@oneuptime/common 12.0.1 → 12.0.3

package/Server/Infrastructure/Postgres/SchemaMigrations/1785930000000-WidenInventoryResourceNameColumns.ts

@@ -0,0 +1,131 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class WidenInventoryResourceNameColumns1785930000000
+  implements MigrationInterface
+{
+  public name = "WidenInventoryResourceNameColumns1785930000000";
+
+  /*
+   * Same overflow class as WidenDockerResourceImageColumns1782800000000,
+   * on the Podman and Kubernetes inventory tables. These services build
+   * `INSERT ... ON CONFLICT` strings by hand and flush them in chunks of
+   * 500 rows, so ONE value over varchar(100) raises "value too long for
+   * type character varying(100)" (22001) and aborts the ENTIRE multi-row
+   * INSERT — up to 500 inventory rows silently dropped per flush.
+   *
+   * The offenders, all previously varchar(100):
+   *   - PodmanResource."name" / "imageName": full image references
+   *     (registry host + org + repo + tag) routinely exceed 100 chars.
+   *   - KubernetesResource."name" and KubernetesContainer."podName":
+   *     Kubernetes DNS-subdomain names go up to 253 characters, and
+   *     generated pod names (deployment + replicaset hash + pod hash)
+   *     commonly clear 100.
+   *   - KubernetesResource."controllerDeploymentName": written from the
+   *     `k8s.deployment.name` resource attribute, same bound.
+   *
+   * 500 (ColumnLength.LongText) clears the 253-char Kubernetes ceiling
+   * with room to spare and matches what DockerResource already uses.
+   *
+   * COST: raising a varchar length cap is binary-coercible, so Postgres
+   * skips the table rewrite — but ALTER COLUMN TYPE still rebuilds every
+   * index on the altered column ("any indexes on the affected columns
+   * must still be rebuilt"). Three of these five columns are members of
+   * composite UNIQUE indexes:
+   *   - PodmanResource."name"        -> IDX_772c02b6419beb57fa47ccae1b
+   *   - KubernetesResource."name"    -> IDX_3ae20a0d4346958dff73ba7fda
+   *   - KubernetesContainer."podName" -> IDX_1dcb8fed322a9bddfabb60cbc7
+   * Those three rebuild under ACCESS EXCLUSIVE, so on a large inventory
+   * table this is not free: ingest for the affected tables blocks for
+   * the duration, and TypeORM runs all pending migrations in one
+   * transaction, so the locks are held until the whole batch commits.
+   * "imageName" and "controllerDeploymentName" are in no index and are
+   * genuinely metadata-only.
+   */
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "PodmanResource" ALTER COLUMN "name" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanResource" ALTER COLUMN "imageName" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesResource" ALTER COLUMN "name" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesResource" ALTER COLUMN "controllerDeploymentName" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesContainer" ALTER COLUMN "podName" TYPE character varying(500)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Narrowing back to varchar(100) fails outright if any row written
+     * since up() exceeds 100 chars, so clip first. "name" / "podName"
+     * are part of UNIQUE indexes: clipping two rows onto the same
+     * truncated key would violate them, so the revert deletes rows
+     * whose identity would collide after clipping instead of letting
+     * the ALTER blow up. Inventory rows are a projection of what the
+     * agent is reporting — the next snapshot re-creates them.
+     */
+    await queryRunner.query(
+      `DELETE FROM "PodmanResource" a USING "PodmanResource" b
+       WHERE a."projectId" = b."projectId"
+         AND a."podmanHostId" = b."podmanHostId"
+         AND a."kind" = b."kind"
+         AND LEFT(a."name", 100) = LEFT(b."name", 100)
+         AND a."_id" > b."_id"`,
+    );
+    await queryRunner.query(
+      `DELETE FROM "KubernetesResource" a USING "KubernetesResource" b
+       WHERE a."projectId" = b."projectId"
+         AND a."kubernetesClusterId" = b."kubernetesClusterId"
+         AND a."kind" = b."kind"
+         AND a."namespaceKey" = b."namespaceKey"
+         AND LEFT(a."name", 100) = LEFT(b."name", 100)
+         AND a."_id" > b."_id"`,
+    );
+    await queryRunner.query(
+      `DELETE FROM "KubernetesContainer" a USING "KubernetesContainer" b
+       WHERE a."projectId" = b."projectId"
+         AND a."kubernetesClusterId" = b."kubernetesClusterId"
+         AND a."podNamespaceKey" = b."podNamespaceKey"
+         AND LEFT(a."podName", 100) = LEFT(b."podName", 100)
+         AND a."name" = b."name"
+         AND a."_id" > b."_id"`,
+    );
+
+    await queryRunner.query(
+      `UPDATE "PodmanResource" SET "name" = LEFT("name", 100) WHERE LENGTH("name") > 100`,
+    );
+    await queryRunner.query(
+      `UPDATE "PodmanResource" SET "imageName" = LEFT("imageName", 100) WHERE "imageName" IS NOT NULL AND LENGTH("imageName") > 100`,
+    );
+    await queryRunner.query(
+      `UPDATE "KubernetesResource" SET "name" = LEFT("name", 100) WHERE LENGTH("name") > 100`,
+    );
+    await queryRunner.query(
+      `UPDATE "KubernetesResource" SET "controllerDeploymentName" = LEFT("controllerDeploymentName", 100) WHERE "controllerDeploymentName" IS NOT NULL AND LENGTH("controllerDeploymentName") > 100`,
+    );
+    await queryRunner.query(
+      `UPDATE "KubernetesContainer" SET "podName" = LEFT("podName", 100) WHERE LENGTH("podName") > 100`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "PodmanResource" ALTER COLUMN "name" TYPE character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "PodmanResource" ALTER COLUMN "imageName" TYPE character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesResource" ALTER COLUMN "name" TYPE character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesResource" ALTER COLUMN "controllerDeploymentName" TYPE character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesContainer" ALTER COLUMN "podName" TYPE character varying(100)`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1785930709405-AddStatusPageReportPeriod.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddStatusPageReportPeriod1785930709405
+  implements MigrationInterface
+{
+  public name = "AddStatusPageReportPeriod1785930709405";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "reportPeriodType" character varying DEFAULT 'Rolling'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "reportTimezone" character varying DEFAULT 'UTC'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "reportTimezone"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "reportPeriodType"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786005052769-AddStatusPageMonitorRule.ts

@@ -0,0 +1,123 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddStatusPageMonitorRule1786005052769
+  implements MigrationInterface
+{
+  public name = "AddStatusPageMonitorRule1786005052769";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "StatusPageMonitorRule" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "statusPageId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "isEnabled" boolean NOT NULL DEFAULT true, "monitorNamePattern" character varying(500), "monitorDescriptionPattern" character varying(500), "statusPageGroupId" uuid, "showCurrentStatus" boolean NOT NULL DEFAULT true, "showUptimePercent" boolean NOT NULL DEFAULT true, "uptimePercentPrecision" character varying, "showStatusHistoryChart" boolean NOT NULL DEFAULT true, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_f8d44792805d19b9a80921b6aa6" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_1dfd95ad32f7b687ef4d7ba591" ON "StatusPageMonitorRule" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_473317deaa55a8305a047e4098" ON "StatusPageMonitorRule" ("statusPageId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_61196848685b7e7f5a6a54278b" ON "StatusPageMonitorRule" ("name") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_71d1869039530178fd5f7e6faa" ON "StatusPageMonitorRule" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_3e6d0bc4d444371aaa13a1c14c" ON "StatusPageMonitorRule" ("statusPageGroupId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "StatusPageMonitorRuleMonitorLabel" ("statusPageMonitorRuleId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_59234d33b435d8e771cd3728ea4" PRIMARY KEY ("statusPageMonitorRuleId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_0eb2b2a3601ea9813b8e162bd3" ON "StatusPageMonitorRuleMonitorLabel" ("statusPageMonitorRuleId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_bc08b888a870ecc9167516230a" ON "StatusPageMonitorRuleMonitorLabel" ("labelId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageResource" ADD "statusPageMonitorRuleId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_4e1ed45d9506da817dc7811601" ON "StatusPageResource" ("statusPageMonitorRuleId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_1dfd95ad32f7b687ef4d7ba5910" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_473317deaa55a8305a047e4098b" FOREIGN KEY ("statusPageId") REFERENCES "StatusPage"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_3e6d0bc4d444371aaa13a1c14cc" FOREIGN KEY ("statusPageGroupId") REFERENCES "StatusPageGroup"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_60d22031be1695cbd1405376cbf" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_3416ec12899c9dde670d8dea290" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageResource" ADD CONSTRAINT "FK_4e1ed45d9506da817dc78116010" FOREIGN KEY ("statusPageMonitorRuleId") REFERENCES "StatusPageMonitorRule"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRuleMonitorLabel" ADD CONSTRAINT "FK_0eb2b2a3601ea9813b8e162bd3b" FOREIGN KEY ("statusPageMonitorRuleId") REFERENCES "StatusPageMonitorRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRuleMonitorLabel" ADD CONSTRAINT "FK_bc08b888a870ecc9167516230ad" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRuleMonitorLabel" DROP CONSTRAINT "FK_bc08b888a870ecc9167516230ad"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRuleMonitorLabel" DROP CONSTRAINT "FK_0eb2b2a3601ea9813b8e162bd3b"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageResource" DROP CONSTRAINT "FK_4e1ed45d9506da817dc78116010"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_3416ec12899c9dde670d8dea290"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_60d22031be1695cbd1405376cbf"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_3e6d0bc4d444371aaa13a1c14cc"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_473317deaa55a8305a047e4098b"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_1dfd95ad32f7b687ef4d7ba5910"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_4e1ed45d9506da817dc7811601"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageResource" DROP COLUMN "statusPageMonitorRuleId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_bc08b888a870ecc9167516230a"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0eb2b2a3601ea9813b8e162bd3"`,
+    );
+    await queryRunner.query(`DROP TABLE "StatusPageMonitorRuleMonitorLabel"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_3e6d0bc4d444371aaa13a1c14c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_71d1869039530178fd5f7e6faa"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_61196848685b7e7f5a6a54278b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_473317deaa55a8305a047e4098"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_1dfd95ad32f7b687ef4d7ba591"`,
+    );
+    await queryRunner.query(`DROP TABLE "StatusPageMonitorRule"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -492,8 +492,13 @@ import { SessionReplayDefaultToSensitiveInputMasking1785860000000 } from "./1785
 import { AddAiCommandRemediation1785870000000 } from "./1785870000000-AddAiCommandRemediation";
 import { AlignRunnerSchemaWithEntities1785880000000 } from "./1785880000000-AlignRunnerSchemaWithEntities";
 import { AddFixVerificationAndAutomaticCodeFixes1785890000000 } from "./1785890000000-AddFixVerificationAndAutomaticCodeFixes";
+import { AddSloMonitorLabelRule1785900000000 } from "./1785900000000-AddSloMonitorLabelRule";
+import { IncreaseHostIpAddressesLength1785915638551 } from "./1785915638551-IncreaseHostIpAddressesLength";
+import { WidenInventoryResourceNameColumns1785930000000 } from "./1785930000000-WidenInventoryResourceNameColumns";
+import { AddStatusPageReportPeriod1785930709405 } from "./1785930709405-AddStatusPageReportPeriod";
 import { AddIncidentInvestigationGating1785790000000 } from "./1785790000000-AddIncidentInvestigationGating";
 import { AddRemediationVerification1785768089408 } from "./1785768089408-AddRemediationVerification";
+import { AddStatusPageMonitorRule1786005052769 } from "./1786005052769-AddStatusPageMonitorRule";
 
 export default [
   InitialMigration,
@@ -992,4 +997,9 @@ export default [
   AddAiCommandRemediation1785870000000,
   AlignRunnerSchemaWithEntities1785880000000,
   AddFixVerificationAndAutomaticCodeFixes1785890000000,
+  AddSloMonitorLabelRule1785900000000,
+  IncreaseHostIpAddressesLength1785915638551,
+  WidenInventoryResourceNameColumns1785930000000,
+  AddStatusPageReportPeriod1785930709405,
+  AddStatusPageMonitorRule1786005052769,
 ];

package/Server/Middleware/ProjectAuthorization.ts

@@ -41,18 +41,69 @@ export default class ProjectMiddleware {
     return projectId;
   }
 
+  /*
+   * The `apikey` header exactly as it arrived, or null when it was never
+   * sent at all. Node lower-cases header names, and a caller that sends the
+   * header twice arrives here as one comma-joined string — never a usable
+   * key, but unmistakably a caller who meant to authenticate by key.
+   *
+   * An empty or whitespace-only value is a header that WAS sent. Keeping that
+   * distinct from "absent" is the whole point of this helper; see hasApiKey.
+   */
+  private static getRawApiKeyHeader(req: ExpressRequest): string | null {
+    const rawHeader: string | Array<string> | undefined =
+      req.headers?.["apikey"];
+
+    if (rawHeader === undefined) {
+      return null;
+    }
+
+    return Array.isArray(rawHeader) ? rawHeader.join(",") : rawHeader;
+  }
+
   @CaptureSpan()
   public static getApiKey(req: ExpressRequest): ObjectID | null {
-    if (req.headers && req.headers["apikey"]) {
-      return new ObjectID(req.headers["apikey"] as string);
+    const rawHeader: string | null = ProjectMiddleware.getRawApiKeyHeader(req);
+
+    if (rawHeader === null) {
+      return null;
     }
 
