@oneuptime/common 12.0.5 → 12.0.6

package/Types/DataSource/DataSourceLimits.ts

@@ -0,0 +1,62 @@
+/*
+ * Hard resource bounds applied to every external Data Source query,
+ * regardless of connector. These protect the OneUptime API server (memory,
+ * event loop) and the customer's target system from runaway dashboard
+ * queries — a dashboard with 20 widgets refreshing every minute multiplies
+ * whatever a single query costs.
+ */
+
+// Upper bound on wall-clock time for one connection attempt.
+export const DATA_SOURCE_CONNECT_TIMEOUT_IN_MS: number = 10 * 1000;
+
+// Upper bound on wall-clock time for one query execution.
+export const DATA_SOURCE_QUERY_TIMEOUT_IN_MS: number = 30 * 1000;
+
+/*
+ * Row cap for time-series results. 11k points ≈ 7.5 days at 1-minute
+ * resolution for a single series — beyond that the chart cannot render the
+ * detail anyway. Connectors fetch cap+1 to detect truncation.
+ */
+export const DATA_SOURCE_MAX_TIME_SERIES_ROWS: number = 11000;
+
+// Row cap for tabular results — dashboards render tables, not exports.
+export const DATA_SOURCE_MAX_TABLE_ROWS: number = 1000;
+
+// Cap on distinct series one query may return before truncation.
+export const DATA_SOURCE_MAX_SERIES: number = 100;
+
+/*
+ * Cap on the raw HTTP response body accepted from HTTP-based sources
+ * (Prometheus/Loki/Elasticsearch/REST), before parsing. Prevents a
+ * misconfigured endpoint from ballooning API-server memory.
+ */
+export const DATA_SOURCE_MAX_RESPONSE_SIZE_IN_BYTES: number = 20 * 1024 * 1024;
+
+/*
+ * Default step for range queries when the client does not send one:
+ * aim for ~250 buckets across the selected window, clamped to sane bounds.
+ */
+export const DATA_SOURCE_TARGET_BUCKETS: number = 250;
+export const DATA_SOURCE_MIN_STEP_IN_SECONDS: number = 10;
+export const DATA_SOURCE_MAX_STEP_IN_SECONDS: number = 24 * 60 * 60;
+
+export class DataSourceLimitsUtil {
+  /*
+   * Derive a range-query step (seconds) from a time window: ~TARGET_BUCKETS
+   * buckets, clamped. Used server-side when the widget doesn't specify one
+   * so Prometheus/Loki range queries stay bounded no matter the window.
+   */
+  public static getStepInSeconds(startDate: Date, endDate: Date): number {
+    const rangeSeconds: number = Math.max(
+      Math.floor((endDate.getTime() - startDate.getTime()) / 1000),
+      1,
+    );
+    const rawStep: number = Math.ceil(
+      rangeSeconds / DATA_SOURCE_TARGET_BUCKETS,
+    );
+    return Math.min(
+      Math.max(rawStep, DATA_SOURCE_MIN_STEP_IN_SECONDS),
+      DATA_SOURCE_MAX_STEP_IN_SECONDS,
+    );
+  }
+}

package/Types/DataSource/DataSourceQueryConfig.ts

@@ -0,0 +1,41 @@
+/*
+ * A widget-stored binding to an external Data Source. Persisted inside
+ * `Dashboard.dashboardViewConfig` on chart/value/gauge/table components, so
+ * every field must survive JSON round-trips (plain strings/numbers only —
+ * dataSourceId is a string, not an ObjectID instance).
+ */
+export default interface DataSourceQueryConfig {
+  /*
+   * Stable identity for this query within the widget (mirrors
+   * MetricQueryConfigData.id) so editor UI state survives reorders.
+   */
+  id?: string | undefined;
+
+  // _id of the project's DataSource record this query runs against.
+  dataSourceId: string;
+
+  /*
+   * Query text in the source's native language: PromQL, SQL, LogQL,
+   * Elasticsearch Query DSL JSON, or the REST request descriptor JSON.
+   * SQL queries may use the $__startTime / $__endTime / $__startTimeMs /
+   * $__endTimeMs / $__rangeSeconds macros, replaced server-side with the
+   * dashboard's current time window.
+   */
+  query: string;
+
+  /*
+   * Optional legend template for chart series. Supports {{label}}
+   * placeholders resolved against each series' group keys (e.g. Prometheus
+   * label values). Absent ⇒ series are named from their group keys.
+   */
+  legend?: string | undefined;
+}
+
+/*
+ * What shape of result the widget wants back from the query endpoint.
+ * Charts/values/gauges consume time series; the table widget consumes rows.
+ */
+export enum DataSourceResultKind {
+  TimeSeries = "TimeSeries",
+  Table = "Table",
+}

