@oneuptime/common 12.0.33 → 12.0.34

package/Server/Services/UserNotificationSettingService.ts

@@ -53,6 +53,8 @@ import {
 import EmailRollupWriter from "../Utils/EmailRollup/EmailRollupWriter";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { appendRecipientToWhatsAppMessage } from "../Utils/WhatsAppTemplateUtil";
+import DatabaseConfig from "../DatabaseConfig";
+import URL from "../../Types/API/URL";
 
 export class Service extends DatabaseService<UserNotificationSetting> {
   public constructor() {
@@ -149,18 +151,44 @@ export class Service extends DatabaseService<UserNotificationSetting> {
           },
         });
 
+        const emailEnvelope: EmailEnvelope = {
+          ...data.emailEnvelope,
+          vars: { ...data.emailEnvelope.vars },
+        };
+
+        if (userEmails.length > 0) {
+          try {
+            const dashboardUrl: URL = await DatabaseConfig.getDashboardUrl();
+            /*
+             * Keep this out of the producer's envelope and the other channels.
+             * A *Link variable would be mistaken for a resource by the rollup writer.
+             */
+            emailEnvelope.vars["notificationPreferencesUrl"] = URL.fromString(
+              dashboardUrl.toString(),
+            )
+              .addRoute(
+                `/${data.projectId.toString()}/user-settings/notification-settings`,
+              )
+              .toString();
+          } catch (err) {
+            // The footer retains navigation instructions if a URL is unavailable.
+            logger.error(err);
+          }
+        }
+
         for (const userEmail of userEmails) {
           /*
            * The one seam where an owner email can be held back. Below the
-           * burst threshold this is byte-for-byte the send that was here
-           * before - same envelope, same correlation ids, still
-           * fire-and-forget inside the writer - and above it the message is
+           * burst threshold the email is sent immediately with its original
+           * subject, template and correlation ids, plus the preferences URL
+           * above. Delivery is fire-and-forget inside the writer; above the
+           * threshold the message is
            * queued for a rollup instead of dropped. Awaited, unlike the raw
            * send it replaces, because the queue row has to exist before this
            * method returns; the writer itself never awaits MailService.
            *
-           * data.emailEnvelope is passed by reference and is never mutated by
-           * the writer, which the Telegram fallback below and the Slack /
+           * The email-only envelope copy is never mutated by the writer.
+           * The original remains unchanged, which the Telegram fallback and Slack /
            * Microsoft Teams bodies further down depend on: all three
            * synthesise their message from data.emailEnvelope.subject.
            *
@@ -177,7 +205,7 @@ export class Service extends DatabaseService<UserNotificationSetting> {
               userId: data.userId,
               toEmail: userEmail.email!,
               eventType: data.eventType,
-              emailEnvelope: data.emailEnvelope,
+              emailEnvelope: emailEnvelope,
               mailOptions: {
                 projectId: data.projectId,
                 incidentId: data.incidentId,

package/Server/Services/UserTelegramService.ts

@@ -4,6 +4,7 @@ import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import ProjectService from "./ProjectService";
+import TeamMemberService from "./TeamMemberService";
 import UserNotificationRuleService, {
   NotificationDeletionImpact,
   NotificationMethodChannel,
@@ -11,10 +12,29 @@ import UserNotificationRuleService, {
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
-import Text from "../../Types/Text";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
 import Project from "../../Models/DatabaseModels/Project";
+import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import Model from "../../Models/DatabaseModels/UserTelegram";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import TelegramVerificationToken from "../Utils/TelegramVerificationToken";
+import {
+  QueryDeepPartialEntity,
+  UpdateQueryBuilder,
+  UpdateResult,
+} from "typeorm";
+
+export enum TelegramVerificationOutcome {
+  Verified = "verified",
+  Invalid = "invalid",
+  Expired = "expired",
+  AlreadyClaimed = "already-claimed",
+}
+
+export interface TelegramVerificationResult {
+  outcome: TelegramVerificationOutcome;
+  item?: Model | undefined;
+}
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -90,6 +110,59 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("telegramChatId cannot be set directly");
     }
 
