@oneuptime/common 12.0.13 → 12.0.14

package/Models/DatabaseModels/OnCallDutyPolicySchedule.ts

@@ -588,6 +588,20 @@ export default class OnCallDutyPolicySchedule extends BaseModel {
   })
   @TableColumn({
     type: TableColumnType.ObjectID,
+    /*
+     * Read through a relation, alongside `name`, so a joined schedule row can
+     * say whether it would page anybody right now. An escalation rule lists
+     * schedules by name and has to mark the ones that are currently uncovered;
+     * that is one join away from the rule, and without this flag
+     * QueryPermission rejects the whole select rather than dropping the column
+     * - the escalation rule page fails to load at all.
+     *
+     * The disclosure is a user id belonging to the same project as the
+     * schedule, to a caller who is already reading the schedule's name off the
+     * same joined row. It is not an @OwnerOnlyColumn: who is on call is
+     * operational state the team is meant to see, not a personal credential.
+     */
+    canReadOnRelationQuery: true,
     title: "Current User ID On Roster",
     description: "User ID who is currently on roster",
     example: "c3d4e5f6-a7b8-9012-cdef-123456789012",

package/Models/DatabaseModels/UserCall.ts

@@ -315,15 +315,27 @@ class UserCall extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -331,6 +343,85 @@ class UserCall extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserCall;

package/Models/DatabaseModels/UserEmail.ts

@@ -318,15 +318,27 @@ class UserEmail extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -334,6 +346,85 @@ class UserEmail extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserEmail;

package/Models/DatabaseModels/UserIncomingCallNumber.ts

@@ -275,15 +275,27 @@ class UserIncomingCallNumber extends BaseModel {
   })
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -291,6 +303,85 @@ class UserIncomingCallNumber extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserIncomingCallNumber;

package/Models/DatabaseModels/UserPush.ts

@@ -346,6 +346,43 @@ class UserPush extends BaseModel {
     default: false,
   })
   public isVerified?: boolean = undefined;
+
+  /*
+   * Whether this handset should be paged through silent mode and Do Not
+   * Disturb when it is on call. Per DEVICE and not per user on purpose: the
+   * responder's work phone on the nightstand and their tablet on the sofa are
+   * the same person making two different decisions, and only the phone should
+   * be allowed to wake the house.
+   *
+   * Off unless the responder turns it on from that device. It is the one
+   * setting in this product that deliberately defeats the switch a person
+   * flicked to be left alone, so it is opted into rather than out of, and the
+   * app only offers it once the OS has actually granted the capability
+   * (the iOS critical-alert entitlement, or Do Not Disturb access on Android).
+   *
+   * `update` is empty like every other column here: the value is written by
+   * UserPushAPI's critical-alerts route, which checks the row belongs to the
+   * caller and then writes as root. That keeps "who may change this" in one
+   * readable place rather than spread across the generic CRUD surface.
+   */
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    title: "Critical Alerts Enabled",
+    description:
+      "Should on-call notifications to this device override silent mode and Do Not Disturb?",
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    defaultValue: false,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public isCriticalAlertEnabled?: boolean = undefined;
 }
 
 export default UserPush;

package/Models/DatabaseModels/UserSMS.ts

@@ -317,15 +317,27 @@ class UserSMS extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -333,6 +345,85 @@ class UserSMS extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserSMS;

package/Models/DatabaseModels/UserWhatsApp.ts

@@ -309,13 +309,25 @@ class UserWhatsApp extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
   })
   @Column({
@@ -324,6 +336,85 @@ class UserWhatsApp extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserWhatsApp;