@oneuptime/common 12.0.8 → 12.0.9

package/Tests/__mocks__/bullmq.js

@@ -0,0 +1,55 @@
+/*
+ * bullmq ships ESM and pulls in msgpackr, which is also ESM. Neither is listed
+ * in transformIgnorePatterns, so the moment any module under test reaches
+ * Server/Infrastructure/Queue the suite dies before a single test runs with
+ * "SyntaxError: Unexpected token 'export'" pointing at msgpackr/index.js.
+ *
+ * That import edge is not exotic: enqueueing a job is ordinary service code, so
+ * any service that schedules background work drags bullmq into the graph of
+ * every test that touches it, however indirectly. Mapping the package here -
+ * the same mechanism this config already uses for uuid, yaml, locter, otpauth
+ * and friends - fixes it once for every current and future test, instead of
+ * making each one repeat a hoisted jest.mock factory.
+ *
+ * The surface below is only what the real Queue wrapper calls. A test that
+ * needs to assert on queue behaviour should still declare its own
+ * jest.mock("bullmq", ...) with a richer factory, which takes precedence over
+ * this mapping - Common/Tests/Server/Infrastructure/Queue.test.ts does exactly
+ * that.
+ */
+
+class Queue {
+  constructor() {
+    this.add = jest.fn().mockResolvedValue({});
+    this.getRepeatableJobs = jest.fn().mockResolvedValue([]);
+    this.removeRepeatableByKey = jest.fn().mockResolvedValue(true);
+    this.getJob = jest.fn().mockResolvedValue(undefined);
+    this.clean = jest.fn().mockResolvedValue([]);
+    this.close = jest.fn().mockResolvedValue(undefined);
+    this.client = Promise.resolve({ on: jest.fn() });
+  }
+}
+
+class Worker {
+  constructor() {
+    this.on = jest.fn();
+    this.close = jest.fn().mockResolvedValue(undefined);
+  }
+}
+
+class QueueEvents {
+  constructor() {
+    this.on = jest.fn();
+    this.close = jest.fn().mockResolvedValue(undefined);
+  }
+}
+
+class Job {}
+
+module.exports = {
+  __esModule: true,
+  Queue,
+  Worker,
+  QueueEvents,
+  Job,
+};

package/Types/AI/AIChatMessageStatus.ts

@@ -9,6 +9,12 @@ enum AIChatMessageStatus {
   WaitingForApproval = "WaitingForApproval",
   Completed = "Completed",
   Error = "Error",
+  /*
+   * The user pressed Stop: POST /ai-chat/cancel-run finalized the message
+   * mid-generation (contentInMarkdown says so). Terminal like Error, but
+   * deliberate — never counted or rendered as a failure.
+   */
+  Cancelled = "Cancelled",
 }
 
 export default AIChatMessageStatus;
@@ -17,7 +23,8 @@ export class AIChatMessageStatusHelper {
   public static isTerminalStatus(status: AIChatMessageStatus): boolean {
     return (
       status === AIChatMessageStatus.Completed ||
-      status === AIChatMessageStatus.Error
+      status === AIChatMessageStatus.Error ||
+      status === AIChatMessageStatus.Cancelled
     );
   }
 

package/Types/AI/AIChatTypes.ts

@@ -24,6 +24,18 @@ export enum AIChatCitationTargetType {
   MonitorView = "MonitorView",
   ScheduledMaintenanceEvents = "ScheduledMaintenanceEvents",
   ScheduledMaintenanceView = "ScheduledMaintenanceView",
+  OnCallPolicies = "OnCallPolicies",
+  OnCallPolicyView = "OnCallPolicyView",
+  StatusPages = "StatusPages",
+  StatusPageView = "StatusPageView",
+  Slos = "Slos",
+  SloView = "SloView",
+  Runbooks = "Runbooks",
+  RunbookView = "RunbookView",
+  Workflows = "Workflows",
+  WorkflowView = "WorkflowView",
+  Probes = "Probes",
+  Teams = "Teams",
 }
 
 export interface AIChatCitationTarget {

package/Types/Database/AccessControl/OwnerOnlyColumn.ts

@@ -0,0 +1,88 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { ReflectionMetadataType } from "../../Reflection";
+import "reflect-metadata";
+
+/*
+ * WHY THIS DECORATOR EXISTS, AND WHY @ColumnAccessControl COULD NOT DO THE JOB.
+ *
+ * @ColumnAccessControl lists the PERMISSIONS that may read a column, and the
+ * permission layer satisfies it by intersecting that list with the permissions
+ * the caller holds. That works for "only a billing admin may read this", and it
+ * is useless for "only the person this row belongs to may read this", for one
+ * blunt reason: Permission.CurrentUser is auto-granted to every authenticated
+ * caller (DatabaseCommonInteractionPropsUtil.getUserPermissions pushes it onto
+ * the global permission list whenever props.userId is set). A column list of
+ * [CurrentUser] therefore admits EVERY logged-in user in the project, including
+ * an administrator reading somebody else's row. Row scoping has only ever come
+ * from the TABLE list, never from a column list, and no arrangement of column
+ * lists can restrict which VALUES a caller sees.
+ *
+ * So the marking here carries no permissions at all. It says one thing:
+ *
+ *   this column may be read only by a query that is pinned to the row's owner.
+ *
+ * What "pinned" means, and every route by which a marked column can be reached
+ * (a top-level select, a select nested through a relation, a sort key injected
+ * into the select after the permission check, and a WHERE predicate used to
+ * probe values), is enforced by OwnerOnlyColumnPermission on the server. This
+ * file is only the mark.
+ *
+ * Mark credentials, secrets, verification codes and directly-addressable
+ * delivery targets - a phone number, an email address, a webhook URL, a device
+ * token. Do NOT mark the labels an administrator legitimately needs in order to
+ * see that a row exists and what kind of thing it is: a webhook's name, a
+ * device's name and type, a verification flag, the owning user id. An admin
+ * surface that cannot name the rows it is administering is not a feature.
+ */
+
+const ownerOnlyColumnSymbol: symbol = Symbol("OwnerOnlyColumn");
+
+export default (): ReflectionMetadataType => {
+  return Reflect.metadata(ownerOnlyColumnSymbol, true);
+};
+
+type IsOwnerOnlyColumnFunction = <T extends BaseModel>(
+  target: T,
+  propertyKey: string,
+) => boolean;
+
+/**
+ * True when the named column of this model is marked owner-only. Reads through
+ * the prototype chain, so a model that extends another inherits its marks.
+ */
+export const isOwnerOnlyColumn: IsOwnerOnlyColumnFunction = <
+  T extends BaseModel,
+>(
+  target: T,
+  propertyKey: string,
+): boolean => {
+  return (
+    Reflect.getMetadata(ownerOnlyColumnSymbol, target, propertyKey) === true
+  );
+};
+
+type GetOwnerOnlyColumnsFunction = <T extends BaseModel>(
+  target: T,
+) => Array<string>;
+
+/**
+ * Every owner-only column on this model. Enumerating requires the property to
+ * exist on the instance, which it does for every declared column because model
+ * columns are initialised to `undefined` in the class body - the same
+ * assumption getTableColumns() already makes.
+ */
+export const getOwnerOnlyColumns: GetOwnerOnlyColumnsFunction = <
+  T extends BaseModel,
+>(
+  target: T,
+): Array<string> => {
+  const columns: Array<string> = [];
+
+  for (const key of Object.keys(target)) {
+    if (Reflect.getMetadata(ownerOnlyColumnSymbol, target, key) === true) {
+      columns.push(key);
+    }
+  }
+
+  return columns;
+};

package/Types/Exception/ExceptionCode.ts

@@ -17,6 +17,8 @@ enum ExceptionCode {
   TimeoutException = 408,
   TenantNotFoundException = 405,
   SsoAuthorizationException = 406,
+  TooManyRequestsException = 429,
+  ServiceUnavailableException = 503,
 }
 
 export default ExceptionCode;

package/Types/Exception/ServiceUnavailableException.ts

@@ -0,0 +1,8 @@
+import Exception from "./Exception";
+import ExceptionCode from "./ExceptionCode";
+
+export default class ServiceUnavailableException extends Exception {
+  public constructor(message: string) {
+    super(ExceptionCode.ServiceUnavailableException, message);
+  }
+}

package/Types/Exception/TooManyRequestsException.ts

@@ -0,0 +1,8 @@
+import Exception from "./Exception";
+import ExceptionCode from "./ExceptionCode";
+
+export default class TooManyRequestsException extends Exception {
+  public constructor(message: string) {
+    super(ExceptionCode.TooManyRequestsException, message);
+  }
+}

package/Types/IP/IP.ts

@@ -13,65 +13,90 @@ export default class IP extends DatabaseProperty {
     return this._ip;
   }
 
+  /*
+   * Does ONE address match the allowlist?
+   *
+   * This deliberately takes a single `ip` rather than a list. It used to take
+   * an array and return true if ANY member matched, which made it trivially
+   * bypassable when callers fed it a whole X-Forwarded-For chain: the caller
+   * chooses the left-hand entries of that header, so "any entry matches" means
+   * "the caller can name any address they like". Resolve the one address you
+   * mean to check first -- see resolveClientIp in Server/Utils/ClientIp -- and
+   * check that.
+   *
+   * Throws BadDataException if `ip` is not a valid address, so callers must
+   * establish that before asking. Callers making an access decision should
+   * treat a throw as a denial.
+   */
   public static isInWhitelist(data: {
-    ips: Array<string>;
+    ip: string;
     whitelist: string[];
   }): boolean {
-    for (const ip of data.ips) {
-      // If whitelist is empty, return false
-      if (!data.whitelist || data.whitelist.length === 0) {
-        return false;
-      }
-
-      // Check if IP is valid
-      if (!IP.isIP(ip)) {
-        throw new BadDataException("Invalid IP address");
-      }
+    const ip: string = data.ip;
 
-      // Check each whitelist entry
-      for (const entry of data.whitelist) {
-        // Skip empty entries
-        if (!entry || entry.trim() === "") {
-          continue;
-        }
+    // If whitelist is empty, return false
+    if (!data.whitelist || data.whitelist.length === 0) {
+      return false;
+    }
 
-        // Direct IP match
-        if (entry === ip) {
-          return true;
-        }
+    // Check if IP is valid
+    if (!IP.isIP(ip)) {
+      throw new BadDataException("Invalid IP address");
+    }
 
-        // CIDR notation check (IPv4 only for now)
-        if (entry.includes("/") && IP.isIPv4(ip)) {
-          try {
-            const [network, prefixStr] = entry.split("/");
+    // Check each whitelist entry
+    for (const entry of data.whitelist) {
+      // Skip empty entries
+      const trimmedEntry: string = entry ? entry.trim() : "";
 
-            if (!network || !prefixStr) {
-              continue;
-            }
+      if (trimmedEntry === "") {
+        continue;
+      }
 
-            if (!IP.isIPv4(network)) {
-              continue;
-            }
+      // Direct IP match
+      if (trimmedEntry === ip) {
+        return true;
+      }
 
-            const prefix: number = parseInt(prefixStr, 10);
-            if (isNaN(prefix) || prefix < 0 || prefix > 32) {
-              continue;
-            }
+      // CIDR notation check (IPv4 only for now)
+      if (trimmedEntry.includes("/") && IP.isIPv4(ip)) {
+        try {
+          const [network, prefixStr] = trimmedEntry.split("/");
 
-            // Convert IPs to integers for comparison
-            const ipInt: number = this._ipv4ToInt(ip);
-            const networkInt: number = this._ipv4ToInt(network);
+          if (!network || !prefixStr) {
+            continue;
+          }
 
-            // Create mask from prefix
-            const mask: number = ~((1 << (32 - prefix)) - 1) >>> 0;
+          if (!IP.isIPv4(network)) {
+            continue;
+          }
 
-            // Check if IP is in network
-            if ((ipInt & mask) === (networkInt & mask)) {
-              return true;
-            }
-          } catch {
+          const prefix: number = parseInt(prefixStr, 10);
+          if (isNaN(prefix) || prefix < 0 || prefix > 32) {
             continue;
           }
+
+          // Convert IPs to integers for comparison
+          const ipInt: number = this._ipv4ToInt(ip);
+          const networkInt: number = this._ipv4ToInt(network);
+
+          /*
+           * Create mask from prefix.
+           *
+           * Note: a /0 entry does NOT match everything here -- JS evaluates
+           * `1 << 32` as `1 << 0`, so the mask comes out 0xFFFFFFFF and /0
+           * degenerates into an exact match on the network address. Left
+           * as-is deliberately: correcting it would WIDEN existing
+           * allowlists, which does not belong in a hardening change.
+           */
+          const mask: number = ~((1 << (32 - prefix)) - 1) >>> 0;
+
+          // Check if IP is in network
+          if ((ipInt & mask) === (networkInt & mask)) {
+            return true;
+          }
+        } catch {
+          continue;
         }
       }
     }
@@ -133,9 +158,30 @@ export default class IP extends DatabaseProperty {
     return this.ip;
   }
 
+  /*
+   * Both validators below are ANCHORED, and deliberately so.
+   *
+   * An unanchored pattern accepts any string that merely CONTAINS something
+   * address-shaped, which is never what a validator should mean. The IPv6
+   * pattern used to be unanchored, so `evil 2001:db8::1 evil`,
+   * `[2001:db8::1]:443` and `2001:0db8:85a3:::8a2e:0370:7334` all reported as
+   * valid addresses. Every consumer of isIP inherited that: an allowlist check
+   * accepted a value it could then never match, a monitor destination stored a
+   * hostname as an IP literal, and IpCanonicalUtil was handed input it could
+   * not canonicalize.
+   *
+   * Neither pattern carries the `g` flag either. `.test()` on a `g` regex is
+   * stateful -- it advances `lastIndex` between calls -- and only happens to
+   * be safe here because the literal is re-created on every call. A hoisted
+   * constant would have made alternate calls silently return the wrong answer.
+   *
+   * Note that neither validator trims: callers pass the exact string they mean
+   * to validate. Whitespace-padded input is rejected, which is how the IPv4
+   * side has always behaved.
+   */
   private static isIPv4(str: string): boolean {
     const regexExp: RegExp =
-      /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/gi;
+      /^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$/i;
     const result: boolean = regexExp.test(str);
 
     return result;
@@ -143,7 +189,7 @@ export default class IP extends DatabaseProperty {
 
   private static isIPv6(str: string): boolean {
     const regexExp: RegExp =
-      /(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))/gi;
+      /^(?:([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])\.){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$/i;
     return regexExp.test(str);
   }
 

package/Types/Monitor/SnmpMonitor/NetworkTopology.ts

@@ -13,10 +13,16 @@
 export type NetworkTopologyNodeStatus = "up" | "down" | "unknown";
 
 /*
- * Which source(s) reported a link — a discovery protocol, or the bridge
- * forwarding database (endpoint attachment).
+ * Which source(s) reported a link — a discovery protocol, the bridge
+ * forwarding database (endpoint attachment), or a person.
+ *
+ * "manual" is a NetworkDeviceLink an operator drew: a cable neither protocol
+ * can see, because one end has discovery disabled, does not speak LLDP or
+ * CDP, or is monitored by ping alone. It is a protocol like the others so a
+ * hand-drawn link and a later-discovered one MERGE into a single edge
+ * carrying both, rather than doubling the line on the map.
  */
-export type NetworkTopologyLinkProtocol = "lldp" | "cdp" | "fdb";
+export type NetworkTopologyLinkProtocol = "lldp" | "cdp" | "fdb" | "manual";
 
 /*
  * What a node represents. Older payloads carry no kind — readers should
@@ -51,6 +57,35 @@ export type NetworkTopologyDeviceRole =
   | "host"
   | "unknown";
 
+/*
+ * Why a device is drawn with no links.
+ *
+ * "The router is not linked to any device" is a report we could previously
+ * only answer with a shrug — the map showed an isolated box and nothing about
+ * which of the several possible causes was the real one. These fields turn
+ * that into a sentence: discovery never ran, or it ran and the device
+ * reported nothing, or it reported neighbours that matched nothing we manage
+ * (and here is what they called themselves).
+ *
+ * Present on managed device nodes only; absent on older payloads.
+ */
+export interface NetworkTopologyNodeDiagnostics {
+  /*
+   * False when the device's interface walk is off. LLDP and CDP ride along
+   * with that walk, so a device with it disabled can never report a
+   * neighbour, however well it speaks either protocol.
+   */
+  isNeighborDiscoveryEnabled?: boolean | undefined;
+  // How many neighbour entries the device's last poll reported.
+  reportedNeighborCount: number;
+  /*
+   * What the unresolved neighbours called themselves. This is the actionable
+   * half: an operator reading "advertised OLD-CORE-SW1" knows immediately
+   * that a device was renamed, which no amount of "no links found" conveys.
+   */
+  unmatchedNeighborIdentifiers: Array<string>;
+}
+
 export interface NetworkTopologyNode {
   // Device id for managed nodes; a synthetic "unmanaged:<key>" id otherwise.
   id: string;
@@ -82,6 +117,8 @@ export interface NetworkTopologyNode {
   ipAddress?: string | undefined;
   classification?: string | undefined;
   vlanId?: number | undefined;
+  // Why this device has no links. Managed device nodes only.
+  diagnostics?: NetworkTopologyNodeDiagnostics | undefined;
 }
 
 /*
@@ -110,6 +147,15 @@ export interface NetworkTopologyEdge {
   // Operational data at each end, when the endpoint interface is known.
   fromInterface?: NetworkTopologyEdgeEndpoint | undefined;
   toInterface?: NetworkTopologyEdgeEndpoint | undefined;
+  /*
+   * Health for a link that has no interface counters of its own — a manual
+   * link with a Monitor bound to it. Readers prefer real interface data and
+   * fall back to this, so a discovered link never loses its measured state
+   * to a monitor's summary of it.
+   */
+  monitorState?: "up" | "down" | undefined;
+  // Operator-supplied label, set only on manual links.
+  name?: string | undefined;
 }
 
 export default interface NetworkTopology {

package/Types/NetworkDevice/NetworkDeviceMonitoringMethod.ts

@@ -0,0 +1,55 @@
+/*
+ * How a NetworkDevice's health is established.
+ *
+ * The network product was built around SNMP: a device is a thing an assigned
+ * probe walks on a schedule, and everything downstream — the status pill, the
+ * site rollup, the topology map — reads freshness off `lastSeenAt`, which only
+ * a successful walk ever stamps.
+ *
+ * Plenty of real gear cannot be walked. Consumer APs, PDUs, cameras, anything
+ * with SNMP disabled by policy: an operator tracks those with an ordinary Ping
+ * or IP monitor. They are as real a part of the network as the switch they
+ * hang off, and before this existed they could not be recorded as devices at
+ * all — so they were absent from the site hierarchy and from the topology map,
+ * which is what issue #3023 is about.
+ *
+ * `Monitor` is that second answer: no probe, no credentials, no polling; the
+ * bound Monitor's status IS the device's status, stamped through the same
+ * bridge that already stamps SNMP devices watched by a Network Device monitor.
+ *
+ * Stored as free text on the column (the SnmpVersion precedent), so parse it
+ * through `NetworkDeviceMonitoringMethodUtil.parse` rather than comparing the
+ * raw column: rows written before this existed hold NULL and must read as
+ * `Snmp`, which is what they are.
+ */
+export enum NetworkDeviceMonitoringMethod {
+  // An assigned probe walks the device over SNMP on its own schedule.
+  Snmp = "SNMP",
+  // No polling; a bound Monitor (Ping, IP, Port, ...) reports its health.
+  Monitor = "Monitor",
+}
+
+export class NetworkDeviceMonitoringMethodUtil {
+  /*
+   * NULL, empty and anything unrecognised read as Snmp — that is what every
+   * device created before this column existed is, and defaulting a device
+   * into "monitor-backed" would silently stop it being polled.
+   */
+  public static parse(
+    value: string | undefined | null,
+  ): NetworkDeviceMonitoringMethod {
+    if ((value || "").trim().toLowerCase() === "monitor") {
+      return NetworkDeviceMonitoringMethod.Monitor;
+    }
+    return NetworkDeviceMonitoringMethod.Snmp;
+  }
+
+  public static isMonitorBacked(value: string | undefined | null): boolean {
+    return (
+      NetworkDeviceMonitoringMethodUtil.parse(value) ===
+      NetworkDeviceMonitoringMethod.Monitor
+    );
+  }
+}
+
+export default NetworkDeviceMonitoringMethod;