@oneuptime/common 12.0.4 → 12.0.6

package/Server/API/DataSourceAPI.ts

@@ -0,0 +1,268 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import CommonAPI from "./CommonAPI";
+import DataSourceService, {
+  Service as DataSourceServiceType,
+} from "../Services/DataSourceService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import BaseAPI from "./BaseAPI";
+import DataSource from "../../Models/DatabaseModels/DataSource";
+import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { JSONObject } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
+import AggregatedResult from "../../Types/BaseDatabase/AggregatedResult";
+import DataSourceTableResult from "../../Types/DataSource/DataSourceTableResult";
+import { DataSourceResultKind } from "../../Types/DataSource/DataSourceQueryConfig";
+import {
+  DataSourceConnectionSettings,
+  DataSourceConnector,
+} from "../Utils/DataSource/Types";
+import ConnectorRegistry from "../Utils/DataSource/ConnectorRegistry";
+import logger from "../Utils/Logger";
+
+/*
+ * Upper bound on stored/ad-hoc query text. Real PromQL/SQL/DSL queries are
+ * a few KB; anything beyond this is abuse or a mistake.
+ */
+const MAX_QUERY_LENGTH: number = 100_000;
+
+export default class DataSourceAPI extends BaseAPI<
+  DataSource,
+  DataSourceServiceType
+> {
+  public constructor() {
+    super(DataSource, DataSourceService);
+
+    /*
+     * Test a data source's connectivity + credentials. Authenticated
+     * users only; access is checked by reading the record with the
+     * caller's own permissions before any root read of credentials.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/test`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const body: JSONObject = req.body;
+
+          const dataSource: DataSource = await this.getAccessibleDataSource({
+            req,
+            dataSourceId: body["dataSourceId"] as string,
+          });
+
+          const settings: DataSourceConnectionSettings =
+            await this.getConnectionSettings(dataSource);
+
+          const connector: DataSourceConnector = ConnectorRegistry.getConnector(
+            settings.dataSourceType,
+          );
+
+          try {
+            await connector.testConnection(settings);
+          } catch (err) {
+            logger.error(err);
+            return Response.sendJsonObjectResponse(req, res, {
+              ok: false,
+              message: this.toFriendlyErrorMessage(err),
+            });
+          }
+
+          return Response.sendJsonObjectResponse(req, res, {
+            ok: true,
+            message: "Connection successful.",
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
+    /*
+     * Execute a query against a data source and return normalized time
+     * series (for chart/value/gauge widgets) or rows (for the table
+     * widget).
+     *
+     * SECURITY: authenticated project users only — this route must NEVER
+     * be reachable from the anonymous public-dashboard surface, because
+     * it executes caller-supplied query text. Public dashboards render a
+     * placeholder for data-source widgets instead.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/query`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const body: JSONObject = req.body;
+
+          const query: string = (body["query"] as string) || "";
+          if (!query || query.trim().length === 0) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("query is required"),
+            );
+          }
+          if (query.length > MAX_QUERY_LENGTH) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("query is too long"),
+            );
+          }
+
+          const resultKind: DataSourceResultKind =
+            body["resultKind"] === DataSourceResultKind.Table
+              ? DataSourceResultKind.Table
+              : DataSourceResultKind.TimeSeries;
+
+          const startDate: Date = new Date(body["startDate"] as string);
+          const endDate: Date = new Date(body["endDate"] as string);
+          if (
+            isNaN(startDate.getTime()) ||
+            isNaN(endDate.getTime()) ||
+            startDate.getTime() >= endDate.getTime()
