@oneuptime/common 13.0.4 → 13.0.5

package/Server/API/GoogleSecOpsConnectionAPI.ts

@@ -1,7 +1,9 @@
 import GoogleSecOpsConnection from "../../Models/DatabaseModels/GoogleSecOpsConnection";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
+import { JSONObject, JSONValue } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
+import { SecurityConnectorTestReport } from "../../Types/SecurityEvent/Connectors/ConnectorDiagnostics";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import GoogleSecOpsConnectionService, {
   Service as GoogleSecOpsConnectionServiceType,
@@ -12,6 +14,7 @@ import {
   NextFunction,
 } from "../Utils/Express";
 import Response from "../Utils/Response";
+import GoogleSecOpsConnectionTester from "../Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsConnectionTester";
 import GoogleSecOpsRunExecutor from "../Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsRunExecutor";
 import BaseAPI from "./BaseAPI";
 import CommonAPI from "./CommonAPI";
@@ -23,8 +26,11 @@ export default class GoogleSecOpsConnectionAPI extends BaseAPI<
   public constructor() {
     super(GoogleSecOpsConnection, GoogleSecOpsConnectionService);
 
+    const basePath: string =
+      new this.entityType().getCrudApiPath()?.toString() || "";
+
     this.router.post(
-      `${new this.entityType().getCrudApiPath()?.toString()}/:connectionId/run`,
+      `${basePath}/:connectionId/run`,
       UserMiddleware.getUserMiddleware,
       UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
@@ -33,13 +39,7 @@ export default class GoogleSecOpsConnectionAPI extends BaseAPI<
             await CommonAPI.getDatabaseCommonInteractionProps(req);
           const projectId: ObjectID =
             CommonAPI.assertAuthenticatedProjectMember(props);
-          CommonAPI.assertPermittedInProject({
-            databaseProps: props,
-            allowedPermissions:
-              new GoogleSecOpsConnection().getUpdatePermissions(),
-            errorMessage:
-              "Project owners, project administrators, and security administrators can run connection diagnostics.",
-          });
+          this.assertCanOperate(props);
 
           const connectionId: string | undefined = req.params["connectionId"];
           if (!connectionId || !ObjectID.isValidUUID(connectionId)) {
@@ -75,5 +75,246 @@ export default class GoogleSecOpsConnectionAPI extends BaseAPI<
         }
       },
     );
+
+    /*
+     * Synchronous connection test, run in this process rather than through
+     * the Worker queue so it can report "no worker is consuming the queue"
+     * instead of sitting in "queued". Body is either
+     *   { connectionId, region?, instanceResourceName?,
+     *     includeNonAlertingDetections? } — a saved connection (credentials
+     *     read with root props here, never returned). The optional settings
+     *     are the edit form's unsaved values: they replace the stored ones
+     *     for this test only, while the stored key is always used, because
+     *     the key can never be read back into the form. Or
+     *   { region, instanceResourceName, serviceAccountJson,
+     *     includeNonAlertingDetections } — settings that were never saved,
+     *     so the create form can test before storing anything.
+     * Nothing is persisted except a run-history row for a saved connection
+     * tested exactly as stored: a row describing settings that were never
+     * saved would misstate that connection's history.
