@oneuptime/common 13.0.0 → 13.0.3

package/UI/Utils/UserEmailRegistrationStatus.ts

@@ -1,4 +1,10 @@
-import { MutableRefObject, useCallback, useRef, useState } from "react";
+import {
+  MutableRefObject,
+  useCallback,
+  useEffect,
+  useRef,
+  useState,
+} from "react";
 import Dictionary from "../../Types/Dictionary";
 import Email from "../../Types/Email";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
@@ -36,8 +42,28 @@ export function useUserEmailRegistrationStatus(options?: {
   > | null> = useRef<ReturnType<typeof setTimeout> | null>(null);
   const latestEmail: MutableRefObject<string> = useRef<string>("");
 
-  const getRequestHeaders: (() => Dictionary<string>) | undefined =
-    options?.getRequestHeaders;
+  /*
+   * Held in a ref so a caller that writes its options inline - which is every
+   * caller - does not get a new checkEmail on every render, and through it a
+   * new field definition and a new re-render of the form it is attached to.
+   */
+  const getRequestHeaders: MutableRefObject<
+    (() => Dictionary<string>) | undefined
+  > = useRef<(() => Dictionary<string>) | undefined>(
+    options?.getRequestHeaders,
+  );
+
+  getRequestHeaders.current = options?.getRequestHeaders;
+
+  // A check still in flight when the form closes has nowhere to report to.
+  useEffect(() => {
+    return () => {
+      if (debounceTimeout.current) {
+        clearTimeout(debounceTimeout.current);
+        debounceTimeout.current = null;
+      }
+    };
+  }, []);
 
   const checkEmail: (email: string) => void = useCallback(
     (email: string): void => {
@@ -64,7 +90,9 @@ export function useUserEmailRegistrationStatus(options?: {
               data: {
                 email: trimmedEmail,
               },
-              ...(getRequestHeaders ? { headers: getRequestHeaders() } : {}),
+              ...(getRequestHeaders.current
+                ? { headers: getRequestHeaders.current() }
+                : {}),
             });
 
           if (latestEmail.current !== trimmedEmail) {
@@ -86,7 +114,7 @@ export function useUserEmailRegistrationStatus(options?: {
         }
       }, 400);
     },
-    [getRequestHeaders],
+    [],
   );
 
   return { isEmailRegistered, checkEmail };

package/UI/Utils/WebAuthn.ts

@@ -0,0 +1,220 @@
+/* global PublicKeyCredentialDescriptor, PublicKeyCredentialRequestOptions, PublicKeyCredentialCreationOptions, PublicKeyCredentialUserEntity */
+import { JSONObject } from "../../Types/JSON";
+
+type CredentialDescriptorJSON = Omit<PublicKeyCredentialDescriptor, "id"> & {
+  id: string;
+};
+
+type RequestOptionsJSON = Omit<
+  PublicKeyCredentialRequestOptions,
+  "challenge" | "allowCredentials"
+> & {
+  challenge: string;
+  allowCredentials?: Array<CredentialDescriptorJSON>;
+};
+
+type CreationOptionsJSON = Omit<
+  PublicKeyCredentialCreationOptions,
+  "challenge" | "user" | "excludeCredentials"
+> & {
+  challenge: string;
+  user: Omit<PublicKeyCredentialUserEntity, "id"> & { id: string };
+  excludeCredentials?: Array<CredentialDescriptorJSON>;
+};
+
+// Keep binary conversion in the browser: Buffer is not available on all clients.
+export default class WebAuthn {
+  private static decode(value: string): ArrayBuffer {
+    const binary: string = atob(value.replace(/-/g, "+").replace(/_/g, "/"));
+    return Uint8Array.from(binary, (character: string) => {
+      return character.charCodeAt(0);
+    }).buffer;
+  }
+
+  private static encode(value: ArrayBuffer): string {
+    let binary: string = "";
+    for (const byte of new Uint8Array(value)) {
+      binary += String.fromCharCode(byte);
+    }
+
+    return btoa(binary)
+      .replace(/\+/g, "-")
+      .replace(/\//g, "_")
+      .replace(/[=]+$/g, "");
+  }
+
+  public static ensureSupported(): void {
+    if (typeof window !== "undefined" && window.isSecureContext === false) {
+      throw new Error(
+        "Passkeys require a secure connection. Open OneUptime using HTTPS, or sign in with your password.",
+      );
+    }
+
+    if (
+      typeof PublicKeyCredential === "undefined" ||
+      typeof navigator === "undefined" ||
+      !navigator.credentials?.get ||
+      !navigator.credentials?.create
+    ) {
+      throw new Error(
+        "This browser does not support passkeys. Use a supported browser or sign in with your password.",
+      );
+    }
+  }
+
+  public static isSupported(): boolean {
+    try {
+      WebAuthn.ensureSupported();
+      return true;
+    } catch {
+      return false;
+    }
+  }
+
+  public static async authenticate(
+    options: JSONObject,
+    signal?: AbortSignal,
+  ): Promise<JSONObject> {
+    WebAuthn.ensureSupported();
+    if (signal?.aborted) {
+      throw new DOMException("Passkey request canceled.", "AbortError");
+    }
+    const json: RequestOptionsJSON = options as unknown as RequestOptionsJSON;
+    const credential: PublicKeyCredential | null =
+      (await navigator.credentials.get({
+        ...(signal ? { signal: signal } : {}),
+        publicKey: {
+          ...json,
+          challenge: WebAuthn.decode(json.challenge),
+          ...(json.allowCredentials
+            ? {
+                allowCredentials: json.allowCredentials.map(
+                  (
+                    item: CredentialDescriptorJSON,
+                  ): PublicKeyCredentialDescriptor => {
+                    return { ...item, id: WebAuthn.decode(item.id) };
+                  },
+                ),
+              }
+            : {}),
+        } as PublicKeyCredentialRequestOptions,
+      })) as PublicKeyCredential | null;
+
+    if (signal?.aborted) {
+      throw new DOMException("Passkey request canceled.", "AbortError");
+    }
+
+    if (!credential) {
+      throw new DOMException("No credential was selected.", "NotAllowedError");
+    }
+
+    const response: AuthenticatorAssertionResponse =
+      credential.response as AuthenticatorAssertionResponse;
+
+    return {
+      id: credential.id,
+      rawId: WebAuthn.encode(credential.rawId),
+      type: credential.type,
+      ...(credential.authenticatorAttachment
+        ? { authenticatorAttachment: credential.authenticatorAttachment }
+        : {}),
+      clientExtensionResults:
+        credential.getClientExtensionResults() as JSONObject,
+      response: {
+        authenticatorData: WebAuthn.encode(response.authenticatorData),
+        clientDataJSON: WebAuthn.encode(response.clientDataJSON),
+        signature: WebAuthn.encode(response.signature),
+        userHandle: response.userHandle
+          ? WebAuthn.encode(response.userHandle)
+          : null,
+      },
+    };
+  }
+
+  public static async register(
+    options: JSONObject,
+    signal?: AbortSignal,
+  ): Promise<JSONObject> {
+    WebAuthn.ensureSupported();
+    if (signal?.aborted) {
+      throw new DOMException("Passkey request canceled.", "AbortError");
+    }
+    const json: CreationOptionsJSON = options as unknown as CreationOptionsJSON;
+    const credential: PublicKeyCredential | null =
+      (await navigator.credentials.create({
+        ...(signal ? { signal: signal } : {}),
+        publicKey: {
+          ...json,
+          challenge: WebAuthn.decode(json.challenge),
+          user: { ...json.user, id: WebAuthn.decode(json.user.id) },
+          ...(json.excludeCredentials
+            ? {
+                excludeCredentials: json.excludeCredentials.map(
+                  (
+                    item: CredentialDescriptorJSON,
+                  ): PublicKeyCredentialDescriptor => {
+                    return { ...item, id: WebAuthn.decode(item.id) };
+                  },
+                ),
+              }
+            : {}),
+        } as PublicKeyCredentialCreationOptions,
+      })) as PublicKeyCredential | null;
+
+    if (signal?.aborted) {
+      throw new DOMException("Passkey request canceled.", "AbortError");
+    }
+
+    if (!credential) {
+      throw new DOMException("No credential was created.", "NotAllowedError");
+    }
+
+    const response: AuthenticatorAttestationResponse =
+      credential.response as AuthenticatorAttestationResponse;
+
+    return {
+      id: credential.id,
+      rawId: WebAuthn.encode(credential.rawId),
+      type: credential.type,
+      ...(credential.authenticatorAttachment
+        ? { authenticatorAttachment: credential.authenticatorAttachment }
+        : {}),
+      clientExtensionResults:
+        credential.getClientExtensionResults() as JSONObject,
+      response: {
+        attestationObject: WebAuthn.encode(response.attestationObject),
+        clientDataJSON: WebAuthn.encode(response.clientDataJSON),
+        transports: response.getTransports?.() || [],
+      },
+    };
+  }
+
+  public static getErrorMessage(
+    error: unknown,
+    operation: "sign-in" | "registration",
+  ): string {
+    if (error instanceof Error) {
+      if (error.name === "NotAllowedError" || error.name === "AbortError") {
+        return operation === "sign-in"
+          ? "Passkey sign-in was canceled or timed out. Try again, or sign in with your password."
+          : "Passkey registration was canceled or timed out. Try again when you are ready.";
+      }
+
+      if (error.name === "InvalidStateError") {
+        return "This authenticator is already registered. Choose a different authenticator or use your existing passkey.";
+      }
+    }
+
+    if (
+      error &&
+      typeof error === "object" &&
+      "message" in error &&
+      typeof error.message === "string" &&
+      error.message
+    ) {
+      return error.message;
+    }
+
+    return `Unable to complete passkey ${operation}. Please try again.`;
+  }
+}

package/UI/esbuild-config.js

@@ -279,6 +279,41 @@ function resolvePackageRoot(packageName) {
   );
 }
 
+/**
+ * Resolve a package SUBPATH (e.g. "react-router/dom") to the file its exports
+ * map publishes, or null when the installed version publishes no such subpath.
+ *
+ * Needed because esbuild's `alias` matches path prefixes: an entry for
+ * "react-router" also rewrites "react-router/dom" to "<root>/dom", a directory
+ * that does not exist on disk because the subpath only exists in the package's
+ * exports map. Aliasing the subpath explicitly, to the file it really resolves
+ * to, is what keeps the prefix alias from swallowing it.
+ *
+ * Returns null rather than throwing: the subpath is only present from
+ * react-router 7 onward, and a version without it needs no alias at all
+ * because nothing imports it.
+ */
+function resolvePackageSubpath(packageName, subpath) {
+  const specifier = `${packageName}/${subpath}`;
+
+  const resolutionPaths = [
+    process.cwd(),
+    __dirname,
+    path.resolve(__dirname, ".."),
+    path.resolve(__dirname, "../.."),
+  ];
+
+  for (const resolutionPath of resolutionPaths) {
+    try {
+      return require.resolve(specifier, { paths: [resolutionPath] });
+    } catch (error) {
+      continue;
+    }
+  }
+
+  return null;
+}
+
 /**
  * Create esbuild configuration for a service
  * @param {Object} options - Configuration options
@@ -304,7 +339,9 @@ function createConfig(options) {
   const isDev = process.env.NODE_ENV !== "production";
   const isAnalyze = process.env.analyze === "true";
   const reactRoot = resolvePackageRoot("react");
+  const reactDomRoot = resolvePackageRoot("react-dom");
   const reactRouterRoot = resolvePackageRoot("react-router");
+  const reactRouterDomSubpath = resolvePackageSubpath("react-router", "dom");
   const reactRouterDomRoot = resolvePackageRoot("react-router-dom");
   const reactI18nextRoot = resolvePackageRoot("react-i18next");
   const i18nextRoot = resolvePackageRoot("i18next");
@@ -356,11 +393,24 @@ function createConfig(options) {
     external: ["react-native-sqlite-storage", ...additionalExternal],
     alias: {
       react: reactRoot,
+      // Shared controls use portals while the entry point uses react-dom/client.
+      // Resolve both to one renderer even when each package installs its own copy.
+      "react-dom": reactDomRoot,
       "react/jsx-runtime": path.join(reactRoot, "jsx-runtime.js"),
       "react/jsx-dev-runtime": path.join(reactRoot, "jsx-dev-runtime.js"),
       // Public dashboards reuse widgets from the private dashboard package.
       // Their links must share the router context installed by the entry app.
       "react-router": reactRouterRoot,
+      /*
+       * react-router-dom 7 re-exports from "react-router/dom". The prefix
+       * alias above would rewrite that to "<reactRouterRoot>/dom", which is
+       * not a path on disk, and the bundle fails to build entirely. Point the
+       * subpath at the file its exports map names - the same shape as the
+       * react/jsx-runtime entries above.
+       */
+      ...(reactRouterDomSubpath
+        ? { "react-router/dom": reactRouterDomSubpath }
+        : {}),
       "react-router-dom": reactRouterDomRoot,
       // Force a single instance of i18next/react-i18next so that translations
       // initialized in the service entry are visible to Common UI components.

package/Utils/API.ts

@@ -11,6 +11,9 @@ import URL from "../Types/API/URL";
 import Dictionary from "../Types/Dictionary";
 import APIException from "../Types/Exception/ApiException";
 import BadDataException from "../Types/Exception/BadDataException";
+import EgressGuardException, {
+  EgressFailureReason,
+} from "../Types/Exception/EgressGuardException";
 import { JSONArray, JSONObject } from "../Types/JSON";
 import RequestFailedDetails, {
   RequestFailedPhase,
@@ -1158,6 +1161,37 @@ export default class API {
     const rawErrorMessage: string =
       (error as Error)?.message || String(error) || "Unknown error";
 
+    /*
+     * The egress guard refuses a target BEFORE any socket is opened, and for
+     * tenant-facing callers it sanitizes its message down to one sentence that
+     * matches none of the patterns below. Left to the fall-through, every such
+     * failure was reported as phase "Unknown" with the sanitized sentence
+     * echoed back as its own explanation — which is exactly what a monitor
+     * incident showed for a host whose DNS had hiccuped. Classify it here
+     * instead, from the exception TYPE rather than from its text.
+     */
+    if (error instanceof EgressGuardException) {
+      return {
+        failedPhase: RequestFailedPhase.TargetResolution,
+        errorCode:
+          error.reason === EgressFailureReason.InvalidTarget
+            ? "INVALID_TARGET"
+            : "TARGET_UNREACHABLE",
+        /*
+         * One constant description for every unreachable reason. It names all
+         * the possibilities without saying which occurred, so it stays useful
+         * without telling a tenant on a shared probe whether a hostname
+         * resolved — that difference is the enumeration oracle the guard's
+         * sanitized message exists to close.
+         */
+        errorDescription:
+          error.reason === EgressFailureReason.InvalidTarget
+            ? `The monitor's target is not a valid HTTP or HTTPS destination, so no request was attempted. ${rawErrorMessage}`
+            : "The probe could not obtain a usable network address for this host, so no connection was attempted and the target was never contacted. Either DNS did not answer, answered with no records, or returned an address this probe is not allowed to dial. Check that the hostname resolves publicly and that its authoritative nameservers are healthy. If this monitor targets an internal host, run it from a self-hosted probe with PROBE_ALLOW_PRIVATE_NETWORK_MONITORS=true.",
+        rawErrorMessage,
+      };
+    }
+
     // Helper to determine the phase and description based on error code/message
     const lowerMessage: string = rawErrorMessage.toLowerCase();
 

package/Utils/Dashboard/Components/DashboardVMwareHostListComponent.ts

@@ -0,0 +1,38 @@
+import DashboardVMwareHostListComponent from "../../../Types/Dashboard/DashboardComponents/DashboardVMwareHostListComponent";
+import { ObjectType } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import DashboardBaseComponentUtil from "./DashboardBaseComponent";
+import { ComponentArgument } from "../../../Types/Dashboard/DashboardComponents/ComponentArgument";
+import DashboardComponentType from "../../../Types/Dashboard/DashboardComponentType";
+import { getVMwareCommonArguments } from "./DashboardVMwareResourceListShared";
+
+export default class DashboardVMwareHostListComponentUtil extends DashboardBaseComponentUtil {
+  public static override getDefaultComponent(): DashboardVMwareHostListComponent {
+    return {
+      _type: ObjectType.DashboardComponent,
+      componentType: DashboardComponentType.VMwareHostList,
+      widthInDashboardUnits: 6,
+      heightInDashboardUnits: 4,
+      topInDashboardUnits: 0,
+      leftInDashboardUnits: 0,
+      componentId: ObjectID.generate(),
+      minHeightInDashboardUnits: 3,
+      minWidthInDashboardUnits: 6,
+      arguments: {
+        maxRows: 25,
+      },
+    };
+  }
+
+  /*
+   * ESXi hosts carry no per-host power or connection state in the vcenter
+   * receiver's output (host power state only appears as a datacenter-level
+   * count), so this widget has no status filter — just the shared
+   * title / max rows / view mode / vCenter arguments.
+   */
+  public static override getComponentConfigArguments(): Array<
+    ComponentArgument<DashboardVMwareHostListComponent>
+  > {
+    return getVMwareCommonArguments<DashboardVMwareHostListComponent>();
+  }
+}

package/Utils/Dashboard/Components/DashboardVMwareResourceListShared.ts

@@ -0,0 +1,70 @@
+import {
+  ComponentArgument,
+  ComponentArgumentSection,
+  ComponentInputType,
+  EntityFilterModelType,
+} from "../../../Types/Dashboard/DashboardComponents/ComponentArgument";
+import DashboardBaseComponent from "../../../Types/Dashboard/DashboardComponents/DashboardBaseComponent";
+import { getViewModeArgument } from "./DashboardListSharedArgs";
+
+/*
+ * Arguments shared by every VMware inventory list widget (hosts, virtual
+ * machines). The shape — title, max rows, view mode, then a vCenter
+ * multi-select in a collapsed Filters panel — is deliberately identical to
+ * the Ceph / Docker Swarm / Proxmox / Kubernetes builders; a cross-provider
+ * test compares them. Widget-specific filters (power state, templates) are
+ * added by the per-widget util, never here.
+ */
+
+export const VMwareDisplaySection: ComponentArgumentSection = {
+  name: "Display Options",
+  description: "Configure the widget title and row limit",
+  order: 1,
+};
+
+export const VMwareFiltersSection: ComponentArgumentSection = {
+  name: "Filters",
+  description: "Narrow down which resources are shown",
+  order: 2,
+  defaultCollapsed: true,
+};
+
+export function getVMwareCommonArguments<
+  T extends DashboardBaseComponent,
+>(): Array<ComponentArgument<T>> {
+  const args: Array<ComponentArgument<T>> = [];
+
+  args.push({
+    name: "Title",
+    description: "Header shown above the list",
+    required: false,
+    type: ComponentInputType.Text,
+    id: "title" as keyof T["arguments"],
+    section: VMwareDisplaySection,
+  });
+
+  args.push({
+    name: "Max Rows",
+    description: "Maximum number of rows to show",
+    required: false,
+    type: ComponentInputType.Number,
+    id: "maxRows" as keyof T["arguments"],
+    placeholder: "25",
+    section: VMwareDisplaySection,
+  });
+
+  args.push(getViewModeArgument<T>(VMwareDisplaySection));
+
+  args.push({
+    name: "vCenters",
+    description: "Show only resources from the selected vCenters",
+    required: false,
+    type: ComponentInputType.EntityMultiSelectDropdown,
+    id: "vmwareVCenterIds" as keyof T["arguments"],
+    placeholder: "All vCenters",
+    section: VMwareFiltersSection,
+    entityFilterModelType: EntityFilterModelType.VMwareVCenter,
+  });
+
+  return args;
+}

package/Utils/Dashboard/Components/DashboardVMwareVirtualMachineListComponent.ts

@@ -0,0 +1,76 @@
+import DashboardVMwareVirtualMachineListComponent from "../../../Types/Dashboard/DashboardComponents/DashboardVMwareVirtualMachineListComponent";
+import { ObjectType } from "../../../Types/JSON";
+import ObjectID from "../../../Types/ObjectID";
+import DashboardBaseComponentUtil from "./DashboardBaseComponent";
+import {
+  ComponentArgument,
+  ComponentInputType,
+} from "../../../Types/Dashboard/DashboardComponents/ComponentArgument";
+import DashboardComponentType from "../../../Types/Dashboard/DashboardComponentType";
+import {
+  VMwareFiltersSection,
+  getVMwareCommonArguments,
+} from "./DashboardVMwareResourceListShared";
+
+export default class DashboardVMwareVirtualMachineListComponentUtil extends DashboardBaseComponentUtil {
+  public static override getDefaultComponent(): DashboardVMwareVirtualMachineListComponent {
+    return {
+      _type: ObjectType.DashboardComponent,
+      componentType: DashboardComponentType.VMwareVirtualMachineList,
+      widthInDashboardUnits: 6,
+      heightInDashboardUnits: 4,
+      topInDashboardUnits: 0,
+      leftInDashboardUnits: 0,
+      componentId: ObjectID.generate(),
+      minHeightInDashboardUnits: 3,
+      minWidthInDashboardUnits: 6,
+      arguments: {
+        maxRows: 25,
+      },
+    };
+  }
+
+  public static override getComponentConfigArguments(): Array<
+    ComponentArgument<DashboardVMwareVirtualMachineListComponent>
+  > {
+    const args: Array<
+      ComponentArgument<DashboardVMwareVirtualMachineListComponent>
+    > = getVMwareCommonArguments<DashboardVMwareVirtualMachineListComponent>();
+
+    /*
+     * Power state is inferred at ingest: the vcenter receiver emits
+     * vcenter.vm.cpu.* only for powered-on VMs, so "off" covers both
+     * powered-off and suspended machines.
+     */
+    args.push({
+      name: "Power State",
+      description: "Quick filter by virtual machine power state",
+      required: false,
+      type: ComponentInputType.Dropdown,
+      id: "powerStateFilter",
+      section: VMwareFiltersSection,
+      dropdownOptions: [
+        { label: "All", value: "" },
+        { label: "Powered on only", value: "on" },
+        { label: "Powered off only", value: "off" },
+      ],
+    });
+
+    args.push({
+      name: "Templates",
+      description:
+        "Include VM templates alongside virtual machines, hide them, or show only templates",
+      required: false,
+      type: ComponentInputType.Dropdown,
+      id: "templateFilter",
+      section: VMwareFiltersSection,
+      dropdownOptions: [
+        { label: "VMs and templates", value: "" },
+        { label: "Hide templates", value: "exclude" },
+        { label: "Templates only", value: "only" },
+      ],
+    });
+
+    return args;
+  }
+}

package/Utils/Dashboard/Components/Index.ts

@@ -50,6 +50,8 @@ import DashboardTraceChartComponentUtil from "./DashboardTraceChartComponent";
 import DashboardTraceTableComponentUtil from "./DashboardTraceTableComponent";
 import DashboardTraceListComponentUtil from "./DashboardTraceListComponent";
 import DashboardValueComponentUtil from "./DashboardValueComponent";
+import DashboardVMwareHostListComponentUtil from "./DashboardVMwareHostListComponent";
+import DashboardVMwareVirtualMachineListComponentUtil from "./DashboardVMwareVirtualMachineListComponent";
 
 export default class DashboardComponentsUtil {
   public static getComponentSettingsArguments(
@@ -318,6 +320,20 @@ export default class DashboardComponentsUtil {
       >;
     }
 
+    if (dashboardComponentType === DashboardComponentType.VMwareHostList) {
+      return DashboardVMwareHostListComponentUtil.getComponentConfigArguments() as Array<
+        ComponentArgument<DashboardBaseComponent>
+      >;
+    }
+
+    if (
+      dashboardComponentType === DashboardComponentType.VMwareVirtualMachineList
+    ) {
+      return DashboardVMwareVirtualMachineListComponentUtil.getComponentConfigArguments() as Array<
+        ComponentArgument<DashboardBaseComponent>
+      >;
+    }
+
     if (dashboardComponentType === DashboardComponentType.DockerSwarmNodeList) {
       return DashboardDockerSwarmNodeListComponentUtil.getComponentConfigArguments() as Array<
         ComponentArgument<DashboardBaseComponent>