@oneuptime/common 12.0.25 → 12.0.27

package/build/dist/Server/Services/TelemetrySourceMapService.js

@@ -0,0 +1,265 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/TelemetrySourceMap";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import QueryHelper from "../Types/Database/QueryHelper";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import SourceMapResolver, { MAX_SOURCE_MAP_SIZE_IN_BYTES, } from "../Utils/Telemetry/SourceMapResolver";
+export { MAX_SOURCE_MAP_SIZE_IN_BYTES };
+/*
+ * How long uploaded maps are kept. Old releases age out automatically —
+ * a map is only useful while exceptions from its release are still within
+ * telemetry retention, and 90 days comfortably exceeds the default.
+ */
+export const SOURCE_MAP_RETENTION_DAYS = 90;
+/*
+ * How many maps one (service, release) pair may hold. Enforced by the
+ * upload endpoint (existing bundles + new bundles must fit) and used as
+ * the resolver's read limit, so nothing stored is ever silently ignored.
+ * A build rarely emits more than a few dozen chunks with maps.
+ */
+export const MAX_SOURCE_MAPS_PER_RELEASE = 100;
+export class Service extends DatabaseService {
+    constructor() {
+        super(Model);
+        /*
+         * Age-based retention: the HardDelete:HardDeleteOlderItemsInDatabase
+         * worker sweeps this daily (not gated on billing, so self-hosted
+         * deployments get cleanup too).
+         */
+        this.hardDeleteItemsOlderThanInDays("createdAt", SOURCE_MAP_RETENTION_DAYS);
+    }
+    async onBeforeCreate(createBy) {
+        const content = createBy.data.content;
+        if (!content) {
+            throw new BadDataException("Source map content is required.");
+        }
+        if (Buffer.byteLength(content, "utf8") > MAX_SOURCE_MAP_SIZE_IN_BYTES) {
+            throw new BadDataException(`Source map is too large. The maximum size is ${MAX_SOURCE_MAP_SIZE_IN_BYTES / (1024 * 1024)} MB.`);
+        }
+        SourceMapResolver.validateSourceMapContent(content);
+        if (!createBy.data.bundlePath || !createBy.data.bundlePath.trim()) {
+            throw new BadDataException("Bundle path is required.");
+        }
+        if (!createBy.data.serviceVersion || !createBy.data.serviceVersion.trim()) {
+            throw new BadDataException("Service version is required.");
+        }
+        createBy.data.sizeInBytes = Buffer.byteLength(content, "utf8");
+        return { createBy, carryForward: null };
+    }
+    /**
+     * Bundle paths currently stored for a (project, service, release) tuple.
+     * Used by the upload endpoint to enforce the per-release ceiling without
+     * pulling map content.
+     */
+    async getStoredBundlePathsForRelease(data) {
+        const rows = await this.findBy({
+            query: {
+                projectId: data.projectId,
+                serviceId: data.serviceId,
+                serviceVersion: data.serviceVersion,
+            },
+            select: {
+                _id: true,
+                bundlePath: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        return rows
+            .map((row) => {
+            return row.bundlePath || "";
+        })
+            .filter((bundlePath) => {
+            return bundlePath.length > 0;
+        });
+    }
+    /**
+     * Store a source map for (project, service, release, bundle), replacing
+     * any previous upload for the same bundle so CI re-runs converge on one
+     * row. Used by the authenticated upload endpoint, hence isRoot.
+     */
+    async replaceSourceMap(data) {
+        /*
+         * Hard delete (not soft): a replaced map has no restore story, and
+         * soft-deleted rows would hold megabytes until a billing-gated sweep
+         * that self-hosted deployments never run.
+         */
+        await this.hardDeleteBy({
+            query: {
+                projectId: data.projectId,
+                serviceId: data.serviceId,
+                serviceVersion: data.serviceVersion,
+                bundlePath: data.bundlePath,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const sourceMap = new Model();
+        sourceMap.projectId = data.projectId;
+        sourceMap.serviceId = data.serviceId;
+        sourceMap.serviceVersion = data.serviceVersion;
+        sourceMap.bundlePath = data.bundlePath;
+        sourceMap.content = data.content;
+        return this.create({
+            data: sourceMap,
+            props: {
+                isRoot: true,
+            },
+        });
+    }
+    /**
+     * Resolve parsed exception stack frames for a service + release against
+     * the maps uploaded for that pair. Reads with isRoot — callers must have
+     * already authorized the (projectId, serviceId) pair.
