@oneuptime/common 12.0.28 → 12.0.29

package/Server/Services/StatusPagePrivateUserSessionService.ts

@@ -9,6 +9,7 @@ import Text from "../../Types/Text";
 import logger from "../Utils/Logger";
 import Exception from "../../Types/Exception/Exception";
 import BadDataException from "../../Types/Exception/BadDataException";
+import { JsonContains, MoreThan, UpdateResult } from "typeorm";
 
 export interface SessionMetadata {
   session: Model;
@@ -52,8 +53,24 @@ export interface RevokeSessionOptions {
   reason?: string | undefined;
 }
 
+export interface ExchangeLoginCodeOptions {
+  statusPageId: ObjectID;
+  ipAddress?: string | undefined;
+  userAgent?: string | undefined;
+  deviceName?: string | undefined;
+  deviceType?: string | undefined;
+  deviceOS?: string | undefined;
+  deviceBrowser?: string | undefined;
+  additionalInfo?: JSONObject | undefined;
+}
+
+export const STATUS_PAGE_LOGIN_CODE_TTL_MINUTES: number = 5;
+
 export class Service extends DatabaseService<Model> {
   private static readonly DEFAULT_REFRESH_TOKEN_TTL_DAYS: number = 30;
+  private static readonly LOGIN_CODE_PURPOSE_KEY: string =
+    "oneuptimeStatusPageSessionPurpose";
+  private static readonly LOGIN_CODE_PURPOSE_VALUE: string = "login-code";
   private static readonly SHORT_TEXT_LIMIT: number = 100;
 
   public constructor() {
@@ -91,6 +108,31 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  public async createLoginCodeSession(
+    options: Omit<
+      CreateSessionOptions,
+      "refreshToken" | "refreshTokenExpiresAt"
+    >,
+  ): Promise<SessionMetadata> {
+    return await this.createSession({
+      ...options,
+      additionalInfo: {
+        ...(options.additionalInfo || {}),
+        [Service.LOGIN_CODE_PURPOSE_KEY]: Service.LOGIN_CODE_PURPOSE_VALUE,
+      } as JSONObject,
+      refreshTokenExpiresAt: OneUptimeDate.getSomeMinutesAfter(
+        STATUS_PAGE_LOGIN_CODE_TTL_MINUTES,
+      ),
+    });
+  }
+
+  public isLoginCodeSession(session: Model): boolean {
+    return (
+      session.additionalInfo?.[Service.LOGIN_CODE_PURPOSE_KEY] ===
+      Service.LOGIN_CODE_PURPOSE_VALUE
+    );
+  }
+
   public async findActiveSessionByRefreshToken(
     refreshToken: string,
   ): Promise<Model | null> {
@@ -146,79 +188,111 @@ export class Service extends DatabaseService<Model> {
     const refreshTokenExpiresAt: Date =
       options.refreshTokenExpiresAt || Service.getRefreshTokenExpiry();
 
-    const updatePayload: Partial<Model> = {
-      refreshToken: HashedString.fromString(refreshToken),
-      refreshTokenExpiresAt: refreshTokenExpiresAt,
-      lastActiveAt: OneUptimeDate.getCurrentDate(),
-      isRevoked: false,
-    };
+    const updatePayload: Partial<Model> = this.buildRenewalUpdatePayload({
+      options,
+      refreshToken,
+      refreshTokenExpiresAt,
+    });
 
-    const ipAddress: string | undefined = Text.truncate(
-      options.ipAddress,
-      Service.SHORT_TEXT_LIMIT,
-    );
+    const updatedSession: Model | null = await this.updateOneByIdAndFetch({
+      id: options.session.id!,
+      data: updatePayload as any,
+      props: {
+        isRoot: true,
+      },
+    });
 
-    if (ipAddress) {
-      updatePayload.ipAddress = ipAddress;
+    if (!updatedSession) {
+      throw new BadDataException("Unable to renew status page user session");
     }
 
