@oneuptime/common 13.0.5 → 13.0.6

package/Server/Utils/Slo/SloOwnerReferenceValidator.ts

@@ -0,0 +1,208 @@
+import TeamMemberService from "../../Services/TeamMemberService";
+import TeamService from "../../Services/TeamService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import SloRecordReferenceValidator from "./SloRecordReferenceValidator";
+import Team from "../../../Models/DatabaseModels/Team";
+import TeamMember from "../../../Models/DatabaseModels/TeamMember";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * An SLO owner row names a user or a team, and nothing in the framework checks
+ * either against the row's project: DatabaseService only stamps the row's own
+ * projectId from the caller. Owners are who hears about an SLO, so a stranger
+ * named as one is a leak in both directions:
+ *
+ * - SendOwnerAddedNotification emails every owner (and every member of an
+ *   owner team) this project's SLO name, project name and link;
+ * - ServiceLevelObjectiveService.findOwners reads owners by SLO id alone, so a
+ *   burn rate rule with addSloOwnersAsOwners adds them to its alerts and
+ *   incidents;
+ * - the SLO feed names the user - email included when they are removed - and
+ *   the team, read as root.
+ *
+ * Both checks read pinned to the row's project and select nothing but ids, so
+ * a user or team from elsewhere is never loaded. An id from another project and
+ * an id that matches nothing get the same answer, which echoes only the ids the
+ * caller sent - never a name or an email.
+ */
+
+// Postgres renders a uuid lower-cased whatever case the payload used.
+type NormalizeIdFunction = (id: string) => string;
+
+const normalizeId: NormalizeIdFunction = (id: string): string => {
+  return id.trim().toLowerCase();
+};
+
+type DescribeIdsFunction = (ids: Array<string>) => string;
+
+const describeIds: DescribeIdsFunction = (ids: Array<string>): string => {
+  return ids
+    .map((id: string): string => {
+      return `"${id}"`;
+    })
+    .join(", ");
+};
+
+// The ids a pinned lookup found, as the database returned them.
+type FindIdsFunction = (lookupIds: Array<string>) => Promise<Array<string>>;
+
+export default class SloOwnerReferenceValidator {
+  /*
+   * Team membership is what "in this project" means for a user, and it is
+   * exactly the set the dashboard's owner picker offers (AddOwnerPopover lists
+   * the project's TeamMember rows). Pending invitations count for that reason:
+   * refusing a user the picker just offered would fail a save nobody could
+   * explain. It is the rule ServiceLevelObjectiveBurnRateRuleService applies to
+   * a burn rate rule's alert and incident owner users.
+   */
+  public static async validateUsersAreProjectMembers(data: {
+    projectId: ObjectID | undefined;
+    // The userId column and/or the user relation, in any shape a hook sees.
+    users: unknown;
+    // Used in the error message, e.g. "SLO owner user".
+    subject: string;
+  }): Promise<void> {
+    const ids: Array<string> = SloRecordReferenceValidator.getReferencedIds(
+      data.users,
+    );
+
+    if (ids.length === 0 || !data.projectId) {
+      /*
+       * Same rule as SloRecordReferenceValidator: with no project to compare
+       * against the check is a no-op, and the required tenant column fails the
+       * write instead.
+       */
+      return;
+    }
+
+    const projectId: ObjectID = data.projectId;
+
+    const nonMemberIds: Array<string> =
+      await SloOwnerReferenceValidator.getUnmatchedIds({
+        ids: ids,
+        findIds: async (lookupIds: Array<string>): Promise<Array<string>> => {
+          const memberships: Array<TeamMember> = await TeamMemberService.findBy(
+            {
+              query: {
+                // Pinned: a membership in another project is never read.
+                projectId: projectId,
+                userId: QueryHelper.any(lookupIds),
+              },
+              select: {
+                userId: true,
+              },
+              // One row per team the user is in, so not one row per id.
+              limit: LIMIT_PER_PROJECT,
+              skip: 0,
+              props: {
+                isRoot: true,
+              },
+            },
+          );
+
+          return memberships.map((membership: TeamMember): string => {
+            return membership.userId?.toString() || "";
+          });
+        },
+      });
+
+    if (nonMemberIds.length === 0) {
+      return;
+    }
+
+    throw new BadDataException(
+      nonMemberIds.length === 1
+        ? `This ${data.subject} names a user who is not a member of this project: ${describeIds(nonMemberIds)}. Please pick a user from this project and try again.`
+        : `This ${data.subject} names users who are not members of this project: ${describeIds(nonMemberIds)}. Please pick users from this project and try again.`,
+    );
+  }
+
+  public static async validateTeamsBelongToProject(data: {
+    projectId: ObjectID | undefined;
+    // The teamId column and/or the team relation, in any shape a hook sees.
+    teams: unknown;
+    // Used in the error message, e.g. "SLO owner team".
+    subject: string;
+  }): Promise<void> {
+    const ids: Array<string> = SloRecordReferenceValidator.getReferencedIds(
+      data.teams,
+    );
+
+    if (ids.length === 0 || !data.projectId) {
+      // Nothing to compare against, as above.
+      return;
+    }
+
+    const projectId: ObjectID = data.projectId;
+
+    const unknownTeamIds: Array<string> =
+      await SloOwnerReferenceValidator.getUnmatchedIds({
+        ids: ids,
+        findIds: async (lookupIds: Array<string>): Promise<Array<string>> => {
+          const teams: Array<Team> = await TeamService.findBy({
+            query: {
+              _id: QueryHelper.any(lookupIds),
+              // Pinned: another project's team is never read.
+              projectId: projectId,
+            },
+            select: {
+              _id: true,
+            },
+            limit: lookupIds.length,
+            skip: 0,
+            props: {
+              isRoot: true,
+            },
+          });
+
+          return teams.map((team: Team): string => {
+            return team._id?.toString() || "";
+          });
+        },
+      });
+
+    if (unknownTeamIds.length === 0) {
+      return;
+    }
+
+    throw new BadDataException(
+      unknownTeamIds.length === 1
+        ? `This ${data.subject} references a team that does not exist in this project: ${describeIds(unknownTeamIds)}. Please pick a team from this project and try again.`
+        : `This ${data.subject} references teams that do not exist in this project: ${describeIds(unknownTeamIds)}. Please pick teams from this project and try again.`,
+    );
+  }
+
+  /*
+   * The requested ids the pinned lookup did not return, in the order and case
+   * the caller sent them.
+   */
+  private static async getUnmatchedIds(data: {
+    ids: Array<string>;
+    findIds: FindIdsFunction;
+  }): Promise<Array<string>> {
+    /*
+     * A malformed id would make Postgres reject the uuid cast and surface as an
+     * opaque 500. It cannot match anything in this project either, so it gets
+     * the same answer as a foreign id, without a query.
+     */
+    const lookupIds: Array<string> = data.ids.filter((id: string): boolean => {
+      return ObjectID.isValidUUID(id);
+    });
+
+    const foundIds: Set<string> = new Set<string>();
+
+    if (lookupIds.length > 0) {
+      for (const foundId of await data.findIds(lookupIds)) {
+        if (foundId) {
+          foundIds.add(normalizeId(foundId));
+        }
+      }
+    }
+
+    return data.ids.filter((id: string): boolean => {
+      return !foundIds.has(normalizeId(id));
+    });
+  }
+}

