@oneuptime/common 12.0.13 → 12.0.15

package/Models/DatabaseModels/UserSMS.ts

@@ -317,15 +317,27 @@ class UserSMS extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
-    example: "123456",
+    example: "9f2c1b4a7d3e6058c1f0a9b8d7e6f5c4b3a291807f6e5d4c3b2a19081726354",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -333,6 +345,85 @@ class UserSMS extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserSMS;

package/Models/DatabaseModels/UserWhatsApp.ts

@@ -309,13 +309,25 @@ class UserWhatsApp extends BaseModel {
   @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
-    description: "Temporary Verification Code",
+    description:
+      "Keyed digest of the temporary verification code — never the code itself",
     isDefaultValueColumn: true,
     computed: true,
     required: true,
     type: TableColumnType.ShortText,
+    /*
+     * A row is born with NO usable code on it: a 64-character random
+     * placeholder that no six-digit code can ever hash to. The real code is
+     * generated, hashed and sent by this channel's service once the row
+     * exists — the row id is part of the hashed message, so the digest cannot
+     * be computed before the insert has assigned one.
+     *
+     * This stays a forced default rather than moving wholly into the service
+     * hook because the column is NOT NULL and must be satisfied on every
+     * create path, including those that pass props.ignoreHooks.
+     */
     forceGetDefaultValueOnCreate: () => {
-      return Text.generateRandomNumber(6);
+      return Text.generateRandomText(64);
     },
   })
   @Column({
@@ -324,6 +336,85 @@ class UserWhatsApp extends BaseModel {
     length: ColumnLength.ShortText,
   })
   public verificationCode?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When the code currently on this row stops being accepted.
+   *
+   * NULL means there is no live code: none was ever issued, or the last one
+   * was used, or it was burned by the attempt limit — or the row predates
+   * this column, which is read the same conservative way. Without an expiry
+   * the six-digit code space stood open indefinitely, which is what made
+   * walking it worthwhile.
+   */
+  @TableColumn({
+    title: "Verification Code Expires At",
+    description: "When the verification code on this row stops being accepted",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * Wrong guesses made against the code currently on this row, reset to zero
+   * each time a code is issued.
+   *
+   * This is the counter that stops /verify being an unlimited oracle over a
+   * space small enough to walk in minutes. It is incremented with a single
+   * atomic UPDATE ... RETURNING rather than a read-modify-write, because
+   * requests racing each other are the normal shape of the attack.
+   */
+  @TableColumn({
+    title: "Verification Failed Attempts",
+    description:
+      "Incorrect verification attempts made against the current verification code",
+    computed: true,
+    type: TableColumnType.Number,
+  })
+  @Column({
+    type: ColumnType.Number,
+    nullable: false,
+    default: 0,
+  })
+  public verificationFailedAttempts?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  /*
+   * When a verification code was last sent for this row.
+   *
+   * Drives the resend cooldown. Without it, "spend the five attempts, ask for
+   * a fresh code, repeat" costs an attacker nothing — and the resend control
+   * doubles as a way to send somebody unsolicited messages at whatever rate
+   * the network allows, at the project's expense.
+   */
+  @TableColumn({
+    title: "Verification Code Sent At",
+    description: "When a verification code was last sent for this row",
+    computed: true,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+  })
+  public verificationCodeSentAt?: Date = undefined;
 }
 
 export default UserWhatsApp;

