@oneuptime/common 12.0.30 → 12.0.32

package/Server/API/TelemetryAPI.ts

@@ -14,7 +14,9 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import TelemetryType from "../../Types/Telemetry/TelemetryType";
 import TelemetryAttributeService from "../Services/TelemetryAttributeService";
 import TelemetrySourceMapService from "../Services/TelemetrySourceMapService";
-import SourceMapResolver from "../Utils/Telemetry/SourceMapResolver";
+import SourceMapResolver, {
+  MAX_FRAMES_PER_RESOLVE_REQUEST,
+} from "../Utils/Telemetry/SourceMapResolver";
 import {
   MinifiedStackFrame,
   ResolveStackTraceResult,
@@ -214,10 +216,28 @@ const requireProfileReadAccess: Array<RequestHandler> =
 
 /*
  * Mirrors the read access control declared on the SecurityEvent analytics
- * model.
+ * model - which, unlike every other signal above, is NOT the telemetry list.
+ * Security events read through the Security tiers only, so this route cannot
+ * be built from createTelemetryReadAccessGuard: doing so would leave the
+ * attribute endpoints open to ProjectMember and the Telemetry tiers while the
+ * model-backed CRUD API refused them, and the attribute keys and values of a
+ * SIEM table are themselves the sensitive part - usernames, hostnames, source
+ * IPs, and every value seen for them.
  */
-const requireSecurityEventReadAccess: Array<RequestHandler> =
-  createTelemetryReadAccessGuard(Permission.ReadSecurityEvent);
+const requireSecurityEventReadAccess: Array<RequestHandler> = [
+  UserMiddleware.getUserMiddleware,
+  UserMiddleware.requireUserAuthentication,
+  UserMiddleware.requirePermission({
+    permissions: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.SecurityAdmin,
+      Permission.SecurityMember,
+      Permission.SecurityViewer,
+      Permission.ReadSecurityEvent,
+    ],
+  }),
+];
 
 router.post(
   "/telemetry/metrics/get-attributes",
@@ -346,6 +366,24 @@ router.post(
         );
       }
 
+      /*
+       * Bound the array before sanitizing it. sanitizeMinifiedStackFrames
+       * never throws and never truncates, so without this the only limit on
+       * the work a caller can ask for is the body-size cap.
+       */
+      if (
+        (body["frames"] as Array<unknown>).length >
+        MAX_FRAMES_PER_RESOLVE_REQUEST
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            `frames must contain at most ${MAX_FRAMES_PER_RESOLVE_REQUEST} stack frames.`,
+          ),
+        );
+      }
+
       const frames: Array<MinifiedStackFrame> =
         SourceMapResolver.sanitizeMinifiedStackFrames(body["frames"]);
 

package/Server/EnvironmentConfig.ts

@@ -15,6 +15,7 @@ import Route from "../Types/API/Route";
 import SubscriptionPlan from "../Types/Billing/SubscriptionPlan";
 import Email from "../Types/Email";
 import { JSONObject } from "../Types/JSON";
+import LIMIT_MAX from "../Types/Database/LimitMax";
 import ObjectID from "../Types/ObjectID";
 import Port from "../Types/Port";
 import Hostname from "../Types/API/Hostname";
@@ -130,6 +131,20 @@ const parsePositiveIntegerFromEnv: (
   return parsedValue;
 };
 
+/*
+ * parsePositiveIntegerFromEnv with a ceiling the rest of the system can
+ * actually honour. A configured value the app would silently fail to enforce
+ * is worse than a visibly clamped one -- so this clamps rather than trusting
+ * the operator, and every call site documents WHY its ceiling exists.
+ */
+const parseClampedIntegerFromEnv: (
+  envKey: string,
+  fallback: number,
+  ceiling: number,
+) => number = (envKey: string, fallback: number, ceiling: number): number => {
+  return Math.min(parsePositiveIntegerFromEnv(envKey, fallback), ceiling);
+};
+
 export const IsBillingEnabled: boolean = BillingConfig.IsBillingEnabled;
 export const BillingPublicKey: string = BillingConfig.BillingPublicKey;
 export const BillingPrivateKey: string = BillingConfig.BillingPrivateKey;
@@ -863,6 +878,103 @@ export const OnCallCalendarFeedRateLimitPerIpPerWindow: number =
     3000,
   );
 
+/*
+ * Source map ingestion and resolution limits.
+ *
+ * These were fixed constants, sized on the assumption that "a build rarely
+ * emits more than a few dozen chunks with maps". That assumption does not
+ * survive route-level code splitting: a Nuxt/Vite/Next app with a hundred
+ * routes emits hundreds of chunk .map files per release, and the maps that
+ * did not fit simply never resolved. They are operator knobs now, and the
+ * Helm chart exposes each one.
+ *
+ * The division of labour matters, because it is what makes raising the
+ * ceiling safe:
+ *
+ *   - SourceMapMaxMapsPerRelease is purely a WRITE gate. An upload past it is
+ *     rejected with a 400 that names the limit. It is no longer the
+ *     resolver's read limit, so raising it can never turn stored maps into
+ *     maps that store fine and then silently never resolve.
+ *   - SourceMapMaxBytesPerResolve is what bounds the READ path. Resolution
+ *     loads whole maps into memory, so a byte budget -- not a row count -- is
+ *     the invariant that actually protects the process.
+ */
+
+/*
+ * Distinct bundles one (project, service, release) may hold.
+ *
+ * Clamped to LIMIT_MAX because the gate reads the release's existing bundle
+ * paths with LIMIT_MAX; a configured value above that could not be enforced
+ * and would be a lie.
+ */
+export const SourceMapMaxMapsPerRelease: number = parseClampedIntegerFromEnv(
+  "SOURCE_MAP_MAX_MAPS_PER_RELEASE",
+  1000,
+  LIMIT_MAX,
+);
+
+/*
+ * How long uploaded maps are kept. A map is only useful while exceptions from
+ * its release are still within telemetry retention, and the default
+ * comfortably exceeds it.
+ */
+export const SourceMapRetentionInDays: number = parsePositiveIntegerFromEnv(
+  "SOURCE_MAP_RETENTION_DAYS",
+  90,
+);
+
+/*
+ * Hard ceiling on ONE map, enforced on the raw upload and again on the
+ * decoded string.
+ *
+ * The ceiling is MAX_MULTIPART_FILE_BYTES from
+ * Common/Server/Middleware/MultipartFormData.ts, repeated as a literal
+ * because that module pulls in multer and express and has no business being
+ * imported by config. The two are pinned to each other by
+ * Common/Tests/Server/Utils/Telemetry/SourceMapLimits.test.ts. Configuring
+ * past it would not raise anything: multer aborts the request first, turning
+ * the 400 this ceiling is meant to give into a confusing 413.
+ */
+export const SourceMapMaxFileSizeInBytes: number = parseClampedIntegerFromEnv(
+  "SOURCE_MAP_MAX_FILE_SIZE_BYTES",
+  50 * 1024 * 1024,
+  50 * 1024 * 1024,
+);
+
+/*
+ * Source map files accepted in ONE upload request.
+ *
+ * Separate from the per-release ceiling: a release may hold far more maps
+ * than any single request may carry, and CI splits the upload. Clamped to
+ * MAX_MULTIPART_FILES, which is the shared middleware default and runs
+ * BEFORE authentication on every route that mounts it -- so this knob only
+ * ever narrows the source map route, never widens the pre-auth surface that
+ * Pyroscope and inbound email sit behind.
+ */
+export const SourceMapMaxFilesPerRequest: number = parseClampedIntegerFromEnv(
+  "SOURCE_MAP_MAX_FILES_PER_REQUEST",
+  50,
+  50,
+);
+
+/*
+ * Total map bytes one resolve request may pull into memory.
+ *
+ * This is the bound that used to be implied by the per-release count, and it
+ * is a much tighter one: resolution materialises whole maps, each up to
+ * SourceMapMaxFileSizeInBytes, and the set it loads is chosen by a
+ * caller-supplied frames array. Maps that do not fit the budget are skipped
+ * in match-quality order and REPORTED on the response, so a skip is visible
+ * rather than looking like "no map was uploaded".
+ *
+ * 512 MiB is roughly ten maps at the per-file ceiling, or every map of a
+ * realistically sized release many times over.
+ */
+export const SourceMapMaxBytesPerResolve: number = parsePositiveIntegerFromEnv(
+  "SOURCE_MAP_MAX_BYTES_PER_RESOLVE",
+  512 * 1024 * 1024,
+);
+
 export const EnableProfiling: boolean =
   process.env["ENABLE_PROFILING"] === "true";
 

package/Server/Infrastructure/Postgres/SchemaMigrations/1790500000000-AddNetworkDeviceOidTemplate.ts

@@ -0,0 +1,59 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddNetworkDeviceOidTemplate1790500000000
+  implements MigrationInterface
+{
+  public name: string = "AddNetworkDeviceOidTemplate1790500000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceOidTemplate" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "slug" character varying(100) NOT NULL, "description" character varying(500), "oids" jsonb, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_ec94e3734230b1ed5d6ae2a125d" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6bd61393f6b4438538eedbfad9" ON "NetworkDeviceOidTemplate" ("projectId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "oidTemplateId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_3e408227ae81663555e1583ac8" ON "NetworkDevice" ("projectId", "oidTemplateId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOidTemplate" ADD CONSTRAINT "FK_6bd61393f6b4438538eedbfad9c" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOidTemplate" ADD CONSTRAINT "FK_9d0cb53f1ee2e900434772c19a8" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOidTemplate" ADD CONSTRAINT "FK_f74ffbb8d3cb49a27055c53697e" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD CONSTRAINT "FK_c7891e3a7597717e1b7ed86581e" FOREIGN KEY ("oidTemplateId") REFERENCES "NetworkDeviceOidTemplate"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP CONSTRAINT "FK_c7891e3a7597717e1b7ed86581e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOidTemplate" DROP CONSTRAINT "FK_f74ffbb8d3cb49a27055c53697e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOidTemplate" DROP CONSTRAINT "FK_9d0cb53f1ee2e900434772c19a8"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceOidTemplate" DROP CONSTRAINT "FK_6bd61393f6b4438538eedbfad9c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_3e408227ae81663555e1583ac8"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "oidTemplateId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6bd61393f6b4438538eedbfad9"`,
+    );
+    await queryRunner.query(`DROP TABLE "NetworkDeviceOidTemplate"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790600000000-AddAutoImportRuleOidTemplate.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddAutoImportRuleOidTemplate1790600000000
+  implements MigrationInterface
+{
+  public name: string = "AddAutoImportRuleOidTemplate1790600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD "oidTemplateId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" ADD CONSTRAINT "FK_022aca601b5a2ce29cf82f9ba25" FOREIGN KEY ("oidTemplateId") REFERENCES "NetworkDeviceOidTemplate"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" DROP CONSTRAINT "FK_022aca601b5a2ce29cf82f9ba25"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceAutoImportRule" DROP COLUMN "oidTemplateId"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790800000000-AddNetworkDeviceRoleTable.ts

@@ -0,0 +1,72 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Device roles become a per-project lookup instead of a fixed union.
+ *
+ * "deviceRole" (the inline string on NetworkDevice) is NOT touched here: the
+ * BackfillNetworkDeviceRoles data migration still reads it to point every
+ * device that has one at its new NetworkDeviceRole row. It is dropped in a
+ * follow-up once that backfill has run everywhere.
+ *
+ * networkDeviceRoleId is ON DELETE SET NULL on purpose. Deleting a role from
+ * the project's settings must not delete the devices using it - they simply go
+ * back to being classified from their own SNMP identity, which is exactly what
+ * a NULL role has always meant.
+ */
+export class AddNetworkDeviceRoleTable1790800000000
+  implements MigrationInterface
+{
+  public name: string = "AddNetworkDeviceRoleTable1790800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "NetworkDeviceRole" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "slug" character varying(100) NOT NULL, "key" character varying(100) NOT NULL, "description" character varying(500), "topologyShape" character varying(100), "isCoreLayer" boolean NOT NULL DEFAULT false, "isSnmpWalkable" boolean NOT NULL DEFAULT true, "order" integer, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_10fb79a5d66950e4a9c6d774d07" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_188009b80d1281f1d7ccecdf74" ON "NetworkDeviceRole" ("projectId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "networkDeviceRoleId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_41f59fed52c5ec4ff6a2725ad9" ON "NetworkDevice" ("networkDeviceRoleId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" ADD CONSTRAINT "FK_188009b80d1281f1d7ccecdf74d" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" ADD CONSTRAINT "FK_9860e7a5b4d23cf1c4192c468cd" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" ADD CONSTRAINT "FK_9dc66fa19636ba160af1521f45d" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD CONSTRAINT "FK_41f59fed52c5ec4ff6a2725ad9a" FOREIGN KEY ("networkDeviceRoleId") REFERENCES "NetworkDeviceRole"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP CONSTRAINT "FK_41f59fed52c5ec4ff6a2725ad9a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" DROP CONSTRAINT "FK_9dc66fa19636ba160af1521f45d"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" DROP CONSTRAINT "FK_9860e7a5b4d23cf1c4192c468cd"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceRole" DROP CONSTRAINT "FK_188009b80d1281f1d7ccecdf74d"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_41f59fed52c5ec4ff6a2725ad9"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "networkDeviceRoleId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_188009b80d1281f1d7ccecdf74"`,
+    );
+    await queryRunner.query(`DROP TABLE "NetworkDeviceRole"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -564,6 +564,9 @@ import { AddResourceActivityFeeds1790100000000 } from "./1790100000000-AddResour
 import { AllowNullMonitorNameOnMonitorTemplate1790200000000 } from "./1790200000000-AllowNullMonitorNameOnMonitorTemplate";
 import { AddCertificateReissueRequestedAtToDomains1790300000000 } from "./1790300000000-AddCertificateReissueRequestedAtToDomains";
 import { AddOnCallCalendarFeeds1790400000000 } from "./1790400000000-AddOnCallCalendarFeeds";
+import { AddNetworkDeviceOidTemplate1790500000000 } from "./1790500000000-AddNetworkDeviceOidTemplate";
+import { AddAutoImportRuleOidTemplate1790600000000 } from "./1790600000000-AddAutoImportRuleOidTemplate";
+import { AddNetworkDeviceRoleTable1790800000000 } from "./1790800000000-AddNetworkDeviceRoleTable";
 
 export default [
   InitialMigration,
@@ -1132,4 +1135,7 @@ export default [
   AllowNullMonitorNameOnMonitorTemplate1790200000000,
   AddCertificateReissueRequestedAtToDomains1790300000000,
   AddOnCallCalendarFeeds1790400000000,
+  AddNetworkDeviceOidTemplate1790500000000,
+  AddAutoImportRuleOidTemplate1790600000000,
+  AddNetworkDeviceRoleTable1790800000000,
 ];

package/Server/Middleware/MultipartFormData.ts

@@ -31,26 +31,55 @@ export const MAX_MULTIPART_FIELD_BYTES: number = 25 * 1024 * 1024;
 export const MAX_MULTIPART_FILES: number = 50;
 export const MAX_MULTIPART_FIELDS: number = 200;
 
+/*
+ * busboy's SIZE limits and its `parts` counter are EXCLUSIVE: each fires
+ * the moment the counter REACHES the limit, so handing it N admits only
+ * N-1. Its `files` and `fields` counters are INCLUSIVE -- N admits N.
+ *
+ * That asymmetry is undocumented and easy to lose, so the constants above
+ * stay the INCLUSIVE maxima this app documents and that callers
+ * range-check against (`file.buffer.length > MAX_SOURCE_MAP_SIZE_IN_BYTES`
+ * and friends), and only the three exclusive limits are converted here.
+ *
+ * Both halves of this were live bugs. A file of exactly 50 MiB -- a size
+ * the source map endpoint means to accept, and whose 400 message says it
+ * accepts -- was truncated by the parser into a 413 the endpoint never
+ * saw. And `parts`, whose whole job is to allow the file and field
+ * allowances in full, rejected a body carrying exactly both with
+ * LIMIT_PART_COUNT.
+ */
+const exclusive: (inclusiveMax: number) => number = (
+  inclusiveMax: number,
+): number => {
+  return inclusiveMax + 1;
+};
+
 /*
  * Configure multer for handling multipart/form-data
  * Uses memory storage to store files in memory as Buffer objects
  */
-const upload: multer.Multer = multer({
-  storage: multer.memoryStorage(),
-  limits: {
-    fileSize: MAX_MULTIPART_FILE_BYTES,
-    fieldSize: MAX_MULTIPART_FIELD_BYTES,
-    files: MAX_MULTIPART_FILES,
-    fields: MAX_MULTIPART_FIELDS,
-    /*
-     * Parts are files + fields, so this has to allow both in full or it
-     * would be the effective limit and the two above would never fire.
-     */
-    parts: MAX_MULTIPART_FILES + MAX_MULTIPART_FIELDS,
-  },
-});
-
-const uploadAny: RequestHandler = upload.any() as unknown as RequestHandler;
+const buildUploadAny: (maxFiles: number) => RequestHandler = (
+  maxFiles: number,
+): RequestHandler => {
+  const upload: multer.Multer = multer({
+    storage: multer.memoryStorage(),
+    limits: {
+      fileSize: exclusive(MAX_MULTIPART_FILE_BYTES),
+      fieldSize: exclusive(MAX_MULTIPART_FIELD_BYTES),
+      files: maxFiles,
+      fields: MAX_MULTIPART_FIELDS,
+      /*
+       * Parts are files + fields, so this has to allow both in full or it
+       * would be the effective limit and the two above would never fire.
+       */
+      parts: exclusive(maxFiles + MAX_MULTIPART_FIELDS),
+    },
+  });
+
+  return upload.any() as unknown as RequestHandler;
+};
+
+const uploadAny: RequestHandler = buildUploadAny(MAX_MULTIPART_FILES);
 
 /*
  * The LIMIT_* codes that mean "you sent too much". LIMIT_UNEXPECTED_FILE
@@ -68,15 +97,33 @@ const TOO_LARGE_CODES: Set<string> = new Set<string>([
   "LIMIT_FIELD_COUNT",
 ]);
 
+/*
+ * A limit breach must answer 413 rather than 500. multer signals every limit
+ * with a MulterError whose `code` is one of the LIMIT_* values, and nothing
+ * downstream knows what those mean - the generic error handler would turn a
+ * caller's oversized upload into a server error and page whoever is on call
+ * for it. Shared by every middleware this module builds.
+ */
+const handleMulterError: (err: unknown, next: NextFunction) => void = (
+  err: unknown,
+  next: NextFunction,
+): void => {
+  if (err instanceof multer.MulterError) {
+    const message: string = `Multipart request rejected: ${err.code}.`;
+
+    return next(
+      TOO_LARGE_CODES.has(err.code)
+        ? new PayloadTooLargeException(message)
+        : new BadRequestException(message),
+    );
+  }
+
+  return next(err);
+};
+
 /*
  * Middleware for handling any file uploads (multipart/form-data)
  * This is useful for webhooks that send data as multipart/form-data (e.g., SendGrid inbound email)
- *
- * Wrapped so a limit breach answers 413 rather than 500. multer signals
- * every limit with a MulterError whose `code` is one of the LIMIT_*
- * values, and nothing downstream knows what those mean - the generic
- * error handler would turn a caller's oversized upload into a server
- * error and page whoever is on call for it.
  */
 const MultipartFormDataMiddleware: RequestHandler = (
   req: ExpressRequest,
@@ -84,18 +131,57 @@ const MultipartFormDataMiddleware: RequestHandler = (
   next: NextFunction,
 ): void => {
   uploadAny(req, res, (err: unknown): void => {
-    if (err instanceof multer.MulterError) {
-      const message: string = `Multipart request rejected: ${err.code}.`;
+    return handleMulterError(err, next);
+  });
+};
 
-      return next(
-        TOO_LARGE_CODES.has(err.code)
-          ? new PayloadTooLargeException(message)
-          : new BadRequestException(message),
-      );
-    }
+/**
+ * A multipart middleware for a route that wants a LOWER file count than the
+ * shared default.
+ *
+ * Only downward: maxFiles is clamped to MAX_MULTIPART_FILES. Every route that
+ * mounts this middleware parses the body before its own auth check runs, so
+ * the shared ceiling is the limit an unauthenticated caller is held to across
+ * all of them. A per-route knob that could raise it would widen the pre-auth
+ * memory surface of every OTHER route's neighbours by proxy of a config
+ * change made for one — so it cannot.
+ *
+ * Routes that are happy with the default should keep using the default
+ * export; this builds a second multer instance, so call it once at module
+ * scope and never per request.
+ */
+export const getMultipartFormDataMiddleware: (options: {
+  maxFiles: number;
+}) => RequestHandler = (options: { maxFiles: number }): RequestHandler => {
+  /*
+   * Clamp the DOMAIN as well as the range. busboy compares `files === limit`,
+   * which never matches a fractional or NaN limit — so a non-integer would
+   * not narrow anything, it would remove the file bound entirely and leave
+   * the pre-auth parse unbounded. That is the exact widening this function
+   * exists to prevent, so anything not a finite number falls back to the
+   * shared ceiling rather than being passed through.
+   */
+  const requestedMaxFiles: number = options.maxFiles;
 
-    return next(err);
-  });
+  const maxFiles: number = Number.isFinite(requestedMaxFiles)
+    ? Math.max(1, Math.min(Math.floor(requestedMaxFiles), MAX_MULTIPART_FILES))
+    : MAX_MULTIPART_FILES;
+
+  if (maxFiles === MAX_MULTIPART_FILES) {
+    return MultipartFormDataMiddleware;
+  }
+
+  const scopedUploadAny: RequestHandler = buildUploadAny(maxFiles);
+
+  return (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): void => {
+    scopedUploadAny(req, res, (err: unknown): void => {
+      return handleMulterError(err, next);
+    });
+  };
 };
 
 export default MultipartFormDataMiddleware;

package/Server/Services/AlertEpisodeLabelRuleEngineService.ts

@@ -13,6 +13,8 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class AlertEpisodeLabelRuleEngineServiceClass {
   /**
@@ -44,10 +46,16 @@ class AlertEpisodeLabelRuleEngineServiceClass {
             episodeDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "AlertEpisodeLabelRule",
+        projectId: episode.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/AlertEpisodeOnCallRuleEngineService.ts

@@ -14,6 +14,8 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class AlertEpisodeOnCallRuleEngineServiceClass {
   /**
@@ -44,10 +46,16 @@ class AlertEpisodeOnCallRuleEngineServiceClass {
             episodeDescriptionPattern: true,
             onCallDutyPolicies: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "AlertEpisodeOnCallRule",
+        projectId: episode.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/AlertEpisodeOwnerRuleEngineService.ts

@@ -16,6 +16,8 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class AlertEpisodeOwnerRuleEngineServiceClass {
   /**
@@ -48,10 +50,16 @@ class AlertEpisodeOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "AlertEpisodeOwnerRule",
+        projectId: episode.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/AlertEpisodePrivacyRuleEngineService.ts

@@ -9,6 +9,8 @@ import { AlertEpisodeFeedEventType } from "../../Models/DatabaseModels/AlertEpis
 import { Red500 } from "../../Types/BrandColors";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class AlertEpisodePrivacyRuleEngineServiceClass {
   /**
@@ -41,10 +43,16 @@ class AlertEpisodePrivacyRuleEngineServiceClass {
             episodeTitlePattern: true,
             episodeDescriptionPattern: true,
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "AlertEpisodePrivacyRule",
+        projectId: episode.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return false;
       }