@oneuptime/common 12.0.12 → 12.0.14

package/Server/Utils/Logger.ts

@@ -5,6 +5,12 @@ import { SeverityNumber } from "@opentelemetry/api-logs";
 import Exception from "../../Types/Exception/Exception";
 import { JSONObject } from "../../Types/JSON";
 import ConfigLogLevel from "../Types/ConfigLogLevel";
+import {
+  REDACTED,
+  isSensitiveLogKey,
+  redactLogString,
+  redactLogValue,
+} from "./LogRedaction";
 
 export type LogBody = string | JSONObject | Exception | Error | unknown;
 
@@ -68,9 +74,10 @@ export default class logger {
   private static readonly recentLogTrimSlack: number = 256;
   private static readonly maxRecentLogMessageLength: number = 4000;
 
+  // `body` has already been through redactBody -- see the level methods.
   private static record(level: string, body: LogBody): void {
     try {
-      const message: string = this.serializeLogBody(body);
+      const message: string = this.serializeRedactedBody(body);
 
       this.recentLogs.push({
         time: new Date().toISOString(),
@@ -114,13 +121,71 @@ export default class logger {
     return LogLevel;
   }
 
-  public static serializeLogBody(body: LogBody): string {
-    if (typeof body === "string") {
-      return body;
-    } else if (body instanceof Exception || body instanceof Error) {
-      return body.message;
+  /*
+   * Turns a body into a redacted copy, once, before it is handed to any sink.
+   * Every level method calls this and then passes the RESULT to console, to
+   * the recent-log buffer and to telemetry, so a log record is redacted a
+   * single time no matter how many places it ends up in.
+   *
+   * Objects come back as plain redacted copies, so console keeps printing them
+   * as objects rather than as a JSON string.
+   *
+   * Errors are special-cased: when nothing in the message or the stack needed
+   * redacting -- the overwhelmingly common case -- the original Error is
+   * returned untouched, so console still renders a real stack trace.
+   */
+  private static redactBody(body: LogBody): LogBody {
+    try {
+      if (typeof body === "string") {
+        return redactLogString(body);
+      }
+
+      if (body instanceof Exception || body instanceof Error) {
+        const originalStack: string = body.stack || "";
+        const message: string = redactLogString(body.message);
+        const stack: string = redactLogString(originalStack);
+
+        if (message === body.message && stack === originalStack) {
+          return body;
+        }
+
+        return stack || `${body.name}: ${message}`;
+      }
+
+      return redactLogValue(body) as LogBody;
+    } catch {
+      // Never pass on a body we could not prove was redacted.
+      return REDACTED;
     }
-    return JSON.stringify(body);
+  }
+
+  // Serialization only. The body must already have been through redactBody.
+  private static serializeRedactedBody(body: LogBody): string {
+    try {
+      if (typeof body === "string") {
+        return body;
+      } else if (body instanceof Exception || body instanceof Error) {
+        return body.message;
+      }
+
+      /*
+       * redactBody swept every string inside this copy already, so stringifying
+       * it needs no second textual pass.
+       */
+      const serialized: string | undefined = JSON.stringify(body);
+
+      return serialized === undefined ? "" : serialized;
+    } catch {
+      return REDACTED;
+    }
+  }
+
+  /*
+   * Redacts and serializes in one step, for callers outside the level methods
+   * that hold a raw body.
+   */
+  public static serializeLogBody(body: LogBody): string {
+    return this.serializeRedactedBody(this.redactBody(body));
   }
 
   private static sanitizeAttributes(
@@ -136,7 +201,16 @@ export default class logger {
       for (const key in attributes) {
         const value: string | number | boolean | undefined = attributes[key];
 
-        if (value !== undefined && value !== null) {
+        if (value === undefined || value === null) {
+          continue;
+        }
+
+        // Attributes are a log sink too, and they travel to telemetry verbatim.
+        if (isSensitiveLogKey(key, value)) {
+          sanitized[key] = REDACTED;
+        } else if (typeof value === "string") {
+          sanitized[key] = redactLogString(value);
+        } else {
           sanitized[key] = value;
         }
       }
@@ -151,16 +225,14 @@ export default class logger {
     const logLevel: ConfigLogLevel = this.getLogLevel();
 
     if (logLevel === ConfigLogLevel.DEBUG || logLevel === ConfigLogLevel.INFO) {
+      const body: LogBody = this.redactBody(message);
+
       // eslint-disable-next-line no-console
-      console.info(message);
+      console.info(body);
 
-      this.record("INFO", message);
+      this.record("INFO", body);
 
-      this.emit({
-        body: message,
-        severityNumber: SeverityNumber.INFO,
-        attributes,
-      });
+      this.emitRedacted(body, SeverityNumber.INFO, attributes);
     }
   }
 
@@ -173,16 +245,14 @@ export default class logger {
       logLevel === ConfigLogLevel.WARN ||
       logLevel === ConfigLogLevel.ERROR
     ) {
+      const body: LogBody = this.redactBody(message);
+
       // eslint-disable-next-line no-console
-      console.error(message);
+      console.error(body);
 
-      this.record("ERROR", message);
+      this.record("ERROR", body);
 
-      this.emit({
-        body: message,
-        severityNumber: SeverityNumber.ERROR,
-        attributes,
-      });
+      this.emitRedacted(body, SeverityNumber.ERROR, attributes);
     }
   }
 
@@ -194,16 +264,14 @@ export default class logger {
       logLevel === ConfigLogLevel.INFO ||
       logLevel === ConfigLogLevel.WARN
     ) {
+      const body: LogBody = this.redactBody(message);
+
       // eslint-disable-next-line no-console
-      console.warn(message);
+      console.warn(body);
 
-      this.record("WARN", message);
+      this.record("WARN", body);
 
-      this.emit({
-        body: message,
-        severityNumber: SeverityNumber.WARN,
-        attributes,
-      });
+      this.emitRedacted(body, SeverityNumber.WARN, attributes);
     }
   }
 
@@ -211,16 +279,14 @@ export default class logger {
     const logLevel: ConfigLogLevel = this.getLogLevel();
 
     if (logLevel === ConfigLogLevel.DEBUG) {
+      const body: LogBody = this.redactBody(message);
+
       // eslint-disable-next-line no-console
-      console.debug(message);
+      console.debug(body);
 
-      this.record("DEBUG", message);
+      this.record("DEBUG", body);
 
-      this.emit({
-        body: message,
-        severityNumber: SeverityNumber.DEBUG,
-        attributes,
-      });
+      this.emitRedacted(body, SeverityNumber.DEBUG, attributes);
     }
   }
 
@@ -229,6 +295,19 @@ export default class logger {
     severityNumber: SeverityNumber;
     attributes?: LogAttributes | undefined;
   }): void {
+    this.emitRedacted(
+      this.redactBody(data.body),
+      data.severityNumber,
+      data.attributes,
+    );
+  }
+
+  // `body` must already have been through redactBody.
+  private static emitRedacted(
+    body: LogBody,
+    severityNumber: SeverityNumber,
+    attributes?: LogAttributes | undefined,
+  ): void {
     try {
       const logger: TelemetryLogger | null = OneUptimeTelemetry.getLogger();
 
@@ -243,7 +322,7 @@ export default class logger {
        */
       const mergedAttributes: LogAttributes = {
         ...TelemetryContext.getAttributes(),
-        ...(data.attributes || {}),
+        ...(attributes || {}),
       };
 
       const sanitizedAttributes:
@@ -251,8 +330,8 @@ export default class logger {
         | undefined = this.sanitizeAttributes(mergedAttributes);
 
       logger.emit({
-        body: this.serializeLogBody(data.body),
-        severityNumber: data.severityNumber,
+        body: this.serializeRedactedBody(body),
+        severityNumber: severityNumber,
         ...(sanitizedAttributes ? { attributes: sanitizedAttributes } : {}),
       });
     } catch {
@@ -264,16 +343,14 @@ export default class logger {
     const logLevel: ConfigLogLevel = this.getLogLevel();
 
     if (logLevel === ConfigLogLevel.DEBUG) {
+      const body: LogBody = this.redactBody(message);
+
       // eslint-disable-next-line no-console
-      console.trace(message);
+      console.trace(body);
 
-      this.record("TRACE", message);
+      this.record("TRACE", body);
 
-      this.emit({
-        body: message,
-        severityNumber: SeverityNumber.DEBUG,
-        attributes,
-      });
+      this.emitRedacted(body, SeverityNumber.DEBUG, attributes);
     }
   }
 }

package/Server/Utils/Monitor/Criteria/IncomingRequestCriteria.ts

@@ -160,36 +160,33 @@ export default class IncomingRequestCriteria {
     }
 
     if (input.criteriaFilter.checkOn === CheckOn.RequestBody) {
-      let responseBody: string | JSONObject | undefined = (
+      let requestBody: string | JSONObject | undefined = (
         input.dataToProcess as IncomingMonitorRequest
       ).requestBody;
 
-      if (responseBody && typeof responseBody === Typeof.Object) {
-        responseBody = JSON.stringify(responseBody);
+      if (requestBody && typeof requestBody === Typeof.Object) {
+        requestBody = JSON.stringify(requestBody);
       }
 
-      if (!responseBody) {
-        return null;
-      }
+      /*
+       * A request that carried no body is an empty body, not an unknown one.
+       * Normalising to "" (the same thing IncomingEmailCriteria does for the
+       * email fields) is what lets a "Not Contains" filter match a bodiless
+       * heartbeat ping - the default online criteria for this monitor type.
+       * "Contains" is unaffected: "" contains nothing.
+       */
+      const body: string = (requestBody as string | undefined) || "";
 
       // contains
       if (input.criteriaFilter.filterType === FilterType.Contains) {
-        if (
-          value &&
-          responseBody &&
-          (responseBody as string).includes(value as string)
-        ) {
+        if (value && body.includes(value as string)) {
           return `Request body contains ${value}.`;
         }
         return null;
       }
 
       if (input.criteriaFilter.filterType === FilterType.NotContains) {
-        if (
-          value &&
-          responseBody &&
-          !(responseBody as string).includes(value as string)
-        ) {
+        if (value && !body.includes(value as string)) {
           return `Request body does not contain ${value}.`;
         }
         return null;

package/Server/Utils/Monitor/Criteria/SSLMonitorCriteria.ts

@@ -78,16 +78,8 @@ export default class ServerMonitorCriteria {
     }
 
     if (input.criteriaFilter.checkOn === CheckOn.IsValidCertificate) {
-      const isValidCertificate: boolean = Boolean(
-        sslResponse &&
-          dataToProcess.isOnline &&
-          sslResponse.expiresAt &&
-          !sslResponse.isSelfSigned &&
-          OneUptimeDate.isAfter(
-            sslResponse.expiresAt,
-            OneUptimeDate.getCurrentDate(),
-          ),
-      );
+      const isValidCertificate: boolean =
+        ServerMonitorCriteria.isValidCertificate(dataToProcess);
 
       const isTrue: boolean =
         input.criteriaFilter.filterType === FilterType.True;
@@ -100,7 +92,7 @@ export default class ServerMonitorCriteria {
       }
 
       if (!isValidCertificate && isFalse) {
-        return "SSL certificate is not valid.";
+        return ServerMonitorCriteria.invalidCertificateReason(dataToProcess);
       }
     }
 
@@ -149,18 +141,19 @@ export default class ServerMonitorCriteria {
     }
 
     if (input.criteriaFilter.checkOn === CheckOn.IsNotAValidCertificate) {
+      /*
+       * The exact complement of IsValidCertificate, by construction.
+       *
+       * These two used to be computed independently, and both came out
+       * false whenever expiresAt was missing or unparseable - so a
+       * certificate the probe could not fully read satisfied NEITHER
+       * "valid" nor "not valid", every criterion went unmatched, and the
+       * monitor silently stayed at its default status. Deriving one from
+       * the other makes that state unreachable.
+       */
       const isNotValid: boolean =
-        !sslResponse ||
-        !dataToProcess.isOnline ||
-        Boolean(
-          sslResponse &&
-            sslResponse.expiresAt &&
-            (sslResponse.isSelfSigned ||
-              OneUptimeDate.isBefore(
-                sslResponse.expiresAt,
-                OneUptimeDate.getCurrentDate(),
-              )),
-        );
+        !ServerMonitorCriteria.isValidCertificate(dataToProcess);
+
       const isTrue: boolean =
         input.criteriaFilter.filterType === FilterType.True;
 
