@oneuptime/common 12.0.15 → 12.0.16

package/Server/Types/Database/Permissions/TenantPermission.ts

@@ -19,6 +19,16 @@ import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
  * Permissions auto-granted to every logged-in tenant user. Holding only these
  * (without an actual role permission) does not signal admin authority and so
  * should not unlock cross-row access on models that scope by user.
+ *
+ * `Permission.ProjectUser` is auto-granted too (AccessTokenService adds it for
+ * every project member) but is deliberately NOT listed here. These three are
+ * granted to callers a model never opted into: any logged-in user, anyone at
+ * all, anyone mid-SSO. `ProjectUser` is different - a model only sees it if it
+ * wrote `Permission.ProjectUser` into its own access list, and that is an
+ * explicit statement that the whole project may read the table, rows and all.
+ * Treating it as auto-granted would silently re-narrow those tables to the
+ * caller's own rows and put the shared owner and label pickers back to empty,
+ * which is the bug this permission exists to fix.
  */
 const AUTO_GRANTED_TENANT_PERMISSIONS: ReadonlyArray<Permission> = [
   Permission.CurrentUser,

package/Server/Types/Database/QueryHelper.ts

@@ -637,7 +637,7 @@ export default class QueryHelper {
     const rid: string = Text.generateRandomText(10);
     return Raw(
       (alias: string) => {
-        return `(${alias} >= :${rid} or ${alias} IS NULL)`;
+        return `(${alias} > :${rid} or ${alias} IS NULL)`;
       },
       {
         [rid]: value,

package/Server/Utils/AI/Chat/ObservabilityChatPrompt.ts

@@ -138,7 +138,7 @@ ${buildActionGuidance(data.permissionMode)}
 ## How to investigate
 
 - Resolve names first: use lookup_context to turn a service name into its ID before filtering other tools by service, and to discover metric names.
-- Prefer aggregations (query_traces, log_histogram, query_metrics, top_exceptions) to establish the shape of a problem, then drill into raw data (search_logs, get_trace) for evidence.
+- Prefer aggregations (query_traces, log_histogram, query_metrics, top_exceptions, security_event_summary) to establish the shape of a problem, then drill into raw data (search_logs, get_trace, search_security_events) for evidence.
 - Always pass explicit ISO 8601 time ranges. If the user did not specify one, use the last hour for logs and the last 24 hours for metrics/traces, and say which window you used.
 - When durations are involved they are in milliseconds unless stated otherwise.
 - Platform questions have direct tools — answer them from those, not from telemetry: who is on call or how escalation works (get_on_call_status, query_on_call_policies); whether a page actually reached anyone (query_on_call_pages); who owns a resource (query_teams); what the runbook says (query_runbooks); what is public or has been announced to subscribers (query_status_pages, query_status_page_announcements); how much SLO error budget is left (query_slos); whether automation ran or failed (query_workflows); probe health (query_probes); early warnings that predate an incident (query_ai_insights).

package/Server/Utils/AI/Toolbox/Index.ts

@@ -39,6 +39,10 @@ import { QueryTeamsTool } from "./TeamTools";
 import { CreateAlertNoteTool, CreateIncidentNoteTool } from "./NoteWriteTools";
 import { TopExceptionsTool } from "./ExceptionTools";
 import { LogHistogramTool, SearchLogsTool } from "./LogTools";
+import {
+  SearchSecurityEventsTool,
+  SecurityEventSummaryTool,
+} from "./SecurityEventTools";
 import { RecentChangesTool } from "./RecentChangesTools";
 import { BaselineAnomalyTool, QueryMetricsTool } from "./MetricTools";
 import { GetTraceTool, QueryTracesTool } from "./TraceTools";
@@ -121,6 +125,8 @@ export default class AIToolbox {
     QueryAIInsightsTool,
     TopExceptionsTool,
     SearchLogsTool,
+    SearchSecurityEventsTool,
+    SecurityEventSummaryTool,
     LogHistogramTool,
     QueryMetricsTool,
     BaselineAnomalyTool,