-    if (options.userAgent) {
-      updatePayload.userAgent = options.userAgent;
-    }
+    return {
+      session: updatedSession,
+      refreshToken,
+      refreshTokenExpiresAt,
+    };
+  }
 
-    const deviceName: string | undefined = Text.truncate(
-      options.deviceName,
-      Service.SHORT_TEXT_LIMIT,
-    );
-    if (deviceName) {
-      updatePayload.deviceName = deviceName;
+  /**
+   * Atomically consume the short-lived login code and replace it with the
+   * long-lived refresh credential that is delivered only as an HttpOnly
+   * cookie. The refresh-token column is unique and included in the UPDATE
+   * predicate, so concurrent redemption attempts cannot both succeed.
+   */
+  public async exchangeLoginCode(
+    loginCode: string,
+    options: ExchangeLoginCodeOptions,
+  ): Promise<SessionMetadata | null> {
+    if (!ObjectID.isValidUUID(loginCode)) {
+      return null;
     }
 
-    const deviceType: string | undefined = Text.truncate(
-      options.deviceType,
-      Service.SHORT_TEXT_LIMIT,
-    );
-    if (deviceType) {
-      updatePayload.deviceType = deviceType;
+    const session: Model | null =
+      await this.findActiveSessionByRefreshToken(loginCode);
+
+    if (
+      !session?.id ||
+      !session.statusPageId ||
+      !this.isLoginCodeSession(session) ||
+      session.statusPageId.toString() !== options.statusPageId.toString()
+    ) {
+      return null;
     }
 
-    const deviceOS: string | undefined = Text.truncate(
-      options.deviceOS,
-      Service.SHORT_TEXT_LIMIT,
+    const refreshToken: string = Service.generateRefreshToken();
+    const refreshTokenExpiresAt: Date = Service.getRefreshTokenExpiry();
+    const renewalOptions: RenewSessionOptions = {
+      session,
+      ipAddress: options.ipAddress,
+      userAgent: options.userAgent,
+      deviceName: options.deviceName,
+      deviceType: options.deviceType,
+      deviceOS: options.deviceOS,
+      deviceBrowser: options.deviceBrowser,
+      additionalInfo: options.additionalInfo,
+    };
+    const updatePayload: Partial<Model> = this.buildRenewalUpdatePayload({
+      options: renewalOptions,
+      refreshToken,
+      refreshTokenExpiresAt,
+    });
+    const refreshTokenHash: string = await HashedString.hashValue(
+      refreshToken,
+      EncryptionSecret,
+    );
+    updatePayload.refreshToken = new HashedString(refreshTokenHash, true);
+    const additionalInfo: JSONObject = {
+      ...(updatePayload.additionalInfo || {}),
+    } as JSONObject;
+    delete additionalInfo[Service.LOGIN_CODE_PURPOSE_KEY];
+    updatePayload.additionalInfo = additionalInfo;
+    const loginCodeHash: string = await HashedString.hashValue(
+      loginCode,
+      EncryptionSecret,
     );
-    if (deviceOS) {
-      updatePayload.deviceOS = deviceOS;
-    }
 
-    const deviceBrowser: string | undefined = Text.truncate(
-      options.deviceBrowser,
-      Service.SHORT_TEXT_LIMIT,
+    const updateResult: UpdateResult = await this.getRepository().update(
+      {
+        _id: session._id!,
+        statusPageId: options.statusPageId,
+        refreshToken: new HashedString(loginCodeHash, true),
+        refreshTokenExpiresAt: MoreThan(OneUptimeDate.getCurrentDate()),
+        isRevoked: false,
+        additionalInfo: JsonContains({
+          [Service.LOGIN_CODE_PURPOSE_KEY]: Service.LOGIN_CODE_PURPOSE_VALUE,
+        }),
+      } as any,
+      updatePayload as any,
     );
-    if (deviceBrowser) {
-      updatePayload.deviceBrowser = deviceBrowser;
-    }
 
-    if (options.additionalInfo || options.session.additionalInfo) {
-      updatePayload.additionalInfo = {
-        ...(options.session.additionalInfo || {}),
-        ...(options.additionalInfo || {}),
-      } as JSONObject;
+    if (updateResult.affected !== 1) {
+      return null;
     }
 
