@oneuptime/common 12.0.34 → 13.0.1

package/Server/API/GitHubAPI.ts

@@ -18,6 +18,9 @@ import {
 } from "../EnvironmentConfig";
 import ObjectID from "../../Types/ObjectID";
 import GitHubUtil from "../Utils/CodeRepository/GitHub/GitHub";
+import GitHubWebhookHandler, {
+  GitHubWebhookHandlingResult,
+} from "../Utils/CodeRepository/GitHub/GitHubWebhookHandler";
 import CodeRepositoryService, {
   ImportReposFromInstallationResult,
 } from "../Services/CodeRepositoryService";
@@ -499,8 +502,34 @@ export default class GitHubAPI {
             );
           }
 
-          // Get raw body for signature verification
-          const rawBody: string = JSON.stringify(req.body);
+          /*
+           * The signature covers the bytes GitHub SENT, so it has to be
+           * checked against those bytes. This used to re-serialize the parsed
+           * body with JSON.stringify, which only verifies when GitHub's
+           * payload happens to be a fixed point of parse-then-stringify —
+           * every \uXXXX escape, renormalized number and reordered numeric
+           * key silently became "Invalid webhook signature" instead. The
+           * express json parser already captures the real body for exactly
+           * this purpose (see jsonBodyParserOptions in StartServer).
+           *
+           * A missing rawBody is a misconfiguration (a route mounted without
+           * that parser), and it fails closed: verifying a body we did not
+           * capture is not something to guess at.
+           */
+          const rawBody: string | undefined = (req as OneUptimeRequest).rawBody;
+
+          if (!rawBody) {
+            logger.error(
+              "Rejecting GitHub webhook: the raw request body was not captured, so its signature cannot be verified.",
+              getLogAttributesFromRequest(req as OneUptimeRequest),
+            );
+
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("Could not verify webhook signature"),
+            );
+          }
 
           // Verify webhook signature
           const isValid: boolean = GitHubUtil.verifyWebhookSignature(
@@ -661,14 +690,27 @@ export default class GitHubAPI {
           }
 
           /*
-           * Handle different webhook events here
-           * For now, just acknowledge receipt
-           * Future: Handle push, pull_request, check_run events
+           * The interactive surface: mentions, assignments, trigger labels
+           * and review requests. It is deliberately the LAST thing this
+           * handler does and it never throws — the installation bookkeeping
+           * above must not be undone by a comment that could not be posted,
+           * and an exception escaping to GitHub becomes a redelivery of the
+           * same payload forever.
            */
+          const interactiveResult: GitHubWebhookHandlingResult =
+            await GitHubWebhookHandler.handleEvent({
+              event: event,
+              deliveryId: req.headers["x-github-delivery"] as
+                | string
+                | undefined,
+              payload: req.body as JSONObject,
+            });
 
           return Response.sendJsonObjectResponse(req, res, {
             success: true,
             message: "Webhook received",
+            handled: interactiveResult.handled,
+            outcome: interactiveResult.outcome,
           } as JSONObject);
         } catch (error) {
           logger.error(

package/Server/API/GoogleSecOpsConnectionAPI.ts

@@ -0,0 +1,79 @@
+import GoogleSecOpsConnection from "../../Models/DatabaseModels/GoogleSecOpsConnection";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import GoogleSecOpsConnectionService, {
+  Service as GoogleSecOpsConnectionServiceType,
+} from "../Services/GoogleSecOpsConnectionService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import GoogleSecOpsRunExecutor from "../Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsRunExecutor";
+import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+
+export default class GoogleSecOpsConnectionAPI extends BaseAPI<
+  GoogleSecOpsConnection,
+  GoogleSecOpsConnectionServiceType
+> {
+  public constructor() {
+    super(GoogleSecOpsConnection, GoogleSecOpsConnectionService);
+
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:connectionId/run`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+          CommonAPI.assertPermittedInProject({
+            databaseProps: props,
+            allowedPermissions:
+              new GoogleSecOpsConnection().getUpdatePermissions(),
+            errorMessage:
+              "Project owners, project administrators, and security administrators can run connection diagnostics.",
+          });
+
+          const connectionId: string | undefined = req.params["connectionId"];
+          if (!connectionId || !ObjectID.isValidUUID(connectionId)) {
+            throw new BadDataException("A valid connection ID is required.");
+          }
+
+          /*
+           * Authorize against the caller's tenant before any root read or work
+           * is queued. Credentials are only read by the worker.
+           */
+          const connection: GoogleSecOpsConnection | null =
+            await this.service.findOneBy({
+              query: { _id: connectionId, projectId },
+              select: { _id: true, projectId: true },
+              props,
+            });
+          CommonAPI.assertResourceBelongsToProject({
+            resourceProjectId: connection?.projectId,
+            projectId,
+          });
+
+          const runId: ObjectID = await GoogleSecOpsRunExecutor.enqueue({
+            projectId,
+            connectionId: new ObjectID(connectionId),
+            options: GoogleSecOpsRunExecutor.validateOptions(req.body),
+            requestedByUserId: props.userId,
+          });
+          return Response.sendJsonObjectResponse(req, res, {
+            runId: runId.toString(),
+          });
+        } catch (error) {
+          next(error);
+        }
+      },
+    );
+  }
+}

package/Server/API/UserWebAuthnAPI.ts

@@ -20,6 +20,9 @@ import UserTwoFactorBackupCodeService from "../Services/UserTwoFactorBackupCodeS
 import TwoFactorBackupCode from "../Utils/TwoFactorBackupCode";
 import logger from "../Utils/Logger";
 import TwoFactorBackupCodeNotification from "../Utils/TwoFactorBackupCodeNotification";
+import IdentityRateLimit, {
+  IdentityRateLimitBucket,
+} from "../Middleware/IdentityRateLimit";
 
 export default class UserWebAuthnAPI extends BaseAPI<
   UserWebAuthn,
@@ -39,6 +42,7 @@ export default class UserWebAuthnAPI extends BaseAPI<
           const result: { options: any; challenge: string } =
             await UserWebAuthnService.generateRegistrationOptions({
               userId: userId,
+              isPasskey: req.body?.["isPasskey"] === true,
             });
 
           return Response.sendJsonObjectResponse(req, res, result);
@@ -113,8 +117,24 @@ export default class UserWebAuthnAPI extends BaseAPI<
       },
     );
 
+    /*
+     * The only route on this class that no signed-in user stands behind. It
+     * has to be anonymous -- this is where the challenge a security key signs
+     * comes from, and it is needed before there is any assertion to prove who
+     * is asking -- but "anonymous" and "unmetered" are different things, and
+     * it was both.
+     *
+     * What an unmetered version hands out: a database write against any email
+     * address the caller cares to name, as fast as the process will answer.
+     * The limiter keys on the submitted address AND the caller's own address
+     * (see IdentityRateLimit), so a flood spends the attacker's budget rather
+     * than the victim's -- the same trade every other identity route makes.
+     */
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/generate-authentication-options`,
+      IdentityRateLimit.getMiddleware(
+        IdentityRateLimitBucket.WebAuthnChallenge,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const data: JSONObject = req.body["data"] as JSONObject;
@@ -129,7 +149,7 @@ export default class UserWebAuthnAPI extends BaseAPI<
             throw new BadDataException("Email is required");
           }
 
-          const result: { options: any; challenge: string; userId: string } =
+          const result: { options: any; challenge: string } =
             await UserWebAuthnService.generateAuthenticationOptions({
               email: email,
             });

package/Server/API/VMwareResourceAPI.ts

@@ -0,0 +1,143 @@
+import VMwareResource from "../../Models/DatabaseModels/VMwareResource";
+import VMwareVCenter from "../../Models/DatabaseModels/VMwareVCenter";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import VMwareResourceService, {
+  VMwareInventorySummary,
+  Service as VMwareResourceServiceType,
+} from "../Services/VMwareResourceService";
+import VMwareVCenterService from "../Services/VMwareVCenterService";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import Response from "../Utils/Response";
+import BaseAPI from "./BaseAPI";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import CommonAPI from "./CommonAPI";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import { JSONObject } from "../../Types/JSON";
+
+/*
+ * ------------------------------------------------------------------
+ * VMwareResourceAPI
+ *
+ * Augments the auto-generated CRUD router with a single custom
+ * endpoint the VMware layout/overview pages use to fetch sidebar
+ * badge counts (hosts, virtual machines, datastores, clusters,
+ * resource pools) in one round-trip:
+ *
+ *   POST /vmware-resource/inventory-summary/:vcenterId
+ *
+ * The standard CRUD endpoints (list / get) are still registered by
+ * BaseAPI; the UI uses them via ModelAPI for list/detail reads.
+ * Write endpoints reject (@TableAccessControl create/update/delete
+ * = []); ingest writes go through VMwareResourceService as root.
+ * ------------------------------------------------------------------
+ */
+export default class VMwareResourceAPI extends BaseAPI<
+  VMwareResource,
+  VMwareResourceServiceType
+> {
+  public constructor() {
+    super(VMwareResource, VMwareResourceService);
+
+    this.router.post(
+      `${new this.entityType()
+        .getCrudApiPath()
+        ?.toString()}/inventory-summary/:vcenterId`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          await this.getInventorySummary(req, res);
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+
+  /*
+   * vCenter + auth resolution for the vCenter-scoped sub-route.
+   * Returns the (projectId, vmwareVCenterId) tuple after enforcing
+   * the standard ACL chain (the VMwareVCenter model's read
+   * permissions, Permission.ReadVMwareVCenter et al.). Throws
+   * NotFound when the vCenter is missing or the caller lacks read
+   * access (indistinguishable on purpose, so an unauthorised caller
+   * cannot probe which vCenter ids exist).
+   */
+  private async resolveVCenterForRequest(req: ExpressRequest): Promise<{
+    projectId: ObjectID;
+    vmwareVCenterId: ObjectID;
+  }> {
+    const vcenterIdParam: string | undefined = req.params["vcenterId"];
+    if (!vcenterIdParam) {
+      throw new BadDataException("vCenter ID is required");
+    }
+
+    let vmwareVCenterId: ObjectID;
+    try {
+      vmwareVCenterId = new ObjectID(vcenterIdParam);
+    } catch {
+      throw new BadDataException("Invalid vCenter ID");
+    }
+
+    const props: DatabaseCommonInteractionProps =
+      await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+    const vcenter: VMwareVCenter | null =
+      await VMwareVCenterService.findOneById({
+        id: vmwareVCenterId,
+        select: {
+          _id: true,
+          projectId: true,
+        },
+        props,
+      });
+
+    if (!vcenter || !vcenter.projectId) {
+      throw new NotFoundException("vCenter not found");
+    }
+
+    return {
+      projectId: vcenter.projectId,
+      vmwareVCenterId,
+    };
+  }
+
+  private async getInventorySummary(
+    req: ExpressRequest,
+    res: ExpressResponse,
+  ): Promise<void> {
+    const { projectId, vmwareVCenterId } =
+      await this.resolveVCenterForRequest(req);
+
+    const summary: VMwareInventorySummary =
+      await this.service.getInventorySummary({
+        projectId,
+        vmwareVCenterId,
+      });
+
+    const responseBody: JSONObject = {
+      countsByKind: summary.countsByKind as unknown as JSONObject,
+      /*
+       * Convenience fields so the UI doesn't have to repeat COALESCE.
+       * The kind strings are the PascalCase values ingest writes to
+       * VMwareResource.kind (VMwareResourceKind).
+       */
+      datacenterCount: summary.datacenterCount,
+      clusterCount: summary.clusterCount,
+      hostCount: summary.hostCount,
+      // Non-template VM rows — matches VMwareVCenter.vmCount.
+      virtualMachineCount: summary.virtualMachineCount,
+      poweredOnVirtualMachineCount: summary.poweredOnVirtualMachineCount,
+      virtualMachineTemplateCount: summary.virtualMachineTemplateCount,
+      datastoreCount: summary.datastoreCount,
+      resourcePoolCount: summary.resourcePoolCount,
+    };
+
+    return Response.sendJsonObjectResponse(req, res, responseBody);
+  }
+}

package/Server/EnvironmentConfig.ts

@@ -472,32 +472,63 @@ export const HomeHostname: Hostname = Hostname.fromString(
 
 export const Env: string = process.env["NODE_ENV"] || "production";
 
-// Redis does not require password.
-export const RedisHostname: string = process.env["REDIS_HOST"] || "redis";
-export const RedisPort: Port = new Port(process.env["REDIS_PORT"] || "6379");
-export const RedisDb: number = Number(process.env["REDIS_DB"]) || 0;
-export const RedisUsername: string = process.env["REDIS_USERNAME"] || "default";
-export const RedisPassword: string =
-  process.env["REDIS_PASSWORD"] || "password";
+/*
+ * The cache and queue tier runs Valkey -- the BSD-licensed fork of Redis 7.2 --
+ * so its settings are named VALKEY_*. Any Redis-protocol server works here,
+ * including real Redis, which is why the in-code names below stay `Redis*`:
+ * they describe the protocol, not the vendor.
+ *
+ * The REDIS_* names these shipped under are still read, so an existing
+ * config.env or values.yaml keeps working untouched. They are DEPRECATED, not
+ * removed; VALKEY_* wins when both are set. Nothing here may start requiring
+ * the new name -- a self-hoster who never edits config.env must keep running.
+ *
+ * `||` here is load-bearing and must not be "modernised" to `??`. Compose
+ * materialises an unset variable as an EMPTY STRING, and docker-compose.base.yml
+ * lists every VALKEY_* name, so the new name is always *defined* inside our
+ * containers. Under `??` an empty VALKEY_PASSWORD would beat the operator's real
+ * REDIS_PASSWORD and the app would silently fall through to the literal default
+ * below.
+ */
+export function getCacheEnvVar(suffix: string): string | undefined {
+  return (
+    process.env[`VALKEY_${suffix}`] ||
+    process.env[`REDIS_${suffix}`] ||
+    undefined
+  );
+}
+
+/*
+ * The cache does not require a password.
+ *
+ * The default hostname stays "redis" even though the compose service is now
+ * `valkey`. This default is only reached when NEITHER variable is set, which
+ * never happens in our own compose or Helm -- both always set them. What it does
+ * cover is hand-written Kubernetes manifests, a bare `docker run`, and third
+ * party compose files, where the Service has been called `redis` for years.
+ * Compose is unaffected either way: its valkey service answers to `redis` too.
+ */
+export const RedisHostname: string = getCacheEnvVar("HOST") || "redis";
+export const RedisPort: Port = new Port(getCacheEnvVar("PORT") || "6379");
+export const RedisDb: number = Number(getCacheEnvVar("DB")) || 0;
+export const RedisUsername: string = getCacheEnvVar("USERNAME") || "default";
+export const RedisPassword: string = getCacheEnvVar("PASSWORD") || "password";
 
