@oneuptime/common 12.0.3 → 12.0.4

package/Models/DatabaseModels/CephCluster.ts

@@ -80,6 +80,20 @@ import {
  */
 @Index(["projectId", "name"], { unique: true })
 @Index(["projectId", "isArchived"])
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index("IDX_ceph_cluster_slug", ["slug"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
 @TableMetadata({
   tableName: "CephCluster",
   singularName: "Ceph Cluster",

package/Models/DatabaseModels/CodeRepository.ts

@@ -649,13 +649,21 @@ export default class CodeRepository extends BaseModel {
   })
   public repositoryUrl?: URL = undefined;
 
-  // GitHub App specific fields
+  /*
+   * GitHub App specific fields.
+   *
+   * `create` is empty on purpose. This column decides which GitHub App
+   * installation a repository token is minted from, so a caller who could set
+   * it could name ANOTHER tenant's installation, put the row in a project they
+   * own, and pass every "is this row in your project?" check on the way to a
+   * live `ghs_` token. It is assigned server-side only — by the install
+   * callback and the installation webhooks, which write with `isRoot` after
+   * GitHub has confirmed the installation belongs to the project.
+   * CodeRepositoryService.onBeforeCreate/onBeforeUpdate enforce the same rule
+   * a second time, in case a future route writes as root.
+   */
   @ColumnAccessControl({
-    create: [
-      Permission.ProjectOwner,
-      Permission.ProjectAdmin,
-      Permission.CreateCodeRepository,
-    ],
+    create: [],
     read: [
       Permission.ProjectOwner,
       Permission.ProjectAdmin,

package/Models/DatabaseModels/DockerHost.ts

@@ -72,6 +72,20 @@ import {
 @CrudApiEndpoint(new Route("/docker-host"))
 @SlugifyColumn("name", "slug")
 @Index(["projectId", "isArchived"])
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index("IDX_docker_host_slug", ["slug"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
 @TableMetadata({
   tableName: "DockerHost",
   singularName: "Docker Host",

package/Models/DatabaseModels/GlobalOidcProject.ts

@@ -39,6 +39,24 @@ import {
   update: [],
 })
 @CrudApiEndpoint(new Route("/global-oidc-project"))
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index(
+  "IDX_GlobalOIDCProject_globalOidcId_projectId",
+  ["globalOidcId", "projectId"],
+  {
+    unique: true,
+    where: '"deletedAt" IS NULL',
+  },
+)
 @TableMetadata({
   tableName: "GlobalOIDCProject",
   singularName: "Global OIDC Project",

package/Models/DatabaseModels/GlobalSsoProject.ts

@@ -42,6 +42,24 @@ import {
   update: [],
 })
 @CrudApiEndpoint(new Route("/global-sso-project"))
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index(
+  "IDX_GlobalSSOProject_globalSsoId_projectId",
+  ["globalSsoId", "projectId"],
+  {
+    unique: true,
+    where: '"deletedAt" IS NULL',
+  },
+)
 @TableMetadata({
   tableName: "GlobalSSOProject",
   singularName: "Global SSO Project",

package/Models/DatabaseModels/IoTFleet.ts

@@ -80,6 +80,20 @@ import {
  */
 @Index(["projectId", "name"], { unique: true })
 @Index(["projectId", "isArchived"])
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index("IDX_iot_fleet_slug", ["slug"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
 @TableMetadata({
   tableName: "IoTFleet",
   singularName: "IoT Fleet",

package/Models/DatabaseModels/KubernetesCluster.ts

@@ -79,6 +79,20 @@ import {
  */
 @Index(["projectId", "clusterIdentifier"], { unique: true })
 @Index(["projectId", "isArchived"])
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index("IDX_kubernetes_cluster_slug", ["slug"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
 @TableMetadata({
   tableName: "KubernetesCluster",
   singularName: "Kubernetes Cluster",

package/Models/DatabaseModels/NetworkDevice.ts

@@ -78,6 +78,20 @@ import {
 @CrudApiEndpoint(new Route("/network-device"))
 @SlugifyColumn("name", "slug")
 @Index(["projectId", "isArchived"])
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index("IDX_network_device_slug", ["slug"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
 @TableMetadata({
   tableName: "NetworkDevice",
   singularName: "Network Device",

package/Models/DatabaseModels/NetworkInterface.ts

@@ -72,6 +72,24 @@ const decimalTransformer: ValueTransformer = {
 })
 @CrudApiEndpoint(new Route("/network-interface"))
 @Index(["projectId", "networkDeviceId"])
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index(
+  "IDX_network_interface_device_ifindex",
+  ["networkDeviceId", "interfaceIndex"],
+  {
+    unique: true,
+    where: '"deletedAt" IS NULL',
+  },
+)
 @TableMetadata({
   tableName: "NetworkInterface",
   singularName: "Network Interface",

package/Models/DatabaseModels/Project.ts

@@ -2583,7 +2583,21 @@ export default class Project extends TenantModel {
   })
   public doNotAddGlobalProbesByDefaultOnNewMonitors?: boolean = undefined;
 
-  // GitHub App Installation ID for this project
+  /*
+   * GitHub App Installation ID for this project.
+   *
+   * This column IS the authority on which GitHub App installation a project
+   * owns — every path that mints a repository token re-derives the binding
+   * from it (see GitHubInstallationBinding). That makes it security state, not
+   * project configuration, so `update` is empty: a Project Owner who could PUT
+   * an arbitrary installation ID here would simply be writing their own
+   * permission slip to another tenant's repositories.
+   *
+   * It is written server-side only, with `isRoot`, by the GitHub App install
+   * callback — and only after the OAuth user-to-server round trip has proved
+   * to GitHub's satisfaction that the installer controls that installation —
+   * and cleared again by the `installation.deleted` webhook.
+   */
   @ColumnAccessControl({
     create: [],
     read: [
@@ -2593,7 +2607,7 @@ export default class Project extends TenantModel {
       Permission.Viewer,
       Permission.ReadProject,
     ],
-    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+    update: [],
   })
   @TableColumn({
     required: false,

package/Models/DatabaseModels/ProxmoxCluster.ts

@@ -81,6 +81,20 @@ import {
  */
 @Index(["projectId", "name"], { unique: true })
 @Index(["projectId", "isArchived"])
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index("IDX_proxmox_cluster_slug", ["slug"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
 @TableMetadata({
   tableName: "ProxmoxCluster",
   singularName: "Proxmox Cluster",

package/Models/DatabaseModels/Service.ts

@@ -26,6 +26,7 @@ import Permission from "../../Types/Permission";
 import TechStack from "../../Types/Service/TechStack";
 import MetricDownsamplingRetentionDays from "../../Types/Metrics/MetricDownsamplingRetentionDays";
 import TelemetryRetentionConfig from "../../Types/Telemetry/TelemetryRetentionConfig";
+import UNSYNCHRONIZED_INDEX from "../../Types/Database/UnsynchronizedIndex";
 import {
   Column,
   Entity,
@@ -101,6 +102,35 @@ import {
  */
 @Index(["projectId", "name"], { unique: true })
 @Index(["projectId", "isArchived"])
+/*
+ * Serves the hottest read on the telemetry ingest path: OTLP resource
+ * resolution looks a service up by `service.name` case-insensitively, so
+ * `QueryHelper.findWithSameText` emits `LOWER("Service"."name") = $2`. The
+ * unique index above is over the RAW name column and cannot satisfy that
+ * predicate — Postgres can only use its `projectId` prefix as an index qual and
+ * must then heap-fetch and filter every service in the project. The real
+ * definition is an EXPRESSION index and lives in migration
+ * 1786100000000-RestoreServiceLowerNameIndex; `@Index()` cannot express
+ * `LOWER(...)`.
+ *
+ * `synchronize: false` is the load-bearing part of this declaration, and it is
+ * why the index is declared here at all rather than only in the migration.
+ * TypeORM's schema builder matches database indexes to entity metadata BY NAME
+ * and drops every one it cannot find (RdbmsSchemaBuilder.dropOldIndices). An
+ * index created only in a migration is therefore invisible to it and gets
+ * emitted as a DROP by the next autogenerated migration. That is not
+ * hypothetical: this exact index existed once, as
+ * IDX_SERVICE_PROJECT_NAME_UNIQUE in migration 1774559064921, and migration
+ * 1775735059360 dropped it as collateral damage — its down() even "restores"
+ * it without the LOWER(), so the round-trip silently loses the expression.
+ * Naming it here with synchronize:false makes the builder skip it in both
+ * directions: it will never drop it, and it will never try to create it.
+ */
+@Index(
+  "IDX_SERVICE_PROJECT_LOWER_NAME",
+  ["projectId", "name"],
+  UNSYNCHRONIZED_INDEX,
+)
 @TableMetadata({
   tableName: "Service",
   singularName: "Service",

package/Models/DatabaseModels/StatusPagePrivateUser.ts

@@ -319,6 +319,7 @@ export default class StatusPagePrivateUser extends BaseModel {
   @TableColumn({
     title: "Password",
     hashed: true,
+    hashSaltColumn: "passwordSalt",
     type: TableColumnType.HashedString,
   })
   @Column({
@@ -330,6 +331,35 @@ export default class StatusPagePrivateUser extends BaseModel {
   })
   public password?: HashedString = undefined;
 
+  /*
+   * Per-user salt mixed into `password`'s hash. Written by the database
+   * write path on every password write — never by an API caller, hence the
+   * empty access control and `computed: true`.
+   *
+   * Nullable on purpose: rows that predate per-user salts have none, and are
+   * verified against the legacy unsalted scheme until the next successful
+   * login re-hashes them with a fresh salt.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    title: "Password Salt",
+    description: "Per-user random salt mixed into this user's password hash.",
+    computed: true,
+    type: TableColumnType.ShortText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public passwordSalt?: string = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/User.ts

@@ -140,6 +140,7 @@ class User extends UserModel {
   @TableColumn({
     title: "Password",
     hashed: true,
+    hashSaltColumn: "passwordSalt",
     type: TableColumnType.HashedString,
   })
   @Column({
@@ -151,6 +152,35 @@ class User extends UserModel {
   })
   public password?: HashedString = undefined;
 
+  /*
+   * Per-user salt mixed into `password`'s hash. Written by the database
+   * write path on every password write — never by an API caller, hence the
+   * empty access control and `computed: true`.
+   *
+   * Nullable on purpose: rows that predate per-user salts have none, and are
+   * verified against the legacy unsalted scheme until the next successful
+   * login re-hashes them with a fresh salt.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    title: "Password Salt",
+    description: "Per-user random salt mixed into this user's password hash.",
+    computed: true,
+    type: TableColumnType.ShortText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public passwordSalt?: string = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [Permission.CurrentUser],

package/Server/API/AIAgentDataAPI.ts

@@ -69,6 +69,7 @@ import ObjectID from "../../Types/ObjectID";
 import GitHubUtil, {
   GitHubInstallationToken,
 } from "../Utils/CodeRepository/GitHub/GitHub";
+import GitHubInstallationBinding from "../Utils/CodeRepository/GitHub/GitHubInstallationBinding";
 import CodeRepositoryType from "../../Types/CodeRepository/CodeRepositoryType";
 import URL from "../../Types/API/URL";
 import PullRequestState from "../../Types/CodeRepository/PullRequestState";
@@ -1166,6 +1167,36 @@ export default class AIAgentDataAPI {
             );
           }
 
+          /*
+           * The project check above proves the ROW is in the agent's project.
+           * It does not prove the INSTALLATION is — and those are different
+           * questions, because the row's installation ID is just a number
+           * stored on a record. Someone who could get an arbitrary
+           * installation ID onto a row in a project they own would otherwise
+           * pass every check to this point and be handed a live `ghs_` token
+           * for another tenant's repositories. So re-derive the binding from
+           * the project itself, right before minting.
+           */
+          if (
+            !codeRepository.projectId ||
+            !(await GitHubInstallationBinding.isInstallationBoundToProject({
+              projectId: codeRepository.projectId,
+              installationId: codeRepository.gitHubAppInstallationId,
+            }))
+          ) {
+            logger.error(
+              `Refusing to mint a GitHub token for code repository ${codeRepositoryId.toString()}: installation ${codeRepository.gitHubAppInstallationId} is not bound to project ${codeRepository.projectId?.toString()}.`,
+            );
+
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "This repository's GitHub App installation is not connected to its project. Please reconnect the GitHub App from Project Settings.",
+              ),
+            );
+          }
+
           /*
            * G11 guardrail: per-repo open-PR cap, enforced HERE because the
            * token is the agent's only way to clone and push — a repo at its