@oneuptime/common 12.0.5 → 12.0.7

package/Server/API/DataSourceAPI.ts

@@ -0,0 +1,268 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import CommonAPI from "./CommonAPI";
+import DataSourceService, {
+  Service as DataSourceServiceType,
+} from "../Services/DataSourceService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import BaseAPI from "./BaseAPI";
+import DataSource from "../../Models/DatabaseModels/DataSource";
+import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { JSONObject } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
+import AggregatedResult from "../../Types/BaseDatabase/AggregatedResult";
+import DataSourceTableResult from "../../Types/DataSource/DataSourceTableResult";
+import { DataSourceResultKind } from "../../Types/DataSource/DataSourceQueryConfig";
+import {
+  DataSourceConnectionSettings,
+  DataSourceConnector,
+} from "../Utils/DataSource/Types";
+import ConnectorRegistry from "../Utils/DataSource/ConnectorRegistry";
+import logger from "../Utils/Logger";
+
+/*
+ * Upper bound on stored/ad-hoc query text. Real PromQL/SQL/DSL queries are
+ * a few KB; anything beyond this is abuse or a mistake.
+ */
+const MAX_QUERY_LENGTH: number = 100_000;
+
+export default class DataSourceAPI extends BaseAPI<
+  DataSource,
+  DataSourceServiceType
+> {
+  public constructor() {
+    super(DataSource, DataSourceService);
+
+    /*
+     * Test a data source's connectivity + credentials. Authenticated
+     * users only; access is checked by reading the record with the
+     * caller's own permissions before any root read of credentials.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/test`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const body: JSONObject = req.body;
+
+          const dataSource: DataSource = await this.getAccessibleDataSource({
+            req,
+            dataSourceId: body["dataSourceId"] as string,
+          });
+
+          const settings: DataSourceConnectionSettings =
+            await this.getConnectionSettings(dataSource);
+
+          const connector: DataSourceConnector = ConnectorRegistry.getConnector(
+            settings.dataSourceType,
+          );
+
+          try {
+            await connector.testConnection(settings);
+          } catch (err) {
+            logger.error(err);
+            return Response.sendJsonObjectResponse(req, res, {
+              ok: false,
+              message: this.toFriendlyErrorMessage(err),
+            });
+          }
+
+          return Response.sendJsonObjectResponse(req, res, {
+            ok: true,
+            message: "Connection successful.",
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
+    /*
+     * Execute a query against a data source and return normalized time
+     * series (for chart/value/gauge widgets) or rows (for the table
+     * widget).
+     *
+     * SECURITY: authenticated project users only — this route must NEVER
+     * be reachable from the anonymous public-dashboard surface, because
+     * it executes caller-supplied query text. Public dashboards render a
+     * placeholder for data-source widgets instead.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/query`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const body: JSONObject = req.body;
+
+          const query: string = (body["query"] as string) || "";
+          if (!query || query.trim().length === 0) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("query is required"),
+            );
+          }
+          if (query.length > MAX_QUERY_LENGTH) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("query is too long"),
+            );
+          }
+
+          const resultKind: DataSourceResultKind =
+            body["resultKind"] === DataSourceResultKind.Table
+              ? DataSourceResultKind.Table
+              : DataSourceResultKind.TimeSeries;
+
+          const startDate: Date = new Date(body["startDate"] as string);
+          const endDate: Date = new Date(body["endDate"] as string);
+          if (
+            isNaN(startDate.getTime()) ||
+            isNaN(endDate.getTime()) ||
+            startDate.getTime() >= endDate.getTime()
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "A valid startDate and endDate are required (startDate must be before endDate).",
+              ),
+            );
+          }
+
+          let stepInSeconds: number | undefined = undefined;
+          if (body["stepInSeconds"] !== undefined) {
+            const parsedStep: number = Number(body["stepInSeconds"]);
+            if (Number.isFinite(parsedStep) && parsedStep > 0) {
+              // Floor, but never to 0 — Loki/Prometheus reject step=0.
+              stepInSeconds = Math.max(1, Math.floor(parsedStep));
+            }
+          }
+
+          const dataSource: DataSource = await this.getAccessibleDataSource({
+            req,
+            dataSourceId: body["dataSourceId"] as string,
+          });
+
+          const settings: DataSourceConnectionSettings =
+            await this.getConnectionSettings(dataSource);
+
+          const connector: DataSourceConnector = ConnectorRegistry.getConnector(
+            settings.dataSourceType,
+          );
+
+          try {
+            if (resultKind === DataSourceResultKind.Table) {
+              const tableResult: DataSourceTableResult =
+                await connector.queryTable(settings, query, {
+                  startDate,
+                  endDate,
+                  stepInSeconds,
+                });
+              return Response.sendJsonObjectResponse(req, res, {
+                resultKind: DataSourceResultKind.Table,
+                result: tableResult as unknown as JSONObject,
+              });
+            }
+
+            const timeSeriesResult: AggregatedResult =
+              await connector.queryTimeSeries(settings, query, {
+                startDate,
+                endDate,
+                stepInSeconds,
+              });
+
+            return Response.sendJsonObjectResponse(req, res, {
+              resultKind: DataSourceResultKind.TimeSeries,
+              result: timeSeriesResult as unknown as JSONObject,
+            });
+          } catch (err) {
+            logger.error(err);
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                `Data source query failed: ${this.toFriendlyErrorMessage(err)}`,
+              ),
+            );
+          }
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+
+  /*
+   * Two-phase access pattern (same as LlmProviderAPI /test): first read
+   * the record with the CALLER'S permissions — wrong project or missing
+   * ReadDataSource yields null — and only then may callers proceed to a
+   * root read of credentials.
+   */
+  private async getAccessibleDataSource(data: {
+    req: ExpressRequest;
+    dataSourceId: string;
+  }): Promise<DataSource> {
+    if (!data.dataSourceId) {
+      throw new BadDataException("dataSourceId is required");
+    }
+
+    if (!ObjectID.isValidUUID(data.dataSourceId)) {
+      throw new BadDataException(
+        "Data source not found, or you do not have access to it.",
+      );
+    }
+
+    const props: DatabaseCommonInteractionProps =
+      await CommonAPI.getDatabaseCommonInteractionProps(data.req);
+
+    const accessibleDataSource: DataSource | null =
+      await DataSourceService.findOneById({
+        id: new ObjectID(data.dataSourceId),
+        select: {
+          _id: true,
+          projectId: true,
+          dataSourceType: true,
+        },
+        props: props,
+      });
+
+    if (!accessibleDataSource) {
+      throw new BadDataException(
+        "Data source not found, or you do not have access to it.",
+      );
+    }
+
+    return accessibleDataSource;
+  }
+
+  private async getConnectionSettings(
+    dataSource: DataSource,
+  ): Promise<DataSourceConnectionSettings> {
+    const settings: DataSourceConnectionSettings | null =
+      await DataSourceService.getConnectionSettingsById(dataSource.id!);
+
+    if (!settings) {
+      throw new BadDataException("Data source configuration is incomplete.");
+    }
+
+    return settings;
+  }
+
+  private toFriendlyErrorMessage(err: unknown): string {
+    const message: string =
+      err instanceof Exception
+        ? err.message
+        : "Could not reach the data source. Please verify the connection details.";
+    return message.substring(0, 1000);
+  }
+}

package/Server/API/FileAPI.ts

@@ -32,6 +32,17 @@ const isAuthenticatedRequest: (req: ExpressRequest) => boolean = (
   }
 };
 
+/*
+ * isPublic is a real boolean column, but this stays deliberately strict.
+ * It was created as a varchar, so every row held the STRING 'true'/'false'
+ * — and 'false' is truthy, which silently disabled both gates below. Treat
+ * anything that is not exactly `true` as private so a loose value can never
+ * re-open them.
+ */
+const isFilePublic: (file: File) => boolean = (file: File): boolean => {
+  return (file.isPublic as unknown) === true;
+};
+
 export default class FileAPI extends BaseAPI<File, FileServiceType> {
   public constructor() {
     super(File, FileService);
@@ -74,6 +85,7 @@ export default class FileAPI extends BaseAPI<File, FileServiceType> {
             file: true,
             fileType: true,
             isPublic: true,
+            name: true,
           },
         });
 
@@ -85,7 +97,7 @@ export default class FileAPI extends BaseAPI<File, FileServiceType> {
           );
         }
 
-        if (!file.isPublic && !isAuthenticatedRequest(req)) {
+        if (!isFilePublic(file) && !isAuthenticatedRequest(req)) {
           return Response.sendErrorResponse(
             req,
             res,
@@ -120,10 +132,11 @@ export default class FileAPI extends BaseAPI<File, FileServiceType> {
             file: true,
             fileType: true,
             isPublic: true,
+            name: true,
           },
         });
 
-        if (!file || !file.file || !file.fileType || !file.isPublic) {
+        if (!file || !file.file || !file.fileType || !isFilePublic(file)) {
           return Response.sendErrorResponse(
             req,
             res,

package/Server/API/MicrosoftTeamsAPI.ts

@@ -799,7 +799,12 @@ export default class MicrosoftTeamsAPI {
                     id: t["id"] as string,
                     name: (t["displayName"] as string) || "Unnamed Team",
                   };
-                  acc[team.name] = team;
+                  /*
+                   * Keyed by id, not display name — Teams allows duplicate
+                   * team names, and keying by name silently collapsed them so
+                   * only the last one of each name was selectable.
+                   */
+                  acc[team.id] = team;
                   return acc;
                 },
                 {} as Record<string, MicrosoftTeamsTeam>,

package/Server/API/ProjectAPI.ts

@@ -3,6 +3,7 @@ import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import ProjectService, {
   ProjectService as ProjectServiceType,
+  ProjectBalanceAdjustmentResult,
 } from "../Services/ProjectService";
 import ResellerService from "../Services/ResellerService";
 import TeamMemberService from "../Services/TeamMemberService";
@@ -17,6 +18,7 @@ import {
 import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
 import BillingService from "../Services/BillingService";
 import Errors from "../Utils/Errors";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
@@ -28,9 +30,17 @@ import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import BadDataException from "../../Types/Exception/BadDataException";
 import OneUptimeDate from "../../Types/Date";
 import Permission, { UserPermission } from "../../Types/Permission";
+import ProjectBalanceType from "../../Types/Billing/ProjectBalanceType";
+import BalanceAdjustmentType from "../../Types/Billing/BalanceAdjustmentType";
 import ObjectID from "../../Types/ObjectID";
 import { JSONObject, JSONValue } from "../../Types/JSON";
 
+/*
+ * The reason is free text a customer types into the delete confirmation. The
+ * column is unbounded text, so the cap is here.
+ */
+export const MAX_DELETION_REASON_LENGTH: number = 5000;
+
 export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
   public constructor() {
     super(Project, ProjectService);
@@ -137,6 +147,76 @@ export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
       },
     );
 
+    /*
+     * Deletes a project, carrying the reason the customer gave for deleting it.
+     * The plain DELETE /project/:id route still works and still records the
+     * deletion - this one exists only because a DELETE has nowhere to put the
+     * answer to "why are you deleting this project?".
+     *
+     * The delete itself goes through deleteOneById with the caller's own props,
+     * so ModelPermission enforces ProjectOwner / DeleteProject exactly as it
+     * does on the plain route.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:id/delete-project`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const idParam: string = req.params["id"] as string;
+          ObjectID.validateUUID(idParam);
+          const projectId: ObjectID = new ObjectID(idParam);
+
+          /*
+           * Same guard as change-plan: permissions are resolved for the
+           * authenticated tenant, so the project in the URL has to be that
+           * tenant or permissions on one project would authorize deleting
+           * another.
+           */
+          const tenantId: ObjectID | null = this.getTenantId(req);
+
+          if (!tenantId || tenantId.toString() !== projectId.toString()) {
+            throw new BadDataException(
+              "Project ID in the URL does not match the project the request is authenticated for",
+            );
+          }
+
+          const body: JSONObject = (req.body as JSONObject) || {};
+          const data: JSONObject = (body["data"] as JSONObject) || {};
+          const deletionReasonValue: JSONValue = data["deletionReason"];
+
+          let deletionReason: string | undefined = undefined;
+
+          if (typeof deletionReasonValue === "string") {
+            /*
+             * Free text from a form field. Bound what a client can store, and
+             * drop NUL bytes: Postgres rejects them in a text column, and the
+             * write that fails here is the audit record of a project that has
+             * already been deleted - there is no second chance at it.
+             */
+            const cleaned: string = deletionReasonValue
+              // eslint-disable-next-line no-control-regex
+              .replace(/\u0000/g, "")
+              .trim()
+              .substring(0, MAX_DELETION_REASON_LENGTH);
+
+            if (cleaned) {
+              deletionReason = cleaned;
+            }
+          }
+
+          await ProjectService.deleteOneById({
+            id: projectId,
+            deletionReason: deletionReason,
+            props: await CommonAPI.getDatabaseCommonInteractionProps(req),
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
     /*
      * Extends a project's trial. Master-admin only: this hands out free
      * service and moves the customer's next invoice, so it is deliberately not
@@ -212,6 +292,140 @@ export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
       },
     );
 
+    /*
+     * Manually corrects a project's SMS/Call or AI balance. Master-admin only,
+     * for the same reason extend-trial is: it hands out (or claws back) paid
+     * service with no payment behind it, so project-level billing permissions
+     * must not reach it - only OneUptime staff acting from the Admin
+     * Dashboard.
+     */
+    this.router.put(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:id/adjust-balance`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          if (!IsBillingEnabled) {
+            throw new BadDataException(
+              "Billing is not enabled for this server",
+            );
+          }
+
+          const projectId: ObjectID = new ObjectID(req.params["id"] as string);
+
+          const body: JSONObject = (req.body as JSONObject) || {};
+          const data: JSONObject = (body["data"] as JSONObject) || {};
+
+          const balanceTypeValue: JSONValue = data["balanceType"];
+          const adjustmentTypeValue: JSONValue = data["adjustmentType"];
+          const amountInUSDValue: JSONValue = data["amountInUSD"];
+          const reasonValue: JSONValue = data["reason"];
+
+          if (
+            !balanceTypeValue ||
+            typeof balanceTypeValue !== "string" ||
+            !Object.values(ProjectBalanceType).includes(
+              balanceTypeValue as ProjectBalanceType,
+            )
+          ) {
+            throw new BadDataException(
+              `Balance type must be one of: ${Object.values(
+                ProjectBalanceType,
+              ).join(", ")}`,
+            );
+          }
+
+          if (
+            !adjustmentTypeValue ||
+            typeof adjustmentTypeValue !== "string" ||
+            !Object.values(BalanceAdjustmentType).includes(
+              adjustmentTypeValue as BalanceAdjustmentType,
+            )
+          ) {
+            throw new BadDataException(
+              `Adjustment type must be one of: ${Object.values(
+                BalanceAdjustmentType,
+              ).join(", ")}`,
+            );
+          }
+
+          /*
+           * The form posts dollars because that is what staff think in, but
+           * the column is cents. A JSON body can carry a numeric string, so
+           * accept both and reject anything that does not parse - Number("")
+           * and Number([]) are 0, which would otherwise read as a real
+           * "set to zero" instruction.
+           */
+          if (
+            typeof amountInUSDValue !== "number" &&
+            typeof amountInUSDValue !== "string"
+          ) {
+            throw new BadDataException("Amount is not a valid number");
+          }
+
+          const amountInUSD: number =
+            typeof amountInUSDValue === "number"
+              ? amountInUSDValue
+              : Number(amountInUSDValue.trim());
+
+          if (
+            !Number.isFinite(amountInUSD) ||
+            (typeof amountInUSDValue === "string" &&
+              amountInUSDValue.trim() === "")
+          ) {
+            throw new BadDataException("Amount is not a valid number");
+          }
+
+          if (typeof reasonValue !== "string" || !reasonValue.trim()) {
+            throw new BadDataException(
+              "A reason is required to adjust the balance",
+            );
+          }
+
+          /*
+           * Dollars carry at most two decimal places, and floating point
+           * multiplication does not (20.15 * 100 is 2014.9999...). Round to
+           * the nearest cent so the stored amount is the one that was typed.
+           */
+          const amountInUSDCents: number = Math.round(amountInUSD * 100);
+
+          /*
+           * The master admin middleware verifies the token but does not put
+           * the decoded payload on the request, so read it again here - who
+           * moved the balance is the only audit trail this action has.
+           */
+          let adjustedByUserId: ObjectID | undefined = undefined;
+
+          try {
+            const accessToken: string | undefined =
+              UserMiddleware.getAccessTokenFromExpressRequest(req);
+
+            if (accessToken) {
+              adjustedByUserId = JSONWebToken.decode(accessToken).userId;
+            }
+          } catch {
+            // Only used for the log line - never block the adjustment on it.
+          }
+
+          const result: ProjectBalanceAdjustmentResult =
+            await ProjectService.adjustBalance({
+              projectId: projectId,
+              balanceType: balanceTypeValue as ProjectBalanceType,
+              adjustmentType: adjustmentTypeValue as BalanceAdjustmentType,
+              amountInUSDCents: amountInUSDCents,
+              reason: reasonValue,
+              adjustedByUserId: adjustedByUserId,
+            });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            previousBalanceInUSDCents: result.previousBalanceInUSDCents,
+            newBalanceInUSDCents: result.newBalanceInUSDCents,
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
     /*
      * This API lists all the projects where user is its team member.
      * This API is usually used to show project selector dropdown in the UI

package/Server/API/StatusPageAPI.ts

@@ -113,6 +113,23 @@ import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
 } from "../Services/StatusPageSubscriberNotificationTemplateService";
 