package/Server/API/BaseAPI.ts

@@ -298,20 +298,85 @@ export default class BaseAPI<
     const databaseProps: DatabaseCommonInteractionProps =
       await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-    const list: Array<BaseModel> = await this.service.findBy({
-      query,
-      select,
-      skip: skip,
-      limit: limit,
-      groupBy: groupBy,
-      sort: sort,
-      props: databaseProps,
-    });
-
-    const count: PositiveNumber = await this.service.countBy({
-      query,
-      props: databaseProps,
-    });
+    /*
+     * findBy and countBy are independent reads, so run them in parallel to
+     * cut list latency where the count is costly. The one thing that makes
+     * the sequential order load-bearing is a service-level onBeforeFind
+     * override that mutates the shared query/props objects in place (e.g.
+     * ProjectService elevates props.isRoot and pins query._id for users with
+     * no projects; the incident/alert privacy filters rewrite query keys):
+     * countBy historically ran after findBy and inherited those mutations.
+     * Services on the stock hook cannot mutate anything (and the permission
+     * pipeline copies the query before touching it, ReadPermission.ts:33),
+     * so only they run in parallel; hook-overriding services keep the
+     * sequential order and its exact semantics.
+     */
+    const usesStockOnBeforeFindHook: boolean =
+      (this.service as unknown as { onBeforeFind: unknown }).onBeforeFind ===
+      (DatabaseService.prototype as unknown as { onBeforeFind: unknown })
+        .onBeforeFind;
+
+    let list: Array<BaseModel>;
+    let count: PositiveNumber;
+
+    if (usesStockOnBeforeFindHook) {
+      const listPromise: Promise<Array<BaseModel>> = this.service.findBy({
+        query,
+        select,
+        skip: skip,
+        limit: limit,
+        groupBy: groupBy,
+        sort: sort,
+        props: databaseProps,
+      });
+
+      /*
+       * Shallow copies so a countBy override that rewrites top-level query
+       * keys (the established privacy-filter pattern) can never race the
+       * concurrent findBy's reads of the shared objects.
+       */
+      const countPromise: Promise<PositiveNumber> = this.service.countBy({
+        query: { ...query },
+        props: { ...databaseProps },
+      });
+
+      /*
+       * allSettled instead of Promise.all: a findBy rejection must not leave
+       * countPromise as an unhandled rejection, and findBy's error keeps
+       * priority when both fail - the same failure the sequential code
+       * surfaced.
+       */
+      const [listResult, countResult]: [
+        PromiseSettledResult<Array<BaseModel>>,
+        PromiseSettledResult<PositiveNumber>,
+      ] = await Promise.allSettled([listPromise, countPromise]);
+
+      if (listResult.status === "rejected") {
+        throw listResult.reason;
+      }
+
+      if (countResult.status === "rejected") {
+        throw countResult.reason;
+      }
+
+      list = listResult.value;
+      count = countResult.value;
+    } else {
+      list = await this.service.findBy({
+        query,
+        select,
+        skip: skip,
+        limit: limit,
+        groupBy: groupBy,
+        sort: sort,
+        props: databaseProps,
+      });
+
+      count = await this.service.countBy({
+        query,
+        props: databaseProps,
+      });
+    }
 
     return Response.sendEntityArrayResponse(
       req,

package/Server/API/StatusPageAPI.ts

@@ -117,6 +117,7 @@ import StatusPageSubscriberNotificationTemplate from "../../Models/DatabaseModel
 import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
 } from "../Services/StatusPageSubscriberNotificationTemplateService";
+import { canServeStatusPageCustomizations } from "../Utils/StatusPageCustomizationAccess";
 
 type EscapeXmlFunction = (text: string) => string;
 
@@ -860,6 +861,12 @@ export default class StatusPageAPI extends BaseAPI<
           ObjectID.validateUUID(statusPageIdParam);
           const objectId: ObjectID = new ObjectID(statusPageIdParam);
 
+          const allowStatusPageCustomizations: boolean =
+            await canServeStatusPageCustomizations({
+              req,
+              statusPageId: objectId,
+            });
+
           const select: Select<StatusPage> = {
             _id: true,
             slug: true,
@@ -870,11 +877,7 @@ export default class StatusPageAPI extends BaseAPI<
             pageTitle: true,
             pageDescription: true,
             copyrightText: true,
-            customCSS: true,
-            customJavaScript: true,
             hidePoweredByOneUptimeBranding: true,
-            headerHTML: true,
-            footerHTML: true,
             enableEmailSubscribers: true,
             enableSlackSubscribers: true,
             enableMicrosoftTeamsSubscribers: true,
@@ -911,6 +914,13 @@ export default class StatusPageAPI extends BaseAPI<
             enabledLanguages: true,
           };
 
+          if (allowStatusPageCustomizations) {
+            select.customCSS = true;
+            select.customJavaScript = true;
+            select.headerHTML = true;
+            select.footerHTML = true;
+          }
+
           const hasEnabledSSO: PositiveNumber =
             await StatusPageSsoService.countBy({
               query: {
@@ -934,6 +944,20 @@ export default class StatusPageAPI extends BaseAPI<
             throw new BadDataException("Status Page not found");
           }
 
