@oneuptime/common 12.0.28 → 12.0.29

package/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller.ts

@@ -16,7 +16,7 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
 import ConnectorErrorMessage from "../ConnectorErrorMessage";
 import { buildSecurityEventDbRow } from "../SecurityEventRow";
 import ThreatIntelEnricher from "../ThreatIntel/ThreatIntelEnricher";
-import GoogleSecOpsClient from "./GoogleSecOpsClient";
+import GoogleSecOpsClient, { FetchAlertsResult } from "./GoogleSecOpsClient";
 
 const SECOPS_SERVICE_NAME: string = "Google SecOps";
 
@@ -31,6 +31,10 @@ const MAX_LOOKBACK_IN_MINUTES: number = 24 * 60;
 /*
  * Overlap between windows so boundary alerts are never missed; the
  * eventUid content hash keeps redelivered alerts deduplicatable.
+ *
+ * Still open (out of scope here): the overlap does produce genuine
+ * duplicate rows, because SecurityEvent is a plain MergeTree with
+ * eventUid outside the sort key, so nothing collapses them at write time.
  */
 const WINDOW_OVERLAP_IN_MINUTES: number = 1;
 
@@ -80,7 +84,18 @@ export default class GoogleSecOpsPoller {
       }
 
       try {
-        await this.pollConnection(connection);
+        const ingested: number = await this.pollConnection(connection);
+
+        /*
+         * The count used to be returned and dropped on the floor, which
+         * left "polling healthy but quiet" and "polling silently broken"
+         * looking identical from outside the process. At info rather than
+         * debug for that reason — a number nobody sees at the default log
+         * level answers the question no better than not having it.
+         */
+        logger.info(
+          `GoogleSecOpsPoller: connection ${connection.id?.toString()} ingested ${ingested} security events.`,
+        );
       } catch (error) {
         logger.error(
           `GoogleSecOpsPoller: error polling connection ${connection.id?.toString()}:`,
@@ -134,6 +149,8 @@ export default class GoogleSecOpsPoller {
       );
     }
 
+    const connectionId: string = connection.id.toString();
+
     const client: GoogleSecOpsClient =
       clientOverride ||
       new GoogleSecOpsClient({
@@ -149,26 +166,96 @@ export default class GoogleSecOpsPoller {
       -MAX_LOOKBACK_IN_MINUTES,
     );
 
-    let startTime: Date = connection.cursor
-      ? OneUptimeDate.addRemoveMinutes(
-          new Date(connection.cursor),
+    const defaultStartTime: Date = OneUptimeDate.addRemoveMinutes(
+      endTime,
+      -DEFAULT_LOOKBACK_IN_MINUTES,
+    );
+
+    let startTime: Date = defaultStartTime;
+
+    if (connection.cursor) {
+      const cursorTime: Date = new Date(connection.cursor);
+
+      if (Number.isNaN(cursorTime.getTime())) {
+        /*
+         * An unreadable cursor used to share a branch with a stale one and
+         * open the full 24 hour window — the widest possible blast radius
+         * for the least trustworthy input. It means "no usable cursor",
+         * which is what a first poll means too.
+         */
+        logger.warn(
+          `GoogleSecOpsPoller: connection ${connectionId} has an unreadable cursor ${JSON.stringify(
+            connection.cursor,
+          )}; polling the default ${DEFAULT_LOOKBACK_IN_MINUTES} minute window instead.`,
+        );
+      } else {
+        startTime = OneUptimeDate.addRemoveMinutes(
+          cursorTime,
           -WINDOW_OVERLAP_IN_MINUTES,
-        )
-      : OneUptimeDate.addRemoveMinutes(endTime, -DEFAULT_LOOKBACK_IN_MINUTES);
+        );
+      }
+    }
+
+    if (OneUptimeDate.isBefore(startTime, earliestAllowed)) {
+      /*
+       * The alerts between the cursor and the cap are skipped and will
+       * never be fetched again, so the gap has to be stated. Silently
+       * truncating it is how a connector comes back from an outage
+       * looking healthy while a day of detections is simply missing.
+       */
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} would poll from ${startTime.toISOString()}, ${OneUptimeDate.getMinutesBetweenTwoDates(
+          startTime,
+          endTime,
+        )} minutes back and past the ${MAX_LOOKBACK_IN_MINUTES} minute cap; alerts before ${earliestAllowed.toISOString()} are skipped and will not be fetched again.`,
+      );
 
