@oneuptime/common 12.0.2 → 12.0.4

package/Server/Utils/PasswordHash.ts

@@ -0,0 +1,306 @@
+import { EncryptionSecret } from "../EnvironmentConfig";
+import BadDataException from "../../Types/Exception/BadDataException";
+import HashedString from "../../Types/HashedString";
+import crypto from "crypto";
+
+/*
+ * Password hashing for user credentials.
+ *
+ * WHY THIS IS NOT A PLAIN HASH
+ *
+ * SHA-256 is designed to be fast, and that is exactly wrong for a password.
+ * A commodity GPU computes billions of SHA-256 digests per second, so a
+ * leaked User table is a dictionary attack that finishes over lunch — a
+ * per-user salt stops the attacker amortising that work across accounts, but
+ * it does nothing to slow down any single guess.
+ *
+ * scrypt is deliberately expensive in BOTH time and memory. The memory cost
+ * is the important half: it is what stops an attacker buying a thousandfold
+ * speedup with GPUs or custom silicon, because memory bandwidth is the one
+ * thing that hardware cannot cheaply parallelise.
+ *
+ * THE CONSTRUCTION
+ *
+ *   input   = HMAC-SHA256(key = EncryptionSecret, message = password)
+ *   derived = scrypt(input, salt, 32 bytes, { N, r, p })
+ *
+ * The HMAC step carries the instance-wide EncryptionSecret as a "pepper".
+ * The pepper lives in configuration, not in the database, so a dump of
+ * Postgres alone is not enough to start guessing — the attacker also needs
+ * the deployment's secret. It also normalises the password to a fixed 32
+ * bytes before scrypt sees it, which sidesteps every question about very
+ * long or oddly-encoded inputs.
+ *
+ * THE STORED FORMAT
+ *
+ *   scrypt$N=16384,r=8,p=1$<64 hex characters>
+ *
+ * The hash carries the algorithm and the cost parameters it was produced
+ * with. That is what makes raising the cost later a non-event: old hashes
+ * keep verifying against the parameters recorded in them, and each user's
+ * hash is re-derived at their next successful login. Nothing about a cost
+ * bump requires a migration or a forced password reset.
+ *
+ * The salt is NOT in this string — it lives in the row's own salt column
+ * (see TableColumn.hashSaltColumn), which is where the previous scheme put
+ * it and where the write path keeps it in step with the hash.
+ */
+
+/*
+ * N is the CPU/memory cost. Memory used is 128 * N * r bytes, so the values
+ * below cost 16 MiB and roughly 50ms per hash on current server hardware.
+ *
+ * That is a deliberate middle: enough to make offline guessing expensive,
+ * cheap enough that a burst of logins does not exhaust the libuv thread pool
+ * or the box's memory. Raising N is a one-line change — bump it here, and
+ * every user is migrated to the new cost as they log in.
+ */
+const CURRENT_PARAMS: ScryptParams = {
+  N: 16384,
+  r: 8,
+  p: 1,
+};
+
+/** Bytes of derived key. 32 bytes = the 64 hex characters stored. */
+const KEY_LENGTH_IN_BYTES: number = 32;
+
+const SCHEME_NAME: string = "scrypt";
+
+/*
+ * Refuse absurd parameters read back out of the database. Stored values are
+ * ours, not an attacker's, but a corrupted row must fail the login rather
+ * than ask Node to allocate gigabytes.
+ */
+const MAX_N: number = 1048576; // 2^20
+const MAX_R: number = 32;
+const MAX_P: number = 16;
+
+export interface ScryptParams {
+  N: number;
+  r: number;
+  p: number;
+}
+
+interface ParsedPasswordHash {
+  params: ScryptParams;