package/Server/Utils/AI/Toolbox/SecurityEventTools.ts

@@ -0,0 +1,349 @@
+import SecurityEvent from "../../../../Models/AnalyticsModels/SecurityEvent";
+import InBetween from "../../../../Types/BaseDatabase/InBetween";
+import Includes from "../../../../Types/BaseDatabase/Includes";
+import Search from "../../../../Types/BaseDatabase/Search";
+import SortOrder from "../../../../Types/BaseDatabase/SortOrder";
+import { JSONObject } from "../../../../Types/JSON";
+import Permission from "../../../../Types/Permission";
+import {
+  AIChatCitationTarget,
+  AIChatCitationTargetType,
+} from "../../../../Types/AI/AIChatTypes";
+import SecurityEventService from "../../../Services/SecurityEventService";
+import ToolResultSerializer, { SerializedResult } from "./Serializer";
+import WidgetBuilder from "./WidgetBuilder";
+import {
+  ObservabilityTool,
+  TimeRangeSchemaProperties,
+  ToolArgs,
+  ToolContext,
+  ToolExecutionResult,
+} from "./ToolTypes";
+
+/*
+ * AI toolbox over the SecurityEvent table — the "AI security analyst"
+ * surface. Read-only; executes under the requesting user's permission
+ * props like every other analytics tool.
+ */
+
+/*
+ * Derived from the model ACL so the tool gate can never drift from RBAC.
+ * Resolved lazily — this module loads through the service import graph
+ * before the model class is fully wired, so calling a model method at
+ * import time throws a circular-dependency TypeError.
+ */
+let cachedReadPermissions: Array<Permission> | null = null;
+const resolveReadPermissions: () => Array<Permission> =
+  (): Array<Permission> => {
+    if (!cachedReadPermissions) {
+      cachedReadPermissions = new SecurityEvent().getReadPermissions();
+    }
+    return cachedReadPermissions;
+  };
+
+export const SearchSecurityEventsTool: ObservabilityTool = {
+  name: "search_security_events",
+  description:
+    "Search SIEM security events (normalized to OCSF). Filter by time range, severity, event class, message text, user, host, or any observable (IP, hostname, username). Use this to investigate what security activity involved a given entity, or what fired recently.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      ...TimeRangeSchemaProperties,
+      severityNames: {
+        type: "array",
+        items: { type: "string" },
+        description:
+          'Filter by OCSF severity, e.g. ["Critical", "High"] or ["Medium"].',
+      },
+      classNames: {
+        type: "array",
+        items: { type: "string" },
+        description:
+          'Filter by OCSF event class, e.g. ["Authentication", "Detection Finding", "DNS Activity"].',
+      },
+      messageSearchText: {
+        type: "string",
+        description: "Only events whose message contains this text.",
+      },
+      principalUser: {
+        type: "string",
+        description: "Only events where this user is the actor.",
+      },
+      principalHost: {
+        type: "string",
+        description: "Only events where this host is the actor.",
+      },
+      observable: {
+        type: "string",
+        description:
+          "Only events mentioning this observable anywhere (user, hostname, IP, domain). Broader than principalUser/principalHost.",
+      },
+      limit: {
+        type: "number",
+        description: "Maximum events to return (default 25, max 50).",
+      },
+    },
+  },
+  get requiredPermissions(): Array<Permission> {
+    return resolveReadPermissions();
+  },
+  execute: async (
+    args: JSONObject,
+    ctx: ToolContext,
+  ): Promise<ToolExecutionResult> => {
+    const { startTime, endTime } = ToolArgs.getTimeRange(args, {
+      defaultHours: 24,
+      maxDays: 30,
+    });
+    const limit: number = ToolArgs.getNumber(args, "limit", {
+      defaultValue: 25,
+      min: 1,
+      max: 50,
+    });
+
+    const query: JSONObject = {
+      time: new InBetween(startTime, endTime),
+    };
+
+    const severityNames: Array<string> | undefined = ToolArgs.getStringArray(
+      args,
+      "severityNames",
+    );
+    if (severityNames) {
+      query["severityName"] = new Includes(severityNames);
+    }
+
+    const classNames: Array<string> | undefined = ToolArgs.getStringArray(
+      args,
+      "classNames",
+    );
+    if (classNames) {
+      query["className"] = new Includes(classNames);
+    }
+
+    const messageSearchText: string | undefined = ToolArgs.getString(
+      args,
+      "messageSearchText",
+    );
+    if (messageSearchText) {
+      query["message"] = new Search(messageSearchText);
+    }
+
+    const principalUser: string | undefined = ToolArgs.getString(
+      args,
+      "principalUser",
+    );
+    if (principalUser) {
+      query["principalUser"] = principalUser;
+    }
+
+    const principalHost: string | undefined = ToolArgs.getString(
+      args,
+      "principalHost",
+    );
+    if (principalHost) {
+      query["principalHost"] = principalHost;
+    }
+
+    const observable: string | undefined = ToolArgs.getString(
+      args,
+      "observable",
+    );
+    if (observable) {
+      query["observables"] = new Includes([observable]);
+    }
+
+    const events: Array<SecurityEvent> = await SecurityEventService.findBy({
+      query: query as never,
+      select: {
+        time: true,
+        severityName: true,
+        className: true,
+        message: true,
+        principalUser: true,
+        principalHost: true,
+        principalIp: true,
+        targetHost: true,
+        vendorName: true,
+        ruleName: true,
+      } as never,
+      sort: {
+        time: SortOrder.Descending,
+      } as never,
+      limit: limit,
+      skip: 0,
+      props: ctx.props,
+    });
+
+    const rows: Array<JSONObject> = events.map(
+      (event: SecurityEvent): JSONObject => {
