@oneuptime/common 12.0.8 → 12.0.9

package/Models/DatabaseModels/UserOnCallLogTimeline.ts

@@ -238,6 +238,29 @@ export default class UserOnCallLogTimeline extends BaseModel {
   @JoinColumn({ name: "userNotificationRuleId" })
   public userNotificationRule?: UserNotificationRule = undefined;
 
+  /*
+   * Nullable, unlike every other id on this row.
+   *
+   * A timeline row records a delivery attempt, and not every delivery attempt
+   * is driven by a stored notification rule. When a responder is paged but has
+   * no rule matching the event's rule type and severity, the fallback delivers
+   * on whatever verified method they do have, driving the normal per-channel
+   * delivery path with a UserNotificationRule built in memory and never saved.
+   * That rule has no id, so there is nothing to point this column at.
+   *
+   * The alternative — persisting a synthetic rule row purely so the foreign key
+   * has something to reference — would put rules the user never configured into
+   * their notification settings, where they would show up in the UI, be matched
+   * by future executions, and have to be garbage collected. A NULL here states
+   * the truth plainly: this delivery had no rule behind it. Readers must treat
+   * the column as absent-by-design rather than as missing data.
+   *
+   * `required: true` is deliberately absent from the @TableColumn: that flag
+   * feeds getRequiredColumns(), which DatabaseService.checkRequiredFields reads
+   * to throw BadDataException before the insert is attempted. Leaving it on
+   * would reject every fallback row in the application layer even after the
+   * database column itself allows NULL.
+   */
   @ColumnAccessControl({
     create: [],
     read: [Permission.CurrentUser],
@@ -246,7 +269,6 @@ export default class UserOnCallLogTimeline extends BaseModel {
   @Index()
   @TableColumn({
     type: TableColumnType.ObjectID,
-    required: true,
     canReadOnRelationQuery: true,
     title: "User Notification Rule ID",
     description:
@@ -254,7 +276,7 @@ export default class UserOnCallLogTimeline extends BaseModel {
   })
   @Column({
     type: ColumnType.ObjectID,
-    nullable: false,
+    nullable: true,
     transformer: ObjectID.getDatabaseTransformer(),
   })
   public userNotificationRuleId?: ObjectID = undefined;

package/Models/DatabaseModels/UserPush.ts

@@ -4,6 +4,7 @@ import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import OwnerOnlyColumn from "../../Types/Database/AccessControl/OwnerOnlyColumn";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
@@ -19,6 +20,46 @@ import Permission from "../../Types/Permission";
 import PushDeviceType from "../../Types/PushNotification/PushDeviceType";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+/*
+ * `read` names Permission.CurrentUser and nothing else. That single entry is
+ * what makes every column below owner-only, and it has to stay that way.
+ *
+ * CurrentUser is auto-granted to every authenticated caller, so on a COLUMN
+ * list it does not mean "on my own row" - column permissions are intersected
+ * by NAME and never see the query at all. The row scope lives HERE:
+ * TenantPermission.isAccessGrantedOnlyByCurrentUser is true exactly while this
+ * table list holds nothing but CurrentUser, and that is what stamps
+ * `userId = me` onto every read and refuses one that names somebody else. Add
+ * a single administrator permission to this list and the stamp stops being
+ * applied for whoever holds it - and the device token, which is the
+ * provider-issued routing token anything holding it can deliver to that
+ * handset with, becomes readable on every member's row in the project.
+ *
+ * That is not hypothetical. It shipped once, and the column-level guard
+ * written to contain it was walked past by nested relation selects, by `query`
+ * filters it never inspected, and by the sort columns that are appended to the
+ * select after it had already run. Each fix produced the next defect, because
+ * this model was never designed to be read across users.
+ *
+ * An administrator who needs to know whether a colleague can be paged does not
+ * read this table. OnCallReadinessService answers that question as root and
+ * returns ReadinessMethod { methodId, methodType, maskedIdentifier,
+ * isVerified } - masked server-side by the one code path that holds the raw
+ * value - and the admin readiness surface already consumes it. The id is a
+ * foreign key rather than a secret: it lets an administrator POINT A RULE AT a
+ * method without reading the method's row, which is the thing the widening was
+ * actually reaching for. Point the next admin surface there. Widening this
+ * list is not a cheaper version of that; it is the version that leaks.
+ *
+ * One path does not pass through this list at all, and it is the reason
+ * `canReadOnRelationQuery: true` on deviceToken below is worth reading twice:
+ * a nested relation select made FROM a model whose own read is admin-wide -
+ * today UserNotificationRule - is checked by
+ * QueryPermission.checkRelationQueryPermission, which skips the column check
+ * outright when that flag is true and never consults this table list. Flipping
+ * the flag is a change to the rule tables that select the column through the
+ * relation, not a change that can be made here alone.
+ */
 @TenantColumn("projectId")
 @AllowAccessIfSubscriptionIsUnpaid()
 @TableAccessControl({
@@ -91,6 +132,14 @@ class UserPush extends BaseModel {
     read: [Permission.CurrentUser],
     update: [],
   })
+  /*
+   * The push subscription itself - endpoint plus keys. Anyone holding it can
+   * push notifications straight to that device, so it is a credential. The
+   * device NAME and TYPE next to it are deliberately left unmarked: they are
+   * how an admin surface says "Jane has a verified iPhone" without handing over
+   * the ability to push to it.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Device Token",
     required: true,

