@oneuptime/common 12.0.7 → 12.0.9

package/Server/API/TeamComplianceAPI.ts

@@ -12,7 +12,6 @@ import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
-import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import Team from "../../Models/DatabaseModels/Team";
 import TeamService, {
@@ -20,6 +19,44 @@ import TeamService, {
 } from "../Services/TeamService";
 import ComplianceRuleType from "../../Types/Team/ComplianceRuleType";
 
+/*
+ * `/team/compliance-status/:teamId` - who on this team cannot be paged, and why.
+ *
+ * AUTHORISATION, and why it is written out here rather than assumed.
+ *
+ * This route is mounted with UserMiddleware.getUserMiddleware, and that
+ * middleware is not an authorisation gate: it admits an unauthenticated request
+ * as UserType.Public and calls next(), and the tenant id it attaches is read
+ * from the caller-supplied `tenantid` header before any authorisation runs.
+ * Everything underneath then reads with `isRoot: true`, because a compliance
+ * page necessarily reports on people the reader may not be permitted to read
+ * individually. The handler is therefore the only gate that exists.
+ *
+ * Until this change the handler checked only that the header carried SOME
+ * project id, so anyone at all could send a `tenantid` and a team id and be told
+ * which of that team's responders are unreachable, by name and email. That is a
+ * roster of who to phone during an outage and who will never pick up, and it
+ * predates Phase 2 - it is not a regression introduced by the readiness work,
+ * but the readiness work rebuilt this service, so it is closed here.
+ *
+ * Two assertions now, in this order:
+ *
+ *   1. the caller is a logged-in member of the project they named
+ *      (CommonAPI.assertAuthenticatedProjectMember), and
+ *   2. the team in the path belongs to that same project - otherwise a member of
+ *      project A reads project B's roster simply by sending their own header
+ *      alongside a borrowed team id.
+ *
+ * TeamComplianceService scopes its own team read to the project as well, and the
+ * duplication is deliberate for the same reason OnCallReadinessAPI duplicates
+ * its service's guards: the service's scoping answers "no such team" (a 400),
+ * whereas a member of project A reaching for project B's team id is an
+ * authorisation failure and should be answered as one - and an endpoint's
+ * authorisation should be legible in the endpoint, not inferred from what some
+ * service happens to do today. The wording of the refusal is identical to the
+ * one a nonexistent team gets, so the route cannot be used to enumerate team ids
+ * across tenants.
+ */
 export default class TeamComplianceAPI extends BaseAPI<Team, TeamServiceType> {
   public constructor() {
     super(Team, TeamService);
@@ -33,25 +70,40 @@ export default class TeamComplianceAPI extends BaseAPI<Team, TeamServiceType> {
           const databaseProps: DatabaseCommonInteractionProps =
             await CommonAPI.getDatabaseCommonInteractionProps(req);
 
-          const projectId: ObjectID = databaseProps.tenantId as ObjectID;
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(databaseProps);
 
-          const teamId: ObjectID = new ObjectID(req.params["teamId"] as string);
+          /*
+           * ObjectID's constructor accepts any string, so an unparseable path
+           * segment would otherwise travel all the way to a query that matches
+           * nothing and be reported as "this team does not exist" rather than as
+           * "you sent nonsense". The guard this replaces was `if (!teamId)`,
+           * which could never fire: `new ObjectID(...)` is always truthy, so a
+           * malformed id was accepted silently.
+           */
+          const rawTeamId: string = (req.params["teamId"] as string) || "";
+          ObjectID.validateUUID(rawTeamId);
+          const teamId: ObjectID = new ObjectID(rawTeamId);
 
-          if (!projectId) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Invalid projectId."),
-            );
-          }
+          /*
+           * The team id arrives from the caller and everything downstream reads
+           * as root, so the team's OWN projectId - not the header - is what has
+           * to agree with the project the caller was authorised for.
+           */
+          const team: Team | null = await TeamService.findOneById({
+            id: teamId,
+            select: {
+              projectId: true,
+            },
+            props: {
+              isRoot: true,
+            },
+          });
 
-          if (!teamId) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Invalid teamId."),
-            );
-          }
+          CommonAPI.assertResourceBelongsToProject({
+            resourceProjectId: team?.projectId,
+            projectId: projectId,
+          });
 
           const complianceStatus: TeamComplianceStatus =
             await TeamComplianceService.getTeamComplianceStatus(

package/Server/API/TelemetryAPI.ts

@@ -47,6 +47,7 @@ import ExceptionAggregationService, {
 import MetricAggregationService, {
   FacetValue as MetricFacetValue,
   FacetRequest as MetricFacetRequest,
+  MetricForTraceItem,
 } from "../Services/MetricAggregationService";
 import ProfileAggregationService, {
   FlamegraphRequest,
@@ -61,6 +62,7 @@ import ProfileAggregationService, {
   DiffFlamegraphNode,
   ServiceActivityRequest,
   ServiceActivityItem,
+  TracePresenceResult,
 } from "../Services/ProfileAggregationService";
 import PprofEncoder, {
   PprofProfile,
@@ -445,6 +447,10 @@ router.post(
         ? (body["spanIds"] as Array<string>)
         : undefined;
 
+      const sessionIds: Array<string> | undefined = body["sessionIds"]
+        ? (body["sessionIds"] as Array<string>)
+        : undefined;
+
       const attributes: Record<string, string | Array<string>> | undefined =
         body["attributes"]
           ? (body["attributes"] as Record<string, string | Array<string>>)
@@ -461,6 +467,7 @@ router.post(
         bodySearchText,
         traceIds,
         spanIds,
+        sessionIds,
         attributes,
       };
 
@@ -540,6 +547,10 @@ router.post(
         ? (body["spanIds"] as Array<string>)
         : undefined;
 
+      const sessionIds: Array<string> | undefined = body["sessionIds"]
+        ? (body["sessionIds"] as Array<string>)
+        : undefined;
+
       const attributes: Record<string, string> | undefined = body["attributes"]
         ? (body["attributes"] as Record<string, string>)
         : undefined;
@@ -585,6 +596,7 @@ router.post(
                   bodySearchText,
                   traceIds,
                   spanIds,
+                  sessionIds,
                   attributes,
                 };
                 const values: Array<FacetValue> =
@@ -1625,6 +1637,73 @@ router.post(
   },
 );
 
+// --- Metrics For Trace (reverse exemplar lookup) Endpoint ---
+
+router.post(
+  "/telemetry/metrics/for-trace",
+  ...requireMetricReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+
+      const traceId: string | undefined =
+        body["traceId"] && typeof body["traceId"] === "string"
+          ? (body["traceId"] as string)
+          : undefined;
+
+      if (!traceId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("traceId is required"),
+        );
+      }
+
+      const spanIds: Array<string> | undefined = Array.isArray(body["spanIds"])
+        ? (body["spanIds"] as Array<string>).filter(
+            (s: unknown): s is string => {
+              return typeof s === "string" && s.length > 0;
+            },
+          )
+        : undefined;
+
+      const limit: number | undefined =
+        typeof body["limit"] === "number"
+          ? (body["limit"] as number)
+          : undefined;
+
+      const items: Array<MetricForTraceItem> =
+        await MetricAggregationService.getMetricsForTrace({
+          projectId: databaseProps.tenantId,
+          traceId,
+          ...(spanIds !== undefined && spanIds.length > 0 && { spanIds }),
+          ...(limit !== undefined && { limit }),
+        });
+
+      return Response.sendJsonObjectResponse(req, res, {
+        items: items as unknown as JSONObject,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 // --- Log Analytics Endpoint ---
 
 router.post(
@@ -1705,6 +1784,10 @@ router.post(
         ? (body["spanIds"] as Array<string>)
         : undefined;
 
+      const sessionIds: Array<string> | undefined = body["sessionIds"]
+        ? (body["sessionIds"] as Array<string>)
+        : undefined;
+
       const groupBy: Array<string> | undefined = body["groupBy"]
         ? (body["groupBy"] as Array<string>)
         : undefined;
@@ -1731,6 +1814,7 @@ router.post(
         bodySearchText,
         traceIds,
         spanIds,
+        sessionIds,
         limit,
       };
 
@@ -1823,6 +1907,10 @@ router.post(
         ? (body["spanIds"] as Array<string>)
         : undefined;
 
+      const sessionIds: Array<string> | undefined = body["sessionIds"]
+        ? (body["sessionIds"] as Array<string>)
+        : undefined;
+
       const rows: Array<JSONObject> = await LogAggregationService.getExportLogs(
         {
           projectId: databaseProps.tenantId,
@@ -1834,6 +1922,7 @@ router.post(
           bodySearchText,
           traceIds,
           spanIds,
+          sessionIds,
         },
       );
 
@@ -1927,6 +2016,10 @@ router.post(
 
       const count: number = (body["count"] as number) || 5;
 
+      const sessionIds: Array<string> | undefined = body["sessionIds"]
+        ? (body["sessionIds"] as Array<string>)
+        : undefined;
+
       const result: {
         before: Array<JSONObject>;
         after: Array<JSONObject>;
@@ -1936,6 +2029,7 @@ router.post(
         time: OneUptimeDate.fromString(time),
         logId,
         count,
+        sessionIds,
       });
 
       return Response.sendJsonObjectResponse(req, res, {
@@ -2121,12 +2215,29 @@ router.post(
           )
         : undefined;
 
-      if (!profileId && !startTime) {
+      const traceId: string | undefined =
+        body["traceId"] && typeof body["traceId"] === "string"
+          ? (body["traceId"] as string)
+          : undefined;
+
+      const spanIds: Array<string> | undefined = Array.isArray(body["spanIds"])
+        ? (body["spanIds"] as Array<string>).filter(
+            (s: unknown): s is string => {
+              return typeof s === "string" && s.length > 0;
+            },
+          )
+        : undefined;
+
+      /*
+       * A traceId bounds the read as tightly as a profileId (bloom-indexed
+       * point lookup), so it also satisfies the scoping requirement.
+       */
+      if (!profileId && !startTime && !traceId) {
         return Response.sendErrorResponse(
           req,
           res,
           new BadDataException(
-            "Either profileId or startTime must be provided",
+            "Either profileId, startTime, or traceId must be provided",
           ),
         );
       }
@@ -2140,6 +2251,8 @@ router.post(
         ...(profileType !== undefined && { profileType }),
         ...(profileTypes !== undefined &&
           profileTypes.length > 0 && { profileTypes }),
+        ...(traceId !== undefined && { traceId }),
+        ...(spanIds !== undefined && spanIds.length > 0 && { spanIds }),
       };
 
       const result: FlamegraphResult =
@@ -2183,30 +2296,43 @@ router.post(
         ? (body["profileId"] as string)
         : undefined;
 
+      const traceId: string | undefined =
+        body["traceId"] && typeof body["traceId"] === "string"
+          ? (body["traceId"] as string)
+          : undefined;
+
+      const spanIds: Array<string> | undefined = Array.isArray(body["spanIds"])
+        ? (body["spanIds"] as Array<string>).filter(
+            (s: unknown): s is string => {
+              return typeof s === "string" && s.length > 0;
+            },
+          )
+        : undefined;
+
       /*
-       * Only default the window when no profileId is given: a profile's
-       * samples are bounded by the profile itself, and a defaulted
-       * last-hour window would silently exclude any profile captured
-       * before the window started.
+       * Only default the window when neither profileId nor traceId is
+       * given: a profile's samples are bounded by the profile itself (and
+       * a trace's by the trace), so a defaulted last-hour window would
+       * silently exclude anything captured before the window started.
        */
       const startTime: Date | undefined = body["startTime"]
         ? OneUptimeDate.fromString(body["startTime"] as string)
-        : profileId
+        : profileId || traceId
           ? undefined
           : OneUptimeDate.addRemoveHours(OneUptimeDate.getCurrentDate(), -1);
 
       const endTime: Date | undefined = body["endTime"]
         ? OneUptimeDate.fromString(body["endTime"] as string)
-        : profileId
+        : profileId || traceId
           ? undefined
           : OneUptimeDate.getCurrentDate();
 
-      if (!profileId && !startTime) {
+      if (!profileId && !startTime && !traceId) {
         return Response.sendErrorResponse(
           req,
           res,
           new BadDataException(
-            "Either profileId or startTime must be provided",
+            "Either profileId, startTime, or traceId must be provided",
           ),
         );
       }
@@ -2249,6 +2375,8 @@ router.post(
         ...(profileType !== undefined && { profileType }),
         ...(profileTypes !== undefined &&
           profileTypes.length > 0 && { profileTypes }),
+        ...(traceId !== undefined && { traceId }),
+        ...(spanIds !== undefined && spanIds.length > 0 && { spanIds }),
         ...(limit !== undefined && { limit }),
         ...(sortBy !== undefined && { sortBy }),
       };
@@ -2647,12 +2775,29 @@ router.post(
           )
         : undefined;
 
-      if (!profileId && !startTime) {
+      const traceId: string | undefined =
+        body["traceId"] && typeof body["traceId"] === "string"
+          ? (body["traceId"] as string)
+          : undefined;
+
+      const spanIds: Array<string> | undefined = Array.isArray(body["spanIds"])
+        ? (body["spanIds"] as Array<string>).filter(
+            (s: unknown): s is string => {
+              return typeof s === "string" && s.length > 0;
+            },
+          )
+        : undefined;
+
+      /*
+       * A traceId bounds the read as tightly as a profileId (bloom-indexed
+       * point lookup), so it also satisfies the scoping requirement.
+       */
+      if (!profileId && !startTime && !traceId) {
         return Response.sendErrorResponse(
           req,
           res,
           new BadDataException(
-            "Either profileId or startTime must be provided",
+            "Either profileId, startTime, or traceId must be provided",
           ),
         );
       }
@@ -2668,6 +2813,8 @@ router.post(
         ...(profileType !== undefined && { profileType }),
         ...(profileTypes !== undefined &&
           profileTypes.length > 0 && { profileTypes }),
+        ...(traceId !== undefined && { traceId }),
+        ...(spanIds !== undefined && spanIds.length > 0 && { spanIds }),
       };
 
       const result: FunctionFocusResult =
@@ -2791,6 +2938,67 @@ router.post(
   },
 );
 
+// --- Profile Trace Presence Endpoint ---
+
+router.post(
+  "/telemetry/profiles/trace-presence",
+  ...requireProfileReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+
+      const traceId: string | undefined =
+        body["traceId"] && typeof body["traceId"] === "string"
+          ? (body["traceId"] as string)
+          : undefined;
+
+      if (!traceId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("traceId is required"),
+        );
+      }
+
+      const spanIds: Array<string> | undefined = Array.isArray(body["spanIds"])
+        ? (body["spanIds"] as Array<string>).filter(
+            (s: unknown): s is string => {
+              return typeof s === "string" && s.length > 0;
+            },
+          )
+        : undefined;
+
+      const result: TracePresenceResult =
+        await ProfileAggregationService.getTracePresence({
+          projectId: databaseProps.tenantId,
+          traceId,
+          ...(spanIds !== undefined && spanIds.length > 0 && { spanIds }),
+        });
+
+      return Response.sendJsonObjectResponse(req, res, {
+        sampleCount: result.sampleCount,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 /*
  * ---------------------------------------------------------------------
  * Session replay playback

package/Server/API/UserAPI.ts

@@ -53,10 +53,25 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
      * the gate; the read below runs as root because a master admin is not a
      * member of the projects being listed and so has no tenant permissions to
      * read them with.
+     *
+     * The gate accepts the instance-wide master API key as well as a
+     * master-admin session, because the caller asking "which projects is this
+     * person in?" is typically a script rather than somebody with a browser
+     * open. That is a widening, so it is worth being explicit about why it is
+     * the right one HERE and not on the routes below: this endpoint only reads,
+     * and it reads nothing the key does not already reach through
+     * POST /team-member/get-list, which any master-key caller can call today
+     * (untenanted, so cross-project) to assemble the same answer one membership
+     * at a time. The key buys convenience and correct paging, not new reach.
+     *
+     * The writes below stay on the session-only middleware. A leaked static key
+     * that can list memberships is a disclosure of what it could already
+     * disclose; one that can remove a user from a project, set their password or
+     * mail them a reset link is a headless account takeover.
      */
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/:userId/projects`,
-      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      MasterAdminAuthorization.isAuthorizedMasterAdminOrMasterApiKeyMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const userId: ObjectID = UserAPI.getUserIdFromParams(req);

package/Server/EnvironmentConfig.ts

@@ -597,6 +597,58 @@ export const HttpProtocol: Protocol =
 
 export const Host: string = process.env["HOST"] || "";
 
+/*
+ * How many reverse proxies that WE control sit in front of this process and
+ * append to X-Forwarded-For.
+ *
+ * X-Forwarded-For is caller-supplied on its left-hand end: every proxy appends
+ * the address it accepted the connection from, and our Nginx uses
+ * `$proxy_add_x_forwarded_for` (Nginx/default.conf.template), which keeps
+ * whatever the caller sent and adds to it. Only entries that one of our own
+ * proxies wrote mean anything, and those are at the RIGHT-hand end. This
+ * number says how far in from the right the real client sits, so IP
+ * allowlists and IP-keyed rate limits read an entry a caller cannot choose.
+ *
+ * 1 is correct for every topology this repo ships -- Docker Compose and the
+ * Helm chart both put exactly one Nginx (the `ingress` gateway) in front of
+ * the app, and the Kubernetes Service in front of that is L4 and does not
+ * touch the header.
+ *
+ * RAISE IT if you have added HTTP proxies of your own: a CDN or WAF that
+ * appends to X-Forwarded-For (Cloudflare, an AWS ALB, an external
+ * ingress-nginx) makes this 2, and each further appending hop adds one. Set it
+ * too low and you attribute requests to your own proxy; set it too high and
+ * you read an entry the caller controls.
+ *
+ * 0 ignores X-Forwarded-For entirely and uses only the TCP peer address --
+ * correct when the app is exposed directly with no proxy in front.
+ */
+export const TrustedProxyHops: number = ((): number => {
+  const rawValue: string | undefined = process.env["TRUSTED_PROXY_HOPS"];
+
+  if (rawValue === undefined || rawValue.trim() === "") {
+    return 1;
+  }
+
+  const parsedValue: number = Number(rawValue.trim());
+
+  /*
+   * Anything that is not a whole, non-negative, finite count is a
+   * misconfiguration. Fall back to the shipped topology rather than to 0:
+   * 0 would silently attribute every request to the gateway's own address,
+   * which does not fail closed so much as make allowlists useless.
+   */
+  if (
+    !Number.isFinite(parsedValue) ||
+    !Number.isInteger(parsedValue) ||
+    parsedValue < 0
+  ) {
+    return 1;
+  }
+
+  return parsedValue;
+})();
+
 export const ProvisionSsl: boolean = process.env["PROVISION_SSL"] === "true";
 
 export const CaptchaEnabled: boolean =

package/Server/Infrastructure/Postgres/DataSourceOptions.ts

@@ -40,6 +40,28 @@ const dataSourceOptions: DataSourceOptions = {
    * dedicated migrate Job owns migrations). See RunDatabaseMigrationsOnBoot.
    */
   migrationsRun: RunDatabaseMigrationsOnBoot,
+  /*
+   * Run each migration in its own transaction rather than wrapping the whole
+   * set in one (TypeORM's "all" default).
+   *
+   * An empty database — every new install, and the Postgres Schema Drift job —
+   * applies all 500+ migrations at once. Under "all", every table, index and
+   * foreign key those migrations create holds a lock for the entire run, and
+   * the total outgrew Postgres's default lock table
+   * (max_locks_per_transaction * max_connections), so the run aborted with
+   * "out of shared memory ... increase max_locks_per_transaction". "each"
+   * commits after every migration, so peak lock usage is one migration's worth
+   * instead of the whole history's, and it no longer scales with the number of
+   * migrations.
+   *
+   * Safe for every existing migration: none use CREATE INDEX CONCURRENTLY (it
+   * cannot run inside a transaction block, which is just as true per-migration
+   * as it was for the single wrapping transaction), and each migration is still
+   * atomic on its own. It is also more correct for the migrations that
+   * `SET LOCAL lock_timeout`, which is transaction-scoped and under "all" would
+   * have leaked into every migration that ran after them.
+   */
+  migrationsTransactionMode: "each",
   entities: Entities,
   applicationName: "oneuptime",
   ssl: ShouldDatabaseSslEnable

package/Server/Infrastructure/Postgres/SchemaMigrations/1786100000000-RestoreServiceLowerNameIndex.ts

@@ -70,10 +70,10 @@ import { MigrationInterface, QueryRunner } from "typeorm";
  *
  * NOT CONCURRENT, DELIBERATELY
  *
- * DataSourceOptions sets no `migrationsTransactionMode`, so TypeORM defaults to
- * "all" and runs every migration inside ONE transaction. `CREATE INDEX
- * CONCURRENTLY` cannot run inside a transaction block and would abort the whole
- * run. A plain CREATE INDEX takes a SHARE lock that blocks writes to Service
+ * DataSourceOptions sets `migrationsTransactionMode: "each"`, so every migration
+ * runs inside its own transaction. `CREATE INDEX CONCURRENTLY` cannot run inside
+ * a transaction block and would abort the run. A plain CREATE INDEX takes a
+ * SHARE lock that blocks writes to Service
  * for the duration, which is milliseconds at this table's size (thousands of
  * live rows).
  *

package/Server/Infrastructure/Postgres/SchemaMigrations/1786200000000-RestoreDroppedUniqueIndexes.ts

@@ -74,11 +74,11 @@ import { MigrationInterface, QueryRunner } from "typeorm";
  *
  * NOT CONCURRENT
  *
- * DataSourceOptions sets no `migrationsTransactionMode`, so TypeORM defaults to
- * "all" and runs every migration inside one transaction. CREATE INDEX
- * CONCURRENTLY cannot run inside a transaction block and would abort the run.
- * These tables are small (infrastructure inventory, not telemetry), so the
- * brief SHARE lock is not a concern.
+ * DataSourceOptions sets `migrationsTransactionMode: "each"`, so every migration
+ * runs inside its own transaction. CREATE INDEX CONCURRENTLY cannot run inside a
+ * transaction block and would abort the run. These tables are small
+ * (infrastructure inventory, not telemetry), so the brief SHARE lock is not a
+ * concern.
  *
  * HAND-WRITTEN
  *