-    if (
-      Number.isNaN(startTime.getTime()) ||
-      OneUptimeDate.isBefore(startTime, earliestAllowed)
-    ) {
       startTime = earliestAllowed;
     }
 
-    const alerts: Array<JSONObject> = await client.fetchDetectionAlerts({
+    if (!OneUptimeDate.isBefore(startTime, endTime)) {
+      /*
+       * A cursor in the future — clock skew on the writer, or a restored
+       * backup — used to send Chronicle an inverted timeRange, which is
+       * neither an error the operator sees nor a window that returns
+       * anything.
+       */
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} cursor resolves to ${startTime.toISOString()}, at or after the current time; polling the default ${DEFAULT_LOOKBACK_IN_MINUTES} minute window instead.`,
+      );
+
+      startTime = defaultStartTime;
+    }
+
+    const fetched: FetchAlertsResult = await client.fetchDetectionAlerts({
       startTime,
       endTime,
     });
 
-    let ingested: number = 0;
+    if (fetched.truncatedByCount) {
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} window ${startTime.toISOString()} to ${endTime.toISOString()} matched more alerts than Chronicle will return, and this endpoint has no pagination — alerts in this window were dropped. Lower pollIntervalInMinutes.`,
+      );
+    }
+
+    if (fetched.truncatedByBytes) {
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} window ${startTime.toISOString()} to ${endTime.toISOString()} was truncated by Chronicle's memory limit — alerts in this window were dropped. Lower pollIntervalInMinutes.`,
+      );
+    }
+
+    const alerts: Array<JSONObject> = fetched.alerts;
+
+    const normalizedAlerts: Array<NormalizedSecurityEvent> = [];
+
+    /*
+     * Objects the alert gate refused, and objects that blew up on the way
+     * through it. They are kept apart because they mean opposite things
+     * for the cursor: a refusal is deterministic and re-fetching it would
+     * refuse it again forever, a failure may well succeed next time.
+     */
+    let rejectedCount: number = 0;
+    let failedCount: number = 0;
 
     if (alerts.length > 0) {
       const serviceMetadata: TelemetryServiceMetadata =
@@ -185,17 +272,34 @@ export default class GoogleSecOpsPoller {
         projectRetentionInDays: serviceMetadata.projectRetentionInDays,
       });
 
-      const normalizedAlerts: Array<NormalizedSecurityEvent> = [];
-
       for (const alert of alerts) {
         try {
+          /*
+           * The normalizer is a total function whose class, category,
+           * vendor and product are constants, so anything handed to it
+           * comes back out as a plausible Detection Finding row. The gate
+           * is what keeps a stray envelope chunk from being stored as a
+           * severity-Unknown detection nobody can tell from a real one.
+           */
+          if (!GoogleSecOpsAlertNormalizer.isGoogleSecOpsAlert(alert)) {
+            rejectedCount++;
+            continue;
+          }
+
           normalizedAlerts.push(GoogleSecOpsAlertNormalizer.normalize(alert));
         } catch (normalizeError) {
+          failedCount++;
           logger.error("GoogleSecOpsPoller: error normalizing alert");
           logger.error(normalizeError);
         }
       }
 
+      if (rejectedCount > 0) {
+        logger.warn(
+          `GoogleSecOpsPoller: connection ${connectionId} discarded ${rejectedCount} of ${alerts.length} fetched objects that do not look like Google SecOps alerts.`,
+        );
+      }
+
       /*
        * Threat-intel enrichment before row building, same seam as the
        * HTTP ingest path — polled alerts get the same threat.* stamps.
@@ -218,15 +322,43 @@ export default class GoogleSecOpsPoller {
 
       if (rows.length > 0) {
         await SecurityEventService.insertJsonRows(rows);
-        ingested = rows.length;
       }
     }
 
+    const ingested: number = normalizedAlerts.length;
+
+    /*
+     * Nothing storable came out of a window that did contain alerts, and
+     * the reason was a failure rather than a refusal — so the alerts still
+     * exist at Chronicle and the window has to be re-fetched. Advancing
+     * here is what turned a normalizer fault into permanent, silent data
+     * loss: the insert-failure path leaves the cursor alone by throwing,
+     * and this path did not.
+     */
+    const advanceCursor: boolean = ingested > 0 || failedCount === 0;
+
+    if (!advanceCursor) {
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} normalized none of its ${alerts.length} fetched alerts; holding the cursor so the window is polled again rather than skipped.`,
+      );
+    }
+
+    const cursorUpdate: { cursor?: string } = advanceCursor
+      ? {
+          /*
+           * Still open (out of scope here): this stores the end of the
+           * window rather than the newest detection timestamp actually
+           * ingested, which is what the column documents itself as.
+           */
+          cursor: endTime.toISOString(),
+        }
+      : {};
+
     await GoogleSecOpsConnectionService.updateOneById({
       id: connection.id,
       data: {
         lastPolledAt: endTime,
-        cursor: endTime.toISOString(),
+        ...cursorUpdate,
         lastError: null as unknown as string,
       },
       props: {
@@ -234,6 +366,10 @@ export default class GoogleSecOpsPoller {
       },
     });
 
