@oneuptime/common 12.0.34 → 13.0.1

package/Server/Services/Index.ts

@@ -98,6 +98,12 @@ import DockerSwarmClusterOwnerUserService from "./DockerSwarmClusterOwnerUserSer
 import CephClusterLabelRuleService from "./CephClusterLabelRuleService";
 import CephClusterOwnerRuleService from "./CephClusterOwnerRuleService";
 import CephClusterOwnerTeamService from "./CephClusterOwnerTeamService";
+import VMwareVCenterService from "./VMwareVCenterService";
+import VMwareResourceService from "./VMwareResourceService";
+import VMwareVCenterLabelRuleService from "./VMwareVCenterLabelRuleService";
+import VMwareVCenterOwnerRuleService from "./VMwareVCenterOwnerRuleService";
+import VMwareVCenterOwnerTeamService from "./VMwareVCenterOwnerTeamService";
+import VMwareVCenterOwnerUserService from "./VMwareVCenterOwnerUserService";
 import CephClusterOwnerUserService from "./CephClusterOwnerUserService";
 import LlmProviderService from "./LlmProviderService";
 import DataSourceService from "./DataSourceService";
@@ -145,6 +151,7 @@ import DockerSwarmClusterFeedService from "./DockerSwarmClusterFeedService";
 import CephClusterFeedService from "./CephClusterFeedService";
 import PodmanHostFeedService from "./PodmanHostFeedService";
 import ProxmoxClusterFeedService from "./ProxmoxClusterFeedService";
+import VMwareVCenterFeedService from "./VMwareVCenterFeedService";
 import HostFeedService from "./HostFeedService";
 import CloudResourceFeedService from "./CloudResourceFeedService";
 import ServiceFeedService from "./ServiceFeedService";
@@ -327,6 +334,7 @@ import AlertOwnerUserService from "./AlertOwnerUserService";
 import AlertSeverityService from "./AlertSeverityService";
 import DetectionRuleService from "./DetectionRuleService";
 import GoogleSecOpsConnectionService from "./GoogleSecOpsConnectionService";
+import GoogleSecOpsConnectionRunService from "./GoogleSecOpsConnectionRunService";
 import ThreatIntelFeedService from "./ThreatIntelFeedService";
 import ThreatIntelIndicatorService from "./ThreatIntelIndicatorService";
 import AlertNoteTemplateService from "./AlertNoteTemplateService";
@@ -551,6 +559,12 @@ const services: Array<BaseService> = [
   CephClusterOwnerRuleService,
   CephClusterOwnerTeamService,
   CephClusterOwnerUserService,
+  VMwareVCenterService,
+  VMwareResourceService,
+  VMwareVCenterLabelRuleService,
+  VMwareVCenterOwnerRuleService,
+  VMwareVCenterOwnerTeamService,
+  VMwareVCenterOwnerUserService,
   LlmProviderService,
   DataSourceService,
 
@@ -580,6 +594,7 @@ const services: Array<BaseService> = [
   CephClusterFeedService,
   PodmanHostFeedService,
   ProxmoxClusterFeedService,
+  VMwareVCenterFeedService,
   HostFeedService,
   CloudResourceFeedService,
   ServiceFeedService,
@@ -749,6 +764,7 @@ const services: Array<BaseService> = [
   AlertSeverityService,
   DetectionRuleService,
   GoogleSecOpsConnectionService,
+  GoogleSecOpsConnectionRunService,
   ThreatIntelFeedService,
   AlertNoteTemplateService,
   AlertFeedService,

package/Server/Services/InventoryItemService.ts

@@ -57,6 +57,27 @@ export class InventoryItemService extends DatabaseService<Model> {
   ): Promise<OnCreate<Model>> {
     const data: Model = createBy.data;
 
