@oneuptime/common 12.0.12 → 12.0.14

package/Server/Services/PushNotificationService.ts

@@ -26,6 +26,7 @@ import UserPush from "../../Models/DatabaseModels/UserPush";
 import PushNotificationLog from "../../Models/DatabaseModels/PushNotificationLog";
 import PushNotificationLogService from "./PushNotificationLogService";
 import PushStatus from "../../Types/PushNotification/PushStatus";
+import AndroidNotificationChannel from "../../Types/PushNotification/AndroidNotificationChannel";
 
 /*
  * The push services the browsers actually use. A Web Push subscription is a
@@ -67,6 +68,43 @@ export interface PushNotificationOptions {
   teamId?: ObjectID | undefined;
 }
 
+/*
+ * What Expo needs to be told for a notification to ring through a silenced
+ * handset. The two platforms disagree about where the answer lives, so this is
+ * computed once and reused by both the direct-SDK and relay send paths.
+ *
+ * iOS reads the payload: a `sound` object with `critical: true` plus
+ * `interruptionLevel: "critical"` is what makes APNs ignore the ringer switch
+ * and Focus, and it is refused unless the app carries Apple's critical-alert
+ * entitlement.
+ *
+ * Android ignores all of that and reads the CHANNEL. Sound, importance and Do
+ * Not Disturb bypass are baked into the channel when the app creates it and
+ * cannot be raised by a payload, so the only lever the server has is which
+ * channel id it names.
+ */
+export type ExpoPushSound =
+  | string
+  | null
+  | {
+      critical?: boolean;
+      name?: string | null;
+      volume?: number;
+    };
+
+export type ExpoInterruptionLevel =
+  | "active"
+  | "critical"
+  | "passive"
+  | "time-sensitive";
+
+export interface ExpoDeliveryOptions {
+  channelId: string;
+  sound: ExpoPushSound;
+  priority: "high";
+  interruptionLevel?: ExpoInterruptionLevel;
+}
+
 export default class PushNotificationService {
   public static isWebPushInitialized = false;
   private static expoClient: Expo = new Expo(
@@ -408,6 +446,57 @@ export default class PushNotificationService {
     }
   }
 
+  /*
+   * Volume is pinned rather than exposed as a setting. A critical alert exists
+   * to wake somebody, and a responder who has already opted this device in and
+   * granted the OS permission has not asked to be woken quietly.
+   */
+  public static readonly CRITICAL_ALERT_VOLUME: number = 1;
+
+  public static getExpoDeliveryOptions(
+    message: PushNotificationMessage,
+    deviceType: PushDeviceType,
+  ): ExpoDeliveryOptions {
+    const isAndroid: boolean = deviceType === PushDeviceType.Android;
+    const isCritical: boolean = Boolean(message.isCriticalAlert);
+
+    /*
+     * iOS has no channels, so "default" here is the payload's own sound rather
+     * than a channel id. Android without the critical flag stays on
+     * oncall_high, which is what every push has used until now.
+     */
+    const channelId: string = isAndroid
+      ? isCritical
+        ? AndroidNotificationChannel.Critical
+        : AndroidNotificationChannel.High
+      : "default";
+
+    if (!isCritical) {
+      return {
+        channelId: channelId,
+        sound: "default",
+        priority: "high",
+      };
+    }
+
+    return {
+      channelId: channelId,
+      /*
+       * Sent to Android too, and harmlessly ignored there. Expo forwards it to
+       * APNs where it is the whole mechanism, and to FCM where the channel has
+       * already decided the sound; keeping one shape avoids a per-platform
+       * branch that could silently drop the iOS half.
+       */
+      sound: {
+        critical: true,
+        name: "default",
+        volume: PushNotificationService.CRITICAL_ALERT_VOLUME,
+      },
+      priority: "high",
+      interruptionLevel: "critical",
+    };
+  }
+
   private static async sendExpoPushNotification(
     expoPushToken: string,
     message: PushNotificationMessage,
@@ -430,8 +519,10 @@ export default class PushNotificationService {
       dataPayload["url"] = message.url || message.clickAction || "";
     }
 
-    const channelId: string =
-      deviceType === PushDeviceType.Android ? "oncall_high" : "default";
+    const delivery: ExpoDeliveryOptions = this.getExpoDeliveryOptions(
+      message,
+      deviceType,
+    );
 
