@oneuptime/common 12.0.28 → 12.0.29

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -561,6 +561,8 @@ import { AddTelemetrySourceMap1790000000000 } from "./1790000000000-AddTelemetry
 import { AddSnmpConfigsToNetworkDeviceDiscoveryScan1790000000001 } from "./1790000000001-AddSnmpConfigsToNetworkDeviceDiscoveryScan";
 import { AddSnmpEnabledToNetworkDeviceDiscoveryScan1790003445000 } from "./1790003445000-AddSnmpEnabledToNetworkDeviceDiscoveryScan";
 import { AddResourceActivityFeeds1790100000000 } from "./1790100000000-AddResourceActivityFeeds";
+import { AllowNullMonitorNameOnMonitorTemplate1790200000000 } from "./1790200000000-AllowNullMonitorNameOnMonitorTemplate";
+import { AddCertificateReissueRequestedAtToDomains1790300000000 } from "./1790300000000-AddCertificateReissueRequestedAtToDomains";
 
 export default [
   InitialMigration,
@@ -1126,4 +1128,6 @@ export default [
   AddSnmpConfigsToNetworkDeviceDiscoveryScan1790000000001,
   AddSnmpEnabledToNetworkDeviceDiscoveryScan1790003445000,
   AddResourceActivityFeeds1790100000000,
+  AllowNullMonitorNameOnMonitorTemplate1790200000000,
+  AddCertificateReissueRequestedAtToDomains1790300000000,
 ];

package/Server/Middleware/ProjectAuthorization.ts

@@ -199,7 +199,12 @@ export default class ProjectMiddleware {
         (req as OneUptimeRequest).userType = UserType.API;
 
         /*
-         * TODO: Add API key permissions.
+         * The two halves of an API key's authority. The global half is the
+         * fixed marker set every key carries (see APIKeyAccessPermission); the
+         * per-key grants an administrator actually configured are read from
+         * ApiKeyPermission just below. That second half is what the long-lived
+         * "TODO: Add API key permissions" here was asking for, and it is done -
+         * the TODO outlived the work.
          */
         (req as OneUptimeRequest).userGlobalAccessPermission =
           await APIKeyAccessPermission.getDefaultApiGlobalPermission(tenantId);

package/Server/Services/DashboardDomainService.ts

@@ -20,6 +20,10 @@ import Telemetry, { Span } from "../Utils/Telemetry";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DashboardCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
+import OneUptimeDate from "../../Types/Date";
+import CertificateReissueUtil from "../../Utils/CertificateReissue";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import QueryHelper from "../Types/Database/QueryHelper";
 
 const DASHBOARD_DOMAIN_EGRESS_LABEL: string = "Dashboard domain";
 
@@ -247,6 +251,133 @@ export class Service extends DatabaseService<DashboardDomain> {
     });
   }
 
+  /*
+   * Reissue this domain's Let's Encrypt certificate because a customer asked
+   * for it, rather than because it is close to expiring.
+   *
+   * Every order spends from a Let's Encrypt account that is shared by the
+   * whole installation - including by the cron that keeps everybody else's
+   * certificates alive - so this is throttled to one request per domain per
+   * CertificateReissueUtil.COOLDOWN_IN_HOURS.
+   *
+   * Throws with a customer-readable reason for every refusal, so the API layer
+   * can hand the message straight back without classifying the failure:
+   * BadDataException for a domain that is not eligible at all, and
+   * TooManyRequestsException (429) for one that is simply too soon.
+   */
+  @CaptureSpan()
+  public async reissueCert(domainId: ObjectID): Promise<void> {
+    const now: Date = OneUptimeDate.getCurrentDate();
+
+    const dashboardDomain: DashboardDomain | null = await this.findOneBy({
+      query: {
+        _id: domainId.toString(),
+      },
+      select: {
+        _id: true,
+        fullDomain: true,
+        isCnameVerified: true,
+        isSslOrdered: true,
+        isCustomCertificate: true,
+        certificateReissueRequestedAt: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!dashboardDomain) {
+      throw new BadDataException("Domain not found.");
+    }
+
+    if (!dashboardDomain.fullDomain) {
+      throw new BadDataException(
+        "Unable to reissue certificate because domain is null",
+      );
+    }
+
+    /*
+     * Nothing to reissue: the certificate on a custom-certificate domain is
+     * the one the customer uploaded, and we have no way to obtain another.
+     */
+    if (dashboardDomain.isCustomCertificate) {
+      throw new BadDataException(
+        "This domain uses a certificate you uploaded yourself, so there is no Let's Encrypt certificate to reissue. Please edit this domain and upload a new certificate instead.",
+      );
+    }
+
+    if (!dashboardDomain.isCnameVerified) {
+      throw new BadDataException(
+        "CNAME is not verified. Please verify CNAME first before you reissue the SSL certificate.",
+      );
+    }
+
+    /*
+     * A domain that never ordered a certificate has nothing to reissue - the
+     * dashboard shows "Order Free SSL" for it, which is the correct button.
+     */
+    if (!dashboardDomain.isSslOrdered) {
+      throw new BadDataException(
+        "No SSL certificate has been ordered for this domain yet. Please order one first.",
+      );
+    }
+
+    /*
+     * Claim the cooldown before ordering anything, and claim it by putting the
+     * cooldown condition in the WHERE clause rather than in an `if` above the
+     * write. Two clicks that arrive together both read a row that is not
+     * cooling down; only the write can decide which one of them gets to spend
+     * the CA's allowance.
+     *
+     * The stamp goes down BEFORE the order and is never rolled back on
+     * failure. A rejected order still costs a validation attempt against the
+     * shared account, and a domain whose order fails is exactly the domain
+     * somebody presses again - so a failed attempt has to start the clock the
+     * same way a successful one does.
+     */
+    const claimedRowCount: number = await this.updateOneBy({
+      query: {
+        _id: domainId.toString(),
+        certificateReissueRequestedAt: QueryHelper.lessThanEqualToOrNull(
+          CertificateReissueUtil.getCooldownCutoff(now),
+        ),
+      },
+      data: {
+        certificateReissueRequestedAt: now,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (claimedRowCount === 0) {
+      if (dashboardDomain.certificateReissueRequestedAt) {
+        throw new TooManyRequestsException(
+          CertificateReissueUtil.getCooldownMessage(
+            dashboardDomain.certificateReissueRequestedAt,
+            now,
+          ),
+        );
+      }
+
+      /*
+       * The row matched the cooldown a moment ago and does not now: another
+       * request claimed it in between, or the domain was deleted. Either way
+       * the caller must not order.
+       */
+      throw new BadDataException(
+        "Could not start a certificate reissue for this domain. Please refresh the page and try again.",
+      );
+    }
+
+    logger.debug(
+      "Reissuing SSL certificate for domain: " + dashboardDomain.fullDomain,
+      { fullDomain: dashboardDomain.fullDomain } as LogAttributes,
+    );
+
+    await this.orderCert(dashboardDomain);
+  }
+
   @CaptureSpan()
   public async updateSslProvisioningStatusForAllDomains(): Promise<void> {
     const domains: Array<DashboardDomain> = await this.findBy({

package/Server/Services/LogPipelineProcessorService.ts

@@ -1,10 +1,98 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/LogPipelineProcessor";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import { JSONObject } from "../../Types/JSON";
+import { validateLogPipelineProcessor } from "../Utils/LogPipelineProcessorValidation";
+
+/*
+ * `PartialEntity` values may be `() => string` raw SQL expressions rather
+ * than literals. One cannot be evaluated here, so an update that sets a
+ * validated field to an expression is skipped - validating a stringified
+ * function would be worse than not validating at all. Nothing in the
+ * product writes processor fields this way.
+ */
+function isSqlExpressionValue(value: unknown): boolean {
+  return typeof value === "function";
+}
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    validateLogPipelineProcessor({
+      processorType: createBy.data.processorType,
+      configuration: createBy.data.configuration as JSONObject | undefined,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * An edit can break a row without naming both fields: switching
+     * `processorType` to GrokParser while the stored configuration is
+     * still a severity-remapper blob, or replacing the pattern on a row
+     * that is already a GrokParser. So validate the MERGED row.
+     *
+     * Only pay for the SELECT when the update touches one of them.
+     * Processor edits are rare, human-driven config changes - this is
+     * not a hot path.
+     */
+    const incomingProcessorType: unknown = updateBy.data.processorType;
+    const incomingConfiguration: unknown = updateBy.data.configuration;
+
+    if (
+      incomingProcessorType === undefined &&
+      incomingConfiguration === undefined
+    ) {
+      return { updateBy, carryForward: null };
+    }
+
+    if (
+      isSqlExpressionValue(incomingProcessorType) ||
+      isSqlExpressionValue(incomingConfiguration)
+    ) {
+      return { updateBy, carryForward: null };
+    }
+
+    const existingRows: Array<Model> = await this.findBy({
+      query: updateBy.query,
+      skip: 0,
+      limit: LIMIT_MAX,
+      select: {
+        _id: true,
+        processorType: true,
+        configuration: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const existing of existingRows) {
+      validateLogPipelineProcessor({
+        processorType:
+          incomingProcessorType !== undefined
+            ? (incomingProcessorType as string | null)
+            : existing.processorType,
+        configuration:
+          incomingConfiguration !== undefined
+            ? (incomingConfiguration as JSONObject | string | null)
+            : (existing.configuration as JSONObject | undefined),
+      });
+    }
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();

package/Server/Services/MonitorTemplateService.ts

@@ -6,6 +6,7 @@ import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import MonitorStepsProjectValidator from "../Utils/Monitor/MonitorStepsProjectValidator";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
+import Includes from "../../Types/BaseDatabase/Includes";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import { JSONObject } from "../../Types/JSON";
 import MonitorSteps from "../../Types/Monitor/MonitorSteps";
@@ -275,7 +276,7 @@ export class Service extends DatabaseService<Model> {
             monitorSteps: true,
             autoProvisionedNetworkDeviceId: true,
           },
-          sort: { createdAt: SortOrder.Ascending },
+          sort: { createdAt: SortOrder.Ascending, _id: SortOrder.Ascending },
           limit: LIMIT_MAX,
           skip: skip,
           props: { isRoot: true },
@@ -321,16 +322,74 @@ export class Service extends DatabaseService<Model> {
       return { totalLinkedMonitors, syncedMonitors };
     }
 
-    const syncedMonitors: number = await MonitorService.updateBy({
-      query: {
-        monitorTemplateId: template.id!,
-        projectId: template.projectId,
-      },
-      data: updateData as any,
-      limit: LIMIT_MAX,
-      skip: 0,
-      props: data.props,
-    });
+    /*
+     * A single updateBy is capped at its `limit`, so a template with more
+     * linked monitors than LIMIT_MAX used to leave the remainder on the old
+     * config and still return success. Offset paging cannot fix that here:
+     * updateBy takes no sort, and rewriting a row moves its tuple, so a
+     * second page at a higher skip can step over rows the first page moved.
+     * Page the ids first instead, then update by id batch.
+     *
+     * `_id` rides along in the sort because skip/limit paging is only stable
+     * over a total order: a fleet provisioned by one auto-import run shares a
+     * createdAt, and without the tiebreaker a tie straddling a page boundary
+     * returns one row twice and another never — which here would inflate
+     * syncedMonitors by exactly the number of rows it dropped.
+     */
+    const linkedMonitorIds: Array<ObjectID> = [];
+
+    for (let skip: number = 0; ; skip += LIMIT_MAX) {
+      const monitors: Array<Monitor> = await MonitorService.findBy({
+        query: {
+          monitorTemplateId: template.id!,
+          projectId: template.projectId,
+        },
+        select: { _id: true },
+        sort: { createdAt: SortOrder.Ascending, _id: SortOrder.Ascending },
+        limit: LIMIT_MAX,
+        skip: skip,
+        props: { isRoot: true },
+      });
+
+      for (const monitor of monitors) {
+        linkedMonitorIds.push(monitor.id!);
+      }
+
+      if (monitors.length < LIMIT_MAX) {
+        break;
+      }
+    }
+
+    let syncedMonitors: number = 0;
+
+    for (
+      let batchStart: number = 0;
+      batchStart < linkedMonitorIds.length;
+      batchStart += LIMIT_MAX
+    ) {
+      const batch: Array<ObjectID> = linkedMonitorIds.slice(
+        batchStart,
+        batchStart + LIMIT_MAX,
+      );
+
+      /*
+       * Still scoped by template and project, so a stale id from the paging
+       * read above cannot widen the write beyond this template's fleet.
+       * props stays the caller's — updateBy narrows each batch to what they
+       * may actually update.
+       */
+      syncedMonitors += await MonitorService.updateBy({
+        query: {
+          _id: new Includes(batch),
+          monitorTemplateId: template.id!,
+          projectId: template.projectId,
+        },
+        data: updateData as any,
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: data.props,
+      });
+    }
 
     return {
       totalLinkedMonitors,

package/Server/Services/StatusPageDomainService.ts

@@ -20,10 +20,24 @@ import Telemetry, { Span } from "../Utils/Telemetry";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { StatusPageCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
+import ArrayUtil from "../../Utils/Array";
+import OneUptimeDate from "../../Types/Date";
+import CertificateReissueUtil from "../../Utils/CertificateReissue";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import QueryHelper from "../Types/Database/QueryHelper";
 
 const STATUS_PAGE_DOMAIN_EGRESS_LABEL: string = "Status page domain";
 
 export class Service extends DatabaseService<StatusPageDomain> {
+  /*
+   * How many status pages the provisioning sweep checks at once. Each check is
+   * one bounded request out to a customer domain, so this is about not letting
+   * the sweep's length grow with the size of the fleet, rather than about local
+   * work. Kept modest so a sweep cannot look like a burst of traffic to any
+   * shared infrastructure sitting in front of those domains.
+   */
+  public static readonly SSL_PROVISIONING_CHECK_CONCURRENCY: number = 10;
+
   public constructor() {
     super(StatusPageDomain);
   }
@@ -248,6 +262,133 @@ export class Service extends DatabaseService<StatusPageDomain> {
     });
   }
 
+  /*
+   * Reissue this domain's Let's Encrypt certificate because a customer asked
+   * for it, rather than because it is close to expiring.
+   *
+   * Every order spends from a Let's Encrypt account that is shared by the
+   * whole installation - including by the cron that keeps everybody else's
+   * certificates alive - so this is throttled to one request per domain per
+   * CertificateReissueUtil.COOLDOWN_IN_HOURS.
+   *
+   * Throws with a customer-readable reason for every refusal, so the API layer
+   * can hand the message straight back without classifying the failure:
+   * BadDataException for a domain that is not eligible at all, and
+   * TooManyRequestsException (429) for one that is simply too soon.
+   */
+  @CaptureSpan()
+  public async reissueCert(domainId: ObjectID): Promise<void> {
+    const now: Date = OneUptimeDate.getCurrentDate();
+
+    const statusPageDomain: StatusPageDomain | null = await this.findOneBy({
+      query: {
+        _id: domainId.toString(),
+      },
+      select: {
+        _id: true,
+        fullDomain: true,
+        isCnameVerified: true,
+        isSslOrdered: true,
+        isCustomCertificate: true,
+        certificateReissueRequestedAt: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!statusPageDomain) {
+      throw new BadDataException("Domain not found.");
+    }
+
+    if (!statusPageDomain.fullDomain) {
+      throw new BadDataException(
+        "Unable to reissue certificate because domain is null",
+      );
+    }
+
+    /*
+     * Nothing to reissue: the certificate on a custom-certificate domain is
+     * the one the customer uploaded, and we have no way to obtain another.
+     */
+    if (statusPageDomain.isCustomCertificate) {
+      throw new BadDataException(
+        "This domain uses a certificate you uploaded yourself, so there is no Let's Encrypt certificate to reissue. Please edit this domain and upload a new certificate instead.",
+      );
+    }
+
+    if (!statusPageDomain.isCnameVerified) {
+      throw new BadDataException(
+        "CNAME is not verified. Please verify CNAME first before you reissue the SSL certificate.",
+      );
+    }
+
+    /*
+     * A domain that never ordered a certificate has nothing to reissue - the
+     * dashboard shows "Order Free SSL" for it, which is the correct button.
+     */
+    if (!statusPageDomain.isSslOrdered) {
+      throw new BadDataException(
+        "No SSL certificate has been ordered for this domain yet. Please order one first.",
+      );
+    }
+
+    /*
+     * Claim the cooldown before ordering anything, and claim it by putting the
+     * cooldown condition in the WHERE clause rather than in an `if` above the
+     * write. Two clicks that arrive together both read a row that is not
+     * cooling down; only the write can decide which one of them gets to spend
+     * the CA's allowance.
+     *
+     * The stamp goes down BEFORE the order and is never rolled back on
+     * failure. A rejected order still costs a validation attempt against the
+     * shared account, and a domain whose order fails is exactly the domain
+     * somebody presses again - so a failed attempt has to start the clock the
+     * same way a successful one does.
+     */
+    const claimedRowCount: number = await this.updateOneBy({
+      query: {
+        _id: domainId.toString(),
+        certificateReissueRequestedAt: QueryHelper.lessThanEqualToOrNull(
+          CertificateReissueUtil.getCooldownCutoff(now),
+        ),
+      },
+      data: {
+        certificateReissueRequestedAt: now,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (claimedRowCount === 0) {
+      if (statusPageDomain.certificateReissueRequestedAt) {
+        throw new TooManyRequestsException(
+          CertificateReissueUtil.getCooldownMessage(
+            statusPageDomain.certificateReissueRequestedAt,
+            now,
+          ),
+        );
+      }
+
+      /*
+       * The row matched the cooldown a moment ago and does not now: another
+       * request claimed it in between, or the domain was deleted. Either way
+       * the caller must not order.
+       */
+      throw new BadDataException(
+        "Could not start a certificate reissue for this domain. Please refresh the page and try again.",
+      );
+    }
+
+    logger.debug(
+      "Reissuing SSL certificate for domain: " + statusPageDomain.fullDomain,
+      { fullDomain: statusPageDomain.fullDomain } as LogAttributes,
+    );
+
+    await this.orderCert(statusPageDomain);
+  }
+
   @CaptureSpan()
   public async updateSslProvisioningStatusForAllDomains(): Promise<void> {
     const domains: Array<StatusPageDomain> = await this.findBy({
@@ -257,6 +398,7 @@ export class Service extends DatabaseService<StatusPageDomain> {
       },
       select: {
         _id: true,
+        fullDomain: true,
       },
       limit: LIMIT_MAX,
       skip: 0,
@@ -265,9 +407,27 @@ export class Service extends DatabaseService<StatusPageDomain> {
       },
     });
 
-    for (const domain of domains) {
-      await this.updateSslProvisioningStatus(domain);
-    }
+    /*
+     * Each domain costs a request out to the customer's status page, so walking
+     * the fleet one at a time makes the sweep as long as the fleet is slow.
+     * That length is the delay before an expired certificate is noticed and
+     * reordered, so it is the outage a customer sees when renewal has not
+     * already happened - it must stay well inside the sweep's own interval.
+     */
+    await ArrayUtil.forEachWithConcurrency(
+      domains,
+      Service.SSL_PROVISIONING_CHECK_CONCURRENCY,
+      async (domain: StatusPageDomain): Promise<void> => {
+        try {
+          await this.updateSslProvisioningStatus(domain);
+        } catch (err) {
+          // one unreachable domain must not end the sweep for the rest.
+          logger.error(err, {
+            fullDomain: domain.fullDomain,
+          } as LogAttributes);
+        }
+      },
+    );
   }
 
   private async isSSLProvisioned(