+    /*
+     * Who is calling decides this, not what they sent.
+     *
+     * The two machine writers — the ingest reconciler and the inventory
+     * mirror — construct the model themselves and create it with
+     * `props: { isRoot: true }`. Everything else is a person or an API
+     * client. Keying the branch on "did the payload include an entityKey"
+     * instead let any caller opt out of every check below simply by sending
+     * one: the manual-type restriction, the required display name, the
+     * canonicalize-then-hash identity derivation and the firstSeenAt /
+     * lastSeenAt stamp were all skipped, and a hand-supplied
+     * `source: "discovered"` was taken at face value — putting a row in
+     * Inventory that claims to have been discovered from telemetry, of a type
+     * only ingest is supposed to create, which the prune sweep then treats as
+     * TTL-reapable.
+     */
+    if (createBy.props.isRoot !== true) {
+      delete data.entityKey;
+      data.source = EntitySource.Manual;
+    }
+
     if (!data.entityKey) {
       data.source = EntitySource.Manual;
     }
@@ -150,7 +171,16 @@ export class InventoryItemService extends DatabaseService<Model> {
     const countByType: Map<EntityType, number> = new Map<EntityType, number>();
 
     for (const entity of data.entities) {
-      if (!REGISTRY_PROMOTED_TYPES.has(entity.entityType)) {
+      /*
+       * Both promotion gates, repeated at the write boundary. The caller
+       * applies them too, but this method is public and the cost of a missed
+       * gate here is a registry row that should never have existed — see
+       * `ExtractedEntity.membershipOnly` for what the per-entity flag means.
+       */
+      if (
+        entity.membershipOnly ||
+        !REGISTRY_PROMOTED_TYPES.has(entity.entityType)
+      ) {
         continue;
       }
       try {

package/Server/Services/LogAggregationService.ts

@@ -277,6 +277,7 @@ export class LogAggregationService {
       ["podmanHostId", ServiceType.PodmanHost],
       ["kubernetesClusterId", ServiceType.KubernetesCluster],
       ["proxmoxClusterId", ServiceType.ProxmoxCluster],
+      ["vmwareVCenterId", ServiceType.VMwareVCenter],
       ["cephClusterId", ServiceType.CephCluster],
       ["serverlessFunctionId", ServiceType.ServerlessFunction],
       ["cloudResourceId", ServiceType.CloudResource],

package/Server/Services/MetricAggregationService.ts

@@ -104,6 +104,7 @@ export class MetricAggregationService {
       ["podmanHostId", ServiceType.PodmanHost],
       ["kubernetesClusterId", ServiceType.KubernetesCluster],
       ["proxmoxClusterId", ServiceType.ProxmoxCluster],
+      ["vmwareVCenterId", ServiceType.VMwareVCenter],
       ["cephClusterId", ServiceType.CephCluster],
       ["serverlessFunctionId", ServiceType.ServerlessFunction],
       ["cloudResourceId", ServiceType.CloudResource],