package/Types/DataSource/DataSourceTableResult.ts

@@ -0,0 +1,38 @@
+import { JSONValue } from "../JSON";
+
+/*
+ * Column type hints let table widgets right-align numbers and format dates
+ * without sniffing every row. Connectors set these from driver metadata when
+ * available and fall back to inspecting the first row.
+ */
+export enum DataSourceTableColumnType {
+  Text = "Text",
+  Number = "Number",
+  Date = "Date",
+  Boolean = "Boolean",
+  Json = "Json",
+}
+
+export interface DataSourceTableColumn {
+  // Row-object key this column reads from.
+  key: string;
+  // Human-facing header; defaults to the key.
+  title: string;
+  type: DataSourceTableColumnType;
+}
+
+/*
+ * Normalized tabular result every connector's queryTable returns. Rows are
+ * plain JSON objects keyed by column key so the payload serializes straight
+ * through the API to the table widget.
+ */
+export default interface DataSourceTableResult {
+  columns: Array<DataSourceTableColumn>;
+  rows: Array<{ [key: string]: JSONValue }>;
+  /*
+   * True when the connector clamped the result at the row cap — the widget
+   * shows a truncation banner so users don't mistake a clamp for the full
+   * result set.
+   */
+  truncated?: boolean | undefined;
+}

