@oneuptime/common 12.0.28 → 12.0.30

package/Server/Services/UserOnCallCalendarFeedService.ts

@@ -0,0 +1,159 @@
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import CalendarFeedToken, {
+  CalendarFeedRotation,
+  MintedCalendarFeedToken,
+} from "../Utils/OnCall/CalendarFeedToken";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model from "../../Models/DatabaseModels/UserOnCallCalendarFeed";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import CalendarFeedWindow from "../../Types/OnCallDutyPolicy/CalendarFeedWindow";
+import ObjectID from "../../Types/ObjectID";
+import OneUptimeDate from "../../Types/Date";
+
+/*
+ * The personal calendar feed row: one per (project, user).
+ *
+ * WHAT THE HOOKS GUARANTEE
+ *
+ *   - Only root creates one. The table create list is already empty, but the
+ *     hook says it out loud: the plaintext token is minted here or by the
+ *     calendar API, never by a request body.
+ *   - A created row always carries a consistent token set (see
+ *     CalendarFeedToken.applyTokenColumnsOnCreate): there is no path to a row
+ *     whose hash does not match its token.
+ *   - pastDays / futureDays are clamped to the CalendarFeedWindow bounds on
+ *     every write, so a feed can never be asked to render a year.
+ *
+ * Rotation lives here too (rotateTokenById) so the grace-hash bookkeeping is
+ * written once and the API, the member-leave cleanup and the tests share it.
+ * Cache purging is the caller's job - this service knows nothing about the
+ * feed cache.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Calendar feeds are generated by the calendar API, not created directly.",
+      );
+    }
+
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    if (!createBy.data.userId) {
+      throw new BadDataException("userId is required");
+    }
+
+    createBy.data.projectId = projectId;
+
+    // Root only reaches this line, so a pre-minted token may be trusted.
+    CalendarFeedToken.applyTokenColumnsOnCreate(createBy.data, {
+      trustSuppliedToken: true,
+    });
+
+    createBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+      createBy.data.pastDays,
+    );
+    createBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+      createBy.data.futureDays,
+    );
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.pastDays !== undefined) {
+      updateBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+        updateBy.data.pastDays,
+      );
+    }
+
+    if (updateBy.data.futureDays !== undefined) {
+      updateBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+        updateBy.data.futureDays,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /**
+   * Create the feed row for a user in a project and hand the plaintext token
+   * back ONCE, so the caller can build the subscription URL without a
+   * decrypt round-trip. Root only; the caller is responsible for holding the
+   * per-(project, user) lock the API uses around mint-or-rotate.
+   */
+  @CaptureSpan()
+  public async createForUser(data: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }): Promise<{ feed: Model; minted: MintedCalendarFeedToken }> {
+    const minted: MintedCalendarFeedToken = CalendarFeedToken.mintSet();
+
+    const feed: Model = new Model();
+    feed.projectId = data.projectId;
+    feed.userId = data.userId;
+    feed.token = minted.token;
+    feed.rotatedAt = OneUptimeDate.getCurrentDate();
+
+    const created: Model = await this.create({
+      data: feed,
+      props: { isRoot: true },
+    });
+
+    return { feed: created, minted };
+  }
+
+  /**
+   * Rotate the token of an existing feed: mint a new one, move the current
+   * hash into the 30-day grace slot, stamp rotatedAt. Returns the new
+   * plaintext token ONCE. Root write; the caller purges caches.
+   */
+  @CaptureSpan()
+  public async rotateTokenById(data: {
+    id: ObjectID;
+  }): Promise<CalendarFeedRotation> {
+    const existing: Model | null = await this.findOneBy({
+      query: { _id: data.id },
+      select: { _id: true, tokenHash: true },
+      props: { isRoot: true, ignoreHooks: true },
+    });
+
+    if (!existing) {
+      throw new NotFoundException("Calendar feed not found.");
+    }
+
+    const rotation: CalendarFeedRotation = CalendarFeedToken.buildRotation({
+      currentTokenHash: existing.tokenHash,
+    });
+
+    await this.updateOneById({
+      id: data.id,
+      data: CalendarFeedToken.toRotationUpdateData(rotation),
+      props: { isRoot: true },
+    });
+
+    return rotation;
+  }
+}
+
+export default new Service();