-    return null;
+    const apiKey: string = rawHeader.trim();
+
+    /*
+     * `ApiKey.apiKey` is a Postgres `uuid` column, so a non-UUID value makes
+     * the lookup raise "invalid input syntax for type uuid" down in the query
+     * layer. A raw QueryFailedError is not a OneUptime Exception, so it slips
+     * past the error translator and answers 500 to what is really a malformed
+     * request. Reject the shape here and let the caller get `Invalid API Key`.
+     */
+    if (!ObjectID.isValidUUID(apiKey)) {
+      return null;
+    }
+
+    return new ObjectID(apiKey);
   }
 
+  /*
+   * Presence, not usability — deliberately NOT `Boolean(this.getApiKey(req))`.
+   *
+   * A request carrying an empty or malformed `ApiKey` header is a caller
+   * trying to authenticate by key and getting it wrong. Answering false here
+   * routed it down the anonymous path, where it failed much later with
+   * "A user should be logged in to <op> record of <Model>." — an error about
+   * session auth, raised against a caller who never attempted session auth,
+   * naming a model as though the model were what went wrong. It reads as an
+   * RBAC bug in whichever resource happened to be asked for, and has been
+   * reported as one more than once (issues #1754, #3004). An unset shell
+   * variable, a client that sends the header blank, and our own CLI's
+   * partial-credential path all land here.
+   *
+   * Claim the request instead, so it fails as `Invalid API Key`.
+   */
   @CaptureSpan()
   public static hasApiKey(req: ExpressRequest): boolean {
-    return Boolean(this.getApiKey(req));
+    return ProjectMiddleware.getRawApiKeyHeader(req) !== null;
   }
 
   @CaptureSpan()
@@ -118,6 +169,17 @@ export default class ProjectMiddleware {
       }
 
       if (!apiKey) {
+        /*
+         * Separate "no header at all" from "header sent, but unusable".
+         * getUserMiddleware only routes here once the header is present, so
+         * in practice it is always the second: an empty value from an unset
+         * variable, a non-UUID string, or duplicate headers that Node joined
+         * into a comma-separated list.
+         */
+        if (ProjectMiddleware.hasApiKey(req)) {
+          throw new BadDataException("Invalid API Key");
+        }
+
         throw new BadDataException(
           "API Key not found in the request header. Please provide a valid API Key in the request header.",
         );

package/Server/Services/AlertStateTimelineService.ts

@@ -19,6 +19,7 @@ import { JSONObject } from "../../Types/JSON";
 import AlertInternalNote from "../../Models/DatabaseModels/AlertInternalNote";
 import AlertInternalNoteService from "./AlertInternalNoteService";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ProjectScopedReferenceValidator from "../Utils/Database/ProjectScopedReferenceValidator";
 import logger, { LogAttributes } from "../Utils/Logger";
 import AlertFeedService from "./AlertFeedService";
 import { AlertFeedEventType } from "../../Models/DatabaseModels/AlertFeed";
@@ -118,6 +119,25 @@ export class Service extends DatabaseService<AlertStateTimeline> {
         throw new BadDataException("alertStateId is null");
       }
 
+      /*
+       * Same guard, same reason, as MonitorStatusTimelineService: an id that
+       * exists nowhere (or belongs to another project) used to reach Postgres
+       * and come back as a raw foreign key violation. The ordering check below
+       * does look the state up, but only when there IS a preceding row with an
+       * order, so the first timeline row for an alert went through unchecked.
+       */
+      await ProjectScopedReferenceValidator.validateReferencesBelongToProject({
+        projectId: createBy.props.tenantId || createBy.data.projectId,
+        subject: "alert state timeline",
+        references: [
+          {
+            modelName: "Alert State",
+            id: alertStateId,
+            service: AlertStateService,
+          },
+        ],
+      });
+
       const stateBeforeThis: AlertStateTimeline | null = await this.findOneBy({
         query: {
           alertId: createBy.data.alertId,