@oneuptime/common 12.0.31 → 12.0.33

package/Server/Services/ProjectService.ts

@@ -34,6 +34,7 @@ import IncidentStateService from "./IncidentStateService";
 import IncidentRoleService from "./IncidentRoleService";
 import MailService from "./MailService";
 import MonitorStatusService from "./MonitorStatusService";
+import NetworkDeviceRoleService from "./NetworkDeviceRoleService";
 import NetworkSiteTypeService from "./NetworkSiteTypeService";
 import NotificationService from "./NotificationService";
 import PromoCodeService from "./PromoCodeService";
@@ -64,6 +65,7 @@ import {
 } from "../../Types/BrandColors";
 import Color from "../../Types/Color";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import QueryDeepPartialEntity from "../../Types/Database/PartialEntity";
 import OneUptimeDate from "../../Types/Date";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
@@ -79,6 +81,15 @@ import IncidentRole from "../../Models/DatabaseModels/IncidentRole";
 import MonitorStatus from "../../Models/DatabaseModels/MonitorStatus";
 import NetworkSiteType from "../../Models/DatabaseModels/NetworkSiteType";
 import DefaultNetworkSiteType from "../../Types/NetworkSite/DefaultNetworkSiteType";
+import NetworkDeviceRole from "../../Models/DatabaseModels/NetworkDeviceRole";
+import {
+  DEFAULT_NETWORK_DEVICE_ROLES,
+  DefaultNetworkDeviceRole,
+} from "../../Types/NetworkDevice/DefaultNetworkDeviceRole";
+import {
+  DefaultNetworkSiteTypeCreationOrder,
+  DefaultNetworkSiteTypeParent,
+} from "../../Types/NetworkSite/DefaultNetworkSiteTypeHierarchy";
 import Model from "../../Models/DatabaseModels/Project";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import PromoCode from "../../Models/DatabaseModels/PromoCode";
@@ -1444,6 +1455,7 @@ These are no longer recorded against the project and have to be cancelled by han
       this.addDefaultAlertState(createdItem),
       this.addDefaultIncidentRoles(createdItem),
       this.addDefaultNetworkSiteTypes(createdItem),
+      this.addDefaultNetworkDeviceRoles(createdItem),
     ]);
 
     if (createdItem.createdOwnerEmail) {
@@ -1905,21 +1917,50 @@ These are no longer recorded against the project and have to be cancelled by han
    * addDefaultAlertSeverity / addDefaultAlertState.
    */
   @CaptureSpan()
-  public async addDefaultNetworkSiteTypes(createdItem: Model): Promise<Model> {
+  public async addDefaultNetworkSiteTypes(
+    createdItem: Model,
+    options?: { setParentRelationships?: boolean },
+  ): Promise<Model> {
     const projectId: ObjectID = createdItem.id!;
 
-    // Idempotent — see getExistingProjectScopedNames.
-    const existingNames: Set<string | undefined> =
-      await this.getExistingProjectScopedNames(
-        NetworkSiteTypeService,
-        projectId,
-      );
+    const existingNetworkSiteTypes: Array<NetworkSiteType> = [];
+    let networkSiteTypeSkip: number = 0;
+
+    while (true) {
+      const page: Array<NetworkSiteType> = await NetworkSiteTypeService.findBy({
+        query: { projectId },
+        select: { _id: true, name: true },
+        sort: { _id: SortOrder.Ascending },
+        limit: LIMIT_MAX,
+        skip: networkSiteTypeSkip,
+        props: { isRoot: true },
+      });
+
+      existingNetworkSiteTypes.push(...page);
+
+      if (page.length < LIMIT_MAX) {
+        break;
+      }
+
+      networkSiteTypeSkip += page.length;
+    }
+
+    const networkSiteTypeByName: Map<string, NetworkSiteType> = new Map<
+      string,
+      NetworkSiteType
+    >();
+
+    for (const networkSiteType of existingNetworkSiteTypes) {
+      if (networkSiteType.name) {
+        networkSiteTypeByName.set(networkSiteType.name, networkSiteType);
+      }
+    }
 
