@oneuptime/common 12.0.5 → 12.0.7

package/Server/Types/Database/DeleteById.ts

@@ -5,5 +5,7 @@ import User from "../../../Models/DatabaseModels/User";
 export default interface DeleteById {
   id: ObjectID;
   deletedByUser?: User;
+  // See DeleteOneBy.deletionReason - passed straight through to the hooks.
+  deletionReason?: string | undefined;
   props: DatabaseCommonInteractionProps;
 }

package/Server/Types/Database/DeleteOneBy.ts

@@ -6,5 +6,11 @@ import User from "../../../Models/DatabaseModels/User";
 export default interface DeleteOneBy<TBaseModel extends BaseModel> {
   query: Query<TBaseModel>;
   deletedByUser?: User | undefined;
+  /*
+   * Free-text reason the caller gave for the delete. Never persisted on the
+   * row being deleted (it is about to be gone) - it rides through to the
+   * delete hooks, which are the last place that can record it anywhere.
+   */
+  deletionReason?: string | undefined;
   props: DatabaseCommonInteractionProps;
 }

package/Server/Types/Database/Permissions/BasePermission.ts

@@ -32,6 +32,13 @@ export default class BasePermission {
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
   ): Promise<CheckPermissionBaseInterface<TBaseModel>> {
+    /*
+     * Permission checks add predicates and QueryUtil serializes values in
+     * place. Callers such as BaseAPI intentionally reuse the original query
+     * for list and count, so work on a fresh top-level object.
+     */
+    query = { ...query };
+
     const model: BaseModel = new modelType();
 
     if (props.isRoot || props.isMasterAdmin) {

package/Server/Types/Database/Permissions/DeletePermission.ts

@@ -34,6 +34,8 @@ export default class DeletePermission {
     query: Query<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    query = { ...query };
+
     if (props.isRoot || props.isMasterAdmin) {
       query = await PermissionUtil.addTenantScopeToQueryAsRoot(
         modelType,

package/Server/Types/Database/Permissions/ReadPermission.ts

@@ -29,6 +29,9 @@ export default class ReadPermission {
     select: Select<TBaseModel> | null,
     props: DatabaseCommonInteractionProps,
   ): Promise<CheckReadPermissionType<TBaseModel>> {
+    // Block and base permission checks both add predicates to the query.
+    query = { ...query };
+
     // check block permission first.
     await this.checkReadBlockPermission(modelType, query, props);
 

package/Server/Types/Database/Permissions/TenantPermission.ts

@@ -45,6 +45,40 @@ export default class TenantPermission {
       );
     }
 
+    const isAccessGrantedOnlyByCurrentUser: boolean =
+      TenantPermission.isAccessGrantedOnlyByCurrentUser(modelType, props, type);
+    const userColumn: string | null = model.getUserColumn();
+
+    /*
+     * CurrentUser is an auto-granted permission, not a tenant-wide role. A
+     * query operation that relies on it must declare an ownership column so
+     * the permission can be converted into a row predicate.
+     */
+    if (
+      isAccessGrantedOnlyByCurrentUser &&
+      type !== DatabaseRequestType.Create &&
+      !userColumn
+    ) {
+      throw new NotAuthorizedException(
+        `Current user scope is not configured for ${model.singularName}.`,
+      );
+    }
+
+    const shouldScopeQueryByCurrentUser: boolean =
+      isAccessGrantedOnlyByCurrentUser && Boolean(userColumn);
+
+    /*
+     * API keys and other non-user callers can carry the auto-granted
+     * CurrentUser permission without having a userId. Such a grant can never
+     * be converted into an ownership filter, so reject it instead of running
+     * the caller's query without a user scope.
+     */
+    if (shouldScopeQueryByCurrentUser && !props.userId) {
+      throw new NotAuthorizedException(
+        `A user session is required to ${type} ${model.singularName}.`,
+      );
+    }
+
     // If this model has a tenantColumn, and request has tenantId, and is multiTenantQuery null then add tenantId to query.
     if (tenantColumn && props.tenantId && !props.isMultiTenantRequest) {
       (query as any)[tenantColumn] = props.tenantId;
@@ -56,13 +90,12 @@ export default class TenantPermission {
        * row in the project (CVE-class issue when CurrentUser appears in a
        * model's delete/update list alongside admin permissions).
        */
-      if (
-        TenantPermission.shouldScopeQueryByCurrentUser(modelType, props, type)
-      ) {
-        const userColumn: string | null = model.getUserColumn();
-        if (userColumn) {
-          (query as any)[userColumn] = props.userId;
-        }
+      if (shouldScopeQueryByCurrentUser) {
+        TenantPermission.addCurrentUserScopeToQuery(
+          model,
+          query,
+          props.userId as ObjectID,
+        );
       }
     }
     // if model allows user query without tenant, and user column is present, and userId is present, then add userId to query.
@@ -71,7 +104,7 @@ export default class TenantPermission {
       model.getUserColumn() &&
       props.userId
     ) {
-      (query as any)[model.getUserColumn() as string] = props.userId;
+      TenantPermission.addCurrentUserScopeToQuery(model, query, props.userId);
     } else if (
       tenantColumn &&
       props.userGlobalAccessPermission &&
@@ -114,6 +147,7 @@ export default class TenantPermission {
       }
 