package/Models/DatabaseModels/UserSMS.ts

@@ -4,6 +4,7 @@ import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import OwnerOnlyColumn from "../../Types/Database/AccessControl/OwnerOnlyColumn";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
@@ -20,6 +21,36 @@ import Phone from "../../Types/Phone";
 import Text from "../../Types/Text";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+/*
+ * `read` names Permission.CurrentUser and nothing else. That single entry is
+ * what makes every column below owner-only, and it has to stay that way.
+ *
+ * CurrentUser is auto-granted to every authenticated caller, so on a COLUMN
+ * list it does not mean "on my own row" - column permissions are intersected
+ * by NAME and never see the query at all. The row scope lives HERE:
+ * TenantPermission.isAccessGrantedOnlyByCurrentUser is true exactly while this
+ * table list holds nothing but CurrentUser, and that is what stamps
+ * `userId = me` onto every read and refuses one that names somebody else. Add
+ * a single administrator permission to this list and the stamp stops being
+ * applied for whoever holds it - and the raw phone number and the verification
+ * code become readable on every member's row in the project.
+ *
+ * That is not hypothetical. It shipped once, and the column-level guard
+ * written to contain it was walked past by nested relation selects, by `query`
+ * filters it never inspected, and by the sort columns that are appended to the
+ * select after it had already run. Each fix produced the next defect, because
+ * this model was never designed to be read across users.
+ *
+ * An administrator who needs to know whether a colleague can be paged does not
+ * read this table. OnCallReadinessService answers that question as root and
+ * returns ReadinessMethod { methodId, methodType, maskedIdentifier,
+ * isVerified } - masked server-side by the one code path that holds the raw
+ * value - and the admin readiness surface already consumes it. The id is a
+ * foreign key rather than a secret: it lets an administrator POINT A RULE AT a
+ * method without reading the method's row, which is the thing the widening was
+ * actually reaching for. Point the next admin surface there. Widening this
+ * list is not a cheaper version of that; it is the version that leaks.
+ */
 @TenantColumn("projectId")
 @AllowAccessIfSubscriptionIsUnpaid()
 @TableAccessControl({
@@ -93,6 +124,13 @@ class UserSMS extends BaseModel {
     read: [Permission.CurrentUser],
     update: [],
   })
+  /*
+   * A personal mobile number, and a directly addressable delivery target. It is
+   * also the same number the person very likely uses for their own second
+   * factor elsewhere, which is why it does not belong in an admin's view of
+   * somebody else's on-call configuration.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Phone",
     required: true,
@@ -272,6 +310,11 @@ class UserSMS extends BaseModel {
     read: [],
     update: [],
   })
+  /*
+   * A live verification code. Reading somebody else's is claiming their
+   * notification channel.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
     description: "Temporary Verification Code",

package/Models/DatabaseModels/UserTelegram.ts

@@ -4,6 +4,7 @@ import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import OwnerOnlyColumn from "../../Types/Database/AccessControl/OwnerOnlyColumn";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
@@ -19,6 +20,48 @@ import Permission from "../../Types/Permission";
 import Text from "../../Types/Text";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+/*
+ * `read` names Permission.CurrentUser and nothing else. That single entry is
+ * what makes every column below owner-only, and it has to stay that way.
+ *
+ * CurrentUser is auto-granted to every authenticated caller, so on a COLUMN
+ * list it does not mean "on my own row" - column permissions are intersected
+ * by NAME and never see the query at all. The row scope lives HERE:
+ * TenantPermission.isAccessGrantedOnlyByCurrentUser is true exactly while this
+ * table list holds nothing but CurrentUser, and that is what stamps
+ * `userId = me` onto every read and refuses one that names somebody else. Add
+ * a single administrator permission to this list and the stamp stops being
+ * applied for whoever holds it - and the raw handle, the chat id a bot message
+ * can be addressed to, and the verification code that turns possession of that
+ * chat id into a verified method all become readable on every member's row in
+ * the project.
+ *
+ * That is not hypothetical. It shipped once, and the column-level guard
+ * written to contain it was walked past by nested relation selects, by `query`
+ * filters it never inspected, and by the sort columns that are appended to the
+ * select after it had already run. Each fix produced the next defect, because
+ * this model was never designed to be read across users.
+ *
+ * An administrator who needs to know whether a colleague can be paged does not
+ * read this table. OnCallReadinessService answers that question as root and
+ * returns ReadinessMethod { methodId, methodType, maskedIdentifier,
+ * isVerified } - masked server-side by the one code path that holds the raw
+ * value - and the admin readiness surface already consumes it. The id is a
+ * foreign key rather than a secret: it lets an administrator POINT A RULE AT a
+ * method without reading the method's row, which is the thing the widening was
+ * actually reaching for. Point the next admin surface there. Widening this
+ * list is not a cheaper version of that; it is the version that leaks.
+ *
+ * One path does not pass through this list at all, and it is the reason
+ * `canReadOnRelationQuery: true` below is worth reading twice: a nested
+ * relation select made FROM a model whose own read is admin-wide - today
+ * UserNotificationRule - is checked by
+ * QueryPermission.checkRelationQueryPermission, which skips the column check
+ * outright when that flag is true and never consults this table list. The
+ * columns carrying the flag are reachable that way. Narrowing them is a change
+ * to the rule tables that select them through the relation, not a change that
+ * can be made here alone.
+ */
 @TenantColumn("projectId")
 @AllowAccessIfSubscriptionIsUnpaid()
 @TableAccessControl({
@@ -91,6 +134,12 @@ class UserTelegram extends BaseModel {
     read: [Permission.CurrentUser],
     update: [Permission.CurrentUser],
   })
+  /*
+   * The person's Telegram identity outside this product. It is how they are
+   * found and messaged by anyone at all, not just by OneUptime, so it is a
+   * personal contact detail rather than a label for a row.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Telegram Handle",
     required: false,
@@ -114,6 +163,11 @@ class UserTelegram extends BaseModel {
     update: [],
   })
   @Index()
+  /*
+   * The chat the bot delivers into. Holding it is enough to send messages to
+   * that chat through the same bot, so it is a delivery target and not a label.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Telegram Chat ID",
     required: false,
@@ -289,6 +343,11 @@ class UserTelegram extends BaseModel {
     read: [Permission.CurrentUser],
     update: [],
   })
+  /*
+   * A live verification code. Reading somebody else's is claiming their
+   * notification channel.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
     description:

package/Models/DatabaseModels/UserWebhook.ts

@@ -4,6 +4,7 @@ import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import OwnerOnlyColumn from "../../Types/Database/AccessControl/OwnerOnlyColumn";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
@@ -18,6 +19,47 @@ import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+/*
+ * `read` names Permission.CurrentUser and nothing else. That single entry is
+ * what makes every column below owner-only, and it has to stay that way.
+ *
+ * CurrentUser is auto-granted to every authenticated caller, so on a COLUMN
+ * list it does not mean "on my own row" - column permissions are intersected
+ * by NAME and never see the query at all. The row scope lives HERE:
+ * TenantPermission.isAccessGrantedOnlyByCurrentUser is true exactly while this
+ * table list holds nothing but CurrentUser, and that is what stamps
+ * `userId = me` onto every read and refuses one that names somebody else. Add
+ * a single administrator permission to this list and the stamp stops being
+ * applied for whoever holds it - and the webhook URL and its signing secret,
+ * both bearer credentials that let whoever holds them impersonate OneUptime to
+ * the member's endpoint, become readable on every member's row in the project.
+ *
+ * That is not hypothetical. It shipped once, and the column-level guard
+ * written to contain it was walked past by nested relation selects, by `query`
+ * filters it never inspected, and by the sort columns that are appended to the
+ * select after it had already run. Each fix produced the next defect, because
+ * this model was never designed to be read across users.
+ *
+ * An administrator who needs to know whether a colleague can be paged does not
+ * read this table. OnCallReadinessService answers that question as root and
+ * returns ReadinessMethod { methodId, methodType, maskedIdentifier,
+ * isVerified } - masked server-side by the one code path that holds the raw
+ * value - and the admin readiness surface already consumes it. The id is a
+ * foreign key rather than a secret: it lets an administrator POINT A RULE AT a
+ * method without reading the method's row, which is the thing the widening was
+ * actually reaching for. Point the next admin surface there. Widening this
+ * list is not a cheaper version of that; it is the version that leaks.
+ *
+ * One path does not pass through this list at all, and it is the reason
+ * `canReadOnRelationQuery: true` on webhookUrl below is worth reading twice: a
+ * nested relation select made FROM a model whose own read is admin-wide -
+ * today UserNotificationRule - is checked by
+ * QueryPermission.checkRelationQueryPermission, which skips the column check
+ * outright when that flag is true and never consults this table list. The
+ * signing secret already carries `false` and is therefore closed on that path
+ * too; flipping the URL to match is a change to the rule tables that select it
+ * through the relation, not a change that can be made here alone.
+ */
 @TenantColumn("projectId")
 @AllowAccessIfSubscriptionIsUnpaid()
 @TableAccessControl({
@@ -112,6 +154,14 @@ class UserWebhook extends BaseModel {
     read: [Permission.CurrentUser],
     update: [Permission.CurrentUser],
   })
+  /*
+   * A webhook URL is a bearer credential in its own right. Slack, Discord and
+   * Teams hooks all carry their secret in the path, so anyone who can read this
+   * string can post into the channel it belongs to. It stays readable through a
+   * relation query - that is how a rule table renders which webhook a rule
+   * points at - but only for a query pinned to the webhook's owner.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Webhook URL",
     required: true,
@@ -134,6 +184,8 @@ class UserWebhook extends BaseModel {
     read: [Permission.CurrentUser],
     update: [Permission.CurrentUser],
   })
+  // The HMAC signing key. Reading it is forging requests.
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Signing Secret",
     required: false,

package/Models/DatabaseModels/UserWhatsApp.ts

@@ -4,6 +4,7 @@ import BaseModel from "./DatabaseBaseModel/DatabaseBaseModel";
 import Route from "../../Types/API/Route";
 import AllowAccessIfSubscriptionIsUnpaid from "../../Types/Database/AccessControl/AllowAccessIfSubscriptionIsUnpaid";
 import ColumnAccessControl from "../../Types/Database/AccessControl/ColumnAccessControl";
+import OwnerOnlyColumn from "../../Types/Database/AccessControl/OwnerOnlyColumn";
 import TableAccessControl from "../../Types/Database/AccessControl/TableAccessControl";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import ColumnType from "../../Types/Database/ColumnType";
@@ -20,6 +21,36 @@ import Phone from "../../Types/Phone";
 import Text from "../../Types/Text";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
+/*
+ * `read` names Permission.CurrentUser and nothing else. That single entry is
+ * what makes every column below owner-only, and it has to stay that way.
+ *
+ * CurrentUser is auto-granted to every authenticated caller, so on a COLUMN
+ * list it does not mean "on my own row" - column permissions are intersected
+ * by NAME and never see the query at all. The row scope lives HERE:
+ * TenantPermission.isAccessGrantedOnlyByCurrentUser is true exactly while this
+ * table list holds nothing but CurrentUser, and that is what stamps
+ * `userId = me` onto every read and refuses one that names somebody else. Add
+ * a single administrator permission to this list and the stamp stops being
+ * applied for whoever holds it - and the raw WhatsApp number and the
+ * verification code become readable on every member's row in the project.
+ *
+ * That is not hypothetical. It shipped once, and the column-level guard
+ * written to contain it was walked past by nested relation selects, by `query`
+ * filters it never inspected, and by the sort columns that are appended to the
+ * select after it had already run. Each fix produced the next defect, because
+ * this model was never designed to be read across users.
+ *
+ * An administrator who needs to know whether a colleague can be paged does not
+ * read this table. OnCallReadinessService answers that question as root and
+ * returns ReadinessMethod { methodId, methodType, maskedIdentifier,
+ * isVerified } - masked server-side by the one code path that holds the raw
+ * value - and the admin readiness surface already consumes it. The id is a
+ * foreign key rather than a secret: it lets an administrator POINT A RULE AT a
+ * method without reading the method's row, which is the thing the widening was
+ * actually reaching for. Point the next admin surface there. Widening this
+ * list is not a cheaper version of that; it is the version that leaks.
+ */
 @TenantColumn("projectId")
 @AllowAccessIfSubscriptionIsUnpaid()
 @TableAccessControl({
@@ -92,6 +123,11 @@ class UserWhatsApp extends BaseModel {
     read: [Permission.CurrentUser],
     update: [],
   })
+  /*
+   * A personal phone number, and a directly addressable delivery target. Same
+   * reasoning as UserSMS.phone - and usually the very same number.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "WhatsApp Number",
     required: true,
@@ -266,6 +302,11 @@ class UserWhatsApp extends BaseModel {
     read: [],
     update: [],
   })
+  /*
+   * A live verification code. Reading somebody else's is claiming their
+   * notification channel.
+   */
+  @OwnerOnlyColumn()
   @TableColumn({
     title: "Verification Code",
     description: "Temporary Verification Code",

package/Models/DatabaseModels/WorkflowVariable.ts

@@ -33,10 +33,22 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 })
 @TenantColumn("projectId")
 @TableAccessControl({
+  /*
+   * Mirrors Workflow's own create list. Anyone who can create a workflow can
+   * create the variables that workflow needs — the create-from-template wizard
+   * writes both in one go, and a member who could do the first but not the
+   * second was left with a saved workflow whose {{local.variables.…}}
+   * references resolved to nothing. Unresolved references are not an error at
+   * run time (VMAPI leaves the literal text in place), so that workflow looked
+   * healthy and posted braces to Slack.
+   */
   create: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
     Permission.CreateWorkflowVariable,
+    Permission.ProjectMember,
+    Permission.WorkflowAdmin,
+    Permission.WorkflowMember,
   ],
   read: [
     Permission.ProjectOwner,