@oneuptime/common 13.0.7 → 13.0.8

package/Server/Middleware/UserAuthorization.ts

@@ -495,6 +495,49 @@ export default class UserMiddleware {
     req: ExpressRequest,
     res: ExpressResponse,
     next: NextFunction,
+  ): Promise<void> {
+    return await UserMiddleware.resolveRequestUser(req, res, next, {
+      treatInvalidAccessTokenAsAnonymous: false,
+    });
+  }
+
+  /*
+   * getUserMiddleware for the anonymous surfaces: the public dashboard and
+   * public status page routes. Their handlers decide access themselves
+   * (DashboardService / StatusPageService.hasReadAccess: public flag, IP
+   * allowlist, master-password cookie, the page's own session cookie) and
+   * never read the caller's user identity.
+   *
+   * The one difference: an access token that is present but cannot be decoded
+   * makes the request anonymous (UserType.Public) instead of answering 401.
+   * The host-wide dashboard access-token cookie reaches these routes whenever
+   * the page is served from the dashboard's host (the preview routes), and it
+   * can stay in the browser after it stops decoding - an encryption-secret
+   * rotation, say. The public clients cannot refresh a dashboard session, so
+   * that 401 only ever meant "sent back to the login route": a reload loop on
+   * the preview route, and a password prompt for a master password the viewer
+   * already entered.
+   *
+   * A token that does decode is still resolved exactly as getUserMiddleware
+   * resolves it, and an API key is still validated. Never mount this on a
+   * route that needs to know who the caller is.
+   */
+  @CaptureSpan()
+  public static async getPublicRouteUserMiddleware(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> {
+    return await UserMiddleware.resolveRequestUser(req, res, next, {
+      treatInvalidAccessTokenAsAnonymous: true,
+    });
+  }
+
+  private static async resolveRequestUser(
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+    options: { treatInvalidAccessTokenAsAnonymous: boolean },
   ): Promise<void> {
     const tenantId: ObjectID | null = ProjectMiddleware.getProjectId(req);
     const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
@@ -529,6 +572,12 @@ export default class UserMiddleware {
     try {
       oneuptimeRequest.userAuthorization = JSONWebToken.decode(accessToken);
     } catch (err) {
+      if (options.treatInvalidAccessTokenAsAnonymous) {
+        // decode() has already logged why the token was refused.
+        oneuptimeRequest.userType = UserType.Public;
+        return next();
+      }
+
       // if the token is invalid or expired, return 401 so clients can refresh the token.
       logger.error(err, getLogAttributesFromRequest(oneuptimeRequest));
       return Response.sendErrorResponse(
@@ -712,15 +761,12 @@ export default class UserMiddleware {
   ): Promise<void> {
     const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
 
-    if (
-      !oneuptimeRequest.userType ||
-      oneuptimeRequest.userType === UserType.Public
-    ) {
+    if (UserMiddleware.isAnonymousRequest(oneuptimeRequest)) {
       return Response.sendErrorResponse(
         req,
         res,
         new NotAuthenticatedException(
-          "Authentication required. Please log in to access this resource.",
+          UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
         ),
       );
     }
@@ -728,6 +774,19 @@ export default class UserMiddleware {
     return next();
   }
 
+  // Same wording as CommonAPI.AUTHENTICATION_REQUIRED_MESSAGE.
+  public static readonly AUTHENTICATION_REQUIRED_MESSAGE: string =
+    "Authentication required. Please log in to access this resource.";
+
+  /*
+   * The request-level twin of CommonAPI.isAnonymous: getUserMiddleware found
+   * no access token and no API key. Usually an expired session, since the
+   * access-token cookie expires with the JWT inside it.
+   */
+  public static isAnonymousRequest(req: OneUptimeRequest): boolean {
+    return !req.userType || req.userType === UserType.Public;
+  }
+
   public static requirePermission(data: {
     permissions: Array<Permission>;
   }): (
@@ -742,6 +801,21 @@ export default class UserMiddleware {
     ): Promise<void> => {
       const oneuptimeRequest: OneUptimeRequest = req as OneUptimeRequest;
 
