@oneuptime/common 12.0.18 → 12.0.20

package/Server/Utils/Monitor/MonitorPayloadRedaction.ts

@@ -0,0 +1,321 @@
+import { JSONObject, JSONValue } from "../../../Types/JSON";
+import { isSensitiveLogKey, REDACTED } from "../LogRedaction";
+
+/*
+ * Credential stripping for monitor ingest payloads.
+ *
+ * https://github.com/OneUptime/oneuptime/issues/3360
+ *
+ * The infrastructure agent authenticates by putting the monitor's
+ * `serverMonitorSecretKey` in BOTH the ingest URL and the JSON body
+ * (`ServerMonitorReport.SecretKey`, `json:"secretKey"`). The URL copy is
+ * transient. The body copy is not: the deserialized body becomes
+ * `dataToProcess`, and `dataToProcess` is written verbatim to three places
+ * that a read-only principal can select from:
+ *
+ *   - `MonitorLog.logBody` (ClickHouse, `Permission.Viewer` readable),
+ *   - `Monitor.serverMonitorResponse` (Postgres jsonb, `Viewer` readable),
+ *   - `MonitorProbe.lastMonitoringLog`.
+ *
+ * So the shared secret that authenticates every agent in the project sat at
+ * rest, in plaintext, behind the lowest privilege OneUptime grants. Rotating
+ * did not help: the replacement re-entered the payload on the very next beat.
+ *
+ * Two entry points, because the two sinks want different things:
+ *
+ *   - `stripAgentCredentials` DELETES the key. It runs at the ingest boundary,
+ *     before `dataToProcess` exists, so the secret never reaches any sink and
+ *     never enters the process's monitor-evaluation state at all. Deleting
+ *     rather than masking keeps `Monitor.serverMonitorResponse` faithful to
+ *     the `ServerMonitorResponse` interface, which declares no `secretKey`.
+ *
+ *   - `redactForPersistence` MASKS the value with `[REDACTED]`. It runs on the
+ *     copy `MonitorLogUtil` writes to `logBody`. Masking is the better choice
+ *     there because `logBody` is a diagnostic record: an operator debugging an
+ *     API monitor wants to see THAT an `Authorization` header was sent without
+ *     seeing what it was. It is also the net underneath the boundary strip —
+ *     it applies to every monitor type and every future payload field, so a
+ *     credential added to some other ingest path does not silently start
+ *     accumulating in ClickHouse.
+ *
+ * What counts as a credential is delegated to `isSensitiveLogKey`, the same
+ * deny-by-default classifier the logger uses, so there is one list to keep
+ * current rather than two. It is structural only (decided by key name): the
+ * textual sweeps in `redactLogString` are right for log lines but would mangle
+ * a captured HTTP response body, which is legitimate monitor evidence.
+ */
+
+// Deep enough for any real ingest payload, shallow enough to bound the walk.
+const MAX_DEPTH: number = 12;
+
+type WalkFunction = (
+  value: JSONValue,
+  drop: boolean,
+  depth: number,
+) => JSONValue;
+
+/*
+ * One walker, two behaviours. `drop` picks whether a sensitive key is removed
+ * from its parent object or kept with its value replaced.
+ *
+ * Always returns a new object/array rather than mutating in place. The ingest
+ * caller hands us an object it is about to keep using, and `MonitorLogUtil`
+ * hands us a payload that is still being read by the criteria evaluator — so
+ * mutating the input would change what the monitor evaluates, not just what
+ * gets stored.
+ */
+const walk: WalkFunction = (
+  value: JSONValue,
+  drop: boolean,
+  depth: number,
+): JSONValue => {
+  /*
+   * Past the depth ceiling we cannot keep vouching for what is nested below,
+   * and a payload that deep is not something a monitor legitimately reports.
+   * Drop the subtree instead of passing it through unredacted.
+   */
+  if (depth > MAX_DEPTH) {
+    return null;
+  }
+
+  if (value === null || value === undefined) {
+    return value;
+  }
+
+  if (Array.isArray(value)) {
+    return value.map((item: JSONValue) => {
+      return walk(item, drop, depth + 1);
+    });
+  }
+
+  /*
+   * Dates and ObjectIDs survive the JSON round-trip as strings, but callers
+   * may hand us live instances (the ingest boundary runs before
+   * `JSON.stringify`). Anything that is not a plain object is a leaf.
+   */
+  if (
+    typeof value !== "object" ||
+    Object.getPrototypeOf(value) !== Object.prototype
+  ) {
+    return value;
+  }
+
+  const source: JSONObject = value as JSONObject;
+  const result: JSONObject = {};
+
+  for (const key of Object.keys(source)) {
+    const child: JSONValue = source[key] as JSONValue;
+
+    if (isSensitiveLogKey(key, child)) {
+      if (drop) {
+        continue;
+      }
+
+      result[key] = REDACTED;
+      continue;
+    }
+
+    result[key] = walk(child, drop, depth + 1);
+  }
+
+  return result;
+};
+
+export type StripAgentCredentialsFunction = <T>(payload: T) => T;
+
+/*
+ * Ingest boundary. Removes agent-supplied credentials from a freshly
+ * deserialized payload so the secret never becomes part of `dataToProcess`.
+ *
+ * Generic over the payload type because the caller immediately treats the
+ * result as its declared interface (`ServerMonitorResponse` and friends) —
+ * none of which declare a credential field, so removing one cannot invalidate
+ * the type.
+ */
+export const stripAgentCredentials: StripAgentCredentialsFunction = <T>(
+  payload: T,
+): T => {
+  if (payload === null || payload === undefined) {
+    return payload;
+  }
+
+  return walk(payload as JSONValue, true, 0) as T;
+};
+
+export type RedactForPersistenceFunction = (payload: JSONValue) => JSONValue;
+
+/*
+ * Storage boundary. Masks credentials in the copy that is about to be written
+ * to `MonitorLog.logBody`.
+ */
+export const redactForPersistence: RedactForPersistenceFunction = (
+  payload: JSONValue,
+): JSONValue => {
+  if (payload === null || payload === undefined) {
+    return payload;
+  }
+
+  return walk(payload, false, 0);
+};
+
+export type RedactMonitorSecretFunction = <T>(
+  payload: T,
+  secret: string | null | undefined,
+) => T;
+
+/*
+ * Value boundary. Masks every textual occurrence of ONE monitor's own secret
+ * key inside an ingest payload.
+ *
+ * The two walkers above are structural: they decide by key name, which is the
+ * right test when a credential arrives as its own field (`secretKey`). The
+ * incoming-email path has the other shape. There the secret is not a field at
+ * all -- it is baked into a value that is otherwise legitimate evidence.
+ * `MonitorService` mints `incomingEmailSecretKey`, and
+ * `SendGridInboundProvider.generateMonitorEmailAddress` turns it into the
+ * monitor's ingest address, `monitor-{secretKey}@{inboundDomain}`. The address
+ * IS the credential -- `extractSecretKeyFromEmail` parses the key straight back
+ * out of it -- so everything that quotes the recipient quotes the key:
+ * `emailTo`, the `To:` header, and the `Received:` / `Delivered-To:` headers a
+ * relay adds on the way in.
+ *
+ * No key name marks any of those as sensitive, and none of them can simply be
+ * dropped. `IncomingEmailCriteria` evaluates `emailTo` for the "Email to"
+ * check, and mail that reaches the monitor through an alias or a forwarding
+ * rule carries a genuinely different -- and genuinely interesting -- recipient.
+ * So this masks the secret substring and leaves the rest of the value intact:
+ * domain, alias and relay chain all survive, and a filter written against them
+ * keeps matching.
+ *
+ * Matching is case-insensitive because the key is a UUID that reaches us
+ * through address normalisation (`extractEmailAddress` lowercases) and through
+ * relay headers that preserve whatever case the sender happened to use.
+ */
+
+/*
+ * A secret shorter than this is not a key we minted -- `ObjectID.generate()`
+ * returns a 36-character UUID. Sweeping for a short string would mask ordinary
+ * text that merely contains it, destroying the evidence this is trying to keep
+ * readable, so treat it as nothing to do rather than over-redact.
+ */
+const MIN_SWEEPABLE_SECRET_LENGTH: number = 8;
+
+type ReplaceAllInsensitiveFunction = (
+  haystack: string,
+  needle: string,
+) => string;
+
+/*
+ * Case-insensitive replace-all done by scan rather than by `RegExp`, so a
+ * secret that happens to contain regex metacharacters needs no escaping and
+ * cannot alter the pattern. Compares on lowercased copies but slices from the
+ * original, so the surrounding text keeps its own casing.
+ */
+const replaceAllInsensitive: ReplaceAllInsensitiveFunction = (
+  haystack: string,
+  needle: string,
+): string => {
+  const lowerHaystack: string = haystack.toLowerCase();
+  const lowerNeedle: string = needle.toLowerCase();
+
+  let result: string = "";
+  let cursor: number = 0;
+  let index: number = lowerHaystack.indexOf(lowerNeedle, cursor);
+
+  while (index !== -1) {
+    result += haystack.slice(cursor, index) + REDACTED;
+    cursor = index + lowerNeedle.length;
+    index = lowerHaystack.indexOf(lowerNeedle, cursor);
+  }
+
+  return result + haystack.slice(cursor);
+};
+
+type SweepFunction = (
+  value: JSONValue,
+  secret: string,
+  depth: number,
+) => JSONValue;
+
+const sweep: SweepFunction = (
+  value: JSONValue,
+  secret: string,
+  depth: number,
+): JSONValue => {
+  // Same reasoning as `walk`: below the ceiling we cannot vouch for the value.
+  if (depth > MAX_DEPTH) {
+    return null;
+  }
+
+  if (value === null || value === undefined) {
+    return value;
+  }
+
+  if (typeof value === "string") {
+    return replaceAllInsensitive(value, secret);
+  }
+
+  if (Array.isArray(value)) {
+    return value.map((item: JSONValue) => {
+      return sweep(item, secret, depth + 1);
+    });
+  }
+
+  /*
+   * Leaf. Dates and ObjectIDs land here as live instances on the ingest side;
+   * neither can carry the secret as text, so they pass through untouched.
+   */
+  if (
+    typeof value !== "object" ||
+    Object.getPrototypeOf(value) !== Object.prototype
+  ) {
+    return value;
+  }
+
+  const source: JSONObject = value as JSONObject;
+  const result: JSONObject = {};
+
+  /*
+   * Keys are swept too. `emailHeaders` is a `Dictionary<string>` built from
+   * whatever header names the relay sent, so a key is no more trustworthy than
+   * a value -- and a redacted key still serialises into the stored jsonb.
+   */
+  for (const key of Object.keys(source)) {
+    result[replaceAllInsensitive(key, secret)] = sweep(
+      source[key] as JSONValue,
+      secret,
+      depth + 1,
+    );
+  }
+
+  return result;
+};
+
+/*
+ * Generic over the payload type for the same reason as `stripAgentCredentials`:
+ * the caller goes on treating the result as its declared interface. Masking
+ * only ever rewrites strings in place, so every field keeps its declared type.
+ */
+export const redactMonitorSecret: RedactMonitorSecretFunction = <T>(
+  payload: T,
+  secret: string | null | undefined,
+): T => {
+  if (payload === null || payload === undefined) {
+    return payload;
+  }
+
+  if (
+    typeof secret !== "string" ||
+    secret.length < MIN_SWEEPABLE_SECRET_LENGTH
+  ) {
+    return payload;
+  }
+
+  return sweep(payload as JSONValue, secret, 0) as T;
+};
+
+export default {
+  stripAgentCredentials,
+  redactForPersistence,
+  redactMonitorSecret,
+};

package/Server/Utils/Response.ts

@@ -25,7 +25,7 @@ import MimeType from "../../Types/File/MimeType";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Route from "../../Types/API/Route";
 import CaptureSpan from "./Telemetry/CaptureSpan";
-import { IsBillingEnabled } from "../EnvironmentConfig";
+import { GoogleTagManagerEnabled } from "../EnvironmentConfig";
 
 /*
  * Raster image types, which is to say the types that cannot carry script and
@@ -239,7 +239,7 @@ export default class Response {
      * already use; passing the flag explicitly still wins.
      */
     oneUptimeResponse.render(path, {
-      enableGoogleTagManager: IsBillingEnabled,
+      enableGoogleTagManager: GoogleTagManagerEnabled,
       ...vars,
     });
   }

package/Server/Utils/StartServer.ts

@@ -3,7 +3,7 @@ import CommonAPI from "../API/Index";
 import { StatusAPIOptions } from "../API/StatusAPI";
 import {
   AppVersion,
-  IsBillingEnabled,
+  GoogleTagManagerEnabled,
   TrustedProxyHops,
   getFrontendEnvVars,
 } from "../EnvironmentConfig";
@@ -449,7 +449,7 @@ const init: InitFunction = async (
           }
 
           return res.render(path.resolve(process.cwd(), "views/index.ejs"), {
-            enableGoogleTagManager: IsBillingEnabled || false,
+            enableGoogleTagManager: GoogleTagManagerEnabled,
             ...variables,
           });
         } catch (err) {

package/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.ts

@@ -76,6 +76,7 @@ import {
   TeamsChannelAccount,
   TeamsPagedMembersResult,
   TurnContext,
+  ConversationParameters,
   ConversationReference,
   MessageFactory,
   ConfigurationBotFrameworkAuthenticationOptions,
@@ -902,6 +903,163 @@ export default class MicrosoftTeamsUtil extends WorkspaceBase {
     });
   }
 
+  /*
+   * Sends a 1:1 message to a Teams user as the OneUptime bot, addressed by the
+   * user's Microsoft Entra object id (which is what WorkspaceUserAuthToken
+   * stores as workspaceUserId).
+   *
+   * This cannot go through sendDirectMessageToUser above: that method posts to
+   * Graph's /chats/{chatId}/messages, which needs an existing chat id and a
+   * delegated token. A personal chat between the bot and the user may not
+   * exist yet, so this uses the Bot Framework's createConversation, which
+   * resolves (or creates) the 1:1 conversation from the member's Entra id -
+   * provided the OneUptime app is installed for that user. When the personal
+   * chat was already captured from a bot activity, it is reused instead, which
+   * also preserves the regional serviceUrl captured with it.
+   */
+  @CaptureSpan()
+  public static async sendDirectMessageToUserAsBot(data: {
+    projectId: ObjectID;
+    workspaceUserId: string;
+    messageBlocks: Array<WorkspaceMessageBlock>;
+  }): Promise<void> {
+    const adaptiveCard: JSONObject = this.buildAdaptiveCardFromMessageBlocks({
+      messageBlocks: data.messageBlocks,
+    });
+
+    const projectAuth: WorkspaceProjectAuthToken | null =
+      await WorkspaceProjectAuthTokenService.getProjectAuth({
+        projectId: data.projectId,
+        workspaceType: WorkspaceType.MicrosoftTeams,
+      });
+
+    if (!projectAuth || !projectAuth.miscData) {
+      throw new BadDataException(
+        "Microsoft Teams integration not found for this project",
+      );
+    }
+
+    const miscData: MicrosoftTeamsMiscData =
+      projectAuth.miscData as MicrosoftTeamsMiscData;
+
+    const tenantId: string | undefined = projectAuth.workspaceProjectId;
+
+    if (!tenantId) {
+      throw new BadDataException(
+        "Tenant ID not found in Microsoft Teams integration",
+      );
+    }
+
+    if (!MicrosoftTeamsAppClientId) {
+      throw new BadDataException(
+        "Microsoft Teams App Client ID not configured",
+      );
+    }
+
+    /*
+     * Prefer a personal chat that was already captured from a bot activity:
+     * it is known-deliverable and carries the regional serviceUrl.
+     */
+    const capturedPersonalChat: MicrosoftTeamsChat | undefined = Object.values(
+      miscData.availableChats || {},
+    ).find((chat: MicrosoftTeamsChat) => {
+      return (
+        chat.chatType === "personal" &&
+        (chat.memberAadObjectIds || []).includes(data.workspaceUserId)
+      );
+    });
+
+    if (capturedPersonalChat) {
+      await this.sendAdaptiveCardToChat({
+        chatId: capturedPersonalChat.id,
+        projectId: data.projectId,
+        adaptiveCard: adaptiveCard,
+      });
+      return;
+    }
+
+    /*
+     * No captured personal chat - create (or resolve) the 1:1 conversation
+     * proactively. A regional serviceUrl captured from any prior activity is
+     * preferred; the commercial-cloud global endpoint is the fallback.
+     */
+    const serviceUrl: string =
+      Object.values(miscData.availableChats || {}).find(
+        (chat: MicrosoftTeamsChat) => {
+          return Boolean(chat.serviceUrl);
+        },
+      )?.serviceUrl ||
+      Object.values(miscData.installedTeams || {}).find(
+        (team: MicrosoftTeamsInstalledTeam) => {
+          return Boolean(team.serviceUrl);
+        },
+      )?.serviceUrl ||
+      "https://smba.trafficmanager.net/teams/";
+
+    const adapter: CloudAdapter = this.getBotAdapter();
+
+    const conversationParameters: ConversationParameters = {
+      isGroup: false,
+      // 28:<appId> is the Teams-side bot account id.
+      bot: {
+        id: `28:${MicrosoftTeamsAppClientId}`,
+        name: "OneUptime Bot",
+      },
+      // Teams accepts the member's Microsoft Entra object id here.
+      members: [
+        {
+          id: data.workspaceUserId,
+          name: "",
+        },
+      ],
+      tenantId: tenantId,
+      channelData: {
+        tenant: {
+          id: tenantId,
+        },
+      },
+    };
+
+    try {
+      await adapter.createConversationAsync(
+        MicrosoftTeamsAppClientId,
+        "msteams",
+        serviceUrl,
+        undefined as unknown as string,
+        conversationParameters,
+        async (context: TurnContext) => {
+          const message: Partial<Activity> = MessageFactory.attachment({
+            contentType: "application/vnd.microsoft.card.adaptive",
+            content: adaptiveCard,
+          });
+
+          await context.sendActivity(message);
+        },
+      );
+    } catch (error) {
+      logger.error(
+        "Error sending Microsoft Teams direct message via Bot Framework:",
+        {
+          projectId: data.projectId.toString(),
+        },
+      );
+      logger.error(error);
+
+      /*
+       * Microsoft's roster rejection is meaningless to the person being paged.
+       * For a 1:1 conversation it means the OneUptime app is not installed for
+       * this user, so say exactly that.
+       */
+      if (this.isBotNotInConversationRosterError(error)) {
+        throw new BadDataException(
+          "The OneUptime app is not installed for this Microsoft Teams user. Ask them to add the OneUptime app in Microsoft Teams (personal scope) so the bot can message them directly.",
+        );
+      }
+
+      throw error;
+    }
+  }
+
   @CaptureSpan()
   public static override async createChannelsIfDoesNotExist(data: {
     authToken: string;
@@ -4154,6 +4312,18 @@ All monitoring checks are passing normally.`;
       if (data.serviceUrl && chat.serviceUrl !== data.serviceUrl) {
         return false; // stored serviceUrl is stale.
       }
+
+      /*
+       * Personal chats captured before member Entra ids were recorded cannot
+       * serve as direct-message targets — treat them as stale so the next
+       * activity on the chat backfills the roster.
+       */
+      if (
+        chat.chatType === "personal" &&
+        (chat.memberAadObjectIds || []).length === 0
+      ) {
+        return false;
+      }
     }
 
     return true;
@@ -4222,6 +4392,7 @@ All monitoring checks are passing normally.`;
         | undefined;
 
       let memberNames: Array<string> = [];
+      let memberAadObjectIds: Array<string> = [];
 
       try {
         const botId: string | undefined =
@@ -4243,12 +4414,27 @@ All monitoring checks are passing normally.`;
           continuationToken = page.continuationToken;
         } while (continuationToken);
 
-        memberNames = members
-          .filter((member: TeamsChannelAccount) => {
+        const humanMembers: Array<TeamsChannelAccount> = members.filter(
+          (member: TeamsChannelAccount) => {
             return member.id !== botId;
-          })
+          },
+        );
+
+        memberNames = humanMembers.map((member: TeamsChannelAccount) => {
+          return member.name || "";
+        });
+
+        /*
+         * The Entra object id is what maps a chat member back to the
+         * OneUptime user who connected that Teams account, so personal chats
+         * can serve as direct-message delivery targets.
+         */
+        memberAadObjectIds = humanMembers
           .map((member: TeamsChannelAccount) => {
-            return member.name || "";
+            return member.aadObjectId || "";
+          })
+          .filter((aadObjectId: string) => {
+            return Boolean(aadObjectId);
           });
       } catch (err) {
         logger.debug("Could not fetch chat members for chat name resolution");
@@ -4265,6 +4451,7 @@ All monitoring checks are passing normally.`;
         chatType: chatType,
         serviceUrl: activityServiceUrl,
         addedAt: OneUptimeDate.getCurrentDate().toISOString(),
+        memberAadObjectIds: memberAadObjectIds,
       };
 
       await this.saveChatToProjectAuthTokens({