     // If EXPO_ACCESS_TOKEN is not set, relay through the push notification gateway
     if (!ExpoAccessToken) {
@@ -439,7 +530,7 @@ export default class PushNotificationService {
         expoPushToken,
         message,
         dataPayload,
-        channelId,
+        delivery,
         deviceType,
       );
       return;
@@ -452,9 +543,12 @@ export default class PushNotificationService {
         title: message.title,
         body: message.body,
         data: dataPayload,
-        sound: "default",
-        priority: "high",
-        channelId: channelId,
+        sound: delivery.sound,
+        priority: delivery.priority,
+        channelId: delivery.channelId,
+        ...(delivery.interruptionLevel
+          ? { interruptionLevel: delivery.interruptionLevel }
+          : {}),
       };
 
       const tickets: ExpoPushTicket[] =
@@ -500,7 +594,7 @@ export default class PushNotificationService {
     expoPushToken: string,
     message: PushNotificationMessage,
     dataPayload: { [key: string]: string },
-    channelId: string,
+    delivery: ExpoDeliveryOptions,
     deviceType: PushDeviceType,
   ): Promise<void> {
     logger.info(
@@ -516,9 +610,19 @@ export default class PushNotificationService {
             title: message.title || "",
             body: message.body || "",
             data: dataPayload,
-            sound: "default",
-            priority: "high",
-            channelId: channelId,
+            /*
+             * The relay re-sends exactly what it is given, so a critical page
+             * that loses its sound object here arrives on the responder's
+             * phone as an ordinary silent notification. That is the failure
+             * this feature exists to prevent, so the whole delivery shape
+             * crosses the wire rather than the channel id alone.
+             */
+            sound: delivery.sound,
+            priority: delivery.priority,
+            channelId: delivery.channelId,
+            ...(delivery.interruptionLevel
+              ? { interruptionLevel: delivery.interruptionLevel }
+              : {}),
           },
         });
 
@@ -552,9 +656,10 @@ export default class PushNotificationService {
     title?: string;
     body?: string;
     data?: { [key: string]: string };
-    sound?: string;
+    sound?: ExpoPushSound;
     priority?: string;
     channelId?: string;
+    interruptionLevel?: ExpoInterruptionLevel;
   }): Promise<void> {
     if (!ExpoAccessToken) {
       throw new Error(
@@ -562,14 +667,24 @@ export default class PushNotificationService {
       );
     }
 
+    /*
+     * `sound: null` is a caller asking for a silent notification and has to
+     * survive, so the fallback tests for undefined rather than falsiness.
+     */
+    const sound: ExpoPushSound =
+      data.sound === undefined ? "default" : data.sound;
+
     const expoPushMessage: ExpoPushMessage = {
       to: data.to,
       title: data.title || "",
       body: data.body || "",
       data: data.data || {},
-      sound: (data.sound as "default" | null) || "default",
+      sound: sound,
       priority: (data.priority as "default" | "normal" | "high") || "high",
       channelId: data.channelId || "default",
+      ...(data.interruptionLevel
+        ? { interruptionLevel: data.interruptionLevel }
+        : {}),
     };
 
     const tickets: ExpoPushTicket[] =

package/Server/Services/SpanService.ts

@@ -14,6 +14,9 @@ import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import InBetween from "../../Types/BaseDatabase/InBetween";
 import Includes from "../../Types/BaseDatabase/Includes";
 import ObjectID from "../../Types/ObjectID";
+import FindBy from "../Types/AnalyticsDatabase/FindBy";
+import { OnFind } from "../Types/AnalyticsDatabase/Hooks";
+import ResourceEntityFilter from "../Utils/Telemetry/ResourceEntityFilter";
 
 /**
  * Columns the proj_hist_by_minute projection can answer with. If a count
@@ -35,6 +38,24 @@ export class SpanService extends AnalyticsDatabaseService<Span> {
     super({ modelType: Span, database: clickhouseDatabase });
   }
 
+  /*
+   * Resolve the traces explorer's resource-facet selections (a Kubernetes
+   * cluster, a host, ...) before the query is compiled. They arrive as
+   * Postgres ids under `resourceFilters`; matching them needs the
+   * resource's entity key, which only Postgres can supply. See
+   * ResourceEntityFilter.
+   */
+  protected override async onBeforeFind(
+    findBy: FindBy<Span>,
+  ): Promise<OnFind<Span>> {
+    await ResourceEntityFilter.rewriteAnalyticsQuery({
+      query: findBy.query as unknown as Record<string, unknown>,
+      projectId: findBy.props?.tenantId,
+    });
+
+    return { findBy, carryForward: null };
+  }
+
   /**
    * Normalize a JSON-deserialized date value to a Date instance. When a query
    * crosses the API boundary, InBetween's startValue/endValue come back as ISO

package/Server/Services/TeamMemberService.ts

@@ -10,6 +10,7 @@ import UpdateBy from "../Types/Database/UpdateBy";
 import Errors from "../Utils/Errors";
 import logger, { LogAttributes } from "../Utils/Logger";
 import ProductAnalytics from "../Utils/ProductAnalytics";
+import UserRegistrationToken from "../Utils/UserRegistrationToken";
 import AccessTokenService from "./AccessTokenService";
 import BillingService from "./BillingService";
 import DatabaseService from "./DatabaseService";
@@ -166,8 +167,23 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
         ? (createBy.miscDataProps["name"] as string).trim()
         : undefined;
 
