@oneuptime/common 12.0.12 → 12.0.14

package/build/dist/Server/Utils/Telemetry/ResourceEntityFilter.js

@@ -0,0 +1,311 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import HostService from "../../Services/HostService";
+import DockerHostService from "../../Services/DockerHostService";
+import PodmanHostService from "../../Services/PodmanHostService";
+import KubernetesClusterService from "../../Services/KubernetesClusterService";
+import { keyForHost, keyForKubernetesCluster, } from "../../../Utils/Telemetry/EntityKey";
+import { isResourceEntityFacetKey, parseResourceEntityFacetSelections, } from "../../../Types/Telemetry/ResourceEntityFacet";
+import Includes from "../../../Types/BaseDatabase/Includes";
+import TableColumnType from "../../../Types/AnalyticsDatabase/TableColumnType";
+import { SQL } from "../AnalyticsDatabase/Statement";
+import logger from "../Logger";
+import CaptureSpan from "./CaptureSpan";
+/*
+ * `Host` / `DockerHost` / `PodmanHost` all key on the canonicalized
+ * `host.name` (see `HostService.findOrCreateByHostIdentifier` and its
+ * Docker / Podman siblings), which is exactly the Host entity's identity —
+ * so all three resolve through `keyForHost`. A Kubernetes cluster keys on
+ * `k8s.cluster.name` (`InventoryItem.k8sClusterIdentity`).
+ *
+ * The Docker / Podman facets need this as much as the Kubernetes one does:
+ * `getServiceNameFromAttributes` synthesises a per-container service name
+ * for agent-collected container telemetry, so those rows are primary-keyed
+ * on a Service too and an id-only predicate finds almost nothing.
+ *
+ * Resolving them to the Host entity means "Docker Host web-1" also matches
+ * non-container telemetry from web-1 when the Infrastructure agent runs
+ * alongside. That is the machine the facet names, so the wider match is the
+ * honest reading — and it is the only identity an OTLP resource carries;
+ * DockerHost / PodmanHost are inventory-mirrored types that no resource
+ * ever declares (see EntityType).
+ */
+const FACET_DEFINITIONS = {
+    hostId: {
+        attributeKey: "resource.host.name",
+        entityKeyFor: keyForHost,
+        findIdentifiers: async (data) => {
+            const rows = await HostService.findBy({
+                query: { projectId: data.projectId, _id: new Includes(data.ids) },
+                select: { hostIdentifier: true },
+                limit: new PositiveNumber(data.ids.length),
+                skip: new PositiveNumber(0),
+                props: { isRoot: true },
+            });
+            return rows.map((row) => {
+                return row.hostIdentifier || "";
+            });
+        },
+    },
+    dockerHostId: {
+        attributeKey: "resource.host.name",
+        entityKeyFor: keyForHost,
+        findIdentifiers: async (data) => {
+            const rows = await DockerHostService.findBy({
+                query: { projectId: data.projectId, _id: new Includes(data.ids) },
+                select: { hostIdentifier: true },
+                limit: new PositiveNumber(data.ids.length),
+                skip: new PositiveNumber(0),
+                props: { isRoot: true },
+            });
+            return rows.map((row) => {
+                return row.hostIdentifier || "";
+            });
+        },
+    },
+    podmanHostId: {
+        attributeKey: "resource.host.name",
+        entityKeyFor: keyForHost,
+        findIdentifiers: async (data) => {
+            const rows = await PodmanHostService.findBy({
+                query: { projectId: data.projectId, _id: new Includes(data.ids) },
+                select: { hostIdentifier: true },
+                limit: new PositiveNumber(data.ids.length),
+                skip: new PositiveNumber(0),
+                props: { isRoot: true },
+            });
+            return rows.map((row) => {
+                return row.hostIdentifier || "";
+            });
+        },
+    },
+    kubernetesClusterId: {
+        attributeKey: "resource.k8s.cluster.name",
+        entityKeyFor: keyForKubernetesCluster,
+        findIdentifiers: async (data) => {
+            const rows = await KubernetesClusterService.findBy({
+                query: { projectId: data.projectId, _id: new Includes(data.ids) },
+                select: { clusterIdentifier: true },
+                limit: new PositiveNumber(data.ids.length),
+                skip: new PositiveNumber(0),
+                props: { isRoot: true },
+            });
+            return rows.map((row) => {
+                return row.clusterIdentifier || "";
+            });
+        },
+    },
+};
+/**
+ * Append the resolved resource scopes to a hand-written aggregation
+ * statement (the Log / Trace histogram, facet and analytics queries, which
+ * build SQL directly rather than through StatementGenerator).