+type EscapeXmlFunction = (text: string) => string;
+
+/*
+ * The status badge is hand-built SVG served as image/svg+xml, and SVG is a
+ * document - anything interpolated into it is markup, not text. A monitor
+ * status named `</text><script>...` would otherwise run on the status page
+ * origin for anyone who opens the badge URL directly.
+ */
+const escapeXml: EscapeXmlFunction = (text: string): string => {
+  return text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+};
+
 type ResolveStatusPageIdOrThrowFunction = (
   statusPageIdOrDomain: string,
 ) => Promise<ObjectID>;
@@ -531,9 +548,12 @@ export default class StatusPageAPI extends BaseAPI<
             });
 
           // Generate SVG badge
-          const statusName: string = overallStatus?.name || "Unknown";
-          const statusColor: string =
-            overallStatus?.color?.toString() || "#808080";
+          const statusName: string = escapeXml(
+            overallStatus?.name || "Unknown",
+          );
+          const statusColor: string = escapeXml(
+            overallStatus?.color?.toString() || "#808080",
+          );
 
           const svg: string = `<svg xmlns="http://www.w3.org/2000/svg" width="150" height="20">
   <linearGradient id="b" x2="0" y2="100%">
@@ -558,6 +578,17 @@ export default class StatusPageAPI extends BaseAPI<
 
           res.setHeader("Content-Type", "image/svg+xml");
           res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
+          /*
+           * The badge is only ever loaded through <img>, which ignores both of
+           * these. They exist for the case where someone opens the badge URL
+           * as a top-level document, where the SVG would otherwise be a
+           * scriptable document on this origin.
+           */
+          res.setHeader("X-Content-Type-Options", "nosniff");
+          res.setHeader(
+            "Content-Security-Policy",
+            "sandbox; script-src 'none'; object-src 'none'",
+          );
           return res.send(svg);
         } catch (err) {
           logger.error(err, getLogAttributesFromRequest(req as any));
@@ -786,9 +817,11 @@ export default class StatusPageAPI extends BaseAPI<
       UserMiddleware.getUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
-          const objectId: ObjectID = new ObjectID(
-            req.params["statusPageId"] as string,
-          );
+          const statusPageIdParam: string = req.params[
+            "statusPageId"
+          ] as string;
+          ObjectID.validateUUID(statusPageIdParam);
+          const objectId: ObjectID = new ObjectID(statusPageIdParam);
 
           const select: Select<StatusPage> = {
             _id: true,
@@ -3853,9 +3886,19 @@ export default class StatusPageAPI extends BaseAPI<
         `Updating existing subscriber with ID: ${subscriberId} for status page with ID: ${objectId}`,
         getLogAttributesFromRequest(req as any),
       );
+      /*
+       * Scope the lookup to the status page in the route. This endpoint only
+       * checks read access on that status page, so without the statusPageId
+       * clause anyone holding a subscriber UUID could pass any status page they
+       * can read and edit a subscriber belonging to a different — possibly
+       * private — status page. A subscriber on another page must be
+       * indistinguishable from one that does not exist, so that the shared
+       * "Subscriber not found" below cannot be used to probe for valid UUIDs.
+       */
       statusPageSubscriber = await StatusPageSubscriberService.findOneBy({
         query: {
           _id: subscriberId.toString(),
+          statusPageId: objectId,
         },
         props: {
           isRoot: true,
@@ -3864,7 +3907,7 @@ export default class StatusPageAPI extends BaseAPI<
 
       if (!statusPageSubscriber) {
         logger.debug(
-          `Subscriber not found with ID: ${subscriberId}`,
+          `Subscriber not found with ID: ${subscriberId} on status page with ID: ${objectId}`,
           getLogAttributesFromRequest(req as any),
         );
         throw new BadDataException("Subscriber not found");