       let lastException: Error | null = null;
+      const queryForEachProject: Query<TBaseModel> = { ...query };
 
       for (const projectId of projectIDs) {
         if (!props.userId) {
@@ -124,7 +158,7 @@ export default class TenantPermission {
           const checkBasePermissions: CheckPermissionBaseInterface<TBaseModel> =
             await BasePermission.checkPermissions(
               modelType,
-              query,
+              { ...queryForEachProject },
               select,
               {
                 ...props,
@@ -154,25 +188,76 @@ export default class TenantPermission {
       return queries as any;
     }
 
+    /*
+     * A model that relies on CurrentUser must resolve that permission to the
+     * requester's exact ownership column. This catches missing decorators and
+     * prevents a future model misconfiguration from silently becoming an
+     * instance-wide query.
+     */
+    if (shouldScopeQueryByCurrentUser) {
+      const scopedUserId: unknown = (query as any)[userColumn as string];
+
+      if (
+        !TenantPermission.isExactUserScope(scopedUserId) ||
+        scopedUserId.toString() !== (props.userId as ObjectID).toString()
+      ) {
+        throw new NotAuthorizedException(
+          `Current user scope could not be applied to ${model.singularName}.`,
+        );
+      }
+    }
+
     return query;
   }
 
+  /**
+   * Add the authenticated user's ownership predicate without redirecting an
+   * operation that explicitly targeted another user. Rejecting a conflict is
+   * important because service hooks run before the final permission check;
+   * silently replacing the target would let a hook inspect one row and the
+   * database operation mutate a different one.
+   */
+  private static addCurrentUserScopeToQuery<TBaseModel extends BaseModel>(
+    model: BaseModel,
+    query: Query<TBaseModel>,
+    userId: ObjectID,
+  ): void {
+    const userColumn: string = model.getUserColumn() as string;
+    const existingUserScope: unknown = (query as any)[userColumn];
+
+    if (
+      existingUserScope !== undefined &&
+      (!TenantPermission.isExactUserScope(existingUserScope) ||
+        existingUserScope.toString() !== userId.toString())
+    ) {
+      throw new NotAuthorizedException(
+        `You do not have permission to access another user's ${model.singularName}.`,
+      );
+    }
+
+    (query as any)[userColumn] = userId;
+  }
+
+  /**
+   * Ownership filters must be exact scalar ids. Query operators such as
+   * NotEqual stringify to their wrapped id as well, so comparing only their
+   * string value would allow a broad hook query to masquerade as an exact
+   * current-user predicate.
+   */
+  private static isExactUserScope(value: unknown): value is string | ObjectID {
+    return typeof value === "string" || value instanceof ObjectID;
+  }
+
   /**
    * True if the only permission letting this user through the table-level
    * check for this op is Permission.CurrentUser. In that case the query must
    * be restricted to rows the user owns (via the model's user column).
    */
-  private static shouldScopeQueryByCurrentUser<TBaseModel extends BaseModel>(
+  private static isAccessGrantedOnlyByCurrentUser<TBaseModel extends BaseModel>(
     modelType: { new (): TBaseModel },
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
   ): boolean {
-    const model: BaseModel = new modelType();
-
-    if (!model.getUserColumn() || !props.userId) {
-      return false;
-    }
-
     const modelPermissions: Array<Permission> =
       TablePermission.getTablePermission(modelType, type);
 

