@oneuptime/common 13.0.6 → 13.0.8

package/Server/API/ProjectAPI.ts

@@ -48,6 +48,7 @@ export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
     this.router.put(
       `${new this.entityType().getCrudApiPath()?.toString()}/:id/change-plan`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!IsBillingEnabled) {

package/Server/API/ScheduledMaintenanceAPI.ts

@@ -43,6 +43,7 @@ export default class ScheduledMaintenanceAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/generate-note-from-ai/:scheduledMaintenanceId`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.generateNoteFromAI(req, res);

package/Server/API/StatusPageAPI.ts

@@ -1,4 +1,7 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import PublicDashboardRateLimit, {
+  PublicDashboardRateLimitBucket,
+} from "../Middleware/PublicDashboardRateLimit";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 import AcmeChallengeService from "../Services/AcmeChallengeService";
 import IncidentEpisodeService from "../Services/IncidentEpisodeService";
@@ -28,6 +31,7 @@ import StatusPageService, {
 import StatusPageSsoService from "../Services/StatusPageSsoService";
 import StatusPageOidcService from "../Services/StatusPageOidcService";
 import StatusPageSubscriberService from "../Services/StatusPageSubscriberService";
+import ModelPermission from "../Types/Database/Permissions/Index";
 import Query from "../Types/Database/Query";
 import QueryHelper from "../Types/Database/QueryHelper";
 import Select from "../Types/Database/Select";
@@ -43,8 +47,10 @@ import {
 } from "../../Types/StatusPage/SearchEngineIndexing";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import ArrayUtil from "../../Utils/Array";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import OneUptimeDate from "../../Types/Date";
@@ -52,6 +58,7 @@ import Dictionary from "../../Types/Dictionary";
 import Email from "../../Types/Email";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import { JSONArray, JSONObject } from "../../Types/JSON";
 import JSONFunctions from "../../Types/JSONFunctions";
@@ -193,13 +200,63 @@ export default class StatusPageAPI extends BaseAPI<
     this.overviewResponseInFlight.clear();
   }
 
+  /*
+   * Holding one of StatusPage's update roles is not the same as being allowed
+   * to update a given page: team block rows, label-restricted grants and
+   * Owned-scoped grants all narrow it. Apply the checks a CRUD update of this
+   * page would run - block and label rules against the loaded page, then the
+   * query narrowing (tenant, labels, Owned scope) - and require the page to
+   * survive them. `statusPage` must have been loaded with its labels.
+   */
+  private static async assertCanUpdateStatusPage(data: {
+    statusPage: StatusPage;
+    projectId: ObjectID;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<void> {
+    await ModelPermission.checkUpdatePermissionByModel({
+      modelType: StatusPage,
+      fetchModelWithAccessControlIds: async (): Promise<StatusPage> => {
+        return data.statusPage;
+      },
+      props: data.props,
+    });
+
+    const permittedQuery: Query<StatusPage> =
+      await ModelPermission.checkUpdateQueryPermissions(
+        StatusPage,
+        {
+          _id: data.statusPage.id!,
+          projectId: data.projectId,
+        },
+        {},
+        data.props,
+      );
+
+    const permittedStatusPage: StatusPage | null =
+      await StatusPageService.findOneBy({
+        query: permittedQuery,
+        select: {
+          _id: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    if (!permittedStatusPage) {
+      throw new NotAuthorizedException(
+        "You do not have permission to send this status page's report.",
+      );
+    }
+  }
+
   public constructor() {
     super(StatusPage, StatusPageService);
 
     // get title, description of the page.  This is used for SEO.
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/seo/:statusPageIdOrDomain`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse) => {
         const statusPageIdOrDomain: string = req.params[
           "statusPageIdOrDomain"
@@ -427,7 +484,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/incident-public-note/attachment/:statusPageId/:incidentId/:noteId/:fileId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.getIncidentPublicNoteAttachment(req, res);
@@ -441,7 +498,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/incident-episode-public-note/attachment/:statusPageId/:episodeId/:noteId/:fileId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.getIncidentEpisodePublicNoteAttachment(req, res);
@@ -455,7 +512,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/incident/postmortem/attachment/:statusPageId/:incidentId/:fileId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.getIncidentPostmortemAttachment(req, res);
@@ -469,7 +526,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/scheduled-maintenance-public-note/attachment/:statusPageId/:scheduledMaintenanceId/:noteId/:fileId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.getScheduledMaintenancePublicNoteAttachment(req, res);
@@ -483,7 +540,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/status-page-announcement/attachment/:statusPageId/:announcementId/:fileId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.getStatusPageAnnouncementAttachment(req, res);
@@ -792,16 +849,74 @@ export default class StatusPageAPI extends BaseAPI<
       },
     );
 