-    const updatedSession: Model | null = await this.updateOneByIdAndFetch({
-      id: options.session.id!,
-      data: updatePayload as any,
-      props: {
-        isRoot: true,
-      },
-    });
-
-    if (!updatedSession) {
-      throw new BadDataException("Unable to renew status page user session");
-    }
+    Object.assign(session, updatePayload);
 
     return {
-      session: updatedSession,
+      session,
       refreshToken,
       refreshTokenExpiresAt,
     };
@@ -354,6 +428,73 @@ export class Service extends DatabaseService<Model> {
     return session;
   }
 
+  private buildRenewalUpdatePayload(data: {
+    options: RenewSessionOptions;
+    refreshToken: string;
+    refreshTokenExpiresAt: Date;
+  }): Partial<Model> {
+    const updatePayload: Partial<Model> = {
+      refreshToken: HashedString.fromString(data.refreshToken),
+      refreshTokenExpiresAt: data.refreshTokenExpiresAt,
+      lastActiveAt: OneUptimeDate.getCurrentDate(),
+      isRevoked: false,
+    };
+
+    const ipAddress: string | undefined = Text.truncate(
+      data.options.ipAddress,
+      Service.SHORT_TEXT_LIMIT,
+    );
+
+    if (ipAddress) {
+      updatePayload.ipAddress = ipAddress;
+    }
+
+    if (data.options.userAgent) {
+      updatePayload.userAgent = data.options.userAgent;
+    }
+
+    const deviceName: string | undefined = Text.truncate(
+      data.options.deviceName,
+      Service.SHORT_TEXT_LIMIT,
+    );
+    if (deviceName) {
+      updatePayload.deviceName = deviceName;
+    }
+
+    const deviceType: string | undefined = Text.truncate(
+      data.options.deviceType,
+      Service.SHORT_TEXT_LIMIT,
+    );
+    if (deviceType) {
+      updatePayload.deviceType = deviceType;
+    }
+
+    const deviceOS: string | undefined = Text.truncate(
+      data.options.deviceOS,
+      Service.SHORT_TEXT_LIMIT,
+    );
+    if (deviceOS) {
+      updatePayload.deviceOS = deviceOS;
+    }
+
+    const deviceBrowser: string | undefined = Text.truncate(
+      data.options.deviceBrowser,
+      Service.SHORT_TEXT_LIMIT,
+    );
+    if (deviceBrowser) {
+      updatePayload.deviceBrowser = deviceBrowser;
+    }
+
+    if (data.options.additionalInfo || data.options.session.additionalInfo) {
+      updatePayload.additionalInfo = {
+        ...(data.options.session.additionalInfo || {}),
+        ...(data.options.additionalInfo || {}),
+      } as JSONObject;
+    }
+
+    return updatePayload;
+  }
+
   private static generateRefreshToken(): string {
     return ObjectID.generate().toString();
   }

package/Server/Types/Domain.ts

@@ -11,6 +11,13 @@ import URL from "../../Types/API/URL";
 import API from "../../Utils/API";
 import DataSourceEgressGuard from "../Utils/DataSource/EgressGuard";
 
+/*
+ * A status page that is up answers the verification path well inside this.
+ * It is a ceiling on how long one unreachable domain may hold up the rest of a
+ * certificate run, not a latency target.
+ */
+export const DOMAIN_VERIFICATION_TIMEOUT_IN_MS: number = 10000;
+
 export default class Domain extends DomainCommon {
   /*
    * GET a domain-verification URL built from a tenant-supplied domain.
@@ -26,6 +33,15 @@ export default class Domain extends DomainCommon {
    *
    * Private ranges stay reachable on self-hosted installs, where a status page
    * domain legitimately resolves inside the corporate network.
+   *
+   * The call is bounded. A customer domain that has been pointed at an address
+   * which silently drops packets - a decommissioned load balancer, a firewall
+   * that blackholes instead of refusing - never answers and never resets, so an
+   * unbounded request sits until the kernel gives up on the TCP connect, which
+   * is a little over two minutes on Linux. The certificate crons walk every
+   * status page domain in turn, so each such domain would burn that timeout out
+   * of the run's budget and push the domains behind it into the next run - the
+   * renewals that matter get starved by the domains that will never answer.
    */
   @CaptureSpan()
   public static async getForDomainVerification(data: {
@@ -41,6 +57,7 @@ export default class Domain extends DomainCommon {
       url: URL.fromString(data.url),
       options: {
         doNotFollowRedirects: true,
+        timeout: DOMAIN_VERIFICATION_TIMEOUT_IN_MS,
         httpAgent,
         httpsAgent,
       },