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "A valid startDate and endDate are required (startDate must be before endDate).",
+              ),
+            );
+          }
+
+          let stepInSeconds: number | undefined = undefined;
+          if (body["stepInSeconds"] !== undefined) {
+            const parsedStep: number = Number(body["stepInSeconds"]);
+            if (Number.isFinite(parsedStep) && parsedStep > 0) {
+              // Floor, but never to 0 — Loki/Prometheus reject step=0.
+              stepInSeconds = Math.max(1, Math.floor(parsedStep));
+            }
+          }
+
+          const dataSource: DataSource = await this.getAccessibleDataSource({
+            req,
+            dataSourceId: body["dataSourceId"] as string,
+          });
+
+          const settings: DataSourceConnectionSettings =
+            await this.getConnectionSettings(dataSource);
+
+          const connector: DataSourceConnector = ConnectorRegistry.getConnector(
+            settings.dataSourceType,
+          );
+
+          try {
+            if (resultKind === DataSourceResultKind.Table) {
+              const tableResult: DataSourceTableResult =
+                await connector.queryTable(settings, query, {
+                  startDate,
+                  endDate,
+                  stepInSeconds,
+                });
+              return Response.sendJsonObjectResponse(req, res, {
+                resultKind: DataSourceResultKind.Table,
+                result: tableResult as unknown as JSONObject,
+              });
+            }
+
+            const timeSeriesResult: AggregatedResult =
+              await connector.queryTimeSeries(settings, query, {
+                startDate,
+                endDate,
+                stepInSeconds,
+              });
+
+            return Response.sendJsonObjectResponse(req, res, {
+              resultKind: DataSourceResultKind.TimeSeries,
+              result: timeSeriesResult as unknown as JSONObject,
+            });
+          } catch (err) {
+            logger.error(err);
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                `Data source query failed: ${this.toFriendlyErrorMessage(err)}`,
+              ),
+            );
+          }
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+
+  /*
+   * Two-phase access pattern (same as LlmProviderAPI /test): first read
+   * the record with the CALLER'S permissions — wrong project or missing
+   * ReadDataSource yields null — and only then may callers proceed to a
+   * root read of credentials.
+   */
+  private async getAccessibleDataSource(data: {
+    req: ExpressRequest;
+    dataSourceId: string;
+  }): Promise<DataSource> {
+    if (!data.dataSourceId) {
+      throw new BadDataException("dataSourceId is required");
+    }
+
+    if (!ObjectID.isValidUUID(data.dataSourceId)) {
+      throw new BadDataException(
+        "Data source not found, or you do not have access to it.",
+      );
+    }
+
+    const props: DatabaseCommonInteractionProps =
+      await CommonAPI.getDatabaseCommonInteractionProps(data.req);
+
+    const accessibleDataSource: DataSource | null =
+      await DataSourceService.findOneById({
+        id: new ObjectID(data.dataSourceId),
+        select: {
+          _id: true,
+          projectId: true,
+          dataSourceType: true,
+        },
+        props: props,
+      });
+
+    if (!accessibleDataSource) {
+      throw new BadDataException(
+        "Data source not found, or you do not have access to it.",
+      );
+    }
+
+    return accessibleDataSource;
+  }
+
+  private async getConnectionSettings(
+    dataSource: DataSource,
+  ): Promise<DataSourceConnectionSettings> {
+    const settings: DataSourceConnectionSettings | null =
+      await DataSourceService.getConnectionSettingsById(dataSource.id!);
+
+    if (!settings) {
+      throw new BadDataException("Data source configuration is incomplete.");
+    }
+
+    return settings;
+  }
+
+  private toFriendlyErrorMessage(err: unknown): string {
+    const message: string =
+      err instanceof Exception
+        ? err.message
+        : "Could not reach the data source. Please verify the connection details.";
+    return message.substring(0, 1000);
+  }
+}