package/Types/DataSource/DataSourceType.ts

@@ -0,0 +1,213 @@
+/*
+ * External systems a project-level Data Source can connect to. Dashboards
+ * bind widgets to a Data Source + a query written in that source's native
+ * query language (PromQL, SQL, LogQL, ES Query DSL, or a REST request
+ * descriptor), and the server-side connector for the type normalizes the
+ * response into the same shapes OneUptime's own widgets already consume.
+ */
+enum DataSourceType {
+  Prometheus = "Prometheus",
+  PostgreSQL = "PostgreSQL",
+  MySQL = "MySQL",
+  MicrosoftSqlServer = "Microsoft SQL Server",
+  ClickHouse = "ClickHouse",
+  Loki = "Loki",
+  Elasticsearch = "Elasticsearch",
+  RestApi = "REST API",
+}
+
+export default DataSourceType;
+
+/*
+ * What a type is used for, so the type picker can group hundreds of
+ * connectors into a handful of sections. Enum values are the section
+ * headings; DataSourceTypeCategories below fixes the display order.
+ */
+export enum DataSourceTypeCategory {
+  Metrics = "Metrics",
+  Logs = "Logs",
+  Databases = "Databases",
+  Search = "Search",
+  Api = "APIs",
+}
+
+export const DataSourceTypeCategories: Array<DataSourceTypeCategory> = [
+  DataSourceTypeCategory.Metrics,
+  DataSourceTypeCategory.Logs,
+  DataSourceTypeCategory.Databases,
+  DataSourceTypeCategory.Search,
+  DataSourceTypeCategory.Api,
+];
+
+export interface DataSourceTypeProps {
+  dataSourceType: DataSourceType;
+  title: string;
+  description: string;
+  category: DataSourceTypeCategory;
+  queryLanguageTitle: string;
+  queryPlaceholder: string;
+}
+
+export class DataSourceTypeUtil {
+  public static getAllDataSourceTypes(): Array<DataSourceType> {
+    return [
+      DataSourceType.Prometheus,
+      DataSourceType.PostgreSQL,
+      DataSourceType.MySQL,
+      DataSourceType.MicrosoftSqlServer,
+      DataSourceType.ClickHouse,
+      DataSourceType.Loki,
+      DataSourceType.Elasticsearch,
+      DataSourceType.RestApi,
+    ];
+  }
+
+  /*
+   * Sources reached over HTTP(S) at a base URL (Prometheus-compatible APIs,
+   * Loki, Elasticsearch, arbitrary REST endpoints). These require `url` on
+   * the Data Source and are queried through the SSRF-guarded HTTP client.
+   */
+  public static isHttpBasedType(dataSourceType: DataSourceType): boolean {
+    return [
+      DataSourceType.Prometheus,
+      DataSourceType.Loki,
+      DataSourceType.Elasticsearch,
+      DataSourceType.RestApi,
+    ].includes(dataSourceType);
+  }
+
+  /*
+   * Sources reached with a database driver over host/port. These require
+   * `databaseHost` (+ optionally port/databaseName/username/password) and
+   * run read-only guarded SQL.
+   */
+  public static isDatabaseType(dataSourceType: DataSourceType): boolean {
+    return [
+      DataSourceType.PostgreSQL,
+      DataSourceType.MySQL,
+      DataSourceType.MicrosoftSqlServer,
+      DataSourceType.ClickHouse,
+    ].includes(dataSourceType);
+  }
+
+  public static getCategory(
+    dataSourceType: DataSourceType,
+  ): DataSourceTypeCategory {
+    return DataSourceTypeUtil.getProps(dataSourceType).category;
+  }
+
+  /** Default port used to seed the settings form for database sources. */
+  public static getDefaultPort(dataSourceType: DataSourceType): number | null {
+    switch (dataSourceType) {
+      case DataSourceType.PostgreSQL:
+        return 5432;
+      case DataSourceType.MySQL:
+        return 3306;
+      case DataSourceType.MicrosoftSqlServer:
+        return 1433;
+      case DataSourceType.ClickHouse:
+        return 8123; // HTTP interface — the @clickhouse/client transport.
+      default:
+        return null;
+    }
+  }
+
+  public static getProps(dataSourceType: DataSourceType): DataSourceTypeProps {
+    switch (dataSourceType) {
+      case DataSourceType.Prometheus:
+        return {
+          dataSourceType,
+          title: "Prometheus",
+          description:
+            "Query a Prometheus-compatible API (Prometheus, Thanos, Cortex, Mimir, VictoriaMetrics) with PromQL.",
+          category: DataSourceTypeCategory.Metrics,
+          queryLanguageTitle: "PromQL",
+          queryPlaceholder: 'rate(http_requests_total{job="api"}[5m])',
+        };
+      case DataSourceType.PostgreSQL:
+        return {
+          dataSourceType,
+          title: "PostgreSQL",
+          description:
+            "Run read-only SQL against a PostgreSQL-compatible database (PostgreSQL, TimescaleDB, CockroachDB).",
+          category: DataSourceTypeCategory.Databases,
+          queryLanguageTitle: "SQL",
+          queryPlaceholder:
+            "SELECT created_at AS time, COUNT(*) AS value FROM orders WHERE created_at BETWEEN $__startTime AND $__endTime GROUP BY 1 ORDER BY 1",
+        };
+      case DataSourceType.MySQL:
+        return {
+          dataSourceType,
+          title: "MySQL",
+          description: "Run read-only SQL against a MySQL or MariaDB database.",
+          category: DataSourceTypeCategory.Databases,
+          queryLanguageTitle: "SQL",
+          queryPlaceholder:
+            "SELECT created_at AS time, COUNT(*) AS value FROM orders WHERE created_at BETWEEN $__startTime AND $__endTime GROUP BY 1 ORDER BY 1",
+        };
+      case DataSourceType.MicrosoftSqlServer:
+        return {
+          dataSourceType,
+          title: "Microsoft SQL Server",
+          description:
+            "Run read-only SQL against a Microsoft SQL Server or Azure SQL database.",
+          category: DataSourceTypeCategory.Databases,
+          queryLanguageTitle: "T-SQL",
+          queryPlaceholder:
+            "SELECT created_at AS time, COUNT(*) AS value FROM orders WHERE created_at BETWEEN $__startTime AND $__endTime GROUP BY created_at ORDER BY created_at",
+        };
+      case DataSourceType.ClickHouse:
+        return {
+          dataSourceType,
+          title: "ClickHouse",
+          description:
+            "Run read-only SQL against a ClickHouse database over its HTTP interface.",
+          category: DataSourceTypeCategory.Databases,
+          queryLanguageTitle: "SQL",
+          queryPlaceholder:
+            "SELECT toStartOfMinute(timestamp) AS time, count() AS value FROM events WHERE timestamp BETWEEN $__startTime AND $__endTime GROUP BY time ORDER BY time",
+        };
+      case DataSourceType.Loki:
+        return {
+          dataSourceType,
+          title: "Grafana Loki",
+          description:
+            "Query a Grafana Loki log aggregation endpoint with LogQL metric queries.",
+          category: DataSourceTypeCategory.Logs,
+          queryLanguageTitle: "LogQL",
+          queryPlaceholder: 'sum(rate({app="api"} |= "error" [5m]))',
+        };
+      case DataSourceType.Elasticsearch:
+        return {
+          dataSourceType,
+          title: "Elasticsearch",
+          description:
+            "Query an Elasticsearch or OpenSearch cluster with Query DSL (date-histogram aggregations for charts).",
+          category: DataSourceTypeCategory.Search,
+          queryLanguageTitle: "Query DSL (JSON)",
+          queryPlaceholder:
+            '{ "query": { "match_all": {} }, "aggs": { "over_time": { "date_histogram": { "field": "@timestamp", "fixed_interval": "1m" }, "aggs": { "value": { "value_count": { "field": "_id" } } } } } }',
+        };
+      case DataSourceType.RestApi:
+        return {
+          dataSourceType,
+          title: "REST API",
+          description:
+            "Fetch JSON from any HTTP(S) API and map fields into time series or tables.",
+          category: DataSourceTypeCategory.Api,
+          queryLanguageTitle: "Request (JSON)",
+          queryPlaceholder:
+            '{ "path": "/api/stats", "method": "GET", "rowsPath": "data.items", "timestampField": "time", "valueField": "count" }',
+        };
+      default:
+        return {
+          dataSourceType,
+          title: dataSourceType,
+          description: "",
+          category: DataSourceTypeCategory.Api,
+          queryLanguageTitle: "Query",
+          queryPlaceholder: "",
+        };
+    }
+  }
+}

package/Types/Date.ts

@@ -476,7 +476,12 @@ export default class OneUptimeDate {
   }
 
   public static getCurrentDate(): Date {
-    return moment().toDate();
+    /*
+     * Not moment().toDate(): this is called on per-record telemetry ingest
+     * paths, and a moment wrapper allocation per call is pure overhead for
+     * what is exactly `new Date()`.
+     */
+    return new Date();
   }
 
   public static fromNow(date: Date): string {
@@ -934,6 +939,17 @@ export default class OneUptimeDate {
     return this.getSecondsInDays(days) * 1000;
   }
 
+  public static getSecondsInHours(hours: PositiveNumber | number): number {
+    if (!(hours instanceof PositiveNumber)) {
+      hours = new PositiveNumber(hours);
+    }
+    return hours.positiveNumber * 60 * 60;
+  }
+
+  public static getMillisecondsInHours(hours: PositiveNumber | number): number {
+    return this.getSecondsInHours(hours) * 1000;
+  }
+
   public static getSomeHoursAgo(hours: PositiveNumber | number): Date {
     if (!(hours instanceof PositiveNumber)) {
       hours = new PositiveNumber(hours);
@@ -2067,9 +2083,33 @@ export default class OneUptimeDate {
     return date;
   }
 
+  /*
+   * Hand-rolled UTC "YYYY-MM-DD HH:mm:ss" formatter. The two Clickhouse
+   * formatters below run several times per ingested log / span / metric
+   * datapoint — millions of calls per minute on a busy worker — and a
+   * moment() wrapper plus format-token parsing per call is roughly an order
+   * of magnitude more expensive than reading the UTC fields directly.
+   * Output is byte-identical to moment's, including the "Invalid date"
+   * sentinel for NaN dates.
+   */
+  private static formatUtcClickhouseDateTime(date: Date): string {
+    if (Number.isNaN(date.getTime())) {
+      return "Invalid date";
+    }
+
+    const year: string = String(date.getUTCFullYear()).padStart(4, "0");
+    const month: string = String(date.getUTCMonth() + 1).padStart(2, "0");
+    const day: string = String(date.getUTCDate()).padStart(2, "0");
+    const hours: string = String(date.getUTCHours()).padStart(2, "0");
+    const minutes: string = String(date.getUTCMinutes()).padStart(2, "0");
+    const seconds: string = String(date.getUTCSeconds()).padStart(2, "0");
+
+    return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
+  }
+
   public static toClickhouseDateTime(date: Date | string): string {
     const parsedDate: Date = this.fromString(date);
-    return moment(parsedDate).utc().format("YYYY-MM-DD HH:mm:ss");
+    return this.formatUtcClickhouseDateTime(parsedDate);
   }
 
   public static toClickhouseDateTime64(
@@ -2077,7 +2117,7 @@ export default class OneUptimeDate {
     nanoTimestamp?: number,
   ): string {
     const parsedDate: Date = this.fromString(date);
-    const base: string = moment(parsedDate).utc().format("YYYY-MM-DD HH:mm:ss");
+    const base: string = this.formatUtcClickhouseDateTime(parsedDate);
 
     let nanoFraction: string;
 

package/Types/Password.ts

@@ -0,0 +1,64 @@
+/*
+ * The password rules, in one place, so the form that collects a password and
+ * the endpoint that stores it cannot disagree about what is acceptable.
+ *
+ * Every password form in OneUptime has historically carried its own inline
+ * `minLength: 6`, and no server-side check existed at all -- the browser was
+ * the only thing enforcing it. That is fine right up until a password arrives
+ * from somewhere that is not the browser, which is exactly what an admin API
+ * is. These constants and `getPasswordValidationError` live in Common/Types
+ * (not Common/Server) precisely so the browser can import them too.
+ */
+
+/*
+ * Six is the number every existing OneUptime password form already enforces
+ * (Accounts sign-up, Accounts reset-password, the user profile, the status
+ * page). It is stated here rather than raised so that adopting this module
+ * cannot lock out anyone whose current password was accepted under the old
+ * inline rule.
+ */
+export const MINIMUM_PASSWORD_LENGTH: number = 6;
+
+/*
+ * An upper bound, so a caller cannot hand the hasher an arbitrarily large
+ * string. It is not a security property -- scrypt's cost is set by N/r/p, not
+ * by input length -- it just keeps a pathological request from becoming work.
+ * 100 is far above any password a person types and far below anything that
+ * matters.
+ */
+export const MAXIMUM_PASSWORD_LENGTH: number = 100;
+
+/**
+ * Why this password is unacceptable, or null if it is fine.
+ *
+ * Returns a message rather than throwing so the same function can back a
+ * browser-side form validator and a server-side guard -- the server wraps the
+ * message in the exception type it wants to return.
+ *
+ * Length is measured on the raw value, NOT a trimmed one: a password is a
+ * secret the user typed, and silently trimming it would store something other
+ * than what they entered and then fail to match it at login. A value that is
+ * *only* whitespace is rejected outright, though -- that is a mistake, not a
+ * password.
+ */
+export function getPasswordValidationError(
+  password: string | undefined | null,
+): string | null {
+  if (password === undefined || password === null || password === "") {
+    return "Password is required.";
+  }
+
+  if (password.trim().length === 0) {
+    return "Password cannot be blank.";
+  }
+
+  if (password.length < MINIMUM_PASSWORD_LENGTH) {
+    return `Password cannot be less than ${MINIMUM_PASSWORD_LENGTH} characters.`;
+  }
+
+  if (password.length > MAXIMUM_PASSWORD_LENGTH) {
+    return `Password cannot be more than ${MAXIMUM_PASSWORD_LENGTH} characters.`;
+  }
+
+  return null;
+}

package/Types/Permission.ts

@@ -130,6 +130,13 @@ enum Permission {
   ReadDashboard = "ReadDashboard",
   EditDashboard = "EditDashboard",
 
+  // Data Sources (external systems dashboards can query)
+
+  CreateDataSource = "CreateDataSource",
+  DeleteDataSource = "DeleteDataSource",
+  ReadDataSource = "ReadDataSource",
+  EditDataSource = "EditDataSource",
+
   // Dashboard Domains
   CreateDashboardDomain = "CreateDashboardDomain",
   DeleteDashboardDomain = "DeleteDashboardDomain",
@@ -2498,6 +2505,45 @@ export class PermissionHelper {
         group: PermissionGroup.Settings,
       },
 
+      // Data Sources.
+
+      {
+        permission: Permission.CreateDataSource,
+        title: "Create Data Source",
+        description: "This permission can create Data Sources of this project",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Settings,
+      },
+      {
+        permission: Permission.DeleteDataSource,
+        title: "Delete Data Source",
+        description: "This permission can delete Data Sources of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Settings,
+      },
+      {
+        permission: Permission.EditDataSource,
+        title: "Edit Data Source",
+        description: "This permission can edit Data Sources of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Settings,
+      },
+      {
+        permission: Permission.ReadDataSource,
+        title: "Read Data Source",
+        description: "This permission can read Data Sources of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.Settings,
+      },
+
       // Dashboard Owner Team Permissions
       {
         permission: Permission.CreateDashboardOwnerTeam,

package/Types/UserAuthenticationStatus.ts

@@ -0,0 +1,34 @@
+/**
+ * What an operator needs to know about how one user can sign in, with nothing
+ * secret in it.
+ *
+ * `hasPassword` is a boolean rather than the column itself for a specific
+ * reason: the password column holds a scrypt digest, and a master admin
+ * bypasses column read permissions, so "just select it in the UI" would put
+ * every user's password hash in a browser's network tab. The only fact the
+ * Admin Dashboard needs is whether one is set at all.
+ *
+ * This lives in Common/Types rather than beside the service that builds it so
+ * that the page rendering it and the endpoint producing it are typed against
+ * the same declaration -- a renamed field then fails to compile instead of
+ * quietly rendering `undefined`.
+ */
+export default interface UserAuthenticationStatus {
+  // Can this user sign in with a password at all, or are they SSO-only?
+  hasPassword: boolean;
+
+  isEmailVerified: boolean;
+
+  /*
+   * Read from User.enableTwoFactorAuth, NOT the similarly named
+   * User.twoFactorAuthEnabled. Both columns exist; only `enableTwoFactorAuth`
+   * is the one login consults and the one the rest of the product writes.
+   * `twoFactorAuthEnabled` is a vestige of the initial migration that nothing
+   * reads -- reporting it here would tell an operator "2FA off" about a user
+   * who very much has it on.
+   */
+  isTwoFactorAuthEnabled: boolean;
+
+  // Is there an unexpired password-reset link outstanding for this user?
+  hasPendingPasswordResetLink: boolean;
+}

package/UI/Components/Button/Button.tsx

@@ -49,7 +49,7 @@ export interface ComponentProps {
   iconSize?: undefined | SizeProp;
   buttonStyle?: undefined | ButtonStyleType;
   buttonSize?: ButtonSize | undefined;
-  dataTestId?: string;
+  dataTestId?: string | undefined;
   className?: string | undefined;
   tooltip?: string | undefined;
   ariaLabel?: string | undefined;