@oneuptime/common 12.0.33 → 13.0.0

package/Utils/API.ts

@@ -10,6 +10,7 @@ import Route from "../Types/API/Route";
 import URL from "../Types/API/URL";
 import Dictionary from "../Types/Dictionary";
 import APIException from "../Types/Exception/ApiException";
+import BadDataException from "../Types/Exception/BadDataException";
 import { JSONArray, JSONObject } from "../Types/JSON";
 import RequestFailedDetails, {
   RequestFailedPhase,
@@ -21,6 +22,9 @@ import axios, {
   AxiosResponse,
 } from "axios";
 import Sleep from "../Types/Sleep";
+import HTTPResponseBodyReader, {
+  HTTPResponseBodyBudget,
+} from "./HTTPResponseBodyReader";
 import type { Agent as HttpAgent } from "http";
 import type { Agent as HttpsAgent } from "https";
 
@@ -75,6 +79,33 @@ export interface RequestOptions {
   totalTimeoutInMs?: number | undefined;
   timeout?: number | undefined;
   doNotFollowRedirects?: boolean | undefined;
+  /*
+   * Explicit byte ceilings for callers that return tenant-selected remote
+   * content. Axios otherwise accepts an unlimited response/request body.
+   */
+  maxContentLength?: number | undefined;
+  maxBodyLength?: number | undefined;
+  /*
+   * Axios reads HTTP(S)_PROXY from the process environment on its own. A
+   * caller that supplies a destination-pinned agent must be able to turn that
+   * implicit second routing layer off, or the proxy can resolve a different
+   * address from the one the caller approved.
+   */
+  disableProxy?: boolean | undefined;
+  /* Abort active sockets when a caller-owned end-to-end deadline expires. */
+  signal?: AbortSignal | undefined;
+  /*
+   * Opt-in streaming mode used by monitor requests. All responses that share
+   * this object draw from one decompressed-byte budget.
+   */
+  responseBodyBudget?: HTTPResponseBodyBudget | undefined;
+  limitRedirectResponseBody?: boolean | undefined;
+  maximumResponseBytes?: number | undefined;
+  /**
+   * @internal Already-validated wire URL used by guarded callers when the
+   * reporting URL type cannot represent an href without normalization.
+   */
+  dispatchUrl?: string | undefined;
   // Per-request proxy agent support (Probe supplies these instead of mutating global axios defaults)
   httpAgent?: HttpAgent | undefined;
   httpsAgent?: HttpsAgent | undefined;
@@ -474,7 +505,7 @@ export default class API {
       // Identical on every attempt, so build it once.
       const axiosOptions: AxiosRequestConfig = {
         method: method,
-        url: url.toString(),
+        url: options?.dispatchUrl ?? url.toString(),
         headers: finalHeaders,
         data: finalBody,
       };
@@ -487,6 +518,35 @@ export default class API {
         axiosOptions.maxRedirects = 0;
       }
 
+      if (options?.maxContentLength !== undefined) {
+        axiosOptions.maxContentLength = options.maxContentLength;
+      }
+
+      if (options?.maxBodyLength !== undefined) {
+        axiosOptions.maxBodyLength = options.maxBodyLength;
+      }
+
+      if (options?.disableProxy) {
+        axiosOptions.proxy = false;
+      }
+
+      if (options?.signal) {
+        axiosOptions.signal = options.signal;
+      }
+
+      if (options?.responseBodyBudget) {
+        axiosOptions.responseType = "stream";
+        /*
+         * Axios's Node adapter enforces maxContentLength in an async
+         * generator before yielding the chunk that crosses the limit. That
+         * would hide already-received bytes from the shared budget and let a
+         * retry reclaim them. The streamed reader below is the sole response
+         * cap in this mode; it charges every decompressed chunk before
+         * rejecting and destroys the stream immediately.
+         */
+        axiosOptions.maxContentLength = -1;
+      }
+
       // Attach proxy agents per request if provided (avoids global side-effects)
       if (options?.httpAgent) {
         axiosOptions.httpAgent = options.httpAgent;
@@ -505,10 +565,40 @@ export default class API {
         attempts++;
 
         try {
-          result = await axios(axiosOptions);
+          const axiosResult: AxiosResponse = await axios(axiosOptions);
+
+          if (options?.responseBodyBudget) {
+            axiosResult.data = await API.readBudgetedResponseBody(
+              axiosResult,
+              options.responseBodyBudget,
+              options.limitRedirectResponseBody || false,
+              method === HTTPMethod.HEAD,
+              options.maximumResponseBytes,
+            );
+          }
+
+          result = axiosResult;
 
           break;
         } catch (e) {
+          if (e instanceof BadDataException) {
+            throw e;
+          }
+
+          if (
+            options?.responseBodyBudget &&
+            axios.isAxiosError(e) &&
+            e.response
+          ) {
+            e.response.data = await API.readBudgetedResponseBody(
+              e.response,
+              options.responseBodyBudget,
+              options.limitRedirectResponseBody || false,
+              method === HTTPMethod.HEAD,
+              options.maximumResponseBytes,
+            );
+          }
+
           if (attempt >= maxRetries) {
             throw e;
           }
@@ -590,6 +680,14 @@ export default class API {
       };
 
       if (!axios.isAxiosError(error)) {
+        if (error instanceof BadDataException) {
+          this.notifyRequestComplete(options, {
+            ...baseOutcome,
+            error: error,
+          });
+          throw error;
+        }
+
         const apiException: APIException = new APIException(error.message);
 
         this.notifyRequestComplete(options, {
@@ -625,7 +723,7 @@ export default class API {
         !options?.skipAuthRefresh &&
         !options?.hasAttemptedAuthRefresh
       ) {
-        const retryUrl: URL = URL.fromString(url.toString());
+        const retryUrl: URL = URL.fromStringLenient(url.toString());
 
         const requestContext: AuthRetryContext["request"] = {
           method,
@@ -682,6 +780,34 @@ export default class API {
     }
   }
 
+  private static async readBudgetedResponseBody(
+    response: AxiosResponse,
+    budget: HTTPResponseBodyBudget,
+    limitRedirectResponseBody: boolean,
+    isHeadResponse: boolean,
+    maximumResponseBytes?: number | undefined,
+  ): Promise<unknown> {
+    const body: Buffer = await HTTPResponseBodyReader.read(response.data, {
+      budget: budget,
+      statusCode: response.status,
+      headers: response.headers,
+      limitRedirectResponseBody: limitRedirectResponseBody,
+      isHeadResponse: isHeadResponse,
+      maximumResponseBytes: maximumResponseBytes,
+    });
+    const text: string = HTTPResponseBodyReader.decodeUtf8(body);
+
+    if (!text) {
+      return "";
+    }
+
+    try {
+      return JSON.parse(text) as JSONObject | JSONArray;
+    } catch {
+      return text;
+    }
+  }
+
   private static notifyRequestComplete(
     options: RequestOptions | undefined,
     outcome: RequestOutcome,

package/Utils/Dashboard/Components/DashboardMonitorListComponent.ts

@@ -74,7 +74,8 @@ export default class DashboardMonitorListComponentUtil extends DashboardBaseComp
 
     componentArguments.push({
       name: "Title",
-      description: "Header shown above the monitor list",
+      description:
+        "Header shown above the monitor list. Use {{UNIT}} to show a dashboard variable’s selected label; configure Label Variable separately to filter monitors.",
       required: false,
       type: ComponentInputType.Text,
       id: "title",
@@ -142,6 +143,16 @@ export default class DashboardMonitorListComponentUtil extends DashboardBaseComp
       entityFilterModelType: EntityFilterModelType.Label,
     });
 
+    componentArguments.push({
+      name: "Label Variable",
+      description:
+        "Filter monitors using a Project Labels dashboard variable. This is combined with the fixed filters above. All removes only the variable filter.",
+      required: false,
+      type: ComponentInputType.ProjectLabelVariable,
+      id: "labelVariableId",
+      section: FiltersSection,
+    });
+
     return componentArguments;
   }
 }

package/Utils/Dashboard/LabelVariable.ts

@@ -0,0 +1,152 @@
+import Includes from "../../Types/BaseDatabase/Includes";
+import IncludesAnyOfGroups from "../../Types/BaseDatabase/IncludesAnyOfGroups";
+import DashboardVariable, {
+  DashboardVariableOption,
+  DashboardVariableType,
+} from "../../Types/Dashboard/DashboardVariable";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import DashboardVariableInterpolation, {
+  ResolvedVariableValue,
+} from "./VariableInterpolation";
+
+export interface DashboardLabelFilterData {
+  labelIds?: Array<string> | undefined;
+  labelVariableId?: string | undefined;
+  variables?: Array<DashboardVariable> | undefined;
+}
+
+export default class DashboardLabelVariable {
+  public static getOptions(
+    variable: DashboardVariable,
+  ): Array<DashboardVariableOption> {
+    const options: Array<DashboardVariableOption> | undefined =
+      variable.labelOptions;
+    if (
+      !Array.isArray(options) ||
+      options.length === 0 ||
+      options.length > 1000
+    ) {
+      throw new BadDataException(
+        "A project label variable must offer between 1 and 1000 labels.",
+      );
+    }
+
+    const seen: Set<string> = new Set<string>();
+    for (const option of options) {
+      if (
+        !option ||
+        typeof option.value !== "string" ||
+        !ObjectID.isValidUUID(option.value) ||
+        typeof option.label !== "string" ||
+        option.label.trim().length === 0 ||
+        option.label.length > 1024 ||
+        seen.has(option.value)
+      ) {
+        throw new BadDataException(
+          "Project label variable choices must have unique label IDs and nonempty display names.",
+        );
+      }
+      seen.add(option.value);
+    }
+    return options;
+  }
+
+  public static getFilter(
+    data: DashboardLabelFilterData,
+  ): Includes | IncludesAnyOfGroups | undefined {
+    const fixed: Array<string> = [...new Set(data.labelIds || [])];
+    if (!data.labelVariableId) {
+      return fixed.length > 0 ? new Includes(fixed) : undefined;
+    }
+
+    const matching: Array<DashboardVariable> = (data.variables || []).filter(
+      (variable: DashboardVariable) => {
+        return variable.id === data.labelVariableId;
+      },
+    );
+    const variable: DashboardVariable | undefined = matching[0];
+    if (
+      matching.length !== 1 ||
+      !variable ||
+      variable.type !== DashboardVariableType.ProjectLabel
+    ) {
+      throw new BadDataException(
+        "The monitor widget's label variable is missing or is not a project label variable. Edit the widget to select a label variable.",
+      );
+    }
+
+    const allowed: Set<string> = new Set(
+      DashboardLabelVariable.getOptions(variable).map(
+        (option: DashboardVariableOption) => {
+          return option.value;
+        },
+      ),
+    );
+    const resolved: ResolvedVariableValue | undefined =
+      DashboardVariableInterpolation.resolveValue(variable);
+    const selected: Array<string> =
+      resolved?.multi ||
+      (resolved?.scalar !== undefined ? [resolved.scalar] : []);
+    if (
+      selected.length > 100 ||
+      selected.some((value: string) => {
+        return !allowed.has(value);
+      })
+    ) {
+      throw new BadDataException(
+        "Choose up to 100 labels offered by this dashboard variable, or select All.",
+      );
+    }
+
+    if (selected.length === 0) {
+      return fixed.length > 0 ? new Includes(fixed) : undefined;
+    }
+    const dynamic: Array<string> = [...new Set(selected)];
+    return fixed.length > 0
+      ? new IncludesAnyOfGroups([fixed, dynamic])
+      : new Includes(dynamic);
+  }
+
+  public static interpolateTitle(
+    title: string | undefined,
+    variables: Array<DashboardVariable> | undefined,
+  ): string | undefined {
+    if (!title || !variables?.length) {
+      return title;
+    }
+    return title.replace(
+      /\{\{([a-zA-Z_][a-zA-Z0-9_]*)\}\}/g,
+      (placeholder: string, name: string): string => {
+        const variable: DashboardVariable | undefined = variables.find(
+          (item: DashboardVariable) => {
+            return item.name === name;
+          },
+        );
+        if (!variable) {
+          return placeholder;
+        }
+        const resolved: ResolvedVariableValue | undefined =
+          DashboardVariableInterpolation.resolveValue(variable);
+        if (!resolved) {
+          return "All";
+        }
+        const values: Array<string> = resolved.multi || [
+          resolved.scalar as string,
+        ];
+        return values
+          .map((value: string): string => {
+            if (variable.type !== DashboardVariableType.ProjectLabel) {
+              return value;
+            }
+            return (
+              variable.labelOptions?.find((option: DashboardVariableOption) => {
+                return option.value === value;
+              })?.label || "Unavailable label"
+            );
+          })
+          .join(", ");
+      },
+    );
+  }
+}

package/Utils/Dashboard/VariableUrlState.ts

@@ -65,10 +65,25 @@ export default class DashboardVariableUrlState {
       if (!fromName) {
         return variable;
       }
+
+      /*
+       * The URL's comma syntax cannot distinguish one multi-select choice
+       * from a scalar. Resolve that ambiguity using the saved definition.
+       */
+      if (variable.isMultiSelect) {
+        return {
+          ...variable,
+          selectedValue: undefined,
+          selectedValues:
+            fromName.selectedValues ||
+            (fromName.selectedValue ? [fromName.selectedValue] : []),
+        };
+      }
       return {
         ...variable,
-        selectedValue: fromName.selectedValue,
-        selectedValues: fromName.selectedValues,
+        selectedValue:
+          fromName.selectedValue ?? fromName.selectedValues?.join(","),
+        selectedValues: undefined,
       };
     });
   }
@@ -110,11 +125,18 @@ export default class DashboardVariableUrlState {
         continue;
       }
       const paramKey: string = `${VAR_PREFIX}${name}`;
-      if (variable.selectedValues && variable.selectedValues.length > 0) {
-        params.set(paramKey, variable.selectedValues.join(","));
+      if (variable.isMultiSelect) {
+        if (Array.isArray(variable.selectedValues)) {
+          params.set(paramKey, variable.selectedValues.join(","));
+        }
         continue;
       }
-      if (variable.selectedValue && variable.selectedValue.length > 0) {
+
+      /*
+       * Keep an explicit All as `var-name=`. Omitting it would restore the
+       * saved selection or default when this URL is reopened.
+       */
+      if (typeof variable.selectedValue === "string") {
         params.set(paramKey, variable.selectedValue);
       }
     }

package/Utils/HTTPResponseBodyReader.ts

@@ -0,0 +1,221 @@
+import BadDataException from "../Types/Exception/BadDataException";
+
+interface StreamedResponseBody extends AsyncIterable<unknown> {
+  destroy?: (() => unknown) | undefined;
+}
+
+const DEFAULT_MAX_REDIRECT_RESPONSE_BYTES: number = 64 * 1024;
+
+export class HTTPResponseBodyBudget {
+  private remainingByteCount: number;
+  public readonly maxRedirectResponseBytes: number;
+
+  public constructor(
+    maximumBytes: number,
+    maxRedirectResponseBytes: number = DEFAULT_MAX_REDIRECT_RESPONSE_BYTES,
+  ) {
+    this.remainingByteCount = this.normalizeMaximumBytes(maximumBytes);
+    this.maxRedirectResponseBytes = this.normalizeMaximumBytes(
+      maxRedirectResponseBytes,
+    );
+  }
+
+  public get remainingBytes(): number {
+    return this.remainingByteCount;
+  }
+
+  public getResponseLimit(
+    statusCode: number,
+    limitRedirectResponseBody: boolean,
+  ): number {
+    if (this.remainingByteCount <= 0) {
+      throw new BadDataException(
+        "Remote response exceeded the allowed cumulative size.",
+      );
+    }
+
+    if (
+      limitRedirectResponseBody &&
+      [301, 302, 303, 307, 308].includes(statusCode)
+    ) {
+      return Math.min(this.remainingByteCount, this.maxRedirectResponseBytes);
+    }
+
+    return this.remainingByteCount;
+  }
+
+  public consume(byteCount: number): void {
+    if (
+      !Number.isFinite(byteCount) ||
+      byteCount < 0 ||
+      byteCount > this.remainingByteCount
+    ) {
+      throw new BadDataException(
+        "Remote response exceeded the allowed cumulative size.",
+      );
+    }
+
+    this.remainingByteCount -= byteCount;
+  }
+
+  private normalizeMaximumBytes(value: number): number {
+    if (!Number.isFinite(value)) {
+      return 0;
+    }
+
+    return Math.max(0, Math.floor(value));
+  }
+}
+
+export default class HTTPResponseBodyReader {
+  /*
+   * Axios removes a leading UTF-8 BOM before returning text or parsing JSON.
+   * Bounded callers request a raw stream so they can enforce a cumulative
+   * byte budget themselves; keep Axios-compatible decoding in one shared
+   * place for every streamed response path.
+   */
+  public static decodeUtf8(body: Buffer): string {
+    const text: string = body.toString("utf8");
+    return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+  }
+
+  public static async read(
+    responseBody: unknown,
+    options: {
+      budget: HTTPResponseBodyBudget;
+      statusCode: number;
+      headers?: unknown;
+      limitRedirectResponseBody: boolean;
+      isHeadResponse?: boolean | undefined;
+      maximumResponseBytes?: number | undefined;
+    },
+  ): Promise<Buffer> {
+    if (!this.isStreamedResponseBody(responseBody)) {
+      throw new BadDataException("Remote response body could not be read.");
+    }
+
+    let limit: number;
+    try {
+      limit = options.budget.getResponseLimit(
+        options.statusCode,
+        options.limitRedirectResponseBody,
+      );
+
+      if (options.maximumResponseBytes !== undefined) {
+        limit = Math.min(
+          limit,
+          this.normalizeMaximumBytes(options.maximumResponseBytes),
+        );
+      }
+    } catch (error) {
+      responseBody.destroy?.();
+      throw error;
+    }
+
+    const contentLength: number | null = this.getContentLength(options.headers);
+
+    /*
+     * HEAD and 304 Content-Length values describe a selected representation,
+     * not bytes carried by this response. A 204 cannot carry a body either.
+     * Still stream-count any non-compliant bytes actually sent for all three.
+     *
+     * Keep this utility browser-bundle-safe: API.ts is shared by the web
+     * frontends, so the streamed body is deliberately duck-typed instead of
+     * importing Node's `stream` module at runtime.
+     */
+    const responseHasNoBody: boolean =
+      Boolean(options.isHeadResponse) ||
+      options.statusCode === 204 ||
+      options.statusCode === 304;
+
+    if (!responseHasNoBody && contentLength !== null && contentLength > limit) {
+      responseBody.destroy?.();
+      throw new BadDataException("Remote response exceeded the allowed size.");
+    }
+
+    const chunks: Array<Buffer> = [];
+    let byteCount: number = 0;
+
+    for await (const rawChunk of responseBody) {
+      const chunk: Buffer = Buffer.isBuffer(rawChunk)
+        ? rawChunk
+        : Buffer.from(rawChunk as Uint8Array);
+      byteCount += chunk.length;
+
+      if (byteCount > limit) {
+        /*
+         * The bytes have already crossed the socket boundary, so charge them
+         * even though this response is rejected. Otherwise a peer can send a
+         * near-limit partial response, reset the stream, and reclaim the
+         * entire cumulative budget on every monitor retry.
+         */
+        options.budget.consume(
+          Math.min(chunk.length, options.budget.remainingBytes),
+        );
+        responseBody.destroy?.();
+        throw new BadDataException(
+          "Remote response exceeded the allowed size.",
+        );
+      }
+
+      options.budget.consume(chunk.length);
+      chunks.push(chunk);
+    }
+
+    return Buffer.concat(chunks, byteCount);
+  }
+
+  private static normalizeMaximumBytes(value: number): number {
+    if (!Number.isFinite(value)) {
+      return 0;
+    }
+
+    return Math.max(0, Math.floor(value));
+  }
+
+  private static isStreamedResponseBody(
+    responseBody: unknown,
+  ): responseBody is StreamedResponseBody {
+    return Boolean(
+      responseBody &&
+        typeof responseBody === "object" &&
+        typeof (responseBody as Partial<AsyncIterable<unknown>>)[
+          Symbol.asyncIterator
+        ] === "function",
+    );
+  }
+
+  private static getContentLength(headers: unknown): number | null {
+    if (!headers || typeof headers !== "object") {
+      return null;
+    }
+
+    const getHeader: unknown = (headers as { get?: unknown }).get;
+    let value: unknown;
+
+    if (typeof getHeader === "function") {
+      value = (getHeader as (name: string) => unknown).call(
+        headers,
+        "content-length",
+      );
+    } else {
+      const headerRecord: Record<string, unknown> = headers as Record<
+        string,
+        unknown
+      >;
+      const name: string | undefined = Object.keys(headerRecord).find(
+        (headerName: string) => {
+          return headerName.toLowerCase() === "content-length";
+        },
+      );
+      value = name ? headerRecord[name] : undefined;
+    }
+
+    if (Array.isArray(value)) {
+      value = value[0];
+    }
+
+    const parsed: number = Number(value);
+    return Number.isFinite(parsed) && parsed >= 0 ? parsed : null;
+  }
+}

package/Utils/MetricUnitUtil.ts

@@ -297,6 +297,40 @@ export default class MetricUnitUtil {
     return (value * fromDef.toCanonical) / metricDef.toCanonical;
   }
 
+  /*
+   * The canonical base of the family this unit belongs to — "B" for any
+   * data unit, "sec" for any time unit, "%" for percent, "bit" for bits.
+   * Null when the unit belongs to no known family.
+   *
+   * Distinct from getCanonicalUnitValue, which answers "what should the
+   * threshold dropdown default to for this metric" and returns the unit
+   * itself for a known family member. This answers "what is the one unit
+   * every member of this family can be converted into", which is what a
+   * formatter needs before it can pick a human-readable scale: a value
+   * carrying the unit "GB" has to become bytes before a bytes ladder can
+   * decide that 2500 of them read best as "2.5 TB".
+   */
+  public static getFamilyBaseUnit(
+    metricUnit: string | undefined,
+  ): string | null {
+    if (!metricUnit || !metricUnit.trim()) {
+      return null;
+    }
+
+    const family: Array<UnitDefinition> | null = findFamily(metricUnit);
+    if (!family) {
+      return null;
+    }
+
+    const base: UnitDefinition | undefined = family.find(
+      (u: UnitDefinition) => {
+        return u.toCanonical === 1;
+      },
+    );
+
+    return base?.value || null;
+  }
+
   /*
    * Convenience: does the metric unit belong to a family we can offer
    * conversions for? When false, the UI should still render a dropdown,