+      /*
+       * An anonymous caller has no permissions to compare, and telling it so
+       * with a 422 would stop the browser client from refreshing an expired
+       * session. Ask who it is first.
+       */
+      if (UserMiddleware.isAnonymousRequest(oneuptimeRequest)) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new NotAuthenticatedException(
+            UserMiddleware.AUTHENTICATION_REQUIRED_MESSAGE,
+          ),
+        );
+      }
+
       // Master admins bypass permission checks
       if (oneuptimeRequest.userType === UserType.MasterAdmin) {
         return next();

package/Server/Services/ApiKeyPermissionService.ts

@@ -2,6 +2,7 @@ import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
+import ModelPermission from "../Types/Database/Permissions/Index";
 import UpdateBy from "../Types/Database/UpdateBy";
 import ApiKeyService from "./ApiKeyService";
 import DatabaseService from "./DatabaseService";
@@ -10,7 +11,7 @@ import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
-import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import Exception from "../../Types/Exception/Exception";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
@@ -493,8 +494,27 @@ export class Service extends DatabaseService<Model> {
      */
     this.clearCache();
 
-    const existingPermissions: Array<Model> = await this.findBy({
+    updateBy.query = await ModelPermission.checkUpdateQueryPermissions(
+      Model,
+      updateBy.query,
+      updateBy.data,
+      updateBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: updateBy.query,
+      select: { _id: true },
+      skip: updateBy.skip,
+      limit: updateBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    // Reload by ID so a label filter cannot hide part of a saved block's scope.
+    const existingPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         labels: true,
@@ -503,8 +523,6 @@ export class Service extends DatabaseService<Model> {
         apiKeyId: true,
         permission: true,
       },
-      limit: LIMIT_PER_PROJECT,
-      skip: 0,
       props: {
         isRoot: true,
       },
@@ -565,6 +583,15 @@ export class Service extends DatabaseService<Model> {
       }
 
       await this.assertApiKeyBelongsToProject(apiKeyId, projectId);
+      // Changing a block's permission or labels can restore its old scope.
+      if (existingPermission.isBlockPermission) {
+        this.assertCallerCanGrantPermission({
+          permission: existingPermission.permission!,
+          labels: existingPermission.labels,
+          projectId,
+          props: updateBy.props,
+        });
+      }
       this.assertCallerCanGrantPermission({
         permission,
         labels: isLabelsUpdateRequested
@@ -647,6 +674,8 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    updateBy.query = { ...updateBy.query, _id: QueryHelper.any(selectedIds) };
+    updateBy.skip = 0;
     return { updateBy, carryForward: null };
   }
 
@@ -655,6 +684,74 @@ export class Service extends DatabaseService<Model> {
     deleteBy: DeleteBy<Model>,
   ): Promise<OnDelete<Model>> {
     this.clearCache();
+
+    if (!deleteBy.props.isRoot && !deleteBy.props.isMasterAdmin) {
+      // Hooks run before DatabaseService applies the delete ACL and tenant.
+      deleteBy.query = await ModelPermission.checkDeleteQueryPermission(
+        Model,
+        deleteBy.query,
+        deleteBy.props,
+      );
+      const selectedPermissions: Array<Model> = await this.findAllBy({
+        query: deleteBy.query,
+        select: { _id: true },
+        skip: deleteBy.skip,
+        limit: deleteBy.limit,
+        props: { isRoot: true },
+      });
+      const selectedIds: Array<ObjectID> = selectedPermissions.map(
+        (row: Model) => {
+          return row.id!;
+        },
+      );
+      // A relation filter may select a row, but must not trim its saved labels.
+      const permissions: Array<Model> = await this.findAllBy({
+        query: { _id: QueryHelper.any(selectedIds) },
+        select: {
+          _id: true,
+          projectId: true,
+          permission: true,
+          labels: { _id: true },
+          isBlockPermission: true,
+        },
+        props: { isRoot: true },
+      });
+
+      for (const permission of permissions) {
+        /*
+         * Revoking an allow cannot expand access. Removing a deny can expose
+         * an existing allow, so it requires authority over the entire deny.
+         */
+        if (permission.isBlockPermission) {
+          if (!permission.projectId || !permission.permission) {
+            throw new BadDataException("Invalid API Key permission");
+          }
+          if (
+            !deleteBy.props.tenantId ||
+            deleteBy.props.tenantId.toString() !==
+              permission.projectId.toString()
+          ) {
+            throw new BadDataException("Invalid API Key ID for this project");
+          }
+          this.assertCallerCanGrantPermission({
+            permission: permission.permission,
+            labels: permission.labels,
+            projectId: permission.projectId,
+            props: deleteBy.props,
+          });
+        }
+      }
+
+      /*
+       * Delete exactly the checked page, even when the query matches more
+       * than one batch. The original offset has already been applied.
+       */
+      deleteBy.query = {
+        ...deleteBy.query,
+        _id: QueryHelper.any(selectedIds),
+      };
+      deleteBy.skip = 0;
+    }
     return { deleteBy, carryForward: null };
   }
 

package/Server/Services/DatabaseService.ts

@@ -22,6 +22,8 @@ import {
   OnUpdate,
 } from "../Types/Database/Hooks";
 import ModelPermission from "../Types/Database/Permissions/Index";
+import PublicPermission from "../Types/Database/Permissions/PublicPermission";
+import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import OwnerOnlyColumnPermission from "../Types/Database/Permissions/OwnerOnlyColumnPermission";
 import { CheckReadPermissionType } from "../Types/Database/Permissions/ReadPermission";
 import Query from "../Types/Database/Query";
@@ -57,6 +59,7 @@ import PartialEntity from "../../Types/Database/PartialEntity";
 import { TableColumnMetadata } from "../../Types/Database/TableColumn";
 import TableColumnType from "../../Types/Database/TableColumnType";
 import { getUniqueColumnsBy } from "../../Types/Database/UniqueColumnBy";
+import QueryOperator from "../../Types/BaseDatabase/QueryOperator";
 import OneUptimeDate from "../../Types/Date";
 import Dictionary from "../../Types/Dictionary";
 import BadDataException from "../../Types/Exception/BadDataException";
@@ -96,6 +99,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import type AuditLogServiceType from "./AuditLogService";
 import EnableAuditLogOn from "../../Types/BaseDatabase/EnableAuditLogOn";
 import RelationValueUtil from "../Utils/Database/RelationValueUtil";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 
 const RULE_CRITERIA_RELATION_OPERATORS: ReadonlySet<RuleCriteriaOperator> =
   new Set<RuleCriteriaOperator>([
@@ -295,6 +299,31 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     return data;
   }
 
+  /*
+   * The permission layer's login check, run BEFORE the hooks instead of only
+   * after them.
+   *
+   * The hooks run first, and many of them key off props.userId: a missing one
+   * reads as "userId is required" (400), "User should be logged in" (422), or,
+   * for Project reads, an empty list with a 200. For an anonymous caller that
+   * is almost always a dashboard tab whose access-token cookie expired, and
+   * only a 401 makes the browser client refresh the session and replay the
+   * request. Everything this admits, the permission check would have admitted
+   * too (same condition, same exemptions for API keys and public models), so
+   * it only changes which refusal an anonymous caller gets, and it keeps hooks
+   * with side effects from running for them at all.
+   */
+  private checkIfUserIsLoggedInBeforeHooks(
+    props: DatabaseCommonInteractionProps,
+    type: DatabaseRequestType,
+  ): void {
+    if (props.isRoot || props.isMasterAdmin) {
+      return;
+    }
+
+    PublicPermission.checkIfUserIsLoggedIn(this.modelType, props, type);
+  }
+
   protected async onBeforeCreate(
     createBy: CreateBy<TBaseModel>,
   ): Promise<OnCreate<TBaseModel>> {
@@ -347,6 +376,49 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     }
   }
 
+  /*
+   * Query operators (StartsWith, NotNull, Search, GreaterThan, Includes...)
+   * belong in the `query` of a read/update, never in the `data` of a write.
+   * They can reach create/update data because JSONFunctions.deserialize - run
+   * on every request body while building the model - turns
+   * `{"_type":"StartsWith","value":"a"}` into a real operator instance, and
+   * DatabaseBaseModel._fromJSON assigns it to an id/text column unchanged.
+   *
+   * An operator is never a valid stored value, and leaving one on a write
+   * payload also feeds it to the lookups built from that data - the uniqueness
+   * check here and the findBy/countBy calls in service hooks - where QueryUtil
+   * turns the intended exact comparison into a pattern match, quietly matching
+   * rows the caller never named. Refuse such a write up front instead. JSON
+   * columns are exempt: they legitimately hold arbitrary objects, and their
+   * values are not used to build a query.
+   */
+  private rejectQueryOperatorsInData(
+    data: TBaseModel | PartialEntity<TBaseModel>,
+  ): void {
+    for (const columnName of Object.keys(data)) {
+      const value: unknown = (data as Record<string, unknown>)[columnName];
+
+      if (!(value instanceof QueryOperator)) {
+        continue;
+      }
+
+      if (!this.model.isTableColumn(columnName)) {
+        continue;
+      }
+
+      const metadata: TableColumnMetadata =
+        this.model.getTableColumnMetadata(columnName);
+
+      if (metadata && metadata.type === TableColumnType.JSON) {
+        continue;
+      }
+
+      throw new BadDataException(
+        `Invalid value for ${columnName}. A query operator cannot be used as a value when creating or updating ${this.model.singularName}.`,
+      );
+    }
+  }
+
   /*
    * Rows written before the fix above hold their ciphertext inside that
    * HashedString envelope. Decrypting the envelope itself is not just wrong
@@ -984,6 +1056,107 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       RULE_CRITERIA_LEGACY_NEVER_MATCH_PATTERN;
   }
 
+  /*
+   * A tenant model declares its tenant TWICE: a scalar column (e.g.
+   * `projectId`) AND a ManyToOne relation (`project`) whose @JoinColumn names
+   * that same scalar. Both are separately writable through the public API, and
+   * both land on the entity that reaches getRepository().save()/update().
+   * TypeORM (metadata/ColumnMetadata.js getEntityValue) resolves the relation
+   * object to the join-column value with PRECEDENCE over the scalar, so a
+   * request carrying `project: { _id: <another project> }` is persisted under
+   * THAT project even though create() has just stamped the scalar to
+   * props.tenantId. That is a cross-tenant write of the whole row (reproduced
+   * end to end: the generated INSERT binds `projectId` to the relation's id,
+   * not the stamped scalar).
+   *
+   * The stamped scalar is the authoritative tenant for every non-root write,
+   * and no `project` relation in the schema legitimately points at a project
+   * other than the tenant (every one joins on `projectId`; there is no second,
+   * foreign-project reference to preserve). So neutralize the relation
+   * spelling: reject a tenant relation that points anywhere other than the
+   * request tenant, then delete it so the scalar is the single source of truth
+   * and no TypeORM precedence rule between the two can move the row. This is
+   * the framework-level generalisation of the per-service fixes already
+   * shipped in ApiKeyPermissionService and UserTelegramService.
+   *
+   * Root / master-admin / internal callers are left untouched — they have no
+   * request tenant (props.tenantId is unset) and legitimately set the tenant
+   * relation for another project during seeding, migrations and
+   * invitation-acceptance. This mirrors the create() scalar stamp, which is
+   * likewise gated on props.tenantId.
+   */
+  private enforceTenantRelationMatchesScalar(
+    data: TBaseModel | PartialEntity<TBaseModel>,
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    if (props.isRoot || props.isMasterAdmin) {
+      return;
+    }
+
+    const tenantColumn: string | null = this.model.getTenantColumn();
+
+    if (!tenantColumn || !props.tenantId) {
+      return;
+    }
+
+    const tenantRelationProperty: string | null =
+      this.getTenantRelationProperty(tenantColumn);
+
+    if (!tenantRelationProperty) {
+      /*
+       * e.g. Project itself, whose tenant column is its own `_id`, has no such
+       * relation; global (non-tenant) models return null from getTenantColumn.
+       */
+      return;
+    }
+
+    const suppliedRelation: unknown = (data as Record<string, unknown>)[
+      tenantRelationProperty
+    ];
+
+    if (suppliedRelation === undefined) {
+      return;
+    }
+
+    const relationTenantId: ObjectID | null = RelationIdUtil.read(
+      data as Record<string, unknown>,
+      [tenantRelationProperty],
+    );
+
+    if (
+      relationTenantId &&
+      relationTenantId.toString() !== props.tenantId.toString()
+    ) {
+      throw new BadDataException(
+        `The ${tenantRelationProperty} relation does not belong to this project.`,
+      );
+    }
+
+    delete (data as Record<string, unknown>)[tenantRelationProperty];
+  }
+
+  /*
+   * Property name of the ManyToOne relation that shares the tenant scalar
+   * column as its join column (`project` for the `projectId` tenant column),
+   * or null when the model has no such relation.
+   */
+  private getTenantRelationProperty(tenantColumn: string): string | null {
+    for (const columnName of this.model.getTableColumns().columns) {
+      const metadata: TableColumnMetadata | undefined =
+        this.model.getTableColumnMetadata(columnName);
+
+      if (
+        metadata &&
+        metadata.type === TableColumnType.Entity &&
+        metadata.manyToOneRelationColumn === tenantColumn
+      ) {
+        return columnName;
+      }
+    }
+
+    return null;
+  }
+
   private async sanitizeCreateOrUpdate(
     data: TBaseModel | PartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,
@@ -1368,6 +1541,34 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
   @CaptureSpan()
   public async create(createBy: CreateBy<TBaseModel>): Promise<TBaseModel> {
+    this.checkIfUserIsLoggedInBeforeHooks(
+      createBy.props,
+      DatabaseRequestType.Create,
+    );
+
+    /*
+     * A non-root create must not pin the row's own primary key. save() treats
+     * an entity carrying an existing id as an update of that row rather than an
+     * insert, so a supplied `_id` turns a create into an in-place modification
+     * of a record the caller never named. BaseAPI.createItem already strips it;
+     * this guards every other non-root caller (custom routes, workflow
+     * components) too. Root/internal seeding legitimately assigns ids and is
+     * exempt. Only the top-level primary key is checked - nested relation
+     * `_id`s reference existing related rows and are fine.
+     */
+    if (
+      !createBy.props.isRoot &&
+      !createBy.props.isMasterAdmin &&
+      (createBy.data as TBaseModel)._id
+    ) {
+      throw new BadDataException(
+        `An id cannot be supplied when creating ${this.model.singularName}.`,
+      );
+    }
+
+    // Query operators are for queries, not for write payloads. See the helper.
+    this.rejectQueryOperatorsInData(createBy.data);
+
     this.unwrapHashedStringsForUnhashedColumns(createBy.data);
 
     const onCreate: OnCreate<TBaseModel> = createBy.props.ignoreHooks
@@ -1389,6 +1590,15 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       data.setColumnValue(tenantColumnName, _createdBy.props.tenantId);
     }
 
+    /*
+     * The tenant scalar has just been stamped to the request tenant, but the
+     * matching tenant RELATION object (e.g. `project`) is still whatever the
+     * caller sent, and TypeORM lets that relation override the scalar on the
+     * INSERT. Force the relation to agree with — or be dropped in favour of —
+     * the stamped scalar so a caller cannot write the row into another tenant.
+     */
+    this.enforceTenantRelationMatchesScalar(data, _createdBy.props);
+
     data = this.generateDefaultValues(data);
 
     data = this.checkRequiredFields(data);
@@ -2291,6 +2501,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   @CaptureSpan()
   public async hardDeleteBy(deleteBy: DeleteBy<TBaseModel>): Promise<number> {
     try {
+      this.checkIfUserIsLoggedInBeforeHooks(
+        deleteBy.props,
+        DatabaseRequestType.Delete,
+      );
+
       const onDelete: OnDelete<TBaseModel> = deleteBy.props.ignoreHooks
         ? { deleteBy, carryForward: [] }
         : await this.onBeforeDelete(deleteBy);
@@ -2353,6 +2568,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(deleteBy.props);
 
+      this.checkIfUserIsLoggedInBeforeHooks(
+        deleteBy.props,
+        DatabaseRequestType.Delete,
+      );
+
       if (this.doNotAllowDelete && !deleteBy.props.isRoot) {
         throw new BadDataException("Delete not allowed");
       }
@@ -2587,6 +2807,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(findBy.props);
 
+      this.checkIfUserIsLoggedInBeforeHooks(
+        findBy.props,
+        DatabaseRequestType.Read,
+      );
+
       if (!findBy.sort || Object.keys(findBy.sort).length === 0) {
         findBy.sort = {
           createdAt: SortOrder.Descending,
@@ -2967,8 +3192,28 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(updateBy.props);
 
+      this.checkIfUserIsLoggedInBeforeHooks(
+        updateBy.props,
+        DatabaseRequestType.Update,
+      );
+
       updateBy.data = this.sanitizeUpdateData(updateBy.data);
 
+      // Query operators are for queries, not for write payloads. See the helper.
+      this.rejectQueryOperatorsInData(updateBy.data);
+
+      /*
+       * Defense in depth for the tenant confused-deputy on the update path.
+       * Unlike create(), _updateBy() never re-stamps the tenant scalar, and a
+       * tenant relation object would likewise override the scalar join column
+       * on the UPDATE. Today the tenant columns carry `update: []` so the
+       * column-permission check rejects them first, but that is incidental —
+       * this keeps the row's tenant immutable even if a model ever grants
+       * update on the tenant relation. Runs before the permission check so the
+       * ACL stays a redundant second line rather than the only one.
+       */
+      this.enforceTenantRelationMatchesScalar(updateBy.data, updateBy.props);
+
       this.unwrapHashedStringsForUnhashedColumns(updateBy.data);
 
       const onUpdate: OnUpdate<TBaseModel> = updateBy.props.ignoreHooks

package/Server/Services/DetectionRuleService.ts

@@ -5,6 +5,8 @@ import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import BadDataException from "../../Types/Exception/BadDataException";
 import {
+  DETECTION_EVALUATION_INTERVAL_MAX_IN_MINUTES,
+  DETECTION_EVALUATION_INTERVAL_MIN_IN_MINUTES,
   DETECTION_MATCH_COUNT_THRESHOLD_MAX,
   DETECTION_MATCH_COUNT_THRESHOLD_MIN,
 } from "../../Types/SecurityEvent/DetectionFindingConstants";
@@ -52,10 +54,9 @@ export class Service extends DatabaseService<Model> {
   private validateEvaluationInterval(interval: number | undefined): void {
     this.validateIntegerInRange({
       value: interval,
-      min: 1,
-      max: 1440,
-      message:
-        "Evaluation interval must be a whole number of minutes between 1 and 1440.",
+      min: DETECTION_EVALUATION_INTERVAL_MIN_IN_MINUTES,
+      max: DETECTION_EVALUATION_INTERVAL_MAX_IN_MINUTES,
+      message: `Evaluation interval must be a whole number of minutes between ${DETECTION_EVALUATION_INTERVAL_MIN_IN_MINUTES} and ${DETECTION_EVALUATION_INTERVAL_MAX_IN_MINUTES}.`,
     });
   }