@oneuptime/common 12.0.3 → 12.0.5

package/Server/Services/DatabaseService.ts

@@ -30,6 +30,7 @@ import UpdateByID from "../Types/Database/UpdateByID";
 import UpdateByIDAndFetch from "../Types/Database/UpdateByIDAndFetch";
 import UpdateOneBy from "../Types/Database/UpdateOneBy";
 import Encryption from "../Utils/Encryption";
+import PasswordHash from "../Utils/PasswordHash";
 import PostgresErrorTranslator from "../Utils/Database/PostgresErrorTranslator";
 import logger, { LogAttributes } from "../Utils/Logger";
 import BaseService from "./BaseService";
@@ -321,6 +322,56 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     return data;
   }
 
+  /*
+   * Hash one HashedString column in place.
+   *
+   * Declaring `hashSaltColumn` on a column is what marks it a CREDENTIAL —
+   * a low-entropy, human-chosen secret. Those go through scrypt (see
+   * PasswordHash): deliberately slow and memory-hard, with a fresh per-record
+   * salt minted into the sibling column named by the metadata.
+   *
+   * Columns without a salt column are high-entropy values the server itself
+   * generated — session refresh tokens and the like. They keep the fast
+   * SHA-256 hash, which is the right tool for them: there is nothing to guess,
+   * and they have to stay searchable by hash because that is how they are
+   * looked up. Every human-chosen credential, including dashboard and status
+   * page master passwords, declares a salt column and takes the scrypt path.
+   *
+   * The salt is written onto the SAME payload as the hash, so the pair can
+   * never be persisted out of step with each other.
+   *
+   * The salt column grants nobody create or update rights, so it has to get
+   * past the column-permission check some other way on each path. On update
+   * it does so by timing — sanitizeCreateOrUpdate runs after the check. On
+   * create the check runs after `hash()`, so the salt column relies on being
+   * declared `computed: true`, which checkDataColumnPermissions skips on
+   * create. A salt column that forgets that flag breaks every non-root
+   * create of a row carrying a password.
+   */
+  private async hashColumnValue(data: {
+    payload: TBaseModel | PartialEntity<TBaseModel>;
+    columnName: string;
+    columnValue: HashedString;
+  }): Promise<void> {
+    const saltColumnName: string | undefined =
+      this.model.getTableColumnMetadata(data.columnName)?.hashSaltColumn;
+
+    if (!saltColumnName) {
+      await data.columnValue.hashValue(EncryptionSecret);
+      return;
+    }
+
+    const salt: string = PasswordHash.generateSalt();
+    (data.payload as any)[saltColumnName] = salt;
+
+    data.columnValue.setHashedValue(
+      await PasswordHash.hash({
+        plainValue: data.columnValue.toString(),
+        salt: salt,
+      }),
+    );
+  }
+
   protected async hash(data: TBaseModel): Promise<TBaseModel> {
     const columns: Columns = data.getHashedColumns();
 
@@ -329,13 +380,114 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         data.hasValue(key) &&
         !(data.getValue(key) as HashedString).isValueHashed()
       ) {
-        await ((data as any)[key] as HashedString).hashValue(EncryptionSecret);
+        await this.hashColumnValue({
+          payload: data,
+          columnName: key,
+          columnValue: (data as any)[key] as HashedString,
+        });
       }
     }
 
     return data;
   }
 
+  /*
+   * Check a plaintext secret (a password) against a hashed column on a row
+   * that has already been read out of the database, and re-hash the stored
+   * value in place when it was not written by today's scheme.
+   *
+   * The row must have been selected with BOTH the hashed column and its salt
+   * column. Without the salt a scrypt hash cannot be checked at all, and an
+   * older SHA-256 one would be checked against the wrong scheme — either way
+   * a perfectly good password gets rejected. PasswordHash.verify throws
+   * rather than silently returning false for the scrypt case, because a
+   * missing SELECT is a bug and must not look like a bad password.
+   *
+   * Why the caller cannot just query by the hash any more: with a per-user
+   * salt the hash is not computable until the row's own salt is known, so
+   * `WHERE password = <hash>` has nothing to bind. Read the row by its
+   * identity (email, id) and verify here.
+   *
+   * THE UPGRADE. Anything that is not exactly what PasswordHash writes today
+   * is re-hashed once the password is known to be correct: the two SHA-256
+   * schemes that preceded scrypt, and any scrypt hash whose cost parameters
+   * have since been raised. That is what makes raising the cost a one-line
+   * change — users migrate as they log in, with no reset and no migration.
+   *
+   * The write is deliberately hook-free and leaves updatedAt alone: the user
+   * did not change their password, the server changed how it stores it.
+   * Firing the password-change hooks would revoke every session and mail the
+   * user about a change they did not make. A failed upgrade is logged and
+   * swallowed — a correct password must not be rejected because a
+   * bookkeeping write lost a race.
+   */
+  @CaptureSpan()
+  public async verifyHashedColumnValue(data: {
+    item: TBaseModel;
+    columnName: string;
+    plainValue: string;
+  }): Promise<boolean> {
+    const storedHash: string | undefined = (data.item as any)[
+      data.columnName
+    ]?.toString();
+
+    if (!storedHash || !data.plainValue) {
+      return false;
+    }
+
+    const saltColumnName: string | undefined =
+      this.model.getTableColumnMetadata(data.columnName)?.hashSaltColumn;
+
+    const salt: string | null = saltColumnName
+      ? ((data.item as any)[saltColumnName] as string | undefined) || null
+      : null;
+
+    const isValid: boolean = await PasswordHash.verify({
+      plainValue: data.plainValue,
+      storedValue: storedHash,
+      salt: salt,
+    });
+
+    if (!isValid) {
+      return false;
+    }
+
+    if (
+      saltColumnName &&
+      data.item.id &&
+      PasswordHash.needsUpgrade(storedHash)
+    ) {
+      try {
+        const newSalt: string = PasswordHash.generateSalt();
+
+        await this.updateColumnsByIdWithoutHooks({
+          id: data.item.id,
+          data: {
+            [data.columnName]: await PasswordHash.hash({
+              plainValue: data.plainValue,
+              salt: newSalt,
+            }),
+            [saltColumnName]: newSalt,
+          } as unknown as PartialEntity<TBaseModel>,
+          expectedData: {
+            [data.columnName]: storedHash,
+            [saltColumnName]: salt,
+          } as unknown as PartialEntity<TBaseModel>,
+          skipUpdateDateColumn: true,
+        });
+      } catch (err) {
+        /*
+         * `data.item` is deliberately left holding the old hash and old salt,
+         * so it stays an internally consistent pair whether or not the write
+         * above landed.
+         */
+        logger.error(err);
+      }
+    }
+
+    return true;
+  }
+
   protected async decrypt(data: TBaseModel): Promise<TBaseModel> {
     for (const key of data.getEncryptedColumns().columns) {
       if (!data.hasValue(key)) {
@@ -552,6 +704,26 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       if (this.model.isHashedStringColumn(columnName)) {
         const columnValue: JSONValue = (data as any)[columnName];
 
+        /*
+         * A salted column's hash and its salt are only ever correct as a
+         * pair. A write that supplies the column as a bare string skips the
+         * hashing branch below, leaving the row's existing salt attached to
+         * a value it was not computed from — which locks the account out
+         * silently, at the next login, far from whatever wrote it. Refuse
+         * instead. Callers pass a HashedString; the write path hashes it.
+         */
+        if (
+          data &&
+          columnName &&
+          columnValue &&
+          !(columnValue instanceof HashedString) &&
+          this.model.getTableColumnMetadata(columnName)?.hashSaltColumn
+        ) {
+          throw new BadDataException(
+            `${columnName} is a salted column and must be supplied as a HashedString, not a pre-hashed value.`,
+          );
+        }
+
         if (
           data &&
           columnName &&
@@ -559,7 +731,23 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
           columnValue instanceof HashedString
         ) {
           if (!columnValue.isValueHashed()) {
-            await columnValue.hashValue(EncryptionSecret);
+            /*
+             * The update path never runs `hash()`, so this is where an
+             * updated password gets both hashed and salted. The salt lands
+             * on `data`, which the caller turns into the SET list, so the
+             * new hash and the salt it was computed with are written by the
+             * same statement.
+             *
+             * An update matching several rows writes the same salt to all of
+             * them, which is correct: they are all being set to the same
+             * value by one statement. Per-row salts come from per-row
+             * writes.
+             */
+            await this.hashColumnValue({
+              payload: data,
+              columnName: columnName,
+              columnValue: columnValue,
+            });
           }
 
           (data as any)[columnName] = columnValue.toString();
@@ -2319,6 +2507,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   public async updateColumnsByIdWithoutHooks(input: {
     id: ObjectID;
     data: PartialEntity<TBaseModel>;
+    /*
+     * Optional compare-and-set guard. Every supplied property is added to
+     * the WHERE clause with null-safe equality, so the update is skipped if
+     * another writer changed the row after the caller read it. Password-hash
+     * upgrades use this to avoid overwriting a concurrently changed
+     * credential with a re-hash of the old password.
+     */
+    expectedData?: PartialEntity<TBaseModel>;
     /*
      * Leave `updatedAt` untouched. For passive bookkeeping writes (liveness
      * timestamps, ingest health markers) where consumers key change
@@ -2393,9 +2589,37 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       metadata.primaryColumns[0]?.databaseName || "_id";
     params.push(input.id.toString());
 
+    const whereClauses: Array<string> = [
+      `"${primaryColumnName}" = $${params.length}`,
+    ];
+
+    for (const [propertyName, value] of Object.entries(
+      (input.expectedData || {}) as ObjectLiteral,
+    )) {
+      const column: ColumnMetadata | undefined =
+        metadata.findColumnWithPropertyName(propertyName);
+
+      if (!column) {
+        throw new BadDataException(
+          `updateColumnsByIdWithoutHooks: unknown expected column "${propertyName}" on "${metadata.tableName}"`,
+        );
+      }
+
+      if (typeof value === "function") {
+        throw new BadDataException(
+          `updateColumnsByIdWithoutHooks: SQL-expression expected values are not supported (column "${propertyName}"); pass a literal value.`,
+        );
+      }
+
+      params.push(driver.preparePersistentValue(value, column));
+      whereClauses.push(
+        `"${column.databaseName}" IS NOT DISTINCT FROM $${params.length}`,
+      );
+    }
+
     const sql: string = `UPDATE "${metadata.tableName}" SET ${setClauses.join(
       ", ",
-    )} WHERE "${primaryColumnName}" = $${params.length}`;
+    )} WHERE ${whereClauses.join(" AND ")}`;
 
     await repository.manager.query(sql, params);
   }

package/Server/Services/IncidentFeedService.ts

@@ -84,6 +84,7 @@ export class Service extends DatabaseService<IncidentFeed> {
     displayColor?: Color | undefined;
     userId?: ObjectID | undefined;
     postedAt?: Date | undefined;
+    aiRunId?: ObjectID | undefined;
     // send notifificatin to slack and teams. This is optional
     workspaceNotification?:
       | {
@@ -131,6 +132,10 @@ export class Service extends DatabaseService<IncidentFeed> {
       incidentFeed.incidentFeedEventType = data.incidentFeedEventType;
       incidentFeed.projectId = data.projectId;
 
+      if (data.aiRunId) {
+        incidentFeed.aiRunId = data.aiRunId;
+      }
+
       if (!data.postedAt) {
         incidentFeed.postedAt = OneUptimeDate.getCurrentDate();
       }

package/Server/Services/LlmLogService.ts

@@ -2,6 +2,7 @@ import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/LlmLog";
 import { IsBillingEnabled } from "../EnvironmentConfig";
 import ObjectID from "../../Types/ObjectID";
+import BadDataException from "../../Types/Exception/BadDataException";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 export class Service extends DatabaseService<Model> {
@@ -22,15 +23,58 @@ export class Service extends DatabaseService<Model> {
     projectId: ObjectID;
     since: Date;
     features: Array<string>;
+    /*
+     * Subject ids select a lane, not one particular subject: passing an
+     * incident id counts every incident-associated log for the project, and
+     * passing an alert id counts every alert-associated log. With neither id,
+     * only genuinely subjectless work is counted. The caller already has the
+     * concrete id, so using it as the discriminator keeps this API aligned
+     * with AIService's request shape without introducing a second subject enum.
+     */
+    incidentId?: ObjectID | undefined;
+    alertId?: ObjectID | undefined;
+    /*
+     * Feature-only fallbacks for rows written before subject identity was
+     * propagated. Shared features are recovered through aiRunId below.
+     */
+    legacyIncidentFeatures?: Array<string> | undefined;
+    legacyAlertFeatures?: Array<string> | undefined;
   }): Promise<number> {
+    if (data.incidentId && data.alertId) {
+      throw new BadDataException(
+        "An LLM usage query cannot select both the incident and alert lanes.",
+      );
+    }
+
     if (data.features.length === 0) {
       return 0;
     }
 
+    const legacyIncidentFeatures: Array<string> =
+      data.legacyIncidentFeatures || [];
+    const legacyAlertFeatures: Array<string> = data.legacyAlertFeatures || [];
+
+    const incidentRunMembership: string = `EXISTS (SELECT 1 FROM "AIRun" AS "run" WHERE "run"."_id" = "log"."aiRunId" AND "run"."triggeredByIncidentId" IS NOT NULL AND "run"."triggeredByAlertId" IS NULL)`;
+    const alertRunMembership: string = `EXISTS (SELECT 1 FROM "AIRun" AS "run" WHERE "run"."_id" = "log"."aiRunId" AND "run"."triggeredByIncidentId" IS NULL AND "run"."triggeredByAlertId" IS NOT NULL)`;
+
+    let subjectClause: string = `AND "log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND NOT ("log"."feature" = ANY($4)) AND NOT ("log"."feature" = ANY($5)) AND NOT (${incidentRunMembership}) AND NOT (${alertRunMembership})`;
+
+    if (data.incidentId) {
+      subjectClause = `AND (("log"."incidentId" IS NOT NULL AND "log"."alertId" IS NULL) OR ("log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND (("log"."feature" = ANY($4)) OR ${incidentRunMembership})))`;
+    } else if (data.alertId) {
+      subjectClause = `AND (("log"."incidentId" IS NULL AND "log"."alertId" IS NOT NULL) OR ("log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND (("log"."feature" = ANY($5)) OR ${alertRunMembership})))`;
+    }
+
     const rows: Array<{ total: string | number | null }> =
       await this.getRepository().manager.query(
-        `SELECT COALESCE(SUM("totalTokens"), 0) AS "total" FROM "LlmLog" WHERE "projectId" = $1 AND "createdAt" >= $2 AND "feature" = ANY($3) AND "deletedAt" IS NULL`,
-        [data.projectId.toString(), data.since, data.features],
+        `SELECT COALESCE(SUM("log"."totalTokens"), 0) AS "total" FROM "LlmLog" AS "log" WHERE "log"."projectId" = $1 AND "log"."createdAt" >= $2 AND "log"."feature" = ANY($3) ${subjectClause} AND "log"."deletedAt" IS NULL`,
+        [
+          data.projectId.toString(),
+          data.since,
+          data.features,
+          legacyIncidentFeatures,
+          legacyAlertFeatures,
+        ],
       );
 
     return Number(rows[0]?.total || 0);