package/Server/Types/Domain.ts

@@ -4,8 +4,49 @@ import { PromiseRejectErrorFunction } from "../../Types/FunctionTypes";
 import dns from "dns";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import BadDataException from "../../Types/Exception/BadDataException";
+import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
+import HTTPResponse from "../../Types/API/HTTPResponse";
+import { JSONObject } from "../../Types/JSON";
+import URL from "../../Types/API/URL";
+import API from "../../Utils/API";
+import DataSourceEgressGuard from "../Utils/DataSource/EgressGuard";
 
 export default class Domain extends DomainCommon {
+  /*
+   * GET a domain-verification URL built from a tenant-supplied domain.
+   *
+   * Both the status page and the dashboard build these URLs by interpolating
+   * a customer domain into a string, and the certificate cron re-fetches them
+   * unattended every 15 minutes — so the target has to be validated on every
+   * call, not just when the row was written. The address that was validated
+   * is pinned into the socket, and redirects are refused so a 3xx cannot
+   * bounce the request to a host that was never checked. (The callers try
+   * http first and https second, so the ordinary http→https redirect a
+   * customer proxy emits is still covered by the https attempt.)
+   *
+   * Private ranges stay reachable on self-hosted installs, where a status page
+   * domain legitimately resolves inside the corporate network.
+   */
+  @CaptureSpan()
+  public static async getForDomainVerification(data: {
+    url: string;
+    targetLabel: string;
+  }): Promise<HTTPErrorResponse | HTTPResponse<JSONObject>> {
+    const { httpAgent, httpsAgent } =
+      await DataSourceEgressGuard.assertUrlAllowedAndPin(data.url, {
+        targetLabel: data.targetLabel,
+      });
+
+    return API.get<JSONObject>({
+      url: URL.fromString(data.url),
+      options: {
+        doNotFollowRedirects: true,
+        httpAgent,
+        httpsAgent,
+      },
+    });
+  }
+
   @CaptureSpan()
   public static getCnameRecords(data: { domain: string }): Promise<string[]> {
     return new Promise(

package/Server/Types/Workflow/Components/API/Delete.ts

@@ -37,7 +37,7 @@ export default class ApiDelete extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -46,6 +46,7 @@ export default class ApiDelete extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       /*

package/Server/Types/Workflow/Components/API/Get.ts

@@ -37,7 +37,7 @@ export default class ApiGet extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -46,6 +46,7 @@ export default class ApiGet extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       /*

package/Server/Types/Workflow/Components/API/Patch.ts

@@ -37,7 +37,7 @@ export default class ApiPut extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -46,6 +46,7 @@ export default class ApiPut extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       /*

package/Server/Types/Workflow/Components/API/Post.ts

@@ -38,7 +38,7 @@ export default class ApiPost extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -77,6 +77,7 @@ export default class ApiPost extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       logger.debug("API Post Component is done.", workflowLogAttributes);

package/Server/Types/Workflow/Components/API/Put.ts

@@ -37,7 +37,7 @@ export default class ApiPut extends ComponentCode {
     options: RunOptions,
   ): Promise<RunReturnType> {
     const result: { args: JSONObject; successPort: Port; errorPort: Port } =
-      ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
+      await ApiComponentUtils.sanitizeArgs(this.getMetadata(), args, options);
 
     let apiResult: HTTPResponse<JSONObject> | HTTPErrorResponse | null = null;
 
@@ -46,6 +46,7 @@ export default class ApiPut extends ComponentCode {
         url: args["url"] as URL,
         data: args["request-body"] as JSONObject,
         headers: args["request-headers"] as Dictionary<string>,
+        options: ApiComponentUtils.requestOptions,
       });
 
