@oneuptime/common 12.0.3 → 12.0.4

package/Server/API/UserAPI.ts

@@ -1,10 +1,29 @@
+import Team from "../../Models/DatabaseModels/Team";
+import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import User from "../../Models/DatabaseModels/User";
+import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Query from "../../Types/BaseDatabase/Query";
+import LIMIT_MAX, { DEFAULT_LIMIT } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
+import { JSONArray, JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import TeamMembersByProject, {
+  UserProjectMembership,
+} from "../../Utils/TeamMembersByProject";
+import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
+import TeamMemberService from "../Services/TeamMemberService";
 import UserService, {
   Service as UserServiceType,
 } from "../Services/UserService";
-import { ExpressRequest, ExpressResponse } from "../Utils/Express";
+import CommonAPI from "./CommonAPI";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
@@ -16,6 +35,162 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
   public constructor() {
     super(User, UserService);
 
+    /*
+     * Every project one user belongs to, one row per project, for the Admin
+     * Dashboard's User > Projects page.
+     *
+     * There is no CRUD list that answers this. `GET /team-member` scoped to a
+     * user returns MEMBERSHIPS - a (user, team) pair - so a user on three teams
+     * of one project comes back as three rows and reads as three projects. This
+     * endpoint folds those into one row per project carrying every team the
+     * user is on there, which is both what the page renders and what any
+     * caller asking "which projects is this person in?" actually wants.
+     *
+     * Master-admin only: it deliberately reads across every tenant, which is
+     * exactly what no project-scoped caller is allowed to do. The middleware is
+     * the gate; the read below runs as root because a master admin is not a
+     * member of the projects being listed and so has no tenant permissions to
+     * read them with.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/projects`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const memberships: Array<TeamMember> = await TeamMemberService.findBy(
+            {
+              query: {
+                userId: userId,
+              },
+              select: {
+                _id: true,
+                projectId: true,
+                teamId: true,
+                hasAcceptedInvitation: true,
+                createdAt: true,
+                project: {
+                  _id: true,
+                  name: true,
+                  slug: true,
+                },
+                team: {
+                  _id: true,
+                  name: true,
+                },
+              },
+              limit: LIMIT_MAX,
+              skip: 0,
+              sort: {},
+              props: {
+                isRoot: true,
+              },
+            },
+          );
+
+          const rows: Array<UserProjectMembership> =
+            TeamMembersByProject.sortByProjectName(
+              TeamMembersByProject.groupByProject(memberships),
+            );
+
+          const skip: number = UserAPI.getPositiveIntegerParam(
+            req.query["skip"],
+            0,
+          );
+          const limit: number = UserAPI.getPositiveIntegerParam(
+            req.query["limit"],
+            DEFAULT_LIMIT,
+          );
+
+          const page: Array<UserProjectMembership> = rows.slice(
+            skip,
+            skip + limit,
+          );
+
+          return Response.sendJsonArrayResponse(
+            req,
+            res,
+            page.map((row: UserProjectMembership) => {
+              return UserAPI.serializeUserProjectMembership(userId, row);
+            }),
+            new PositiveNumber(rows.length),
+          );
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Removes one user from one project - every team they belong to in it - in
+     * a single call.
+     *
+     * A row on the User > Projects page is a project, so "remove" there means
+     * "remove from the project". Doing that as N separate DELETEs from the
+     * browser is not equivalent: TeamMemberService.onBeforeDelete refuses to
+     * remove the last accepted member of a team that shouldHaveAtLeastOneMember
+     * (the Owners team), and it refuses per request - so a client-side loop
+     * deletes every other membership first and only then reports the failure,
+     * leaving the user stripped of the teams the admin was just told they had
+     * not lost. One deleteBy over the whole set runs that guard against all of
+     * the user's memberships in the project before anything is deleted.
+     *
+     * This is the master-admin twin of
+     * POST /team-member/remove-user-from-project, which takes its project from
+     * the request's tenant. A master admin is not a member of the project and
+     * sends no tenant, so the project is named in the body here - the
+     * master-admin middleware, not a tenant, is what authorizes the call.
+     *
+     * The delete runs with the CALLER'S props rather than as root, so the
+     * Owners-team and SCIM Push Groups guards still apply: a master admin can
+     * remove people, but not leave a project ownerless or fight the customer's
+     * identity provider behind its back.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/remove-from-project`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const projectIdParam: string = (
+            (req.body?.["projectId"] as string) || ""
+          ).trim();
+
+          if (!projectIdParam) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("Project ID is required"),
+            );
+          }
+
+          ObjectID.validateUUID(projectIdParam);
+
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          const numberOfMembershipsDeleted: number =
+            await TeamMemberService.deleteBy({
+              query: {
+                userId: userId,
+                projectId: new ObjectID(projectIdParam),
+              } as Query<TeamMember>,
+              limit: LIMIT_MAX,
+              skip: 0,
+              props: props,
+            });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            numberOfMembershipsDeleted: numberOfMembershipsDeleted,
+          });
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/profile-picture/:userId`,
       async (req: ExpressRequest, res: ExpressResponse) => {
@@ -78,6 +253,93 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
     );
   }
 
+  /**
+   * The `:userId` in the path, rejected loudly if it is not a uuid.
+   *
+   * Validating rather than trusting matters even behind the master-admin gate:
+   * the value flows into a query, and a malformed id should fail as bad input
+   * rather than reach the database layer.
+   */
+  private static getUserIdFromParams(req: ExpressRequest): ObjectID {
+    const userIdParam: string = ((req.params["userId"] as string) || "").trim();
+
+    if (!userIdParam) {
+      throw new BadDataException("User ID is required");
+    }
+
+    ObjectID.validateUUID(userIdParam);
+
+    return new ObjectID(userIdParam);
+  }
+
+  /**
+   * A non-negative integer from a query string, or the fallback.
+   *
+   * Anything unparseable (missing, "abc", "-5", "1e9999") falls back rather
+   * than becoming NaN - a NaN skip/limit turns Array.slice into "return
+   * everything from 0", which would silently ignore paging instead of failing.
+   */
+  private static getPositiveIntegerParam(
+    value: unknown,
+    fallback: number,
+  ): number {
+    if (value === undefined || value === null || value === "") {
+      return fallback;
+    }
+
+    const parsed: number = Number(value.toString());
+
+    if (!Number.isFinite(parsed) || !Number.isInteger(parsed) || parsed < 0) {
+      return fallback;
+    }
+
+    return parsed;
+  }
+
+  /**
+   * One grouped row as JSON.
+   *
+   * The row is sent as a TeamMember - the model the row is built from, and the
+   * one the Admin Dashboard's table is typed against - carrying the project it
+   * stands for. The aggregate fields (`teams`, the counts) are not columns of
+   * TeamMember, so they are attached after serialization; the client reads them
+   * off the raw JSON before hydrating the model.
+   */
+  private static serializeUserProjectMembership(
+    userId: ObjectID,
+    row: UserProjectMembership,
+  ): JSONObject {
+    const teamMember: TeamMember = new TeamMember();
+
+    if (row.id) {
+      teamMember._id = row.id;
+    }
+
+    teamMember.userId = userId;
+    teamMember.hasAcceptedInvitation = row.hasAcceptedInvitation;
+
+    if (row.projectId) {
+      teamMember.projectId = row.projectId;
+    }
+
+    if (row.project) {
+      teamMember.project = row.project;
+    }
+
+    if (row.joinedAt) {
+      teamMember.createdAt = row.joinedAt;
+    }
+
+    const json: JSONObject = BaseModel.toJSON(teamMember, TeamMember);
+
+    json["teams"] = BaseModel.toJSONArray(row.teams, Team) as JSONArray;
+    json["teamCount"] = row.teams.length;
+    json["pendingTeamCount"] = row.pendingTeamCount;
+    json["teamMemberIds"] = [...row.teamMemberIds];
+
+    return json;
+  }
+
   private sendBlankProfile(req: ExpressRequest, res: ExpressResponse): void {
     Response.setNoCacheHeaders(res);
 

package/Server/EnvironmentConfig.ts

@@ -477,10 +477,14 @@ export const DisableQueueWorkers: boolean =
  * When "false", this process does NOT run schema or data migrations on boot.
  * Set on runtime pods (app/worker/nginx) when a dedicated one-shot migrate Job
  * (App/Migrate.ts) owns migrations instead, so the fleet's many replicas never
- * run them — which is what makes PgBouncer transaction-mode pooling safe (the
- * data-migration session advisory lock then only ever runs in the single Job).
+ * run them — which keeps boot DDL off pooled connections and, since the data
+ * migration runner no longer takes an advisory lock, is also what keeps two
+ * replicas from running the same migration concurrently.
+ *
  * Default true preserves the original self-migrating-on-boot behavior used by
- * docker-compose and any deploy that does not run the migrate Job.
+ * docker-compose and any deploy that does not run the migrate Job. Those
+ * deployments DO run several unserialized runners, so data migrations must be
+ * written to tolerate it (see Workers/Utils/DataMigration.ts).
  */
 export const RunDatabaseMigrationsOnBoot: boolean =
   process.env["RUN_DATABASE_MIGRATIONS_ON_BOOT"] !== "false";

package/Server/Infrastructure/GlobalCache.ts

@@ -291,6 +291,43 @@ export default abstract class GlobalCache {
     return Math.ceil(expiresInSeconds * (1 + Math.random() * 0.25));
   }
 
+  /*
+   * Atomic compare-and-delete: drop the key only if it still holds `value`.
+   * Returns true only when this caller's value was the one removed.
+   *
+   * This is the release half of a lease taken with `setStringIfNotExists`, and
+   * the comparison is what makes the release safe. A plain `deleteKey` is a
+   * check-then-act race in disguise: if the holder overruns its TTL the key
+   * expires, a second worker legitimately acquires the lease, and the first
+   * worker's release then deletes the SECOND worker's lease — handing the same
+   * lease to a third. Comparing the holder token collapses that into one
+   * atomic evaluation, so a late release is a no-op instead of a double-grant.
+   *
+   * The key is passed as KEYS[1] rather than inlined into the script body so
+   * the script stays correct on Redis Cluster, which routes by declared keys.
+   */
+  @CaptureSpan()
+  public static async deleteKeyIfValue(
+    namespace: string,
+    key: string,
+    value: string,
+  ): Promise<boolean> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const result: unknown = await client.eval(
+      "if redis.call('GET', KEYS[1]) == ARGV[1] then return redis.call('DEL', KEYS[1]) else return 0 end",
+      1,
+      `${namespace}-${key}`,
+      value,
+    );
+
+    return result === 1;
+  }
+
   @CaptureSpan()
   public static async deleteKey(namespace: string, key: string): Promise<void> {
     const client: ClientType | null = Redis.getClient();

package/Server/Infrastructure/Postgres/SchemaMigrations/1786018109307-AddPerUserPasswordSalt.ts

@@ -0,0 +1,21 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddPerUserPasswordSalt1786018109307 implements MigrationInterface {
+  public name = "AddPerUserPasswordSalt1786018109307";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD "passwordSalt" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPagePrivateUser" ADD "passwordSalt" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPagePrivateUser" DROP COLUMN "passwordSalt"`,
+    );
+    await queryRunner.query(`ALTER TABLE "User" DROP COLUMN "passwordSalt"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786023262402-WidenHashedStringColumnsForScrypt.ts

@@ -0,0 +1,68 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Widen every HashedString column from varchar(64) to varchar(255).
+ *
+ * A bare SHA-256 digest is 64 hex characters, which is exactly what the old
+ * column held. User passwords are now scrypt hashes that carry the cost
+ * parameters they were produced with — `scrypt$N=16384,r=8,p=1$<64 hex>`,
+ * about 90 characters — so that raising the cost later needs no migration and
+ * no password reset. The other HashedString columns (session refresh tokens,
+ * master passwords) still store a bare digest and simply do not use the room;
+ * they are widened only because they share ColumnLength.HashedString.
+ *
+ * WHY THIS FILE IS NOT WHAT `migration:generate` PRODUCED.
+ *
+ * TypeORM does not express a varchar length change as ALTER COLUMN TYPE. It
+ * emits DROP COLUMN followed by ADD COLUMN, which for these six columns means
+ * deleting every password, every status page and dashboard master password,
+ * and every active session in the instance. The generated `up()` also had to
+ * drop and recreate the refresh-token unique constraints and indexes, purely
+ * to work around its own DROP.
+ *
+ * ALTER COLUMN TYPE to a WIDER varchar is the correct statement and is
+ * cheaper besides: Postgres skips the table rewrite entirely when a varchar
+ * is only being lengthened (no rewrite means the unique indexes survive
+ * untouched too), so this is a catalog update behind a brief ACCESS EXCLUSIVE
+ * lock rather than a full copy of six tables.
+ *
+ * The resulting schema is identical to what the generated migration would
+ * have produced, which is what `npm run check-postgres-schema-drift` verifies.
+ */
+
+const WIDENED_COLUMNS: ReadonlyArray<{ table: string; column: string }> = [
+  { table: "User", column: "password" },
+  { table: "StatusPagePrivateUser", column: "password" },
+  { table: "StatusPage", column: "masterPassword" },
+  { table: "Dashboard", column: "masterPassword" },
+  { table: "UserSession", column: "refreshToken" },
+  { table: "StatusPagePrivateUserSession", column: "refreshToken" },
+];
+
+export class WidenHashedStringColumnsForScrypt1786023262402
+  implements MigrationInterface
+{
+  public name = "WidenHashedStringColumnsForScrypt1786023262402";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    for (const { table, column } of WIDENED_COLUMNS) {
+      await queryRunner.query(
+        `ALTER TABLE "${table}" ALTER COLUMN "${column}" TYPE character varying(255)`,
+      );
+    }
+  }
+
+  /*
+   * Narrowing back to 64 fails loudly if any scrypt hash has been written,
+   * because those do not fit. That is the intended behaviour: a down
+   * migration that truncated password hashes would lock every user out
+   * silently instead of refusing.
+   */
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    for (const { table, column } of [...WIDENED_COLUMNS].reverse()) {
+      await queryRunner.query(
+        `ALTER TABLE "${table}" ALTER COLUMN "${column}" TYPE character varying(64)`,
+      );
+    }
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786100000000-RestoreServiceLowerNameIndex.ts

@@ -0,0 +1,100 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Restores the expression index that serves the telemetry ingest path's
+ * `service.name` lookup, and that an autogenerated migration deleted.
+ *
+ * WHAT BROKE
+ *
+ * `OTelIngestService.findOrCreateTelemetryService` resolves an OTLP resource's
+ * `service.name` to a Service row through `QueryHelper.findWithSameText`, which
+ * emits a case-insensitive predicate:
+ *
+ *   WHERE "projectId" = $1 AND LOWER("name") = $2 AND "deletedAt" IS NULL
+ *   ORDER BY "createdAt" ASC LIMIT 1
+ *
+ * Every live index on Service is over the RAW `name` column. Postgres cannot
+ * invert `lower()` (it is not order-preserving under any non-C collation) and
+ * PG16 has no index-condition pushdown, so `LOWER("name") = $2` degrades to a
+ * post-heap-fetch Filter. Only the `projectId` prefix acts as an index qual,
+ * which makes each lookup cost O(services in that project) heap fetches plus
+ * that many collation-aware lower() calls — not O(log n).
+ *
+ * That query runs once per OTLP *resource* (hundreds per batch for the shipped
+ * host-metrics collector config), again per signal type, from every ingest pod.
+ * Production sat at 100% CPU against a 100% buffer cache hit ratio and ~110 B/s
+ * of reads: entirely in memory, entirely CPU.
+ *
+ * WHY IT BROKE
+ *
+ * The correct index existed. Migration 1774559064921 created:
+ *
+ *   CREATE UNIQUE INDEX "IDX_SERVICE_PROJECT_NAME_UNIQUE"
+ *     ON "Service" ("projectId", LOWER("name")) WHERE "deletedAt" IS NULL
+ *
+ * Migration 1775735059360 — otherwise two unrelated column-default changes —
+ * dropped it. TypeORM's schema builder matches database indexes to entity
+ * metadata BY NAME and drops any it cannot find, and a hand-named expression
+ * index created only in a migration is invisible to entity metadata. Its down()
+ * "restores" the index as ("projectId") alone, silently losing the expression,
+ * which is the signature of a machine-generated statement rather than a
+ * deliberate one.
+ *
+ * The Service entity now declares this index with `synchronize: false`, which
+ * makes the schema builder skip it in both directions. Without that decorator
+ * this migration would be undone again by the next autogenerated one.
+ *
+ * WHY THIS IS HAND-WRITTEN
+ *
+ * AGENTS.md requires migrations to come from `npm run generate-postgres-migration`.
+ * That cannot produce this one: `@Index()` has no way to express `LOWER(...)`,
+ * so TypeORM can neither generate nor round-trip an expression index. The
+ * generator is authoritative for column and table drift; expression indexes are
+ * outside what it can model.
+ *
+ * NOT UNIQUE, DELIBERATELY
+ *
+ * The dropped original was UNIQUE. Recreating it that way would make this
+ * migration fail on any project that already holds two services whose names
+ * differ only by case — which the surviving raw-name unique index permits, so
+ * such rows can legitimately exist today. Failing a deploy to enforce an
+ * invariant nobody is currently relying on is the wrong trade: this index
+ * exists to make the lookup fast. `ORDER BY "createdAt" ASC LIMIT 1` in the
+ * query already resolves duplicates deterministically (oldest wins), and the
+ * raw-name unique index still blocks exact-duplicate races. Restoring
+ * case-insensitive uniqueness would need a dedupe pass first, as migration
+ * 1778100000000 did, and belongs in its own change.
+ *
+ * `createdAt` is the third key column so the ORDER BY is satisfied by the index
+ * itself and the plan carries no Sort node even when duplicates exist.
+ *
+ * NOT CONCURRENT, DELIBERATELY
+ *
+ * DataSourceOptions sets no `migrationsTransactionMode`, so TypeORM defaults to
+ * "all" and runs every migration inside ONE transaction. `CREATE INDEX
+ * CONCURRENTLY` cannot run inside a transaction block and would abort the whole
+ * run. A plain CREATE INDEX takes a SHARE lock that blocks writes to Service
+ * for the duration, which is milliseconds at this table's size (thousands of
+ * live rows).
+ *
+ * IF NOT EXISTS makes this a no-op when an operator has already created the
+ * index by hand — the recommended incident mitigation is to build it
+ * CONCURRENTLY on the live database under this exact name, ahead of the deploy.
+ */
+export class RestoreServiceLowerNameIndex1786100000000
+  implements MigrationInterface
+{
+  public name: string = "RestoreServiceLowerNameIndex1786100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE INDEX IF NOT EXISTS "IDX_SERVICE_PROJECT_LOWER_NAME" ON "Service" ("projectId", LOWER("name"), "createdAt") WHERE "deletedAt" IS NULL`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX IF EXISTS "public"."IDX_SERVICE_PROJECT_LOWER_NAME"`,
+    );
+  }
+}