-export const RedisTlsCa: string | undefined =
-  process.env["REDIS_TLS_CA"] || undefined;
+export const RedisTlsCa: string | undefined = getCacheEnvVar("TLS_CA");
 
-export const RedisTlsCert: string | undefined =
-  process.env["REDIS_TLS_CERT"] || undefined;
+export const RedisTlsCert: string | undefined = getCacheEnvVar("TLS_CERT");
 
-export const RedisTlsKey: string | undefined =
-  process.env["REDIS_TLS_KEY"] || undefined;
+export const RedisTlsKey: string | undefined = getCacheEnvVar("TLS_KEY");
 
 export const RedisTlsSentinelMode: boolean =
-  process.env["REDIS_TLS_SENTINEL_MODE"] === "true";
+  getCacheEnvVar("TLS_SENTINEL_MODE") === "true";
 
 export const ShouldRedisTlsEnable: boolean = Boolean(
   RedisTlsCa || (RedisTlsCert && RedisTlsKey),
 );
 
-export const RedisIPFamily: number = process.env["REDIS_IP_FAMILY"]
-  ? Number(process.env["REDIS_IP_FAMILY"])
+export const RedisIPFamily: number = getCacheEnvVar("IP_FAMILY")
+  ? Number(getCacheEnvVar("IP_FAMILY"))
   : 4;
 
 export const IsProduction: boolean =

package/Server/Infrastructure/Postgres/SchemaMigrations/1791700000000-AddMacAddressToNetworkDevice.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddMacAddressToNetworkDevice1791700000000
+  implements MigrationInterface
+{
+  public name: string = "AddMacAddressToNetworkDevice1791700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "macAddress" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" ADD "isMacAddressLearned" boolean DEFAULT false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "isMacAddressLearned"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDevice" DROP COLUMN "macAddress"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1791800000000-SplitWebAuthnChallengeByPurpose.ts

@@ -0,0 +1,68 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Registering a security key and signing in with one each need a challenge,
+ * and they used to write the same pair of columns -- so whichever ceremony
+ * wrote last silently destroyed the other's. Registration is keyed by the
+ * session's user and signing in by an email address, but both land on the same
+ * User row, so a second browser tab was enough to lose a registration that was
+ * already halfway through.
+ *
+ * The old pair is dropped rather than kept as the sign-in slot. A column named
+ * `webauthnChallenge` that in fact means "the sign-in one" is exactly the
+ * ambiguity that let the two flows share it, and leaving it would also leave a
+ * value written by a pre-deploy REGISTRATION to be read afterwards as a
+ * sign-in challenge.
+ *
+ * Nothing durable is lost. These columns hold a single-use value with a
+ * five-minute TTL, so the worst case is a user who was mid-ceremony as the
+ * deploy landed being told to start again -- which is what the message already
+ * says, and which retrying fixes.
+ */
+export class SplitWebAuthnChallengeByPurpose1791800000000
+  implements MigrationInterface
+{
+  public name: string = "SplitWebAuthnChallengeByPurpose1791800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "User" DROP COLUMN "webauthnChallenge"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" DROP COLUMN "webauthnChallengeExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD "webauthnRegistrationChallenge" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD "webauthnRegistrationChallengeExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD "webauthnAuthenticationChallenge" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD "webauthnAuthenticationChallengeExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "User" DROP COLUMN "webauthnAuthenticationChallengeExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" DROP COLUMN "webauthnAuthenticationChallenge"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" DROP COLUMN "webauthnRegistrationChallengeExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" DROP COLUMN "webauthnRegistrationChallenge"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD "webauthnChallengeExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD "webauthnChallenge" character varying(100)`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1791900000000-AddSeverityAndStateToNotificationEmailRollup.ts

@@ -0,0 +1,26 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddSeverityAndStateToNotificationEmailRollup1791900000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddSeverityAndStateToNotificationEmailRollup1791900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" ADD "severity" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" ADD "currentState" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" DROP COLUMN "currentState"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" DROP COLUMN "severity"`,
+    );
+  }
+}