@oneuptime/common 12.0.25 → 12.0.26

package/Server/Types/Database/QueryHelper.ts

@@ -6,6 +6,7 @@ import Text from "../../../Types/Text";
 import Typeof from "../../../Types/Typeof";
 import { FindOperator, Raw } from "typeorm";
 import { FindWhereProperty } from "../../../Types/BaseDatabase/Query";
+import { toLikePattern } from "../../../Types/BaseDatabase/WildcardPattern";
 import CaptureSpan from "../../Utils/Telemetry/CaptureSpan";
 import buildJSONColumnQuery, { JSONColumnQuery } from "./JSONColumnQuery";
 
@@ -249,6 +250,45 @@ export default class QueryHelper {
     );
   }
 
+  /*
+   * Glob matching (`api-*`, `*.internal`). The pattern comes from
+   * `toLikePattern`, which is also what the ClickHouse side uses, so a
+   * wildcard filter means the same thing on a Postgres model and on a
+   * telemetry model. Unlike the helpers above, the value is NOT lowercased
+   * first: `ILIKE` is already case-insensitive, and lowercasing would corrupt
+   * a `\A` escape into `\a`.
+   */
+  @CaptureSpan()
+  public static wildcard(glob: string): FindWhereProperty<any> {
+    const rid: string = Text.generateRandomText(10);
+    return Raw(
+      (alias: string) => {
+        return `(CAST(${alias} AS TEXT) ILIKE :${rid})`;
+      },
+      {
+        [rid]: toLikePattern(glob.trim()),
+      },
+    );
+  }
+
+  /*
+   * The negation lets NULL through explicitly: a row with no value at all
+   * trivially does not match a glob, but `NULL ILIKE ...` is NULL, which
+   * would filter it out. Mirrors `notContains` above.
+   */
+  @CaptureSpan()
+  public static notWildcard(glob: string): FindWhereProperty<any> {
+    const rid: string = Text.generateRandomText(10);
+    return Raw(
+      (alias: string) => {
+        return `(CAST(${alias} AS TEXT) NOT ILIKE :${rid} OR ${alias} IS NULL)`;
+      },
+      {
+        [rid]: toLikePattern(glob.trim()),
+      },
+    );
+  }
+
   @CaptureSpan()
   public static all(values: Array<string | ObjectID>): FindWhereProperty<any> {
     values = values.map((value: string | ObjectID) => {

package/Server/Types/Database/QueryUtil.ts

@@ -11,6 +11,8 @@ import IncludesNone from "../../../Types/BaseDatabase/IncludesNone";
 import StartsWith from "../../../Types/BaseDatabase/StartsWith";
 import EndsWith from "../../../Types/BaseDatabase/EndsWith";
 import NotContains from "../../../Types/BaseDatabase/NotContains";
+import Wildcard from "../../../Types/BaseDatabase/Wildcard";
+import NotWildcard from "../../../Types/BaseDatabase/NotWildcard";
 import IsNull from "../../../Types/BaseDatabase/IsNull";
 import LessThan from "../../../Types/BaseDatabase/LessThan";
 import LessThanOrEqual from "../../../Types/BaseDatabase/LessThanOrEqual";
@@ -259,6 +261,22 @@ export default class QueryUtil {
         query[key] = QueryHelper.endsWith(
           (query[key] as EndsWith<string>).toString() as any,
         ) as any;
+      } else if (
+        query[key] &&
+        query[key] instanceof Wildcard &&
+        tableColumnMetadata
+      ) {
+        query[key] = QueryHelper.wildcard(
+          (query[key] as Wildcard<string>).toString() as any,
+        ) as any;
+      } else if (
+        query[key] &&
+        query[key] instanceof NotWildcard &&
+        tableColumnMetadata
+      ) {
+        query[key] = QueryHelper.notWildcard(
+          (query[key] as NotWildcard<string>).toString() as any,
+        ) as any;
       } else if (
         query[key] &&
         query[key] instanceof LessThan &&
@@ -603,6 +621,14 @@ export default class QueryUtil {
             relationQuery[relationKey] = QueryHelper.notContains(
               (nestedValue as NotContains<string>).toString(),
             ) as any;
+          } else if (nestedValue instanceof Wildcard) {
+            relationQuery[relationKey] = QueryHelper.wildcard(
+              (nestedValue as Wildcard<string>).toString(),
+            ) as any;
+          } else if (nestedValue instanceof NotWildcard) {
+            relationQuery[relationKey] = QueryHelper.notWildcard(
+              (nestedValue as NotWildcard<string>).toString(),
+            ) as any;
           }
         }
       }

