@oneuptime/common 12.0.3 → 12.0.4

package/Server/Services/UserService.ts

@@ -24,6 +24,9 @@ import URL from "../../Types/API/URL";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import OneUptimeDate from "../../Types/Date";
+import PositiveNumber from "../../Types/PositiveNumber";
+import ProjectService from "./ProjectService";
+import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
 import Email from "../../Types/Email";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
 import HashedString from "../../Types/HashedString";
@@ -45,6 +48,37 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Timezone from "../../Types/Timezone";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 
+/*
+ * Names the Redis mutex that serializes the first-Master-Admin election across
+ * every process on this instance. Namespaced the same way as the other
+ * cross-process mutexes in this codebase (see ProjectService's counter locks)
+ * so the key is self-documenting in Redis and cannot collide with another lock.
+ */
+const FIRST_MASTER_ADMIN_ELECTION_LOCK_NAMESPACE: string =
+  "UserService.firstMasterAdminElection";
+const FIRST_MASTER_ADMIN_ELECTION_LOCK_KEY: string = "instance";
+
+/*
+ * How long the mutex survives without being refreshed. This is a crash bound,
+ * NOT a work budget: redis-semaphore refreshes an held lock every
+ * 0.8 * lockTimeout for as long as the holder is alive, so a slow COUNT+INSERT
+ * does not expire the lock out from under itself. It only matters when a holder
+ * dies mid-election (SIGKILL, eviction) — the lock then frees itself after this
+ * long instead of wedging every subsequent signup on the instance forever.
+ */
+const FIRST_MASTER_ADMIN_ELECTION_LOCK_TIMEOUT_MS: number = 10_000;
+
+/*
+ * How long a signup waits for the lock before giving up. Signup is a
+ * user-facing request, so the wait has to be bounded rather than indefinite —
+ * this replaces the bound that Postgres `lock_timeout` used to give us.
+ *
+ * Failing the signup is the correct outcome when it fires: refusing to serve
+ * one request is safe, serving it unserialized is exactly the bug this lock
+ * exists to prevent (GHSA-3qqq-hprx-g2jw).
+ */
+const FIRST_MASTER_ADMIN_ELECTION_ACQUIRE_TIMEOUT_MS: number = 5_000;
+
 export class Service extends DatabaseService<Model> {
   /*
    * Suppresses repeated `lastActive` UPDATEs from a single API node. 60s of
@@ -499,6 +533,156 @@ export class Service extends DatabaseService<Model> {
     return onUpdate;
   }
 
+  /**
+   * Creates a user who is signing themselves up, and decides — atomically —
+   * whether they are the instance's very first Master Admin.
+   *
+   * Every signup MUST come through here rather than calling `create` directly,
+   * because this method is the only place that is allowed to set
+   * `isMasterAdmin` on a self-service signup. It always assigns the column, so
+   * an `isMasterAdmin: true` smuggled into the request body is overwritten
+   * rather than honoured (signup creates with `isRoot: true`, which bypasses
+   * the column's empty `create: []` access control).
+   */
+  @CaptureSpan()
+  public async createUserOnSignup(data: {
+    user: Model;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<Model> {
+    // Never inherited from the caller. Decided below, or not at all.
+    data.user.isMasterAdmin = false;
+
+    if (IsBillingEnabled) {
+      /*
+       * On the hosted service there is no first-user bootstrap: master admins
+       * are provisioned out of band, so there is nothing to elect and no reason
+       * to take a lock.
+       */
+      return await this.create({
+        data: data.user,
+        props: data.props,
+      });
+    }
+
+    /*
+     * Self-hosted: the first user to sign up bootstraps the instance as Master
+     * Admin. The eligibility check reads the User table and the create writes to
+     * it, which is a read-then-write and therefore not atomic on its own — two
+     * signups landing together both counted zero users and both became Master
+     * Admin (GHSA-3qqq-hprx-g2jw). Serialize the check and the insert
+     * instance-wide so the second request observes the first one's row.
+     *
+     * The mutex is the Redis one every other cross-process critical section in
+     * this codebase uses (Semaphore), not a Postgres advisory lock. It holds no
+     * database connection and no open transaction, so serializing signups
+     * cannot pin a pooled backend `idle in transaction`, and it is unaffected
+     * by how PgBouncer is pooling.
+     */
+    let mutex: SemaphoreMutex;
+
+    try {
+      mutex = await Semaphore.lock({
+        key: FIRST_MASTER_ADMIN_ELECTION_LOCK_KEY,
+        namespace: FIRST_MASTER_ADMIN_ELECTION_LOCK_NAMESPACE,
+        lockTimeout: FIRST_MASTER_ADMIN_ELECTION_LOCK_TIMEOUT_MS,
+        acquireTimeout: FIRST_MASTER_ADMIN_ELECTION_ACQUIRE_TIMEOUT_MS,
+      });
+    } catch (err) {
+      /*
+       * Redis unreachable, or the lock stayed contended past the acquire
+       * timeout. Fail the signup rather than fall back to an unserialized
+       * election — the fallback is the vulnerability.
+       */
+      logger.error(
+        "Refusing to create a signup: could not acquire the first-Master-Admin election lock.",
+      );
+      logger.error(err);
+
+      throw err;
+    }
+
+    /*
+     * The critical section deliberately covers the INSERT, not just the count:
+     * releasing after the count would let the next holder count a table the
+     * winner had not written to yet, which is the same race with extra steps.
+     *
+     * `finally` so a failed create still frees the lock immediately instead of
+     * blocking every other signup until lockTimeout elapses.
+     */
+    try {
+      data.user.isMasterAdmin = await this.isInstanceAwaitingFirstUser();
+
+      return await this.create({
+        data: data.user,
+        props: data.props,
+      });
+    } finally {
+      try {
+        await Semaphore.release(mutex);
+      } catch (err) {
+        /*
+         * Best-effort and non-masking: an error here must not replace the
+         * outcome of the signup, and an unreleased lock still expires on its
+         * own after lockTimeout.
+         */
+        logger.error(
+          "Failed to release the first-Master-Admin election lock; it will expire on its own.",
+        );
+        logger.error(err);
+      }
+    }
+  }
+
+  /**
+   * Is this a brand-new instance that nobody has ever signed up to — i.e. may
+   * the next user through the door take Master Admin?
+   *
+   * Only ever called while holding the first-Master-Admin election mutex.
+   */
+  private async isInstanceAwaitingFirstUser(): Promise<boolean> {
+    const userCount: PositiveNumber = await this.countBy({
+      props: {
+        isRoot: true,
+      },
+      query: {},
+    });
+
+    if (!userCount.isZero()) {
+      return false;
+    }
+
+    /*
+     * Zero users, but projects exist: this is not a fresh install, it is an
+     * instance whose User table was emptied out from under it — a bad restore, a
+     * cleanup script, a cascade. Handing Master Admin to whoever signs up next
+     * would be a free promotion for a stranger, so refuse and make the operator
+     * grant it deliberately.
+     *
+     * This cannot fire on any supported path: a user who belongs to a project
+     * cannot be deleted (see onBeforeDelete), so "projects with no users at all"
+     * is only reachable by writing to the database directly. It does not get in
+     * the way of the ordinary recovery either — someone who signs up, has no
+     * projects yet, deletes their account and signs up again still bootstraps
+     * normally.
+     */
+    const projectCount: PositiveNumber = await ProjectService.countBy({
+      props: {
+        isRoot: true,
+      },
+      query: {},
+    });
+
+    if (!projectCount.isZero()) {
+      logger.warn(
+        "Refusing to grant Master Admin to a new signup: the User table is empty but this instance already has projects. Grant Master Admin explicitly instead.",
+      );
+
+      return false;
+    }
+
+    return true;
+  }
+
   @CaptureSpan()
   public async createByEmail(data: {
     email: Email;

package/Server/Utils/AI/Toolbox/CodeTools.ts

@@ -17,6 +17,7 @@ import {
   RepoResolution,
 } from "../../CodeRepository/StackTraceRepoResolver";
 import logger from "../../Logger";
+import GitHubInstallationBinding from "../../CodeRepository/GitHub/GitHubInstallationBinding";
 import StackTraceParser, {
   ParsedStackTrace,
   StackFrame,
@@ -121,6 +122,7 @@ export async function findReadableRepositories(
       query: query as never,
       select: {
         _id: true,
+        projectId: true,
         name: true,
         organizationName: true,
         repositoryName: true,
@@ -134,11 +136,50 @@ export async function findReadableRepositories(
       props: ctx.props,
     });
 
-  return repositories.filter((repository: CodeRepository) => {
-    return (
-      repository.repositoryHostedAt === CodeRepositoryType.GitHub &&
-      Boolean(repository.gitHubAppInstallationId)
+  const gitHubRepositories: Array<CodeRepository> = repositories.filter(
+    (repository: CodeRepository) => {
+      return (
+        repository.repositoryHostedAt === CodeRepositoryType.GitHub &&
+        Boolean(repository.gitHubAppInstallationId)
+      );
+    },
+  );
+
+  /*
+   * Every code tool — read and write — resolves its target through here, so
+   * this is the one place that has to prove the row's installation really
+   * belongs to the row's project (GHSA-xx95-gmcf-7q86). "The row is in your
+   * project" is not that proof: before the fix a caller could put any
+   * installation ID on a row in a project they owned, and these tools would
+   * then read source, commit and open pull requests in another tenant's
+   * private repositories.
+   *
+   * Writing an unbound installation ID is closed off now and the quarantine
+   * migration clears the rows that already existed, so this filter should
+   * never drop anything on a healthy database. It stays because the cost of
+   * being wrong here is another tenant's source code.
+   */
+  if (gitHubRepositories.length === 0) {
+    return gitHubRepositories;
+  }
+
+  // Every row here is in ctx.projectId, so one lookup answers for all of them.
+  const boundInstallationId: string | null =
+    await GitHubInstallationBinding.getBoundInstallationId(ctx.projectId);
+
+  return gitHubRepositories.filter((repository: CodeRepository) => {
+    if (
+      boundInstallationId &&
+      repository.gitHubAppInstallationId === boundInstallationId
+    ) {
+      return true;
+    }
+
+    logger.error(
+      `Excluding code repository ${repository.id?.toString()} from AI code tools: its GitHub App installation is not bound to project ${ctx.projectId.toString()}.`,
     );
+
+    return false;
   });
 }
 

package/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

@@ -1169,11 +1169,24 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
   public toSortStatement(sort: Sort<TBaseModel>): Statement {
     const sortStatement: Statement = new Statement();
 
+    /*
+     * Keys must be comma separated. Without the separator a multi-key sort
+     * concatenates into a single malformed term (`time DESCseverity ASC`),
+     * so every ORDER BY beyond the first key was unusable. Mirrors
+     * toGroupByStatement above.
+     */
+    let first: boolean = true;
     for (const key in sort) {
       if (!this.model.getTableColumn(key)) {
         throw new BadDataException(`Unknown column: ${key}`);
       }
 
+      if (first) {
+        first = false;
+      } else {
+        sortStatement.append(SQL`, `);
+      }
+
       const value: SortOrder = sort[key]!;
       sortStatement.append(SQL`${key} `).append(
         {

package/Server/Utils/CodeRepository/GitHub/GitHub.ts

@@ -16,6 +16,8 @@ import { JSONArray, JSONObject } from "../../../../Types/JSON";
 import API from "../../../../Utils/API";
 import CaptureSpan from "../../Telemetry/CaptureSpan";
 import {
+  GitHubAppClientId,
+  GitHubAppClientSecret,
   GitHubAppId,
   GitHubAppPrivateKey,
   GitHubAppWebhookSecret,
@@ -686,6 +688,140 @@ export default class GitHubUtil extends HostedCodeRepository {
     return GitHubUtil.summarizeCheckRuns(allCheckRuns);
   }
 
+  /*
+   * Exchanges the short-lived OAuth `code` GitHub appends to the install
+   * redirect for a user-to-server access token.
+   *
+   * This is the ONLY thing that ties a redirect back to the human who
+   * actually performed the install: `installation_id` is just a number in a
+   * query string that anyone can type, but `code` is minted by GitHub for one
+   * specific GitHub user and is single-use. Pair it with
+   * listInstallationIdsForUserAccessToken below to answer "does this person
+   * really control this installation?".
+   */
+  @CaptureSpan()
+  public static async exchangeOAuthCodeForUserAccessToken(
+    code: string,
+  ): Promise<string> {
+    if (!GitHubAppClientId || !GitHubAppClientSecret) {
+      throw new BadDataException(
+        'GitHub App OAuth is not configured on this OneUptime instance. Set GITHUB_APP_CLIENT_ID and GITHUB_APP_CLIENT_SECRET, and enable "Request user authorization (OAuth) during installation" in the GitHub App settings.',
+      );
+    }
+
+    const result: HTTPErrorResponse | HTTPResponse<JSONObject> = await API.post(
+      {
+        url: URL.fromString("https://github.com/login/oauth/access_token"),
+        data: {
+          client_id: GitHubAppClientId,
+          client_secret: GitHubAppClientSecret,
+          code: code,
+        },
+        headers: {
+          Accept: "application/json",
+        },
+      },
+    );
+
+    if (result instanceof HTTPErrorResponse) {
+      throw new BadDataException(
+        "Could not verify the GitHub App installation with GitHub. Please restart the installation from OneUptime.",
+      );
+    }
+
+    const accessToken: string | undefined =
+      result.data["access_token"]?.toString();
+
+    /*
+     * GitHub answers a bad / expired / already-redeemed code with HTTP 200 and
+     * an `error` body, so a non-error status is not enough on its own.
+     */
+    if (!accessToken) {
+      throw new BadDataException(
+        "The GitHub authorization code is invalid or has already been used. Please restart the installation from OneUptime.",
+      );
+    }
+
+    return accessToken;
+  }
+
+  /*
+   * Lists the IDs of every installation of THIS GitHub App that the user
+   * behind `userAccessToken` can administer. GitHub scopes this endpoint to
+   * the app the token was issued for, so a token minted by another app cannot
+   * widen it.
+   */
+  @CaptureSpan()
+  public static async listInstallationIdsForUserAccessToken(
+    userAccessToken: string,
+  ): Promise<Array<string>> {
+    const installationIds: Array<string> = [];
+    let page: number = 1;
+    let hasMore: boolean = true;
+
+    while (hasMore) {
+      const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
+        await API.get({
+          url: URL.fromString(
+            `https://api.github.com/user/installations?per_page=100&page=${page}`,
+          ),
+          headers: {
+            Authorization: `Bearer ${userAccessToken}`,
+            Accept: "application/vnd.github+json",
+            "X-GitHub-Api-Version": "2022-11-28",
+          },
+        });
+
+      if (result instanceof HTTPErrorResponse) {
+        throw new BadDataException(
+          "Could not read your GitHub App installations from GitHub. Please restart the installation from OneUptime.",
+        );
+      }
+
+      const installations: JSONArray =
+        (result.data["installations"] as JSONArray) || [];
+
+      for (const installation of installations) {
+        const installationId: string | undefined = (
+          installation as JSONObject
+        )?.["id"]?.toString();
+
+        if (installationId) {
+          installationIds.push(installationId);
+        }
+      }
+
+      hasMore = installations.length === 100;
+      page++;
+    }
+
+    return installationIds;
+  }
+
+  /*
+   * Proves that the person completing the install redirect actually controls
+   * the installation they claim, by round-tripping the OAuth code through
+   * GitHub. Throws (never returns false) so no caller can accidentally treat
+   * a verification failure as a pass.
+   */
+  @CaptureSpan()
+  public static async assertUserControlsInstallation(data: {
+    oauthCode: string;
+    installationId: string;
+  }): Promise<void> {
+    const userAccessToken: string =
+      await GitHubUtil.exchangeOAuthCodeForUserAccessToken(data.oauthCode);
+
+    const installationIds: Array<string> =
+      await GitHubUtil.listInstallationIdsForUserAccessToken(userAccessToken);
+
+    if (!installationIds.includes(data.installationId.toString())) {
+      throw new BadDataException(
+        "The GitHub account you authorized does not have access to this GitHub App installation. Please restart the installation from OneUptime.",
+      );
+    }
+  }
+
   /**
    * Lists repositories accessible to a GitHub App installation
    * @param installationId - The GitHub App installation ID
@@ -767,7 +903,15 @@ export default class GitHubUtil extends HostedCodeRepository {
     branchName: string;
   }): Promise<Array<string>> {
     const cacheNamespace: string = "github-repo-tree";
-    const cacheKey: string = `${data.organizationName}/${data.repositoryName}@${data.branchName}`;
+
+    /*
+     * The installation is part of the key because this cache is read BEFORE a
+     * token is minted — so the key is doing the access control for a cache
+     * hit. Keyed on org/repo/branch alone, any caller who could name someone
+     * else's repository would be served that repository's cached private file
+     * listing without ever proving access to it.
+     */
+    const cacheKey: string = `${data.installationId}:${data.organizationName}/${data.repositoryName}@${data.branchName}`;
 
     try {
       const cachedPaths: Array<string> | null =
@@ -1415,11 +1559,20 @@ export default class GitHubUtil extends HostedCodeRepository {
     payload: string,
     signature: string,
   ): boolean {
+    /*
+     * Fail closed. This used to return true when the secret was unset, which
+     * made the webhook endpoint fully unauthenticated on any instance that had
+     * not configured one — and the handler acts on what it is sent: the
+     * `installation.deleted` branch clears installation IDs across every
+     * tenant, and `installation_repositories` triggers repository imports. An
+     * unconfigured secret is a misconfiguration to surface, not a check to
+     * skip.
+     */
     if (!GitHubAppWebhookSecret) {
-      logger.warn(
-        "GITHUB_APP_WEBHOOK_SECRET is not set, skipping verification",
+      logger.error(
+        "Rejecting GitHub webhook: GITHUB_APP_WEBHOOK_SECRET is not set, so the payload's signature cannot be verified. Set it to the webhook secret configured in the GitHub App settings.",
       );
-      return true;
+      return false;
     }
 
