@oneuptime/common 13.0.0 → 13.0.1

package/Server/Infrastructure/Postgres/SchemaMigrations/1792100000000-AddGitHubCommandSettingsToCodeRepository.ts

@@ -0,0 +1,47 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Per-repository settings for the interactive GitHub App: whether it answers
+ * commands in this repository's issues and pull requests, and which issue
+ * label hands it work.
+ *
+ * DDL taken verbatim from `npm run generate-postgres-migration`; only the
+ * class name and this comment are hand-written.
+ *
+ * Both columns are NULLABLE with no default, and both nulls are meaningful:
+ *
+ *   - A null `isGitHubCommandsEnabled` means ENABLED. Backfilling every
+ *     existing row to `true` would say the same thing at the cost of a table
+ *     rewrite, and defaulting to `false` would mean the feature does nothing
+ *     anywhere until each repository is visited by hand. Nothing happens in a
+ *     repository until somebody deliberately mentions the app, so the safe
+ *     default and the useful one are the same. The reader is
+ *     GitHubCommandAuthorizer.areCommandsEnabled, which spells it as
+ *     `!== false`.
+ *
+ *   - A null `gitHubTriggerLabel` means the default label, the literal
+ *     "oneuptime" (DEFAULT_GITHUB_TRIGGER_LABEL in GitHubWebhookEvents).
+ */
+export class AddGitHubCommandSettingsToCodeRepository1792100000000
+  implements MigrationInterface
+{
+  public name = "AddGitHubCommandSettingsToCodeRepository1792100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "CodeRepository" ADD "isGitHubCommandsEnabled" boolean`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CodeRepository" ADD "gitHubTriggerLabel" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "CodeRepository" DROP COLUMN "gitHubTriggerLabel"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "CodeRepository" DROP COLUMN "isGitHubCommandsEnabled"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1792200000000-AddUserWebAuthnPurpose.ts

@@ -0,0 +1,17 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddUserWebAuthnPurpose1792200000000 implements MigrationInterface {
+  public name = "AddUserWebAuthnPurpose1792200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserWebAuthn" ADD "isPasskey" boolean`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserWebAuthn" DROP COLUMN "isPasskey"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1792300000000-AddGoogleSecOpsDiagnostics.ts

@@ -0,0 +1,83 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddGoogleSecOpsDiagnostics1792300000000
+  implements MigrationInterface
+{
+  public name: string = "AddGoogleSecOpsDiagnostics1792300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "GoogleSecOpsConnectionRun" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "googleSecOpsConnectionId" uuid NOT NULL, "requestedByUserId" uuid, "type" character varying(100) NOT NULL, "status" character varying(100) NOT NULL, "startedAt" TIMESTAMP WITH TIME ZONE, "completedAt" TIMESTAMP WITH TIME ZONE, "request" jsonb, "result" jsonb, "error" text, CONSTRAINT "PK_edc505ba32341f44a99ff40be50" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_0037f8381daf86ddbe38e0b485" ON "GoogleSecOpsConnectionRun" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5fc0c5f4352278ed7c7a8de5d6" ON "GoogleSecOpsConnectionRun" ("googleSecOpsConnectionId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_dff8018998e3e8d5d702094e21" ON "GoogleSecOpsConnectionRun" ("requestedByUserId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_cd32cd9e57cde7e7d75d03457e" ON "GoogleSecOpsConnectionRun" ("projectId", "googleSecOpsConnectionId", "createdAt") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ADD "includeNonAlertingDetections" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ADD "lastSuccessfulPollAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ADD "lastEventIngestedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ADD "lastPollResult" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnectionRun" ADD CONSTRAINT "FK_0037f8381daf86ddbe38e0b4854" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnectionRun" ADD CONSTRAINT "FK_5fc0c5f4352278ed7c7a8de5d65" FOREIGN KEY ("googleSecOpsConnectionId") REFERENCES "GoogleSecOpsConnection"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnectionRun" ADD CONSTRAINT "FK_dff8018998e3e8d5d702094e212" FOREIGN KEY ("requestedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnectionRun" DROP CONSTRAINT "FK_dff8018998e3e8d5d702094e212"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnectionRun" DROP CONSTRAINT "FK_5fc0c5f4352278ed7c7a8de5d65"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnectionRun" DROP CONSTRAINT "FK_0037f8381daf86ddbe38e0b4854"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" DROP COLUMN "lastPollResult"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" DROP COLUMN "lastEventIngestedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" DROP COLUMN "lastSuccessfulPollAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" DROP COLUMN "includeNonAlertingDetections"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_cd32cd9e57cde7e7d75d03457e"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_dff8018998e3e8d5d702094e21"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5fc0c5f4352278ed7c7a8de5d6"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0037f8381daf86ddbe38e0b485"`,
+    );
+    await queryRunner.query(`DROP TABLE "GoogleSecOpsConnectionRun"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -1,3 +1,5 @@
+import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
+import { AddUserWebAuthnPurpose1792200000000 } from "./1792200000000-AddUserWebAuthnPurpose";
 import InitialMigration from "./1717605043663-InitialMigration";
 import { MigrationName1717678334852 } from "./1717678334852-MigrationName";
 import { MigrationName1717839110671 } from "./1717839110671-MigrationName";
@@ -578,6 +580,10 @@ import { SessionReplayRecordEverySessionByDefault1791400000000 } from "./1791400
 import { WidenCustomFieldDropdownOptions1791500000000 } from "./1791500000000-WidenCustomFieldDropdownOptions";
 import { AddCustomFieldValueMapping1791600000000 } from "./1791600000000-AddCustomFieldValueMapping";
 import { AddMacAddressToNetworkDevice1791700000000 } from "./1791700000000-AddMacAddressToNetworkDevice";
+import { SplitWebAuthnChallengeByPurpose1791800000000 } from "./1791800000000-SplitWebAuthnChallengeByPurpose";
+import { AddSeverityAndStateToNotificationEmailRollup1791900000000 } from "./1791900000000-AddSeverityAndStateToNotificationEmailRollup";
+import { AddVMwareTables1792000000000 } from "./1792000000000-AddVMwareTables";
+import { AddGitHubCommandSettingsToCodeRepository1792100000000 } from "./1792100000000-AddGitHubCommandSettingsToCodeRepository";
 
 export default [
   InitialMigration,
@@ -1160,4 +1166,10 @@ export default [
   WidenCustomFieldDropdownOptions1791500000000,
   AddCustomFieldValueMapping1791600000000,
   AddMacAddressToNetworkDevice1791700000000,
+  SplitWebAuthnChallengeByPurpose1791800000000,
+  AddSeverityAndStateToNotificationEmailRollup1791900000000,
+  AddVMwareTables1792000000000,
+  AddGitHubCommandSettingsToCodeRepository1792100000000,
+  AddUserWebAuthnPurpose1792200000000,
+  AddGoogleSecOpsDiagnostics1792300000000,
 ];

package/Server/Middleware/IdentityRateLimit.ts

@@ -124,6 +124,16 @@ export enum IdentityRateLimitBucket {
    * the recovery route already spent. See BACKUP_CODE_BUCKET.
    */
   BackupCode = "backup-code",
+
+  /*
+   * POST /user-webauthn/generate-authentication-options -- the step that hands
+   * out the challenge a security key is about to sign. Its own counter for the
+   * same reason the recovery step has one; see WEBAUTHN_CHALLENGE_BUCKET.
+   */
+  WebAuthnChallenge = "webauthn-challenge",
+
+  // Discoverable passkey requests have no account identifier until verified.
+  Passkey = "passkey",
 }
 
 export enum IdentityRateLimitScope {
@@ -291,6 +301,89 @@ const BACKUP_CODE_BUCKET: BucketConfig = {
   ),
 };
 
+/*
+ * Challenge-issuing budget.
+ *
+ * POST /user-webauthn/generate-authentication-options is the odd one out on
+ * this list: it accepts no credential and can refuse nobody, so it is not a
+ * guessing oracle and a limit here is not what stops an attacker signing in.
+ * It needed one anyway, because of what it DOES rather than what it checks.
+ *
+ * It is anonymous -- the challenge has to exist before the assertion that
+ * proves anything does, so there is nothing to authenticate it with -- and it
+ * takes an email address and WRITES to that user's row. Unlimited, one
+ * request is one free database write against any address the caller cares to
+ * name, and a flood of them is a flood of writes nobody asked for.
+ *
+ * And the write is not junk. It is the challenge that user's key is about to
+ * sign, in the single slot that holds it, so an overwrite landing between
+ * somebody's generate and their verify makes the library reject an assertion
+ * that was perfectly correct -- a targeted refusal of security-key sign-in
+ * against any address a caller can name, rather than a resource cost.
+ *
+ * WHAT THIS COUNTER THEREFORE BOUNDS BUT DOES NOT CLOSE. The account counter
+ * is keyed on the address the request came FROM, as it must be -- see the note
+ * at the top of this file: a bare per-account counter is itself a lockout
+ * weapon -- so an attacker with several source addresses gets this budget from
+ * each one. Splitting the registration and authentication challenge slots
+ * (Common/Models/DatabaseModels/User.ts) stopped the two FLOWS destroying each
+ * other; it does not stop two authentication requests for one account, which
+ * still land on one slot, last write wins.
+ *
+ * Closing that properly means the challenge ceasing to be a single
+ * overwritable row -- one row per attempt, or a short-lived per-ceremony key
+ * -- which is a larger change than this one and is not attempted here. What
+ * this bucket buys is that the cheap version of the attack now costs an
+ * address per thirty attempts instead of nothing at all.
+ *
+ * A SEPARATE counter from the two-factor one, for exactly the reason the
+ * recovery bucket is separate. This route is the step immediately BEFORE
+ * /verify-webauthn-auth in the same sign-in. Sharing a pool would mean every
+ * challenge a user asked for spent an attempt they had not yet made, halving
+ * a ten-attempt allowance to five real tries -- and, worse, a user who had
+ * just used up the shared budget failing at the key could not obtain a fresh
+ * challenge to try again with. The step that exists to enable an attempt must
+ * not be spendable by the attempts it enables.
+ *
+ * More generous than its siblings on the account counter, because nothing is
+ * being guessed and abandoning a prompt is ordinary: a user who touches the
+ * wrong key, closes the dialog, or reloads the page asks for another
+ * challenge each time, and none of that is suspicious. The per-address
+ * ceiling is what actually bounds the writes.
+ */
+const WEBAUTHN_CHALLENGE_BUCKET: BucketConfig = {
+  windowSeconds: parsePositiveIntFromEnv(
+    "IDENTITY_WEBAUTHN_CHALLENGE_RATE_LIMIT_WINDOW_SECONDS",
+    15 * 60,
+  ),
+  perAccountLimit: parsePositiveIntFromEnv(
+    "IDENTITY_WEBAUTHN_CHALLENGE_RATE_LIMIT_PER_ACCOUNT_PER_WINDOW",
+    30,
+  ),
+  perIpLimit: parsePositiveIntFromEnv(
+    "IDENTITY_WEBAUTHN_CHALLENGE_RATE_LIMIT_PER_IP_PER_WINDOW",
+    150,
+  ),
+};
+
+/*
+ * Both counters use the IP budget because passkeys do not submit an email.
+ * Keep this independent of password attempts so a canceled passkey prompt
+ * cannot consume the user's password fallback allowance.
+ */
+const PASSKEY_RATE_LIMIT: number = parsePositiveIntFromEnv(
+  "IDENTITY_PASSKEY_RATE_LIMIT_PER_IP_PER_WINDOW",
+  300,
+);
+const PASSKEY_BUCKET: BucketConfig = {
+  windowSeconds: parsePositiveIntFromEnv(
+    "IDENTITY_PASSKEY_RATE_LIMIT_WINDOW_SECONDS",
+    15 * 60,
+  ),
+  perAccountLimit: PASSKEY_RATE_LIMIT,
+  perIpLimit: PASSKEY_RATE_LIMIT,
+};
+
 const KEY_PREFIX: string = "identity:rl:";
 
 /*
@@ -432,6 +525,10 @@ export default class IdentityRateLimit {
   }
 
   public static getBucketConfig(bucket: IdentityRateLimitBucket): BucketConfig {
+    if (bucket === IdentityRateLimitBucket.Passkey) {
+      return PASSKEY_BUCKET;
+    }
+
     if (bucket === IdentityRateLimitBucket.TwoFactor) {
       return TWO_FACTOR_BUCKET;
     }
@@ -440,6 +537,10 @@ export default class IdentityRateLimit {
       return BACKUP_CODE_BUCKET;
     }
 
+    if (bucket === IdentityRateLimitBucket.WebAuthnChallenge) {
+      return WEBAUTHN_CHALLENGE_BUCKET;
+    }
+
     return LOGIN_BUCKET;
   }
 

package/Server/Services/AIRunService.ts

@@ -11,6 +11,7 @@ import CodeFixTaskType, {
   CodeFixTaskTypeHelper,
 } from "../../Types/AI/CodeFixTaskType";
 import {
+  getGitHubTaskContext,
   getInvestigationCodeFixTaskSnapshot,
   InvestigationCodeFixTaskContext,
 } from "../../Types/AI/CodeFixTaskContext";
@@ -296,6 +297,18 @@ export class Service extends DatabaseService<Model> {
           missingContextMessage =
             "Queued FixFromIncident run has no complete pinned investigation analysis snapshot.";
         }
+      } else if (CodeFixTaskTypeHelper.isGitHubTaskType(run.codeFixTaskType)) {
+        /*
+         * The GitHub recipes carry their whole world in taskContext.github:
+         * which repository, which installation, and which issue OR pull
+         * request. getGitHubTaskContext rejects a half-built context — one
+         * missing its repository, or naming both an issue and a pull
+         * request — so a run that could not decide what it is about fails
+         * here rather than picking one at execution time.
+         */
+        missingContextMessage = getGitHubTaskContext(run.taskContext)
+          ? null
+          : "Queued GitHub run has no complete GitHub conversation in its task context.";
       } else if (
         run.codeFixTaskType === CodeFixTaskType.ImproveLogging ||
         run.codeFixTaskType === CodeFixTaskType.ImproveTracing

package/Server/Services/BillingPaymentMethodService.ts

@@ -9,47 +9,64 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import Model from "../../Models/DatabaseModels/BillingPaymentMethod";
 import Project from "../../Models/DatabaseModels/Project";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import PayAsYouGoBillingService from "./PayAsYouGoBillingService";
+import Dictionary from "../../Types/Dictionary";
+import ObjectID from "../../Types/ObjectID";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
-  @CaptureSpan()
-  protected override async onBeforeFind(
-    findBy: FindBy<Model>,
-  ): Promise<OnFind<Model>> {
-    if (!findBy.props.tenantId) {
-      throw new BadDataException("ProjectID not found.");
+  /*
+   * Every read of this model re-syncs it from the payment provider, and one
+   * billing page render issues two list requests at once (the table itself,
+   * and the unfiltered count beside it). That was 10 provider reads - four
+   * payment-method types plus the customer, twice - fired simultaneously for a
+   * single page, on top of a hard delete and re-insert of the same rows from
+   * both requests at once. Against a rate-limited account that is what makes a
+   * read fail; it also raced the two re-syncs against each other in Postgres.
+   *
+   * Collapse only requests that genuinely overlap in time: a caller arriving
+   * while a sync is in flight awaits that one instead of starting a second.
+   * Nothing is cached beyond the in-flight window, so a payment method added
+   * a moment ago is still read fresh by the next request.
+   */
+  private syncsInFlight: Dictionary<Promise<Array<PaymentMethod>>> = {};
+
+  private syncPaymentMethodsFromProvider(data: {
+    projectId: ObjectID;
+    customerId: string;
+  }): Promise<Array<PaymentMethod>> {
+    const key: string = data.projectId.toString();
+
+    const inFlight: Promise<Array<PaymentMethod>> | undefined =
+      this.syncsInFlight[key];
+    if (inFlight) {
+      return inFlight;
     }
 
-    const project: Project | null = await ProjectService.findOneById({
-      id: findBy.props.tenantId!,
-      props: {
-        ...findBy.props,
-        isRoot: true,
-        ignoreHooks: true,
-      },
-      select: {
-        _id: true,
-        paymentProviderCustomerId: true,
-      },
+    const sync: Promise<Array<PaymentMethod>> = this.runPaymentMethodSync(
+      data,
+    ).finally(() => {
+      delete this.syncsInFlight[key];
     });
 
-    if (!project) {
-      throw new BadDataException("Project not found");
-    }
+    this.syncsInFlight[key] = sync;
 
-    if (!project.paymentProviderCustomerId) {
-      throw new BadDataException("Payment provider customer id not found.");
-    }
+    return sync;
+  }
 
+  private async runPaymentMethodSync(data: {
+    projectId: ObjectID;
+    customerId: string;
+  }): Promise<Array<PaymentMethod>> {
     const paymentMethods: Array<PaymentMethod> =
-      await BillingService.getPaymentMethods(project.paymentProviderCustomerId);
+      await BillingService.getPaymentMethods(data.customerId);
 
     await this.deleteBy({
       query: {
-        projectId: findBy.props.tenantId!,
+        projectId: data.projectId,
       },
       limit: LIMIT_PER_PROJECT,
       skip: 0,
@@ -62,14 +79,13 @@ export class Service extends DatabaseService<Model> {
     for (const paymentMethod of paymentMethods) {
       const billingPaymentMethod: Model = new Model();
 
-      billingPaymentMethod.projectId = project.id!;
+      billingPaymentMethod.projectId = data.projectId;
 
       billingPaymentMethod.paymentMethodType = paymentMethod.type;
       billingPaymentMethod.last4Digits = paymentMethod.last4Digits;
       billingPaymentMethod.isDefault = paymentMethod.isDefault;
       billingPaymentMethod.paymentProviderPaymentMethodId = paymentMethod.id;
-      billingPaymentMethod.paymentProviderCustomerId =
-        project.paymentProviderCustomerId;
+      billingPaymentMethod.paymentProviderCustomerId = data.customerId;
 
       await this.create({
         data: billingPaymentMethod,
@@ -79,6 +95,54 @@ export class Service extends DatabaseService<Model> {
       });
     }
 
+    /*
+     * We have just read the authoritative list of payment methods for this
+     * project, so any cached authorization decision is now stale by
+     * definition. Clearing it here is what makes the admission path's denial
+     * cache safe: the billing page reads this table immediately after a card
+     * is added, so ingest stops being denied on the very next batch instead of
+     * at the end of the denial TTL.
+     */
+    PayAsYouGoBillingService.invalidate(data.projectId);
+
+    return paymentMethods;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeFind(
+    findBy: FindBy<Model>,
+  ): Promise<OnFind<Model>> {
+    if (!findBy.props.tenantId) {
+      throw new BadDataException("ProjectID not found.");
+    }
+
+    const project: Project | null = await ProjectService.findOneById({
+      id: findBy.props.tenantId!,
+      props: {
+        ...findBy.props,
+        isRoot: true,
+        ignoreHooks: true,
+      },
+      select: {
+        _id: true,
+        paymentProviderCustomerId: true,
+      },
+    });
+
+    if (!project) {
+      throw new BadDataException("Project not found");
+    }
+
+    if (!project.paymentProviderCustomerId) {
+      throw new BadDataException("Payment provider customer id not found.");
+    }
+
+    const paymentMethods: Array<PaymentMethod> =
+      await this.syncPaymentMethodsFromProvider({
+        projectId: project.id!,
+        customerId: project.paymentProviderCustomerId,
+      });
+
     return { findBy, carryForward: paymentMethods };
   }
 
@@ -113,6 +177,13 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * No authorization invalidation here on purpose: BillingService
+     * .deletePaymentMethod refuses to detach the last remaining method, so a
+     * successful delete always leaves the project with at least one card and
+     * its authorization unchanged. Clearing the cache would only force a
+     * needless provider read.
+     */
     return { deleteBy, carryForward: null };
   }
 }