     /*
-     * Listed broadest-first: the array position is the hierarchy level, so the
-     * index drives `order` (1..7, lower = higher in the hierarchy). Names come
-     * from DefaultNetworkSiteType so that enum stays the single source of
-     * truth for the defaults, shared with the backfill data migration.
+     * DefaultNetworkSiteTypeCreationOrder lists parents before children, so a
+     * parent's ID is always available by the time its child is created. The
+     * parent mapping itself is shared with the data migration that repairs
+     * projects created before type parents existed.
      *
      * isUnitLevel is true for "Unit" only. It is load-bearing, not a label:
      * the network map drills sites of a unit-level type into their device
@@ -1927,77 +1968,178 @@ These are no longer recorded against the project and have to be cancelled by han
      * as units. Downstream code keys off this flag rather than the name,
      * because the name is user-editable once seeded.
      */
-    const defaultNetworkSiteTypes: Array<{
-      name: DefaultNetworkSiteType;
-      description: string;
-      isUnitLevel: boolean;
-    }> = [
-      {
-        name: DefaultNetworkSiteType.AccountType,
+    const defaultNetworkSiteTypes: Readonly<
+      Record<
+        DefaultNetworkSiteType,
+        {
+          description: string;
+          isUnitLevel: boolean;
+        }
+      >
+    > = {
+      [DefaultNetworkSiteType.AccountType]: {
         description:
           "Top level grouping - the kind of account the sites underneath it belong to.",
         isUnitLevel: false,
       },
-      {
-        name: DefaultNetworkSiteType.Region,
+      [DefaultNetworkSiteType.Region]: {
         description:
           "A broad geographic region that groups markets and the sites within them.",
         isUnitLevel: false,
       },
-      {
-        name: DefaultNetworkSiteType.Franchisee,
+      [DefaultNetworkSiteType.Franchisee]: {
         description:
           "An operator or franchise partner responsible for a group of sites.",
         isUnitLevel: false,
       },
-      {
-        name: DefaultNetworkSiteType.Market,
+      [DefaultNetworkSiteType.Market]: {
         description: "A metro or trade area that groups the sites within it.",
         isUnitLevel: false,
       },
-      {
-        name: DefaultNetworkSiteType.Unit,
+      [DefaultNetworkSiteType.Unit]: {
         description:
           "An individual location with network devices. This is the leaf level of the hierarchy.",
         isUnitLevel: true,
       },
-      {
-        name: DefaultNetworkSiteType.DataCenter,
+      [DefaultNetworkSiteType.DataCenter]: {
         description:
           "A data center or core facility that hosts shared infrastructure.",
         isUnitLevel: false,
       },
-      {
-        name: DefaultNetworkSiteType.Other,
+      [DefaultNetworkSiteType.Other]: {
         description: "Any site that does not fit the other levels.",
         isUnitLevel: false,
       },
-    ];
+    };
 
-    for (
-      let index: number = 0;
-      index < defaultNetworkSiteTypes.length;
-      index++
-    ) {
+    /*
+     * `order` is a sibling display order, not a proxy for depth. Increment a
+     * separate counter per parent: the default chain's only child is 1 at each
+     * level, while the three roots are Account Type (1), Data Center (2), and
+     * Other (3).
+     */
+    const nextOrderByParent: Map<DefaultNetworkSiteType | null, number> =
+      new Map<DefaultNetworkSiteType | null, number>();
+
+    for (const name of DefaultNetworkSiteTypeCreationOrder) {
       const defaultNetworkSiteType: {
-        name: DefaultNetworkSiteType;
         description: string;
         isUnitLevel: boolean;
-      } = defaultNetworkSiteTypes[index]!;
-
-      if (existingNames.has(defaultNetworkSiteType.name)) {
+      } = defaultNetworkSiteTypes[name];
+      const parentName: DefaultNetworkSiteType | null =
+        options?.setParentRelationships === false
+          ? null
+          : DefaultNetworkSiteTypeParent[name];
+      const siblingOrder: number = (nextOrderByParent.get(parentName) || 0) + 1;
+      nextOrderByParent.set(parentName, siblingOrder);
+
+      if (networkSiteTypeByName.has(name)) {
         continue;
       }
 
       const networkSiteType: NetworkSiteType = new NetworkSiteType();
-      networkSiteType.name = defaultNetworkSiteType.name;
+      networkSiteType.name = name;
       networkSiteType.description = defaultNetworkSiteType.description;
       networkSiteType.isUnitLevel = defaultNetworkSiteType.isUnitLevel;
       networkSiteType.projectId = projectId;
-      networkSiteType.order = index + 1;
+      networkSiteType.order = siblingOrder;
+
+      if (parentName) {
+        const parent: NetworkSiteType | undefined =
+          networkSiteTypeByName.get(parentName);
+
+        if (!parent?.id) {
+          throw new BadDataException(
+            `Cannot create the default ${name} Network Site Type because its ${parentName} parent could not be resolved.`,
+          );
+        }
+
+        networkSiteType.parentNetworkSiteTypeId = parent.id;
+      }
+
+      const createdNetworkSiteType: NetworkSiteType =
+        await NetworkSiteTypeService.create({
+          data: networkSiteType,
+          props: {
+            isRoot: true,
+          },
+        });
+
+      networkSiteTypeByName.set(name, createdNetworkSiteType);
+    }
+
+    return createdItem;
+  }
+
+  /**
+   * Seeds the per-project network device role lookup table.
+   *
+   * Device roles used to be a fixed union with the label, the silhouette and
+   * the "is this a core device?" flag hardcoded in three different modules.
+   * They are now a configurable per-project table, so a project can rename
+   * "Wireless AP" to "Access Point", draw firewalls as something else, or add
+   * a role of its own - which means every project needs its own seeded copy of
+   * the defaults.
+   *
+   * Public for the same reason addDefaultNetworkSiteTypes is: the
+   * BackfillNetworkDeviceRoles data migration calls it to seed roles into
+   * projects that existed before the table did, so the defaults are defined
+   * once and cannot drift between project creation and the backfill.
+   *
+   * The key is passed explicitly rather than derived from the name. It has to
+   * be exactly what the SNMP classifier emits - "wirelessAccessPoint", which
+   * no derivation from "Wireless AP" would produce - or a classified access
+   * point would match no row.
+   */
+  @CaptureSpan()
+  public async addDefaultNetworkDeviceRoles(
+    createdItem: Model,
+  ): Promise<Model> {
+    const projectId: ObjectID = createdItem.id!;
+
+    // Idempotent - see getExistingProjectScopedNames.
+    const existingNames: Set<string | undefined> =
+      await this.getExistingProjectScopedNames(
+        NetworkDeviceRoleService,
+        projectId,
+      );
+
+    /*
+     * Also guarded on the key, not just the name: a project that renamed the
+     * seeded "Router" to "Edge Router" must not get a second row called
+     * "Router" the next time this runs, and the key is the identity that
+     * survives the rename.
+     */
+    const existingKeys: Set<string> =
+      await NetworkDeviceRoleService.getKeysInProject(projectId);
+
+    for (
+      let index: number = 0;
+      index < DEFAULT_NETWORK_DEVICE_ROLES.length;
+      index++
+    ) {
+      const defaultRole: DefaultNetworkDeviceRole =
+        DEFAULT_NETWORK_DEVICE_ROLES[index]!;
+
+      if (
+        existingNames.has(defaultRole.name) ||
+        existingKeys.has(defaultRole.key)
+      ) {
+        continue;
+      }
 
-      await NetworkSiteTypeService.create({
-        data: networkSiteType,
+      const networkDeviceRole: NetworkDeviceRole = new NetworkDeviceRole();
+      networkDeviceRole.name = defaultRole.name;
+      networkDeviceRole.key = defaultRole.key;
+      networkDeviceRole.description = defaultRole.description;
+      networkDeviceRole.topologyShape = defaultRole.topologyShape;
+      networkDeviceRole.isCoreLayer = defaultRole.isCoreLayer;
+      networkDeviceRole.isSnmpWalkable = defaultRole.isSnmpWalkable;
+      networkDeviceRole.projectId = projectId;
+      networkDeviceRole.order = index + 1;
+
+      await NetworkDeviceRoleService.create({
+        data: networkDeviceRole,
         props: {
           isRoot: true,
         },

package/Server/Services/StatusPagePrivateUserService.ts

@@ -1,6 +1,8 @@
 import DatabaseConfig from "../DatabaseConfig";
+import { EncryptionSecret } from "../EnvironmentConfig";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import logger from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import MailService from "./MailService";
@@ -13,6 +15,9 @@ import Protocol from "../../Types/API/Protocol";
 import URL from "../../Types/API/URL";
 import OneUptimeDate from "../../Types/Date";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import Email from "../../Types/Email";
+import HashedString from "../../Types/HashedString";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import StatusPage from "../../Models/DatabaseModels/StatusPage";
@@ -55,17 +60,112 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  /**
+   * Kill any outstanding password-reset link for a status page user whose
+   * email address is about to change.
+   *
+   * Same invariant, and the same reasoning, as
+   * `UserService.expirePasswordResetTokensForEmailChange`: the link is a
+   * bearer credential addressed to one mailbox, and `/status-page-api/
+   * reset-password` finds the row by token hash and status page alone, never
+   * by the address the link was mailed to. Left unexpired, a link sent to the
+   * old address keeps working against the account at its new one.
+   *
+   * This path is worth closing even though a status page user cannot edit
+   * their own email: project admins can (the column carries `update` for
+   * ProjectAdmin and StatusPageAdmin), and `StatusPageSCIM.ts` rewrites it
+   * from the directory. "Move this subscriber to their new address" is the
+   * same rescue action, done by somebody else on the user's behalf, and it has
+   * to invalidate old links for the same reason.
+   *
+   * Cleared before the write, and only for rows whose address actually
+   * changes, so a SCIM push that re-sends an unchanged address does not
+   * invalidate a reset link the user is part-way through using.
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.email) {
+      const newEmail: string = (updateBy.data.email as Email)
+        .toString()
+        .toLowerCase();
+
+      const existingUsers: Array<Model> = await this.findBy({
+        query: updateBy.query,
+        select: {
+          _id: true,
+          email: true,
+        },
+        props: updateBy.props,
+        limit: LIMIT_MAX,
+        skip: 0,
+      });
+
+      for (const user of existingUsers) {
+        if (!user.id) {
+          continue;
+        }
+
+        /*
+         * A row whose `email` did not come back is treated as changed -- that
+         * only happens when the caller could not read the column, and on a
+         * credential the safe assumption is the one that expires the token.
+         */
+        const currentEmail: string | undefined = user.email
+          ?.toString()
+          .toLowerCase();
+
+        if (currentEmail === newEmail) {
+          continue;
+        }
+
+        await this.updateOneById({
+          id: user.id,
+          data: {
+            resetPasswordToken: null!,
+            resetPasswordExpires: null!,
+          },
+          props: {
+            isRoot: true,
+            ignoreHooks: true,
+          },
+        });
+      }
+    }
+
+    return {
+      updateBy: updateBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<Model>,
     createdItem: Model,
   ): Promise<Model> {
-    // send email to the user.
+    /*
+     * The invite link doubles as this user's first password-reset link, so the
+     * column has to hold what `/status-page-api/reset-password` looks rows up
+     * by: the SHA-256 of the token, never the token itself. That endpoint
+     * hashes whatever the link carried and queries by the digest, so a raw
+     * token stored here matches nothing and the welcome link is dead on
+     * arrival -- and it would also leave a working bearer credential sitting
+     * in the database in plaintext.
+     *
+     * Same split as `/status-page-api/forgot-password`: the digest is
+     * persisted, the raw token is only ever mailed.
+     */
     const token: string = ObjectID.generate().toString();
+    const hashedToken: string = await HashedString.hashValue(
+      token,
+      EncryptionSecret,
+    );
     await this.updateOneById({
       id: createdItem.id!,
       data: {
-        resetPasswordToken: token,
+        resetPasswordToken: hashedToken,
         resetPasswordExpires: OneUptimeDate.getOneDayAfter(),
       },
       props: {

package/Server/Services/UserNotificationEmailRollupBatchService.ts

@@ -0,0 +1,78 @@
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { ROLLUP_BATCH_RETENTION_DAYS } from "../Utils/EmailRollup/EmailRollupConstants";
+import Model from "../../Models/DatabaseModels/UserNotificationEmailRollupBatch";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+
+/*
+ * The rollup claim ledger. Root only in every direction: an insert here is
+ * what wins an epoch, so a caller who could create one could stop the next
+ * rollup being sent, and one who could delete one could make it be sent
+ * twice.
+ *
+ * Retention is set UNCONDITIONALLY, deliberately unlike EmailLogService,
+ * which only registers its retention when billing is enabled. The
+ * HardDelete:HardDeleteOlderItemsInDatabase cron iterates every service in
+ * the Services array with no billing check, so a gated call would simply
+ * never prune on a self-hosted install.
+ *
+ * Thirty days rather than the items' seven: a batch row is the record of how
+ * many notifications one email replaced, which is the number the whole
+ * feature is judged on, and it is one row per flush rather than one per
+ * notification. Pruning it cannot orphan anything, because rollupBatchId on
+ * the item table is deliberately a bare column with no foreign key.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+    this.hardDeleteItemsOlderThanInDays(
+      "createdAt",
+      ROLLUP_BATCH_RETENTION_DAYS,
+    );
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Notification email rollup batches are claimed by the flush worker only.",
+      );
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (!updateBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Notification email rollup batches are claimed by the flush worker only.",
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    if (!deleteBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Notification email rollup batches are claimed by the flush worker only.",
+      );
+    }
+
+    return { deleteBy, carryForward: null };
+  }
+}
+
+export default new Service();

package/Server/Services/UserNotificationEmailRollupItemService.ts

@@ -0,0 +1,79 @@
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { ROLLUP_ITEM_RETENTION_DAYS } from "../Utils/EmailRollup/EmailRollupConstants";
+import Model from "../../Models/DatabaseModels/UserNotificationEmailRollupItem";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+
+/*
+ * The owner-email rollup queue and volume ledger. Root only in every
+ * direction: a pending row is the thing that makes a deferred notification
+ * eventually arrive, so nothing outside the notification write path and the
+ * flush sweep may insert, edit or remove one.
+ *
+ * Retention is set UNCONDITIONALLY, deliberately unlike EmailLogService,
+ * which only registers its retention when billing is enabled. The
+ * HardDelete:HardDeleteOlderItemsInDatabase cron iterates every service in
+ * the Services array and honours whatever retention it declares, with no
+ * billing check anywhere in the loop - so gating the call on IsBillingEnabled
+ * would leave a self-hosted install accumulating one row per owner email
+ * forever, which for the exact customer this feature exists for is thousands
+ * of rows a day.
+ *
+ * Seven days is chosen against the two things that read the table: the burst
+ * counter, which looks back BURST_WINDOW_MINUTES, and a human answering "what
+ * flooded this inbox last week".
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+    this.hardDeleteItemsOlderThanInDays(
+      "createdAt",
+      ROLLUP_ITEM_RETENTION_DAYS,
+    );
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Notification email rollup items are written by the notification pipeline only.",
+      );
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (!updateBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Notification email rollup items are written by the notification pipeline only.",
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    if (!deleteBy.props.isRoot) {
+      throw new NotAuthorizedException(
+        "Notification email rollup items are written by the notification pipeline only.",
+      );
+    }
+
+    return { deleteBy, carryForward: null };
+  }
+}
+
+export default new Service();