@oneuptime/common 12.0.34 → 13.0.1

package/Server/Services/WorkflowVariableService.ts

@@ -1,9 +1,212 @@
 import DatabaseService from "./DatabaseService";
+import { OnUpdate } from "../Types/Database/Hooks";
+import QueryHelper from "../Types/Database/QueryHelper";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import Typeof from "../../Types/Typeof";
 import Model from "../../Models/DatabaseModels/WorkflowVariable";
 
+/*
+ * isSecret is declared `string` over a genuinely boolean column, so the value
+ * that comes back is `true` from Postgres and can be the string "true" from a
+ * request body. Read exactly the way RunWorkflow.getSecretWorkflowVariableValues
+ * reads it, so what this service calls secret and what the run logs redact can
+ * never disagree.
+ */
+function isSecretValue(value: unknown): boolean {
+  return value === true || value === "true";
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  /*
+   * @UniqueColumnBy(["workflowId", "projectId"]) on `name` is enforced by
+   * DatabaseService.checkUniqueColumnBy, which runs on create only - and there
+   * is no unique index on WorkflowVariable to catch what it misses. That was
+   * harmless while the dashboard offered no way to edit a variable. Now that it
+   * does, a rename is the one write that can put two rows with the same name in
+   * the same scope, and RunWorkflow.getVariables builds
+   * `storageMap.local.variables[variable.name] = variable.content` - a plain
+   * dictionary - so the second row would silently overwrite the first and
+   * {{local.variables.X}} would resolve to whichever the query happened to
+   * return last. Nothing would look broken; the workflow would just quietly run
+   * on the wrong value.
+   *
+   * Two things this cannot close, both shared with the create-side guard it
+   * mirrors: DatabaseService._updateBy skips every hook when props.ignoreHooks
+   * is set, and check-then-write is not atomic, so two concurrent renames onto
+   * the same free name can still both land. Closing either properly means a
+   * unique index on (projectId, workflowId, LOWER(name)), which needs a dedupe
+   * migration first because the racy create-side check may already have let
+   * duplicates through.
+   */
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    const rawName: unknown = updateBy.data.name;
+
+    /*
+     * Only an update that does not carry the column at all is exempt. An
+     * explicitly blank name is still a write to `name` - the column is
+     * nullable: false but the empty string satisfies that, and update does not
+     * re-run the required check - so two rows blanked in the same scope would
+     * both become "" and collide like any other duplicate. Let it through to
+     * the lookup rather than treating it as "no rename".
+     */
+    const isRename: boolean = rawName !== undefined && rawName !== null;
+
+    /*
+     * sanitizeUpdateData passes plain objects straight through, so `name` is
+     * whatever the request body said it was. Reject a non-string here rather
+     * than letting toLowerCase() throw a TypeError, which would surface as a
+     * 500 and a stack trace instead of a 400 naming the field.
+     */
+    if (isRename && typeof rawName !== Typeof.String) {
+      throw new BadDataException("Workflow variable name must be text.");
+    }
+
+    const newName: string = rawName as string;
+
+    /*
+     * Turning the secret flag OFF is the one direction that can expose
+     * something. isSecret decides whether RunWorkflow replaces this variable's
+     * value with [REDACTED] before a run log is persisted, and content itself
+     * is unreadable through the API - so a caller who may write a variable but
+     * may not read it could otherwise clear the flag, trigger a run, and read
+     * the value out of the log. Marking a variable secret stays freely
+     * available; unmarking one does not.
+     */
+    const isDeclassifying: boolean =
+      updateBy.data.isSecret !== undefined &&
+      updateBy.data.isSecret !== null &&
+      !isSecretValue(updateBy.data.isSecret);
+
+    if (!isRename && !isDeclassifying) {
+      return { updateBy, carryForward: null };
+    }
+
+    /*
+     * Read the rows this update will actually touch. Two things about this
+     * query matter.
+     *
+     * It is scoped to the caller's tenant here rather than relying on the
+     * permission layer, because _updateBy runs this hook BEFORE
+     * ModelPermission.checkUpdateQueryPermissions - which is what appends the
+     * project clause. Reading unscoped-as-root would make this hook answer
+     * questions about another project's rows, and its refusal messages say
+     * whether a variable is global and whether a name is taken. A caller