-      let user: User | null = await UserService.findByEmail(email, {
-        isRoot: true,
+      /*
+       * `password` comes back too, because whether this person has finished
+       * registering decides both which link the invitation carries and whether
+       * that link needs a registration token. UserService.findByEmail selects
+       * only the id, so it cannot answer that.
+       */
+      let user: User | null = await UserService.findOneBy({
+        query: {
+          email: email,
+        },
+        select: {
+          _id: true,
+          password: true,
+        },
+        props: {
+          isRoot: true,
+        },
       });
 
       let isNewUser: boolean = false;
@@ -228,6 +244,39 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
         const host: Hostname = await DatabaseConfig.getHost();
         const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
 
+        /*
+         * "Still has to register", not "we just created the row". Someone
+         * invited to a second project before they ever signed up already has a
+         * user row and still has no password, and used to be sent the sign-in
+         * link — which they could not use, having no password to sign in with.
+         */
+        const needsRegistration: boolean = isNewUser || !user.password;
+
+        /*
+         * The token is what lets the recipient claim this account, so it exists
+         * only on the link inside this email and only for someone who has not
+         * registered yet. An already-registered invitee gets the plain link;
+         * they sign in instead, and minting a claim token for an account that
+         * cannot be claimed would just be a spare key lying around.
+         */
+        const registerLink: string = needsRegistration
+          ? (
+              await UserRegistrationToken.generateRegistrationLink({
+                userId: user.id!,
+                email: email,
+              })
+            ).toString()
+          : URL.fromString(
+              new URL(
+                httpProtocol,
+                host,
+                new Route(AccountsRoute.toString()),
+              ).toString(),
+            )
+              .addRoute("/register")
+              .addQueryParam("email", email.toString(), true)
+              .toString();
+
         MailService.sendMail(
           {
             toEmail: email,
@@ -240,17 +289,8 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
                   new Route(AccountsRoute.toString()),
                 ).toString(),
               ).toString(),
-              registerLink: URL.fromString(
-                new URL(
-                  httpProtocol,
-                  host,
-                  new Route(AccountsRoute.toString()),
-                ).toString(),
-              )
-                .addRoute("/register")
-                .addQueryParam("email", email.toString(), true)
-                .toString(),
-              isNewUser: isNewUser.toString(),
+              registerLink: registerLink,
+              isNewUser: needsRegistration.toString(),
               /*
                * An auto-accepted member has nothing left to accept, so the
                * template drops the "sign in to accept your invitation" framing

package/Server/Services/TraceAggregationService.ts

@@ -11,6 +11,10 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DbJSONResponse, Results } from "./AnalyticsDatabaseService";
 import logger from "../Utils/Logger";
 import ServiceType from "../../Types/Telemetry/ServiceType";
+import {
+  appendResourceScopeFilters,
+  ResourceEntityScope,
+} from "../Utils/Telemetry/ResourceEntityFilter";
 import ResourceFacetResolver, {
   ResolvedFacetValue,
   ResourceFacetSpec,
@@ -33,6 +37,15 @@ export type TraceAttributeFilters = Record<string, TraceAttributeFilterValue>;
 export interface TraceFilters {
   serviceIds?: Array<ObjectID> | undefined;
   entityKeys?: Array<string> | undefined;
+  /*
+   * Resource-facet selections (Kubernetes cluster / host / docker host /
+   * podman host) already resolved to their entity keys. One scope per
+   * facet: the branches inside a scope OR (a span proves membership either
+   * by being primary-keyed on the resource or by carrying its entity key),
+   * and the scopes AND with each other so two facets intersect. See
+   * ResourceEntityFilter.
+   */
+  resourceScopes?: Array<ResourceEntityScope> | undefined;
   statusCodes?: Array<number> | undefined;
   spanKinds?: Array<string> | undefined;
   spanNames?: Array<string> | undefined;
@@ -1008,6 +1021,8 @@ export class TraceAggregationService {
       );
     }
 
