@oneuptime/common 12.0.33 → 13.0.0

package/Server/Utils/StartServer.ts

@@ -6,7 +6,6 @@ import {
   EncryptionSecretWarning,
   GoogleTagManagerEnabled,
   TrustedProxyHops,
-  getFrontendEnvVars,
 } from "../EnvironmentConfig";
 import LocalCache from "../Infrastructure/LocalCache";
 import HttpMetricsMiddleware from "../Middleware/HttpMetricsMiddleware";
@@ -16,6 +15,7 @@ import CorsOptions, {
   CORS_PREFLIGHT_MAX_AGE_SECONDS,
 } from "./CorsOptions";
 import "./Environment";
+import { sendFrontendEnvironmentResponse } from "./FrontendEnvironment";
 import Express, {
   ExpressApplication,
   ExpressJson,
@@ -373,22 +373,7 @@ const init: InitFunction = async (
       [`/${appName}/env.js`, "/env.js"],
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
-          // ping api server for database config.
-
-          const env: JSONObject = getFrontendEnvVars();
-
-          const script: string = `
-    if(!window.process){
-      window.process = {}
-    }
-
-    if(!window.process.env){
-      window.process.env = {}
-    }
-    window.process.env = ${JSON.stringify(env)};
-  `;
-
-          Response.sendJavaScriptResponse(req, res, script);
+          sendFrontendEnvironmentResponse(req, res);
         } catch (err) {
           return next(err);
         }

