@oneuptime/common 12.0.12 → 12.0.14

package/Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel.ts

@@ -58,6 +58,32 @@ export type DbTypes =
   | JSONArray
   | Buffer;
 
+/*
+ * Metadata-only vanilla instances used by toJSONObject to read table-column
+ * metadata. Frozen and never exported, so they can never be mutated or escape
+ * this file. _fromJSON must never use this cache — it mutates and returns the
+ * instance it constructs.
+ */
+const vanillaModelCache: WeakMap<
+  { new (): DatabaseBaseModel },
+  DatabaseBaseModel
+> = new WeakMap();
+
+function getVanillaModel(modelType: {
+  new (): DatabaseBaseModel;
+}): DatabaseBaseModel {
+  let vanillaModel: DatabaseBaseModel | undefined =
+    vanillaModelCache.get(modelType);
+
+  if (!vanillaModel) {
+    vanillaModel = new modelType();
+    Object.freeze(vanillaModel);
+    vanillaModelCache.set(modelType, vanillaModel);
+  }
+
+  return vanillaModel;
+}
+
 export default class DatabaseBaseModel extends BaseEntity {
   @TableColumn({
     title: "ID",
@@ -252,8 +278,7 @@ export default class DatabaseBaseModel extends BaseEntity {
   }
 
   public getTableColumnMetadata(columnName: string): TableColumnMetadata {
-    const dictionary: Dictionary<TableColumnMetadata> = getTableColumns(this);
-    return dictionary[columnName] as TableColumnMetadata;
+    return getTableColumn(this, columnName);
   }
 
   public hasColumn(columnName: string): boolean {
@@ -275,8 +300,10 @@ export default class DatabaseBaseModel extends BaseEntity {
   }
 
   public getColumnAccessControlForAllColumns(): Dictionary<ColumnAccessControl> {
-    const dictionary: Dictionary<ColumnAccessControl> =
-      getColumnAccessControlForAllColumns(this);
+    // Copy: the helper's dictionary is cached per class and must stay pristine.
+    const dictionary: Dictionary<ColumnAccessControl> = {
+      ...getColumnAccessControlForAllColumns(this),
+    };
 
     const defaultColumns: Array<string> = [
       "_id",
@@ -613,7 +640,7 @@ export default class DatabaseBaseModel extends BaseEntity {
   ): JSONObject {
     const json: JSONObject = {};
 
-    const vanillaModel: DatabaseBaseModel = new modelType();
+    const vanillaModel: DatabaseBaseModel = getVanillaModel(modelType);
 
     for (const key of vanillaModel.getTableColumns().columns) {
       if ((model as any)[key] === undefined) {

package/Models/DatabaseModels/NetworkDevice.ts

@@ -1942,6 +1942,70 @@ export default class NetworkDevice extends BaseModel {
   })
   public lastSeenAt?: Date = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    canReadOnRelationQuery: true,
+    title: "Last Polled At",
+    description:
+      'When the assigned probe last ATTEMPTED an SNMP walk of this device, whether or not the device answered. Paired with lastSeenAt (which only moves on a successful walk) this is what separates "the device did not answer" from "we have not asked recently". Managed by the probe.',
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Date,
+  })
+  public lastPolledAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadNetworkDevice,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditNetworkDevice,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Boolean,
+    canReadOnRelationQuery: true,
+    title: "Is Reachable",
+    description:
+      "Whether the most recent SNMP walk reached this device. NULL means it has never been polled. This — not the age of lastSeenAt — is what the device list, the topology graph and the site rollup read, so a device whose last poll succeeded is never shown as down just because the probe is behind schedule. Managed by the probe.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Boolean,
+  })
+  public isReachable?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [

package/Models/DatabaseModels/OnCallDutyPolicySchedule.ts

@@ -588,6 +588,20 @@ export default class OnCallDutyPolicySchedule extends BaseModel {
   })
   @TableColumn({
     type: TableColumnType.ObjectID,
+    /*
+     * Read through a relation, alongside `name`, so a joined schedule row can
+     * say whether it would page anybody right now. An escalation rule lists
+     * schedules by name and has to mark the ones that are currently uncovered;
+     * that is one join away from the rule, and without this flag
+     * QueryPermission rejects the whole select rather than dropping the column
+     * - the escalation rule page fails to load at all.
+     *
+     * The disclosure is a user id belonging to the same project as the
+     * schedule, to a caller who is already reading the schedule's name off the
+     * same joined row. It is not an @OwnerOnlyColumn: who is on call is
+     * operational state the team is meant to see, not a personal credential.
+     */
+    canReadOnRelationQuery: true,
     title: "Current User ID On Roster",
     description: "User ID who is currently on roster",
     example: "c3d4e5f6-a7b8-9012-cdef-123456789012",

package/Models/DatabaseModels/StatusPage.ts

@@ -317,6 +317,65 @@ export default class StatusPage extends BaseModel {
   })
   public pageDescription?: string = undefined;
 
