@oneuptime/common 12.0.32 → 12.0.34

package/Server/Utils/StartServer.ts

@@ -6,7 +6,6 @@ import {
   EncryptionSecretWarning,
   GoogleTagManagerEnabled,
   TrustedProxyHops,
-  getFrontendEnvVars,
 } from "../EnvironmentConfig";
 import LocalCache from "../Infrastructure/LocalCache";
 import HttpMetricsMiddleware from "../Middleware/HttpMetricsMiddleware";
@@ -16,6 +15,7 @@ import CorsOptions, {
   CORS_PREFLIGHT_MAX_AGE_SECONDS,
 } from "./CorsOptions";
 import "./Environment";
+import { sendFrontendEnvironmentResponse } from "./FrontendEnvironment";
 import Express, {
   ExpressApplication,
   ExpressJson,
@@ -37,6 +37,12 @@ import "./Process";
 import Response from "./Response";
 import SpanUtil from "./Telemetry/SpanUtil";
 import TelemetryContext from "./Telemetry/TelemetryContext";
+import {
+  COMPONENT_ATTRIBUTE_KEY,
+  TelemetryComponent,
+  UNIT_OF_WORK_ATTRIBUTE_KEY,
+  UnitOfWork,
+} from "../../Types/Telemetry/UnitOfWork";
 import mountVendorAssets from "./VendorAssets";
 import { api } from "@opentelemetry/sdk-node";
 import StatusCode from "../../Types/API/StatusCode";
@@ -284,13 +290,34 @@ app.use((req: ExpressRequest, _res: ExpressResponse, next: NextFunction) => {
    * ContextSpanProcessor and Logger read this ambient context, every span and
    * log produced downstream inherits it automatically.
    */
-  TelemetryContext.runWithContext({ requestId: requestId }, () => {
-    SpanUtil.addAttributesToCurrentSpan({
+  TelemetryContext.runWithContext(
+    {
       requestId: requestId,
-    });
+      /*
+       * Seed the unit of work EXPLICITLY. ErrorClassResolver honours a
+       * user-error / expected-denial classification only inside an HTTP
+       * request — everywhere else there is no client to blame, so those
+       * classes are promoted back to code-fault. runWithContext inherits the
+       * enclosing scope, so leaving this unset would let a request's marker
+       * leak into background work started from inside the request.
+       */
+      [UNIT_OF_WORK_ATTRIBUTE_KEY]: UnitOfWork.HttpRequest,
+      /*
+       * Which deployment role served this. service.name cannot answer it: the
+       * Helm chart runs the worker from the same image and entrypoint as the
+       * API, so worker pods also report service.name="api".
+       */
+      [COMPONENT_ATTRIBUTE_KEY]:
+        LocalCache.getString("app", "name") || TelemetryComponent.Api,
+    },
+    () => {
+      SpanUtil.addAttributesToCurrentSpan({
+        requestId: requestId,
+      });
 
-    next();
-  });
+      next();
+    },
+  );
 });
 
 export interface InitFuctionOptions {
@@ -346,22 +373,7 @@ const init: InitFunction = async (
       [`/${appName}/env.js`, "/env.js"],
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
-          // ping api server for database config.
-
-          const env: JSONObject = getFrontendEnvVars();
-
-          const script: string = `
-    if(!window.process){
-      window.process = {}
-    }
-
-    if(!window.process.env){
-      window.process.env = {}
-    }
-    window.process.env = ${JSON.stringify(env)};
-  `;
-
-          Response.sendJavaScriptResponse(req, res, script);
+          sendFrontendEnvironmentResponse(req, res);
         } catch (err) {
           return next(err);
         }
@@ -509,20 +521,25 @@ export const expressErrorHandler: (
 ): void => {
   logger.error(err, getLogAttributesFromRequest(_req as OneUptimeRequest));
 
