@oneuptime/common 12.0.13 → 12.0.15

package/Models/DatabaseModels/GlobalOidc.ts

@@ -235,6 +235,26 @@ export default class GlobalOIDC extends BaseModel {
   })
   public disableSignUpWithSso?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Restrict to Attached Projects",
+    description:
+      "When enabled, a login through this provider only satisfies SSO enforcement for the projects attached below. Leave this off (the default) and the provider satisfies SSO enforcement for every project the user is a member of, which is how attachments have always behaved - they are the provisioning allow-list, not an access boundary. Turning this on narrows access for people already signed in.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public restrictToAttachedProjects?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/GlobalSso.ts

@@ -196,6 +196,26 @@ export default class GlobalSSO extends BaseModel {
   })
   public disableSignUpWithSso?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Restrict to Attached Projects",
+    description:
+      "When enabled, a login through this provider only satisfies SSO enforcement for the projects attached below. Leave this off (the default) and the provider satisfies SSO enforcement for every project the user is a member of, which is how attachments have always behaved - they are the provisioning allow-list, not an access boundary. Turning this on narrows access for people already signed in.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public restrictToAttachedProjects?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/MarketingConversion.ts

@@ -14,11 +14,13 @@ import ObjectID from "../../Types/ObjectID";
 import { Column, Entity, Index } from "typeorm";
 
 /*
- * Internal table (no API access) recording ad-attributed conversions —
- * signups and paid subscriptions from visitors that carried ad click IDs —
- * and the status of uploading each of them to ad platforms (Google Ads
- * offline click conversions, Meta Conversions API). Written and read only by
- * the MarketingConversions worker job.
+ * Internal table (no API access) recording server-confirmed conversions —
+ * signups, booked meetings and paid subscriptions, along with any ad click IDs
+ * the converting visitor carried — and the status of uploading the
+ * ad-uploadable ones to ad platforms (Google Ads offline click conversions,
+ * Meta Conversions API). Browser analytics never write this table: rows are
+ * written by the signup/subscription flows and the Cal.com webhook, and read
+ * by the MarketingConversions worker job.
  */
 @TableAccessControl({
   create: [],
@@ -33,11 +35,18 @@ import { Column, Entity, Index } from "typeorm";
   pluralName: "Marketing Conversions",
   icon: IconProp.ChartBar,
   tableDescription:
-    "Ad-attributed conversions (signups, paid subscriptions) and their upload status to ad platforms for offline conversion tracking.",
+    "Server-confirmed conversions (signups, meetings booked, paid subscriptions) and their upload status to ad platforms for offline conversion tracking.",
 })
 @Entity({
   name: "MarketingConversion",
 })
+/*
+ * One conversion of each type per user/project. Postgres treats NULLs as
+ * distinct, so these indexes only constrain rows that actually carry a user or
+ * project id — conversion types with neither (a booked meeting from an
+ * anonymous visitor) are de-duplicated by their deterministic primary key
+ * instead.
+ */
 @Index("uq_marketing_conversion_type_user", ["conversionType", "userId"], {
   unique: true,
 })
@@ -58,7 +67,7 @@ export default class MarketingConversion extends BaseModel {
     type: TableColumnType.ShortText,
     required: true,
     title: "Conversion Type",
-    description: "SignUp or PaidSubscription.",
+    description: "SignUp, MeetingBooked or PaidSubscription.",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -77,7 +86,8 @@ export default class MarketingConversion extends BaseModel {
     type: TableColumnType.ObjectID,
     required: false,
     title: "User ID",
-    description: "User this conversion belongs to (SignUp conversions).",
+    description:
+      "User this conversion belongs to (SignUp conversions). Null when the conversion has no OneUptime user yet, as with a booked meeting.",
   })
   @Column({
     type: ColumnType.ObjectID,
@@ -170,7 +180,7 @@ export default class MarketingConversion extends BaseModel {
     required: false,
     title: "Conversion Value (USD Cents)",
     description:
-      "Conversion value in USD cents (monthly recurring revenue for paid subscriptions). Null when unknown (custom pricing) or not applicable (signups).",
+      "Conversion value in USD cents (monthly recurring revenue for paid subscriptions). Null when unknown (custom pricing) or not applicable (signups, booked meetings).",
   })
   @Column({
     type: ColumnType.Number,

package/Models/DatabaseModels/NetworkDeviceLinkRule.ts

@@ -1,6 +1,7 @@
 import Label from "./Label";
 import Project from "./Project";
 import User from "./User";
+import NetworkDeviceLinkRuleScope from "../../Types/NetworkDevice/NetworkDeviceLinkRuleScope";
 import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
@@ -42,6 +43,15 @@ import {
  * cabling. Both cases are reported rather than silently producing an empty
  * map — see NetworkDeviceLinkRuleUtil.
  *
+ * "Exactly one" needs a universe, and `scope` names it. By default the
+ * question is asked across the whole project, which is what every rule
+ * written before that column existed means. Setting it to Site asks the same
+ * question once per site instead, so one rule draws the same router-to-switch
+ * star in every building rather than reporting fourteen candidate routers and
+ * drawing nothing anywhere. A site-scoped rule looks only inside each device's
+ * OWN site — it never reaches up to a parent site — and skips devices that
+ * have no site at all, reporting how many it walked past.
+ *
  * Rules are evaluated when the topology is built, not materialised into
  * NetworkDeviceLink rows: relabelling a device then shows up on the next
  * refresh, and there is nothing to garbage-collect when a rule is deleted.
@@ -342,6 +352,42 @@ export default class NetworkDeviceLinkRule extends BaseModel {
   })
   public parentDeviceLabels?: Array<Label> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateNetworkDeviceLinkRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadNetworkDeviceLinkRule,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditNetworkDeviceLinkRule,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "Parent Scope",
+    description:
+      "How wide the 'exactly one parent device' question is asked. Project (the default) looks for one parent across the whole project. Site asks once per site, so the same rule can draw an uplink in every building. Rules created before this existed are Project.",
+    example: "Project",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    default: NetworkDeviceLinkRuleScope.Project,
+  })
+  public scope?: string = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/OnCallDutyPolicySchedule.ts

