@oneuptime/common 13.0.6 → 13.0.8

package/Server/Middleware/UserAuthorization.ts

@@ -495,6 +495,49 @@ export default class UserMiddleware {
     req: ExpressRequest,
     res: ExpressResponse,
     next: NextFunction,
+  ): Promise<void> {
+    return await UserMiddleware.resolveRequestUser(req, res, next, {
+      treatInvalidAccessTokenAsAnonymous: false,
+    });
+  }
+
+  /*
+   * getUserMiddleware for the anonymous surfaces: the public dashboard and
+   * public status page routes. Their handlers decide access themselves
+   * (DashboardService / StatusPageService.hasReadAccess: public flag, IP
+   * allowlist, master-password cookie, the page's own session cookie) and
+   * never read the caller's user identity.
+   *
+   * The one difference: an access token that is present but cannot be decoded
+   * makes the request anonymous (UserType.Public) instead of answering 401.
+   * The host-wide dashboard access-token cookie reaches these routes whenever
+   * the page is served from the dashboard's host (the preview routes), and it
+   * can stay in the browser after it stops decoding - an encryption-secret
+   * rotation, say. The public clients cannot refresh a dashboard session, so
+   * that 401 only ever meant "sent back to the login route": a reload loop on
+   * the preview route, and a password prompt for a master password the viewer
+   * already entered.
+   *
+   * A token that does decode is still resolved exactly as getUserMiddleware
+   * resolves it, and an API key is still validated. Never mount this on a
+   * route that needs to know who the caller is.
+   */
+  @CaptureSpan()
+  public static async getPublicRouteUserMiddleware(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> {
+    return await UserMiddleware.resolveRequestUser(req, res, next, {
+      treatInvalidAccessTokenAsAnonymous: true,
+    });
+  }
+
+  private static async resolveRequestUser(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+    options: { treatInvalidAccessTokenAsAnonymous: boolean },
   ): Promise<void> {
     const tenantId: ObjectID | null = ProjectMiddleware.getProjectId(req);
     const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
@@ -529,6 +572,12 @@ export default class UserMiddleware {
     try {
       oneuptimeRequest.userAuthorization = JSONWebToken.decode(accessToken);
     } catch (err) {
+      if (options.treatInvalidAccessTokenAsAnonymous) {
+        // decode() has already logged why the token was refused.
+        oneuptimeRequest.userType = UserType.Public;
+        return next();
+      }
+
       // if the token is invalid or expired, return 401 so clients can refresh the token.
       logger.error(err, getLogAttributesFromRequest(oneuptimeRequest));
       return Response.sendErrorResponse(
@@ -712,15 +761,12 @@ export default class UserMiddleware {
   ): Promise<void> {
     const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
 
-    if (
-      !oneuptimeRequest.userType ||
-      oneuptimeRequest.userType === UserType.Public
-    ) {
+    if (UserMiddleware.isAnonymousRequest(oneuptimeRequest)) {
       return Response.sendErrorResponse(
         req,
         res,
         new NotAuthenticatedException(
-          "Authentication required. Please log in to access this resource.",
+          UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
         ),
       );
     }
@@ -728,6 +774,19 @@ export default class UserMiddleware {
     return next();
   }
 
+  // Same wording as CommonAPI.AUTHENTICATION_REQUIRED_MESSAGE.
+  public static readonly AUTHENTICATION_REQUIRED_MESSAGE: string =
+    "Authentication required. Please log in to access this resource.";
+
+  /*
+   * The request-level twin of CommonAPI.isAnonymous: getUserMiddleware found
+   * no access token and no API key. Usually an expired session, since the
+   * access-token cookie expires with the JWT inside it.
+   */
+  public static isAnonymousRequest(req: OneUptimeRequest): boolean {
+    return !req.userType || req.userType === UserType.Public;
+  }
+
   public static requirePermission(data: {
     permissions: Array<Permission>;
   }): (
@@ -742,6 +801,21 @@ export default class UserMiddleware {
     ): Promise<void> => {
       const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
 
+      /*
+       * An anonymous caller has no permissions to compare, and telling it so
+       * with a 422 would stop the browser client from refreshing an expired
+       * session. Ask who it is first.
+       */
+      if (UserMiddleware.isAnonymousRequest(oneuptimeRequest)) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new NotAuthenticatedException(
+            UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+          ),
+        );
+      }
+
       // Master admins bypass permission checks
       if (oneuptimeRequest.userType === UserType.MasterAdmin) {
         return next();