-  // Mark span as error.
-  if (err) {
-    const span: api.Span | undefined = api.trace.getSpan(api.context.active());
-    if (span) {
-      // record exception
-      span.recordException(err);
-
-      // set span status code to ERROR
-      span.setStatus({
-        code: api.SpanStatusCode.ERROR,
-        message: err.message,
-      });
-    }
-  }
+  /*
+   * Deliberately does NOT record the exception on a span.
+   *
+   * There is no HTTP instrumentation (Telemetry.init passes an empty
+   * `instrumentations` array) and nothing creates a request-scoped span, so at
+   * this point the ambient span is either absent or an already-ENDED
+   * @CaptureSpan span — and addEvent no-ops on an ended span. On the whole
+   * BaseAPI CRUD surface this emitted exactly zero events while looking like
+   * it emitted one.
+   *
+   * Where it DID fire was the handful of @CaptureSpan-decorated middleware
+   * that swallow an error and call next(err) from inside their own still-open
+   * span. There it wrote to a span the request does not own, and — because the
+   * raw error was passed to span.recordException, and the SDK reads
+   * `exception.code` before `exception.name` — it typed the event with the
+   * HTTP status ("400", "422") instead of the class name. Those middleware now
+   * rethrow instead of swallowing, so CaptureSpan's normalized recorder does
+   * the right thing on the right span.
+   */
 
   if (res.headersSent) {
     next(err);

