@oneuptime/common 13.0.7 → 13.0.8

package/Server/Types/Database/Permissions/Index.ts

@@ -7,9 +7,40 @@ import ReadPermission, { CheckReadPermissionType } from "./ReadPermission";
 import UpdatePermission from "./UpdatePermission";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil from "../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import NotAuthenticatedException from "../../../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 
 export default class ModelPermission {
+  /*
+   * A refusal of a caller with no credentials at all is a 401.
+   *
+   * The login check near the top of every permission check passes an
+   * anonymous caller straight through on models that are readable (or
+   * creatable) by Public - Probe, AIAgent, LlmProvider and friends - and the
+   * column, select and query checks that follow then refuse it with 422
+   * NotAuthorizedException. For the dashboard that caller is a signed-in user
+   * whose access-token cookie expired, and only a 401 makes the browser client
+   * refresh the session and replay the request. Callers with credentials keep
+   * the 422 they always got; the message is kept either way.
+   */
+  private static toAnonymousRefusal(
+    error: unknown,
+    props: DatabaseCommonInteractionProps,
+  ): unknown {
+    if (
+      error instanceof NotAuthorizedException &&
+      !props.isRoot &&
+      !props.isMasterAdmin &&
+      DatabaseCommonInteractionPropsUtil.isAnonymous(props)
+    ) {
+      return new NotAuthenticatedException(error.message);
+    }
+
+    return error;
+  }
+
   @CaptureSpan()
   public static async checkDeletePermissionByModel<
     TBaseModel extends BaseModel,
@@ -18,7 +49,11 @@ export default class ModelPermission {
     fetchModelWithAccessControlIds: () => Promise<TBaseModel | null>;
     props: DatabaseCommonInteractionProps;
   }): Promise<void> {
-    return DeletePermission.checkDeletePermissionByModel(data);
+    try {
+      return await DeletePermission.checkDeletePermissionByModel(data);
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, data.props);
+    }
   }
 
   @CaptureSpan()
@@ -29,7 +64,11 @@ export default class ModelPermission {
     fetchModelWithAccessControlIds: () => Promise<TBaseModel | null>;
     props: DatabaseCommonInteractionProps;
   }): Promise<void> {
-    return UpdatePermission.checkUpdatePermissionByModel(data);
+    try {
+      return await UpdatePermission.checkUpdatePermissionByModel(data);
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, data.props);
+    }
   }
 
   @CaptureSpan()
@@ -38,7 +77,15 @@ export default class ModelPermission {
     query: Query<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
-    return DeletePermission.checkDeletePermission(modelType, query, props);
+    try {
+      return await DeletePermission.checkDeletePermission(
+        modelType,
+        query,
+        props,
+      );
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, props);
+    }
   }
 
   @CaptureSpan()
@@ -48,12 +95,16 @@ export default class ModelPermission {
     data: QueryDeepPartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
-    return UpdatePermission.checkUpdatePermissions(
-      modelType,
-      query,
-      data,
-      props,
-    );
+    try {
+      return await UpdatePermission.checkUpdatePermissions(
+        modelType,
+        query,
+        data,
+        props,
+      );
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, props);
+    }
   }
 
   @CaptureSpan()
@@ -62,7 +113,11 @@ export default class ModelPermission {
     data: TBaseModel,
     props: DatabaseCommonInteractionProps,
   ): void {
-    return CreatePermission.checkCreatePermissions(modelType, data, props);
+    try {
+      return CreatePermission.checkCreatePermissions(modelType, data, props);
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, props);
+    }
   }
 
   @CaptureSpan()
@@ -72,6 +127,15 @@ export default class ModelPermission {
     select: Select<TBaseModel> | null,
     props: DatabaseCommonInteractionProps,
   ): Promise<CheckReadPermissionType<TBaseModel>> {
-    return ReadPermission.checkReadPermission(modelType, query, select, props);
+    try {
+      return await ReadPermission.checkReadPermission(
+        modelType,
+        query,
+        select,
+        props,
+      );
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, props);
+    }
   }
 }

package/Server/Types/Database/Permissions/TablePermission.ts

@@ -168,35 +168,31 @@ export default class TablePermission {
     const modelPermissions: Array<Permission> =
       TablePermission.getTablePermission(modelType, type);
 