+        return {
+          time: event.time,
+          severity: event.severityName,
+          class: event.className,
+          message: event.message,
+          principalUser: event.principalUser,
+          principalHost: event.principalHost,
+          principalIp: event.principalIp,
+          targetHost: event.targetHost,
+          vendor: event.vendorName,
+          rule: event.ruleName,
+        };
+      },
+    );
+
+    const serialized: SerializedResult =
+      ToolResultSerializer.serializeRows(rows);
+
+    const securityEventsLink: AIChatCitationTarget = {
+      type: AIChatCitationTargetType.SecurityEvents,
+    };
+
+    return {
+      dataForLlm: serialized.text,
+      rowCount: serialized.rowCount,
+      citationLabel: `Security events ${startTime.toISOString()} – ${endTime.toISOString()} (${serialized.rowCount} shown)`,
+      citationTarget: securityEventsLink,
+      redactionCount: serialized.redactionCount,
+      isTruncated: serialized.isTruncated,
+      widget:
+        rows.length > 0
+          ? WidgetBuilder.table({
+              title: `Security Events (${rows.length})`,
+              description: `${startTime.toISOString()} – ${endTime.toISOString()}`,
+              columns: [
+                { key: "time", title: "Time", type: "date" },
+                { key: "severity", title: "Severity", type: "text" },
+                { key: "class", title: "Class", type: "text" },
+                { key: "message", title: "Message", type: "text" },
+                { key: "principalHost", title: "Host", type: "text" },
+              ],
+              rows: rows,
+              link: securityEventsLink,
+            })
+          : undefined,
+    };
+  },
+};
+
+// Sample size for the in-code aggregation below.
+const SUMMARY_SAMPLE_LIMIT: number = 500;
+
+export const SecurityEventSummaryTool: ObservabilityTool = {
+  name: "security_event_summary",
+  description:
+    "Summarize security event volume by event class and severity over a time range. Use this first to understand the shape of security activity before drilling into raw events with search_security_events.",
+  inputSchema: {
+    type: "object",
+    properties: {
+      ...TimeRangeSchemaProperties,
+      observable: {
+        type: "string",
+        description:
+          "Optionally scope the summary to events mentioning this observable (user, hostname, IP).",
+      },
+    },
+  },
+  get requiredPermissions(): Array<Permission> {
+    return resolveReadPermissions();
+  },
+  execute: async (
+    args: JSONObject,
+    ctx: ToolContext,
+  ): Promise<ToolExecutionResult> => {
+    const { startTime, endTime } = ToolArgs.getTimeRange(args, {
+      defaultHours: 24,
+      maxDays: 30,
+    });
+
+    const query: JSONObject = {
+      time: new InBetween(startTime, endTime),
+    };
+
+    const observable: string | undefined = ToolArgs.getString(
+      args,
+      "observable",
+    );
+    if (observable) {
+      query["observables"] = new Includes([observable]);
+    }
+
+    /*
+     * Aggregate in code over a bounded sample rather than raw SQL: findBy
+     * runs the model layer's permission scoping, which raw aggregation
+     * would bypass. The sample cap is stated in the result so the model
+     * knows when counts are a floor rather than a total.
+     */
+    const events: Array<SecurityEvent> = await SecurityEventService.findBy({
+      query: query as never,
+      select: {
+        className: true,
+        severityName: true,
+      } as never,
+      sort: {
+        time: SortOrder.Descending,
+      } as never,
+      limit: SUMMARY_SAMPLE_LIMIT,
+      skip: 0,
+      props: ctx.props,
+    });
+
+    const countsByKey: Map<string, JSONObject> = new Map<string, JSONObject>();
+
+    for (const event of events) {
+      const className: string = event.className || "Base Event";
+      const severity: string = event.severityName || "Unknown";
+      const key: string = `${className}|${severity}`;
+
+      const existing: JSONObject | undefined = countsByKey.get(key);
+
+      if (existing) {
+        existing["count"] = (existing["count"] as number) + 1;
+      } else {
+        countsByKey.set(key, {
+          class: className,
+          severity: severity,
+          count: 1,
+        });
+      }
+    }
+
+    const rows: Array<JSONObject> = Array.from(countsByKey.values()).sort(
+      (a: JSONObject, b: JSONObject): number => {
+        return (b["count"] as number) - (a["count"] as number);
+      },
+    );
+
+    const serialized: SerializedResult =
+      ToolResultSerializer.serializeRows(rows);
+
+    const sampleNote: string =
+      events.length >= SUMMARY_SAMPLE_LIMIT
+        ? ` (based on the most recent ${SUMMARY_SAMPLE_LIMIT} events — counts are a floor)`
+        : "";
+
+    return {
+      dataForLlm: serialized.text + sampleNote,
+      rowCount: serialized.rowCount,
+      citationLabel: `Security event summary ${startTime.toISOString()} – ${endTime.toISOString()}${sampleNote}`,
+      citationTarget: {
+        type: AIChatCitationTargetType.SecurityEvents,
+      },
+      redactionCount: serialized.redactionCount,
+      isTruncated: serialized.isTruncated,
+      widget:
+        rows.length > 0
+          ? WidgetBuilder.table({
+              title: "Security events by class and severity",
+              description: `${startTime.toISOString()} – ${endTime.toISOString()}${sampleNote}`,
+              columns: [
+                { key: "class", title: "Event Class", type: "text" },
+                { key: "severity", title: "Severity", type: "text" },
+                { key: "count", title: "Count", type: "number" },
+              ],
+              rows: rows,
+            })
+          : undefined,
+    };
+  },
+};