+ *
+ * Emits one `AND ( ... OR ... )` group per scope, mirroring exactly what
+ * StatementGenerator compiles for the list query — the chart and the list
+ * must agree on which rows a facet selects, or the histogram tells a
+ * different story than the rows underneath it.
+ *
+ * A scope with no usable branch appends nothing rather than an empty
+ * `IN ()`: an unresolvable filter must not silently match zero rows.
+ */
+export function appendResourceScopeFilters(statement, scopes) {
+    if (!scopes || scopes.length === 0) {
+        return;
+    }
+    for (const scope of scopes) {
+        if (!scope) {
+            continue;
+        }
+        const branches = [];
+        const entityIds = (scope.entityIds || []).filter((id) => {
+            return typeof id === "string" && id.length > 0;
+        });
+        if (entityIds.length > 0) {
+            branches.push(SQL `primaryEntityId IN (${{
+                type: TableColumnType.ObjectID,
+                value: new Includes(entityIds),
+            }})`);
+        }
+        const entityKeys = (scope.entityKeys || []).filter((entityKey) => {
+            return typeof entityKey === "string" && entityKey.length > 0;
+        });
+        if (entityKeys.length > 0) {
+            branches.push(SQL `hasAny(entityKeys, ${{
+                type: TableColumnType.ArrayText,
+                value: entityKeys,
+            }})`);
+        }
+        const attributeValues = (scope.attributeValues || []).filter((attributeValue) => {
+            return typeof attributeValue === "string" && attributeValue.length > 0;
+        });
+        if (scope.attributeKey && attributeValues.length > 0) {
+            branches.push(SQL `attributes[${{
+                type: TableColumnType.Text,
+                value: scope.attributeKey,
+            }}] IN (${{
+                type: TableColumnType.Text,
+                value: new Includes(attributeValues),
+            }})`);
+        }
+        if (branches.length === 0) {
+            continue;
+        }
+        statement.append(SQL ` AND (`);
+        for (const [index, branch] of branches.entries()) {
+            if (index > 0) {
+                statement.append(SQL ` OR `);
+            }
+            statement.append(branch);
+        }
+        statement.append(SQL `)`);
+    }
+}
+class ResourceEntityFilter {
+    /**
+     * Read the `resourceFilters` field off a request body (or an analytics
+     * query record) into the canonical selection shape. Delegates to the
+     * isomorphic parser so the browser and the server agree on exactly which
+     * selections are well-formed.
+     */
+    static parseSelections(source) {
+        return parseResourceEntityFacetSelections(source);
+    }
+    /**
+     * Compile each facet's selected ids into a scope. One scope per facet, so
+     * the caller ANDs them: selecting a cluster and a host means "in that
+     * cluster AND on that host", which is what a reader expects of two
+     * independent filter groups.
+     *
+     * The identifier lookup is best-effort: if Postgres is unreachable or an
+     * id no longer resolves, the scope keeps its `entityIds` branch and
+     * simply loses the entity-key one. That degrades to today's behavior
+     * rather than dropping the constraint (which would silently widen the
+     * result set).
+     */
+    static async resolveScopes(data) {
+        const facetKeys = Object.keys(data.selections).filter((key) => {
+            return (isResourceEntityFacetKey(key) &&
+                (data.selections[key] || []).length > 0);
+        });
+        if (facetKeys.length === 0) {
+            return [];
+        }
+        return Promise.all(facetKeys.map(async (facetKey) => {
+            return ResourceEntityFilter.resolveOne({
+                projectId: data.projectId,
+                facetKey,
+                ids: data.selections[facetKey] || [],
+            });
+        }));
+    }
+    /**
+     * Rewrite an analytics list query in place: consume the client-sent
+     * `resourceFilters` ids and replace them with the resolved
+     * `resourceEntityScopes` that StatementGenerator compiles.