       /*

package/Server/Types/Workflow/Components/API/Utils.ts

@@ -3,14 +3,27 @@ import HTTPErrorResponse from "../../../../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../../../../Types/API/HTTPResponse";
 import URL from "../../../../../Types/API/URL";
 import BadDataException from "../../../../../Types/Exception/BadDataException";
+import Exception from "../../../../../Types/Exception/Exception";
 import { JSONObject } from "../../../../../Types/JSON";
 import JSONFunctions from "../../../../../Types/JSONFunctions";
 import ComponentMetadata, {
   Port,
 } from "../../../../../Types/Workflow/Component";
+import { RequestOptions } from "../../../../../Utils/API";
+import SSRFProtection from "../../../../Utils/SSRFProtection";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
 
 export class ApiComponentUtils {
+  /*
+   * Every API component sends its request with these. Redirects MUST stay off:
+   * sanitizeArgs validates the URL before the request is dispatched, and a
+   * validated public host that answers 302 -> http://169.254.169.254/ would
+   * otherwise walk the server straight past that check.
+   */
+  public static readonly requestOptions: RequestOptions = {
+    doNotFollowRedirects: true,
+  };
+
   @CaptureSpan()
   public static getReturnValues(
     response: HTTPResponse<JSONObject> | HTTPErrorResponse,
@@ -33,11 +46,11 @@ export class ApiComponentUtils {
   }
 
   @CaptureSpan()
-  public static sanitizeArgs(
+  public static async sanitizeArgs(
     metadata: ComponentMetadata,
     args: JSONObject,
     options: RunOptions,
-  ): { args: JSONObject; successPort: Port; errorPort: Port } {
+  ): Promise<{ args: JSONObject; successPort: Port; errorPort: Port }> {
     const successPort: Port | undefined = metadata.outPorts.find((p: Port) => {
       return p.id === "success";
     });
@@ -77,6 +90,32 @@ export class ApiComponentUtils {
       throw options.onError(new BadDataException("URL is not type of string"));
     }
 
+    /*
+     * The URL is authored by whoever built the workflow - i.e. any member of
+     * any project - and the request goes out from the server, which sits
+     * inside the cluster and next to the cloud metadata endpoint. Without this
+     * check the API components are an authenticated request proxy into the
+     * private network: GET http://169.254.169.254/latest/meta-data/iam/... and
+     * the credentials come back in the component's "response-body" return
+     * value, in plain sight in the workflow log. Resolve and blocklist the
+     * target the same way outbound webhooks already do.
+     *
+     * Validate the RAW string, before URL.fromString - that parser defaults an
+     * unrecognized scheme to https, so "file:///etc/passwd" would reach the
+     * check already rewritten as host "file".
+     */
+    try {
+      await SSRFProtection.validateWebhookTargetIsSafe(args["url"] as string);
+    } catch (err) {
+      throw options.onError(
+        new BadDataException(
+          err instanceof Exception
+            ? err.message
+            : "URL points to an address that is not allowed.",
+        ),
+      );
+    }
+
     args["url"] = URL.fromString(args["url"] as string);
 
     return { args, successPort, errorPort };

package/Server/Types/Workflow/Components/BaseModel/CreateManyBaseModel.ts

@@ -10,6 +10,7 @@ import ComponentMetadata, {
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { applyTenantColumn } from "./ModelArguments";
 
 export default class CreateManyBaseModel<
   TBaseModel extends BaseModel,
@@ -91,25 +92,30 @@ export default class CreateManyBaseModel<
 
       const array: Array<TBaseModel> = [];
 
-      if (this.modelService.getModel().getTenantColumn()) {
-        for (const item of args["json-array"]) {
-          (item as JSONObject)[
-            this.modelService.getModel().getTenantColumn() as string
-          ] = options.projectId;
-
-          array.push(
-            (await this.modelService.create({
-              data: BaseModel.fromJSON<TBaseModel>(
-                (item as JSONObject) || {},
-                this.modelService.modelType,
-              ) as TBaseModel,
-              props: {
-                isRoot: true,
-                tenantId: options.projectId,
-              },
-            })) as TBaseModel,
-          );
-        }
+      /*
+       * This loop used to sit inside an `if (getTenantColumn())` check that
+       * was only meant to guard the projectId stamping, so a model without a
+       * tenant column created nothing at all and still reported success.
+       */
+      for (const item of args["json-array"]) {
+        const json: JSONObject = applyTenantColumn(
+          (item as JSONObject) || {},
+          this.modelService.getModel(),
+          options.projectId,
+        );
+
+        array.push(
+          (await this.modelService.create({
+            data: BaseModel.fromJSON<TBaseModel>(
+              json,
+              this.modelService.modelType,
+            ) as TBaseModel,
+            props: {
+              isRoot: true,
+              tenantId: options.projectId,
+            },
+          })) as TBaseModel,
+        );
       }
 
