@oneuptime/common 12.0.2 → 12.0.4

package/build/dist/Server/Services/CodeRepositoryService.js

@@ -16,10 +16,77 @@ import logger from "../Utils/Logger";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { resolveRepositoryForExceptionFix, } from "../Utils/CodeRepository/StackTraceRepoResolver";
 import GitHubUtil from "../Utils/CodeRepository/GitHub/GitHub";
+import GitHubInstallationBinding from "../Utils/CodeRepository/GitHub/GitHubInstallationBinding";
+import BadDataException from "../../Types/Exception/BadDataException";
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /*
+     * Last line of defence for the installation-to-project binding.
+     *
+     * gitHubAppInstallationId is already closed to API callers at the column
+     * level, but that only stops requests that go through permission checks —
+     * every write here is made with `props: { isRoot: true }`, which skips them
+     * entirely. This hook runs regardless of isRoot, so any route (including one
+     * added later) that writes a row carrying another tenant's installation ID
+     * is refused at the service boundary rather than at the token endpoint.
+     *
+     * The legitimate writer is importReposFromInstallation, which the install
+     * callback and the installation webhooks only ever call for a project the
+     * installation is already bound to — so this check passes for them.
+     */
+    async onBeforeCreate(createBy) {
+        const installationId = createBy.data.gitHubAppInstallationId;
+        if (installationId) {
+            const projectId = createBy.data.projectId || createBy.props.tenantId;
+            if (!projectId) {
+                throw new BadDataException("A project is required to connect a GitHub App installation to a repository.");
+            }
+            await GitHubInstallationBinding.assertInstallationBoundToProject({
+                projectId: projectId,
+                installationId: installationId,
+            });
+        }
+        return { createBy, carryForward: null };
+    }
+    /*
+     * Same rule on the update path. Clearing the installation ID is always
+     * allowed — that is how the `installation.deleted` webhook tears a
+     * disconnected installation out of the database.
+     */
+    async onBeforeUpdate(updateBy) {
+        const installationId = updateBy.data
+            .gitHubAppInstallationId;
+        if (installationId) {
+            /*
+             * updateBy matches by query rather than by id, so check every row the
+             * write would touch: one unbound row is enough to leak a token.
+             */
+            const repositories = await this.findBy({
+                query: updateBy.query,
+                select: {
+                    _id: true,
+                    projectId: true,
+                },
+                limit: LIMIT_MAX,
+                skip: 0,
+                props: {
+                    isRoot: true,
+                },
+            });
+            for (const repository of repositories) {
+                if (!repository.projectId) {
+                    throw new BadDataException("A project is required to connect a GitHub App installation to a repository.");
+                }
+                await GitHubInstallationBinding.assertInstallationBoundToProject({
+                    projectId: repository.projectId,
+                    installationId: installationId,
+                });
+            }
+        }
+        return { updateBy, carryForward: null };
+    }
     /*
      * Imports all repositories accessible to a GitHub App installation into a
      * project. Repositories that already exist for the project (matched on
@@ -138,12 +205,21 @@ export class Service extends DatabaseService {
                 isRoot: true,
             },
         });
-        // Only GitHub-App-connected repos can be cloned/pushed by the agent.
+        /*
+         * Only GitHub-App-connected repos can be cloned/pushed by the agent — and
+         * only ones whose installation this project actually owns. Resolution
+         * probes EVERY candidate's file tree, so an unbound row here would have
+         * the server read another tenant's private repository on its own
+         * initiative (GHSA-xx95-gmcf-7q86).