+    logger.debug(
+      `GoogleSecOpsPoller: connection ${connectionId} fetched ${alerts.length} alerts and ingested ${ingested} security events for ${startTime.toISOString()} to ${endTime.toISOString()}.`,
+    );
+
     return ingested;
   }
 }

package/Server/Utils/Workspace/MicrosoftTeams/Actions/Alert.ts

@@ -18,6 +18,8 @@ import AlertStateService from "../../../../Services/AlertStateService";
 import UserNotificationEventType from "../../../../../Types/UserNotification/UserNotificationEventType";
 import OnCallDutyPolicy from "../../../../../Models/DatabaseModels/OnCallDutyPolicy";
 import AlertState from "../../../../../Models/DatabaseModels/AlertState";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import MicrosoftTeamsActionAuthorization from "./Authorization";
 
 export default class MicrosoftTeamsAlertActions {
   @CaptureSpan()
@@ -255,6 +257,7 @@ export default class MicrosoftTeamsAlertActions {
     value: JSONObject;
     projectId: ObjectID;
     oneUptimeUserId: ObjectID;
+    databaseProps: DatabaseCommonInteractionProps;
     turnContext: TurnContext;
   }): Promise<void> {
     const {
@@ -263,6 +266,7 @@ export default class MicrosoftTeamsAlertActions {
       value,
       projectId,
       oneUptimeUserId,
+      databaseProps,
       turnContext,
     } = data;
 
@@ -274,10 +278,15 @@ export default class MicrosoftTeamsAlertActions {
         return;
       }
 
-      await AlertService.acknowledgeAlert(
-        new ObjectID(actionValue),
-        oneUptimeUserId,
-      );
+      const alertId: ObjectID = new ObjectID(actionValue);
+
+      await MicrosoftTeamsActionAuthorization.assertCanUpdateAlert({
+        alertId: alertId,
+        projectId: projectId,
+        props: databaseProps,
+      });
+
+      await AlertService.acknowledgeAlert(alertId, oneUptimeUserId);
       await turnContext.sendActivity("✅ Alert acknowledged.");
       return;
     }
@@ -288,10 +297,15 @@ export default class MicrosoftTeamsAlertActions {
         return;
       }
 
-      await AlertService.resolveAlert(
-        new ObjectID(actionValue),
-        oneUptimeUserId,
-      );
+      const alertId: ObjectID = new ObjectID(actionValue);
+
+      await MicrosoftTeamsActionAuthorization.assertCanUpdateAlert({
+        alertId: alertId,
+        projectId: projectId,
+        props: databaseProps,
+      });
+
+      await AlertService.resolveAlert(alertId, oneUptimeUserId);
       await turnContext.sendActivity("✅ Alert resolved.");
       return;
     }
@@ -506,9 +520,7 @@ export default class MicrosoftTeamsAlertActions {
           data: {
             currentAlertStateId: new ObjectID(alertStateId.toString()),
           },
-          props: {
-            isRoot: true,
-          },
+          props: databaseProps,
         });
 
         await turnContext.sendActivity("✅ Alert state changed successfully.");

package/Server/Utils/Workspace/MicrosoftTeams/Actions/Auth.ts

@@ -1,8 +1,5 @@
-import { ExpressRequest } from "../../../Express";
 import { JSONObject } from "../../../../../Types/JSON";
 import ObjectID from "../../../../../Types/ObjectID";
-import WorkspaceProjectAuthToken from "../../../../../Models/DatabaseModels/WorkspaceProjectAuthToken";
-import WorkspaceProjectAuthTokenService from "../../../../Services/WorkspaceProjectAuthTokenService";
 import WorkspaceType from "../../../../../Types/Workspace/WorkspaceType";
 import logger from "../../../Logger";
 import CaptureSpan from "../../../Telemetry/CaptureSpan";
@@ -30,173 +27,6 @@ export interface MicrosoftTeamsRequest {
 }
 