+          if (!allowStatusPageCustomizations) {
+            /*
+             * The conditional select above keeps these values out of the
+             * normal database result. Explicit redaction is the second half
+             * of the boundary: it prevents a future eager-load, hook, cache,
+             * or over-populated service result from serializing tenant code
+             * onto the authenticated application's origin.
+             */
+            delete item.customCSS;
+            delete item.customJavaScript;
+            delete item.headerHTML;
+            delete item.footerHTML;
+          }
+
           const footerLinks: Array<StatusPageFooterLink> =
             await StatusPageFooterLinkService.findBy({
               query: {
@@ -987,6 +1011,7 @@ export default class StatusPageAPI extends BaseAPI<
               StatusPageHeaderLink,
             ),
             hasEnabledSSO: hasEnabledSSO.toNumber(),
+            allowStatusPageCustomizations,
           };
 
           return Response.sendJsonObjectResponse(req, res, response);

package/Server/API/UserCallAPI.ts

@@ -1,22 +1,44 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import UserCallService, {
   Service as UserCallServiceType,
 } from "../Services/UserCallService";
-import UserNotificationRuleService from "../Services/UserNotificationRuleService";
 import {
   ExpressRequest,
   ExpressResponse,
   NextFunction,
   OneUptimeRequest,
 } from "../Utils/Express";
+import ChannelVerification, {
+  ChannelVerificationOutcome,
+  ChannelVerificationResult,
+} from "../Utils/ChannelVerification";
 import Response from "../Utils/Response";
-import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import BaseAPI from "./BaseAPI";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import UserCall from "../../Models/DatabaseModels/UserCall";
-import UserSMS from "../../Models/DatabaseModels/UserSMS";
+import UserNotificationRuleService from "../Services/UserNotificationRuleService";
+import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 
+/*
+ * The verify and resend routes for this notification channel.
+ *
+ * Neither the checking of a submitted code nor the issuing of a new one lives
+ * here, on purpose. The state machine is shared by all five channels
+ * (Common/Server/Utils/ChannelVerification.ts) so that a control added for one
+ * of them cannot quietly go missing on another — which is exactly what went
+ * wrong before: five hand-written copies of "compare the column, set
+ * isVerified", none of which expired the code, counted attempts, or refused a
+ * caller running the comparison a million times against somebody else's phone
+ * number.
+ *
+ * What is left here is the HTTP shape: reject malformed bodies, run the rate
+ * limiter before anything costs a database read, and turn the outcome into a
+ * response.
+ */
 export default class UserCallAPI extends BaseAPI<
   UserCall,
   UserCallServiceType
@@ -27,6 +49,9 @@ export default class UserCallAPI extends BaseAPI<
     this.router.post(
       `/user-call/verify`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Verify,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -47,33 +72,10 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
-          // Check if the code matches and verify the phone number.
-          const item: UserSMS | null = await this.service.findOneById({
-            id: req.body["itemId"],
-            props: {
-              isRoot: true,
-            },
-            select: {
-              userId: true,
-              projectId: true,
-              verificationCode: true,
-            },
-          });
+          const userId: ObjectID | undefined = (req as OneUptimeRequest)
+            ?.userAuthorization?.userId;
 
-          if (!item) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Item not found"),
-            );
-          }
-
-          //check user id
-
-          if (
-            item.userId?.toString() !==
-            (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()
-          ) {
+          if (!userId) {
             return Response.sendErrorResponse(
               req,
               res,
@@ -81,32 +83,30 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
-          if (item.verificationCode !== req.body["code"]) {
+          const result: ChannelVerificationResult =
+            await ChannelVerification.verifyCode({
+              service: this.service,
+              itemId: new ObjectID(req.body["itemId"].toString()),
+              userId: userId,
+              code: req.body["code"].toString(),
+            });
+
+          if (result.outcome !== ChannelVerificationOutcome.Verified) {
             return Response.sendErrorResponse(
               req,
               res,
-              new BadDataException("Invalid code"),
+              ChannelVerification.getFailureException(result.outcome),
             );
           }
 
-          await this.service.updateOneById({
-            id: item.id!,
-            props: {
-              isRoot: true,
-            },
-            data: {
-              isVerified: true,
-            },
-          });
-
-          // Create default notification rules for this verified call number
+          /* Create default notification rules for this verified call number */
           try {
             await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
               {
-                projectId: new ObjectID(item.projectId!.toString()),
-                userId: new ObjectID(item.userId!.toString()),
+                projectId: new ObjectID(result.projectId!.toString()),
+                userId: new ObjectID(result.userId!.toString()),
                 notificationMethod: {
-                  userCallId: item.id!,
+                  userCallId: result.itemId!,
                 },
               },
             );
@@ -127,6 +127,9 @@ export default class UserCallAPI extends BaseAPI<
     this.router.post(
       `/user-call/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -157,6 +160,11 @@ export default class UserCallAPI extends BaseAPI<
             );
           }
 
+          /*
+           * A caller may only ask for a code to be sent to a row they own.
+           * Without this the resend route is a way to make somebody else's
+           * device ring on demand.
+           */
           if (
             item.userId?.toString() !==
             (req as OneUptimeRequest)?.userAuthorization?.userId?.toString()