@oneuptime/common 12.0.14 → 12.0.15

package/Models/DatabaseModels/GlobalOidc.ts

@@ -235,6 +235,26 @@ export default class GlobalOIDC extends BaseModel {
   })
   public disableSignUpWithSso?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Restrict to Attached Projects",
+    description:
+      "When enabled, a login through this provider only satisfies SSO enforcement for the projects attached below. Leave this off (the default) and the provider satisfies SSO enforcement for every project the user is a member of, which is how attachments have always behaved - they are the provisioning allow-list, not an access boundary. Turning this on narrows access for people already signed in.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public restrictToAttachedProjects?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/GlobalSso.ts

@@ -196,6 +196,26 @@ export default class GlobalSSO extends BaseModel {
   })
   public disableSignUpWithSso?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Restrict to Attached Projects",
+    description:
+      "When enabled, a login through this provider only satisfies SSO enforcement for the projects attached below. Leave this off (the default) and the provider satisfies SSO enforcement for every project the user is a member of, which is how attachments have always behaved - they are the provisioning allow-list, not an access boundary. Turning this on narrows access for people already signed in.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    default: false,
+  })
+  public restrictToAttachedProjects?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/MarketingConversion.ts

@@ -14,11 +14,13 @@ import ObjectID from "../../Types/ObjectID";
 import { Column, Entity, Index } from "typeorm";
 
 /*
- * Internal table (no API access) recording ad-attributed conversions —
- * signups and paid subscriptions from visitors that carried ad click IDs —
- * and the status of uploading each of them to ad platforms (Google Ads
- * offline click conversions, Meta Conversions API). Written and read only by
- * the MarketingConversions worker job.
+ * Internal table (no API access) recording server-confirmed conversions —
+ * signups, booked meetings and paid subscriptions, along with any ad click IDs
+ * the converting visitor carried — and the status of uploading the
+ * ad-uploadable ones to ad platforms (Google Ads offline click conversions,
+ * Meta Conversions API). Browser analytics never write this table: rows are
+ * written by the signup/subscription flows and the Cal.com webhook, and read
+ * by the MarketingConversions worker job.
  */
 @TableAccessControl({
   create: [],
@@ -33,11 +35,18 @@ import { Column, Entity, Index } from "typeorm";
   pluralName: "Marketing Conversions",
   icon: IconProp.ChartBar,
   tableDescription:
-    "Ad-attributed conversions (signups, paid subscriptions) and their upload status to ad platforms for offline conversion tracking.",
+    "Server-confirmed conversions (signups, meetings booked, paid subscriptions) and their upload status to ad platforms for offline conversion tracking.",
 })
 @Entity({
   name: "MarketingConversion",
 })
+/*
+ * One conversion of each type per user/project. Postgres treats NULLs as
+ * distinct, so these indexes only constrain rows that actually carry a user or
+ * project id — conversion types with neither (a booked meeting from an
+ * anonymous visitor) are de-duplicated by their deterministic primary key
+ * instead.
+ */
 @Index("uq_marketing_conversion_type_user", ["conversionType", "userId"], {
   unique: true,
 })
@@ -58,7 +67,7 @@ export default class MarketingConversion extends BaseModel {
     type: TableColumnType.ShortText,
     required: true,
     title: "Conversion Type",
-    description: "SignUp or PaidSubscription.",
+    description: "SignUp, MeetingBooked or PaidSubscription.",
   })
   @Column({
     type: ColumnType.ShortText,
@@ -77,7 +86,8 @@ export default class MarketingConversion extends BaseModel {
     type: TableColumnType.ObjectID,
     required: false,
     title: "User ID",
-    description: "User this conversion belongs to (SignUp conversions).",
+    description:
+      "User this conversion belongs to (SignUp conversions). Null when the conversion has no OneUptime user yet, as with a booked meeting.",
   })
   @Column({
     type: ColumnType.ObjectID,
@@ -170,7 +180,7 @@ export default class MarketingConversion extends BaseModel {
     required: false,
     title: "Conversion Value (USD Cents)",
     description:
-      "Conversion value in USD cents (monthly recurring revenue for paid subscriptions). Null when unknown (custom pricing) or not applicable (signups).",
+      "Conversion value in USD cents (monthly recurring revenue for paid subscriptions). Null when unknown (custom pricing) or not applicable (signups, booked meetings).",
   })
   @Column({
     type: ColumnType.Number,