+    appendResourceScopeFilters(statement, request.resourceScopes);
+
     if (request.statusCodes && request.statusCodes.length > 0) {
       statement.append(
         SQL` AND statusCode IN (${{

package/Server/Services/UserCallService.ts

@@ -16,7 +16,8 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import TwilioConfig from "../../Types/CallAndSMS/TwilioConfig";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
-import Text from "../../Types/Text";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import ChannelVerification from "../Utils/ChannelVerification";
 import Project from "../../Models/DatabaseModels/Project";
 import Model from "../../Models/DatabaseModels/UserCall";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -144,7 +145,8 @@ export class Service extends DatabaseService<Model> {
     createdItem: Model,
   ): Promise<Model> {
     if (!createdItem.isVerified) {
-      this.sendVerificationCode(createdItem);
+      // issue and send the first verification code
+      await this.issueAndSendVerificationCode(createdItem);
     }
     return createdItem;
   }
@@ -158,9 +160,10 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         phone: true,
-        verificationCode: true,
         isVerified: true,
         projectId: true,
+        userId: true,
+        verificationCodeSentAt: true,
       },
     });
 
@@ -215,23 +218,57 @@ export class Service extends DatabaseService<Model> {
       );
     }
 
-    // generate new verification code
-    item.verificationCode = Text.generateRandomNumber(6);
+    /*
+     * Resend cooldown.
+     *
+     * Without it, spending the attempt budget on a code and asking for
+     * another one is free, which turns the attempt limit into a speed bump
+     * rather than a wall — and the resend control doubles as a way to send
+     * somebody unsolicited messages as fast as the network allows, at the
+     * project's expense.
+     */
+    const retryAfterSeconds: number =
+      ChannelVerification.getResendRetryAfterSeconds({
+        lastSentAt: item.verificationCodeSentAt,
+      });
 
-    await this.updateOneById({
-      id: item.id!,
-      props: {
-        isRoot: true,
-      },
-      data: {
-        verificationCode: item.verificationCode,
-      },
+    if (retryAfterSeconds > 0) {
+      throw new TooManyRequestsException(
+        `Please wait ${retryAfterSeconds} seconds before requesting another verification code.`,
+      );
+    }
+
+    await this.issueAndSendVerificationCode(item);
+  }
+
+  /*
+   * Mint a fresh code for this row, store only its digest, and send the
+   * plaintext to the channel.
+   *
+   * The plaintext exists in memory for exactly as long as it takes to hand it
+   * to the notification service and is never written anywhere. Everything
+   * about why — expiry, the attempt counter, rotation, the resend cooldown —
+   * is in Common/Server/Utils/ChannelVerification.ts.
+   *
+   * This does NOT check whether a send is allowed. Callers decide that:
+   * onCreateSuccess because a brand new row has never been sent to, and
+   * resendVerificationCode after the cooldown and the channel's own
+   * preconditions have passed.
+   */
+  @CaptureSpan()
+  public async issueAndSendVerificationCode(item: Model): Promise<void> {
+    const plainCode: string = await ChannelVerification.issueCodeOnItem({
+      service: this,
+      itemId: item.id!,
     });
 
-    this.sendVerificationCode(item);
+    this.sendVerificationCode(item, plainCode);
   }
 
-  public sendVerificationCode(item: Model): void {
+  public sendVerificationCode(item: Model, code: string): void {
+    // add space to make it more clear and slow down the message
+    const spokenCode: string = code.split("").join("  ");
+
     const callRequest: CallRequest = {
       to: item.phone!,
       data: [
@@ -239,19 +276,13 @@ export class Service extends DatabaseService<Model> {
           sayMessage: "This call is from One Uptime.",
         },
         {
-          sayMessage:
-            "Your verification code is " +
-            item.verificationCode?.split("").join("  "), // add space to make it more clear and slow down the message
+          sayMessage: "Your verification code is " + spokenCode,
         },
         {
-          sayMessage:
-            "Your verification code is " +
-            item.verificationCode?.split("").join("  "), // add space to make it more clear and slow down the message
+          sayMessage: "Your verification code is " + spokenCode,
         },
         {
-          sayMessage:
-            "Your verification code is " +
-            item.verificationCode?.split("").join("  "), // add space to make it more clear and slow down the message
+          sayMessage: "Your verification code is " + spokenCode,
         },
         {
           sayMessage: "Thank you for using One Uptime. Goodbye.",

