@oneuptime/common 12.0.13 → 12.0.14

package/Server/Utils/Monitor/SeriesResourceLinker.ts

@@ -10,6 +10,7 @@ import Service from "../../../Models/DatabaseModels/Service";
 import Includes from "../../../Types/BaseDatabase/Includes";
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 import { JSONObject } from "../../../Types/JSON";
+import MonitorType from "../../../Types/Monitor/MonitorType";
 import ObjectID from "../../../Types/ObjectID";
 import CephClusterService from "../../Services/CephClusterService";
 import DockerHostService from "../../Services/DockerHostService";
@@ -20,11 +21,18 @@ import KubernetesClusterService from "../../Services/KubernetesClusterService";
 import PodmanHostService from "../../Services/PodmanHostService";
 import ProxmoxClusterService from "../../Services/ProxmoxClusterService";
 import ServiceService from "../../Services/ServiceService";
-import { MonitorClusterContext } from "./MonitorClusterContext";
+import QueryHelper from "../../Types/Database/QueryHelper";
 import SeriesResourceLabels, {
   SeriesResourceRefs,
 } from "./SeriesResourceLabels";
 
+/*
+ * How a resource's NAME is matched against its identifier column.
+ * Ingest-written series labels match byte for byte; user-typed monitor
+ * step identifiers may differ from the agent-stamped name by case.
+ */
+export type NameMatchMode = "exact" | "caseInsensitive";
+
 /*
  * A grouped monitor opens one alert/incident per breaching series, and
  * each series carries the identity of the resource it came from in its
@@ -100,11 +108,61 @@ export default class SeriesResourceLinker {
   public static async resolveResourcesFromSeriesLabels(input: {
     seriesLabels: JSONObject;
     projectId: ObjectID;
+    /*
+     * Optional, and only consulted to disambiguate `host.name`. Left
+     * undefined by callers that have no monitor in hand.
+     */
+    monitorType?: MonitorType | undefined;
   }): Promise<SeriesResolvedResourceIds> {
     const refs: SeriesResourceRefs = SeriesResourceLabels.extractResourceRefs(
       input.seriesLabels,
     );
 
+    /*
+     * On a Docker or Podman monitor, `resource.host.name` names the
+     * DockerHost / PodmanHost the containers run on — the agent stamps
+     * the container runtime's host under the generic key. The label key
+     * map hands that key to Host, which would attach an unrelated Host
+     * row and surface the event on that host's Activity tab. The
+     * step-config path links the right model instead
+     * (MonitorStepResourceIdentity), so drop the host refs here rather
+     * than linking a resource the event is not about.
+     */
+    if (
+      input.monitorType === MonitorType.Docker ||
+      input.monitorType === MonitorType.Podman
+    ) {
+      refs.hostIds = [];
+      refs.hostNames = [];
+    }
+
+    /*
+     * Series labels are ingest-written, so they match the resource
+     * rows' identifier columns byte for byte. See resolveResourceIds
+     * for why that rules out case-insensitive matching here.
+     */
+    return this.resolveResourceRefs({
+      refs: refs,
+      projectId: input.projectId,
+      nameMatch: "exact",
+    });
+  }
+
+  /*
+   * The one place that turns identifiers into database ids, shared by
+   * the series-label path and the monitor-step-config path
+   * (MonitorStepResourceIdentity). Keeping the nine-way lookup table,
+   * the project scoping and the `Includes` batching in a single
+   * function is what stops the two paths from resolving the same
+   * identifier to different rows.
+   */
+  public static async resolveResourceRefs(input: {
+    refs: SeriesResourceRefs;
+    projectId: ObjectID;
+    nameMatch: NameMatchMode;
+  }): Promise<SeriesResolvedResourceIds> {
+    const refs: SeriesResourceRefs = input.refs;
+
     /*
      * Proxmox / Ceph / Docker Swarm / IoT carry no `oneuptime.*.id`
      * stamp at ingest — they are addressable by name only — so their
@@ -186,6 +244,7 @@ export default class SeriesResourceLinker {
           names: spec.names,
           nameColumn: spec.nameColumn,
           projectId: input.projectId,
+          nameMatch: input.nameMatch,
           findBy: spec.findBy,
         });
       }),
@@ -206,9 +265,10 @@ export default class SeriesResourceLinker {
 
