@oneuptime/common 12.0.12 → 12.0.14

package/Models/DatabaseModels/UserSMS.ts

@@ -317,15 +317,27 @@ class UserSMS extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -333,6 +345,85 @@ class UserSMS extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserSMS;

package/Models/DatabaseModels/UserWhatsApp.ts

@@ -309,13 +309,25 @@ class UserWhatsApp extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
   })
   @Column({
@@ -324,6 +336,85 @@ class UserWhatsApp extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserWhatsApp;

package/Models/DatabaseModels/WorkspaceProjectAuthToken.ts

@@ -45,9 +45,26 @@ export interface MicrosoftTeamsChat {
  * roster member of. Listing a team is therefore NOT evidence that we can post
  * to it — this record is, which is why channel sends check it before calling
  * the Bot Framework.
+ *
+ * A Teams team has TWO ids and they are not interchangeable. Bot activities
+ * carry the thread id (channelData.team.id, "19:...@thread.tacv2"); Graph — and
+ * therefore every team picker, notification rule and channel URL in OneUptime —
+ * uses the AAD group id (a GUID, channelData.team.aadGroupId). Records used to
+ * be keyed by the thread id and looked up by the group id, so the lookup could
+ * never hit. Both are stored explicitly now so neither side has to guess which
+ * one it holds.
  */
 export interface MicrosoftTeamsInstalledTeam {
-  id: string; // Teams team (group) id.
+  /*
+   * Map key. The Graph team id when we could resolve it, otherwise the Teams
+   * thread id — a record written before this shipped, or one whose group id
+   * could not be resolved, keeps the thread id here so uninstall still matches.
+   * Read it through MicrosoftTeamsUtil.indexInstalledTeamsByGraphTeamId rather
+   * than assuming which id space it is in.
+   */
+  id: string;
+  graphTeamId?: string | undefined; // AAD group id — what Graph and notification rules use. Absent on unresolved records.
+  teamsThreadId?: string | undefined; // channelData.team.id ("19:...@thread.tacv2") — what bot activities carry.
   name?: string | undefined;
   serviceUrl?: string | undefined; // Bot Framework service URL captured on install. Required for GCC/DoD.
   addedAt?: string | undefined;
@@ -79,7 +96,7 @@ export interface MicrosoftTeamsMiscData extends MiscData {
   availableTeams?: Record<string, MicrosoftTeamsTeam>; // keyed by team id. Every team Graph can see in the tenant.
   appAccessTokenExpiresAt?: string;
   availableChats?: Record<string, MicrosoftTeamsChat>; // keyed by chat id. Chats the OneUptime app has been added to.
-  installedTeams?: Record<string, MicrosoftTeamsInstalledTeam>; // keyed by team id. Teams the OneUptime app has been added to.
+  installedTeams?: Record<string, MicrosoftTeamsInstalledTeam>; // keyed by MicrosoftTeamsInstalledTeam.id — see that type, the key is not always a Graph team id.
 }
 
 export type WorkspaceMiscData = SlackMiscData | MicrosoftTeamsMiscData;

package/Server/API/AIChatAPI.ts

@@ -9,7 +9,6 @@ import Express, {
 import Response from "../Utils/Response";
 import BadDataException from "../../Types/Exception/BadDataException";
 import PaymentRequiredException from "../../Types/Exception/PaymentRequiredException";
-import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
@@ -89,18 +88,16 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
-
-      const projectId: ObjectID = props.tenantId;
-      const userId: ObjectID = props.userId;
+      /*
+       * Membership, not just a session. getUserMiddleware admits an
+       * unauthenticated request as "public" and reads the tenant id straight
+       * out of the caller-supplied `tenantid` header, so the pair of checks
+       * this replaces proved only that SOMEBODY was logged in and had named
+       * SOME project - never that they belonged to the project they named.
+       */
+      const projectId: ObjectID =
+        CommonAPI.assertAuthenticatedProjectMember(props);
+      const userId: ObjectID = props.userId!;
 
       const content: string = (req.body["content"] as string) || "";
 
@@ -502,17 +499,30 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
+      /*
+       * Membership, not just a session - see the note on send-message. This
+       * route is where that distinction was load-bearing: it took the project
+       * id straight from the header and handed it to root-privileged reads,
+       * so any logged-in user could name ANY project's UUID and be told which
+       * LLM providers that project has - their names, descriptions, types and
+       * models (GHSA-hm7m-9qjj-xj5x).
+       */
+      const projectId: ObjectID =
+        CommonAPI.assertAuthenticatedProjectMember(props);
 
