@oneuptime/common 13.0.6 → 13.0.8

package/Server/Services/RumApplicationOwnerRuleEngineService.ts

@@ -235,11 +235,15 @@ class RumApplicationOwnerRuleEngineServiceClass
         owner.projectId = rumApplication.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await RumApplicationOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: RumApplicationOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -248,11 +252,15 @@ class RumApplicationOwnerRuleEngineServiceClass
         owner.projectId = rumApplication.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await RumApplicationOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: RumApplicationOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/RumSessionPinService.ts

@@ -1,10 +1,17 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/RumSessionPin";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
+import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import CreateBy from "../Types/Database/CreateBy";
 import { OnCreate } from "../Types/Database/Hooks";
+import CreatePermission from "../Types/Database/Permissions/CreatePermission";
+import ReadPermission from "../Types/Database/Permissions/ReadPermission";
+import TablePermission from "../Types/Database/Permissions/TablePermission";
 import QueryHelper from "../Types/Database/QueryHelper";
 import PostgresErrorTranslator from "../Utils/Database/PostgresErrorTranslator";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -24,6 +31,62 @@ const isUniqueViolation: IsUniqueViolationFunction = (
   return PostgresErrorTranslator.isUniqueViolation(error);
 };
 
+/* What the unique index keys a pin on. */
+interface PinKey {
+  projectId: ObjectID;
+  rumApplicationId: ObjectID;
+  sessionId: string;
+}
+
+type IsSameIdFunction = (a: ObjectID, b: ObjectID) => boolean;
+
+/*
+ * ObjectID.equals compares the strings as given, but a UUID is the same
+ * project in any case - and the tenant an API key resolves to comes back
+ * from Postgres in lower case whatever the client typed.
+ */
+const isSameId: IsSameIdFunction = (a: ObjectID, b: ObjectID): boolean => {
+  return a.toString().toLowerCase() === b.toString().toLowerCase();
+};
+
+type ToPlainIdFunction = (
+  value: unknown,
+  field: string,
+) => ObjectID | undefined;
+
+/*
+ * An id from the request body as a plain ObjectID. The body is deserialized
+ * generically, so a field typed as an id can arrive as some other object.
+ */
+const toPlainId: ToPlainIdFunction = (
+  value: unknown,
+  field: string,
+): ObjectID | undefined => {
+  if (value === undefined || value === null) {
+    return undefined;
+  }
+
+  if (value instanceof ObjectID || typeof value === "string") {
+    const id: string = value.toString();
+
+    if (ObjectID.isValidUUID(id)) {
+      return new ObjectID(id);
+    }
+  }
+
+  throw new BadDataException(`${field} must be an ID.`);
+};
+
+type IsInternalCallerFunction = (
+  props: DatabaseCommonInteractionProps,
+) => boolean;
+
+const isInternalCaller: IsInternalCallerFunction = (
+  props: DatabaseCommonInteractionProps,
+): boolean => {
+  return Boolean(props.isRoot || props.isMasterAdmin);
+};
+
 /*
  * Pins that keep a session recording past its retention window.
  *
@@ -88,27 +151,36 @@ export class Service extends DatabaseService<Model> {
    *
    * The pre-check handles the common case and the catch closes the race
    * between two concurrent pins of the same session.
+   *
+   * Both lookups read as root, so neither may run until the caller has
+   * passed the create check that super.create would otherwise have been the
+   * first to apply, and what they find is handed back only as far as the
+   * caller could have read it.
    */
   @CaptureSpan()
   public override async create(createBy: CreateBy<Model>): Promise<Model> {
-    const projectId: ObjectID | undefined = createBy.data.projectId;
-    const rumApplicationId: ObjectID | undefined =
-      createBy.data.rumApplicationId;
-    const sessionId: string | undefined = createBy.data.sessionId;
+    this.assertCallerMayCreatePins(createBy.props);
 
-    if (!projectId || !rumApplicationId || !sessionId) {
+    if (!isInternalCaller(createBy.props)) {
+      /* The database keeps these for itself; a request does not set them. */
+      delete createBy.data._id;
+      delete createBy.data.createdAt;
+      delete createBy.data.updatedAt;
+      delete createBy.data.deletedAt;
+      delete createBy.data.version;
+    }
+
+    const pinKey: PinKey | null = this.resolvePinKey(createBy);
+
+    if (!pinKey) {
       /* Let onBeforeCreate produce the specific validation message. */
       return await super.create(createBy);
     }
 
