@oneuptime/common 12.0.29 → 12.0.31

package/Server/Utils/Response.ts

@@ -26,6 +26,32 @@ import PositiveNumber from "../../Types/PositiveNumber";
 import Route from "../../Types/API/Route";
 import CaptureSpan from "./Telemetry/CaptureSpan";
 import { GoogleTagManagerEnabled } from "../EnvironmentConfig";
+import { createHash } from "crypto";
+
+/*
+ * How long a calendar client may reuse a feed body before asking again. The
+ * body cache behind the feed routes has the same TTL, so a client that honours
+ * this sees a new body no later than one it would have been served anyway.
+ */
+export const CALENDAR_RESPONSE_MAX_AGE_SECONDS: number = 300;
+
+export const CALENDAR_RESPONSE_CONTENT_TYPE: string =
+  "text/calendar; charset=utf-8";
+
+export const CALENDAR_RESPONSE_FILE_NAME: string = "oneuptime-on-call.ics";
+
+/*
+ * The response headers a calendar feed carries, as a shape the API and its
+ * tests can share. `etag` may be passed bare or already quoted; the helper
+ * emits the quoted strong form either way. `lastModified` is the newest
+ * change to anything the feed was built from, and is what a client's
+ * If-Modified-Since is compared against.
+ */
+export interface CalendarResponseData {
+  body: string;
+  etag: string;
+  lastModified: Date;
+}
 
 /*
  * Raster image types, which is to say the types that cannot carry script and
@@ -485,6 +511,114 @@ export default class Response {
     oneUptimeResponse.end(javascript);
   }
 
+  /*
+   * A strong ETag for a calendar body: the first 32 hex characters of the
+   * SHA-256 of the exact bytes sent, quoted. Strong rather than weak because
+   * the body is byte-deterministic for a given input (the iCalendar serializer
+   * orders properties and folds lines the same way every time), so two bodies
+   * with the same tag are byte-identical and a client may treat them so.
+   * Computed from the body rather than from an update timestamp so a cached
+   * body and a freshly rendered identical one carry the same tag.
+   */
+  public static getCalendarETag(body: string): string {
+    return `"${createHash("sha256").update(body, "utf8").digest("hex").slice(0, 32)}"`;
+  }
+
+  /*
+   * Send an iCalendar feed body with the headers calendar clients expect.
+   *
+   * Deliberately its own method rather than sendCustomResponse: that one
+   * starts from setNoCacheHeaders, which stamps `Pragma: no-cache` and cannot
+   * take it back, and a feed that says both "max-age=300" and "no-cache" is
+   * re-fetched on every open by clients that honour Pragma. Nor
+   * sendTextResponse, which sets no Content-Type at all and would let Express
+   * fall back to text/html.
+   *
+   * Conditional requests are left to Express: `res.send` answers 304 by itself
+   * when `req.fresh` is true (If-None-Match against the ETag set here, weak
+   * `W/` prefixes included, or If-Modified-Since against Last-Modified), and it
+   * strips the body for HEAD. Nothing here inspects the method.
+   *
+   * private, not public: the body is one person's (or one team's) on-call
+   * roster behind a bearer token in the URL, and a shared cache that stored it
+   * would hand it to the next requester of that URL regardless of who they
+   * are. Expires duplicates max-age for the clients that only read Expires.
+   */
+  @CaptureSpan()
+  public static sendCalendarResponse(
+    _req: ExpressRequest,
+    res: ExpressResponse,
+    data: CalendarResponseData,
+  ): void {
+    const oneUptimeResponse: OneUptimeResponse = res as OneUptimeResponse;
+
+    const etag: string = Response.normalizeStrongETag(data.etag);
+
+    const expiresAt: Date = new Date(
+      Date.now() + CALENDAR_RESPONSE_MAX_AGE_SECONDS * 1000,
+    );
+
+    oneUptimeResponse.set("Content-Type", CALENDAR_RESPONSE_CONTENT_TYPE);
+    oneUptimeResponse.set(
+      "Content-Disposition",
+      `inline; filename="${CALENDAR_RESPONSE_FILE_NAME}"`,
+    );
+    oneUptimeResponse.set(
+      "Cache-Control",
+      `private, max-age=${CALENDAR_RESPONSE_MAX_AGE_SECONDS}`,
+    );
+    oneUptimeResponse.set("Expires", expiresAt.toUTCString());
+    oneUptimeResponse.set("ETag", etag);
+    oneUptimeResponse.set("Last-Modified", data.lastModified.toUTCString());
+    oneUptimeResponse.set("X-Content-Type-Options", "nosniff");
+    oneUptimeResponse.set("X-Robots-Tag", "noindex");
+
+    /*
+     * A middleware upstream of the route may already have stamped the
+     * no-cache trio (setNoCacheHeaders). Cache-Control and Expires were just
+     * overwritten; Pragma has no "do cache" value, so the only correct thing
+     * is for it not to be there.
+     */
+    oneUptimeResponse.removeHeader("Pragma");
+
+    /*
+     * Never the body: it is a roster behind a bearer token, and the audit log
+     * is not where it belongs. Enough to know what went out and how big.
+     */
+    oneUptimeResponse.logBody = {
+      contentType: CALENDAR_RESPONSE_CONTENT_TYPE,
+      bytes: Buffer.byteLength(data.body, "utf8"),
+    };
+
+    oneUptimeResponse.status(200).send(data.body);
+  }
+
+  /*
+   * Accept `abc`, `"abc"` or `W/"abc"` and return the strong, quoted form.
+   * The tag is content-derived (see getCalendarETag), so weakening it would
+   * only lose the byte-identical guarantee the client is entitled to.
+   */
+  private static normalizeStrongETag(etag: string): string {
+    let value: string = etag.trim();
+
+    if (value.startsWith("W/")) {
+      value = value.slice(2).trim();
+    }
+
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      value = value.slice(1, -1);
+    }
+
+    /*
+     * RFC 7232: an entity-tag is quoted and may not itself contain a double
+     * quote. Strip anything that would break the header rather than emit an
+     * unparseable one.
+     */
+    value = value.replace(/["\r\n]/g, "");
+
+    return `"${value}"`;
+  }
+
   public static setNoCacheHeaders(res: ExpressResponse): void {
     const oneUptimeResponse: OneUptimeResponse = res as OneUptimeResponse;
 

package/Server/Utils/Rules/RuleEngineRuleRead.ts

@@ -0,0 +1,48 @@
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../../Utils/Rules/RuleEngineLimits";
+import ObjectID from "../../../Types/ObjectID";
+import logger, { LogAttributes } from "../Logger";
+
+/*
+ * The one thing that makes MAX_RULES_EVALUATED_PER_PROJECT a ceiling rather
+ * than a cliff.
+ *
+ * A rule engine reads a project's enabled rules as `limit: <cap>, skip: 0`
+ * and evaluates what comes back. There is no second page, so a project with
+ * more rules than the cap has the remainder evaluated by nobody — and the
+ * read cannot tell the difference between "that is all of them" and "that is
+ * as many as I was allowed to ask for".
+ *
+ * That gap is the whole of OneUptime/oneuptime#3506. The cap was 100, a
+ * project had 1,243 rules, and the 1,143 that never ran produced no log, no
+ * error, no counter and no span attribute. It surfaced as a customer noticing
+ * that most of a 1,000-monitor import had come out bare, a day later.
+ *
+ * Raising the cap to 10,000 moves that threshold somewhere projects are very
+ * unlikely to reach, but it does not change the shape of the failure: at
+ * 10,001 rules the oldest rule goes quiet exactly as before. So the read now
+ * says so. Crossing the ceiling is an operator-visible error, not silence.
+ *
+ * Deliberately not an exception. A project that walks past the ceiling still
+ * wants the 10,000 rules that did match to be applied; refusing to label
+ * anything would turn a partial evaluation into no evaluation.
+ */
+export default function logIfRuleReadWasTruncated(data: {
+  /** The rule model being read, e.g. "MonitorLabelRule". Names the config to go and look at. */
+  ruleKind: string;
+  projectId: ObjectID | undefined;
+  /** How many rows the read returned. */
+  rulesRead: number;
+}): boolean {
+  if (data.rulesRead < MAX_RULES_EVALUATED_PER_PROJECT) {
+    return false;
+  }
+
+  logger.error(
+    `${data.ruleKind}: this project has at least ${MAX_RULES_EVALUATED_PER_PROJECT} enabled rules, which is the most one evaluation reads. Rules beyond that are NOT being evaluated, and resources they would match will silently go without. Reduce or consolidate the project's ${data.ruleKind} rows.`,
+    {
+      projectId: data.projectId?.toString(),
+    } as LogAttributes,
+  );
+
+  return true;
+}

package/Server/Utils/StartServer.ts

@@ -3,6 +3,7 @@ import CommonAPI from "../API/Index";
 import { StatusAPIOptions } from "../API/StatusAPI";
 import {
   AppVersion,
+  EncryptionSecretWarning,
   GoogleTagManagerEnabled,
   TrustedProxyHops,
   getFrontendEnvVars,
@@ -314,6 +315,15 @@ const init: InitFunction = async (
 
   logger.info(`App Version: ${AppVersion.toString()}`);
 
+  /*
+   * Said once per process at boot, where an operator reading the startup log
+   * will see it. EnvironmentConfig computes the message but cannot log it
+   * (Logger depends on EnvironmentConfig), so the entrypoint does.
+   */
+  if (EncryptionSecretWarning) {
+    logger.warn(EncryptionSecretWarning);
+  }
+
   await Express.launchApplication(appName, port);
   LocalCache.setString("app", "name", appName);
 

package/Server/Utils/Telemetry/AppMetrics.ts

@@ -239,4 +239,55 @@ export default class AppMetrics {
 
     return this.ingestDroppedCounter;
   }
+
+  // -- On-call calendar feeds -------------------------------------------
+
+  /*
+   * The one bounded attribute these carry: which kind of feed was rendered.
+   * "user" (personal), "schedule" (one schedule, shared link) or "project"
+   * (every schedule in a project). Never the token, the user or the project
+   * id -- those are unbounded and belong on traces and logs.
+   */
+  public static readonly ON_CALL_CALENDAR_FEED_KIND_ATTRIBUTE: string =
+    "oneuptime.oncall_calendar.feed_kind";
+
+  private static onCallCalendarRenderDuration: TelemetryHistogram | null = null;
+  private static onCallCalendarRenderEvents: TelemetryHistogram | null = null;
+
+  /*
+   * Wall-clock time to materialise the shifts and serialise a feed body, on a
+   * cache miss. Rendering expands every layer of every candidate schedule
+   * across a window of up to 180 days, so this is the number that says whether
+   * the render cap and the schedule-level cache are doing their job.
+   */
+  public static getOnCallCalendarRenderDuration(): TelemetryHistogram {
+    if (!this.onCallCalendarRenderDuration) {
+      this.onCallCalendarRenderDuration = Telemetry.getHistogram({
+        name: "oncall_calendar_render_duration_ms",
+        description:
+          "Time taken to render an on-call calendar feed body on a cache miss, partitioned by feed kind.",
+        unit: "ms",
+      });
+    }
+
+    return this.onCallCalendarRenderDuration;
+  }
+
+  /*
+   * How many VEVENTs a rendered feed carried. Distribution matters more than
+   * the total: a fat tail near MAX_EVENTS means windows are being shrunk to
+   * fit and subscribers are losing the far end of their calendar.
+   */
+  public static getOnCallCalendarRenderEvents(): TelemetryHistogram {
+    if (!this.onCallCalendarRenderEvents) {
+      this.onCallCalendarRenderEvents = Telemetry.getHistogram({
+        name: "oncall_calendar_render_events",
+        description:
+          "Number of calendar events in a rendered on-call calendar feed, partitioned by feed kind.",
+        unit: "1",
+      });
+    }
+
+    return this.onCallCalendarRenderEvents;
+  }
 }

package/Server/Utils/Telemetry/ExceptionSanitizer.ts

@@ -204,6 +204,18 @@ export function sanitizeExceptionMessage(message: string): string {
 // Frame lines are indented; header/message lines are not.
 const INDENTED_FRAME_LINE_REGEX: RegExp = /^\s/;
 
+/*
+ * ...except in Firefox and Safari, which indent nothing: SpiderMonkey and
+ * JavaScriptCore write `fn@source:line:col` flush against column 0 and emit no
+ * header line at all. Without this second test every browser frame takes the
+ * header branch, where rule 19 rewrites the content hash in
+ * `entry.a1b2c3d4.js` to `<HEX_ID>` and rule 22 rewrites `:1:98217` to
+ * `:<LINE>:<COL>)` — destroying for Firefox and Safari exactly the file:line
+ * references the comment above promises to keep for V8 ones.
+ */
+const BROWSER_FRAME_LINE_REGEX: RegExp =
+  /^[^@:\n]{0,256}@(?:\[(?:native|wasm) code\]|self-hosted:\d{1,9}(?::\d{1,9})?|[A-Za-z][A-Za-z0-9+.-]{0,31}:[^\s]{1,2048}:\d{1,9}(?::\d{1,9})?)\r?$/;
+
 export function sanitizeStackTrace(stackTrace: string): string {
   if (!stackTrace) {
     return "";
@@ -212,7 +224,8 @@ export function sanitizeStackTrace(stackTrace: string): string {
   const normalized: string = stackTrace
     .split("\n")
     .map((line: string): string => {
-      return INDENTED_FRAME_LINE_REGEX.test(line)
+      return INDENTED_FRAME_LINE_REGEX.test(line) ||
+        BROWSER_FRAME_LINE_REGEX.test(line)
         ? line
         : normalizeExceptionText(line);
     })

package/Server/Utils/Telemetry/LogExceptionExtractor.ts

@@ -56,10 +56,22 @@ const MAX_MESSAGE_LENGTH: number = 1024;
  * Single pre-compiled signature for "this body plausibly contains a stack
  * trace". Evaluated once before the (more expensive) multi-language parser.
  * Covers: Python traceback header, JS/Java `at file:line`, Go panic/goroutine,
- * Python `File "...", line N`, and a typed `SomethingException`/`SomethingError`.
+ * Python `File "...", line N`, a Firefox/Safari `fn@url:line:col` frame, and a
+ * typed `SomethingException`/`SomethingError`.
+ *
+ * The `fn@url:line` alternative mirrors the shape StackTraceParser's browser
+ * parser accepts and must stay in step with it. Without it a SpiderMonkey or
+ * JavaScriptCore stack reaches this gate with no `at ` frame and — unless the
+ * app happened to log a `*Error`/`*Exception` token above it — is rejected
+ * here, before the parser ever runs. The name class admits spaces (Safari's
+ * `global code@…`, Firefox's `promise callback*fn@…`) but never a colon, which
+ * is what keeps ordinary `key: value` log prose out. It also absorbs a log
+ * body's leading indentation, so do NOT prepend a `[ \t]*` — space and tab are
+ * already in the class, and the two overlapping quantifiers backtrack
+ * quadratically (a hostile 16 KB body measured 11 ms against 0.1 ms without).
  */
 const LOOKS_LIKE_STACK_TRACE: RegExp =
-  /(?:Traceback \(most recent call last\)|\n\s+at\s+.+:\d+|\bpanic:\s|goroutine\s+\d+\s+\[|\n\s*File\s+"[^"]+",\s+line\s+\d+|\b[A-Za-z_][\w.$]*(?:Exception|Error)\b)/;
+  /(?:Traceback \(most recent call last\)|\n\s+at\s+.+:\d+|\bpanic:\s|goroutine\s+\d+\s+\[|\n\s*File\s+"[^"]+",\s+line\s+\d+|(?:^|\n)[^@:\n]{0,256}@[A-Za-z][A-Za-z0-9+.-]{0,31}:[^\s]{1,2048}:\d{1,9}|\b[A-Za-z_][\w.$]*(?:Exception|Error)\b)/;
 
 // Header parsers for deriving exceptionType + message from a raw body.
 const PYTHON_TRACEBACK_HEADER: RegExp = /^Traceback \(most recent call last\):/;

package/Server/Utils/Telemetry/SourceMapResolver.ts

@@ -14,6 +14,7 @@ import {
   SourceCodeSnippet,
 } from "../../../Types/Telemetry/SourceMap";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import { SourceMapMaxFileSizeInBytes } from "../../EnvironmentConfig";
 import {
   AnyMap,
   TraceMap,
@@ -28,11 +29,12 @@ export interface SourceMapBundle {
 }
 
 /*
- * Hard ceiling on one map. Matches MAX_MULTIPART_FILE_BYTES on the upload
- * path; also enforced on the decoded string (invalid UTF-8 bytes expand to
- * 3-byte U+FFFD on decode, so the string can outgrow the raw file).
+ * Hard ceiling on one map, from SOURCE_MAP_MAX_FILE_SIZE_BYTES. Clamped to
+ * MAX_MULTIPART_FILE_BYTES on the upload path by the config layer; also
+ * enforced on the decoded string (invalid UTF-8 bytes expand to 3-byte
+ * U+FFFD on decode, so the string can outgrow the raw file).
  */
-export const MAX_SOURCE_MAP_SIZE_IN_BYTES: number = 50 * 1024 * 1024;
+export const MAX_SOURCE_MAP_SIZE_IN_BYTES: number = SourceMapMaxFileSizeInBytes;
 
 /** Lines of context shown on each side of the resolved line. */
 const SNIPPET_CONTEXT_LINES: number = 3;
@@ -51,7 +53,16 @@ const MAX_SNIPPET_LINE_LENGTH: number = 512;
  * through unresolved so the output length always equals the input length,
  * which the dashboard overlay relies on.
  */
-const MAX_FRAMES_TO_RESOLVE: number = 500;
+export const MAX_FRAMES_TO_RESOLVE: number = 500;
+
+/*
+ * Hard ceiling on the frames array ONE resolve request may carry. Well above
+ * anything a runtime produces — browsers truncate stack traces long before
+ * this — so it never rejects a real trace; it exists so the request body
+ * cannot be used to drive work proportional to a caller-chosen length. The
+ * per-call resolution cap above is the tighter, non-rejecting bound.
+ */
+export const MAX_FRAMES_PER_RESOLVE_REQUEST: number = 10000;
 
 interface ParsedBundle {
   bundlePath: string;