@oneuptime/common 12.0.14 → 12.0.16

package/Server/Services/UserService.ts

@@ -42,14 +42,13 @@ import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import Model from "../../Models/DatabaseModels/User";
 import SlackUtil from "../Utils/Workspace/Slack/Slack";
 import ProductAnalytics from "../Utils/ProductAnalytics";
-import UserTotpAuth from "../../Models/DatabaseModels/UserTotpAuth";
 import UserTotpAuthService from "./UserTotpAuthService";
-import UserWebAuthn from "../../Models/DatabaseModels/UserWebAuthn";
 import UserWebAuthnService from "./UserWebAuthnService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import { getPasswordValidationError } from "../../Types/Password";
 import UserAuthenticationStatus from "../../Types/UserAuthenticationStatus";
+import TwoFactorAuthStatus from "../../Types/TwoFactorAuthStatus";
 import Name from "../../Types/Name";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Timezone from "../../Types/Timezone";
@@ -293,55 +292,60 @@ export class Service extends DatabaseService<Model> {
       carryForward = users;
     }
 
-    if (updateBy.data.enableTwoFactorAuth) {
-      // check if any two factor auth is verified.
-
-      const users: Array<Model> = await this.findBy({
-        query: updateBy.query,
-        select: {
-          _id: true,
-          email: true,
-        },
-        props: updateBy.props,
-        limit: LIMIT_MAX,
-        skip: 0,
-      });
-
-      for (const user of users) {
-        const totpAuth: UserTotpAuth | null =
-          await UserTotpAuthService.findOneBy({
-            query: {
-              userId: user.id!,
-              isVerified: true,
-            },
-            select: {
-              _id: true,
-            },
-            props: {
-              isRoot: true,
-            },
-          });
-
-        const webAuthn: UserWebAuthn | null =
-          await UserWebAuthnService.findOneBy({
-            query: {
-              userId: user.id!,
-              isVerified: true,
-            },
-            select: {
-              _id: true,
-            },
-            props: {
-              isRoot: true,
-            },
-          });
+    /*
+     * There used to be a guard here refusing to set `enableTwoFactorAuth` on
+     * an account with no verified authenticator, on the grounds that doing so
+     * locked the user out: login demanded a second factor, found none, and
+     * said "contact your admin".
+     *
+     * That is no longer true, and the guard was the single thing standing in
+     * the way of the feature it appeared to protect. Login now sends an
+     * account in that state through ENROLMENT -- a QR code and a code to type
+     * back -- rather than refusing it (see App/FeatureSet/Identity/API/
+     * Authentication.ts). "Required, nothing set up yet" is therefore an
+     * ordinary, recoverable state, and it is exactly the state an admin
+     * creates on purpose when they mandate two factor auth for somebody who
+     * has never used it.
+     *
+     * Keeping the guard would have meant an admin could only require two
+     * factor auth from users who had already volunteered for it, which is the
+     * opposite of what a mandate is for.
+     *
+     * What replaces it is the guard below, which protects the opposite
+     * direction.
+     */
 
-        if (!totpAuth && !webAuthn) {
-          throw new BadDataException(
-            "Please verify two factor authentication method before you enable two factor authentication.",
-          );
-        }
-      }
+    /*
+     * TURNING THE REQUIREMENT OFF IS A MASTER-ADMIN ACTION, NOT A USER ONE.
+     *
+     * `enableTwoFactorAuth` carries `update: [Permission.CurrentUser]` and the
+     * User table's row ACL scopes updates to the caller's own id, so without
+     * this every signed-in user can clear their own flag with an ordinary
+     * `PUT /user/<their own id>` -- and the product ships the button that does
+     * it, at Dashboard > Profile > Two Factor Authentication.
+     *
+     * That makes an admin mandate self-undoing. The admin requires two factor
+     * auth, the user is marched through enrolment at their next sign-in, and
+     * then, from the session they just earned, they switch it straight back
+     * off and delete the factor. The account is password-only again and the
+     * Authentication page reports the mandate as simply absent.
+     *
+     * So: anybody may turn the requirement ON for themselves -- self-service
+     * enrolment is a feature and taking it away would help nobody -- but only
+     * a root caller may turn it OFF. The one root caller is
+     * `setTwoFactorAuthRequired` below, reached through the master-admin
+     * endpoint. A user who wants two factor auth removed now has to ask an
+     * administrator, which is the point of the feature.
+     *
+     * Keyed on `isRoot` rather than on a master-admin check because a master
+     * admin editing their OWN row through the CRUD API is still that user, and
+     * the flag should move through the endpoint that also revokes sessions
+     * either way.
+     */
+    if (updateBy.data.enableTwoFactorAuth === false && !updateBy.props.isRoot) {
+      throw new BadDataException(
+        "Only an administrator can turn off two factor authentication for this account.",
+      );
     }
 
     return { updateBy, carryForward: carryForward };
@@ -782,14 +786,243 @@ export class Service extends DatabaseService<Model> {
         !OneUptimeDate.hasExpired(user.resetPasswordExpires),
     );
 