+  derivedKey: string;
+}
+
+export default class PasswordHash {
+  /**
+   * A fresh, cryptographically random salt: 32 bytes as 64 hex characters.
+   *
+   * A salt is not a secret — its one job is to be UNIQUE per user, so that no
+   * precomputed table and no cracked password is ever worth anything against
+   * a second account.
+   */
+  public static generateSalt(): string {
+    return crypto.randomBytes(32).toString("hex");
+  }
+
+  /** The `algorithm$params$` prefix that hashes written today carry. */
+  public static getCurrentPrefix(): string {
+    return `${SCHEME_NAME}$${PasswordHash.encodeParams(CURRENT_PARAMS)}$`;
+  }
+
+  public static getCurrentParams(): ScryptParams {
+    return { ...CURRENT_PARAMS };
+  }
+
+  private static encodeParams(params: ScryptParams): string {
+    return `N=${params.N},r=${params.r},p=${params.p}`;
+  }
+
+  /**
+   * Pull the parameters and derived key back out of a stored value.
+   *
+   * Returns null for anything that is not one of our scrypt hashes — which
+   * includes every password written before this scheme existed. Callers use
+   * null to mean "fall back to the legacy comparison", so this must never
+   * throw on unrecognised input.
+   */
+  private static parse(storedValue: string): ParsedPasswordHash | null {
+    const parts: Array<string> = storedValue.split("$");
+
+    if (parts.length !== 3 || parts[0] !== SCHEME_NAME) {
+      return null;
+    }
+
+    const match: RegExpMatchArray | null = (parts[1] as string).match(
+      /^N=(\d+),r=(\d+),p=(\d+)$/,
+    );
+
+    if (!match) {
+      return null;
+    }
+
+    const params: ScryptParams = {
+      N: Number(match[1]),
+      r: Number(match[2]),
+      p: Number(match[3]),
+    };
+
+    const isSane: boolean =
+      params.N > 1 &&
+      params.N <= MAX_N &&
+      (params.N & (params.N - 1)) === 0 && // scrypt requires a power of two
+      params.r > 0 &&
+      params.r <= MAX_R &&
+      params.p > 0 &&
+      params.p <= MAX_P;
+
+    if (!isSane || !parts[2]) {
+      return null;
+    }
+
+    return { params: params, derivedKey: parts[2] };
+  }
+
+  /**
+   * The pepper step. Keyed with the instance's EncryptionSecret, so the
+   * database alone cannot be attacked offline.
+   */
+  private static applyPepper(plainValue: string): Buffer {
+    return crypto
+      .createHmac("sha256", EncryptionSecret.toString())
+      .update(plainValue, "utf8")
+      .digest();
+  }
+
+  private static derive(data: {
+    plainValue: string;
+    salt: string;
+    params: ScryptParams;
+  }): Promise<string> {
+    const { N, r, p } = data.params;
+
+    return new Promise<string>(
+      (resolve: (value: string) => void, reject: (error: Error) => void) => {
+        crypto.scrypt(
+          PasswordHash.applyPepper(data.plainValue),
+          data.salt,
+          KEY_LENGTH_IN_BYTES,
+          {
+            N: N,
+            r: r,
+            p: p,
+            /*
+             * Node rejects the call outright when 128 * N * r exceeds
+             * maxmem, and its default is a flat 32 MiB. Scale the ceiling
+             * with the parameters instead, so raising N does not silently
+             * become "Invalid scrypt params" at runtime.
+             */
+            maxmem: 128 * N * r * 2,
+          },
+          (error: Error | null, derivedKey: Buffer): void => {
+            if (error) {