package/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

@@ -1068,6 +1068,15 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
            * values (including the empty-string default for missing
            * keys), which compares to false against any numeric
            * threshold and naturally drops those rows.
+           *
+           * The threshold binds as Decimal (ClickHouse `Double`), not
+           * Number (`Int32`): the attribute filter form builds these
+           * with `Number(input)` (see buildDictionaryValue in
+           * Common/UI/Components/Dictionary/DictionaryFilterOperator.ts),
+           * so a user can legitimately ask for `duration > 0.5` and an
+           * Int32 bind would fail to parse the fractional value. Double
+           * represents every Int32 exactly, so integer thresholds are
+           * unaffected, and it matches the Float64 comparison side.
            */
           if (mapEntry instanceof GreaterThan) {
             this.appendMapKeyPresenceFilter({
@@ -1082,7 +1091,7 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
                 type: TableColumnType.Text,
               }}]) > ${{
                 value: Number((mapEntry as GreaterThan<any>).value),
-                type: TableColumnType.Number,
+                type: TableColumnType.Decimal,
               }}`,
             );
             continue;
@@ -1101,7 +1110,7 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
                 type: TableColumnType.Text,
               }}]) >= ${{
                 value: Number((mapEntry as GreaterThanOrEqual<any>).value),
-                type: TableColumnType.Number,
+                type: TableColumnType.Decimal,
               }}`,
             );
             continue;
@@ -1120,7 +1129,7 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
                 type: TableColumnType.Text,
               }}]) < ${{
                 value: Number((mapEntry as LessThan<any>).value),
-                type: TableColumnType.Number,
+                type: TableColumnType.Decimal,
               }}`,
             );
             continue;
@@ -1139,7 +1148,7 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
                 type: TableColumnType.Text,
               }}]) <= ${{
                 value: Number((mapEntry as LessThanOrEqual<any>).value),
-                type: TableColumnType.Number,
+                type: TableColumnType.Decimal,
               }}`,
             );
             continue;

package/Server/Utils/Attribution.ts

@@ -1,55 +1,56 @@
+import crypto from "crypto";
+import {
+  AdClickIdKeys,
+  FirstTouchStringKeys,
+  MaxAttributionValueLength,
+  UtmPropertyKeys,
+  UtmUrlPropertyKey,
+  UtmWireKeyToPropertyKey,
+} from "../../Types/Marketing/Attribution";
 import { JSONObject, JSONValue } from "../../Types/JSON";
 
 /*
- * Sanitizers for the publicly-creatable attribution jsonb columns on User
- * (clickIds, firstTouchAttribution). Unauthenticated signup can submit these,
- * so — unlike the varchar(500)-bounded utm columns — they must be whitelisted
- * and size-bounded here before they are persisted, copied onto projects, and
- * forwarded to analytics.
+ * Sanitizers for attribution submitted by unauthenticated callers — the signup
+ * form, the Cal.com booking webhook, and the enterprise licence request form.
+ *
+ * Everything here is a whitelist, never a denylist. Cal booking metadata and
+ * form bodies are free-form caller content (names, notes, answers to booking
+ * questions), and only the keys named in Common/Types/Marketing/Attribution.ts
+ * may be copied into a row that is later forwarded to an ad platform.
+ *
+ * This file also owns email normalisation and hashing. Meta and Reddit each
+ * used to carry a private copy of the hash, and MarketingConversion.emailHash
+ * has to agree with all of them or the demo-to-signup identity join silently
+ * matches nothing — so there is exactly one definition, tested once.
  */
 
-const MAX_VALUE_LENGTH: number = 500;
-
-const CLICK_ID_KEYS: Array<string> = [
-  "gclid",
-  "wbraid",
-  "gbraid",
-  "fbclid",
-  "msclkid",
-  "li_fat_id",
-  "twclid",
-  "rdt_cid",
-];
-
-const FIRST_TOUCH_STRING_KEYS: Array<string> = [
-  "utmSource",
-  "utmMedium",
-  "utmCampaign",
-  "utmTerm",
-  "utmContent",
-  "landingUrl",
-  "referrer",
-  "timestamp",
-];
-
 type SanitizeStringValueFunction = (value: JSONValue) => string | null;
 
 const sanitizeStringValue: SanitizeStringValueFunction = (
   value: JSONValue,
 ): string | null => {
   if (typeof value === "string" && value.length > 0) {
-    return value.slice(0, MAX_VALUE_LENGTH);
+    return value.slice(0, MaxAttributionValueLength);
   }
 
   if (typeof value === "number") {
-    return value.toString().slice(0, MAX_VALUE_LENGTH);
+    return value.toString().slice(0, MaxAttributionValueLength);
   }
 
   return null;
 };
 
+export interface UtmAttribution {
+  utmSource?: string | undefined;
+  utmMedium?: string | undefined;
+  utmCampaign?: string | undefined;
+  utmTerm?: string | undefined;
+  utmContent?: string | undefined;
+  utmUrl?: string | undefined;
+}
+
 export default class Attribution {
-  // Whitelist known ad-platform click id keys; bound each value to 500 chars.
+  // Whitelist known ad-platform click id keys; bound each value.
   public static sanitizeClickIds(value: JSONValue): JSONObject | undefined {
     if (!value || typeof value !== "object" || Array.isArray(value)) {
       return undefined;
@@ -58,7 +59,7 @@ export default class Attribution {
     const input: JSONObject = value as JSONObject;
     const result: JSONObject = {};
 
