@oneuptime/common 12.0.13 → 12.0.14

package/Server/API/UserSmsAPI.ts

@@ -1,21 +1,44 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserSMSService, {
   Service as UserSMSServiceType,
 } from "../Services/UserSmsService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserSMS from "../../Models/DatabaseModels/UserSMS";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserSMSAPI extends BaseAPI<UserSMS, UserSMSServiceType> {
   public constructor() {
     super(UserSMS, UserSMSService);
@@ -23,6 +46,9 @@ export default class UserSMSAPI extends BaseAPI<UserSMS, UserSMSServiceType> {
     this.router.post(
       `/user-sms/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -43,33 +69,10 @@ export default class UserSMSAPI extends BaseAPI<UserSMS, UserSMSServiceType> {
             );
           }
 
-          // Check if the code matches and verify the phone number.
-          const item: UserSMS | null = await this.service.findOneById({
-            id: req.body["itemId"],
-            props: {
-              isRoot: true,
-            },
-            select: {
-              userId: true,
-              projectId: true,
-              verificationCode: true,
-            },
-          });
-
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
-
-          //check user id
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -77,32 +80,30 @@ export default class UserSMSAPI extends BaseAPI<UserSMS, UserSMSServiceType> {
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
-          // Create default notification rules for this verified SMS
+          /* Create default notification rules for this verified SMS number */
           try {
             await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
               {
-                projectId: new ObjectID(item.projectId!.toString()),
-                userId: new ObjectID(item.userId!.toString()),
+                projectId: new ObjectID(result.projectId!.toString()),
+                userId: new ObjectID(result.userId!.toString()),
                 notificationMethod: {
-                  userSmsId: item.id!,
+                  userSmsId: result.itemId!,
                 },
               },
             );
@@ -123,6 +124,9 @@ export default class UserSMSAPI extends BaseAPI<UserSMS, UserSMSServiceType> {
     this.router.post(
       `/user-sms/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -153,6 +157,11 @@ export default class UserSMSAPI extends BaseAPI<UserSMS, UserSMSServiceType> {
             );
           }
 
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()

package/Server/API/UserWhatsAppAPI.ts

@@ -1,21 +1,44 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserWhatsAppService, {
   Service as UserWhatsAppServiceType,
 } from "../Services/UserWhatsAppService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserWhatsApp from "../../Models/DatabaseModels/UserWhatsApp";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserWhatsAppAPI extends BaseAPI<
   UserWhatsApp,
   UserWhatsAppServiceType
@@ -26,6 +49,9 @@ export default class UserWhatsAppAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -46,39 +72,10 @@ export default class UserWhatsAppAPI extends BaseAPI<
             );
           }
 
-          const item: UserWhatsApp | null = await this.service.findOneById({
-            id: req.body["itemId"],
-            props: {
-              isRoot: true,
-            },
-            select: {
-              userId: true,
-              projectId: true,
-              verificationCode: true,
-              isVerified: true,
-            },
-          });
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
-
-          if (item.isVerified) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("WhatsApp number already verified"),
-            );
-          }
-
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -86,32 +83,30 @@ export default class UserWhatsAppAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
-          // Create default notification rules for this verified WhatsApp number
+          /* Create default notification rules for this verified WhatsApp number */
           try {
             await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
               {
-                projectId: new ObjectID(item.projectId!.toString()),
-                userId: new ObjectID(item.userId!.toString()),
+                projectId: new ObjectID(result.projectId!.toString()),
+                userId: new ObjectID(result.userId!.toString()),
                 notificationMethod: {
-                  userWhatsAppId: item.id!,
+                  userWhatsAppId: result.itemId!,
                 },
               },
             );
@@ -134,6 +129,9 @@ export default class UserWhatsAppAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -164,6 +162,11 @@ export default class UserWhatsAppAPI extends BaseAPI<
             );
           }
 
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()

package/Server/Infrastructure/Postgres/SchemaMigrations/1787142779538-MigrationName.ts

@@ -0,0 +1,154 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * GHSA-5cr8-vph4-3hrf: expiry, attempt counting and resend throttling for the
+ * notification-channel verification codes.
+ *
+ * Three columns per channel table:
+ *
+ *   verificationCodeExpiresAt    NULL means there is no live code. Every row
+ *                                that exists when this runs gets NULL, which
+ *                                is read as expired — so the plaintext codes
+ *                                those rows are carrying stop being accepted
+ *                                the moment this lands, and their owners
+ *                                press "resend" once. That is the intended
+ *                                behaviour, not a side effect: those codes
+ *                                never expired and were never attempt-limited.
+ *
+ *   verificationFailedAttempts   The counter that bounds guessing. NOT NULL
+ *                                DEFAULT 0 so the atomic increment never has
+ *                                to deal with a NULL.
+ *
+ *   verificationCodeSentAt       Drives the resend cooldown. NULL on existing
+ *                                rows, which allows one immediate resend —
+ *                                correct, since the code they hold has just
+ *                                been invalidated above.
+ *
+ * The up() also SCRUBS the plaintext codes those rows are still carrying.
+ * They are already unusable by the time the scrub runs, but they are live
+ * six-digit secrets sitting in a table, its replicas and every backup taken
+ * while they were there, and the whole point of the change this migration
+ * supports is that the column holds a keyed digest and never the code.
+ */
+
+export class MigrationName1787142779538 implements MigrationInterface {
+  public name: string = "MigrationName1787142779538";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserCall" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserCall" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserCall" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserEmail" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserEmail" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserEmail" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserSMS" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserSMS" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserSMS" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserWhatsApp" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserWhatsApp" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserWhatsApp" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserIncomingCallNumber" ADD "verificationCodeExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserIncomingCallNumber" ADD "verificationFailedAttempts" integer NOT NULL DEFAULT '0'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserIncomingCallNumber" ADD "verificationCodeSentAt" TIMESTAMP WITH TIME ZONE`,
+    );
+
+    /*
+     * Replace every stored plaintext code with a value nothing can hash
+     * to. Two md5s give the 64 hex characters a real digest has, using
+     * only functions core Postgres always has — gen_random_bytes would
+     * need pgcrypto, which is not a dependency this schema otherwise has.
+     *
+     * Restricted to values that look like a code rather than applied
+     * blindly, so re-running against a database that has already moved on
+     * cannot damage a real digest.
+     */
+    for (const tableName of [
+      "UserEmail",
+      "UserSMS",
+      "UserCall",
+      "UserWhatsApp",
+      "UserIncomingCallNumber",
+    ]) {
+      await queryRunner.query(
+        `UPDATE "${tableName}" SET "verificationCode" = md5(random()::text || clock_timestamp()::text) || md5(random()::text || clock_timestamp()::text) WHERE "verificationCode" ~ '^[0-9]{1,10}$'`,
+      );
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserIncomingCallNumber" DROP COLUMN "verificationCodeSentAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserIncomingCallNumber" DROP COLUMN "verificationFailedAttempts"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserIncomingCallNumber" DROP COLUMN "verificationCodeExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserWhatsApp" DROP COLUMN "verificationCodeSentAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserWhatsApp" DROP COLUMN "verificationFailedAttempts"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserWhatsApp" DROP COLUMN "verificationCodeExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserSMS" DROP COLUMN "verificationCodeSentAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserSMS" DROP COLUMN "verificationFailedAttempts"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserSMS" DROP COLUMN "verificationCodeExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserEmail" DROP COLUMN "verificationCodeSentAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserEmail" DROP COLUMN "verificationFailedAttempts"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserEmail" DROP COLUMN "verificationCodeExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserCall" DROP COLUMN "verificationCodeSentAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserCall" DROP COLUMN "verificationFailedAttempts"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserCall" DROP COLUMN "verificationCodeExpiresAt"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1787156982416-MigrationName.ts

@@ -0,0 +1,17 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1787156982416 implements MigrationInterface {
+  public name = "MigrationName1787156982416";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserPush" ADD "isCriticalAlertEnabled" boolean NOT NULL DEFAULT false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserPush" DROP COLUMN "isCriticalAlertEnabled"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1787700000000-FixTotpOtpUrlAlgorithm.ts

@@ -0,0 +1,45 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Corrects the otpauth:// URLs behind every un-scanned 2FA QR code.
+ *
+ * OneUptime used to build those URLs with `algorithm=SHA256`. Google
+ * Authenticator and Microsoft Authenticator parse the URL, ignore that
+ * parameter, and compute SHA1 — so the app displayed six digits the server
+ * could never agree with and enrolment failed with "Invalid code" forever, no
+ * matter how many fresh codes the user tried.
+ *
+ * This migration is NOT what unsticks those users. The code fix already does:
+ * verification tries SHA1 first, which is what those apps were emitting all
+ * along, so a pending enrolment starts working the moment the new build ships
+ * and the stored URL is never consulted during verification. What this fixes
+ * is the URL still claiming something untrue, which matters for the apps that
+ * DO honour the parameter and do not implement SHA256 — some hardware tokens,
+ * older FreeOTP builds — and which would otherwise keep minting new rows that
+ * depend on the SHA256 fallback long after the fallback should have gone.
+ *
+ * Only the algorithm label changes; the secret is untouched, so an app that
+ * already scanned the old QR keeps working. Verification accepts SHA1 and
+ * legacy SHA256 either way (see Common/Server/Utils/TotpAuth.ts), which is
+ * what makes rewriting the label safe rather than a second lockout.
+ *
+ * Verified rows are deliberately left alone. Their QR code is never shown
+ * again — the Verify action only exists for unverified entries — so the stored
+ * URL is a record of what the user's authenticator actually holds, and that
+ * record should stay accurate.
+ */
+export class FixTotpOtpUrlAlgorithm1787700000000 implements MigrationInterface {
+  public name = "FixTotpOtpUrlAlgorithm1787700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `UPDATE "UserTotpAuth" SET "twoFactorOtpUrl" = REPLACE("twoFactorOtpUrl", 'algorithm=SHA256', 'algorithm=SHA1') WHERE "isVerified" = false AND "twoFactorOtpUrl" LIKE '%algorithm=SHA256%'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `UPDATE "UserTotpAuth" SET "twoFactorOtpUrl" = REPLACE("twoFactorOtpUrl", 'algorithm=SHA1', 'algorithm=SHA256') WHERE "isVerified" = false AND "twoFactorOtpUrl" LIKE '%algorithm=SHA1%'`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -530,6 +530,9 @@ import { AddEpisodeMemberNotifyIndexes1787300000000 } from "./1787300000000-AddE
 import { AddDeviceRoleAndDeclaredLinkParent1787400000000 } from "./1787400000000-AddDeviceRoleAndDeclaredLinkParent";
 import { AddEnableSearchEngineIndexingToStatusPage1787500000000 } from "./1787500000000-AddEnableSearchEngineIndexingToStatusPage";
 import { AddNetworkDeviceReachabilityColumns1787600000000 } from "./1787600000000-AddNetworkDeviceReachabilityColumns";
+import { FixTotpOtpUrlAlgorithm1787700000000 } from "./1787700000000-FixTotpOtpUrlAlgorithm";
+import { MigrationName1787142779538 } from "./1787142779538-MigrationName";
+import { MigrationName1787156982416 } from "./1787156982416-MigrationName";
 
 export default [
   InitialMigration,
@@ -1059,9 +1062,12 @@ export default [
   AddInventoryItemArchiveAndCustomFields1786900000000,
   AddOnCallNotificationFallbackColumns1787000000000,
   AddAIConversationPageContext1787100000000,
+  MigrationName1787142779538,
+  MigrationName1787156982416,
   AddAIChatMessageFeedback1787200000000,
   AddEpisodeMemberNotifyIndexes1787300000000,
   AddDeviceRoleAndDeclaredLinkParent1787400000000,
   AddEnableSearchEngineIndexingToStatusPage1787500000000,
   AddNetworkDeviceReachabilityColumns1787600000000,
+  FixTotpOtpUrlAlgorithm1787700000000,
 ];