+              return reject(error);
+            }
+
+            return resolve(derivedKey.toString("hex"));
+          },
+        );
+      },
+    );
+  }
+
+  /**
+   * Hash a password for storage, at today's cost parameters.
+   *
+   * The returned string records the algorithm and the parameters used, so it
+   * stays verifiable after those parameters change.
+   */
+  public static async hash(data: {
+    plainValue: string;
+    salt: string;
+  }): Promise<string> {
+    if (!data.plainValue) {
+      return "";
+    }
+
+    if (!data.salt) {
+      throw new BadDataException("A salt is required to hash a password.");
+    }
+
+    const derivedKey: string = await PasswordHash.derive({
+      plainValue: data.plainValue,
+      salt: data.salt,
+      params: CURRENT_PARAMS,
+    });
+
+    return `${PasswordHash.getCurrentPrefix()}${derivedKey}`;
+  }
+
+  /**
+   * Check a password against a stored value, whichever scheme wrote it.
+   *
+   * Three schemes are in circulation and all three have to keep working, or
+   * the change that introduced the next one locks people out:
+   *
+   *   scrypt$...   this one. Verified at the parameters recorded in the hash.
+   *   salted SHA   `SHA256("v2:" + salt + ":" + secret + ":" + password)`.
+   *   bare SHA     `SHA256(secret + password)`, from before salts existed.
+   *
+   * The last two are told apart by whether the row has a salt, which is the
+   * same rule they were written under. Anything not carrying a recognised
+   * scheme prefix is one of them.
+   */
+  public static async verify(data: {
+    plainValue: string;
+    storedValue: string;
+    salt?: string | null | undefined;
+  }): Promise<boolean> {
+    if (!data.plainValue || !data.storedValue) {
+      return false;
+    }
+
+    const parsed: ParsedPasswordHash | null = PasswordHash.parse(
+      data.storedValue,
+    );
+
+    if (!parsed) {
+      return await HashedString.verifyValue({
+        plainValue: data.plainValue,
+        hashedValue: data.storedValue,
+        encryptionSecret: EncryptionSecret,
+        salt: data.salt || null,
+      });
+    }
+
+    /*
+     * A scrypt hash is meaningless without the salt it was derived with.
+     * Reaching here without one means the caller did not select the salt
+     * column, which would otherwise look exactly like a wrong password.
+     */
+    if (!data.salt) {
+      throw new BadDataException(
+        "Cannot verify a salted password hash without its salt. Select the salt column alongside the hash.",
+      );
+    }
+
+    const derivedKey: string = await PasswordHash.derive({
+      plainValue: data.plainValue,
+      salt: data.salt,
+      params: parsed.params,
+    });
+
+    return HashedString.isEqual(derivedKey, parsed.derivedKey);
+  }
+
+  /**
+   * Should this stored value be re-hashed the next time the password is
+   * known to be correct?
+   *
+   * True for every hash that is not exactly what `hash()` writes today: the
+   * two SHA-256 schemes that came before, and any scrypt hash carrying
+   * parameters that are no longer current. This is the whole upgrade
+   * mechanism — raising the cost above is enough to start migrating users.
+   */
+  public static needsUpgrade(storedValue: string): boolean {
+    if (!storedValue) {
+      return false;
+    }
+
+    return !storedValue.startsWith(PasswordHash.getCurrentPrefix());
+  }
+}

package/Server/Utils/SingleFlight.ts

@@ -0,0 +1,83 @@
+/*
+ * In-process de-duplication of concurrent identical work.
+ *
+ * A Redis fence admits one writer per window across the FLEET, but every
+ * caller still pays a Redis round trip to discover it lost. That is the wrong
+ * unit of work when the duplicate callers are in the same process: an ingest
+ * pod running hundreds of concurrent jobs re-resolves the same handful of
+ * services on every batch, so hundreds of coroutines independently ask Redis
+ * the same question and then throw the answer away.
+ *
+ * SingleFlight collapses them first. The first caller for a key runs the work;
+ * everyone who arrives while it is still in flight awaits the SAME promise and
+ * gets the same result. Per pod, N concurrent duplicates cost one Redis round
+ * trip and at most one database write instead of N of each — which is what
+ * turns fleet-wide write amplification from (pods x jobs) into (pods).
+ *
+ * Deliberately unbounded in time but not in size: entries live only for the
+ * duration of the work itself and are removed in a `finally`, so the map holds
+ * exactly the set of operations currently running. There is no eviction policy
+ * to get wrong and nothing to leak if work hangs beyond a caller's patience —
+ * the entry is released when the underlying promise settles either way.
+ *
+ * This is a per-process optimisation and NOT a correctness mechanism: nothing
+ * here coordinates across pods. It composes with a distributed fence, it does
+ * not replace one.
+ */
+export default class SingleFlight {
+  private static inflight: Map<string, Promise<unknown>> = new Map<
+    string,
+    Promise<unknown>
+  >();
+
+  /**
+   * Run `work` for `key`, or join the run already in flight for it.
+   *
+   * Followers observe whatever the leader observes, including a rejection.
+   * That is intentional: these callers asked for identical work, so they are
+   * entitled to identical outcomes, and a follower silently retrying a failure
+   * the leader just hit would re-create the stampede this exists to prevent.
+   */
+  public static async run<T>(key: string, work: () => Promise<T>): Promise<T> {
+    const existing: Promise<unknown> | undefined = this.inflight.get(key);
+
+    if (existing) {
+      return (await existing) as T;
+    }
+
+    /*
+     * Invoke through a wrapper so a `work` that throws SYNCHRONOUSLY still
+     * produces a promise to register and await. Calling it bare would throw
+     * past the bookkeeping below and leave the key registered forever.
+     */
+    const promise: Promise<T> = (async () => {
+      return await work();
+    })();
+
+    this.inflight.set(key, promise);
+
+    try {
+      return await promise;
+    } finally {
+      /*
+       * Only clear the entry if it is still ours. A follower cannot install a
+       * new one (it awaited instead), but a later leader can, and blindly
+       * deleting here would evict that live run and let the next caller start
+       * a duplicate of work already underway.
+       */
+      if (this.inflight.get(key) === promise) {
+        this.inflight.delete(key);
+      }
+    }
+  }
+
+  /** Number of operations currently in flight. For tests and diagnostics. */
+  public static inflightCount(): number {
+    return this.inflight.size;
+  }
+
+  /** Drop all bookkeeping. For tests only. */
+  public static clear(): void {
+    this.inflight.clear();
+  }
+}

package/Server/Utils/StatusPage/MonitorRulePatternValidator.ts

@@ -0,0 +1,46 @@
+import BadDataException from "../../../Types/Exception/BadDataException";
+import RulePatternMatchUtil from "../../../Utils/Rules/RulePatternMatchUtil";
+
+/*
+ * Write-time validation for the monitor name / description patterns on status
+ * page monitor rules.
+ *
+ * The rule engine accepts a case-insensitive regex or a '*' wildcard glob, the
+ * same two syntaxes the network device rules take. Anything else - `api-(01`,
+ * `[unclosed` - compiles to nothing and matches nothing, and the engine can
+ * only log about it long after the user left the form. Reject it at the write
+ * instead, exactly as NetworkDeviceRulePatternValidator does
+ * (OneUptime/oneuptime#2940).
+ */
+export default class StatusPageMonitorRulePatternValidator {
+  public static validate(data: {
+    namePattern?: string | null | undefined;
+    descriptionPattern?: string | null | undefined;
+  }): void {
+    StatusPageMonitorRulePatternValidator.validateOne(
+      "Monitor Name Pattern",
+      data.namePattern,
+    );
+    StatusPageMonitorRulePatternValidator.validateOne(
+      "Monitor Description Pattern",
+      data.descriptionPattern,
+    );
+  }
+
+  private static validateOne(
+    title: string,
+    pattern: string | null | undefined,
+  ): void {
+    if (!pattern) {
+      return;
+    }
+
+    if (RulePatternMatchUtil.isSupportedPattern(pattern)) {
+      return;
+    }
+
+    throw new BadDataException(
+      `${title} "${pattern}" is not a valid regular expression, and contains no '*' wildcard to fall back on, so it would never match a monitor. Use a regex such as api-.* or a wildcard such as *api*.`,
+    );
+  }
+}

package/Server/Utils/Telemetry/EntityRegistry.ts

@@ -14,6 +14,7 @@ import {
   deriveRelationships,
   EntityRelationshipEdge,
 } from "../../../Utils/Telemetry/EntityRelationship";
+import crypto from "crypto";
 
 /*
  * Shared entity-registry reconciliation machinery (phases 2 + 5 of the
@@ -87,28 +88,81 @@ export const REGISTRY_PROMOTED_TYPES: ReadonlySet<EntityType> =
  */
 const FENCE_NAMESPACE: string = "otel-maintenance-fence";
 const FENCE_SCOPE: string = "entity-reconcile";
+const ROW_FENCE_SCOPE: string = "entity-reconcile-row";
 const FENCE_TTL_SECONDS: number = 5 * 60; // 5 minutes
 
+/*
+ * Atomic claim. A read-then-write here admits every worker that reads the
+ * absent key in the same instant, which at ingest concurrency is all of them —
+ * the defect behind the row-lock convoy documented in
+ * DatabaseService.updateColumnsByIdIfUnlockedWithoutHooks. TTLs are jittered
+ * so a fleet-wide restart cannot re-synchronise the windows and rebuild the
+ * herd on a fixed period.
+ */
 async function shouldReconcile(fenceId: string): Promise<boolean> {
   try {
-    const key: string = `${FENCE_SCOPE}:${fenceId}`;
-    const seen: string | null = await GlobalCache.getString(
+    return await GlobalCache.setStringIfNotExists(
       FENCE_NAMESPACE,
-      key,
+      `${FENCE_SCOPE}:${hashFenceId(fenceId)}`,
+      "1",
+      { expiresInSeconds: GlobalCache.withJitter(FENCE_TTL_SECONDS) },
     );
-    if (seen) {
-      return false;
-    }
-    await GlobalCache.setString(FENCE_NAMESPACE, key, "1", {
-      expiresInSeconds: FENCE_TTL_SECONDS,
-    });
+  } catch {
+    // If the cache is down, default to running the reconcile.
     return true;
+  }
+}
+
+/*
+ * The set-level fence id concatenates every promoted entity key, so it is
+ * unbounded in length — a pod with many entities would otherwise produce a
+ * multi-kilobyte Redis key. Hashing keeps it fixed-width without changing which
+ * sets collide.
+ */
+function hashFenceId(fenceId: string): string {
+  return crypto.createHash("sha1").update(fenceId).digest("hex");
+}
+
+/*
+ * Per-ROW fence, sitting inside the set-level one.
+ *
+ * The set-level fence keys on (project + the whole promoted entity set), which
+ * in practice is unique per POD — a pod's own key is in the set. But the writes
+ * it gates are per ROW: the single TelemetryEntity row for a Kubernetes cluster
+ * takes one UPDATE per pod in that cluster per window, the namespace row one
+ * per pod in the namespace, and so on. Throttle granularity finer than write
+ * granularity means the throttle does not bound the writes at all, and the
+ * mismatch factor is the pod count — the same shape of defect as the Service
+ * heartbeat, one layer down.
+ *
+ * Claiming per row before the lookup also removes the redundant SELECT, not
+ * just the redundant UPDATE.
+ */
+async function shouldReconcileRow(rowFenceId: string): Promise<boolean> {
+  try {
+    return await GlobalCache.setStringIfNotExists(
+      FENCE_NAMESPACE,
+      `${ROW_FENCE_SCOPE}:${hashFenceId(rowFenceId)}`,
+      "1",
+      { expiresInSeconds: GlobalCache.withJitter(FENCE_TTL_SECONDS) },
+    );
   } catch {
     // If the cache is down, default to running the reconcile.
     return true;
   }
 }
 