       return {

package/Server/Types/Workflow/Components/BaseModel/CreateOneBaseModel.ts

@@ -12,6 +12,7 @@ import ComponentMetadata, {
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
 import CaptureSpan from "../../../../Utils/Telemetry/CaptureSpan";
+import { applyTenantColumn } from "./ModelArguments";
 
 export default class CreateOneBaseModel<
   TBaseModel extends BaseModel,
@@ -90,11 +91,11 @@ export default class CreateOneBaseModel<
         );
       }
 
-      if (this.modelService.getModel().getTenantColumn()) {
-        (args["json"] as JSONObject)[
-          this.modelService.getModel().getTenantColumn() as string
-        ] = options.projectId;
-      }
+      args["json"] = applyTenantColumn(
+        args["json"] as JSONObject,
+        this.modelService.getModel(),
+        options.projectId,
+      );
 
       const model: TBaseModel = (await this.modelService.create({
         data: BaseModel.fromJSON<TBaseModel>(

package/Server/Types/Workflow/Components/BaseModel/DeleteManyBaseModel.ts

@@ -12,6 +12,8 @@ import ComponentMetadata, {
   Port,
 } from "../../../../../Types/Workflow/Component";
 import BaseModelComponents from "../../../../../Types/Workflow/Components/BaseModel";
+import { normalizeModelKeys } from "./ModelArguments";
+import logComponentError from "./LogComponentError";
 
 export default class DeleteManyBaseModel<
   TBaseModel extends BaseModel,
@@ -114,22 +116,26 @@ export default class DeleteManyBaseModel<
         args["limit"] = LIMIT_PER_PROJECT;
       }
 
+      const query: Query<TBaseModel> = JSONFunctions.deserialize(
+        normalizeModelKeys(
+          args["query"] as JSONObject,
+          this.modelService.getModel(),
+        ),
+      ) as Query<TBaseModel>;
+
+      /*
+       * The tenant column goes on the deserialized query, not on args["query"]
+       * - JSONFunctions.deserialize returns a new object, so anything written
+       * to args after it runs never reaches the database.
+       */
       if (this.modelService.getModel().getTenantColumn()) {
-        (args["query"] as JSONObject)[
+        (query as JSONObject)[
           this.modelService.getModel().getTenantColumn() as string
         ] = options.projectId;
       }
 
-      let query: Query<TBaseModel> = args["query"] as Query<TBaseModel>;
-
-      if (query) {
-        query = JSONFunctions.deserialize(
-          args["query"] as JSONObject,
-        ) as Query<TBaseModel>;
-      }
-
-      await this.modelService.deleteBy({
-        query: query || {},
+      const itemsDeleted: number = await this.modelService.deleteBy({
+        query: query,
         limit: new PositiveNumber(args["limit"] as number),
         skip: new PositiveNumber(args["skip"] as number),
         props: {
@@ -138,13 +144,25 @@ export default class DeleteManyBaseModel<
         },
       });
 
+      options.log(
+        `Deleted ${itemsDeleted} ${
+          this.modelService.getModel().singularName || "record"
+        }(s).`,
+      );
+
       return {
-        returnValues: {},
+        returnValues: {
+          "items-deleted": itemsDeleted,
+        },
         executePort: successPort,
       };
     } catch (err: any) {
-      options.log("Error running component");
-      options.log(err.message ? err.message : JSON.stringify(err, null, 2));
+      logComponentError({
+        error: err,
+        model: this.modelService?.getModel() || null,
+        log: options.log,
+      });
+
       return {
         returnValues: {},
         executePort: errorPort,