@oneuptime/common 13.0.6 → 13.0.8

package/Types/SecurityEvent/OcsfSeverity.ts

@@ -43,6 +43,36 @@ export function ocsfSeverityFromId(id: number): OcsfSeverity {
   return OcsfSeverity.Unknown;
 }
 
+/*
+ * Upper-cased severity text -> OCSF severity. Exported so SQL that grades
+ * stored rows (the Google SecOps severity backfill) is generated from this
+ * table instead of restating it.
+ */
+export const OCSF_SEVERITY_ALIASES: Readonly<Record<string, OcsfSeverity>> = {
+  UNKNOWN: OcsfSeverity.Unknown,
+  UNKNOWN_SEVERITY: OcsfSeverity.Unknown,
+  NONE: OcsfSeverity.Informational,
+  INFO: OcsfSeverity.Informational,
+  INFORMATION: OcsfSeverity.Informational,
+  INFORMATIONAL: OcsfSeverity.Informational,
+  NOTICE: OcsfSeverity.Informational,
+  DEBUG: OcsfSeverity.Informational,
+  LOW: OcsfSeverity.Low,
+  WARN: OcsfSeverity.Low,
+  WARNING: OcsfSeverity.Low,
+  MEDIUM: OcsfSeverity.Medium,
+  MODERATE: OcsfSeverity.Medium,
+  ERR: OcsfSeverity.Medium,
+  ERROR: OcsfSeverity.Medium,
+  HIGH: OcsfSeverity.High,
+  SEVERE: OcsfSeverity.High,
+  CRITICAL: OcsfSeverity.Critical,
+  CRIT: OcsfSeverity.Critical,
+  ALERT: OcsfSeverity.Critical,
+  FATAL: OcsfSeverity.Fatal,
+  EMERGENCY: OcsfSeverity.Fatal,
+};
+
 /*
  * Loose severity text -> OCSF severity. Accepts the dialects we ingest:
  * UDM security_result severities (EMERGENCY/ALERT/CRITICAL/ERROR/HIGH/...),
@@ -57,32 +87,7 @@ export function normalizeOcsfSeverity(text: string): OcsfSeverity | null {
     return null;
   }
 
-  const aliases: Record<string, OcsfSeverity> = {
-    UNKNOWN: OcsfSeverity.Unknown,
-    UNKNOWN_SEVERITY: OcsfSeverity.Unknown,
-    NONE: OcsfSeverity.Informational,
-    INFO: OcsfSeverity.Informational,
-    INFORMATION: OcsfSeverity.Informational,
-    INFORMATIONAL: OcsfSeverity.Informational,
-    NOTICE: OcsfSeverity.Informational,
-    DEBUG: OcsfSeverity.Informational,
-    LOW: OcsfSeverity.Low,
-    WARN: OcsfSeverity.Low,
-    WARNING: OcsfSeverity.Low,
-    MEDIUM: OcsfSeverity.Medium,
-    MODERATE: OcsfSeverity.Medium,
-    ERR: OcsfSeverity.Medium,
-    ERROR: OcsfSeverity.Medium,
-    HIGH: OcsfSeverity.High,
-    SEVERE: OcsfSeverity.High,
-    CRITICAL: OcsfSeverity.Critical,
-    CRIT: OcsfSeverity.Critical,
-    ALERT: OcsfSeverity.Critical,
-    FATAL: OcsfSeverity.Fatal,
-    EMERGENCY: OcsfSeverity.Fatal,
-  };
-
-  return aliases[normalized] || null;
+  return OCSF_SEVERITY_ALIASES[normalized] || null;
 }
 
 export default OcsfSeverity;

package/Types/SecurityEvent/SigmaRule.ts

@@ -1,5 +1,6 @@
 import Dictionary from "../Dictionary";
 import { JSONValue } from "../JSON";
+import OcsfSeverity from "./OcsfSeverity";
 
 /*
  * Typed representation of a parsed Sigma rule — the subset OneUptime's
@@ -17,6 +18,56 @@ export enum SigmaLevel {
   Critical = "critical",
 }
 
