@oneuptime/common 13.0.6 → 13.0.8

package/Server/Utils/Realtime.ts

@@ -24,6 +24,19 @@ import Dictionary from "../../Types/Dictionary";
 import UserPermissionUtil from "./UserPermission/UserPermission";
 import CaptureSpan from "./Telemetry/CaptureSpan";
 
+// What became of one ListenToModelEvent request.
+export enum ListenToModelEventOutcome {
+  Joined = "Joined",
+  // No access token, or one that no longer decodes. The client was told.
+  AuthenticationRequired = "AuthenticationRequired",
+  // A valid session without access to this tenant or model.
+  NotAuthorized = "NotAuthorized",
+  // The request itself was malformed.
+  InvalidRequest = "InvalidRequest",
+  // Something failed while authorizing (for example the permission cache).
+  Failed = "Failed",
+}
+
 export default abstract class Realtime {
   private static socketServer: SocketServer | null = null;
 
@@ -45,37 +58,19 @@ export default abstract class Realtime {
       this.socketServer!.on("connection", (socket: Socket) => {
         logger.debug("New socket connection established");
 
-        socket.on(EventName.ListenToModalEvent, async (data: JSONObject) => {
-          logger.debug("Received ListenToModalEvent with data:");
-          logger.debug(data);
-
-          const socketLogAttributes: LogAttributes = {
-            projectId: data["tenantId"]?.toString(),
-          };
-
-          if (typeof data["eventType"] !== "string") {
-            logger.error("eventType is not a string", socketLogAttributes);
-            throw new BadDataException("eventType is not a string");
-          }
-          if (typeof data["modelType"] !== "string") {
-            logger.error("modelType is not a string", socketLogAttributes);
-            throw new BadDataException("modelType is not a string");
-          }
-          if (typeof data["modelName"] !== "string") {
-            logger.error("modelName is not a string", socketLogAttributes);
-            throw new BadDataException("modelName is not a string");
-          }
-          if (typeof data["tenantId"] !== "string") {
-            logger.error("tenantId is not a string", socketLogAttributes);
-            throw new BadDataException("tenantId is not a string");
-          }
-
-          await Realtime.listenToModelEvent(socket, {
-            eventType: data["eventType"] as ModelEventType,
-            modelType: data["modelType"] as DatabaseType,
-            modelName: data["modelName"] as string,
-            tenantId: data["tenantId"] as string,
-          });
+        /*
+         * socket.io calls a listener and throws away what it returns. An async
+         * listener that throws is therefore an unhandled rejection: nothing
+         * goes back to the client, and the subscription it asked for simply
+         * never happens. handleListenToModelEventRequest settles every outcome
+         * itself; the catch is a backstop, not the error handling.
+         */
+        socket.on(EventName.ListenToModalEvent, (data: JSONObject): void => {
+          Realtime.handleListenToModelEventRequest(socket, data).catch(
+            (err: unknown) => {
+              logger.error(err);
+            },
+          );
         });
       });
     }
@@ -83,11 +78,108 @@ export default abstract class Realtime {
     return this.socketServer;
   }
 
+  /*
+   * One ListenToModelEvent from a client, start to finish. Never throws: a
+   * malformed request, a missing or expired access token, a refused
+   * subscription and a failing permission lookup each end here as an outcome,
+   * so none of them can become an unhandled rejection in the socket listener.
+   */
+  @CaptureSpan()
+  public static async handleListenToModelEventRequest(
+    socket: Socket,
+    data: JSONObject,
+  ): Promise<ListenToModelEventOutcome> {
+    logger.debug("Received ListenToModalEvent with data:");
+    logger.debug(data);
+
+    let request: ListenToModelEventJSON;
+
+    try {
+      request = Realtime.parseListenToModelEventRequest(data);
+    } catch (err) {
+      logger.error(err);
+      return ListenToModelEventOutcome.InvalidRequest;
+    }
+
+    try {
+      return await Realtime.listenToModelEvent(socket, request);
+    } catch (err) {
+      // A permission-cache (Redis) failure, say. The room is not joined.
+      const failureLogAttributes: LogAttributes = {
+        projectId: request.tenantId,
+      };
+
+      logger.error(err, failureLogAttributes);
+      return ListenToModelEventOutcome.Failed;
+    }
+  }
+
+  private static parseListenToModelEventRequest(
+    data: JSONObject,
+  ): ListenToModelEventJSON {
+    if (!data || typeof data !== "object") {
+      logger.error("ListenToModelEvent data is not an object");
+      throw new BadDataException("ListenToModelEvent data is not an object");
+    }
+
+    const socketLogAttributes: LogAttributes = {
+      projectId: data["tenantId"]?.toString(),
+    };
+
+    if (typeof data["eventType"] !== "string") {
+      logger.error("eventType is not a string", socketLogAttributes);
+      throw new BadDataException("eventType is not a string");
+    }
+    if (typeof data["modelType"] !== "string") {
+      logger.error("modelType is not a string", socketLogAttributes);
+      throw new BadDataException("modelType is not a string");
+    }
+    if (typeof data["modelName"] !== "string") {
+      logger.error("modelName is not a string", socketLogAttributes);
+      throw new BadDataException("modelName is not a string");
+    }
+    if (typeof data["tenantId"] !== "string") {
+      logger.error("tenantId is not a string", socketLogAttributes);
+      throw new BadDataException("tenantId is not a string");
+    }
+
+    return {
+      eventType: data["eventType"] as ModelEventType,
+      modelType: data["modelType"] as DatabaseType,
+      modelName: data["modelName"] as string,
+      tenantId: data["tenantId"] as string,
+    };
+  }
+
+  /*
+   * The socket has no usable user session: tell the client, which refreshes
+   * its session and reconnects so the new handshake carries the new cookie.
+   * Dropping the request silently is what used to happen, and it left every
+   * subscription made after the access token expired dead (no live counters
+   * after switching project, no live logs) with nothing in the browser to
+   * show why.
+   */
+  private static rejectForMissingAuthentication(
+    socket: Socket,
+    data: ListenToModelEventJSON,
+    reason: string,
+    listenLogAttributes: LogAttributes,
+  ): ListenToModelEventOutcome {
+    logger.debug(
+      `${reason}, aborting joining room and asking the client to re-authenticate`,
+      listenLogAttributes,
+    );
+
+    socket.emit(EventName.AuthenticationRequired, data);
+
+    return ListenToModelEventOutcome.AuthenticationRequired;
+  }
+
   @CaptureSpan()
   public static async listenToModelEvent(
     socket: Socket,
     data: ListenToModelEventJSON,
-  ): Promise<void> {
+  ): Promise<ListenToModelEventOutcome> {
     const listenLogAttributes: LogAttributes = {
       projectId: data.tenantId?.toString(),
     };
@@ -116,31 +208,51 @@ export default abstract class Realtime {
       this.getAccessTokenFromSocket(socket);
 
     if (!userAccessToken) {
-      logger.debug(
-        "User access token not found in socket, aborting joining room",
+      return this.rejectForMissingAuthentication(
+        socket,
+        data,
+        "User access token not found in socket",
         listenLogAttributes,
       );
-      return;
     }
 
     logger.debug("Decoding user access token", listenLogAttributes);
-    const userAuthorizationData: JSONWebTokenData =
-      JSONWebToken.decode(userAccessToken);
+
+    /*
+     * The token is the one the browser sent with the handshake, and it is not
+     * re-read for the life of the connection. Once it expires every decode
+     * throws, which is the normal state of a dashboard tab left open past the
+     * access token's lifetime, not an error in the request.
+     */
+    let userAuthorizationData: JSONWebTokenData;
+
+    try {
+      userAuthorizationData = JSONWebToken.decode(userAccessToken);
+    } catch {
+      return this.rejectForMissingAuthentication(
+        socket,
+        data,
+        "User access token in socket is invalid or expired",
+        listenLogAttributes,
+      );
+    }
 
     if (!userAuthorizationData) {
-      logger.debug(
-        "User authorization data not found in socket, aborting joining room",
+      return this.rejectForMissingAuthentication(
+        socket,
+        data,
+        "User authorization data not found in socket",
         listenLogAttributes,
       );
-      return;
     }
 
     if (!userAuthorizationData.userId) {
-      logger.debug(
-        "User ID not found in socket, aborting joining room",
+      return this.rejectForMissingAuthentication(
+        socket,
+        data,
+        "User ID not found in socket",
         listenLogAttributes,
       );
-      return;
     }
 
     logger.debug("Checking user access permissions", listenLogAttributes);
@@ -179,7 +291,7 @@ export default abstract class Realtime {
           "User does not have access to this tenant, aborting joining room",
           listenLogAttributes,
         );
-        return;
+        return ListenToModelEventOutcome.NotAuthorized;
       }
 
       logger.debug(
@@ -214,12 +326,16 @@ export default abstract class Realtime {
       }
     }
 
+    /*
+     * Authenticated but not allowed. The room is not joined and, as before,
+     * nothing is sent back: a fresh session would not change the answer.
+     */
     if (!hasAccess) {
       logger.debug(
         "User does not have access to this tenant, aborting joining room",
         listenLogAttributes,
       );
-      return;
+      return ListenToModelEventOutcome.NotAuthorized;
     }
 
     if (data.modelId) {
@@ -244,6 +360,8 @@ export default abstract class Realtime {
       // join the room.
       await socket.join(roomId);
     }
+
+    return ListenToModelEventOutcome.Joined;
   }
 
   @CaptureSpan()

package/Server/Utils/Rules/OwnerRuleAssignment.ts

@@ -1,17 +1,24 @@
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 import ObjectID from "../../../Types/ObjectID";
 import DatabaseService from "../../Services/DatabaseService";
 import QueryHelper from "../../Types/Database/QueryHelper";
 import Query from "../../Types/Database/Query";
+import PostgresErrorTranslator from "../Database/PostgresErrorTranslator";
 
 /*
- * Owner rows are plain join rows with no unique constraint, so creating one for
- * a user who already owns the resource produces a duplicate owner - shown
- * twice, and notified twice. A resource created a moment ago rarely has owners
- * yet, but the create form can assign some before the owner rules run, and a
- * rule run over existing resources meets owners on almost every one of them.
- * Every owner rule engine filters its owner set through this first.
+ * An owner row is unique per (resource, user or team, project): every
+ * <Resource>OwnerUser / <Resource>OwnerTeam model declares that both as a
+ * unique index and through @UniqueColumnsTogether, so a second row for the
+ * same owner is rejected rather than stored (issue #3394). Before that, a
+ * duplicate was shown twice and notified twice.
+ *
+ * A rejected insert is an error, though, and the callers here - owner rules,
+ * create forms, monitor criteria, grouping rules - add owners in bulk and
+ * cannot let one owner who is already there stop the rest from being added.
+ * They filter their owner set through getOwnersNotYetAssigned first, and
+ * insert through createOwner, which treats "already an owner" as done.
  */
 
 export interface OwnersToAssign {
@@ -107,4 +114,148 @@ export default class OwnerRuleAssignment {
       }),
     };
   }
+
+  /*
+   * Inserts one owner row. Resolves true when the row was written and false
+   * when the owner was already there - whether the owner service's own check
+   * found the existing row, or the unique index rejected a concurrent insert
+   * that got past it. Every other failure is thrown as before.
+   */
+  public static async createOwner<TOwner extends BaseModel>(data: {
+    ownerService: DatabaseService<TOwner>;
+    owner: TOwner;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<boolean> {
+    try {
+      await data.ownerService.create({
+        data: data.owner,
+        props: data.props,
+      });
+
+      return true;
+    } catch (error) {
+      if (PostgresErrorTranslator.isUniqueViolation(error)) {
+        return false;
+      }
+
+      throw error;
+    }
+  }
+
+  /*
+   * Makes every user in `userIds` and team in `teamIds` an owner of the
+   * resource, skipping the ones that already are. Safe to call again with the
+   * same input: a retried workflow, a template that lists a team twice, or two
+   * paths adding the same owner each leave exactly one row, and so exactly one
+   * feed item and one notification.
+   *
+   * Resolves to the owners this call actually added.
+   */
+  public static async addOwners<
+    TOwnerUser extends BaseModel,
+    TOwnerTeam extends BaseModel,
+  >(data: {
+    ownerUserService: DatabaseService<TOwnerUser>;
+    ownerTeamService: DatabaseService<TOwnerTeam>;
+    // The owner rows' column holding the resource id, e.g. "incidentId".
+    resourceIdColumn: string;
+    resourceId: ObjectID;
+    projectId: ObjectID;
+    userIds: Array<ObjectID | string>;
+    teamIds: Array<ObjectID | string>;
+    /*
+     * Written to every added row's isOwnerNotified. Leave it out for owner
+     * tables that have no such column.
+     */
+    isOwnerNotified?: boolean | undefined;
+    createdByUserId?: ObjectID | undefined;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<OwnersToAssign> {
+    const ownersToAdd: OwnersToAssign =
+      await OwnerRuleAssignment.getOwnersNotYetAssigned({
+        ownerUserService: data.ownerUserService,
+        ownerTeamService: data.ownerTeamService,
+        resourceIdColumn: data.resourceIdColumn,
+        resourceId: data.resourceId,
+        userIds: data.userIds,
+        teamIds: data.teamIds,
+      });
+
+    const added: OwnersToAssign = { userIds: [], teamIds: [] };
+
+    for (const teamId of ownersToAdd.teamIds) {
+      const owner: TOwnerTeam = OwnerRuleAssignment.buildOwner({
+        ownerService: data.ownerTeamService,
+        ownerColumn: "teamId",
+        ownerId: teamId,
+        resourceIdColumn: data.resourceIdColumn,
+        resourceId: data.resourceId,
+        projectId: data.projectId,
+        isOwnerNotified: data.isOwnerNotified,
+        createdByUserId: data.createdByUserId,
+      });
+
+      if (
+        await OwnerRuleAssignment.createOwner({
+          ownerService: data.ownerTeamService,
+          owner: owner,
+          props: data.props,
+        })
+      ) {
+        added.teamIds.push(teamId);
+      }
+    }
+
+    for (const userId of ownersToAdd.userIds) {
+      const owner: TOwnerUser = OwnerRuleAssignment.buildOwner({
+        ownerService: data.ownerUserService,
+        ownerColumn: "userId",
+        ownerId: userId,
+        resourceIdColumn: data.resourceIdColumn,
+        resourceId: data.resourceId,
+        projectId: data.projectId,
+        isOwnerNotified: data.isOwnerNotified,
+        createdByUserId: data.createdByUserId,
+      });
+
+      if (
+        await OwnerRuleAssignment.createOwner({
+          ownerService: data.ownerUserService,
+          owner: owner,
+          props: data.props,
+        })
+      ) {
+        added.userIds.push(userId);
+      }
+    }
+
+    return added;
+  }
+
+  private static buildOwner<TOwner extends BaseModel>(data: {
+    ownerService: DatabaseService<TOwner>;
+    ownerColumn: "userId" | "teamId";
+    ownerId: ObjectID;
+    resourceIdColumn: string;
+    resourceId: ObjectID;
+    projectId: ObjectID;
+    isOwnerNotified?: boolean | undefined;
+    createdByUserId?: ObjectID | undefined;
+  }): TOwner {
+    const owner: TOwner = new data.ownerService.modelType();
+
+    owner.setColumnValue(data.resourceIdColumn, data.resourceId);
+    owner.setColumnValue("projectId", data.projectId);
+    owner.setColumnValue(data.ownerColumn, data.ownerId);
+
+    if (data.isOwnerNotified !== undefined) {
+      owner.setColumnValue("isOwnerNotified", data.isOwnerNotified);
+    }
+
+    if (data.createdByUserId) {
+      owner.setColumnValue("createdByUserId", data.createdByUserId);
+    }
+
+    return owner;
+  }
 }

package/Server/Utils/SecurityEvent/DetectionRuleEvaluator.ts

@@ -8,13 +8,18 @@ import OcsfSeverity, {
   OcsfSeverityId,
 } from "../../../Types/SecurityEvent/OcsfSeverity";
 import { ocsfCategoryForClassUid } from "../../../Types/SecurityEvent/OcsfEventClass";
-import SigmaRule, { SigmaLevel } from "../../../Types/SecurityEvent/SigmaRule";
+import SigmaRule, {
+  SIGMA_LEVEL_TO_OCSF_SEVERITY,
+  isSevereSigmaLevel,
+} from "../../../Types/SecurityEvent/SigmaRule";
 import {
   DETECTION_DISTINCT_COUNT_ATTRIBUTE,
   DETECTION_FINDING_CLASS_NAME,
   DETECTION_FINDING_CLASS_UID,
   DETECTION_GROUP_VALUE_ATTRIBUTE,
   DETECTION_MATCH_COUNT_ATTRIBUTE,
+  DETECTION_MAX_GROUPS_PER_EVALUATION,
+  DETECTION_MAX_LOOKBACK_IN_MINUTES,
   DETECTION_RULE_ID_ATTRIBUTE,
   DETECTION_RULE_NAME_ATTRIBUTE,
   DETECTION_SIGMA_ID_ATTRIBUTE,
@@ -49,24 +54,6 @@ import { buildSecurityEventDbRow } from "./SecurityEventRow";
 
 const DETECTIONS_SERVICE_NAME: string = "OneUptime Detections";
 
-/*
- * Cap on how far back one evaluation may scan, whatever lastEvaluatedAt
- * says — a rule re-enabled after a month must not trigger a month-long
- * table scan.
- */
-const MAX_LOOKBACK_IN_MINUTES: number = 24 * 60;
-
-// One alert per distinct group value per cycle, at most.
-const MAX_GROUPS_PER_EVALUATION: number = 100;
-
-const SIGMA_LEVEL_TO_OCSF: Record<SigmaLevel, OcsfSeverity> = {
-  [SigmaLevel.Informational]: OcsfSeverity.Informational,
-  [SigmaLevel.Low]: OcsfSeverity.Low,
-  [SigmaLevel.Medium]: OcsfSeverity.Medium,
-  [SigmaLevel.High]: OcsfSeverity.High,
-  [SigmaLevel.Critical]: OcsfSeverity.Critical,
-};
-
 export interface DetectionRuleEvaluationResult {
   ruleId: string;
   matchedGroups: number;
@@ -190,7 +177,7 @@ export default class DetectionRuleEvaluator {
 
     const earliestAllowed: Date = OneUptimeDate.addRemoveMinutes(
       endTime,
-      -MAX_LOOKBACK_IN_MINUTES,
+      -DETECTION_MAX_LOOKBACK_IN_MINUTES,
     );
 
     let startTime: Date = rule.lastEvaluatedAt
@@ -220,7 +207,7 @@ export default class DetectionRuleEvaluator {
         groupByExpression,
         distinctCountExpression,
         minMatchCount: matchCountThreshold,
-        maxGroups: MAX_GROUPS_PER_EVALUATION,
+        maxGroups: DETECTION_MAX_GROUPS_PER_EVALUATION,
       });
 
     /*
@@ -500,7 +487,7 @@ export default class DetectionRuleEvaluator {
     });
 
     const severityName: OcsfSeverity =
-      SIGMA_LEVEL_TO_OCSF[parsedRule.level] || OcsfSeverity.Medium;
+      SIGMA_LEVEL_TO_OCSF_SEVERITY[parsedRule.level] || OcsfSeverity.Medium;
 
     const { categoryUid, categoryName } = ocsfCategoryForClassUid(
       DETECTION_FINDING_CLASS_UID,
@@ -625,7 +612,7 @@ export default class DetectionRuleEvaluator {
       projectId: data.projectId,
       explicitSeverityId: data.rule.alertSeverityId,
       severityLabel: data.parsedRule.level,
-      isSevere: this.isSevereLevel(data.parsedRule.level),
+      isSevere: isSevereSigmaLevel(data.parsedRule.level),
     });
   }
 
@@ -647,11 +634,7 @@ export default class DetectionRuleEvaluator {
       projectId: data.projectId,
       explicitSeverityId: data.rule.incidentSeverityId,
       severityLabel: data.parsedRule.level,
-      isSevere: this.isSevereLevel(data.parsedRule.level),
+      isSevere: isSevereSigmaLevel(data.parsedRule.level),
     });
   }
-
-  private static isSevereLevel(level: SigmaLevel): boolean {
-    return level === SigmaLevel.Critical || level === SigmaLevel.High;
-  }
 }