@oneuptime/common 12.0.5 → 12.0.7

package/Server/Services/UserService.ts

@@ -1,5 +1,6 @@
 import DatabaseConfig from "../DatabaseConfig";
 import {
+  EncryptionSecret,
   IsBillingEnabled,
   NotificationSlackWebhookOnCreateUser,
 } from "../EnvironmentConfig";
@@ -18,9 +19,12 @@ import UserNotificationSettingService from "./UserNotificationSettingService";
 import UserSessionService from "./UserSessionService";
 import { AccountsRoute } from "../../ServiceRoute";
 import Hostname from "../../Types/API/Hostname";
+import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
+import HTTPResponse from "../../Types/API/HTTPResponse";
 import Protocol from "../../Types/API/Protocol";
 import Route from "../../Types/API/Route";
 import URL from "../../Types/API/URL";
+import EmptyResponseData from "../../Types/API/EmptyResponse";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import OneUptimeDate from "../../Types/Date";
@@ -43,6 +47,9 @@ import UserTotpAuthService from "./UserTotpAuthService";
 import UserWebAuthn from "../../Models/DatabaseModels/UserWebAuthn";
 import UserWebAuthnService from "./UserWebAuthnService";
 import BadDataException from "../../Types/Exception/BadDataException";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import { getPasswordValidationError } from "../../Types/Password";
+import UserAuthenticationStatus from "../../Types/UserAuthenticationStatus";
 import Name from "../../Types/Name";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Timezone from "../../Types/Timezone";
@@ -267,9 +274,7 @@ export class Service extends DatabaseService<Model> {
           _id: true,
           email: true,
         },
-        props: {
-          isRoot: true,
-        },
+        props: updateBy.props,
         limit: LIMIT_MAX,
         skip: 0,
       });
@@ -286,9 +291,7 @@ export class Service extends DatabaseService<Model> {
           _id: true,
           email: true,
         },
-        props: {
-          isRoot: true,
-        },
+        props: updateBy.props,
         limit: LIMIT_MAX,
         skip: 0,
       });
@@ -343,9 +346,7 @@ export class Service extends DatabaseService<Model> {
       select: {
         _id: true,
       },
-      props: {
-        isRoot: true,
-      },
+      props: deleteBy.props,
       limit: LIMIT_MAX,
       skip: 0,
     });
@@ -725,6 +726,276 @@ export class Service extends DatabaseService<Model> {
     });
   }
 
