@oneuptime/common 12.0.2 → 12.0.4

package/Types/Database/NumericColumnValue.ts

@@ -0,0 +1,128 @@
+import { JSONObject, JSONValue } from "../JSON";
+import { TableColumnMetadata } from "./TableColumn";
+import TableColumnType from "./TableColumnType";
+
+/*
+ * Column types whose in-memory representation is a plain JavaScript number.
+ *
+ * Deliberately excludes the types that merely *look* numeric — `Port`,
+ * `Version`, `Date` — because coercing those would destroy them.
+ *
+ * The declared type is not a perfect proxy for the in-memory one: an SMTP
+ * port is declared `Number` but typed `Port`, and a usage figure is declared
+ * `Number` but typed `Decimal`. Coercing a string to a number is safe for
+ * those only because each of their transformers accepts a raw number —
+ * which is a property their tests pin, not an accident.
+ */
+const NUMERIC_TABLE_COLUMN_TYPES: Set<TableColumnType> =
+  new Set<TableColumnType>([
+    TableColumnType.Number,
+    TableColumnType.SmallNumber,
+    TableColumnType.BigNumber,
+    TableColumnType.PositiveNumber,
+    TableColumnType.SmallPositiveNumber,
+    TableColumnType.BigPositiveNumber,
+  ]);
+
+export function isNumericTableColumnType(
+  type: TableColumnType | undefined | null,
+): boolean {
+  if (!type) {
+    return false;
+  }
+
+  return NUMERIC_TABLE_COLUMN_TYPES.has(type);
+}
+
+/*
+ * Normalize a JSON value destined for a number column.
+ *
+ * The dashboard's number form field is an `<input type="number">`, and a DOM
+ * input's value is a *string* — there is no numeric input event in HTML. So
+ * "10" typed into "Sample Percentage" reached the API as the JSON string
+ * "10", and any server-side check spelled `typeof value === "number"`
+ * rejected a perfectly valid form submission:
+ *
+ *   BadDataException: Sample percentage is required when the action is
+ *   "Sample" ... between 1 and 99.
+ *
+ * Postgres silently coerces '10' to 10 on the way in, which is why this had
+ * gone unnoticed on every other number field in the product: the string only
+ * becomes visible when something reads the value before it is stored.
+ *
+ * Normalizing here — where the column's declared type is known, on both the
+ * browser side (ModelForm -> BaseModel.fromJSON) and the server side
+ * (BaseAPI -> BaseModel.fromJSON) — means a number column holds a number by
+ * the time any hook, validator or query sees it.
+ *
+ * Only strings that parse cleanly to a finite number are converted. A blank
+ * string is left alone rather than turned into `0` (`Number("")` is 0, which
+ * would silently write a real value for a field the user cleared) or into
+ * `null` (which would defeat a column DEFAULT the same way the bigint
+ * transformer used to). Garbage like "abc" is left alone too, so validation
+ * rejects it with a message about the field instead of this function
+ * inventing a value.
+ */
+export function coerceNumericColumnValue(value: unknown): unknown {
+  if (typeof value !== "string") {
+    return value;
+  }
+
+  const trimmed: string = value.trim();
+
+  if (trimmed.length === 0) {
+    return value;
+  }
+
+  const parsed: number = Number(trimmed);
+
+  if (!Number.isFinite(parsed)) {
+    return value;
+  }
+
+  return parsed;
+}
+
+/*
+ * The minimum a model has to offer for its number columns to be found.
+ * Every DatabaseBaseModel satisfies it; asking for only this keeps the
+ * coercion usable from the API layer without dragging the model class in.
+ */
+export interface ColumnMetadataSource {
+  getTableColumnMetadata: (columnName: string) => TableColumnMetadata;
+}
+
+/*
+ * Coerce the number columns of a loose JSON patch, in place.
+ *
+ * `BaseModel.fromJSON` does this on its way to building a model, but an
+ * update never builds one — `BaseAPI.updateItem` goes from the request body
+ * straight to a partial entity — so without this a PATCH and a POST
+ * disagree about whether "10" is a number. That matters because the
+ * save-time hooks read these values before the database gets a chance to
+ * coerce them.
+ *
+ * Values that are not strings are left exactly as they are, including the
+ * `() => string` raw SQL expressions a PartialEntity may carry.
+ */
+export function coerceNumericColumnsInJSON(
+  json: JSONObject,
+  model: ColumnMetadataSource,
+): JSONObject {
+  for (const key of Object.keys(json)) {
+    const tableColumnMetadata: TableColumnMetadata =
+      model.getTableColumnMetadata(key);
+
+    if (!tableColumnMetadata) {
+      continue;
+    }
+
+    if (!isNumericTableColumnType(tableColumnMetadata.type)) {
+      continue;
+    }
+
+    json[key] = coerceNumericColumnValue(json[key]) as JSONValue;
+  }
+
+  return json;
+}