package/Server/Utils/TelegramVerificationToken.ts

@@ -0,0 +1,185 @@
+import crypto from "crypto";
+import {
+  RESEND_COOLDOWN_SECONDS,
+  VERIFICATION_CODE_EXPIRY_MINUTES,
+} from "./ChannelVerification";
+
+/*
+ * Telegram's /start payload is a bearer capability: anyone who can guess it
+ * can bind their chat to the pending notification method. A six-digit value
+ * is therefore not appropriate, even with request throttling. This format
+ * carries 256 bits from the operating-system CSPRNG and an authenticated-by-
+ * equality issue timestamp, while staying below Telegram's 64-character
+ * start-parameter limit.
+ *
+ *   8 base36 timestamp characters + "_" + 43 base64url characters = 52
+ *
+ * The whole value is stored on the pending row. Its random portion makes an
+ * offline or online search infeasible; the timestamp gives old links a hard
+ * lifetime without adding schema columns solely for this channel.
+ */
+
+const TOKEN_RANDOM_BYTES: number = 32;
+const TOKEN_TIMESTAMP_LENGTH: number = 8;
+const TOKEN_RANDOM_LENGTH: number = 43;
+const WEBHOOK_SECRET_MIN_LENGTH: number = 32;
+const WEBHOOK_SECRET_MAX_LENGTH: number = 100;
+const WEBHOOK_SECRET_REGEX: RegExp = /^[A-Za-z0-9_-]+$/;
+
+export const TELEGRAM_VERIFICATION_TOKEN_LENGTH: number =
+  TOKEN_TIMESTAMP_LENGTH + 1 + TOKEN_RANDOM_LENGTH;
+
+export const TELEGRAM_VERIFICATION_TOKEN_REGEX: RegExp =
+  /^[0-9a-z]{8}_[A-Za-z0-9_-]{43}$/;
+
+export default class TelegramVerificationToken {
+  public static mint(now: Date = new Date()): string {
+    const issuedAtSeconds: number = Math.floor(now.getTime() / 1000);
+    const encodedIssuedAt: string = issuedAtSeconds
+      .toString(36)
+      .padStart(TOKEN_TIMESTAMP_LENGTH, "0");
+
+    if (encodedIssuedAt.length !== TOKEN_TIMESTAMP_LENGTH) {
+      throw new Error("Telegram verification timestamp is out of range");
+    }
+
+    const randomValue: string = crypto
+      .randomBytes(TOKEN_RANDOM_BYTES)
+      .toString("base64url");
+
+    return `${encodedIssuedAt}_${randomValue}`;
+  }
+
+  public static isValidShape(token: unknown): token is string {
+    return (
+      typeof token === "string" &&
+      token.length === TELEGRAM_VERIFICATION_TOKEN_LENGTH &&
+      TELEGRAM_VERIFICATION_TOKEN_REGEX.test(token)
+    );
+  }
+
+  public static getIssuedAt(token: unknown): Date | null {
+    if (!TelegramVerificationToken.isValidShape(token)) {
+      return null;
+    }
+
+    const encodedIssuedAt: string = token.slice(0, TOKEN_TIMESTAMP_LENGTH);
+    const issuedAtSeconds: number = parseInt(encodedIssuedAt, 36);
+
+    if (!Number.isSafeInteger(issuedAtSeconds) || issuedAtSeconds <= 0) {
+      return null;
+    }
+
+    return new Date(issuedAtSeconds * 1000);
+  }
+
+  public static isExpired(data: {
+    token: unknown;
+    now?: Date | undefined;
+  }): boolean {
+    const issuedAt: Date | null = TelegramVerificationToken.getIssuedAt(
+      data.token,
+    );
+
+    if (!issuedAt) {
+      return true;
+    }
+
+    const now: Date = data.now || new Date();
+
+    /*
+     * A timestamp from the future is malformed or the result of clock skew in
+     * the unsafe direction. Refuse it instead of extending the token's life.
+     */
+    if (issuedAt.getTime() > now.getTime()) {
+      return true;
+    }
+
+    return (
+      now.getTime() - issuedAt.getTime() >=
+      VERIFICATION_CODE_EXPIRY_MINUTES * 60 * 1000
+    );
+  }
+
+  public static getResendRetryAfterSeconds(data: {
+    token: unknown;
+    now?: Date | undefined;
+  }): number {
+    const issuedAt: Date | null = TelegramVerificationToken.getIssuedAt(
+      data.token,
+    );
+
+    if (!issuedAt) {
+      return 0;
+    }
+
+    const now: Date = data.now || new Date();
+    const elapsedSeconds: number = (now.getTime() - issuedAt.getTime()) / 1000;
+
+    if (elapsedSeconds < 0) {
+      return RESEND_COOLDOWN_SECONDS;
+    }
+
+    if (elapsedSeconds >= RESEND_COOLDOWN_SECONDS) {
+      return 0;
+    }
+
+    return Math.max(1, Math.ceil(RESEND_COOLDOWN_SECONDS - elapsedSeconds));
+  }
+
+  /*
+   * A non-reversible, fixed-size Redis key segment that never discloses the
+   * live bearer token in operational tooling.
+   */
+  public static getRateLimitKey(token: string): string {
+    return crypto.createHash("sha256").update(token, "utf8").digest("hex");
+  }
+
+  /*
+   * Burn a token after use. This deliberately does not match the live-token
+   * grammar, so no time or random value can make it acceptable again.
+   */
+  public static mintUnusableValue(): string {
+    return crypto.randomBytes(TOKEN_RANDOM_BYTES).toString("hex");
+  }
+
+  public static isWebhookSecretStrong(secret: unknown): secret is string {
+    if (typeof secret !== "string") {
+      return false;
+    }
+
+    const normalizedSecret: string = secret.trim();
+
+    return (
+      normalizedSecret.length >= WEBHOOK_SECRET_MIN_LENGTH &&
+      normalizedSecret.length <= WEBHOOK_SECRET_MAX_LENGTH &&
+      WEBHOOK_SECRET_REGEX.test(normalizedSecret)
+    );
+  }
+
+  /*
+   * Fail closed when the administrator did not configure a Telegram webhook
+   * secret. Comparing equal-length values with timingSafeEqual avoids turning
+   * the header check into a prefix oracle.
+   */
+  public static isWebhookSecretValid(data: {
+    configuredSecret: string | null | undefined;
+    providedSecret: string | null | undefined;
+  }): boolean {
+    const configuredSecret: string = data.configuredSecret?.trim() || "";
+    const providedSecret: string = data.providedSecret || "";
+
+    if (!configuredSecret || !providedSecret) {
+      return false;
+    }
+
+    const configuredBuffer: Buffer = Buffer.from(configuredSecret, "utf8");
+    const providedBuffer: Buffer = Buffer.from(providedSecret, "utf8");
+
+    if (configuredBuffer.length !== providedBuffer.length) {
+      return false;
+    }
+
+    return crypto.timingSafeEqual(configuredBuffer, providedBuffer);
+  }
+}

package/Server/Utils/Telemetry/EntityRegistry.ts

@@ -217,7 +217,17 @@ export async function reconcileEntityRegistryThrottled(data: {
   try {
     const promoted: Array<ExtractedEntity> = data.entities.filter(
       (entity: ExtractedEntity) => {
-        return REGISTRY_PROMOTED_TYPES.has(entity.entityType);
+        /*
+         * Two gates, and they answer different questions. The type gate asks
+         * "does this KIND of thing belong in the registry"; the per-entity
+         * flag asks "is this particular observation the resource's entity of
+         * that type, or a duplicate the producer sent alongside it". See
+         * `ExtractedEntity.membershipOnly`.
+         */
+        return (
+          !entity.membershipOnly &&
+          REGISTRY_PROMOTED_TYPES.has(entity.entityType)
+        );
       },
     );
     const retiredHosts: Array<RetiredEntityIdentity> = (

package/Server/Utils/Telemetry/PinServiceName.ts

@@ -0,0 +1,197 @@
+import { JSONObject, JSONValue } from "../../../Types/JSON";
+
+/*
+ * Every top-level OTLP container that carries a `resource` block. Each is an
+ * array of { resource, scopeSpans|scopeLogs|scopeMetrics|scopeProfiles }
+ * envelopes.
+ *
+ * Profiles are in the list even though a Browser ingestion key cannot reach
+ * the profiles surface at all (see BROWSER_ALLOWED_INGEST_SURFACES). Pinning
+ * is not a browser-only feature: a Server key may set a pinned service name
+ * too, and the dashboard field promises it applies to "everything the key
+ * writes". Leaving one signal out would make that promise false in exactly
+ * the quiet way nobody notices until they are reading a chart. The
+ * containment argument for browser keys is unaffected either way.
+ */
+const RESOURCE_CONTAINER_KEYS: ReadonlyArray<string> = [
+  "resourceSpans",
+  "resourceLogs",
+  "resourceMetrics",
+  "resourceProfiles",
+];
+
+const SERVICE_NAME_ATTRIBUTE_KEY: string = "service.name";
+
+/*
+ * Rewrites `service.name` on every OTLP resource in a payload so telemetry
+ * written with a given ingestion key can only ever land under the service that
+ * key is pinned to.
+ *
+ * WHY THIS EXISTS: a Browser ingestion key is published in page source by
+ * design - that is the whole point of the key class - so it must be assumed
+ * scraped. Rate limits and the origin allowlist bound HOW MUCH forged data an
+ * attacker can write and FROM WHERE, but neither stops them writing it under
+ * `service.name: "payments-api"` and poisoning the dashboards, SLOs and alert
+ * rules of a backend service that never emitted a byte of it. Pinning is the
+ * control that makes the forged data self-identifying: it can only ever appear
+ * as the browser service the customer named.
+ *
+ * WHY IT MUTATES IN PLACE: this runs on the ingest path over payloads that are
+ * routinely megabytes of spans. Deep-cloning them to return a rewritten copy
+ * would double peak heap on the hot path for no benefit - the caller owns the
+ * body and has no use for the original.
+ *
+ * WHY NOTHING IN HERE THROWS: the input is attacker-controlled JSON that has
+ * NOT been validated against the OTLP schema at this point, and this runs
+ * inside a queue worker. A TypeError on a hostile shape would fail the whole
+ * batch (and, worse, would be trivially reachable by anyone holding a scraped
+ * key). Every shape check below therefore skips or repairs rather than raises.
+ */
+export default class PinServiceName {
+  /*
+   * Pin `serviceName` onto every resource block in `body`, in place.
+   *
+   * Returns the number of resource blocks rewritten, which the caller can log
+   * or use to tell "we pinned nothing because the payload was empty" apart
+   * from "we pinned nothing because the payload was malformed".
+   */
+  public static pinInPlace(body: JSONObject, serviceName: string): number {
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return 0;
+    }
+
+    /*
+     * An empty pin would stamp `service.name: ""` on everything, which is
+     * strictly worse than not pinning: it destroys the customer's own service
+     * attribution AND gives the attacker's data a shape indistinguishable