+     * holding a variable id from a project they cannot see would get an oracle
+     * before any authorization ran.
+     *
+     * isRoot inside that scope is still right: the conflicting row may be one
+     * this caller cannot read - read access is label-gated - and a count that
+     * cannot see it reports zero and waves the duplicate through.
+     */
+    const tenantId: ObjectID | undefined = updateBy.props.tenantId;
+
+    const itemsBeingUpdated: Array<Model> = await this.findBy({
+      query: tenantId
+        ? { ...updateBy.query, projectId: tenantId }
+        : updateBy.query,
+      select: {
+        _id: true,
+        name: true,
+        isSecret: true,
+        projectId: true,
+        workflowId: true,
+      },
+      limit: LIMIT_PER_PROJECT,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (isDeclassifying) {
+      for (const item of itemsBeingUpdated) {
+        if (isSecretValue(item.isSecret)) {
+          throw new BadDataException(
+            `"${item.name}" is marked secret, and a secret variable cannot be un-marked. Its value is redacted from workflow run logs, and clearing the flag would publish that value to the logs of every later run. Delete the variable and create it again if it should no longer be secret.`,
+          );
+        }
+      }
+    }
+
+    if (!isRename) {
+      return { updateBy, carryForward: null };
+    }
+
+    /*
+     * Renaming two rows to one name is a conflict the database lookup below
+     * cannot see: neither collides with anything that exists yet, they collide
+     * with each other once both are written.
+     */
+    if (itemsBeingUpdated.length > 1) {
+      throw new BadDataException(
+        `Cannot rename ${itemsBeingUpdated.length} workflow variables to "${newName}" at once. Variable names must be unique.`,
+      );
+    }
+
+    for (const item of itemsBeingUpdated) {
+      /*
+       * A no-op rename must stay a no-op. Compared case-insensitively because
+       * that is how the uniqueness lookup compares, so "TOKEN" -> "token" is a
+       * change of casing on the same row and not a collision with itself.
+       */
+      if (item.name && item.name.toLowerCase() === newName.toLowerCase()) {
+        continue;
+      }
+
+      /*
+       * The scope is what makes the lookup mean anything. projectId comes back
+       * from the select above and is non-nullable on the table, so its absence
+       * means the select or the row is wrong - and a missing projectId would
+       * silently drop the clause and count this name across every project on
+       * the instance. Refuse rather than answer the wrong question.
+       */
+      if (!item.projectId) {
+        throw new BadDataException(
+          "This workflow variable cannot be renamed because it is not attached to a project.",
+        );
+      }
+
+      const conflictCount: number = (
+        await this.countBy({
+          query: {
+            name: QueryHelper.findWithSameText(newName),
+            projectId: item.projectId,
+            /*
+             * Global variables are the rows with a null workflowId, and they
+             * share a namespace of their own. Querying `workflowId: undefined`
+             * would drop the clause entirely and compare a global variable
+             * against every workflow-local one in the project.
+             */
+            workflowId: item.workflowId
+              ? item.workflowId
+              : QueryHelper.isNull(),
+            _id: QueryHelper.notEquals(item.id as ObjectID),
+          },
+          props: {
+            isRoot: true,
+          },
+        })
+      ).toNumber();
+
+      if (conflictCount > 0) {
+        throw new BadDataException(
+          item.workflowId
+            ? `A workflow variable named "${newName}" already exists on this workflow. Variable names must be unique within a workflow.`
+            : `A global variable named "${newName}" already exists in this project. Global variable names must be unique.`,
+        );
+      }
+    }
+
+    return { updateBy, carryForward: null };
+  }
 }
 export default new Service();

package/Server/Types/Billing/MeteredPlan/ActiveMonitoringMeteredPlan.ts

@@ -9,6 +9,9 @@ import ObjectID from "../../../../Types/ObjectID";
 import PositiveNumber from "../../../../Types/PositiveNumber";
 import Project from "../../../../Models/DatabaseModels/Project";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService, {
+  LiveUsageAuthorization,
+} from "../../../Services/PayAsYouGoBillingService";
 
 export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
   @CaptureSpan()
@@ -44,6 +47,19 @@ export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
       },
     });
 
+    /*
+     * This runs on every monitor create and delete, so each live check here
+     * is a payment-provider read on a request path. Check once, and hand the
+     * answer to the usage write instead of letting it read the same payment
+     * setup again a moment later.
+     */
+    const liveAuthorization: LiveUsageAuthorization | null =
+      await PayAsYouGoBillingService.authorizeUsageNow(projectId);
+
+    if (!liveAuthorization) {
+      return;
+    }
+
     // update this count in project as well.
     const project: Project | null = await ProjectService.findOneById({
       id: projectId,
@@ -67,6 +83,7 @@ export default class ActiveMonitoringMeteredPlan extends ServerMeteredPlan {
           (project.paymentProviderMeteredSubscriptionId as string),
         this,
         count.toNumber(),
+        { liveAuthorization: liveAuthorization },
       );
     }
   }

package/Server/Types/Billing/MeteredPlan/TelemetryMeteredPlan.ts

@@ -8,6 +8,9 @@ import ObjectID from "../../../../Types/ObjectID";
 import Project from "../../../../Models/DatabaseModels/Project";
 import TelemetryUsageBilling from "../../../../Models/DatabaseModels/TelemetryUsageBilling";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService, {
+  LiveUsageAuthorization,
+} from "../../../Services/PayAsYouGoBillingService";
 
 export default class TelemetryMeteredPlan extends ServerMeteredPlan {
   private _productType!: ProductType;
@@ -54,11 +57,37 @@ export default class TelemetryMeteredPlan extends ServerMeteredPlan {
       meteredPlanSubscriptionId?: string | undefined;
     },
   ): Promise<void> {
-    // get all unreported logs
+    /*
+     * One live read of the payment setup for the whole report. Staging and the
+     * usage write each used to repeat it seconds later, for every product type
+     * of every project in the billing pass; they are handed this one instead,
+     * and still check live when it is not for this project or has aged out.
+     */
+    const liveAuthorization: LiveUsageAuthorization | null =
+      await PayAsYouGoBillingService.authorizeUsageNow(projectId);
+
+    if (!liveAuthorization) {
+      await TelemetryUsageBillingService.waiveUnreportedUsageBilling({
+        projectId: projectId,
+        productType: this.productType,
+      });
+      return;
+    }
+
+    const billingStartsAt: Date | undefined =
+      await PayAsYouGoBillingService.getTelemetryBillingStartDate(projectId);
+    if (billingStartsAt) {
+      await TelemetryUsageBillingService.waiveUnreportedUsageBilling({
+        projectId: projectId,
+        productType: this.productType,
+        before: billingStartsAt,
+      });
+    }
 
     await TelemetryUsageBillingService.stageTelemetryUsageForProject({
       projectId: projectId,
       productType: this.productType,
+      liveAuthorization: liveAuthorization,
     });
 
     const usageBillings: Array<TelemetryUsageBilling> =
@@ -119,6 +148,7 @@ export default class TelemetryMeteredPlan extends ServerMeteredPlan {
           (project.paymentProviderMeteredSubscriptionId as string),
         this,
         totalCostInCents,
+        { liveAuthorization: liveAuthorization },
       );
 
       for (const usageBilling of usageBillings) {

package/Server/Types/Database/Permissions/ReadPermission.ts

@@ -1,6 +1,7 @@
 import DatabaseRequestType from "../../BaseDatabase/DatabaseRequestType";
 import Query from "../Query";
 import QueryHelper from "../QueryHelper";
+import QueryUtil from "../QueryUtil";
 import RelationSelect from "../RelationSelect";
 import Select from "../Select";
 import SelectUtil from "../SelectUtil";
@@ -12,8 +13,11 @@ import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import ObjectID from "../../../../Types/ObjectID";
+import BadDataException from "../../../../Types/Exception/BadDataException";
 import Permission, { UserPermission } from "../../../../Types/Permission";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
+import { combineWithPrivacyClause } from "../../../Utils/PrivacyFilterUtil";
+import { FindOperator } from "typeorm";
 
 export interface CheckReadPermissionType<TBaseModel extends BaseModel>
   extends CheckPermissionBaseInterface<TBaseModel> {
@@ -119,13 +123,49 @@ export default class ReadPermission {
       }
     }
 
-    // now add these to query
-
     const model: TBaseModel = new modelType();
+    const accessControlColumn: string | null = model.getAccessControlColumn();
+    const manyToManyMeta: ReturnType<
+      typeof QueryUtil.getManyToManyRelationMetadata
+    > = accessControlColumn
+      ? QueryUtil.getManyToManyRelationMetadata(modelType, accessControlColumn)
+      : null;
+
+    if (!manyToManyMeta) {
+      throw new BadDataException(
+        "Cannot apply read label restrictions without access-control relation metadata.",
+      );
+    }
 
-    (query as any)[model.getAccessControlColumn() as string] = {
-      _id: QueryHelper.notInOrNull(labelIds),
-    };
+    const idQuery: Query<TBaseModel> = QueryUtil.serializeQuery(modelType, {
+      _id: query._id,
+    } as Query<TBaseModel>);
+    const existingIdFilter: unknown = idQuery._id;
+    if (
+      existingIdFilter !== undefined &&
+      typeof existingIdFilter !== "string" &&
+      !(existingIdFilter instanceof FindOperator)
+    ) {
+      throw new BadDataException(
+        "Cannot combine read label restrictions with an unsupported ID filter.",
+      );
+    }
+
+    /*
+     * Keep the caller's label selection intact. Blocking labels is a separate
+     * condition on the owner: it must have none of the blocked label links.
+     * Applying that condition to _id also lets grouped dashboard label filters
+     * and existing record selectors reach QueryUtil without being replaced.
+     * Serialize the ID condition first because QueryUtil does not descend into
+     * the database AND operator to convert application query operators later.
+     */
+    (query as any)._id = combineWithPrivacyClause(
+      existingIdFilter,
+      QueryHelper.noneEntitiesInManyToMany({
+        values: labelIds,
+        ...manyToManyMeta,
+      }),
+    );
 
     return { query };
   }

package/Server/Types/Database/QueryUtil.ts

@@ -7,6 +7,7 @@ import GreaterThanOrEqual from "../../../Types/BaseDatabase/GreaterThanOrEqual";
 import InBetween from "../../../Types/BaseDatabase/InBetween";
 import Includes from "../../../Types/BaseDatabase/Includes";
 import IncludesAll from "../../../Types/BaseDatabase/IncludesAll";
+import IncludesAnyOfGroups from "../../../Types/BaseDatabase/IncludesAnyOfGroups";
 import IncludesNone from "../../../Types/BaseDatabase/IncludesNone";
 import StartsWith from "../../../Types/BaseDatabase/StartsWith";
 import EndsWith from "../../../Types/BaseDatabase/EndsWith";
@@ -24,6 +25,7 @@ import { TableColumnMetadata } from "../../../Types/Database/TableColumn";
 import TableColumnType from "../../../Types/Database/TableColumnType";
 import { JSONObject } from "../../../Types/JSON";
 import ObjectID from "../../../Types/ObjectID";
+import BadDataException from "../../../Types/Exception/BadDataException";
 import Typeof from "../../../Types/Typeof";
 import { And, DataSource } from "typeorm";
 import { FindOperator } from "typeorm/find-options/FindOperator";
@@ -45,6 +47,7 @@ export default class QueryUtil {
     const model: BaseModel = new modelType();
 
     query = query as Query<TBaseModel>;
+    const groupedRelationFilters: Array<FindOperator<unknown>> = [];
 
     /*
      * Multi-field text search:
@@ -126,6 +129,37 @@ export default class QueryUtil {
       const tableColumnMetadata: TableColumnMetadata =
         model.getTableColumnMetadata(key);
 
+      if (query[key] instanceof IncludesAnyOfGroups) {
+        if (tableColumnMetadata?.type !== TableColumnType.EntityArray) {
+          throw new BadDataException(
+            "IncludesAnyOfGroups requires a many-to-many entity relation.",
+          );
+        }
+
+        const relation: {
+          joinTableName: string;
+          ownerColumnName: string;
+          relationColumnName: string;
+        } | null = QueryUtil.getManyToManyRelationMetadata(modelType, key);
+
+        if (!relation) {
+          throw new BadDataException(
+            "IncludesAnyOfGroups requires available many-to-many relation metadata.",
+          );
+        }
+
+        for (const group of (query[key] as IncludesAnyOfGroups).groups) {
+          groupedRelationFilters.push(
+            QueryHelper.anyOfEntitiesInManyToMany({
+              ...relation,
+              values: group,
+            }) as FindOperator<unknown>,
+          );
+        }
+        delete query[key];
+        continue;
+      }
+
       if (tableColumnMetadata && query[key] === null) {
         query[key] = QueryHelper.isNull();
       } else if (
@@ -634,6 +668,28 @@ export default class QueryUtil {
       }
     }
 
+    if (groupedRelationFilters.length > 0) {
+      /*
+       * Apply these only after scalar operators have been serialized, so an
+       * existing id condition survives regardless of the query's key order.
+       */
+      const existingIdFilter: unknown = query._id;
+      if (existingIdFilter !== undefined) {
+        if (existingIdFilter instanceof FindOperator) {
+          groupedRelationFilters.unshift(existingIdFilter);
+        } else if (typeof existingIdFilter === "string") {
+          groupedRelationFilters.unshift(
+            QueryHelper.equalTo(existingIdFilter) as FindOperator<unknown>,
+          );
+        } else {
+          throw new BadDataException(
+            "IncludesAnyOfGroups cannot combine an unsupported id filter.",
+          );
+        }
+      }
+      query._id = And(...groupedRelationFilters) as any;
+    }
+
     return query;
   }
 

package/Server/Types/Markdown.ts

@@ -119,7 +119,15 @@ export default class Markdown {
     return htmlBody;
   }
 
-  private static escapeHtml(text: string): string {
+  /**
+   * Escape the five characters that can break out of HTML text or an
+   * attribute value.
+   *
+   * Public because it is not only marked's business: code that hand-builds
+   * an email fragment by string interpolation needs the same escaping, and
+   * a second implementation is a second thing to get wrong.
+   */
+  public static escapeHtml(text: string): string {
     return text
       .replace(/&/g, "&")
       .replace(/</g, "&lt;")
@@ -128,6 +136,31 @@ export default class Markdown {
       .replace(/'/g, "&#39;");
   }
 
+  /*
+   * The email renderer.
+   *
+   * Everything here is an INLINE style, and that is not a preference.
+   * MailService compiles the Handlebars template and sends it — there is no
+   * CSS inlining step anywhere in the pipeline — and Gmail strips <style>
+   * blocks from the document head, so a class name emitted here reaches the
+   * reader as nothing at all. That is why the Docs/Blog renderers' Tailwind
+   * classes cannot be copied even though the override shape can.
+   *
+   * Until this existed the renderer was a bare `new Renderer()`. Alert and
+   * incident root causes carry a GitHub-flavoured table of breaching
+   * samples, and marked emitted it as a naked <table> with no borders, no
+   * padding and no alignment: every row ran into the next, which is
+   * precisely the part of the email an on-call engineer reads first.
+   *
+   * Outlook renders through Word, which ignores border-radius, box-shadow
+   * and — importantly — overflow, so the scrolling wrapper the Docs and
+   * Blog renderers use does not transfer. The table has to FIT instead:
+   * the DetailBox card is 472px wide with 28px of padding either side,
+   * leaving roughly 416px for a root-cause table that routinely runs to
+   * four or more columns. Hence `width:100%` with `table-layout:auto` and
+   * `word-break:break-word` on the cells — a long metric name wraps inside
+   * its column rather than pushing the table past the body width.
+   */
   private static getEmailRenderer(): Renderer {
     if (this.emailRenderer !== null) {
       return this.emailRenderer;
@@ -135,6 +168,65 @@ export default class Markdown {
 
