@oneuptime/common 12.0.3 → 12.0.5

package/Types/AI/AIRunCodeFixRecommendation.ts

@@ -0,0 +1,17 @@
+/*
+ * The durable code-fix recommendation for an incident/alert investigation.
+ * Stored on AIRun so the dashboard and the manual fix-task endpoint consume
+ * the same server-authored decision instead of interpreting analysis prose.
+ *
+ * Every run starts NotRecommended. The investigation engine atomically moves
+ * a winning incident/alert run to Pending with its Completed transition, then
+ * settles the posted analysis to a terminal recommendation. This keeps all
+ * error, legacy and non-investigation paths fail closed.
+ */
+enum AIRunCodeFixRecommendation {
+  Pending = "Pending",
+  Recommended = "Recommended",
+  NotRecommended = "NotRecommended",
+}
+
+export default AIRunCodeFixRecommendation;

package/Types/AI/CodeFixTaskContext.ts

@@ -1,7 +1,8 @@
 /*
- * The JSON persisted on AIRun.taskContext for CodeFix recipes whose entire
- * working context is captured at trigger time rather than referenced by a
- * subject id (incident/alert) or a telemetry exception.
+ * The JSON persisted on AIRun.taskContext for tasks whose exact working
+ * context must survive until a worker claims them. Some recipes have no
+ * durable subject record; others, such as FixFromIncident, deliberately pin
+ * a snapshot instead of re-reading mutable subject state at execution time.
  *
  * First user: the FixPerformance recipe. Its evidence is computed
  * DETERMINISTICALLY from a trace's span tree when the user clicks "Fix
@@ -74,7 +75,29 @@ export interface PerformanceCodeLocation {
   lineNumber?: number | undefined;
 }
 
+/*
+ * The immutable investigation snapshot consumed by FixFromIncident. Both
+ * fields travel together: the run id proves which Recommended decision was
+ * gated, and the markdown is the exact posted analysis that decision covered.
+ */
+export interface InvestigationCodeFixTaskSnapshot {
+  investigationRunId: string;
+  investigationAnalysisMarkdown: string;
+}
+
 export interface CodeFixTaskContext {
+  /*
+   * FixFromIncident: the exact investigation whose published RootCause is
+   * the task's context. This prevents a later re-investigation from changing
+   * the report between the user's click and the worker claiming the task.
+   */
+  sourceInvestigationRunId?: string | undefined;
+  /*
+   * Snapshot of that run's published analysis. Fix tasks can wait in the
+   * queue, so reading the feed again when the worker claims the task would
+   * let a later re-investigation silently change the requested fix.
+   */
+  sourceInvestigationAnalysisMarkdown?: string | undefined;
   // FixPerformance: the analyzed trace.
   traceId?: string | undefined;
   // Best-effort service attribution resolved from the trace's spans.
@@ -91,4 +114,41 @@ export interface CodeFixTaskContext {
   telemetryServiceId?: string | undefined;
 }
 
+/*
+ * Canonical JSON shape persisted for a Recommended investigation. Unlike the
+ * normalized snapshot returned below, these names are the established
+ * AIRun.taskContext wire contract.
+ */
+export type InvestigationCodeFixTaskContext = CodeFixTaskContext & {
+  sourceInvestigationRunId: string;
+  sourceInvestigationAnalysisMarkdown: string;
+};
+
+/*
+ * Treat partial, empty and malformed JSON as no snapshot. The same validator
+ * is shared by the trigger, claim guard and task-details reader so none of
+ * those boundaries can silently fall back to a different investigation.
+ */
+export function getInvestigationCodeFixTaskSnapshot(
+  taskContext: CodeFixTaskContext | null | undefined,
+): InvestigationCodeFixTaskSnapshot | null {
+  const investigationRunId: unknown = taskContext?.sourceInvestigationRunId;
+  const investigationAnalysisMarkdown: unknown =
+    taskContext?.sourceInvestigationAnalysisMarkdown;
+
+  if (
+    typeof investigationRunId !== "string" ||
+    investigationRunId.trim().length === 0 ||
+    typeof investigationAnalysisMarkdown !== "string" ||
+    investigationAnalysisMarkdown.trim().length === 0
+  ) {
+    return null;
+  }
+
+  return {
+    investigationRunId,
+    investigationAnalysisMarkdown,
+  };
+}
+
 export default CodeFixTaskContext;

package/Types/AI/CodeFixTaskType.ts

@@ -26,9 +26,9 @@ enum CodeFixTaskType {
    * Add the observability an INCONCLUSIVE AI investigation was missing
    * (structured logs, spans, metric counters on the implicated code paths).
    * NOT user-triggerable from the exception page — it has its own automatic
-   * trigger: an inconclusive investigation on a project that opted in via
-   * Project.enableInstrumentationFixTasks (see Common/Server/Utils/AI/
-   * AI/InstrumentationTaskTrigger.ts). Its subject is the triggering
+   * trigger: an inconclusive investigation on a project that opted in through
+   * the incident/alert instrumentation fix setting (see Common/Server/Utils/
+   * AI/SRE/InstrumentationTaskTrigger.ts). Its subject is the triggering
    * incident/alert, NOT a telemetry exception.
    */
   ImproveInstrumentation = "ImproveInstrumentation",

package/Types/Database/ColumnLength.ts

@@ -12,7 +12,15 @@ enum ColumnLength {
   Password = 500,
   ShortURL = 100,
   ShortText = 100,
-  HashedString = 64,
+  /*
+   * Wide enough for a self-describing password hash, not just a bare digest.
+   * User passwords are stored as `scrypt$N=...,r=...,p=...$<64 hex>` (~90
+   * characters) so the cost parameters travel with the hash and can be
+   * raised later without a migration. The columns that still store a plain
+   * SHA-256 digest — session refresh tokens, master passwords — simply do
+   * not use the extra room.
+   */
+  HashedString = 255,
   Phone = 30,
   OTP = 8,
 }

package/Types/Database/TableColumn.ts

@@ -16,6 +16,17 @@ export interface TableColumnMetadata {
   unique?: boolean;
   computed?: boolean;
   hashed?: boolean;
+  /*
+   * Name of the sibling column that holds this column's per-record salt.
+   *
+   * When set, the write path generates a fresh random salt on every write of
+   * this column, stores it in the named column, and mixes it into the hash.
+   * Two records with the same plaintext then hash to different values, so one
+   * precomputed table (or one cracked value) buys an attacker nothing
+   * anywhere else. The salt column must be nullable — rows written before the
+   * salt existed have none and verify against the legacy unsalted scheme.
+   */
+  hashSaltColumn?: string;
   encrypted?: boolean;
   manyToOneRelationColumn?: string;
   type: TableColumnType;

package/Types/Database/UnsynchronizedIndex.ts

@@ -0,0 +1,48 @@
+import { IndexOptions } from "typeorm";
+
+/*
+ * Options for an index whose definition TypeORM cannot express, and which must
+ * therefore be owned by a migration rather than by the schema builder.
+ *
+ * WHY THIS EXISTS
+ *
+ * TypeORM's schema builder matches database indexes to entity metadata BY NAME
+ * (RdbmsSchemaBuilder.dropOldIndices: `metadata.indices.find((i) => i.name ===
+ * tableIndex.name)`) and DROPS every index it cannot find a match for. An index
+ * created only in a migration is invisible to entity metadata, so the next
+ * `npm run generate-postgres-migration` emits a DROP for it — silently, mixed
+ * in with whatever change was actually being made.
+ *
+ * That is not hypothetical. An audit of every hand-named index ever created by
+ * a migration against a fully-migrated database found ten that had been deleted
+ * this way and never restored, including the unique guards on six `slug`
+ * columns and the LOWER(name) index serving the telemetry ingest hot path.
+ * Migration 1775735059360 is a representative example: two unrelated column
+ * default changes, plus a DROP of an expression index, plus a down() that
+ * "restores" it without the expression.
+ *
+ * HOW THIS FIXES IT
+ *
+ * Declaring the index on the entity BY NAME with these options makes the schema
+ * builder skip it in both directions: `dropOldIndices` returns early on
+ * `synchronize === false`, and `createNewIndices` only considers indexes with
+ * `synchronize === true`. The migration stays the single source of truth for
+ * the real definition, and the declaration exists purely so TypeORM leaves it
+ * alone.
+ *
+ * The columns passed alongside these options are documentation — the schema
+ * builder never reads them for an unsynchronized index. Where the real
+ * definition is partial or an expression, say so in a comment at the call site.
+ *
+ * THE CAST
+ *
+ * `synchronize` is a real, supported option: the @Index decorator forwards it
+ * into IndexMetadataArgs (typeorm/decorator/Index.js), IndexMetadataArgs
+ * declares it, and RdbmsSchemaBuilder reads it. Only the public IndexOptions
+ * type omits it — a gap in TypeORM's own typings rather than a misuse.
+ */
+const UNSYNCHRONIZED_INDEX: IndexOptions = {
+  synchronize: false,
+} as IndexOptions;
+
+export default UNSYNCHRONIZED_INDEX;

package/Types/HashedString.ts

@@ -7,6 +7,30 @@ import ObjectID from "./ObjectID";
 import CryptoJS from "crypto-js";
 import { FindOperator } from "typeorm";
 
+/*
+ * SHA-256 hashing for values that are ALREADY high-entropy: session refresh
+ * tokens, email verification tokens, reset tokens, permission fingerprints.
+ * Those are random values the server minted, so there is nothing to guess and
+ * a fast hash is the right tool — it also keeps them searchable by hash,
+ * which is how they are looked up.
+ *
+ * User passwords are NOT hashed here any more. A password is low-entropy and
+ * guessable, so it goes through scrypt in Common/Server/Utils/PasswordHash,
+ * which is deliberately slow and memory-hard. What remains in this class is
+ * the two SHA-256 schemes passwords used to be stored under, kept so those
+ * rows still verify (and are then upgraded) at their owner's next login:
+ *
+ *   no salt   `SHA256(secret + value)`, from before per-user salts existed.
+ *   salted    `SHA256("v2:" + salt + ":" + secret + ":" + value)`.
+ *
+ * Neither records its scheme in the digest — it is a bare hex SHA-256 either
+ * way — so callers normally select the scheme by whether the row carries a
+ * salt. PasswordHash also has a bare-hash fallback for rolling deployments,
+ * where an old pod can write the original scheme while leaving a newer salt
+ * behind. The "v2" prefix and separators exist for domain separation.
+ */
+const SALTED_HASH_SCHEME_VERSION: string = "v2";
+
 export default class HashedString extends DatabaseProperty {
   private isHashed: boolean = false;
 
@@ -65,7 +89,62 @@ export default class HashedString extends DatabaseProperty {
     return this.isHashed;
   }
 
-  public async hashValue(encryptionSecret: ObjectID | null): Promise<string> {
+  /**
+   * Adopt an already-computed digest.
+   *
+   * For hashes this class does not compute itself — user passwords go
+   * through scrypt in Common/Server/Utils/PasswordHash, which is server-only
+   * because this type is also bundled into the browser. The guard is the
+   * same one hashValue() carries: a value is hashed once and never re-hashed
+   * over the top of itself.
+   */
+  public setHashedValue(hashedValue: string): void {
+    if (this.isHashed) {
+      throw new BadOperationException("Value is already hashed");
+    }
+
+    this.isHashed = true;
+    this.value = hashedValue;
+  }
+
+  /**
+   * The exact byte string fed to SHA-256.
+   *
+   * The unsalted branch MUST stay byte-for-byte identical forever: every
+   * password hashed before per-user salts existed is verified through it.
+   */
+  private static buildValueToHash(
+    value: string,
+    encryptionSecret: ObjectID | null,
+    salt: string | null,
+  ): string {
+    if (!salt) {
+      return (encryptionSecret || "") + value;
+    }
+
+    return `${SALTED_HASH_SCHEME_VERSION}:${salt}:${
+      encryptionSecret || ""
+    }:${value}`;
+  }
+
+  public static computeHash(
+    value: string,
+    encryptionSecret: ObjectID | null,
+    salt?: string | null,
+  ): string {
+    if (!value) {
+      return "";
+    }
+
+    return CryptoJS.SHA256(
+      HashedString.buildValueToHash(value, encryptionSecret, salt || null),
+    ).toString();
+  }
+
+  public async hashValue(
+    encryptionSecret: ObjectID | null,
+    salt?: string | null,
+  ): Promise<string> {
     if (!this.value) {
       return "";
     }
@@ -74,19 +153,76 @@ export default class HashedString extends DatabaseProperty {
       throw new BadOperationException("Value is already hashed");
     }
 
-    const valueToHash: string = (encryptionSecret || "") + this.value;
     this.isHashed = true;
 
-    this.value = CryptoJS.SHA256(valueToHash).toString();
+    this.value = HashedString.computeHash(
+      this.value,
+      encryptionSecret,
+      salt || null,
+    );
     return this.value;
   }
 
   public static async hashValue(
     value: string,
     encryptionSecret: ObjectID | null,
+    salt?: string | null,
   ): Promise<string> {
     const hashstring: HashedString = new HashedString(value, false);
-    return await hashstring.hashValue(encryptionSecret);
+    return await hashstring.hashValue(encryptionSecret, salt || null);
+  }
+
+  /**
+   * Compare two already-hashed values without leaking, through timing, how
+   * many leading characters matched. Comparing digests with `===` lets an
+   * attacker who can measure response time recover a stored hash one
+   * character at a time; recovering the hash is what makes offline cracking
+   * possible in the first place.
+   *
+   * Lengths are compared up front. Digests here are always the same length,
+   * so an early exit only happens on malformed input, where the length is
+   * not the secret.
+   */
+  public static isEqual(a: string, b: string): boolean {
+    if (a.length !== b.length) {
+      return false;
+    }
+
+    let difference: number = 0;
+
+    for (let i: number = 0; i < a.length; i++) {
+      difference |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+
+    return difference === 0;
+  }
+
+  /**
+   * Verify a plaintext value against a stored hash.
+   *
+   * Pass the salt stored alongside the hash. Pass null/undefined for records
+   * written before per-user salts existed — those verify against the legacy
+   * unsalted scheme, and the caller should re-hash them with a fresh salt
+   * once the value is known to be correct.
+   */
+  public static async verifyValue(data: {
+    plainValue: string;
+    hashedValue: string;
+    encryptionSecret: ObjectID | null;
+    salt?: string | null | undefined;
+  }): Promise<boolean> {
+    if (!data.plainValue || !data.hashedValue) {
+      return false;
+    }
+
+    return HashedString.isEqual(
+      HashedString.computeHash(
+        data.plainValue,
+        data.encryptionSecret,
+        data.salt || null,
+      ),
+      data.hashedValue,
+    );
   }
 
   protected static override fromDatabase(_value: string): HashedString | null {

package/Types/Monitor/CriteriaFilter.ts

@@ -5,6 +5,8 @@ export enum CheckOn {
   ResponseTime = "Response Time (in ms)",
   PacketLossPercent = "Packet Loss (in %)",
   Jitter = "Jitter (in ms)",
+  PortDnsLookupTime = "Port DNS Lookup Time (in ms)",
+  PortTcpConnectTime = "Port TCP Connect Time (in ms)",
   ResponseStatusCode = "Response Status Code",
   ResponseHeader = "Response Header",
   ResponseHeaderValue = "Response Header Value",
@@ -399,6 +401,8 @@ export class CriteriaFilterUtil {
       checkOn === CheckOn.ResponseTime ||
       checkOn === CheckOn.PacketLossPercent ||
       checkOn === CheckOn.Jitter ||
+      checkOn === CheckOn.PortDnsLookupTime ||
+      checkOn === CheckOn.PortTcpConnectTime ||
       checkOn === CheckOn.DiskUsagePercent ||
       checkOn === CheckOn.CPUUsagePercent ||
       checkOn === CheckOn.MemoryUsagePercent ||

package/Types/Monitor/DomainMonitor/DomainLookupMethod.ts

@@ -0,0 +1,23 @@
+/*
+ * Which protocol the probe uses to read a domain's registration record.
+ *
+ * WHOIS is the legacy protocol and its server list is not authoritative:
+ * clients ship a static map of TLD -> WHOIS host, and registries move. Every
+ * Identity Digital TLD (.digital, .email, .life, .today, .zone, ~290 more)
+ * still points at the retired whois.donuts.co in most of those maps, and that
+ * host now answers every query with the literal text "TLD is not supported."
+ * instead of a record. RDAP (RFC 9083) is the ICANN-mandated replacement and
+ * is discovered from the IANA bootstrap registry (RFC 9224), so it stays
+ * correct as registries move.
+ *
+ * Plenty of ccTLDs (.io, .co, .de, .ch, .jp, ...) publish no RDAP service at
+ * all, which is why Auto - RDAP when the TLD has one, WHOIS otherwise - is
+ * the default rather than RDAP.
+ */
+enum DomainLookupMethod {
+  Auto = "Auto",
+  RDAP = "RDAP",
+  WHOIS = "WHOIS",
+}
+
+export default DomainLookupMethod;

package/Types/Monitor/DomainMonitor/DomainMonitorResponse.ts

@@ -1,4 +1,5 @@
 import ProbeAttempt from "../../Probe/ProbeAttempt";
+import DomainLookupMethod from "./DomainLookupMethod";
 
 export default interface DomainMonitorResponse {
   isOnline: boolean;
@@ -16,4 +17,10 @@ export default interface DomainMonitorResponse {
   isTimeout?: boolean | undefined;
   probeAttempts?: Array<ProbeAttempt> | undefined;
   totalAttempts?: number | undefined;
+  /*
+   * Which protocol actually produced this record. With the Auto lookup
+   * method the answer varies by TLD, so it is worth surfacing rather than
+   * leaving the operator to guess.
+   */
+  lookupMethod?: DomainLookupMethod | undefined;
 }

package/Types/Monitor/MonitorCriteriaInstance.ts

@@ -505,6 +505,12 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
         monitorStatusId: arg.monitorStatusId,
         filterCondition: FilterCondition.All,
         filters: [
+          // The registration lookup itself has to have worked.
+          {
+            checkOn: CheckOn.IsOnline,
+            filterType: FilterType.True,
+            value: undefined,
+          },
           {
             checkOn: CheckOn.DomainIsExpired,
             filterType: FilterType.False,
@@ -517,7 +523,7 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
         changeMonitorStatus: true,
         createIncidents: false,
         name: `Check if ${arg.monitorName} is not expired`,
-        description: `This criteria checks if the ${arg.monitorName} domain registration is not expired`,
+        description: `This criteria checks if the ${arg.monitorName} domain registration was read successfully and is not expired`,
       };
 
       return monitorCriteriaInstance;
@@ -774,11 +780,22 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
             filterType: FilterType.True,
             value: undefined,
           },
+          /*
+           * Without this, a lookup that returns no registration data at all
+           * leaves every Domain* filter unable to decide, and the monitor
+           * keeps whatever status it had - so a domain whose registration
+           * data cannot be read looks exactly like a healthy one.
+           */
+          {
+            checkOn: CheckOn.IsOnline,
+            filterType: FilterType.False,
+            value: undefined,
+          },
         ],
         incidents: [
           {
-            title: `${arg.monitorName} domain is expired`,
-            description: `${arg.monitorName} domain registration has expired.`,
+            title: `${arg.monitorName} domain check failed`,
+            description: `${arg.monitorName} domain registration has expired, or its registration data could not be retrieved.`,
             incidentSeverityId: arg.incidentSeverityId,
             autoResolveIncident: true,
             id: ObjectID.generate().toString(),
@@ -790,16 +807,16 @@ export default class MonitorCriteriaInstance extends DatabaseProperty {
         createAlerts: false,
         alerts: [
           {
-            title: `${arg.monitorName} domain is expired`,
-            description: `${arg.monitorName} domain registration has expired.`,
+            title: `${arg.monitorName} domain check failed`,
+            description: `${arg.monitorName} domain registration has expired, or its registration data could not be retrieved.`,
             alertSeverityId: arg.alertSeverityId,
             autoResolveAlert: true,
             id: ObjectID.generate().toString(),
             onCallPolicyIds: [],
           },
         ],
-        name: `Check if ${arg.monitorName} domain is expired`,
-        description: `This criteria checks if the ${arg.monitorName} domain registration has expired`,
+        name: `Check if ${arg.monitorName} domain check failed`,
+        description: `This criteria checks if the ${arg.monitorName} domain registration has expired or could not be read`,
       };
     }
 

package/Types/Monitor/MonitorMetricType.ts

@@ -24,6 +24,14 @@ enum MonitorMetricType {
   TimeToFirstByte = "oneuptime.monitor.http.time.to.first.byte",
   DownloadTime = "oneuptime.monitor.http.download.time",
 