@@ -168,7 +161,7 @@ export default class ServerMonitorCriteria {
         input.criteriaFilter.filterType === FilterType.False;
 
       if (isNotValid && isTrue) {
-        return "SSL certificate is not valid.";
+        return ServerMonitorCriteria.invalidCertificateReason(dataToProcess);
       }
 
       if (!isNotValid && isFalse) {
@@ -230,4 +223,82 @@ export default class ServerMonitorCriteria {
 
     return null;
   }
+
+  /*
+   * The single source of truth for "is this certificate trustworthy",
+   * shared by IsValidCertificate and IsNotAValidCertificate so the two can
+   * never both be false for the same response.
+   *
+   * The probe now records the strict-TLS verdict explicitly on
+   * sslResponse.isValidCertificate. Responses written before that field
+   * existed (rows already in MonitorProbe.lastMonitoringLog, and any probe
+   * still running an older build) do not carry it, so the pre-existing
+   * heuristic is kept as the fallback rather than treating those as
+   * invalid and flipping healthy monitors to Down on upgrade.
+   */
+  private static isValidCertificate(
+    dataToProcess: ProbeMonitorResponse,
+  ): boolean {
+    const sslResponse: SslMonitorResponse | undefined =
+      dataToProcess.sslResponse;
+
+    if (!sslResponse || !dataToProcess.isOnline) {
+      return false;
+    }
+
+    if (sslResponse.isValidCertificate !== undefined) {
+      return Boolean(sslResponse.isValidCertificate);
+    }
+
+    // Legacy payload: fall back to what could be inferred before.
+    return Boolean(
+      sslResponse.expiresAt &&
+        !sslResponse.isSelfSigned &&
+        OneUptimeDate.isAfter(
+          sslResponse.expiresAt,
+          OneUptimeDate.getCurrentDate(),
+        ),
+    );
+  }
+
+  /*
+   * Names WHY the certificate is not trustworthy. The root cause is what
+   * reaches the incident and the person paged by it, so "SSL certificate is
+   * not valid" on its own is not good enough when the probe knows it was a
+   * hostname mismatch.
+   */
+  private static invalidCertificateReason(
+    dataToProcess: ProbeMonitorResponse,
+  ): string {
+    const sslResponse: SslMonitorResponse | undefined =
+      dataToProcess.sslResponse;
+
+    if (!dataToProcess.isOnline) {
+      return "SSL certificate could not be checked because the endpoint is not reachable.";
+    }
+
+    if (!sslResponse) {
+      return "SSL certificate is not valid.";
+    }
+
+    if (sslResponse.certificateValidationError) {
+      return `SSL certificate is not valid: ${sslResponse.certificateValidationError}`;
+    }
+
+    if (sslResponse.isSelfSigned) {
+      return "SSL certificate is not valid: the certificate is self signed.";
+    }
+
+    if (
+      sslResponse.expiresAt &&
+      OneUptimeDate.isBefore(
+        sslResponse.expiresAt,
+        OneUptimeDate.getCurrentDate(),
+      )
+    ) {
+      return "SSL certificate is not valid: the certificate has expired.";
+    }
+
+    return "SSL certificate is not valid.";
+  }
 }

