@oneuptime/common 12.0.33 → 13.0.0

package/Server/Utils/DataSource/EgressGuard.ts

@@ -67,6 +67,19 @@ export interface EgressGuardOptions {
    * to "Data source".
    */
   targetLabel?: string | undefined;
+  /*
+   * Optional operator guidance appended only when a PRIVATE-tier address is
+   * refused. It is deliberately omitted for loopback/link-local/reserved
+   * ranges because those cannot be opened by the private-network switch.
+   */
+  privateNetworkHint?: string | undefined;
+  /*
+   * Detailed DNS failures and address-policy reasons are useful to operators,
+   * but tenant-facing callers can compare them to enumerate internal names.
+   * Defaults to true for backwards compatibility; shared-probe monitor
+   * requests set it to false and receive one indistinguishable failure.
+   */
+  includeResolvedAddressInError?: boolean | undefined;
 }
 
 export interface PinnedAgents {
@@ -96,6 +109,7 @@ const DEFAULT_TARGET_LABEL: string = "Data source";
 export interface AddressVerdict {
   blocked: boolean;
   reason?: string | undefined;
+  isPrivateNetwork?: boolean | undefined;
 }
 
 const DNS_LOOKUP_TIMEOUT_IN_MS: number = 5000;
@@ -111,6 +125,9 @@ type RangeSpec = [string, number, string];
 const ALWAYS_BLOCKED_IPV4_RANGE_SPECS: Array<RangeSpec> = [
   ["127.0.0.0", 8, "loopback address"],
   ["169.254.0.0", 16, "link-local address (cloud metadata range)"],
+  ["100.100.100.200", 32, "cloud metadata address"],
+  ["168.63.129.16", 32, "cloud platform metadata address"],
+  ["192.0.0.192", 32, "cloud metadata address"],
   ["0.0.0.0", 8, "unspecified address"],
   ["224.0.0.0", 4, "multicast address"],
   ["240.0.0.0", 4, "reserved address"],
@@ -195,7 +212,11 @@ export default class DataSourceEgressGuard {
     if (blockPrivateAddresses) {
       for (const range of this.buildRanges(PRIVATE_IPV4_RANGE_SPECS)) {
         if (this.isInRange(ipAsInt, range)) {
-          return { blocked: true, reason: range.reason };
+          return {
+            blocked: true,
+            reason: range.reason,
+            isPrivateNetwork: true,
+          };
         }
       }
     }
@@ -309,6 +330,80 @@ export default class DataSourceEgressGuard {
       return { blocked: true, reason: "loopback address" };
     }
 
+    const groups: Array<number> = expanded.split(":").map((group: string) => {
+      return parseInt(group, 16);
+    });
+
+    /*
+     * These cloud-local IPv6 endpoints expose instance metadata or workload
+     * credentials. They remain forbidden even when a self-hosted operator
+     * explicitly enables ordinary private-network monitor targets.
+     */
+    if (groups[0] === 0xfd00 && groups[1] === 0x0ec2) {
+      return { blocked: true, reason: "cloud metadata address" };
+    }
+    if (expanded === "fd20:00ce:0000:0000:0000:0000:0000:0254") {
+      return { blocked: true, reason: "cloud metadata address" };
+    }
+
+    /*
+     * RFC 8215 reserves 64:ff9b:1::/48 for locally assigned IPv4/IPv6
+     * translation. Its IPv4 layout is operator-defined, so it cannot be
+     * decoded safely here and the special-use prefix is refused wholesale.
+     * RFC 2765's legacy IPv4-translated prefix receives the same treatment.
+     */
+    if (
+      expanded.startsWith("0064:ff9b:0001:") ||
+      expanded.startsWith("0000:0000:0000:0000:ffff:0000:")
+    ) {
+      return { blocked: true, reason: "IPv4 translation address" };
+    }
+
+    const embeddedIpv4: (highGroupIndex: number, invert?: boolean) => string = (
+      highGroupIndex: number,
+      invert: boolean = false,
+    ): string => {
+      let high: number = groups[highGroupIndex]!;
+      let low: number = groups[highGroupIndex + 1]!;
+
+      if (invert) {
+        high ^= 0xffff;
+        low ^= 0xffff;
+      }
+
+      return `${high >> 8}.${high & 0xff}.${low >> 8}.${low & 0xff}`;
+    };
+
+    /*
+     * Deprecated IPv4-compatible ::/96 addresses are still understood by
+     * network stacks. Classify the IPv4 destination they carry rather than
+     * accepting the globally-looking IPv6 wrapper.
+     */
+    if (
+      groups.slice(0, 6).every((group: number) => {
+        return group === 0;
+      })
+    ) {
+      return this.checkIpv4(embeddedIpv4(6), blockPrivateAddresses);
+    }
+
+    // 6to4 (2002::/16) stores its IPv4 gateway in the next 32 bits.
+    if (groups[0] === 0x2002) {
+      return this.checkIpv4(embeddedIpv4(1), blockPrivateAddresses);
+    }
+
+    /*
+     * Teredo (2001:0000::/32) carries both a server IPv4 address and a
+     * bitwise-inverted client IPv4 address. Either endpoint being forbidden
+     * is enough to reject the route.
+     */
+    if (groups[0] === 0x2001 && groups[1] === 0) {
+      return this.getStrictestVerdict(
+        this.checkIpv4(embeddedIpv4(2), blockPrivateAddresses),
+        this.checkIpv4(embeddedIpv4(6, true), blockPrivateAddresses),
+      );
+    }
+
     const firstGroup: number = parseInt(expanded.substring(0, 4), 16);
     // fe80::/10 link-local.
     if ((firstGroup & 0xffc0) === 0xfe80) {
@@ -322,17 +417,52 @@ export default class DataSourceEgressGuard {
     if (blockPrivateAddresses) {
       // fc00::/7 unique-local.
       if ((firstGroup & 0xfe00) === 0xfc00) {
-        return { blocked: true, reason: "private network address" };
+        return {
+          blocked: true,
+          reason: "private network address",
+          isPrivateNetwork: true,
+        };
+      }
+      // fec0::/10 deprecated site-local addresses are still routed in places.
+      if ((firstGroup & 0xffc0) === 0xfec0) {
+        return {
+          blocked: true,
+          reason: "private network address",
+          isPrivateNetwork: true,
+        };
       }
       // 2001:db8::/32 documentation.
       if (expanded.startsWith("2001:0db8:")) {
-        return { blocked: true, reason: "documentation address" };
+        return {
+          blocked: true,
+          reason: "documentation address",
+          isPrivateNetwork: true,
+        };
       }
     }
 
     return { blocked: false };
   }
 
+  private static getStrictestVerdict(
+    left: AddressVerdict,
+    right: AddressVerdict,
+  ): AddressVerdict {
+    if (left.blocked && !left.isPrivateNetwork) {
+      return left;
+    }
+    if (right.blocked && !right.isPrivateNetwork) {
+      return right;
+    }
+    if (left.blocked) {
+      return left;
+    }
+    if (right.blocked) {
+      return right;
+    }
+    return { blocked: false };
+  }
+
   /*
    * Verdict for a single literal IP address under the given (or derived)
    * policy. Exposed for tests and for connectors that receive addresses
@@ -413,7 +543,9 @@ export default class DataSourceEgressGuard {
       const verdict: AddressVerdict = this.checkAddress(bareHostname, options);
       if (verdict.blocked) {
         throw new BadDataException(
-          `${label} host ${bareHostname} is not allowed: ${verdict.reason}.`,
+          `${label} host ${bareHostname} is not allowed: ${verdict.reason}.${
+            verdict.isPrivateNetwork ? options?.privateNetworkHint || "" : ""
+          }`,
         );
       }
       return [{ address: bareHostname, family: net.isIP(bareHostname) }];
@@ -429,6 +561,11 @@ export default class DataSourceEgressGuard {
     try {
       addresses = await resolveFunction(bareHostname);
     } catch (error) {
+      if (options?.includeResolvedAddressInError === false) {
+        throw new BadDataException(
+          `${label} host ${bareHostname} could not be reached.`,
+        );
+      }
       throw new BadDataException(
         `Could not resolve ${label.toLowerCase()} host ${bareHostname}: ${
           error instanceof Error ? error.message : String(error)
@@ -437,6 +574,11 @@ export default class DataSourceEgressGuard {
     }
 
     if (addresses.length === 0) {
+      if (options?.includeResolvedAddressInError === false) {
+        throw new BadDataException(
+          `${label} host ${bareHostname} could not be reached.`,
+        );
+      }
       throw new BadDataException(
         `Could not resolve ${label.toLowerCase()} host ${bareHostname}.`,
       );
@@ -448,8 +590,15 @@ export default class DataSourceEgressGuard {
         options,
       );
       if (verdict.blocked) {
+        if (options?.includeResolvedAddressInError === false) {
+          throw new BadDataException(
+            `${label} host ${bareHostname} could not be reached.`,
+          );
+        }
         throw new BadDataException(
-          `${label} host ${bareHostname} resolves to ${resolved.address}, which is not allowed: ${verdict.reason}.`,
+          `${label} host ${bareHostname} resolves to ${resolved.address}, which is not allowed: ${verdict.reason}.${
+            verdict.isPrivateNetwork ? options?.privateNetworkHint || "" : ""
+          }`,
         );
       }
     }
@@ -510,20 +659,40 @@ export default class DataSourceEgressGuard {
   ): EgressLookupFunction {
     return (
       _hostname: string,
-      lookupOptions: { all?: boolean | undefined },
+      lookupOptions: {
+        all?: boolean | undefined;
+        family?: number | undefined;
+      },
       callback: EgressLookupCallback,
     ): void => {
+      const wantedFamily: number | undefined = lookupOptions?.family;
+      const usableAddresses: Array<ResolvedAddress> =
+        wantedFamily === 4 || wantedFamily === 6
+          ? addresses.filter((resolved: ResolvedAddress) => {
+              return resolved.family === wantedFamily;
+            })
+          : addresses;
+
+      if (usableAddresses.length === 0) {
+        const error: NodeJS.ErrnoException = new Error(
+          `No IPv${wantedFamily} address is available for the validated host.`,
+        );
+        error.code = "ENOTFOUND";
+        callback(error, "");
+        return;
+      }
+
       if (lookupOptions && lookupOptions.all) {
         callback(
           null,
-          addresses.map((resolved: ResolvedAddress) => {
+          usableAddresses.map((resolved: ResolvedAddress) => {
             return { address: resolved.address, family: resolved.family };
           }),
         );
         return;
       }
 
-      const first: ResolvedAddress = addresses[0]!;
+      const first: ResolvedAddress = usableAddresses[0]!;
       callback(null, first.address, first.family);
     };
   }

package/Server/Utils/EmailRollup/EmailRollupConstants.ts

@@ -19,13 +19,46 @@ export const ROLLUP_SWEEP_LOCK_NAMESPACE: string = "Workers.Cron";
 /*
  * The FIRST BURST_THRESHOLD rollup-eligible owner emails for one
  * (project, user, address, category) inside BURST_WINDOW_MINUTES are sent
- * immediately; the next one and everything after it is coalesced. Four is
- * chosen so one incident's whole normal lifecycle (created -> acknowledged ->
- * resolved) plus one more event stays immediate; the fifth event in ten
- * minutes is where a human starts noticing.
+ * immediately; the next one and everything after it is coalesced.
+ *
+ * THE WINDOW IS THIRTY MINUTES BECAUSE TEN CANNOT SEE A SLOW FLAP.
+ *
+ * The flood this feature exists for is not a spike. The recommendation
+ * monitors fixed in RecommendationCriteriaBuilder.ts produced 39 owner emails
+ * - 19 open, 20 resolve - from ONE monitor in under two hours: about 3.3
+ * items per ten minutes. Both event types are RollupCategory.Alerts, so they
+ * share one counter, and 3.3 sits under a trip point of four. A rate like
+ * that is invisible to a ten-minute window and obvious to a thirty-minute
+ * one, which sees the same flap as about ten items and coalesces from the
+ * fifth onwards.
+ *
+ * Stated precisely, because the number deserves it: rollup did not exist
+ * while that cluster was flapping. This is what a ten-minute window WOULD
+ * have missed, not a throttle that was observed to fail. The flapping itself
+ * is fixed at source; this is the second line of defence, and it is worth
+ * sizing against the case that actually got through.
+ *
+ * WHAT IT COSTS. A row is written for every eligible email, deferred ones
+ * included, so the counter tracks the true arrival rate and does not decay
+ * while a bucket is being coalesced. Tripling the window therefore triples
+ * how long the throttle REMEMBERS: a project with three separate incidents in
+ * half an hour now has the third one's CREATION email deferred by
+ * FLUSH_AFTER_MINUTES, not merely the tail of the second. That is the real
+ * trade, and it is reversible with the same one-line edit.
+ *
+ * Four survives the change because it still covers one incident's whole
+ * normal lifecycle (created -> acknowledged -> resolved) plus one more event.
+ * What it no longer promises is headroom for a SECOND unrelated incident in
+ * the same window; that is the cost above, and it is deliberate.
+ *
+ * Nothing is dropped - deferred items arrive together FLUSH_AFTER_MINUTES
+ * later - and no page is affected, because escalation notifications call
+ * MailService directly from UserNotificationRuleService and never reach this
+ * code at all. The per-user opt-out EmailRollupWriter consults still wins
+ * over both numbers.
  */
 export const BURST_THRESHOLD: number = 4;
-export const BURST_WINDOW_MINUTES: number = 10;
+export const BURST_WINDOW_MINUTES: number = 30;
 
 /*
  * A deferred item is due once it is this old. Also the claim-epoch length,

package/Server/Utils/EmailRollup/EmailRollupFlushRunner.ts

@@ -5,6 +5,7 @@ import ProjectService from "../../Services/ProjectService";
 import UserEmailService from "../../Services/UserEmailService";
 import UserNotificationEmailRollupBatchService from "../../Services/UserNotificationEmailRollupBatchService";
 import UserNotificationEmailRollupItemService from "../../Services/UserNotificationEmailRollupItemService";
+import UserNotificationSettingService from "../../Services/UserNotificationSettingService";
 import QueryHelper from "../../Types/Database/QueryHelper";
 import PostgresErrorTranslator from "../Database/PostgresErrorTranslator";
 import logger from "../Logger";
@@ -29,6 +30,7 @@ import UserNotificationEmailRollupBatch, {
   RollupBatchStatus,
 } from "../../../Models/DatabaseModels/UserNotificationEmailRollupBatch";
 import UserNotificationEmailRollupItem from "../../../Models/DatabaseModels/UserNotificationEmailRollupItem";
+import UserNotificationSetting from "../../../Models/DatabaseModels/UserNotificationSetting";
 import URL from "../../../Types/API/URL";
 import SortOrder from "../../../Types/BaseDatabase/SortOrder";
 import ColumnLength from "../../../Types/Database/ColumnLength";
@@ -37,6 +39,7 @@ import PartialEntity from "../../../Types/Database/PartialEntity";
 import OneUptimeDate from "../../../Types/Date";
 import Email from "../../../Types/Email";
 import EmailTemplateType from "../../../Types/Email/EmailTemplateType";
+import NotificationSettingEventType from "../../../Types/NotificationSetting/NotificationSettingEventType";
 import ObjectID from "../../../Types/ObjectID";
 import PositiveNumber from "../../../Types/PositiveNumber";
 import Text from "../../../Types/Text";
@@ -52,8 +55,9 @@ import Text from "../../../Types/Text";
  * WHAT ONE TICK DOES. Find every rollup item that is still pending and old
  * enough to be due, group them by (project, user, address), and for each such
  * bucket send ONE email carrying everything still pending for that address -
- * across every category. Nothing is suppressed and nothing is summarised
- * away; the recipient gets the same information in one message instead of N.
+ * across every category, excluding events the user has since unsubscribed
+ * from. The recipient gets their subscribed updates in one message instead
+ * of N.
  *
  * THE EXACTLY-ONCE ARGUMENT, IN THE ORDER THE LAYERS ACTUALLY MATTER.
  *
@@ -550,6 +554,38 @@ export default class EmailRollupFlushRunner {
       return RollupFlushOutcome.Empty;
     }
 
+    /*
+     * Read current preferences before consuming any queued items. A user may
+     * have turned an event's email off, or removed its setting, while this
+     * batch was waiting. Both mean no email, just as they do on the immediate
+     * send path. If this lookup fails, the items stay pending so a later epoch
+     * can retry instead of discarding them or mailing against unknown choices.
+     */
+    const settings: Array<UserNotificationSetting> =
+      await UserNotificationSettingService.findBy({
+        query: {
+          projectId: bucket.projectId,
+          userId: bucket.userId,
+          alertByEmail: true,
+        },
+        select: {
+          eventType: true,
+        },
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+    const enabledEventTypes: Set<NotificationSettingEventType> =
+      new Set<NotificationSettingEventType>();
+
+    for (const setting of settings) {
+      if (setting.eventType) {
+        enabledEventTypes.add(setting.eventType);
+      }
+    }
+
     const stamped: number =
       await UserNotificationEmailRollupItemService.updateBy({
         query: {
@@ -591,7 +627,7 @@ export default class EmailRollupFlushRunner {
      * READ BACK BY BATCH, never by "still pending for this bucket": this is
      * what guarantees the email describes exactly the rows this attempt owns.
      */
-    const items: Array<UserNotificationEmailRollupItem> =
+    const claimedItems: Array<UserNotificationEmailRollupItem> =
       await UserNotificationEmailRollupItemService.findBy({
         query: {
           rollupBatchId: batchId,
@@ -613,7 +649,7 @@ export default class EmailRollupFlushRunner {
         },
       });
 
-    if (items.length === 0) {
+    if (claimedItems.length === 0) {
       await EmailRollupFlushRunner.finish({
         batchId: batchId,
         status: RollupBatchStatus.Empty,
@@ -623,6 +659,23 @@ export default class EmailRollupFlushRunner {
       return RollupFlushOutcome.Empty;
     }
 
+    const items: Array<UserNotificationEmailRollupItem> = claimedItems.filter(
+      (item: UserNotificationEmailRollupItem): boolean => {
+        return Boolean(item.eventType && enabledEventTypes.has(item.eventType));
+      },
+    );
+
+    if (items.length === 0) {
+      await EmailRollupFlushRunner.finish({
+        batchId: batchId,
+        status: RollupBatchStatus.Skipped,
+        itemCount: 0,
+        now: now,
+        message: "email notifications are no longer enabled for these events",
+      });
+      return RollupFlushOutcome.Skipped;
+    }
+
     /*
      * RE-VALIDATE THE RECIPIENT. The address was snapshotted minutes ago when
      * the first item was queued, and the individual sends this rollup replaces
@@ -698,9 +751,18 @@ export default class EmailRollupFlushRunner {
     const projectHomeLink: string = URL.fromString(dashboardUrl.toString())
       .addRoute(`/${bucket.projectId.toString()}/home`)
       .toString();
+    /*
+     * Email Preferences, not Notification Settings: this footer exists to
+     * offer the reader a way out of BATCHING, and the rollup switch lives on
+     * Email Preferences. Notification Settings is one link further on, from
+     * the page this lands on. The segment is duplicated from the Dashboard's
+     * UserSettingsRoutePath for the reason OnCallSetupReminderService gives -
+     * Common/Server cannot import App sources - so a route rename there has
+     * to be repeated here.
+     */
     const preferencesLink: string = URL.fromString(dashboardUrl.toString())
       .addRoute(
-        `/${bucket.projectId.toString()}/user-settings/notification-settings`,
+        `/${bucket.projectId.toString()}/user-settings/email-preferences`,
       )
       .toString();
 

package/Server/Utils/EmailRollup/EmailRollupRenderer.ts

@@ -629,8 +629,8 @@ export const buildRollupEmail: BuildRollupEmailFunction = (
    */
   const preferencesText: string =
     "OneUptime groups owner notifications into a single email when several arrive at once for the same project. " +
-    "To go back to one email per notification, sent the moment it happens, turn off email rollup for this project in your notification settings. " +
-    "The same page is where you choose which notifications you receive, or turn email off entirely:";
+    "To go back to one email per notification, sent the moment it happens, turn off email rollup for this project in your email preferences. " +
+    "The same page can also switch off routine emails in bulk, and it links on to the per-event settings:";
 
   /*
    * ONE FLAT ARRAY, WITH THE SECTION HEADING CARRIED ON ITS FIRST ROW.

package/Server/Utils/FrontendEnvironment.ts

@@ -0,0 +1,40 @@
+import { getFrontendEnvVars } from "../EnvironmentConfig";
+import { ExpressRequest, ExpressResponse } from "./Express";
+import Response from "./Response";
+
+export const FRONTEND_ENVIRONMENT_CACHE_CONTROL: string =
+  "private, no-store, no-cache, must-revalidate";
+
+/*
+ * The combined App server and the five standalone frontend servers must emit
+ * exactly the same environment payload. Keeping the serializer here prevents
+ * either route family from growing a second, less restrictive copy.
+ */
+export const getFrontendEnvironmentScript: () => string = (): string => {
+  return `
+if(!window.process){
+  window.process = {}
+}
+
+if(!window.process.env){
+  window.process.env = {}
+}
+window.process.env = ${JSON.stringify(getFrontendEnvVars())};
+`;
+};
+
+/*
+ * Keep the cache policy beside the one serializer used by every frontend. A
+ * pre-remediation env.js may contain a backend exporter credential, so merely
+ * fixing the next response is insufficient if a browser or intermediary is
+ * allowed to retain the old bytes. `private` is defence in depth for shared
+ * caches; `no-store` is the controlling requirement.
+ */
+export const sendFrontendEnvironmentResponse: (
+  req: ExpressRequest,
+  res: ExpressResponse,
+) => void = (req: ExpressRequest, res: ExpressResponse): void => {
+  Response.setNoCacheHeaders(res);
+  res.setHeader("Cache-Control", FRONTEND_ENVIRONMENT_CACHE_CONTROL);
+  Response.sendJavaScriptResponse(req, res, getFrontendEnvironmentScript());
+};

package/Server/Utils/LogRedaction.ts

@@ -139,6 +139,15 @@ const SENSITIVE_EXACT_KEYS: Set<string> = new Set<string>([
   "userhandle",
   "challenge",
   "twofactorsecret",
+  /*
+   * Database drivers attach bind values to QueryFailedError as enumerable
+   * arrays. The values have no reliable self-identifying shape, so the whole
+   * field must be treated as secret rather than logged positionally.
+   */
+  "parameters",
+  "parametervalues",
+  "bindparameters",
+  "bindvalues",
 ]);
 
 export type NormalizeLogKeyFunction = (key: string) => string;
@@ -337,6 +346,16 @@ const STRING_REDACTION_RULES: Array<StringRedactionRule> = [
     regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
     replacement: REDACTED,
   },
+  {
+    /*
+     * Telegram puts the bot credential in the request path rather than a
+     * header. Network clients commonly copy that URL into exception messages,
+     * so structural key redaction cannot see it.
+     */
+    name: "telegram-bot-token-path",
+    regex: /(\/bot)[0-9]{5,}:[A-Za-z0-9_-]{20,}/g,
+    replacement: `$1${REDACTED}`,
+  },
   {
     name: "private-key-block",
     regex:
@@ -377,6 +396,7 @@ const SENSITIVE_TEXT_HINT_REGEX: RegExp = new RegExp(
     "github_pat_",
     "AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA",
     "AIza",
+    "/bot[0-9]{5,}:",
     "-----BEGIN",
     "://",
   ].join("|"),

package/Server/Utils/Logger.ts

@@ -164,6 +164,17 @@ export default class logger {
       }
 
       if (body instanceof Exception || body instanceof Error) {
+        /*
+         * Driver and HTTP errors often carry security-sensitive enumerable
+         * fields (`parameters`, request config, headers) even when their
+         * message and stack are harmless. Preserve the native Error fast path
+         * only for errors with no extra fields; structured errors must pass
+         * through the recursive key-aware redactor before any sink sees them.
+         */
+        if (Object.keys(body).length > 0) {
+          return redactLogValue(body) as LogBody;
+        }
+
         const originalStack: string = body.stack || "";
         const message: string = redactLogString(body.message);
         const stack: string = redactLogString(originalStack);