@oneuptime/common 12.0.27 → 12.0.29

package/Server/Services/MonitorTemplateService.ts

@@ -6,6 +6,7 @@ import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import MonitorStepsProjectValidator from "../Utils/Monitor/MonitorStepsProjectValidator";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
+import Includes from "../../Types/BaseDatabase/Includes";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import { JSONObject } from "../../Types/JSON";
 import MonitorSteps from "../../Types/Monitor/MonitorSteps";
@@ -275,7 +276,7 @@ export class Service extends DatabaseService<Model> {
             monitorSteps: true,
             autoProvisionedNetworkDeviceId: true,
           },
-          sort: { createdAt: SortOrder.Ascending },
+          sort: { createdAt: SortOrder.Ascending, _id: SortOrder.Ascending },
           limit: LIMIT_MAX,
           skip: skip,
           props: { isRoot: true },
@@ -321,16 +322,74 @@ export class Service extends DatabaseService<Model> {
       return { totalLinkedMonitors, syncedMonitors };
     }
 
-    const syncedMonitors: number = await MonitorService.updateBy({
-      query: {
-        monitorTemplateId: template.id!,
-        projectId: template.projectId,
-      },
-      data: updateData as any,
-      limit: LIMIT_MAX,
-      skip: 0,
-      props: data.props,
-    });
+    /*
+     * A single updateBy is capped at its `limit`, so a template with more
+     * linked monitors than LIMIT_MAX used to leave the remainder on the old
+     * config and still return success. Offset paging cannot fix that here:
+     * updateBy takes no sort, and rewriting a row moves its tuple, so a
+     * second page at a higher skip can step over rows the first page moved.
+     * Page the ids first instead, then update by id batch.
+     *
+     * `_id` rides along in the sort because skip/limit paging is only stable
+     * over a total order: a fleet provisioned by one auto-import run shares a
+     * createdAt, and without the tiebreaker a tie straddling a page boundary
+     * returns one row twice and another never — which here would inflate
+     * syncedMonitors by exactly the number of rows it dropped.
+     */
+    const linkedMonitorIds: Array<ObjectID> = [];
+
+    for (let skip: number = 0; ; skip += LIMIT_MAX) {
+      const monitors: Array<Monitor> = await MonitorService.findBy({
+        query: {
+          monitorTemplateId: template.id!,
+          projectId: template.projectId,
+        },
+        select: { _id: true },
+        sort: { createdAt: SortOrder.Ascending, _id: SortOrder.Ascending },
+        limit: LIMIT_MAX,
+        skip: skip,
+        props: { isRoot: true },
+      });
+
+      for (const monitor of monitors) {
+        linkedMonitorIds.push(monitor.id!);
+      }
+
+      if (monitors.length < LIMIT_MAX) {
+        break;
+      }
+    }
+
+    let syncedMonitors: number = 0;
+
+    for (
+      let batchStart: number = 0;
+      batchStart < linkedMonitorIds.length;
+      batchStart += LIMIT_MAX
+    ) {
+      const batch: Array<ObjectID> = linkedMonitorIds.slice(
+        batchStart,
+        batchStart + LIMIT_MAX,
+      );
+
+      /*
+       * Still scoped by template and project, so a stale id from the paging
+       * read above cannot widen the write beyond this template's fleet.
+       * props stays the caller's — updateBy narrows each batch to what they
+       * may actually update.
+       */
+      syncedMonitors += await MonitorService.updateBy({
+        query: {
+          _id: new Includes(batch),
+          monitorTemplateId: template.id!,
+          projectId: template.projectId,
+        },
+        data: updateData as any,
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: data.props,
+      });
+    }
 
     return {
       totalLinkedMonitors,

package/Server/Services/StatusPageDomainService.ts

@@ -20,10 +20,24 @@ import Telemetry, { Span } from "../Utils/Telemetry";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { StatusPageCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
+import ArrayUtil from "../../Utils/Array";
+import OneUptimeDate from "../../Types/Date";
+import CertificateReissueUtil from "../../Utils/CertificateReissue";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import QueryHelper from "../Types/Database/QueryHelper";
 
 const STATUS_PAGE_DOMAIN_EGRESS_LABEL: string = "Status page domain";
 