+     */
+    async resolveFramesForService(data) {
+        if (!data.serviceVersion || data.frames.length === 0) {
+            return {
+                frames: data.frames.map((frame) => {
+                    return Object.assign(Object.assign({}, frame), { resolved: false });
+                }),
+                resolvedCount: 0,
+                sourceMapCount: 0,
+            };
+        }
+        /*
+         * Two-step fetch: list bundle paths first (cheap), then pull content
+         * only for bundles that at least one frame can match. Maps can be tens
+         * of megabytes each and a release may store up to
+         * MAX_SOURCE_MAPS_PER_RELEASE of them — loading them all for every
+         * exception view would be a memory hazard for no benefit.
+         */
+        const sourceMapRows = await this.findBy({
+            query: {
+                projectId: data.projectId,
+                serviceId: data.serviceId,
+                serviceVersion: data.serviceVersion,
+            },
+            select: {
+                _id: true,
+                bundlePath: true,
+                createdAt: true,
+            },
+            sort: {
+                createdAt: SortOrder.Descending,
+            },
+            limit: MAX_SOURCE_MAPS_PER_RELEASE,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        /*
+         * Newest-first sort + first-wins dedupe: if a racing double upload left
+         * two rows for one bundle, the newer one is used.
+         */
+        const dedupedRows = [];
+        const seenBundlePaths = new Set();
+        for (const row of sourceMapRows) {
+            if (!row.bundlePath) {
+                continue;
+            }
+            const normalizedPath = SourceMapResolver.normalizePath(row.bundlePath);
+            if (seenBundlePaths.has(normalizedPath)) {
+                continue;
+            }
+            seenBundlePaths.add(normalizedPath);
+            dedupedRows.push(row);
+        }
+        const matchedRows = dedupedRows.filter((row) => {
+            return data.frames.some((frame) => {
+                return (SourceMapResolver.getMatchScore(frame.fileName, row.bundlePath || "") > 0);
+            });
+        });
+        const bundles = [];
+        if (matchedRows.length > 0) {
+            const contentRows = await this.findBy({
+                query: {
+                    /*
+                     * Tenant scoping repeated here even though ids are already
+                     * tenant-scoped — defense in depth for a root query.
+                     */
+                    projectId: data.projectId,
+                    _id: QueryHelper.any(matchedRows.map((row) => {
+                        return new ObjectID(row.id.toString());
+                    })),
+                },
+                select: {
+                    _id: true,
+                    bundlePath: true,
+                    content: true,
+                },
+                limit: MAX_SOURCE_MAPS_PER_RELEASE,
+                skip: 0,
+                props: {
+                    isRoot: true,
+                },
+            });
+            for (const row of contentRows) {
+                if (row.bundlePath && row.content) {
+                    bundles.push({
+                        bundlePath: row.bundlePath,
+                        content: row.content,
+                    });
+                }
+            }
+        }
+        const resolvedFrames = SourceMapResolver.resolveFrames(data.frames, bundles);
+        return {
+            frames: resolvedFrames,
+            resolvedCount: resolvedFrames.filter((frame) => {
+                return frame.resolved;
+            }).length,
+            /*
+             * Stored (deduped) maps for the release — not just the ones a frame
+             * matched — so "maps exist but none matched your bundles" is
+             * distinguishable from "no maps uploaded".
+             */
+            sourceMapCount: dedupedRows.length,
+        };
+    }
+}
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getStoredBundlePathsForRelease", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "replaceSourceMap", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "resolveFramesForService", null);
+export default new Service();
+//# sourceMappingURL=TelemetrySourceMapService.js.map

package/build/dist/Server/Services/TelemetrySourceMapService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TelemetrySourceMapService.js","sourceRoot":"","sources":["../../../../Server/Services/TelemetrySourceMapService.ts"],"names":[],"mappings":";;;;;;;;;AAEA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,gDAAgD,CAAC;AACnE,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,SAAS,MAAM,oCAAoC,CAAC;AAC3D,OAAO,SAAS,MAAM,+BAA+B,CAAC;AACtD,OAAO,WAAW,MAAM,+BAA+B,CAAC;AACxD,OAAO,WAAW,MAAM,gCAAgC,CAAC;AACzD,OAAO,iBAAiB,EAAE,EACxB,4BAA4B,GAE7B,MAAM,sCAAsC,CAAC;AAO9C,OAAO,EAAE,4BAA4B,EAAE,CAAC;AAExC;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,EAAE,CAAC;AAEpD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAW,GAAG,CAAC;AAEvD,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;QACb;;;;WAIG;QACH,IAAI,CAAC,8BAA8B,CAAC,WAAW,EAAE,yBAAyB,CAAC,CAAC;IAC9E,CAAC;IAGwB,AAAN,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,MAAM,OAAO,GAAuB,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC;QAE1D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,4BAA4B,EAAE,CAAC;YACtE,MAAM,IAAI,gBAAgB,CACxB,gDACE,4BAA4B,GAAG,CAAC,IAAI,GAAG,IAAI,CAC7C,MAAM,CACP,CAAC;QACJ,CAAC;QAED,iBAAiB,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QAEpD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;YAClE,MAAM,IAAI,gBAAgB,CAAC,0BAA0B,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1E,MAAM,IAAI,gBAAgB,CAAC,8BAA8B,CAAC,CAAC;QAC7D,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAE/D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IAEU,AAAN,KAAK,CAAC,8BAA8B,CAAC,IAI3C;QACC,MAAM,IAAI,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YAC3C,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,UAAU,EAAE,IAAI;aACjB;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,OAAO,IAAI;aACR,GAAG,CAAC,CAAC,GAAU,EAAE,EAAE;YAClB,OAAO,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC;QAC9B,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,UAAkB,EAAE,EAAE;YAC7B,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACP,CAAC;IAED;;;;OAIG;IAEU,AAAN,KAAK,CAAC,gBAAgB,CAAC,IAM7B;QACC;;;;WAIG;QACH,MAAM,IAAI,CAAC,YAAY,CAAC;YACtB,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;YACD,KAAK,EAAE,SAAS;YAChB,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,GAAU,IAAI,KAAK,EAAE,CAAC;QACrC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,SAAS,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QACrC,SAAS,CAAC,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC;QAC/C,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACvC,SAAS,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAEjC,OAAO,IAAI,CAAC,MAAM,CAAC;YACjB,IAAI,EAAE,SAAS;YACf,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IAEU,AAAN,KAAK,CAAC,uBAAuB,CAAC,IAKpC;QACC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrD,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAyB,EAAE,EAAE;oBACpD,uCAAY,KAAK,KAAE,QAAQ,EAAE,KAAK,IAAG;gBACvC,CAAC,CAAC;gBACF,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,CAAC;aAClB,CAAC;QACJ,CAAC;QAED;;;;;;WAMG;QACH,MAAM,aAAa,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YACpD,KAAK,EAAE;gBACL,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC;YACD,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,IAAI;aAChB;YACD,IAAI,EAAE;gBACJ,SAAS,EAAE,SAAS,CAAC,UAAU;aAChC;YACD,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,CAAC;YACP,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH;;;WAGG;QACH,MAAM,WAAW,GAAiB,EAAE,CAAC;QACrC,MAAM,eAAe,GAAgB,IAAI,GAAG,EAAE,CAAC;QAE/C,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBACpB,SAAS;YACX,CAAC;YAED,MAAM,cAAc,GAAW,iBAAiB,CAAC,aAAa,CAC5D,GAAG,CAAC,UAAU,CACf,CAAC;YAEF,IAAI,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;gBACxC,SAAS;YACX,CAAC;YAED,eAAe,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACpC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,WAAW,GAAiB,WAAW,CAAC,MAAM,CAAC,CAAC,GAAU,EAAE,EAAE;YAClE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAyB,EAAE,EAAE;gBACpD,OAAO,CACL,iBAAiB,CAAC,aAAa,CAC7B,KAAK,CAAC,QAAQ,EACd,GAAG,CAAC,UAAU,IAAI,EAAE,CACrB,GAAG,CAAC,CACN,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAA2B,EAAE,CAAC;QAE3C,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;gBAClD,KAAK,EAAE;oBACL;;;uBAGG;oBACH,SAAS,EAAE,IAAI,CAAC,SAAS;oBACzB,GAAG,EAAE,WAAW,CAAC,GAAG,CAClB,WAAW,CAAC,GAAG,CAAC,CAAC,GAAU,EAAE,EAAE;wBAC7B,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;oBAC1C,CAAC,CAAC,CACH;iBACF;gBACD,MAAM,EAAE;oBACN,GAAG,EAAE,IAAI;oBACT,UAAU,EAAE,IAAI;oBAChB,OAAO,EAAE,IAAI;iBACd;gBACD,KAAK,EAAE,2BAA2B;gBAClC,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE;oBACL,MAAM,EAAE,IAAI;iBACb;aACF,CAAC,CAAC;YAEH,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC9B,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC;wBACX,UAAU,EAAE,GAAG,CAAC,UAAU;wBAC1B,OAAO,EAAE,GAAG,CAAC,OAAO;qBACrB,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAClB,iBAAiB,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAExD,OAAO;YACL,MAAM,EAAE,cAAc;YACtB,aAAa,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,KAAyB,EAAE,EAAE;gBACjE,OAAO,KAAK,CAAC,QAAQ,CAAC;YACxB,CAAC,CAAC,CAAC,MAAM;YACT;;;;eAIG;YACH,cAAc,EAAE,WAAW,CAAC,MAAM;SACnC,CAAC;IACJ,CAAC;CACF;AA/P0B;IADxB,WAAW,EAAE;;;;6CA+Bb;AAQY;IADZ,WAAW,EAAE;;;;6DA8Bb;AAQY;IADZ,WAAW,EAAE;;;;+CAwCb;AAQY;IADZ,WAAW,EAAE;;;;sDAqIb;AAGH,eAAe,IAAI,OAAO,EAAE,CAAC"}

package/build/dist/Server/Services/ThreatIntelFeedService.js

@@ -0,0 +1,157 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/ThreatIntelFeed";
+import BadDataException from "../../Types/Exception/BadDataException";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import { THREAT_INTEL_MINIMUM_CONFIDENCE_MAX, THREAT_INTEL_MINIMUM_CONFIDENCE_MIN, } from "../../Types/SecurityEvent/ThreatIntelConstants";
+import TaxiiClient from "../Utils/SecurityEvent/ThreatIntel/TaxiiClient";
+export class Service extends DatabaseService {
+    constructor() {
+        super(Model);
+    }
+    /*
+     * Validate at save time so a feed that stores is a feed the poller can
+     * use — a malformed URL or collection id surfaces to the person
+     * configuring it, not as a cron-side lastError later. (The
+     * GoogleSecOpsConnectionService discipline.)
+     */
+    validateFeed(data) {
+        if (data.apiRootUrl !== undefined) {
+            TaxiiClient.validateApiRootUrl(data.apiRootUrl);
+        }
+        if (data.collectionId !== undefined) {
+            TaxiiClient.validateCollectionId(data.collectionId);
+        }
+        if (data.pollIntervalInMinutes !== undefined) {
+            if (!Number.isInteger(data.pollIntervalInMinutes) ||
+                data.pollIntervalInMinutes < 1 ||
+                data.pollIntervalInMinutes > 1440) {
+                throw new BadDataException("Poll interval must be a whole number of minutes between 1 and 1440.");
+            }
+        }
+        if (data.minimumConfidence !== undefined) {
+            if (!Number.isInteger(data.minimumConfidence) ||
+                data.minimumConfidence < THREAT_INTEL_MINIMUM_CONFIDENCE_MIN ||
+                data.minimumConfidence > THREAT_INTEL_MINIMUM_CONFIDENCE_MAX) {
+                throw new BadDataException(`Minimum confidence must be a whole number between ${THREAT_INTEL_MINIMUM_CONFIDENCE_MIN} and ${THREAT_INTEL_MINIMUM_CONFIDENCE_MAX}.`);
+            }
+        }
+    }
+    async onBeforeCreate(createBy) {
+        if (!createBy.data.apiRootUrl) {
+            throw new BadDataException("TAXII API root URL is required.");
+        }
+        if (!createBy.data.collectionId) {
+            throw new BadDataException("Collection ID is required.");
+        }
+        if (createBy.data.apiToken && createBy.data.basicAuthPassword) {
+            throw new BadDataException("Configure either an API token or basic-auth credentials, not both.");
+        }
+        this.validateFeed({
+            apiRootUrl: createBy.data.apiRootUrl,
+            collectionId: createBy.data.collectionId,
+            pollIntervalInMinutes: createBy.data.pollIntervalInMinutes,
+            minimumConfidence: createBy.data.minimumConfidence,
+        });
+        return { createBy, carryForward: null };
+    }
+    async onBeforeUpdate(updateBy) {
+        this.validateFeed({
+            apiRootUrl: updateBy.data.apiRootUrl,
+            collectionId: updateBy.data.collectionId,
+            pollIntervalInMinutes: updateBy.data.pollIntervalInMinutes,
+            minimumConfidence: updateBy.data.minimumConfidence,
+        });
+        await this.validateCredentialExclusivity(updateBy);
+        /*
+         * Repointing a feed invalidates its poll position: the added_after
+         * cursor (and any saved page token) is a position in ONE collection's
+         * date_added timeline. Carrying it to a different API root or
+         * collection would silently skip the new collection's entire history.
+         * Flagged here, reset in onUpdateSuccess — the cursor columns have
+         * update: [] access control, so writing them into updateBy.data would
+         * be rejected for non-root callers; the root-props write after the
+         * update bypasses the column ACL the same legitimate way the poller's
+         * own bookkeeping does.
+         */
+        const repointed = updateBy.data.apiRootUrl !== undefined ||
+            updateBy.data.collectionId !== undefined;
+        return { updateBy, carryForward: { repointed } };
+    }
+    async onUpdateSuccess(onUpdate, updatedItemIds) {
+        var _a;
+        if (((_a = onUpdate.carryForward) === null || _a === void 0 ? void 0 : _a.repointed) ===
+            true) {
+            for (const updatedItemId of updatedItemIds) {
+                /*
+                 * Cannot recurse: this inner update carries neither apiRootUrl
+                 * nor collectionId, so its own onBeforeUpdate flags nothing.
+                 */
+                await this.updateOneById({
+                    id: updatedItemId,
+                    data: {
+                        cursor: null,
+                        nextPageToken: null,
+                        lastPolledAt: null,
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                });
+            }
+        }
+        return onUpdate;
+    }
+    /*
+     * The create-time either/or rule, enforced on updates too — including
+     * against what the row ALREADY stores, since the API updates secrets
+     * one at a time. TaxiiClient silently prefers the token over basic
+     * auth, so a row holding both would poll with whichever secret the
+     * user was NOT trying to use.
+     */
+    async validateCredentialExclusivity(updateBy) {
+        const settingToken = Boolean(updateBy.data.apiToken);
+        const settingBasicPassword = Boolean(updateBy.data.basicAuthPassword);
+        if (settingToken && settingBasicPassword) {
+            throw new BadDataException("Configure either an API token or basic-auth credentials, not both.");
+        }
+        if (!settingToken && !settingBasicPassword) {
+            return;
+        }
+        /*
+         * Setting one kind while the update leaves the other kind's stored
+         * value untouched (undefined = not in the update; null = explicit
+         * clear, which is fine) — check the matched rows.
+         */
+        const otherKindUntouched = settingToken
+            ? updateBy.data.basicAuthPassword === undefined
+            : updateBy.data.apiToken === undefined;
+        if (!otherKindUntouched) {
+            return;
+        }
+        const matchedFeeds = await this.findBy({
+            query: updateBy.query,
+            select: {
+                _id: true,
+                apiToken: true,
+                basicAuthPassword: true,
+            },
+            skip: 0,
+            limit: LIMIT_MAX,
+            props: {
+                isRoot: true,
+            },
+        });
+        for (const feed of matchedFeeds) {
+            const storesOtherKind = settingToken
+                ? Boolean(feed.basicAuthPassword)
+                : Boolean(feed.apiToken);
+            if (storesOtherKind) {
+                throw new BadDataException(settingToken
+                    ? "This feed uses basic auth. Clear the basic-auth password in the same update (or use the Update Credentials action, which switches automatically) before setting an API token."