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -24,11 +24,11 @@ import NetworkDeviceOwnerUserService, {
 import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import DataToProcess from "./DataToProcess";
-import MonitorClusterContextUtil, {
-  MonitorClusterContext,
-} from "./MonitorClusterContext";
+import MonitorResourceContextUtil from "./MonitorResourceContext";
 import MonitorTemplateUtil from "./MonitorTemplateUtil";
-import SeriesResourceLinker from "./SeriesResourceLinker";
+import SeriesResourceLinker, {
+  SeriesResolvedResourceIds,
+} from "./SeriesResourceLinker";
 import MonitorDependencySuppression, {
   DependencySuppressionResult,
 } from "./MonitorDependencySuppression";
@@ -322,15 +322,17 @@ export default class MonitorAlert {
     }
 
     /*
-     * Proxmox/Ceph monitors: resolve the monitored cluster once per
-     * evaluation (lookup-only, from the step config's clusterIdentifier)
-     * so every alert created below is attached to it. Series labels
-     * cannot supply this — they carry datapoint labels (`id`,
-     * `ceph_daemon`, `pool_id`), not cluster identity, and ungrouped
-     * templates have no series at all. No-op for other monitor types.
+     * Resolve the resources this monitor's own config names — its host,
+     * cluster, fleet, telemetry services, or the resource its metric
+     * filters scope it to — once per evaluation, so every alert created
+     * below is attached to them. Series labels cannot supply this: they
+     * only exist for grouped criteria, and most monitors (every shipped
+     * Host/Docker/Podman template, all Logs/Traces/Exceptions monitors)
+     * are ungrouped. No-op, and no round-trip, for monitor types whose
+     * config names no resource.
      */
-    const clusterContext: MonitorClusterContext =
-      await MonitorClusterContextUtil.resolveClusterContextForMonitor({
+    const resourceContext: SeriesResolvedResourceIds =
+      await MonitorResourceContextUtil.resolveResourceContextForMonitor({
         monitor: input.monitor,
       });
 
@@ -556,21 +558,22 @@ export default class MonitorAlert {
             model: alert,
             seriesLabels,
             projectId: input.monitor.projectId!,
+            monitorType: input.monitor.monitorType,
           });
         }
 
         /*
-         * Deterministic Proxmox/Ceph/Swarm/IoT cluster link from the
-         * monitor's step config (resolved once above). The shipped
-         * templates for those monitor types group by datapoint labels
-         * that carry no cluster identity, so this — not the label path
-         * above — is what makes the per-cluster Activity tabs and badge
-         * counts see monitor-created alerts. Runs for both grouped and
-         * ungrouped alerts, and merges with whatever the labels resolved.
+         * Deterministic resource link from the monitor's step config
+         * (resolved once above). For most monitor types this — not the
+         * label path above — is what makes the per-resource Activity
+         * tabs and badge counts see monitor-created alerts, because
+         * their criteria are ungrouped and emit no series labels at
+         * all. Runs for both grouped and ungrouped alerts, and merges
+         * with whatever the labels resolved.
          */
-        SeriesResourceLinker.attachClusterContext({
+        SeriesResourceLinker.attachResolvedResources({
           model: alert,
-          clusterContext,
+          resolved: resourceContext,
         });
 
         alert.onCallDutyPolicies =

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -37,10 +37,10 @@ import MonitorSummarySnapshot from "../../../Types/Monitor/MonitorSummarySnapsho
 import MonitorSummarySnapshotUtil from "../../../Utils/Monitor/MonitorSummarySnapshotUtil";
 import { IncidentMemberRoleAssignment } from "../../../Types/Monitor/CriteriaIncident";
 import { PerSeriesCriteriaMatch } from "../../../Types/Probe/ProbeApiIngestResponse";
-import MonitorClusterContextUtil, {
-  MonitorClusterContext,
-} from "./MonitorClusterContext";
-import SeriesResourceLinker from "./SeriesResourceLinker";
+import MonitorResourceContextUtil from "./MonitorResourceContext";
+import SeriesResourceLinker, {
+  SeriesResolvedResourceIds,
+} from "./SeriesResourceLinker";
 
 export default class MonitorIncident {
   @CaptureSpan()
@@ -364,15 +364,17 @@ export default class MonitorIncident {
     }
 