   /*
    * Resolve the series' resources and MERGE them onto the alert/incident.
-   * Merging (rather than assigning) matters because attachClusterContext
-   * writes the same four cluster relations from the monitor's step
-   * config; whichever runs second must not erase the other's work.
+   * Merging (rather than assigning) matters because
+   * attachResolvedResources writes the same relations from the
+   * monitor's step config; whichever runs second must not erase the
+   * other's work.
    *
    * Relations the series says nothing about are left untouched —
    * `undefined`, not `[]` — so an ungrouped event and an event whose
@@ -223,11 +283,17 @@ export default class SeriesResourceLinker {
     model: SeriesLinkableModel;
     seriesLabels: JSONObject;
     projectId: ObjectID;
+    /*
+     * Optional, and only consulted to disambiguate `host.name`. Left
+     * undefined by callers that have no monitor in hand.
+     */
+    monitorType?: MonitorType | undefined;
   }): Promise<void> {
     const resolved: SeriesResolvedResourceIds =
       await this.resolveResourcesFromSeriesLabels({
         seriesLabels: input.seriesLabels,
         projectId: input.projectId,
+        monitorType: input.monitorType,
       });
 
     this.mergeResolvedIdsIntoModel({
@@ -237,30 +303,22 @@ export default class SeriesResourceLinker {
   }
 
   /*
-   * Attach the cluster ids resolved from the monitor's step config
-   * (Proxmox / Ceph / Docker Swarm / IoT), merging with — never
-   * overwriting — anything the series-label path already linked. Both
-   * paths can resolve the same cluster, so this dedupes by id. Unlike
-   * the label path this runs for ungrouped events too: those monitor
-   * types get their cluster identity from the step config alone.
+   * Attach the resources resolved from the monitor's own step config
+   * (MonitorResourceContext), merging with — never overwriting —
+   * anything the series-label path already linked. Both paths can
+   * resolve the same resource, so this dedupes by id.
+   *
+   * Unlike the label path this runs for ungrouped events too, and that
+   * is the whole point: an ungrouped monitor has no series labels, so
+   * before this existed it linked nothing at all.
    */
-  public static attachClusterContext(input: {
+  public static attachResolvedResources(input: {
     model: SeriesLinkableModel;
-    clusterContext: MonitorClusterContext;
+    resolved: SeriesResolvedResourceIds;
   }): void {
     this.mergeResolvedIdsIntoModel({
       model: input.model,
-      resolved: {
-        hostIds: [],
-        dockerHostIds: [],
-        podmanHostIds: [],
-        kubernetesClusterIds: [],
-        serviceIds: [],
-        proxmoxClusterIds: input.clusterContext.proxmoxClusterIds,
-        cephClusterIds: input.clusterContext.cephClusterIds,
-        dockerSwarmClusterIds: input.clusterContext.dockerSwarmClusterIds,
-        iotFleetIds: input.clusterContext.iotFleetIds,
-      },
+      resolved: input.resolved,
     });
   }
 
@@ -396,16 +454,23 @@ export default class SeriesResourceLinker {
    * Costs zero round-trips when the series carries neither, which is the
    * common case for most of the nine types on any given series.
    *
-   * Name matching is exact. Every identifier column read here is written
-   * by ingest from the same attribute the series label carries — host
-   * identifiers are canonicalized on both sides — so exact matching is
-   * what keeps a lookup from straying onto a neighbouring row.
+   * `nameMatch: "exact"` is for series labels. Every identifier column
+   * read here is written by ingest from the same attribute the series
+   * label carries — host identifiers are canonicalized on both sides —
+   * so exact matching is what keeps a lookup from straying onto a
+   * neighbouring row.
+   *
+   * `nameMatch: "caseInsensitive"` is for monitor step configs, where
+   * the identifier was typed by a user and the row's name was stamped
+   * by an agent; the two legitimately differ by case. This mirrors what
+   * ingest discovery itself does when it keys a row by name.
    */
   private static async resolveResourceIds(input: {
     ids: Array<string>;
     names: Array<string>;
     nameColumn: string;
     projectId: ObjectID;
+    nameMatch: NameMatchMode;
     /*
      * Loosely typed because each resource service has its own
      * `Query<TBaseModel>` shape and we deliberately abstract over
@@ -443,7 +508,10 @@ export default class SeriesResourceLinker {
         input.findBy({
           query: {
             projectId: input.projectId,
-            [input.nameColumn]: new Includes(input.names),
+            [input.nameColumn]:
+              input.nameMatch === "caseInsensitive"
+                ? QueryHelper.findWithSameTextAnyOf(input.names)
+                : new Includes(input.names),
           },
           select: { _id: true },
           skip: 0,

package/Server/Utils/TotpAuth.ts

@@ -2,6 +2,63 @@ import Email from "../../Types/Email";
 import * as OTPAuth from "otpauth";
 import CaptureSpan from "./Telemetry/CaptureSpan";
 