-    const existingPin: Model | null = await this.getPinForSession({
-      projectId: projectId,
-      rumApplicationId: rumApplicationId,
-      sessionId: sessionId,
-    });
+    const existingPin: Model | null = await this.getPinForSession(pinKey);
 
     if (existingPin) {
-      return existingPin;
+      return await this.presentExistingPin(existingPin, pinKey, createBy.props);
     }
 
     try {
@@ -118,27 +190,204 @@ export class Service extends DatabaseService<Model> {
         throw err;
       }
 
-      const racedPin: Model | null = await this.getPinForSession({
-        projectId: projectId,
-        rumApplicationId: rumApplicationId,
-        sessionId: sessionId,
-      });
+      const racedPin: Model | null = await this.getPinForSession(pinKey);
 
       if (racedPin) {
-        return racedPin;
+        return await this.presentExistingPin(racedPin, pinKey, createBy.props);
+      }
+
+      throw err;
+    }
+  }
+
+  /*
+   * The table half of ModelPermission.checkCreatePermissions: signed in or
+   * holding an API key, and granted something on the model's create list in
+   * the tenant. The column half stays with super.create, which runs it after
+   * onBeforeCreate has stripped the fields it rewrites; the idempotent path
+   * writes no columns for it to judge.
+   */
+  private assertCallerMayCreatePins(
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    if (isInternalCaller(props)) {
+      return;
+    }
+
+    CreatePermission.checkCreateBlockPermissions(Model, props);
+
+    TablePermission.checkTableLevelPermissions(
+      Model,
+      props,
+      DatabaseRequestType.Create,
+    );
+  }
+
+  /*
+   * The (projectId, rumApplicationId, sessionId) this request would insert,
+   * which is therefore what both lookups must search - or null when a part
+   * is missing, so that onBeforeCreate can say which. The lookups are
+   * queries, so every part has to be a plain id or string.
+   *
+   * projectId is the one super.create will write: the caller's tenant when
+   * there is one, otherwise the projectId an internal caller passed. A
+   * request naming any other project is refused, because the caller's
+   * grants were checked in the tenant and nowhere else; internal callers
+   * keep DatabaseService's rule that the tenant replaces it.
+   *
+   * The project and the application can also be named through the `project`
+   * and `rumApplication` relations. Each shares its scalar's column and wins
+   * over it when TypeORM saves, so a relation that disagrees is refused and
+   * both are dropped, leaving the scalars as the only thing saved.
+   */
+  private resolvePinKey(createBy: CreateBy<Model>): PinKey | null {
+    const props: DatabaseCommonInteractionProps = createBy.props;
+    const isInternal: boolean = isInternalCaller(props);
+
+    const claimedProjectId: ObjectID | undefined = toPlainId(
+      createBy.data.projectId,
+      "projectId",
+    );
+    const rumApplicationId: ObjectID | undefined = toPlainId(
+      createBy.data.rumApplicationId,
+      "rumApplicationId",
+    );
+
+    const rawSessionId: unknown = createBy.data.sessionId;
+
+    if (
+      rawSessionId !== undefined &&
+      rawSessionId !== null &&
+      typeof rawSessionId !== "string"
+    ) {
+      throw new BadDataException("sessionId must be a string.");
+    }
+
+    const sessionId: string | undefined =
+      typeof rawSessionId === "string" ? rawSessionId : undefined;