     /*
-     * Proxmox/Ceph monitors: resolve the monitored cluster once per
-     * evaluation (lookup-only, from the step config's clusterIdentifier)
-     * so every incident created below is attached to it. Series labels
-     * cannot supply this — they carry datapoint labels (`id`,
-     * `ceph_daemon`, `pool_id`), not cluster identity, and ungrouped
-     * templates have no series at all. No-op for other monitor types.
+     * Resolve the resources this monitor's own config names — its host,
+     * cluster, fleet, telemetry services, or the resource its metric
+     * filters scope it to — once per evaluation, so every incident
+     * created below is attached to them. Series labels cannot supply
+     * this: they only exist for grouped criteria, and most monitors
+     * (every shipped Host/Docker/Podman template, all Logs/Traces/
+     * Exceptions monitors) are ungrouped. No-op, and no round-trip, for
+     * monitor types whose config names no resource.
      */
-    const clusterContext: MonitorClusterContext =
-      await MonitorClusterContextUtil.resolveClusterContextForMonitor({
+    const resourceContext: SeriesResolvedResourceIds =
+      await MonitorResourceContextUtil.resolveResourceContextForMonitor({
         monitor: input.monitor,
       });
 
@@ -656,19 +658,20 @@ export default class MonitorIncident {
             model: incident,
             seriesLabels,
             projectId: input.monitor.projectId!,
+            monitorType: input.monitor.monitorType,
           });
         }
 
         /*
-         * Deterministic Proxmox/Ceph cluster link from the monitor's
-         * step config (resolved once above). Runs for both grouped and
-         * ungrouped incidents and merges with anything the series-label
-         * path resolved, so the per-cluster Activity tabs always see
+         * Deterministic resource link from the monitor's step config
+         * (resolved once above). Runs for both grouped and ungrouped
+         * incidents and merges with anything the series-label path
+         * resolved, so the per-resource Activity tabs always see
          * monitor-created incidents.
          */
-        SeriesResourceLinker.attachClusterContext({
+        SeriesResourceLinker.attachResolvedResources({
           model: incident,
-          clusterContext,
+          resolved: resourceContext,
         });
 
         incident.onCallDutyPolicies =

package/Server/Utils/Monitor/MonitorResource.ts

@@ -636,7 +636,16 @@ export default class MonitorResourceUtil {
         }
       }
 
-      const monitorStep: MonitorStep | undefined =
+      /*
+       * The step this result was actually produced for. A probe result carries
+       * the monitorStepId it ran, and a monitor can have several steps whose
+       * criteria differ - so the step must be looked up, not assumed to be the
+       * first one. The lookup used to be performed and its result thrown away,
+       * which silently evaluated every result against step 0's criteria and fed
+       * step 0's id into checkProbeAgreement (so agreement compared this
+       * result against other probes' logs for the wrong step).
+       */
+      let monitorStep: MonitorStep | undefined =
         monitorSteps.data.monitorStepsInstanceArray[0];
 
       logger.debug(
@@ -644,14 +653,25 @@ export default class MonitorResourceUtil {
       );
 
       if ((dataToProcess as ProbeMonitorResponse).monitorStepId) {
-        monitorSteps.data.monitorStepsInstanceArray.find(
-          (monitorStep: MonitorStep) => {
-            return (
-              monitorStep.id.toString() ===
-              (dataToProcess as ProbeMonitorResponse).monitorStepId.toString()
-            );
-          },
-        );
+        const ingestedMonitorStep: MonitorStep | undefined =
+          monitorSteps.data.monitorStepsInstanceArray.find(
+            (step: MonitorStep) => {
+              return (
+                step.id.toString() ===
+                (dataToProcess as ProbeMonitorResponse).monitorStepId.toString()
+              );
+            },
+          );
+
+        /*
+         * An id that matches no step is stale - the step was deleted after the
+         * probe was scheduled. Keep the existing behaviour there and fall back
+         * to the first step rather than dropping the result.
+         */
+        if (ingestedMonitorStep) {
+          monitorStep = ingestedMonitorStep;
+        }
+
         logger.debug(
           `Found Monitor Step ID: ${(dataToProcess as ProbeMonitorResponse).monitorStepId}`,
         );