package/Server/API/StatusPageAPI.ts

@@ -53,7 +53,6 @@ import JSONFunctions from "../../Types/JSONFunctions";
 import ObjectID from "../../Types/ObjectID";
 import Phone from "../../Types/Phone";
 import PositiveNumber from "../../Types/PositiveNumber";
-import HashedString from "../../Types/HashedString";
 import AcmeChallenge from "../../Models/DatabaseModels/AcmeChallenge";
 import Incident from "../../Models/DatabaseModels/Incident";
 import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
@@ -85,7 +84,9 @@ import StatusPageOIDC from "../../Models/DatabaseModels/StatusPageOidc";
 import StatusPageSubscriber from "../../Models/DatabaseModels/StatusPageSubscriber";
 import StatusPageEventType from "../../Types/StatusPage/StatusPageEventType";
 import StatusPageResourceUptimeUtil from "../../Utils/StatusPage/ResourceUptime";
-import StatusPageGroupTreeUtil from "../../Utils/StatusPage/GroupTree";
+import StatusPageGroupTreeUtil, {
+  StatusPageGroupTreeIndex,
+} from "../../Utils/StatusPage/GroupTree";
 import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
 import { Green } from "../../Types/BrandColors";
 import UptimeUtil, { UptimeWindow } from "../../Utils/Uptime/UptimeUtil";
@@ -100,7 +101,6 @@ import Hostname from "../../Types/API/Hostname";
 import Protocol from "../../Types/API/Protocol";
 import DatabaseConfig from "../DatabaseConfig";
 import CookieUtil from "../Utils/Cookie";
-import { EncryptionSecret } from "../EnvironmentConfig";
 import { StatusPageApiRoute } from "../../ServiceRoute";
 import ProjectSmtpConfigService from "../Services/ProjectSmtpConfigService";
 import ForbiddenException from "../../Types/Exception/ForbiddenException";
@@ -941,10 +941,9 @@ export default class StatusPageAPI extends BaseAPI<
             req.params["statusPageId"] as string,
           );
 
-          const password: string | undefined =
-            req.body && (req.body["password"] as string);
+          const password: unknown = req.body && req.body["password"];
 
-          if (!password) {
+          if (typeof password !== "string" || !password) {
             throw new BadDataException("Master password is required.");
           }
 
@@ -956,6 +955,7 @@ export default class StatusPageAPI extends BaseAPI<
                 projectId: true,
                 enableMasterPassword: true,
                 masterPassword: true,
+                masterPasswordSalt: true,
                 isPublicStatusPage: true,
               },
               props: {
@@ -979,12 +979,14 @@ export default class StatusPageAPI extends BaseAPI<
             );
           }
 
-          const hashedInput: string = await HashedString.hashValue(
-            password,
-            EncryptionSecret,
-          );
+          const isMasterPasswordValid: boolean =
+            await StatusPageService.verifyHashedColumnValue({
+              item: statusPage,
+              columnName: "masterPassword",
+              plainValue: password,
+            });
 
-          if (hashedInput !== statusPage.masterPassword.toString()) {
+          if (!isMasterPasswordValid) {
             throw new BadDataException(MASTER_PASSWORD_INVALID_MESSAGE);
           }
 
@@ -1407,19 +1409,35 @@ export default class StatusPageAPI extends BaseAPI<
           const resourceUptimesByGroupId: Dictionary<Array<ResourceUptime>> =
             {};
 
+          /*
+           * Keyed the same way, so the loop below can look a group's uptime up
+           * instead of scanning the whole list for it. A status page can carry
+           * well over a thousand groups, and a scan per group is a scan of the
+           * whole list per group.
+           */
+          const groupUptimeByGroupId: Dictionary<StatusPageGroupUptime> = {};
+
           for (const groupUptime of groupUptimes) {
-            resourceUptimesByGroupId[
-              groupUptime.statusPageGroupId?.toString() || ""
-            ] = groupUptime.statusPageResourceUptimes;
+            const groupId: string =
+              groupUptime.statusPageGroupId?.toString() || "";
+
+            resourceUptimesByGroupId[groupId] =
+              groupUptime.statusPageResourceUptimes;
+            groupUptimeByGroupId[groupId] = groupUptime;
           }
 
+          /*
+           * One index for every subtree walk below, rather than one
+           * re-bucketing of the group list per group.
+           */
+          const statusPageGroupTreeIndex: StatusPageGroupTreeIndex =
+            StatusPageGroupTreeUtil.buildIndex({
+              statusPageGroups: statusPageGroups,
+            });
+
           for (const group of statusPageGroups) {
             const groupUptime: StatusPageGroupUptime | undefined =
-              groupUptimes.find((item: StatusPageGroupUptime) => {
-                return (
-                  item.statusPageGroupId?.toString() === group.id?.toString()
-                );
-              });
+              groupUptimeByGroupId[group.id?.toString() || ""];
 
             if (!groupUptime) {
               continue;
@@ -1429,6 +1447,7 @@ export default class StatusPageAPI extends BaseAPI<
               StatusPageGroupTreeUtil.getGroupAndDescendants({
                 statusPageGroup: group,
                 statusPageGroups: statusPageGroups,
+                index: statusPageGroupTreeIndex,
               }).flatMap((groupInSubtree: StatusPageGroup) => {
                 return (
                   resourceUptimesByGroupId[
@@ -3834,9 +3853,19 @@ export default class StatusPageAPI extends BaseAPI<
         `Updating existing subscriber with ID: ${subscriberId} for status page with ID: ${objectId}`,
         getLogAttributesFromRequest(req as any),
       );
+      /*
+       * Scope the lookup to the status page in the route. This endpoint only
+       * checks read access on that status page, so without the statusPageId
+       * clause anyone holding a subscriber UUID could pass any status page they
+       * can read and edit a subscriber belonging to a different — possibly
+       * private — status page. A subscriber on another page must be
+       * indistinguishable from one that does not exist, so that the shared
+       * "Subscriber not found" below cannot be used to probe for valid UUIDs.
+       */
       statusPageSubscriber = await StatusPageSubscriberService.findOneBy({
         query: {
           _id: subscriberId.toString(),
+          statusPageId: objectId,
         },
         props: {
           isRoot: true,
@@ -3845,7 +3874,7 @@ export default class StatusPageAPI extends BaseAPI<
 
       if (!statusPageSubscriber) {
         logger.debug(
-          `Subscriber not found with ID: ${subscriberId}`,
+          `Subscriber not found with ID: ${subscriberId} on status page with ID: ${objectId}`,
           getLogAttributesFromRequest(req as any),
         );
         throw new BadDataException("Subscriber not found");

package/Server/API/UserAPI.ts

@@ -12,8 +12,10 @@ import PositiveNumber from "../../Types/PositiveNumber";
 import TeamMembersByProject, {
   UserProjectMembership,
 } from "../../Utils/TeamMembersByProject";
+import Email from "../../Types/Email";
 import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import TeamMemberService from "../Services/TeamMemberService";
+import UserAuthenticationStatus from "../../Types/UserAuthenticationStatus";
 import UserService, {
   Service as UserServiceType,
 } from "../Services/UserService";
@@ -191,6 +193,123 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
       },
     );
 
+    /*
+     * How one user can sign in, for Admin Dashboard > User > Authentication.
+     *
+     * A dedicated endpoint rather than extra columns on the CRUD read, because
+     * the interesting fact -- "does this account have a password at all?" --
+     * cannot be answered from the CRUD API without shipping the password
+     * column itself. A master admin bypasses column read permissions, so
+     * selecting `password` in the browser would put every user's scrypt digest
+     * in a page's network tab. The booleans below are derived server-side and
+     * nothing secret crosses the wire.
+     */
+    this.router.get(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/authentication-status`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const status: UserAuthenticationStatus =
+            await UserService.getAuthenticationStatus(userId);
+
+          /*
+           * Whether an account has a password is exactly the sort of answer a
+           * shared cache must not keep -- and it changes the moment either
+           * action below is used.
+           */
+          Response.setNoCacheHeaders(res);
+
+          return Response.sendJsonObjectResponse(
+            req,
+            res,
+            status as unknown as JSONObject,
+          );
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Set a user's password on their behalf.
+     *
+     * Master-admin only, and deliberately its own route rather than a PUT to
+     * /user/:id with a password in it. That generic write would work -- a
+     * master admin bypasses the password column's `update: [CurrentUser]` ACL
+     * -- but nothing about the URL would say so, the password policy could not
+     * be enforced, and the payload would have to be a hand-serialized
+     * HashedString. Here the gate is a middleware anyone can grep for, and the
+     * body is a plain string.
+     *
+     * Session revocation and the "Password Changed." email happen in
+     * UserService's update hook, not here, so they cannot be forgotten by a
+     * caller and cannot fire twice.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/set-password`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const password: unknown = req.body?.["password"];
+
+          /*
+           * Type-checked rather than cast. `as string` on a JSON body is a
+           * lie the moment somebody posts {"password": {...}} or a number, and
+           * the value flows into the hasher.
+           */
+          if (typeof password !== "string") {
+            throw new BadDataException("Password is required");
+          }
+
+          await UserService.setPassword({
+            userId: userId,
+            password: password,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Email the user a link that lets them choose their own password.
+     *
+     * The counterpart to setting one for them: it never puts the operator in
+     * possession of the user's credentials, which is the better default when
+     * the point is simply to get somebody back into a locked-out account. The
+     * link is the same one /forgot-password sends, redeemed by the same page.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/send-password-reset-link`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const email: Email = await UserService.sendPasswordResetLink({
+            userId: userId,
+          });
+
+          /*
+           * Echoed back so the page can say where the link went. The caller is
+           * a master admin who can already read this user's email through the
+           * CRUD API, so this discloses nothing new.
+           */
+          return Response.sendJsonObjectResponse(req, res, {
+            email: email.toString(),
+          });
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/profile-picture/:userId`,
       async (req: ExpressRequest, res: ExpressResponse) => {