+     *
+     * The compiled key is always rebuilt from scratch — a client cannot
+     * hand-craft one, so the only way a scope reaches the SQL is through this
+     * resolver. (It could only ever narrow rows, but leaving one authoritative
+     * writer keeps the predicate auditable.)
+     *
+     * Without a tenant the identifier lookup cannot be project-scoped, so the
+     * scope keeps its id branch and drops the entity-key one: narrower than
+     * the request asked for, never wider.
+     */
+    static async rewriteAnalyticsQuery(data) {
+        const query = data.query;
+        if (!query || typeof query !== "object") {
+            return;
+        }
+        const raw = query[ResourceEntityFilter.QUERY_FILTER_KEY];
+        delete query[ResourceEntityFilter.QUERY_FILTER_KEY];
+        delete query[ResourceEntityFilter.QUERY_SCOPE_KEY];
+        if (raw === undefined || raw === null) {
+            return;
+        }
+        const selections = ResourceEntityFilter.parseSelections(raw);
+        if (Object.keys(selections).length === 0) {
+            return;
+        }
+        if (!data.projectId) {
+            query[ResourceEntityFilter.QUERY_SCOPE_KEY] = Object.keys(selections).map((facetKey) => {
+                return { entityIds: selections[facetKey] || [], entityKeys: [] };
+            });
+            return;
+        }
+        const scopes = await ResourceEntityFilter.resolveScopes({
+            projectId: data.projectId,
+            selections,
+        });
+        if (scopes.length > 0) {
+            query[ResourceEntityFilter.QUERY_SCOPE_KEY] = scopes;
+        }
+    }
+    static async resolveOne(data) {
+        const scope = {
+            entityIds: data.ids,
+            entityKeys: [],
+        };
+        const definition = FACET_DEFINITIONS[data.facetKey];
+        if (!definition) {
+            return scope;
+        }
+        let identifiers = [];
+        try {
+            identifiers = await definition.findIdentifiers({
+                projectId: data.projectId,
+                ids: data.ids.map((id) => {
+                    return new ObjectID(id);
+                }),
+            });
+        }
+        catch (err) {
+            logger.warn(`Could not resolve ${data.facetKey} identifiers for the entity-key filter; falling back to primaryEntityId only: ${err}`);
+            return scope;
+        }
+        const uniqueIdentifiers = Array.from(new Set(identifiers.filter((identifier) => {
+            return identifier.trim().length > 0;
+        })));
+        if (uniqueIdentifiers.length === 0) {
+            return scope;
+        }
+        const projectIdString = data.projectId.toString();
+        scope.entityKeys = Array.from(new Set(uniqueIdentifiers.map((identifier) => {
+            return definition.entityKeyFor(projectIdString, identifier);
+        })));
+        scope.attributeKey = definition.attributeKey;
+        scope.attributeValues = uniqueIdentifiers;
+        return scope;
+    }
+}
+/**
+ * Query key the client puts the raw selected ids under, and the key the
+ * compiled scopes are written to. Kept together so the rewrite below is
+ * the only thing that has to know the pair.