+  /**
+   * How this user authenticates today, for an operator looking at their
+   * account. Runs as root because the caller is a master admin acting outside
+   * of any project, and is authorized by the route's middleware rather than by
+   * tenant permissions.
+   *
+   * Throws NotFoundException rather than returning null so that every caller
+   * reports "no such user" the same way instead of each inventing its own.
+   */
+  @CaptureSpan()
+  public async getAuthenticationStatus(
+    userId: ObjectID,
+  ): Promise<UserAuthenticationStatus> {
+    const user: Model | null = await this.findOneBy({
+      query: {
+        _id: userId,
+      },
+      select: {
+        _id: true,
+        password: true,
+        isEmailVerified: true,
+        enableTwoFactorAuth: true,
+        resetPasswordToken: true,
+        resetPasswordExpires: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!user) {
+      throw new NotFoundException("User not found.");
+    }
+
+    /*
+     * An expired token is not a pending link: the row keeps the token until
+     * something overwrites it, so "the column is set" on its own would report
+     * a link that /reset-password would refuse.
+     */
+    const hasPendingPasswordResetLink: boolean = Boolean(
+      user.resetPasswordToken &&
+        user.resetPasswordExpires &&
+        !OneUptimeDate.hasExpired(user.resetPasswordExpires),
+    );
+
+    return {
+      hasPassword: Boolean(user.password),
+      isEmailVerified: Boolean(user.isEmailVerified),
+      isTwoFactorAuthEnabled: Boolean(user.enableTwoFactorAuth),
+      hasPendingPasswordResetLink: hasPendingPasswordResetLink,
+    };
+  }
+
+  /**
+   * Set one user's password on their behalf. Used by the master-admin route
+   * behind Admin Dashboard > User > Authentication.
+   *
+   * Three things make this safe to expose:
+   *
+   *  - the plaintext is handed to the write path as an UNHASHED HashedString,
+   *    which is what makes `sanitizeCreateOrUpdate` mint a fresh per-user salt
+   *    and run scrypt over it. Pre-hashing here, or passing a bare string,
+   *    would be rejected by that same code (see DatabaseService's salted-column
+   *    guard) precisely because it would strand the row's salt;
+   *  - any outstanding reset link is invalidated in the SAME statement. A link
+   *    mailed before the admin intervened must not still be able to change the
+   *    password afterwards;
+   *  - session revocation and the "Password Changed." email are NOT done here.
+   *    `onUpdateSuccess` already does both for any update that carries a
+   *    password, and doing it again would send the user two identical emails.
+   */
+  @CaptureSpan()
+  public async setPassword(data: {
+    userId: ObjectID;
+    password: string;
+  }): Promise<void> {
+    const validationError: string | null = getPasswordValidationError(
+      data.password,
+    );
+
+    if (validationError) {
+      throw new BadDataException(validationError);
+    }
+
+    const user: Model | null = await this.findOneBy({
+      query: {
+        _id: data.userId,
+      },
+      select: {
+        _id: true,
+        email: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!user) {
+      throw new NotFoundException("User not found.");
+    }
+
+    await this.updateOneById({
+      id: user.id!,
+      data: {
+        password: new HashedString(data.password),
+        resetPasswordToken: null!,
+        resetPasswordExpires: null!,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    logger.info(
+      `Password set by a master admin for user: ${user.id!.toString()}`,
+    );
+  }
+
+  /**
+   * Mint a fresh password-reset link for a user and email it to them.
+   *
+   * Produces exactly the link the public /forgot-password endpoint produces --
+   * same token minting, same hashed-at-rest storage, same 24 hour expiry, same
+   * /accounts/reset-password/<token> shape -- so the link an operator sends
+   * from the Admin Dashboard is redeemed by the ordinary reset-password page
+   * with no second code path behind it. Identity's /forgot-password keeps its
+   * own copy of this because it differs around the edges (it finds the user by
+   * a typed email, refuses accounts with no password, and answers success
+   * without waiting for the mail); if either changes the token scheme, both
+   * must move together.
+   *
+   * Only the SHA-256 of the token is stored. The token itself exists just long
+   * enough to be put in the email, so a leaked database row cannot be replayed
+   * as a reset link. It is hashed unsalted on purpose: /reset-password looks
+   * the row up BY that hash, which a per-row salt would make impossible, and a
+   * generated ObjectID has enough entropy that there is nothing to guess.