-    for (const key of CLICK_ID_KEYS) {
+    for (const key of AdClickIdKeys) {
       const sanitized: string | null = sanitizeStringValue(input[key]);
       if (sanitized) {
         result[key] = sanitized;
@@ -79,7 +80,7 @@ export default class Attribution {
     const input: JSONObject = value as JSONObject;
     const result: JSONObject = {};
 
-    for (const key of FIRST_TOUCH_STRING_KEYS) {
+    for (const key of FirstTouchStringKeys) {
       const sanitized: string | null = sanitizeStringValue(input[key]);
       if (sanitized) {
         result[key] = sanitized;
@@ -96,4 +97,99 @@ export default class Attribution {
 
     return Object.keys(result).length > 0 ? result : undefined;
   }
+
+  /*
+   * UTM values out of an arbitrary object, accepting either spelling.
+   *
+   * A URL and Cal booking metadata carry `utm_source`; a JSON body posted by
+   * the signup page carries `utmSource`. Both arrive at server doors that
+   * write the same columns, so both are read here rather than making each
+   * caller remember which shape it is holding. camelCase wins when a caller
+   * somehow sends both, because that is the spelling the browser writes
+   * deliberately and the snake_case one is the raw URL echo.
+   */
+  public static sanitizeUtm(value: JSONValue): UtmAttribution {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      return {};
+    }
+
+    const input: JSONObject = value as JSONObject;
+    const result: JSONObject = {};
+
+    for (const wireKey of Object.keys(UtmWireKeyToPropertyKey)) {
+      const propertyKey: string = UtmWireKeyToPropertyKey[wireKey]!;
+
+      const sanitized: string | null =
+        sanitizeStringValue(input[propertyKey]) ??
+        sanitizeStringValue(input[wireKey]);
+
+      if (sanitized) {
+        result[propertyKey] = sanitized;
+      }
+    }
+
+    const utmUrl: string | null =
+      sanitizeStringValue(input[UtmUrlPropertyKey]) ??
+      sanitizeStringValue(input["utm_url"]) ??
+      sanitizeStringValue(input["landingUrl"]) ??
+      sanitizeStringValue(input["landing_url"]);
+
+    if (utmUrl) {
+      result[UtmUrlPropertyKey] = utmUrl;
+    }
+
+    return result as UtmAttribution;
+  }
+
+  // True when anything at all identifies where this visitor came from.
+  public static hasAnyAttribution(data: {
+    clickIds?: JSONObject | undefined;
+    utm?: UtmAttribution | undefined;
+  }): boolean {
+    if (data.clickIds && Object.keys(data.clickIds).length > 0) {
+      return true;
+    }
+
+    if (!data.utm) {
+      return false;
+    }
+
+    return UtmPropertyKeys.some((key: string) => {
+      return Boolean((data.utm as JSONObject)[key]);
+    });
+  }
+
+  /*
+   * The form an email is compared and hashed in.
+   *
+   * Trim and lowercase only — deliberately NOT gmail dot/plus folding. Every
+   * ad platform specifies exactly this normalisation before SHA-256, so
+   * folding further would produce a digest none of them can match, and the
+   * same value is used for OneUptime's own identity join so the two must not
+   * diverge.
+   */
+  public static normalizeEmail(email: string | undefined): string | null {
+    if (typeof email !== "string") {
+      return null;
+    }
+
+    const normalized: string = email.trim().toLowerCase();
+
+    return normalized.length > 0 ? normalized : null;
+  }
+
+  /*
+   * SHA-256 of the normalised email, hex encoded — the identifier every ad
+   * platform's enhanced matching expects, and the key the conversion ledger
+   * joins a booked meeting to the signup it later produced.
+   */
+  public static hashEmail(email: string | undefined): string | null {
+    const normalized: string | null = this.normalizeEmail(email);
+
+    if (!normalized) {
+      return null;
+    }
+
+    return crypto.createHash("sha256").update(normalized).digest("hex");
+  }
 }