@oneuptime/common 12.0.33 → 13.0.0

package/Server/Services/DatabaseService.ts

@@ -46,6 +46,7 @@ import Protocol from "../../Types/API/Protocol";
 import Route from "../../Types/API/Route";
 import URL from "../../Types/API/URL";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import Sort from "../../Types/BaseDatabase/Sort";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import { getMaxLengthFromTableColumnType } from "../../Types/Database/ColumnLength";
 import Columns from "../../Types/Database/Columns";
@@ -1636,12 +1637,28 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * A query builder scoped to exactly the rows this read may see, and — this
    * is the whole point — scoped so that each of them appears ONCE.
    *
-   * The permission pipeline expresses a label-scoped read as a condition on
-   * the access-control RELATION: `{ labels: [permittedIds] }` for an allow
-   * permission, `{ labels: { _id: NotIn([...]) } }` for a block. Handed to
-   * TypeORM's FindOptions machinery those become a join through the
-   * many-to-many junction table — and a join multiplies rows. A device
-   * carrying two permitted labels comes back twice.
+   * The permission pipeline expresses a label-scoped ALLOW as a condition on
+   * the access-control RELATION — `{ labels: [permittedIds] }`, which
+   * QueryUtil.serializeQuery then nests into `{ labels: { _id: <a set
+   * membership operator> } }`. Handed to TypeORM's FindOptions machinery that
+   * becomes a join through the many-to-many junction table — and a join
+   * multiplies rows. A device carrying two permitted labels comes back twice.
+   *
+   * A label BLOCK no longer takes that route, and it is worth being precise
+   * about why, because the shape reads like the allow half's mirror image and
+   * is not. A relation condition cannot express "has NONE of these labels" at
+   * all: a device labelled {blocked, other} still matches the join through its
+   * "other" row. So ReadPermission writes the block as a flat predicate on the
+   * owner's own id instead — `_id NOT IN (SELECT ownerId FROM the junction
+   * table WHERE labelId IN (...))`. Flat means no join, which means no
+   * duplicate rows, which means the block half needs nothing from this method
+   * beyond the cheap path below.
+   *
+   * The allow half is not the only producer of relation-keyed conditions
+   * either. `@CanAccessIfCanReadOn` makes BasePermission write
+   * `query[relation] = { <the related model's access-control column>: ids }`
+   * for StatusPageResource, IncidentInternalNote, AlertEpisodeMember and
+   * others, and that arrives here indistinguishable from a label allow.
    *
    * `findBy` never notices, because entity hydration de-duplicates by primary
    * key on the way out. An aggregate has no such step: COUNT(*) would report
@@ -1656,9 +1673,10 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
    * by a DISTINCT subquery of ids. The joins live inside that subquery, where
    * duplicate rows collapse before anything is added up.
    *
-   * The subquery is skipped when the query is flat — which is every read by a
-   * user whose permissions are not label-scoped, i.e. the hot path — so the
-   * ordinary full-fleet aggregate stays a single sequential scan.
+   * The subquery is skipped when the query is flat — every read by a user with
+   * no label-scoped allow grant and no `@CanAccessIfCanReadOn` relation, which
+   * is the hot path, and the block half above with it — so the ordinary
+   * full-fleet aggregate stays a single sequential scan.
    */
   private buildAggregateScope(
     query: Query<TBaseModel>,
@@ -1698,10 +1716,14 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       `"${this.modelName}"."_id" IN (${scopeBuilder.getQuery()})`,
     );
     /*
-     * The subquery's own bound values. Its placeholders are auto-named
-     * (`orm_param_N`) and the outer builder generates none of its own here —
-     * its only WHERE is the raw string above — so there is nothing to clash
-     * with. Caller-supplied parameters are named and applied later.
+     * The subquery's own bound values, copied across under whatever names they
+     * already carry. Two naming schemes reach this line: TypeORM auto-names
+     * the parameters it creates itself (`orm_param_N`), but a label predicate
+     * arrives as a `Raw` operator carrying its own object-literal parameters,
+     * and TypeORM registers those verbatim — QueryHelper names them with ten
+     * random characters apiece. Neither can clash with the outer builder,
+     * which generates no parameters of its own here: its only WHERE is the raw
+     * string above. Caller-supplied parameters are named and applied later.
      */
     queryBuilder.setParameters(scopeBuilder.getParameters());
 
