@oneuptime/common 13.0.6 → 13.0.8

package/build/dist/Server/Services/DatabaseService.js

@@ -22,6 +22,8 @@ import { EncryptionSecret, WorkflowHostname } from "../EnvironmentConfig";
 import PostgresAppInstance from "../Infrastructure/PostgresDatabase";
 import ClusterKeyAuthorization from "../Middleware/ClusterKeyAuthorization";
 import ModelPermission from "../Types/Database/Permissions/Index";
+import PublicPermission from "../Types/Database/Permissions/PublicPermission";
+import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import OwnerOnlyColumnPermission from "../Types/Database/Permissions/OwnerOnlyColumnPermission";
 import QueryHelper from "../Types/Database/QueryHelper";
 import Encryption from "../Utils/Encryption";
@@ -42,6 +44,7 @@ import { getMaxLengthFromTableColumnType } from "../../Types/Database/ColumnLeng
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import TableColumnType from "../../Types/Database/TableColumnType";
 import { getUniqueColumnsBy } from "../../Types/Database/UniqueColumnBy";
+import QueryOperator from "../../Types/BaseDatabase/QueryOperator";
 import OneUptimeDate from "../../Types/Date";
 import BadDataException from "../../Types/Exception/BadDataException";
 import DatabaseNotConnectedException from "../../Types/Exception/DatabaseNotConnectedException";
@@ -63,6 +66,7 @@ import Realtime from "../Utils/Realtime";
 import ModelEventType from "../../Types/Realtime/ModelEventType";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import RelationValueUtil from "../Utils/Database/RelationValueUtil";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 const RULE_CRITERIA_RELATION_OPERATORS = new Set([
     RuleCriteriaOperator.HasAnyOf,
     RuleCriteriaOperator.HasAllOf,
@@ -202,6 +206,26 @@ class DatabaseService extends BaseService {
         }
         return data;
     }
+    /*
+     * The permission layer's login check, run BEFORE the hooks instead of only
+     * after them.
+     *
+     * The hooks run first, and many of them key off props.userId: a missing one
+     * reads as "userId is required" (400), "User should be logged in" (422), or,
+     * for Project reads, an empty list with a 200. For an anonymous caller that
+     * is almost always a dashboard tab whose access-token cookie expired, and
+     * only a 401 makes the browser client refresh the session and replay the
+     * request. Everything this admits, the permission check would have admitted
+     * too (same condition, same exemptions for API keys and public models), so
+     * it only changes which refusal an anonymous caller gets, and it keeps hooks
+     * with side effects from running for them at all.
+     */
+    checkIfUserIsLoggedInBeforeHooks(props, type) {
+        if (props.isRoot || props.isMasterAdmin) {
+            return;
+        }
+        PublicPermission.checkIfUserIsLoggedIn(this.modelType, props, type);
+    }
     async onBeforeCreate(createBy) {
         // A place holder method used for overriding.
         return Promise.resolve({
@@ -240,6 +264,38 @@ class DatabaseService extends BaseService {
             }
         }
     }
+    /*
+     * Query operators (StartsWith, NotNull, Search, GreaterThan, Includes...)
+     * belong in the `query` of a read/update, never in the `data` of a write.
+     * They can reach create/update data because JSONFunctions.deserialize - run
+     * on every request body while building the model - turns
+     * `{"_type":"StartsWith","value":"a"}` into a real operator instance, and
+     * DatabaseBaseModel._fromJSON assigns it to an id/text column unchanged.
+     *
+     * An operator is never a valid stored value, and leaving one on a write
+     * payload also feeds it to the lookups built from that data - the uniqueness
+     * check here and the findBy/countBy calls in service hooks - where QueryUtil
+     * turns the intended exact comparison into a pattern match, quietly matching
+     * rows the caller never named. Refuse such a write up front instead. JSON
+     * columns are exempt: they legitimately hold arbitrary objects, and their
+     * values are not used to build a query.