+  /*
+   * Port-monitor connection phases. These intentionally use a Port-specific
+   * namespace instead of the HTTP phase metrics above: Port TCP timing can
+   * include automatic address-family fallback and has no HTTP request phase.
+   */
+  PortDnsLookupTime = "oneuptime.monitor.port.dns.lookup.time",
+  PortTcpConnectTime = "oneuptime.monitor.port.tcp.connect.time",
+
   /*
    * Per-interface SNMP metrics. Emitted when interface monitoring is enabled
    * on an SNMP monitor; one series per interface (interfaceName attribute).

package/Types/Monitor/MonitorStep.ts

@@ -1144,8 +1144,17 @@ export default class MonitorStep extends DatabaseProperty {
       dnsMonitor: json["dnsMonitor"]
         ? (json["dnsMonitor"] as JSONObject)
         : undefined,
+      /*
+       * Normalized rather than passed through raw: steps saved before the
+       * lookupMethod option existed carry no such key, and the probe would
+       * otherwise receive a config that does not satisfy its own type.
+       */
       domainMonitor: json["domainMonitor"]
-        ? (json["domainMonitor"] as JSONObject)
+        ? MonitorStepDomainMonitorUtil.toJSON(
+            MonitorStepDomainMonitorUtil.fromJSON(
+              json["domainMonitor"] as JSONObject,
+            ),
+          )
         : undefined,
       dnssecMonitor: json["dnssecMonitor"]
         ? (json["dnssecMonitor"] as JSONObject)

package/Types/Monitor/MonitorStepDomainMonitor.ts

@@ -1,7 +1,9 @@
 import { JSONObject } from "../JSON";
+import DomainLookupMethod from "./DomainMonitor/DomainLookupMethod";
 
 export default interface MonitorStepDomainMonitor {
   domainName: string;
+  lookupMethod: DomainLookupMethod;
   timeout: number;
   retries: number;
 }
@@ -10,6 +12,7 @@ export class MonitorStepDomainMonitorUtil {
   public static getDefault(): MonitorStepDomainMonitor {
     return {
       domainName: "",
+      lookupMethod: DomainLookupMethod.Auto,
       timeout: 10000,
       retries: 3,
     };
@@ -18,6 +21,13 @@ export class MonitorStepDomainMonitorUtil {
   public static fromJSON(json: JSONObject): MonitorStepDomainMonitor {
     return {
       domainName: (json["domainName"] as string) || "",
+      /*
+       * Monitors saved before RDAP support existed carry no lookupMethod at
+       * all, and Auto is the behaviour they should get.
+       */
+      lookupMethod: MonitorStepDomainMonitorUtil.parseLookupMethod(
+        json["lookupMethod"],
+      ),
       timeout: (json["timeout"] as number) || 10000,
       retries: (json["retries"] as number) || 3,
     };
@@ -26,8 +36,19 @@ export class MonitorStepDomainMonitorUtil {
   public static toJSON(monitor: MonitorStepDomainMonitor): JSONObject {
     return {
       domainName: monitor.domainName,
+      lookupMethod: monitor.lookupMethod,
       timeout: monitor.timeout,
       retries: monitor.retries,
     };
   }
+
+  public static parseLookupMethod(value: unknown): DomainLookupMethod {
+    const values: Array<string> = Object.values(DomainLookupMethod);
+
+    if (typeof value === "string" && values.includes(value)) {
+      return value as DomainLookupMethod;
+    }
+
+    return DomainLookupMethod.Auto;
+  }
 }

package/Types/Monitor/PortMonitor/PortMonitorTimings.ts

@@ -0,0 +1,10 @@
+/*
+ * Per-phase breakdown of a Port monitor connection, in milliseconds. DNS is
+ * absent when the destination is already an IP address. Fields are optional
+ * so partial timing evidence can be represented when a connection fails.
+ */
+export default interface PortMonitorTimings {
+  dnsLookupInMs?: number | undefined;
+  tcpConnectInMs?: number | undefined;
+  totalConnectionInMs?: number | undefined;
+}