@oneuptime/common 12.0.13 → 12.0.14

package/Types/Permission.ts

@@ -1085,6 +1085,24 @@ enum Permission {
   ReadProjectUserNotificationRule = "ReadProjectUserNotificationRule",
   EditProjectUserNotificationRule = "EditProjectUserNotificationRule",
 
+  /*
+   * Adding and removing the notification METHODS a member's rules point at:
+   * the email address, phone number or device a page is actually delivered to.
+   *
+   * Separate from EditProjectUserNotificationRule, and deliberately not implied
+   * by it. Repairing somebody's rules re-points their pages between devices
+   * they have already proved they hold; adding a method introduces a device
+   * nobody has proved anything about, so the two have different blast radii and
+   * an installation must be able to hand out the first without the second.
+   *
+   * What it does NOT grant, and cannot: making a method live. A method added
+   * this way lands unverified and the verification code goes to the address
+   * itself, and every verify endpoint refuses a caller who is not the row's
+   * owner. So this permission lets an administrator do the typing for a
+   * colleague; only that colleague can finish it.
+   */
+  ManageProjectUserNotificationMethod = "ManageProjectUserNotificationMethod",
+
   // Resource Permissions (Team Permission)
   CreateProjectOnCallDutyPolicySchedule = "CreateProjectOnCallDutyPolicySchedule",
   EditProjectOnCallDutyPolicySchedule = "EditProjectOnCallDutyPolicySchedule",
@@ -6068,6 +6086,23 @@ export class PermissionHelper {
         isRolePermission: false,
         group: PermissionGroup.OnCallDutyPolicy,
       },
+      /*
+       * isRolePermission false for the same reason as the two above: a true
+       * value would file it under getRolePermissionProps(), the list every
+       * default project role is built from, and the ability to put a new phone
+       * number on a colleague's account would then arrive silently with an
+       * existing role rather than being handed out on purpose.
+       */
+      {
+        permission: Permission.ManageProjectUserNotificationMethod,
+        title: "Manage User Notification Methods",
+        description:
+          "This permission can add and remove the notification methods (email, SMS, call, WhatsApp) of any user in this project, so an administrator can set up a member who cannot yet be paged at all. Addresses are only ever shown masked, an added method stays unverified until the person who owns the device verifies it, and that person is emailed about every change.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.OnCallDutyPolicy,
+      },
 
       {
         permission: Permission.CreateProjectOnCallDutyPolicySchedule,

package/Types/PushNotification/AndroidNotificationChannel.ts

@@ -0,0 +1,26 @@
+/*
+ * Android delivers a notification with the settings of the channel it names,
+ * not the settings in the payload - importance, sound and Do Not Disturb
+ * bypass are all fixed when the app creates the channel and cannot be raised
+ * afterwards. So "ring through silent mode" is expressed by picking a channel,
+ * and these ids are the contract for that choice.
+ *
+ * The app creates channels with exactly these ids in
+ * MobileApp/src/notifications/channels.ts. An id sent from here that the app
+ * never created does not fail loudly: Android falls back to a default channel
+ * and the page arrives with default settings, which for an on-call page means
+ * silently. Keep the two lists in step.
+ */
+enum AndroidNotificationChannel {
+  /*
+   * Do Not Disturb bypass, alarm audio stream, MAX importance. Reserved for
+   * on-call pages from a device whose owner opted in and granted the app Do
+   * Not Disturb access.
+   */
+  Critical = "oncall_critical",
+  High = "oncall_high",
+  Normal = "oncall_normal",
+  Low = "oncall_low",
+}
+
+export default AndroidNotificationChannel;

package/Types/PushNotification/PushNotificationMessage.ts

@@ -13,6 +13,21 @@ interface PushNotificationMessage {
   }>;
   clickAction?: string;
   url?: string;
+  /*
+   * Ask the handset to ring even when it is silenced or in Do Not Disturb.
+   * Reserved for on-call pages: a responder who has opted their device in has
+   * decided that being woken is the point. Everything else - owner
+   * subscriptions, note-posted, test pings - leaves this unset and respects
+   * the ringer switch like a normal notification.
+   *
+   * Honouring it is a three-way handshake, and all three have to agree or the
+   * page arrives silently:
+   *   - the responder opts THIS device in (UserPush.isCriticalAlertEnabled),
+   *   - the server stamps the flag onto the payload (PushNotificationService),
+   *   - the OS lets it through (iOS critical-alert entitlement, or an Android
+   *     channel granted Do Not Disturb access).
+   */
+  isCriticalAlert?: boolean;
 }
 
 export default PushNotificationMessage;