package/Server/Types/Workflow/Components/API/Utils.ts

@@ -146,9 +146,18 @@ export class ApiComponentUtils {
      * Validate the RAW string, before URL.fromString - that parser defaults an
      * unrecognized scheme to https, so "file:///etc/passwd" would reach the
      * check already rewritten as host "file".
+     *
+     * A self-hosted install may legitimately point a workflow at an internal
+     * service (issue #3424), so this URL is eligible for the instance's
+     * private-network exception: a workflow is authored by a member of the
+     * project it runs in, not by a passing visitor. Whether that eligibility
+     * grants anything is decided by the instance configuration, which is off
+     * on every SaaS deployment and off by default everywhere else.
      */
     try {
-      await SSRFProtection.validateWebhookTargetIsSafe(args["url"] as string);
+      await SSRFProtection.validateWebhookTargetIsSafe(args["url"] as string, {
+        allowPrivateNetworkTargets: true,
+      });
     } catch (err) {
       throw options.onError(
         new BadDataException(

package/Server/Types/Workflow/Components/JavaScript.ts

@@ -71,6 +71,14 @@ export default class JavaScriptCode extends ComponentCode {
         options: {
           args: scriptArgs as JSONObject,
           timeout: WorkflowScriptTimeoutInMS,
+          /*
+           * The sandbox's axios bridge is guarded by the same SSRF blocklist
+           * as the API components, and is eligible for the same exception for
+           * the same reason: this script was authored by a member of the
+           * project the workflow runs in (issue #3424). The instance
+           * configuration decides whether that unlocks anything.
+           */
+          allowPrivateNetworkRequests: true,
         },
       });
 

package/Server/Utils/AI/CodeFix/CodeFixAgentCompletion.ts

@@ -176,6 +176,15 @@ export default class CodeFixAgentCompletion {
       throw new BadDataException(budgetDecision.reason as string);
     }
 
+    /*
+     * The project's AI kill switch, before the provider is resolved. This
+     * route is reached by an authenticated agent worker rather than a
+     * browser, so a throw is the correct delivery: /ai-agent-data/
+     * llm-completion turns it into an error response the worker reads and
+     * stops its loop on.
+     */
+    await AIService.assertProjectAIEnabled(run.projectId);
+
     /*
      * Metered-path provider resolution: project-owned first, else the global
      * provider — on cloud too, because this call is executed through

package/Server/Utils/AI/SRE/InvestigationGrader.ts

@@ -136,6 +136,24 @@ export default class InvestigationGrader {
     const { incidentId, projectId } = data;
 
     try {
+      /*
+       * The project's AI kill switch, checked the non-throwing way.
+       *
+       * This runs fire-and-forget off an incident resolve, inside a catch
+       * that logs at error level. "This project switched AI off" is a
+       * setting, not a failure, so letting the backstop in
+       * executeWithLogging throw would file a permanent error for every
+       * incident such a project ever resolves. It is a silent skip instead —
+       * the same posture the sibling on-resolve job takes via
+       * AIInvestigationEngine.isEnabledForProject.
+       */
+      if (!(await AIService.isProjectAIEnabled(projectId))) {
+        logger.debug(
+          `AI grading: AI is disabled for project ${projectId.toString()} — skipping.`,
+        );
+        return;
+      }
+
       // The latest completed investigation for this incident (if any).
       const run: AIRun | null = await AIRunService.findOneBy({
         query: {

package/Server/Utils/AnalyticsDatabase/AttributeFilterStatement.ts

@@ -0,0 +1,422 @@
+import BadDataException from "../../../Types/Exception/BadDataException";
+import Includes from "../../../Types/BaseDatabase/Includes";
+import TableColumnType from "../../../Types/AnalyticsDatabase/TableColumnType";
+import { ObjectType } from "../../../Types/JSON";
+import {
+  MAX_WILDCARD_PATTERNS,
+  toLikePattern,
+} from "../../../Types/BaseDatabase/WildcardPattern";
+import { SQL, Statement, escapeIlikePattern } from "./Statement";
+
+/*
+ * Attribute predicates for the hand-written aggregation builders (log /
+ * trace / metric / exception histograms, facets, analytics and exports).
+ *
+ * The *list* query for every signal is compiled by StatementGenerator from a
+ * `Query<Model>`; these endpoints receive the same filters as JSON instead,
+ * so an operator arrives as the serialized `{_type, value}` shape that every
+ * QueryOperator's `toJSON()` emits. This module is the single place that
+ * turns one of those back into SQL, so a filter cannot mean one thing in the
+ * list and another in the chart beside it — which is exactly what happened
+ * while each aggregation service carried its own partial copy.
+ *
+ * Predicates use the case-insensitive `arrayExists((k, v) -> lowerUTF8(k) =
+ * lowerUTF8(?) ...)` form over `mapKeys`/`mapValues` rather than a direct
+ * `attributes['k']` subscript: these keys are typed by a person, so
+ * `requestId` and `requestid` have to be the same filter. StatementGenerator
+ * makes the same choice for its user-typed operators (see the comment above
+ * its map branch).
+ *
+ * The map column is `attributes` on every model routed through here.
+ */
+
+/** A serialized QueryOperator off the wire: `{_type: "Search", value: "web"}`. */
+export interface SerializedAttributeOperator {
+  _type: string;
+  value?: unknown;
+}
+
+export interface AppendAttributeOperatorFilterOptions {
+  /** The statement being built. The predicate is appended, prefixed with `AND`. */
+  statement: Statement;
+  /** Attribute key as typed by the user. Callers MUST validate it first. */
+  attributeKey: string;
+  /** The serialized operator. */
+  operator: Record<string, unknown>;
+}
+
+type MatchesFunction = (predicate: Statement) => Statement;
+type RequirePrimitiveFunction = (
+  value: unknown,
+) => string | number | boolean | null;
+type TextValueFunction = () => string;
+type LikeFunction = (pattern: string) => Statement;
+type NumericFunction = (comparison: string) => Statement;
+type MembershipValuesFunction = () => Array<string>;
+type HasNonEmptyValueFunction = () => Statement;
+
+export type AppendAttributeOperatorFilterFunction = (
+  options: AppendAttributeOperatorFilterOptions,
+) => void;
+
+/**
+ * Compile one serialized attribute operator into a predicate and append it.
+ *
+ * Throws BadDataException (a 400, not a 500) for an operator this builder
+ * cannot honour or a value it cannot bind — refusing is the only answer that
+ * keeps the chart and the list agreeing.
+ */
+export const appendAttributeOperatorFilter: AppendAttributeOperatorFilterFunction =
+  (options: AppendAttributeOperatorFilterOptions): void => {
+    const { statement, attributeKey, operator } = options;
+
+    const operatorType: unknown = operator["_type"];
+    const rawValue: unknown = operator["value"];
+
+    // `<key> matches case-insensitively AND <predicate>` over the map pairs.
+    const matches: MatchesFunction = (predicate: Statement): Statement => {
+      return SQL`arrayExists((k, v) -> lowerUTF8(k) = lowerUTF8(${{
+        type: TableColumnType.Text,
+        value: attributeKey,
+      }}) AND `
+        .append(predicate)
+        .append(SQL`, mapKeys(attributes), mapValues(attributes))`);
+    };
+
+    /*
+     * `value` is unvalidated JSON off the wire. `String()` and `Number()` do
+     * not merely produce a bad result on an object — ToPrimitive THROWS a
+     * TypeError when the object shadows toString/valueOf with non-callables
+     * (`{"toString": 1}`), and that escapes the BadDataException the default
+     * branch raises, answering with a 500 instead of a 400. Narrow to
+     * primitives first so every rejection goes out the same door.
+     */
+    const requirePrimitive: RequirePrimitiveFunction = (
+      value: unknown,
+    ): string | number | boolean | null => {
+      if (value === undefined || value === null) {
+        return null;
+      }
+
+      if (
+        typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean"
+      ) {
+        return value;
+      }
+
+      throw new BadDataException(
+        `Invalid value in the attribute filter for "${attributeKey}"`,
+      );
+    };
+
+    const textValue: TextValueFunction = (): string => {
+      const primitive: string | number | boolean | null =
+        requirePrimitive(rawValue);
+
+      return primitive === null ? "" : String(primitive);
+    };
+
+    const like: LikeFunction = (pattern: string): Statement => {
+      return SQL`v ILIKE ${{
+        type: TableColumnType.Text,
+        value: pattern,
+      }}`;
+    };
+
+    /*
+     * Map values are stored as text; toFloat64OrNull yields NULL for
+     * non-numeric values (including the empty default for a missing key),
+     * which compares false against any threshold and drops those rows.
+     */
+    const numeric: NumericFunction = (comparison: string): Statement => {
+      const primitive: string | number | boolean | null =
+        requirePrimitive(rawValue);
+      const threshold: number = Number(primitive);
+
+      /*
+       * Reject rather than bind. `Number(null)` is 0, so a filter with no
+       * value would silently become "> 0", and a non-numeric one binds as the
+       * literal `nan`, which ClickHouse cannot parse — a 500 where the user
+       * should get a 400 naming the filter.
+       */
+      if (
+        primitive === null ||
+        primitive === "" ||
+        !Number.isFinite(threshold)
+      ) {
+        throw new BadDataException(
+          `The attribute filter for "${attributeKey}" needs a numeric value`,
+        );
+      }
+
+      /*
+       * Decimal (ClickHouse Double), not Number (Int32): the left-hand side is
+       * a Float64 and thresholds are free text, so `> 1.5` bound as Int32 is a
+       * parse error at the database rather than a comparison.
+       *
+       * The comparison itself is appended as raw SQL — an interpolation in the
+       * SQL tag becomes a bound Identifier, which is not what `>` is. Every
+       * caller passes a literal from the switch below, never user input.
+       */
+      return SQL`toFloat64OrNull(v) `.append(comparison).append(
+        SQL` ${{
+          type: TableColumnType.Decimal,
+          value: threshold,
+        }}`,
+      );
+    };
+
+    /*
+     * A Wildcard payload is an array of globs (a single glob is an array of
+     * one), and the wire shape is whatever JSON arrived — accept both so a
+     * client that sends the scalar form still works.
+     */
+    const globPatterns: MembershipValuesFunction = (): Array<string> => {
+      const globs: Array<unknown> = Array.isArray(rawValue)
+        ? rawValue
+        : [rawValue];
+
+      return globs
+        .map((entry: unknown) => {
+          const primitive: string | number | boolean | null =
+            requirePrimitive(entry);
+
+          return primitive === null ? "" : String(primitive);
+        })
+        .filter((glob: string) => {
+          return glob.length > 0;
+        })
+        .map((glob: string) => {
+          return toLikePattern(glob);
+        });
+    };
+
+    const membershipValues: MembershipValuesFunction = (): Array<string> => {
+      return Array.isArray(rawValue)
+        ? rawValue.map((entry: unknown) => {
+            const primitive: string | number | boolean | null =
+              requirePrimitive(entry);
+
+            return primitive === null ? "" : String(primitive);
+          })
+        : [];
+    };
+
+    /*
+     * "the key is present with a non-empty value".
+     *
+     * A ClickHouse Map subscript returns the value type's default for a
+     * missing key, so the list query's `attributes['k']` reads as '' for a row
+     * that has no such attribute at all. That makes an EMPTY comparison value
+     * mean something different from every other value, in both directions:
+     * `attributes['k'] = ''` matches rows that lack the key, and
+     * `attributes['k'] != ''` drops them. Naively negating the existence test
+     * gets both backwards — an "is not equal to <blank>" filter counted every
+     * row in the project while the list beside it counted only the handful
+     * that carried the attribute.
+     */
+    const hasNonEmptyValue: HasNonEmptyValueFunction = (): Statement => {
+      return matches(SQL`v != ''`);
+    };
+
+    switch (operatorType) {
+      case ObjectType.EqualTo:
+        if (textValue() === "") {
+          // `attributes['k'] = ''` — missing or empty. Same set as "is empty".
+          statement.append(SQL` AND NOT `.append(hasNonEmptyValue()));
+          return;
+        }
+
+        statement.append(
+          SQL` AND `.append(
+            matches(
+              SQL`v = ${{
+                type: TableColumnType.Text,
+                value: textValue(),
+              }}`,
+            ),
+          ),
+        );
+        return;
+
+      case ObjectType.NotEqual:
+        if (textValue() === "") {
+          /*
+           * `attributes['k'] != ''` — present AND non-empty. Same set as
+           * "is not empty"; see hasNonEmptyValue above for why blank is
+           * special.
+           */
+          statement.append(SQL` AND `.append(hasNonEmptyValue()));
+          return;
+        }
+
+        /*
+         * Negating the whole existence test is what makes rows that lack the
+         * attribute pass, matching the map-subscript form's semantics (a
+         * missing key reads as '' and so is != a non-empty value).
+         */
+        statement.append(
+          SQL` AND NOT `.append(
+            matches(
+              SQL`v = ${{
+                type: TableColumnType.Text,
+                value: textValue(),
+              }}`,
+            ),
+          ),
+        );
+        return;
+
+      /*
+       * Every ILIKE pattern below escapes the user's `%` and `_` so they match
+       * literally. Without it a value like `100%` or `req_id` silently widens
+       * the match here while the list query (which escapes centrally, in
+       * Statement.serializseValue) matches it literally — the chart and the
+       * table disagreeing on the same filter.
+       */
+      case ObjectType.Search:
+        statement.append(
+          SQL` AND `.append(
+            matches(like(`%${escapeIlikePattern(textValue())}%`)),
+          ),
+        );
+        return;
+
+      case ObjectType.NotContains:
+        statement.append(
+          SQL` AND NOT `.append(
+            matches(like(`%${escapeIlikePattern(textValue())}%`)),
+          ),
+        );
+        return;
+
+      case ObjectType.StartsWith:
+        statement.append(
+          SQL` AND `.append(
+            matches(like(`${escapeIlikePattern(textValue())}%`)),
+          ),
+        );
+        return;
+
+      case ObjectType.EndsWith:
+        statement.append(
+          SQL` AND `.append(
+            matches(like(`%${escapeIlikePattern(textValue())}`)),
+          ),
+        );
+        return;
+
+      /*
+       * Globs, one ILIKE per glob OR-ed together so an any-of list can mix
+       * patterns with literals. `toLikePattern` decides which `%`/`_` are
+       * wildcards and which are literal characters the user typed, so
+       * escaping on top of it would escape the wildcards it just produced.
+       *
+       * The negated form is NOT arrayExists, so a row that does not carry the
+       * attribute passes — it trivially fails to match the glob.
+       */
+      case ObjectType.Wildcard:
+      case ObjectType.NotWildcard: {
+        const patterns: Array<string> = globPatterns();
+
+        // An empty pattern list constrains nothing — the "All" reading.
+        if (patterns.length === 0) {
+          return;
+        }
+
+        if (patterns.length > MAX_WILDCARD_PATTERNS) {
+          throw new BadDataException(
+            `The attribute filter for "${attributeKey}" has more than ${MAX_WILDCARD_PATTERNS} patterns`,
+          );
+        }
+
+        const disjunction: Statement = SQL`(`;
+
+        patterns.forEach((pattern: string, index: number) => {
+          if (index > 0) {
+            disjunction.append(SQL` OR `);
+          }
+
+          disjunction.append(like(pattern));
+        });
+
+        disjunction.append(SQL`)`);
+
+        statement.append(
+          (operatorType === ObjectType.Wildcard
+            ? SQL` AND `
+            : SQL` AND NOT `
+          ).append(matches(disjunction)),
+        );
+        return;
+      }
+
+      case ObjectType.GreaterThan:
+        statement.append(SQL` AND `.append(matches(numeric(">"))));
+        return;
+
+      case ObjectType.GreaterThanOrEqual:
+        statement.append(SQL` AND `.append(matches(numeric(">="))));
+        return;
+
+      case ObjectType.LessThan:
+        statement.append(SQL` AND `.append(matches(numeric("<"))));
+        return;
+
+      case ObjectType.LessThanOrEqual:
+        statement.append(SQL` AND `.append(matches(numeric("<="))));
+        return;
+
+      case ObjectType.IsNull:
+        // "is empty" — no non-empty value stored under that key.
+        statement.append(SQL` AND NOT `.append(hasNonEmptyValue()));
+        return;
+
+      case ObjectType.NotNull:
+        statement.append(SQL` AND `.append(hasNonEmptyValue()));
+        return;
+
+      case ObjectType.Includes:
+      case ObjectType.IncludesNone: {
+        const values: Array<string> = membershipValues();
+
+        /*
+         * An empty membership list means "All", not "nothing" — skipping the
+         * predicate matches how StatementGenerator and the form treat it, and
+         * avoids emitting `IN ()`.
+         */
+        if (values.length === 0) {
+          return;
+        }
+
+        const membership: Statement = matches(
+          SQL`v IN (${{
+            type: TableColumnType.Text,
+            value: new Includes(values),
+          }})`,
+        );
+
+        statement.append(
+          (operatorType === ObjectType.Includes
+            ? SQL` AND `
+            : SQL` AND NOT `
+          ).append(membership),
+        );
+        return;
+      }
+
+      default:
+        /*
+         * An unrecognized shape is a filter this builder cannot honour.
+         * Refuse it rather than binding an object as text and quietly
+         * returning counts that disagree with the list.
+         */
+        throw new BadDataException(
+          `Unsupported attribute filter for "${attributeKey}"`,
+        );
+    }
+  };
+
+export default appendAttributeOperatorFilter;