+/**
+ * The HMAC algorithm every new enrolment is issued with.
+ *
+ * RFC 6238 fixes SHA1 as the default and every authenticator implements it.
+ * The `algorithm` parameter in an otpauth:// URI is, in practice, advisory:
+ * Google Authenticator and Microsoft Authenticator parse the URI, ignore the
+ * parameter, and compute SHA1 anyway. A server that issues `algorithm=SHA256`
+ * therefore hands those apps a QR code they will silently mis-implement — the
+ * app shows a confident six digits, the server computes a completely different
+ * six digits, and enrolment can never succeed no matter how many codes the
+ * user tries. That is the failure this constant exists to prevent.
+ *
+ * SHA1 is not a weakness here. HMAC-SHA1 is unaffected by the collision
+ * attacks that retired SHA1 for signatures (RFC 6234 / RFC 2104), and the
+ * output is truncated to six digits over a 30 second window regardless — the
+ * brute-force surface is the 10^6 code space, not the hash.
+ */
+export const DefaultTotpAlgorithm: string = "SHA1";
+
+/**
+ * Algorithms a submitted token is checked against, in order.
+ *
+ * OneUptime issued `SHA256` enrolments before this was understood. Those
+ * secrets are still in the database and still work in the minority of apps
+ * that do honour the parameter (1Password, Bitwarden, Aegis, FreeOTP), so
+ * dropping SHA256 from verification would lock those accounts out of their
+ * own logins.
+ *
+ * The cost is exactly one bit: two algorithms across the validation window
+ * means twice as many six-digit strings are accepted at any instant. Against
+ * a 10^6 code space that is still a vanishing fraction, and the tests pin the
+ * bound so it cannot quietly grow.
+ *
+ * Retiring SHA256 needs more than time passing. Nothing on the row records
+ * which algorithm the user's app actually computes, so "no legacy rows remain"
+ * is not a question the database can answer today — removing it means either
+ * storing the algorithm that verified, or accepting that some long-dormant
+ * account re-enrols instead of logging in.
+ */
+export const SupportedTotpAlgorithms: Array<string> = ["SHA1", "SHA256"];
+
+/**
+ * Number of 30 second steps either side of now that a token is accepted for.
+ *
+ * Three steps is +/- 90 seconds, which absorbs ordinary phone/server clock
+ * drift and the user typing the last digit as the code rolls over.
+ */
+export const TotpValidationWindow: number = 3;
+
+/**
+ * Number of digits in a token, and the length of the time step in seconds.
+ * Both are the values Google Authenticator assumes, and — like `algorithm` —
+ * both are parameters it ignores when told anything else.
+ */
+export const TotpDigits: number = 6;
+export const TotpPeriodInSeconds: number = 30;
+
 /**
  * Utility class for handling TOTP authentication.
  */
@@ -21,7 +78,11 @@ export default class TotpAuth {
   }
 
   @CaptureSpan()
-  public static getTotp(data: { secret: string; email: Email }): OTPAuth.TOTP {
+  public static getTotp(data: {
+    secret: string;
+    email: Email;
+    algorithm?: string | undefined;
+  }): OTPAuth.TOTP {
     const totp: OTPAuth.TOTP = new OTPAuth.TOTP({
       // Provider or service the account is associated with.
       issuer: "OneUptime",
@@ -30,11 +91,11 @@ export default class TotpAuth {
         email: data.email,
       }),
       // Algorithm used for the HMAC function.
-      algorithm: "SHA256",
+      algorithm: data.algorithm || DefaultTotpAlgorithm,
       // Length of the generated tokens.
-      digits: 6,
+      digits: TotpDigits,
       // Interval of time for which a token is valid, in seconds.
-      period: 30,
+      period: TotpPeriodInSeconds,
       // Arbitrary key encoded in Base32 or OTPAuth.Secret instance.
       secret: data.secret,
     });
@@ -42,6 +103,33 @@ export default class TotpAuth {
     return totp;
   }
 
