@oneuptime/common 12.0.7 → 12.0.9

package/Tests/Utils/Telemetry/EntityKeyNonTelemetry.test.ts

@@ -0,0 +1,193 @@
+import {
+  computeEntityKey,
+  INVENTORY_ENTITY_IDENTITY_ATTRIBUTE,
+  keyForInventoryEntity,
+  keyForManualEntity,
+  MANUAL_ENTITY_IDENTITY_ATTRIBUTE,
+} from "../../../Utils/Telemetry/EntityKey";
+import EntityType from "../../../Types/Telemetry/EntityType";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * Identity for the two entity flavours that never pass through ingest:
+ * manually registered CIs and rows mirrored from OneUptime's inventory
+ * tables. Neither has an ingest-side resolver to byte-match, so the only
+ * things that must hold are the ones tested here — determinism, tenant and
+ * type separation, and the specific choice of what each keys on (a manual CI
+ * on its name, an inventory mirror on its owning row's id).
+ *
+ * The consequence of getting these wrong is duplicate registry rows that
+ * both look correct, so each property is pinned rather than assumed.
+ */
+
+const PROJECT: string = "proj1";
+const OTHER_PROJECT: string = "proj2";
+const RESOURCE_ID: string = "6f2e5c1a-0b3d-4e5f-8a9b-1c2d3e4f5a6b";
+
+describe("keyForManualEntity", () => {
+  test("is deterministic", () => {
+    expect(
+      keyForManualEntity(PROJECT, EntityType.ExternalService, "Stripe API"),
+    ).toBe(
+      keyForManualEntity(PROJECT, EntityType.ExternalService, "Stripe API"),
+    );
+  });
+
+  test("is a 16-char lowercase hex key, like every other entity key", () => {
+    const key: string = keyForManualEntity(
+      PROJECT,
+      EntityType.ExternalService,
+      "Stripe API",
+    );
+    expect(key).toMatch(/^[0-9a-f]{16}$/);
+  });
+
+  test("canonicalizes the name, so casing and padding do not fork identity", () => {
+    const canonical: string = keyForManualEntity(
+      PROJECT,
+      EntityType.ExternalService,
+      "Stripe API",
+    );
+
+    expect(
+      keyForManualEntity(PROJECT, EntityType.ExternalService, "  stripe api "),
+    ).toBe(canonical);
+    expect(
+      keyForManualEntity(PROJECT, EntityType.ExternalService, "STRIPE API"),
+    ).toBe(canonical);
+  });
+
+  test("separates tenants", () => {
+    expect(
+      keyForManualEntity(PROJECT, EntityType.ExternalService, "Stripe API"),
+    ).not.toBe(
+      keyForManualEntity(
+        OTHER_PROJECT,
+        EntityType.ExternalService,
+        "Stripe API",
+      ),
+    );
+  });
+
+  test("separates types, so one name can exist as two kinds of thing", () => {
+    expect(
+      keyForManualEntity(PROJECT, EntityType.ExternalService, "payments"),
+    ).not.toBe(
+      keyForManualEntity(PROJECT, EntityType.ExternalDatabase, "payments"),
+    );
+  });
+
+  test("distinct names within a type get distinct keys", () => {
+    expect(
+      keyForManualEntity(PROJECT, EntityType.ExternalService, "Stripe API"),
+    ).not.toBe(
+      keyForManualEntity(PROJECT, EntityType.ExternalService, "Adyen API"),
+    );
+  });
+
+  test("matches computeEntityKey over the documented identity attribute", () => {
+    expect(
+      keyForManualEntity(PROJECT, EntityType.Appliance, "Rack PDU 3"),
+    ).toBe(
+      computeEntityKey({
+        projectId: PROJECT,
+        entityType: EntityType.Appliance,
+        identifyingAttributes: {
+          [MANUAL_ENTITY_IDENTITY_ATTRIBUTE]: "rack pdu 3",
+        },
+      }),
+    );
+  });
+});
+
+describe("keyForInventoryEntity", () => {
+  test("is deterministic", () => {
+    expect(
+      keyForInventoryEntity(PROJECT, EntityType.NetworkDevice, RESOURCE_ID),
+    ).toBe(
+      keyForInventoryEntity(PROJECT, EntityType.NetworkDevice, RESOURCE_ID),
+    );
+  });
+
+  test("keys on the owning row id, so renaming the row keeps its identity", () => {
+    /*
+     * This is the whole reason inventory mirrors key on the id rather than
+     * the name: a rename must update the existing registry row, not orphan
+     * it and mint a second one alongside.
+     */
+    const key: string = keyForInventoryEntity(
+      PROJECT,
+      EntityType.NetworkDevice,
+      RESOURCE_ID,
+    );
+
+    expect(
+      keyForInventoryEntity(PROJECT, EntityType.NetworkDevice, RESOURCE_ID),
+    ).toBe(key);
+  });
+
+  test("separates tenants and types", () => {
+    const key: string = keyForInventoryEntity(
+      PROJECT,
+      EntityType.NetworkDevice,
+      RESOURCE_ID,
+    );
+
+    expect(
+      keyForInventoryEntity(
+        OTHER_PROJECT,
+        EntityType.NetworkDevice,
+        RESOURCE_ID,
+      ),
+    ).not.toBe(key);
+    expect(
+      keyForInventoryEntity(PROJECT, EntityType.IoTDevice, RESOURCE_ID),
+    ).not.toBe(key);
+  });
+
+  test("distinct rows get distinct keys", () => {
+    expect(
+      keyForInventoryEntity(PROJECT, EntityType.NetworkDevice, RESOURCE_ID),
+    ).not.toBe(
+      keyForInventoryEntity(
+        PROJECT,
+        EntityType.NetworkDevice,
+        "11111111-2222-3333-4444-555555555555",
+      ),
+    );
+  });
+
+  test("matches computeEntityKey over the documented identity attribute", () => {
+    expect(
+      keyForInventoryEntity(PROJECT, EntityType.CloudResource, RESOURCE_ID),
+    ).toBe(
+      computeEntityKey({
+        projectId: PROJECT,
+        entityType: EntityType.CloudResource,
+        identifyingAttributes: {
+          [INVENTORY_ENTITY_IDENTITY_ATTRIBUTE]: RESOURCE_ID,
+        },
+      }),
+    );
+  });
+});
+
+describe("manual and inventory identities do not collide", () => {
+  test("the two attributes are distinct", () => {
+    expect(MANUAL_ENTITY_IDENTITY_ATTRIBUTE).not.toBe(
+      INVENTORY_ENTITY_IDENTITY_ATTRIBUTE,
+    );
+  });
+
+  test("same project, same type, same literal value still key differently", () => {
+    /*
+     * A manual CI literally named after a resource id would otherwise
+     * collide with the mirror of that resource.
+     */
+    expect(
+      keyForManualEntity(PROJECT, EntityType.Appliance, RESOURCE_ID),
+    ).not.toBe(
+      keyForInventoryEntity(PROJECT, EntityType.Appliance, RESOURCE_ID),
+    );
+  });
+});

package/Tests/__mocks__/bullmq.js

@@ -0,0 +1,55 @@
+/*
+ * bullmq ships ESM and pulls in msgpackr, which is also ESM. Neither is listed
+ * in transformIgnorePatterns, so the moment any module under test reaches
+ * Server/Infrastructure/Queue the suite dies before a single test runs with
+ * "SyntaxError: Unexpected token 'export'" pointing at msgpackr/index.js.
+ *
+ * That import edge is not exotic: enqueueing a job is ordinary service code, so
+ * any service that schedules background work drags bullmq into the graph of
+ * every test that touches it, however indirectly. Mapping the package here -
+ * the same mechanism this config already uses for uuid, yaml, locter, otpauth
+ * and friends - fixes it once for every current and future test, instead of
+ * making each one repeat a hoisted jest.mock factory.
+ *
+ * The surface below is only what the real Queue wrapper calls. A test that
+ * needs to assert on queue behaviour should still declare its own
+ * jest.mock("bullmq", ...) with a richer factory, which takes precedence over
+ * this mapping - Common/Tests/Server/Infrastructure/Queue.test.ts does exactly
+ * that.
+ */
+
+class Queue {
+  constructor() {
+    this.add = jest.fn().mockResolvedValue({});
+    this.getRepeatableJobs = jest.fn().mockResolvedValue([]);
+    this.removeRepeatableByKey = jest.fn().mockResolvedValue(true);
+    this.getJob = jest.fn().mockResolvedValue(undefined);
+    this.clean = jest.fn().mockResolvedValue([]);
+    this.close = jest.fn().mockResolvedValue(undefined);
+    this.client = Promise.resolve({ on: jest.fn() });
+  }
+}
+
+class Worker {
+  constructor() {
+    this.on = jest.fn();
+    this.close = jest.fn().mockResolvedValue(undefined);
+  }
+}
+
+class QueueEvents {
+  constructor() {
+    this.on = jest.fn();
+    this.close = jest.fn().mockResolvedValue(undefined);
+  }
+}
+
+class Job {}
+
+module.exports = {
+  __esModule: true,
+  Queue,
+  Worker,
+  QueueEvents,
+  Job,
+};

package/Types/AI/AIChatMessageStatus.ts

@@ -9,6 +9,12 @@ enum AIChatMessageStatus {
   WaitingForApproval = "WaitingForApproval",
   Completed = "Completed",
   Error = "Error",
+  /*
+   * The user pressed Stop: POST /ai-chat/cancel-run finalized the message
+   * mid-generation (contentInMarkdown says so). Terminal like Error, but
+   * deliberate — never counted or rendered as a failure.
+   */
+  Cancelled = "Cancelled",
 }
 
 export default AIChatMessageStatus;
@@ -17,7 +23,8 @@ export class AIChatMessageStatusHelper {
   public static isTerminalStatus(status: AIChatMessageStatus): boolean {
     return (
       status === AIChatMessageStatus.Completed ||
-      status === AIChatMessageStatus.Error
+      status === AIChatMessageStatus.Error ||
+      status === AIChatMessageStatus.Cancelled
     );
   }
 

package/Types/AI/AIChatTypes.ts

@@ -24,6 +24,18 @@ export enum AIChatCitationTargetType {
   MonitorView = "MonitorView",
   ScheduledMaintenanceEvents = "ScheduledMaintenanceEvents",
   ScheduledMaintenanceView = "ScheduledMaintenanceView",
+  OnCallPolicies = "OnCallPolicies",
+  OnCallPolicyView = "OnCallPolicyView",
+  StatusPages = "StatusPages",
+  StatusPageView = "StatusPageView",
+  Slos = "Slos",
+  SloView = "SloView",
+  Runbooks = "Runbooks",
+  RunbookView = "RunbookView",
+  Workflows = "Workflows",
+  WorkflowView = "WorkflowView",
+  Probes = "Probes",
+  Teams = "Teams",
 }
 
 export interface AIChatCitationTarget {

package/Types/Database/AccessControl/OwnerOnlyColumn.ts

@@ -0,0 +1,88 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { ReflectionMetadataType } from "../../Reflection";
+import "reflect-metadata";
+
+/*
+ * WHY THIS DECORATOR EXISTS, AND WHY @ColumnAccessControl COULD NOT DO THE JOB.
+ *
+ * @ColumnAccessControl lists the PERMISSIONS that may read a column, and the
+ * permission layer satisfies it by intersecting that list with the permissions
+ * the caller holds. That works for "only a billing admin may read this", and it
+ * is useless for "only the person this row belongs to may read this", for one
+ * blunt reason: Permission.CurrentUser is auto-granted to every authenticated
+ * caller (DatabaseCommonInteractionPropsUtil.getUserPermissions pushes it onto
+ * the global permission list whenever props.userId is set). A column list of
+ * [CurrentUser] therefore admits EVERY logged-in user in the project, including
+ * an administrator reading somebody else's row. Row scoping has only ever come
+ * from the TABLE list, never from a column list, and no arrangement of column
+ * lists can restrict which VALUES a caller sees.
+ *
+ * So the marking here carries no permissions at all. It says one thing:
+ *
+ *   this column may be read only by a query that is pinned to the row's owner.
+ *
+ * What "pinned" means, and every route by which a marked column can be reached
+ * (a top-level select, a select nested through a relation, a sort key injected
+ * into the select after the permission check, and a WHERE predicate used to
+ * probe values), is enforced by OwnerOnlyColumnPermission on the server. This
+ * file is only the mark.
+ *
+ * Mark credentials, secrets, verification codes and directly-addressable
+ * delivery targets - a phone number, an email address, a webhook URL, a device
+ * token. Do NOT mark the labels an administrator legitimately needs in order to
+ * see that a row exists and what kind of thing it is: a webhook's name, a
+ * device's name and type, a verification flag, the owning user id. An admin
+ * surface that cannot name the rows it is administering is not a feature.
+ */
+
+const ownerOnlyColumnSymbol: symbol = Symbol("OwnerOnlyColumn");
+
+export default (): ReflectionMetadataType => {
+  return Reflect.metadata(ownerOnlyColumnSymbol, true);
+};
+
+type IsOwnerOnlyColumnFunction = <T extends BaseModel>(
+  target: T,
+  propertyKey: string,
+) => boolean;
+
+/**
+ * True when the named column of this model is marked owner-only. Reads through
+ * the prototype chain, so a model that extends another inherits its marks.
+ */
+export const isOwnerOnlyColumn: IsOwnerOnlyColumnFunction = <
+  T extends BaseModel,
+>(
+  target: T,
+  propertyKey: string,
+): boolean => {
+  return (
+    Reflect.getMetadata(ownerOnlyColumnSymbol, target, propertyKey) === true
+  );
+};
+
+type GetOwnerOnlyColumnsFunction = <T extends BaseModel>(
+  target: T,
+) => Array<string>;
+
+/**
+ * Every owner-only column on this model. Enumerating requires the property to
+ * exist on the instance, which it does for every declared column because model
+ * columns are initialised to `undefined` in the class body - the same
+ * assumption getTableColumns() already makes.
+ */
+export const getOwnerOnlyColumns: GetOwnerOnlyColumnsFunction = <
+  T extends BaseModel,
+>(
+  target: T,
+): Array<string> => {
+  const columns: Array<string> = [];
+
+  for (const key of Object.keys(target)) {
+    if (Reflect.getMetadata(ownerOnlyColumnSymbol, target, key) === true) {
+      columns.push(key);
+    }
+  }
+
+  return columns;
+};

package/Types/Exception/ExceptionCode.ts

@@ -17,6 +17,8 @@ enum ExceptionCode {
   TimeoutException = 408,
   TenantNotFoundException = 405,
   SsoAuthorizationException = 406,
+  TooManyRequestsException = 429,
+  ServiceUnavailableException = 503,
 }
 
 export default ExceptionCode;

package/Types/Exception/ServiceUnavailableException.ts

@@ -0,0 +1,8 @@
+import Exception from "./Exception";
+import ExceptionCode from "./ExceptionCode";
+
+export default class ServiceUnavailableException extends Exception {
+  public constructor(message: string) {
+    super(ExceptionCode.ServiceUnavailableException, message);
+  }
+}

package/Types/Exception/TooManyRequestsException.ts

@@ -0,0 +1,8 @@
+import Exception from "./Exception";
+import ExceptionCode from "./ExceptionCode";
+
+export default class TooManyRequestsException extends Exception {
+  public constructor(message: string) {
+    super(ExceptionCode.TooManyRequestsException, message);
+  }
+}

package/Types/IP/IP.ts

@@ -13,65 +13,90 @@ export default class IP extends DatabaseProperty {
     return this._ip;
   }
 
+  /*
+   * Does ONE address match the allowlist?
+   *
+   * This deliberately takes a single `ip` rather than a list. It used to take
+   * an array and return true if ANY member matched, which made it trivially
+   * bypassable when callers fed it a whole X-Forwarded-For chain: the caller
+   * chooses the left-hand entries of that header, so "any entry matches" means
+   * "the caller can name any address they like". Resolve the one address you
+   * mean to check first -- see resolveClientIp in Server/Utils/ClientIp -- and
+   * check that.
+   *
+   * Throws BadDataException if `ip` is not a valid address, so callers must
+   * establish that before asking. Callers making an access decision should
+   * treat a throw as a denial.
+   */
   public static isInWhitelist(data: {
-    ips: Array<string>;
+    ip: string;
     whitelist: string[];
   }): boolean {
-    for (const ip of data.ips) {
-      // If whitelist is empty, return false
-      if (!data.whitelist || data.whitelist.length === 0) {
-        return false;
-      }
-
-      // Check if IP is valid
-      if (!IP.isIP(ip)) {
-        throw new BadDataException("Invalid IP address");
-      }
+    const ip: string = data.ip;
 
-      // Check each whitelist entry
-      for (const entry of data.whitelist) {
-        // Skip empty entries
-        if (!entry || entry.trim() === "") {
-          continue;
-        }
+    // If whitelist is empty, return false
+    if (!data.whitelist || data.whitelist.length === 0) {
+      return false;
+    }
 
-        // Direct IP match
-        if (entry === ip) {
-          return true;
-        }
+    // Check if IP is valid
+    if (!IP.isIP(ip)) {
+      throw new BadDataException("Invalid IP address");
+    }
 
-        // CIDR notation check (IPv4 only for now)
-        if (entry.includes("/") && IP.isIPv4(ip)) {
-          try {
-            const [network, prefixStr] = entry.split("/");
+    // Check each whitelist entry
+    for (const entry of data.whitelist) {
+      // Skip empty entries
+      const trimmedEntry: string = entry ? entry.trim() : "";
 
-            if (!network || !prefixStr) {
-              continue;
-            }
+      if (trimmedEntry === "") {
+        continue;
+      }
 
-            if (!IP.isIPv4(network)) {
-              continue;
-            }
+      // Direct IP match
+      if (trimmedEntry === ip) {
+        return true;
+      }
 
-            const prefix: number = parseInt(prefixStr, 10);
-            if (isNaN(prefix) || prefix < 0 || prefix > 32) {
-              continue;
-            }
+      // CIDR notation check (IPv4 only for now)
+      if (trimmedEntry.includes("/") && IP.isIPv4(ip)) {
+        try {
+          const [network, prefixStr] = trimmedEntry.split("/");
 
-            // Convert IPs to integers for comparison
-            const ipInt: number = this._ipv4ToInt(ip);
-            const networkInt: number = this._ipv4ToInt(network);
+          if (!network || !prefixStr) {
+            continue;
+          }
 
-            // Create mask from prefix
-            const mask: number = ~((1 << (32 - prefix)) - 1) >>> 0;
+          if (!IP.isIPv4(network)) {
+            continue;
+          }
 
-            // Check if IP is in network
-            if ((ipInt & mask) === (networkInt & mask)) {
-              return true;
-            }
-          } catch {
+          const prefix: number = parseInt(prefixStr, 10);
+          if (isNaN(prefix) || prefix < 0 || prefix > 32) {
             continue;
           }
+
+          // Convert IPs to integers for comparison
+          const ipInt: number = this._ipv4ToInt(ip);
+          const networkInt: number = this._ipv4ToInt(network);
+
+          /*
+           * Create mask from prefix.
+           *
+           * Note: a /0 entry does NOT match everything here -- JS evaluates
+           * `1 << 32` as `1 << 0`, so the mask comes out 0xFFFFFFFF and /0
+           * degenerates into an exact match on the network address. Left
+           * as-is deliberately: correcting it would WIDEN existing
+           * allowlists, which does not belong in a hardening change.
+           */
+          const mask: number = ~((1 << (32 - prefix)) - 1) >>> 0;
+
+          // Check if IP is in network
+          if ((ipInt & mask) === (networkInt & mask)) {
+            return true;
+          }
+        } catch {
+          continue;
         }
       }
     }
@@ -133,9 +158,30 @@ export default class IP extends DatabaseProperty {
     return this.ip;
   }
 
+  /*
+   * Both validators below are ANCHORED, and deliberately so.
+   *
+   * An unanchored pattern accepts any string that merely CONTAINS something
+   * address-shaped, which is never what a validator should mean. The IPv6
+   * pattern used to be unanchored, so `evil 2001:db8::1 evil`,
+   * `[2001:db8::1]:443` and `2001:0db8:85a3:::8a2e:0370:7334` all reported as
+   * valid addresses. Every consumer of isIP inherited that: an allowlist check
+   * accepted a value it could then never match, a monitor destination stored a
+   * hostname as an IP literal, and IpCanonicalUtil was handed input it could
+   * not canonicalize.
+   *
+   * Neither pattern carries the `g` flag either. `.test()` on a `g` regex is
+   * stateful -- it advances `lastIndex` between calls -- and only happens to
+   * be safe here because the literal is re-created on every call. A hoisted
+   * constant would have made alternate calls silently return the wrong answer.
+   *
+   * Note that neither validator trims: callers pass the exact string they mean
+   * to validate. Whitespace-padded input is rejected, which is how the IPv4
+   * side has always behaved.
+   */
   private static isIPv4(str: string): boolean {
     const regexExp: RegExp =
-      /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/gi;
+      /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/i;
     const result: boolean = regexExp.test(str);
 
     return result;
@@ -143,7 +189,7 @@ export default class IP extends DatabaseProperty {
 
   private static isIPv6(str: string): boolean {
     const regexExp: RegExp =
-      /(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))/gi;
+      /^(?:([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/i;
     return regexExp.test(str);
   }