+ */
+ResourceEntityFilter.QUERY_FILTER_KEY = "resourceFilters";
+ResourceEntityFilter.QUERY_SCOPE_KEY = "resourceEntityScopes";
+export default ResourceEntityFilter;
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceEntityFilter, "resolveScopes", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], ResourceEntityFilter, "rewriteAnalyticsQuery", null);
+//# sourceMappingURL=ResourceEntityFilter.js.map

package/build/dist/Server/Utils/Telemetry/ResourceEntityFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ResourceEntityFilter.js","sourceRoot":"","sources":["../../../../../Server/Utils/Telemetry/ResourceEntityFilter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAM3D,OAAO,WAAW,MAAM,4BAA4B,CAAC;AACrD,OAAO,iBAAiB,MAAM,kCAAkC,CAAC;AACjE,OAAO,iBAAiB,MAAM,kCAAkC,CAAC;AACjE,OAAO,wBAAwB,MAAM,yCAAyC,CAAC;AAC/E,OAAO,EACL,UAAU,EACV,uBAAuB,GACxB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAEL,wBAAwB,EACxB,kCAAkC,GACnC,MAAM,8CAA8C,CAAC;AACtD,OAAO,QAAQ,MAAM,sCAAsC,CAAC;AAC5D,OAAO,eAAe,MAAM,kDAAkD,CAAC;AAC/E,OAAO,EAAE,GAAG,EAAa,MAAM,gCAAgC,CAAC;AAChE,OAAO,MAAM,MAAM,WAAW,CAAC;AAC/B,OAAO,WAAW,MAAM,eAAe,CAAC;AAsCxC;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,iBAAiB,GAA4C;IACjE,MAAM,EAAE;QACN,YAAY,EAAE,oBAAoB;QAClC,YAAY,EAAE,UAAU;QACxB,eAAe,EAAE,KAAK,EAAE,IAGvB,EAA0B,EAAE;YAC3B,MAAM,IAAI,GAAqB,MAAM,WAAW,CAAC,MAAM,CAAC;gBACtD,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACjE,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;gBAChC,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1C,IAAI,EAAE,IAAI,cAAc,CAAC,CAAC,CAAC;gBAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAc,EAAU,EAAE;gBACzC,OAAO,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;KACF;IACD,YAAY,EAAE;QACZ,YAAY,EAAE,oBAAoB;QAClC,YAAY,EAAE,UAAU;QACxB,eAAe,EAAE,KAAK,EAAE,IAGvB,EAA0B,EAAE;YAC3B,MAAM,IAAI,GAA2B,MAAM,iBAAiB,CAAC,MAAM,CAAC;gBAClE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACjE,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;gBAChC,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1C,IAAI,EAAE,IAAI,cAAc,CAAC,CAAC,CAAC;gBAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAoB,EAAU,EAAE;gBAC/C,OAAO,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;KACF;IACD,YAAY,EAAE;QACZ,YAAY,EAAE,oBAAoB;QAClC,YAAY,EAAE,UAAU;QACxB,eAAe,EAAE,KAAK,EAAE,IAGvB,EAA0B,EAAE;YAC3B,MAAM,IAAI,GAA2B,MAAM,iBAAiB,CAAC,MAAM,CAAC;gBAClE,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACjE,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE;gBAChC,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1C,IAAI,EAAE,IAAI,cAAc,CAAC,CAAC,CAAC;gBAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEH,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAoB,EAAU,EAAE;gBAC/C,OAAO,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;YAClC,CAAC,CAAC,CAAC;QACL,CAAC;KACF;IACD,mBAAmB,EAAE;QACnB,YAAY,EAAE,2BAA2B;QACzC,YAAY,EAAE,uBAAuB;QACrC,eAAe,EAAE,KAAK,EAAE,IAGvB,EAA0B,EAAE;YAC3B,MAAM,IAAI,GACR,MAAM,wBAAwB,CAAC,MAAM,CAAC;gBACpC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;gBACjE,MAAM,EAAE,EAAE,iBAAiB,EAAE,IAAI,EAAE;gBACnC,KAAK,EAAE,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;gBAC1C,IAAI,EAAE,IAAI,cAAc,CAAC,CAAC,CAAC;gBAC3B,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC,CAAC;YAEL,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAA2B,EAAU,EAAE;gBACtD,OAAO,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;YACrC,CAAC,CAAC,CAAC;QACL,CAAC;KACF;CACF,CAAC;AAEF;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAoB,EACpB,MAA8C;IAE9C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO;IACT,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAqB,EAAE,CAAC;QAEtC,MAAM,SAAS,GAAkB,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAC7D,CAAC,EAAU,EAAW,EAAE;YACtB,OAAO,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACjD,CAAC,CACF,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CACX,GAAG,CAAA,uBAAuB;gBACxB,IAAI,EAAE,eAAe,CAAC,QAAQ;gBAC9B,KAAK,EAAE,IAAI,QAAQ,CAAC,SAAS,CAAC;aAC/B,GAAG,CACL,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAkB,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,MAAM,CAC/D,CAAC,SAAiB,EAAW,EAAE;YAC7B,OAAO,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/D,CAAC,CACF,CAAC;QAEF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CACX,GAAG,CAAA,sBAAsB;gBACvB,IAAI,EAAE,eAAe,CAAC,SAAS;gBAC/B,KAAK,EAAE,UAAU;aAClB,GAAG,CACL,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAkB,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,MAAM,CACzE,CAAC,cAAsB,EAAW,EAAE;YAClC,OAAO,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC;QACzE,CAAC,CACF,CAAC;QAEF,IAAI,KAAK,CAAC,YAAY,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrD,QAAQ,CAAC,IAAI,CACX,GAAG,CAAA,cAAc;gBACf,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,KAAK,EAAE,KAAK,CAAC,YAAY;aAC1B,SAAS;gBACR,IAAI,EAAE,eAAe,CAAC,IAAI;gBAC1B,KAAK,EAAE,IAAI,QAAQ,CAAC,eAAe,CAAC;aACrC,GAAG,CACL,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,SAAS,CAAC,MAAM,CAAC,GAAG,CAAA,QAAQ,CAAC,CAAC;QAE9B,KAAK,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;YACjD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,SAAS,CAAC,MAAM,CAAC,GAAG,CAAA,MAAM,CAAC,CAAC;YAC9B,CAAC;YACD,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,SAAS,CAAC,MAAM,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAqB,oBAAoB;IACvC;;;;;OAKG;IACI,MAAM,CAAC,eAAe,CAC3B,MAAqC;QAErC,OAAO,kCAAkC,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC;IAED;;;;;;;;;;;OAWG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAGjC;QACC,MAAM,SAAS,GAAkB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAClE,CAAC,GAAW,EAAW,EAAE;YACvB,OAAO,CACL,wBAAwB,CAAC,GAAG,CAAC;gBAC7B,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,CACxC,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,OAAO,CAAC,GAAG,CAChB,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,QAAgB,EAAgC,EAAE;YACrE,OAAO,oBAAoB,CAAC,UAAU,CAAC;gBACrC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,QAAQ;gBACR,GAAG,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE;aACrC,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAUD;;;;;;;;;;;;;OAaG;IAEiB,AAAb,MAAM,CAAC,KAAK,CAAC,qBAAqB,CAAC,IAGzC;QACC,MAAM,KAAK,GAAwC,IAAI,CAAC,KAAK,CAAC;QAE9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,OAAO;QACT,CAAC;QAED,MAAM,GAAG,GAAY,KAAK,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QAElE,OAAO,KAAK,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;QACpD,OAAO,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,CAAC;QAEnD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QAED,MAAM,UAAU,GACd,oBAAoB,CAAC,eAAe,CAAC,GAAiB,CAAC,CAAC;QAE1D,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO;QACT,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,GAAG,CACvE,CAAC,QAAgB,EAAuB,EAAE;gBACxC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;YACnE,CAAC,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GACV,MAAM,oBAAoB,CAAC,aAAa,CAAC;YACvC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,UAAU;SACX,CAAC,CAAC;QAEL,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,oBAAoB,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC;QACvD,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAI/B;QACC,MAAM,KAAK,GAAwB;YACjC,SAAS,EAAE,IAAI,CAAC,GAAG;YACnB,UAAU,EAAE,EAAE;SACf,CAAC;QAEF,MAAM,UAAU,GACd,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,WAAW,GAAkB,EAAE,CAAC;QAEpC,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,UAAU,CAAC,eAAe,CAAC;gBAC7C,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAU,EAAY,EAAE;oBACzC,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC1B,CAAC,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CACT,qBAAqB,IAAI,CAAC,QAAQ,iFAAiF,GAAG,EAAE,CACzH,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,iBAAiB,GAAkB,KAAK,CAAC,IAAI,CACjD,IAAI,GAAG,CACL,WAAW,CAAC,MAAM,CAAC,CAAC,UAAkB,EAAW,EAAE;YACjD,OAAO,UAAU,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,CACH,CACF,CAAC;QAEF,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,eAAe,GAAW,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QAE1D,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,IAAI,CAC3B,IAAI,GAAG,CACL,iBAAiB,CAAC,GAAG,CAAC,CAAC,UAAkB,EAAU,EAAE;YACnD,OAAO,UAAU,CAAC,YAAY,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAC9D,CAAC,CAAC,CACH,CACF,CAAC;QACF,KAAK,CAAC,YAAY,GAAG,UAAU,CAAC,YAAY,CAAC;QAC7C,KAAK,CAAC,eAAe,GAAG,iBAAiB,CAAC;QAE1C,OAAO,KAAK,CAAC;IACf,CAAC;;AA/HD;;;;GAIG;AACoB,qCAAgB,GAAW,iBAAiB,CAAC;AAC7C,oCAAe,GAAW,sBAAsB,CAAC;eA5DrD,oBAAoB;AA0BnB;IADnB,WAAW,EAAE;;;;+CA2Bb;AAyBmB;IADnB,WAAW,EAAE;;;;uDA6Cb"}

package/build/dist/Server/Utils/TotpAuth.js

@@ -9,6 +9,59 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 };
 import * as OTPAuth from "otpauth";
 import CaptureSpan from "./Telemetry/CaptureSpan";
+/**
+ * The HMAC algorithm every new enrolment is issued with.
+ *
+ * RFC 6238 fixes SHA1 as the default and every authenticator implements it.
+ * The `algorithm` parameter in an otpauth:// URI is, in practice, advisory:
+ * Google Authenticator and Microsoft Authenticator parse the URI, ignore the
+ * parameter, and compute SHA1 anyway. A server that issues `algorithm=SHA256`
+ * therefore hands those apps a QR code they will silently mis-implement — the
+ * app shows a confident six digits, the server computes a completely different
+ * six digits, and enrolment can never succeed no matter how many codes the
+ * user tries. That is the failure this constant exists to prevent.
+ *
+ * SHA1 is not a weakness here. HMAC-SHA1 is unaffected by the collision
+ * attacks that retired SHA1 for signatures (RFC 6234 / RFC 2104), and the
+ * output is truncated to six digits over a 30 second window regardless — the
+ * brute-force surface is the 10^6 code space, not the hash.
+ */
+export const DefaultTotpAlgorithm = "SHA1";
+/**
+ * Algorithms a submitted token is checked against, in order.
+ *
+ * OneUptime issued `SHA256` enrolments before this was understood. Those
+ * secrets are still in the database and still work in the minority of apps
+ * that do honour the parameter (1Password, Bitwarden, Aegis, FreeOTP), so
+ * dropping SHA256 from verification would lock those accounts out of their
+ * own logins.
+ *
+ * The cost is exactly one bit: two algorithms across the validation window
+ * means twice as many six-digit strings are accepted at any instant. Against
+ * a 10^6 code space that is still a vanishing fraction, and the tests pin the
+ * bound so it cannot quietly grow.
+ *
+ * Retiring SHA256 needs more than time passing. Nothing on the row records
+ * which algorithm the user's app actually computes, so "no legacy rows remain"
+ * is not a question the database can answer today — removing it means either
+ * storing the algorithm that verified, or accepting that some long-dormant
+ * account re-enrols instead of logging in.
+ */
+export const SupportedTotpAlgorithms = ["SHA1", "SHA256"];
+/**
+ * Number of 30 second steps either side of now that a token is accepted for.
+ *
+ * Three steps is +/- 90 seconds, which absorbs ordinary phone/server clock
+ * drift and the user typing the last digit as the code rolls over.
+ */
+export const TotpValidationWindow = 3;
+/**
+ * Number of digits in a token, and the length of the time step in seconds.