+     */
+    rejectQueryOperatorsInData(data) {
+        for (const columnName of Object.keys(data)) {
+            const value = data[columnName];
+            if (!(value instanceof QueryOperator)) {
+                continue;
+            }
+            if (!this.model.isTableColumn(columnName)) {
+                continue;
+            }
+            const metadata = this.model.getTableColumnMetadata(columnName);
+            if (metadata && metadata.type === TableColumnType.JSON) {
+                continue;
+            }
+            throw new BadDataException(`Invalid value for ${columnName}. A query operator cannot be used as a value when creating or updating ${this.model.singularName}.`);
+        }
+    }
     /*
      * Rows written before the fix above hold their ciphertext inside that
      * HashedString envelope. Decrypting the envelope itself is not just wrong
@@ -674,6 +730,78 @@ class DatabaseService extends BaseService {
         data[safetyPatternField] =
             RULE_CRITERIA_LEGACY_NEVER_MATCH_PATTERN;
     }
+    /*
+     * A tenant model declares its tenant TWICE: a scalar column (e.g.
+     * `projectId`) AND a ManyToOne relation (`project`) whose @JoinColumn names
+     * that same scalar. Both are separately writable through the public API, and
+     * both land on the entity that reaches getRepository().save()/update().
+     * TypeORM (metadata/ColumnMetadata.js getEntityValue) resolves the relation
+     * object to the join-column value with PRECEDENCE over the scalar, so a
+     * request carrying `project: { _id: <another project> }` is persisted under
+     * THAT project even though create() has just stamped the scalar to
+     * props.tenantId. That is a cross-tenant write of the whole row (reproduced
+     * end to end: the generated INSERT binds `projectId` to the relation's id,
+     * not the stamped scalar).
+     *
+     * The stamped scalar is the authoritative tenant for every non-root write,
+     * and no `project` relation in the schema legitimately points at a project
+     * other than the tenant (every one joins on `projectId`; there is no second,
+     * foreign-project reference to preserve). So neutralize the relation
+     * spelling: reject a tenant relation that points anywhere other than the
+     * request tenant, then delete it so the scalar is the single source of truth
+     * and no TypeORM precedence rule between the two can move the row. This is
+     * the framework-level generalisation of the per-service fixes already
+     * shipped in ApiKeyPermissionService and UserTelegramService.
+     *
+     * Root / master-admin / internal callers are left untouched — they have no
+     * request tenant (props.tenantId is unset) and legitimately set the tenant
+     * relation for another project during seeding, migrations and
+     * invitation-acceptance. This mirrors the create() scalar stamp, which is
+     * likewise gated on props.tenantId.
+     */
+    enforceTenantRelationMatchesScalar(data, props) {
+        if (props.isRoot || props.isMasterAdmin) {
+            return;
+        }
+        const tenantColumn = this.model.getTenantColumn();
+        if (!tenantColumn || !props.tenantId) {
+            return;
+        }
+        const tenantRelationProperty = this.getTenantRelationProperty(tenantColumn);
+        if (!tenantRelationProperty) {
+            /*
+             * e.g. Project itself, whose tenant column is its own `_id`, has no such
+             * relation; global (non-tenant) models return null from getTenantColumn.
+             */
+            return;
+        }
+        const suppliedRelation = data[tenantRelationProperty];
+        if (suppliedRelation === undefined) {
+            return;
+        }
+        const relationTenantId = RelationIdUtil.read(data, [tenantRelationProperty]);
+        if (relationTenantId &&
+            relationTenantId.toString() !== props.tenantId.toString()) {
+            throw new BadDataException(`The ${tenantRelationProperty} relation does not belong to this project.`);
+        }
+        delete data[tenantRelationProperty];
+    }
+    /*
+     * Property name of the ManyToOne relation that shares the tenant scalar
+     * column as its join column (`project` for the `projectId` tenant column),
+     * or null when the model has no such relation.
+     */
+    getTenantRelationProperty(tenantColumn) {
+        for (const columnName of this.model.getTableColumns().columns) {
+            const metadata = this.model.getTableColumnMetadata(columnName);
+            if (metadata &&
+                metadata.type === TableColumnType.Entity &&
+                metadata.manyToOneRelationColumn === tenantColumn) {
+                return columnName;
+            }
+        }
+        return null;
+    }
     async sanitizeCreateOrUpdate(data, props, isUpdate = false) {
         var _a;
         const criteriaValue = data["criteria"];
@@ -954,6 +1082,24 @@ class DatabaseService extends BaseService {
     }
     async create(createBy) {
         var _a, _b;
+        this.checkIfUserIsLoggedInBeforeHooks(createBy.props, DatabaseRequestType.Create);
+        /*
+         * A non-root create must not pin the row's own primary key. save() treats
+         * an entity carrying an existing id as an update of that row rather than an
+         * insert, so a supplied `_id` turns a create into an in-place modification
+         * of a record the caller never named. BaseAPI.createItem already strips it;
+         * this guards every other non-root caller (custom routes, workflow
+         * components) too. Root/internal seeding legitimately assigns ids and is
+         * exempt. Only the top-level primary key is checked - nested relation
+         * `_id`s reference existing related rows and are fine.
+         */
+        if (!createBy.props.isRoot &&
+            !createBy.props.isMasterAdmin &&
+            createBy.data._id) {
+            throw new BadDataException(`An id cannot be supplied when creating ${this.model.singularName}.`);
+        }
+        // Query operators are for queries, not for write payloads. See the helper.
+        this.rejectQueryOperatorsInData(createBy.data);
         this.unwrapHashedStringsForUnhashedColumns(createBy.data);
         const onCreate = createBy.props.ignoreHooks
             ? { createBy, carryForward: [] }
@@ -967,6 +1113,14 @@ class DatabaseService extends BaseService {
         if (tenantColumnName && _createdBy.props.tenantId) {
             data.setColumnValue(tenantColumnName, _createdBy.props.tenantId);
         }
+        /*
+         * The tenant scalar has just been stamped to the request tenant, but the
+         * matching tenant RELATION object (e.g. `project`) is still whatever the
+         * caller sent, and TypeORM lets that relation override the scalar on the
+         * INSERT. Force the relation to agree with — or be dropped in favour of —
+         * the stamped scalar so a caller cannot write the row into another tenant.
+         */
+        this.enforceTenantRelationMatchesScalar(data, _createdBy.props);
         data = this.generateDefaultValues(data);
         data = this.checkRequiredFields(data);
         await this.checkForUniqueValues(data);
@@ -983,6 +1137,7 @@ class DatabaseService extends BaseService {
         createBy.data = data;
         // check uniqueColumns by:
         createBy = await this.checkUniqueColumnBy(createBy);
+        await this.checkUniqueColumnsTogether(createBy.data);
         // serialize.
         createBy.data = (await this.sanitizeCreateOrUpdate(createBy.data, createBy.props));
         try {
@@ -1096,8 +1251,14 @@ class DatabaseService extends BaseService {
             return;
         }
         try {
+            /*
+             * A new row every time. getModel() is the owner service's own shared
+             * instance, and a save writes the generated _id back onto whatever it
+             * was handed - so reusing it would turn the next auto-owner insert into
+             * an update of this row.
+             */
             // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            const ownerModel = entry.ownerUserService.getModel();
+            const ownerModel = new entry.ownerUserService.modelType();
             ownerModel[entry.fkColumn] = resourceId;
             ownerModel.userId = props.userId;
             ownerModel.projectId = projectId;
@@ -1107,6 +1268,13 @@ class DatabaseService extends BaseService {
             });
         }
         catch (err) {
+            /*
+             * The create form can name the creator as an owner too, and that path
+             * may have added them first. They are an owner either way.
+             */
+            if (PostgresErrorTranslator.isUniqueViolation(err)) {
+                return;
+            }
             logger.error(`auto-owner-on-create failed for ${modelName} ${resourceId.toString()}`);
             logger.error(err);
         }
@@ -1228,6 +1396,62 @@ class DatabaseService extends BaseService {
         }
         return Promise.resolve(createBy);
     }
+    /*
+     * Enforces @UniqueColumnsTogether before the row is written, so a duplicate
+     * is rejected with the model's own message and never reaches
+     * onCreateSuccess (and whatever feed items or notifications it sends).
+     *
+     * A key column can arrive as its id column (`teamId`) or only as the
+     * relation that fills it (`team`), so both are read. When a value is
+     * missing altogether there is nothing to compare; the unique index decides.
+     */
+    async checkUniqueColumnsTogether(data) {
+        for (const constraint of this.model.getUniqueColumnsTogether()) {
+            const query = {};
+            let isKeyComplete = true;
+            for (const columnName of constraint.columnNames) {
+                const value = this.getUniqueKeyValue(data, columnName);
+                if (value === null) {
+                    isKeyComplete = false;
+                    break;
+                }
+                query[columnName] = value;
+            }
+            if (!isKeyComplete) {
+                continue;
+            }
+            const count = await this.countBy({
+                query: query,
+                props: {
+                    isRoot: true,
+                },
+            });
+            if (count.toNumber() > 0) {
+                throw PostgresErrorTranslator.createUniqueViolationException(constraint.errorMessage);
+            }
+        }
+    }
+    getUniqueKeyValue(data, columnName) {
+        const metadata = this.model.getTableColumnMetadata(columnName);
+        if ((metadata === null || metadata === void 0 ? void 0 : metadata.type) !== TableColumnType.ObjectID) {
+            const value = data[columnName];
+            return value === undefined || value === null ? null : value;
+        }
+        let id = RelationValueUtil.getRelationId(data[columnName]);
+        if (!id) {
+            const relationColumnName = this.model
+                .getTableColumns()
+                .columns.find((column) => {
+                const relationMetadata = this.model.getTableColumnMetadata(column);
+                return (relationMetadata.type === TableColumnType.Entity &&
+                    relationMetadata.manyToOneRelationColumn === columnName);
+            });
+            if (relationColumnName) {
+                id = RelationValueUtil.getRelationId(data[relationColumnName]);
+            }
+        }
+        return id ? new ObjectID(id) : null;
+    }
     async countBy({ query, skip, limit, props, groupBy, distinctOn, }) {
         try {
             if (groupBy && Object.keys(groupBy).length > 0) {
@@ -1531,6 +1755,7 @@ class DatabaseService extends BaseService {
     }
     async hardDeleteBy(deleteBy) {
         try {
+            this.checkIfUserIsLoggedInBeforeHooks(deleteBy.props, DatabaseRequestType.Delete);
             const onDelete = deleteBy.props.ignoreHooks
                 ? { deleteBy, carryForward: [] }
                 : await this.onBeforeDelete(deleteBy);
@@ -1570,6 +1795,7 @@ class DatabaseService extends BaseService {
         var _a, _b, _c, _d;
         try {
             this.setTelemetryContextFromProps(deleteBy.props);
+            this.checkIfUserIsLoggedInBeforeHooks(deleteBy.props, DatabaseRequestType.Delete);
             if (this.doNotAllowDelete && !deleteBy.props.isRoot) {
                 throw new BadDataException("Delete not allowed");
             }
@@ -1730,6 +1956,7 @@ class DatabaseService extends BaseService {
         var _a;
         try {
             this.setTelemetryContextFromProps(findBy.props);
+            this.checkIfUserIsLoggedInBeforeHooks(findBy.props, DatabaseRequestType.Read);
             if (!findBy.sort || Object.keys(findBy.sort).length === 0) {
                 findBy.sort = {
                     createdAt: SortOrder.Descending,
@@ -2000,7 +2227,21 @@ class DatabaseService extends BaseService {
         var _a, _b, _c, _d, _e;
         try {
             this.setTelemetryContextFromProps(updateBy.props);
+            this.checkIfUserIsLoggedInBeforeHooks(updateBy.props, DatabaseRequestType.Update);
             updateBy.data = this.sanitizeUpdateData(updateBy.data);
+            // Query operators are for queries, not for write payloads. See the helper.
+            this.rejectQueryOperatorsInData(updateBy.data);
+            /*
+             * Defense in depth for the tenant confused-deputy on the update path.
+             * Unlike create(), _updateBy() never re-stamps the tenant scalar, and a
+             * tenant relation object would likewise override the scalar join column
+             * on the UPDATE. Today the tenant columns carry `update: []` so the
+             * column-permission check rejects them first, but that is incidental —
+             * this keeps the row's tenant immutable even if a model ever grants
+             * update on the tenant relation. Runs before the permission check so the
+             * ACL stays a redundant second line rather than the only one.
+             */
+            this.enforceTenantRelationMatchesScalar(updateBy.data, updateBy.props);
             this.unwrapHashedStringsForUnhashedColumns(updateBy.data);
             const onUpdate = updateBy.props.ignoreHooks
                 ? { updateBy, carryForward: [] }