@oneuptime/common 12.0.2 → 12.0.4

package/Server/Services/CephClusterService.ts

@@ -5,6 +5,7 @@ import Model from "../../Models/DatabaseModels/CephCluster";
 import Label from "../../Models/DatabaseModels/Label";
 import { OnCreate } from "../Types/Database/Hooks";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ResourceHeartbeat from "../Utils/Telemetry/ResourceHeartbeat";
 import ObjectID from "../../Types/ObjectID";
 import QueryHelper from "../Types/Database/QueryHelper";
 import OneUptimeDate from "../../Types/Date";
@@ -181,7 +182,6 @@ export class Service extends DatabaseService<Model> {
       capacityUsedPercent?: number | undefined;
     },
   ): Promise<void> {
-    const cacheKey: string = clusterId.toString();
     const extrasFingerprint: string = crypto
       .createHash("sha1")
       .update(
@@ -200,34 +200,6 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    let cached: string | null = null;
-    try {
-      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
-    } catch {
-      /*
-       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
-       * cache error must never skip the DB write below, otherwise the
-       * resource is wrongly marked "disconnected" while telemetry is
-       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
-       */
-      cached = null;
-    }
-
-    if (cached === extrasFingerprint) {
-      return; // same data was written recently
-    }
-
-    try {
-      await GlobalCache.setString(
-        LAST_SEEN_CACHE_NAMESPACE,
-        cacheKey,
-        extrasFingerprint,
-        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-      );
-    } catch {
-      // Best-effort throttle write; proceed with the DB update regardless.
-    }
-
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const liveness: any = {
       lastSeenAt: OneUptimeDate.getCurrentDate(),
@@ -235,91 +207,59 @@ export class Service extends DatabaseService<Model> {
     };
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const data: any = { ...liveness };
+    const metadata: any = {};
 
     if (extra?.cephVersion) {
-      data.cephVersion = extra.cephVersion;
+      metadata.cephVersion = extra.cephVersion;
     }
     if (extra?.fsid) {
-      data.fsid = extra.fsid;
+      metadata.fsid = extra.fsid;
     }
     if (extra?.agentVersion) {
-      data.agentVersion = extra.agentVersion;
+      metadata.agentVersion = extra.agentVersion;
     }
     /*
      * Counts and health: 0 is a legitimate value (healthStatus 0 = OK,
      * osdUpCount 0 = every OSD down) — gate on undefined, not falsiness.
      */
     if (extra?.monCount !== undefined) {
-      data.monCount = extra.monCount;
+      metadata.monCount = extra.monCount;
     }
     if (extra?.osdCount !== undefined) {
-      data.osdCount = extra.osdCount;
+      metadata.osdCount = extra.osdCount;
     }
     if (extra?.osdUpCount !== undefined) {
-      data.osdUpCount = extra.osdUpCount;
+      metadata.osdUpCount = extra.osdUpCount;
     }
     if (extra?.osdInCount !== undefined) {
-      data.osdInCount = extra.osdInCount;
+      metadata.osdInCount = extra.osdInCount;
     }
     if (extra?.poolCount !== undefined) {
-      data.poolCount = extra.poolCount;
+      metadata.poolCount = extra.poolCount;
     }
     if (extra?.healthStatus !== undefined) {
-      data.healthStatus = extra.healthStatus;
+      metadata.healthStatus = extra.healthStatus;
     }
     if (extra?.capacityUsedPercent !== undefined) {
-      data.capacityUsedPercent = extra.capacityUsedPercent;
+      metadata.capacityUsedPercent = extra.capacityUsedPercent;
     }
 
     /*
-     * Heartbeat write: a single-statement UPDATE with no hooks and no
-     * `version` bump, avoiding the hot-row Postgres lock convoy that the
-     * full updateOneById pipeline causes. See ServiceService.updateLastSeen.
-     *
-     * Collector-supplied strings are clamped to their declared column
-     * widths inside updateColumnsByIdWithoutHooks — see
-     * DatabaseService.truncateStringColumnsToMaxLength.
+     * One gated, non-blocking heartbeat write. The gates, the fail-open /
+     * fail-closed split and the liveness-only fallback all live in
+     * ResourceHeartbeat — see there for why this row's throttle used to
+     * provide no throttling at all.
      */
-    try {
-      await this.updateColumnsByIdWithoutHooks({
-        id: clusterId,
-        data: data,
-      });
-    } catch (err) {
-      /*
-       * Liveness must survive bad metadata. The enriched write carries
-       * `lastSeenAt` and `otelCollectorStatus` alongside optional,
-       * collector-supplied columns; if any one of them makes Postgres
-       * reject the statement, lastSeenAt silently stops advancing and
-       * markDisconnectedClusters flips a perfectly healthy Ceph cluster to
-       * "disconnected" 15 minutes later — with telemetry still arriving the
-       * whole time. That was issue #3006 on the Host path (a host.ip list
-       * longer than the then-varchar(500) column). Retry with liveness only
-       * so the enrichment is what gets dropped, never the heartbeat.
-       */
-      logger.warn(
-        `CephClusterService.updateLastSeen: metadata write failed for Ceph cluster ${clusterId.toString()}, falling back to a liveness-only update: ${
-          err instanceof Error ? err.message : String(err)
-        }`,
-      );
-
-      /*
-       * The throttle fingerprint was already stored, so without this the
-       * next batch would short-circuit on a cache hit and skip the retry
-       * for the rest of the window.
-       */
-      try {
-        await GlobalCache.deleteKey(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
-      } catch {
-        // Best-effort; the fallback write below is what actually matters.
-      }
-
-      await this.updateColumnsByIdWithoutHooks({
-        id: clusterId,
-        data: liveness,
-      });
-    }
+    await ResourceHeartbeat.write({
+      service: this,
+      id: clusterId,
+      cacheNamespace: LAST_SEEN_CACHE_NAMESPACE,
+      throttleInSeconds: LAST_SEEN_THROTTLE_SECONDS,
+      liveness: liveness,
+      metadata: metadata,
+      fingerprint: extrasFingerprint,
+      describe: `ceph cluster ${clusterId.toString()}`,
+    });
   }
 
   /**

package/Server/Services/CloudResourceService.ts

@@ -2,6 +2,7 @@ import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/CloudResource";
 import Label from "../../Models/DatabaseModels/Label";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import ResourceHeartbeat from "../Utils/Telemetry/ResourceHeartbeat";
 import ObjectID from "../../Types/ObjectID";
 import QueryHelper from "../Types/Database/QueryHelper";
 import OneUptimeDate from "../../Types/Date";
@@ -154,7 +155,6 @@ export class Service extends DatabaseService<Model> {
       runtimeVersion?: string | undefined;
     },
   ): Promise<void> {
-    const cacheKey: string = cloudResourceId.toString();
     const extrasFingerprint: string = crypto
       .createHash("sha1")
       .update(
@@ -170,34 +170,6 @@ export class Service extends DatabaseService<Model> {
       )
       .digest("hex");
 
-    let cached: string | null = null;
-    try {
-      cached = await GlobalCache.getString(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
-    } catch {
-      /*
-       * Cache unavailable — fail open and refresh lastSeenAt anyway. A
-       * cache error must never skip the DB write below, otherwise the
-       * resource is wrongly marked "disconnected" while telemetry is
-       * still flowing. Mirrors shouldRunMaintenance's fail-open stance.
-       */
-      cached = null;
-    }
-
-    if (cached === extrasFingerprint) {
-      return; // same data was written recently
-    }
-
-    try {
-      await GlobalCache.setString(
-        LAST_SEEN_CACHE_NAMESPACE,
-        cacheKey,
-        extrasFingerprint,
-        { expiresInSeconds: LAST_SEEN_THROTTLE_SECONDS },
-      );
-    } catch {
-      // Best-effort throttle write; proceed with the DB update regardless.
-    }
-
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     const liveness: any = {
       lastSeenAt: OneUptimeDate.getCurrentDate(),
@@ -205,78 +177,46 @@ export class Service extends DatabaseService<Model> {
     };
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    const data: any = { ...liveness };
+    const metadata: any = {};
 
     if (extra?.agentVersion) {
-      data.agentVersion = extra.agentVersion;
+      metadata.agentVersion = extra.agentVersion;
     }
     if (extra?.cloudPlatform) {
-      data.cloudPlatform = extra.cloudPlatform;
+      metadata.cloudPlatform = extra.cloudPlatform;
     }
     if (extra?.cloudProvider) {
-      data.cloudProvider = extra.cloudProvider;
+      metadata.cloudProvider = extra.cloudProvider;
     }
     if (extra?.cloudRegion) {
-      data.cloudRegion = extra.cloudRegion;
+      metadata.cloudRegion = extra.cloudRegion;
     }
     if (extra?.cloudAccountId) {
-      data.cloudAccountId = extra.cloudAccountId;
+      metadata.cloudAccountId = extra.cloudAccountId;
     }
     if (extra?.runtimeName) {
-      data.runtimeName = extra.runtimeName;
+      metadata.runtimeName = extra.runtimeName;
     }
     if (extra?.runtimeVersion) {
-      data.runtimeVersion = extra.runtimeVersion;
+      metadata.runtimeVersion = extra.runtimeVersion;
     }
 
     /*
-     * Heartbeat write: a single-statement UPDATE with no hooks and no
-     * `version` bump, avoiding the hot-row Postgres lock convoy that the
-     * full updateOneById pipeline causes. See ServiceService.updateLastSeen.
-     *
-     * Collector-supplied strings are clamped to their declared column
-     * widths inside updateColumnsByIdWithoutHooks — see
-     * DatabaseService.truncateStringColumnsToMaxLength.
+     * One gated, non-blocking heartbeat write. The gates, the fail-open /
+     * fail-closed split and the liveness-only fallback all live in
+     * ResourceHeartbeat — see there for why this row's throttle used to
+     * provide no throttling at all.
      */
-    try {
-      await this.updateColumnsByIdWithoutHooks({
-        id: cloudResourceId,
-        data: data,
-      });
-    } catch (err) {
-      /*
-       * Liveness must survive bad metadata. The enriched write carries
-       * `lastSeenAt` and `otelCollectorStatus` alongside optional,
-       * collector-supplied columns; if any one of them makes Postgres
-       * reject the statement, lastSeenAt silently stops advancing and
-       * markDisconnectedResources flips a perfectly healthy cloud resource
-       * to "disconnected" 15 minutes later — with telemetry still arriving
-       * the whole time. That was issue #3006 on the Host path (a host.ip
-       * list longer than the then-varchar(500) column). Retry with liveness
-       * only so the enrichment is what gets dropped, never the heartbeat.
-       */
-      logger.warn(
-        `CloudResourceService.updateLastSeen: metadata write failed for cloud resource ${cloudResourceId.toString()}, falling back to a liveness-only update: ${
-          err instanceof Error ? err.message : String(err)
-        }`,
-      );
-
-      /*
-       * The throttle fingerprint was already stored, so without this the
-       * next batch would short-circuit on a cache hit and skip the retry
-       * for the rest of the window.
-       */
-      try {
-        await GlobalCache.deleteKey(LAST_SEEN_CACHE_NAMESPACE, cacheKey);
-      } catch {
-        // Best-effort; the fallback write below is what actually matters.
-      }
-
-      await this.updateColumnsByIdWithoutHooks({
-        id: cloudResourceId,
-        data: liveness,
-      });
-    }
+    await ResourceHeartbeat.write({
+      service: this,
+      id: cloudResourceId,
+      cacheNamespace: LAST_SEEN_CACHE_NAMESPACE,
+      throttleInSeconds: LAST_SEEN_THROTTLE_SECONDS,
+      liveness: liveness,
+      metadata: metadata,
+      fingerprint: extrasFingerprint,
+      describe: `cloud resource ${cloudResourceId.toString()}`,
+    });
   }
 
   @CaptureSpan()

package/Server/Services/CodeRepositoryService.ts

@@ -14,6 +14,11 @@ import {
 import GitHubUtil, {
   GitHubRepository,
 } from "../Utils/CodeRepository/GitHub/GitHub";
+import GitHubInstallationBinding from "../Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import BadDataException from "../../Types/Exception/BadDataException";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 
 export interface ImportReposFromInstallationResult {
   imported: number;
@@ -25,6 +30,93 @@ export class Service extends DatabaseService<Model> {
     super(Model);
   }
 
+  /*
+   * Last line of defence for the installation-to-project binding.
+   *
+   * gitHubAppInstallationId is already closed to API callers at the column
+   * level, but that only stops requests that go through permission checks —
+   * every write here is made with `props: { isRoot: true }`, which skips them
+   * entirely. This hook runs regardless of isRoot, so any route (including one
+   * added later) that writes a row carrying another tenant's installation ID
+   * is refused at the service boundary rather than at the token endpoint.
+   *
+   * The legitimate writer is importReposFromInstallation, which the install
+   * callback and the installation webhooks only ever call for a project the
+   * installation is already bound to — so this check passes for them.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const installationId: string | undefined =
+      createBy.data.gitHubAppInstallationId;
+
+    if (installationId) {
+      const projectId: ObjectID | undefined =
+        createBy.data.projectId || createBy.props.tenantId;
+
+      if (!projectId) {
+        throw new BadDataException(
+          "A project is required to connect a GitHub App installation to a repository.",
+        );
+      }
+
+      await GitHubInstallationBinding.assertInstallationBoundToProject({
+        projectId: projectId,
+        installationId: installationId,
+      });
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  /*
+   * Same rule on the update path. Clearing the installation ID is always
+   * allowed — that is how the `installation.deleted` webhook tears a
+   * disconnected installation out of the database.
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    const installationId: string | undefined = updateBy.data
+      .gitHubAppInstallationId as string | undefined;
+
+    if (installationId) {
+      /*
+       * updateBy matches by query rather than by id, so check every row the
+       * write would touch: one unbound row is enough to leak a token.
+       */
+      const repositories: Array<Model> = await this.findBy({
+        query: updateBy.query,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      for (const repository of repositories) {
+        if (!repository.projectId) {
+          throw new BadDataException(
+            "A project is required to connect a GitHub App installation to a repository.",
+          );
+        }
+
+        await GitHubInstallationBinding.assertInstallationBoundToProject({
+          projectId: repository.projectId,
+          installationId: installationId,
+        });
+      }
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
   /*
    * Imports all repositories accessible to a GitHub App installation into a
    * project. Repositories that already exist for the project (matched on
@@ -174,13 +266,24 @@ export class Service extends DatabaseService<Model> {
       },
     });
 
-    // Only GitHub-App-connected repos can be cloned/pushed by the agent.
+    /*
+     * Only GitHub-App-connected repos can be cloned/pushed by the agent — and
+     * only ones whose installation this project actually owns. Resolution
+     * probes EVERY candidate's file tree, so an unbound row here would have
+     * the server read another tenant's private repository on its own
+     * initiative (GHSA-xx95-gmcf-7q86).
+     */
+    const boundInstallationId: string | null =
+      await GitHubInstallationBinding.getBoundInstallationId(data.projectId);
+
     const resolvable: Array<ResolvableRepository> = repositories
       .filter((repository: Model) => {
         return (
           repository.repositoryHostedAt === CodeRepositoryType.GitHub &&
           Boolean(repository.gitHubAppInstallationId) &&
-          Boolean(repository.id)
+          Boolean(repository.id) &&
+          Boolean(boundInstallationId) &&
+          repository.gitHubAppInstallationId === boundInstallationId
         );
       })
       .map((repository: Model) => {