package/Server/Services/MobilePasskeyLoginService.ts

@@ -0,0 +1,216 @@
+import Redis, { ClientType } from "../Infrastructure/Redis";
+import { Host, HttpProtocol } from "../EnvironmentConfig";
+import BadDataException from "../../Types/Exception/BadDataException";
+import DatabaseNotConnectedException from "../../Types/Exception/DatabaseNotConnectedException";
+import ObjectID from "../../Types/ObjectID";
+import { createHash, randomBytes } from "crypto";
+import { URL } from "url";
+
+export interface MobilePasskeyRequest {
+  codeChallenge: string;
+  codeChallengeMethod: "S256";
+  state: string;
+}
+
+export interface MobilePasskeyContext extends MobilePasskeyRequest {
+  serverOrigin: string;
+}
+
+const HANDOFF_ERROR: string =
+  "Unable to complete mobile passkey sign-in. Please start again in the app.";
+const CHALLENGE_PREFIX: string = "mobile-passkey-challenge-";
+const CODE_PREFIX: string = "mobile-passkey-code-";
+const CODE_TTL_SECONDS: number = 120;
+const CHALLENGE_TTL_SECONDS: number = 300;
+const RANDOM_VALUE_PATTERN: RegExp = /^[A-Za-z0-9_-]{43}$/;
+const PKCE_VALUE_PATTERN: RegExp = /^[A-Za-z0-9._~-]{43,128}$/;
+
+/*
+ * Keep the authorization code separate from the eventual session. A callback
+ * intercepted by another app contains no access or refresh token and cannot be
+ * redeemed without the verifier held by the app that started this sign-in.
+ */
+export default class MobilePasskeyLoginService {
+  public static validateRequest(value: unknown): MobilePasskeyContext {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    const data: Partial<MobilePasskeyRequest> = value;
+    if (
+      typeof data.codeChallenge !== "string" ||
+      data.codeChallenge.length !== 43 ||
+      !RANDOM_VALUE_PATTERN.test(data.codeChallenge) ||
+      data.codeChallengeMethod !== "S256" ||
+      typeof data.state !== "string" ||
+      PKCE_VALUE_PATTERN.exec(data.state)?.[0] !== data.state
+    ) {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    return {
+      codeChallenge: data.codeChallenge,
+      codeChallengeMethod: "S256",
+      state: data.state,
+      serverOrigin: this.getServerOrigin(),
+    };
+  }
+
+  public static async storeChallengeContext(
+    challengeId: string,
+    context: MobilePasskeyContext,
+  ): Promise<void> {
+    await this.store(
+      `${CHALLENGE_PREFIX}${this.hash(challengeId)}`,
+      JSON.stringify(context),
+      CHALLENGE_TTL_SECONDS,
+    );
+  }
+
+  public static async consumeChallengeContext(
+    challengeId: string,
+  ): Promise<MobilePasskeyContext | null> {
+    const result: unknown = await this.getStore().eval(
+      "local value = redis.call('GET', KEYS[1]); " +
+        "if value then redis.call('DEL', KEYS[1]); end; return value",
+      1,
+      `${CHALLENGE_PREFIX}${this.hash(challengeId)}`,
+    );
+
+    if (result === null) {
+      return null;
+    }
+
+    if (typeof result !== "string") {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    let stored: MobilePasskeyContext;
+    try {
+      stored = JSON.parse(result) as MobilePasskeyContext;
+    } catch {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    const context: MobilePasskeyContext = this.validateRequest(stored);
+    if (stored.serverOrigin !== context.serverOrigin) {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    return context;
+  }
+
+  public static async createAuthorizationCode(data: {
+    userId: ObjectID;
+    context: MobilePasskeyContext;
+  }): Promise<string> {
+    if (data.context.serverOrigin !== this.getServerOrigin()) {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    const code: string = randomBytes(32).toString("base64url");
+    await this.store(
+      `${CODE_PREFIX}${this.hash(code)}`,
+      JSON.stringify({
+        ...data.context,
+        userId: data.userId.toString(),
+      }),
+      CODE_TTL_SECONDS,
+    );
+
+    // The callback destination is fixed; no caller-controlled redirect URL.
+    const callback: URL = new URL("oneuptime://passkey");
+    callback.searchParams.set("code", code);
+    callback.searchParams.set("state", data.context.state);
+    callback.searchParams.set("serverOrigin", data.context.serverOrigin);
+    return callback.toString();
+  }
+
+  public static async exchangeAuthorizationCode(
+    value: unknown,
+  ): Promise<ObjectID> {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    const data: { code?: unknown; codeVerifier?: unknown; state?: unknown } =
+      value;
+    if (
+      typeof data.code !== "string" ||
+      data.code.length !== 43 ||
+      !RANDOM_VALUE_PATTERN.test(data.code) ||
+      typeof data.codeVerifier !== "string" ||
+      PKCE_VALUE_PATTERN.exec(data.codeVerifier)?.[0] !== data.codeVerifier ||
+      typeof data.state !== "string" ||
+      PKCE_VALUE_PATTERN.exec(data.state)?.[0] !== data.state
+    ) {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    /*
+     * Match and delete in one Redis operation. Concurrent exchanges cannot
+     * issue two sessions, and a wrong verifier cannot burn the legitimate
+     * app's code. This also works on Redis versions without GETDEL.
+     */
+    const userId: unknown = await this.getStore().eval(
+      "local value = redis.call('GET', KEYS[1]); " +
+        "if not value then return nil end; " +
+        "local ok, data = pcall(cjson.decode, value); " +
+        "if not ok or type(data) ~= 'table' then return nil end; " +
+        "if data.codeChallenge ~= ARGV[1] or data.state ~= ARGV[2] " +
+        "or data.serverOrigin ~= ARGV[3] or data.codeChallengeMethod ~= 'S256' " +
+        "or type(data.userId) ~= 'string' then return nil end; " +
+        "redis.call('DEL', KEYS[1]); return data.userId",
+      1,
+      `${CODE_PREFIX}${this.hash(data.code)}`,
+      this.hash(data.codeVerifier),
+      data.state,
+      this.getServerOrigin(),
+    );
+
+    if (typeof userId !== "string" || !ObjectID.isValidUUID(userId)) {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+
+    return new ObjectID(userId);
+  }
+
+  private static getServerOrigin(): string {
+    const origin: URL = new URL(`${HttpProtocol}${Host.toString()}`);
+    if (origin.protocol !== "https:") {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+    return origin.origin;
+  }
+
+  private static hash(value: string): string {
+    return createHash("sha256").update(value, "ascii").digest("base64url");
+  }
+
+  private static getStore(): ClientType {
+    const client: ClientType | null = Redis.getClient();
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException(
+        "Mobile passkey sign-in is temporarily unavailable",
+      );
+    }
+    return client;
+  }
+
+  private static async store(
+    key: string,
+    value: string,
+    ttlSeconds: number,
+  ): Promise<void> {
+    const result: string | null = await this.getStore().set(
+      key,
+      value,
+      "EX",
+      ttlSeconds,
+      "NX",
+    );
+    if (result !== "OK") {
+      throw new BadDataException(HANDOFF_ERROR);
+    }
+  }
+}

package/Server/Services/MonitorService.ts

@@ -31,6 +31,7 @@ import ServerException from "../../Types/Exception/ServerException";
 import Sleep from "../../Types/Sleep";
 import ProbeService from "./ProbeService";
 import ProjectService, { CurrentPlan } from "./ProjectService";
+import PayAsYouGoBillingService from "./PayAsYouGoBillingService";
 import TeamMemberService from "./TeamMemberService";
 import URL from "../../Types/API/URL";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
@@ -763,6 +764,46 @@ export class Service extends DatabaseService<Model> {
       });
     }
 
+    if (
+      IsBillingEnabled &&
+      ((updateBy.data.monitorType &&
+        updateBy.data.monitorType !== MonitorType.Manual) ||
+        updateBy.data.disableActiveMonitoring === false)
+    ) {
+      const monitors: Array<Model> = await this.findBy({
+        query:
+          !updateBy.props.isRoot && updateBy.props.tenantId
+            ? { ...updateBy.query, projectId: updateBy.props.tenantId }
+            : updateBy.query,
+        select: { projectId: true, monitorType: true },
+        limit: updateBy.limit,
+        skip: updateBy.skip,
+        props: { isRoot: true, ignoreHooks: true },
+      });
+      const checkedProjects: Set<string> = new Set<string>();
+
+      for (const monitor of monitors) {
+        const monitorType: MonitorType | undefined =
+          (updateBy.data.monitorType as MonitorType | undefined) ||
+          monitor.monitorType;
+
+        if (monitorType === MonitorType.Manual) {
+          continue;
+        }
+
+        if (!monitor.projectId) {
+          throw new BadDataException(
+            "ProjectId required to enable monitoring.",
+          );
+        }
+
+        if (!checkedProjects.has(monitor.projectId.toString())) {
+          await PayAsYouGoBillingService.requirePayAsYouGo(monitor.projectId);
+          checkedProjects.add(monitor.projectId.toString());
+        }
+      }
+    }
+
     return { updateBy, carryForward: null };
   }
 
@@ -1340,11 +1381,20 @@ export class Service extends DatabaseService<Model> {
     }
 
     if (IsBillingEnabled && createBy.props.tenantId) {
+      if (createBy.data.monitorType !== MonitorType.Manual) {
+        await PayAsYouGoBillingService.requirePayAsYouGo(
+          createBy.props.tenantId,
+        );
+      }
+
       const currentPlan: CurrentPlan = await ProjectService.getCurrentPlan(
         createBy.props.tenantId,
       );
 
-      if (currentPlan.isSubscriptionUnpaid) {
+      if (
+        currentPlan.isSubscriptionUnpaid &&
+        createBy.data.monitorType !== MonitorType.Manual
+      ) {
         throw new BadDataException(
           "Your subscription is unpaid. Please update your payment method and pay all the outstanding invoices to add more monitors.",
         );