@oneuptime/common 12.0.13 → 12.0.14

package/Server/API/BaseAPI.ts

@@ -298,20 +298,85 @@ export default class BaseAPI<
     const databaseProps: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    const list: Array<BaseModel> = await this.service.findBy({
-      query,
-      select,
-      skip: skip,
-      limit: limit,
-      groupBy: groupBy,
-      sort: sort,
-      props: databaseProps,
-    });
-
-    const count: PositiveNumber = await this.service.countBy({
-      query,
-      props: databaseProps,
-    });
+    /*
+     * findBy and countBy are independent reads, so run them in parallel to
+     * cut list latency where the count is costly. The one thing that makes
+     * the sequential order load-bearing is a service-level onBeforeFind
+     * override that mutates the shared query/props objects in place (e.g.
+     * ProjectService elevates props.isRoot and pins query._id for users with
+     * no projects; the incident/alert privacy filters rewrite query keys):
+     * countBy historically ran after findBy and inherited those mutations.
+     * Services on the stock hook cannot mutate anything (and the permission
+     * pipeline copies the query before touching it, ReadPermission.ts:33),
+     * so only they run in parallel; hook-overriding services keep the
+     * sequential order and its exact semantics.
+     */
+    const usesStockOnBeforeFindHook: boolean =
+      (this.service as unknown as { onBeforeFind: unknown }).onBeforeFind ===
+      (DatabaseService.prototype as unknown as { onBeforeFind: unknown })
+        .onBeforeFind;
+
+    let list: Array<BaseModel>;
+    let count: PositiveNumber;
+
+    if (usesStockOnBeforeFindHook) {
+      const listPromise: Promise<Array<BaseModel>> = this.service.findBy({
+        query,
+        select,
+        skip: skip,
+        limit: limit,
+        groupBy: groupBy,
+        sort: sort,
+        props: databaseProps,
+      });
+
+      /*
+       * Shallow copies so a countBy override that rewrites top-level query
+       * keys (the established privacy-filter pattern) can never race the
+       * concurrent findBy's reads of the shared objects.
+       */
+      const countPromise: Promise<PositiveNumber> = this.service.countBy({
+        query: { ...query },
+        props: { ...databaseProps },
+      });
+
+      /*
+       * allSettled instead of Promise.all: a findBy rejection must not leave
+       * countPromise as an unhandled rejection, and findBy's error keeps
+       * priority when both fail - the same failure the sequential code
+       * surfaced.
+       */
+      const [listResult, countResult]: [
+        PromiseSettledResult<Array<BaseModel>>,
+        PromiseSettledResult<PositiveNumber>,
+      ] = await Promise.allSettled([listPromise, countPromise]);
+
+      if (listResult.status === "rejected") {
+        throw listResult.reason;
+      }
+
+      if (countResult.status === "rejected") {
+        throw countResult.reason;
+      }
+
+      list = listResult.value;
+      count = countResult.value;
+    } else {
+      list = await this.service.findBy({
+        query,
+        select,
+        skip: skip,
+        limit: limit,
+        groupBy: groupBy,
+        sort: sort,
+        props: databaseProps,
+      });
+
+      count = await this.service.countBy({
+        query,
+        props: databaseProps,
+      });
+    }
 
     return Response.sendEntityArrayResponse(
       req,

package/Server/API/UserCallAPI.ts

@@ -1,22 +1,44 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserCallService, {
   Service as UserCallServiceType,
 } from "../Services/UserCallService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserCall from "../../Models/DatabaseModels/UserCall";
-import UserSMS from "../../Models/DatabaseModels/UserSMS";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserCallAPI extends BaseAPI<
   UserCall,
   UserCallServiceType
@@ -27,6 +49,9 @@ export default class UserCallAPI extends BaseAPI<
     this.router.post(
       `/user-call/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -47,33 +72,10 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the phone number.
-          const item: UserSMS | null = await this.service.findOneById({
-            id: req.body["itemId"],
-            props: {
-              isRoot: true,
-            },
-            select: {
-              userId: true,
-              projectId: true,
-              verificationCode: true,
-            },
-          });
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
-
-          //check user id
-
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -81,32 +83,30 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
-          // Create default notification rules for this verified call number
+          /* Create default notification rules for this verified call number */
           try {
             await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
               {
-                projectId: new ObjectID(item.projectId!.toString()),
-                userId: new ObjectID(item.userId!.toString()),
+                projectId: new ObjectID(result.projectId!.toString()),
+                userId: new ObjectID(result.userId!.toString()),
                 notificationMethod: {
-                  userCallId: item.id!,
+                  userCallId: result.itemId!,
                 },
               },
             );
@@ -127,6 +127,9 @@ export default class UserCallAPI extends BaseAPI<
     this.router.post(
       `/user-call/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -157,6 +160,11 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()

package/Server/API/UserEmailAPI.ts

@@ -1,21 +1,44 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserEmailService, {
   Service as UserEmailServiceType,
 } from "../Services/UserEmailService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserEmail from "../../Models/DatabaseModels/UserEmail";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserEmailAPI extends BaseAPI<
   UserEmail,
   UserEmailServiceType
@@ -26,6 +49,9 @@ export default class UserEmailAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -46,33 +72,10 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the email.
-          const item: UserEmail | null = await this.service.findOneById({
-            id: req.body["itemId"],
-            props: {
-              isRoot: true,
-            },
-            select: {
-              userId: true,
-              projectId: true,
-              verificationCode: true,
-            },
-          });
-
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
-
-          //check user id
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -80,32 +83,30 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
-          // Create default notification rules for this verified email
+          /* Create default notification rules for this verified email */
           try {
             await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
               {
-                projectId: new ObjectID(item.projectId!.toString()),
-                userId: new ObjectID(item.userId!.toString()),
+                projectId: new ObjectID(result.projectId!.toString()),
+                userId: new ObjectID(result.userId!.toString()),
                 notificationMethod: {
-                  userEmailId: item.id!,
+                  userEmailId: result.itemId!,
                 },
               },
             );
@@ -128,6 +129,9 @@ export default class UserEmailAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -158,6 +162,11 @@ export default class UserEmailAPI extends BaseAPI<
             );
           }
 
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()

package/Server/API/UserIncomingCallNumberAPI.ts

@@ -1,4 +1,7 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserIncomingCallNumberService, {
   Service as UserIncomingCallNumberServiceType,
 } from "../Services/UserIncomingCallNumberService";
@@ -8,11 +11,32 @@ import {
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
 import UserIncomingCallNumber from "../../Models/DatabaseModels/UserIncomingCallNumber";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserIncomingCallNumberAPI extends BaseAPI<
   UserIncomingCallNumber,
   UserIncomingCallNumberServiceType
@@ -23,6 +47,9 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
     this.router.post(
       `/user-incoming-call-number/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -43,32 +70,10 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the phone number
-          const item: UserIncomingCallNumber | null =
-            await this.service.findOneById({
-              id: req.body["itemId"],
-              props: {
-                isRoot: true,
-              },
-              select: {
-                userId: true,
-                verificationCode: true,
-              },
-            });
-
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          // Check user ID
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -76,24 +81,22 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
           return Response.sendEmptySuccessResponse(req, res);
         } catch (err) {
           return next(err);
@@ -104,6 +107,9 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
     this.router.post(
       `/user-incoming-call-number/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -135,7 +141,11 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
             );
           }
 
-          // Check user ID
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()