@oneuptime/common 13.0.6 → 13.0.8

package/UI/Utils/Realtime.ts

@@ -1,4 +1,5 @@
 import { HOST, HTTP_PROTOCOL } from "../Config";
+import API from "./API/API";
 import AnalyticsBaseModel from "../../Models/AnalyticsModels/AnalyticsBaseModel/AnalyticsBaseModel";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import { RealtimeRoute } from "../../ServiceRoute";
@@ -21,14 +22,55 @@ export interface ListenToModelEvent<
   modelId?: ObjectID | undefined;
 }
 
+/*
+ * One subscription a caller holds: what the server has to be asked for (again
+ * after every reconnect) and the handler listening on its room.
+ */
+interface RealtimeSubscription {
+  request: ListenToModelEventJSON;
+  roomId: string;
+  handler: (data: JSONObject) => void;
+}
+
 export default abstract class Realtime {
+  /*
+   * The least time between two refresh-and-reconnects. A reconnect with a
+   * freshly refreshed session that the server still refuses (a cookie that
+   * does not reach the socket, say) must not turn into a reconnect loop; the
+   * next refusal after this long tries again. Far shorter than the 15-minute
+   * access token, so a session that genuinely expires again is still renewed.
+   */
+  public static readonly AUTHENTICATION_RECOVERY_COOLDOWN_IN_MS: number =
+    60 * 1000;
+
   private static socket: Socket;
 
+  /*
+   * Every subscription still wanted, by identity: two callers asking for the
+   * same room are two entries, and each one's stop function removes only its
+   * own. The server forgets a socket's rooms when the connection drops, so
+   * this is what gets re-sent on every (re)connect.
+   */
+  private static subscriptions: Set<RealtimeSubscription> = new Set();
+
+  private static isRecoveringAuthentication: boolean = false;
+
+  private static lastAuthenticationRecoveryAt: number | null = null;
+
   public static init(): void {
     const socket: Socket = SocketIO(new URL(HTTP_PROTOCOL, HOST).toString(), {
       path: RealtimeRoute.toString(),
     });
 
+    // Initial connect and every reconnect: the new connection is in no rooms.
+    socket.on("connect", (): void => {
+      this.resubscribeAll();
+    });
+
+    socket.on(EventName.AuthenticationRequired, (): void => {
+      this.onAuthenticationRequired();
+    });
+
     this.socket = socket;
   }
 
@@ -55,27 +97,22 @@ export default abstract class Realtime {
       tenantId: listenToModelEvent.tenantId.toString(),
     };
 
-    this.emit(EventName.ListenToModalEvent, listenToModelEventJSON as any);
-
     const roomId: string = RealtimeUtil.getRoomId(
       listenToModelEvent.tenantId,
       listenToModelEvent.modelType.name,
       listenToModelEvent.eventType,
     );
 
-    this.socket.on(roomId, (data: JSONObject) => {
-      const id: ObjectID = ObjectID.fromString(
-        data["modelId"]?.toString() as string,
-      );
-      onEvent(id);
-    });
-
-    // Stop listening to the event.
-    const stopListening: () => void = (): void => {
-      this.socket.off(roomId);
-    };
-
-    return stopListening;
+    return this.subscribe(
+      listenToModelEventJSON,
+      roomId,
+      (data: JSONObject): void => {
+        const id: ObjectID = ObjectID.fromString(
+          data["modelId"]?.toString() as string,
+        );
+        onEvent(id);
+      },
+    );
   }
 
   public static listenToAnalyticsModelEvent<Model extends AnalyticsBaseModel>(
@@ -93,8 +130,6 @@ export default abstract class Realtime {
       tenantId: listenToModelEvent.tenantId.toString(),
     };
 
-    this.emit(EventName.ListenToModalEvent, listenToModelEventJSON as any);
-
     let roomId: string = RealtimeUtil.getRoomId(
       listenToModelEvent.tenantId,
       listenToModelEvent.modelType.name,
@@ -110,28 +145,139 @@ export default abstract class Realtime {
       );
     }
 
-    this.socket.on(roomId, (model: JSONObject) => {
-      onEvent(
-        AnalyticsBaseModel.fromJSON(
-          model,
-          listenToModelEvent.modelType,
-        ) as Model,
-      );
-    });
+    return this.subscribe(
+      listenToModelEventJSON,
+      roomId,
+      (model: JSONObject): void => {
+        onEvent(
+          AnalyticsBaseModel.fromJSON(
+            model,
+            listenToModelEvent.modelType,
+          ) as Model,
+        );
+      },
+    );
+  }
+
+  public static emit(eventName: string, data: JSONObject): void {
+    if (!this.socket) {
+      this.init();
+    }
+
+    this.socket.emit(eventName, data);
+  }
+
+  private static subscribe(
+    request: ListenToModelEventJSON,
+    roomId: string,
+    handler: (data: JSONObject) => void,
+  ): () => void {
+    const subscription: RealtimeSubscription = {
+      request: request,
+      roomId: roomId,
+      handler: handler,
+    };
+
+    this.subscriptions.add(subscription);
+
+    this.socket.on(roomId, handler);
+
+    /*
+     * Not connected yet (or between a disconnect and a reconnect): the
+     * 'connect' handler sends every registered subscription, this one
+     * included. Emitting now as well would have socket.io buffer this one and
+     * send it a second time on connect.
+     */
+    if (this.socket.connected) {
+      this.socket.emit(EventName.ListenToModalEvent, request);
+    }
 
     // Stop listening to the event.
     const stopListening: () => void = (): void => {
-      this.socket.off(roomId);
+      this.subscriptions.delete(subscription);
+
+      /*
+       * Only this subscription's handler. Removing every listener on the room
+       * would also silence any other subscription to the same room.
+       */
+      this.socket.off(roomId, handler);
     };
 
     return stopListening;
   }
 
-  public static emit(eventName: string, data: JSONObject): void {
-    if (!this.socket) {
-      this.init();
+  private static resubscribeAll(): void {
+    // The server's join is idempotent, so identical requests go once.
+    const sentRequests: Set<string> = new Set();
+
+    for (const subscription of this.subscriptions) {
+      const requestKey: string = JSON.stringify(subscription.request);
+
+      if (sentRequests.has(requestKey)) {
+        continue;
+      }
+
+      sentRequests.add(requestKey);
+
+      this.socket.emit(EventName.ListenToModalEvent, subscription.request);
     }
+  }
 
-    this.socket.emit(eventName, data);
+  /*
+   * The server refused a subscription because this socket's handshake carries
+   * no access token, or an expired one. The cookie is read once, when the
+   * socket connects, so an HTTP request refreshing the session does nothing
+   * for the socket: refresh (or reuse a refresh another request or tab just
+   * did), then reconnect so the new handshake carries the new cookie. The
+   * reconnect's 'connect' re-sends every subscription, including the refused
+   * one.
+   *
+   * A burst of refusals (a page subscribing to several rooms at once) is one
+   * recovery: the first starts it, the rest arrive while it is in flight or
+   * inside the cool-down.
+   */
+  private static onAuthenticationRequired(): void {
+    if (this.isRecoveringAuthentication) {
+      return;
+    }
+
+    if (
+      this.lastAuthenticationRecoveryAt !== null &&
+      Date.now() - this.lastAuthenticationRecoveryAt <
+        this.AUTHENTICATION_RECOVERY_COOLDOWN_IN_MS
+    ) {
+      return;
+    }
+
+    this.isRecoveringAuthentication = true;
+    this.lastAuthenticationRecoveryAt = Date.now();
+
+    this.recoverAuthentication().catch(() => {
+      // recoverAuthentication settles every outcome itself.
+    });
+  }
+
+  private static async recoverAuthentication(): Promise<void> {
+    try {
+      /*
+       * Without a new cookie a reconnect would only be refused again. When
+       * the refresh failed because the session is over, the refresh request
+       * has already sent the user to the login page.
+       */
+      const refreshed: boolean = await API.refreshSession();
+
+      if (!refreshed) {
+        return;
+      }
+
+      this.socket.disconnect();
+      this.socket.connect();
+    } catch {
+      // A refresh that could not complete (offline, say) did not happen.
+    } finally {
+      this.isRecoveringAuthentication = false;
+      // The cool-down runs from the end of the attempt, however long it took.
+      this.lastAuthenticationRecoveryAt = Date.now();
+    }
   }
 }

package/UI/esbuild-config.js

@@ -11,7 +11,7 @@ const dotenv = require("dotenv");
 function createRefractorCompatibilityPlugin() {
   const candidateRoots = [
     path.resolve(__dirname, "../node_modules/refractor"),
-    path.resolve(__dirname, "../../node_modules/refractor"),
+    path.resolve(__dirname, "../../../node_modules/refractor"),
   ];
 
   const refractorRoot = candidateRoots.find((packagePath) =>
@@ -53,7 +53,7 @@ function createRefractorCompatibilityPlugin() {
 function createMermaidPlugin() {
   const candidateRoots = [
     path.resolve(__dirname, "../node_modules/mermaid"),
-    path.resolve(__dirname, "../../node_modules/mermaid"),
+    path.resolve(__dirname, "../../../node_modules/mermaid"),
   ];
   const mermaidRoot = candidateRoots.find((p) => fs.existsSync(p));
 
@@ -259,7 +259,7 @@ function resolvePackageRoot(packageName) {
     process.cwd(),
     __dirname,
     path.resolve(__dirname, ".."),
-    path.resolve(__dirname, "../.."),
+    path.resolve(__dirname, "../../.."),
   ];
 
   for (const resolutionPath of resolutionPaths) {
@@ -300,7 +300,7 @@ function resolvePackageSubpath(packageName, subpath) {
     process.cwd(),
     __dirname,
     path.resolve(__dirname, ".."),
-    path.resolve(__dirname, "../.."),
+    path.resolve(__dirname, "../../.."),
   ];
 
   for (const resolutionPath of resolutionPaths) {

package/Utils/API.ts

@@ -247,34 +247,43 @@ export default class API {
     return false;
   }
 
+  /*
+   * The class this instance was built from, so `new BaseAPI(...).get()` gets
+   * BaseAPI's session refresh, error handling and headers rather than the
+   * base class's no-op versions.
+   */
+  private getStaticClient(): typeof API {
+    return this.constructor as typeof API;
+  }
+
   public async get<
     T extends JSONObject | JSONArray | BaseModel | Array<BaseModel>,
   >(options: APIRequestOptions): Promise<HTTPResponse<T> | HTTPErrorResponse> {
-    return await API.get<T>(options);
+    return await this.getStaticClient().get<T>(options);
   }
 
   public async delete<
     T extends JSONObject | JSONArray | BaseModel | Array<BaseModel>,
   >(options: APIRequestOptions): Promise<HTTPResponse<T> | HTTPErrorResponse> {
-    return await API.delete<T>(options);
+    return await this.getStaticClient().delete<T>(options);
   }
 
   public async head<
     T extends JSONObject | JSONArray | BaseModel | Array<BaseModel>,
   >(options: APIRequestOptions): Promise<HTTPResponse<T> | HTTPErrorResponse> {
-    return await API.head<T>(options);
+    return await this.getStaticClient().head<T>(options);
   }
 
   public async put<
     T extends JSONObject | JSONArray | BaseModel | Array<BaseModel>,
   >(options: APIRequestOptions): Promise<HTTPResponse<T> | HTTPErrorResponse> {
-    return await API.put<T>(options);
+    return await this.getStaticClient().put<T>(options);
   }
 
   public async patch<
     T extends JSONObject | JSONArray | BaseModel | Array<BaseModel>,
   >(options: APIRequestOptions): Promise<HTTPResponse<T> | HTTPErrorResponse> {
-    return await API.patch<T>(options);
+    return await this.getStaticClient().patch<T>(options);
   }
 
   public static handleError(
@@ -659,6 +668,7 @@ export default class API {
               options.limitRedirectResponseBody || false,
               method === HTTPMethod.HEAD,
               options.maximumResponseBytes,
+              options.signal,
             );
           }
 
