@oneuptime/common 12.0.12 → 12.0.14

package/Server/API/TelemetryAPI.ts

@@ -95,6 +95,10 @@ import ResourceFacetResolver, {
   ResolvedFacetValue,
   ResourceFacetSpec,
 } from "../Utils/Telemetry/ResourceFacetResolver";
+import ResourceEntityFilter, {
+  ResourceEntityScope,
+} from "../Utils/Telemetry/ResourceEntityFilter";
+import { ResourceEntityFacetSelections } from "../../Types/Telemetry/ResourceEntityFacet";
 import Label from "../../Models/DatabaseModels/Label";
 import RumApplication from "../../Models/DatabaseModels/RumApplication";
 import RumApplicationService from "../Services/RumApplicationService";
@@ -456,6 +460,9 @@ router.post(
           ? (body["attributes"] as Record<string, string | Array<string>>)
           : undefined;
 
+      const resourceScopes: Array<ResourceEntityScope> | undefined =
+        await resolveResourceScopesFromBody(body, databaseProps.tenantId);
+
       const request: HistogramRequest = {
         projectId: databaseProps.tenantId,
         startTime,
@@ -463,6 +470,7 @@ router.post(
         bucketSizeInMinutes,
         serviceIds,
         entityKeys,
+        resourceScopes,
         severityTexts,
         bodySearchText,
         traceIds,
@@ -573,6 +581,9 @@ router.post(
        */
       const projectId: ObjectID = databaseProps.tenantId;
 
+      const resourceScopes: Array<ResourceEntityScope> | undefined =
+        await resolveResourceScopesFromBody(body, projectId);
+
       /*
        * Run facet queries in parallel so a slow individual facet can't
        * starve the endpoint. Per-facet errors degrade gracefully to [].
@@ -592,6 +603,7 @@ router.post(
                   limit,
                   serviceIds,
                   entityKeys,
+                  resourceScopes,
                   severityTexts,
                   bodySearchText,
                   traceIds,
@@ -656,6 +668,41 @@ router.post(
   },
 );
 
+/**
+ * Resolve the `resourceFilters` field — the explorers' non-Service resource
+ * facet selections (Kubernetes cluster / host / docker host / podman host),
+ * sent as Postgres ids — into the scopes the aggregation services compile.
+ *
+ * Kept out of the sync body parsers because turning an id into an entity
+ * key needs a Postgres round trip: the id names a row whose identifying
+ * value (`clusterIdentifier` / `hostIdentifier`) is what ingest hashed into
+ * `entityKeys`.
+ *
+ * Returns undefined when nothing was selected so the request field stays
+ * absent rather than becoming an empty array.
+ */
+async function resolveResourceScopesFromBody(
+  body: JSONObject,
+  projectId: ObjectID,
+): Promise<Array<ResourceEntityScope> | undefined> {
+  const selections: ResourceEntityFacetSelections =
+    ResourceEntityFilter.parseSelections(
+      body["resourceFilters"] as JSONObject | undefined,
+    );
+
+  if (Object.keys(selections).length === 0) {
+    return undefined;
+  }
+
+  const scopes: Array<ResourceEntityScope> =
+    await ResourceEntityFilter.resolveScopes({
+      projectId,
+      selections,
+    });
+
+  return scopes.length > 0 ? scopes : undefined;
+}
+
 /*
  * Shared body parsing for every trace aggregation endpoint (histogram,
  * facets, analytics). Defensive about shapes: arrays are validated and
@@ -844,7 +891,13 @@ router.post(
         (body["bucketSizeInMinutes"] as number) ||
         computeDefaultBucketSize(startTime, endTime);
 
-      const traceFilters: TraceFilters = parseTraceFilterBody(body);
+      const traceFilters: TraceFilters = {
+        ...parseTraceFilterBody(body),
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+      };
 
       const request: TraceHistogramRequest = {
         projectId: databaseProps.tenantId,
@@ -904,7 +957,13 @@ router.post(
 
       const limit: number = (body["limit"] as number) || 500;
 
-      const traceFilters: TraceFilters = parseTraceFilterBody(body);
+      const traceFilters: TraceFilters = {
+        ...parseTraceFilterBody(body),
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+      };
 
       /*
        * Per-facet partial-match filter applied at the Postgres source-of-truth
@@ -1195,7 +1254,13 @@ router.post(
         ? Math.min(Math.max(Math.trunc(rawLimit), 1), 1000)
         : undefined;
 
-      const traceFilters: TraceFilters = parseTraceFilterBody(body);
+      const traceFilters: TraceFilters = {
+        ...parseTraceFilterBody(body),
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+      };
 
       const request: TraceAnalyticsRequest = {
         projectId: databaseProps.tenantId,
@@ -1800,6 +1865,9 @@ router.post(
         ? (body["limit"] as number)
         : undefined;
 
+      const resourceScopes: Array<ResourceEntityScope> | undefined =
+        await resolveResourceScopesFromBody(body, databaseProps.tenantId);
+
       const request: AnalyticsRequest = {
         projectId: databaseProps.tenantId,
         startTime,
@@ -1810,6 +1878,7 @@ router.post(
         aggregation,
         aggregationField,
         serviceIds,
+        resourceScopes,
         severityTexts,
         bodySearchText,
         traceIds,

package/Server/API/UserCallAPI.ts

@@ -1,22 +1,44 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserCallService, {
   Service as UserCallServiceType,
 } from "../Services/UserCallService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserCall from "../../Models/DatabaseModels/UserCall";
-import UserSMS from "../../Models/DatabaseModels/UserSMS";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserCallAPI extends BaseAPI<
   UserCall,
   UserCallServiceType
@@ -27,6 +49,9 @@ export default class UserCallAPI extends BaseAPI<
     this.router.post(
       `/user-call/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -47,33 +72,10 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the phone number.
-          const item: UserSMS | null = await this.service.findOneById({
-            id: req.body["itemId"],
-            props: {
-              isRoot: true,
-            },
-            select: {
-              userId: true,
-              projectId: true,
-              verificationCode: true,
-            },
-          });
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
-
-          //check user id
-
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -81,32 +83,30 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
-          // Create default notification rules for this verified call number
+          /* Create default notification rules for this verified call number */
           try {
             await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
               {
-                projectId: new ObjectID(item.projectId!.toString()),
-                userId: new ObjectID(item.userId!.toString()),
+                projectId: new ObjectID(result.projectId!.toString()),
+                userId: new ObjectID(result.userId!.toString()),
                 notificationMethod: {
-                  userCallId: item.id!,
+                  userCallId: result.itemId!,
                 },
               },
             );
@@ -127,6 +127,9 @@ export default class UserCallAPI extends BaseAPI<
     this.router.post(
       `/user-call/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -157,6 +160,11 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()

package/Server/API/UserEmailAPI.ts

@@ -1,21 +1,44 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserEmailService, {
   Service as UserEmailServiceType,
 } from "../Services/UserEmailService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserEmail from "../../Models/DatabaseModels/UserEmail";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserEmailAPI extends BaseAPI<
   UserEmail,
   UserEmailServiceType
@@ -26,6 +49,9 @@ export default class UserEmailAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -46,33 +72,10 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the email.
-          const item: UserEmail | null = await this.service.findOneById({
-            id: req.body["itemId"],
-            props: {
-              isRoot: true,
-            },
-            select: {
-              userId: true,
-              projectId: true,
-              verificationCode: true,
-            },
-          });
-
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
-
-          //check user id
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -80,32 +83,30 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
-          // Create default notification rules for this verified email
+          /* Create default notification rules for this verified email */
           try {
             await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
               {
-                projectId: new ObjectID(item.projectId!.toString()),
-                userId: new ObjectID(item.userId!.toString()),
+                projectId: new ObjectID(result.projectId!.toString()),
+                userId: new ObjectID(result.userId!.toString()),
                 notificationMethod: {
-                  userEmailId: item.id!,
+                  userEmailId: result.itemId!,
                 },
               },
             );
@@ -128,6 +129,9 @@ export default class UserEmailAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -158,6 +162,11 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()

package/Server/API/UserIncomingCallNumberAPI.ts

@@ -1,4 +1,7 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserIncomingCallNumberService, {
   Service as UserIncomingCallNumberServiceType,
 } from "../Services/UserIncomingCallNumberService";
@@ -8,11 +11,32 @@ import {
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
 import UserIncomingCallNumber from "../../Models/DatabaseModels/UserIncomingCallNumber";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserIncomingCallNumberAPI extends BaseAPI<
   UserIncomingCallNumber,
   UserIncomingCallNumberServiceType
@@ -23,6 +47,9 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
     this.router.post(
       `/user-incoming-call-number/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -43,32 +70,10 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the phone number
-          const item: UserIncomingCallNumber | null =
-            await this.service.findOneById({
-              id: req.body["itemId"],
-              props: {
-                isRoot: true,
-              },
-              select: {
-                userId: true,
-                verificationCode: true,
-              },
-            });
-
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          // Check user ID
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -76,24 +81,22 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
           return Response.sendEmptySuccessResponse(req, res);
         } catch (err) {
           return next(err);
@@ -104,6 +107,9 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
     this.router.post(
       `/user-incoming-call-number/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -135,7 +141,11 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          // Check user ID
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()