+         */
+        const boundInstallationId = await GitHubInstallationBinding.getBoundInstallationId(data.projectId);
         const resolvable = repositories
             .filter((repository) => {
             return (repository.repositoryHostedAt === CodeRepositoryType.GitHub &&
                 Boolean(repository.gitHubAppInstallationId) &&
-                Boolean(repository.id));
+                Boolean(repository.id) &&
+                Boolean(boundInstallationId) &&
+                repository.gitHubAppInstallationId === boundInstallationId);
         })
             .map((repository) => {
             return {
@@ -173,6 +249,18 @@ export class Service extends DatabaseService {
         });
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),

package/build/dist/Server/Services/CodeRepositoryService.js.map

@@ -1 +1 @@
-{"version":3,"file":"CodeRepositoryService.js","sourceRoot":"","sources":["../../../../Server/Services/CodeRepositoryService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,4CAA4C,CAAC;AAE/D,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,kBAAkB,MAAM,+CAA+C,CAAC;AAC/E,OAAO,GAAG,MAAM,qBAAqB,CAAC;AACtC,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAGL,gCAAgC,GACjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,UAEN,MAAM,uCAAuC,CAAC;AAO/C,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;OAIG;IAEU,AAAN,KAAK,CAAC,2BAA2B,CAAC,IAGxC;QACC,MAAM,wBAAwB,GAC5B,MAAM,UAAU,CAAC,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAExE,wFAAwF;QACxF,MAAM,oBAAoB,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAC3D,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;gBACV,gBAAgB,EAAE,IAAI;gBACtB,cAAc,EAAE,IAAI;aACrB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,sBAAsB,GAAgB,IAAI,GAAG,CACjD,oBAAoB,CAAC,GAAG,CAAC,CAAC,UAAiB,EAAE,EAAE;;YAC7C,OAAO,GAAG,MAAA,UAAU,CAAC,gBAAgB,0CAAE,WAAW,EAAE,IAAI,MAAA,UAAU,CAAC,cAAc,0CAAE,WAAW,EAAE,EAAE,CAAC;QACrG,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,oBAAoB,GAAgB,IAAI,GAAG,CAC/C,oBAAoB;aACjB,GAAG,CAAC,CAAC,UAAiB,EAAE,EAAE;;YACzB,OAAO,CAAA,MAAA,UAAU,CAAC,IAAI,0CAAE,WAAW,EAAE,KAAI,EAAE,CAAC;QAC9C,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;YACvB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,QAAQ,GAAW,CAAC,CAAC;QACzB,IAAI,OAAO,GAAW,CAAC,CAAC;QAExB,KAAK,MAAM,UAAU,IAAI,wBAAwB,EAAE,CAAC;YAClD,MAAM,aAAa,GAAW,GAAG,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAExG,IAAI,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9C,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YAED;;;;eAIG;YACH,IAAI,WAAW,GAAW,UAAU,CAAC,IAAI,CAAC;YAE1C,IAAI,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACxD,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;YACpC,CAAC;YAED,IAAI,MAAM,GAAW,CAAC,CAAC;YAEvB,OAAO,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC3D,WAAW,GAAG,GAAG,UAAU,CAAC,QAAQ,KAAK,MAAM,GAAG,CAAC;gBACnD,MAAM,EAAE,CAAC;YACX,CAAC;YAED,MAAM,cAAc,GAAU,IAAI,KAAK,EAAE,CAAC;YAC1C,cAAc,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1C,cAAc,CAAC,IAAI,GAAG,WAAW,CAAC;YAClC,cAAc,CAAC,kBAAkB,GAAG,kBAAkB,CAAC,MAAM,CAAC;YAC9D,cAAc,CAAC,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC;YACxD,cAAc,CAAC,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC;YAChD,cAAc,CAAC,cAAc,GAAG,UAAU,CAAC,aAAa,IAAI,MAAM,CAAC;YACnE,cAAc,CAAC,uBAAuB,GAAG,IAAI,CAAC,cAAc,CAAC;YAE7D,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,cAAc,CAAC,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC3B,cAAc,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;YACtD,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC;oBAChB,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC1C,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wDAAwD;gBACxD,MAAM,CAAC,KAAK,CACV,+BAA+B,UAAU,CAAC,QAAQ,iCAAiC,IAAI,CAAC,cAAc,iBAAiB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CACpJ,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IAEU,AAAN,KAAK,CAAC,6BAA6B,CAAC,IAI1C;QACC,MAAM,YAAY,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YACnD,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;gBACV,gBAAgB,EAAE,IAAI;gBACtB,cAAc,EAAE,IAAI;gBACpB,cAAc,EAAE,IAAI;gBACpB,uBAAuB,EAAE,IAAI;gBAC7B,kBAAkB,EAAE,IAAI;aACzB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,qEAAqE;QACrE,MAAM,UAAU,GAAgC,YAAY;aACzD,MAAM,CAAC,CAAC,UAAiB,EAAE,EAAE;YAC5B,OAAO,CACL,UAAU,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,MAAM;gBAC3D,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC;gBAC3C,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC,CACvB,CAAC;QACJ,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,UAAiB,EAAE,EAAE;YACzB,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAG,CAAC,QAAQ,EAAE;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE;gBAC3B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,EAAE;gBACnD,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,EAAE;gBAC/C,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,MAAM;gBACnD,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,IAAI,IAAI;aACpE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,gCAAgC,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,UAAU;YACxB,YAAY,EAAE,CACZ,UAAgC,EACR,EAAE;gBAC1B,OAAO,UAAU,CAAC,sBAAsB,CAAC;oBACvC,cAAc,EAAE,UAAU,CAAC,uBAAwB;oBACnD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;oBAC7C,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,UAAU,EAAE,UAAU,CAAC,cAAc;iBACtC,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAvLc;IADZ,WAAW,EAAE;;;;0DA8Gb;AASY;IADZ,WAAW,EAAE;;;;4DAiEb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}
+{"version":3,"file":"CodeRepositoryService.js","sourceRoot":"","sources":["../../../../Server/Services/CodeRepositoryService.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,4CAA4C,CAAC;AAE/D,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,kBAAkB,MAAM,+CAA+C,CAAC;AAC/E,OAAO,GAAG,MAAM,qBAAqB,CAAC;AACtC,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,EAGL,gCAAgC,GACjC,MAAM,gDAAgD,CAAC;AACxD,OAAO,UAEN,MAAM,uCAAuC,CAAC;AAC/C,OAAO,yBAAyB,MAAM,0DAA0D,CAAC;AACjG,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AAUtE,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;;OAaG;IAEsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,cAAc,GAClB,QAAQ,CAAC,IAAI,CAAC,uBAAuB,CAAC;QAExC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,SAAS,GACb,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YAErD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,IAAI,gBAAgB,CACxB,6EAA6E,CAC9E,CAAC;YACJ,CAAC;YAED,MAAM,yBAAyB,CAAC,gCAAgC,CAAC;gBAC/D,SAAS,EAAE,SAAS;gBACpB,cAAc,EAAE,cAAc;aAC/B,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IAEsB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,cAAc,GAAuB,QAAQ,CAAC,IAAI;aACrD,uBAA6C,CAAC;QAEjD,IAAI,cAAc,EAAE,CAAC;YACnB;;;eAGG;YACH,MAAM,YAAY,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBACnD,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,SAAS,EAAE,IAAI;iBAChB;gBACD,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