@oneuptime/common 12.0.5 → 12.0.6

package/Server/Utils/DataSource/Connectors/MySqlConnector.ts

@@ -0,0 +1,307 @@
+import {
+  ConnectionOptions,
+  createConnection,
+  Connection,
+} from "mysql2/promise";
+import AggregatedResult from "../../../../Types/BaseDatabase/AggregatedResult";
+import {
+  DATA_SOURCE_CONNECT_TIMEOUT_IN_MS,
+  DATA_SOURCE_MAX_TABLE_ROWS,
+  DATA_SOURCE_MAX_TIME_SERIES_ROWS,
+  DATA_SOURCE_QUERY_TIMEOUT_IN_MS,
+} from "../../../../Types/DataSource/DataSourceLimits";
+import DataSourceTableResult from "../../../../Types/DataSource/DataSourceTableResult";
+import DataSourceType from "../../../../Types/DataSource/DataSourceType";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import DataSourceEgressGuard from "../EgressGuard";
+import SqlQueryGuard from "../SqlQueryGuard";
+import SqlResultShaper from "../SqlResultShaper";
+import {
+  DataSourceConnectionSettings,
+  DataSourceConnector,
+  DataSourceQueryWindow,
+} from "../Types";
+
+/*
+ * MySQL / MariaDB connector for external Data Sources.
+ *
+ * Read-only enforcement is layered:
+ *  1. SqlQueryGuard.assertReadOnlyQuery rejects anything that is not a
+ *     single read-only statement BEFORE a connection is opened;
+ *  2. the driver runs with multipleStatements: false so stacked statements
+ *     can never execute even if the classifier were bypassed;
+ *  3. the user's query runs inside START TRANSACTION READ ONLY, so the
+ *     server itself rejects writes regardless of the query text.
+ */
+
+/*
+ * Minimal surface of a mysql2 promise connection the connector uses —
+ * doubles as the DI seam so tests can substitute a scripted fake without
+ * touching a real server. Result rows are element [0] of the query tuple.
+ */
+export interface MySqlConnectionLike {
+  query(sql: string): Promise<[unknown, unknown]>;
+  end(): Promise<void>;
+  destroy(): void;
+}
+
+export type MySqlConnectionFactory = (
+  options: ConnectionOptions,
+) => Promise<MySqlConnectionLike>;
+
+const defaultConnectionFactory: MySqlConnectionFactory = async (
+  options: ConnectionOptions,
+): Promise<MySqlConnectionLike> => {
+  const connection: Connection = await createConnection(options);
+  return {
+    query: async (sql: string): Promise<[unknown, unknown]> => {
+      const result: [unknown, unknown] = (await connection.query(sql)) as [
+        unknown,
+        unknown,
+      ];
+      return result;
+    },
+    end: (): Promise<void> => {
+      return connection.end();
+    },
+    destroy: (): void => {
+      connection.destroy();
+    },
+  };
+};
+
+export default class MySqlConnector implements DataSourceConnector {
+  public dataSourceType: DataSourceType = DataSourceType.MySQL;
+
+  private connectionFactory: MySqlConnectionFactory;
+
+  public constructor(connectionFactory?: MySqlConnectionFactory) {
+    this.connectionFactory = connectionFactory || defaultConnectionFactory;
+  }
+
+  public async testConnection(
+    settings: DataSourceConnectionSettings,
+  ): Promise<void> {
+    const connection: MySqlConnectionLike = await this.connect(settings);
+    try {
+      await connection.query("SELECT 1");
+    } catch (error) {
+      throw new BadDataException(
+        SqlResultShaper.sanitizeError(error, this.getSecrets(settings)),
+      );
+    } finally {
+      await this.closeConnection(connection);
+    }
+  }
+
+  public async queryTimeSeries(
+    settings: DataSourceConnectionSettings,
+    query: string,
+    window: DataSourceQueryWindow,
+  ): Promise<AggregatedResult> {