package/Server/Utils/TelegramVerificationToken.ts

@@ -0,0 +1,185 @@
+import crypto from "crypto";
+import {
+  RESEND_COOLDOWN_SECONDS,
+  VERIFICATION_CODE_EXPIRY_MINUTES,
+} from "./ChannelVerification";
+
+/*
+ * Telegram's /start payload is a bearer capability: anyone who can guess it
+ * can bind their chat to the pending notification method. A six-digit value
+ * is therefore not appropriate, even with request throttling. This format
+ * carries 256 bits from the operating-system CSPRNG and an authenticated-by-
+ * equality issue timestamp, while staying below Telegram's 64-character
+ * start-parameter limit.
+ *
+ *   8 base36 timestamp characters + "_" + 43 base64url characters = 52
+ *
+ * The whole value is stored on the pending row. Its random portion makes an
+ * offline or online search infeasible; the timestamp gives old links a hard
+ * lifetime without adding schema columns solely for this channel.
+ */
+
+const TOKEN_RANDOM_BYTES: number = 32;
+const TOKEN_TIMESTAMP_LENGTH: number = 8;
+const TOKEN_RANDOM_LENGTH: number = 43;
+const WEBHOOK_SECRET_MIN_LENGTH: number = 32;
+const WEBHOOK_SECRET_MAX_LENGTH: number = 100;
+const WEBHOOK_SECRET_REGEX: RegExp = /^[A-Za-z0-9_-]+$/;
+
+export const TELEGRAM_VERIFICATION_TOKEN_LENGTH: number =
+  TOKEN_TIMESTAMP_LENGTH + 1 + TOKEN_RANDOM_LENGTH;
+
+export const TELEGRAM_VERIFICATION_TOKEN_REGEX: RegExp =
+  /^[0-9a-z]{8}_[A-Za-z0-9_-]{43}$/;
+
+export default class TelegramVerificationToken {
+  public static mint(now: Date = new Date()): string {
+    const issuedAtSeconds: number = Math.floor(now.getTime() / 1000);
+    const encodedIssuedAt: string = issuedAtSeconds
+      .toString(36)
+      .padStart(TOKEN_TIMESTAMP_LENGTH, "0");
+
+    if (encodedIssuedAt.length !== TOKEN_TIMESTAMP_LENGTH) {
+      throw new Error("Telegram verification timestamp is out of range");
+    }
+
+    const randomValue: string = crypto
+      .randomBytes(TOKEN_RANDOM_BYTES)
+      .toString("base64url");
+
+    return `${encodedIssuedAt}_${randomValue}`;
+  }
+
+  public static isValidShape(token: unknown): token is string {
+    return (
+      typeof token === "string" &&
+      token.length === TELEGRAM_VERIFICATION_TOKEN_LENGTH &&
+      TELEGRAM_VERIFICATION_TOKEN_REGEX.test(token)
+    );
+  }
+
+  public static getIssuedAt(token: unknown): Date | null {
+    if (!TelegramVerificationToken.isValidShape(token)) {
+      return null;
+    }
+
+    const encodedIssuedAt: string = token.slice(0, TOKEN_TIMESTAMP_LENGTH);
+    const issuedAtSeconds: number = parseInt(encodedIssuedAt, 36);
+
+    if (!Number.isSafeInteger(issuedAtSeconds) || issuedAtSeconds <= 0) {
+      return null;
+    }
+
+    return new Date(issuedAtSeconds * 1000);
+  }
+
+  public static isExpired(data: {
+    token: unknown;
+    now?: Date | undefined;
+  }): boolean {
+    const issuedAt: Date | null = TelegramVerificationToken.getIssuedAt(
+      data.token,
+    );
+
+    if (!issuedAt) {
+      return true;
+    }
+
+    const now: Date = data.now || new Date();
+
+    /*
+     * A timestamp from the future is malformed or the result of clock skew in
+     * the unsafe direction. Refuse it instead of extending the token's life.
+     */
+    if (issuedAt.getTime() > now.getTime()) {
+      return true;
+    }
+
+    return (
+      now.getTime() - issuedAt.getTime() >=
+      VERIFICATION_CODE_EXPIRY_MINUTES * 60 * 1000
+    );
+  }
+
+  public static getResendRetryAfterSeconds(data: {
+    token: unknown;
+    now?: Date | undefined;
+  }): number {
+    const issuedAt: Date | null = TelegramVerificationToken.getIssuedAt(
+      data.token,
+    );
+
+    if (!issuedAt) {
+      return 0;
+    }
+
+    const now: Date = data.now || new Date();
+    const elapsedSeconds: number = (now.getTime() - issuedAt.getTime()) / 1000;
+
+    if (elapsedSeconds < 0) {
+      return RESEND_COOLDOWN_SECONDS;
+    }
+
+    if (elapsedSeconds >= RESEND_COOLDOWN_SECONDS) {
+      return 0;
+    }
+
+    return Math.max(1, Math.ceil(RESEND_COOLDOWN_SECONDS - elapsedSeconds));
+  }
+
+  /*
+   * A non-reversible, fixed-size Redis key segment that never discloses the
+   * live bearer token in operational tooling.
+   */
+  public static getRateLimitKey(token: string): string {
+    return crypto.createHash("sha256").update(token, "utf8").digest("hex");
+  }
+
+  /*
+   * Burn a token after use. This deliberately does not match the live-token
+   * grammar, so no time or random value can make it acceptable again.
+   */
+  public static mintUnusableValue(): string {
+    return crypto.randomBytes(TOKEN_RANDOM_BYTES).toString("hex");
+  }
+
+  public static isWebhookSecretStrong(secret: unknown): secret is string {
+    if (typeof secret !== "string") {
+      return false;
+    }
+
+    const normalizedSecret: string = secret.trim();
+
+    return (
+      normalizedSecret.length >= WEBHOOK_SECRET_MIN_LENGTH &&
+      normalizedSecret.length <= WEBHOOK_SECRET_MAX_LENGTH &&
+      WEBHOOK_SECRET_REGEX.test(normalizedSecret)
+    );
+  }
+
+  /*
+   * Fail closed when the administrator did not configure a Telegram webhook
+   * secret. Comparing equal-length values with timingSafeEqual avoids turning
+   * the header check into a prefix oracle.
+   */
+  public static isWebhookSecretValid(data: {
+    configuredSecret: string | null | undefined;
+    providedSecret: string | null | undefined;
+  }): boolean {
+    const configuredSecret: string = data.configuredSecret?.trim() || "";
+    const providedSecret: string = data.providedSecret || "";
+
+    if (!configuredSecret || !providedSecret) {
+      return false;
+    }
+
+    const configuredBuffer: Buffer = Buffer.from(configuredSecret, "utf8");
+    const providedBuffer: Buffer = Buffer.from(providedSecret, "utf8");
+
+    if (configuredBuffer.length !== providedBuffer.length) {
+      return false;
+    }
+
+    return crypto.timingSafeEqual(configuredBuffer, providedBuffer);
+  }
+}

package/Server/Utils/Telemetry/CaptureSpan.ts

@@ -4,6 +4,34 @@ import { JSONObject } from "../../../Types/JSON";
 import JSONFunctions from "../../../Types/JSONFunctions";
 import { DisableTelemetry } from "../../EnvironmentConfig";
 
+/*
+ * Mark a span OK, but never DOWNGRADE an ERROR someone else already set.
+ *
+ * The SDK's own setStatus guard only early-returns when the CURRENT status is
+ * already OK, so an OK written after an ERROR wins. That is reachable whenever
+ * a decorated method swallows an error and signals failure by another route
+ * (Express middleware calling next(err) is the classic case): the method
+ * "returns successfully" from the decorator's point of view, and the span ends
+ * up marked OK while carrying an exception event.
+ */
+function markSpanOk(span: Span): void {
+  try {
+    const currentStatus: { code?: number } | undefined = (
+      span as unknown as { status?: { code?: number } }
+    ).status;
+
+    if (currentStatus && currentStatus.code === SpanStatusCode.ERROR) {
+      return;
+    }
+  } catch {
+    // Span implementation without an observable status — set it normally.
+  }
+
+  span.setStatus({
+    code: SpanStatusCode.OK,
+  });
+}
+
 function CaptureSpan(data?: {
   name?: string;
   attributes?: JSONObject;
@@ -86,9 +114,7 @@ function CaptureSpan(data?: {
             if (result instanceof Promise) {
               return result
                 .then((res: any) => {
-                  span.setStatus({
-                    code: SpanStatusCode.OK,
-                  });
+                  markSpanOk(span);
                   return res;
                 })
                 .catch((err: Error) => {
@@ -100,12 +126,10 @@ function CaptureSpan(data?: {
                   throw err;
                 })
                 .finally(() => {
-                  span.end();
+                  Telemetry.endSpan(span);
                 });
             }
-            span.setStatus({
-              code: SpanStatusCode.OK,
-            });
+            markSpanOk(span);
             return result;
           } catch (err) {
             Telemetry.recordExceptionMarkSpanAsErrorAndEndSpan({
@@ -116,7 +140,7 @@ function CaptureSpan(data?: {
             throw err;
           } finally {
             if (!(result instanceof Promise)) {
-              span.end();
+              Telemetry.endSpan(span);
             }
           }
         },

package/Server/Utils/Telemetry/ErrorClassResolver.ts

@@ -0,0 +1,120 @@
+import ErrorClass, {
+  DeclaredErrorClass,
+  declaredErrorClass,
+  isNonActionableErrorClass,
+  toErrorClass,
+} from "../../../Types/Telemetry/ErrorClass";
+import {
+  UNIT_OF_WORK_ATTRIBUTE_KEY,
+  UnitOfWork,
+} from "../../../Types/Telemetry/UnitOfWork";
+import { TelemetryErrorClassEnabled } from "../../EnvironmentConfig";
+import TelemetryContext from "./TelemetryContext";
+
+/**
+ * Decides the fault domain of a thrown value: is this OUR bug, or a
+ * consequence of what someone asked us to do?
+ *
+ * Two rules, in order, and neither of them asks the catch site to make a
+ * judgment call.
+ *
+ * 1. UNDECLARED MEANS CODE-FAULT. A raw TypeError, a TypeORM QueryFailedError,
+ *    an axios error, a thrown string — nobody predicted it, so by definition
+ *    it is a bug. This is also what happens to an Exception subclass whose
+ *    author never overrode getErrorClass. The scheme's failure mode is
+ *    over-reporting, always.
+ *
+ * 1b. UNLESS THE SITE SAID SO ITSELF. A class declared for one specific throw
+ *    or one specific log line (Exception.asUserError(), or an `error.class`
+ *    attribute on a logger.error call) is authoritative and skips rule 2. Rule
+ *    2 exists to stop a class-level GENERALISATION being trusted in the wrong
+ *    context; it should not overrule a developer who looked at one site. This
+ *    is what lets a probe report "the endpoint we were asked to check is down"
+ *    as a non-defect even though a probe check has no request around it.
+ *
+ * 2. A USER-ERROR NEEDS A USER. user-error and expected-denial are honoured
+ *    only inside an HTTP request. In a worker job, a cron run, a probe check,
+ *    at startup, or outside any scope at all, there is no client whose request
+ *    could have been wrong — so the "bad input" was produced by our own code,
+ *    and that is a bug. They are promoted back to code-fault.
+ *
+ * code-fault and infrastructure are honoured everywhere: neither is ever
+ * suppressed, so promoting them would be meaningless.
+ *
+ * Known limitation, documented rather than papered over: a request handler
+ * that starts background work with `.catch()` after responding stays inside
+ * the http-request scope, so an invariant violation in that async tail is
+ * still labelled user-error. It still emits a `fault` span event, a WARN log
+ * and an `oneuptime.fault.count` increment, so it remains findable — see the
+ * standing review queries in the release notes.
+ */
+export default class ErrorClassResolver {
+  public static resolve(
+    error: unknown,
+    declaredOverride?: unknown,
+  ): ErrorClass {
+    if (!TelemetryErrorClassEnabled) {
+      /*
+       * Kill switch. Everything is a code-fault, which reproduces the
+       * pre-classification behaviour exactly: exception event, ERROR status,
+       * ERROR log.
+       */
+      return ErrorClass.CodeFault;
+    }
+
+    /*
+     * An explicit class handed in by the caller (e.g. the `error.class`
+     * attribute on a logger.error call) is a site-level declaration and wins
+     * outright — including over the unit-of-work promotion.
+     */
+    const override: ErrorClass | null = toErrorClass(declaredOverride);
+
+    if (override !== null) {
+      return override;
+    }
+
+    const declared: DeclaredErrorClass | null = declaredErrorClass(error);
+
+    if (declared === null) {
+      return ErrorClass.CodeFault;
+    }
+
+    if (
+      declared.authoritative ||
+      !isNonActionableErrorClass(declared.errorClass)
+    ) {
+      return declared.errorClass;
+    }
+
+    return this.isInsideHttpRequest()
+      ? declared.errorClass
+      : ErrorClass.CodeFault;
+  }
+
+  /**
+   * Whether the resolved class is one we deliberately keep out of the Issues
+   * list. Convenience so callers do not have to import both this and the
+   * predicate.
+   */
+  public static isNonActionable(
+    error: unknown,
+    declaredOverride?: unknown,
+  ): boolean {
+    return isNonActionableErrorClass(this.resolve(error, declaredOverride));
+  }
+
+  private static isInsideHttpRequest(): boolean {
+    try {
+      return (
+        TelemetryContext.getAttributes()[UNIT_OF_WORK_ATTRIBUTE_KEY] ===
+        UnitOfWork.HttpRequest
+      );
+    } catch {
+      /*
+       * No AsyncLocalStorage scope, or telemetry disabled. "Not a request" is
+       * the safe answer: it promotes toward code-fault.
+       */
+      return false;
+    }
+  }
+}