@@ -681,6 +691,7 @@ export default class API {
               options.limitRedirectResponseBody || false,
               method === HTTPMethod.HEAD,
               options.maximumResponseBytes,
+              options.signal,
             );
           }
 
@@ -871,6 +882,7 @@ export default class API {
     limitRedirectResponseBody: boolean,
     isHeadResponse: boolean,
     maximumResponseBytes?: number | undefined,
+    signal?: AbortSignal | undefined,
   ): Promise<unknown> {
     const body: Buffer = await HTTPResponseBodyReader.read(response.data, {
       budget: budget,
@@ -879,6 +891,7 @@ export default class API {
       limitRedirectResponseBody: limitRedirectResponseBody,
       isHeadResponse: isHeadResponse,
       maximumResponseBytes: maximumResponseBytes,
+      signal: signal,
     });
     const text: string = HTTPResponseBodyReader.decodeUtf8(body);
 
@@ -1246,7 +1259,12 @@ export default class API {
     const axiosError: AxiosError | null = axios.isAxiosError(error)
       ? (error as AxiosError)
       : null;
-    const errorCode: string | undefined = axiosError?.code;
+    const nativeErrorCode: unknown =
+      typeof error === "object" && error !== null && "code" in error
+        ? error.code
+        : undefined;
+    const errorCode: string | undefined =
+      typeof nativeErrorCode === "string" ? nativeErrorCode : undefined;
     const rawErrorMessage: string =
       (error as Error)?.message || String(error) || "Unknown error";
 

package/Utils/Dashboard/HtmlWidgetDocument.ts

@@ -27,7 +27,7 @@ import DashboardVariableInterpolation, {
  * are never emitted together, and getSandboxAttribute() has no input that
  * produces `allow-same-origin`.
  *
- * Internal/Roadmap/SessionReplay.md argues against `allow-scripts` without
+ * Docs/Internal/Roadmap/SessionReplay.md argues against `allow-scripts` without
  * `allow-same-origin`; that conclusion is specific to session replay, where
  * the rrweb Replayer runs in the PARENT and writes into contentDocument, so
  * it needs same-origin access and no script execution. This widget is the

package/Utils/HTTPResponseBodyReader.ts

@@ -4,6 +4,16 @@ interface StreamedResponseBody extends AsyncIterable<unknown> {
   destroy?: (() => unknown) | undefined;
 }
 
+interface ResponseBodyReadOptions {
+  budget: HTTPResponseBodyBudget;
+  statusCode: number;
+  headers?: unknown;
+  limitRedirectResponseBody: boolean;
+  isHeadResponse?: boolean | undefined;
+  maximumResponseBytes?: number | undefined;
+  signal?: AbortSignal | undefined;
+}
+
 const DEFAULT_MAX_REDIRECT_RESPONSE_BYTES: number = 64 * 1024;
 
 export class HTTPResponseBodyBudget {
@@ -81,19 +91,55 @@ export default class HTTPResponseBodyReader {
 
   public static async read(
     responseBody: unknown,
-    options: {
-      budget: HTTPResponseBodyBudget;
-      statusCode: number;
-      headers?: unknown;
-      limitRedirectResponseBody: boolean;
-      isHeadResponse?: boolean | undefined;
-      maximumResponseBytes?: number | undefined;
-    },
+    options: ResponseBodyReadOptions,
   ): Promise<Buffer> {
     if (!this.isStreamedResponseBody(responseBody)) {
       throw new BadDataException("Remote response body could not be read.");
     }
 
+    const signal: AbortSignal | undefined = options.signal;
+    if (!signal) {
+      return await this.readStream(responseBody, options);
+    }
+
+    let onAbort: (() => void) | undefined;
+    const aborted: Promise<never> = new Promise(
+      (_resolve: (value: never) => void, reject: (error: Error) => void) => {
+        onAbort = (): void => {
+          reject(this.abortError());
+          responseBody.destroy?.();
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+      },
+    );
+
+    try {
+      if (signal.aborted) {
+        onAbort!();
+        return await aborted;
+      }
+
+      /*
+       * Axios detaches its signal listener when an HTTP error rejects at
+       * headers, before the error body is read. Own cancellation here too,
+       * so a timed-out attempt closes that stream before retrying. Racing
+       * also settles readers whose async iterator does not expose destroy.
+       */
+      return await Promise.race([
+        this.readStream(responseBody, options),
+        aborted,
+      ]);
+    } finally {
+      if (onAbort) {
+        signal.removeEventListener("abort", onAbort);
+      }
+    }
+  }
+
+  private static async readStream(
+    responseBody: StreamedResponseBody,
+    options: ResponseBodyReadOptions,
+  ): Promise<Buffer> {
     let limit: number;
     try {
       limit = options.budget.getResponseLimit(
@@ -137,6 +183,10 @@ export default class HTTPResponseBodyReader {
     let byteCount: number = 0;
 
     for await (const rawChunk of responseBody) {
+      if (options.signal?.aborted) {
+        throw this.abortError();
+      }
+
       const chunk: Buffer = Buffer.isBuffer(rawChunk)
         ? rawChunk
         : Buffer.from(rawChunk as Uint8Array);
@@ -165,6 +215,12 @@ export default class HTTPResponseBodyReader {
     return Buffer.concat(chunks, byteCount);
   }
 
+  private static abortError(): Error {
+    const error: Error = new Error("Response body read was aborted.");
+    error.name = "AbortError";
+    return error;
+  }
+
   private static normalizeMaximumBytes(value: number): number {
     if (!Number.isFinite(value)) {
       return 0;

package/Utils/Metrics/MetricExplorerUrl.ts

@@ -74,6 +74,7 @@ export interface SerializedMetricQuery {
    */
   variable?: string | undefined;
   attributes?: Dictionary<SerializedMetricAttributeValue> | undefined;
+  eventScope?: Dictionary<SerializedMetricAttributeValue> | undefined;
   aggregationType?: MetricsAggregationType | undefined;
   alias?: SerializedMetricQueryAlias | undefined;
   groupByAttributeKeys?: Array<string> | undefined;
@@ -304,6 +305,13 @@ export default class MetricExplorerUrl {
         ? { variable: queryConfig.metricAliasData.metricVariable }
         : {}),
       attributes,
+      ...(queryConfig.eventScope !== undefined
+        ? {
+            eventScope: MetricExplorerUrl.sanitizeAttributes(
+              queryConfig.eventScope,
+            ),
+          }
+        : {}),
       ...(aggregationType ? { aggregationType } : {}),
       ...(alias ? { alias } : {}),
       ...(groupByAttributeKeys.length > 0 ? { groupByAttributeKeys } : {}),
@@ -451,6 +459,13 @@ export default class MetricExplorerUrl {
         metricName,
         ...(variable ? { variable } : {}),
         attributes,
+        ...(Object.prototype.hasOwnProperty.call(entryRecord, "eventScope")
+          ? {
+              eventScope: MetricExplorerUrl.sanitizeAttributes(
+                entryRecord["eventScope"],
+              ),
+            }
+          : {}),
         ...(aggregationType ? { aggregationType } : {}),
         ...(alias ? { alias } : {}),
         ...(groupByAttributeKeys.length > 0 ? { groupByAttributeKeys } : {}),
@@ -561,6 +576,10 @@ export default class MetricExplorerUrl {
       return true;
     }
 
+    if (query.eventScope !== undefined) {
+      return true;
+    }
+
     if (query.attributes && Object.keys(query.attributes).length > 0) {
       return true;
     }

package/Utils/Monitor/MonitorTestAvailabilityUtil.ts

@@ -0,0 +1,92 @@
+import MonitorSteps from "../../Types/Monitor/MonitorSteps";
+import MonitorType, {
+  MonitorTypeHelper,
+} from "../../Types/Monitor/MonitorType";
+
+/*
+ * Whether "Test Monitor" can do anything for the monitor being looked at.
+ *
+ * Every one of these three conditions produces the SAME symptom when it is not
+ * checked before the button is offered - a dead end the user only discovers
+ * after committing to the flow:
+ *
+ *   - a monitor type no probe runs: the form renders nothing at all, so the
+ *     caller is left with an empty slot in a card header;
+ *   - no monitor steps: the row is accepted by the database, but the probe
+ *     returns before reporting anything (Probe/Utils/Monitors/Monitor.ts checks
+ *     `!monitorTest.monitorSteps || ...length === 0`), so the dashboard polls
+ *     for two and a half minutes and then blames a timeout;
+ *   - no probes: the modal opens on a required "Select Probe" dropdown with
+ *     zero options, which cannot be submitted at all.
+ *
+ * The rule lives here, rather than as a boolean expression at the call site,
+ * because it is the kind of thing that is easy to get right on one page and
+ * forget on the next - and because the reason matters: a caller that wants to
+ * explain itself needs to know WHICH of the three it was.
+ */
+
+export enum MonitorTestAvailability {
+  // The test can be offered.
+  Available = "Available",
+  // No probe runs this kind of monitor, so there is nothing to test with.
+  MonitorTypeNotProbeable = "MonitorTypeNotProbeable",
+  // The monitor has no steps, so a test would have nothing to execute.
+  NoMonitorSteps = "NoMonitorSteps",
+  // Nothing is attached to run the test on.
+  NoProbesAttached = "NoProbesAttached",
+}
+
+export interface MonitorTestAvailabilityInput {
+  /*
+   * Undefined while the monitor is still loading. Treated exactly like a
+   * non-probeable type: not yet an answer, so do not offer the action.
+   */
+  monitorType?: MonitorType | undefined;
+  monitorSteps?: MonitorSteps | undefined | null;
+  // How many probes the caller can actually offer in the picker.
+  attachedProbeCount: number;
+}
+
+export default class MonitorTestAvailabilityUtil {
+  public static getAvailability(
+    data: MonitorTestAvailabilityInput,
+  ): MonitorTestAvailability {
+    if (!data.monitorType) {
+      return MonitorTestAvailability.MonitorTypeNotProbeable;
+    }
+
+    if (!MonitorTypeHelper.isProbableMonitor(data.monitorType)) {
+      return MonitorTestAvailability.MonitorTypeNotProbeable;
+    }
+
+    if (this.getMonitorStepCount(data.monitorSteps) === 0) {
+      return MonitorTestAvailability.NoMonitorSteps;
+    }
+
+    /*
+     * Negative counts cannot happen from an array length, but a caller that
+     * computes this from something else should not be able to smuggle one in.
+     */
+    if (!data.attachedProbeCount || data.attachedProbeCount <= 0) {
+      return MonitorTestAvailability.NoProbesAttached;
+    }
+
+    return MonitorTestAvailability.Available;
+  }
+
+  public static isAvailable(data: MonitorTestAvailabilityInput): boolean {
+    return this.getAvailability(data) === MonitorTestAvailability.Available;
+  }
+
+  /*
+   * How many steps a test would run. Kept here so that every caller agrees on
+   * what an "empty" MonitorSteps is: the property is optional at three levels
+   * (the object, its `data`, and the array), and only the innermost one is the
+   * question actually being asked.
+   */
+  public static getMonitorStepCount(
+    monitorSteps?: MonitorSteps | undefined | null,
+  ): number {
+    return monitorSteps?.data?.monitorStepsInstanceArray?.length || 0;
+  }
+}