+                    : "This feed uses an API token. Clear the API token in the same update (or use the Update Credentials action, which switches automatically) before setting a basic-auth password.");
+            }
+        }
+    }
+}
+export default new Service();
+//# sourceMappingURL=ThreatIntelFeedService.js.map

package/build/dist/Server/Services/ThreatIntelFeedService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ThreatIntelFeedService.js","sourceRoot":"","sources":["../../../../Server/Services/ThreatIntelFeedService.ts"],"names":[],"mappings":"AAAA,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,6CAA6C,CAAC;AAIhE,OAAO,gBAAgB,MAAM,wCAAwC,CAAC;AACtE,OAAO,SAAS,MAAM,+BAA+B,CAAC;AAEtD,OAAO,EACL,mCAAmC,EACnC,mCAAmC,GACpC,MAAM,gDAAgD,CAAC;AACxD,OAAO,WAAW,MAAM,gDAAgD,CAAC;AAEzE,MAAM,OAAO,OAAQ,SAAQ,eAAsB;IACjD;QACE,KAAK,CAAC,KAAK,CAAC,CAAC;IACf,CAAC;IAED;;;;;OAKG;IACK,YAAY,CAAC,IAKpB;QACC,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAClC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;YAC7C,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,CAAC;gBAC7C,IAAI,CAAC,qBAAqB,GAAG,CAAC;gBAC9B,IAAI,CAAC,qBAAqB,GAAG,IAAI,EACjC,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,qEAAqE,CACtE,CAAC;YACJ,CAAC;QACH,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACzC,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,iBAAiB,CAAC;gBACzC,IAAI,CAAC,iBAAiB,GAAG,mCAAmC;gBAC5D,IAAI,CAAC,iBAAiB,GAAG,mCAAmC,EAC5D,CAAC;gBACD,MAAM,IAAI,gBAAgB,CACxB,qDAAqD,mCAAmC,QAAQ,mCAAmC,GAAG,CACvI,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAEkB,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9B,MAAM,IAAI,gBAAgB,CAAC,iCAAiC,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YAChC,MAAM,IAAI,gBAAgB,CAAC,4BAA4B,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC9D,MAAM,IAAI,gBAAgB,CACxB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,CAAC;YAChB,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAU;YACpC,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAY;YACxC,qBAAqB,EAAE,QAAQ,CAAC,IAAI,CAAC,qBAAqB;YAC1D,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAiB;SACnD,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IAEkB,KAAK,CAAC,cAAc,CACrC,QAAyB;QAEzB,IAAI,CAAC,YAAY,CAAC;YAChB,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,UAAgC;YAC1D,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,YAAkC;YAC9D,qBAAqB,EAAE,QAAQ,CAAC,IAAI,CAAC,qBAExB;YACb,iBAAiB,EAAE,QAAQ,CAAC,IAAI,CAAC,iBAAuC;SACzE,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,6BAA6B,CAAC,QAAQ,CAAC,CAAC;QAEnD;;;;;;;;;;WAUG;QACH,MAAM,SAAS,GACb,QAAQ,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS;YACtC,QAAQ,CAAC,IAAI,CAAC,YAAY,KAAK,SAAS,CAAC;QAE3C,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC;IACnD,CAAC;IAEkB,KAAK,CAAC,eAAe,CACtC,QAAyB,EACzB,cAA+B;;QAE/B,IACE,CAAA,MAAC,QAAQ,CAAC,YAA+C,0CAAE,SAAS;YACpE,IAAI,EACJ,CAAC;YACD,KAAK,MAAM,aAAa,IAAI,cAAc,EAAE,CAAC;gBAC3C;;;mBAGG;gBACH,MAAM,IAAI,CAAC,aAAa,CAAC;oBACvB,EAAE,EAAE,aAAa;oBACjB,IAAI,EAAE;wBACJ,MAAM,EAAE,IAAyB;wBACjC,aAAa,EAAE,IAAyB;wBACxC,YAAY,EAAE,IAAuB;qBACtC;oBACD,KAAK,EAAE;wBACL,MAAM,EAAE,IAAI;qBACb;iBACF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,6BAA6B,CACzC,QAAyB;QAEzB,MAAM,YAAY,GAAY,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9D,MAAM,oBAAoB,GAAY,OAAO,CAC3C,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAChC,CAAC;QAEF,IAAI,YAAY,IAAI,oBAAoB,EAAE,CAAC;YACzC,MAAM,IAAI,gBAAgB,CACxB,oEAAoE,CACrE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED;;;;WAIG;QACH,MAAM,kBAAkB,GAAY,YAAY;YAC9C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS;YAC/C,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC;QAEzC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO;QACT,CAAC;QAED,MAAM,YAAY,GAAiB,MAAM,IAAI,CAAC,MAAM,CAAC;YACnD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE;gBACN,GAAG,EAAE,IAAI;gBACT,QAAQ,EAAE,IAAI;gBACd,iBAAiB,EAAE,IAAI;aACxB;YACD,IAAI,EAAE,CAAC;YACP,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE;gBACL,MAAM,EAAE,IAAI;aACb;SACF,CAAC,CAAC;QAEH,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;YAChC,MAAM,eAAe,GAAY,YAAY;gBAC3C,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC;gBACjC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAE3B,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,IAAI,gBAAgB,CACxB,YAAY;oBACV,CAAC,CAAC,+KAA+K;oBACjL,CAAC,CAAC,gLAAgL,CACrL,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,eAAe,IAAI,OAAO,EAAE,CAAC"}