+    const rows: Array<Record<string, unknown>> = await this.runReadOnlyQuery(
+      settings,
+      query,
+      window,
+      DATA_SOURCE_MAX_TIME_SERIES_ROWS,
+    );
+    return SqlResultShaper.rowsToTimeSeries(rows, {
+      maxRows: DATA_SOURCE_MAX_TIME_SERIES_ROWS,
+    });
+  }
+
+  public async queryTable(
+    settings: DataSourceConnectionSettings,
+    query: string,
+    window: DataSourceQueryWindow,
+  ): Promise<DataSourceTableResult> {
+    const rows: Array<Record<string, unknown>> = await this.runReadOnlyQuery(
+      settings,
+      query,
+      window,
+      DATA_SOURCE_MAX_TABLE_ROWS,
+    );
+    return SqlResultShaper.rowsToTable(rows, {
+      maxRows: DATA_SOURCE_MAX_TABLE_ROWS,
+    });
+  }
+
+  private getSecrets(
+    settings: DataSourceConnectionSettings,
+  ): Array<string | undefined> {
+    return [
+      settings.password,
+      settings.apiToken,
+      settings.databaseHost,
+      settings.username,
+    ];
+  }
+
+  private buildConnectionOptions(
+    settings: DataSourceConnectionSettings,
+  ): ConnectionOptions {
+    const options: ConnectionOptions = {
+      host: settings.databaseHost!,
+      port: settings.databasePort ?? 3306,
+      connectTimeout: DATA_SOURCE_CONNECT_TIMEOUT_IN_MS,
+      /*
+       * NEVER true: stacked statements ("SELECT 1; DROP TABLE x") must be
+       * impossible at the driver level, as defense in depth beneath the
+       * SqlQueryGuard classifier and the read-only transaction.
+       */
+      multipleStatements: false,
+    };
+
+    if (settings.databaseName !== undefined) {
+      options.database = settings.databaseName;
+    }
+    if (settings.username !== undefined) {
+      options.user = settings.username;
+    }
+    if (settings.password !== undefined) {
+      options.password = settings.password;
+    }
+
+    if (settings.additionalOptions?.["sslEnabled"] === true) {
+      /*
+       * Certificate verification stays ON by default; only an explicit
+       * sslRejectUnauthorized === false disables it.
+       */
+      options.ssl = {
+        rejectUnauthorized:
+          settings.additionalOptions?.["sslRejectUnauthorized"] !== false,
+      };
+    }
+
+    return options;
+  }
+
+  /*
+   * Egress-validate the host, then open a driver connection. Called only
+   * after the query (when there is one) has already passed the read-only
+   * guard, so a rejected query never even dials the server.
+   */
+  private async connect(
+    settings: DataSourceConnectionSettings,
+  ): Promise<MySqlConnectionLike> {
+    if (!settings.databaseHost) {
+      throw new BadDataException(
+        "MySQL data source is missing a database host. Set the host in the data source settings.",
+      );
+    }
+
+    /*
+     * SSRF guard — must pass BEFORE any socket is opened towards the
+     * configured host.
+     */
+    await DataSourceEgressGuard.assertHostnameAllowed(settings.databaseHost);
+
+    const options: ConnectionOptions = this.buildConnectionOptions(settings);
+
+    try {
+      return await this.connectionFactory(options);
+    } catch (error) {
+      throw new BadDataException(
+        SqlResultShaper.sanitizeError(error, this.getSecrets(settings)),
+      );
+    }
+  }
+
+  /*
+   * Teardown: roll the read-only transaction back (harmless when none is
+   * open), then close. Every step is guarded — a wedged server must not
+   * turn cleanup into an unhandled rejection — with destroy() as the
+   * hard fallback when a graceful end() fails.
+   */
+  private async closeConnection(
+    connection: MySqlConnectionLike,
+  ): Promise<void> {
+    try {
+      await connection.query("ROLLBACK");
+    } catch {
+      /* Best effort — the transaction may already be gone. */
+    }
+
+    try {
+      await connection.end();
+    } catch {
+      try {
+        connection.destroy();
+      } catch {
+        /* Best effort — the socket may already be gone. */
+      }
+    }
+  }
+
+  private async runReadOnlyQuery(
+    settings: DataSourceConnectionSettings,
+    query: string,
+    window: DataSourceQueryWindow,
+    maxRows: number,
+  ): Promise<Array<Record<string, unknown>>> {
+    const withMacros: string = SqlQueryGuard.applyTimeMacros(
+      query,
+      window.startDate,
+      window.endDate,
+    );
+
+    /*
+     * The read-only classifier runs on the USER's query only. The session
+     * SET statements issued below are our own fixed strings and never pass
+     * through this guard — the guard's ban on the SET keyword applies to
+     * user queries, not to the connector's session setup.
+     */
+    SqlQueryGuard.assertReadOnlyQuery(withMacros);
+
+    /* Drop a trailing semicolon; the statement runs bare. */
+    const finalSql: string = withMacros.replace(/;\s*$/, "");
+
+    const connection: MySqlConnectionLike = await this.connect(settings);
+
+    try {
+      /*
+       * Best-effort server-side statement timeout. MAX_EXECUTION_TIME
+       * (milliseconds, SELECT-only) exists on MySQL 5.7.8+; MariaDB uses
+       * max_statement_time in seconds instead, so this statement can fail
+       * there — swallow the error and rely on the engine defaults rather
+       * than failing the query.
+       */
+      try {
+        await connection.query(
+          `SET SESSION MAX_EXECUTION_TIME = ${DATA_SOURCE_QUERY_TIMEOUT_IN_MS}`,
+        );
+      } catch {
+        /* Non-fatal — variable unknown on MariaDB and older MySQL. */
+      }
+
+      /*
+       * Server-side row bound at cap+1 so the shaper can detect truncation.
+       * An explicit LIMIT in the user's query takes precedence over
+       * SQL_SELECT_LIMIT; the shaper's maxRows clamp is the authoritative
+       * cap either way.
+       */
+      await connection.query(`SET SESSION SQL_SELECT_LIMIT = ${maxRows + 1}`);
+
+      /*
+       * Server-enforced read-only guarantee, independent of the query text
+       * classifier.
+       */
+      await connection.query("START TRANSACTION READ ONLY");
+
+      const result: [unknown, unknown] = await connection.query(finalSql);
+      const rows: unknown = result[0];
+      return Array.isArray(rows)
+        ? (rows as Array<Record<string, unknown>>)
+        : [];
+    } catch (error) {
+      if (error instanceof BadDataException) {
+        throw error;
+      }
+      throw new BadDataException(
+        SqlResultShaper.sanitizeError(error, this.getSecrets(settings)),
+      );
+    } finally {
+      await this.closeConnection(connection);
+    }
+  }
+}

package/Server/Utils/DataSource/Connectors/PostgresConnector.ts

@@ -0,0 +1,260 @@
+import { Client, ClientConfig } from "pg";
+import AggregatedResult from "../../../../Types/BaseDatabase/AggregatedResult";
+import {
+  DATA_SOURCE_CONNECT_TIMEOUT_IN_MS,
+  DATA_SOURCE_MAX_TABLE_ROWS,
+  DATA_SOURCE_MAX_TIME_SERIES_ROWS,
+  DATA_SOURCE_QUERY_TIMEOUT_IN_MS,
+} from "../../../../Types/DataSource/DataSourceLimits";
+import DataSourceTableResult from "../../../../Types/DataSource/DataSourceTableResult";
+import DataSourceType from "../../../../Types/DataSource/DataSourceType";
+import BadDataException from "../../../../Types/Exception/BadDataException";
+import DataSourceEgressGuard from "../EgressGuard";
+import SqlQueryGuard from "../SqlQueryGuard";
+import SqlResultShaper from "../SqlResultShaper";
+import {
+  DataSourceConnector,
+  DataSourceConnectionSettings,
+  DataSourceQueryWindow,
+} from "../Types";
+
+/*
+ * PostgreSQL Data Source connector.