+     */
+    this.router.post(
+      `${basePath}/test`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+          this.assertCanOperate(props);
+
+          const body: JSONObject =
+            req.body && typeof req.body === "object" && !Array.isArray(req.body)
+              ? (req.body as JSONObject)
+              : {};
+
+          const connectionIdValue: JSONValue | undefined = body["connectionId"];
+          let connection: GoogleSecOpsConnection;
+          let recordRun: boolean = false;
+
+          if (connectionIdValue !== undefined && connectionIdValue !== null) {
+            const connectionId: string = String(connectionIdValue);
+
+            if (!ObjectID.isValidUUID(connectionId)) {
+              throw new BadDataException("A valid connection ID is required.");
+            }
+
+            const accessible: GoogleSecOpsConnection | null =
+              await this.service.findOneBy({
+                query: { _id: connectionId, projectId },
+                select: { _id: true, projectId: true },
+                props,
+              });
+            CommonAPI.assertResourceBelongsToProject({
+              resourceProjectId: accessible?.projectId,
+              projectId,
+            });
+
+            const loaded: GoogleSecOpsConnection | null =
+              await this.service.findOneById({
+                id: new ObjectID(connectionId),
+                select: {
+                  _id: true,
+                  projectId: true,
+                  name: true,
+                  region: true,
+                  instanceResourceName: true,
+                  serviceAccountJson: true,
+                  includeNonAlertingDetections: true,
+                  isEnabled: true,
+                  pollIntervalInMinutes: true,
+                  createdAt: true,
+                  lastPolledAt: true,
+                  lastSuccessfulPollAt: true,
+                  lastEventIngestedAt: true,
+                  lastError: true,
+                },
+                props: { isRoot: true },
+              });
+
+            if (!loaded) {
+              throw new BadDataException("The connection no longer exists.");
+            }
+
+            const overlaid: boolean =
+              GoogleSecOpsConnectionAPI.overlayEditedSettings({
+                connection: loaded,
+                body,
+              });
+
+            connection = loaded;
+            recordRun = !overlaid;
+          } else {
+            const region: string = GoogleSecOpsConnectionAPI.readString(
+              body["region"],
+            );
+            const instanceResourceName: string =
+              GoogleSecOpsConnectionAPI.readString(
+                body["instanceResourceName"],
+              );
+            const serviceAccountJson: string =
+              GoogleSecOpsConnectionAPI.readString(body["serviceAccountJson"]);
+
+            if (!region || !instanceResourceName || !serviceAccountJson) {
+              throw new BadDataException(
+                "Provide a connectionId, or region, instanceResourceName and serviceAccountJson to test unsaved settings.",
+              );
+            }
+
+            const includeNonAlertingDetections: JSONValue | undefined =
+              body["includeNonAlertingDetections"];
+
+            // The same rules create and update apply, without a row.
+            GoogleSecOpsConnectionServiceType.validateSettings({
+              region,
+              instanceResourceName,
+              serviceAccountJson,
+              includeNonAlertingDetections:
+                includeNonAlertingDetections === undefined ||
+                includeNonAlertingDetections === null
+                  ? undefined
+                  : (includeNonAlertingDetections as boolean),
+            });
+
+            /*
+             * A transient row with no id: the tester treats it as unsaved
+             * (no schedule check, no run-history row) and nothing here
+             * writes it.
+             */
+            connection = new GoogleSecOpsConnection();
+            connection.projectId = projectId;
+            connection.region = region;
+            connection.instanceResourceName = instanceResourceName;
+            connection.serviceAccountJson = serviceAccountJson;
+            connection.includeNonAlertingDetections =
+              includeNonAlertingDetections === true;
+          }
+
+          const report: SecurityConnectorTestReport =
+            await GoogleSecOpsConnectionTester.test({ connection, recordRun });
+
+          return Response.sendJsonObjectResponse(
+            req,
+            res,
+            report as unknown as JSONObject,
+          );
+        } catch (error) {
+          next(error);
+        }
+      },
+    );
+  }
+
+  private assertCanOperate(props: DatabaseCommonInteractionProps): void {
+    CommonAPI.assertPermittedInProject({
+      databaseProps: props,
+      allowedPermissions: new GoogleSecOpsConnection().getUpdatePermissions(),
+      errorMessage:
+        "Project owners, project administrators, and security administrators can run connection diagnostics.",
+    });
+  }
+
+  /*
+   * Applies the edit form's unsaved region, instance resource name and
+   * Detections selection to a loaded connection, validated with the same
+   * rules create and update apply (review finding
+   * edit-form-test-ignores-edited-settings: the stored values used to be
+   * tested and the edits silently ignored). Absent or null values keep the
+   * stored setting; the stored key is never replaced here.
+   *
+   * Returns true when any value differs from the stored one. A value equal
+   * to the stored one tests exactly what is saved, so it is not an overlay
+   * and the run can still be recorded against the connection.
+   */
+  private static overlayEditedSettings(data: {
+    connection: GoogleSecOpsConnection;
+    body: JSONObject;
+  }): boolean {
+    const regionValue: JSONValue | undefined = data.body["region"];
+    const instanceValue: JSONValue | undefined =
+      data.body["instanceResourceName"];
+    const includeValue: JSONValue | undefined =
+      data.body["includeNonAlertingDetections"];
+
+    const region: string | undefined =
+      regionValue === undefined || regionValue === null
+        ? undefined
+        : GoogleSecOpsConnectionAPI.readString(regionValue);
+    const instanceResourceName: string | undefined =
+      instanceValue === undefined || instanceValue === null
+        ? undefined
+        : GoogleSecOpsConnectionAPI.readString(instanceValue);
+    const includeNonAlertingDetections: boolean | undefined =
+      includeValue === undefined || includeValue === null
+        ? undefined
+        : (includeValue as boolean);
+
+    /*
+     * An empty region or instance is validated rather than ignored: the
+     * person cleared the field, and testing the stored value instead is the
+     * defect this overlay exists to remove.
+     */
+    GoogleSecOpsConnectionServiceType.validateSettings({
+      region,
+      instanceResourceName,
+      includeNonAlertingDetections,
+    });
+
+    let overlaid: boolean = false;
+
+    if (region !== undefined && region !== data.connection.region) {
+      data.connection.region = region;
+      overlaid = true;
+    }
+
+    if (
+      instanceResourceName !== undefined &&
+      instanceResourceName !== data.connection.instanceResourceName
+    ) {
+      data.connection.instanceResourceName = instanceResourceName;
+      overlaid = true;
+    }
+
+    if (
+      includeNonAlertingDetections !== undefined &&
+      includeNonAlertingDetections !==
+        (data.connection.includeNonAlertingDetections === true)
+    ) {
+      data.connection.includeNonAlertingDetections =
+        includeNonAlertingDetections;
+      overlaid = true;
+    }
+
+    return overlaid;
+  }
+
+  private static readString(value: JSONValue | undefined): string {
+    if (value === null || value === undefined) {
+      return "";
+    }
+
+    return typeof value === "string" ? value.trim() : String(value).trim();
   }
 }

package/Server/API/SecurityEventConnectionAPI.ts

@@ -0,0 +1,250 @@
+import SecurityEventConnection from "../../Models/DatabaseModels/SecurityEventConnection";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../Types/Exception/BadDataException";
+import { JSONObject, JSONValue } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
+import { SecurityConnectorTestReport } from "../../Types/SecurityEvent/Connectors/ConnectorDiagnostics";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import SecurityEventConnectionService, {
+  Service as SecurityEventConnectionServiceType,
+} from "../Services/SecurityEventConnectionService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import SecurityEventConnectionRunExecutor from "../Utils/SecurityEvent/Connectors/SecurityEventConnectionRunExecutor";
+import SecurityEventConnectionTester from "../Utils/SecurityEvent/Connectors/SecurityEventConnectionTester";
+import { SecurityConnectorSettings } from "../Utils/SecurityEvent/Connectors/Types";
+import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+
+export default class SecurityEventConnectionAPI extends BaseAPI<
+  SecurityEventConnection,
+  SecurityEventConnectionServiceType
+> {
+  public constructor() {
+    super(SecurityEventConnection, SecurityEventConnectionService);
+
+    const basePath: string =
+      new this.entityType().getCrudApiPath()?.toString() || "";
+
+    /*
+     * Queue an operation (test, poll, preview, backfill) for the worker.
+     * Same gate as editing the connection: whoever may configure it may
+     * operate it.
+     */
+    this.router.post(
+      `${basePath}/:connectionId/run`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+          this.assertCanOperate(props);
+
+          const connectionId: string | undefined = req.params["connectionId"];
+
+          if (!connectionId || !ObjectID.isValidUUID(connectionId)) {
+            throw new BadDataException("A valid connection ID is required.");
+          }
+
+          const connection: SecurityEventConnection | null =
+            await this.service.findOneBy({
+              query: { _id: connectionId, projectId },
+              select: { _id: true, projectId: true },
+              props,
+            });
+          CommonAPI.assertResourceBelongsToProject({
+            resourceProjectId: connection?.projectId,
+            projectId,
+          });
+
+          const runId: ObjectID =
+            await SecurityEventConnectionRunExecutor.enqueue({
+              projectId,
+              connectionId: new ObjectID(connectionId),
+              options: SecurityEventConnectionRunExecutor.validateOptions(
+                req.body,
+              ),
+              requestedByUserId: props.userId,
+            });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            runId: runId.toString(),
+          });
+        } catch (error) {
+          next(error);
+        }
+      },
+    );
+
+    /*
+     * Synchronous connection test. Body is either
+     *   { connectionId, config?, secrets? }  — a saved connection, optionally
+     *     with unsaved edits overlaid by the same rule a save applies (a
+     *     secret value replaces the stored one, "" or undefined keeps it,
+     *     null removes it, so the edit form can test a cleared optional
+     *     credential before saving), or
+     *   { provider, config, secrets, alertingOnly? } — settings that were
+     *     never saved, so the create form can test before storing anything.
+     * Nothing is persisted except a run-history row for a saved connection.
+     */
+    this.router.post(
+      `${basePath}/test`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+          this.assertCanOperate(props);
+
+          const body: JSONObject =
+            req.body && typeof req.body === "object" && !Array.isArray(req.body)
+              ? (req.body as JSONObject)
+              : {};
+
+          const connectionIdValue: JSONValue | undefined = body["connectionId"];
+          let connection: SecurityEventConnection | undefined = undefined;
+          let settings: SecurityConnectorSettings;
+
+          if (connectionIdValue !== undefined && connectionIdValue !== null) {
+            const connectionId: string = String(connectionIdValue);
+
+            if (!ObjectID.isValidUUID(connectionId)) {
+              throw new BadDataException("A valid connection ID is required.");
+            }
+
+            const accessible: SecurityEventConnection | null =
+              await this.service.findOneBy({
+                query: { _id: connectionId, projectId },
+                select: { _id: true, projectId: true },
+                props,
+              });
+            CommonAPI.assertResourceBelongsToProject({
+              resourceProjectId: accessible?.projectId,
+              projectId,
+            });
+
+            const loaded: SecurityEventConnection | null =
+              await this.service.findOneById({
+                id: new ObjectID(connectionId),
+                select: {
+                  _id: true,
+                  projectId: true,
+                  name: true,
+                  provider: true,
+                  config: true,
+                  secrets: true,
+                  alertingOnly: true,
+                  isEnabled: true,
+                  pollIntervalInMinutes: true,
+                  createdAt: true,
+                  lastPolledAt: true,
+                  lastSuccessfulPollAt: true,
+                  lastEventIngestedAt: true,
+                  lastError: true,
+                },
+                props: { isRoot: true },
+              });
+
+            if (!loaded || !loaded.provider) {
+              throw new BadDataException("The connection no longer exists.");
+            }
+
+            connection = loaded;
+
+            const stored: SecurityConnectorSettings =
+              await this.service.getConnectorSettings(loaded);
+            const config: JSONObject =
+              body["config"] !== undefined
+                ? SecurityEventConnectionServiceType.parseJsonObject(
+                    body["config"],
+                    "Configuration",
+                  )
+                : stored.config;
+            const overlay: JSONObject =
+              body["secrets"] !== undefined
+                ? SecurityEventConnectionServiceType.parseJsonObject(
+                    body["secrets"],
+                    "Credentials",
+                  )
+                : {};
+            /*
+             * The merge a save would apply. Testing with a different rule
+             * would pass settings that cannot be stored, or report a
+             * cleared credential as still in use (review finding
+             * optional-secret-cannot-be-cleared).
+             */
+            const secrets: JSONObject =
+              SecurityEventConnectionServiceType.mergeSecrets({
+                definition:
+                  SecurityEventConnectionServiceType.getDefinitionOrThrow(
+                    loaded.provider,
+                  ),
+                stored: stored.secrets,
+                provided: overlay,
+              });
+
+            settings =
+              await SecurityEventConnectionServiceType.validateSettings({
+                provider: loaded.provider,
+                config,
+                secrets,
+                alertingOnly:
+                  typeof body["alertingOnly"] === "boolean"
+                    ? body["alertingOnly"]
+                    : stored.alertingOnly,
+                requireRequiredSecrets: true,
+              });
+          } else {
+            settings =
+              await SecurityEventConnectionServiceType.validateSettings({
+                provider: body["provider"],
+                config: SecurityEventConnectionServiceType.parseJsonObject(
+                  body["config"],
+                  "Configuration",
+                ),
+                secrets: SecurityEventConnectionServiceType.parseJsonObject(
+                  body["secrets"],
+                  "Credentials",
+                ),
+                alertingOnly: body["alertingOnly"] !== false,
+                requireRequiredSecrets: true,
+              });
+          }
+
+          const report: SecurityConnectorTestReport =
+            await SecurityEventConnectionTester.test({
+              settings,
+              connection,
+            });
+
+          return Response.sendJsonObjectResponse(
+            req,
+            res,
+            report as unknown as JSONObject,
+          );
+        } catch (error) {
+          next(error);
+        }
+      },
+    );
+  }
+
+  private assertCanOperate(props: DatabaseCommonInteractionProps): void {
+    CommonAPI.assertPermittedInProject({
+      databaseProps: props,
+      allowedPermissions: new SecurityEventConnection().getUpdatePermissions(),
+      errorMessage:
+        "Project owners, project administrators, and security administrators can run connection diagnostics.",
+    });
+  }
+}