package/Models/DatabaseModels/NetworkDeviceLinkRule.ts

@@ -1,6 +1,7 @@
 import Label from "./Label";
 import Project from "./Project";
 import User from "./User";
+import NetworkDeviceLinkRuleScope from "../../Types/NetworkDevice/NetworkDeviceLinkRuleScope";
 import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
@@ -42,6 +43,15 @@ import {
  * cabling. Both cases are reported rather than silently producing an empty
  * map — see NetworkDeviceLinkRuleUtil.
  *
+ * "Exactly one" needs a universe, and `scope` names it. By default the
+ * question is asked across the whole project, which is what every rule
+ * written before that column existed means. Setting it to Site asks the same
+ * question once per site instead, so one rule draws the same router-to-switch
+ * star in every building rather than reporting fourteen candidate routers and
+ * drawing nothing anywhere. A site-scoped rule looks only inside each device's
+ * OWN site — it never reaches up to a parent site — and skips devices that
+ * have no site at all, reporting how many it walked past.
+ *
  * Rules are evaluated when the topology is built, not materialised into
  * NetworkDeviceLink rows: relabelling a device then shows up on the next
  * refresh, and there is nothing to garbage-collect when a rule is deleted.
@@ -342,6 +352,42 @@ export default class NetworkDeviceLinkRule extends BaseModel {
   })
   public parentDeviceLabels?: Array<Label> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateNetworkDeviceLinkRule,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadNetworkDeviceLinkRule,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditNetworkDeviceLinkRule,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "Parent Scope",
+    description:
+      "How wide the 'exactly one parent device' question is asked. Project (the default) looks for one parent across the whole project. Site asks once per site, so the same rule can draw an uplink in every building. Rules created before this existed are Project.",
+    example: "Project",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    default: NetworkDeviceLinkRuleScope.Project,
+  })
+  public scope?: string = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/StatusPage.ts

@@ -928,7 +928,8 @@ export default class StatusPage extends BaseModel {
     required: false,
     type: TableColumnType.HTML,
     title: "Header HTML",
-    description: "Status Page Custom HTML Header",
+    description:
+      "Status Page Custom HTML Header. Served only from a verified custom domain.",
   })
   @Column({
     nullable: true,
@@ -973,7 +974,8 @@ export default class StatusPage extends BaseModel {
     required: false,
     type: TableColumnType.HTML,
     title: "Footer HTML",
-    description: "Status Page Custom HTML Footer",
+    description:
+      "Status Page Custom HTML Footer. Served only from a verified custom domain.",
   })
   @Column({
     nullable: true,
@@ -1018,7 +1020,8 @@ export default class StatusPage extends BaseModel {
     required: false,
     type: TableColumnType.CSS,
     title: "CSS",
-    description: "Status Page Custom CSS Header",
+    description:
+      "Status Page Custom CSS. Served only from a verified custom domain.",
   })
   @Column({
     nullable: true,
@@ -1064,7 +1067,7 @@ export default class StatusPage extends BaseModel {
     type: TableColumnType.JavaScript,
     title: "JavaScript",
     description:
-      "Status Page Custom JavaScript. This runs when the status page is loaded.",
+      "Status Page Custom JavaScript. This runs when the status page is loaded from a verified custom domain.",
   })
   @Column({
     nullable: true,

package/Server/API/StatusPageAPI.ts

@@ -117,6 +117,7 @@ import StatusPageSubscriberNotificationTemplate from "../../Models/DatabaseModel
 import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
 } from "../Services/StatusPageSubscriberNotificationTemplateService";
+import { canServeStatusPageCustomizations } from "../Utils/StatusPageCustomizationAccess";
 
 type EscapeXmlFunction = (text: string) => string;
 
@@ -860,6 +861,12 @@ export default class StatusPageAPI extends BaseAPI<
           ObjectID.validateUUID(statusPageIdParam);
           const objectId: ObjectID = new ObjectID(statusPageIdParam);
 
+          const allowStatusPageCustomizations: boolean =
+            await canServeStatusPageCustomizations({
+              req,
+              statusPageId: objectId,
+            });
+
           const select: Select<StatusPage> = {
             _id: true,
             slug: true,
@@ -870,11 +877,7 @@ export default class StatusPageAPI extends BaseAPI<
             pageTitle: true,
             pageDescription: true,
             copyrightText: true,
-            customCSS: true,
-            customJavaScript: true,
             hidePoweredByOneUptimeBranding: true,
-            headerHTML: true,
-            footerHTML: true,
             enableEmailSubscribers: true,
             enableSlackSubscribers: true,
             enableMicrosoftTeamsSubscribers: true,
@@ -911,6 +914,13 @@ export default class StatusPageAPI extends BaseAPI<
             enabledLanguages: true,
           };
 
+          if (allowStatusPageCustomizations) {
+            select.customCSS = true;
+            select.customJavaScript = true;
+            select.headerHTML = true;
+            select.footerHTML = true;
+          }
+
           const hasEnabledSSO: PositiveNumber =
             await StatusPageSsoService.countBy({
               query: {
@@ -934,6 +944,20 @@ export default class StatusPageAPI extends BaseAPI<
             throw new BadDataException("Status Page not found");
           }
 
+          if (!allowStatusPageCustomizations) {
+            /*
+             * The conditional select above keeps these values out of the
+             * normal database result. Explicit redaction is the second half
+             * of the boundary: it prevents a future eager-load, hook, cache,
+             * or over-populated service result from serializing tenant code
+             * onto the authenticated application's origin.
+             */
+            delete item.customCSS;
+            delete item.customJavaScript;
+            delete item.headerHTML;
+            delete item.footerHTML;
+          }
+
           const footerLinks: Array<StatusPageFooterLink> =
             await StatusPageFooterLinkService.findBy({
               query: {
@@ -987,6 +1011,7 @@ export default class StatusPageAPI extends BaseAPI<
               StatusPageHeaderLink,
             ),
             hasEnabledSSO: hasEnabledSSO.toNumber(),
+            allowStatusPageCustomizations,
           };
 
           return Response.sendJsonObjectResponse(req, res, response);

package/Server/EnvironmentConfig.ts

@@ -368,6 +368,13 @@ export const SubscriptionPlans: Array<SubscriptionPlan> =
 export const AnalyticsKey: string = process.env["ANALYTICS_KEY"] || "";
 export const AnalyticsHost: string = process.env["ANALYTICS_HOST"] || "";
 
+/*
+ * Shared secret Cal.com signs booking webhooks with (App/API/CalWebhook.ts).
+ * Server-only — must never be added to FRONTEND_ENV_ALLOW_LIST. Empty means
+ * the webhook endpoint is disabled and answers 503.
+ */
+export const CalWebhookSecret: string = process.env["CAL_WEBHOOK_SECRET"] || "";
+
 /*
  * Google Ads offline conversion uploads (MarketingConversions worker job).
  * Server-only secrets — must never be added to FRONTEND_ENV_ALLOW_LIST.

package/Server/Infrastructure/Postgres/SchemaMigrations/1787800000000-AddScopeToNetworkDeviceLinkRule.ts

@@ -0,0 +1,19 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddScopeToNetworkDeviceLinkRule1787800000000
+  implements MigrationInterface
+{
+  public name: string = "AddScopeToNetworkDeviceLinkRule1787800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLinkRule" ADD "scope" character varying(100) DEFAULT 'Project'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLinkRule" DROP COLUMN "scope"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1787900000000-AddRestrictToAttachedProjectsToGlobalSso.ts

@@ -0,0 +1,40 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Adds the opt-in that decides whether a Global SSO / Global OIDC provider's
+ * project attachments act as an ACCESS boundary as well as a provisioning one.
+ *
+ * Defaults to false, which is the behaviour every existing installation
+ * already has: a global login satisfies SSO enforcement for every project the
+ * user is a member of. Attachments were introduced as the provisioning
+ * allow-list - "a SAML assertion can only ever provision a user into projects
+ * that a master admin has explicitly attached here" - and the login routers
+ * grant a session on membership of ANY project, so silently reinterpreting
+ * them as an access boundary would lock existing users out of projects they
+ * legitimately reach, with nothing in the product to recover with.
+ *
+ * An admin who wants the narrower behaviour turns it on per provider.
+ */
+export class AddRestrictToAttachedProjectsToGlobalSso1787900000000
+  implements MigrationInterface
+{
+  public name = "AddRestrictToAttachedProjectsToGlobalSso1787900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "GlobalSSO" ADD "restrictToAttachedProjects" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalOIDC" ADD "restrictToAttachedProjects" boolean NOT NULL DEFAULT false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "GlobalOIDC" DROP COLUMN "restrictToAttachedProjects"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GlobalSSO" DROP COLUMN "restrictToAttachedProjects"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -531,6 +531,8 @@ import { AddDeviceRoleAndDeclaredLinkParent1787400000000 } from "./1787400000000
 import { AddEnableSearchEngineIndexingToStatusPage1787500000000 } from "./1787500000000-AddEnableSearchEngineIndexingToStatusPage";
 import { AddNetworkDeviceReachabilityColumns1787600000000 } from "./1787600000000-AddNetworkDeviceReachabilityColumns";
 import { FixTotpOtpUrlAlgorithm1787700000000 } from "./1787700000000-FixTotpOtpUrlAlgorithm";
+import { AddScopeToNetworkDeviceLinkRule1787800000000 } from "./1787800000000-AddScopeToNetworkDeviceLinkRule";
+import { AddRestrictToAttachedProjectsToGlobalSso1787900000000 } from "./1787900000000-AddRestrictToAttachedProjectsToGlobalSso";
 import { MigrationName1787142779538 } from "./1787142779538-MigrationName";
 import { MigrationName1787156982416 } from "./1787156982416-MigrationName";
 
@@ -1070,4 +1072,6 @@ export default [
   AddEnableSearchEngineIndexingToStatusPage1787500000000,
   AddNetworkDeviceReachabilityColumns1787600000000,
   FixTotpOtpUrlAlgorithm1787700000000,
+  AddScopeToNetworkDeviceLinkRule1787800000000,
+  AddRestrictToAttachedProjectsToGlobalSso1787900000000,
 ];

package/Server/Middleware/SlackAuthorization.ts

@@ -10,6 +10,18 @@ import crypto from "crypto";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * Slack sends the digest as "v0=" followed by the 64 hex characters of a
+ * SHA-256 HMAC. Same reasoning as WhatsAppAuthorization: the header is
+ * attacker-controlled on an endpoint whose only authentication IS the
+ * signature, and crypto.timingSafeEqual throws RangeError on a length
+ * mismatch instead of returning false, so the shape is validated before the
+ * comparison. A missing header is covered by the same check - it used to
+ * reach Buffer.from(undefined) and throw a TypeError.
+ */
+const SIGNATURE_PREFIX: string = "v0=";
+const HEX_DIGEST_REGEX: RegExp = /^[a-f0-9]{64}$/i;
+
 export default class SlackAuthorization {
   @CaptureSpan()
   public static async isAuthorizedSlackRequest(
@@ -39,7 +51,9 @@ export default class SlackAuthorization {
     // validate slack signing secret
     const slackSigningSecret: string = SlackAppSigningSecret.toString();
 
-    const slackSignature: string = req.headers["x-slack-signature"] as string;
+    const slackSignature: string | undefined = req.headers[
+      "x-slack-signature"
+    ] as string | undefined;
     const timestamp: string = req.headers[
       "x-slack-request-timestamp"
     ] as string;
@@ -57,19 +71,42 @@ export default class SlackAuthorization {
     logger.debug(`requestBody: `, getLogAttributesFromRequest(req));
     logger.debug(requestBody, getLogAttributesFromRequest(req));
 
+    const providedDigest: string =
+      slackSignature && slackSignature.startsWith(SIGNATURE_PREFIX)
+        ? slackSignature.slice(SIGNATURE_PREFIX.length)
+        : "";
+
+    if (!HEX_DIGEST_REGEX.test(providedDigest)) {
+      logger.error(
+        "Slack request has a missing or malformed X-Slack-Signature header.",
+        getLogAttributesFromRequest(req),
+      );
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new BadDataException("Slack Signature Verification Failed."),
+      );
+    }
+
     const baseString: string = `v0:${timestamp}:${requestBody}`;
-    const signature: string = `v0=${crypto.createHmac("sha256", slackSigningSecret).update(baseString).digest("hex")}`;
+    const expectedDigest: string = crypto
+      .createHmac("sha256", slackSigningSecret)
+      .update(baseString)
+      .digest("hex");
 
     logger.debug(
-      `Generated signature: ${signature}`,
+      `Generated signature: ${SIGNATURE_PREFIX}${expectedDigest}`,
       getLogAttributesFromRequest(req),
     );
 
-    // check if the signature is valid
+    /*
+     * Both sides are decoded from 64 validated hex characters, so both
+     * buffers are 32 bytes and timingSafeEqual cannot throw here.
+     */
     if (
       !crypto.timingSafeEqual(
-        Buffer.from(signature) as Uint8Array,
-        Buffer.from(slackSignature) as Uint8Array,
+        Buffer.from(expectedDigest, "hex") as Uint8Array,
+        Buffer.from(providedDigest, "hex") as Uint8Array,
       )
     ) {
       logger.error(