+    const isTwoFactorAuthEnabled: boolean = Boolean(user.enableTwoFactorAuth);
+
+    const verifiedTwoFactorAuthMethodCount: number =
+      await this.countVerifiedTwoFactorAuthMethods(userId);
+
     return {
       hasPassword: Boolean(user.password),
       isEmailVerified: Boolean(user.isEmailVerified),
-      isTwoFactorAuthEnabled: Boolean(user.enableTwoFactorAuth),
+      isTwoFactorAuthEnabled: isTwoFactorAuthEnabled,
+      twoFactorAuthStatus: Service.deriveTwoFactorAuthStatus({
+        isTwoFactorAuthEnabled: isTwoFactorAuthEnabled,
+        verifiedMethodCount: verifiedTwoFactorAuthMethodCount,
+      }),
+      verifiedTwoFactorAuthMethodCount: verifiedTwoFactorAuthMethodCount,
       hasPendingPasswordResetLink: hasPendingPasswordResetLink,
     };
   }
 
+  /**
+   * How many authenticators this user has actually finished setting up, across
+   * TOTP apps and security keys together.
+   *
+   * `isVerified: true` is mandatory on BOTH queries and the two tables reach
+   * it differently, which is what makes leaving it off a real bug rather than
+   * a redundancy. `UserTotpAuthService.onBeforeCreate` writes `isVerified =
+   * false` and only the enrolment step flips it, so an abandoned QR scan
+   * leaves a row behind forever; `UserWebAuthnService` creates its rows
+   * already verified because the WebAuthn ceremony has no half-finished state.
+   * Counting unverified rows would therefore report a user who has never once
+   * typed a code as fully configured -- and that user is precisely the one an
+   * operator is looking at the page to help.
+   */
+  @CaptureSpan()
+  private async countVerifiedTwoFactorAuthMethods(
+    userId: ObjectID,
+  ): Promise<number> {
+    const verifiedTotpCount: PositiveNumber = await UserTotpAuthService.countBy(
+      {
+        query: {
+          userId: userId,
+          isVerified: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      },
+    );
+
+    const verifiedWebAuthnCount: PositiveNumber =
+      await UserWebAuthnService.countBy({
+        query: {
+          userId: userId,
+          isVerified: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    return verifiedTotpCount.toNumber() + verifiedWebAuthnCount.toNumber();
+  }
+
+  /**
+   * The requirement and the configuration folded into one value.
+   *
+   * Kept as a pure static so the table in Common/Types/TwoFactorAuthStatus.ts
+   * exists in exactly one place in code as well as in prose. Note the middle
+   * case: required with nothing set up is NOT an error state, it is the state
+   * an admin deliberately creates and that login resolves through enrolment.
+   */
+  public static deriveTwoFactorAuthStatus(data: {
+    isTwoFactorAuthEnabled: boolean;
+    verifiedMethodCount: number;
+  }): TwoFactorAuthStatus {
+    if (!data.isTwoFactorAuthEnabled) {
+      return TwoFactorAuthStatus.NotEnabled;
+    }
+
+    if (data.verifiedMethodCount > 0) {
+      return TwoFactorAuthStatus.EnabledConfigured;
+    }
+
+    return TwoFactorAuthStatus.EnabledPendingSetup;
+  }
+
+  /**
+   * Turn the two factor auth requirement on or off for one user, on a master
+   * admin's say-so.
+   *
+   * This is a dedicated method rather than a `PUT /user/:id` carrying
+   * `enableTwoFactorAuth`, for the same reason `setPassword` is: the generic
+   * write would work -- a master admin bypasses the column's ACL -- but it
+   * would skip the session revocation below, and nothing about the URL would
+   * tell a reader that turning this flag on signs somebody out.
+   *
+   * Turning it ON revokes every session; turning it OFF does not. That
+   * asymmetry is deliberate:
+   *
+   *  - `getUserMiddleware` validates an access token statelessly and never
+   *    looks at `UserSession`, so a user who is already signed in keeps working
+   *    for the rest of that token's ~15 minute life no matter what is written
+   *    here. Revoking is what stops POST /refresh-token -- which DOES check
+   *    `isRevoked` -- from renewing it indefinitely, so it bounds the window
+   *    to one token lifetime instead of leaving it open forever. Without this