+async function releaseRowFence(rowFenceId: string): Promise<void> {
+  try {
+    await GlobalCache.deleteKey(
+      FENCE_NAMESPACE,
+      `${ROW_FENCE_SCOPE}:${hashFenceId(rowFenceId)}`,
+    );
+  } catch {
+    // Best effort — losing the release costs one window of staleness.
+  }
+}
+
 /*
  * Over-budget skips happen per row, but the warn log is fenced to once per
  * (project, entityType) per fence window — an over-budget project would
@@ -119,20 +173,12 @@ export async function shouldWarnEntityBudgetOnce(data: {
   entityType: EntityType;
 }): Promise<boolean> {
   try {
-    const key: string = `entity-budget-warn:${data.projectId.toString()}:${
-      data.entityType
-    }`;
-    const seen: string | null = await GlobalCache.getString(
+    return await GlobalCache.setStringIfNotExists(
       FENCE_NAMESPACE,
-      key,
+      `entity-budget-warn:${data.projectId.toString()}:${data.entityType}`,
+      "1",
+      { expiresInSeconds: GlobalCache.withJitter(FENCE_TTL_SECONDS) },
     );
-    if (seen) {
-      return false;
-    }
-    await GlobalCache.setString(FENCE_NAMESPACE, key, "1", {
-      expiresInSeconds: FENCE_TTL_SECONDS,
-    });
-    return true;
   } catch {
     // If the cache is down, default to warning (visibility over silence).
     return true;
@@ -230,6 +276,13 @@ export async function reconcileByNaturalKey<
   lastSeenAt: Date;
   /** Human-readable row identity for log lines, e.g. "entity host/abc123". */
   describe: string;
+  /**
+   * Stable identity of the ROW being reconciled, e.g.
+   * `${projectId}:${entityType}:${entityKey}`. Claimed atomically before the
+   * lookup so one writer per row per window does the work — see
+   * shouldReconcileRow for why the set-level fence above is not enough.
+   */
+  rowFenceId: string;
   /** Extra columns to select on the existing row, for `buildUpdate` diffing. */
   select?: Select<TBaseModel> | undefined;
   /**
@@ -264,6 +317,10 @@ export async function reconcileByNaturalKey<
     } as unknown as QueryDeepPartialEntity<TBaseModel>;
   };
 
+  if (!(await shouldReconcileRow(data.rowFenceId))) {
+    return;
+  }
+
   const existing: TBaseModel | null = await data.service.findOneBy({
     query: data.query,
     select,
@@ -278,15 +335,32 @@ export async function reconcileByNaturalKey<
      * audit). buildBump returns only plain values — lastSeenAt plus, at most,
      * the descriptiveAttributes / labels JSON columns — which the primitive
      * persists via the driver transformer path. See ServiceService.updateLastSeen.
+     *
+     * SKIP LOCKED: a contended bump yields rather than queueing behind the
+     * writer that already holds the row. Registry rows for shared entities (a
+     * cluster, a namespace) are written by every pod that reports them, so
+     * this is exactly the hot-row shape that convoyed on Service.
      */
-    await data.service.updateColumnsByIdWithoutHooks({
-      id: existing.id!,
-      data: buildBump(existing),
-    });
+    const wrote: boolean =
+      await data.service.updateColumnsByIdIfUnlockedWithoutHooks({
+        id: existing.id!,
+        data: buildBump(existing),
+      });
+
+    if (!wrote) {
+      // Skipped under contention — re-open the window so the next batch retries.
+      await releaseRowFence(data.rowFenceId);
+    }
     return;
   }
 
   if (data.beforeCreate && !(await data.beforeCreate())) {
+    /*
+     * Over budget: release the row fence so the gate is re-evaluated next
+     * batch rather than being suppressed for a full window by a decision that
+     * wrote nothing.
+     */
+    await releaseRowFence(data.rowFenceId);
     return;
   }
 
@@ -312,13 +386,20 @@ export async function reconcileByNaturalKey<
       logger.debug(
         `EntityRegistry: create raced for ${data.describe} (concurrent insert); bumping lastSeenAt on the winning row.`,
       );
-      await data.service.updateColumnsByIdWithoutHooks({
+      await data.service.updateColumnsByIdIfUnlockedWithoutHooks({
         id: winner.id!,
         data: buildBump(winner),
       });
       return;
     }
 
+    /*
+     * The insert itself was invalid. Re-open the row window so the next batch
+     * retries rather than being silently suppressed for the TTL — a genuinely
+     * broken row should keep surfacing this warning, not go quiet.
+     */
+    await releaseRowFence(data.rowFenceId);
+
     logger.warn(`EntityRegistry: create failed for ${data.describe}:`);
     logger.warn(err as Error);
   }