 export class Service extends DatabaseService<StatusPageDomain> {
+  /*
+   * How many status pages the provisioning sweep checks at once. Each check is
+   * one bounded request out to a customer domain, so this is about not letting
+   * the sweep's length grow with the size of the fleet, rather than about local
+   * work. Kept modest so a sweep cannot look like a burst of traffic to any
+   * shared infrastructure sitting in front of those domains.
+   */
+  public static readonly SSL_PROVISIONING_CHECK_CONCURRENCY: number = 10;
+
   public constructor() {
     super(StatusPageDomain);
   }
@@ -248,6 +262,133 @@ export class Service extends DatabaseService<StatusPageDomain> {
     });
   }
 
+  /*
+   * Reissue this domain's Let's Encrypt certificate because a customer asked
+   * for it, rather than because it is close to expiring.
+   *
+   * Every order spends from a Let's Encrypt account that is shared by the
+   * whole installation - including by the cron that keeps everybody else's
+   * certificates alive - so this is throttled to one request per domain per
+   * CertificateReissueUtil.COOLDOWN_IN_HOURS.
+   *
+   * Throws with a customer-readable reason for every refusal, so the API layer
+   * can hand the message straight back without classifying the failure:
+   * BadDataException for a domain that is not eligible at all, and
+   * TooManyRequestsException (429) for one that is simply too soon.
+   */
+  @CaptureSpan()
+  public async reissueCert(domainId: ObjectID): Promise<void> {
+    const now: Date = OneUptimeDate.getCurrentDate();
+
+    const statusPageDomain: StatusPageDomain | null = await this.findOneBy({
+      query: {
+        _id: domainId.toString(),
+      },
+      select: {
+        _id: true,
+        fullDomain: true,
+        isCnameVerified: true,
+        isSslOrdered: true,
+        isCustomCertificate: true,
+        certificateReissueRequestedAt: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!statusPageDomain) {
+      throw new BadDataException("Domain not found.");
+    }
+
+    if (!statusPageDomain.fullDomain) {
+      throw new BadDataException(
+        "Unable to reissue certificate because domain is null",
+      );
+    }
+
+    /*
+     * Nothing to reissue: the certificate on a custom-certificate domain is
+     * the one the customer uploaded, and we have no way to obtain another.
+     */
+    if (statusPageDomain.isCustomCertificate) {
+      throw new BadDataException(
+        "This domain uses a certificate you uploaded yourself, so there is no Let's Encrypt certificate to reissue. Please edit this domain and upload a new certificate instead.",
+      );
+    }
+
+    if (!statusPageDomain.isCnameVerified) {
+      throw new BadDataException(
+        "CNAME is not verified. Please verify CNAME first before you reissue the SSL certificate.",
+      );
+    }
+
+    /*
+     * A domain that never ordered a certificate has nothing to reissue - the
+     * dashboard shows "Order Free SSL" for it, which is the correct button.
+     */
+    if (!statusPageDomain.isSslOrdered) {
+      throw new BadDataException(
+        "No SSL certificate has been ordered for this domain yet. Please order one first.",
+      );
+    }
+
+    /*
+     * Claim the cooldown before ordering anything, and claim it by putting the
+     * cooldown condition in the WHERE clause rather than in an `if` above the
+     * write. Two clicks that arrive together both read a row that is not
+     * cooling down; only the write can decide which one of them gets to spend
+     * the CA's allowance.
+     *
+     * The stamp goes down BEFORE the order and is never rolled back on
+     * failure. A rejected order still costs a validation attempt against the
+     * shared account, and a domain whose order fails is exactly the domain
+     * somebody presses again - so a failed attempt has to start the clock the
+     * same way a successful one does.
+     */
+    const claimedRowCount: number = await this.updateOneBy({
+      query: {
+        _id: domainId.toString(),
+        certificateReissueRequestedAt: QueryHelper.lessThanEqualToOrNull(
+          CertificateReissueUtil.getCooldownCutoff(now),
+        ),
+      },
+      data: {
+        certificateReissueRequestedAt: now,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (claimedRowCount === 0) {
+      if (statusPageDomain.certificateReissueRequestedAt) {
+        throw new TooManyRequestsException(
+          CertificateReissueUtil.getCooldownMessage(
+            statusPageDomain.certificateReissueRequestedAt,
+            now,
+          ),
+        );
+      }
+
+      /*
+       * The row matched the cooldown a moment ago and does not now: another
+       * request claimed it in between, or the domain was deleted. Either way
+       * the caller must not order.
+       */
+      throw new BadDataException(
+        "Could not start a certificate reissue for this domain. Please refresh the page and try again.",
+      );
+    }
+
+    logger.debug(
+      "Reissuing SSL certificate for domain: " + statusPageDomain.fullDomain,
+      { fullDomain: statusPageDomain.fullDomain } as LogAttributes,
+    );
+
+    await this.orderCert(statusPageDomain);
+  }
+
   @CaptureSpan()
   public async updateSslProvisioningStatusForAllDomains(): Promise<void> {
     const domains: Array<StatusPageDomain> = await this.findBy({
@@ -257,6 +398,7 @@ export class Service extends DatabaseService<StatusPageDomain> {
       },
       select: {
         _id: true,
+        fullDomain: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -265,9 +407,27 @@ export class Service extends DatabaseService<StatusPageDomain> {
       },
     });
 