+     * from it. Refuse to do that; the caller's policy layer is responsible for
+     * not configuring a blank pin in the first place.
+     */
+    const pinnedServiceName: string =
+      typeof serviceName === "string" ? serviceName.trim() : "";
+
+    if (!pinnedServiceName) {
+      return 0;
+    }
+
+    let rewrittenCount: number = 0;
+
+    for (const containerKey of RESOURCE_CONTAINER_KEYS) {
+      const container: JSONValue | undefined = body[containerKey];
+
+      if (!Array.isArray(container)) {
+        continue;
+      }
+
+      for (const resourceBlock of container) {
+        if (this.pinResourceBlock(resourceBlock, pinnedServiceName)) {
+          rewrittenCount++;
+        }
+      }
+    }
+
+    return rewrittenCount;
+  }
+
+  /*
+   * Pin one { resource, scope* } envelope. Returns whether it was rewritten.
+   *
+   * A malformed `resource` or `attributes` is REPLACED rather than skipped.
+   * That looks aggressive, but consider the alternative: a forged payload that
+   * sends `"resource": "not-an-object"` would then pass through unpinned, and
+   * the downstream decoder - which reads `resource?.attributes` defensively -
+   * would happily ingest it with whatever service attribution it falls back
+   * to. Skipping would hand the attacker a one-character bypass of the entire
+   * control. The only thing we cannot repair is an envelope that is not an
+   * object at all, because there is nowhere to write.
+   */
+  private static pinResourceBlock(
+    resourceBlock: JSONValue | undefined,
+    serviceName: string,
+  ): boolean {
+    if (
+      !resourceBlock ||
+      typeof resourceBlock !== "object" ||
+      Array.isArray(resourceBlock)
+    ) {
+      return false;
+    }
+
+    const block: JSONObject = resourceBlock as JSONObject;
+
+    const existingResource: JSONValue | undefined = block["resource"];
+
+    let resource: JSONObject;
+
+    if (
+      existingResource &&
+      typeof existingResource === "object" &&
+      !Array.isArray(existingResource)
+    ) {
+      resource = existingResource as JSONObject;
+    } else {
+      resource = {};
+      block["resource"] = resource;
+    }
+
+    const existingAttributes: JSONValue | undefined = resource["attributes"];
+
+    const attributes: Array<JSONValue> = [];
+
+    if (Array.isArray(existingAttributes)) {
+      for (const attribute of existingAttributes) {
+        /*
+         * Keep every attribute that is not a service.name in its original
+         * relative order, including entries we cannot parse - dropping those
+         * would be an unrelated, invisible edit to the customer's data.
+         */
+        if (!this.isServiceNameAttribute(attribute)) {
+          attributes.push(attribute as JSONValue);
+        }
+      }
+    }
+
+    /*
+     * Appended last, and exactly once, so there is no ambiguity for a
+     * consumer that takes either the first or the last match.
+     */
+    attributes.push({
+      key: SERVICE_NAME_ATTRIBUTE_KEY,
+      value: {
+        stringValue: serviceName,
+      },
+    } as JSONValue);
+
+    resource["attributes"] = attributes as JSONValue;
+
+    return true;
+  }
+
+  /*
+   * Matched case-insensitively and after trimming, which is deliberately
+   * looser than the OTLP spec (attribute keys are case-sensitive there).
+   *
+   * Rationale: the ONLY consequence of over-matching here is that an exotic
+   * key like "Service.Name" gets dropped, and no consumer in this codebase
+   * reads that. The consequence of under-matching is a bypass, if any
+   * consumer anywhere - now or later, ours or a customer's export - folds
+   * case before looking up the service. Defence in depth wins that trade.
+   */
+  private static isServiceNameAttribute(attribute: JSONValue): boolean {
+    if (
+      !attribute ||
+      typeof attribute !== "object" ||
+      Array.isArray(attribute)
+    ) {
+      return false;
+    }
+
+    const key: JSONValue | undefined = (attribute as JSONObject)["key"];
+
+    if (typeof key !== "string") {
+      return false;
+    }
+
+    return key.trim().toLowerCase() === SERVICE_NAME_ATTRIBUTE_KEY;
+  }
+}

package/Server/Utils/Telemetry/TelemetryEntity.ts

@@ -82,6 +82,20 @@ export interface ExtractedEntity {
    * the registry attaches them via the existing project label system.
    */
   labels?: Array<string>;
+  /**
+   * When true this entity contributes its key to `entityKeys` on signals but
+   * must never mint a registry row.
+   *
+   * One OTLP resource describes ONE object of any given type — it is a single
+   * pod, on a single node, in a single cluster — and the rest of the pipeline
+   * relies on that: `scalarEntityKeysFromEntities` keeps the first key per
+   * type, and the heuristic resolvers emit at most one entity per type by
+   * construction. A producer can nonetheless send two `entity_refs` of the
+   * same type on one resource, and promoting both put two rows in Inventory
+   * from a single batch. The extra refs stay queryable as membership keys and
+   * stop there.
+   */
+  membershipOnly?: boolean;
 }
 
 /**
@@ -302,6 +316,12 @@ export default class InventoryItem {
   }): Array<ExtractedEntity> {
     const out: Array<ExtractedEntity> = [];
     const seen: Set<string> = new Set<string>();
+    /*
+     * First usable ref of a type is the one that gets a registry row; any
+     * later ref of that same type is demoted to membership-only. See
+     * `ExtractedEntity.membershipOnly`.
+     */
+    const promotedTypes: Set<EntityType> = new Set<EntityType>();
 
     for (const ref of data.entityRefs) {
       const refType: string =
@@ -381,6 +401,15 @@ export default class InventoryItem {
         }
       }
 
+      const alreadyPromoted: boolean = promotedTypes.has(entityType);
+      if (alreadyPromoted) {
+        logger.debug(
+          `OTLP resource declares more than one entity_ref of type "${refType}"; keeping the first as the entity and the rest as membership keys only.`,
+        );
+      } else {
+        promotedTypes.add(entityType);
+      }
+
       out.push({
         entityType,
         entityKey,
@@ -388,6 +417,7 @@ export default class InventoryItem {
         ...(Object.keys(descriptiveAttributes).length > 0
           ? { descriptiveAttributes }
           : {}),
+        ...(alreadyPromoted ? { membershipOnly: true } : {}),
       });
     }
 
@@ -570,7 +600,32 @@ export default class InventoryItem {
       return { entityType: EntityType.KubernetesNamespace, id };
     },
 
-    // k8s.node — cluster + k8s.node.uid/k8s.node.name.
+    /*
+     * k8s.node — cluster + k8s.node.name, falling back to k8s.node.uid only
+     * when no name is available.
+     *
+     * The name is preferred BECAUSE the uid is not universally reported and
+     * identity must not depend on which optional attributes a particular
+     * producer happens to carry. The shipped Kubernetes agent proves the
+     * point: its Deployment collector's `k8s_cluster` receiver reports node
+     * metrics with uid AND name, while its DaemonSet collector
+     * (kubeletstats / hostmetrics / cAdvisor / filelog) only ever has the
+     * name — the kubelet summary API carries no node uid and `k8sattributes`
+     * is not asked to extract one. A uid-first rule therefore hashed the same
+     * node two ways and put two rows in Inventory, both `discovered`, both
+     * displaying the same node name (`k8s.node.name` is a descriptive
+     * attribute on the uid-keyed row, so the two were indistinguishable in
+     * the list). Neither row aged out, because both pipelines keep reporting.
+     *
+     * Name-keying is also what the rest of OneUptime already assumes: the
+     * chart's own comment at configmap-daemonset.yaml says "OneUptime keys the
+     * k8s.node entity on k8s.cluster.name + k8s.node.name", and cluster and
+     * host identity are name-based for the same reason (see
+     * k8sClusterIdentity and the host resolver above).
+     *
+     * The uid stays available as a descriptive attribute, and remains the
+     * identity for the one resource that genuinely has nothing else.
+     */
     (attrs: EntityAttributes) => {
       const nodeUid: string | null = InventoryItem.str(attrs, "k8s.node.uid");
       const nodeName: string | null = InventoryItem.str(attrs, "k8s.node.name");
@@ -580,15 +635,27 @@ export default class InventoryItem {
       const id: Dictionary<string> = {
         ...(InventoryItem.k8sClusterIdentity(attrs) || {}),
       };
-      if (nodeUid) {
-        id["k8s.node.uid"] = nodeUid;
-      } else if (nodeName) {
+      if (nodeName) {
         id["k8s.node.name"] = nodeName;
+      } else {
+        id["k8s.node.uid"] = nodeUid!;
       }
       return { entityType: EntityType.KubernetesNode, id };
     },
 
-    // k8s.pod — cluster + namespace + k8s.pod.uid/k8s.pod.name.
+    /*
+     * k8s.pod — cluster + namespace + k8s.pod.name, falling back to
+     * k8s.pod.uid only when no name is available. Name-preferring for the
+     * same reason as k8s.node above: a pod observed by one pipeline that
+     * resolves its uid and another that does not is one pod, not two.
+     *
+     * A pod name is unique within a namespace at any instant, so this also
+     * makes a restarted StatefulSet pod (same name, new uid) stay one
+     * inventory row instead of minting a fresh one per incarnation — which
+     * is the behaviour an inventory wants. Incarnations remain separable on
+     * the signals themselves, which still carry `k8s.pod.uid` as a resource
+     * attribute, and the 24h pod TTL still reaps a name that stops reporting.
+     */
     (attrs: EntityAttributes) => {
       const podUid: string | null = InventoryItem.str(attrs, "k8s.pod.uid");
       const podName: string | null = InventoryItem.str(attrs, "k8s.pod.name");
@@ -599,10 +666,10 @@ export default class InventoryItem {
         ...(InventoryItem.k8sClusterIdentity(attrs) || {}),
       };
       InventoryItem.addIfPresent(id, attrs, "k8s.namespace.name");
-      if (podUid) {
-        id["k8s.pod.uid"] = podUid;
-      } else if (podName) {
+      if (podName) {
         id["k8s.pod.name"] = podName;
+      } else {
+        id["k8s.pod.uid"] = podUid!;
       }
       return { entityType: EntityType.KubernetesPod, id };
     },
@@ -820,11 +887,18 @@ export default class InventoryItem {
       "telemetry.sdk.name",
       "telemetry.sdk.version",
     ],
+    /*
+     * The uids are descriptive rather than identifying (see the node / pod
+     * resolvers): keeping them here means the Inventory row still shows the
+     * uid of the object it is currently tracking, without that uid being able
+     * to fork the row's identity.
+     */
     [EntityType.KubernetesNode]: [
       "k8s.node.name",
+      "k8s.node.uid",
       "node.kubernetes.io/instance-type",
     ],
-    [EntityType.KubernetesPod]: ["k8s.pod.name"],
+    [EntityType.KubernetesPod]: ["k8s.pod.name", "k8s.pod.uid"],
     [EntityType.Container]: [
       "container.image.name",
       "container.image.tag",