@oneuptime/common 13.0.0 → 13.0.3

package/Server/API/GitHubAPI.ts

@@ -18,6 +18,9 @@ import {
 } from "../EnvironmentConfig";
 import ObjectID from "../../Types/ObjectID";
 import GitHubUtil from "../Utils/CodeRepository/GitHub/GitHub";
+import GitHubWebhookHandler, {
+  GitHubWebhookHandlingResult,
+} from "../Utils/CodeRepository/GitHub/GitHubWebhookHandler";
 import CodeRepositoryService, {
   ImportReposFromInstallationResult,
 } from "../Services/CodeRepositoryService";
@@ -499,8 +502,34 @@ export default class GitHubAPI {
             );
           }
 
-          // Get raw body for signature verification
-          const rawBody: string = JSON.stringify(req.body);
+          /*
+           * The signature covers the bytes GitHub SENT, so it has to be
+           * checked against those bytes. This used to re-serialize the parsed
+           * body with JSON.stringify, which only verifies when GitHub's
+           * payload happens to be a fixed point of parse-then-stringify —
+           * every \uXXXX escape, renormalized number and reordered numeric
+           * key silently became "Invalid webhook signature" instead. The
+           * express json parser already captures the real body for exactly
+           * this purpose (see jsonBodyParserOptions in StartServer).
+           *
+           * A missing rawBody is a misconfiguration (a route mounted without
+           * that parser), and it fails closed: verifying a body we did not
+           * capture is not something to guess at.
+           */
+          const rawBody: string | undefined = (req as OneUptimeRequest).rawBody;
+
+          if (!rawBody) {
+            logger.error(
+              "Rejecting GitHub webhook: the raw request body was not captured, so its signature cannot be verified.",
+              getLogAttributesFromRequest(req as OneUptimeRequest),
+            );
+
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("Could not verify webhook signature"),
+            );
+          }
 
           // Verify webhook signature
           const isValid: boolean = GitHubUtil.verifyWebhookSignature(
@@ -661,14 +690,27 @@ export default class GitHubAPI {
           }
 
           /*
-           * Handle different webhook events here
-           * For now, just acknowledge receipt
-           * Future: Handle push, pull_request, check_run events
+           * The interactive surface: mentions, assignments, trigger labels
+           * and review requests. It is deliberately the LAST thing this
+           * handler does and it never throws — the installation bookkeeping
+           * above must not be undone by a comment that could not be posted,
+           * and an exception escaping to GitHub becomes a redelivery of the
+           * same payload forever.
            */
+          const interactiveResult: GitHubWebhookHandlingResult =
+            await GitHubWebhookHandler.handleEvent({
+              event: event,
+              deliveryId: req.headers["x-github-delivery"] as
+                | string
+                | undefined,
+              payload: req.body as JSONObject,
+            });
 
           return Response.sendJsonObjectResponse(req, res, {
             success: true,
             message: "Webhook received",
+            handled: interactiveResult.handled,
+            outcome: interactiveResult.outcome,
           } as JSONObject);
         } catch (error) {
           logger.error(

package/Server/API/GoogleSecOpsConnectionAPI.ts

@@ -0,0 +1,79 @@
+import GoogleSecOpsConnection from "../../Models/DatabaseModels/GoogleSecOpsConnection";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import GoogleSecOpsConnectionService, {
+  Service as GoogleSecOpsConnectionServiceType,
+} from "../Services/GoogleSecOpsConnectionService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import GoogleSecOpsRunExecutor from "../Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsRunExecutor";
+import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+
+export default class GoogleSecOpsConnectionAPI extends BaseAPI<
+  GoogleSecOpsConnection,
+  GoogleSecOpsConnectionServiceType
+> {
+  public constructor() {
+    super(GoogleSecOpsConnection, GoogleSecOpsConnectionService);
+
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:connectionId/run`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+          CommonAPI.assertPermittedInProject({
+            databaseProps: props,
+            allowedPermissions:
+              new GoogleSecOpsConnection().getUpdatePermissions(),
+            errorMessage:
+              "Project owners, project administrators, and security administrators can run connection diagnostics.",
+          });
+
+          const connectionId: string | undefined = req.params["connectionId"];
+          if (!connectionId || !ObjectID.isValidUUID(connectionId)) {
+            throw new BadDataException("A valid connection ID is required.");
+          }
+
+          /*
+           * Authorize against the caller's tenant before any root read or work
+           * is queued. Credentials are only read by the worker.
+           */
+          const connection: GoogleSecOpsConnection | null =
+            await this.service.findOneBy({
+              query: { _id: connectionId, projectId },
+              select: { _id: true, projectId: true },
+              props,
+            });
+          CommonAPI.assertResourceBelongsToProject({
+            resourceProjectId: connection?.projectId,
+            projectId,
+          });
+
+          const runId: ObjectID = await GoogleSecOpsRunExecutor.enqueue({
+            projectId,
+            connectionId: new ObjectID(connectionId),
+            options: GoogleSecOpsRunExecutor.validateOptions(req.body),
+            requestedByUserId: props.userId,
+          });
+          return Response.sendJsonObjectResponse(req, res, {
+            runId: runId.toString(),
+          });
+        } catch (error) {
+          next(error);
+        }
+      },
+    );
+  }
+}

package/Server/API/TelemetryAPI.ts

@@ -118,6 +118,7 @@ import RumApplicationService from "../Services/RumApplicationService";
 import Project from "../../Models/DatabaseModels/Project";
 import ProjectService from "../Services/ProjectService";
 import SessionReplayIdentity from "../Utils/SessionReplay/SessionReplayIdentity";
+import SessionIdentity from "../../Utils/Rum/SessionIdentity";
 import SessionReplayTargeting from "../Utils/SessionReplay/SessionReplayTargeting";
 import SessionReplayUsage from "../Utils/SessionReplay/SessionReplayUsage";
 import RumSessionReplayView from "../../Models/DatabaseModels/RumSessionReplayView";
@@ -126,8 +127,10 @@ import RumSessionReplayViewService, {
 } from "../Services/RumSessionReplayViewService";
 import SessionReplayReadService, {
   DEFAULT_SESSION_REPLAY_LIST_LIMIT,
+  DEFAULT_SESSION_REPLAY_USERS_LIMIT,
   MAX_SESSION_REPLAY_FOR_EXCEPTION_LIMIT,
   MAX_SESSION_REPLAY_LIST_LIMIT,
+  MAX_SESSION_REPLAY_USERS_LIMIT,
   SESSION_REPLAY_EXCEPTION_WINDOW_PADDING_MS,
   SessionReplayApplicationActivitySummary,
   SessionReplayChunkReadResult,
@@ -139,6 +142,8 @@ import SessionReplayReadService, {
   SessionReplayManifest,
   SessionReplaySessionHeader,
   SessionReplaySessionIdentity,
+  SessionReplayUsersCursor,
+  SessionReplayUsersResult,
 } from "../Utils/SessionReplay/SessionReplayReadService";
 import SessionReplayHealthCounters, {
   SessionReplayDropCount,
@@ -163,6 +168,8 @@ import {
   parseSessionReplayListCursor,
 } from "../../Types/Rum/SessionReplayApi";
 import { SessionReplayRefusalCount } from "../../Types/Rum/SessionReplayHealth";
+import zlib from "zlib";
+import { promisify } from "util";
 
 const router: ExpressRouter = Express.getRouter();
 
@@ -4857,6 +4864,32 @@ router.post(
         );
       }
 
+      /*
+       * "Every session from this browser". The visitor id is the
+       * recorder's own random per-browser token, and the list already
+       * hands it to every caller on every row, so - like the digest filter
+       * below - it needs no identity gate: filtering by it discloses
+       * nothing the caller does not have. But a value that is not one
+       * (the shape is strict; there is no legitimate "almost" visitor id)
+       * can match nothing, and a silently unfiltered list is the wrong
+       * answer to that question too.
+       */
+      const rawVisitorId: unknown = rawFilters["visitorId"];
+
+      if (
+        rawVisitorId !== undefined &&
+        rawVisitorId !== null &&
+        !SessionIdentity.isVisitorId(rawVisitorId)
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            "visitorId must be a 32-character lowercase hex visitor id.",
+          ),
+        );
+      }
+
       /*
        * A filter the server understood but did not apply, named in the
        * response.
@@ -4947,6 +4980,10 @@ router.post(
               "identifiedUserKey",
             ),
           }),
+        /* Validated above; not identity-gated, for the reason given there. */
+        ...(SessionIdentity.isVisitorId(rawVisitorId) && {
+          visitorId: rawVisitorId,
+        }),
         ...(readBoundedStringFromBody(rawFilters, "route") && {
           route: readBoundedStringFromBody(rawFilters, "route"),
         }),
@@ -5096,6 +5133,182 @@ router.post(
   },
 );
 
+// --- Session Replay Users Endpoint ---
+
+/*
+ * The cursor /users emits and accepts: the last row's "last seen" clock
+ * and its group key as the tiebreak. A cursor that is present but not
+ * this shape is a bad request rather than a driver error - a non-finite
+ * or negative clock cannot be bound, and an unbounded key would reach
+ * ClickHouse as a parameter on a per-group predicate. The EMPTY key is
+ * valid: it is the anonymous bucket's own key, and that bucket can be the
+ * last row of a page like any other.
+ */
+const MAX_SESSION_REPLAY_USERS_GROUP_KEY_LENGTH: number = 128;
+
+type ParseSessionReplayUsersCursorFunction = (
+  value: unknown,
+) => SessionReplayUsersCursor | null;
+
+const parseSessionReplayUsersCursor: ParseSessionReplayUsersCursorFunction = (
+  value: unknown,
+): SessionReplayUsersCursor | null => {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    return null;
+  }
+
+  const row: JSONObject = value as JSONObject;
+  const lastSeenUnixMs: unknown = row["lastSeenUnixMs"];
+  const groupKey: unknown = row["groupKey"];
+
+  if (
+    typeof lastSeenUnixMs !== "number" ||
+    !Number.isFinite(lastSeenUnixMs) ||
+    lastSeenUnixMs < 0
+  ) {
+    return null;
+  }
+
+  if (
+    typeof groupKey !== "string" ||
+    groupKey.length > MAX_SESSION_REPLAY_USERS_GROUP_KEY_LENGTH
+  ) {
+    return null;
+  }
+
+  return { lastSeenUnixMs: lastSeenUnixMs, groupKey: groupKey };
+};
+
+/*
+ * The session list rolled up by person - "who had trouble" where /list
+ * answers "what happened". One row per identified user, one per linked
+ * browser, and at most one anonymous bucket; see
+ * SessionReplayReadService.listUsers for why it is its own read rather
+ * than a client-side fold of a list page.
+ *
+ * Same guard, same prologue and same identity decision as /list: it
+ * projects nothing the list does not, only grouped. The identity pair is
+ * named at neither level of the statement unless canReadIdentifiedUserLabel
+ * passes for the application the caller was just authorized against.
+ */
+router.post(
+  "/telemetry/rum/session-replay/users",
+  ...requireSessionReplayListAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      assertSessionReplayPlan(databaseProps);
+
+      const projectId: ObjectID = databaseProps.tenantId;
+      const body: JSONObject = req.body as JSONObject;
+
+      const rumApplicationId: ObjectID = readObjectIdFromBody(
+        body,
+        "rumApplicationId",
+      );
+
+      /*
+       * Caller-supplied, and safe for the reason it is on /list: it is
+       * the thing being authorized, and the query is tenant-pinned
+       * regardless.
+       */
+      const application: RumApplication =
+        await assertSessionReplayApplicationAccess({
+          projectId: projectId,
+          rumApplicationId: rumApplicationId,
+          databaseProps: databaseProps,
+          permissions: SESSION_REPLAY_LIST_PERMISSIONS,
+        });
+
+      const startTime: Date =
+        readOptionalDateFromBody(body, "startTime") ||
+        OneUptimeDate.addRemoveDays(OneUptimeDate.getCurrentDate(), -7);
+
+      const endTime: Date =
+        readOptionalDateFromBody(body, "endTime") ||
+        OneUptimeDate.getCurrentDate();
+
+      /* An inverted window matches nothing; say so rather than answer []. */
+      if (startTime.getTime() > endTime.getTime()) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("startTime must not be after endTime"),
+        );
+      }
+
+      const limit: number = readLimitFromBody(
+        body,
+        DEFAULT_SESSION_REPLAY_USERS_LIMIT,
+        MAX_SESSION_REPLAY_USERS_LIMIT,
+      );
+
+      /*
+       * Decided against the application the access check loaded, exactly
+       * as on /list, and enforced by not naming the columns.
+       */
+      const includeIdentifiedUserLabel: boolean = canReadIdentifiedUserLabel({
+        databaseProps: databaseProps,
+        application: application,
+      });
+
+      const cursor: SessionReplayUsersCursor | null | undefined =
+        body["cursor"] !== undefined && body["cursor"] !== null
+          ? parseSessionReplayUsersCursor(body["cursor"])
+          : undefined;
+
+      if (cursor === null) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException(
+            "cursor must be the nextCursor of a previous page.",
+          ),
+        );
+      }
+
+      const result: SessionReplayUsersResult =
+        await SessionReplayReadService.listUsers({
+          projectId: projectId,
+          rumApplicationId: rumApplicationId,
+          startTime: startTime,
+          endTime: endTime,
+          limit: limit,
+          ...(cursor !== undefined && { cursor }),
+          includeIdentifiedUserLabel: includeIdentifiedUserLabel,
+        });
+
+      const nextCursor: JSONObject | null = result.nextCursor
+        ? {
+            lastSeenUnixMs: result.nextCursor.lastSeenUnixMs,
+            groupKey: result.nextCursor.groupKey,
+          }
+        : null;
+
+      return Response.sendJsonObjectResponse(req, res, {
+        users: result.users as unknown as JSONObject,
+        nextCursor: nextCursor,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 // --- Session Replay Manifest Endpoint ---
 
 router.post(
@@ -5292,6 +5505,84 @@ router.post(
 
 // --- Session Replay Chunk Endpoint ---
 
+/*
+ * Chunk pages are gzipped here, in the route, rather than by nginx or a
+ * middleware. The `payload` column holds DECOMPRESSED rrweb JSON (the
+ * recorder's gzip is undone at ingest so the read cap can be judged on
+ * real bytes), so a page is 1-8 MB of highly repetitive text on the wire
+ * unless something compresses it again. Nginx cannot: the body is
+ * application/octet-stream, which is deliberately outside its gzip_types
+ * (Nginx/default.conf.template), and adding it there would also
+ * re-compress pprof downloads that are already gzip. Nothing else in the
+ * API adds response compression.
+ *
+ * Async zlib runs on the libuv threadpool, so the API event loop is never
+ * blocked by a page. Measured on a development machine: level 4 shrinks a
+ * realistic 8.4 MB page 8.7x in ~130 ms of threadpool time, which is why
+ * level 4 rather than the default 6 - the extra levels cost CPU for a few
+ * percent of size on JSON that already compresses this well.
+ */
+const gzipAsync: (input: Buffer, options: zlib.ZlibOptions) => Promise<Buffer> =
+  promisify(zlib.gzip);
+
+/* Mirrors nginx's gzip_min_length: a page this small gains nothing. */
+const SESSION_REPLAY_GZIP_MIN_BYTES: number = 1024;
+const SESSION_REPLAY_GZIP_LEVEL: number = 4;
+
+type AcceptsGzipEncodingFunction = (req: ExpressRequest) => boolean;
+
+/*
+ * Reads Accept-Encoding by hand instead of via req.acceptsEncodings so
+ * the route depends only on the headers object (which is all a plain
+ * request object is guaranteed to carry). Tolerates a repeated header
+ * (array), q-values, and the x-gzip alias; "gzip;q=0" is an explicit
+ * refusal and wins over any other gzip token.
+ */
+const acceptsGzipEncoding: AcceptsGzipEncodingFunction = (
+  req: ExpressRequest,
+): boolean => {
+  const raw: unknown = req.headers?.["accept-encoding"];
+
+  let headerValue: string;
+
+  if (Array.isArray(raw)) {
+    headerValue = raw.join(",");
+  } else if (typeof raw === "string") {
+    headerValue = raw;
+  } else {
+    return false;
+  }
+
+  let gzipAccepted: boolean = false;
+
+  for (const token of headerValue.toLowerCase().split(",")) {
+    const parts: Array<string> = token.split(";");
+    const coding: string = (parts[0] ?? "").trim();
+
+    if (coding !== "gzip" && coding !== "x-gzip") {
+      continue;
+    }
+
+    let quality: number = 1;
+
+    for (const parameter of parts.slice(1)) {
+      const [name, value] = parameter.split("=");
+
+      if ((name ?? "").trim() === "q") {
+        quality = Number.parseFloat((value ?? "").trim());
+      }
+    }
+
+    if (Number.isNaN(quality) || quality <= 0) {
+      return false;
+    }
+
+    gzipAccepted = true;
+  }
+
+  return gzipAccepted;
+};
+
 router.post(
   "/telemetry/rum/session-replay/chunks",
   ...requireSessionReplayPayloadAccess,
@@ -5450,8 +5741,38 @@ router.post(
 
       const responseBody: Buffer = Buffer.concat(frames);
 
+      /*
+       * The read cap and the omitted list above are judged on the
+       * uncompressed frames: they bound what the player must hold in
+       * memory, not what crosses the wire. Only the bytes sent change.
+       */
+      let bodyToSend: Buffer = responseBody;
+      let contentEncoding: string | undefined = undefined;
+
+      if (
+        responseBody.length >= SESSION_REPLAY_GZIP_MIN_BYTES &&
+        acceptsGzipEncoding(req)
+      ) {
+        bodyToSend = await gzipAsync(responseBody, {
+          level: SESSION_REPLAY_GZIP_LEVEL,
+        });
+        contentEncoding = "gzip";
+      }
+
       res.setHeader("Content-Type", "application/octet-stream");
-      res.setHeader("Content-Length", responseBody.length.toString());
+
+      /*
+       * Set on both branches: the representation depends on the request
+       * header even when the answer is identity, and it is identical to
+       * what nginx's gzip_vary would emit for a body it compressed itself.
+       */
+      res.setHeader("Vary", "Accept-Encoding");
+
+      if (contentEncoding) {
+        res.setHeader("Content-Encoding", contentEncoding);
+      }
+
+      res.setHeader("Content-Length", bodyToSend.length.toString());
 
       /*
        * Which requested chunks exist but were left out for size, so a
@@ -5473,7 +5794,7 @@ router.post(
        * shared cache, and the browser should not keep it on disk either.
        */
       res.setHeader("Cache-Control", "no-store");
-      res.send(responseBody);
+      res.send(bodyToSend);
     } catch (err: unknown) {
       next(err);
     }

package/Server/API/UserWebAuthnAPI.ts

@@ -20,6 +20,9 @@ import UserTwoFactorBackupCodeService from "../Services/UserTwoFactorBackupCodeS
 import TwoFactorBackupCode from "../Utils/TwoFactorBackupCode";
 import logger from "../Utils/Logger";
 import TwoFactorBackupCodeNotification from "../Utils/TwoFactorBackupCodeNotification";
+import IdentityRateLimit, {
+  IdentityRateLimitBucket,
+} from "../Middleware/IdentityRateLimit";
 
 export default class UserWebAuthnAPI extends BaseAPI<
   UserWebAuthn,
@@ -39,6 +42,7 @@ export default class UserWebAuthnAPI extends BaseAPI<
           const result: { options: any; challenge: string } =
             await UserWebAuthnService.generateRegistrationOptions({
               userId: userId,
+              isPasskey: req.body?.["isPasskey"] === true,
             });
 
           return Response.sendJsonObjectResponse(req, res, result);
@@ -113,8 +117,24 @@ export default class UserWebAuthnAPI extends BaseAPI<
       },
     );
 
+    /*
+     * The only route on this class that no signed-in user stands behind. It
+     * has to be anonymous -- this is where the challenge a security key signs
+     * comes from, and it is needed before there is any assertion to prove who
+     * is asking -- but "anonymous" and "unmetered" are different things, and
+     * it was both.
+     *
+     * What an unmetered version hands out: a database write against any email
+     * address the caller cares to name, as fast as the process will answer.
+     * The limiter keys on the submitted address AND the caller's own address
+     * (see IdentityRateLimit), so a flood spends the attacker's budget rather
+     * than the victim's -- the same trade every other identity route makes.
+     */
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/generate-authentication-options`,
+      IdentityRateLimit.getMiddleware(
+        IdentityRateLimitBucket.WebAuthnChallenge,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const data: JSONObject = req.body["data"] as JSONObject;
@@ -129,7 +149,7 @@ export default class UserWebAuthnAPI extends BaseAPI<
             throw new BadDataException("Email is required");
           }
 
-          const result: { options: any; challenge: string; userId: string } =
+          const result: { options: any; challenge: string } =
             await UserWebAuthnService.generateAuthenticationOptions({
               email: email,
             });