+  /**
+   * Strips the formatting authenticator apps add for readability.
+   *
+   * Google Authenticator renders a code as "123 456" and both the iOS and
+   * Android clipboards keep that space when the user copies it. Rejecting the
+   * paste is a self-inflicted "Invalid code" for a user who supplied exactly
+   * the right secret material, so the separators are removed before the token
+   * is compared. Anything that is not a digit is dropped, which also covers
+   * the hyphen some apps use and stray whitespace from a trimmed paste.
+   *
+   * @param token - The raw token as submitted.
+   * @returns The token reduced to its digits.
+   */
+  @CaptureSpan()
+  public static normalizeToken(token: string): string {
+    /*
+     * The token arrives straight off a JSON body, so it is only a string
+     * because the client chose to send one. A number or an object here must
+     * fail verification, not throw out of `.replace` and surface as a 500.
+     */
+    if (typeof token !== "string" || !token) {
+      return "";
+    }
+
+    return token.replace(/\D/g, "");
+  }
+
   /**
    * Verifies if a given token matches the provided secret key.
    * @param data - The data object containing the secret key and token.
@@ -53,13 +141,49 @@ export default class TotpAuth {
     token: string;
     email: Email;
   }): boolean {
-    const { secret, token, email } = data;
+    const { secret, email } = data;
 
-    const totp: OTPAuth.TOTP = this.getTotp({ secret, email });
+    if (!secret) {
+      return false;
+    }
 
-    const delta: number | null = totp.validate({ token, window: 3 });
+    const token: string = this.normalizeToken(data.token);
 
-    return delta !== null;
+    /*
+     * otpauth compares the submitted string against the codes it generates,
+     * so a token of the wrong length can never match — but it would still be
+     * run through one HMAC per algorithm per window step first. Reject it up
+     * front instead.
+     */
+    if (token.length !== TotpDigits) {
+      return false;
+    }
+
+    for (const algorithm of SupportedTotpAlgorithms) {
+      let totp: OTPAuth.TOTP;
+
+      try {
+        totp = this.getTotp({ secret, email, algorithm });
+      } catch {
+        /*
+         * A secret that is not valid base32 throws in the OTPAuth.Secret
+         * constructor. That is a corrupt row, not a wrong code, and it fails
+         * identically for every algorithm — so stop rather than repeat it.
+         */
+        return false;
+      }
+
+      const delta: number | null = totp.validate({
+        token,
+        window: TotpValidationWindow,
+      });
+
+      if (delta !== null) {
+        return true;
+      }
+    }
+
+    return false;
   }
 
   /**
@@ -74,7 +198,11 @@ export default class TotpAuth {
   }): string {
     const { secret, userEmail } = data;
 
-    const totp: OTPAuth.TOTP = this.getTotp({ secret, email: userEmail });
+    const totp: OTPAuth.TOTP = this.getTotp({
+      secret,
+      email: userEmail,
+      algorithm: DefaultTotpAlgorithm,
+    });
 
     return totp.toString();
   }

package/Server/Utils/UserRegistrationToken.ts

@@ -0,0 +1,182 @@
+import { AccountsRoute } from "../../ServiceRoute";
+import Hostname from "../../Types/API/Hostname";
+import Protocol from "../../Types/API/Protocol";
+import Route from "../../Types/API/Route";
+import URL from "../../Types/API/URL";
+import OneUptimeDate from "../../Types/Date";
+import Email from "../../Types/Email";
+import ObjectID from "../../Types/ObjectID";
+import EmailVerificationToken from "../../Models/DatabaseModels/EmailVerificationToken";
+import DatabaseConfig from "../DatabaseConfig";
+import EmailVerificationTokenService from "../Services/EmailVerificationTokenService";
+import CaptureSpan from "./Telemetry/CaptureSpan";
+
+/*
+ * An invited user exists in the database before they have ever authenticated.
+ * TeamMemberService creates the row so the membership has something to point
+ * at, and that row carries no password until the person registers.
+ *
+ * /signup is what hands that unclaimed row over, so the hand-over has to be
+ * gated on something only the mailbox owner can hold. Knowing the address is
+ * not enough: addresses at a company are guessable by construction, which is
+ * exactly how GHSA-qg84-6hrg-mr5g turned a pending invitation into an account
+ * takeover -- the guard there was `if (alreadySavedUser.password)`, and an
+ * unclaimed row's password is null, which is falsy.
+ *
+ * This token is that gate. It is minted when the invitation is sent, travels
+ * only inside the invitation email, and is spent the first time it is used.
+ *
+ * It reuses EmailVerificationToken rather than adding a table of its own: the
+ * shape is identical (user, email, opaque token, expiry) and the semantics are
+ * the same claim -- "the holder of this controls this mailbox". Spending one is
+ * therefore also proof of address ownership, which is why the signup path marks
+ * the account verified on the way through.
+ */
+
+/*
+ * Invitations are read when the person gets round to them, not when they are
+ * sent, so these live longer than the 24 hours an email-verification link gets.
+ * Expiring in a week still bounds how long a leaked invite mail stays useful.
+ */
+export const REGISTRATION_TOKEN_EXPIRY_IN_DAYS: number = 7;
+
+export default class UserRegistrationToken {
+  /*
+   * Mint a token for `email` and return it. The caller is responsible for
+   * putting it somewhere only the mailbox owner will see -- which in practice
+   * means a link in an email addressed to that same mailbox, and nowhere else.
+   * It must never be written into an API response.
+   */
+  @CaptureSpan()
+  public static async generateRegistrationToken(data: {
+    userId: ObjectID;
+    email: Email;
+  }): Promise<ObjectID> {
+    const token: ObjectID = ObjectID.generate();
+
+    const emailVerificationToken: EmailVerificationToken =
+      new EmailVerificationToken();
+    emailVerificationToken.userId = data.userId;
+    emailVerificationToken.email = data.email;
+    emailVerificationToken.token = token;
+    emailVerificationToken.expires = OneUptimeDate.getSomeDaysAfter(
+      REGISTRATION_TOKEN_EXPIRY_IN_DAYS,
+    );
+
+    await EmailVerificationTokenService.create({
+      data: emailVerificationToken,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return token;
+  }
+
+  /*
+   * The /accounts/register link an invited person follows. The email is carried
+   * alongside the token only to prefill (and lock) the form field; the token is
+   * the part that authorizes anything.
+   */
+  @CaptureSpan()
+  public static async getRegistrationLink(data: {
+    email: Email;
+    token: ObjectID;
+  }): Promise<URL> {
+    const host: Hostname = await DatabaseConfig.getHost();
+    const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
+
+    return URL.fromString(
+      new URL(
+        httpProtocol,
+        host,
+        new Route(AccountsRoute.toString()),
+      ).toString(),
+    )
+      .addRoute("/register")
+      .addQueryParam("email", data.email.toString(), true)
+      .addQueryParam("token", data.token.toString(), true);
+  }
+
+  // Mint a token and build the link that carries it, in one step.
+  @CaptureSpan()
+  public static async generateRegistrationLink(data: {
+    userId: ObjectID;
+    email: Email;
+  }): Promise<URL> {
+    const token: ObjectID = await this.generateRegistrationToken({
+      userId: data.userId,
+      email: data.email,
+    });
+
+    return await this.getRegistrationLink({
+      email: data.email,
+      token: token,
+    });
+  }
+
+  /*
+   * Spend a token. Returns true only if it exists, was minted for this exact
+   * address, has not expired, and had not already been spent.
+   *
+   * The delete is what makes it single-use, and it is deliberately the last
+   * word: `deleteOneBy` reports how many rows it removed, so two requests
+   * racing on the same token produce exactly one winner (the loser deletes
+   * nothing and gets false back) rather than two callers who both read a live
+   * token and both proceed.
+   *
+   * Every failure returns the same `false`. The caller must not report which
+   * check failed -- "expired" and "no such token" would tell someone probing
+   * with guessed tokens which of them had ever been real.
+   */
+  @CaptureSpan()
+  public static async consumeRegistrationToken(data: {
+    token: ObjectID;
+    email: Email;
+  }): Promise<boolean> {
+    const savedToken: EmailVerificationToken | null =
+      await EmailVerificationTokenService.findOneBy({
+        query: {
+          token: data.token,
+        },
+        select: {
+          _id: true,
+          email: true,
+          expires: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (!savedToken || !savedToken.email || !savedToken.expires) {
+      return false;
+    }
+
+    /*
+     * A token is bound to the address it was mailed to. Without this, a token
+     * from any invitation the attacker had legitimately received would claim
+     * any other unclaimed account. Email lowercases on construction, so the
+     * string comparison is already case-insensitive.
+     */
+    if (savedToken.email.toString() !== data.email.toString()) {
+      return false;
+    }
+
+    if (OneUptimeDate.hasExpired(savedToken.expires)) {
+      return false;
+    }
+
+    const deletedCount: number =
+      await EmailVerificationTokenService.deleteOneBy({
+        query: {
+          _id: savedToken._id!,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    return deletedCount === 1;
+  }
+}