@oneuptime/common 12.0.6 → 12.0.8

package/Server/Utils/Monitor/MonitorDependencySuppression.ts

@@ -0,0 +1,192 @@
+import Monitor from "../../../Models/DatabaseModels/Monitor";
+import MonitorStatus from "../../../Models/DatabaseModels/MonitorStatus";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import ObjectID from "../../../Types/ObjectID";
+import MonitorDependencyRule, {
+  DependencySuppressionResult,
+  ParentMonitorStatusRef,
+  SuppressingParent,
+} from "../../../Utils/Monitor/MonitorDependencyRule";
+import MonitorService from "../../Services/MonitorService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import logger from "../Logger";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+
+/*
+ * Re-exported so server-side callers (and the existing tests) keep a
+ * single import site; the rule itself lives in
+ * Common/Utils/Monitor/MonitorDependencyRule so the dashboard can share
+ * it without importing server modules.
+ */
+export type {
+  DependencySuppressionResult,
+  ParentMonitorStatusRef,
+  SuppressingParent,
+};
+
+/*
+ * Alert-dependency suppression (the per-monitor counterpart of the
+ * per-series MonitorMaintenanceSuppression): when a monitor declares
+ * `dependsOnMonitors` and any of those parents is currently in a
+ * suppressing status, alert/incident *creation* for this monitor is
+ * skipped for the evaluation. The monitor itself keeps evaluating — its
+ * status timeline, metrics, and the resolve path for already-open
+ * alerts/incidents are untouched. That keeps the child visibly Offline on
+ * status pages (and lets grand-children observe the outage through the
+ * child's real status, which is what makes one-hop checks transitive)
+ * while silencing the redundant paging.
+ *
+ * Which parent statuses suppress: the monitor's
+ * `suppressAlertsWhenParentMonitorStatuses` list when configured,
+ * otherwise any status flagged `isOfflineState`. The decision itself is
+ * MonitorDependencyRule.getSuppressingParents, shared with the dashboard
+ * banner.
+ */
+export default class MonitorDependencySuppression {
+  /*
+   * Resolve the suppression decision for one evaluation. Zero queries on
+   * the common path — a monitor with no dependencies returns immediately —
+   * and exactly one query (the parents' current statuses) otherwise. This
+   * sits on the hottest Postgres path in the product, so the monitor's
+   * dependency ids must arrive pre-selected on the monitor row rather than
+   * being re-read here.
+   */
+  @CaptureSpan()
+  public static async getDependencySuppression(input: {
+    monitor: Monitor;
+  }): Promise<DependencySuppressionResult> {
+    const monitorId: string = (
+      input.monitor.id ||
+      input.monitor._id ||
+      ""
+    ).toString();
+
+    const parentIds: Array<ObjectID> = (input.monitor.dependsOnMonitors || [])
+      .map((parent: Monitor) => {
+        return (parent.id || parent._id)?.toString() || "";
+      })
+      .filter((id: string) => {
+        /*
+         * A self-edge should never exist (validation rejects it, uuids
+         * compared case-insensitively), but if one was persisted through
+         * an older payload shape it must not let a monitor suppress its
+         * own offline alerts — that would silence exactly the outage the
+         * monitor exists to report.
+         */
+        return id.length > 0 && id.toLowerCase() !== monitorId.toLowerCase();
+      })
+      .map((id: string) => {
+        return new ObjectID(id);
+      });
+
+    if (parentIds.length === 0) {
+      return { isSuppressed: false, suppressingParents: [] };
+    }
+
+    const parents: Array<Monitor> = await MonitorService.findBy({
+      query: {
+        _id: QueryHelper.any(parentIds),
+      },
+      select: {
+        _id: true,
+        name: true,
+        currentMonitorStatus: {
+          _id: true,
+          name: true,
+          isOfflineState: true,
+        },
+        /*
+         * The parents' own parent ids, for the runtime mutual-cycle guard
+         * below. Selected here so the guard costs no extra query.
+         */
+        dependsOnMonitors: {
+          _id: true,
+        },
+      },
+      skip: 0,
+      limit: LIMIT_PER_PROJECT,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const parentRefs: Array<ParentMonitorStatusRef> = [];
+
+    for (const parent of parents) {
+      /*
+       * Runtime mutual-cycle guard: write-time validation walks the graph
+       * before persisting, but two concurrent updates can each pass
+       * validation and jointly commit a cycle (A depends on B, B depends
+       * on A). If that cycle suppressed, a shared outage would take both
+       * monitors offline and page NOBODY. Fail open instead: a parent
+       * that itself depends on this monitor is ignored for suppression,
+       * so a raced-in cycle degrades to normal (noisy) paging rather than
+       * a silent blackout.
+       */
+      const isMutualCycle: boolean = (parent.dependsOnMonitors || []).some(
+        (grandParent: Monitor) => {
+          const grandParentId: string = (
+            grandParent.id ||
+            grandParent._id ||
+            ""
+          ).toString();
+
+          return (
+            grandParentId.length > 0 &&
+            grandParentId.toLowerCase() === monitorId.toLowerCase()
+          );
+        },
+      );
+
+      if (isMutualCycle) {
+        logger.warn(
+          `${monitorId} - Monitor dependency cycle detected at evaluation time with parent ${parent.id?.toString()} ("${parent.name}"). The parent is ignored for suppression so alerts still fire. Remove one side of the cycle.`,
+        );
+        continue;
+      }
+
+      parentRefs.push({
+        monitorId: parent.id?.toString() || "",
+        monitorName: parent.name || "Unnamed monitor",
+        statusId: parent.currentMonitorStatus?.id?.toString(),
+        statusName: parent.currentMonitorStatus?.name,
+        isOfflineState: Boolean(parent.currentMonitorStatus?.isOfflineState),
+      });
+    }
+
+    const configuredSuppressionStatusIds: Set<string> = new Set<string>(
+      (input.monitor.suppressAlertsWhenParentMonitorStatuses || [])
+        .map((status: MonitorStatus) => {
+          return (status.id || status._id)?.toString() || "";
+        })
+        .filter((id: string) => {
+          return id.length > 0;
+        }),
+    );
+
+    const suppressingParents: Array<SuppressingParent> =
+      this.getSuppressingParents({
+        parents: parentRefs,
+        configuredSuppressionStatusIds,
+      });
+
+    return {
+      isSuppressed: suppressingParents.length > 0,
+      suppressingParents,
+    };
+  }
+
+  // Delegates kept so callers and tests have one server-side entry point.
+  public static getSuppressingParents(input: {
+    parents: Array<ParentMonitorStatusRef>;
+    configuredSuppressionStatusIds: Set<string>;
+  }): Array<SuppressingParent> {
+    return MonitorDependencyRule.getSuppressingParents(input);
+  }
+
+  public static buildSuppressionReason(
+    suppressingParents: Array<SuppressingParent>,
+  ): string {
+    return MonitorDependencyRule.buildSuppressionReason(suppressingParents);
+  }
+}

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -44,6 +44,9 @@ import logger, { LogAttributes } from "../Logger";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import DataToProcess from "./DataToProcess";
 import MonitorTemplateUtil from "./MonitorTemplateUtil";
+import MonitorDependencySuppression, {
+  DependencySuppressionResult,
+} from "./MonitorDependencySuppression";
 import { JSONObject } from "../../../Types/JSON";
 import OneUptimeDate from "../../../Types/Date";
 import MonitorEvaluationSummary from "../../../Types/Monitor/MonitorEvaluationSummary";
@@ -288,6 +291,14 @@ export default class MonitorIncident {
      * are suppressed at creation time. See MonitorMaintenanceSuppression.
      */
     suppressedSeriesFingerprints?: Set<string> | undefined;
+    /**
+     * Alert-dependency suppression: when set and isSuppressed, a parent
+     * monitor this monitor depends on is currently in a suppressing
+     * status, so ALL incident creation for this evaluation is skipped.
+     * Only creation — already-open incidents still follow the normal
+     * resolve path above. See MonitorDependencySuppression.
+     */
+    dependencySuppression?: DependencySuppressionResult | undefined;
     /**
      * Event-driven monitors (incoming-request / webhook fan-out) must not
      * use the metric snapshot model where a series absent from this tick's
@@ -342,6 +353,35 @@ export default class MonitorIncident {
       return;
     }
 
+    /*
+     * Alert-dependency suppression: a parent monitor is in a suppressing
+     * status (offline by default), so skip creating any incident for this
+     * evaluation. Placed after the open-incident resolve pass above on
+     * purpose — an incident raised before the parent went down must still
+     * resolve normally; only new creation is silenced.
+     */
+    if (input.dependencySuppression?.isSuppressed) {
+      const suppressionReason: string =
+        MonitorDependencySuppression.buildSuppressionReason(
+          input.dependencySuppression.suppressingParents,
+        );
+
+      logger.debug(
+        `${input.monitor.id?.toString()} - Skipping incident creation: ${suppressionReason}.`,
+        incidentLogAttributes,
+      );
+
+      input.evaluationSummary?.events.push({
+        type: "incident-skipped",
+        title: "Incident suppressed by monitor dependency",
+        message: `Skipped creating incidents because ${suppressionReason}. This monitor's status still updates normally; open incidents still auto-resolve.`,
+        relatedCriteriaId: input.criteriaInstance.data?.id,
+        at: OneUptimeDate.getCurrentDate(),
+      });
+
+      return;
+    }
+
     /*
      * Proxmox/Ceph monitors: resolve the monitored cluster once per
      * evaluation (lookup-only, from the step config's clusterIdentifier)

package/Server/Utils/Monitor/MonitorResource.ts

@@ -45,6 +45,9 @@ import MonitorSummaryCapture from "./MonitorSummaryCapture";
 import MonitorSummarySnapshot from "../../../Types/Monitor/MonitorSummarySnapshot";
 import IncomingRequestIncidentGrouping from "./IncomingRequestIncidentGrouping";
 import MonitorMaintenanceSuppression from "./MonitorMaintenanceSuppression";
+import MonitorDependencySuppression, {
+  DependencySuppressionResult,
+} from "./MonitorDependencySuppression";
 import MonitorStatusTimelineUtil from "./MonitorStatusTimeline";
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import ExceptionMessages from "../../../Types/Exception/ExceptionMessages";
@@ -150,6 +153,21 @@ export default class MonitorResourceUtil {
           name: true,
         },
         customFields: true,
+        /*
+         * Alert-dependency suppression inputs. Selected here for the same
+         * reason as labels: this query already loads the monitor on the
+         * hottest path, and both lists are empty for the overwhelming
+         * majority of monitors, in which case suppression costs nothing.
+         * Ids only — names are fetched by the suppression util's own
+         * parents query, so selecting them here would just duplicate the
+         * joined row payload on every evaluation.
+         */
+        dependsOnMonitors: {
+          _id: true,
+        },
+        suppressAlertsWhenParentMonitorStatuses: {
+          _id: true,
+        },
       },
       props: {
         isRoot: true,
@@ -917,6 +935,22 @@ export default class MonitorResourceUtil {
             matchesPerSeries: response.perSeriesMatches,
           });
 
+        /*
+         * Alert-dependency suppression: if any parent monitor this monitor
+         * depends on is currently in a suppressing status (offline by
+         * default), skip creating incidents/alerts for this evaluation.
+         * Deliberately computed AFTER the status timeline update above —
+         * the child's own status must keep tracking reality (status pages,
+         * transitive dependency checks); only the redundant paging is
+         * silenced. The resolve path for already-open incidents/alerts is
+         * likewise untouched. Zero queries when the monitor has no
+         * dependencies configured.
+         */
+        const dependencySuppression: DependencySuppressionResult =
+          await MonitorDependencySuppression.getDependencySuppression({
+            monitor: monitor,
+          });
+
         /*
          * Freeze the Monitor Summary as it stands right now, before any
          * incident or alert is created from it. Both creators store the
@@ -945,6 +979,7 @@ export default class MonitorResourceUtil {
           },
           matchesPerSeries: response.perSeriesMatches,
           suppressedSeriesFingerprints,
+          dependencySuppression,
           /*
            * Incoming-request grouping is event-driven: a webhook describes
            * only the keys in its payload, so absence from this tick is not
@@ -969,6 +1004,7 @@ export default class MonitorResourceUtil {
           },
           matchesPerSeries: response.perSeriesMatches,
           suppressedSeriesFingerprints,
+          dependencySuppression,
           /*
            * Incoming-request grouping is event-driven (see the incident
            * create call above): skip the snapshot absence-resolve pass for

package/Server/Utils/Response.ts

@@ -21,11 +21,63 @@ import Dictionary from "../../Types/Dictionary";
 import Exception from "../../Types/Exception/Exception";
 import { JSONArray, JSONObject } from "../../Types/JSON";
 import ListData from "../../Types/ListData";
+import MimeType from "../../Types/File/MimeType";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Route from "../../Types/API/Route";
 import CaptureSpan from "./Telemetry/CaptureSpan";
 import { IsBillingEnabled } from "../EnvironmentConfig";
 
+/*
+ * Raster image types, which is to say the types that cannot carry script and
+ * are therefore safe both to echo back verbatim and to render in our own
+ * origin. An SVG is not here on purpose: it is a document, not a picture, and
+ * a PDF is not here either because it gets its own scripting engine.
+ *
+ * The list is deliberately wider than the MimeType enum. Until November 2025
+ * (62d74c1d84) the file picker stored the browser's own MIME string verbatim,
+ * so installs upgrading through this change hold rows with values that never
+ * appeared in the enum - "image/vnd.microsoft.icon" from a favicon upload,
+ * "image/jpg" from assorted tools. Collapsing those to octet-stream would stop
+ * every one of those avatars and logos from rendering, because nosniff means
+ * an <img> cannot recover from a type it was given wrongly.
+ */
+const SAFE_IMAGE_MIME_TYPES: Set<string> = new Set<string>([
+  MimeType.png,
+  // MimeType.jpg is the same string as MimeType.jpeg, so it is covered.
+  MimeType.jpeg,
+  MimeType.gif,
+  MimeType.webp,
+  MimeType.ico,
+  MimeType.bmp,
+  MimeType.tiff,
+  MimeType.avif,
+  MimeType.heic,
+  "image/jpg",
+  "image/pjpeg",
+  "image/vnd.microsoft.icon",
+  "image/x-ms-bmp",
+]);
+
+/*
+ * `fileType` is a plain varchar filled in from the upload request body, so by
+ * the time a file is served back it holds whatever string the uploader chose -
+ * the MimeType enum is a compile-time type and is erased at runtime. Echoing
+ * that string back as Content-Type is what turns "upload an image" into "run
+ * script on the dashboard origin", because /api, /file and /dashboard are the
+ * same origin. Only types we actually recognise get echoed back.
+ *
+ * Note this read-side list is wider than the one FileService enforces on
+ * upload: new rows are held to the canonical enum, old rows only have to be
+ * servable.
+ */
+const ALLOWED_MIME_TYPES: Set<string> = new Set<string>([
+  ...Object.values(MimeType),
+  ...SAFE_IMAGE_MIME_TYPES,
+]);
+
+// What an unrecognised fileType degrades to: opaque bytes, never a document.
+const FALLBACK_MIME_TYPE: string = "application/octet-stream";
+
 export default class Response {
   @CaptureSpan()
   public static sendEmptySuccessResponse(
@@ -67,21 +119,105 @@ export default class Response {
     oneUptimeResponse.status(statusCode).send(body);
   }
 
+  /*
+   * Reduce a stored fileType to something safe to hand back as Content-Type.
+   * Anything we do not recognise - a made-up string, "text/html", a row
+   * written before uploads were validated - becomes opaque bytes.
+   */
+  public static getSafeFileType(fileType: string | undefined | null): string {
+    const normalizedFileType: string = (fileType || "").trim().toLowerCase();
+
+    if (ALLOWED_MIME_TYPES.has(normalizedFileType)) {
+      return normalizedFileType;
+    }
+
+    return FALLBACK_MIME_TYPE;
+  }
+
+  /*
+   * The filename goes into a response header, so it gets the same treatment as
+   * the MIME string: no quotes, no CR/LF, nothing that could split the header.
+   * This is the ASCII fallback only - see getContentDisposition, which pairs it
+   * with an encoded copy so a non-Latin name is not reduced to underscores.
+   */
+  public static getSafeFileName(name: string | undefined | null): string {
+    const safeFileName: string = (name || "")
+      .replace(/[^a-zA-Z0-9._-]/g, "_")
+      .slice(0, 100);
+
+    return safeFileName || "download";
+  }
+
+  /*
+   * RFC 6266: `filename` carries an ASCII-safe fallback for old clients and
+   * `filename*` carries the real name percent-encoded, so "月次レポート.pdf"
+   * downloads under its own name instead of as a row of underscores. Both are
+   * escaped, so neither can close the quoted string or inject a header.
+   */
+  public static getContentDisposition(
+    disposition: "inline" | "attachment",
+    name: string | undefined | null,
+  ): string {
+    const fileName: string = (name || "").trim().slice(0, 100) || "download";
+
+    /*
+     * encodeURIComponent leaves !'()* alone and RFC 5987's attr-char does not
+     * allow them - single quote especially, since it delimits the value.
+     */
+    const encodedFileName: string = encodeURIComponent(fileName).replace(
+      /['()*!]/g,
+      (character: string): string => {
+        return `%${character.charCodeAt(0).toString(16).toUpperCase()}`;
+      },
+    );
+
+    return `${disposition}; filename="${Response.getSafeFileName(fileName)}"; filename*=UTF-8''${encodedFileName}`;
+  }
+
   @CaptureSpan()
   public static async sendFileResponse(
     _req: ExpressRequest | ExpressRequest,
     res: ExpressResponse,
     file: FileModel,
   ): Promise<void> {
-    /** Create read stream */
-
     const oneUptimeResponse: OneUptimeResponse = res as OneUptimeResponse;
 
-    /** Set the proper content type */
-    oneUptimeResponse.set("Content-Type", file.fileType);
+    const fileType: string = Response.getSafeFileType(file.fileType);
+
+    oneUptimeResponse.set("Content-Type", fileType);
+
+    /*
+     * Belt and braces for the types we do echo back. nosniff stops the browser
+     * from guessing its way to a different type; the CSP gives the response an
+     * opaque origin with no scripting even if it is opened as a top-level
+     * document, so a crafted file cannot reach dashboard cookies; and nothing
+     * we serve here is ever meant to be framed.
+     */
+    oneUptimeResponse.set("X-Content-Type-Options", "nosniff");
+    oneUptimeResponse.set(
+      "Content-Security-Policy",
+      "sandbox; script-src 'none'; object-src 'none'; frame-ancestors 'none'",
+    );
+    oneUptimeResponse.set("X-Frame-Options", "DENY");
+
+    /*
+     * Inline is reserved for raster images, which cannot execute anything.
+     * Everything else - SVG, PDF, office docs, whatever an older row happens
+     * to hold - downloads instead of rendering. This is deliberately not an
+     * SVG ban: <img> and <link rel="icon"> ignore Content-Disposition, so
+     * status page logos, favicons and avatars still render. The only
+     * behaviour that changes is a top-level navigation to the file URL, and
+     * that is exactly the navigation an XSS payload needs.
+     */
+    oneUptimeResponse.set(
+      "Content-Disposition",
+      Response.getContentDisposition(
+        SAFE_IMAGE_MIME_TYPES.has(fileType) ? "inline" : "attachment",
+        file.name,
+      ),
+    );
+
     oneUptimeResponse.status(200);
-    /** Return response */
-    // readstream.pipe(res);
 
     oneUptimeResponse.send(file.file);
   }