     const expectedSignature: string = `sha256=${crypto

package/Server/Utils/CodeRepository/GitHub/GitHubInstallationBinding.ts

@@ -0,0 +1,130 @@
+import ProjectService from "../../../Services/ProjectService";
+import Project from "../../../../Models/DatabaseModels/Project";
+import ObjectID from "../../../../Types/ObjectID";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import CaptureSpan from "../../Telemetry/CaptureSpan";
+
+/*
+ * A GitHub App installation ID is a small, guessable integer, and the single
+ * GitHub App JWT this instance holds will mint a `ghs_` token for ANY of them
+ * (GitHubUtil.getInstallationAccessToken does not — and cannot — know which
+ * tenant asked). So the installation ID alone is not a capability: on its own
+ * it is just an attacker-supplied number.
+ *
+ * Project.gitHubAppInstallationId is the ONE authoritative record of which
+ * project an installation belongs to. It is written only by the GitHub App
+ * install callback, and only after GitHub itself has confirmed — via the
+ * OAuth user-to-server round trip — that the person completing the install
+ * controls that installation. Both `create` and `update` on that column are
+ * closed to API callers, so nothing outside that callback can assert a
+ * binding.
+ *
+ * Every path that turns an installation ID into GitHub access must therefore
+ * re-derive the binding from here rather than trusting the ID it was handed.
+ * Checking that a CodeRepository row is in the caller's project is NOT enough
+ * on its own: the attacker owns their own project, so they control both sides
+ * of that comparison.
+ */
+export default class GitHubInstallationBinding {
+  /*
+   * The installation this project owns, or null if it has none. Callers
+   * filtering a whole project's repositories should read it once and compare
+   * in memory rather than asking per row — every row in such a list shares
+   * the same project, so the answer cannot differ between them.
+   */
+  @CaptureSpan()
+  public static async getBoundInstallationId(
+    projectId: ObjectID,
+  ): Promise<string | null> {
+    const project: Project | null = await ProjectService.findOneBy({
+      query: {
+        _id: projectId.toString(),
+      },
+      select: {
+        _id: true,
+        gitHubAppInstallationId: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return project?.gitHubAppInstallationId || null;
+  }
+
+  // True only if `installationId` is the installation bound to `projectId`.
+  @CaptureSpan()
+  public static async isInstallationBoundToProject(data: {
+    projectId: ObjectID;
+    installationId: string;
+  }): Promise<boolean> {
+    if (!data.installationId) {
+      return false;
+    }
+
+    const project: Project | null = await ProjectService.findOneBy({
+      query: {
+        _id: data.projectId.toString(),
+        gitHubAppInstallationId: data.installationId.toString(),
+      },
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return Boolean(project);
+  }
+
+  /*
+   * Convenience for the many callers that hold a CodeRepository row and are
+   * about to use its installation ID against GitHub. Returns false for a row
+   * that carries no project or no installation, so a half-populated row can
+   * never be mistaken for a permitted one.
+   *
+   * Row-level checks like this stay necessary even with the write boundary
+   * closed, because a database that was exploited before the fix can still
+   * hold rows whose installation ID never belonged to their project.
+   */
+  @CaptureSpan()
+  public static async isRepositoryInstallationBound(repository: {
+    projectId?: ObjectID | undefined;
+    gitHubAppInstallationId?: string | undefined;
+  }): Promise<boolean> {
+    if (!repository.projectId || !repository.gitHubAppInstallationId) {
+      return false;
+    }
+
+    return GitHubInstallationBinding.isInstallationBoundToProject({
+      projectId: repository.projectId,
+      installationId: repository.gitHubAppInstallationId,
+    });
+  }
+
+  /*
+   * Fail-closed variant for the places where continuing without a binding
+   * would hand out cross-tenant access.
+   */
+  @CaptureSpan()
+  public static async assertInstallationBoundToProject(data: {
+    projectId: ObjectID;
+    installationId: string;
+  }): Promise<void> {
+    const isBound: boolean =
+      await GitHubInstallationBinding.isInstallationBoundToProject(data);
+
+    if (!isBound) {
+      /*
+       * Deliberately vague: a probing caller must not be able to tell
+       * "this installation belongs to someone else" from "no such
+       * installation", or the error itself becomes the enumeration oracle
+       * this check exists to close.
+       */
+      throw new BadDataException(
+        "This GitHub App installation is not connected to this project. Please connect the repository from Project Settings using the GitHub App.",
+      );
+    }
+  }
+}