+  /*
+   * Search engine indexing opt-out. Indexing stays on unless the owner turns
+   * it off, so this defaults to true and every pre-existing status page keeps
+   * being indexed exactly as it is today.
+   *
+   * Turning it off is served two ways, both of which a crawler honours before
+   * it decides to index: a <meta name="robots" content="noindex, nofollow">
+   * in the server-rendered index.ejs (so it is there before the JS bundle
+   * loads) and an X-Robots-Tag response header (so it also covers the RSS
+   * feed and llms.txt, which are not HTML).
+   *
+   * Deliberately NOT wired into robots.txt: Disallow blocks the crawl, and a
+   * crawler that never fetches the page never sees the noindex, so the URL can
+   * still surface in results. Letting crawlers in and telling them not to
+   * index is what actually removes the page.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.CreateProjectStatusPage,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.StatusPageViewer,
+      Permission.ReadProjectStatusPage,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.EditProjectStatusPage,
+    ],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Enable Search Engine Indexing",
+    description:
+      "Should search engines like Google and Bing be allowed to index this status page? Turn this off to keep the page reachable by link but out of search results.",
+    defaultValue: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: true,
+    nullable: false,
+  })
+  public enableSearchEngineIndexing?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/StatusPageOidc.ts

@@ -14,6 +14,7 @@ import CanAccessIfCanReadOn from "../../Types/Database/CanAccessIfCanReadOn";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
+import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import TableColumn from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
 import TableMetadata from "../../Types/Database/TableMetadata";
@@ -24,6 +25,7 @@ import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+@EnableDocumentation()
 @CanAccessIfCanReadOn("statusPage")
 @TableEditionAccessControl({
   requiresEnterprise: true,

package/Models/DatabaseModels/UserCall.ts

@@ -315,15 +315,27 @@ class UserCall extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -331,6 +343,85 @@ class UserCall extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserCall;

package/Models/DatabaseModels/UserEmail.ts

@@ -318,15 +318,27 @@ class UserEmail extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -334,6 +346,85 @@ class UserEmail extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserEmail;

package/Models/DatabaseModels/UserIncomingCallNumber.ts

@@ -275,15 +275,27 @@ class UserIncomingCallNumber extends BaseModel {
   })
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -291,6 +303,85 @@ class UserIncomingCallNumber extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserIncomingCallNumber;

package/Models/DatabaseModels/UserPush.ts

@@ -346,6 +346,43 @@ class UserPush extends BaseModel {
     default: false,
   })
   public isVerified?: boolean = undefined;
+
+  /*
+   * Whether this handset should be paged through silent mode and Do Not
+   * Disturb when it is on call. Per DEVICE and not per user on purpose: the
+   * responder's work phone on the nightstand and their tablet on the sofa are
+   * the same person making two different decisions, and only the phone should
+   * be allowed to wake the house.
+   *
+   * Off unless the responder turns it on from that device. It is the one
+   * setting in this product that deliberately defeats the switch a person
+   * flicked to be left alone, so it is opted into rather than out of, and the
+   * app only offers it once the OS has actually granted the capability
+   * (the iOS critical-alert entitlement, or Do Not Disturb access on Android).
+   *
+   * `update` is empty like every other column here: the value is written by
+   * UserPushAPI's critical-alerts route, which checks the row belongs to the
+   * caller and then writes as root. That keeps "who may change this" in one
+   * readable place rather than spread across the generic CRUD surface.
+   */
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    title: "Critical Alerts Enabled",
+    description:
+      "Should on-call notifications to this device override silent mode and Do Not Disturb?",
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    defaultValue: false,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public isCriticalAlertEnabled?: boolean = undefined;
 }
 
 export default UserPush;