@oneuptime/common 12.0.6 → 12.0.8

package/Server/API/StatusPageAPI.ts

@@ -113,6 +113,23 @@ import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
 } from "../Services/StatusPageSubscriberNotificationTemplateService";
 
+type EscapeXmlFunction = (text: string) => string;
+
+/*
+ * The status badge is hand-built SVG served as image/svg+xml, and SVG is a
+ * document - anything interpolated into it is markup, not text. A monitor
+ * status named `</text><script>...` would otherwise run on the status page
+ * origin for anyone who opens the badge URL directly.
+ */
+const escapeXml: EscapeXmlFunction = (text: string): string => {
+  return text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+};
+
 type ResolveStatusPageIdOrThrowFunction = (
   statusPageIdOrDomain: string,
 ) => Promise<ObjectID>;
@@ -531,9 +548,12 @@ export default class StatusPageAPI extends BaseAPI<
             });
 
           // Generate SVG badge
-          const statusName: string = overallStatus?.name || "Unknown";
-          const statusColor: string =
-            overallStatus?.color?.toString() || "#808080";
+          const statusName: string = escapeXml(
+            overallStatus?.name || "Unknown",
+          );
+          const statusColor: string = escapeXml(
+            overallStatus?.color?.toString() || "#808080",
+          );
 
           const svg: string = `<svg xmlns="http://www.w3.org/2000/svg" width="150" height="20">
   <linearGradient id="b" x2="0" y2="100%">
@@ -558,6 +578,17 @@ export default class StatusPageAPI extends BaseAPI<
 
           res.setHeader("Content-Type", "image/svg+xml");
           res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
+          /*
+           * The badge is only ever loaded through <img>, which ignores both of
+           * these. They exist for the case where someone opens the badge URL
+           * as a top-level document, where the SVG would otherwise be a
+           * scriptable document on this origin.
+           */
+          res.setHeader("X-Content-Type-Options", "nosniff");
+          res.setHeader(
+            "Content-Security-Policy",
+            "sandbox; script-src 'none'; object-src 'none'",
+          );
           return res.send(svg);
         } catch (err) {
           logger.error(err, getLogAttributesFromRequest(req as any));
@@ -786,9 +817,11 @@ export default class StatusPageAPI extends BaseAPI<
       UserMiddleware.getUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
-          const objectId: ObjectID = new ObjectID(
-            req.params["statusPageId"] as string,
-          );
+          const statusPageIdParam: string = req.params[
+            "statusPageId"
+          ] as string;
+          ObjectID.validateUUID(statusPageIdParam);
+          const objectId: ObjectID = new ObjectID(statusPageIdParam);
 
           const select: Select<StatusPage> = {
             _id: true,

package/Server/API/UserAPI.ts

@@ -53,10 +53,25 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
      * the gate; the read below runs as root because a master admin is not a
      * member of the projects being listed and so has no tenant permissions to
      * read them with.
+     *
+     * The gate accepts the instance-wide master API key as well as a
+     * master-admin session, because the caller asking "which projects is this
+     * person in?" is typically a script rather than somebody with a browser
+     * open. That is a widening, so it is worth being explicit about why it is
+     * the right one HERE and not on the routes below: this endpoint only reads,
+     * and it reads nothing the key does not already reach through
+     * POST /team-member/get-list, which any master-key caller can call today
+     * (untenanted, so cross-project) to assemble the same answer one membership
+     * at a time. The key buys convenience and correct paging, not new reach.
+     *
+     * The writes below stay on the session-only middleware. A leaked static key
+     * that can list memberships is a disclosure of what it could already
+     * disclose; one that can remove a user from a project, set their password or
+     * mail them a reset link is a headless account takeover.
      */
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/:userId/projects`,
-      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      MasterAdminAuthorization.isAuthorizedMasterAdminOrMasterApiKeyMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const userId: ObjectID = UserAPI.getUserIdFromParams(req);

package/Server/Infrastructure/Postgres/SchemaMigrations/1786446545142-MigrationName.ts

@@ -0,0 +1,50 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1786446545142 implements MigrationInterface {
+  public name = "MigrationName1786446545142";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * "File"."isPublic" backs a `boolean` field but was created as varchar,
+     * so every row holds the STRING 'true'/'false' and every server-side
+     * `!file.isPublic` gate was inert — 'false' is truthy in JS.
+     *
+     * Convert in place. TypeORM generates a DROP COLUMN + ADD COLUMN for
+     * this change, which would discard every stored value and re-default
+     * the whole table to public — the exact opposite of the fix.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" DROP DEFAULT`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" TYPE boolean USING (lower("isPublic") IN ('true', 't', 'yes', 'y', '1'))`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" SET DEFAULT true`,
+    );
+
+    /*
+     * Probe and AI agent icons are the only consumers of the id-based
+     * image route, which serves public files only. Both upload through the
+     * file picker, which marks uploads private, so every icon attached
+     * before this migration would 404 once the gate starts working.
+     * ProbeService/AIAgentService now flip the icon public on attach; this
+     * backfills the rows attached before that hook existed.
+     */
+    await queryRunner.query(
+      `UPDATE "File" SET "isPublic" = true WHERE "_id" IN (SELECT "iconFileId" FROM "Probe" WHERE "iconFileId" IS NOT NULL UNION SELECT "iconFileId" FROM "AIAgent" WHERE "iconFileId" IS NOT NULL)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" DROP DEFAULT`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" TYPE character varying(100) USING (CASE WHEN "isPublic" THEN 'true' ELSE 'false' END)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" SET DEFAULT true`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786449497966-AddMonitorDependency.ts

@@ -0,0 +1,67 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddMonitorDependency1786449497966 implements MigrationInterface {
+  public name = "AddMonitorDependency1786449497966";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "MonitorDependency" ("monitorId" uuid NOT NULL, "dependsOnMonitorId" uuid NOT NULL, CONSTRAINT "PK_26790391f134c5a87b2aa70a902" PRIMARY KEY ("monitorId", "dependsOnMonitorId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_953533a93dba2f345283474c60" ON "MonitorDependency" ("monitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_43f849731e1bda0ada73b3d887" ON "MonitorDependency" ("dependsOnMonitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "MonitorDependencySuppressionStatus" ("monitorId" uuid NOT NULL, "monitorStatusId" uuid NOT NULL, CONSTRAINT "PK_2889f58c301e8a07d46dd82382c" PRIMARY KEY ("monitorId", "monitorStatusId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_747378c59669e4639c4209adc7" ON "MonitorDependencySuppressionStatus" ("monitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_354bf0c679a6dfd64910eb6441" ON "MonitorDependencySuppressionStatus" ("monitorStatusId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" ADD CONSTRAINT "FK_953533a93dba2f345283474c60f" FOREIGN KEY ("monitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" ADD CONSTRAINT "FK_43f849731e1bda0ada73b3d8874" FOREIGN KEY ("dependsOnMonitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" ADD CONSTRAINT "FK_747378c59669e4639c4209adc78" FOREIGN KEY ("monitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" ADD CONSTRAINT "FK_354bf0c679a6dfd64910eb64418" FOREIGN KEY ("monitorStatusId") REFERENCES "MonitorStatus"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" DROP CONSTRAINT "FK_354bf0c679a6dfd64910eb64418"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" DROP CONSTRAINT "FK_747378c59669e4639c4209adc78"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" DROP CONSTRAINT "FK_43f849731e1bda0ada73b3d8874"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" DROP CONSTRAINT "FK_953533a93dba2f345283474c60f"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_354bf0c679a6dfd64910eb6441"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_747378c59669e4639c4209adc7"`,
+    );
+    await queryRunner.query(`DROP TABLE "MonitorDependencySuppressionStatus"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_43f849731e1bda0ada73b3d887"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_953533a93dba2f345283474c60"`,
+    );
+    await queryRunner.query(`DROP TABLE "MonitorDependency"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786461136170-AddDeletedProjectTable.ts

@@ -0,0 +1,39 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddDeletedProjectTable1786461136170 implements MigrationInterface {
+  public name: string = "AddDeletedProjectTable1786461136170";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "DeletedProject" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "projectName" character varying(100) NOT NULL, "projectSlug" character varying(100), "projectCreatedAt" TIMESTAMP WITH TIME ZONE, "projectDeletedAt" TIMESTAMP WITH TIME ZONE NOT NULL, "deletionReason" text, "projectDeletedByUserId" uuid, "projectDeletedByUserName" character varying(50), "projectDeletedByUserEmail" character varying(100), "projectCreatedByUserId" uuid, "projectCreatedByUserName" character varying(50), "projectCreatedByUserEmail" character varying(100), "companyName" character varying(100), "companyPhoneNumber" character varying(30), "companySize" character varying(100), "jobRole" character varying(100), "planName" character varying(100), "paymentProviderPlanId" character varying(100), "paymentProviderCustomerId" character varying(100), "paymentProviderSubscriptionId" character varying(100), "paymentProviderSubscriptionStatus" character varying(100), "paymentProviderSubscriptionSeats" integer, "trialEndsAt" TIMESTAMP WITH TIME ZONE, "activeMonitorCount" integer, "wasProjectBlocked" boolean, CONSTRAINT "PK_bd397da7b51a8649b38c3c8b272" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "idx_deleted_project_project_id" ON "DeletedProject" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "idx_deleted_project_project_deleted_at" ON "DeletedProject" ("projectDeletedAt") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" ADD CONSTRAINT "FK_bb76f7ebe3ee418ffd79346f203" FOREIGN KEY ("projectDeletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" ADD CONSTRAINT "FK_084492367421031e80cd0fdbf1e" FOREIGN KEY ("projectCreatedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" DROP CONSTRAINT "FK_084492367421031e80cd0fdbf1e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" DROP CONSTRAINT "FK_bb76f7ebe3ee418ffd79346f203"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."idx_deleted_project_project_deleted_at"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."idx_deleted_project_project_id"`,
+    );
+    await queryRunner.query(`DROP TABLE "DeletedProject"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786551733814-MigrationName.ts

@@ -0,0 +1,41 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1786551733814 implements MigrationInterface {
+  public name: string = "MigrationName1786551733814";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntity" ADD "source" character varying(100) NOT NULL DEFAULT 'discovered'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntity" ADD "description" character varying(500)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntityRelationship" ADD "source" character varying(100) NOT NULL DEFAULT 'discovered'`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_8106b1d6443d982b12e3318318" ON "TelemetryEntity" ("source") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_26ea726e2ee8fa622348581ac1" ON "TelemetryEntityRelationship" ("source") `,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_26ea726e2ee8fa622348581ac1"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_8106b1d6443d982b12e3318318"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntityRelationship" DROP COLUMN "source"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntity" DROP COLUMN "description"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryEntity" DROP COLUMN "source"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786559879134-AddWorkflowLogStepTrace.ts

@@ -0,0 +1,17 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddWorkflowLogStepTrace1786559879134
+  implements MigrationInterface
+{
+  public name: string = "AddWorkflowLogStepTrace1786559879134";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "WorkflowLog" ADD "stepTrace" jsonb`);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowLog" DROP COLUMN "stepTrace"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -512,6 +512,11 @@ import { AddInvestigationCodeFixRecommendation1786500000000 } from "./1786500000
 import { AddInvestigationAnalysisTldr1786600000000 } from "./1786600000000-AddInvestigationAnalysisTldr";
 import { DropProjectCallSMSConfigCredentialUniques1786700000000 } from "./1786700000000-DropProjectCallSMSConfigCredentialUniques";
 import { AddDataSourceTable1786303472848 } from "./1786303472848-AddDataSourceTable";
+import { MigrationName1786446545142 } from "./1786446545142-MigrationName";
+import { AddMonitorDependency1786449497966 } from "./1786449497966-AddMonitorDependency";
+import { AddDeletedProjectTable1786461136170 } from "./1786461136170-AddDeletedProjectTable";
+import { MigrationName1786551733814 } from "./1786551733814-MigrationName";
+import { AddWorkflowLogStepTrace1786559879134 } from "./1786559879134-AddWorkflowLogStepTrace";
 
 export default [
   InitialMigration,
@@ -1028,4 +1033,9 @@ export default [
   AddInvestigationAnalysisTldr1786600000000,
   DropProjectCallSMSConfigCredentialUniques1786700000000,
   AddDataSourceTable1786303472848,
+  MigrationName1786446545142,
+  AddMonitorDependency1786449497966,
+  AddDeletedProjectTable1786461136170,
+  MigrationName1786551733814,
+  AddWorkflowLogStepTrace1786559879134,
 ];

package/Server/Middleware/MasterAdminAuthorization.ts

@@ -59,13 +59,18 @@ export default class MasterAdminAuthorization {
    * Same as isAuthorizedMasterAdminMiddleware, but ALSO accepts the instance-wide
    * master API key (Admin Dashboard → Settings → API Key) supplied in the
    * `apikey` header. The master key has root/master-admin access, so this lets
-   * automated callers reach the master-admin OneUptime Health endpoints with the
-   * key instead of a logged-in master-admin session.
+   * automated callers reach master-admin endpoints with the key instead of a
+   * logged-in master-admin session.
    *
-   * Deliberately scoped to the read-only health / diagnostics routes only. It is
-   * NOT used on higher-risk master-admin actions (e.g. the read/write query
-   * console or broadcast email), which stay on the JWT-only middleware above so
-   * that a leaked static key cannot trigger them headlessly.
+   * Deliberately scoped to READ-ONLY routes: the OneUptime Health / diagnostics
+   * endpoints, and the cross-tenant read of one user's projects
+   * (POST /user/:userId/projects). It is NOT used on master-admin routes that
+   * change anything — the read/write query console, broadcast email, removing a
+   * user from a project, setting a password — which stay on the JWT-only
+   * middleware above so that a leaked static key cannot trigger them headlessly.
+   *
+   * Read-only is the line to hold when adding a route here. A key that can read
+   * discloses; a key that can write takes over.
    */
   public static async isAuthorizedMasterAdminOrMasterApiKeyMiddleware(
     req: ExpressRequest,

package/Server/Services/AIAgentService.ts

@@ -15,6 +15,7 @@ import AIAgentOwnerTeamService from "./AIAgentOwnerTeamService";
 import TeamMemberService from "./TeamMemberService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ProjectService from "./ProjectService";
+import FileService from "./FileService";
 import Dictionary from "../../Types/Dictionary";
 import OneUptimeDate from "../../Types/Date";
 import UserNotificationSettingService from "./UserNotificationSettingService";
@@ -174,6 +175,21 @@ export class Service extends DatabaseService<Model> {
     return { createBy: createBy, carryForward: [] };
   }
 
+  /*
+   * An AI agent icon is rendered by the id-based image route, which
+   * serves only public files. The file picker uploads it private, so
+   * attaching it to an agent is the point at which it becomes public.
+   */
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    await FileService.makeFilePublic(createdItem.iconFileId);
+
+    return createdItem;
+  }
+
   @CaptureSpan()
   public async getOwners(aiAgentId: ObjectID): Promise<Array<User>> {
     if (!aiAgentId) {
@@ -339,6 +355,10 @@ export class Service extends DatabaseService<Model> {
     onUpdate: OnUpdate<Model>,
     _updatedItemIds: Array<ObjectID>,
   ): Promise<OnUpdate<Model>> {
+    await FileService.makeFilePublic(
+      onUpdate.updateBy.data.iconFileId as ObjectID | undefined,
+    );
+
     if (
       onUpdate.carryForward &&
       onUpdate.carryForward.aiAgentsToNotifyOwners.length > 0

package/Server/Services/DashboardDomainService.ts

@@ -1,18 +1,17 @@
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import GreenlockUtil from "../Utils/Greenlock/Greenlock";
 import logger, { LogAttributes } from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import DomainService from "./DomainService";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../Types/API/HTTPResponse";
-import URL from "../../Types/API/URL";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
-import API from "../../Utils/API";
 import AcmeCertificate from "../../Models/DatabaseModels/AcmeCertificate";
 import DomainModel from "../../Models/DatabaseModels/Domain";
 import DashboardDomain from "../../Models/DatabaseModels/DashboardDomain";
@@ -22,11 +21,60 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DashboardCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
 
+const DASHBOARD_DOMAIN_EGRESS_LABEL: string = "Dashboard domain";
+
 export class Service extends DatabaseService<DashboardDomain> {
   public constructor() {
     super(DashboardDomain);
   }
 
+  /*
+   * Normalize a submitted subdomain and reject anything that is not a plain
+   * DNS label chain.
+   *
+   * fullDomain is built as `${subdomain}.${baseDomain}` and then interpolated
+   * into "https://" + fullDomain + "/dashboard-api/..." — and URL parsing
+   * treats everything before the first "/" as the host. Without this check a
+   * subdomain of "169.254.169.254/latest/meta-data/#" hands an attacker the
+   * host, the port and the path of a request the certificate cron then makes
+   * unattended, every 15 minutes, from inside the cluster.
+   */
+  private static normalizeAndValidateSubdomain(
+    subdomain: string | undefined,
+  ): string {
+    const normalized: string = subdomain?.trim().toLowerCase() || "";
+
+    // "@" is the documented way to ask for the root domain.
+    if (normalized === "" || normalized === "@") {
+      return "";
+    }
+
+    if (!Domain.isValidSubdomain(normalized)) {
+      throw new BadDataException(
+        `Subdomain ${normalized} is not valid. Use a plain subdomain such as "dashboard" — schemes, ports, paths and "/" are not allowed.`,
+      );
+    }
+
+    return normalized;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<DashboardDomain>,
+  ): Promise<OnUpdate<DashboardDomain>> {
+    /*
+     * Create-time validation alone leaves the value editable afterwards —
+     * subdomain is ProjectMember-updatable.
+     */
+    if (updateBy.data.subdomain !== undefined) {
+      updateBy.data.subdomain = Service.normalizeAndValidateSubdomain(
+        updateBy.data.subdomain as string,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<DashboardDomain>,
@@ -48,14 +96,11 @@ export class Service extends DatabaseService<DashboardDomain> {
       );
     }
 
-    let normalizedSubdomain: string =
-      createBy.data.subdomain?.trim().toLowerCase() || "";
-
-    if (normalizedSubdomain === "@") {
-      normalizedSubdomain = "";
-    }
+    createBy.data.subdomain = Service.normalizeAndValidateSubdomain(
+      createBy.data.subdomain,
+    );
 
-    createBy.data.subdomain = normalizedSubdomain;
+    const normalizedSubdomain: string = createBy.data.subdomain;
 
     if (domain) {
       const baseDomain: string =
@@ -230,13 +275,13 @@ export class Service extends DatabaseService<DashboardDomain> {
   ): Promise<boolean> {
     try {
       const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
-        await API.get({
-          url: URL.fromString(
+        await Domain.getForDomainVerification({
+          url:
             "https://" +
-              fulldomain +
-              "/dashboard-api/cname-verification/" +
-              token,
-          ),
+            fulldomain +
+            "/dashboard-api/cname-verification/" +
+            token,
+          targetLabel: DASHBOARD_DOMAIN_EGRESS_LABEL,
         });
 
       if (result.isFailure()) {
@@ -317,13 +362,13 @@ export class Service extends DatabaseService<DashboardDomain> {
 
       try {
         const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
-          await API.get({
-            url: URL.fromString(
+          await Domain.getForDomainVerification({
+            url:
               "http://" +
-                fullDomain +
-                "/dashboard-api/cname-verification/" +
-                token,
-            ),
+              fullDomain +
+              "/dashboard-api/cname-verification/" +
+              token,
+            targetLabel: DASHBOARD_DOMAIN_EGRESS_LABEL,
           });
 
         logger.debug("CNAME verification result", {
@@ -348,13 +393,13 @@ export class Service extends DatabaseService<DashboardDomain> {
 
       try {
         const resultHttps: HTTPErrorResponse | HTTPResponse<JSONObject> =
-          await API.get({
-            url: URL.fromString(
+          await Domain.getForDomainVerification({
+            url:
               "https://" +
-                fullDomain +
-                "/dashboard-api/cname-verification/" +
-                token,
-            ),
+              fullDomain +
+              "/dashboard-api/cname-verification/" +
+              token,
+            targetLabel: DASHBOARD_DOMAIN_EGRESS_LABEL,
           });
 
         logger.debug("CNAME verification result for https", {

package/Server/Services/DatabaseService.ts

@@ -1489,6 +1489,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         _id: deleteById.id.toString(),
       } as any,
       deletedByUser: deleteById.deletedByUser,
+      deletionReason: deleteById.deletionReason,
       props: deleteById.props,
     });
   }