-      const projectId: ObjectID = props.tenantId;
+      /*
+       * Membership is still not read authorisation. The very same rows served
+       * by a plain GET /llm-provider are gated there by LlmProvider's own read
+       * list, and a member whose teams grant none of those permissions has no
+       * business reading them through the chat picker instead. Asking the
+       * model for that list keeps the two paths from drifting apart.
+       */
+      CommonAPI.assertPermittedInProject({
+        databaseProps: props,
+        allowedPermissions: new LlmProvider().getReadPermissions(),
+        errorMessage:
+          "You do not have permission to read this project's AI providers.",
+      });
 
       const [providers, defaultProvider]: [
         Array<LlmProvider>,
@@ -561,18 +571,16 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
-
-      const projectId: ObjectID = props.tenantId;
-      const userId: ObjectID = props.userId;
+      /*
+       * Membership, not just a session. getUserMiddleware admits an
+       * unauthenticated request as "public" and reads the tenant id straight
+       * out of the caller-supplied `tenantid` header, so the pair of checks
+       * this replaces proved only that SOMEBODY was logged in and had named
+       * SOME project - never that they belonged to the project they named.
+       */
+      const projectId: ObjectID =
+        CommonAPI.assertAuthenticatedProjectMember(props);
+      const userId: ObjectID = props.userId!;
 
       const conversationIdString: string = req.body["conversationId"] as string;
       const assistantMessageIdString: string = req.body[
@@ -743,18 +751,16 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
-
-      const projectId: ObjectID = props.tenantId;
-      const userId: ObjectID = props.userId;
+      /*
+       * Membership, not just a session. getUserMiddleware admits an
+       * unauthenticated request as "public" and reads the tenant id straight
+       * out of the caller-supplied `tenantid` header, so the pair of checks
+       * this replaces proved only that SOMEBODY was logged in and had named
+       * SOME project - never that they belonged to the project they named.
+       */
+      const projectId: ObjectID =
+        CommonAPI.assertAuthenticatedProjectMember(props);
+      const userId: ObjectID = props.userId!;
 
       const conversationIdString: string = req.body["conversationId"] as string;
 
@@ -913,15 +919,8 @@ router.post(
       const props: DatabaseCommonInteractionProps =
         await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-      if (!props.userId) {
-        throw new NotAuthorizedException(
-          "AI chat requires a logged-in user session.",
-        );
-      }
-
-      if (!props.tenantId) {
-        throw new BadDataException("Project ID is required (tenantid header).");
-      }
+      // Membership, not just a session - see the note on send-message.
+      CommonAPI.assertAuthenticatedProjectMember(props);
 
       const messageIdString: string = req.body["messageId"] as string;
 

package/Server/API/BaseAPI.ts

@@ -298,20 +298,85 @@ export default class BaseAPI<
     const databaseProps: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    const list: Array<BaseModel> = await this.service.findBy({
-      query,
-      select,
-      skip: skip,
-      limit: limit,
-      groupBy: groupBy,
-      sort: sort,
-      props: databaseProps,
-    });
-
-    const count: PositiveNumber = await this.service.countBy({
-      query,
-      props: databaseProps,
-    });
+    /*
+     * findBy and countBy are independent reads, so run them in parallel to
+     * cut list latency where the count is costly. The one thing that makes
+     * the sequential order load-bearing is a service-level onBeforeFind
+     * override that mutates the shared query/props objects in place (e.g.
+     * ProjectService elevates props.isRoot and pins query._id for users with
+     * no projects; the incident/alert privacy filters rewrite query keys):
+     * countBy historically ran after findBy and inherited those mutations.
+     * Services on the stock hook cannot mutate anything (and the permission
+     * pipeline copies the query before touching it, ReadPermission.ts:33),
+     * so only they run in parallel; hook-overriding services keep the
+     * sequential order and its exact semantics.
+     */
+    const usesStockOnBeforeFindHook: boolean =
+      (this.service as unknown as { onBeforeFind: unknown }).onBeforeFind ===
+      (DatabaseService.prototype as unknown as { onBeforeFind: unknown })
+        .onBeforeFind;
+
+    let list: Array<BaseModel>;
+    let count: PositiveNumber;
+
+    if (usesStockOnBeforeFindHook) {
+      const listPromise: Promise<Array<BaseModel>> = this.service.findBy({
+        query,
+        select,
+        skip: skip,
+        limit: limit,
+        groupBy: groupBy,
+        sort: sort,
+        props: databaseProps,
+      });
+
+      /*
+       * Shallow copies so a countBy override that rewrites top-level query
+       * keys (the established privacy-filter pattern) can never race the
+       * concurrent findBy's reads of the shared objects.
+       */
+      const countPromise: Promise<PositiveNumber> = this.service.countBy({
+        query: { ...query },
+        props: { ...databaseProps },
+      });
+
+      /*
+       * allSettled instead of Promise.all: a findBy rejection must not leave
+       * countPromise as an unhandled rejection, and findBy's error keeps
+       * priority when both fail - the same failure the sequential code
+       * surfaced.
+       */
+      const [listResult, countResult]: [
+        PromiseSettledResult<Array<BaseModel>>,
+        PromiseSettledResult<PositiveNumber>,
+      ] = await Promise.allSettled([listPromise, countPromise]);
+
+      if (listResult.status === "rejected") {
+        throw listResult.reason;
+      }
+
+      if (countResult.status === "rejected") {
+        throw countResult.reason;
+      }
+
+      list = listResult.value;
+      count = countResult.value;
+    } else {
+      list = await this.service.findBy({
+        query,
+        select,
+        skip: skip,
+        limit: limit,
+        groupBy: groupBy,
+        sort: sort,
+        props: databaseProps,
+      });
+
+      count = await this.service.countBy({
+        query,
+        props: databaseProps,
+      });
+    }
 
