@oneuptime/common 12.0.33 → 12.0.34

package/Server/Utils/EmailRollup/EmailRollupFlushRunner.ts

@@ -5,6 +5,7 @@ import ProjectService from "../../Services/ProjectService";
 import UserEmailService from "../../Services/UserEmailService";
 import UserNotificationEmailRollupBatchService from "../../Services/UserNotificationEmailRollupBatchService";
 import UserNotificationEmailRollupItemService from "../../Services/UserNotificationEmailRollupItemService";
+import UserNotificationSettingService from "../../Services/UserNotificationSettingService";
 import QueryHelper from "../../Types/Database/QueryHelper";
 import PostgresErrorTranslator from "../Database/PostgresErrorTranslator";
 import logger from "../Logger";
@@ -29,6 +30,7 @@ import UserNotificationEmailRollupBatch, {
   RollupBatchStatus,
 } from "../../../Models/DatabaseModels/UserNotificationEmailRollupBatch";
 import UserNotificationEmailRollupItem from "../../../Models/DatabaseModels/UserNotificationEmailRollupItem";
+import UserNotificationSetting from "../../../Models/DatabaseModels/UserNotificationSetting";
 import URL from "../../../Types/API/URL";
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import ColumnLength from "../../../Types/Database/ColumnLength";
@@ -37,6 +39,7 @@ import PartialEntity from "../../../Types/Database/PartialEntity";
 import OneUptimeDate from "../../../Types/Date";
 import Email from "../../../Types/Email";
 import EmailTemplateType from "../../../Types/Email/EmailTemplateType";
+import NotificationSettingEventType from "../../../Types/NotificationSetting/NotificationSettingEventType";
 import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
 import Text from "../../../Types/Text";
@@ -52,8 +55,9 @@ import Text from "../../../Types/Text";
  * WHAT ONE TICK DOES. Find every rollup item that is still pending and old
  * enough to be due, group them by (project, user, address), and for each such
  * bucket send ONE email carrying everything still pending for that address -
- * across every category. Nothing is suppressed and nothing is summarised
- * away; the recipient gets the same information in one message instead of N.
+ * across every category, excluding events the user has since unsubscribed
+ * from. The recipient gets their subscribed updates in one message instead
+ * of N.
  *
  * THE EXACTLY-ONCE ARGUMENT, IN THE ORDER THE LAYERS ACTUALLY MATTER.
  *
@@ -550,6 +554,38 @@ export default class EmailRollupFlushRunner {
       return RollupFlushOutcome.Empty;
     }
 
+    /*
+     * Read current preferences before consuming any queued items. A user may
+     * have turned an event's email off, or removed its setting, while this
+     * batch was waiting. Both mean no email, just as they do on the immediate
+     * send path. If this lookup fails, the items stay pending so a later epoch
+     * can retry instead of discarding them or mailing against unknown choices.
+     */
+    const settings: Array<UserNotificationSetting> =
+      await UserNotificationSettingService.findBy({
+        query: {
+          projectId: bucket.projectId,
+          userId: bucket.userId,
+          alertByEmail: true,
+        },
+        select: {
+          eventType: true,
+        },
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+    const enabledEventTypes: Set<NotificationSettingEventType> =
+      new Set<NotificationSettingEventType>();
+
+    for (const setting of settings) {
+      if (setting.eventType) {
+        enabledEventTypes.add(setting.eventType);
+      }
+    }
+
     const stamped: number =
       await UserNotificationEmailRollupItemService.updateBy({
         query: {
@@ -591,7 +627,7 @@ export default class EmailRollupFlushRunner {
      * READ BACK BY BATCH, never by "still pending for this bucket": this is
      * what guarantees the email describes exactly the rows this attempt owns.
      */
-    const items: Array<UserNotificationEmailRollupItem> =
+    const claimedItems: Array<UserNotificationEmailRollupItem> =
       await UserNotificationEmailRollupItemService.findBy({
         query: {
           rollupBatchId: batchId,
@@ -613,7 +649,7 @@ export default class EmailRollupFlushRunner {
         },
       });
 
-    if (items.length === 0) {
+    if (claimedItems.length === 0) {
       await EmailRollupFlushRunner.finish({
         batchId: batchId,
         status: RollupBatchStatus.Empty,
@@ -623,6 +659,23 @@ export default class EmailRollupFlushRunner {
       return RollupFlushOutcome.Empty;
     }
 