+    /*
+     * Sends the status page's report to an address the caller chooses, so it
+     * is gated like editing the status page: an authenticated member of the
+     * project that owns it who could update this particular page.
+     */
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/test-email-report`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
+          /*
+           * This route acts on one page in one project, and the permission
+           * checks below must be evaluated for that single tenant, so the
+           * request is never treated as multi-tenant.
+           */
+          const props: DatabaseCommonInteractionProps = {
+            ...(await CommonAPI.getDatabaseCommonInteractionProps(req)),
+            isMultiTenantRequest: false,
+          };
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+          CommonAPI.assertPermittedInProject({
+            databaseProps: props,
+            allowedPermissions: new StatusPage().getUpdatePermissions(),
+            errorMessage:
+              "You do not have permission to send this status page's report.",
+          });
+
+          if (
+            !req.body["statusPageId"] ||
+            !ObjectID.isValidUUID(req.body["statusPageId"].toString())
+          ) {
+            throw new BadDataException("A valid statusPageId is required.");
+          }
+
           const email: Email = new Email(req.body["email"] as string);
           const statusPageId: ObjectID = new ObjectID(
             req.body["statusPageId"].toString() as string,
           );
 
+          const statusPage: StatusPage | null =
+            await StatusPageService.findOneById({
+              id: statusPageId,
+              select: {
+                _id: true,
+                projectId: true,
+                labels: {
+                  _id: true,
+                  name: true,
+                },
+              },
+              props: {
+                isRoot: true,
+              },
+            });
+
+          CommonAPI.assertResourceBelongsToProject({
+            resourceProjectId: statusPage?.projectId,
+            projectId,
+          });
+
+          await StatusPageAPI.assertCanUpdateStatusPage({
+            statusPage: statusPage!,
+            projectId,
+            props,
+          });
+
           await StatusPageService.sendEmailReport({
             email: email,
             statusPageId,
@@ -816,7 +931,7 @@ export default class StatusPageAPI extends BaseAPI<
 
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/domain`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!req.body["domain"]) {
@@ -860,7 +975,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/master-page/:statusPageId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const statusPageIdParam: string = req.params[
@@ -1029,11 +1144,21 @@ export default class StatusPageAPI extends BaseAPI<
       },
     );
 
+    /*
+     * Every request here runs a scrypt verify, so the route carries a
+     * password attempt limit, the same one the dashboard master password
+     * route uses but with its own counters. It runs ahead of UserMiddleware so
+     * a refused attempt costs neither a session lookup nor a hash. See
+     * PublicDashboardRateLimit for the budget and why it fails closed.
+     */
     this.router.post(
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/master-password/:statusPageId`,
-      UserMiddleware.getUserMiddleware,
+      PublicDashboardRateLimit.getMiddleware(
+        PublicDashboardRateLimitBucket.StatusPageMasterPassword,
+      ),
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           if (!req.params["statusPageId"]) {
@@ -1107,7 +1232,7 @@ export default class StatusPageAPI extends BaseAPI<
 
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/sso/:statusPageId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const objectId: ObjectID = new ObjectID(
@@ -1147,7 +1272,7 @@ export default class StatusPageAPI extends BaseAPI<
 
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/oidc/:statusPageId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const objectId: ObjectID = new ObjectID(
@@ -1190,7 +1315,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/resources/:statusPageId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const statusPageId: ObjectID = new ObjectID(
@@ -1241,7 +1366,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/uptime/:statusPageId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           // This reosurce ID can be of a status page resource OR a status page group.
@@ -1685,7 +1810,7 @@ export default class StatusPageAPI extends BaseAPI<
 
     this.router.post(
       overviewApiPath,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       overviewHandler,
     );
 
@@ -1696,7 +1821,7 @@ export default class StatusPageAPI extends BaseAPI<
      */
     this.router.get(
       overviewApiPath,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       overviewHandler,
     );
 
@@ -1704,7 +1829,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/update-subscription/:statusPageId/:subscriberId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.subscribeToStatusPage(req);
@@ -1719,7 +1844,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/get-subscription/:statusPageId/:subscriberId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const subscriber: StatusPageSubscriber =
@@ -1741,7 +1866,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/subscribe/:statusPageId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.subscribeToStatusPage(req);
@@ -1757,7 +1882,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/manage-subscription/:statusPageId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           await this.manageExistingSubscription(req);
@@ -1808,13 +1933,13 @@ export default class StatusPageAPI extends BaseAPI<
 
     this.router.post(
       incidentsListApiPath,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       incidentsListHandler,
     );
 
     this.router.get(
       incidentsListApiPath,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       incidentsListHandler,
     );
 
@@ -1859,13 +1984,13 @@ export default class StatusPageAPI extends BaseAPI<
 
     this.router.post(
       scheduledMaintenanceEventsListApiPath,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       scheduledMaintenanceEventsListHandler,
     );
 
     this.router.get(
       scheduledMaintenanceEventsListApiPath,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       scheduledMaintenanceEventsListHandler,
     );
 
@@ -1909,13 +2034,13 @@ export default class StatusPageAPI extends BaseAPI<
 
     this.router.post(
       announcementsListApiPath,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       announcementsListHandler,
     );
 
     this.router.get(
       announcementsListApiPath,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       announcementsListHandler,
     );
 
@@ -1923,7 +2048,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/incidents/:statusPageIdOrDomain/:incidentId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const objectId: ObjectID = await resolveStatusPageIdOrThrow(
@@ -1951,7 +2076,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain/:scheduledMaintenanceId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const objectId: ObjectID = await resolveStatusPageIdOrThrow(
@@ -1980,7 +2105,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/announcements/:statusPageIdOrDomain/:announcementId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const objectId: ObjectID = await resolveStatusPageIdOrThrow(
@@ -2010,7 +2135,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/episodes/:statusPageIdOrDomain`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const objectId: ObjectID = await resolveStatusPageIdOrThrow(
@@ -2034,7 +2159,7 @@ export default class StatusPageAPI extends BaseAPI<
       `${new this.entityType()
         .getCrudApiPath()
         ?.toString()}/episodes/:statusPageIdOrDomain/:episodeId`,
-      UserMiddleware.getUserMiddleware,
+      UserMiddleware.getPublicRouteUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const objectId: ObjectID = await resolveStatusPageIdOrThrow(
@@ -3495,6 +3620,23 @@ export default class StatusPageAPI extends BaseAPI<
     return statusPageSubscriber;
   }
 
+  private serializeIncidentsForStatusPage(
+    incidents: Array<Incident>,
+  ): JSONArray {
+    return incidents.map((incident: Incident): JSONObject => {
+      const incidentJson: JSONObject = BaseModel.toJSON(incident, Incident);
+
+      // Enforce postmortem visibility before sending or caching status-page JSON.
+      if (incident.showPostmortemOnStatusPage !== true) {
+        delete incidentJson["postmortemNote"];
+        delete incidentJson["postmortemPostedAt"];
+        delete incidentJson["postmortemAttachments"];
+      }
+
+      return incidentJson;
+    });
+  }
+
   @CaptureSpan()
   public async getIncidents(
     statusPageId: ObjectID,
@@ -3758,7 +3900,7 @@ export default class StatusPageAPI extends BaseAPI<
         IncidentPublicNote,
       ),
       incidentStates: BaseModel.toJSONArray(incidentStates, IncidentState),
-      incidents: BaseModel.toJSONArray(incidents, Incident),
+      incidents: this.serializeIncidentsForStatusPage(incidents),
       statusPageResources: BaseModel.toJSONArray(
         statusPageResources,
         StatusPageResource,
@@ -5361,7 +5503,7 @@ export default class StatusPageAPI extends BaseAPI<
         IncidentPublicNote,
       ),
 
-      activeIncidents: BaseModel.toJSONArray(activeIncidents, Incident),
+      activeIncidents: this.serializeIncidentsForStatusPage(activeIncidents),
 
       activeEpisodes: activeEpisodesJson,
       episodePublicNotes: BaseModel.toJSONArray(

package/Server/API/TeamMemberAPI.ts

@@ -39,6 +39,7 @@ export default class TeamMemberAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/is-user-registered`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const oneUptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
@@ -103,6 +104,7 @@ export default class TeamMemberAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/remove-user-from-project`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const oneUptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
@@ -165,6 +167,7 @@ export default class TeamMemberAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/:id/leave`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const oneUptimeRequest: OneUptimeRequest = req as OneUptimeRequest;

package/Server/API/UserCallAPI.ts

@@ -49,6 +49,7 @@ export default class UserCallAPI extends BaseAPI<
     this.router.post(
       `/user-call/verify`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Verify,
       ),
@@ -127,6 +128,7 @@ export default class UserCallAPI extends BaseAPI<
     this.router.post(
       `/user-call/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Resend,
       ),

package/Server/API/UserEmailAPI.ts

@@ -49,6 +49,7 @@ export default class UserEmailAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verify`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Verify,
       ),
@@ -129,6 +130,7 @@ export default class UserEmailAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Resend,
       ),

package/Server/API/UserIncomingCallNumberAPI.ts

@@ -47,6 +47,7 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
     this.router.post(
       `/user-incoming-call-number/verify`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Verify,
       ),
@@ -107,6 +108,7 @@ export default class UserIncomingCallNumberAPI extends BaseAPI<
     this.router.post(
       `/user-incoming-call-number/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Resend,
       ),

package/Server/API/UserMicrosoftTeamsAPI.ts

@@ -32,6 +32,7 @@ export default class UserMicrosoftTeamsAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/test`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;

package/Server/API/UserSlackAPI.ts

@@ -31,6 +31,7 @@ export default class UserSlackAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/test`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;

package/Server/API/UserSmsAPI.ts

@@ -46,6 +46,7 @@ export default class UserSMSAPI extends BaseAPI<UserSMS, UserSMSServiceType> {
     this.router.post(
       `/user-sms/verify`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Verify,
       ),
@@ -124,6 +125,7 @@ export default class UserSMSAPI extends BaseAPI<UserSMS, UserSMSServiceType> {
     this.router.post(
       `/user-sms/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Resend,
       ),

package/Server/API/UserTotpAuthAPI.ts

@@ -31,6 +31,7 @@ export default class UserTotpAuthAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/validate`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const userTotpAuth: UserTotpAuth | null =

package/Server/API/UserWebAuthnAPI.ts

@@ -34,6 +34,7 @@ export default class UserWebAuthnAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/generate-registration-options`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const userId: ObjectID = (req as OneUptimeRequest).userAuthorization!
@@ -55,6 +56,7 @@ export default class UserWebAuthnAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verify-registration`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           const data: JSONObject = req.body;

package/Server/API/UserWebhookAPI.ts

@@ -26,6 +26,7 @@ export default class UserWebhookAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/test`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;

package/Server/API/UserWhatsAppAPI.ts

@@ -49,6 +49,7 @@ export default class UserWhatsAppAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verify`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Verify,
       ),
@@ -129,6 +130,7 @@ export default class UserWhatsAppAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       VerificationCodeRateLimit.getMiddleware(
         VerificationCodeRateLimitBucket.Resend,
       ),

package/Server/Infrastructure/Postgres/LocalMigrationGenerationDataSource.ts

@@ -7,7 +7,7 @@ import { DataSource } from "typeorm";
  * localhost:5400 — hence the defaults below.
  *
  * DATABASE_MIGRATIONS_HOST / DATABASE_MIGRATIONS_PORT (already in
- * config.example.env, already honoured by migration-run.sh) override them, so
+ * config.example.env) override them, so
  * the schema-drift job can point this at a CI service container on a different
  * port without editing the file.
  */