@@ -588,6 +588,20 @@ export default class OnCallDutyPolicySchedule extends BaseModel {
   })
   @TableColumn({
     type: TableColumnType.ObjectID,
+    /*
+     * Read through a relation, alongside `name`, so a joined schedule row can
+     * say whether it would page anybody right now. An escalation rule lists
+     * schedules by name and has to mark the ones that are currently uncovered;
+     * that is one join away from the rule, and without this flag
+     * QueryPermission rejects the whole select rather than dropping the column
+     * - the escalation rule page fails to load at all.
+     *
+     * The disclosure is a user id belonging to the same project as the
+     * schedule, to a caller who is already reading the schedule's name off the
+     * same joined row. It is not an @OwnerOnlyColumn: who is on call is
+     * operational state the team is meant to see, not a personal credential.
+     */
+    canReadOnRelationQuery: true,
     title: "Current User ID On Roster",
     description: "User ID who is currently on roster",
     example: "c3d4e5f6-a7b8-9012-cdef-123456789012",

package/Models/DatabaseModels/StatusPage.ts

@@ -928,7 +928,8 @@ export default class StatusPage extends BaseModel {
     required: false,
     type: TableColumnType.HTML,
     title: "Header HTML",
-    description: "Status Page Custom HTML Header",
+    description:
+      "Status Page Custom HTML Header. Served only from a verified custom domain.",
   })
   @Column({
     nullable: true,
@@ -973,7 +974,8 @@ export default class StatusPage extends BaseModel {
     required: false,
     type: TableColumnType.HTML,
     title: "Footer HTML",
-    description: "Status Page Custom HTML Footer",
+    description:
+      "Status Page Custom HTML Footer. Served only from a verified custom domain.",
   })
   @Column({
     nullable: true,
@@ -1018,7 +1020,8 @@ export default class StatusPage extends BaseModel {
     required: false,
     type: TableColumnType.CSS,
     title: "CSS",
-    description: "Status Page Custom CSS Header",
+    description:
+      "Status Page Custom CSS. Served only from a verified custom domain.",
   })
   @Column({
     nullable: true,
@@ -1064,7 +1067,7 @@ export default class StatusPage extends BaseModel {
     type: TableColumnType.JavaScript,
     title: "JavaScript",
     description:
-      "Status Page Custom JavaScript. This runs when the status page is loaded.",
+      "Status Page Custom JavaScript. This runs when the status page is loaded from a verified custom domain.",
   })
   @Column({
     nullable: true,

package/Models/DatabaseModels/UserCall.ts

@@ -315,15 +315,27 @@ class UserCall extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -331,6 +343,85 @@ class UserCall extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserCall;

package/Models/DatabaseModels/UserEmail.ts

@@ -318,15 +318,27 @@ class UserEmail extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -334,6 +346,85 @@ class UserEmail extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserEmail;

package/Models/DatabaseModels/UserIncomingCallNumber.ts

@@ -275,15 +275,27 @@ class UserIncomingCallNumber extends BaseModel {
   })
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -291,6 +303,85 @@ class UserIncomingCallNumber extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserIncomingCallNumber;

package/Models/DatabaseModels/UserPush.ts

@@ -346,6 +346,43 @@ class UserPush extends BaseModel {
     default: false,
   })
   public isVerified?: boolean = undefined;
+
+  /*
+   * Whether this handset should be paged through silent mode and Do Not
+   * Disturb when it is on call. Per DEVICE and not per user on purpose: the
+   * responder's work phone on the nightstand and their tablet on the sofa are
+   * the same person making two different decisions, and only the phone should
+   * be allowed to wake the house.
+   *
+   * Off unless the responder turns it on from that device. It is the one
+   * setting in this product that deliberately defeats the switch a person
+   * flicked to be left alone, so it is opted into rather than out of, and the
+   * app only offers it once the OS has actually granted the capability
+   * (the iOS critical-alert entitlement, or Do Not Disturb access on Android).
+   *
+   * `update` is empty like every other column here: the value is written by
+   * UserPushAPI's critical-alerts route, which checks the row belongs to the
+   * caller and then writes as root. That keeps "who may change this" in one
+   * readable place rather than spread across the generic CRUD surface.
+   */
+  @ColumnAccessControl({
+    create: [Permission.CurrentUser],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    title: "Critical Alerts Enabled",
+    description:
+      "Should on-call notifications to this device override silent mode and Do Not Disturb?",
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    defaultValue: false,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public isCriticalAlertEnabled?: boolean = undefined;
 }
 
 export default UserPush;