@oneuptime/common 12.0.2 → 12.0.4

package/Models/DatabaseModels/StatusPagePrivateUser.ts

@@ -319,6 +319,7 @@ export default class StatusPagePrivateUser extends BaseModel {
   @TableColumn({
     title: "Password",
     hashed: true,
+    hashSaltColumn: "passwordSalt",
     type: TableColumnType.HashedString,
   })
   @Column({
@@ -330,6 +331,35 @@ export default class StatusPagePrivateUser extends BaseModel {
   })
   public password?: HashedString = undefined;
 
+  /*
+   * Per-user salt mixed into `password`'s hash. Written by the database
+   * write path on every password write — never by an API caller, hence the
+   * empty access control and `computed: true`.
+   *
+   * Nullable on purpose: rows that predate per-user salts have none, and are
+   * verified against the legacy unsalted scheme until the next successful
+   * login re-hashes them with a fresh salt.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    title: "Password Salt",
+    description: "Per-user random salt mixed into this user's password hash.",
+    computed: true,
+    type: TableColumnType.ShortText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public passwordSalt?: string = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/StatusPageResource.ts

@@ -3,6 +3,7 @@ import MonitorGroup from "./MonitorGroup";
 import Project from "./Project";
 import StatusPage from "./StatusPage";
 import StatusPageGroup from "./StatusPageGroup";
+import StatusPageMonitorRule from "./StatusPageMonitorRule";
 import User from "./User";
 import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
@@ -520,6 +521,78 @@ export default class StatusPageResource extends BaseModel {
   })
   public statusPageGroupId?: ObjectID = undefined;
 
+  /*
+   * Set only on resources a StatusPageMonitorRule created. It is what lets the
+   * rule engine undo its own work without ever touching a resource a human
+   * added by hand, so it is deliberately not writable through the API - the
+   * engine sets it as root.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.StatusPageViewer,
+      Permission.ReadStatusPageResource,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    manyToOneRelationColumn: "statusPageMonitorRuleId",
+    type: TableColumnType.Entity,
+    modelType: StatusPageMonitorRule,
+    title: "Status Page Monitor Rule",
+    description:
+      "Rule that added this resource to the status page, if it was added by a rule instead of by hand",
+  })
+  @ManyToOne(
+    () => {
+      return StatusPageMonitorRule;
+    },
+    {
+      eager: false,
+      nullable: true,
+      onDelete: "CASCADE",
+      orphanedRowAction: "nullify",
+    },
+  )
+  @JoinColumn({ name: "statusPageMonitorRuleId" })
+  public statusPageMonitorRule?: StatusPageMonitorRule = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.StatusPageViewer,
+      Permission.ReadStatusPageResource,
+    ],
+    update: [],
+  })
+  @Index()
+  @TableColumn({
+    type: TableColumnType.ObjectID,
+    required: false,
+    title: "Status Page Monitor Rule ID",
+    description:
+      "ID of the rule that added this resource, if it was added by a rule instead of by hand",
+    example: "d0e1f2a3-b4c5-4678-9abc-def012345678",
+  })
+  @Column({
+    type: ColumnType.ObjectID,
+    nullable: true,
+    transformer: ObjectID.getDatabaseTransformer(),
+  })
+  public statusPageMonitorRuleId?: ObjectID = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/TraceDropFilter.ts

@@ -7,6 +7,7 @@ import TableAccessControl from "../../Types/Database/AccessControl/TableAccessCo
 import TableBillingAccessControl from "../../Types/Database/AccessControl/TableBillingAccessControl";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
+import { getBigIntDatabaseTransformer } from "../../Types/Database/BigIntColumnTransformer";
 import CrudApiEndpoint from "../../Types/Database/CrudApiEndpoint";
 import EnableDocumentation from "../../Types/Database/EnableDocumentation";
 import TableColumn from "../../Types/Database/TableColumn";
@@ -436,26 +437,14 @@ export default class TraceDropFilter extends BaseModel {
     type: ColumnType.BigPositiveNumber,
     nullable: false,
     default: 0,
-    transformer: {
-      to: (value: number | null | undefined): string | null => {
-        if (value === null || value === undefined) {
-          return null;
-        }
-        return Math.trunc(value).toString();
-      },
-      /*
-       * Postgres bigint comes back from the driver as a string. The UI
-       * renders this as a number, so normalize here rather than making
-       * every reader remember.
-       */
-      from: (value: string | null | undefined): number | null => {
-        if (value === null || value === undefined) {
-          return null;
-        }
-        const parsed: number = parseInt(value, 10);
-        return isNaN(parsed) ? null : parsed;
-      },
-    },
+    /*
+     * Shared transformer, not an inline one: it has to preserve `undefined`
+     * so this NOT NULL column's DEFAULT 0 is what a create actually gets.
+     * An inline transformer that mapped `undefined` to `null` made every
+     * drop-filter insert fail the not-null constraint. See
+     * Types/Database/BigIntColumnTransformer.
+     */
+    transformer: getBigIntDatabaseTransformer(),
   })
   public droppedCount?: number = undefined;
 

package/Models/DatabaseModels/User.ts

@@ -140,6 +140,7 @@ class User extends UserModel {
   @TableColumn({
     title: "Password",
     hashed: true,
+    hashSaltColumn: "passwordSalt",
     type: TableColumnType.HashedString,
   })
   @Column({
@@ -151,6 +152,35 @@ class User extends UserModel {
   })
   public password?: HashedString = undefined;
 
+  /*
+   * Per-user salt mixed into `password`'s hash. Written by the database
+   * write path on every password write — never by an API caller, hence the
+   * empty access control and `computed: true`.
+   *
+   * Nullable on purpose: rows that predate per-user salts have none, and are
+   * verified against the legacy unsalted scheme until the next successful
+   * login re-hashes them with a fresh salt.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    title: "Password Salt",
+    description: "Per-user random salt mixed into this user's password hash.",
+    computed: true,
+    type: TableColumnType.ShortText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public passwordSalt?: string = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [Permission.CurrentUser],

package/Server/API/AIAgentDataAPI.ts

@@ -69,6 +69,7 @@ import ObjectID from "../../Types/ObjectID";
 import GitHubUtil, {
   GitHubInstallationToken,
 } from "../Utils/CodeRepository/GitHub/GitHub";
+import GitHubInstallationBinding from "../Utils/CodeRepository/GitHub/GitHubInstallationBinding";
 import CodeRepositoryType from "../../Types/CodeRepository/CodeRepositoryType";
 import URL from "../../Types/API/URL";
 import PullRequestState from "../../Types/CodeRepository/PullRequestState";
@@ -1166,6 +1167,36 @@ export default class AIAgentDataAPI {
             );
           }
 
+          /*
+           * The project check above proves the ROW is in the agent's project.
+           * It does not prove the INSTALLATION is — and those are different
+           * questions, because the row's installation ID is just a number
+           * stored on a record. Someone who could get an arbitrary
+           * installation ID onto a row in a project they own would otherwise
+           * pass every check to this point and be handed a live `ghs_` token
+           * for another tenant's repositories. So re-derive the binding from
+           * the project itself, right before minting.
+           */
+          if (
+            !codeRepository.projectId ||
+            !(await GitHubInstallationBinding.isInstallationBoundToProject({
+              projectId: codeRepository.projectId,
+              installationId: codeRepository.gitHubAppInstallationId,
+            }))
+          ) {
+            logger.error(
+              `Refusing to mint a GitHub token for code repository ${codeRepositoryId.toString()}: installation ${codeRepository.gitHubAppInstallationId} is not bound to project ${codeRepository.projectId?.toString()}.`,
+            );
+
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "This repository's GitHub App installation is not connected to its project. Please reconnect the GitHub App from Project Settings.",
+              ),
+            );
+          }
+
           /*
            * G11 guardrail: per-repo open-PR cap, enforced HERE because the
            * token is the agent's only way to clone and push — a repo at its

package/Server/API/BaseAPI.ts

@@ -22,6 +22,7 @@ import {
   LIMIT_PER_PROJECT,
 } from "../../Types/Database/LimitMax";
 import PartialEntity from "../../Types/Database/PartialEntity";
+import { coerceNumericColumnsInJSON } from "../../Types/Database/NumericColumnValue";
 import BadDataException from "../../Types/Exception/BadDataException";
 import BadRequestException from "../../Types/Exception/BadRequestException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
@@ -418,8 +419,18 @@ export default class BaseAPI<
       );
     }
 
-    const item: PartialEntity<TBaseModel> = JSONFunctions.deserialize(
-      dataInBody as JSONObject,
+    /*
+     * Coerced the same way createItem's BaseModel.fromJSON coerces, so a
+     * PATCH and a POST agree on what a number column holds. The dashboard's
+     * number fields are `<input type="number">`, whose value is a string,
+     * and the save-time hooks read these values before Postgres would
+     * coerce them — a sample percentage of "10" was rejected as "not a
+     * number" on a form that had one filled in.
+     * github.com/OneUptime/oneuptime/issues/3027
+     */
+    const item: PartialEntity<TBaseModel> = coerceNumericColumnsInJSON(
+      JSONFunctions.deserialize(dataInBody as JSONObject),
+      new this.entityType(),
     ) as PartialEntity<TBaseModel>;
 
     delete (item as any)["_id"];