+ * Both are the values Google Authenticator assumes, and — like `algorithm` —
+ * both are parameters it ignores when told anything else.
+ */
+export const TotpDigits = 6;
+export const TotpPeriodInSeconds = 30;
 /**
  * Utility class for handling TOTP authentication.
  */
@@ -32,26 +85,82 @@ export default class TotpAuth {
                 email: data.email,
             }),
             // Algorithm used for the HMAC function.
-            algorithm: "SHA256",
+            algorithm: data.algorithm || DefaultTotpAlgorithm,
             // Length of the generated tokens.
-            digits: 6,
+            digits: TotpDigits,
             // Interval of time for which a token is valid, in seconds.
-            period: 30,
+            period: TotpPeriodInSeconds,
             // Arbitrary key encoded in Base32 or OTPAuth.Secret instance.
             secret: data.secret,
         });
         return totp;
     }
+    /**
+     * Strips the formatting authenticator apps add for readability.
+     *
+     * Google Authenticator renders a code as "123 456" and both the iOS and
+     * Android clipboards keep that space when the user copies it. Rejecting the
+     * paste is a self-inflicted "Invalid code" for a user who supplied exactly
+     * the right secret material, so the separators are removed before the token
+     * is compared. Anything that is not a digit is dropped, which also covers
+     * the hyphen some apps use and stray whitespace from a trimmed paste.
+     *
+     * @param token - The raw token as submitted.
+     * @returns The token reduced to its digits.
+     */
+    static normalizeToken(token) {
+        /*
+         * The token arrives straight off a JSON body, so it is only a string
+         * because the client chose to send one. A number or an object here must
+         * fail verification, not throw out of `.replace` and surface as a 500.
+         */
+        if (typeof token !== "string" || !token) {
+            return "";
+        }
+        return token.replace(/\D/g, "");
+    }
     /**
      * Verifies if a given token matches the provided secret key.
      * @param data - The data object containing the secret key and token.
      * @returns A boolean indicating whether the token is valid or not.
      */
     static verifyToken(data) {
-        const { secret, token, email } = data;
-        const totp = this.getTotp({ secret, email });
-        const delta = totp.validate({ token, window: 3 });
-        return delta !== null;
+        const { secret, email } = data;
+        if (!secret) {
+            return false;
+        }
+        const token = this.normalizeToken(data.token);
+        /*
+         * otpauth compares the submitted string against the codes it generates,
+         * so a token of the wrong length can never match — but it would still be
+         * run through one HMAC per algorithm per window step first. Reject it up
+         * front instead.
+         */
+        if (token.length !== TotpDigits) {
+            return false;
+        }
+        for (const algorithm of SupportedTotpAlgorithms) {
+            let totp;
+            try {
+                totp = this.getTotp({ secret, email, algorithm });
+            }
+            catch (_a) {
+                /*
+                 * A secret that is not valid base32 throws in the OTPAuth.Secret
+                 * constructor. That is a corrupt row, not a wrong code, and it fails
+                 * identically for every algorithm — so stop rather than repeat it.
+                 */
+                return false;
+            }
+            const delta = totp.validate({
+                token,
+                window: TotpValidationWindow,
+            });
+            if (delta !== null) {
+                return true;
+            }
+        }
+        return false;
     }
     /**
      * Generates a URI for the given secret key and user email, which can be used to set up two-factor authentication.