package/Server/Services/AlertEpisodeService.ts

@@ -47,8 +47,8 @@ import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import NotificationRuleWorkspaceChannel from "../../Types/Workspace/NotificationRules/NotificationRuleWorkspaceChannel";
 import WorkspaceType from "../../Types/Workspace/WorkspaceType";
 import AlertEpisodeWorkspaceMessages from "../Utils/Workspace/WorkspaceMessages/AlertEpisode";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import { MessageBlocksByWorkspaceType } from "./WorkspaceNotificationRuleService";
-import Typeof from "../../Types/Typeof";
 import AlertService from "./AlertService";
 import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import AlertEpisodeLabelRuleEngineService from "./AlertEpisodeLabelRuleEngineService";
@@ -1277,39 +1277,18 @@ export class Service extends DatabaseService<Model> {
     notifyOwners: boolean,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: AlertEpisodeOwnerTeam = new AlertEpisodeOwnerTeam();
-      teamOwner.alertEpisodeId = episodeId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-
-      await AlertEpisodeOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-
-      const userOwner: AlertEpisodeOwnerUser = new AlertEpisodeOwnerUser();
-      userOwner.alertEpisodeId = episodeId;
-      userOwner.projectId = projectId;
-      userOwner.userId = userId;
-      userOwner.isOwnerNotified = !notifyOwners;
-
-      await AlertEpisodeOwnerUserService.create({
-        data: userOwner,
-        props: props,
-      });
-    }
+    // Owners already on the episode are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: AlertEpisodeOwnerUserService,
+      ownerTeamService: AlertEpisodeOwnerTeamService,
+      resourceIdColumn: "alertEpisodeId",
+      resourceId: episodeId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      isOwnerNotified: !notifyOwners,
+      props: props,
+    });
   }
 }
 

package/Server/Services/AlertGroupingEngineService.ts

@@ -12,6 +12,7 @@ import Monitor from "../../Models/DatabaseModels/Monitor";
 import AlertSeverity from "../../Models/DatabaseModels/AlertSeverity";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import OneUptimeDate from "../../Types/Date";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -846,8 +847,9 @@ class AlertGroupingEngineServiceClass {
             ownerUser.projectId = alert.projectId!;
             ownerUser.alertEpisodeId = createdEpisode.id;
             ownerUser.userId = user.id;
-            await AlertEpisodeOwnerUserService.create({
-              data: ownerUser,
+            await OwnerRuleAssignment.createOwner({
+              ownerService: AlertEpisodeOwnerUserService,
+              owner: ownerUser,
               props: {
                 isRoot: true,
               },
@@ -877,8 +879,9 @@ class AlertGroupingEngineServiceClass {
             ownerTeam.projectId = alert.projectId!;
             ownerTeam.alertEpisodeId = createdEpisode.id;
             ownerTeam.teamId = team.id;
-            await AlertEpisodeOwnerTeamService.create({
-              data: ownerTeam,
+            await OwnerRuleAssignment.createOwner({
+              ownerService: AlertEpisodeOwnerTeamService,
+              owner: ownerTeam,
               props: {
                 isRoot: true,
               },

package/Server/Services/AlertService.ts

@@ -28,7 +28,6 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import PositiveNumber from "../../Types/PositiveNumber";
-import Typeof from "../../Types/Typeof";
 import UserNotificationEventType from "../../Types/UserNotification/UserNotificationEventType";
 import Model from "../../Models/DatabaseModels/Alert";
 import AlertOwnerTeam from "../../Models/DatabaseModels/AlertOwnerTeam";
@@ -82,6 +81,7 @@ import AlertOwnerRuleEngineService from "./AlertOwnerRuleEngineService";
 import RunbookRuleEngineService from "./RunbookRuleEngineService";
 import AutoRemediationRuleEngineService from "./AutoRemediationRuleEngineService";
 import AIAlertInvestigationRunner from "../Utils/AI/SRE/AlertInvestigationRunner";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import AlertPrivacyRuleEngineService from "./AlertPrivacyRuleEngineService";
 import ProjectService from "./ProjectService";
 
@@ -1264,37 +1264,18 @@ ${alert.remediationNotes || "No remediation notes provided."}
     notifyOwners: boolean,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: AlertOwnerTeam = new AlertOwnerTeam();
-      teamOwner.alertId = alertId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-
-      await AlertOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: AlertOwnerUser = new AlertOwnerUser();
-      teamOwner.alertId = alertId;
-      teamOwner.projectId = projectId;
-      teamOwner.userId = userId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-      await AlertOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the alert are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: AlertOwnerUserService,
+      ownerTeamService: AlertOwnerTeamService,
+      resourceIdColumn: "alertId",
+      resourceId: alertId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      isOwnerNotified: !notifyOwners,
+      props: props,
+    });
   }
 
   @CaptureSpan()

package/Server/Services/ApiKeyPermissionService.ts

@@ -2,6 +2,7 @@ import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
+import ModelPermission from "../Types/Database/Permissions/Index";
 import UpdateBy from "../Types/Database/UpdateBy";
 import ApiKeyService from "./ApiKeyService";
 import DatabaseService from "./DatabaseService";
@@ -10,7 +11,7 @@ import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
-import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Exception from "../../Types/Exception/Exception";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
@@ -493,8 +494,27 @@ export class Service extends DatabaseService<Model> {
      */
     this.clearCache();
 
-    const existingPermissions: Array<Model> = await this.findBy({
+    updateBy.query = await ModelPermission.checkUpdateQueryPermissions(
+      Model,
+      updateBy.query,
+      updateBy.data,
+      updateBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: updateBy.query,
+      select: { _id: true },
+      skip: updateBy.skip,
+      limit: updateBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    // Reload by ID so a label filter cannot hide part of a saved block's scope.
+    const existingPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         labels: true,
@@ -503,8 +523,6 @@ export class Service extends DatabaseService<Model> {
         apiKeyId: true,
         permission: true,
       },
-      limit: LIMIT_PER_PROJECT,
-      skip: 0,
       props: {
         isRoot: true,
       },
@@ -565,6 +583,15 @@ export class Service extends DatabaseService<Model> {
       }
 
       await this.assertApiKeyBelongsToProject(apiKeyId, projectId);
+      // Changing a block's permission or labels can restore its old scope.
+      if (existingPermission.isBlockPermission) {
+        this.assertCallerCanGrantPermission({
+          permission: existingPermission.permission!,
+          labels: existingPermission.labels,
+          projectId,
+          props: updateBy.props,
+        });
+      }
       this.assertCallerCanGrantPermission({
         permission,
         labels: isLabelsUpdateRequested
@@ -647,6 +674,8 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    updateBy.query = { ...updateBy.query, _id: QueryHelper.any(selectedIds) };
+    updateBy.skip = 0;
     return { updateBy, carryForward: null };
   }
 
@@ -655,6 +684,74 @@ export class Service extends DatabaseService<Model> {
     deleteBy: DeleteBy<Model>,
   ): Promise<OnDelete<Model>> {
     this.clearCache();
+
+    if (!deleteBy.props.isRoot && !deleteBy.props.isMasterAdmin) {
+      // Hooks run before DatabaseService applies the delete ACL and tenant.
+      deleteBy.query = await ModelPermission.checkDeleteQueryPermission(
+        Model,
+        deleteBy.query,
+        deleteBy.props,
+      );
+      const selectedPermissions: Array<Model> = await this.findAllBy({
+        query: deleteBy.query,
+        select: { _id: true },
+        skip: deleteBy.skip,
+        limit: deleteBy.limit,
+        props: { isRoot: true },
+      });
+      const selectedIds: Array<ObjectID> = selectedPermissions.map(
+        (row: Model) => {
+          return row.id!;
+        },
+      );
+      // A relation filter may select a row, but must not trim its saved labels.
+      const permissions: Array<Model> = await this.findAllBy({
+        query: { _id: QueryHelper.any(selectedIds) },
+        select: {
+          _id: true,
+          projectId: true,
+          permission: true,
+          labels: { _id: true },
+          isBlockPermission: true,
+        },
+        props: { isRoot: true },
+      });
+
+      for (const permission of permissions) {
+        /*
+         * Revoking an allow cannot expand access. Removing a deny can expose
+         * an existing allow, so it requires authority over the entire deny.
+         */
+        if (permission.isBlockPermission) {
+          if (!permission.projectId || !permission.permission) {
+            throw new BadDataException("Invalid API Key permission");
+          }
+          if (
+            !deleteBy.props.tenantId ||
+            deleteBy.props.tenantId.toString() !==
+              permission.projectId.toString()
+          ) {
+            throw new BadDataException("Invalid API Key ID for this project");
+          }
+          this.assertCallerCanGrantPermission({
+            permission: permission.permission,
+            labels: permission.labels,
+            projectId: permission.projectId,
+            props: deleteBy.props,
+          });
+        }
+      }
+
+      /*
+       * Delete exactly the checked page, even when the query matches more
+       * than one batch. The original offset has already been applied.
+       */
+      deleteBy.query = {
+        ...deleteBy.query,
+        _id: QueryHelper.any(selectedIds),
+      };
+      deleteBy.skip = 0;
+    }
     return { deleteBy, carryForward: null };
   }
 

package/Server/Services/CephClusterOwnerRuleEngineService.ts

@@ -248,11 +248,15 @@ class CephClusterOwnerRuleEngineServiceClass
         owner.projectId = cephCluster.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await CephClusterOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: CephClusterOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -261,11 +265,15 @@ class CephClusterOwnerRuleEngineServiceClass
         owner.projectId = cephCluster.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await CephClusterOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: CephClusterOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/CloudResourceOwnerRuleEngineService.ts

@@ -251,11 +251,15 @@ class CloudResourceOwnerRuleEngineServiceClass
         owner.projectId = cloudResource.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await CloudResourceOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: CloudResourceOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -264,11 +268,15 @@ class CloudResourceOwnerRuleEngineServiceClass
         owner.projectId = cloudResource.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await CloudResourceOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: CloudResourceOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/DashboardOwnerRuleEngineService.ts

@@ -243,11 +243,15 @@ class DashboardOwnerRuleEngineServiceClass
         owner.projectId = dashboard.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await DashboardOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: DashboardOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -256,11 +260,15 @@ class DashboardOwnerRuleEngineServiceClass
         owner.projectId = dashboard.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await DashboardOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: DashboardOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }