@oneuptime/common 13.0.0 → 13.0.1

package/Models/DatabaseModels/Index.ts

@@ -51,6 +51,10 @@ import CephCluster from "./CephCluster";
 import CephClusterOwnerTeam from "./CephClusterOwnerTeam";
 import CephClusterOwnerUser from "./CephClusterOwnerUser";
 import CephResource from "./CephResource";
+import VMwareVCenter from "./VMwareVCenter";
+import VMwareVCenterOwnerTeam from "./VMwareVCenterOwnerTeam";
+import VMwareVCenterOwnerUser from "./VMwareVCenterOwnerUser";
+import VMwareResource from "./VMwareResource";
 import Host from "./Host";
 import HostOwnerTeam from "./HostOwnerTeam";
 import HostOwnerUser from "./HostOwnerUser";
@@ -121,6 +125,7 @@ import LogPipelineProcessor from "./LogPipelineProcessor";
 import LogDropFilter from "./LogDropFilter";
 import DetectionRule from "./DetectionRule";
 import GoogleSecOpsConnection from "./GoogleSecOpsConnection";
+import GoogleSecOpsConnectionRun from "./GoogleSecOpsConnectionRun";
 import ThreatIntelFeed from "./ThreatIntelFeed";
 import LogScrubRule from "./LogScrubRule";
 import MetricPipelineRule from "./MetricPipelineRule";
@@ -425,6 +430,8 @@ import IoTFleetOwnerRule from "./IoTFleetOwnerRule";
 import IoTFleetLabelRule from "./IoTFleetLabelRule";
 import CephClusterOwnerRule from "./CephClusterOwnerRule";
 import CephClusterLabelRule from "./CephClusterLabelRule";
+import VMwareVCenterOwnerRule from "./VMwareVCenterOwnerRule";
+import VMwareVCenterLabelRule from "./VMwareVCenterLabelRule";
 import RunbookOwnerRule from "./RunbookOwnerRule";
 import RunbookLabelRule from "./RunbookLabelRule";
 import WorkflowOwnerRule from "./WorkflowOwnerRule";
@@ -455,6 +462,7 @@ import DockerSwarmClusterFeed from "./DockerSwarmClusterFeed";
 import CephClusterFeed from "./CephClusterFeed";
 import PodmanHostFeed from "./PodmanHostFeed";
 import ProxmoxClusterFeed from "./ProxmoxClusterFeed";
+import VMwareVCenterFeed from "./VMwareVCenterFeed";
 import HostFeed from "./HostFeed";
 import CloudResourceFeed from "./CloudResourceFeed";
 import ServiceFeed from "./ServiceFeed";
@@ -492,6 +500,7 @@ const AllModelTypes: Array<{
   LogDropFilter,
   DetectionRule,
   GoogleSecOpsConnection,
+  GoogleSecOpsConnectionRun,
   ThreatIntelFeed,
   LogScrubRule,
   MetricPipelineRule,
@@ -633,6 +642,8 @@ const AllModelTypes: Array<{
   IoTFleetLabelRule,
   CephClusterOwnerRule,
   CephClusterLabelRule,
+  VMwareVCenterOwnerRule,
+  VMwareVCenterLabelRule,
   RunbookOwnerRule,
   RunbookLabelRule,
   WorkflowOwnerRule,
@@ -861,6 +872,7 @@ const AllModelTypes: Array<{
   CephClusterFeed,
   PodmanHostFeed,
   ProxmoxClusterFeed,
+  VMwareVCenterFeed,
   HostFeed,
   CloudResourceFeed,
   ServiceFeed,
@@ -924,6 +936,10 @@ const AllModelTypes: Array<{
   CephClusterOwnerTeam,
   CephClusterOwnerUser,
   CephResource,
+  VMwareVCenter,
+  VMwareVCenterOwnerTeam,
+  VMwareVCenterOwnerUser,
+  VMwareResource,
   Host,
   HostOwnerTeam,
   HostOwnerUser,

package/Models/DatabaseModels/ScheduledMaintenance.ts

@@ -8,6 +8,7 @@ import Monitor from "./Monitor";
 import MonitorStatus from "./MonitorStatus";
 import Project from "./Project";
 import ProxmoxCluster from "./ProxmoxCluster";
+import VMwareVCenter from "./VMwareVCenter";
 import IoTFleet from "./IoTFleet";
 import NetworkSite from "./NetworkSite";
 import DockerSwarmCluster from "./DockerSwarmCluster";
@@ -766,6 +767,60 @@ export default class ScheduledMaintenance extends BaseModel {
   })
   public proxmoxClusters?: Array<ProxmoxCluster> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.CreateProjectScheduledMaintenance,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.ScheduledMaintenanceViewer,
+      Permission.ReadProjectScheduledMaintenance,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.ScheduledMaintenanceAdmin,
+      Permission.ScheduledMaintenanceMember,
+      Permission.EditProjectScheduledMaintenance,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: VMwareVCenter,
+    title: "vCenters",
+    description: "List of vCenters affected by this event.",
+  })
+  @ManyToMany(
+    () => {
+      return VMwareVCenter;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "ScheduledMaintenanceVMwareVCenter",
+    inverseJoinColumn: {
+      name: "vmwareVCenterId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "scheduledMaintenanceId",
+      referencedColumnName: "_id",
+    },
+  })
+  public vmwareVCenters?: Array<VMwareVCenter> = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/User.ts

@@ -384,6 +384,55 @@ class User extends UserModel {
   })
   public resetPasswordExpires?: Date = undefined;
 
+  /*
+   * TWO challenge slots, not one, and the split is the whole point.
+   *
+   * A WebAuthn challenge is a one-shot value: the server issues it, the
+   * authenticator signs it, and the server compares what came back against
+   * what it stored. Registration and signing in are separate flows that each
+   * need one, and they used to share a single `webauthnChallenge` column --
+   * so whichever flow wrote last silently destroyed the other's.
+   *
+   * That is not a theoretical race. Registration is keyed by the session's
+   * user and signing in is keyed by an email address, so both land on the
+   * SAME row: a user adding a second key in one tab while a stale sign-in page
+   * in another asks for a fresh challenge loses the registration they were
+   * halfway through, and gets "No pending WebAuthn challenge found" for a key
+   * they are holding and touching. The anonymous
+   * /generate-authentication-options route made it reachable by strangers as
+   * well as by the user's own second tab.
+   *
+   * Named for their purposes rather than one being left as the bare
+   * `webauthnChallenge`, because a slot whose name does not say which flow
+   * owns it is exactly how the two came to share one.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({ type: TableColumnType.ShortText })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+    unique: false,
+  })
+  public webauthnRegistrationChallenge?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({ type: TableColumnType.Date })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+    unique: false,
+  })
+  public webauthnRegistrationChallengeExpiresAt?: Date = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],
@@ -396,7 +445,7 @@ class User extends UserModel {
     nullable: true,
     unique: false,
   })
-  public webauthnChallenge?: string = undefined;
+  public webauthnAuthenticationChallenge?: string = undefined;
 
   @ColumnAccessControl({
     create: [],
@@ -409,7 +458,7 @@ class User extends UserModel {
     nullable: true,
     unique: false,
   })
-  public webauthnChallengeExpiresAt?: Date = undefined;
+  public webauthnAuthenticationChallengeExpiresAt?: Date = undefined;
 
   @ColumnAccessControl({
     create: [],

package/Models/DatabaseModels/UserNotificationEmailRollupItem.ts

@@ -40,8 +40,9 @@ import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
  * this customer" without adding telemetry.
  *
  * WHAT IS DELIBERATELY NOT STORED: the envelope vars, the template type, and
- * any rendered body. A rollup line is eventType + subject + an optional deep
- * link. Storing envelopes would multiply row size roughly fiftyfold, add a
+ * any rendered body. A rollup line stores eventType, subject, an optional deep
+ * link, and the severity and state names shown in alert/incident emails.
+ * Storing envelopes would multiply row size roughly fiftyfold, add a
  * stale-template bug class the moment a template changes under a queued row,
  * and buy nothing a reader of the rollup email ever sees.
  *
@@ -291,6 +292,46 @@ export default class UserNotificationEmailRollupItem extends BaseModel {
   })
   public subject?: string = undefined;
 
+  /*
+   * Snapshot the labels in the original notification so a later state change
+   * or rename cannot make a queued event describe a different point in time.
+   * Nullable for older queue items and notification families without these
+   * details. These names use the same length as severity and state models.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    title: "Severity",
+    description: "Severity name when this notification was queued",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public severity?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.ShortText,
+    title: "Current State",
+    description: "State name when this notification was queued",
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    nullable: true,
+  })
+  public currentState?: string = undefined;
+
   /*
    * The deep link back into the dashboard, lifted out of the envelope vars,
    * and also the key rows are folded on when the rollup is rendered - two

package/Models/DatabaseModels/UserWebAuthn.ts

@@ -153,6 +153,23 @@ class UserWebAuthn extends BaseModel {
   })
   public isVerified?: boolean = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [Permission.CurrentUser],
+    update: [],
+  })
+  @TableColumn({
+    type: TableColumnType.Boolean,
+    title: "Registered as a Passkey",
+    description:
+      "Whether this credential was registered for passwordless sign-in. Older credentials have no recorded purpose.",
+  })
+  @Column({
+    type: ColumnType.Boolean,
+    nullable: true,
+  })
+  public isPasskey?: boolean = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],