@@ -2149,6 +2171,36 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         throw new BadDataException("GroupBy is currently not supported");
       }
 
+      /*
+       * Complete the caller's sort into a TOTAL order.
+       *
+       * Everything here pages with LIMIT/OFFSET, and OFFSET only means
+       * anything against an ordering that has no ties: rows that compare
+       * equal may come back in any order, and Postgres is free to return them
+       * differently for the two queries that fetch page 1 and page 2. A tied
+       * row can therefore be served on both pages while another is served on
+       * neither — the same row apparently listed twice.
+       *
+       * Ties are not exotic. The Inventory list sorts on `lastSeenAt`, which
+       * the entity reconciler rewrites for every live entity every few
+       * minutes, and the inventory mirror stamps one identical timestamp
+       * across a whole page of rows; "created at" sorts tie for anything
+       * bulk-inserted in one statement. Appending the primary key breaks
+       * every tie deterministically and costs nothing — `_id` is the PK, and
+       * it is already in the select (see above), so this adds no column to
+       * the projection and nothing to strip afterwards.
+       */
+      const sortSoFar: Dictionary<SortOrder> =
+        (onBeforeFind.sort as Dictionary<SortOrder> | undefined) || {};
+
+      if (!sortSoFar["_id"]) {
+        // Copied, never mutated: callers reuse their sort objects across queries.
+        onBeforeFind.sort = {
+          ...sortSoFar,
+          _id: SortOrder.Ascending,
+        } as Sort<TBaseModel>;
+      }
+
       const items: Array<TBaseModel> = await this.getRepository().find({
         skip: onBeforeFind.skip.toNumber(),
         take: onBeforeFind.limit.toNumber(),

package/Server/Services/GlobalConfigService.ts

@@ -6,6 +6,26 @@ import { OnUpdate } from "../Types/Database/Hooks";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import UpdateBy from "../Types/Database/UpdateBy";
 import BadDataException from "../../Types/Exception/BadDataException";
+import TelegramVerificationToken from "../Utils/TelegramVerificationToken";
+import GlobalCache from "../Infrastructure/GlobalCache";
+
+const TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE: string =
+  "global-config-security";
+const TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY: string =
+  "telegram-webhook-secret-generation";
+const TELEGRAM_WEBHOOK_SECRET_INITIAL_GENERATION: string = "initial";
+const TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE: string = "__not_configured__";
+const TELEGRAM_WEBHOOK_SECRET_CACHE_TTL_SECONDS: number = 5;
+
+interface TelegramWebhookSecretTokenLoadResult {
+  value: string | undefined;
+  isCurrentGeneration: boolean;
+}
+
+interface TelegramWebhookSecretTokenLoad {
+  generation: string;
+  promise: Promise<TelegramWebhookSecretTokenLoadResult>;
+}
 
 export class Service extends DatabaseService<Model> {
   /*
@@ -15,6 +35,15 @@ export class Service extends DatabaseService<Model> {
    */
   private requireSsoForLoginCache: InMemoryTTLCache<boolean> =
     new InMemoryTTLCache(10_000);
+  /*
+   * The public Telegram webhook is hit without a OneUptime session. The value
+   * cache lives in Redis so every app replica observes the same generation.
+   * Only the in-flight promise is process-local: it collapses a cache-miss
+   * burst to one Postgres read per replica without retaining a retired secret.
+   */
+  private telegramWebhookSecretTokenLoad:
+    | TelegramWebhookSecretTokenLoad
+    | undefined = undefined;
 
   public constructor() {
     super(Model);
@@ -43,10 +72,168 @@ export class Service extends DatabaseService<Model> {
     return value;
   }
 
+  @CaptureSpan()
+  public async getTelegramWebhookSecretToken(): Promise<string | undefined> {
+    while (true) {
+      const generation: string =
+        await this.getTelegramWebhookSecretTokenGeneration();
+      const cacheKey: string =
+        this.getTelegramWebhookSecretTokenCacheKey(generation);
+      const cached: string | null = await GlobalCache.getString(
+        TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+        cacheKey,
+      );
+
+      if (cached !== null) {
+        return cached === TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE
+          ? undefined
+          : cached;
+      }
+
+      const existingLoad: TelegramWebhookSecretTokenLoad | undefined =
+        this.telegramWebhookSecretTokenLoad;
+
+      /*
+       * Cache expiry is visible to every public webhook request at once. Share
+       * the database read for that generation so a burst cannot turn one
+       * expiry into one root Postgres query per request.
+       */
+      const load: TelegramWebhookSecretTokenLoad =
+        existingLoad?.generation === generation
+          ? existingLoad
+          : {
+              generation,
+              promise: this.loadTelegramWebhookSecretToken(
+                generation,
+                cacheKey,
+              ),
+            };
+
+      if (load !== existingLoad) {
+        this.telegramWebhookSecretTokenLoad = load;
+      }
+
+      try {
+        const result: TelegramWebhookSecretTokenLoadResult = await load.promise;
+
+        /*
+         * A rotation that completed during the database read makes the result
+         * unreachable through the new generation key. Loop so this request
+         * also joins the new generation instead of authenticating with the
+         * value that was retired while it waited.
+         */
+        if (result.isCurrentGeneration) {
+          return result.value;
+        }
+      } finally {
+        /*
+         * An invalidation can start a newer-generation load while this one is
+         * still pending. The older promise must not clear that newer flight.
+         */
+        if (this.telegramWebhookSecretTokenLoad === load) {
+          this.telegramWebhookSecretTokenLoad = undefined;
+        }
+      }
+    }
+  }
+
+  private async getTelegramWebhookSecretTokenGeneration(): Promise<string> {
+    return (
+      (await GlobalCache.getString(
+        TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+        TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY,
+      )) || TELEGRAM_WEBHOOK_SECRET_INITIAL_GENERATION
+    );
+  }
+
+  private getTelegramWebhookSecretTokenCacheKey(generation: string): string {
+    return `telegram-webhook-secret:${generation}`;
+  }
+
+  private async loadTelegramWebhookSecretToken(
+    generation: string,
+    cacheKey: string,
+  ): Promise<TelegramWebhookSecretTokenLoadResult> {
+    const config: Model | null = await this.findOneBy({
+      query: {
+        _id: ObjectID.getZeroObjectID().toString(),
+      },
+      select: {
+        telegramWebhookSecretToken: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+    const value: string | undefined =
+      config?.telegramWebhookSecretToken?.trim() || undefined;
+
+    /*
+     * A read begun before a rotation may return after the update has committed.
+     * Check the shared generation before populating Redis; an old replica can
+     * still finish its query, but it cannot republish the retired value under
+     * the generation every other replica now reads.
+     */
+    if (generation !== (await this.getTelegramWebhookSecretTokenGeneration())) {
+      return {
+        value: undefined,
+        isCurrentGeneration: false,
+      };
+    }
+
+    await GlobalCache.setString(
+      TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+      cacheKey,
+      value || TELEGRAM_WEBHOOK_SECRET_MISSING_VALUE,
+      { expiresInSeconds: TELEGRAM_WEBHOOK_SECRET_CACHE_TTL_SECONDS },
+    );
+
+    return {
+      value,
+      isCurrentGeneration:
+        generation === (await this.getTelegramWebhookSecretTokenGeneration()),
+    };
+  }
+
+  private async rotateTelegramWebhookSecretTokenGeneration(): Promise<void> {
+    await GlobalCache.setString(
+      TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE,
+      TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY,
+      ObjectID.generate().toString(),
+    );
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.telegramWebhookSecretToken !== undefined) {
+      const secret: unknown = updateBy.data.telegramWebhookSecretToken;
+
+      if (
+        secret !== null &&
+        secret !== "" &&
+        !TelegramVerificationToken.isWebhookSecretStrong(secret)
+      ) {
+        throw new BadDataException(
+          "Telegram webhook secret token must be 32-100 characters and contain only letters, numbers, underscores, or hyphens.",
+        );
+      }
+
+      if (typeof secret === "string") {
+        updateBy.data.telegramWebhookSecretToken = secret.trim();
+      }
+
+      /*
+       * Move every replica to a fresh shared generation before the write. A
+       * request during the transaction may still read the currently committed
+       * secret, but it cannot repopulate the generation used before rotation.
+       * The success hook rotates once more after commit. If the write fails,
+       * this generation simply continues to cache the still-valid old value.
+       */
+      await this.rotateTelegramWebhookSecretTokenGeneration();
+    }
+
     const capacitySettingKeys: Array<keyof Model> = [
       "clickhouseCapacityNotificationEnabled",
       "clickhouseCapacityNotificationThresholdPercent",
@@ -201,6 +388,13 @@ export class Service extends DatabaseService<Model> {
       this.requireSsoForLoginCache.clear();
     }
 
+    if (
+      (onUpdate.updateBy.data as { telegramWebhookSecretToken?: unknown })
+        .telegramWebhookSecretToken !== undefined
+    ) {
+      await this.rotateTelegramWebhookSecretTokenGeneration();
+    }
+
     return onUpdate;
   }
 }

package/Server/Services/IncidentCustomFieldService.ts

@@ -1,9 +1,107 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/IncidentCustomField";
+import ObjectID from "../../Types/ObjectID";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { backfillMappedCustomFieldValues } from "../Utils/CustomField/CustomFieldDefinitionMappingHooks";
+import {
+  validateCustomFieldMappingOnCreate,
+  validateCustomFieldMappingOnUpdate,
+} from "../Utils/CustomField/CustomFieldMappingValidator";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * An incident custom field can take its value from the same field on the
+ * incident's monitors instead of being typed in again
+ * (OneUptime/oneuptime#3549). These hooks are the two halves of that
+ * configuration being saved: refusing a mapping that could never resolve, and
+ * filling in the incidents that already exist once one is saved.
+ */
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    await validateCustomFieldMappingOnCreate({
+      definitionModelType: Model,
+      createBy: createBy,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    await validateCustomFieldMappingOnUpdate({
+      definitionModelType: Model,
+      definitionService: this,
+      updateBy: updateBy,
+    });
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    backfillMappedCustomFieldValues({
+      definitionModelType: Model,
+      projectId: createdItem.projectId,
+      definitionName: "incident custom field",
+    });
+
+    return createdItem;
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    if (updatedItemIds.length > 0) {
+      backfillMappedCustomFieldValues({
+        definitionModelType: Model,
+        projectId: await this.getProjectIdForBackfill(onUpdate, updatedItemIds),
+        definitionName: "incident custom field",
+      });
+    }
+
+    return onUpdate;
+  }
+
+  /*
+   * `props.tenantId` is set on every dashboard write but not on internal
+   * root-scoped ones, so fall back to the row itself rather than skipping the
+   * backfill for a mapping that was changed by a script.
+   */
+  private async getProjectIdForBackfill(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<ObjectID | undefined> {
+    const tenantId: ObjectID | undefined = onUpdate.updateBy.props.tenantId as
+      | ObjectID
+      | undefined;
+
+    if (tenantId) {
+      return tenantId;
+    }
+
+    const item: Model | null = await this.findOneById({
+      id: updatedItemIds[0]!,
+      select: { projectId: true },
+      props: { isRoot: true },
+    });
+
+    return item?.projectId;
+  }
 }
 export default new Service();

package/Server/Services/IncidentService.ts

@@ -8,6 +8,8 @@ import FindBy from "../Types/Database/FindBy";
 import { OnCreate, OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
 import DatabaseService from "./DatabaseService";
+import IncidentCustomField from "../../Models/DatabaseModels/IncidentCustomField";
+import CustomFieldMappingService from "./CustomFieldMappingService";
 import AIRunService from "./AIRunService";
 import AIRunType from "../../Types/AI/AIRunType";
 import AIRunStatus from "../../Types/AI/AIRunStatus";
@@ -556,6 +558,18 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * Re-apply mapped custom field values. Covers the Custom Fields modal
+     * saving the whole bag back over a mapped value, and the incident's
+     * monitors being added or removed — both change what a mapped field should
+     * hold, and folding the answer into this payload keeps it one write with a
+     * truthful audit entry.
+     */
+    await CustomFieldMappingService.applyMappingsToUpdate({
+      definitionModelType: IncidentCustomField,
+      updateBy: updateBy,
+    });
+
     return {
       updateBy: updateBy,
       carryForward: carryForward,
@@ -1014,6 +1028,21 @@ export class Service extends DatabaseService<Model> {
         StatusPageSubscriberNotificationStatus.Pending;
     }
 
+    /*
+     * Last, because the incident template copy above can still be adding
+     * monitors and mapped custom fields are resolved from the final set.
+     *
+     * In onBeforeCreate rather than onCreateSuccess because `customFields` is
+     * a column on this row and the onCreateSuccess chain is un-awaited — a
+     * value written there would be missing from the incident the caller gets
+     * back. Written not to throw: a custom field failing to inherit must not
+     * stop an incident from being declared.
+     */
+    await CustomFieldMappingService.applyMappingsToCreate({
+      definitionModelType: IncidentCustomField,
+      createBy: createBy,
+    });
+
     return {
       createBy,
       carryForward: null,
@@ -1914,6 +1943,12 @@ ${incident.remediationNotes || "No remediation notes provided."}
     onUpdate: OnUpdate<Model>,
     updatedItemIds: ObjectID[],
   ): Promise<OnUpdate<Model>> {
+    CustomFieldMappingService.restampAfterMultiRowUpdate({
+      definitionModelType: IncidentCustomField,
+      updateBy: onUpdate.updateBy,
+      updatedItemIds: updatedItemIds,
+    });
+
     /*
      * Correcting a timestamp is the whole point of making these fields
      * editable, so the numbers derived from them have to move. Without this

package/Server/Services/InventoryItemService.ts

@@ -57,6 +57,27 @@ export class InventoryItemService extends DatabaseService<Model> {
   ): Promise<OnCreate<Model>> {
     const data: Model = createBy.data;
 
+    /*
+     * Who is calling decides this, not what they sent.
+     *
+     * The two machine writers — the ingest reconciler and the inventory
+     * mirror — construct the model themselves and create it with
+     * `props: { isRoot: true }`. Everything else is a person or an API
+     * client. Keying the branch on "did the payload include an entityKey"
+     * instead let any caller opt out of every check below simply by sending
+     * one: the manual-type restriction, the required display name, the
+     * canonicalize-then-hash identity derivation and the firstSeenAt /
+     * lastSeenAt stamp were all skipped, and a hand-supplied
+     * `source: "discovered"` was taken at face value — putting a row in
+     * Inventory that claims to have been discovered from telemetry, of a type
+     * only ingest is supposed to create, which the prune sweep then treats as
+     * TTL-reapable.
+     */
+    if (createBy.props.isRoot !== true) {
+      delete data.entityKey;
+      data.source = EntitySource.Manual;
+    }
+
     if (!data.entityKey) {
       data.source = EntitySource.Manual;
     }
@@ -150,7 +171,16 @@ export class InventoryItemService extends DatabaseService<Model> {
     const countByType: Map<EntityType, number> = new Map<EntityType, number>();
 
     for (const entity of data.entities) {
-      if (!REGISTRY_PROMOTED_TYPES.has(entity.entityType)) {
+      /*
+       * Both promotion gates, repeated at the write boundary. The caller
+       * applies them too, but this method is public and the cost of a missed
+       * gate here is a registry row that should never have existed — see
+       * `ExtractedEntity.membershipOnly` for what the per-entity flag means.
+       */
+      if (
+        entity.membershipOnly ||
+        !REGISTRY_PROMOTED_TYPES.has(entity.entityType)
+      ) {
         continue;
       }
       try {