@oneuptime/common 13.0.7 → 13.0.8

package/Server/Services/RumSessionPinService.ts

@@ -1,10 +1,17 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/RumSessionPin";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
+import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import CreateBy from "../Types/Database/CreateBy";
 import { OnCreate } from "../Types/Database/Hooks";
+import CreatePermission from "../Types/Database/Permissions/CreatePermission";
+import ReadPermission from "../Types/Database/Permissions/ReadPermission";
+import TablePermission from "../Types/Database/Permissions/TablePermission";
 import QueryHelper from "../Types/Database/QueryHelper";
 import PostgresErrorTranslator from "../Utils/Database/PostgresErrorTranslator";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -24,6 +31,62 @@ const isUniqueViolation: IsUniqueViolationFunction = (
   return PostgresErrorTranslator.isUniqueViolation(error);
 };
 
+/* What the unique index keys a pin on. */
+interface PinKey {
+  projectId: ObjectID;
+  rumApplicationId: ObjectID;
+  sessionId: string;
+}
+
+type IsSameIdFunction = (a: ObjectID, b: ObjectID) => boolean;
+
+/*
+ * ObjectID.equals compares the strings as given, but a UUID is the same
+ * project in any case - and the tenant an API key resolves to comes back
+ * from Postgres in lower case whatever the client typed.
+ */
+const isSameId: IsSameIdFunction = (a: ObjectID, b: ObjectID): boolean => {
+  return a.toString().toLowerCase() === b.toString().toLowerCase();
+};
+
+type ToPlainIdFunction = (
+  value: unknown,
+  field: string,
+) => ObjectID | undefined;
+
+/*
+ * An id from the request body as a plain ObjectID. The body is deserialized
+ * generically, so a field typed as an id can arrive as some other object.
+ */
+const toPlainId: ToPlainIdFunction = (
+  value: unknown,
+  field: string,
+): ObjectID | undefined => {
+  if (value === undefined || value === null) {
+    return undefined;
+  }
+
+  if (value instanceof ObjectID || typeof value === "string") {
+    const id: string = value.toString();
+
+    if (ObjectID.isValidUUID(id)) {
+      return new ObjectID(id);
+    }
+  }
+
+  throw new BadDataException(`${field} must be an ID.`);
+};
+
+type IsInternalCallerFunction = (
+  props: DatabaseCommonInteractionProps,
+) => boolean;
+
+const isInternalCaller: IsInternalCallerFunction = (
+  props: DatabaseCommonInteractionProps,
+): boolean => {
+  return Boolean(props.isRoot || props.isMasterAdmin);
+};
+
 /*
  * Pins that keep a session recording past its retention window.
  *
@@ -88,27 +151,36 @@ export class Service extends DatabaseService<Model> {
    *
    * The pre-check handles the common case and the catch closes the race
    * between two concurrent pins of the same session.
+   *
+   * Both lookups read as root, so neither may run until the caller has
+   * passed the create check that super.create would otherwise have been the
+   * first to apply, and what they find is handed back only as far as the
+   * caller could have read it.
    */
   @CaptureSpan()
   public override async create(createBy: CreateBy<Model>): Promise<Model> {
-    const projectId: ObjectID | undefined = createBy.data.projectId;
-    const rumApplicationId: ObjectID | undefined =
-      createBy.data.rumApplicationId;
-    const sessionId: string | undefined = createBy.data.sessionId;
+    this.assertCallerMayCreatePins(createBy.props);
 
-    if (!projectId || !rumApplicationId || !sessionId) {
+    if (!isInternalCaller(createBy.props)) {
+      /* The database keeps these for itself; a request does not set them. */
+      delete createBy.data._id;
+      delete createBy.data.createdAt;
+      delete createBy.data.updatedAt;
+      delete createBy.data.deletedAt;
+      delete createBy.data.version;
+    }
+
+    const pinKey: PinKey | null = this.resolvePinKey(createBy);
+
+    if (!pinKey) {
       /* Let onBeforeCreate produce the specific validation message. */
       return await super.create(createBy);
     }
 
-    const existingPin: Model | null = await this.getPinForSession({
-      projectId: projectId,
-      rumApplicationId: rumApplicationId,
-      sessionId: sessionId,
-    });
+    const existingPin: Model | null = await this.getPinForSession(pinKey);
 
     if (existingPin) {
-      return existingPin;
+      return await this.presentExistingPin(existingPin, pinKey, createBy.props);
     }
 
     try {
@@ -118,27 +190,204 @@ export class Service extends DatabaseService<Model> {
         throw err;
       }
 
-      const racedPin: Model | null = await this.getPinForSession({
-        projectId: projectId,
-        rumApplicationId: rumApplicationId,
-        sessionId: sessionId,
-      });
+      const racedPin: Model | null = await this.getPinForSession(pinKey);
 
       if (racedPin) {
-        return racedPin;
+        return await this.presentExistingPin(racedPin, pinKey, createBy.props);
+      }
+
+      throw err;
+    }
+  }
+
+  /*
+   * The table half of ModelPermission.checkCreatePermissions: signed in or
+   * holding an API key, and granted something on the model's create list in
+   * the tenant. The column half stays with super.create, which runs it after
+   * onBeforeCreate has stripped the fields it rewrites; the idempotent path
+   * writes no columns for it to judge.
+   */
+  private assertCallerMayCreatePins(
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    if (isInternalCaller(props)) {
+      return;
+    }
+
+    CreatePermission.checkCreateBlockPermissions(Model, props);
+
+    TablePermission.checkTableLevelPermissions(
+      Model,
+      props,
+      DatabaseRequestType.Create,
+    );
+  }
+
+  /*
+   * The (projectId, rumApplicationId, sessionId) this request would insert,
+   * which is therefore what both lookups must search - or null when a part
+   * is missing, so that onBeforeCreate can say which. The lookups are
+   * queries, so every part has to be a plain id or string.
+   *
+   * projectId is the one super.create will write: the caller's tenant when
+   * there is one, otherwise the projectId an internal caller passed. A
+   * request naming any other project is refused, because the caller's
+   * grants were checked in the tenant and nowhere else; internal callers
+   * keep DatabaseService's rule that the tenant replaces it.
+   *
+   * The project and the application can also be named through the `project`
+   * and `rumApplication` relations. Each shares its scalar's column and wins
+   * over it when TypeORM saves, so a relation that disagrees is refused and
+   * both are dropped, leaving the scalars as the only thing saved.
+   */
+  private resolvePinKey(createBy: CreateBy<Model>): PinKey | null {
+    const props: DatabaseCommonInteractionProps = createBy.props;
+    const isInternal: boolean = isInternalCaller(props);
+
+    const claimedProjectId: ObjectID | undefined = toPlainId(
+      createBy.data.projectId,
+      "projectId",
+    );
+    const rumApplicationId: ObjectID | undefined = toPlainId(
+      createBy.data.rumApplicationId,
+      "rumApplicationId",
+    );
+
+    const rawSessionId: unknown = createBy.data.sessionId;
+
+    if (
+      rawSessionId !== undefined &&
+      rawSessionId !== null &&
+      typeof rawSessionId !== "string"
+    ) {
+      throw new BadDataException("sessionId must be a string.");
+    }
+
+    const sessionId: string | undefined =
+      typeof rawSessionId === "string" ? rawSessionId : undefined;
+
+    const projectRelationId: ObjectID | undefined = toPlainId(
+      createBy.data.project?._id,
+      "project",
+    );
+    const applicationRelationId: ObjectID | undefined = toPlainId(
+      createBy.data.rumApplication?._id,
+      "rumApplication",
+    );
+
+    delete createBy.data.project;
+    delete createBy.data.rumApplication;
+
+    const projectId: ObjectID | undefined = isInternal
+      ? props.tenantId || claimedProjectId
+      : props.tenantId;
+
+    const projectClaims: Array<ObjectID> = [];
+
+    if (projectRelationId) {
+      projectClaims.push(projectRelationId);
+    }
+
+    if (claimedProjectId && !isInternal) {
+      projectClaims.push(claimedProjectId);
+    }
+
+    for (const projectClaim of projectClaims) {
+      if (!projectId || !isSameId(projectClaim, projectId)) {
+        throw isInternal
+          ? new BadDataException("project does not match projectId.")
+          : new NotAuthorizedException(
+              "You are not authorized to pin recordings in this project.",
+            );
+      }
+    }
+
+    if (
+      applicationRelationId &&
+      !(rumApplicationId && isSameId(applicationRelationId, rumApplicationId))
+    ) {
+      throw new BadDataException(
+        "rumApplication does not match rumApplicationId.",
+      );
+    }
+
+    if (!claimedProjectId || !projectId || !rumApplicationId || !sessionId) {
+      return null;
+    }
+
+    createBy.data.projectId = projectId;
+    createBy.data.rumApplicationId = rumApplicationId;
+
+    return {
+      projectId: projectId,
+      rumApplicationId: rumApplicationId,
+      sessionId: sessionId,
+    };
+  }
+
+  /*
+   * An existing pin was read as root, and passing the create check says
+   * nothing about reading it: CreateRumSessionReplay, the ingest grant, is
+   * on the create list but not the read list, and a team can block reads
+   * alone. Such a caller learns that the recording is pinned, which is all
+   * pinning it again needs, and nothing that somebody else wrote on the pin.
+   */
+  private async presentExistingPin(
+    pin: Model,
+    pinKey: PinKey,
+    props: DatabaseCommonInteractionProps,
+  ): Promise<Model> {
+    if (await this.callerMayReadPins(props)) {
+      return pin;
+    }
+
+    /*
+     * Not even the pin's id: it is what the update and delete endpoints
+     * take, and this caller could not have listed it.
+     */
+    const acknowledgement: Model = new Model();
+    acknowledgement.projectId = pinKey.projectId;
+    acknowledgement.rumApplicationId = pinKey.rumApplicationId;
+    acknowledgement.sessionId = pinKey.sessionId;
+
+    return acknowledgement;
+  }
+
+  /*
+   * The gates a read of this table applies, answered instead of thrown: the
+   * read block list (label-scoped blocks included, which this model cannot
+   * narrow to rows and so refuses outright) and the read list itself. Any
+   * refusal, whatever its type, means the caller does not get the pin.
+   */
+  private async callerMayReadPins(
+    props: DatabaseCommonInteractionProps,
+  ): Promise<boolean> {
+    if (isInternalCaller(props)) {
+      return true;
+    }
+
+    try {
+      await ReadPermission.checkReadBlockPermission(Model, {}, props);
+
+      TablePermission.checkTableLevelPermissions(
+        Model,
+        props,
+        DatabaseRequestType.Read,
+      );
+    } catch (err) {
+      if (err instanceof Exception) {
+        return false;
       }
 
       throw err;
     }
+
+    return true;
   }
 
   /* Null when the recording is not pinned. */
   @CaptureSpan()
-  public async getPinForSession(data: {
-    projectId: ObjectID;
-    rumApplicationId: ObjectID;
-    sessionId: string;
-  }): Promise<Model | null> {
+  public async getPinForSession(data: PinKey): Promise<Model | null> {
     return await this.findOneBy({
       query: {
         projectId: data.projectId,
@@ -147,6 +396,9 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         _id: true,
+        projectId: true,
+        rumApplicationId: true,
+        sessionId: true,
         reason: true,
         incidentId: true,
         alertId: true,

package/Server/Services/TeamPermissionService.ts

@@ -2,6 +2,8 @@ import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
+import ModelPermission from "../Types/Database/Permissions/Index";
+import QueryHelper from "../Types/Database/QueryHelper";
 import AccessTokenService from "./AccessTokenService";
 import DatabaseService from "./DatabaseService";
 import TeamMemberService from "./TeamMemberService";
@@ -11,7 +13,7 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
-import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
@@ -112,6 +114,11 @@ export class Service extends DatabaseService<Model> {
         data.props,
         PermissionType.Allow,
       );
+    const callerBlocks: Array<UserPermission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        data.props,
+        PermissionType.Block,
+      );
 
     /*
      * ProjectOwner is the sole tenant-level delegation override. In
@@ -123,6 +130,12 @@ export class Service extends DatabaseService<Model> {
      */
     if (
       callerPermissions.some((permission: UserPermission) => {
+        return (
+          permission.permission === Permission.ProjectOwner &&
+          this.permissionCoversGrant(permission, PermissionScope.All, [])
+        );
+      }) &&
+      !callerBlocks.some((permission: UserPermission) => {
         return permission.permission === Permission.ProjectOwner;
       })
     ) {
@@ -142,7 +155,38 @@ export class Service extends DatabaseService<Model> {
         );
       });
 
-    if (!canDelegate) {
+    const matchingBlocks: Array<UserPermission> = callerBlocks.filter(
+      (permission: UserPermission) => {
+        return permission.permission === data.permission;
+      },
+    );
+    const targetHasLabelScope: boolean =
+      targetLabelIds.length > 0 &&
+      data.scope !== PermissionScope.All &&
+      data.scope !== PermissionScope.Owned;
+    const isBlocked: boolean = matchingBlocks.some(
+      (permission: UserPermission) => {
+        /*
+         * An unrestricted/Owned grant may include resources blocked from the
+         * caller. Ownership also cannot be transferred between principals.
+         */
+        if (
+          !targetHasLabelScope ||
+          permission.scope === PermissionScope.All ||
+          permission.scope === PermissionScope.Owned ||
+          permission.labelIds.length === 0
+        ) {
+          return true;
+        }
+        return permission.labelIds.some((blockedLabelId: ObjectID) => {
+          return targetLabelIds.some((labelId: ObjectID) => {
+            return labelId.toString() === blockedLabelId.toString();
+          });
+        });
+      },
+    );
+
+    if (!canDelegate || isBlocked) {
       throw new NotAuthorizedException(
         `You cannot grant ${data.permission} because your own access does not include that permission at an equal or broader scope.`,
       );
@@ -349,13 +393,33 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
-    const teamPermissions: Array<Model> = await this.findBy({
+    updateBy.query = await ModelPermission.checkUpdateQueryPermissions(
+      Model,
+      updateBy.query,
+      updateBy.data,
+      updateBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: updateBy.query,
+      select: { _id: true },
+      skip: updateBy.skip,
+      limit: updateBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    // Read complete labels independently of any relation filters in the query.
+    const teamPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         teamId: true,
         projectId: true,
         permission: true,
+        isBlockPermission: true,
         labels: {
           _id: true,
         },
@@ -364,8 +428,6 @@ export class Service extends DatabaseService<Model> {
           isPermissionsEditable: true,
         },
       },
-      skip: 0,
-      limit: LIMIT_MAX,
       props: {
         isRoot: true,
       },
@@ -404,6 +466,16 @@ export class Service extends DatabaseService<Model> {
           ? (rawUpdateData.scope as PermissionScope)
           : permission.scope;
 
+      // Retargeting or narrowing a deny also removes its original restriction.
+      if (permission.isBlockPermission) {
+        this.assertCanGrantPermission({
+          permission: permission.permission!,
+          labelIds: this.getLabelIds(permission.labels),
+          scope: permission.scope,
+          props: updateBy.props,
+        });
+      }
+
       this.assertCanGrantPermission({
         permission: requestedPermission,
         labelIds: this.getLabelIds(requestedLabels),
@@ -413,24 +485,7 @@ export class Service extends DatabaseService<Model> {
     }
 
     if (updateBy.data.labels && updateBy.data.labels.length > 0) {
-      const existingPermissions: Array<Model> = await this.findBy({
-        query: updateBy.query,
-        select: {
-          _id: true,
-          labels: true,
-          isBlockPermission: true,
-          projectId: true,
-          teamId: true,
-          permission: true,
-        },
-        limit: LIMIT_PER_PROJECT,
-        skip: 0,
-        props: {
-          isRoot: true,
-        },
-      });
-
-      for (const alreadySavedPermission of existingPermissions) {
+      for (const alreadySavedPermission of teamPermissions) {
         // check if the
 
         const isBlockPermission: boolean =
@@ -471,6 +526,8 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    updateBy.query = { ...updateBy.query, _id: QueryHelper.any(selectedIds) };
+    updateBy.skip = 0;
     return { updateBy, carryForward: teamPermissions };
   }
 
@@ -523,31 +580,68 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<Model>,
   ): Promise<OnDelete<Model>> {
-    const teamPermissions: Array<Model> = await this.findBy({
+    // Scope the root lookup using the same delete authorization as the write.
+    deleteBy.query = await ModelPermission.checkDeleteQueryPermission(
+      Model,
+      deleteBy.query,
+      deleteBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: deleteBy.query,
+      select: { _id: true },
+      skip: deleteBy.skip,
+      limit: deleteBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    const teamPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         teamId: true,
         projectId: true,
+        permission: true,
+        isBlockPermission: true,
+        labels: { _id: true },
+        scope: true,
         team: {
           isPermissionsEditable: true,
         },
       },
-      skip: 0,
-      limit: LIMIT_MAX,
       props: {
         isRoot: true,
       },
     });
 
     for (const permission of teamPermissions) {
+      this.assertProjectMatchesTenant(permission.projectId!, deleteBy.props);
       if (!permission.team?.isPermissionsEditable) {
         throw new BadDataException(
           "Permissions for this team is not deleteable. You can create a new team and add permissions to that team instead.",
         );
       }
+
+      if (permission.isBlockPermission) {
+        this.assertCanGrantPermission({
+          permission: permission.permission!,
+          labelIds: this.getLabelIds(permission.labels),
+          scope: permission.scope,
+          props: deleteBy.props,
+        });
+      }
     }
 
+    // Keep the write restricted to the page whose authority was checked.
+    deleteBy.query = {
+      ...deleteBy.query,
+      _id: QueryHelper.any(selectedIds),
+    };
+    deleteBy.skip = 0;
+
     let teamMembers: Array<TeamMember> = [];
 
     for (const permission of teamPermissions) {

package/Server/Services/ThreatIntelFeedService.ts

@@ -9,6 +9,8 @@ import ObjectID from "../../Types/ObjectID";
 import {
   THREAT_INTEL_MINIMUM_CONFIDENCE_MAX,
   THREAT_INTEL_MINIMUM_CONFIDENCE_MIN,
+  THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES,
+  THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES,
 } from "../../Types/SecurityEvent/ThreatIntelConstants";
 import TaxiiClient from "../Utils/SecurityEvent/ThreatIntel/TaxiiClient";
 
@@ -40,11 +42,12 @@ export class Service extends DatabaseService<Model> {
     if (data.pollIntervalInMinutes !== undefined) {
       if (
         !Number.isInteger(data.pollIntervalInMinutes) ||
-        data.pollIntervalInMinutes < 1 ||
-        data.pollIntervalInMinutes > 1440
+        data.pollIntervalInMinutes <
+          THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES ||
+        data.pollIntervalInMinutes > THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES
       ) {
         throw new BadDataException(
-          "Poll interval must be a whole number of minutes between 1 and 1440.",
+          `Poll interval must be a whole number of minutes between ${THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES} and ${THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES}.`,
         );
       }
     }

package/Server/Types/Database/Permissions/BasePermission.ts

@@ -70,16 +70,18 @@ export default class BasePermission {
         props,
       );
 
-      if (!props.isMultiTenantRequest) {
-        // We will check for this permission in recursive function.
-
+      /*
+       * Only TenantPermission's per-project recursion returns an array of
+       * queries whose permissions have already been checked. The incoming
+       * query is copied into an ordinary object above, so a caller cannot
+       * supply this array. A multi-tenant request scoped to the current user
+       * (such as pending team invitations) still needs every check below.
+       */
+      if (!Array.isArray(query)) {
         // check model level permissions.
         TablePermission.checkTableLevelPermissions(modelType, props, type);
 
-        /*
-         * We will check for this permission in recursive function.
-         * check query permissions.
-         */
+        // check query permissions.
         QueryPermission.checkQueryPermission(modelType, query, props);
 
         query = await AccessControlPermission.addAccessControlIdsToQuery(