+   */
+  @CaptureSpan()
+  public async sendPasswordResetLink(data: {
+    userId: ObjectID;
+  }): Promise<Email> {
+    const user: Model | null = await this.findOneBy({
+      query: {
+        _id: data.userId,
+      },
+      select: {
+        _id: true,
+        email: true,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!user) {
+      throw new NotFoundException("User not found.");
+    }
+
+    /*
+     * `email` is a NOT NULL column, so this is unreachable through the
+     * database -- it is here because the alternative is a non-null assertion
+     * on the address we are about to mail a password-reset link to, and being
+     * wrong about that would send the link somewhere unintended.
+     */
+    if (!user.email) {
+      throw new BadDataException(
+        "This user has no email address, so a password reset link cannot be sent to them.",
+      );
+    }
+
+    const token: string = ObjectID.generate().toString();
+
+    const hashedToken: string = await HashedString.hashValue(
+      token,
+      EncryptionSecret,
+    );
+
+    await this.updateOneById({
+      id: data.userId,
+      data: {
+        resetPasswordToken: hashedToken,
+        resetPasswordExpires: OneUptimeDate.getOneDayAfter(),
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const host: Hostname = await DatabaseConfig.getHost();
+    const httpProtocol: Protocol = await DatabaseConfig.getHttpProtocol();
+
+    const tokenVerifyUrl: string = new URL(
+      httpProtocol,
+      host,
+      new Route(AccountsRoute.toString()).addRoute("/reset-password/" + token),
+    ).toString();
+
+    /*
+     * Awaited, unlike most MailService calls in this file. The caller is a
+     * human who just pressed "send password reset link" and needs to be told
+     * if the instance cannot send mail -- reporting success and dropping the
+     * email would leave them waiting for a link that is never coming.
+     */
+    try {
+      const mailResponse: HTTPResponse<EmptyResponseData> =
+        await MailService.sendMail({
+          toEmail: user.email,
+          subject: "Password Reset Request for OneUptime",
+          templateType: EmailTemplateType.ForgotPassword,
+          vars: {
+            homeURL: new URL(httpProtocol, host).toString(),
+            tokenVerifyUrl: tokenVerifyUrl,
+          },
+        });
+
+      /*
+       * Awaiting is not enough on its own. MailService.sendMail is an HTTP
+       * call to the notification service, and the API client only REJECTS
+       * when no response came back at all (connection refused, timeout). A
+       * response that says no -- 400 "Global SMTP Config not found" on an
+       * instance with no mail set up, an auth failure, a rejected recipient --
+       * arrives as a RESOLVED HTTPErrorResponse, which type-checks as an
+       * HTTPResponse and would sail straight past a bare try/catch.
+       *
+       * That is the common failure, not the exotic one, so it has to be
+       * turned back into a throw for the rollback below to mean anything.
+       */
+      if (mailResponse instanceof HTTPErrorResponse) {
+        throw new BadDataException(
+          `Could not send the password reset email: ${mailResponse.message}`,
+        );
+      }
+    } catch (err) {
+      /*
+       * The token was written before the send, so a failed send would
+       * otherwise leave a live 24 hour link on the row that nobody ever
+       * received -- and the Authentication page would then report "reset link
+       * pending" directly underneath the error saying it could not be sent.
+       * Take it back off so the record matches what the operator was told.
+       *
+       * Best-effort, and it never masks the mail failure: that is the error
+       * worth reporting, and an orphaned token expires on its own anyway.
+       */
+      await this.updateOneById({
+        id: data.userId,
+        data: {
+          resetPasswordToken: null!,
+          resetPasswordExpires: null!,
+        },
+        props: {
+          isRoot: true,
+        },
+      }).catch((clearError: Error) => {
+        logger.error(
+          `Failed to clear the unsent password reset token for user ${data.userId.toString()}; it will expire on its own.`,
+        );
+        logger.error(clearError);
+      });
+
+      throw err;
+    }
+
+    logger.info(
+      `Password reset link sent by a master admin to user: ${data.userId.toString()}`,
+    );
+
+    // Returned so the caller can tell the operator where the link went.
+    return user.email;
+  }
+
   public async getTimezoneForUser(userId: ObjectID): Promise<Timezone | null> {
     const user: Model | null = await this.findOneBy({
       query: {