     const renderer: Renderer = new Renderer();
 
+    const cellFont: string =
+      "font-family:'Inter', -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', sans-serif;font-size:13px;line-height:20px;";
+
+    renderer.table = function (header: string, body: string): string {
+      return (
+        `<table cellpadding="0" cellspacing="0" border="0" width="100%" ` +
+        `style="border-collapse:collapse;width:100%;table-layout:auto;` +
+        `margin:12px 0;border:1px solid #e2e8f0;">` +
+        `<thead>${header}</thead><tbody>${body}</tbody></table>`
+      );
+    };
+
+    renderer.tablerow = function (content: string): string {
+      return `<tr>${content}</tr>`;
+    };
+
+    renderer.tablecell = function (
+      content: string,
+      flags: { header?: boolean; align?: string | null },
+    ): string {
+      const tag: string = flags.header ? "th" : "td";
+      const align: string = flags.align ? `text-align:${flags.align};` : "";
+
+      /*
+       * A header cell gets the tinted band and the heavier bottom rule; a
+       * body cell gets a hairline so consecutive rows stay separable. Both
+       * keep the same padding so the columns line up.
+       */
+      const tone: string = flags.header
+        ? "background-color:#f8fafc;color:#475569;font-weight:600;border-bottom:1px solid #cbd5e1;"
+        : "color:#1e293b;font-weight:400;border-bottom:1px solid #f1f5f9;";
+
+      return (
+        `<${tag} style="padding:8px 10px;${cellFont}${tone}` +
+        `word-break:break-word;${align || "text-align:left;"}">` +
+        `${content}</${tag}>`
+      );
+    };
+
+    /*
+     * The root cause backticks metric names, aliases and timestamps. Left
+     * bare they were indistinguishable from the prose around them.
+     *
+     * `code` arrives ALREADY escaped — marked escapes codespan text before
+     * it reaches the renderer — so escaping again here would turn a typed
+     * "<img>" into the literal "&lt;img&gt;" on screen rather than the
+     * "<img>" the author wrote. (The Docs and BlogValidation renderers do
+     * escape a second time; that is a separate defect in those surfaces,
+     * not a pattern to copy.)
+     */
+    renderer.codespan = function (code: string): string {
+      return (
+        `<code style="background-color:#f1f5f9;color:#0f172a;` +
+        `padding:1px 5px;border-radius:4px;` +
+        `font-family:'SFMono-Regular', Consolas, 'Liberation Mono', Menlo, monospace;` +
+        `font-size:12px;">${code}</code>`
+      );
+    };
+
     this.emailRenderer = renderer;
 
     return renderer;

package/Server/Utils/CodeRepository/GitHub/GitHub.ts

@@ -398,6 +398,13 @@ export default class GitHubUtil extends HostedCodeRepository {
       permissions?: {
         contents?: "read" | "write";
         pull_requests?: "read" | "write";
+        /*
+         * Issue READ/WRITE for the interactive app: GitHub routes pull
+         * request CONVERSATION comments through the issues API, so posting
+         * the app's acknowledgement on a pull request needs this scope just
+         * as much as answering a mention on an issue does.
+         */
+        issues?: "read" | "write";
         /*
          * Check-run READ access for the Tier 1 CI verification sweep. The
          * GitHub App must have the "Checks: Read-only" permission configured