package/Server/EnvironmentConfig.ts

@@ -8,6 +8,7 @@ import {
   HomeRoute,
 } from "../ServiceRoute";
 import BillingConfig from "./BillingConfig";
+import { getDistributedDdlTaskTimeoutSeconds } from "./Utils/AnalyticsDatabase/ClusterConfig";
 import Protocol from "../Types/API/Protocol";
 import URL from "../Types/API/URL";
 import Route from "../Types/API/Route";
@@ -569,6 +570,21 @@ export const ClickhouseClusterName: string =
 export const ClickhouseShardingKeyOverride: string =
   process.env["CLICKHOUSE_SHARDING_KEY"] || "";
 
+/*
+ * How long migration / schema-sync ON CLUSTER DDL waits for every host to
+ * report completion before giving up on confirmation (the statement itself
+ * stays queued and still executes on every host in the background). Default
+ * 180 — the ClickHouse server default. Raise this on clusters whose DDL queue
+ * drains slowly; the migration pool's socket-idle ceiling scales with it (see
+ * ClickhouseConfig.ts). 0 returns immediately (async); a negative value
+ * removes the server-side wait limit but the client still gives up at the
+ * migration pool's socket-idle ceiling (30-minute floor), so prefer a finite
+ * value. Mirrors the live reader getDistributedDdlTaskTimeoutSeconds() in
+ * ClusterConfig.ts, which is the single source of parsing truth.
+ */
+export const ClickhouseDistributedDdlTaskTimeoutSeconds: number =
+  getDistributedDdlTaskTimeoutSeconds();
+
 export const GitSha: string = process.env["GIT_SHA"] || "unknown";
 
 export const AppVersion: string = process.env["APP_VERSION"] || "unknown";

package/Server/Infrastructure/ClickhouseConfig.ts

@@ -13,6 +13,7 @@ import {
   MaxClickhouseIngestConnections,
   ShouldClickhouseSslEnable,
 } from "../EnvironmentConfig";
+import { getDistributedDdlTaskTimeoutSeconds } from "../Utils/AnalyticsDatabase/ClusterConfig";
 import Hostname from "../../Types/API/Hostname";
 
 export type ClickHouseClientConfigOptions = NodeClickHouseClientConfigOptions;
@@ -22,6 +23,52 @@ const hostProtocol: string = ClickHouseIsHostHttps ? "https" : "http";
 const clickhouseHost: Hostname = ClickhouseHost || new Hostname("clickhouse");
 const clickhousePort: string = (ClickhousePort || 8123).toString();
 
+/*
+ * How long the client keeps an idle pooled HTTP socket alive before
+ * destroying it (keep_alive.idle_socket_ttl). @clickhouse/client enables
+ * keep-alive by default but expires idle sockets after only 2500ms, while
+ * the telemetry fan-in writer's flush window (TELEMETRY_FANIN_MAX_WAIT_MS,
+ * see TelemetryFanInWriter.ts) defaults to 5000ms — so under sub-saturation
+ * ingest load every pooled socket was destroyed between flushes and every
+ * flush paid TCP (+TLS) connection setup again. The default here is bounded
+ * on both sides:
+ *
+ *   - ABOVE the 5000ms fan-in flush window, so the socket a flush opened is
+ *     still alive when the next flush fires and gets reused instead of
+ *     being re-established;
+ *   - BELOW the ClickHouse server's keep_alive_timeout of 10s (the bundled
+ *     Clickhouse/config.xml pins <keep_alive_timeout>10</keep_alive_timeout>,
+ *     which is also the server default since 23.11), so the CLIENT always
+ *     retires an idle socket before the SERVER does. Operators who lower
+ *     the server's keep_alive_timeout below this TTL must lower
+ *     CLICKHOUSE_KEEP_ALIVE_IDLE_SOCKET_TTL_MS along with it (keeping it a
+ *     fair bit under the server value) — otherwise the client reuses
+ *     sockets the server has already closed and requests fail with
+ *     ECONNRESET.
+ *
+ * The value must be a positive number of milliseconds; unset, non-numeric,
+ * zero and negative values all fall back to the default. Zero is rejected
+ * deliberately: the client treats 0 as "disable idle-socket reaping
+ * entirely", which reintroduces the server-closes-first ECONNRESET failure
+ * mode this TTL exists to prevent.
+ */
+const DEFAULT_KEEP_ALIVE_IDLE_SOCKET_TTL_MS: number = 8000;
+
+const keepAliveIdleSocketTtlRawValue: string = (
+  process.env["CLICKHOUSE_KEEP_ALIVE_IDLE_SOCKET_TTL_MS"] || ""
+).trim();
+
+const keepAliveIdleSocketTtlParsedValue: number = parseInt(
+  keepAliveIdleSocketTtlRawValue,
+  10,
+);
+
+const keepAliveIdleSocketTtlInMs: number =
+  Number.isFinite(keepAliveIdleSocketTtlParsedValue) &&
+  keepAliveIdleSocketTtlParsedValue > 0
+    ? keepAliveIdleSocketTtlParsedValue
+    : DEFAULT_KEEP_ALIVE_IDLE_SOCKET_TTL_MS;
+
 const options: ClickHouseClientConfigOptions = {
   url: `${hostProtocol}://${clickhouseHost.toString()}:${clickhousePort}`,
   username: ClickhouseUsername,
@@ -71,6 +118,19 @@ const options: ClickHouseClientConfigOptions = {
     request: true,
     response: true,
   },
+  /*
+   * Reuse pooled sockets across fan-in flush windows — see the note on
+   * keepAliveIdleSocketTtlInMs above for both bounds on the TTL and the
+   * operator warning about the server's keep_alive_timeout. `enabled: true`
+   * restates the client default explicitly so the pairing with
+   * idle_socket_ttl is visible here rather than implied. This lives on the
+   * shared `options` object, so every pool derived from it (query, ingest,
+   * migration, test) gets the same keep-alive behavior.
+   */
+  keep_alive: {
+    enabled: true,
+    idle_socket_ttl: keepAliveIdleSocketTtlInMs,
+  },
 };
 
 if (ShouldClickhouseSslEnable && ClickhouseTlsCa) {
@@ -114,10 +174,23 @@ export const ingestDataSourceOptions: ClickHouseClientConfigOptions = {
  * additionally carry send_progress_in_http_headers (see MigrationExecuteOptions
  * in AnalyticsDatabaseService) so the socket stays non-idle, and a server-side
  * SETTINGS max_execution_time so ClickHouse remains the authoritative cap.
+ *
+ * The ON CLUSTER confirmation wait (distributed_ddl_task_timeout) streams zero
+ * bytes while pending, so this idle ceiling is the effective upper bound on any
+ * DDL confirmation wait. When CLICKHOUSE_DISTRIBUTED_DDL_TASK_TIMEOUT_SECONDS
+ * is raised past the 30-minute floor, scale the ceiling with it (plus slack)
+ * so the longer wait isn't killed client-side. A negative (infinite) DDL
+ * timeout is still bounded by the 30-minute floor — the client must not hang
+ * forever on a dead socket.
  */
+const migrationRequestTimeoutInMs: number = Math.max(
+  30 * 60 * 1000, // 30-minute floor
+  (getDistributedDdlTaskTimeoutSeconds() + 120) * 1000,
+);
+
 export const migrationDataSourceOptions: ClickHouseClientConfigOptions = {
   ...options,
-  request_timeout: 30 * 60 * 1000, // 30 minutes
+  request_timeout: migrationRequestTimeoutInMs,
 };
 
 export const testDataSourceOptions: ClickHouseClientConfigOptions =