+   *    call, "require two factor auth" would be a promise the product does not
+   *    keep for anybody currently signed in;
+   *  - relaxing a requirement creates no such window, and signing the whole
+   *    company out to give them LESS to do would be gratuitous.
+   *
+   * Session revocation lives here rather than in `onUpdateSuccess` because
+   * that hook only fires its revocation for updates carrying a password, and
+   * `onBeforeUpdate` only populates the `carryForward` it reads for password
+   * or email writes. An MFA-only write reaches neither.
+   */
+  @CaptureSpan()
+  public async setTwoFactorAuthRequired(data: {
+    userId: ObjectID;
+    isRequired: boolean;
+  }): Promise<void> {
+    const user: Model | null = await this.findOneBy({
+      query: {
+        _id: data.userId,
+      },
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!user) {
+      throw new NotFoundException("User not found.");
+    }
+
+    await this.updateOneById({
+      id: user.id!,
+      data: {
+        enableTwoFactorAuth: data.isRequired,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (data.isRequired) {
+      /*
+       * Kept short on purpose: `UserSession.revokedReason` is a ShortText
+       * column, and an over-long reason would fail the write that is supposed
+       * to be closing a security window.
+       */
+      await UserSessionService.revokeAllSessionsByUserId(user.id!, {
+        reason: "Two factor auth required by admin",
+      });
+    }
+
+    logger.info(
+      `Two factor auth requirement set to ${data.isRequired} by a master admin for user: ${user.id!.toString()}`,
+    );
+  }
+
+  /**
+   * Throw away everything this user has set up for two factor auth, so that
+   * they start again from a fresh QR code.
+   *
+   * This is the lost-device fix. Somebody whose phone is gone cannot produce a
+   * code, cannot therefore sign in, and -- because two factor auth is
+   * self-service everywhere else in the product -- cannot reach the page that
+   * would let them enrol a new one. Deleting their authenticators from the
+   * outside is the only way back in.
+   *
+   * `enableTwoFactorAuth` is deliberately LEFT ALONE. "Reset" means clear the
+   * configuration and keep the requirement: an account under a mandate lands
+   * on a new QR code at its next sign-in, which is the whole point. Clearing
+   * the flag as well would quietly downgrade the account's security while
+   * answering a request that never asked for that, and an operator helping
+   * with a lost phone would have no reason to notice.
+   *
+   * Unverified rows go too. They are abandoned enrolment attempts, and leaving
+   * one behind would hand the user back the very QR code they could not
+   * finish rather than a new one.
+   */
+  @CaptureSpan()
+  public async resetTwoFactorAuth(data: { userId: ObjectID }): Promise<void> {
+    const user: Model | null = await this.findOneBy({
+      query: {
+        _id: data.userId,
+      },
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!user) {
+      throw new NotFoundException("User not found.");
+    }
+
+    await UserTotpAuthService.deleteBy({
+      query: {
+        userId: user.id!,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    await UserWebAuthnService.deleteBy({
+      query: {
+        userId: user.id!,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    /*
+     * Ordered after the deletes, not before. A session that survives a reset
+     * is a session that never has to prove the second factor again, which
+     * would make "reset because the device was stolen" do nothing about the
+     * person holding the stolen device.
+     */
+    await UserSessionService.revokeAllSessionsByUserId(user.id!, {
+      reason: "Two factor auth reset by admin",
+    });
+
+    logger.info(
+      `Two factor auth reset by a master admin for user: ${user.id!.toString()}`,
+    );
+  }
+
   /**
    * Set one user's password on their behalf. Used by the master-admin route
    * behind Admin Dashboard > User > Authentication.