+
+    const projectRelationId: ObjectID | undefined = toPlainId(
+      createBy.data.project?._id,
+      "project",
+    );
+    const applicationRelationId: ObjectID | undefined = toPlainId(
+      createBy.data.rumApplication?._id,
+      "rumApplication",
+    );
+
+    delete createBy.data.project;
+    delete createBy.data.rumApplication;
+
+    const projectId: ObjectID | undefined = isInternal
+      ? props.tenantId || claimedProjectId
+      : props.tenantId;
+
+    const projectClaims: Array<ObjectID> = [];
+
+    if (projectRelationId) {
+      projectClaims.push(projectRelationId);
+    }
+
+    if (claimedProjectId && !isInternal) {
+      projectClaims.push(claimedProjectId);
+    }
+
+    for (const projectClaim of projectClaims) {
+      if (!projectId || !isSameId(projectClaim, projectId)) {
+        throw isInternal
+          ? new BadDataException("project does not match projectId.")
+          : new NotAuthorizedException(
+              "You are not authorized to pin recordings in this project.",
+            );
+      }
+    }
+
+    if (
+      applicationRelationId &&
+      !(rumApplicationId && isSameId(applicationRelationId, rumApplicationId))
+    ) {
+      throw new BadDataException(
+        "rumApplication does not match rumApplicationId.",
+      );
+    }
+
+    if (!claimedProjectId || !projectId || !rumApplicationId || !sessionId) {
+      return null;
+    }
+
+    createBy.data.projectId = projectId;
+    createBy.data.rumApplicationId = rumApplicationId;
+
+    return {
+      projectId: projectId,
+      rumApplicationId: rumApplicationId,
+      sessionId: sessionId,
+    };
+  }
+
+  /*
+   * An existing pin was read as root, and passing the create check says
+   * nothing about reading it: CreateRumSessionReplay, the ingest grant, is
+   * on the create list but not the read list, and a team can block reads
+   * alone. Such a caller learns that the recording is pinned, which is all
+   * pinning it again needs, and nothing that somebody else wrote on the pin.
+   */
+  private async presentExistingPin(
+    pin: Model,
+    pinKey: PinKey,
+    props: DatabaseCommonInteractionProps,
+  ): Promise<Model> {
+    if (await this.callerMayReadPins(props)) {
+      return pin;
+    }
+
+    /*
+     * Not even the pin's id: it is what the update and delete endpoints
+     * take, and this caller could not have listed it.
+     */
+    const acknowledgement: Model = new Model();
+    acknowledgement.projectId = pinKey.projectId;
+    acknowledgement.rumApplicationId = pinKey.rumApplicationId;
+    acknowledgement.sessionId = pinKey.sessionId;
+
+    return acknowledgement;
+  }
+
+  /*
+   * The gates a read of this table applies, answered instead of thrown: the
+   * read block list (label-scoped blocks included, which this model cannot
+   * narrow to rows and so refuses outright) and the read list itself. Any
+   * refusal, whatever its type, means the caller does not get the pin.
+   */
+  private async callerMayReadPins(
+    props: DatabaseCommonInteractionProps,
+  ): Promise<boolean> {
+    if (isInternalCaller(props)) {
+      return true;
+    }
+
+    try {
+      await ReadPermission.checkReadBlockPermission(Model, {}, props);
+
+      TablePermission.checkTableLevelPermissions(
+        Model,
+        props,
+        DatabaseRequestType.Read,
+      );
+    } catch (err) {
+      if (err instanceof Exception) {
+        return false;
       }
 
       throw err;
     }
+
+    return true;
   }
 
   /* Null when the recording is not pinned. */
   @CaptureSpan()
-  public async getPinForSession(data: {
-    projectId: ObjectID;
-    rumApplicationId: ObjectID;
-    sessionId: string;
-  }): Promise<Model | null> {
+  public async getPinForSession(data: PinKey): Promise<Model | null> {
     return await this.findOneBy({
       query: {
         projectId: data.projectId,
@@ -147,6 +396,9 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         _id: true,
+        projectId: true,
+        rumApplicationId: true,
+        sessionId: true,
         reason: true,
         incidentId: true,
         alertId: true,

package/Server/Services/RunbookOwnerRuleEngineService.ts

@@ -246,11 +246,15 @@ class RunbookOwnerRuleEngineServiceClass
         owner.projectId = runbook.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await RunbookOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: RunbookOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -259,11 +263,15 @@ class RunbookOwnerRuleEngineServiceClass
         owner.projectId = runbook.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await RunbookOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: RunbookOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/ScheduledMaintenanceService.ts

@@ -23,7 +23,6 @@ import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
-import Typeof from "../../Types/Typeof";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import Model from "../../Models/DatabaseModels/ScheduledMaintenance";
@@ -75,6 +74,7 @@ import NotificationRuleWorkspaceChannel from "../../Types/Workspace/Notification
 import { MessageBlocksByWorkspaceType } from "./WorkspaceNotificationRuleService";
 import ScheduledMaintenanceWorkspaceMessages from "../Utils/Workspace/WorkspaceMessages/ScheduledMaintenance";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import ProjectService from "./ProjectService";
 import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
@@ -1447,39 +1447,18 @@ ${scheduledMaintenance.description || "No description provided."}
     notifyOwners: boolean,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: ScheduledMaintenanceOwnerTeam =
-        new ScheduledMaintenanceOwnerTeam();
-      teamOwner.scheduledMaintenanceId = scheduledMaintenanceId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-
-      await ScheduledMaintenanceOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: ScheduledMaintenanceOwnerUser =
-        new ScheduledMaintenanceOwnerUser();
-      teamOwner.scheduledMaintenanceId = scheduledMaintenanceId;
-      teamOwner.projectId = projectId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-      teamOwner.userId = userId;
-      await ScheduledMaintenanceOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the event are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: ScheduledMaintenanceOwnerUserService,
+      ownerTeamService: ScheduledMaintenanceOwnerTeamService,
+      resourceIdColumn: "scheduledMaintenanceId",
+      resourceId: scheduledMaintenanceId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      isOwnerNotified: !notifyOwners,
+      props: props,
+    });
   }
 
   @CaptureSpan()

package/Server/Services/ScheduledMaintenanceTemplateService.ts

@@ -4,7 +4,6 @@ import ScheduledMaintenanceTemplateOwnerTeamService from "./ScheduledMaintenance
 import ScheduledMaintenanceTemplateOwnerUserService from "./ScheduledMaintenanceTemplateOwnerUserService";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
-import Typeof from "../../Types/Typeof";
 import Model from "../../Models/DatabaseModels/ScheduledMaintenanceTemplate";
 import MonitorStatusService from "./MonitorStatusService";
 import Dictionary from "../../Types/Dictionary";
@@ -12,8 +11,6 @@ import ProjectScopedReferenceValidator, {
   ProjectScopedReference,
   resolveReferenceId,
 } from "../Utils/Database/ProjectScopedReferenceValidator";
-import ScheduledMaintenanceTemplateOwnerTeam from "../../Models/DatabaseModels/ScheduledMaintenanceTemplateOwnerTeam";
-import ScheduledMaintenanceTemplateOwnerUser from "../../Models/DatabaseModels/ScheduledMaintenanceTemplateOwnerUser";
 import CreateBy from "../Types/Database/CreateBy";
 import OneUptimeDate from "../../Types/Date";
 import Recurring from "../../Types/Events/Recurring";
@@ -22,6 +19,7 @@ import QueryDeepPartialEntity from "../../Types/Database/PartialEntity";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -385,37 +383,17 @@ export class Service extends DatabaseService<Model> {
     teamIds: Array<ObjectID>,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: ScheduledMaintenanceTemplateOwnerTeam =
-        new ScheduledMaintenanceTemplateOwnerTeam();
-      teamOwner.scheduledMaintenanceTemplateId = scheduledMaintenanceTemplateId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-
-      await ScheduledMaintenanceTemplateOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: ScheduledMaintenanceTemplateOwnerUser =
-        new ScheduledMaintenanceTemplateOwnerUser();
-      teamOwner.scheduledMaintenanceTemplateId = scheduledMaintenanceTemplateId;
-      teamOwner.projectId = projectId;
-      teamOwner.userId = userId;
-      await ScheduledMaintenanceTemplateOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the template are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: ScheduledMaintenanceTemplateOwnerUserService,
+      ownerTeamService: ScheduledMaintenanceTemplateOwnerTeamService,
+      resourceIdColumn: "scheduledMaintenanceTemplateId",
+      resourceId: scheduledMaintenanceTemplateId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      props: props,
+    });
   }
 }
 export default new Service();

package/Server/Services/ServerlessFunctionOwnerRuleEngineService.ts

@@ -240,11 +240,15 @@ class ServerlessFunctionOwnerRuleEngineServiceClass
         owner.projectId = serverlessFunction.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await ServerlessFunctionOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: ServerlessFunctionOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -254,11 +258,15 @@ class ServerlessFunctionOwnerRuleEngineServiceClass
         owner.projectId = serverlessFunction.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await ServerlessFunctionOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: ServerlessFunctionOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/ServiceOwnerRuleEngineService.ts

@@ -249,11 +249,15 @@ class ServiceOwnerRuleEngineServiceClass
         owner.serviceId = service.id;
         owner.projectId = service.projectId;
         owner.userId = new ObjectID(userId);
-        await ServiceOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: ServiceOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -261,11 +265,15 @@ class ServiceOwnerRuleEngineServiceClass
         owner.serviceId = service.id;
         owner.projectId = service.projectId;
         owner.teamId = new ObjectID(teamId);
-        await ServiceOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: ServiceOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }