@oneuptime/common 12.0.6 → 12.0.7

package/Server/Services/ProjectService.ts

@@ -20,6 +20,7 @@ import SessionReplayGateCacheStore from "../Utils/SessionReplay/SessionReplayGat
 import AccessTokenService from "./AccessTokenService";
 import BillingService from "./BillingService";
 import DatabaseService from "./DatabaseService";
+import DeletedProjectService from "./DeletedProjectService";
 import IncidentSeverityService from "./IncidentSeverityService";
 import IncidentStateService from "./IncidentStateService";
 import IncidentRoleService from "./IncidentRoleService";
@@ -39,6 +40,8 @@ import SubscriptionPlan, {
   PlanType,
 } from "../../Types/Billing/SubscriptionPlan";
 import SubscriptionStatus from "../../Types/Billing/SubscriptionStatus";
+import ProjectBalanceType from "../../Types/Billing/ProjectBalanceType";
+import BalanceAdjustmentType from "../../Types/Billing/BalanceAdjustmentType";
 import {
   Black,
   Blue500,
@@ -97,6 +100,24 @@ export interface CurrentPlan {
   isSubscriptionUnpaid: boolean;
 }
 
+export interface ProjectBalanceAdjustmentResult {
+  previousBalanceInUSDCents: number;
+  newBalanceInUSDCents: number;
+}
+
+// The project columns that hold a prepaid balance, in cents.
+export type ProjectBalanceColumnName =
+  | "smsOrCallCurrentBalanceInUSDCents"
+  | "aiCurrentBalanceInUSDCents";
+
+/*
+ * Ceiling on a single manual adjustment. Staff type dollars and the column
+ * stores cents, so the classic slip is a factor of 100 - this turns that into
+ * a rejected form instead of a five-figure credit nobody notices until the
+ * month closes. Larger corrections are still possible, just not in one click.
+ */
+export const MAX_BALANCE_ADJUSTMENT_IN_USD_CENTS: number = 10_000 * 100;
+
 export class ProjectService extends DatabaseService<Model> {
   /*
    * Suppresses repeated `lastActive` UPDATEs from a single API node. 60s of
@@ -2095,6 +2116,12 @@ These are no longer recorded against the project and have to be cancelled by han
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<Model>,
   ): Promise<OnDelete<Model>> {
+    /*
+     * Everything onDeleteSuccess needs has to be read here: projects are hard
+     * deleted, so by the time that hook runs there is nothing left to query.
+     * The extra columns beyond the billing ones are the snapshot that goes
+     * into DeletedProject for customer outreach.
+     */
     const projects: Array<Model> = await this.findBy({
       query: deleteBy.query,
       props: {
@@ -2107,11 +2134,24 @@ These are no longer recorded against the project and have to be cancelled by han
         paymentProviderSubscriptionId: true,
         paymentProviderMeteredSubscriptionId: true,
         name: true,
+        slug: true,
         createdAt: true,
         planName: true,
+        paymentProviderPlanId: true,
+        paymentProviderCustomerId: true,
+        paymentProviderSubscriptionStatus: true,
+        paymentProviderSubscriptionSeats: true,
+        trialEndsAt: true,
+        currentActiveMonitorsCount: true,
+        isBlocked: true,
+        createdByUserId: true,
         createdByUser: {
           name: true,
           email: true,
+          companyName: true,
+          companyPhoneNumber: true,
+          companySize: true,
+          jobRole: true,
         },
       },
     });
@@ -2122,8 +2162,45 @@ These are no longer recorded against the project and have to be cancelled by han
   @CaptureSpan()
   protected override async onDeleteSuccess(
     onDelete: OnDelete<Model>,
-    _itemIdsBeforeDelete: ObjectID[],
+    itemIdsBeforeDelete: ObjectID[],
   ): Promise<OnDelete<Model>> {
+    /*
+     * Record the deleted project first. Everything else in this hook can throw
+     * - Stripe in particular - and the customer we would want to follow up
+     * with is exactly the one whose deletion hit an error.
+     *
+     * Only the projects that were really deleted are recorded: onBeforeDelete
+     * snapshots everything the query matched, which is a superset once
+     * permissions narrow the delete.
+     */
+    const deletedProjectIds: Set<string> = new Set<string>(
+      itemIdsBeforeDelete.map((id: ObjectID) => {
+        return id.toString();
+      }),
+    );
+
+    for (const project of onDelete.carryForward) {
+      if (project.id && !deletedProjectIds.has(project.id.toString())) {
+        continue;
+      }
+
+      try {
+        await DeletedProjectService.logProjectDeletion({
+          project: project,
+          deletedByUserId:
+            onDelete.deleteBy.deletedByUser?.id ||
+            onDelete.deleteBy.props.userId,
+          deletionReason: onDelete.deleteBy.deletionReason,
+        });
+      } catch (err) {
+        /*
+         * The project is already gone. Failing the request now would tell the
+         * customer their delete did not work when it did.
+         */
+        logger.error(err);
+      }
+    }
+
     if (NotificationSlackWebhookOnDeleteProject) {
       for (const project of onDelete.carryForward) {
         let subscriptionStatus: SubscriptionStatus | null = null;
@@ -2496,6 +2573,225 @@ These are no longer recorded against the project and have to be cancelled by han
     });
   }
 
+  /*
+   * Manually correct one of a project's prepaid balances. Master-admin only -
+   * this hands out (or claws back) paid service without a payment, so the API
+   * in front of it sits behind the master admin middleware.
+   *
+   * Add and Deduct go through a single atomic `col = col + delta` statement,
+   * because SMS sends and AI runs are deducting from the same column
+   * concurrently: a read-then-write here would silently swallow whichever
+   * charge landed in between. Set is an absolute assignment and has no such
+   * guarantee by construction - it is last-writer-wins, which is what "make it
+   * read exactly this" means.
+   *
+   * The write is hookless. Project's update hooks only react to session
+   * replay, SSO and billing-detail fields, so none of them have anything to do
+   * for a balance change, and skipping them keeps the whole adjustment in one
+   * statement.
+   */
+  @CaptureSpan()
+  public async adjustBalance(data: {
+    projectId: ObjectID;
+    balanceType: ProjectBalanceType;
+    adjustmentType: BalanceAdjustmentType;
+    amountInUSDCents: number;
+    reason: string;
+    adjustedByUserId?: ObjectID | undefined;
+  }): Promise<ProjectBalanceAdjustmentResult> {
+    if (!IsBillingEnabled) {
+      throw new BadDataException("Billing is not enabled for this server");
+    }
+
+    if (
+      typeof data.amountInUSDCents !== "number" ||
+      !Number.isFinite(data.amountInUSDCents)
+    ) {
+      throw new BadDataException("Adjustment amount is not a valid number");
+    }
+
+    /*
+     * A fractional cent cannot be stored, and rounding it here would make the
+     * balance disagree with the amount the audit log records.
+     */
+    if (!Number.isInteger(data.amountInUSDCents)) {
+      throw new BadDataException(
+        "Adjustment amount must be a whole number of cents",
+      );
+    }
+
+    if (data.amountInUSDCents < 0) {
+      throw new BadDataException("Adjustment amount cannot be negative");
+    }
+
+    /*
+     * Adding or deducting nothing is a no-op that would still write an audit
+     * line. Setting to zero is a real instruction, so it is allowed.
+     */
+    if (
+      data.adjustmentType !== BalanceAdjustmentType.Set &&
+      data.amountInUSDCents === 0
+    ) {
+      throw new BadDataException("Adjustment amount must be greater than zero");
+    }
+
+    if (data.amountInUSDCents > MAX_BALANCE_ADJUSTMENT_IN_USD_CENTS) {
+      throw new BadDataException(
+        `Adjustment amount cannot be more than ${
+          MAX_BALANCE_ADJUSTMENT_IN_USD_CENTS / 100
+        } USD in a single adjustment`,
+      );
+    }
+
+    const reason: string = (data.reason || "").trim();
+
+    if (!reason) {
+      throw new BadDataException("A reason is required to adjust the balance");
+    }
+
+    const balanceColumnName: ProjectBalanceColumnName =
+      ProjectService.getBalanceColumnName(data.balanceType);
+
+    const project: Model | null = await this.findOneById({
+      id: data.projectId,
+      select: {
+        _id: true,
+        [balanceColumnName]: true,
+      } as Select<Model>,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (!project) {
+      throw new BadDataException("Project not found");
+    }
+
+    const previousBalanceInUSDCents: number = project[balanceColumnName] || 0;
+
+    let newBalanceInUSDCents: number = previousBalanceInUSDCents;
+
+    if (data.adjustmentType === BalanceAdjustmentType.Add) {
+      newBalanceInUSDCents = previousBalanceInUSDCents + data.amountInUSDCents;
+    }
+
+    if (data.adjustmentType === BalanceAdjustmentType.Deduct) {
+      newBalanceInUSDCents = previousBalanceInUSDCents - data.amountInUSDCents;
+
+      /*
+       * Usage is allowed to overdraw a balance (the charge is taken, the next
+       * request is refused), but a manual deduction pushing a customer into
+       * the red is a mistake every time - so refuse rather than reproduce a
+       * typo as a negative balance the customer then has to pay off.
+       */
+      if (newBalanceInUSDCents < 0) {
+        throw new BadDataException(
+          `Cannot deduct ${data.amountInUSDCents / 100} USD - the balance is only ${
+            previousBalanceInUSDCents / 100
+          } USD`,
+        );
+      }
+    }
+
+    if (data.adjustmentType === BalanceAdjustmentType.Set) {
+      newBalanceInUSDCents = data.amountInUSDCents;
+    }
+
+    /*
+     * Topping a project back up has to clear the "we already told the owners"
+     * latches, exactly as a paid recharge does. Leaving them set means the
+     * next genuine low balance passes in silence, because the flags say the
+     * owners were warned - about the shortfall this adjustment just fixed.
+     */
+    const set: QueryDeepPartialEntity<Model> =
+      newBalanceInUSDCents > previousBalanceInUSDCents
+        ? ProjectService.getBalanceNotificationFlagResets(data.balanceType)
+        : {};
+
+    if (data.adjustmentType === BalanceAdjustmentType.Set) {
+      await this.atomicAddToColumnsByIdWithoutHooks({
+        id: data.projectId,
+        add: {},
+        set: {
+          ...set,
+          [balanceColumnName]: newBalanceInUSDCents,
+        } as QueryDeepPartialEntity<Model>,
+      });
+    } else {
+      const delta: number =
+        data.adjustmentType === BalanceAdjustmentType.Add
+          ? data.amountInUSDCents
+          : -data.amountInUSDCents;
+
+      await this.atomicAddToColumnsByIdWithoutHooks({
+        id: data.projectId,
+        add: {
+          [balanceColumnName]: delta,
+        } as Partial<Record<keyof Model, number>>,
+        set: set,
+      });
+    }
+
+    /*
+     * The audit trail for moving money. There is no generic admin-action
+     * table, so the acting master admin and their stated reason go in the log
+     * line - the same shape extendTrial uses.
+     */
+    logger.info(
+      `${data.balanceType} balance for project ${data.projectId.toString()} adjusted (${
+        data.adjustmentType
+      } ${data.amountInUSDCents} cents) from ${previousBalanceInUSDCents} to ${newBalanceInUSDCents} cents by master admin ${
+        data.adjustedByUserId?.toString() || "unknown"
+      }. Reason: ${reason}`,
+    );
+
+    return {
+      previousBalanceInUSDCents: previousBalanceInUSDCents,
+      newBalanceInUSDCents: newBalanceInUSDCents,
+    };
+  }
+
+  private static getBalanceColumnName(
+    balanceType: ProjectBalanceType,
+  ): ProjectBalanceColumnName {
+    if (balanceType === ProjectBalanceType.SmsOrCall) {
+      return "smsOrCallCurrentBalanceInUSDCents";
+    }
+
+    if (balanceType === ProjectBalanceType.AI) {
+      return "aiCurrentBalanceInUSDCents";
+    }
+
+    throw new BadDataException(`Invalid balance type: ${balanceType}`);
+  }
+
+  /*
+   * The "owners have been notified" latches that belong to each balance. They
+   * are reset whenever that balance goes up, which is what the paid recharge
+   * paths in NotificationService and AIBillingService do too.
+   */
+  private static getBalanceNotificationFlagResets(
+    balanceType: ProjectBalanceType,
+  ): QueryDeepPartialEntity<Model> {
+    if (balanceType === ProjectBalanceType.SmsOrCall) {
+      return {
+        lowCallAndSMSBalanceNotificationSentToOwners: false,
+        failedCallAndSMSBalanceChargeNotificationSentToOwners: false,
+        notEnabledSmsOrCallNotificationSentToOwners: false,
+      };
+    }
+
+    if (balanceType === ProjectBalanceType.AI) {
+      return {
+        lowAiBalanceNotificationSentToOwners: false,
+        failedAiBalanceChargeNotificationSentToOwners: false,
+        notEnabledAiNotificationSentToOwners: false,
+      };
+    }
+
+    throw new BadDataException(`Invalid balance type: ${balanceType}`);
+  }
+
   @CaptureSpan()
   public async incrementAndGetIncidentCounter(
     projectId: ObjectID,

package/Server/Services/PushNotificationService.ts

@@ -27,6 +27,25 @@ import PushNotificationLog from "../../Models/DatabaseModels/PushNotificationLog
 import PushNotificationLogService from "./PushNotificationLogService";
 import PushStatus from "../../Types/PushNotification/PushStatus";
 
+/*
+ * The push services the browsers actually use. A Web Push subscription is a
+ * JSON blob supplied by the client and stored verbatim in UserPush.deviceToken;
+ * web-push then dials whatever host:port its "endpoint" names. Nothing else is
+ * a legitimate destination, so this is an allowlist rather than a blocklist —
+ * there is no self-hosted deployment of a browser push service to accommodate.
+ *
+ * Matching is on the registrable host (exact, or a subdomain) and https only,
+ * which covers the real endpoints: updates.push.services.mozilla.com,
+ * web.push.apple.com, and the regional *.notify.windows.com hosts.
+ */
+const ALLOWED_WEB_PUSH_HOSTS: Array<string> = [
+  "push.services.mozilla.com",
+  "fcm.googleapis.com",
+  "android.googleapis.com",
+  "notify.windows.com",
+  "push.apple.com",
+];
+
 export interface PushNotificationOptions {
   projectId?: ObjectID | undefined;
   isSensitive?: boolean;
@@ -267,6 +286,54 @@ export default class PushNotificationService {
     }
   }
 
+  /*
+   * Refuse to hand web-push an endpoint that is not one of the browser push
+   * services. The subscription JSON is client-supplied, so without this the
+   * endpoint is a free choice of host and port for a POST the server makes
+   * with its own credentials — the usual internal-service and metadata
+   * targets included.
+   */
+  public static assertWebPushEndpointIsAllowed(endpoint: unknown): void {
+    if (!endpoint || typeof endpoint !== "string") {
+      throw new Error(
+        "Web push subscription is missing its endpoint and cannot be delivered.",
+      );
+    }
+
+    /*
+     * Parsed with the WHATWG parser deliberately: that is the parser web-push
+     * itself uses, so what is checked here is exactly what gets dialed. Going
+     * through OneUptime's URL type instead would introduce a differential —
+     * it reads "https://push.apple.com:80@evil.com/" as host push.apple.com,
+     * while WHATWG (correctly) reads userinfo push.apple.com:80 and host
+     * evil.com.
+     */
+    let parsed: globalThis.URL;
+    try {
+      parsed = new globalThis.URL(endpoint);
+    } catch {
+      throw new Error("Web push subscription endpoint is not a valid URL.");
+    }
+
+    if (parsed.protocol !== "https:") {
+      throw new Error("Web push subscription endpoint must use https.");
+    }
+
+    const host: string = parsed.hostname.toLowerCase();
+
+    const isAllowed: boolean = ALLOWED_WEB_PUSH_HOSTS.some(
+      (allowedHost: string) => {
+        return host === allowedHost || host.endsWith(`.${allowedHost}`);
+      },
+    );
+
+    if (!isAllowed) {
+      throw new Error(
+        `Web push subscription endpoint ${host} is not a recognised browser push service and will not be contacted.`,
+      );
+    }
+  }
+
   private static async sendWebPushNotification(
     deviceToken: string,
     message: PushNotificationMessage,
@@ -307,6 +374,10 @@ export default class PushNotificationService {
         throw new Error(`Invalid device token format: ${parseError}`);
       }
 