package/Server/Services/UserTotpAuthService.ts

@@ -1,16 +1,12 @@
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import { OnCreate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/UserTotpAuth";
 import TotpAuth from "../Utils/TotpAuth";
 import UserService from "./UserService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import User from "../../Models/DatabaseModels/User";
-import DeleteBy from "../Types/Database/DeleteBy";
-import LIMIT_MAX from "../../Types/Database/LimitMax";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
-import UserWebAuthn from "../../Models/DatabaseModels/UserWebAuthn";
-import UserWebAuthnService from "./UserWebAuthnService";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -58,87 +54,32 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
-  @CaptureSpan()
-  protected override async onBeforeDelete(
-    deleteBy: DeleteBy<Model>,
-  ): Promise<OnDelete<Model>> {
-    const itemsToBeDeleted: Array<Model> = await this.findBy({
-      query: deleteBy.query,
-      select: {
-        userId: true,
-        _id: true,
-        isVerified: true,
-      },
-      limit: LIMIT_MAX,
-      skip: 0,
-      props: deleteBy.props,
-    });
-
-    for (const item of itemsToBeDeleted) {
-      if (item.isVerified) {
-        // check if  user two auth is enabled.
-
-        const user: User | null = await UserService.findOneById({
-          id: item.userId!,
-          props: {
-            isRoot: true,
-          },
-          select: {
-            enableTwoFactorAuth: true,
-          },
-        });
-
-        if (!user) {
-          throw new BadDataException("User not found");
-        }
-
-        if (user.enableTwoFactorAuth) {
-          // if enabled then check if this is the only verified 2FA method for this user.
-
-          const verifiedTotpItems: Array<Model> = await this.findBy({
-            query: {
-              userId: item.userId!,
-              isVerified: true,
-            },
-            select: {
-              _id: true,
-            },
-            limit: LIMIT_MAX,
-            skip: 0,
-            props: deleteBy.props,
-          });
-
-          const verifiedWebAuthnItems: Array<UserWebAuthn> =
-            await UserWebAuthnService.findBy({
-              query: {
-                userId: item.userId!,
-                isVerified: true,
-              },
-              select: {
-                _id: true,
-              },
-              limit: LIMIT_MAX,
-              skip: 0,
-              props: deleteBy.props,
-            });
-
-          const totalVerified2FA: number =
-            verifiedTotpItems.length + verifiedWebAuthnItems.length;
-
-          if (totalVerified2FA === 1) {
-            throw new BadDataException(
-              "You must have atleast one verified two factor auth. Please disable two factor auth before deleting this item.",
-            );
-          }
-        }
-      }
-    }
-
-    return {
-      deleteBy: deleteBy,
-      carryForward: {},
-    };
-  }
+  /*
+   * There is no `onBeforeDelete` here any more.
+   *
+   * It used to refuse the deletion of a user's LAST verified factor while
+   * `enableTwoFactorAuth` was on, telling them to "disable two factor auth
+   * before deleting this item". Both halves of that stopped being true:
+   *
+   *  - the advice is impossible to follow for a user whose two factor auth was
+   *    mandated by an admin. They cannot turn the requirement off, so the
+   *    guard did not protect them, it stranded them on an authenticator they
+   *    may have been trying to replace -- and it would have made
+   *    UserService.resetTwoFactorAuth, the fix for a lost device, throw on the
+   *    one account that needs it most;
+   *  - the lockout it protected against no longer exists. An account that is
+   *    required to use two factor auth and has nothing set up is now sent
+   *    through enrolment at its next sign-in rather than refused, so deleting
+   *    the last factor costs a QR code, not an account.
+   *
+   * It was also wrong on its own terms: it counted the verified factors that
+   * existed BEFORE the delete, once per item, inside a loop over the whole
+   * `deleteBy` set -- so removing two verified factors in a single call passed
+   * the check twice and landed in exactly the state it existed to prevent.
+   *
+   * The same guard has been removed from UserWebAuthnService for the same
+   * reasons; the two were mirror images and had to move together.
+   */
 }
 
 export default new Service();

package/Server/Services/UserWebAuthnService.ts

@@ -1,12 +1,11 @@
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import { OnCreate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/UserWebAuthn";
 import UserService from "./UserService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import User from "../../Models/DatabaseModels/User";
-import DeleteBy from "../Types/Database/DeleteBy";
-import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import {
   generateRegistrationOptions,
@@ -17,8 +16,6 @@ import {
 import { Host, HttpProtocol } from "../EnvironmentConfig";
 import ObjectID from "../../Types/ObjectID";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
-import UserTotpAuth from "../../Models/DatabaseModels/UserTotpAuth";
-import UserTotpAuthService from "./UserTotpAuthService";
 import OneUptimeDate from "../../Types/Date";
 
