels/StatusPageResource";
+import Dictionary from "../../Types/Dictionary";
+import {
+  StatusPageReportGroup,
+  StatusPageReportGroupMetrics,
+  StatusPageReportItem,
+  StatusPageReportRow,
+} from "../../Types/StatusPage/StatusPageReport";
+import StatusPageGroupTreeUtil, { StatusPageGroupTreeNode } from "./GroupTree";
+
+/*
+ * One resource on the status page paired with the numbers already computed for
+ * it. Kept as a pair (rather than keyed by id) because the report is built from
+ * the same array the resources were fetched in, and a resource row is not
+ * guaranteed to have been selected with its `_id`.
+ */
+export interface StatusPageReportResourceEntry {
+  statusPageResource: StatusPageResource;
+  reportItem: Omit<StatusPageReportItem, "groupName" | "groupPath">;
+}
+
+export interface StatusPageReportStructure {
+  // Every resource, flat, in the order it was supplied.
+  resources: Array<StatusPageReportItem>;
+  // The group tree, top level groups first.
+  groups: Array<StatusPageReportGroup>;
+  resourcesWithoutGroup: Array<StatusPageReportItem>;
+  // The tree flattened into render order.
+  rows: Array<StatusPageReportRow>;
+}
+
+/*
+ * Turns the flat per-resource numbers of an uptime report into the same nested
+ * shape the live status page renders: ungrouped resources first, then each top
+ * level group with its own resources and then its sub groups, at any depth.
+ *
+ * Deliberately pure and synchronous. Anything that needs the database (rolled up
+ * incident counts, downtime over a group's monitors) is computed by the caller
+ * and handed in through `groupMetricsByGroupId`, which keeps the tree walk here
+ * testable on its own and keeps the number of queries in the caller's hands.
+ */
+export default class StatusPageReportTreeUtil {
+  // How far one level of nesting indents a row in the emailed report.
+  public static readonly IndentInPixelsPerDepth: number = 16;
+
+  public static readonly GroupPathSeparator: string = " / ";
+
+  public static build(data: {
+    entries: Array<StatusPageReportResourceEntry>;
+    statusPageGroups: Array<StatusPageGroup>;
+    /*
+     * Rolled up numbers per group id, covering the group and every group nested
+     * under it. A group with no entry here reports zeroes rather than
+     * disappearing - a level missing from the report is worse than a level with
+     * an empty number.
+     */
+    groupMetricsByGroupId: Dictionary<StatusPageReportGroupMetrics>;
+  }): StatusPageReportStructure {
+    const groupsById: Dictionary<StatusPageGroup> = {};
+
+    for (const group of data.statusPageGroups) {
+      const groupId: string | undefined = group._id?.toString();
+
+      if (groupId) {
+        groupsById[groupId] = group;
+      }
+    }
+
+    const pathByGroupId: Dictionary<string> = this.getPathByGroupId({
+      statusPageGroups: data.statusPageGroups,
+    });
+
+    const resources: Array<StatusPageReportItem> = data.entries.map(
+      (entry: StatusPageReportResourceEntry) => {
+        const groupId: string | undefined =
+          entry.statusPageResource.statusPageGroupId?.toString();
+
+        const group: StatusPageGroup | undefined = groupId
+          ? groupsById[groupId]
+          : undefined;
+
+        return {
+          ...entry.reportItem,
+          groupName: group?.name || "",
+          groupPath: (groupId && pathByGroupId[groupId]) || "",
+        };
+      },
+    );
+
+    /*
+     * Resources are keyed back to their group by index, so this has to stay in
+     * step with `data.entries` above.
+     */
+    const resourcesByGroupId: Dictionary<Array<StatusPageReportItem>> = {};
+    const resourcesWithoutGroup: Array<StatusPageReportItem> = [];
+
+    data.entries.forEach(
+      (entry: StatusPageReportResourceEntry, index: number) => {
+        const reportItem: StatusPageReportItem = resources[index]!;
+
+        const groupId: string | undefined =
+          entry.statusPageResource.statusPageGroupId?.toString();
+
+        /*
+         * A resource pointing at a group that is not on this page has nowhere to
+         * nest, so it renders at the top like any other ungrouped resource
+         * instead of falling out of the report.
+         */
+        if (!groupId || !groupsById[groupId]) {
+          resourcesWithoutGroup.push(reportItem);
+          return;
+        }
+
+        resourcesByGroupId[groupId] = resourcesByGroupId[groupId] || [];
+        resourcesByGroupId[groupId]!.push(reportItem);
+      },
+    );
+
+    /*
+     * buildTree rather than getRootGroups: a parent pointer written straight to
+     * the database can put a group in a cycle, and a cycle has no root. buildTree
+     * promotes those groups to the top level so they still appear.
+     */
+    const tree: Array<StatusPageGroupTreeNode> =
+      StatusPageGroupTreeUtil.buildTree({
+        statusPageGroups: data.statusPageGroups,
+      });
+
+    const groups: Array<StatusPageReportGroup> = tree.map(
+      (node: StatusPageGroupTreeNode) => {
+        return this.buildGroup({
+          node: node,
+          resourcesByGroupId: resourcesByGroupId,
+          groupMetricsByGroupId: data.groupMetricsByGroupId,
+          pathByGroupId: pathByGroupId,
+        });
+      },
+    );
+
+    return {
+      resources: resources,
+      groups: groups,
+      resourcesWithoutGroup: resourcesWithoutGroup,
+      rows: this.getRows({
+        groups: groups,
+        resourcesWithoutGroup: resourcesWithoutGroup,
+      }),
+    };
+  }
+
+  /*
+   * "Region 001 / Market 001 / Unit 0660" for every group, so a resource row can
+   * say where it sits without the reader having to reconstruct the tree.
+   */
+  public static getPathByGroupId(data: {
+    statusPageGroups: Array<StatusPageGroup>;
+  }): Dictionary<string> {
+    const pathByGroupId: Dictionary<string> = {};
+
+    for (const group of data.statusPageGroups) {
+      const groupId: string | undefined = group._id?.toString();
+
+      if (!groupId) {
+        continue;
+      }
+
+      const ancestors: Array<StatusPageGroup> =
+        StatusPageGroupTreeUtil.getAncestorGroups({
+          statusPageGroup: group,
+          statusPageGroups: data.statusPageGroups,
+        });
+
+      const names: Array<string> = [...ancestors]
+        .reverse()
+        .concat([group])
+        .map((groupInPath: StatusPageGroup) => {
+          return groupInPath.name || "";
+        })
+        .filter((name: string) => {
+          return Boolean(name);
+        });
+
+      pathByGroupId[groupId] = names.join(this.GroupPathSeparator);
+    }
+
+    return pathByGroupId;
+  }
+
+  private static buildGroup(data: {
+    node: StatusPageGroupTreeNode;
+    resourcesByGroupId: Dictionary<Array<StatusPageReportItem>>;
+    groupMetricsByGroupId: Dictionary<StatusPageReportGroupMetrics>;
+    pathByGroupId: Dictionary<string>;
+  }): StatusPageReportGroup {
+    const groupId: string = data.node.group._id?.toString() || "";
+
+    const subGroups: Array<StatusPageReportGroup> = data.node.children.map(
+      (child: StatusPageGroupTreeNode) => {
+        return this.buildGroup({
+          node: child,
+          resourcesByGroupId: data.resourcesByGroupId,
+          groupMetricsByGroupId: data.groupMetricsByGroupId,
+          pathByGroupId: data.pathByGroupId,
+        });
+      },
+    );
+
+    const ownResources: Array<StatusPageReportItem> =
+      data.resourcesByGroupId[groupId] || [];
+
+    const metrics: StatusPageReportGroupMetrics = data.groupMetricsByGroupId[
+      groupId
+    ] || {
+      uptimePercent: 0,
+      uptimePercentAsString: "0%",
+      downtimeInHoursAndMinutes: "0",
+      totalIncidentCount: 0,
+    };
+
+    const totalResources: number = subGroups.reduce(
+      (count: number, subGroup: StatusPageReportGroup) => {
+        return count + subGroup.totalResources;
+      },
+      ownResources.length,
+    );
+
+    return {
+      groupName: data.node.group.name || "",
+      groupPath: data.pathByGroupId[groupId] || data.node.group.name || "",
+      depth: data.node.depth,
+      totalResources: totalResources,
+      resources: ownResources,
+      subGroups: subGroups,
+      uptimePercent: metrics.uptimePercent,
+      uptimePercentAsString: metrics.uptimePercentAsString,
+      downtimeInHoursAndMinutes: metrics.downtimeInHoursAndMinutes,
+      totalIncidentCount: metrics.totalIncidentCount,
+    };
+  }
+
+  /*
+   * Render order, matching the live page: resources with no group first, then
+   * each group followed by its own resources and then its sub groups.
+   */
+  public static getRows(data: {
+    groups: Array<StatusPageReportGroup>;
+    resourcesWithoutGroup: Array<StatusPageReportItem>;
+  }): Array<StatusPageReportRow> {
+    const rows: Array<StatusPageReportRow> = [];
+
+    for (const resource of data.resourcesWithoutGroup) {
+      rows.push(this.toResourceRow({ resource: resource, depth: 0 }));
+    }
+
+    const walk: (groups: Array<StatusPageReportGroup>) => void = (
+      groups: Array<StatusPageReportGroup>,
+    ): void => {
+      for (const group of groups) {
+        rows.push({
+          isGroup: true,
+          name: group.groupName,
+          depth: group.depth,
+          indentInPixels: group.depth * this.IndentInPixelsPerDepth,
+          uptimePercentAsString: group.uptimePercentAsString,
+          downtimeInHoursAndMinutes: group.downtimeInHoursAndMinutes,
+          totalIncidentCount: group.totalIncidentCount,
+          totalResources: group.totalResources,
+        });
+
+        for (const resource of group.resources) {
+          rows.push(
+            this.toResourceRow({
+              resource: resource,
+              depth: group.depth + 1,
+            }),
+          );
+        }
+
+        walk(group.subGroups);
+      }
+    };
+
+    walk(data.groups);
+
+    return rows;
+  }
+
+  private static toResourceRow(data: {
+    resource: StatusPageReportItem;
+    depth: number;
+  }): StatusPageReportRow {
+    return {
+      isGroup: false,
+      name: data.resource.resourceName,
+      depth: data.depth,
+      indentInPixels: data.depth * this.IndentInPixelsPerDepth,
+      uptimePercentAsString: data.resource.uptimePercentAsString,
+      downtimeInHoursAndMinutes: data.resource.downtimeInHoursAndMinutes,
+      totalIncidentCount: data.resource.totalIncidentCount,
+      totalResources: 0,
+    };
+  }
+}