package/Server/Services/UserWebhookService.ts

@@ -1,6 +1,7 @@
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
 import UserNotificationRuleService from "./UserNotificationRuleService";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
@@ -8,8 +9,19 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import Model from "../../Models/DatabaseModels/UserWebhook";
 import URL from "../../Types/API/URL";
 import logger from "../Utils/Logger";
+import SSRFProtection from "../Utils/SSRFProtection";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * URL validation here used to be a hand-rolled copy of the SSRF blocklist that
+ * had drifted weaker than the original (it compared the host with the port
+ * still attached, and never resolved DNS). Everything that actually sends one
+ * of these webhooks goes through WebhookService, which calls
+ * SSRFProtection.validateWebhookTargetIsSafe — so the copy bought nothing and
+ * would have been read as "this is checked". Both hooks now call the same
+ * guard the sender does, which fails the write early instead of at delivery.
+ */
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -27,7 +39,7 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Webhook name is required");
     }
 
-    this.validateWebhookUrl(createBy.data.webhookUrl);
+    await SSRFProtection.validateWebhookTargetIsSafe(createBy.data.webhookUrl);
 
     return {
       createBy,
@@ -35,6 +47,26 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    /*
+     * Create-time validation on its own is not a control: the URL is
+     * editable afterwards.
+     */
+    const webhookUrl: unknown = updateBy.data.webhookUrl;
+
+    if (typeof webhookUrl === "string" || webhookUrl instanceof URL) {
+      await SSRFProtection.validateWebhookTargetIsSafe(webhookUrl);
+    }
+
+    return {
+      updateBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<Model>,
@@ -96,113 +128,6 @@ export class Service extends DatabaseService<Model> {
       carryForward: null,
     };
   }
-
-  private validateWebhookUrl(rawUrl: string): void {
-    let parsed: URL;
-    try {
-      parsed = URL.fromString(rawUrl);
-    } catch {
-      throw new BadDataException("Webhook URL is not a valid URL");
-    }
-
-    const protocolValue: string = parsed.protocol.toString().toLowerCase();
-    if (protocolValue !== "http://" && protocolValue !== "https://") {
-      throw new BadDataException(
-        "Webhook URL must use http or https protocol.",
-      );
-    }
-
-    const hostname: string = parsed.hostname.hostname.toLowerCase();
-
-    if (!hostname) {
-      throw new BadDataException("Webhook URL must include a host.");
-    }
-
-    if (isBlockedHostnameLiteral(hostname)) {
-      throw new BadDataException(
-        "Webhook URL points to a private, loopback, or link-local address and is not allowed.",
-      );
-    }
-  }
-}
-
-function isBlockedHostnameLiteral(hostname: string): boolean {
-  if (
-    hostname === "localhost" ||
-    hostname.endsWith(".localhost") ||
-    hostname === "metadata.google.internal"
-  ) {
-    return true;
-  }
-
-  // IPv4 literal check
-  const ipv4Match: RegExpMatchArray | null = hostname.match(
-    /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/,
-  );
-  if (ipv4Match) {
-    const octets: Array<number> = [
-      Number(ipv4Match[1]),
-      Number(ipv4Match[2]),
-      Number(ipv4Match[3]),
-      Number(ipv4Match[4]),
-    ];
-
-    if (
-      octets.some((o: number) => {
-        return o < 0 || o > 255;
-      })
-    ) {
-      return true;
-    }
-
-    // 0.0.0.0/8
-    if (octets[0] === 0) {
-      return true;
-    }
-    // 127.0.0.0/8 loopback
-    if (octets[0] === 127) {
-      return true;
-    }
-    // 10.0.0.0/8
-    if (octets[0] === 10) {
-      return true;
-    }
-    // 172.16.0.0/12
-    if (octets[0] === 172 && (octets[1]! & 0xf0) === 16) {
-      return true;
-    }
-    // 192.168.0.0/16
-    if (octets[0] === 192 && octets[1] === 168) {
-      return true;
-    }
-    // 169.254.0.0/16 link-local (incl. cloud metadata)
-    if (octets[0] === 169 && octets[1] === 254) {
-      return true;
-    }
-    // 100.64.0.0/10 carrier-grade NAT
-    if (octets[0] === 100 && (octets[1]! & 0xc0) === 64) {
-      return true;
-    }
-    return false;
-  }
-
-  // IPv6 literal — block loopback, link-local, unique-local
-  if (hostname.includes(":")) {
-    const stripped: string = hostname.replace(/^\[|\]$/g, "");
-    if (stripped === "::1" || stripped === "::") {
-      return true;
-    }
-    if (stripped.startsWith("fe80:") || stripped.startsWith("fe80::")) {
-      return true;
-    }
-    if (IPV6_UNIQUE_LOCAL_REGEX.test(stripped)) {
-      return true;
-    }
-  }
-
-  return false;
 }
 
-const IPV6_UNIQUE_LOCAL_REGEX: RegExp = /^f[cd][0-9a-f]{2}:/;
-
 export default new Service();

package/Server/Services/WorkspaceNotificationRuleService.ts

@@ -309,6 +309,20 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
 
             // Check for errors in the response
             if (res.errors && res.errors.length > 0) {
+              /*
+               * Record the failure before throwing. Test sends used to throw
+               * straight out of here, so a failed test left no trace in
+               * Notification Logs and support had no way to see what Microsoft
+               * or Slack actually said.
+               */
+              await this.logTestSendFailures({
+                projectId: data.projectId,
+                workspaceType: res.workspaceType,
+                errors: res.errors,
+                message: messageSummary,
+                userId: data.testByUserId,
+              });
+
               const errorMessages: Array<string> = res.errors.map(
                 (error: { channel: WorkspaceChannel; error: string }) => {
                   return `Channel ${error.channel.name}: ${error.error}`;
@@ -408,6 +422,20 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
 
             // Check for errors in the response
             if (res.errors && res.errors.length > 0) {
+              /*
+               * Record the failure before throwing. Test sends used to throw
+               * straight out of here, so a failed test left no trace in
+               * Notification Logs and support had no way to see what Microsoft
+               * or Slack actually said.
+               */
+              await this.logTestSendFailures({
+                projectId: data.projectId,
+                workspaceType: res.workspaceType,
+                errors: res.errors,
+                message: messageSummary,
+                userId: data.testByUserId,
+              });
+
               const errorMessages: Array<string> = res.errors.map(
                 (error: { channel: WorkspaceChannel; error: string }) => {
                   return `Channel ${error.channel.name}: ${error.error}`;
@@ -540,6 +568,47 @@ export class Service extends DatabaseService<WorkspaceNotificationRule> {
     }
   }
 
+  /*
+   * Persist per-destination failures from a test send so they show up in
+   * Settings > Notification Logs alongside real notification failures. Real
+   * sends already log; test sends threw before reaching any logging, which
+   * meant the one action an admin takes to diagnose a broken integration was
+   * also the only one that recorded nothing.
+   *
+   * Best-effort: a logging failure must never mask the underlying send error.
+   */
+  @CaptureSpan()
+  private async logTestSendFailures(data: {
+    projectId: ObjectID;
+    workspaceType: WorkspaceType;
+    errors: Array<{ channel: WorkspaceChannel; error: string }>;
+    message: string;
+    userId: ObjectID;
+  }): Promise<void> {
+    for (const error of data.errors) {
+      try {
+        const log: WorkspaceNotificationLog = new WorkspaceNotificationLog();
+        log.projectId = data.projectId;
+        log.workspaceType = data.workspaceType;
+        log.channelId = error.channel.id;
+        log.channelName = error.channel.name;
+        log.message = data.message;
+        log.status = WorkspaceNotificationStatus.Error;
+        log.statusMessage = error.error;
+        log.userId = data.userId;
+        log.actionType = WorkspaceNotificationActionType.SendMessage;
+
+        await WorkspaceNotificationLogService.create({
+          data: log,
+          props: { isRoot: true },
+        });
+      } catch (err) {
+        logger.error("Could not write test-send failure to notification log:");
+        logger.error(err);
+      }
+    }
+  }
+
   @CaptureSpan()
   public async archiveWorkspaceChannels(data: {
     projectId: ObjectID;

package/Server/Services/WorkspaceProjectAuthTokenService.ts

@@ -1,5 +1,7 @@
 import ObjectID from "../../Types/ObjectID";
-import WorkspaceType from "../../Types/Workspace/WorkspaceType";
+import WorkspaceType, {
+  getWorkspaceTypeDisplayName,
+} from "../../Types/Workspace/WorkspaceType";
 import DatabaseService from "./DatabaseService";
 import Model, {
   WorkspaceMiscData,
@@ -7,6 +9,7 @@ import Model, {
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -112,12 +115,45 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         _id: true,
+        workspaceProjectId: true,
       },
       props: {
         isRoot: true,
       },
     });
 
+    /*
+     * A project stores exactly one workspace (one Microsoft tenant / one Slack
+     * team). Re-running the connect flow from a DIFFERENT workspace used to
+     * silently repoint the project, which breaks every existing notification
+     * rule and orphans the bot conversations captured under the old workspace —
+     * with no error and nothing in the logs.
+     *
+     * Refuse instead, and tell the admin to disconnect first if the change is
+     * deliberate.
+     */
+    if (
+      projectAuth &&
+      projectAuth.workspaceProjectId &&
+      projectAuth.workspaceProjectId !== data.workspaceProjectId
+    ) {
+      logger.error(
+        `Refusing to repoint ${data.workspaceType} for project ${data.projectId.toString()} from workspace ${projectAuth.workspaceProjectId} to ${data.workspaceProjectId}.`,
+        {
+          projectId: data.projectId.toString(),
+          workspaceType: data.workspaceType,
+        },
+      );
+
+      const workspaceName: string = getWorkspaceTypeDisplayName(
+        data.workspaceType,
+      );
+
+      throw new BadDataException(
+        `This OneUptime project is already connected to a different ${workspaceName} workspace. Disconnect the existing ${workspaceName} connection in Project Settings before connecting a new one.`,
+      );
+    }
+
     if (!projectAuth) {
       projectAuth = new Model();