+    /*
+     * DatabaseService stamps props.tenantId only AFTER this hook. Until then,
+     * both projectId and project are request data. Policy checks performed
+     * against either request value would therefore be a confused-deputy bug:
+     * the caller could pass an enabled/funded project here, pass this hook, and
+     * have DatabaseService persist the row under a different authenticated
+     * tenant afterwards.
+     *
+     * Canonicalize both spellings to the authenticated request tenant before
+     * any lookup. Root jobs have no request tenant, so they retain the existing
+     * internal-call behaviour and use the project explicitly carried by data.
+     */
+    const suppliedProjectId: ObjectID | undefined = createBy.data.projectId;
+    const relationProjectId: ObjectID | null | undefined =
+      createBy.data.project?.id ||
+      (createBy.data.project?._id
+        ? new ObjectID(createBy.data.project._id)
+        : undefined);
+    const requestTenantId: ObjectID | undefined = createBy.props.tenantId;
+
+    if (!createBy.props.isRoot && !requestTenantId) {
+      throw new BadDataException("Project ID is required");
+    }
+
+    const authoritativeProjectId: ObjectID | undefined = createBy.props.isRoot
+      ? suppliedProjectId
+      : requestTenantId;
+
+    if (!authoritativeProjectId) {
+      throw new BadDataException("Project ID is required");
+    }
+
+    if (
+      suppliedProjectId &&
+      !suppliedProjectId.equals(authoritativeProjectId)
+    ) {
+      throw new BadDataException("Project ID does not match request tenant");
+    }
+
+    if (
+      relationProjectId &&
+      !relationProjectId.equals(authoritativeProjectId)
+    ) {
+      throw new BadDataException(
+        createBy.props.isRoot
+          ? "Project relation does not match projectId"
+          : "Project relation does not match request tenant",
+      );
+    }
+
+    createBy.data.projectId = authoritativeProjectId;
+    delete createBy.data.project;
+
     const project: Project | null = await ProjectService.findOneById({
       id: createBy.data.projectId!,
       props: {
@@ -120,6 +193,13 @@ export class Service extends DatabaseService<Model> {
       );
     }
 
+    /*
+     * Never accept a caller-selected bearer token. This hook runs before the
+     * required-field and permission checks, so every ordinary create gets a
+     * server-minted 256-bit capability and no API input can choose it.
+     */
+    createBy.data.verificationCode = TelegramVerificationToken.mint();
+
     return {
       createBy,
       carryForward: null,
@@ -127,7 +207,7 @@ export class Service extends DatabaseService<Model> {
   }
 
   @CaptureSpan()
-  public async regenerateVerificationCode(itemId: ObjectID): Promise<void> {
+  public async regenerateVerificationCode(itemId: ObjectID): Promise<string> {
     const item: Model | null = await this.findOneById({
       id: itemId,
       props: {
@@ -135,6 +215,9 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         isVerified: true,
+        verificationCode: true,
+        projectId: true,
+        userId: true,
       },
     });
 
@@ -148,15 +231,253 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Telegram account already verified");
     }
 
-    await this.updateOneById({
+    if (
+      !item.projectId ||
+      !item.userId ||
+      !(await this.hasActiveProjectMembership({
+        projectId: item.projectId,
+        userId: item.userId,
+      }))
+    ) {
+      throw new BadDataException("Item not found");
+    }
+
+    const retryAfterSeconds: number =
+      TelegramVerificationToken.getResendRetryAfterSeconds({
+        token: item.verificationCode,
+      });
+
+    if (
+      !TelegramVerificationToken.isExpired({
+        token: item.verificationCode,
+      }) &&
+      retryAfterSeconds > 0
+    ) {
+      throw new TooManyRequestsException(
+        `Please wait ${retryAfterSeconds} seconds before rotating the Telegram verification code.`,
+      );
+    }
+
+    const verificationCode: string = TelegramVerificationToken.mint();
+
+    await this.updateColumnsByIdWithoutHooks({
+      id: itemId,
+      data: {
+        verificationCode,
+      },
+      expectedData: {
+        isVerified: false,
+        ...(item.verificationCode !== undefined
+          ? { verificationCode: item.verificationCode }
+          : {}),
+      },
+    });
+
+    const updatedItem: Model | null = await this.findOneById({
+      id: itemId,
+      props: {
+        isRoot: true,
+      },
+      select: {
+        isVerified: true,
+        verificationCode: true,
+      },
+    });
+
+    if (!updatedItem) {
+      throw new BadDataException(
+        "Item with ID " + itemId.toString() + " not found",
+      );
+    }
+
+    if (updatedItem.isVerified) {
+      throw new BadDataException("Telegram account already verified");
+    }
+
+    if (updatedItem.verificationCode !== verificationCode) {
+      throw new TooManyRequestsException(
+        "The Telegram verification code changed in another request. Please refresh and try again.",
+      );
+    }
+
+    return verificationCode;
+  }
+
+  @CaptureSpan()
+  public async getVerificationCode(itemId: ObjectID): Promise<string> {
+    const item: Model | null = await this.findOneById({
       id: itemId,
       props: {
         isRoot: true,
       },
-      data: {
-        verificationCode: Text.generateRandomNumber(6),
+      select: {
+        isVerified: true,
+        verificationCode: true,
+      },
+    });
+
+    if (!item) {
+      throw new BadDataException("Item not found");
+    }
+
+    if (item.isVerified) {
+      return "";
+    }
+
+    if (
+      TelegramVerificationToken.isValidShape(item.verificationCode) &&
+      !TelegramVerificationToken.isExpired({ token: item.verificationCode })
+    ) {
+      return item.verificationCode;
+    }
+
+    /*
+     * Rows created before this fix hold a six-digit value with no timestamp.
+     * Expired rows also arrive here. Rotate both on the owner's next view so
+     * upgrades fail closed without leaving the user stranded.
+     */
+    return this.regenerateVerificationCode(itemId);
+  }
+
+  @CaptureSpan()
+  public async hasActiveProjectMembership(data: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }): Promise<boolean> {
+    const membership: TeamMember | null = await TeamMemberService.findOneBy({
+      query: {
+        projectId: data.projectId,
+        userId: data.userId,
+        hasAcceptedInvitation: true,
+      },
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return Boolean(membership);
+  }
+
+  @CaptureSpan()
+  public async claimVerificationCode(data: {
+    verificationCode: string;
+    telegramChatId: string;
+  }): Promise<TelegramVerificationResult> {
+    if (!TelegramVerificationToken.isValidShape(data.verificationCode)) {
+      return { outcome: TelegramVerificationOutcome.Invalid };
+    }
+
+    if (
+      TelegramVerificationToken.isExpired({
+        token: data.verificationCode,
+      })
+    ) {
+      return { outcome: TelegramVerificationOutcome.Expired };
+    }
+
+    const item: Model | null = await this.findOneBy({
+      query: {
+        verificationCode: data.verificationCode,
+        isVerified: false,
+      },
+      select: {
+        _id: true,
+        userId: true,
+        projectId: true,
+      },
+      props: {
+        isRoot: true,
       },
     });
+
+    if (!item?.id || !item.projectId || !item.userId) {
+      return { outcome: TelegramVerificationOutcome.Invalid };
+    }
+
+    if (
+      !(await this.hasActiveProjectMembership({
+        projectId: item.projectId,
+        userId: item.userId,
+      }))
+    ) {
+      return { outcome: TelegramVerificationOutcome.Invalid };
+    }
+
+    /*
+     * Compare-and-set is essential here. Two chats can submit one leaked link
+     * at the same time; only the UPDATE whose expected token and unverified
+     * state still match may bind the row. The winner burns the capability in
+     * the same statement, so replay is impossible.
+     */
+    const queryBuilder: UpdateQueryBuilder<Model> = this.getRepository()
+      .createQueryBuilder()
+      .update(Model)
+      .set({
+        isVerified: true,
+        telegramChatId: data.telegramChatId,
+        verificationCode: TelegramVerificationToken.mintUnusableValue(),
+      } as QueryDeepPartialEntity<Model>)
+      .where('"_id" = :itemId', { itemId: item.id.toString() })
+      .andWhere('"isVerified" = :isVerified', { isVerified: false })
+      .andWhere('"verificationCode" = :verificationCode', {
+        verificationCode: data.verificationCode,
+      })
+      .andWhere(
+        `EXISTS (
+          SELECT 1
+          FROM "TeamMember"
+          WHERE "projectId" = :projectId
+            AND "userId" = :userId
+            AND "hasAcceptedInvitation" = TRUE
+            AND "deletedAt" IS NULL
+          FOR KEY SHARE
+        )`,
+        {
+          projectId: item.projectId.toString(),
+          userId: item.userId.toString(),
+        },
+      );
+
+    const updateResult: UpdateResult = await queryBuilder.execute();
+
+    /*
+     * The affected-row result is the only reliable winner signal. Re-reading
+     * the row cannot distinguish the winner from a simultaneous replay by the
+     * same Telegram chat, because both requests observe the same final chat
+     * id. Only the statement that changed the row may trigger follow-up work.
+     */
+    if (updateResult.affected !== 1) {
+      return { outcome: TelegramVerificationOutcome.AlreadyClaimed };
+    }
+
+    const claimedItem: Model | null = await this.findOneById({
+      id: item.id,
+      props: {
+        isRoot: true,
+      },
+      select: {
+        _id: true,
+        userId: true,
+        projectId: true,
+        isVerified: true,
+        telegramChatId: true,
+      },
+    });
+
+    if (
+      !claimedItem?.isVerified ||
+      claimedItem.telegramChatId !== data.telegramChatId
+    ) {
+      return { outcome: TelegramVerificationOutcome.AlreadyClaimed };
+    }
+
+    return {
+      outcome: TelegramVerificationOutcome.Verified,
+      item: claimedItem,
+    };
   }
 }
 

package/Server/Types/Database/QueryHelper.ts

@@ -10,6 +10,8 @@ import { toLikePattern } from "../../../Types/BaseDatabase/WildcardPattern";
 import CaptureSpan from "../../Utils/Telemetry/CaptureSpan";
 import buildJSONColumnQuery, { JSONColumnQuery } from "./JSONColumnQuery";
 
+export type { FindOperator };
+
 export default class QueryHelper {
   @CaptureSpan()
   public static modulo(

package/Server/Utils/APIKey/AccessPermission.ts

@@ -91,9 +91,12 @@ export default class APIKeyAccessPermission {
     projectId: ObjectID,
     apiKeyId: ObjectID,
   ): Promise<UserTenantAccessPermission> {
-    // get team permissions (cached — see ApiKeyPermissionService).
+    // Get only this key's permissions in this project (cached by both ids).
     const apiKeyPermissionRows: Array<ApiKeyPermissionRow> =
-      await ApiKeyPermissionService.findPermissionsByApiKeyId(apiKeyId);
+      await ApiKeyPermissionService.findPermissionsByApiKeyId(
+        apiKeyId,
+        projectId,
+      );
 
     const userPermissions: Array<UserPermission> = apiKeyPermissionRows.map(
       (row: ApiKeyPermissionRow): UserPermission => {

package/Server/Utils/CustomField/CustomFieldDefinitionMappingHooks.ts

@@ -0,0 +1,54 @@
+import ObjectID from "../../../Types/ObjectID";
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import CustomFieldMappingService from "../../Services/CustomFieldMappingService";
+import logger from "../Logger";
+
+/*
+ * The half of the custom-field-definition lifecycle that belongs to value
+ * mapping, factored out so the three definition services that can carry a
+ * mapping (Alert, Incident, Scheduled Maintenance) say the same thing.
+ *
+ * Validation lives next door in CustomFieldMappingValidator and runs in the
+ * before-hooks; this file is only the after-effect: a mapping that was just
+ * created or changed should fill in the records that already exist, not just
+ * the ones created from now on.
+ */
+
+export type BackfillMappedCustomFieldValuesFunction = (data: {
+  definitionModelType: { new (): BaseModel };
+  projectId: ObjectID | undefined;
+  definitionName: string;
+}) => void;
+
+/*
+ * Deliberately NOT awaited, and deliberately not returning a promise.
+ *
+ * A project-wide backfill can touch thousands of rows, and both onCreateSuccess
+ * and onUpdateSuccess are awaited by the write that triggered them — awaiting
+ * this would put the whole sweep inside the settings form's HTTP request and
+ * time it out. This is the same fire-and-forget shape every rule engine in
+ * this codebase uses from onCreateSuccess, and it carries the same
+ * consequence: a backfill lost to a pod restart leaves records holding their
+ * previous values until their source changes again. Because mapping never
+ * clears a value, that is always a stale copy and never a lost one.
+ */
+export const backfillMappedCustomFieldValues: BackfillMappedCustomFieldValuesFunction =
+  (data: {
+    definitionModelType: { new (): BaseModel };
+    projectId: ObjectID | undefined;
+    definitionName: string;
+  }): void => {
+    if (!data.projectId) {
+      return;
+    }
+
+    CustomFieldMappingService.backfillProject({
+      definitionModelType: data.definitionModelType,
+      projectId: data.projectId,
+    }).catch((error: Error) => {
+      logger.error(
+        `Custom field value mapping: backfill after a ${data.definitionName} change failed.`,
+      );
+      logger.error(error);
+    });
+  };