+ *
+ * Read-only enforcement is layered: the SqlQueryGuard classifier rejects
+ * anything that is not a single read-only statement BEFORE a connection is
+ * opened, and the query then runs inside a server-enforced READ ONLY
+ * transaction (which also blocks writable CTEs the classifier cannot see).
+ * Rows are capped server-side with a NO SCROLL cursor + bounded FETCH so an
+ * unbounded query never materializes on the OneUptime API server — the same
+ * technique the probe's SqlMonitor uses.
+ */
+
+/*
+ * Structural subset of pg's Client used by this connector. The constructor
+ * accepts a factory producing this shape so tests can inject a fake client
+ * and record every statement without touching a real database.
+ */
+export interface PgClientLike {
+  connect(): Promise<void>;
+  query(text: string): Promise<{ rows: Array<Record<string, unknown>> }>;
+  end(): Promise<void>;
+}
+
+export type PgClientFactory = (config: ClientConfig) => PgClientLike;
+
+const CURSOR_NAME: string = "oneuptime_data_source_cursor";
+
+export default class PostgresConnector implements DataSourceConnector {
+  public dataSourceType: DataSourceType = DataSourceType.PostgreSQL;
+
+  private clientFactory: PgClientFactory;
+
+  public constructor(clientFactory?: PgClientFactory) {
+    this.clientFactory =
+      clientFactory ||
+      ((config: ClientConfig): PgClientLike => {
+        /*
+         * Wrap the driver client: pg's Client.connect() resolves with the
+         * Client instance, but the seam promises void — adapt instead of
+         * widening the interface every fake must implement.
+         */
+        const client: Client = new Client(config);
+        return {
+          connect: async (): Promise<void> => {
+            await client.connect();
+          },
+          query: (
+            text: string,
+          ): Promise<{ rows: Array<Record<string, unknown>> }> => {
+            return client.query(text);
+          },
+          end: (): Promise<void> => {
+            return client.end();
+          },
+        };
+      });
+  }
+
+  public async testConnection(
+    settings: DataSourceConnectionSettings,
+  ): Promise<void> {
+    await this.assertEgressAllowed(settings);
+
+    const client: PgClientLike = this.clientFactory(
+      this.buildClientConfig(settings),
+    );
+
+    try {
+      await client.connect();
+      await client.query("SELECT 1");
+    } catch (error) {
+      throw this.toBadDataException(error, settings);
+    } finally {
+      try {
+        await client.end();
+      } catch {
+        // Best effort — the socket may never have opened.
+      }
+    }
+  }
+
+  public async queryTimeSeries(
+    settings: DataSourceConnectionSettings,
+    query: string,
+    window: DataSourceQueryWindow,
+  ): Promise<AggregatedResult> {
+    const rows: Array<Record<string, unknown>> = await this.fetchRows(
+      settings,
+      query,
+      window,
+      DATA_SOURCE_MAX_TIME_SERIES_ROWS,
+    );
+
+    return SqlResultShaper.rowsToTimeSeries(rows, {
+      maxRows: DATA_SOURCE_MAX_TIME_SERIES_ROWS,
+    });
+  }
+
+  public async queryTable(
+    settings: DataSourceConnectionSettings,
+    query: string,
+    window: DataSourceQueryWindow,
+  ): Promise<DataSourceTableResult> {
+    const rows: Array<Record<string, unknown>> = await this.fetchRows(
+      settings,
+      query,
+      window,
+      DATA_SOURCE_MAX_TABLE_ROWS,
+    );
+
+    return SqlResultShaper.rowsToTable(rows, {
+      maxRows: DATA_SOURCE_MAX_TABLE_ROWS,
+    });
+  }
+
+  /*
+   * Validate the target host through the SSRF egress guard. MUST run before
+   * any connection is opened (test and query alike).
+   */
+  private async assertEgressAllowed(
+    settings: DataSourceConnectionSettings,
+  ): Promise<void> {
+    if (!settings.databaseHost) {
+      throw new BadDataException(
+        "Database host is required for a PostgreSQL data source.",
+      );
+    }
+
+    await DataSourceEgressGuard.assertHostnameAllowed(settings.databaseHost);
+  }
+
+  private buildClientConfig(
+    settings: DataSourceConnectionSettings,
+  ): ClientConfig {
+    const sslEnabled: boolean =
+      settings.additionalOptions?.["sslEnabled"] === true;
+    const sslRejectUnauthorized: boolean =
+      settings.additionalOptions?.["sslRejectUnauthorized"] !== false;
+
+    return {
+      host: settings.databaseHost,
+      port: settings.databasePort ?? 5432,
+      database: settings.databaseName ?? "postgres",
+      user: settings.username,
+      password: settings.password,
+      connectionTimeoutMillis: DATA_SOURCE_CONNECT_TIMEOUT_IN_MS,
+      // Server-side per-statement cap (primary timeout control).
+      statement_timeout: DATA_SOURCE_QUERY_TIMEOUT_IN_MS,
+      // Client-side backstop in case the server ignores statement_timeout.
+      query_timeout: DATA_SOURCE_QUERY_TIMEOUT_IN_MS + 2000,
+      application_name: "OneUptime-DataSource",
+      ssl: sslEnabled ? { rejectUnauthorized: sslRejectUnauthorized } : false,
+    };
+  }
+
+  private toBadDataException(
+    error: unknown,
+    settings: DataSourceConnectionSettings,
+  ): BadDataException {
+    if (error instanceof BadDataException) {
+      return error;
+    }
+
+    return new BadDataException(
+      SqlResultShaper.sanitizeError(error, [
+        settings.password,
+        settings.apiToken,
+        settings.databaseHost,
+        settings.username,
+      ]),
+    );
+  }
+
+  /*
+   * Open a connection, run the (macro-expanded, read-only-verified) query
+   * inside a READ ONLY transaction and read at most maxRows+1 rows through a
+   * server-side cursor — the +1 lets the shaper detect truncation. The
+   * transaction is always rolled back and the connection always closed.
+   */
+  private async fetchRows(
+    settings: DataSourceConnectionSettings,
+    query: string,
+    window: DataSourceQueryWindow,
+    maxRows: number,
+  ): Promise<Array<Record<string, unknown>>> {
+    await this.assertEgressAllowed(settings);
+
+    const finalSql: string = SqlQueryGuard.applyTimeMacros(
+      query,
+      window.startDate,
+      window.endDate,
+    );
+    SqlQueryGuard.assertReadOnlyQuery(finalSql);
+
+    // Strip trailing terminators so the SQL embeds in DECLARE ... CURSOR.
+    const cursorSql: string = finalSql.replace(/;+\s*$/g, "").trim();
+
+    const client: PgClientLike = this.clientFactory(
+      this.buildClientConfig(settings),
+    );
+
+    try {
+      await client.connect();
+
+      /*
+       * Server-enforced read-only guarantee: a READ ONLY transaction blocks
+       * all writes — including writable CTEs — regardless of the query text.
+       */
+      await client.query("START TRANSACTION READ ONLY");
+      await client.query(
+        `SET LOCAL statement_timeout = ${Math.floor(
+          DATA_SOURCE_QUERY_TIMEOUT_IN_MS,
+        )}`,
+      );
+
+      await client.query(
+        `DECLARE ${CURSOR_NAME} NO SCROLL CURSOR FOR ${cursorSql}`,
+      );
+
+      const result: { rows: Array<Record<string, unknown>> } =
+        await client.query(`FETCH FORWARD ${maxRows + 1} FROM ${CURSOR_NAME}`);
+
+      return result.rows || [];
+    } catch (error) {
+      throw this.toBadDataException(error, settings);
+    } finally {
+      try {
+        await client.query("ROLLBACK");
+      } catch {
+        // Best effort — the transaction may never have started.
+      }
+
+      try {
+        await client.end();
+      } catch {
+        // Best effort — the socket may already be gone.
+      }
+    }
+  }
+}