+/*
+ * The level a rule gets when its YAML has no `level:` or one outside the
+ * enum above. The parser applies it; the dashboard's rule guide states it.
+ */
+export const SIGMA_DEFAULT_LEVEL: SigmaLevel = SigmaLevel.Medium;
+
+/*
+ * Sigma level -> OCSF severity stamped on a rule's Detection Finding rows.
+ * Lives here rather than in the evaluator so the dashboard's rule guide
+ * renders its severity table from the same map the engine writes with.
+ */
+export const SIGMA_LEVEL_TO_OCSF_SEVERITY: Record<SigmaLevel, OcsfSeverity> = {
+  [SigmaLevel.Informational]: OcsfSeverity.Informational,
+  [SigmaLevel.Low]: OcsfSeverity.Low,
+  [SigmaLevel.Medium]: OcsfSeverity.Medium,
+  [SigmaLevel.High]: OcsfSeverity.High,
+  [SigmaLevel.Critical]: OcsfSeverity.Critical,
+};
+
+/*
+ * Levels that rank onto a project's MOST severe alert/incident severity
+ * when no severity is set on the rule and none is named after the level;
+ * every other level ranks onto the least severe.
+ */
+export function isSevereSigmaLevel(level: SigmaLevel): boolean {
+  return level === SigmaLevel.Critical || level === SigmaLevel.High;
+}
+
+/*
+ * Field modifiers (`field|modifier: value`) the parser accepts. Anything
+ * else is rejected at save time — listed here so the dashboard's rule
+ * guide cannot advertise a modifier the parser refuses, or miss one it
+ * takes.
+ */
+export const SIGMA_SUPPORTED_MODIFIERS: ReadonlyArray<string> = [
+  "contains",
+  "startswith",
+  "endswith",
+  "all",
+  "re",
+  "cased",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "cidr",
+  "exists",
+  "windash",
+];
+
 /*
  * One `field|modifier: value` requirement inside a selection map. `values`
  * always has at least one entry; multiple entries are OR-ed (AND-ed when

package/Types/SecurityEvent/ThreatIntelConstants.ts

@@ -105,6 +105,24 @@ export function ocsfSeverityForConfidence(confidence: number): OcsfSeverity {
 export const THREAT_INTEL_MINIMUM_CONFIDENCE_MIN: number = 0;
 export const THREAT_INTEL_MINIMUM_CONFIDENCE_MAX: number = 100;
 
+/*
+ * Save-time bounds and default for ThreatIntelFeed.pollIntervalInMinutes —
+ * shared by the server validator, the poller's fallback and the dashboard
+ * form, so the three cannot drift apart.
+ */
+export const THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES: number = 1;
+export const THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES: number = 1440;
+export const THREAT_INTEL_DEFAULT_POLL_INTERVAL_IN_MINUTES: number = 60;
+
+// Cap on one match evaluation's scan, whatever lastEvaluatedAt says.
+export const THREAT_INTEL_MATCH_MAX_LOOKBACK_IN_MINUTES: number = 24 * 60;
+
+// First-ever match evaluation window for a feed.
+export const THREAT_INTEL_FIRST_MATCH_WINDOW_IN_MINUTES: number = 15;
+
+// One alert per distinct indicator value per cycle, at most.
+export const THREAT_INTEL_MAX_INDICATORS_PER_EVALUATION: number = 100;
+
 /*
  * Indicators whose STIX object carries no valid_until stay active this
  * long after valid_from. STIX says "valid until revoked"; unbounded

package/Types/WebsiteRequest.ts

@@ -122,6 +122,7 @@ export default class WebsiteRequest {
               options.limitRedirectResponseBody || false,
             isHeadResponse: responseIsForHeadRequest,
             maximumResponseBytes: options.maximumResponseBytes,
+            signal: options.signal,
           }),
         );
       }
@@ -147,6 +148,7 @@ export default class WebsiteRequest {
           limitRedirectResponseBody: options.limitRedirectResponseBody || false,
           isHeadResponse: responseIsForHeadRequest,
           maximumResponseBytes: options.maximumResponseBytes,
+          signal: options.signal,
         }),
       );
     }

package/UI/Components/AttachmentList/EventAttachmentList.tsx

@@ -1,3 +1,4 @@
+import { handleAuthenticatedLinkClick } from "../../Utils/OpenAuthenticatedUrl";
 import React, { FunctionComponent, ReactElement } from "react";
 
 export interface EventAttachment {
@@ -12,6 +13,14 @@ export interface EventAttachmentListProps {
   showHeader?: boolean;
   showCount?: boolean;
   className?: string;
+  /*
+   * Set when the download URLs are behind a session that can lapse while the
+   * page is open (a private status page). A click then refreshes the session
+   * before the new tab loads the file, so a reader who has had the page open
+   * past the access token's lifetime gets the attachment, not a 401. Left
+   * unset, the cards are plain links.
+   */
+  refreshSession?: (() => Promise<boolean>) | undefined;
 }
 
 function getAttachmentExtensionLabel(fileName?: string | null): string | null {
@@ -31,12 +40,13 @@ function getAttachmentExtensionLabel(fileName?: string | null): string | null {
 
 type AttachmentCardProps = {
   attachment: EventAttachment;
+  refreshSession?: (() => Promise<boolean>) | undefined;
 };
 
 const AttachmentCard: FunctionComponent<AttachmentCardProps> = (
   props: AttachmentCardProps,
 ): ReactElement => {
-  const { attachment } = props;
+  const { attachment, refreshSession } = props;
   const extensionLabel: string | null = getAttachmentExtensionLabel(
     attachment.name,
   );
@@ -47,6 +57,17 @@ const AttachmentCard: FunctionComponent<AttachmentCardProps> = (
         href={attachment.downloadUrl}
         target="_blank"
         rel="noopener noreferrer"
+        onClick={
+          refreshSession
+            ? (event: React.MouseEvent<HTMLAnchorElement>): void => {
+                handleAuthenticatedLinkClick(
+                  event,
+                  attachment.downloadUrl,
+                  refreshSession,
+                );
+              }
+            : undefined
+        }
         title={attachment.name}
         className="group flex items-center justify-between gap-3 rounded-lg border border-gray-200 bg-white px-3 py-2 text-sm text-gray-900 transition hover:border-gray-300 hover:bg-gray-50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-gray-200"
       >
@@ -81,6 +102,7 @@ const EventAttachmentList: FunctionComponent<EventAttachmentListProps> = (
     showHeader = true,
     showCount = true,
     className = "",
+    refreshSession,
   } = props;
 
   if (!attachments || attachments.length === 0) {
@@ -90,7 +112,13 @@ const EventAttachmentList: FunctionComponent<EventAttachmentListProps> = (
   const attachmentsList: ReactElement = (
     <ul className="space-y-2">
       {attachments.map((attachment: EventAttachment, index: number) => {
-        return <AttachmentCard attachment={attachment} key={index} />;
+        return (
+          <AttachmentCard
+            attachment={attachment}
+            refreshSession={refreshSession}
+            key={index}
+          />
+        );
       })}
     </ul>
   );

package/UI/Components/Dashboard/DashboardVariableControl.tsx

@@ -193,8 +193,16 @@ const DashboardVariableControl: FunctionComponent<ComponentProps> = (
       });
   const selectedValue: string =
     variable.selectedValue ?? variable.defaultValue ?? "";
+  /*
+   * With no option for its value the browser would show "All", while
+   * VariableInterpolation still filters every widget by that value. A project
+   * label can be deleted or disallowed. A telemetry attribute only lists the
+   * first 100 values seen in the last day, and its default is free text, so
+   * its value can be missing from the list and still match data. Skipped
+   * while those values load: the select reads "Loading…" until they arrive.
+   */
   const isUnavailableSelection: boolean = Boolean(
-    isProjectLabel &&
+    (isProjectLabel || (isTelemetryAttribute && !props.isLoadingOptions)) &&
       selectedValue &&
       !options.some((option: DashboardVariableOption) => {
         return option.value === selectedValue;
@@ -253,7 +261,9 @@ const DashboardVariableControl: FunctionComponent<ComponentProps> = (
             {props.isLoadingOptions ? "Loading…" : "All"}
           </option>
           {isUnavailableSelection && (
-            <option value={selectedValue}>Unavailable label</option>
+            <option value={selectedValue}>
+              {isProjectLabel ? "Unavailable label" : selectedValue}
+            </option>
           )}
           {options.map((option: DashboardVariableOption) => {
             return (

package/UI/Components/Dropdown/Dropdown.tsx

@@ -569,13 +569,18 @@ const Dropdown: FunctionComponent<ComponentProps> = (
       return;
     }
 
+    // Uncontrolled selections belong to this component, even if options refresh.
+    if (!("value" in props)) {
+      return;
+    }
+
     const value: DropdownOption | Array<DropdownOption> | undefined =
       getDropdownOptionFromValue(
         props.value === null ? undefined : props.value,
       );
 
     setValue(value);
-  }, [props.value]);
+  }, [props.value, props.options]);
 
   const menuPortalTarget: HTMLElement | null =
     typeof document === "undefined" ? null : document.body;

package/UI/Components/EditionLabel/EditionLabel.tsx

@@ -38,13 +38,15 @@ export interface ComponentProps {
 const ENTERPRISE_URL: string = "https://oneuptime.com/enterprise/demo";
 
 /*
- * Linked only for major upgrades. Points at GitHub rather than the docs site
- * on this installation, because the guide for the version you are moving TO is
- * the one you need, and this installation only ships the guide for the version
- * it is already running.
+ * Linked only for major upgrades. Points at the oneuptime.com docs rather than
+ * the docs site on this installation, because the guide for the version you are
+ * moving TO is the one you need, and this installation only ships the guide for
+ * the version it is already running. The oneuptime.com docs always carry the
+ * latest release, and unlike a GitHub file link this URL does not break when
+ * the docs move in the repository.
  */
 const UPGRADE_GUIDE_URL: string =
-  "https://github.com/OneUptime/oneuptime/blob/master/App/FeatureSet/Docs/Content/en/installation/upgrading.md";
+  "https://oneuptime.com/docs/installation/upgrading";
 const SALES_EMAIL: string = "sales@oneuptime.com";
 const SALES_MAILTO_URL: string = "mailto:sales@oneuptime.com";
 
@@ -238,6 +240,18 @@ const EditionLabel: FunctionComponent<ComponentProps> = (
           new Route("/global-config/license"),
         );
 
+        /*
+         * The route also serves the login page, so on its own it answers a
+         * caller with no session with the reduced anonymous payload and a 200.
+         * Inside a signed-in app that caller is us with an expired session,
+         * and the reduced payload reads as "no license, no instances". Saying
+         * we expect to be signed in makes the server answer 401 instead,
+         * which the API client refreshes and replays.
+         */
+        if (UserUtil.isLoggedIn()) {
+          licenseUrl.addQueryParam("signedIn", "true");
+        }
+
         const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
           await API.fetch<JSONObject>({
             method: HTTPMethod.GET,

package/UI/Components/EventItem/EventItem.tsx

@@ -58,6 +58,11 @@ export interface ComponentProps {
   eventSecondDescription: string;
   labels?: Array<EventItemLabel> | undefined;
   eventAttachments?: Array<TimelineAttachment> | undefined;
+  /*
+   * Handed to every EventAttachmentList this item renders: the event's own
+   * attachments and each timeline note's. See EventAttachmentList.
+   */
+  attachmentRefreshSession?: (() => Promise<boolean>) | undefined;
 }
 
 const EventItem: FunctionComponent<ComponentProps> = (
@@ -116,7 +121,10 @@ const EventItem: FunctionComponent<ComponentProps> = (
         )}
 
         {props.eventAttachments && props.eventAttachments.length > 0 && (
-          <EventAttachmentList attachments={props.eventAttachments} />
+          <EventAttachmentList
+            attachments={props.eventAttachments}
+            refreshSession={props.attachmentRefreshSession}
+          />
         )}
 
         {props.eventSecondDescription && (
@@ -320,6 +328,9 @@ const EventItem: FunctionComponent<ComponentProps> = (
                                 item.attachments.length > 0 && (
                                   <EventAttachmentList
                                     attachments={item.attachments}
+                                    refreshSession={
+                                      props.attachmentRefreshSession
+                                    }
                                     variant="inline"
                                     showHeader={false}
                                     showCount={false}