-    for (const domain of domains) {
-      await this.updateSslProvisioningStatus(domain);
-    }
+    /*
+     * Each domain costs a request out to the customer's status page, so walking
+     * the fleet one at a time makes the sweep as long as the fleet is slow.
+     * That length is the delay before an expired certificate is noticed and
+     * reordered, so it is the outage a customer sees when renewal has not
+     * already happened - it must stay well inside the sweep's own interval.
+     */
+    await ArrayUtil.forEachWithConcurrency(
+      domains,
+      Service.SSL_PROVISIONING_CHECK_CONCURRENCY,
+      async (domain: StatusPageDomain): Promise<void> => {
+        try {
+          await this.updateSslProvisioningStatus(domain);
+        } catch (err) {
+          // one unreachable domain must not end the sweep for the rest.
+          logger.error(err, {
+            fullDomain: domain.fullDomain,
+          } as LogAttributes);
+        }
+      },
+    );
   }
 
   private async isSSLProvisioned(

package/Server/Services/StatusPagePrivateUserSessionService.ts

@@ -9,6 +9,7 @@ import Text from "../../Types/Text";
 import logger from "../Utils/Logger";
 import Exception from "../../Types/Exception/Exception";
 import BadDataException from "../../Types/Exception/BadDataException";
+import { JsonContains, MoreThan, UpdateResult } from "typeorm";
 
 export interface SessionMetadata {
   session: Model;
@@ -52,8 +53,24 @@ export interface RevokeSessionOptions {
   reason?: string | undefined;
 }
 
+export interface ExchangeLoginCodeOptions {
+  statusPageId: ObjectID;
+  ipAddress?: string | undefined;
+  userAgent?: string | undefined;
+  deviceName?: string | undefined;
+  deviceType?: string | undefined;
+  deviceOS?: string | undefined;
+  deviceBrowser?: string | undefined;
+  additionalInfo?: JSONObject | undefined;
+}
+
+export const STATUS_PAGE_LOGIN_CODE_TTL_MINUTES: number = 5;
+
 export class Service extends DatabaseService<Model> {
   private static readonly DEFAULT_REFRESH_TOKEN_TTL_DAYS: number = 30;
+  private static readonly LOGIN_CODE_PURPOSE_KEY: string =
+    "oneuptimeStatusPageSessionPurpose";
+  private static readonly LOGIN_CODE_PURPOSE_VALUE: string = "login-code";
   private static readonly SHORT_TEXT_LIMIT: number = 100;
 
   public constructor() {
@@ -91,6 +108,31 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  public async createLoginCodeSession(
+    options: Omit<
+      CreateSessionOptions,
+      "refreshToken" | "refreshTokenExpiresAt"
+    >,
+  ): Promise<SessionMetadata> {
+    return await this.createSession({
+      ...options,
+      additionalInfo: {
+        ...(options.additionalInfo || {}),
+        [Service.LOGIN_CODE_PURPOSE_KEY]: Service.LOGIN_CODE_PURPOSE_VALUE,
+      } as JSONObject,
+      refreshTokenExpiresAt: OneUptimeDate.getSomeMinutesAfter(
+        STATUS_PAGE_LOGIN_CODE_TTL_MINUTES,
+      ),
+    });
+  }
+
+  public isLoginCodeSession(session: Model): boolean {
+    return (
+      session.additionalInfo?.[Service.LOGIN_CODE_PURPOSE_KEY] ===
+      Service.LOGIN_CODE_PURPOSE_VALUE
+    );
+  }
+
   public async findActiveSessionByRefreshToken(
     refreshToken: string,
   ): Promise<Model | null> {
@@ -146,79 +188,111 @@ export class Service extends DatabaseService<Model> {
     const refreshTokenExpiresAt: Date =
       options.refreshTokenExpiresAt || Service.getRefreshTokenExpiry();
 
-    const updatePayload: Partial<Model> = {
-      refreshToken: HashedString.fromString(refreshToken),
-      refreshTokenExpiresAt: refreshTokenExpiresAt,
-      lastActiveAt: OneUptimeDate.getCurrentDate(),
-      isRevoked: false,
-    };
+    const updatePayload: Partial<Model> = this.buildRenewalUpdatePayload({
+      options,
+      refreshToken,
+      refreshTokenExpiresAt,
+    });
 
-    const ipAddress: string | undefined = Text.truncate(
-      options.ipAddress,
-      Service.SHORT_TEXT_LIMIT,
-    );
+    const updatedSession: Model | null = await this.updateOneByIdAndFetch({
+      id: options.session.id!,
+      data: updatePayload as any,
+      props: {
+        isRoot: true,
+      },
+    });
 
-    if (ipAddress) {
-      updatePayload.ipAddress = ipAddress;
+    if (!updatedSession) {
+      throw new BadDataException("Unable to renew status page user session");
     }
 
-    if (options.userAgent) {
-      updatePayload.userAgent = options.userAgent;
-    }
+    return {
+      session: updatedSession,
+      refreshToken,
+      refreshTokenExpiresAt,
+    };
+  }
 
-    const deviceName: string | undefined = Text.truncate(
-      options.deviceName,
-      Service.SHORT_TEXT_LIMIT,
-    );
-    if (deviceName) {
-      updatePayload.deviceName = deviceName;
+  /**
+   * Atomically consume the short-lived login code and replace it with the
+   * long-lived refresh credential that is delivered only as an HttpOnly
+   * cookie. The refresh-token column is unique and included in the UPDATE
+   * predicate, so concurrent redemption attempts cannot both succeed.
+   */
+  public async exchangeLoginCode(
+    loginCode: string,
+    options: ExchangeLoginCodeOptions,
+  ): Promise<SessionMetadata | null> {
+    if (!ObjectID.isValidUUID(loginCode)) {
+      return null;
     }
 
-    const deviceType: string | undefined = Text.truncate(
-      options.deviceType,
-      Service.SHORT_TEXT_LIMIT,
-    );
-    if (deviceType) {
-      updatePayload.deviceType = deviceType;
+    const session: Model | null =
+      await this.findActiveSessionByRefreshToken(loginCode);
+
+    if (
+      !session?.id ||
+      !session.statusPageId ||
+      !this.isLoginCodeSession(session) ||
+      session.statusPageId.toString() !== options.statusPageId.toString()
+    ) {
+      return null;
     }
 
-    const deviceOS: string | undefined = Text.truncate(
-      options.deviceOS,
-      Service.SHORT_TEXT_LIMIT,
+    const refreshToken: string = Service.generateRefreshToken();
+    const refreshTokenExpiresAt: Date = Service.getRefreshTokenExpiry();
+    const renewalOptions: RenewSessionOptions = {
+      session,
+      ipAddress: options.ipAddress,
+      userAgent: options.userAgent,
+      deviceName: options.deviceName,
+      deviceType: options.deviceType,
+      deviceOS: options.deviceOS,
+      deviceBrowser: options.deviceBrowser,
+      additionalInfo: options.additionalInfo,
+    };
+    const updatePayload: Partial<Model> = this.buildRenewalUpdatePayload({
+      options: renewalOptions,
+      refreshToken,
+      refreshTokenExpiresAt,
+    });
+    const refreshTokenHash: string = await HashedString.hashValue(
+      refreshToken,
+      EncryptionSecret,
+    );
+    updatePayload.refreshToken = new HashedString(refreshTokenHash, true);
+    const additionalInfo: JSONObject = {
+      ...(updatePayload.additionalInfo || {}),
+    } as JSONObject;
+    delete additionalInfo[Service.LOGIN_CODE_PURPOSE_KEY];
+    updatePayload.additionalInfo = additionalInfo;
+    const loginCodeHash: string = await HashedString.hashValue(
+      loginCode,
+      EncryptionSecret,
     );
-    if (deviceOS) {
-      updatePayload.deviceOS = deviceOS;
-    }
 
-    const deviceBrowser: string | undefined = Text.truncate(
-      options.deviceBrowser,
-      Service.SHORT_TEXT_LIMIT,
+    const updateResult: UpdateResult = await this.getRepository().update(
+      {
+        _id: session._id!,
+        statusPageId: options.statusPageId,
+        refreshToken: new HashedString(loginCodeHash, true),
+        refreshTokenExpiresAt: MoreThan(OneUptimeDate.getCurrentDate()),
+        isRevoked: false,
+        additionalInfo: JsonContains({
+          [Service.LOGIN_CODE_PURPOSE_KEY]: Service.LOGIN_CODE_PURPOSE_VALUE,
+        }),
+      } as any,
+      updatePayload as any,
     );
-    if (deviceBrowser) {
-      updatePayload.deviceBrowser = deviceBrowser;
-    }
 
-    if (options.additionalInfo || options.session.additionalInfo) {
-      updatePayload.additionalInfo = {
-        ...(options.session.additionalInfo || {}),
-        ...(options.additionalInfo || {}),
-      } as JSONObject;
+    if (updateResult.affected !== 1) {
+      return null;
     }
 
-    const updatedSession: Model | null = await this.updateOneByIdAndFetch({
-      id: options.session.id!,
-      data: updatePayload as any,
-      props: {
-        isRoot: true,
-      },
-    });
-
-    if (!updatedSession) {
-      throw new BadDataException("Unable to renew status page user session");
-    }
+    Object.assign(session, updatePayload);
 
     return {
-      session: updatedSession,
+      session,
       refreshToken,
       refreshTokenExpiresAt,
     };
@@ -354,6 +428,73 @@ export class Service extends DatabaseService<Model> {
     return session;
   }
 
+  private buildRenewalUpdatePayload(data: {
+    options: RenewSessionOptions;
+    refreshToken: string;
+    refreshTokenExpiresAt: Date;
+  }): Partial<Model> {
+    const updatePayload: Partial<Model> = {
+      refreshToken: HashedString.fromString(data.refreshToken),
+      refreshTokenExpiresAt: data.refreshTokenExpiresAt,
+      lastActiveAt: OneUptimeDate.getCurrentDate(),
+      isRevoked: false,
+    };
+
+    const ipAddress: string | undefined = Text.truncate(
+      data.options.ipAddress,
+      Service.SHORT_TEXT_LIMIT,
+    );
+
+    if (ipAddress) {
+      updatePayload.ipAddress = ipAddress;
+    }
+
+    if (data.options.userAgent) {
+      updatePayload.userAgent = data.options.userAgent;
+    }
+
+    const deviceName: string | undefined = Text.truncate(
+      data.options.deviceName,
+      Service.SHORT_TEXT_LIMIT,
+    );
+    if (deviceName) {
+      updatePayload.deviceName = deviceName;
+    }
+
+    const deviceType: string | undefined = Text.truncate(
+      data.options.deviceType,
+      Service.SHORT_TEXT_LIMIT,
+    );
+    if (deviceType) {
+      updatePayload.deviceType = deviceType;
+    }
+
+    const deviceOS: string | undefined = Text.truncate(
+      data.options.deviceOS,
+      Service.SHORT_TEXT_LIMIT,
+    );
+    if (deviceOS) {
+      updatePayload.deviceOS = deviceOS;
+    }
+
+    const deviceBrowser: string | undefined = Text.truncate(
+      data.options.deviceBrowser,
+      Service.SHORT_TEXT_LIMIT,
+    );
+    if (deviceBrowser) {
+      updatePayload.deviceBrowser = deviceBrowser;
+    }
+
+    if (data.options.additionalInfo || data.options.session.additionalInfo) {
+      updatePayload.additionalInfo = {
+        ...(data.options.session.additionalInfo || {}),
+        ...(data.options.additionalInfo || {}),
+      } as JSONObject;
+    }
+
+    return updatePayload;
+  }
+
   private static generateRefreshToken(): string {
     return ObjectID.generate().toString();
   }

package/Server/Types/Domain.ts

@@ -11,6 +11,13 @@ import URL from "../../Types/API/URL";
 import API from "../../Utils/API";
 import DataSourceEgressGuard from "../Utils/DataSource/EgressGuard";
 
+/*
+ * A status page that is up answers the verification path well inside this.
+ * It is a ceiling on how long one unreachable domain may hold up the rest of a
+ * certificate run, not a latency target.
+ */
+export const DOMAIN_VERIFICATION_TIMEOUT_IN_MS: number = 10000;
+
 export default class Domain extends DomainCommon {
   /*
    * GET a domain-verification URL built from a tenant-supplied domain.
@@ -26,6 +33,15 @@ export default class Domain extends DomainCommon {
    *
    * Private ranges stay reachable on self-hosted installs, where a status page
    * domain legitimately resolves inside the corporate network.
+   *
+   * The call is bounded. A customer domain that has been pointed at an address
+   * which silently drops packets - a decommissioned load balancer, a firewall
+   * that blackholes instead of refusing - never answers and never resets, so an
+   * unbounded request sits until the kernel gives up on the TCP connect, which
+   * is a little over two minutes on Linux. The certificate crons walk every
+   * status page domain in turn, so each such domain would burn that timeout out
+   * of the run's budget and push the domains behind it into the next run - the
+   * renewals that matter get starved by the domains that will never answer.
    */
   @CaptureSpan()
   public static async getForDomainVerification(data: {
@@ -41,6 +57,7 @@ export default class Domain extends DomainCommon {
       url: URL.fromString(data.url),
       options: {
         doNotFollowRedirects: true,
+        timeout: DOMAIN_VERIFICATION_TIMEOUT_IN_MS,
         httpAgent,
         httpsAgent,
       },

package/Server/Utils/APIKey/AccessPermission.ts

@@ -10,6 +10,28 @@ import ApiKeyPermissionService, {
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import UserPermissionUtil from "../UserPermission/UserPermission";
 
+/*
+ * Permission.AuthenticatedRequest is a marker, not a capability. It says "some
+ * authenticated principal made this call" - its own definition names API keys
+ * first - and unlike every other entry in these lists it has no PermissionProps,
+ * so it never appears in the admin picker and nobody can grant or revoke it per
+ * key. File and FileModel are the only models that name it, which is what bounds
+ * what including it here can widen.
+ *
+ * It is in the list because of TenantPermission.isAccessGrantedOnlyByCurrentUser.
+ * That predicate asks whether the ONLY thing letting a caller through a model's
+ * gate is the auto-granted CurrentUser - i.e. whether they are here as nothing
+ * more than some logged-in user - and when it says yes the caller is held to
+ * rows they own, which an API key can never satisfy because it has no userId.
+ * Without AuthenticatedRequest an API key intersects File's create list down to
+ * CurrentUser alone and answers yes to that question, which is simply the wrong
+ * description of a key: it is not a user acting on their own rows.
+ *
+ * On File as it stands today the wrong answer is harmless - File declares no
+ * user column, so the ownership branch returns before it can bite. The grant is
+ * here so that stays a fact about File's schema rather than the only thing
+ * holding API-key file access up.
+ */
 export default class APIKeyAccessPermission {
   @CaptureSpan()
   public static async getDefaultApiGlobalPermission(
@@ -21,6 +43,7 @@ export default class APIKeyAccessPermission {
         Permission.Public,
         Permission.User,
         Permission.CurrentUser,
+        Permission.AuthenticatedRequest,
       ],
       _type: "UserGlobalAccessPermission",
     };
@@ -36,6 +59,7 @@ export default class APIKeyAccessPermission {
         Permission.Public,
         Permission.User,
         Permission.CurrentUser,
+        Permission.AuthenticatedRequest,
         Permission.ProjectOwner,
       ],
       _type: "UserGlobalAccessPermission",