package/Types/PushNotification/PushNotificationRequest.ts

@@ -1,26 +1,18 @@
 import PushDeviceType from "./PushDeviceType";
+import PushNotificationMessage from "./PushNotificationMessage";
 
 interface PushNotificationRequest {
   devices: Array<{
     token: string;
     name?: string;
   }>;
-  message: {
-    title: string;
-    body: string;
-    icon?: string;
-    badge?: string;
-    data?: { [key: string]: any };
-    tag?: string;
-    requireInteraction?: boolean;
-    actions?: Array<{
-      action: string;
-      title: string;
-      icon?: string;
-    }>;
-    clickAction?: string;
-    url?: string;
-  };
+  /*
+   * The same shape PushNotificationUtil builds, referenced rather than
+   * restated: this used to be a copy of every field in PushNotificationMessage,
+   * and a copy is a place for a newly added field to go missing on the way to
+   * the sender.
+   */
+  message: PushNotificationMessage;
   deviceType: PushDeviceType;
 }
 

package/Types/Service/ServiceLanguage.ts

@@ -0,0 +1,144 @@
+import TechStack from "./TechStack";
+
+/*
+ * Which runtime a telemetry service is written in, and how to work that out
+ * from what the service actually reported.
+ *
+ * This started life inside the dashboard's service-overview charts
+ * (`serviceGoldenMetrics.ts`), where it picked which runtime charts to draw.
+ * It lives in Common now because a second consumer needs the same answer from
+ * a place the dashboard cannot reach: the monitor recommendation catalog. The
+ * recommendations a Java service should get (JVM heap pressure, GC pause
+ * time, thread exhaustion) have nothing in common with the ones a Go service
+ * should get (goroutine leaks, GC cycles), and the catalog runs in Common.
+ *
+ * `serviceGoldenMetrics.ts` re-exports everything here, so the dashboard's
+ * existing import paths are unchanged.
+ */
+
+// Canonical values of the telemetry.sdk.language resource attribute.
+export type ServiceLanguage =
+  | "java"
+  | "dotnet"
+  | "nodejs"
+  | "python"
+  | "go"
+  | "ruby"
+  | "php"
+  | "rust"
+  | "erlang"
+  | "swift"
+  | "cpp"
+  | "webjs";
+
+export const SERVICE_LANGUAGE_DISPLAY_NAMES: Record<ServiceLanguage, string> = {
+  java: "Java",
+  dotnet: ".NET",
+  nodejs: "Node.js",
+  python: "Python",
+  go: "Go",
+  ruby: "Ruby",
+  php: "PHP",
+  rust: "Rust",
+  erlang: "Erlang / Elixir",
+  swift: "Swift",
+  cpp: "C++",
+  webjs: "Browser JS",
+};
+
+const KNOWN_LANGUAGES: Array<ServiceLanguage> = Object.keys(
+  SERVICE_LANGUAGE_DISPLAY_NAMES,
+) as Array<ServiceLanguage>;
+
+/*
+ * process.runtime.name values seen in the wild → language. Checked as
+ * case-insensitive substrings, so "OpenJDK Runtime Environment" → java.
+ * Ordered: more specific markers first ("graalvm" before "go").
+ */
+const RUNTIME_NAME_MARKERS: Array<{ marker: string; lang: ServiceLanguage }> = [
+  { marker: "openjdk", lang: "java" },
+  { marker: "graalvm", lang: "java" },
+  { marker: "java", lang: "java" },