@@ -60,7 +169,11 @@ export default class TotpAuth {
      */
     static generateUri(data) {
         const { secret, userEmail } = data;
-        const totp = this.getTotp({ secret, email: userEmail });
+        const totp = this.getTotp({
+            secret,
+            email: userEmail,
+            algorithm: DefaultTotpAlgorithm,
+        });
         return totp.toString();
     }
 }
@@ -82,6 +195,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", OTPAuth.TOTP)
 ], TotpAuth, "getTotp", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String]),
+    __metadata("design:returntype", String)
+], TotpAuth, "normalizeToken", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Utils/TotpAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"TotpAuth.js","sourceRoot":"","sources":["../../../../Server/Utils/TotpAuth.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,QAAQ;IAC3B;;;OAGG;IAEW,AAAP,MAAM,CAAC,cAAc;QAC1B,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAGa,AAAP,MAAM,CAAC,QAAQ,CAAC,IAAsB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAGa,AAAP,MAAM,CAAC,OAAO,CAAC,IAAsC;QAC1D,MAAM,IAAI,GAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1C,sDAAsD;YACtD,MAAM,EAAE,WAAW;YACnB,sBAAsB;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC;YACF,wCAAwC;YACxC,SAAS,EAAE,QAAQ;YACnB,kCAAkC;YAClC,MAAM,EAAE,CAAC;YACT,2DAA2D;YAC3D,MAAM,EAAE,EAAE;YACV,8DAA8D;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAEtC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAE3D,MAAM,KAAK,GAAkB,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAEjE,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAGzB;QACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEnC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QAEtE,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AAnEe;IADb,WAAW,EAAE;;;;oCAGb;AAGa;IADb,WAAW,EAAE;;;;8BAGb;AAGa;IADb,WAAW,EAAE;;;oCACiD,OAAO,CAAC,IAAI;6BAmB1E;AAQa;IADb,WAAW,EAAE;;;;iCAab;AAQa;IADb,WAAW,EAAE;;;;iCAUb"}
+{"version":3,"file":"TotpAuth.js","sourceRoot":"","sources":["../../../../Server/Utils/TotpAuth.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AACnC,OAAO,WAAW,MAAM,yBAAyB,CAAC;AAElD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,MAAM,CAAC;AAEnD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAEzE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAW,CAAC,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAW,CAAC,CAAC;AACpC,MAAM,CAAC,MAAM,mBAAmB,GAAW,EAAE,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,OAAO,OAAO,QAAQ;IAC3B;;;OAGG;IAEW,AAAP,MAAM,CAAC,cAAc;QAC1B,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC;IACrC,CAAC;IAGa,AAAP,MAAM,CAAC,QAAQ,CAAC,IAAsB;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAGa,AAAP,MAAM,CAAC,OAAO,CAAC,IAIrB;QACC,MAAM,IAAI,GAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;YAC1C,sDAAsD;YACtD,MAAM,EAAE,WAAW;YACnB,sBAAsB;YACtB,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC;YACF,wCAAwC;YACxC,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,oBAAoB;YACjD,kCAAkC;YAClC,MAAM,EAAE,UAAU;YAClB,2DAA2D;YAC3D,MAAM,EAAE,mBAAmB;YAC3B,8DAA8D;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;OAYG;IAEW,AAAP,MAAM,CAAC,cAAc,CAAC,KAAa;QACxC;;;;WAIG;QACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;YACxC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAIzB;QACC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAW,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAEtD;;;;;WAKG;QACH,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,MAAM,SAAS,IAAI,uBAAuB,EAAE,CAAC;YAChD,IAAI,IAAkB,CAAC;YAEvB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YACpD,CAAC;YAAC,WAAM,CAAC;gBACP;;;;mBAIG;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,KAAK,GAAkB,IAAI,CAAC,QAAQ,CAAC;gBACzC,KAAK;gBACL,MAAM,EAAE,oBAAoB;aAC7B,CAAC,CAAC;YAEH,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IAEW,AAAP,MAAM,CAAC,WAAW,CAAC,IAGzB;QACC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;QAEnC,MAAM,IAAI,GAAiB,IAAI,CAAC,OAAO,CAAC;YACtC,MAAM;YACN,KAAK,EAAE,SAAS;YAChB,SAAS,EAAE,oBAAoB;SAChC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;IACzB,CAAC;CACF;AA1Ie;IADb,WAAW,EAAE;;;;oCAGb;AAGa;IADb,WAAW,EAAE;;;;8BAGb;AAGa;IADb,WAAW,EAAE;;;oCAKV,OAAO,CAAC,IAAI;6BAmBf;AAgBa;IADb,WAAW,EAAE;;;;oCAYb;AAQa;IADb,WAAW,EAAE;;;;iCAiDb;AAQa;IADb,WAAW,EAAE;;;;iCAcb"}