 const WEBAUTHN_CHALLENGE_TTL_MINUTES: number = 5;
@@ -441,87 +438,30 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
-  @CaptureSpan()
-  protected override async onBeforeDelete(
-    deleteBy: DeleteBy<Model>,
-  ): Promise<OnDelete<Model>> {
-    const itemsToBeDeleted: Array<Model> = await this.findBy({
-      query: deleteBy.query,
-      select: {
-        userId: true,
-        _id: true,
-        isVerified: true,
-      },
-      limit: LIMIT_MAX,
-      skip: 0,
-      props: deleteBy.props,
-    });
-
-    for (const item of itemsToBeDeleted) {
-      if (item.isVerified) {
-        // check if user two auth is enabled.
-
-        const user: User | null = await UserService.findOneById({
-          id: item.userId!,
-          props: {
-            isRoot: true,
-          },
-          select: {
-            enableTwoFactorAuth: true,
-          },
-        });
-
-        if (!user) {
-          throw new BadDataException("User not found");
-        }
-
-        if (user.enableTwoFactorAuth) {
-          // if enabled then check if this is the only verified 2FA method for this user.
-
-          const verifiedWebAuthnItems: Array<Model> = await this.findBy({
-            query: {
-              userId: item.userId!,
-              isVerified: true,
-            },
-            select: {
-              _id: true,
-            },
-            limit: LIMIT_MAX,
-            skip: 0,
-            props: deleteBy.props,
-          });
-
-          const verifiedTotpItems: Array<UserTotpAuth> =
-            await UserTotpAuthService.findBy({
-              query: {
-                userId: item.userId!,
-                isVerified: true,
-              },
-              select: {
-                _id: true,
-              },
-              limit: LIMIT_MAX,
-              skip: 0,
-              props: deleteBy.props,
-            });
-
-          const totalVerified2FA: number =
-            verifiedWebAuthnItems.length + verifiedTotpItems.length;
-
-          if (totalVerified2FA === 1) {
-            throw new BadDataException(
-              "You must have atleast one verified two factor auth. Please disable two factor auth before deleting this item.",
-            );
-          }
-        }
-      }
-    }
-
-    return {
-      deleteBy: deleteBy,
-      carryForward: {},
-    };
-  }
+  /*
+   * There is no `onBeforeDelete` here any more.
+   *
+   * It used to refuse the deletion of a user's LAST verified factor while
+   * `enableTwoFactorAuth` was on, telling them to "disable two factor auth
+   * before deleting this item". Both halves of that stopped being true:
+   *
+   *  - the advice is impossible to follow for a user whose two factor auth was
+   *    mandated by an admin. They cannot turn the requirement off, so the
+   *    guard did not protect them, it stranded them on an authenticator they
+   *    may have been trying to replace;
+   *  - the lockout it protected against no longer exists. An account that is
+   *    required to use two factor auth and has nothing set up is now sent
+   *    through enrolment at its next sign-in rather than refused, so deleting
+   *    the last factor costs a QR code, not an account.
+   *
+   * It was also wrong on its own terms: it counted the verified factors that
+   * existed BEFORE the delete, once per item, inside a loop over the whole
+   * `deleteBy` set -- so removing two verified factors in a single call passed
+   * the check twice and landed in exactly the state it existed to prevent.
+   *
+   * The same guard has been removed from UserTotpAuthService for the same
+   * reasons; the two were mirror images and had to move together.
+   */
 }
 
 export default new Service();

package/Server/Types/Billing/MeteredPlan/AllMeteredPlans.ts

@@ -60,6 +60,17 @@ export const SessionReplayDataIngestMeteredPlan: TelemetryMeteredPlanType =
       SESSION_REPLAY_PRICE_IN_USD_PER_GB / TELEMETRY_PRICE_RETENTION_IN_DAYS, // 2.00 per 15 days per GB
   });
 
+/*
+ * Security events are priced at telemetry parity: they ride the same
+ * ingest/storage machinery as logs and the driver is the same (bytes of
+ * events retained).
+ */
+export const SecurityEventsDataIngestMeteredPlan: TelemetryMeteredPlanType =
+  new TelemetryMeteredPlanType({
+    productType: ProductType.SecurityEvents,
+    unitCostInUSD: TELEMETRY_UNIT_COST_IN_USD, // 0.10 per 15 days per GB
+  });
+
 const AllMeteredPlans: Array<ServerMeteredPlan> = [
   ActiveMonitoringMeteredPlan,
   LogDataIngestMeteredPlan,
@@ -67,6 +78,7 @@ const AllMeteredPlans: Array<ServerMeteredPlan> = [
   TracesDataIngestMetredPlan,
   ProfilesDataIngestMeteredPlan,
   SessionReplayDataIngestMeteredPlan,
+  SecurityEventsDataIngestMeteredPlan,
 ];
 
 export class MeteredPlanUtil {
@@ -84,6 +96,8 @@ export class MeteredPlanUtil {
       return ProfilesDataIngestMeteredPlan;
     } else if (productType === ProductType.SessionReplay) {
       return SessionReplayDataIngestMeteredPlan;
+    } else if (productType === ProductType.SecurityEvents) {
+      return SecurityEventsDataIngestMeteredPlan;
     } else if (productType === ProductType.ActiveMonitoring) {
       return ActiveMonitoringMeteredPlan;
     }