+      PushNotificationService.assertWebPushEndpointIsAllowed(
+        subscriptionObject?.endpoint,
+      );
+
       const result: webpush.SendResult = await webpush.sendNotification(
         subscriptionObject,
         payload,

package/Server/Services/ScheduledMaintenancePublicNoteService.ts

@@ -14,6 +14,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
 import File from "../../Models/DatabaseModels/File";
 import FileAttachmentMarkdownUtil from "../Utils/FileAttachmentMarkdownUtil";
+import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -57,6 +58,17 @@ export class Service extends DatabaseService<Model> {
     const userId: ObjectID | null | undefined =
       createdItem.createdByUserId || createdItem.createdByUser?.id;
 
+    /*
+     * A public note is always rendered on the status page, so any inline
+     * image the markdown editor uploaded as private must flip to public
+     * for anonymous status page viewers to be able to render it.
+     */
+    await syncIsPublicForMarkdownImages(
+      createdItem.note,
+      true,
+      `scheduled maintenance public note ${createdItem.id?.toString()}`,
+    );
+
     const scheduledMaintenanceId: ObjectID =
       createdItem.scheduledMaintenanceId!;
     const projectId: ObjectID = createdItem.projectId!;
@@ -129,6 +141,12 @@ ${(createdItem.note || "") + attachmentsMarkdown}
         const scheduledMaintenance: ScheduledMaintenance =
           updatedItem.scheduledMaintenance!;
 
+        await syncIsPublicForMarkdownImages(
+          updatedItem.note,
+          true,
+          `scheduled maintenance public note ${updatedItem.id?.toString()}`,
+        );
+
         const attachmentsMarkdown: string = await this.getAttachmentsMarkdown(
           updatedItem.id!,
           "/scheduled-maintenance-public-note/attachment",

package/Server/Services/StatusPageAnnouncementService.ts

@@ -4,6 +4,10 @@ import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
+import ObjectID from "../../Types/ObjectID";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -51,6 +55,55 @@ export class Service extends DatabaseService<Model> {
       carryForward: null,
     };
   }
+
+  /*
+   * An announcement is always rendered on the status pages it is attached
+   * to, so any inline image the markdown editor uploaded as private must
+   * flip to public for anonymous status page viewers to render it.
+   */
+  @CaptureSpan()
+  public override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    await syncIsPublicForMarkdownImages(
+      createdItem.description,
+      true,
+      `status page announcement ${createdItem.id?.toString()}`,
+    );
+
+    return createdItem;
+  }
+
+  @CaptureSpan()
+  public override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    _updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    if (onUpdate.updateBy.data.description) {
+      const updatedItems: Array<Model> = await this.findBy({
+        query: onUpdate.updateBy.query,
+        limit: LIMIT_PER_PROJECT,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+        select: {
+          description: true,
+        },
+      });
+
+      for (const updatedItem of updatedItems) {
+        await syncIsPublicForMarkdownImages(
+          updatedItem.description,
+          true,
+          `status page announcement ${updatedItem.id?.toString()}`,
+        );
+      }
+    }
+
+    return onUpdate;
+  }
 }
 
 export default new Service();