@oneuptime/common 12.0.33 → 12.0.34

package/Server/Utils/StartServer.ts

@@ -6,7 +6,6 @@ import {
   EncryptionSecretWarning,
   GoogleTagManagerEnabled,
   TrustedProxyHops,
-  getFrontendEnvVars,
 } from "../EnvironmentConfig";
 import LocalCache from "../Infrastructure/LocalCache";
 import HttpMetricsMiddleware from "../Middleware/HttpMetricsMiddleware";
@@ -16,6 +15,7 @@ import CorsOptions, {
   CORS_PREFLIGHT_MAX_AGE_SECONDS,
 } from "./CorsOptions";
 import "./Environment";
+import { sendFrontendEnvironmentResponse } from "./FrontendEnvironment";
 import Express, {
   ExpressApplication,
   ExpressJson,
@@ -373,22 +373,7 @@ const init: InitFunction = async (
       [`/${appName}/env.js`, "/env.js"],
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
-          // ping api server for database config.
-
-          const env: JSONObject = getFrontendEnvVars();
-
-          const script: string = `
-    if(!window.process){
-      window.process = {}
-    }
-
-    if(!window.process.env){
-      window.process.env = {}
-    }
-    window.process.env = ${JSON.stringify(env)};
-  `;
-
-          Response.sendJavaScriptResponse(req, res, script);
+          sendFrontendEnvironmentResponse(req, res);
         } catch (err) {
           return next(err);
         }

package/Server/Utils/TelegramVerificationToken.ts

@@ -0,0 +1,185 @@
+import crypto from "crypto";
+import {
+  RESEND_COOLDOWN_SECONDS,
+  VERIFICATION_CODE_EXPIRY_MINUTES,
+} from "./ChannelVerification";
+
+/*
+ * Telegram's /start payload is a bearer capability: anyone who can guess it
+ * can bind their chat to the pending notification method. A six-digit value
+ * is therefore not appropriate, even with request throttling. This format
+ * carries 256 bits from the operating-system CSPRNG and an authenticated-by-
+ * equality issue timestamp, while staying below Telegram's 64-character
+ * start-parameter limit.
+ *
+ *   8 base36 timestamp characters + "_" + 43 base64url characters = 52
+ *
+ * The whole value is stored on the pending row. Its random portion makes an
+ * offline or online search infeasible; the timestamp gives old links a hard
+ * lifetime without adding schema columns solely for this channel.
+ */
+
+const TOKEN_RANDOM_BYTES: number = 32;
+const TOKEN_TIMESTAMP_LENGTH: number = 8;
+const TOKEN_RANDOM_LENGTH: number = 43;
+const WEBHOOK_SECRET_MIN_LENGTH: number = 32;
+const WEBHOOK_SECRET_MAX_LENGTH: number = 100;
+const WEBHOOK_SECRET_REGEX: RegExp = /^[A-Za-z0-9_-]+$/;
+
+export const TELEGRAM_VERIFICATION_TOKEN_LENGTH: number =
+  TOKEN_TIMESTAMP_LENGTH + 1 + TOKEN_RANDOM_LENGTH;
+
+export const TELEGRAM_VERIFICATION_TOKEN_REGEX: RegExp =
+  /^[0-9a-z]{8}_[A-Za-z0-9_-]{43}$/;
+
+export default class TelegramVerificationToken {
+  public static mint(now: Date = new Date()): string {
+    const issuedAtSeconds: number = Math.floor(now.getTime() / 1000);
+    const encodedIssuedAt: string = issuedAtSeconds
+      .toString(36)
+      .padStart(TOKEN_TIMESTAMP_LENGTH, "0");
+
+    if (encodedIssuedAt.length !== TOKEN_TIMESTAMP_LENGTH) {
+      throw new Error("Telegram verification timestamp is out of range");
+    }
+
+    const randomValue: string = crypto
+      .randomBytes(TOKEN_RANDOM_BYTES)
+      .toString("base64url");
+
+    return `${encodedIssuedAt}_${randomValue}`;
+  }
+
+  public static isValidShape(token: unknown): token is string {
+    return (
+      typeof token === "string" &&
+      token.length === TELEGRAM_VERIFICATION_TOKEN_LENGTH &&
+      TELEGRAM_VERIFICATION_TOKEN_REGEX.test(token)
+    );
+  }
+
+  public static getIssuedAt(token: unknown): Date | null {
+    if (!TelegramVerificationToken.isValidShape(token)) {
+      return null;
+    }
+
+    const encodedIssuedAt: string = token.slice(0, TOKEN_TIMESTAMP_LENGTH);
+    const issuedAtSeconds: number = parseInt(encodedIssuedAt, 36);
+
+    if (!Number.isSafeInteger(issuedAtSeconds) || issuedAtSeconds <= 0) {
+      return null;
+    }
+
+    return new Date(issuedAtSeconds * 1000);
+  }
+
+  public static isExpired(data: {
+    token: unknown;
+    now?: Date | undefined;
+  }): boolean {
+    const issuedAt: Date | null = TelegramVerificationToken.getIssuedAt(
+      data.token,
+    );
+
+    if (!issuedAt) {
+      return true;
+    }
+
+    const now: Date = data.now || new Date();
+
+    /*
+     * A timestamp from the future is malformed or the result of clock skew in
+     * the unsafe direction. Refuse it instead of extending the token's life.
+     */
+    if (issuedAt.getTime() > now.getTime()) {
+      return true;
+    }
+
+    return (
+      now.getTime() - issuedAt.getTime() >=
+      VERIFICATION_CODE_EXPIRY_MINUTES * 60 * 1000
+    );
+  }
+
+  public static getResendRetryAfterSeconds(data: {
+    token: unknown;
+    now?: Date | undefined;
+  }): number {
+    const issuedAt: Date | null = TelegramVerificationToken.getIssuedAt(
+      data.token,
+    );
+
+    if (!issuedAt) {
+      return 0;
+    }
+
+    const now: Date = data.now || new Date();
+    const elapsedSeconds: number = (now.getTime() - issuedAt.getTime()) / 1000;
+
+    if (elapsedSeconds < 0) {
+      return RESEND_COOLDOWN_SECONDS;
+    }
+
+    if (elapsedSeconds >= RESEND_COOLDOWN_SECONDS) {
+      return 0;
+    }
+
+    return Math.max(1, Math.ceil(RESEND_COOLDOWN_SECONDS - elapsedSeconds));
+  }
+
+  /*
+   * A non-reversible, fixed-size Redis key segment that never discloses the
+   * live bearer token in operational tooling.
+   */
+  public static getRateLimitKey(token: string): string {
+    return crypto.createHash("sha256").update(token, "utf8").digest("hex");
+  }
+
+  /*
+   * Burn a token after use. This deliberately does not match the live-token
+   * grammar, so no time or random value can make it acceptable again.
+   */
+  public static mintUnusableValue(): string {
+    return crypto.randomBytes(TOKEN_RANDOM_BYTES).toString("hex");
+  }
+
+  public static isWebhookSecretStrong(secret: unknown): secret is string {
+    if (typeof secret !== "string") {
+      return false;
+    }
+
+    const normalizedSecret: string = secret.trim();
+
+    return (
+      normalizedSecret.length >= WEBHOOK_SECRET_MIN_LENGTH &&
+      normalizedSecret.length <= WEBHOOK_SECRET_MAX_LENGTH &&
+      WEBHOOK_SECRET_REGEX.test(normalizedSecret)
+    );
+  }
+
+  /*
+   * Fail closed when the administrator did not configure a Telegram webhook
+   * secret. Comparing equal-length values with timingSafeEqual avoids turning
+   * the header check into a prefix oracle.
+   */
+  public static isWebhookSecretValid(data: {
+    configuredSecret: string | null | undefined;
+    providedSecret: string | null | undefined;
+  }): boolean {
+    const configuredSecret: string = data.configuredSecret?.trim() || "";
+    const providedSecret: string = data.providedSecret || "";
+
+    if (!configuredSecret || !providedSecret) {
+      return false;
+    }
+
+    const configuredBuffer: Buffer = Buffer.from(configuredSecret, "utf8");
+    const providedBuffer: Buffer = Buffer.from(providedSecret, "utf8");
+
+    if (configuredBuffer.length !== providedBuffer.length) {
+      return false;
+    }
+
+    return crypto.timingSafeEqual(configuredBuffer, providedBuffer);
+  }
+}

package/Server/Utils/Telemetry/PinServiceName.ts

@@ -0,0 +1,197 @@
+import { JSONObject, JSONValue } from "../../../Types/JSON";
+
+/*
+ * Every top-level OTLP container that carries a `resource` block. Each is an
+ * array of { resource, scopeSpans|scopeLogs|scopeMetrics|scopeProfiles }
+ * envelopes.
+ *
+ * Profiles are in the list even though a Browser ingestion key cannot reach
+ * the profiles surface at all (see BROWSER_ALLOWED_INGEST_SURFACES). Pinning
+ * is not a browser-only feature: a Server key may set a pinned service name
+ * too, and the dashboard field promises it applies to "everything the key
+ * writes". Leaving one signal out would make that promise false in exactly
+ * the quiet way nobody notices until they are reading a chart. The
+ * containment argument for browser keys is unaffected either way.
+ */
+const RESOURCE_CONTAINER_KEYS: ReadonlyArray<string> = [
+  "resourceSpans",
+  "resourceLogs",
+  "resourceMetrics",
+  "resourceProfiles",
+];
+
+const SERVICE_NAME_ATTRIBUTE_KEY: string = "service.name";
+
+/*
+ * Rewrites `service.name` on every OTLP resource in a payload so telemetry
+ * written with a given ingestion key can only ever land under the service that
+ * key is pinned to.
+ *
+ * WHY THIS EXISTS: a Browser ingestion key is published in page source by
+ * design - that is the whole point of the key class - so it must be assumed
+ * scraped. Rate limits and the origin allowlist bound HOW MUCH forged data an
+ * attacker can write and FROM WHERE, but neither stops them writing it under
+ * `service.name: "payments-api"` and poisoning the dashboards, SLOs and alert
+ * rules of a backend service that never emitted a byte of it. Pinning is the
+ * control that makes the forged data self-identifying: it can only ever appear
+ * as the browser service the customer named.
+ *
+ * WHY IT MUTATES IN PLACE: this runs on the ingest path over payloads that are
+ * routinely megabytes of spans. Deep-cloning them to return a rewritten copy
+ * would double peak heap on the hot path for no benefit - the caller owns the
+ * body and has no use for the original.
+ *
+ * WHY NOTHING IN HERE THROWS: the input is attacker-controlled JSON that has
+ * NOT been validated against the OTLP schema at this point, and this runs
+ * inside a queue worker. A TypeError on a hostile shape would fail the whole
+ * batch (and, worse, would be trivially reachable by anyone holding a scraped
+ * key). Every shape check below therefore skips or repairs rather than raises.
+ */
+export default class PinServiceName {
+  /*
+   * Pin `serviceName` onto every resource block in `body`, in place.
+   *
+   * Returns the number of resource blocks rewritten, which the caller can log
+   * or use to tell "we pinned nothing because the payload was empty" apart
+   * from "we pinned nothing because the payload was malformed".
+   */
+  public static pinInPlace(body: JSONObject, serviceName: string): number {
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return 0;
+    }
+
+    /*
+     * An empty pin would stamp `service.name: ""` on everything, which is
+     * strictly worse than not pinning: it destroys the customer's own service
+     * attribution AND gives the attacker's data a shape indistinguishable
+     * from it. Refuse to do that; the caller's policy layer is responsible for
+     * not configuring a blank pin in the first place.
+     */
+    const pinnedServiceName: string =
+      typeof serviceName === "string" ? serviceName.trim() : "";
+
+    if (!pinnedServiceName) {
+      return 0;
+    }
+
+    let rewrittenCount: number = 0;
+
+    for (const containerKey of RESOURCE_CONTAINER_KEYS) {
+      const container: JSONValue | undefined = body[containerKey];
+
+      if (!Array.isArray(container)) {
+        continue;
+      }
+
+      for (const resourceBlock of container) {
+        if (this.pinResourceBlock(resourceBlock, pinnedServiceName)) {
+          rewrittenCount++;
+        }
+      }
+    }
+
+    return rewrittenCount;
+  }
+
+  /*
+   * Pin one { resource, scope* } envelope. Returns whether it was rewritten.
+   *
+   * A malformed `resource` or `attributes` is REPLACED rather than skipped.
+   * That looks aggressive, but consider the alternative: a forged payload that
+   * sends `"resource": "not-an-object"` would then pass through unpinned, and
+   * the downstream decoder - which reads `resource?.attributes` defensively -
+   * would happily ingest it with whatever service attribution it falls back
+   * to. Skipping would hand the attacker a one-character bypass of the entire
+   * control. The only thing we cannot repair is an envelope that is not an
+   * object at all, because there is nowhere to write.
+   */
+  private static pinResourceBlock(
+    resourceBlock: JSONValue | undefined,
+    serviceName: string,
+  ): boolean {
+    if (
+      !resourceBlock ||
+      typeof resourceBlock !== "object" ||
+      Array.isArray(resourceBlock)
+    ) {
+      return false;
+    }
+
+    const block: JSONObject = resourceBlock as JSONObject;
+
+    const existingResource: JSONValue | undefined = block["resource"];
+
+    let resource: JSONObject;
+
+    if (
+      existingResource &&
+      typeof existingResource === "object" &&
+      !Array.isArray(existingResource)
+    ) {
+      resource = existingResource as JSONObject;
+    } else {
+      resource = {};
+      block["resource"] = resource;
+    }
+
+    const existingAttributes: JSONValue | undefined = resource["attributes"];
+
+    const attributes: Array<JSONValue> = [];
+
+    if (Array.isArray(existingAttributes)) {
+      for (const attribute of existingAttributes) {
+        /*
+         * Keep every attribute that is not a service.name in its original
+         * relative order, including entries we cannot parse - dropping those
+         * would be an unrelated, invisible edit to the customer's data.
+         */
+        if (!this.isServiceNameAttribute(attribute)) {
+          attributes.push(attribute as JSONValue);
+        }
+      }
+    }
+
+    /*
+     * Appended last, and exactly once, so there is no ambiguity for a
+     * consumer that takes either the first or the last match.
+     */
+    attributes.push({
+      key: SERVICE_NAME_ATTRIBUTE_KEY,
+      value: {
+        stringValue: serviceName,
+      },
+    } as JSONValue);
+
+    resource["attributes"] = attributes as JSONValue;
+
+    return true;
+  }
+
+  /*
+   * Matched case-insensitively and after trimming, which is deliberately
+   * looser than the OTLP spec (attribute keys are case-sensitive there).
+   *
+   * Rationale: the ONLY consequence of over-matching here is that an exotic
+   * key like "Service.Name" gets dropped, and no consumer in this codebase
+   * reads that. The consequence of under-matching is a bypass, if any
+   * consumer anywhere - now or later, ours or a customer's export - folds
+   * case before looking up the service. Defence in depth wins that trade.
+   */
+  private static isServiceNameAttribute(attribute: JSONValue): boolean {
+    if (
+      !attribute ||
+      typeof attribute !== "object" ||
+      Array.isArray(attribute)
+    ) {
+      return false;
+    }
+
+    const key: JSONValue | undefined = (attribute as JSONObject)["key"];
+
+    if (typeof key !== "string") {
+      return false;
+    }
+
+    return key.trim().toLowerCase() === SERVICE_NAME_ATTRIBUTE_KEY;
+  }
+}

package/Server/Utils/Telemetry/TelemetryFanInWriter.ts

@@ -125,7 +125,10 @@ export interface FanInWriterOptions {
   maxWaitMs: number;
   /** Per-pod cap on concurrent ClickHouse inserts across all tables. */
   maxConcurrentInserts: number;
-  /** High-water mark of buffered+in-flight rows; submit() blocks above it. */
+  /**
+   * High-water mark of reserved+buffered+in-flight rows. A whole submission
+   * may cross it once; later submit() calls wait for capacity to be released.
+   */
   maxPendingRows: number;
   retryMaxAttempts: number;
   retryBaseDelayMs: number;
@@ -197,6 +200,11 @@ type TableBuffer = {
   timer: NodeJS.Timeout | null;
 };
 
+type CapacityWaiter = {
+  rowCount: number;
+  resolve: () => void;
+};
+
 /*
  * ClickHouse server error codes that indicate transient overload or an
  * ambiguous outcome. All are safe to retry here because every insert
@@ -328,7 +336,7 @@ export class TelemetryFanInWriter {
   private options: FanInWriterOptions;
   private buffers: Map<string, TableBuffer> = new Map();
   private pendingRows: number = 0;
-  private capacityWaiters: Array<() => void> = [];
+  private capacityWaiters: Set<CapacityWaiter> = new Set();
   private activeInserts: number = 0;
   private insertSlotWaiters: Array<() => void> = [];
   private inFlightDispatches: Set<Promise<void>> = new Set();
@@ -428,7 +436,7 @@ export class TelemetryFanInWriter {
 
     this.acceptingSubmits++;
     try {
-      await this.waitForCapacity();
+      await this.waitForCapacity(rows.length);
 
       let buffer: TableBuffer | undefined = this.buffers.get(tableName);
       if (!buffer) {
@@ -458,7 +466,6 @@ export class TelemetryFanInWriter {
         rejectAck,
       });
       buffer.rowCount += rows.length;
-      this.pendingRows += rows.length;
 
       if (buffer.rowCount >= this.getMaxBatchRows(tableName)) {
         this.cutAndDispatch(tableName, false);
@@ -532,24 +539,39 @@ export class TelemetryFanInWriter {
     );
   }
 
-  private async waitForCapacity(): Promise<void> {
-    while (this.pendingRows >= this.options.maxPendingRows) {
-      await new Promise<void>((resolve: () => void) => {
-        this.capacityWaiters.push(resolve);
-      });
+  private async waitForCapacity(rowCount: number): Promise<void> {
+    /*
+     * Reserve before yielding: concurrent submitters otherwise all observe
+     * the same available capacity and buffer their rows after the await,
+     * multiplying the memory limit by the number of submitters. Keep whole
+     * submissions intact: one submission may cross the high-water mark,
+     * but every later submission waits until pending rows fall below it.
+     */
+    if (this.pendingRows < this.options.maxPendingRows) {
+      this.pendingRows += rowCount;
+      return;
     }
+
+    await new Promise<void>((resolve: () => void) => {
+      this.capacityWaiters.add({ rowCount, resolve });
+    });
   }
 
   private releaseCapacity(): void {
     /*
-     * Wake all waiters; each re-checks the high-water mark in its
-     * waitForCapacity loop, so overshoot stays bounded to one submission
-     * per waiter.
+     * Transfer capacity to FIFO waiters before waking them. Only admitted
+     * callers resume, so completing an insert does not wake the entire
+     * backlog to compete for the same capacity again.
+     * Set keeps FIFO order and releases each waiter without shifting the
+     * remaining queue or retaining consumed entries.
      */
-    const waiters: Array<() => void> = this.capacityWaiters;
-    this.capacityWaiters = [];
-    for (const wake of waiters) {
-      wake();
+    for (const waiter of this.capacityWaiters) {
+      if (this.pendingRows >= this.options.maxPendingRows) {
+        break;
+      }
+      this.pendingRows += waiter.rowCount;
+      this.capacityWaiters.delete(waiter);
+      waiter.resolve();
     }
   }
 

package/Server/Utils/Telemetry/TelemetryIngestionKeyGuard.ts

@@ -0,0 +1,92 @@
+import TelemetryIngestionKeyPolicy from "../../../Types/Telemetry/TelemetryIngestionKeyPolicy";
+import TelemetryIngestionKeyType from "../../../Types/Telemetry/TelemetryIngestionKeyType";
+import TelemetryIngestSurface, {
+  BROWSER_ALLOWED_INGEST_SURFACES,
+  getIngestSurfaceReadableName,
+} from "../../../Types/Telemetry/TelemetryIngestSurface";
+
+/*
+ * The three key-state checks that every ingest entry point has to make, in
+ * one place.
+ *
+ * TelemetryIngest (the Express middleware) runs these inline as part of a
+ * longer chain that also covers the Origin allowlist and the per-key rate
+ * limit, neither of which means anything off HTTP. Everything else that
+ * accepts a TelemetryIngestionKey - the gRPC OTLP server, the MQTT broker,
+ * and the two key-validation probes - is NOT an Express route and cannot use
+ * that middleware, yet must answer these same three questions or a disabled
+ * key keeps working on the pipe nobody remembered to update.
+ *
+ * The refusal SENTENCES are deliberately identical to the middleware's, so a
+ * customer who moves the same key between HTTP, gRPC and MQTT reads the same
+ * explanation each time rather than three differently-worded versions of one
+ * problem. If you change wording here, change it there too.
+ *
+ * What this deliberately does NOT do is decide the transport-level response.
+ * A refusal is a status code on HTTP, a CONNACK return code on MQTT, and a
+ * silent success on gRPC (see GrpcServer for why); each caller owns that
+ * translation because each transport's retry semantics are its own.
+ */
+export enum TelemetryIngestionKeyRefusalReason {
+  Disabled = "disabled",
+  Expired = "expired",
+  SurfaceNotAllowedForBrowserKey = "surface-not-allowed-for-browser-key",
+}
+
+export interface TelemetryIngestionKeyRefusal {
+  reason: TelemetryIngestionKeyRefusalReason;
+
+  /*
+   * Safe to return to whoever presented the key. It names the problem and
+   * never the key, the project, the allowlist or the expiry timestamp - a
+   * caller holding a dead credential is not entitled to a project's
+   * configuration.
+   */
+  message: string;
+}
+
+export default class TelemetryIngestionKeyGuard {
+  /**
+   * Why this key may not write to this surface, or null when it may.
+   *
+   * Order matters and mirrors the middleware: the kill switch is checked
+   * first so that switching a leaked key off is the one action guaranteed to
+   * stop it whatever else is true of the key, then expiry, then the
+   * browser-key surface rule.
+   */
+  public static getRefusal(data: {
+    policy: TelemetryIngestionKeyPolicy;
+    surface: TelemetryIngestSurface;
+  }): TelemetryIngestionKeyRefusal | null {
+    const policy: TelemetryIngestionKeyPolicy = data.policy;
+
+    if (policy.isEnabled === false) {
+      return {
+        reason: TelemetryIngestionKeyRefusalReason.Disabled,
+        message: "This telemetry ingestion key has been disabled.",
+      };
+    }
+
+    if (policy.expiresAt && policy.expiresAt.getTime() <= Date.now()) {
+      return {
+        reason: TelemetryIngestionKeyRefusalReason.Expired,
+        message: "This telemetry ingestion key expired.",
+      };
+    }
+
+    if (
+      policy.keyType === TelemetryIngestionKeyType.Browser &&
+      !BROWSER_ALLOWED_INGEST_SURFACES.has(data.surface)
+    ) {
+      return {
+        reason:
+          TelemetryIngestionKeyRefusalReason.SurfaceNotAllowedForBrowserKey,
+        message: `A browser ingestion key cannot be used for ${getIngestSurfaceReadableName(
+          data.surface,
+        )}. Use a server ingestion key.`,
+      };
+    }
+
+    return null;
+  }
+}