@oneuptime/common 11.7.4 → 12.0.0

package/Server/Services/RumSessionErasureRequestService.ts

@@ -0,0 +1,197 @@
+import DatabaseService from "./DatabaseService";
+import Model, {
+  RumSessionErasureRequestStatus,
+  RumSessionErasureRequestType,
+} from "../../Models/DatabaseModels/RumSessionErasureRequest";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import OneUptimeDate from "../../Types/Date";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate } from "../Types/Database/Hooks";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * Session replay erasure requests.
+ *
+ * The service owns the two invariants the model cannot express on its
+ * own: a request is always born Pending with zeroed counters no matter
+ * what the client sent, and a request must actually be actionable by the
+ * worker before it is accepted. A request that is accepted but can never
+ * be executed is worse than a rejected one - the requester believes their
+ * data is gone.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const requestType: RumSessionErasureRequestType | undefined =
+      createBy.data.requestType;
+
+    if (!requestType) {
+      throw new BadDataException(
+        "requestType is required on a session replay erasure request.",
+      );
+    }
+
+    /*
+     * Validated here rather than only in the UI because the worker cannot
+     * do anything sensible with a request whose target is missing, and it
+     * would sit Pending forever looking like an erasure in progress.
+     */
+    if (requestType === RumSessionErasureRequestType.ByDateRange) {
+      if (!createBy.data.startDate || !createBy.data.endDate) {
+        throw new BadDataException(
+          "startDate and endDate are required for a ByDateRange erasure request.",
+        );
+      }
+
+      if (
+        OneUptimeDate.isAfter(createBy.data.startDate, createBy.data.endDate)
+      ) {
+        throw new BadDataException(
+          "startDate must not be after endDate on a ByDateRange erasure request.",
+        );
+      }
+    } else if (!createBy.data.targetValue) {
+      throw new BadDataException(
+        `targetValue is required for a ${requestType} erasure request.`,
+      );
+    }
+
+    /*
+     * A ByRumApplication request stores the application id in targetValue
+     * as well as in the relation, because rumApplicationId is nulled out
+     * (not cascaded) when the application is deleted - which is precisely
+     * when the erasure still needs to run.
+     */
+    if (
+      requestType === RumSessionErasureRequestType.ByRumApplication &&
+      createBy.data.rumApplicationId &&
+      !createBy.data.targetValue
+    ) {
+      createBy.data.targetValue = createBy.data.rumApplicationId.toString();
+    }
+
+    /*
+     * All five are overwritten unconditionally, never merged with what the
+     * client sent. Every one of them is declared `computed` on the model,
+     * which is what lets these assignments survive the create-column
+     * permission check that runs after this hook.
+     */
+    createBy.data.status = RumSessionErasureRequestStatus.Pending;
+    createBy.data.requestedAt = OneUptimeDate.getCurrentDate();
+    createBy.data.sessionsDeleted = 0;
+    createBy.data.chunksDeleted = 0;
+
+    if (createBy.props.userId) {
+      createBy.data.requestedByUserId = createBy.props.userId;
+    } else {
+      /*
+       * No authenticated user (an API key, say). Deleting rather than
+       * leaving the field alone matters: a client-supplied value would
+       * otherwise persist and attribute the erasure to somebody who never
+       * asked for it.
+       */
+      delete createBy.data.requestedByUserId;
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  /*
+   * Outstanding requests for the erasure worker, oldest first so a
+   * request cannot be starved by newer ones.
+   *
+   * sessionsDeleted / chunksDeleted are in the select list because a
+   * requeued request has to ACCUMULATE its counters across runs; omitting
+   * them is what made the worker stop using this helper and inline its own
+   * copy of the query.
+   */
+  @CaptureSpan()
+  public async getPendingRequests(data: {
+    limit: number;
+  }): Promise<Array<Model>> {
+    return await this.findBy({
+      query: {
+        status: RumSessionErasureRequestStatus.Pending,
+      },
+      select: {
+        _id: true,
+        projectId: true,
+        rumApplicationId: true,
+        requestType: true,
+        targetValue: true,
+        startDate: true,
+        endDate: true,
+        requestedAt: true,
+        sessionsDeleted: true,
+        chunksDeleted: true,
+      },
+      sort: {
+        requestedAt: SortOrder.Ascending,
+      },
+      skip: 0,
+      limit: data.limit,
+      props: { isRoot: true },
+    });
+  }
+
+  @CaptureSpan()
+  public async markInProgress(data: { requestId: ObjectID }): Promise<void> {
+    await this.updateOneById({
+      id: data.requestId,
+      data: {
+        status: RumSessionErasureRequestStatus.InProgress,
+      },
+      props: { isRoot: true },
+    });
+  }
+
+  @CaptureSpan()
+  public async markCompleted(data: {
+    requestId: ObjectID;
+    sessionsDeleted: number;
+    chunksDeleted: number;
+  }): Promise<void> {
+    await this.updateOneById({
+      id: data.requestId,
+      data: {
+        status: RumSessionErasureRequestStatus.Completed,
+        completedAt: OneUptimeDate.getCurrentDate(),
+        sessionsDeleted: data.sessionsDeleted,
+        chunksDeleted: data.chunksDeleted,
+      },
+      props: { isRoot: true },
+    });
+  }
+
+  /*
+   * completedAt is set on failure too. It means "the attempt finished",
+   * not "the data is gone" - status is what says whether it worked, and
+   * leaving completedAt null would make a failed request indistinguishable
+   * from one still running.
+   */
+  @CaptureSpan()
+  public async markFailed(data: {
+    requestId: ObjectID;
+    failureReason: string;
+  }): Promise<void> {
+    await this.updateOneById({
+      id: data.requestId,
+      data: {
+        status: RumSessionErasureRequestStatus.Failed,
+        completedAt: OneUptimeDate.getCurrentDate(),
+        failureReason: data.failureReason,
+      },
+      props: { isRoot: true },
+    });
+  }
+}
+
+export default new Service();

package/Server/Services/RumSessionPinService.ts

@@ -0,0 +1,213 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/RumSessionPin";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import OneUptimeDate from "../../Types/Date";
+import CreateBy from "../Types/Database/CreateBy";
+import { OnCreate } from "../Types/Database/Hooks";
+import QueryHelper from "../Types/Database/QueryHelper";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/* Postgres unique_violation. https://www.postgresql.org/docs/current/errcodes-appendix.html */
+const UNIQUE_VIOLATION: string = "23505";
+
+type IsUniqueViolationFunction = (error: unknown) => boolean;
+
+/*
+ * TypeORM wraps driver failures in QueryFailedError, which hoists the pg
+ * fields onto itself but also keeps the original under `driverError`.
+ * Check both rather than assuming which one carries the code.
+ */
+const isUniqueViolation: IsUniqueViolationFunction = (
+  error: unknown,
+): boolean => {
+  if (!error || typeof error !== "object") {
+    return false;
+  }
+
+  if ((error as { code?: string | undefined }).code === UNIQUE_VIOLATION) {
+    return true;
+  }
+
+  const driverError: unknown = (error as { driverError?: unknown }).driverError;
+
+  return Boolean(
+    driverError &&
+      typeof driverError === "object" &&
+      (driverError as { code?: string | undefined }).code === UNIQUE_VIOLATION,
+  );
+};
+
+/*
+ * Pins that keep a session recording past its retention window.
+ *
+ * The unique index on (projectId, rumApplicationId, sessionId) is the real
+ * guard against duplicate copies; this service turns the resulting
+ * constraint violation into an idempotent "already pinned" so that
+ * clicking Pin twice, or pinning the same recording from two incidents,
+ * is not an error the user has to interpret.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.data.projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    if (!createBy.data.rumApplicationId) {
+      throw new BadDataException("rumApplicationId is required");
+    }
+
+    if (!createBy.data.sessionId) {
+      throw new BadDataException("sessionId is required");
+    }
+
+    /*
+     * materializedAt is never client-supplied: it asserts that the
+     * recording has actually been copied out of the expiring table, and
+     * a client that could set it would make an unprotected recording look
+     * protected.
+     */
+    delete createBy.data.materializedAt;
+
+    /*
+     * Assigned or removed, never left as the client sent it. pinnedByUserId
+     * is declared `computed` on the model, which is what lets this
+     * assignment survive the create-column permission check that runs after
+     * this hook; the delete is what stops an API-key caller (no
+     * props.userId) attributing the pin to a colleague.
+     */
+    if (createBy.props.userId) {
+      createBy.data.pinnedByUserId = createBy.props.userId;
+    } else {
+      delete createBy.data.pinnedByUserId;
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  /*
+   * Pinning is idempotent, which is the whole reason this override exists.
+   * Clicking Pin twice, or pinning the same recording from two incidents,
+   * hits the unique index on (projectId, rumApplicationId, sessionId) and
+   * would otherwise surface as a raw 500 carrying a Postgres constraint
+   * name: checkForUniqueValues only understands single-column `unique`
+   * metadata, not a composite @Index, so nothing else catches it.
+   *
+   * The pre-check handles the common case and the catch closes the race
+   * between two concurrent pins of the same session.
+   */
+  @CaptureSpan()
+  public override async create(createBy: CreateBy<Model>): Promise<Model> {
+    const projectId: ObjectID | undefined = createBy.data.projectId;
+    const rumApplicationId: ObjectID | undefined =
+      createBy.data.rumApplicationId;
+    const sessionId: string | undefined = createBy.data.sessionId;
+
+    if (!projectId || !rumApplicationId || !sessionId) {
+      /* Let onBeforeCreate produce the specific validation message. */
+      return await super.create(createBy);
+    }
+
+    const existingPin: Model | null = await this.getPinForSession({
+      projectId: projectId,
+      rumApplicationId: rumApplicationId,
+      sessionId: sessionId,
+    });
+
+    if (existingPin) {
+      return existingPin;
+    }
+
+    try {
+      return await super.create(createBy);
+    } catch (err) {
+      if (!isUniqueViolation(err)) {
+        throw err;
+      }
+
+      const racedPin: Model | null = await this.getPinForSession({
+        projectId: projectId,
+        rumApplicationId: rumApplicationId,
+        sessionId: sessionId,
+      });
+
+      if (racedPin) {
+        return racedPin;
+      }
+
+      throw err;
+    }
+  }
+
+  /* Null when the recording is not pinned. */
+  @CaptureSpan()
+  public async getPinForSession(data: {
+    projectId: ObjectID;
+    rumApplicationId: ObjectID;
+    sessionId: string;
+  }): Promise<Model | null> {
+    return await this.findOneBy({
+      query: {
+        projectId: data.projectId,
+        rumApplicationId: data.rumApplicationId,
+        sessionId: data.sessionId,
+      },
+      select: {
+        _id: true,
+        reason: true,
+        incidentId: true,
+        alertId: true,
+        expiresAt: true,
+        materializedAt: true,
+        pinnedByUserId: true,
+      },
+      props: { isRoot: true },
+    });
+  }
+
+  /*
+   * Pins whose copy has not happened yet. This is the worker's queue, and
+   * it is also the honest answer to "is this recording safe?" - a pin
+   * without a materializedAt protects nothing.
+   */
+  @CaptureSpan()
+  public async getUnmaterializedPins(data: {
+    limit: number;
+  }): Promise<Array<Model>> {
+    return await this.findBy({
+      query: {
+        materializedAt: QueryHelper.isNull(),
+      },
+      select: {
+        _id: true,
+        projectId: true,
+        rumApplicationId: true,
+        sessionId: true,
+        expiresAt: true,
+      },
+      skip: 0,
+      limit: data.limit,
+      props: { isRoot: true },
+    });
+  }
+
+  @CaptureSpan()
+  public async markMaterialized(data: { pinId: ObjectID }): Promise<void> {
+    await this.updateOneById({
+      id: data.pinId,
+      data: {
+        materializedAt: OneUptimeDate.getCurrentDate(),
+      },
+      props: { isRoot: true },
+    });
+  }
+}
+
+export default new Service();

package/Server/Services/RumSessionReplayViewService.ts

@@ -0,0 +1,201 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/RumSessionReplayView";
+import ColumnLength from "../../Types/Database/ColumnLength";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import ObjectID from "../../Types/ObjectID";
+import OneUptimeDate from "../../Types/Date";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * Session replay read audit.
+ *
+ * Every write here happens as root from the playback API, not from a
+ * client, because the audit row has to be written whether or not the
+ * caller would have had permission to create it - and because the caller
+ * must not be able to choose what it says.
+ *
+ * No hardDeleteItemsOlderThanInDays: unlike the SCIM logs this table is
+ * modelled on, the whole point of the audit is that it outlives the
+ * recording it describes.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * Record that somebody opened a recording for playback. Called from the
+   * manifest endpoint BEFORE any payload byte is served, so a read that
+   * fails halfway through is still audited.
+   */
+  @CaptureSpan()
+  public async recordView(data: {
+    projectId: ObjectID;
+    rumApplicationId: ObjectID;
+    sessionId: string;
+    viewedByUserId?: ObjectID | undefined;
+    viewedByApiKeyId?: ObjectID | undefined;
+    ipAddress?: string | undefined;
+    userAgent?: string | undefined;
+    accessReason?: string | undefined;
+    linkedIncidentId?: ObjectID | undefined;
+    linkedExceptionFingerprint?: string | undefined;
+  }): Promise<Model> {
+    const item: Model = new Model();
+
+    item.projectId = data.projectId;
+    item.rumApplicationId = data.rumApplicationId;
+    item.sessionId = data.sessionId;
+    item.viewedAt = OneUptimeDate.getCurrentDate();
+    item.secondsWatched = 0;
+
+    if (data.viewedByUserId) {
+      item.viewedByUserId = data.viewedByUserId;
+      /*
+       * The row is created as root, so createdByUserId would otherwise be
+       * null and the audit would not name the human behind the read.
+       */
+      item.createdByUserId = data.viewedByUserId;
+    }
+
+    if (data.viewedByApiKeyId) {
+      item.viewedByApiKeyId = data.viewedByApiKeyId;
+    }
+
+    /*
+     * All three come straight off an untrusted request: a header, or a
+     * free-text field in the body. Truncated rather than validated because
+     * failing the audit write would fail the playback it is auditing, and
+     * DatabaseService.checkMaxLengthOfFields throws on anything longer
+     * than the column. An oversized user agent must not be able to stop a
+     * read from being recorded.
+     */
+    if (data.ipAddress) {
+      item.ipAddress = data.ipAddress.substring(0, ColumnLength.ShortText);
+    }
+
+    if (data.userAgent) {
+      item.userAgent = data.userAgent.substring(0, ColumnLength.LongText);
+    }
+
+    if (data.accessReason) {
+      item.accessReason = data.accessReason.substring(0, ColumnLength.LongText);
+    }
+
+    if (data.linkedIncidentId) {
+      item.linkedIncidentId = data.linkedIncidentId;
+    }
+
+    if (data.linkedExceptionFingerprint) {
+      item.linkedExceptionFingerprint = data.linkedExceptionFingerprint;
+    }
+
+    return await this.create({
+      data: item,
+      props: { isRoot: true },
+    });
+  }
+
+  /*
+   * Advance how much of the recording was actually watched, from the
+   * player's throttled heartbeat.
+   *
+   * Monotonic on purpose: the heartbeat carries a cumulative total, and a
+   * player that seeks backwards or reloads would otherwise walk the
+   * recorded figure back down and make a full viewing look like a glance.
+   */
+  @CaptureSpan()
+  public async recordSecondsWatched(data: {
+    viewId: ObjectID;
+    projectId: ObjectID;
+    secondsWatched: number;
+  }): Promise<void> {
+    if (!Number.isFinite(data.secondsWatched) || data.secondsWatched <= 0) {
+      return;
+    }
+
+    const existing: Model | null = await this.findOneBy({
+      query: {
+        _id: data.viewId.toString(),
+        projectId: data.projectId,
+      },
+      select: {
+        _id: true,
+        secondsWatched: true,
+      },
+      props: { isRoot: true },
+    });
+
+    if (!existing) {
+      return;
+    }
+
+    const seconds: number = Math.floor(data.secondsWatched);
+
+    if ((existing.secondsWatched || 0) >= seconds) {
+      return;
+    }
+
+    await this.updateOneById({
+      id: data.viewId,
+      data: {
+        secondsWatched: seconds,
+      },
+      props: { isRoot: true },
+    });
+  }
+
+  /*
+   * Who has watched this recording. Shown on the player itself, not only
+   * in a log - inward visibility changes behaviour more than an audit
+   * trail nobody reads.
+   */
+  @CaptureSpan()
+  public async getViewsForSession(data: {
+    projectId: ObjectID;
+    /*
+     * Required, not optional. A sessionId is only unique within an
+     * application, and the caller has been authorised against one
+     * application - listing every project-wide view of a colliding id
+     * would leak audit rows from an application they cannot see.
+     */
+    rumApplicationId: ObjectID;
+    sessionId: string;
+    limit: number;
+  }): Promise<Array<Model>> {
+    return await this.findBy({
+      query: {
+        projectId: data.projectId,
+        rumApplicationId: data.rumApplicationId,
+        sessionId: data.sessionId,
+      },
+      select: {
+        _id: true,
+        viewedAt: true,
+        secondsWatched: true,
+        accessReason: true,
+        viewedByUserId: true,
+        viewedByUser: {
+          _id: true,
+          name: true,
+          email: true,
+          profilePictureId: true,
+        },
+      },
+      sort: {
+        viewedAt: SortOrder.Descending,
+      },
+      skip: 0,
+      /*
+       * Clamped rather than passed through: findBy rejects anything above
+       * LIMIT_PER_PROJECT with an exception, and a too-large page is not
+       * worth failing an audit listing over.
+       */
+      limit: Math.min(Math.max(data.limit, 1), LIMIT_PER_PROJECT),
+      props: { isRoot: true },
+    });
+  }
+}
+
+export default new Service();