package/Server/Utils/Slo/SloRecordReferenceValidator.ts

@@ -0,0 +1,169 @@
+import DatabaseService from "../../Services/DatabaseService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import { resolveReferenceId } from "../Database/ProjectScopedReferenceValidator";
+import ServiceLevelObjective from "../../../Models/DatabaseModels/ServiceLevelObjective";
+import BadDataException from "../../../Types/Exception/BadDataException";
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * Incident.serviceLevelObjectives and Alert.serviceLevelObjectives are
+ * client-writable. Their column ACL matches `services`, so any IncidentMember
+ * or AlertMember can send them, and nothing in the framework checks that a
+ * relation id belongs to the row's project. A caller holding another project's
+ * SLO id could link it. The created feed item, the incidents and alerts lists,
+ * the AI context and the incident/alert metrics would then show that SLO's
+ * name inside the caller's project.
+ *
+ * Why this file exists instead of ProjectScopedReferenceValidator with
+ * ServiceLevelObjectiveService:
+ *
+ * - IncidentService and AlertService cannot import ServiceLevelObjectiveService.
+ *   It imports ServiceLevelObjectiveBurnRateRuleService, which imports both of
+ *   them to resolve burn-rate outputs. So the lookup here goes through a plain
+ *   DatabaseService over the model, which carries no hooks and imports none of
+ *   those services.
+ * - ProjectScopedReferenceValidator reads the referenced rows as root and names
+ *   a foreign one in its error (`Service Level Objective "<name>"`). That is
+ *   fine for a state or a severity. For an SLO, the name is exactly what must
+ *   not leak. Here the read is pinned to the record's own project, so another
+ *   project's SLO is never loaded. A foreign id and an id that matches nothing
+ *   get the same answer, which echoes only the ids the caller sent.
+ */
+
+/*
+ * Ids are compared lower-cased. Postgres reads a uuid back lower-cased
+ * whatever case the payload used (see ProjectScopedReferenceValidator).
+ */
+function normalizeId(id: string): string {
+  return id.trim().toLowerCase();
+}
+
+let lookupService: DatabaseService<ServiceLevelObjective> | null = null;
+
+export default class SloRecordReferenceValidator {
+  /*
+   * Created on first use rather than at module load. The service instantiates
+   * the model, and this module is reached through the service import graph
+   * before every model decorator has run.
+   */
+  public static getLookupService(): DatabaseService<ServiceLevelObjective> {
+    if (!lookupService) {
+      lookupService = new DatabaseService<ServiceLevelObjective>(
+        ServiceLevelObjective,
+      );
+    }
+
+    return lookupService;
+  }
+
+  /*
+   * The SLO ids in a `serviceLevelObjectives` payload, in the order given and
+   * each once. The value arrives in several shapes: model instances or `{_id}`
+   * objects from the API and the worker, and bare uuid strings or ObjectIDs on
+   * an update, which sanitizeCreateOrUpdate only turns into entities after the
+   * hooks have run. Entries with no id are skipped: without an id they cannot
+   * link anything.
+   */
+  public static getReferencedIds(value: unknown): Array<string> {
+    if (value === undefined || value === null) {
+      return [];
+    }
+
+    const entries: Array<unknown> = Array.isArray(value) ? value : [value];
+    const ids: Array<string> = [];
+    const seen: Set<string> = new Set<string>();
+
+    for (const entry of entries) {
+      const id: string = resolveReferenceId(entry)?.toString().trim() || "";
+
+      if (!id || seen.has(normalizeId(id))) {
+        continue;
+      }
+
+      seen.add(normalizeId(id));
+      ids.push(id);
+    }
+
+    return ids;
+  }
+
+  public static async validateServiceLevelObjectivesBelongToProject(data: {
+    projectId: ObjectID | undefined;
+    serviceLevelObjectives: unknown;
+    // Used in the error message, e.g. "incident" -> "This incident references…".
+    subject: string;
+  }): Promise<void> {
+    const ids: Array<string> = SloRecordReferenceValidator.getReferencedIds(
+      data.serviceLevelObjectives,
+    );
+
+    if (ids.length === 0) {
+      return;
+    }
+
+    if (!data.projectId) {
+      /*
+       * Same rule as ProjectScopedReferenceValidator. With no project to
+       * compare against, the check is a no-op. The create hooks always resolve
+       * one, and the update hooks fall back to the matched rows' projects.
+       */
+      return;
+    }
+
+    /*
+     * A malformed id would make Postgres reject the uuid cast and surface as
+     * an opaque 500. It cannot name an SLO in this project either, so it gets
+     * the same answer as a foreign id, without a query.
+     */
+    const lookupIds: Array<string> = ids.filter((id: string): boolean => {
+      return ObjectID.isValidUUID(id);
+    });
+
+    const foundIds: Set<string> = new Set<string>();
+
+    if (lookupIds.length > 0) {
+      const serviceLevelObjectives: Array<ServiceLevelObjective> =
+        await SloRecordReferenceValidator.getLookupService().findBy({
+          query: {
+            _id: QueryHelper.any(lookupIds),
+            // Pinned to the record's project: a foreign SLO is never read.
+            projectId: data.projectId,
+          },
+          select: {
+            _id: true,
+          },
+          limit: lookupIds.length,
+          skip: 0,
+          props: {
+            isRoot: true,
+          },
+        });
+
+      for (const serviceLevelObjective of serviceLevelObjectives) {
+        const id: string = serviceLevelObjective._id?.toString() || "";
+
+        if (id) {
+          foundIds.add(normalizeId(id));
+        }
+      }
+    }
+
+    const unknownIds: Array<string> = ids.filter((id: string): boolean => {
+      return !foundIds.has(normalizeId(id));
+    });
+
+    if (unknownIds.length === 0) {
+      return;
+    }
+
+    const described: string = unknownIds
+      .map((id: string): string => {
+        return `"${id}"`;
+      })
+      .join(", ");
+
+    throw new BadDataException(
+      `This ${data.subject} references Service Level Objectives that do not exist in this project: ${described}. Please pick SLOs from this project and try again.`,
+    );
+  }
+}

package/Server/Utils/StatusPage/MonitorRulePatternValidator.ts

@@ -1,46 +1,9 @@
-import BadDataException from "../../../Types/Exception/BadDataException";
-import RulePatternMatchUtil from "../../../Utils/Rules/RulePatternMatchUtil";
+import MonitorRulePatternValidator from "../Rules/MonitorRulePatternValidator";
 
 /*
- * Write-time validation for the monitor name / description patterns on status
- * page monitor rules.
- *
- * The rule engine accepts a case-insensitive regex or a '*' wildcard glob, the
- * same two syntaxes the network device rules take. Anything else - `api-(01`,
- * `[unclosed` - compiles to nothing and matches nothing, and the engine can
- * only log about it long after the user left the form. Reject it at the write
- * instead, exactly as NetworkDeviceRulePatternValidator does
- * (OneUptime/oneuptime#2940).
+ * Status page monitor rules validate their patterns with the validator every
+ * monitor rule shares (SLO monitor rules use the same one). This name is kept
+ * so existing imports keep resolving; the behaviour lives in
+ * Server/Utils/Rules/MonitorRulePatternValidator.
  */
-export default class StatusPageMonitorRulePatternValidator {
-  public static validate(data: {
-    namePattern?: string | null | undefined;
-    descriptionPattern?: string | null | undefined;
-  }): void {
-    StatusPageMonitorRulePatternValidator.validateOne(
-      "Monitor Name Pattern",
-      data.namePattern,
-    );
-    StatusPageMonitorRulePatternValidator.validateOne(
-      "Monitor Description Pattern",
-      data.descriptionPattern,
-    );
-  }
-
-  private static validateOne(
-    title: string,
-    pattern: string | null | undefined,
-  ): void {
-    if (!pattern) {
-      return;
-    }
-
-    if (RulePatternMatchUtil.isSupportedPattern(pattern)) {
-      return;
-    }
-
-    throw new BadDataException(
-      `${title} "${pattern}" is not a valid regular expression, and contains no '*' wildcard to fall back on, so it would never match a monitor. Use a regex such as api-.* or a wildcard such as *api*.`,
-    );
-  }
-}
+export default MonitorRulePatternValidator;

package/Server/Utils/StatusPageResource.ts

@@ -6,21 +6,66 @@ export interface GetResourcesGroupedByGroupNameOptions {
   defaultValue?: string;
 }
 
+// Groups go on their own line in HTML emails.
+export const HTML_RESOURCE_GROUP_SEPARATOR: string = "<br/>";
+
+/*
+ * SMS, Slack, Teams, email subjects and webhooks show "<br/>" as literal
+ * text, so they get every group on one line. The names inside a group are
+ * already comma-separated, which is why groups are split with a semicolon.
+ */
+export const PLAIN_TEXT_RESOURCE_GROUP_SEPARATOR: string = "; ";
+
 export default class StatusPageResourceUtil {
   /**
-   * Formats an array of StatusPageResource items into a string grouped by their resource group.
+   * Formats an array of StatusPageResource items into an HTML string grouped by their resource group.
    *
    * If resources have no group or only one resource exists without a group, returns a simple comma-separated list.
-   * If resources are grouped, returns a formatted string like:
-   * "EU: Infrastructure, Website; UK: Infrastructure, API"
+   * If resources are grouped, returns one group per line, like:
+   * "EU: Infrastructure, Website<br/>UK: Infrastructure, API"
+   *
+   * Use this only where the value is rendered as HTML (email bodies). Use
+   * getResourcesGroupedByGroupNameAsPlainText everywhere else.
    *
    * @param resources - Array of StatusPageResource items with displayName, statusPageGroupId, and optionally statusPageGroup.name
-   * @param defaultValue - Value to return if no resources (defaults to "None")
+   * @param defaultValue - Value to return if no resources (defaults to "")
    * @returns Formatted string of resources grouped by their resource group
    */
   public static getResourcesGroupedByGroupName(
     resources: Array<StatusPageResource>,
     defaultValue: string = "",
+  ): string {
+    return StatusPageResourceUtil.formatResourcesGroupedByGroupName(
+      resources,
+      defaultValue,
+      HTML_RESOURCE_GROUP_SEPARATOR,
+    );
+  }
+
+  /**
+   * The plain-text form of getResourcesGroupedByGroupName, for channels that
+   * do not render HTML. Grouped resources come back on one line, like:
+   * "EU: Infrastructure, Website; UK: Infrastructure, API"
+   *
+   * @param resources - Array of StatusPageResource items with displayName, statusPageGroupId, and optionally statusPageGroup.name
+   * @param defaultValue - Value to return if no resources (defaults to "")
+   * @returns Formatted string of resources grouped by their resource group
+   */
+  public static getResourcesGroupedByGroupNameAsPlainText(
+    resources: Array<StatusPageResource>,
+    defaultValue: string = "",
+  ): string {
+    return StatusPageResourceUtil.formatResourcesGroupedByGroupName(
+      resources,
+      defaultValue,
+      PLAIN_TEXT_RESOURCE_GROUP_SEPARATOR,
+    );
+  }
+
+  private static formatResourcesGroupedByGroupName(
+    resources: Array<StatusPageResource>,
+    defaultValue: string,
+    groupSeparator: string,
   ): string {
     if (!resources || resources.length === 0) {
       return defaultValue;
@@ -84,6 +129,6 @@ export default class StatusPageResourceUtil {
       }
     }
 
-    return formattedGroups.join("<br/>") || defaultValue;
+    return formattedGroups.join(groupSeparator) || defaultValue;
   }
 }