package/Types/Database/TableColumn.ts

@@ -16,6 +16,17 @@ export interface TableColumnMetadata {
   unique?: boolean;
   computed?: boolean;
   hashed?: boolean;
+  /*
+   * Name of the sibling column that holds this column's per-record salt.
+   *
+   * When set, the write path generates a fresh random salt on every write of
+   * this column, stores it in the named column, and mixes it into the hash.
+   * Two records with the same plaintext then hash to different values, so one
+   * precomputed table (or one cracked value) buys an attacker nothing
+   * anywhere else. The salt column must be nullable — rows written before the
+   * salt existed have none and verify against the legacy unsalted scheme.
+   */
+  hashSaltColumn?: string;
   encrypted?: boolean;
   manyToOneRelationColumn?: string;
   type: TableColumnType;

package/Types/Database/UnsynchronizedIndex.ts

@@ -0,0 +1,48 @@
+import { IndexOptions } from "typeorm";
+
+/*
+ * Options for an index whose definition TypeORM cannot express, and which must
+ * therefore be owned by a migration rather than by the schema builder.
+ *
+ * WHY THIS EXISTS
+ *
+ * TypeORM's schema builder matches database indexes to entity metadata BY NAME
+ * (RdbmsSchemaBuilder.dropOldIndices: `metadata.indices.find((i) => i.name ===
+ * tableIndex.name)`) and DROPS every index it cannot find a match for. An index
+ * created only in a migration is invisible to entity metadata, so the next
+ * `npm run generate-postgres-migration` emits a DROP for it — silently, mixed
+ * in with whatever change was actually being made.
+ *
+ * That is not hypothetical. An audit of every hand-named index ever created by
+ * a migration against a fully-migrated database found ten that had been deleted
+ * this way and never restored, including the unique guards on six `slug`
+ * columns and the LOWER(name) index serving the telemetry ingest hot path.
+ * Migration 1775735059360 is a representative example: two unrelated column
+ * default changes, plus a DROP of an expression index, plus a down() that
+ * "restores" it without the expression.
+ *
+ * HOW THIS FIXES IT
+ *
+ * Declaring the index on the entity BY NAME with these options makes the schema
+ * builder skip it in both directions: `dropOldIndices` returns early on
+ * `synchronize === false`, and `createNewIndices` only considers indexes with
+ * `synchronize === true`. The migration stays the single source of truth for
+ * the real definition, and the declaration exists purely so TypeORM leaves it
+ * alone.
+ *
+ * The columns passed alongside these options are documentation — the schema
+ * builder never reads them for an unsynchronized index. Where the real
+ * definition is partial or an expression, say so in a comment at the call site.
+ *
+ * THE CAST
+ *
+ * `synchronize` is a real, supported option: the @Index decorator forwards it
+ * into IndexMetadataArgs (typeorm/decorator/Index.js), IndexMetadataArgs
+ * declares it, and RdbmsSchemaBuilder reads it. Only the public IndexOptions
+ * type omits it — a gap in TypeORM's own typings rather than a misuse.
+ */
+const UNSYNCHRONIZED_INDEX: IndexOptions = {
+  synchronize: false,
+} as IndexOptions;
+
+export default UNSYNCHRONIZED_INDEX;

package/Types/Decimal.ts

@@ -35,14 +35,26 @@ export default class Decimal extends DatabaseProperty {
     return this.value.toString();
   }
 
+  /*
+   * A decimal column is declared `TableColumnType.Number`, so what reaches
+   * the transformer may be a Decimal, a string, or a plain number depending
+   * on how far the request body got through deserialization.
+   *
+   * Both raw forms are handled before the truthiness check, because `0` is a
+   * perfectly good decimal and the old `if (value)` sent it to `null` — on a
+   * NOT NULL column that is a constraint violation for a value the caller
+   * supplied.
+   */
   protected static override toDatabase(
     value: Decimal | FindOperator<Decimal>,
   ): string | null {
-    if (value) {
-      if (typeof value === "string") {
-        value = new Decimal(value);
-      }
+    const rawValue: unknown = value;
+
+    if (typeof rawValue === "string" || typeof rawValue === "number") {
+      return new Decimal(rawValue).toString();
+    }
 
+    if (value) {
       return value.toString();
     }
 

package/Types/HashedString.ts

@@ -7,6 +7,29 @@ import ObjectID from "./ObjectID";
 import CryptoJS from "crypto-js";
 import { FindOperator } from "typeorm";
 
+/*
+ * SHA-256 hashing for values that are ALREADY high-entropy: session refresh
+ * tokens, email verification tokens, reset tokens, permission fingerprints.
+ * Those are random values the server minted, so there is nothing to guess and
+ * a fast hash is the right tool — it also keeps them searchable by hash,
+ * which is how they are looked up.
+ *
+ * User passwords are NOT hashed here any more. A password is low-entropy and
+ * guessable, so it goes through scrypt in Common/Server/Utils/PasswordHash,
+ * which is deliberately slow and memory-hard. What remains in this class is
+ * the two SHA-256 schemes passwords used to be stored under, kept so those
+ * rows still verify (and are then upgraded) at their owner's next login:
+ *
+ *   no salt   `SHA256(secret + value)`, from before per-user salts existed.
+ *   salted    `SHA256("v2:" + salt + ":" + secret + ":" + value)`.
+ *
+ * Neither records its scheme in the digest — it is a bare hex SHA-256 either
+ * way — so they are told apart by whether the row carries a salt. The "v2"
+ * prefix and the separators exist for domain separation: without them a
+ * crafted salt could make a salted input collide with an unsalted one.
+ */
+const SALTED_HASH_SCHEME_VERSION: string = "v2";
+
 export default class HashedString extends DatabaseProperty {
   private isHashed: boolean = false;
 
@@ -65,7 +88,62 @@ export default class HashedString extends DatabaseProperty {
     return this.isHashed;
   }
 
-  public async hashValue(encryptionSecret: ObjectID | null): Promise<string> {
+  /**
+   * Adopt an already-computed digest.
+   *
+   * For hashes this class does not compute itself — user passwords go
+   * through scrypt in Common/Server/Utils/PasswordHash, which is server-only
+   * because this type is also bundled into the browser. The guard is the
+   * same one hashValue() carries: a value is hashed once and never re-hashed
+   * over the top of itself.
+   */
+  public setHashedValue(hashedValue: string): void {
+    if (this.isHashed) {
+      throw new BadOperationException("Value is already hashed");
+    }
+
+    this.isHashed = true;
+    this.value = hashedValue;
+  }
+
+  /**
+   * The exact byte string fed to SHA-256.
+   *
+   * The unsalted branch MUST stay byte-for-byte identical forever: every
+   * password hashed before per-user salts existed is verified through it.
+   */
+  private static buildValueToHash(
+    value: string,
+    encryptionSecret: ObjectID | null,
+    salt: string | null,
+  ): string {
+    if (!salt) {
+      return (encryptionSecret || "") + value;
+    }
+
+    return `${SALTED_HASH_SCHEME_VERSION}:${salt}:${
+      encryptionSecret || ""
+    }:${value}`;
+  }
+
+  public static computeHash(
+    value: string,
+    encryptionSecret: ObjectID | null,
+    salt?: string | null,
+  ): string {
+    if (!value) {
+      return "";
+    }
+
+    return CryptoJS.SHA256(
+      HashedString.buildValueToHash(value, encryptionSecret, salt || null),
+    ).toString();
+  }
+
+  public async hashValue(
+    encryptionSecret: ObjectID | null,
+    salt?: string | null,
+  ): Promise<string> {
     if (!this.value) {
       return "";
     }
@@ -74,19 +152,76 @@ export default class HashedString extends DatabaseProperty {
       throw new BadOperationException("Value is already hashed");
     }
 
-    const valueToHash: string = (encryptionSecret || "") + this.value;
     this.isHashed = true;
 
-    this.value = CryptoJS.SHA256(valueToHash).toString();
+    this.value = HashedString.computeHash(
+      this.value,
+      encryptionSecret,
+      salt || null,
+    );
     return this.value;
   }
 
   public static async hashValue(
     value: string,
     encryptionSecret: ObjectID | null,
+    salt?: string | null,
   ): Promise<string> {
     const hashstring: HashedString = new HashedString(value, false);
-    return await hashstring.hashValue(encryptionSecret);
+    return await hashstring.hashValue(encryptionSecret, salt || null);
+  }
+
+  /**
+   * Compare two already-hashed values without leaking, through timing, how
+   * many leading characters matched. Comparing digests with `===` lets an
+   * attacker who can measure response time recover a stored hash one
+   * character at a time; recovering the hash is what makes offline cracking
+   * possible in the first place.
+   *
+   * Lengths are compared up front. Digests here are always the same length,
+   * so an early exit only happens on malformed input, where the length is
+   * not the secret.
+   */
+  public static isEqual(a: string, b: string): boolean {
+    if (a.length !== b.length) {
+      return false;
+    }
+
+    let difference: number = 0;
+
+    for (let i: number = 0; i < a.length; i++) {
+      difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+
+    return difference === 0;
+  }
+
+  /**
+   * Verify a plaintext value against a stored hash.
+   *
+   * Pass the salt stored alongside the hash. Pass null/undefined for records
+   * written before per-user salts existed — those verify against the legacy
+   * unsalted scheme, and the caller should re-hash them with a fresh salt
+   * once the value is known to be correct.
+   */
+  public static async verifyValue(data: {
+    plainValue: string;
+    hashedValue: string;
+    encryptionSecret: ObjectID | null;
+    salt?: string | null | undefined;
+  }): Promise<boolean> {
+    if (!data.plainValue || !data.hashedValue) {
+      return false;
+    }
+
+    return HashedString.isEqual(
+      HashedString.computeHash(
+        data.plainValue,
+        data.encryptionSecret,
+        data.salt || null,
+      ),
+      data.hashedValue,
+    );
   }
 
   protected static override fromDatabase(_value: string): HashedString | null {

package/Types/Permission.ts

@@ -484,6 +484,12 @@ enum Permission {
   EditStatusPageLabelRule = "EditStatusPageLabelRule",
   ReadStatusPageLabelRule = "ReadStatusPageLabelRule",
 
+  // Status Page Monitor Rule Permissions
+  CreateStatusPageMonitorRule = "CreateStatusPageMonitorRule",
+  DeleteStatusPageMonitorRule = "DeleteStatusPageMonitorRule",
+  EditStatusPageMonitorRule = "EditStatusPageMonitorRule",
+  ReadStatusPageMonitorRule = "ReadStatusPageMonitorRule",
+
   // Host Owner Rule Permissions
   CreateHostOwnerRule = "CreateHostOwnerRule",
   DeleteHostOwnerRule = "DeleteHostOwnerRule",
@@ -11104,6 +11110,48 @@ export class PermissionHelper {
         group: PermissionGroup.StatusPage,
       },
 
+      // Status Page Monitor Rule Permissions
+      {
+        permission: Permission.CreateStatusPageMonitorRule,
+        title: "Create Status Page Monitor Rule",
+        description:
+          "This permission can create Status Page Monitor Rules in this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.StatusPage,
+      },
+      {
+        permission: Permission.DeleteStatusPageMonitorRule,
+        title: "Delete Status Page Monitor Rule",
+        description:
+          "This permission can delete Status Page Monitor Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.StatusPage,
+      },
+      {
+        permission: Permission.EditStatusPageMonitorRule,
+        title: "Edit Status Page Monitor Rule",
+        description:
+          "This permission can edit Status Page Monitor Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.StatusPage,
+      },
+      {
+        permission: Permission.ReadStatusPageMonitorRule,
+        title: "Read Status Page Monitor Rule",
+        description:
+          "This permission can read Status Page Monitor Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.StatusPage,
+      },
+
       // Host Owner Rule Permissions
       {
         permission: Permission.CreateHostOwnerRule,

package/Types/Port.ts

@@ -59,17 +59,29 @@ export default class Port extends DatabaseProperty {
     this.port = new PositiveNumber(port);
   }
 
+  /*
+   * A port column is declared `TableColumnType.Number`, so a raw number is
+   * as legitimate an incoming value as a raw string — the SMTP forms send
+   * one or the other depending on how far the value got through
+   * deserialization. Dropping a number on the floor here wrote NULL over a
+   * port the user had just typed, with no error anywhere.
+   */
   public static override toDatabase(
     value: Port | FindOperator<Port>,
   ): number | null {
-    if (typeof value === "string") {
-      value = new Port(value);
+    /*
+     * The declared parameter type stays Port-shaped so this still overrides
+     * DatabaseProperty.toDatabase, but a raw string or number genuinely
+     * arrives here — see the note above — so widen at the check instead.
+     */
+    const rawValue: unknown = value;
+
+    if (typeof rawValue === "string" || typeof rawValue === "number") {
+      value = new Port(rawValue);
     }
 
     if (value instanceof Port) {
       return value.toNumber();
-    } else if (typeof value === "string") {
-      return parseInt(value);
     }
 
     return null;

package/UI/Components/CustomFields/CustomFieldsDetail.tsx

@@ -51,14 +51,41 @@ export interface ComponentProps {
   customFieldType: DatabaseBaseModelType;
   projectId: ObjectID;
   name: string;
-  isEditable?: boolean;
+  isEditable?: boolean | undefined;
+  /*
+   * For call sites that mount this card unconditionally - the resource
+   * overview pages - where most projects have never defined a custom field.
+   *
+   * With this set the card renders NOTHING until it knows the project has at
+   * least one field of this type: no loader flash and no "no custom fields
+   * have been added" placeholder occupying a slot on a page the operator
+   * opened to look at something else.
+   *
+   * It also hides on a load failure, because reading the schema is gated on
+   * both a permission and a billing plan. Without that, every incident a
+   * project below the custom-fields plan opens would carry an error card it
+   * can do nothing about. The dedicated Custom Fields page mounts this same
+   * component WITHOUT the flag, so anyone who goes looking still sees the
+   * real reason.
+   */
+  hideIfEmpty?: boolean | undefined;
 }
 
 const CustomFieldsDetail: FunctionComponent<ComponentProps> = (
   props: ComponentProps,
 ): ReactElement => {
   const [schemaList, setSchemaList] = useState<Array<BaseModel>>([]);
-  const [error, setError] = useState<string>("");
+  /*
+   * Read failures and write failures are kept apart because hideIfEmpty
+   * treats them oppositely. Failing to READ the schema is something an
+   * overview page swallows - the project may simply not be on a plan that
+   * includes custom fields, and there is nothing the operator can do about it
+   * on an incident page. Failing to WRITE is the operator's own edit coming
+   * back rejected, and must be reported wherever it happens. Sharing one slot
+   * meant a rejected save made the whole card disappear.
+   */
+  const [loadError, setLoadError] = useState<string>("");
+  const [saveError, setSaveError] = useState<string>("");
   const [isLoading, setIsLoading] = useState<boolean>(false);
   const [model, setModel] = useState<BaseModel | null>(null);
   const [showModelForm, setShowModelForm] = useState<boolean>(false);
@@ -67,6 +94,7 @@ const CustomFieldsDetail: FunctionComponent<ComponentProps> = (
     try {
       // load schema.
       setIsLoading(true);
+      setLoadError("");
 
       const schemaList: ListResult<BaseModel> =
         await ModelAPI.getList<BaseModel>({
@@ -99,7 +127,7 @@ const CustomFieldsDetail: FunctionComponent<ComponentProps> = (
       setIsLoading(false);
     } catch (err) {
       setIsLoading(false);
-      setError(API.getFriendlyMessage(err));
+      setLoadError(API.getFriendlyMessage(err));
     }
   };
 
@@ -109,6 +137,7 @@ const CustomFieldsDetail: FunctionComponent<ComponentProps> = (
     try {
       // load schema.
       setIsLoading(true);
+      setSaveError("");
       setShowModelForm(false);
 
       await ModelAPI.updateById({
@@ -122,7 +151,7 @@ const CustomFieldsDetail: FunctionComponent<ComponentProps> = (
       await onLoad();
     } catch (err) {
       setIsLoading(false);
-      setError(API.getFriendlyMessage(err));
+      setSaveError(API.getFriendlyMessage(err));
     }
   };
 
@@ -132,12 +161,45 @@ const CustomFieldsDetail: FunctionComponent<ComponentProps> = (
 
   const isEditable: boolean = props.isEditable !== false;
 
+  /*
+   * schemaList is empty both before the first load finishes and when the
+   * project genuinely has no fields of this type, which is exactly when an
+   * overview page should show nothing - so one check covers both.
+   *
+   * `!model` covers the record itself coming back empty. On a page that is
+   * plainly displaying that record, a card announcing "Item not found" is a
+   * contradiction; showing nothing is the honest version.
+   *
+   * Deliberately NOT saveError: a rejected save has to stay on screen, and it
+   * leaves schemaList and model intact, so the card keeps rendering.
+   */
+  if (
+    props.hideIfEmpty &&
+    (Boolean(loadError) || schemaList.length === 0 || !model)
+  ) {
+    return <></>;
+  }
+
+  /*
+   * There has to be something to edit before the button is worth offering:
+   * the modal reads its initial values off the record and its inputs off the
+   * schema, so opening it mid-load threw on a null record, and opening it
+   * with no fields defined produced a form with nothing in it.
+   *
+   * A failed LOAD needs no term of its own - it leaves schemaList empty and
+   * model null, which the checks below already cover. A failed SAVE must not
+   * take the button away, or the error message is telling the operator to
+   * retry something they can no longer reach.
+   */
+  const canEdit: boolean =
+    isEditable && !isLoading && schemaList.length > 0 && Boolean(model);
+
   return (
     <Card
       title={props.title}
       description={props.description}
       buttons={
-        isEditable
+        canEdit
           ? [
               {
                 title: "Edit Fields",
@@ -152,14 +214,26 @@ const CustomFieldsDetail: FunctionComponent<ComponentProps> = (
       }
     >
       <div className="border-t border-gray-200 px-4 py-5 sm:px-6 -m-6 -mt-2">
-        {isLoading && !error && <ComponentLoader />}
-        {!isLoading && !error && schemaList.length === 0 && (
+        {isLoading && !loadError && <ComponentLoader />}
+        {!isLoading && !loadError && schemaList.length === 0 && (
           <ErrorMessage message="No custom fields have been added for this resource. You may add custom fields in Project Settings." />
         )}
-        {error && <ErrorMessage message={error} />}
-        {!model && <ErrorMessage message={"Item not found"} />}
+        {loadError && <ErrorMessage message={loadError} />}
+        {/*
+         * Above the values, which are still the ones on the record: the save
+         * did not happen, so what is on screen below is what is stored.
+         */}
+        {saveError && <ErrorMessage message={saveError} />}
+        {/*
+         * Only once the fetch has settled: model is null on the very first
+         * render too, and announcing "Item not found" while the request is
+         * still in flight reads as a broken record rather than a pending one.
+         */}
+        {!isLoading && !loadError && schemaList.length > 0 && !model && (
+          <ErrorMessage message={"Item not found"} />
+        )}
 
-        {!isLoading && !error && model && (
+        {!isLoading && !loadError && schemaList.length > 0 && model && (
           <Detail
             id={props.name}
             item={(model as any)["customFields"] || {}}
@@ -194,7 +268,7 @@ const CustomFieldsDetail: FunctionComponent<ComponentProps> = (
               await onSave(data).catch();
             }}
             formProps={{
-              initialValues: (model as any)["customFields"] || {},
+              initialValues: (model as any)?.["customFields"] || {},
               fields: schemaList.map((schemaItem: BaseModel) => {
                 const isDropdown: boolean =
                   (schemaItem as any).customFieldType ===