+  { marker: "dotnet", lang: "dotnet" },
+  { marker: ".net", lang: "dotnet" },
+  { marker: "node", lang: "nodejs" },
+  { marker: "deno", lang: "nodejs" },
+  { marker: "bun", lang: "nodejs" },
+  { marker: "cpython", lang: "python" },
+  { marker: "pypy", lang: "python" },
+  { marker: "python", lang: "python" },
+  { marker: "beam", lang: "erlang" },
+  { marker: "erlang", lang: "erlang" },
+  { marker: "ruby", lang: "ruby" },
+  { marker: "php", lang: "php" },
+  { marker: "rust", lang: "rust" },
+  { marker: "swift", lang: "swift" },
+  { marker: "go", lang: "go" },
+];
+
+// Manual tech-stack selections → language (JVM languages map to java).
+const TECH_STACK_LANGUAGES: Partial<Record<TechStack, ServiceLanguage>> = {
+  [TechStack.Java]: "java",
+  [TechStack.Kotlin]: "java",
+  [TechStack.CSharp]: "dotnet",
+  [TechStack.NodeJS]: "nodejs",
+  [TechStack.TypeScript]: "nodejs",
+  [TechStack.JavaScript]: "nodejs",
+  [TechStack.React]: "webjs",
+  [TechStack.Python]: "python",
+  [TechStack.Go]: "go",
+  [TechStack.Ruby]: "ruby",
+  [TechStack.PHP]: "php",
+  [TechStack.Rust]: "rust",
+  [TechStack.Swift]: "swift",
+  [TechStack.CPlusPlus]: "cpp",
+};
+
+/*
+ * Best-effort language for a service, in descending order of trust:
+ *
+ *   1. `telemetry.sdk.language` — stamped by the SDK itself, so it is what the
+ *      process actually runs on rather than what anyone believes it runs on.
+ *   2. `process.runtime.name` — present when runtime instrumentation is on but
+ *      the SDK attribute did not survive a collector hop.
+ *   3. The manually-chosen tech stack — a human's answer, used only when the
+ *      telemetry has not answered.
+ *
+ * Returns null when nothing identifies the runtime. Callers must treat that as
+ * "unknown", never as a default language: recommending JVM heap monitors to a
+ * service that turns out to be Go is worse than recommending nothing.
+ */
+export const detectServiceLanguage: (data: {
+  telemetrySdkLanguage?: string | undefined;
+  runtimeName?: string | undefined;
+  techStack?: Array<TechStack> | undefined;
+}) => ServiceLanguage | null = (data: {
+  telemetrySdkLanguage?: string | undefined;
+  runtimeName?: string | undefined;
+  techStack?: Array<TechStack> | undefined;
+}): ServiceLanguage | null => {
+  const sdkLanguage: string = (data.telemetrySdkLanguage || "")
+    .trim()
+    .toLowerCase();
+  if (sdkLanguage && KNOWN_LANGUAGES.includes(sdkLanguage as ServiceLanguage)) {
+    return sdkLanguage as ServiceLanguage;
+  }
+
+  const runtimeName: string = (data.runtimeName || "").trim().toLowerCase();
+  if (runtimeName) {
+    for (const entry of RUNTIME_NAME_MARKERS) {
+      if (runtimeName.includes(entry.marker)) {
+        return entry.lang;
+      }
+    }
+  }
+
+  for (const stack of data.techStack || []) {
+    const lang: ServiceLanguage | undefined = TECH_STACK_LANGUAGES[stack];
+    if (lang) {
+      return lang;
+    }
+  }
+
+  return null;
+};