 export default class MicrosoftTeamsAuthAction {
-  @CaptureSpan()
-  public static async isAuthorized(data: {
-    req: ExpressRequest;
-  }): Promise<MicrosoftTeamsRequest> {
-    const req: ExpressRequest = data.req;
-    let payload: JSONObject = {};
-    let tenantId: string = "";
-
-    try {
-      payload = req.body as JSONObject;
-      logger.debug("Microsoft Teams payload received:");
-      logger.debug(payload);
-    } catch (error) {
-      logger.debug("Failed to parse Microsoft Teams payload:");
-      logger.debug(error);
-      return {
-        isAuthorized: false,
-        projectId: new ObjectID(""),
-        authToken: "",
-        payloadType: "unknown",
-        tenantId: tenantId,
-      };
-    }
-
-    // Microsoft Teams sends different types of activities
-    const activityType: string = payload["type"] as string;
-    const from: JSONObject = payload["from"] as JSONObject;
-    const conversation: JSONObject = payload["conversation"] as JSONObject;
-    const channelData: JSONObject = payload["channelData"] as JSONObject;
-
-    let teamId: string = "";
-    let channelId: string = "";
-    let userId: string = "";
-
-    // Extract team and channel information
-    if (channelData && channelData["team"]) {
-      teamId = (channelData["team"] as JSONObject)["id"] as string;
-    }
-
-    if (conversation && conversation["id"]) {
-      // For channel messages, conversation ID contains channel info
-      channelId = conversation["id"] as string;
-    }
-
-    if (from && from["id"]) {
-      userId = from["id"] as string;
-    }
-
-    if (channelData && channelData["tenant"]) {
-      tenantId = (channelData["tenant"] as JSONObject)["id"] as string;
-    }
-
-    // Handle different activity types
-    if (activityType === "installationUpdate") {
-      // Bot was installed or uninstalled
-      const action: string = payload["action"] as string;
-      if (action === "remove") {
-        return {
-          isAuthorized: true,
-          projectId: new ObjectID(""), // We'll need to find the project
-          authToken: "",
-          payloadType: "app_uninstall",
-          teamId: teamId,
-          tenantId: tenantId,
-        };
-      }
-    }
-
-    // Find the project associated with this team
-    if (!teamId) {
-      logger.debug("No team ID found in payload", {
-        tenantId: tenantId,
-      });
-      return {
-        isAuthorized: false,
-        projectId: new ObjectID(""),
-        authToken: "",
-        payloadType: activityType,
-        tenantId: tenantId,
-      };
-    }
-
-    let projectAuthToken: WorkspaceProjectAuthToken | null = null;
-
-    try {
-      // Find project auth token by checking if miscData contains the teamId
-      projectAuthToken = await WorkspaceProjectAuthTokenService.findOneBy({
-        query: {
-          workspaceType: WorkspaceType.MicrosoftTeams,
-          workspaceProjectId: tenantId,
-        },
-        select: {
-          _id: true,
-          projectId: true,
-          authToken: true,
-          miscData: true,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
-    } catch (error) {
-      logger.debug("Error finding project auth token:", {
-        teamId: teamId,
-        tenantId: tenantId,
-      });
-      logger.debug(error);
-      return {
-        isAuthorized: false,
-        projectId: new ObjectID(""),
-        authToken: "",
-        payloadType: activityType,
-        tenantId: tenantId,
-      };
-    }
-
-    if (!projectAuthToken) {
-      logger.debug(`No project auth token found for team: ${teamId}`, {
-        teamId: teamId,
-        tenantId: tenantId,
-      });
-      return {
-        isAuthorized: false,
-        projectId: new ObjectID(""),
-        authToken: "",
-        payloadType: activityType,
-        tenantId: tenantId,
-      };
-    }
-
-    // Parse actions from the payload
-    const actions: Array<MicrosoftTeamsAction> = [];
-
-    if (activityType === "invoke") {
-      // Handle adaptive card button clicks
-      const value: JSONObject = payload["value"] as JSONObject;
-      if (value && value["action"]) {
-        actions.push({
-          actionType: value["action"] as string,
-          actionValue: value["actionValue"] as string,
-        });
-      }
-    } else if (activityType === "message") {
-      // Handle text messages to the bot
-      const text: string = (payload["text"] as string) || "";
-      if (text.toLowerCase().includes("help")) {
-        actions.push({
-          actionType: "help",
-        });
-      }
-    }
-
-    return {
-      isAuthorized: true,
-      projectId: projectAuthToken.projectId!,
-      authToken: projectAuthToken.authToken!,
-      payloadType: activityType,
-      actions: actions,
-      userId: userId,
-      teamId: teamId,
-      tenantId: tenantId,
-      channelId: channelId,
-      messageId: payload["id"] as string,
-      payload: payload,
-    };
-  }
-
   @CaptureSpan()
   public static async getOneUptimeUserIdFromTeamsUserId(data: {
     teamsUserId: string;

package/Server/Utils/Workspace/MicrosoftTeams/Actions/Authorization.ts

@@ -0,0 +1,158 @@
+import Alert from "../../../../../Models/DatabaseModels/Alert";
+import Incident from "../../../../../Models/DatabaseModels/Incident";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotAuthorizedException from "../../../../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../../../../Types/ObjectID";
+import AlertService from "../../../../Services/AlertService";
+import IncidentService from "../../../../Services/IncidentService";
+import ModelPermission from "../../../../Types/Database/Permissions/Index";
+import Query from "../../../../Types/Database/Query";
+import { applyAlertSelfPrivacyFilter } from "../../../Alert/AlertPrivacyFilter";
+import { applyIncidentSelfPrivacyFilter } from "../../../Incident/IncidentPrivacyFilter";
+import CaptureSpan from "../../../Telemetry/CaptureSpan";
+
+export default class MicrosoftTeamsActionAuthorization {
+  @CaptureSpan()
+  public static async assertCanUpdateIncident(data: {
+    incidentId: ObjectID;
+    projectId: ObjectID;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    const incident: Incident | null = await IncidentService.findOneBy({
+      query: {
+        _id: data.incidentId,
+        projectId: data.projectId,
+      },
+      select: {
+        _id: true,
+        labels: {
+          _id: true,
+          name: true,
+        },
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!incident) {
+      throw new NotAuthorizedException(
+        "You do not have permission to update this incident.",
+      );
+    }
+
+    await ModelPermission.checkUpdatePermissionByModel({
+      modelType: Incident,
+      fetchModelWithAccessControlIds: async (): Promise<Incident> => {
+        return incident;
+      },
+      props: data.props,
+    });
+
+    const permittedQuery: Query<Incident> =
+      await ModelPermission.checkUpdateQueryPermissions(
+        Incident,
+        {
+          _id: data.incidentId,
+          projectId: data.projectId,
+        },
+        {
+          currentIncidentStateId: ObjectID.getZeroObjectID(),
+        },
+        data.props,
+      );
+
+    const privacyScopedQuery: Query<Incident> = applyIncidentSelfPrivacyFilter(
+      permittedQuery,
+      data.props,
+    );
+
+    const permittedIncident: Incident | null = await IncidentService.findOneBy({
+      query: privacyScopedQuery,
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!permittedIncident) {
+      throw new NotAuthorizedException(
+        "You do not have permission to update this incident.",
+      );
+    }
+  }
+
+  @CaptureSpan()
+  public static async assertCanUpdateAlert(data: {
+    alertId: ObjectID;
+    projectId: ObjectID;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    const alert: Alert | null = await AlertService.findOneBy({
+      query: {
+        _id: data.alertId,
+        projectId: data.projectId,
+      },
+      select: {
+        _id: true,
+        labels: {
+          _id: true,
+          name: true,
+        },
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!alert) {
+      throw new NotAuthorizedException(
+        "You do not have permission to update this alert.",
+      );
+    }
+
+    await ModelPermission.checkUpdatePermissionByModel({
+      modelType: Alert,
+      fetchModelWithAccessControlIds: async (): Promise<Alert> => {
+        return alert;
+      },
+      props: data.props,
+    });
+
+    const permittedQuery: Query<Alert> =
+      await ModelPermission.checkUpdateQueryPermissions(
+        Alert,
+        {
+          _id: data.alertId,
+          projectId: data.projectId,
+        },
+        {
+          currentAlertStateId: ObjectID.getZeroObjectID(),
+        },
+        data.props,
+      );
+
+    const privacyScopedQuery: Query<Alert> = applyAlertSelfPrivacyFilter(
+      permittedQuery,
+      data.props,
+    );
+
+    const permittedAlert: Alert | null = await AlertService.findOneBy({
+      query: privacyScopedQuery,
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!permittedAlert) {
+      throw new NotAuthorizedException(
+        "You do not have permission to update this alert.",
+      );
+    }
+  }
+}