package/Server/Utils/APIKey/AccessPermission.ts

@@ -10,6 +10,28 @@ import ApiKeyPermissionService, {
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import UserPermissionUtil from "../UserPermission/UserPermission";
 
+/*
+ * Permission.AuthenticatedRequest is a marker, not a capability. It says "some
+ * authenticated principal made this call" - its own definition names API keys
+ * first - and unlike every other entry in these lists it has no PermissionProps,
+ * so it never appears in the admin picker and nobody can grant or revoke it per
+ * key. File and FileModel are the only models that name it, which is what bounds
+ * what including it here can widen.
+ *
+ * It is in the list because of TenantPermission.isAccessGrantedOnlyByCurrentUser.
+ * That predicate asks whether the ONLY thing letting a caller through a model's
+ * gate is the auto-granted CurrentUser - i.e. whether they are here as nothing
+ * more than some logged-in user - and when it says yes the caller is held to
+ * rows they own, which an API key can never satisfy because it has no userId.
+ * Without AuthenticatedRequest an API key intersects File's create list down to
+ * CurrentUser alone and answers yes to that question, which is simply the wrong
+ * description of a key: it is not a user acting on their own rows.
+ *
+ * On File as it stands today the wrong answer is harmless - File declares no
+ * user column, so the ownership branch returns before it can bite. The grant is
+ * here so that stays a fact about File's schema rather than the only thing
+ * holding API-key file access up.
+ */
 export default class APIKeyAccessPermission {
   @CaptureSpan()
   public static async getDefaultApiGlobalPermission(
@@ -21,6 +43,7 @@ export default class APIKeyAccessPermission {
         Permission.Public,
         Permission.User,
         Permission.CurrentUser,
+        Permission.AuthenticatedRequest,
       ],
       _type: "UserGlobalAccessPermission",
     };
@@ -36,6 +59,7 @@ export default class APIKeyAccessPermission {
         Permission.Public,
         Permission.User,
         Permission.CurrentUser,
+        Permission.AuthenticatedRequest,
         Permission.ProjectOwner,
       ],
       _type: "UserGlobalAccessPermission",

package/Server/Utils/Greenlock/Greenlock.ts

@@ -16,11 +16,64 @@ import ServerException from "../../../Types/Exception/ServerException";
 import Text from "../../../Types/Text";
 import AcmeCertificate from "../../../Models/DatabaseModels/AcmeCertificate";
 import AcmeChallenge from "../../../Models/DatabaseModels/AcmeChallenge";
+import ArrayUtil from "../../../Utils/Array";
 import acme from "acme-client";
 import { Challenge } from "acme-client/types/rfc8555";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 
 export default class GreenlockUtil {
+  /*
+   * How early a certificate is renewed, as a range rather than a single value.
+   *
+   * Let's Encrypt issues for 90 days, so every domain ordered on the same day
+   * expires on the same day. Renewing them all at one fixed lead time keeps
+   * that batch together for every cycle that follows, and a single bad day -
+   * an upstream outage, a rate limit, a run that does not finish - then expires
+   * the whole batch at once instead of one domain.
+   *
+   * Spreading the lead time across a range pulls the batch apart: domains that
+   * expire on the same day come due days apart, and having been renewed days
+   * apart they expire days apart next cycle too. The offset is derived from the
+   * domain name so it is stable - a domain must not drift in and out of
+   * eligibility between two runs, which would leave it renewed by neither.
+   */
+  public static readonly RENEW_LEAD_TIME_MAX_IN_DAYS: number = 40;
+  public static readonly RENEW_LEAD_TIME_MIN_IN_DAYS: number = 25;
+
+  /*
+   * A run renews at most this many domains, at most this many at a time.
+   *
+   * Both bound how much of a backlog is dispatched at once. Let's Encrypt
+   * allows 300 new orders per account per three hours, and the reactive
+   * provisioning sweep spends from the same allowance, so a run that tried to
+   * clear a large backlog in one pass would spend the account's budget and get
+   * the renewals behind it refused. At the schedule this job runs on the cap
+   * still clears far more per day than one sequential daily pass ever did,
+   * while leaving room under the limit.
+   */
+  public static readonly RENEW_MAX_PER_RUN: number = 10;
+  public static readonly RENEW_CONCURRENCY: number = 5;
+
+  /*
+   * Stable per-domain lead time, somewhere in the range above. Same domain,
+   * same answer, on every run and every replica.
+   */
+  public static getRenewalLeadTimeInDays(domain: string): number {
+    const spanInDays: number =
+      GreenlockUtil.RENEW_LEAD_TIME_MAX_IN_DAYS -
+      GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS;
+
+    let hash: number = 0;
+
+    for (let i: number = 0; i < domain.length; i++) {
+      hash = (hash * 31 + domain.charCodeAt(i)) % 1000003;
+    }
+
+    return (
+      GreenlockUtil.RENEW_LEAD_TIME_MIN_IN_DAYS + (hash % (spanInDays + 1))
+    );
+  }
+
   @CaptureSpan()
   public static async renewAllCertsWhichAreExpiringSoon(data: {
     validateCname: (domain: string) => Promise<boolean>;
@@ -29,15 +82,17 @@ export default class GreenlockUtil {
     try {
       logger.debug("Renewing all certificates");
 
-      // get all certificates which are expiring soon
-
+      /*
+       * Read the widest window any domain's lead time can make it due in, then
+       * keep only the domains whose own lead time has actually been reached.
+       */
       const certificates: AcmeCertificate[] =
         await AcmeCertificateService.findBy({
           query: {
             expiresAt: QueryHelper.lessThanEqualTo(
               OneUptimeDate.addRemoveDays(
                 OneUptimeDate.getCurrentDate(),
-                40, // 40 days before expiry
+                GreenlockUtil.RENEW_LEAD_TIME_MAX_IN_DAYS,
               ),
             ),
           },
@@ -45,6 +100,7 @@ export default class GreenlockUtil {
           skip: 0,
           select: {
             domain: true,
+            expiresAt: true,
           },
           sort: {
             expiresAt: SortOrder.Ascending,
@@ -54,76 +110,118 @@ export default class GreenlockUtil {
           },
         });
 
+      const now: Date = OneUptimeDate.getCurrentDate();
+
+      const dueCertificates: AcmeCertificate[] = certificates.filter(
+        (certificate: AcmeCertificate) => {
+          if (!certificate.domain || !certificate.expiresAt) {
+            return false;
+          }
+
+          const renewAt: Date = OneUptimeDate.addRemoveDays(
+            certificate.expiresAt,
+            -GreenlockUtil.getRenewalLeadTimeInDays(certificate.domain),
+          );
+
+          return !OneUptimeDate.isAfter(renewAt, now);
+        },
+      );
+
+      /*
+       * Still sorted by expiry, so a run that cannot take the whole backlog
+       * spends itself on the domains closest to expiring and leaves the rest -
+       * which by construction still have weeks of lead time - to the next run.
+       */
+      const batch: AcmeCertificate[] = dueCertificates.slice(
+        0,
+        GreenlockUtil.RENEW_MAX_PER_RUN,
+      );
+
       logger.debug(
-        `Found ${certificates.length} certificates which are expiring soon`,
-        { certificateCount: certificates.length },
+        `Found ${dueCertificates.length} certificates due for renewal, renewing ${batch.length} in this run`,
+        {
+          dueCount: dueCertificates.length,
+          batchCount: batch.length,
+        },
+      );
+
+      await ArrayUtil.forEachWithConcurrency(
+        batch,
+        GreenlockUtil.RENEW_CONCURRENCY,
+        async (certificate: AcmeCertificate): Promise<void> => {
+          await GreenlockUtil.renewCertForDomain({
+            domain: certificate.domain as string,
+            validateCname: data.validateCname,
+            notifyDomainRemoved: data.notifyDomainRemoved,
+          });
+        },
       );
+    } catch (e) {
+      logger.error("Error renewing all certificates");
+      logger.error(e);
 
-      // order certificate for each domain
+      throw e;
+    }
+  }
 
-      for (const certificate of certificates) {
-        if (!certificate.domain) {
-          continue;
-        }
+  /*
+   * Renew one domain. Never throws: one domain that cannot be renewed - a CNAME
+   * that no longer points here, a challenge the CA would not accept - must not
+   * take down the rest of the run with it.
+   */
+  private static async renewCertForDomain(data: {
+    domain: string;
+    validateCname: (domain: string) => Promise<boolean>;
+    notifyDomainRemoved: (domain: string) => Promise<void>;
+  }): Promise<void> {
+    const { domain } = data;
+
+    const certLogAttributes: LogAttributes = {
+      domain: domain,
+    };
 
-        const certLogAttributes: LogAttributes = {
-          domain: certificate.domain,
-        };
+    logger.debug(
+      `Renewing certificate for domain: ${domain}`,
+      certLogAttributes,
+    );
 
+    try {
+      //validate cname
+      const isValidCname: boolean = await data.validateCname(domain);
+
+      if (!isValidCname) {
         logger.debug(
-          `Renewing certificate for domain: ${certificate.domain}`,
+          `CNAME is not valid for domain: ${domain}`,
           certLogAttributes,
         );
 
-        try {
-          //validate cname
-          const isValidCname: boolean = await data.validateCname(
-            certificate.domain,
-          );
-
-          if (!isValidCname) {
-            logger.debug(
-              `CNAME is not valid for domain: ${certificate.domain}`,
-              certLogAttributes,
-            );
-
-            // if cname is not valid then remove the domain
-            await GreenlockUtil.removeDomain(certificate.domain);
-            await data.notifyDomainRemoved(certificate.domain);
+        // if cname is not valid then remove the domain
+        await GreenlockUtil.removeDomain(domain);
+        await data.notifyDomainRemoved(domain);
 
-            logger.error(
-              `Cname is not valid for domain: ${certificate.domain}`,
-              certLogAttributes,
-            );
-          } else {
-            logger.debug(
-              `CNAME is valid for domain: ${certificate.domain}`,
-              certLogAttributes,
-            );
+        logger.error(
+          `Cname is not valid for domain: ${domain}`,
+          certLogAttributes,
+        );
+      } else {
+        logger.debug(`CNAME is valid for domain: ${domain}`, certLogAttributes);
 
-            await GreenlockUtil.orderCert({
-              domain: certificate.domain,
-              validateCname: data.validateCname,
-            });
+        await GreenlockUtil.orderCert({
+          domain: domain,
+          validateCname: data.validateCname,
+        });
 
-            logger.debug(
-              `Certificate renewed for domain: ${certificate.domain}`,
-              certLogAttributes,
-            );
-          }
-        } catch (e) {
-          logger.error(
-            `Error renewing certificate for domain: ${certificate.domain}`,
-            certLogAttributes,
-          );
-          logger.error(e, certLogAttributes);
-        }
+        logger.debug(
+          `Certificate renewed for domain: ${domain}`,
+          certLogAttributes,
+        );
       }
     } catch (e) {
-      logger.error("Error renewing all certificates");
-      logger.error(e);
-
-      throw e;
+      logger.error(
+        `Error renewing certificate for domain: ${domain}`,
+        certLogAttributes,
+      );
+      logger.error(e, certLogAttributes);
     }
   }