,KAAK,MAAM,UAAU,IAAI,YAAY,EAAE,CAAC;gBACtC,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;oBAC1B,MAAM,IAAI,gBAAgB,CACxB,6EAA6E,CAC9E,CAAC;gBACJ,CAAC;gBAED,MAAM,yBAAyB,CAAC,gCAAgC,CAAC;oBAC/D,SAAS,EAAE,UAAU,CAAC,SAAS;oBAC/B,cAAc,EAAE,cAAc;iBAC/B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IAEU,AAAN,KAAK,CAAC,2BAA2B,CAAC,IAGxC;QACC,MAAM,wBAAwB,GAC5B,MAAM,UAAU,CAAC,+BAA+B,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAExE,wFAAwF;QACxF,MAAM,oBAAoB,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAC3D,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;gBACV,gBAAgB,EAAE,IAAI;gBACtB,cAAc,EAAE,IAAI;aACrB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,sBAAsB,GAAgB,IAAI,GAAG,CACjD,oBAAoB,CAAC,GAAG,CAAC,CAAC,UAAiB,EAAE,EAAE;;YAC7C,OAAO,GAAG,MAAA,UAAU,CAAC,gBAAgB,0CAAE,WAAW,EAAE,IAAI,MAAA,UAAU,CAAC,cAAc,0CAAE,WAAW,EAAE,EAAE,CAAC;QACrG,CAAC,CAAC,CACH,CAAC;QAEF,MAAM,oBAAoB,GAAgB,IAAI,GAAG,CAC/C,oBAAoB;aACjB,GAAG,CAAC,CAAC,UAAiB,EAAE,EAAE;;YACzB,OAAO,CAAA,MAAA,UAAU,CAAC,IAAI,0CAAE,WAAW,EAAE,KAAI,EAAE,CAAC;QAC9C,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;YACvB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC,CAAC,CACL,CAAC;QAEF,IAAI,QAAQ,GAAW,CAAC,CAAC;QACzB,IAAI,OAAO,GAAW,CAAC,CAAC;QAExB,KAAK,MAAM,UAAU,IAAI,wBAAwB,EAAE,CAAC;YAClD,MAAM,aAAa,GAAW,GAAG,UAAU,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;YAExG,IAAI,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;gBAC9C,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YAED;;;;eAIG;YACH,IAAI,WAAW,GAAW,UAAU,CAAC,IAAI,CAAC;YAE1C,IAAI,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACxD,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC;YACpC,CAAC;YAED,IAAI,MAAM,GAAW,CAAC,CAAC;YAEvB,OAAO,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBAC3D,WAAW,GAAG,GAAG,UAAU,CAAC,QAAQ,KAAK,MAAM,GAAG,CAAC;gBACnD,MAAM,EAAE,CAAC;YACX,CAAC;YAED,MAAM,cAAc,GAAU,IAAI,KAAK,EAAE,CAAC;YAC1C,cAAc,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1C,cAAc,CAAC,IAAI,GAAG,WAAW,CAAC;YAClC,cAAc,CAAC,kBAAkB,GAAG,kBAAkB,CAAC,MAAM,CAAC;YAC9D,cAAc,CAAC,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC;YACxD,cAAc,CAAC,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC;YAChD,cAAc,CAAC,cAAc,GAAG,UAAU,CAAC,aAAa,IAAI,MAAM,CAAC;YACnE,cAAc,CAAC,uBAAuB,GAAG,IAAI,CAAC,cAAc,CAAC;YAE7D,IAAI,UAAU,CAAC,OAAO,EAAE,CAAC;gBACvB,cAAc,CAAC,aAAa,GAAG,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YACpE,CAAC;YAED,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC;gBAC3B,cAAc,CAAC,WAAW,GAAG,UAAU,CAAC,WAAW,CAAC;YACtD,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,MAAM,CAAC;oBAChB,IAAI,EAAE,cAAc;oBACpB,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;gBAEH,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;gBAC1C,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;gBACpD,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,wDAAwD;gBACxD,MAAM,CAAC,KAAK,CACV,+BAA+B,UAAU,CAAC,QAAQ,iCAAiC,IAAI,CAAC,cAAc,iBAAiB,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,CACpJ,CAAC;gBACF,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACpB,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAED;;;;;OAKG;IAEU,AAAN,KAAK,CAAC,6BAA6B,CAAC,IAI1C;QACC,MAAM,YAAY,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YACnD,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,IAAI,EAAE,IAAI;gBACV,gBAAgB,EAAE,IAAI;gBACtB,cAAc,EAAE,IAAI;gBACpB,cAAc,EAAE,IAAI;gBACpB,uBAAuB,EAAE,IAAI;gBAC7B,kBAAkB,EAAE,IAAI;aACzB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH;;;;;;WAMG;QACH,MAAM,mBAAmB,GACvB,MAAM,yBAAyB,CAAC,sBAAsB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAEzE,MAAM,UAAU,GAAgC,YAAY;aACzD,MAAM,CAAC,CAAC,UAAiB,EAAE,EAAE;YAC5B,OAAO,CACL,UAAU,CAAC,kBAAkB,KAAK,kBAAkB,CAAC,MAAM;gBAC3D,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC;gBAC3C,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;gBACtB,OAAO,CAAC,mBAAmB,CAAC;gBAC5B,UAAU,CAAC,uBAAuB,KAAK,mBAAmB,CAC3D,CAAC;QACJ,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,UAAiB,EAAE,EAAE;YACzB,OAAO;gBACL,EAAE,EAAE,UAAU,CAAC,EAAG,CAAC,QAAQ,EAAE;gBAC7B,IAAI,EAAE,UAAU,CAAC,IAAI,IAAI,EAAE;gBAC3B,gBAAgB,EAAE,UAAU,CAAC,gBAAgB,IAAI,EAAE;gBACnD,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,EAAE;gBAC/C,cAAc,EAAE,UAAU,CAAC,cAAc,IAAI,MAAM;gBACnD,uBAAuB,EAAE,UAAU,CAAC,uBAAuB,IAAI,IAAI;aACpE,CAAC;QACJ,CAAC,CAAC,CAAC;QAEL,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,gCAAgC,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,YAAY,EAAE,UAAU;YACxB,YAAY,EAAE,CACZ,UAAgC,EACR,EAAE;gBAC1B,OAAO,UAAU,CAAC,sBAAsB,CAAC;oBACvC,cAAc,EAAE,UAAU,CAAC,uBAAwB;oBACnD,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;oBAC7C,cAAc,EAAE,UAAU,CAAC,cAAc;oBACzC,UAAU,EAAE,UAAU,CAAC,cAAc;iBACtC,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;CACF;AAhR0B;IADxB,WAAW,EAAE;;;;6CAwBb;AAQwB;IADxB,WAAW,EAAE;;;;6CAwCb;AAQY;IADZ,WAAW,EAAE;;;;0DA8Gb;AASY;IADZ,WAAW,EAAE;;;;4DA4Eb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/DatabaseService.js

@@ -24,6 +24,7 @@ import ClusterKeyAuthorization from "../Middleware/ClusterKeyAuthorization";
 import ModelPermission from "../Types/Database/Permissions/Index";
 import QueryHelper from "../Types/Database/QueryHelper";
 import Encryption from "../Utils/Encryption";
+import PasswordHash from "../Utils/PasswordHash";
 import PostgresErrorTranslator from "../Utils/Database/PostgresErrorTranslator";
 import logger from "../Utils/Logger";
 import BaseService from "./BaseService";
@@ -222,16 +223,135 @@ class DatabaseService extends BaseService {
         }
         return data;
     }
+    /*
+     * Hash one HashedString column in place.
+     *
+     * Declaring `hashSaltColumn` on a column is what marks it a CREDENTIAL —
+     * a low-entropy, human-chosen secret. Those go through scrypt (see
+     * PasswordHash): deliberately slow and memory-hard, with a fresh per-record
+     * salt minted into the sibling column named by the metadata.
+     *
+     * Columns without a salt column are high-entropy values the server itself
+     * generated — session refresh tokens and the like. They keep the fast
+     * SHA-256 hash, which is the right tool for them: there is nothing to guess,
+     * and they have to stay searchable by hash because that is how they are
+     * looked up.
+     *
+     * The salt is written onto the SAME payload as the hash, so the pair can
+     * never be persisted out of step with each other.
+     *
+     * The salt column grants nobody create or update rights, so it has to get
+     * past the column-permission check some other way on each path. On update
+     * it does so by timing — sanitizeCreateOrUpdate runs after the check. On
+     * create the check runs after `hash()`, so the salt column relies on being
+     * declared `computed: true`, which checkDataColumnPermissions skips on
+     * create. A salt column that forgets that flag breaks every non-root
+     * create of a row carrying a password.
+     */
+    async hashColumnValue(data) {
+        var _a;
+        const saltColumnName = (_a = this.model.getTableColumnMetadata(data.columnName)) === null || _a === void 0 ? void 0 : _a.hashSaltColumn;
+        if (!saltColumnName) {
+            await data.columnValue.hashValue(EncryptionSecret);
+            return;
+        }
+        const salt = PasswordHash.generateSalt();
+        data.payload[saltColumnName] = salt;
+        data.columnValue.setHashedValue(await PasswordHash.hash({
+            plainValue: data.columnValue.toString(),
+            salt: salt,
+        }));
+    }
     async hash(data) {
         const columns = data.getHashedColumns();
         for (const key of columns.columns) {
             if (data.hasValue(key) &&
                 !data.getValue(key).isValueHashed()) {
-                await data[key].hashValue(EncryptionSecret);
+                await this.hashColumnValue({
+                    payload: data,
+                    columnName: key,
+                    columnValue: data[key],
+                });
             }
         }
         return data;
     }
+    /*
+     * Check a plaintext secret (a password) against a hashed column on a row
+     * that has already been read out of the database, and re-hash the stored
+     * value in place when it was not written by today's scheme.
+     *
+     * The row must have been selected with BOTH the hashed column and its salt
+     * column. Without the salt a scrypt hash cannot be checked at all, and an
+     * older SHA-256 one would be checked against the wrong scheme — either way
+     * a perfectly good password gets rejected. PasswordHash.verify throws
+     * rather than silently returning false for the scrypt case, because a
+     * missing SELECT is a bug and must not look like a bad password.
+     *
+     * Why the caller cannot just query by the hash any more: with a per-user
+     * salt the hash is not computable until the row's own salt is known, so
+     * `WHERE password = <hash>` has nothing to bind. Read the row by its
+     * identity (email, id) and verify here.
+     *
+     * THE UPGRADE. Anything that is not exactly what PasswordHash writes today
+     * is re-hashed once the password is known to be correct: the two SHA-256
+     * schemes that preceded scrypt, and any scrypt hash whose cost parameters
+     * have since been raised. That is what makes raising the cost a one-line
+     * change — users migrate as they log in, with no reset and no migration.
+     *
+     * The write is deliberately hook-free and leaves updatedAt alone: the user
+     * did not change their password, the server changed how it stores it.
+     * Firing the password-change hooks would revoke every session and mail the
+     * user about a change they did not make. A failed upgrade is logged and
+     * swallowed — a correct password must not be rejected because a
+     * bookkeeping write lost a race.
+     */
+    async verifyHashedColumnValue(data) {
+        var _a, _b;
+        const storedHash = (_a = data.item[data.columnName]) === null || _a === void 0 ? void 0 : _a.toString();
+        if (!storedHash || !data.plainValue) {
+            return false;
+        }
+        const saltColumnName = (_b = this.model.getTableColumnMetadata(data.columnName)) === null || _b === void 0 ? void 0 : _b.hashSaltColumn;
+        const salt = saltColumnName
+            ? data.item[saltColumnName] || null
+            : null;
+        const isValid = await PasswordHash.verify({
+            plainValue: data.plainValue,
+            storedValue: storedHash,
+            salt: salt,
+        });
+        if (!isValid) {
+            return false;
+        }
+        if (saltColumnName &&
+            data.item.id &&
+            PasswordHash.needsUpgrade(storedHash)) {
+            try {
+                const newSalt = PasswordHash.generateSalt();
+                await this.updateColumnsByIdWithoutHooks({
+                    id: data.item.id,
+                    data: {
+                        [data.columnName]: await PasswordHash.hash({
+                            plainValue: data.plainValue,
+                            salt: newSalt,
+                        }),
+                        [saltColumnName]: newSalt,
+                    },
+                    skipUpdateDateColumn: true,
+                });
+            }
+            catch (err) {
+                /*
+                 * `data.item` is deliberately left holding the old hash and old salt,
+                 * so it stays an internally consistent pair whether or not the write
+                 * above landed.
+                 */
+                logger.error(err);
+            }
+        }
+        return true;
+    }
     async decrypt(data) {
         for (const key of data.getEncryptedColumns().columns) {
             if (!data.hasValue(key)) {
@@ -326,6 +446,7 @@ class DatabaseService extends BaseService {
         return createBy;
     }
     async sanitizeCreateOrUpdate(data, props, isUpdate = false) {
+        var _a;
         data = this.checkMaxLengthOfFields(data);
         const columns = this.model.getTableColumns();
         for (const columnName of columns.columns) {
@@ -380,12 +501,43 @@ class DatabaseService extends BaseService {
             }
             if (this.model.isHashedStringColumn(columnName)) {
                 const columnValue = data[columnName];
+                /*
+                 * A salted column's hash and its salt are only ever correct as a
+                 * pair. A write that supplies the column as a bare string skips the
+                 * hashing branch below, leaving the row's existing salt attached to
+                 * a value it was not computed from — which locks the account out
+                 * silently, at the next login, far from whatever wrote it. Refuse
+                 * instead. Callers pass a HashedString; the write path hashes it.
+                 */
+                if (data &&
+                    columnName &&
+                    columnValue &&
+                    !(columnValue instanceof HashedString) &&
+                    ((_a = this.model.getTableColumnMetadata(columnName)) === null || _a === void 0 ? void 0 : _a.hashSaltColumn)) {
+                    throw new BadDataException(`${columnName} is a salted column and must be supplied as a HashedString, not a pre-hashed value.`);
+                }
                 if (data &&
                     columnName &&
                     columnValue &&
                     columnValue instanceof HashedString) {
                     if (!columnValue.isValueHashed()) {
-                        await columnValue.hashValue(EncryptionSecret);
+                        /*
+                         * The update path never runs `hash()`, so this is where an
+                         * updated password gets both hashed and salted. The salt lands
+                         * on `data`, which the caller turns into the SET list, so the
+                         * new hash and the salt it was computed with are written by the
+                         * same statement.
+                         *
+                         * An update matching several rows writes the same salt to all of
+                         * them, which is correct: they are all being set to the same
+                         * value by one statement. Per-row salts come from per-row
+                         * writes.
+                         */
+                        await this.hashColumnValue({
+                            payload: data,
+                            columnName: columnName,
+                            columnValue: columnValue,
+                        });
                     }
                     data[columnName] = columnValue.toString();
                 }
@@ -1698,6 +1850,86 @@ class DatabaseService extends BaseService {
         const sql = `UPDATE "${metadata.tableName}" SET ${setClauses.join(", ")} WHERE "${primaryColumnName}" = $${params.length}`;
         await repository.manager.query(sql, params);
     }
+    /*
+     * Same single-statement, hook-free, no-version-bump write as
+     * `updateColumnsByIdWithoutHooks`, except it YIELDS instead of queueing:
+     * if another transaction already holds the row's lock, this write is
+     * abandoned and the method returns false. It never waits.
+     *
+     * Why this exists. A single-statement UPDATE holds its row lock for a very
+     * short time, but "short" does not mean "safe" once the arrival rate on ONE
+     * row exceeds the service rate. Postgres queues lock waiters strictly, so
+     * every waiter pins a backend for the sum of everyone ahead of it — the
+     * classic convoy. In the outage this was written for, ~25K concurrent
+     * ingest jobs across 100 worker pods funnelled onto ~2,300 Service rows and
+     * produced 1,017 active connections with 892 of them parked on row locks;
+     * the tail had been waiting 3.7 hours. Nothing about that is fixable by
+     * making the statement faster, and no Postgres tier changes it: the queue
+     * is the bug.
+     *
+     * `FOR UPDATE SKIP LOCKED` inverts it. A contended writer does zero work
+     * and returns immediately, so the number of backends blocked on any single
+     * row is capped at ONE no matter how many workers arrive together. The
+     * convoy cannot form — and cannot form even if every upstream throttle
+     * fails open at once (Redis down, fence bug, cache flush). That is the
+     * point: this is the structural backstop underneath the throttles, not a
+     * second copy of them.
+     *
+     * Use ONLY where losing the write is harmless because a concurrent writer
+     * is writing the same thing — liveness timestamps and other idempotent
+     * bookkeeping, whose contended value is by construction the value the
+     * winner is already storing. It is the WRONG primitive for a write carrying
+     * information the winner does not have (a changed attribute); for those the
+     * caller must re-attempt, and `false` is the signal to do it. Returning a
+     * boolean rather than swallowing the skip is deliberate: a silent drop here
+     * would be indistinguishable from a successful write at the call site,
+     * which is exactly how a "reliable" heartbeat quietly stops beating.
+     *
+     * Returns true when the row was updated, false when it was locked (or no
+     * longer exists).
+     */
+    async updateColumnsByIdIfUnlockedWithoutHooks(input) {
+        var _a;
+        if (!input.id) {
+            throw new BadDataException("id is required");
+        }
+        const repository = this.getRepository();
+        const metadata = repository.metadata;
+        const driver = repository.manager.connection.driver;
+        const setClauses = [];
+        const params = [];
+        // Clamp on a shallow COPY — see updateColumnsByIdWithoutHooks.
+        const data = this.truncateStringColumnsToMaxLength(Object.assign({}, input.data));
+        for (const [propertyName, value] of Object.entries(data)) {
+            const column = metadata.findColumnWithPropertyName(propertyName);
+            if (!column) {
+                throw new BadDataException(`updateColumnsByIdIfUnlockedWithoutHooks: unknown column "${propertyName}" on "${metadata.tableName}"`);
+            }
+            if (typeof value === "function") {
+                throw new BadDataException(`updateColumnsByIdIfUnlockedWithoutHooks: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`);
+            }
+            params.push(driver.preparePersistentValue(value, column));
+            setClauses.push(`"${column.databaseName}" = $${params.length}`);
+        }
+        if (setClauses.length === 0) {
+            return false;
+        }
+        if (metadata.updateDateColumn && !input.skipUpdateDateColumn) {
+            setClauses.push(`"${metadata.updateDateColumn.databaseName}" = CURRENT_TIMESTAMP`);
+        }
+        const primaryColumnName = ((_a = metadata.primaryColumns[0]) === null || _a === void 0 ? void 0 : _a.databaseName) || "_id";
+        params.push(input.id.toString());
+        /*
+         * The lock is taken by the sub-SELECT and inherited by the UPDATE within
+         * the same implicit transaction, so the outer write never blocks either.
+         * RETURNING is how the affected-row count comes back: TypeORM's `query()`
+         * surfaces the driver's rows and a bare UPDATE returns none, so without it
+         * a skipped write is indistinguishable from an applied one.
+         */
+        const sql = `UPDATE "${metadata.tableName}" SET ${setClauses.join(", ")} WHERE "${primaryColumnName}" IN (SELECT "${primaryColumnName}" FROM "${metadata.tableName}" WHERE "${primaryColumnName}" = $${params.length} FOR UPDATE SKIP LOCKED) RETURNING "${primaryColumnName}"`;
+        const result = await repository.manager.query(sql, params);
+        return Array.isArray(result) && result.length > 0;
+    }
     /*
      * Atomically add to numeric columns and set literal columns for one row,
      * in a SINGLE auto-committed UPDATE, with no hooks and no `version` bump.
@@ -1805,6 +2037,12 @@ class DatabaseService extends BaseService {
         return { items, count };
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DatabaseService.prototype, "verifyHashedColumnValue", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
@@ -1909,6 +2147,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DatabaseService.prototype, "updateColumnsByIdWithoutHooks", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DatabaseService.prototype, "updateColumnsByIdIfUnlockedWithoutHooks", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),