     return Response.sendEntityArrayResponse(
       req,

package/Server/API/CommonAPI.ts

@@ -9,6 +9,14 @@ import SpanUtil from "../Utils/Telemetry/SpanUtil";
 import ObjectID from "../../Types/ObjectID";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import Permission, {
+  PermissionHelper,
+  PermissionProps,
+  UserPermission,
+} from "../../Types/Permission";
+import DatabaseCommonInteractionPropsUtil, {
+  PermissionType,
+} from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 
 export default class CommonAPI {
   /*
@@ -132,6 +140,87 @@ export default class CommonAPI {
     }
   }
 
+  /*
+   * Membership is not read authorisation.
+   *
+   * assertAuthenticatedProjectMember proves the caller belongs to the project
+   * they named in the `tenantid` header; it says nothing about WHICH of that
+   * project's data they may see. A custom route that then reads with
+   * `isRoot: true` has skipped the permission check the equivalent CRUD read
+   * would have run, so the route has to make that check itself - otherwise a
+   * member whose teams grant nothing but, say, ReadProjectIncident still reads
+   * everything else the route happens to touch.
+   *
+   * The permissions consulted are the caller's grants in props.tenantId, so
+   * this must be called after assertAuthenticatedProjectMember has confirmed
+   * that tenant is one the caller actually belongs to.
+   *
+   * `allowedPermissions` is normally the model's own declared list, e.g.
+   * `new LlmProvider().getReadPermissions()`, so the custom route stays in
+   * step with the CRUD endpoint for the same data instead of inventing a
+   * second, quietly diverging rule.
+   *
+   * Permissions that are never assigned INSIDE a project are stripped from
+   * that list first. This matters: getUserPermissions merges the caller's
+   * global permissions in, and every caller - including an anonymous one -
+   * carries Permission.Public, which a model's read list very often contains
+   * (LlmProvider has it so the shared global providers stay readable). Left
+   * in, it would make this guard pass for anyone. What remains is the
+   * tenant-assignable subset, which is exactly what a team can grant.
+   *
+   * Stripping can empty the list, and an empty list denies everyone rather
+   * than admitting them - a model whose read access is purely public has no
+   * business behind this guard, and failing closed is the safe direction.
+   *
+   * Master admins bypass, matching every other permission gate in the API.
+   */
+  public static assertPermittedInProject(data: {
+    databaseProps: DatabaseCommonInteractionProps;
+    allowedPermissions: Array<Permission>;
+    errorMessage?: string | undefined;
+  }): void {
+    if (data.databaseProps.isMasterAdmin) {
+      return;
+    }
+
+    const tenantAssignablePermissions: Array<Permission> =
+      PermissionHelper.getTenantPermissionProps().map(
+        (permissionProps: PermissionProps) => {
+          return permissionProps.permission;
+        },
+      );
+
+    const requiredPermissions: Array<Permission> =
+      data.allowedPermissions.filter((permission: Permission) => {
+        return tenantAssignablePermissions.includes(permission);
+      });
+
+    /*
+     * Allow-only: getUserPermissions discriminates grants from denials by
+     * isBlockPermission, so a team's explicit BLOCK row for one of these
+     * permissions must never be counted as a grant of it.
+     */
+    const grantedPermissions: Array<Permission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        data.databaseProps,
+        PermissionType.Allow,
+      ).map((userPermission: UserPermission) => {
+        return userPermission.permission;
+      });
+
+    if (
+      !PermissionHelper.doesPermissionsIntersect(
+        grantedPermissions,
+        requiredPermissions,
+      )
+    ) {
+      throw new NotAuthorizedException(
+        data.errorMessage ||
+          "You do not have permission to access this project's data.",
+      );
+    }
+  }
+
   @CaptureSpan()
   public static async getDatabaseCommonInteractionProps(
     req: ExpressRequest,