@oneuptime/common 12.0.27 → 12.0.29

package/Server/API/StatusPageDomainAPI.ts

@@ -239,5 +239,79 @@ export default class StatusPageDomainAPI extends BaseAPI<
         }
       },
     );
+
+    /*
+     * Reissue SSL API. Backs the "Reissue SSL Certificate" button in the
+     * dashboard, for a customer who wants a fresh certificate now rather than
+     * whenever the renewal cron next gets to this domain.
+     *
+     * The throttle that keeps this from becoming a way to spend the shared
+     * Let's Encrypt allowance lives in the service, alongside the write that
+     * claims it - a check here would be a check the automated callers do not
+     * share, and one an extra caller could forget.
+     */
+    this.router.get(
+      `${new this.entityType().getCrudApiPath()?.toString()}/reissue-ssl/:id`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          if (!StatusPageCNameRecord) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                `Custom Domains not enabled for this
+                                OneUptime installation. Please contact
+                                your server admin to enable this
+                                feature.`,
+              ),
+            );
+          }
+
+          const databaseProps: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          const id: ObjectID = new ObjectID(req.params["id"] as string);
+
+          /*
+           * Scoped by the caller's own props, so a domain in someone else's
+           * project is indistinguishable from one that does not exist.
+           */
+          const domainCount: PositiveNumber =
+            await StatusPageDomainService.countBy({
+              query: {
+                _id: id.toString(),
+              },
+              props: databaseProps,
+            });
+
+          if (domainCount.toNumber() === 0) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "The domain does not exist or user does not have access to it.",
+              ),
+            );
+          }
+
+          logger.debug(
+            "Reissuing SSL",
+            getLogAttributesFromRequest(req as any),
+          );
+
+          await StatusPageDomainService.reissueCert(id);
+
+          logger.debug(
+            "SSL reissued for domain id - " + id.toString(),
+            getLogAttributesFromRequest(req as any),
+          );
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (e) {
+          next(e);
+        }
+      },
+    );
   }
 }

package/Server/API/TelemetryAPI.ts

@@ -115,6 +115,7 @@ import RumApplication from "../../Models/DatabaseModels/RumApplication";
 import RumApplicationService from "../Services/RumApplicationService";
 import Project from "../../Models/DatabaseModels/Project";
 import ProjectService from "../Services/ProjectService";
+import SessionReplayIdentity from "../Utils/SessionReplay/SessionReplayIdentity";
 import SessionReplayTargeting from "../Utils/SessionReplay/SessionReplayTargeting";
 import SessionReplayUsage from "../Utils/SessionReplay/SessionReplayUsage";
 import RumSessionReplayView from "../../Models/DatabaseModels/RumSessionReplayView";
@@ -134,6 +135,7 @@ import {
   DEFAULT_SESSION_REPLAY_MAX_BYTES_PER_PROJECT_PER_DAY,
   MAX_SESSION_REPLAY_CHUNKS_PER_READ,
   MAX_SESSION_REPLAY_READ_BYTES,
+  SESSION_REPLAY_MAX_USER_REF_LENGTH,
 } from "../../Types/Rum/SessionReplay";
 
 const router: ExpressRouter = Express.getRouter();
@@ -3495,6 +3497,14 @@ router.post(
 /*
  * Listing sessions. Mirrors RumSession's table-level read ACL exactly:
  * knowing WHICH sessions errored is triage.
+ *
+ * Including the PAYLOAD permission, which that ACL also carries and this
+ * guard used to omit. Watching implies listing: the payload routes authorize
+ * on ReadRumSessionReplayPayload alone, so a role granted only "Watch
+ * Session Replays" could play back any session whose id it was handed while
+ * being 401'd on the list, the manifest and the exception page's replay card
+ * - an incoherent grant rather than a safer one, and exactly what
+ * RumSession's own comment says the ACL exists to prevent.
  */
 const requireSessionReplayListAccess: Array<RequestHandler> = [
   UserMiddleware.getUserMiddleware,
@@ -3505,6 +3515,7 @@ const requireSessionReplayListAccess: Array<RequestHandler> = [
       Permission.ProjectAdmin,
       Permission.TelemetryAdmin,
       Permission.ReadRumSessionReplay,
+      Permission.ReadRumSessionReplayPayload,
     ],
   }),
 ];
@@ -3534,6 +3545,20 @@ const SESSION_REPLAY_LIST_PERMISSIONS: Array<Permission> = [
   Permission.ProjectAdmin,
   Permission.TelemetryAdmin,
   Permission.ReadRumSessionReplay,
+  /*
+   * Watching implies listing.
+   *
+   * RumSession's own table read ACL contains this permission for a reason it
+   * states outright: a role granted only the watch permission could fetch
+   * payloads (the payload routes authorize on it alone) while being 401'd on
+   * the manifest and the list - an incoherent grant rather than a safer one.
+   * Leaving it out here meant a support-engineer role built from "Watch
+   * Session Replays" + "Read RUM Application" - the natural pairing, and the
+   * one the permission's own description suggests - got a permission error
+   * on the session list and a silently missing "Watch what the user saw"
+   * card on every exception page.
+   */
+  Permission.ReadRumSessionReplayPayload,
 ];
 
 const SESSION_REPLAY_PAYLOAD_PERMISSIONS: Array<Permission> = [
@@ -4131,8 +4156,51 @@ router.post(
         ? OneUptimeDate.fromString(body["endTime"] as string)
         : OneUptimeDate.getCurrentDate();
 
+      /*
+       * The narrower identity ACL, resolved BEFORE the filters are built.
+       *
+       * It is enforced by simply not naming the column in the SELECT - there
+       * is no ModelPermission on this path to strip it after the fact - and
+       * it is decided against the application already loaded by the access
+       * check, so a caller whose identity grant is label-scoped elsewhere
+       * does not get named end users here.
+       *
+       * It gates the identity FILTER as well as the column. Without that,
+       * a caller deliberately denied the label could still ask "does
+       * jane@example.com have sessions here" and read every other field of
+       * the answer - a dictionary attack that de-anonymises the list one
+       * candidate at a time, and hands back identifiedUserKey as a stable
+       * pseudonym to join against the route filter. The permission sets are
+       * genuinely different: SESSION_REPLAY_IDENTITY_PERMISSIONS excludes
+       * TelemetryAdmin and ReadRumSessionReplay, both of which can list.
+       */
+      const includeIdentifiedUserLabel: boolean = canReadIdentifiedUserLabel({
+        databaseProps: databaseProps,
+        application: application,
+      });
+
       const rawFilters: JSONObject = (body["filters"] as JSONObject) || {};
 
+      /*
+       * A reference the server cannot hash must be a 400, never a filter
+       * that quietly disappears. Dropping it would return the WHOLE
+       * unfiltered list with a 200 - the caller sees every session in the
+       * project and has no way to tell that the person they asked about was
+       * not the one being answered about.
+       */
+      if (
+        rawFilters["identifiedUserRef"] !== undefined &&
+        !SessionReplayIdentity.isUsableUserRef(rawFilters["identifiedUserRef"])
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            `identifiedUserRef must be a non-empty string of at most ${SESSION_REPLAY_MAX_USER_REF_LENGTH} characters.`,
+          ),
+        );
+      }
+
       const filters: SessionReplayListFilters = {
         ...(typeof rawFilters["hasError"] === "boolean" && {
           hasError: rawFilters["hasError"],
@@ -4158,9 +4226,42 @@ router.post(
         ...(readStringArrayFromBody(rawFilters, "countryCodes") && {
           countryCodes: readStringArrayFromBody(rawFilters, "countryCodes"),
         }),
-        ...(typeof rawFilters["identifiedUserKey"] === "string" && {
-          identifiedUserKey: rawFilters["identifiedUserKey"],
-        }),
+        /*
+         * The caller sends the end-user reference their own page supplied -
+         * the value the session list displays - and the server derives the
+         * digest with the same per-project HMAC the ingest used. Hashing
+         * here rather than in the browser is what keeps the derivation (and
+         * the EncryptionSecret it is keyed on) server-side, and it is the
+         * only reason this filter can match anything: the raw key is
+         * displayed nowhere in the product, so a user had no way to obtain
+         * the value the field used to demand.
+         *
+         * Gated on the identity permission, and validated above so an
+         * unusable reference is a 400 rather than a silently unfiltered
+         * list.
+         */
+        ...(includeIdentifiedUserLabel &&
+          SessionReplayIdentity.isUsableUserRef(
+            rawFilters["identifiedUserRef"],
+          ) && {
+            identifiedUserKey: SessionReplayIdentity.buildUserKey({
+              projectId: projectId,
+              userRef: rawFilters["identifiedUserRef"] as string,
+            }),
+          }),
+        /*
+         * Still accepted, for API callers that already hold a digest (an
+         * erasure workflow, a saved view). Ignored when a reference was also
+         * sent, since the reference is the one a human typed. The digest is
+         * not guessable and is already returned to every list-capable
+         * caller, so it needs no identity gate of its own.
+         */
+        ...(typeof rawFilters["identifiedUserKey"] === "string" &&
+          !SessionReplayIdentity.isUsableUserRef(
+            rawFilters["identifiedUserRef"],
+          ) && {
+            identifiedUserKey: rawFilters["identifiedUserKey"],
+          }),
         ...(typeof rawFilters["route"] === "string" && {
           route: rawFilters["route"],
         }),
@@ -4183,18 +4284,6 @@ router.post(
             }
           : undefined;
 
-      /*
-       * The narrower identity ACL is enforced by simply not naming the
-       * column in the SELECT. There is no ModelPermission on this path to
-       * strip it after the fact. Decided against the application already
-       * loaded by the access check, so a caller whose identity grant is
-       * label-scoped elsewhere does not get named end users here.
-       */
-      const includeIdentifiedUserLabel: boolean = canReadIdentifiedUserLabel({
-        databaseProps: databaseProps,
-        application: application,
-      });
-
       const result: SessionReplayListResult =
         await SessionReplayReadService.listSessions({
           projectId: projectId,

package/Server/Infrastructure/Postgres/SchemaMigrations/1790200000000-AllowNullMonitorNameOnMonitorTemplate.ts

@@ -0,0 +1,43 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * "Default Monitor Name" on a Monitor Template becomes optional (issue #3486).
+ *
+ * A Network Device auto-import rule names every monitor it provisions
+ * "<device> - <template's default monitor name>". While the column was NOT
+ * NULL there was nothing an operator could type that would not become a
+ * suffix on every imported device in the estate — "UN0660WANRTR01 - Unit
+ * Router" for a router whose name is already UN0660WANRTR01. Blank now means
+ * the monitor is named after the device alone.
+ *
+ * Nullable with no default and no backfill: every template that already
+ * exists keeps the name it was created with, so nothing about an existing
+ * project's monitor naming changes when this ships.
+ */
+export class AllowNullMonitorNameOnMonitorTemplate1790200000000
+  implements MigrationInterface
+{
+  public name: string = "AllowNullMonitorNameOnMonitorTemplate1790200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "MonitorTemplate" ALTER COLUMN "monitorName" DROP NOT NULL`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Templates written while the column was nullable have no name, and
+     * restoring NOT NULL would fail on every one of them. "Monitor" is the
+     * exact string the pre-#3486 code substituted when a template's name was
+     * blank, so it is the one value that reconstructs the old behaviour
+     * rather than inventing a new one.
+     */
+    await queryRunner.query(
+      `UPDATE "MonitorTemplate" SET "monitorName" = 'Monitor' WHERE "monitorName" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorTemplate" ALTER COLUMN "monitorName" SET NOT NULL`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790300000000-AddCertificateReissueRequestedAtToDomains.ts

@@ -0,0 +1,40 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * When a customer last asked us to reissue the Let's Encrypt certificate for a
+ * custom domain, on both the status page and the dashboard domain tables.
+ *
+ * This is the state behind the reissue cooldown: certificates are ordered
+ * against a Let's Encrypt account shared by every customer on the
+ * installation, so the dashboard button that spends that account's allowance
+ * is throttled per domain, and this column is what the throttle reads.
+ *
+ * Nullable with no default and no backfill. Null means "never reissued", which
+ * is exactly true of every domain that exists when this ships, and it is the
+ * value that lets the first press of the button through rather than making
+ * every existing customer wait out a cooldown they never triggered.
+ */
+export class AddCertificateReissueRequestedAtToDomains1790300000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddCertificateReissueRequestedAtToDomains1790300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageDomain" ADD "certificateReissueRequestedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DashboardDomain" ADD "certificateReissueRequestedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DashboardDomain" DROP COLUMN "certificateReissueRequestedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageDomain" DROP COLUMN "certificateReissueRequestedAt"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -561,6 +561,8 @@ import { AddTelemetrySourceMap1790000000000 } from "./1790000000000-AddTelemetry
 import { AddSnmpConfigsToNetworkDeviceDiscoveryScan1790000000001 } from "./1790000000001-AddSnmpConfigsToNetworkDeviceDiscoveryScan";
 import { AddSnmpEnabledToNetworkDeviceDiscoveryScan1790003445000 } from "./1790003445000-AddSnmpEnabledToNetworkDeviceDiscoveryScan";
 import { AddResourceActivityFeeds1790100000000 } from "./1790100000000-AddResourceActivityFeeds";
+import { AllowNullMonitorNameOnMonitorTemplate1790200000000 } from "./1790200000000-AllowNullMonitorNameOnMonitorTemplate";
+import { AddCertificateReissueRequestedAtToDomains1790300000000 } from "./1790300000000-AddCertificateReissueRequestedAtToDomains";
 
 export default [
   InitialMigration,
@@ -1126,4 +1128,6 @@ export default [
   AddSnmpConfigsToNetworkDeviceDiscoveryScan1790000000001,
   AddSnmpEnabledToNetworkDeviceDiscoveryScan1790003445000,
   AddResourceActivityFeeds1790100000000,
+  AllowNullMonitorNameOnMonitorTemplate1790200000000,
+  AddCertificateReissueRequestedAtToDomains1790300000000,
 ];

package/Server/Middleware/ProjectAuthorization.ts

@@ -199,7 +199,12 @@ export default class ProjectMiddleware {
         (req as OneUptimeRequest).userType = UserType.API;
 
         /*
-         * TODO: Add API key permissions.
+         * The two halves of an API key's authority. The global half is the
+         * fixed marker set every key carries (see APIKeyAccessPermission); the
+         * per-key grants an administrator actually configured are read from
+         * ApiKeyPermission just below. That second half is what the long-lived
+         * "TODO: Add API key permissions" here was asking for, and it is done -
+         * the TODO outlived the work.
          */
         (req as OneUptimeRequest).userGlobalAccessPermission =
           await APIKeyAccessPermission.getDefaultApiGlobalPermission(tenantId);

package/Server/Services/DashboardDomainService.ts

@@ -20,6 +20,10 @@ import Telemetry, { Span } from "../Utils/Telemetry";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DashboardCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
+import OneUptimeDate from "../../Types/Date";
+import CertificateReissueUtil from "../../Utils/CertificateReissue";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import QueryHelper from "../Types/Database/QueryHelper";
 
 const DASHBOARD_DOMAIN_EGRESS_LABEL: string = "Dashboard domain";
 
@@ -247,6 +251,133 @@ export class Service extends DatabaseService<DashboardDomain> {
     });
   }
 
+  /*
+   * Reissue this domain's Let's Encrypt certificate because a customer asked
+   * for it, rather than because it is close to expiring.
+   *
+   * Every order spends from a Let's Encrypt account that is shared by the
+   * whole installation - including by the cron that keeps everybody else's
+   * certificates alive - so this is throttled to one request per domain per
+   * CertificateReissueUtil.COOLDOWN_IN_HOURS.
+   *
+   * Throws with a customer-readable reason for every refusal, so the API layer
+   * can hand the message straight back without classifying the failure:
+   * BadDataException for a domain that is not eligible at all, and
+   * TooManyRequestsException (429) for one that is simply too soon.
+   */
+  @CaptureSpan()
+  public async reissueCert(domainId: ObjectID): Promise<void> {
+    const now: Date = OneUptimeDate.getCurrentDate();
+
+    const dashboardDomain: DashboardDomain | null = await this.findOneBy({
+      query: {
+        _id: domainId.toString(),
+      },
+      select: {
+        _id: true,
+        fullDomain: true,
+        isCnameVerified: true,
+        isSslOrdered: true,
+        isCustomCertificate: true,
+        certificateReissueRequestedAt: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!dashboardDomain) {
+      throw new BadDataException("Domain not found.");
+    }
+
+    if (!dashboardDomain.fullDomain) {
+      throw new BadDataException(
+        "Unable to reissue certificate because domain is null",
+      );
+    }
+
+    /*
+     * Nothing to reissue: the certificate on a custom-certificate domain is
+     * the one the customer uploaded, and we have no way to obtain another.
+     */
+    if (dashboardDomain.isCustomCertificate) {
+      throw new BadDataException(
+        "This domain uses a certificate you uploaded yourself, so there is no Let's Encrypt certificate to reissue. Please edit this domain and upload a new certificate instead.",
+      );
+    }
+
+    if (!dashboardDomain.isCnameVerified) {
+      throw new BadDataException(
+        "CNAME is not verified. Please verify CNAME first before you reissue the SSL certificate.",
+      );
+    }
+
+    /*
+     * A domain that never ordered a certificate has nothing to reissue - the
+     * dashboard shows "Order Free SSL" for it, which is the correct button.
+     */
+    if (!dashboardDomain.isSslOrdered) {
+      throw new BadDataException(
+        "No SSL certificate has been ordered for this domain yet. Please order one first.",
+      );
+    }
+
+    /*
+     * Claim the cooldown before ordering anything, and claim it by putting the
+     * cooldown condition in the WHERE clause rather than in an `if` above the
+     * write. Two clicks that arrive together both read a row that is not
+     * cooling down; only the write can decide which one of them gets to spend
+     * the CA's allowance.
+     *
+     * The stamp goes down BEFORE the order and is never rolled back on
+     * failure. A rejected order still costs a validation attempt against the
+     * shared account, and a domain whose order fails is exactly the domain
+     * somebody presses again - so a failed attempt has to start the clock the
+     * same way a successful one does.
+     */
+    const claimedRowCount: number = await this.updateOneBy({
+      query: {
+        _id: domainId.toString(),
+        certificateReissueRequestedAt: QueryHelper.lessThanEqualToOrNull(
+          CertificateReissueUtil.getCooldownCutoff(now),
+        ),
+      },
+      data: {
+        certificateReissueRequestedAt: now,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (claimedRowCount === 0) {
+      if (dashboardDomain.certificateReissueRequestedAt) {
+        throw new TooManyRequestsException(
+          CertificateReissueUtil.getCooldownMessage(
+            dashboardDomain.certificateReissueRequestedAt,
+            now,
+          ),
+        );
+      }
+
+      /*
+       * The row matched the cooldown a moment ago and does not now: another
+       * request claimed it in between, or the domain was deleted. Either way
+       * the caller must not order.
+       */
+      throw new BadDataException(
+        "Could not start a certificate reissue for this domain. Please refresh the page and try again.",
+      );
+    }
+
+    logger.debug(
+      "Reissuing SSL certificate for domain: " + dashboardDomain.fullDomain,
+      { fullDomain: dashboardDomain.fullDomain } as LogAttributes,
+    );
+
+    await this.orderCert(dashboardDomain);
+  }
+
   @CaptureSpan()
   public async updateSslProvisioningStatusForAllDomains(): Promise<void> {
     const domains: Array<DashboardDomain> = await this.findBy({

package/Server/Services/LogPipelineProcessorService.ts

@@ -1,10 +1,98 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/LogPipelineProcessor";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import { JSONObject } from "../../Types/JSON";
+import { validateLogPipelineProcessor } from "../Utils/LogPipelineProcessorValidation";
+
+/*
+ * `PartialEntity` values may be `() => string` raw SQL expressions rather
+ * than literals. One cannot be evaluated here, so an update that sets a
+ * validated field to an expression is skipped - validating a stringified
+ * function would be worse than not validating at all. Nothing in the
+ * product writes processor fields this way.
+ */
+function isSqlExpressionValue(value: unknown): boolean {
+  return typeof value === "function";
+}
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    validateLogPipelineProcessor({
+      processorType: createBy.data.processorType,
+      configuration: createBy.data.configuration as JSONObject | undefined,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * An edit can break a row without naming both fields: switching
+     * `processorType` to GrokParser while the stored configuration is
+     * still a severity-remapper blob, or replacing the pattern on a row
+     * that is already a GrokParser. So validate the MERGED row.
+     *
+     * Only pay for the SELECT when the update touches one of them.
+     * Processor edits are rare, human-driven config changes - this is
+     * not a hot path.
+     */
+    const incomingProcessorType: unknown = updateBy.data.processorType;
+    const incomingConfiguration: unknown = updateBy.data.configuration;
+
+    if (
+      incomingProcessorType === undefined &&
+      incomingConfiguration === undefined
+    ) {
+      return { updateBy, carryForward: null };
+    }
+
+    if (
+      isSqlExpressionValue(incomingProcessorType) ||
+      isSqlExpressionValue(incomingConfiguration)
+    ) {
+      return { updateBy, carryForward: null };
+    }
+
+    const existingRows: Array<Model> = await this.findBy({
+      query: updateBy.query,
+      skip: 0,
+      limit: LIMIT_MAX,
+      select: {
+        _id: true,
+        processorType: true,
+        configuration: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const existing of existingRows) {
+      validateLogPipelineProcessor({
+        processorType:
+          incomingProcessorType !== undefined
+            ? (incomingProcessorType as string | null)
+            : existing.processorType,
+        configuration:
+          incomingConfiguration !== undefined
+            ? (incomingConfiguration as JSONObject | string | null)
+            : (existing.configuration as JSONObject | undefined),
+      });
+    }
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();