+    const items: Array<UserNotificationEmailRollupItem> = claimedItems.filter(
+      (item: UserNotificationEmailRollupItem): boolean => {
+        return Boolean(item.eventType && enabledEventTypes.has(item.eventType));
+      },
+    );
+
+    if (items.length === 0) {
+      await EmailRollupFlushRunner.finish({
+        batchId: batchId,
+        status: RollupBatchStatus.Skipped,
+        itemCount: 0,
+        now: now,
+        message: "email notifications are no longer enabled for these events",
+      });
+      return RollupFlushOutcome.Skipped;
+    }
+
     /*
      * RE-VALIDATE THE RECIPIENT. The address was snapshotted minutes ago when
      * the first item was queued, and the individual sends this rollup replaces

package/Server/Utils/FrontendEnvironment.ts

@@ -0,0 +1,40 @@
+import { getFrontendEnvVars } from "../EnvironmentConfig";
+import { ExpressRequest, ExpressResponse } from "./Express";
+import Response from "./Response";
+
+export const FRONTEND_ENVIRONMENT_CACHE_CONTROL: string =
+  "private, no-store, no-cache, must-revalidate";
+
+/*
+ * The combined App server and the five standalone frontend servers must emit
+ * exactly the same environment payload. Keeping the serializer here prevents
+ * either route family from growing a second, less restrictive copy.
+ */
+export const getFrontendEnvironmentScript: () => string = (): string => {
+  return `
+if(!window.process){
+  window.process = {}
+}
+
+if(!window.process.env){
+  window.process.env = {}
+}
+window.process.env = ${JSON.stringify(getFrontendEnvVars())};
+`;
+};
+
+/*
+ * Keep the cache policy beside the one serializer used by every frontend. A
+ * pre-remediation env.js may contain a backend exporter credential, so merely
+ * fixing the next response is insufficient if a browser or intermediary is
+ * allowed to retain the old bytes. `private` is defence in depth for shared
+ * caches; `no-store` is the controlling requirement.
+ */
+export const sendFrontendEnvironmentResponse: (
+  req: ExpressRequest,
+  res: ExpressResponse,
+) => void = (req: ExpressRequest, res: ExpressResponse): void => {
+  Response.setNoCacheHeaders(res);
+  res.setHeader("Cache-Control", FRONTEND_ENVIRONMENT_CACHE_CONTROL);
+  Response.sendJavaScriptResponse(req, res, getFrontendEnvironmentScript());
+};

package/Server/Utils/LogRedaction.ts

@@ -139,6 +139,15 @@ const SENSITIVE_EXACT_KEYS: Set<string> = new Set<string>([
   "userhandle",
   "challenge",
   "twofactorsecret",
+  /*
+   * Database drivers attach bind values to QueryFailedError as enumerable
+   * arrays. The values have no reliable self-identifying shape, so the whole
+   * field must be treated as secret rather than logged positionally.
+   */
+  "parameters",
+  "parametervalues",
+  "bindparameters",
+  "bindvalues",
 ]);
 
 export type NormalizeLogKeyFunction = (key: string) => string;
@@ -337,6 +346,16 @@ const STRING_REDACTION_RULES: Array<StringRedactionRule> = [
     regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
     replacement: REDACTED,
   },
+  {
+    /*
+     * Telegram puts the bot credential in the request path rather than a
+     * header. Network clients commonly copy that URL into exception messages,
+     * so structural key redaction cannot see it.
+     */
+    name: "telegram-bot-token-path",
+    regex: /(\/bot)[0-9]{5,}:[A-Za-z0-9_-]{20,}/g,
+    replacement: `$1${REDACTED}`,
+  },
   {
     name: "private-key-block",
     regex:
@@ -377,6 +396,7 @@ const SENSITIVE_TEXT_HINT_REGEX: RegExp = new RegExp(
     "github_pat_",
     "AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA",
     "AIza",
+    "/bot[0-9]{5,}:",
     "-----BEGIN",
     "://",
   ].join("|"),

package/Server/Utils/Logger.ts

@@ -164,6 +164,17 @@ export default class logger {
       }
 
       if (body instanceof Exception || body instanceof Error) {
+        /*
+         * Driver and HTTP errors often carry security-sensitive enumerable
+         * fields (`parameters`, request config, headers) even when their
+         * message and stack are harmless. Preserve the native Error fast path
+         * only for errors with no extra fields; structured errors must pass
+         * through the recursive key-aware redactor before any sink sees them.
+         */
+        if (Object.keys(body).length > 0) {
+          return redactLogValue(body) as LogBody;
+        }
+
         const originalStack: string = body.stack || "";
         const message: string = redactLogString(body.message);
         const stack: string = redactLogString(originalStack);