package/Server/Services/UserEmailService.ts

@@ -12,7 +12,8 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
-import Text from "../../Types/Text";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import ChannelVerification from "../Utils/ChannelVerification";
 import Model from "../../Models/DatabaseModels/UserEmail";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
@@ -100,8 +101,33 @@ export class Service extends DatabaseService<Model> {
     createdItem: Model,
   ): Promise<Model> {
     if (!createdItem.isVerified) {
-      // send verification code
-      this.sendVerificationCode(createdItem);
+      // issue and send the first verification code
+      const plainCode: string =
+        await this.issueAndSendVerificationCode(createdItem);
+
+      /*
+       * TEST-ONLY seam, OFF unless explicitly switched on.
+       *
+       * The plaintext code is otherwise only ever emailed - never returned by
+       * the API - which is deliberate: returning it would let a caller add
+       * anybody's address and confirm it instantly, the exact takeover the
+       * hashing/expiry/attempt controls exist to stop (see ChannelVerification
+       * and VerificationCode). The end-to-end stack has no mailbox to read the
+       * emailed code from, so this narrow hatch hands the code back on the
+       * create response for it to confirm the address the way a user would.
+       *
+       * It is gated on an environment variable that is unset in every shipped
+       * config and set true ONLY in the CI e2e job (docker-compose passes it
+       * through, .github/workflows/test-release.yaml sets it for the SaaS run).
+       * In production the flag is absent, this branch never runs, and the code
+       * never leaves the mail path.
+       */
+      if (
+        process.env["EXPOSE_VERIFICATION_CODE_IN_API_RESPONSE_FOR_E2E"] ===
+        "true"
+      ) {
+        createdItem.verificationCode = plainCode;
+      }
     }
 
     return createdItem;
@@ -116,9 +142,10 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         email: true,
-        verificationCode: true,
         isVerified: true,
         projectId: true,
+        userId: true,
+        verificationCodeSentAt: true,
       },
     });
 
@@ -132,29 +159,68 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Email already verified");
     }
 
-    // generate new verification code
-    item.verificationCode = Text.generateRandomNumber(6);
+    /*
+     * Resend cooldown.
+     *
+     * Without it, spending the attempt budget on a code and asking for
+     * another one is free, which turns the attempt limit into a speed bump
+     * rather than a wall — and the resend control doubles as a way to send
+     * somebody unsolicited messages as fast as the network allows, at the
+     * project's expense.
+     */
+    const retryAfterSeconds: number =
+      ChannelVerification.getResendRetryAfterSeconds({
+        lastSentAt: item.verificationCodeSentAt,
+      });
 
-    await this.updateOneById({
-      id: item.id!,
-      props: {
-        isRoot: true,
-      },
-      data: {
-        verificationCode: item.verificationCode,
-      },
+    if (retryAfterSeconds > 0) {
+      throw new TooManyRequestsException(
+        `Please wait ${retryAfterSeconds} seconds before requesting another verification code.`,
+      );
+    }
+
+    await this.issueAndSendVerificationCode(item);
+  }
+
+  /*
+   * Mint a fresh code for this row, store only its digest, and send the
+   * plaintext to the channel.
+   *
+   * The plaintext exists in memory for exactly as long as it takes to hand it
+   * to the notification service and is never written anywhere. Everything
+   * about why — expiry, the attempt counter, rotation, the resend cooldown —
+   * is in Common/Server/Utils/ChannelVerification.ts.
+   *
+   * This does NOT check whether a send is allowed. Callers decide that:
+   * onCreateSuccess because a brand new row has never been sent to, and
+   * resendVerificationCode after the cooldown and the channel's own
+   * preconditions have passed.
+   */
+  @CaptureSpan()
+  public async issueAndSendVerificationCode(item: Model): Promise<string> {
+    const plainCode: string = await ChannelVerification.issueCodeOnItem({
+      service: this,
+      itemId: item.id!,
     });
 
-    this.sendVerificationCode(item);
+    this.sendVerificationCode(item, plainCode);
+
+    /*
+     * The plaintext exists here for exactly as long as it takes to hand it to
+     * the mailer, and is returned so a caller that has a legitimate reason to
+     * see it can - see onCreateSuccess for the one place that does, and the
+     * hard gate around it.
+     */
+    return plainCode;
   }
 
-  public sendVerificationCode(item: Model): void {
+  public sendVerificationCode(item: Model, code: string): void {
     MailService.sendMail(
       {
         toEmail: item.email!,
         templateType: EmailTemplateType.VerificationCode,
         vars: {
-          code: item.verificationCode!,
+          code: code,
           subject: "Verify this email address",
         },
         subject: "Verify this email address",