package/Types/Text.ts

@@ -236,21 +236,117 @@ export default class Text {
     return null;
   }
 
-  public static generateRandomText(length?: number): string {
-    if (!length) {
-      length = 10;
+  /*
+   * Cryptographically secure random bytes, or null if this runtime has no
+   * CSPRNG at all.
+   *
+   * `globalThis.crypto` is the Web Crypto API: present in every browser, and a
+   * global in Node since 19. It is used here rather than `require("crypto")`
+   * because this file is bundled into the dashboard as well as the server, so
+   * it cannot reach for a Node built-in.
+   */
+  private static getSecureRandomBytes(byteCount: number): Uint8Array | null {
+    const webCrypto: { getRandomValues?: (array: Uint8Array) => Uint8Array } =
+      (
+        globalThis as unknown as {
+          crypto?: { getRandomValues?: (array: Uint8Array) => Uint8Array };
+        }
+      ).crypto || {};
+
+    if (typeof webCrypto.getRandomValues !== "function") {
+      return null;
     }
 
-    let result: string = "";
-    const characters: string =
-      "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+    return webCrypto.getRandomValues(new Uint8Array(byteCount));
+  }
+
+  /*
+   * Draw `length` characters uniformly at random from `characters`.
+   *
+   * TWO properties here are load-bearing, and this used to have neither:
+   *
+   * 1. The source is a CSPRNG. Math.random is a fast non-cryptographic PRNG
+   *    (xorshift128+ in V8) whose entire internal state can be recovered from
+   *    a handful of observed outputs and then run forwards AND backwards. For
+   *    a value used as a secret that is worse than a short code: an attacker
+   *    who sees one generated value predicts the next one exactly, with no
+   *    guessing at all.
+   *
+   * 2. The draw is unbiased. `byte % n` is only uniform when n divides 256.
+   *    Rejection sampling discards the short tail of the byte range instead of
+   *    folding it, which is what keeps a k-character code at its full
+   *    k * log2(n) bits of entropy.
+   *
+   * The Math.random fallback survives ONLY for the case where no CSPRNG exists
+   * at all, which is unreachable on any supported runtime. It is there so the
+   * non-secret callers - SQL alias suffixes in QueryHelper and friends, which
+   * run on every query - cannot be broken by an exotic environment. Secrets
+   * must NOT come through here: notification-channel codes go through
+   * Common/Server/Utils/VerificationCode.ts, which throws rather than
+   * downgrading.
+   */
+  private static generateRandomString(
+    length: number,
+    characters: string,
+  ): string {
     const charactersLength: number = characters.length;
-    for (let i: number = 0; i < length; i++) {
-      result += characters.charAt(Math.floor(Math.random() * charactersLength));
+
+    /*
+     * The largest multiple of charactersLength that fits in a byte. Bytes at
+     * or above it are thrown away rather than folded - that is the whole of
+     * the rejection sampling, and skipping it is what biases the result.
+     */
+    const unbiasedCeiling: number = 256 - (256 % charactersLength);
+
+    let result: string = "";
+
+    while (result.length < length) {
+      const remaining: number = length - result.length;
+
+      /*
+       * Over-draw a little so a rejected byte usually does not cost a second
+       * trip into the CSPRNG. With a 10-character alphabet fewer than 3% of
+       * bytes are rejected, so one pass almost always finishes the job.
+       */
+      const bytes: Uint8Array | null = Text.getSecureRandomBytes(
+        remaining + Math.ceil(remaining / 4) + 4,
+      );
+
+      if (!bytes) {
+        while (result.length < length) {
+          result += characters.charAt(
+            Math.floor(Math.random() * charactersLength),
+          );
+        }
+
+        return result;
+      }
+
+      for (let i: number = 0; i < bytes.length; i++) {
+        if (result.length >= length) {
+          break;
+        }
+
+        const byte: number | undefined = bytes[i];
+
+        if (byte === undefined || byte >= unbiasedCeiling) {
+          continue;
+        }
+
+        result += characters.charAt(byte % charactersLength);
+      }
     }
+
     return result;
   }
 
+  public static generateRandomText(length?: number): string {
+    return Text.generateRandomString(
+      length || 10,
+      "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz",
+    );
+  }
+
   public static trimLines(text: string): string {
     return text
       .split("\n")
@@ -260,18 +356,14 @@ export default class Text {
       .join("\n");
   }
 
+  /*
+   * The alphabet used to be the string "12134567890" - eleven characters, with
+   * "1" written twice and every digit therefore NOT equally likely. Combined
+   * with Math.random that made a six-digit code both biased and predictable.
+   * Both halves are fixed in generateRandomString above.
+   */
   public static generateRandomNumber(length?: number): string {
-    if (!length) {
-      length = 10;
-    }
-
-    let result: string = "";
-    const characters: string = "12134567890";
-    const charactersLength: number = characters.length;
-    for (let i: number = 0; i < length; i++) {
-      result += characters.charAt(Math.floor(Math.random() * charactersLength));
-    }
-    return result;
+    return Text.generateRandomString(length || 10, "0123456789");
   }
 
   public static convertNumberToWords(num: number): string {

package/UI/Components/Button/Button.tsx

@@ -91,22 +91,28 @@ const Button: FunctionComponent<ComponentProps> = ({
   const translatedTitle: string | undefined = translateString(title);
   const translatedTooltip: string | undefined = translateString(tooltip);
   useEffect(() => {
-    // componentDidMount
-    if (shortcutKey) {
-      window.addEventListener(`keydown`, (e: KeyboardEventProp) => {
-        return handleKeyboard(e);
-      });
+    if (!shortcutKey) {
+      return undefined;
     }
 
-    // componentDidUnmount
+    /*
+     * One stable function for the whole subscription. The previous version
+     * passed a fresh arrow function to removeEventListener, which never
+     * matches the one that was added — every render leaked a live keydown
+     * listener for the lifetime of the page.
+     */
+    const onKeyDown: (event: KeyboardEventProp) => void = (
+      event: KeyboardEventProp,
+    ): void => {
+      return handleKeyboard(event);
+    };
+
+    window.addEventListener(`keydown`, onKeyDown);
+
     return () => {
-      if (shortcutKey) {
-        window.removeEventListener(`keydown`, (e: KeyboardEventProp) => {
-          return handleKeyboard(e);
-        });
-      }
+      window.removeEventListener(`keydown`, onKeyDown);
     };
-  });
+  }, [shortcutKey, onClick]);
 
   type HandleKeyboardFunction = (event: KeyboardEventProp) => void;
 
@@ -141,7 +147,7 @@ const Button: FunctionComponent<ComponentProps> = ({
   }
 
   if (buttonStyle === ButtonStyleType.LINK) {
-    buttonStyleCssClass = `text-indigo-600 hover:text-indigo-900  space-x-2`;
+    buttonStyleCssClass = `text-indigo-600 hover:text-indigo-900  space-x-2 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500 focus-visible:ring-offset-2`;
 
     if (icon) {
       buttonStyleCssClass += ` flex`;
@@ -149,7 +155,7 @@ const Button: FunctionComponent<ComponentProps> = ({
   }
 
   if (buttonStyle === ButtonStyleType.SECONDARY_LINK) {
-    buttonStyleCssClass = `text-sm text-gray-400 hover:text-gray-500 space-x-2`;
+    buttonStyleCssClass = `text-sm text-gray-400 hover:text-gray-500 space-x-2 focus:outline-none focus-visible:ring-2 focus-visible:ring-indigo-500 focus-visible:ring-offset-2`;
 
     if (icon) {
       buttonStyleCssClass += ` flex`;
@@ -239,6 +245,13 @@ const Button: FunctionComponent<ComponentProps> = ({
     }   focus:outline-none focus:ring-2 focus:ring-yellow-500 focus:ring-offset-2 md:mt-0 md:ml-3 md:w-auto md:text-sm`;
   }
 
+  /*
+   * The one shared point every variant funnels through: hover/focus colour
+   * changes ease in instead of snapping, at the same 150ms the other
+   * primitives use.
+   */
+  buttonStyleCssClass += ` transition-colors duration-150 ease-out`;
+
   buttonStyleCssClass += ` ` + buttonSize;
 
   if (className) {

package/UI/Components/CodeBlock/CodeBlock.tsx

@@ -1,6 +1,16 @@
 import "highlight.js/styles/a11y-dark.css";
-import React, { FunctionComponent, ReactElement, useState } from "react";
-import Highlight from "react-highlight";
+import React, {
+  FunctionComponent,
+  ReactElement,
+  useMemo,
+  useState,
+} from "react";
+/*
+ * Trimmed highlight.js instance — lib/core plus only the languages CodeBlock
+ * callers actually pass (see the audit in LanguageRegistry.ts). Replaces
+ * react-highlight, which imported all 194 grammars (~1.5MB) eagerly.
+ */
+import hljs, { resolveRegisteredLanguage } from "./LanguageRegistry";
 import Icon from "../Icon/Icon";
 import IconProp from "../../../Types/Icon/IconProp";
 
@@ -31,6 +41,38 @@ const CodeBlock: FunctionComponent<ComponentProps> = (
   const maxHeight: string = props.maxHeight || "500px";
   const showCopyButton: boolean = props.showCopyButton !== false;
 
+  /*
+   * react-highlight rendered <pre><code className>…</code></pre> and then ran
+   * hljs.highlightBlock over the DOM after mount (reading the language from
+   * the `language-*` class and adding the theme's `hljs` class). We keep that
+   * exact DOM shape but highlight synchronously: registered language → hljs
+   * token markup (hljs.highlight escapes the source before wrapping it in
+   * spans, so the HTML is safe to inject); unregistered language or a
+   * ReactElement child → plain React-escaped rendering. hljs is never called
+   * with an unknown language, so it never logs lookup warnings.
+   */
+  const registeredLanguage: string | null =
+    typeof props.code === "string"
+      ? resolveRegisteredLanguage(props.language)
+      : null;
+
+  const highlightedHtml: string | null = useMemo((): string | null => {
+    if (typeof props.code !== "string" || !registeredLanguage) {
+      return null;
+    }
+
+    return hljs.highlight(props.code, {
+      language: registeredLanguage,
+      ignoreIllegals: true,
+    }).value;
+  }, [props.code, registeredLanguage]);
+
+  /*
+   * `hljs` carries the a11y-dark theme background; react-highlight added it
+   * post-mount, we add it up front so there is no unstyled first paint.
+   */
+  const codeClassName: string = `hljs p-4 language-${props.language} text-sm leading-relaxed`;
+
   return (
     <div className="relative group">
       {showCopyButton && typeof props.code === "string" && (
@@ -51,11 +93,16 @@ const CodeBlock: FunctionComponent<ComponentProps> = (
         className="overflow-auto rounded-lg border border-gray-700"
         style={{ maxHeight: maxHeight }}
       >
-        <Highlight
-          className={`p-4 language-${props.language} text-sm leading-relaxed`}
-        >
-          {props.code}
-        </Highlight>
+        <pre>
+          {highlightedHtml !== null ? (
+            <code
+              className={codeClassName}
+              dangerouslySetInnerHTML={{ __html: highlightedHtml }}
+            />
+          ) : (
+            <code className={codeClassName}>{props.code}</code>
+          )}
+        </pre>
       </div>
     </div>
   );