package/Server/Services/UserOnCallShiftReminderLogService.ts

@@ -0,0 +1,151 @@
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model, {
+  UserOnCallShiftReminderLogKind,
+} from "../../Models/DatabaseModels/UserOnCallShiftReminderLog";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import ObjectID from "../../Types/ObjectID";
+import OneUptimeDate from "../../Types/Date";
+
+const MILLISECONDS_PER_MINUTE: number = 60 * 1000;
+
+const ALLOWED_KINDS: Set<string> = new Set<string>(
+  Object.values(UserOnCallShiftReminderLogKind),
+);
+
+/*
+ * The shift-reminder ledger. Root only, in every direction: a claim row is
+ * the thing that makes "send exactly once" true, so nothing outside the
+ * worker may insert, edit or remove one.
+ *
+ * The create hook normalises the idempotency key so two workers that compute
+ * the same shift a few milliseconds apart still collide on the unique index:
+ * shiftStartsAt is truncated to the minute here as well as by the worker
+ * (belt and braces - the seam normalisation upstream already makes starts
+ * minute-granular, this makes it a guarantee of the table rather than of one
+ * caller), and minutesBeforeShift defaults to 0 for change notices.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Shift reminder logs are written by the reminder worker only.",
+      );
+    }
+
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    if (!createBy.data.userId) {
+      throw new BadDataException("userId is required");
+    }
+
+    if (!createBy.data.onCallDutyPolicyScheduleId) {
+      throw new BadDataException("onCallDutyPolicyScheduleId is required");
+    }
+
+    if (!createBy.data.shiftStartsAt) {
+      throw new BadDataException("shiftStartsAt is required");
+    }
+
+    if (
+      !createBy.data.kind ||
+      !ALLOWED_KINDS.has(createBy.data.kind as string)
+    ) {
+      throw new BadDataException(
+        `kind must be one of: ${Object.values(UserOnCallShiftReminderLogKind).join(", ")}`,
+      );
+    }
+
+    createBy.data.projectId = projectId;
+
+    createBy.data.shiftStartsAt = Service.truncateToMinute(
+      OneUptimeDate.fromString(createBy.data.shiftStartsAt),
+    );
+
+    createBy.data.minutesBeforeShift = Service.validateMinutesBeforeShift(
+      createBy.data.minutesBeforeShift,
+    );
+
+    if (!createBy.data.claimedAt) {
+      createBy.data.claimedAt = OneUptimeDate.getCurrentDate();
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (!updateBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Shift reminder logs are written by the reminder worker only.",
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    if (!deleteBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Shift reminder logs are written by the reminder worker only.",
+      );
+    }
+
+    return { deleteBy, carryForward: null };
+  }
+
+  // Zero the seconds and milliseconds. Part of the idempotency key.
+  public static truncateToMinute(date: Date): Date {
+    return new Date(
+      Math.floor(date.getTime() / MILLISECONDS_PER_MINUTE) *
+        MILLISECONDS_PER_MINUTE,
+    );
+  }
+
+  /*
+   * 0 (a change notice) or a positive whole number of minutes. Missing means
+   * 0. Anything else is a caller bug, not a value to store.
+   */
+  public static validateMinutesBeforeShift(value: unknown): number {
+    if (value === undefined || value === null) {
+      return 0;
+    }
+
+    const parsed: number =
+      typeof value === "string" && value.trim() !== ""
+        ? Number(value)
+        : (value as number);
+
+    if (typeof parsed !== "number" || !Number.isInteger(parsed) || parsed < 0) {
+      throw new BadDataException(
+        "minutesBeforeShift must be a whole number of minutes, 0 or more.",
+      );
+    }
+
+    return parsed;
+  }
+}
+
+export default new Service();

package/Server/Services/UserOnCallShiftReminderService.ts

@@ -0,0 +1,112 @@
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model, {
+  MAX_MINUTES_BEFORE_SHIFT,
+  MIN_MINUTES_BEFORE_SHIFT,
+} from "../../Models/DatabaseModels/UserOnCallShiftReminder";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+
+/*
+ * "Remind me N minutes before my shift" rows.
+ *
+ * The hooks keep the table honest for the reminder worker: every row has an
+ * owner (defaulted to the session user when the client did not send one, so
+ * the settings page can post `{ minutesBeforeShift }` and nothing else), a
+ * project, and a lead time inside 15 minutes ... 2 weeks. A duplicate lead
+ * is answered with a message rather than a unique-violation 500.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    if (!createBy.data.userId && createBy.props.userId) {
+      createBy.data.userId = createBy.props.userId;
+    }
+
+    if (!createBy.data.userId) {
+      throw new BadDataException("userId is required");
+    }
+
+    createBy.data.projectId = projectId;
+
+    createBy.data.minutesBeforeShift = Service.validateMinutesBeforeShift(
+      createBy.data.minutesBeforeShift,
+    );
+
+    const duplicates: PositiveNumber = await this.countBy({
+      query: {
+        projectId: projectId,
+        userId: createBy.data.userId,
+        minutesBeforeShift: createBy.data.minutesBeforeShift,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (duplicates.toNumber() > 0) {
+      throw new BadDataException(
+        `You already have a reminder ${createBy.data.minutesBeforeShift} minutes before your shifts.`,
+      );
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.minutesBeforeShift !== undefined) {
+      updateBy.data.minutesBeforeShift = Service.validateMinutesBeforeShift(
+        updateBy.data.minutesBeforeShift,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  /*
+   * A whole number of minutes between MIN_MINUTES_BEFORE_SHIFT and
+   * MAX_MINUTES_BEFORE_SHIFT. Numeric strings are accepted (a form may post
+   * one); missing, fractional, negative or out-of-range values are a 400.
+   */
+  public static validateMinutesBeforeShift(value: unknown): number {
+    const parsed: number =
+      typeof value === "string" && value.trim() !== ""
+        ? Number(value)
+        : (value as number);
+
+    if (
+      typeof parsed !== "number" ||
+      !Number.isInteger(parsed) ||
+      parsed < MIN_MINUTES_BEFORE_SHIFT ||
+      parsed > MAX_MINUTES_BEFORE_SHIFT
+    ) {
+      throw new BadDataException(
+        `Reminder lead time must be a whole number of minutes between ${MIN_MINUTES_BEFORE_SHIFT} and ${MAX_MINUTES_BEFORE_SHIFT} (two weeks).`,
+      );
+    }
+
+    return parsed;
+  }
+}
+
+export default new Service();

package/Server/Types/Domain.ts

@@ -11,6 +11,13 @@ import URL from "../../Types/API/URL";
 import API from "../../Utils/API";
 import DataSourceEgressGuard from "../Utils/DataSource/EgressGuard";
 
+/*
+ * A status page that is up answers the verification path well inside this.
+ * It is a ceiling on how long one unreachable domain may hold up the rest of a
+ * certificate run, not a latency target.
+ */
+export const DOMAIN_VERIFICATION_TIMEOUT_IN_MS: number = 10000;
+
 export default class Domain extends DomainCommon {
   /*
    * GET a domain-verification URL built from a tenant-supplied domain.
@@ -26,6 +33,15 @@ export default class Domain extends DomainCommon {
    *
    * Private ranges stay reachable on self-hosted installs, where a status page
    * domain legitimately resolves inside the corporate network.
+   *
+   * The call is bounded. A customer domain that has been pointed at an address
+   * which silently drops packets - a decommissioned load balancer, a firewall
+   * that blackholes instead of refusing - never answers and never resets, so an
+   * unbounded request sits until the kernel gives up on the TCP connect, which
+   * is a little over two minutes on Linux. The certificate crons walk every
+   * status page domain in turn, so each such domain would burn that timeout out
+   * of the run's budget and push the domains behind it into the next run - the
+   * renewals that matter get starved by the domains that will never answer.
    */
   @CaptureSpan()
   public static async getForDomainVerification(data: {
@@ -41,6 +57,7 @@ export default class Domain extends DomainCommon {
       url: URL.fromString(data.url),
       options: {
         doNotFollowRedirects: true,
+        timeout: DOMAIN_VERIFICATION_TIMEOUT_IN_MS,
         httpAgent,
         httpsAgent,
       },

package/Server/Utils/APIKey/AccessPermission.ts

@@ -10,6 +10,28 @@ import ApiKeyPermissionService, {
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import UserPermissionUtil from "../UserPermission/UserPermission";
 
+/*
+ * Permission.AuthenticatedRequest is a marker, not a capability. It says "some
+ * authenticated principal made this call" - its own definition names API keys
+ * first - and unlike every other entry in these lists it has no PermissionProps,
+ * so it never appears in the admin picker and nobody can grant or revoke it per
+ * key. File and FileModel are the only models that name it, which is what bounds
+ * what including it here can widen.
+ *
+ * It is in the list because of TenantPermission.isAccessGrantedOnlyByCurrentUser.
+ * That predicate asks whether the ONLY thing letting a caller through a model's
+ * gate is the auto-granted CurrentUser - i.e. whether they are here as nothing
+ * more than some logged-in user - and when it says yes the caller is held to
+ * rows they own, which an API key can never satisfy because it has no userId.
+ * Without AuthenticatedRequest an API key intersects File's create list down to
+ * CurrentUser alone and answers yes to that question, which is simply the wrong
+ * description of a key: it is not a user acting on their own rows.
+ *
+ * On File as it stands today the wrong answer is harmless - File declares no
+ * user column, so the ownership branch returns before it can bite. The grant is
+ * here so that stays a fact about File's schema rather than the only thing
+ * holding API-key file access up.
+ */
 export default class APIKeyAccessPermission {
   @CaptureSpan()
   public static async getDefaultApiGlobalPermission(
@@ -21,6 +43,7 @@ export default class APIKeyAccessPermission {
         Permission.Public,
         Permission.User,
         Permission.CurrentUser,
+        Permission.AuthenticatedRequest,
       ],
       _type: "UserGlobalAccessPermission",
     };
@@ -36,6 +59,7 @@ export default class APIKeyAccessPermission {
         Permission.Public,
         Permission.User,
         Permission.CurrentUser,
+        Permission.AuthenticatedRequest,
         Permission.ProjectOwner,
       ],
       _type: "UserGlobalAccessPermission",