-    const intersectingPermissions: Array<Permission> =
-      PermissionHelper.getIntersectingPermissions(
-        userPermissions.map((userPermission: UserPermission) => {
-          return userPermission.permission;
-        }) || [],
-        modelPermissions,
-      );
-
-    if (intersectingPermissions && intersectingPermissions.length > 0) {
-      for (const permission of intersectingPermissions) {
-        const userPermission: UserPermission = userPermissions.find(
-          (userPermission: UserPermission) => {
-            return userPermission.permission === permission;
-          },
-        ) as UserPermission;
-
-        if (
-          userPermission &&
+    /*
+     * The user gets one block row per TeamPermission across all of their
+     * teams, unmerged and unordered, so the same permission can be blocked
+     * both for some labels and for the whole table. A row without labels
+     * blocks the whole table and must win whichever row comes first:
+     * ReadPermission and AccessControlPermission only enforce the labelled
+     * rows, so an unlabelled row missed here is enforced nowhere.
+     */
+    const tableWideBlock: UserPermission | undefined = userPermissions.find(
+      (userPermission: UserPermission) => {
+        return (
+          modelPermissions.includes(userPermission.permission) &&
           (!userPermission.labelIds || userPermission.labelIds.length === 0)
-        ) {
-          throw new NotAuthorizedException(
-            `You are not authorized to ${type} ${
-              new modelType().singularName
-            } because ${
-              userPermission.permission
-            } is in your team's permission block list.`,
-          );
-        }
-      }
+        );
+      },
+    );
+
+    if (tableWideBlock) {
+      throw new NotAuthorizedException(
+        `You are not authorized to ${type} ${
+          new modelType().singularName
+        } because ${
+          tableWideBlock.permission
+        } is in your team's permission block list.`,
+      );
     }
   }
 }

package/Server/Utils/AI/AIChatPrivacyFilter.ts

@@ -1,4 +1,5 @@
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil from "../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 
 /*
@@ -16,6 +17,13 @@ export function pinQueryToRequestingUser<TQuery>(
     return query;
   }
 
+  /*
+   * No credentials at all is an expired session, not someone else's data:
+   * 401 so the client refreshes. The countBy overrides reach this before the
+   * permission layer's own login check does.
+   */
+  DatabaseCommonInteractionPropsUtil.assertCredentialsPresent(props);
+
   if (!props.userId) {
     throw new NotAuthorizedException(
       "AI conversations are personal and can only be accessed by the user who created them.",

package/Server/Utils/AI/AIRunPrivacyFilter.ts

@@ -1,4 +1,5 @@
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil from "../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import { FindWhereProperty } from "../../../Types/BaseDatabase/Query";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 import AIRunType from "../../../Types/AI/AIRunType";
@@ -57,6 +58,13 @@ export function getAIRunPrivacyRaw(
    * /ai-run nor /code-fix-run grants today. That is a separate product
    * decision and must not ride in as a side effect of this filter.
    */
+  /*
+   * No credentials at all is an expired session, not someone else's data:
+   * 401 so the client refreshes. The countBy overrides reach this before the
+   * permission layer's own login check does.
+   */
+  DatabaseCommonInteractionPropsUtil.assertCredentialsPresent(props);
+
   if (!props.userId) {
     throw new NotAuthorizedException(
       "AI runs are personal and can only be accessed by the user who created them.",

package/Server/Utils/MasterAdminPageAccess.ts

@@ -0,0 +1,61 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import { ExpressRequest, ExpressResponse } from "./Express";
+import JSONWebToken from "./JsonWebToken";
+import logger from "./Logger";
+import Response from "./Response";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import { JSONObject } from "../../Types/JSON";
+import JSONWebTokenData from "../../Types/JsonWebTokenData";
+
+export const NOT_A_MASTER_ADMIN_MESSAGE: string =
+  "Unauthorized: Only master admins can access the admin dashboard.";
+
+/*
+ * Gate for the Admin Dashboard's index page (the HTML shell, not its APIs).
+ *
+ * It refuses only a caller it can positively identify as NOT a master admin.
+ * A missing access token, or one that no longer decodes, is served the shell:
+ * the access-token cookie expires with the JWT inside it, so an admin who
+ * reloads a tab left open past the token lifetime arrives here with no token
+ * at all, and answering that with a 422 JSON page meant the app never loaded
+ * and so never got to refresh the session. The shell holds nothing the public
+ * static bundle does not; once it loads, the SPA sends a signed-out visitor to
+ * the login page, and every admin API it calls refreshes an expired session
+ * (or answers 401) on its own.
+ */
+export const ensureMasterAdminPageAccess: (data: {
+  req: ExpressRequest;
+  res: ExpressResponse;
+  service: string;
+}) => Promise<JSONObject> = async (data: {
+  req: ExpressRequest;
+  res: ExpressResponse;
+  service: string;
+}): Promise<JSONObject> => {
+  const accessToken: string | undefined =
+    UserMiddleware.getAccessTokenFromExpressRequest(data.req);
+
+  if (!accessToken) {
+    return {};
+  }
+
+  let authData: JSONWebTokenData;
+
+  try {
+    authData = JSONWebToken.decode(accessToken);
+  } catch (error) {
+    // Expired or unreadable: let the app load and refresh it.
+    logger.debug(error, { service: data.service });
+    return {};
+  }
+
+  if (!authData.isMasterAdmin) {
+    Response.sendErrorResponse(
+      data.req,
+      data.res,
+      new NotAuthorizedException(NOT_A_MASTER_ADMIN_MESSAGE),
+    );
+  }
+
+  return {};
+};

package/Server/Utils/Monitor/MonitorAlert.ts

@@ -86,6 +86,7 @@ export default class MonitorAlert {
       select: {
         _id: true,
         title: true,
+        createdAt: true,
         createdCriteriaId: true,
         projectId: true,
         alertNumber: true,
@@ -514,6 +515,7 @@ export default class MonitorAlert {
               relatedAlertNumber: alreadyOpenAlert?.alertNumber,
               relatedAlertNumberWithPrefix:
                 alreadyOpenAlert?.alertNumberWithPrefix,
+              relatedAlertCreatedAt: alreadyOpenAlert?.createdAt,
               at: OneUptimeDate.getCurrentDate(),
             });
             continue;
@@ -794,7 +796,7 @@ export default class MonitorAlert {
             relatedAlertId: createdAlert.id?.toString(),
             relatedAlertNumber: createdAlert.alertNumber,
             relatedAlertNumberWithPrefix: createdAlert.alertNumberWithPrefix,
-            at: OneUptimeDate.getCurrentDate(),
+            at: createdAlert.createdAt || OneUptimeDate.getCurrentDate(),
           });
         } catch (err) {
           /*

package/Server/Utils/Monitor/MonitorIncident.ts

@@ -99,6 +99,7 @@ export default class MonitorIncident {
       select: {
         _id: true,
         title: true,
+        createdAt: true,
         createdCriteriaId: true,
         createdIncidentTemplateId: true,
         projectId: true,
@@ -579,6 +580,7 @@ export default class MonitorIncident {
               relatedIncidentNumber: alreadyOpenIncident?.incidentNumber,
               relatedIncidentNumberWithPrefix:
                 alreadyOpenIncident?.incidentNumberWithPrefix,
+              relatedIncidentCreatedAt: alreadyOpenIncident?.createdAt,
               at: OneUptimeDate.getCurrentDate(),
             });
             continue;
@@ -913,7 +915,7 @@ export default class MonitorIncident {
             relatedIncidentNumber: createdIncident.incidentNumber,
             relatedIncidentNumberWithPrefix:
               createdIncident.incidentNumberWithPrefix,
-            at: OneUptimeDate.getCurrentDate(),
+            at: createdIncident.createdAt || OneUptimeDate.getCurrentDate(),
           });
         } catch (err) {
           /*

package/Server/Utils/OnCall/OnCallCalendarFeedRenderer.ts

@@ -176,7 +176,7 @@ export interface EmptyOutcomeOptions {
 }
 
 /* The schedule facts every render needs, read once per request. */
-interface ScheduleInfo {
+export interface ScheduleInfo {
   id: ObjectID;
   name: string;
   timezone?: string | undefined;

package/Server/Utils/Realtime.ts

@@ -24,6 +24,19 @@ import Dictionary from "../../Types/Dictionary";
 import UserPermissionUtil from "./UserPermission/UserPermission";
 import CaptureSpan from "./Telemetry/CaptureSpan";
 
+// What became of one ListenToModelEvent request.
+export enum ListenToModelEventOutcome {
+  Joined = "Joined",
+  // No access token, or one that no longer decodes. The client was told.
+  AuthenticationRequired = "AuthenticationRequired",
+  // A valid session without access to this tenant or model.
+  NotAuthorized = "NotAuthorized",
+  // The request itself was malformed.
+  InvalidRequest = "InvalidRequest",
+  // Something failed while authorizing (for example the permission cache).
+  Failed = "Failed",
+}
+
 export default abstract class Realtime {
   private static socketServer: SocketServer | null = null;
 
@@ -45,37 +58,19 @@ export default abstract class Realtime {
       this.socketServer!.on("connection", (socket: Socket) => {
         logger.debug("New socket connection established");
 
-        socket.on(EventName.ListenToModalEvent, async (data: JSONObject) => {
-          logger.debug("Received ListenToModalEvent with data:");
-          logger.debug(data);
-
-          const socketLogAttributes: LogAttributes = {
-            projectId: data["tenantId"]?.toString(),
-          };
-
-          if (typeof data["eventType"] !== "string") {
-            logger.error("eventType is not a string", socketLogAttributes);
-            throw new BadDataException("eventType is not a string");
-          }
-          if (typeof data["modelType"] !== "string") {
-            logger.error("modelType is not a string", socketLogAttributes);
-            throw new BadDataException("modelType is not a string");
-          }
-          if (typeof data["modelName"] !== "string") {
-            logger.error("modelName is not a string", socketLogAttributes);
-            throw new BadDataException("modelName is not a string");
-          }
-          if (typeof data["tenantId"] !== "string") {
-            logger.error("tenantId is not a string", socketLogAttributes);
-            throw new BadDataException("tenantId is not a string");
-          }
-
-          await Realtime.listenToModelEvent(socket, {
-            eventType: data["eventType"] as ModelEventType,
-            modelType: data["modelType"] as DatabaseType,
-            modelName: data["modelName"] as string,
-            tenantId: data["tenantId"] as string,
-          });
+        /*
+         * socket.io calls a listener and throws away what it returns. An async
+         * listener that throws is therefore an unhandled rejection: nothing
+         * goes back to the client, and the subscription it asked for simply
+         * never happens. handleListenToModelEventRequest settles every outcome
+         * itself; the catch is a backstop, not the error handling.
+         */
+        socket.on(EventName.ListenToModalEvent, (data: JSONObject): void => {
+          Realtime.handleListenToModelEventRequest(socket, data).catch(
+            (err: unknown) => {
+              logger.error(err);
+            },
+          );
         });
       });
     }
@@ -83,11 +78,108 @@ export default abstract class Realtime {
     return this.socketServer;
   }
 
+  /*
+   * One ListenToModelEvent from a client, start to finish. Never throws: a
+   * malformed request, a missing or expired access token, a refused
+   * subscription and a failing permission lookup each end here as an outcome,
+   * so none of them can become an unhandled rejection in the socket listener.
+   */
+  @CaptureSpan()
+  public static async handleListenToModelEventRequest(
+    socket: Socket,
+    data: JSONObject,
+  ): Promise<ListenToModelEventOutcome> {
+    logger.debug("Received ListenToModalEvent with data:");
+    logger.debug(data);
+
+    let request: ListenToModelEventJSON;
+
+    try {
+      request = Realtime.parseListenToModelEventRequest(data);
+    } catch (err) {
+      logger.error(err);
+      return ListenToModelEventOutcome.InvalidRequest;
+    }
+
+    try {
+      return await Realtime.listenToModelEvent(socket, request);
+    } catch (err) {
+      // A permission-cache (Redis) failure, say. The room is not joined.
+      const failureLogAttributes: LogAttributes = {
+        projectId: request.tenantId,
+      };
+
+      logger.error(err, failureLogAttributes);
+      return ListenToModelEventOutcome.Failed;
+    }
+  }
+
+  private static parseListenToModelEventRequest(
+    data: JSONObject,
+  ): ListenToModelEventJSON {
+    if (!data || typeof data !== "object") {
+      logger.error("ListenToModelEvent data is not an object");
+      throw new BadDataException("ListenToModelEvent data is not an object");
+    }
+
+    const socketLogAttributes: LogAttributes = {
+      projectId: data["tenantId"]?.toString(),
+    };
+
+    if (typeof data["eventType"] !== "string") {
+      logger.error("eventType is not a string", socketLogAttributes);
+      throw new BadDataException("eventType is not a string");
+    }
+    if (typeof data["modelType"] !== "string") {
+      logger.error("modelType is not a string", socketLogAttributes);
+      throw new BadDataException("modelType is not a string");
+    }
+    if (typeof data["modelName"] !== "string") {
+      logger.error("modelName is not a string", socketLogAttributes);
+      throw new BadDataException("modelName is not a string");
+    }
+    if (typeof data["tenantId"] !== "string") {
+      logger.error("tenantId is not a string", socketLogAttributes);
+      throw new BadDataException("tenantId is not a string");
+    }
+
+    return {
+      eventType: data["eventType"] as ModelEventType,
+      modelType: data["modelType"] as DatabaseType,
+      modelName: data["modelName"] as string,
+      tenantId: data["tenantId"] as string,
+    };
+  }
+
+  /*
+   * The socket has no usable user session: tell the client, which refreshes
+   * its session and reconnects so the new handshake carries the new cookie.
+   * Dropping the request silently is what used to happen, and it left every
+   * subscription made after the access token expired dead (no live counters
+   * after switching project, no live logs) with nothing in the browser to
+   * show why.
+   */
+  private static rejectForMissingAuthentication(
+    socket: Socket,
+    data: ListenToModelEventJSON,
+    reason: string,
+    listenLogAttributes: LogAttributes,
+  ): ListenToModelEventOutcome {
+    logger.debug(
+      `${reason}, aborting joining room and asking the client to re-authenticate`,
+      listenLogAttributes,
+    );
+
+    socket.emit(EventName.AuthenticationRequired, data);
+
+    return ListenToModelEventOutcome.AuthenticationRequired;
+  }
+
   @CaptureSpan()
   public static async listenToModelEvent(
     socket: Socket,
     data: ListenToModelEventJSON,
-  ): Promise<void> {
+  ): Promise<ListenToModelEventOutcome> {
     const listenLogAttributes: LogAttributes = {
       projectId: data.tenantId?.toString(),
     };
@@ -116,31 +208,51 @@ export default abstract class Realtime {
       this.getAccessTokenFromSocket(socket);
 
     if (!userAccessToken) {
-      logger.debug(
-        "User access token not found in socket, aborting joining room",
+      return this.rejectForMissingAuthentication(
+        socket,
+        data,
+        "User access token not found in socket",
         listenLogAttributes,
       );
-      return;
     }
 
     logger.debug("Decoding user access token", listenLogAttributes);
-    const userAuthorizationData: JSONWebTokenData =
-      JSONWebToken.decode(userAccessToken);
+
+    /*
+     * The token is the one the browser sent with the handshake, and it is not
+     * re-read for the life of the connection. Once it expires every decode
+     * throws, which is the normal state of a dashboard tab left open past the
+     * access token's lifetime, not an error in the request.
+     */
+    let userAuthorizationData: JSONWebTokenData;
+
+    try {
+      userAuthorizationData = JSONWebToken.decode(userAccessToken);
+    } catch {
+      return this.rejectForMissingAuthentication(
+        socket,
+        data,
+        "User access token in socket is invalid or expired",
+        listenLogAttributes,
+      );
+    }
 
     if (!userAuthorizationData) {
-      logger.debug(
-        "User authorization data not found in socket, aborting joining room",
+      return this.rejectForMissingAuthentication(
+        socket,
+        data,
+        "User authorization data not found in socket",
         listenLogAttributes,
       );
-      return;
     }
 
     if (!userAuthorizationData.userId) {
-      logger.debug(
-        "User ID not found in socket, aborting joining room",
+      return this.rejectForMissingAuthentication(
+        socket,
+        data,
+        "User ID not found in socket",
         listenLogAttributes,
       );
-      return;
     }
 
     logger.debug("Checking user access permissions", listenLogAttributes);
@@ -179,7 +291,7 @@ export default abstract class Realtime {
           "User does not have access to this tenant, aborting joining room",
           listenLogAttributes,
         );
-        return;
+        return ListenToModelEventOutcome.NotAuthorized;
       }
 
       logger.debug(
@@ -214,12 +326,16 @@ export default abstract class Realtime {
       }
     }
 
+    /*
+     * Authenticated but not allowed. The room is not joined and, as before,
+     * nothing is sent back: a fresh session would not change the answer.
+     */
     if (!hasAccess) {
       logger.debug(
         "User does not have access to this tenant, aborting joining room",
         listenLogAttributes,
       );
-      return;
+      return ListenToModelEventOutcome.NotAuthorized;
     }
 
     if (data.modelId) {
@@ -244,6 +360,8 @@ export default abstract class Realtime {
       // join the room.
       await socket.join(roomId);
     }
+
+    return ListenToModelEventOutcome.Joined;
   }
 
   @CaptureSpan()