@oneuptime/common 13.0.7 → 13.0.8

package/Types/SecurityEvent/SigmaRule.ts

@@ -1,5 +1,6 @@
 import Dictionary from "../Dictionary";
 import { JSONValue } from "../JSON";
+import OcsfSeverity from "./OcsfSeverity";
 
 /*
  * Typed representation of a parsed Sigma rule — the subset OneUptime's
@@ -17,6 +18,56 @@ export enum SigmaLevel {
   Critical = "critical",
 }
 
+/*
+ * The level a rule gets when its YAML has no `level:` or one outside the
+ * enum above. The parser applies it; the dashboard's rule guide states it.
+ */
+export const SIGMA_DEFAULT_LEVEL: SigmaLevel = SigmaLevel.Medium;
+
+/*
+ * Sigma level -> OCSF severity stamped on a rule's Detection Finding rows.
+ * Lives here rather than in the evaluator so the dashboard's rule guide
+ * renders its severity table from the same map the engine writes with.
+ */
+export const SIGMA_LEVEL_TO_OCSF_SEVERITY: Record<SigmaLevel, OcsfSeverity> = {
+  [SigmaLevel.Informational]: OcsfSeverity.Informational,
+  [SigmaLevel.Low]: OcsfSeverity.Low,
+  [SigmaLevel.Medium]: OcsfSeverity.Medium,
+  [SigmaLevel.High]: OcsfSeverity.High,
+  [SigmaLevel.Critical]: OcsfSeverity.Critical,
+};
+
+/*
+ * Levels that rank onto a project's MOST severe alert/incident severity
+ * when no severity is set on the rule and none is named after the level;
+ * every other level ranks onto the least severe.
+ */
+export function isSevereSigmaLevel(level: SigmaLevel): boolean {
+  return level === SigmaLevel.Critical || level === SigmaLevel.High;
+}
+
+/*
+ * Field modifiers (`field|modifier: value`) the parser accepts. Anything
+ * else is rejected at save time — listed here so the dashboard's rule
+ * guide cannot advertise a modifier the parser refuses, or miss one it
+ * takes.
+ */
+export const SIGMA_SUPPORTED_MODIFIERS: ReadonlyArray<string> = [
+  "contains",
+  "startswith",
+  "endswith",
+  "all",
+  "re",
+  "cased",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "cidr",
+  "exists",
+  "windash",
+];
+
 /*
  * One `field|modifier: value` requirement inside a selection map. `values`
  * always has at least one entry; multiple entries are OR-ed (AND-ed when

package/Types/SecurityEvent/ThreatIntelConstants.ts

@@ -105,6 +105,24 @@ export function ocsfSeverityForConfidence(confidence: number): OcsfSeverity {
 export const THREAT_INTEL_MINIMUM_CONFIDENCE_MIN: number = 0;
 export const THREAT_INTEL_MINIMUM_CONFIDENCE_MAX: number = 100;
 
+/*
+ * Save-time bounds and default for ThreatIntelFeed.pollIntervalInMinutes —
+ * shared by the server validator, the poller's fallback and the dashboard
+ * form, so the three cannot drift apart.
+ */
+export const THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES: number = 1;
+export const THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES: number = 1440;
+export const THREAT_INTEL_DEFAULT_POLL_INTERVAL_IN_MINUTES: number = 60;
+
+// Cap on one match evaluation's scan, whatever lastEvaluatedAt says.
+export const THREAT_INTEL_MATCH_MAX_LOOKBACK_IN_MINUTES: number = 24 * 60;
+
+// First-ever match evaluation window for a feed.
+export const THREAT_INTEL_FIRST_MATCH_WINDOW_IN_MINUTES: number = 15;
+
+// One alert per distinct indicator value per cycle, at most.
+export const THREAT_INTEL_MAX_INDICATORS_PER_EVALUATION: number = 100;
+
 /*
  * Indicators whose STIX object carries no valid_until stay active this
  * long after valid_from. STIX says "valid until revoked"; unbounded

package/UI/Components/AttachmentList/EventAttachmentList.tsx

@@ -1,3 +1,4 @@
+import { handleAuthenticatedLinkClick } from "../../Utils/OpenAuthenticatedUrl";
 import React, { FunctionComponent, ReactElement } from "react";
 
 export interface EventAttachment {
@@ -12,6 +13,14 @@ export interface EventAttachmentListProps {
   showHeader?: boolean;
   showCount?: boolean;
   className?: string;
+  /*
+   * Set when the download URLs are behind a session that can lapse while the
+   * page is open (a private status page). A click then refreshes the session
+   * before the new tab loads the file, so a reader who has had the page open
+   * past the access token's lifetime gets the attachment, not a 401. Left
+   * unset, the cards are plain links.
+   */
+  refreshSession?: (() => Promise<boolean>) | undefined;
 }
 
 function getAttachmentExtensionLabel(fileName?: string | null): string | null {
@@ -31,12 +40,13 @@ function getAttachmentExtensionLabel(fileName?: string | null): string | null {
 
 type AttachmentCardProps = {
   attachment: EventAttachment;
+  refreshSession?: (() => Promise<boolean>) | undefined;
 };
 
 const AttachmentCard: FunctionComponent<AttachmentCardProps> = (
   props: AttachmentCardProps,
 ): ReactElement => {
-  const { attachment } = props;
+  const { attachment, refreshSession } = props;
   const extensionLabel: string | null = getAttachmentExtensionLabel(
     attachment.name,
   );
@@ -47,6 +57,17 @@ const AttachmentCard: FunctionComponent<AttachmentCardProps> = (
         href={attachment.downloadUrl}
         target="_blank"
         rel="noopener noreferrer"
+        onClick={
+          refreshSession
+            ? (event: React.MouseEvent<HTMLAnchorElement>): void => {
+                handleAuthenticatedLinkClick(
+                  event,
+                  attachment.downloadUrl,
+                  refreshSession,
+                );
+              }
+            : undefined
+        }
         title={attachment.name}
         className="group flex items-center justify-between gap-3 rounded-lg border border-gray-200 bg-white px-3 py-2 text-sm text-gray-900 transition hover:border-gray-300 hover:bg-gray-50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-gray-200"
       >
@@ -81,6 +102,7 @@ const EventAttachmentList: FunctionComponent<EventAttachmentListProps> = (
     showHeader = true,
     showCount = true,
     className = "",
+    refreshSession,
   } = props;
 
   if (!attachments || attachments.length === 0) {
@@ -90,7 +112,13 @@ const EventAttachmentList: FunctionComponent<EventAttachmentListProps> = (
   const attachmentsList: ReactElement = (
     <ul className="space-y-2">
       {attachments.map((attachment: EventAttachment, index: number) => {
-        return <AttachmentCard attachment={attachment} key={index} />;
+        return (
+          <AttachmentCard
+            attachment={attachment}
+            refreshSession={refreshSession}
+            key={index}
+          />
+        );
       })}
     </ul>
   );

package/UI/Components/Dashboard/DashboardVariableControl.tsx

@@ -193,8 +193,16 @@ const DashboardVariableControl: FunctionComponent<ComponentProps> = (
       });
   const selectedValue: string =
     variable.selectedValue ?? variable.defaultValue ?? "";
+  /*
+   * With no option for its value the browser would show "All", while
+   * VariableInterpolation still filters every widget by that value. A project
+   * label can be deleted or disallowed. A telemetry attribute only lists the
+   * first 100 values seen in the last day, and its default is free text, so
+   * its value can be missing from the list and still match data. Skipped
+   * while those values load: the select reads "Loading…" until they arrive.
+   */
   const isUnavailableSelection: boolean = Boolean(
-    isProjectLabel &&
+    (isProjectLabel || (isTelemetryAttribute && !props.isLoadingOptions)) &&
       selectedValue &&
       !options.some((option: DashboardVariableOption) => {
         return option.value === selectedValue;
@@ -253,7 +261,9 @@ const DashboardVariableControl: FunctionComponent<ComponentProps> = (
             {props.isLoadingOptions ? "Loading…" : "All"}
           </option>
           {isUnavailableSelection && (
-            <option value={selectedValue}>Unavailable label</option>
+            <option value={selectedValue}>
+              {isProjectLabel ? "Unavailable label" : selectedValue}
+            </option>
           )}
           {options.map((option: DashboardVariableOption) => {
             return (

package/UI/Components/Dropdown/Dropdown.tsx

@@ -569,13 +569,18 @@ const Dropdown: FunctionComponent<ComponentProps> = (
       return;
     }
 
+    // Uncontrolled selections belong to this component, even if options refresh.
+    if (!("value" in props)) {
+      return;
+    }
+
     const value: DropdownOption | Array<DropdownOption> | undefined =
       getDropdownOptionFromValue(
         props.value === null ? undefined : props.value,
       );
 
     setValue(value);
-  }, [props.value]);
+  }, [props.value, props.options]);
 
   const menuPortalTarget: HTMLElement | null =
     typeof document === "undefined" ? null : document.body;

package/UI/Components/EditionLabel/EditionLabel.tsx

@@ -240,6 +240,18 @@ const EditionLabel: FunctionComponent<ComponentProps> = (
           new Route("/global-config/license"),
         );
 
+        /*
+         * The route also serves the login page, so on its own it answers a
+         * caller with no session with the reduced anonymous payload and a 200.
+         * Inside a signed-in app that caller is us with an expired session,
+         * and the reduced payload reads as "no license, no instances". Saying
+         * we expect to be signed in makes the server answer 401 instead,
+         * which the API client refreshes and replays.
+         */
+        if (UserUtil.isLoggedIn()) {
+          licenseUrl.addQueryParam("signedIn", "true");
+        }
+
         const response: HTTPResponse<JSONObject> | HTTPErrorResponse =
           await API.fetch<JSONObject>({
             method: HTTPMethod.GET,

package/UI/Components/EventItem/EventItem.tsx

@@ -58,6 +58,11 @@ export interface ComponentProps {
   eventSecondDescription: string;
   labels?: Array<EventItemLabel> | undefined;
   eventAttachments?: Array<TimelineAttachment> | undefined;
+  /*
+   * Handed to every EventAttachmentList this item renders: the event's own
+   * attachments and each timeline note's. See EventAttachmentList.
+   */
+  attachmentRefreshSession?: (() => Promise<boolean>) | undefined;
 }
 
 const EventItem: FunctionComponent<ComponentProps> = (
@@ -116,7 +121,10 @@ const EventItem: FunctionComponent<ComponentProps> = (
         )}
 
         {props.eventAttachments && props.eventAttachments.length > 0 && (
-          <EventAttachmentList attachments={props.eventAttachments} />
+          <EventAttachmentList
+            attachments={props.eventAttachments}
+            refreshSession={props.attachmentRefreshSession}
+          />
         )}
 
         {props.eventSecondDescription && (
@@ -320,6 +328,9 @@ const EventItem: FunctionComponent<ComponentProps> = (
                                 item.attachments.length > 0 && (
                                   <EventAttachmentList
                                     attachments={item.attachments}
+                                    refreshSession={
+                                      props.attachmentRefreshSession
+                                    }
                                     variant="inline"
                                     showHeader={false}
                                     showCount={false}

package/UI/Components/Forms/BasicForm.tsx

@@ -11,6 +11,7 @@ import {
   DropdownValue,
 } from "../Dropdown/Dropdown";
 import ErrorMessage from "../ErrorMessage/ErrorMessage";
+import CollapsibleFormSection from "./CollapsibleFormSection";
 import FormField from "./Fields/FormField";
 import FormSummary from "./FormSummary";
 import Steps from "./Steps/Steps";
@@ -222,6 +223,7 @@ const BasicForm: ForwardRefExoticComponent<any> = forwardRef(
 
     const [errors, setErrors] = useState<Dictionary<string>>({});
     const [touched, setTouched] = useState<Dictionary<boolean>>({});
+    const [validationAttempt, setValidationAttempt] = useState<number>(0);
 
     useEffect(() => {
       setFormSteps(getVisibleFormSteps());
@@ -402,6 +404,9 @@ const BasicForm: ForwardRefExoticComponent<any> = forwardRef(
     const submitForm: () => void = (): void => {
       // check for any boolean values and if they don't exist in values - mark them as false.
 
+      setValidationAttempt((attempt: number) => {
+        return attempt + 1;
+      });
       setAllTouched();
 
       const validationErrors: Dictionary<string> = validate(
@@ -592,41 +597,16 @@ const BasicForm: ForwardRefExoticComponent<any> = forwardRef(
           field.fieldType === FormFieldSchemaType.MultiSelectDropdown &&
           (values as any)[fieldName]
         ) {
-          const flatDropdownOptions: Array<DropdownOption> =
-            field.dropdownOptions?.flatMap(
-              (item: DropdownOption | DropdownOptionGroup) => {
-                if (
-                  "options" in item &&
-                  Array.isArray((item as DropdownOptionGroup).options)
-                ) {
-                  return (item as DropdownOptionGroup).options;
-                }
-                return [item as DropdownOption];
-              },
-            ) || [];
-
-          const dropdownOptions: Array<DropdownOption> =
-            flatDropdownOptions.filter((option: DropdownOption) => {
-              let valueToCompare: Array<DropdownValue> = [
-                ...(values as any)[fieldName],
-              ];
-
-              valueToCompare = valueToCompare.map((item: DropdownValue) => {
-                if ((item as any) instanceof ObjectID) {
-                  return item.toString();
-                }
-
-                return item;
-              });
-
-              return valueToCompare.includes(option.value);
-            });
-
-          (values as any)[fieldName] = dropdownOptions.map(
-            (option: DropdownOption) => {
-              return option.value;
-            },
-          );
+          /*
+           * Options can be loaded lazily for a later step or omit entities the
+           * user cannot browse. Preserve every stored selection just as a single
+           * dropdown does; an option list is not an authorization to clear IDs.
+           */
+          (values as any)[fieldName] = (
+            (values as any)[fieldName] as Array<DropdownValue | ObjectID>
+          ).map((value: DropdownValue | ObjectID): DropdownValue => {
+            return value instanceof ObjectID ? value.toString() : value;
+          });
         }
 
         // if the field is still null but has a default value then... have the default initial value
@@ -742,102 +722,147 @@ const BasicForm: ForwardRefExoticComponent<any> = forwardRef(
                     const activeColumns: number =
                       currentStep?.columns || props.showAsColumns || 1;
                     const fullRowSpan: string = `md:col-span-${activeColumns}`;
+                    const visibleFields: Fields<T> = formFields.filter(
+                      (field: Field<T>): boolean => {
+                        return (
+                          (!currentFormStepId ||
+                            field.stepId === currentFormStepId) &&
+                          (!field.showIf ||
+                            field.showIf(refCurrentValue.current))
+                        );
+                      },
+                    );
+                    const fieldGroups: Array<Fields<T>> = [];
+
+                    for (const field of visibleFields) {
+                      const previousGroup: Fields<T> | undefined =
+                        fieldGroups[fieldGroups.length - 1];
+                      if (
+                        field.collapsibleSection &&
+                        previousGroup?.[0]?.collapsibleSection?.id ===
+                          field.collapsibleSection.id
+                      ) {
+                        previousGroup.push(field);
+                      } else {
+                        fieldGroups.push([field]);
+                      }
+                    }
+
+                    const renderField: (
+                      field: Field<T>,
+                      index: number,
+                    ) => ReactElement = (
+                      field: Field<T>,
+                      index: number,
+                    ): ReactElement => {
+                      const fieldName: string = getFieldName(field);
+                      return (
+                        <Fragment key={fieldName}>
+                          {field.sectionTitle && (
+                            <div
+                              className={`${fullRowSpan} mt-4 pt-5 first:mt-0 first:pt-0 border-t first:border-t-0 border-gray-200`}
+                            >
+                              <h3 className="text-base font-semibold text-gray-900">
+                                {translateString(field.sectionTitle) ??
+                                  field.sectionTitle}
+                              </h3>
+                              {field.sectionDescription && (
+                                <p className="mt-1 text-sm text-gray-500">
+                                  {typeof field.sectionDescription === "string"
+                                    ? translateString(
+                                        field.sectionDescription,
+                                      ) ?? field.sectionDescription
+                                    : field.sectionDescription}
+                                </p>
+                              )}
+                            </div>
+                          )}
+                          <div
+                            className={
+                              field.spanFullRow ? fullRowSpan : undefined
+                            }
+                          >
+                            <FormField<T>
+                              field={field}
+                              fieldName={fieldName}
+                              index={index}
+                              error={errors[fieldName] || ""}
+                              touched={touched[fieldName] || false}
+                              isDisabled={
+                                isLoading ||
+                                (isDropdownOptionsLoading &&
+                                  isDropdownField(field)) ||
+                                false
+                              }
+                              currentValues={refCurrentValue.current}
+                              setFieldValue={setFieldValue}
+                              setFieldTouched={setFieldTouched}
+                              submitForm={submitForm}
+                              disableAutofocus={props.disableAutofocus || false}
+                              setFormValues={(values: FormValues<T>) => {
+                                refCurrentValue.current = values;
+                                setCurrentValue(refCurrentValue.current);
+                              }}
+                            />
+                            {field.footerElement}
+                            {field.getFooterElement &&
+                              field.getFooterElement(
+                                refCurrentValue.current,
+                                touched[fieldName]
+                                  ? errors[fieldName] || undefined
+                                  : undefined,
+                              )}
+                          </div>
+                        </Fragment>
+                      );
+                    };
+                    let fieldIndex: number = 0;
+
                     return (
                       <div
                         className={`grid md:grid-cols-${activeColumns} grid-cols-1 gap-x-4 gap-y-3`}
                       >
-                        {formFields &&
-                          formFields
-                            .filter((field: Field<T>) => {
-                              if (currentFormStepId) {
-                                return field.stepId === currentFormStepId;
+                        {fieldGroups.map((group: Fields<T>): ReactElement => {
+                          const firstField: Field<T> = group[0]!;
+                          const fields: Array<ReactElement> = group.map(
+                            (field: Field<T>): ReactElement => {
+                              return renderField(field, fieldIndex++);
+                            },
+                          );
+
+                          if (!firstField.collapsibleSection) {
+                            return fields[0]!;
+                          }
+
+                          return (
+                            <CollapsibleFormSection
+                              key={`${firstField.collapsibleSection.id}-${getFieldName(firstField)}`}
+                              title={firstField.collapsibleSection.title}
+                              description={
+                                firstField.collapsibleSection.description
                               }
-
-                              return true;
-                            })
-                            .filter((field: Field<T>) => {
-                              const currentValues: FormValues<T> =
-                                refCurrentValue.current;
-                              if (
-                                field.showIf &&
-                                !field.showIf(currentValues)
-                              ) {
-                                return false;
-                              }
-
-                              return true;
-                            })
-                            .map((field: Field<T>, i: number) => {
-                              const fieldName: string = getFieldName(field);
-                              return (
-                                <Fragment key={fieldName}>
-                                  {field.sectionTitle && (
-                                    <div
-                                      className={`${fullRowSpan} mt-4 pt-5 first:mt-0 first:pt-0 border-t first:border-t-0 border-gray-200`}
-                                    >
-                                      <h3 className="text-base font-semibold text-gray-900">
-                                        {translateString(field.sectionTitle) ??
-                                          field.sectionTitle}
-                                      </h3>
-                                      {field.sectionDescription && (
-                                        <p className="mt-1 text-sm text-gray-500">
-                                          {typeof field.sectionDescription ===
-                                          "string"
-                                            ? translateString(
-                                                field.sectionDescription,
-                                              ) ?? field.sectionDescription
-                                            : field.sectionDescription}
-                                        </p>
-                                      )}
-                                    </div>
-                                  )}
-                                  <div
-                                    className={
-                                      field.spanFullRow
-                                        ? fullRowSpan
-                                        : undefined
-                                    }
-                                  >
-                                    <FormField<T>
-                                      field={field}
-                                      fieldName={fieldName}
-                                      index={i}
-                                      error={errors[fieldName] || ""}
-                                      touched={touched[fieldName] || false}
-                                      isDisabled={
-                                        isLoading ||
-                                        (isDropdownOptionsLoading &&
-                                          isDropdownField(field)) ||
-                                        false
-                                      }
-                                      currentValues={refCurrentValue.current}
-                                      setFieldValue={setFieldValue}
-                                      setFieldTouched={setFieldTouched}
-                                      submitForm={submitForm}
-                                      disableAutofocus={
-                                        props.disableAutofocus || false
-                                      }
-                                      setFormValues={(
-                                        values: FormValues<T>,
-                                      ) => {
-                                        refCurrentValue.current = values;
-                                        setCurrentValue(
-                                          refCurrentValue.current,
-                                        );
-                                      }}
-                                    />
-                                    {field.footerElement}
-                                    {field.getFooterElement &&
-                                      field.getFooterElement(
-                                        refCurrentValue.current,
-                                        touched[fieldName]
-                                          ? errors[fieldName] || undefined
-                                          : undefined,
-                                      )}
-                                  </div>
-                                </Fragment>
-                              );
-                            })}
+                              isConfigured={firstField.collapsibleSection.isConfigured(
+                                refCurrentValue.current,
+                              )}
+                              hasError={group.some(
+                                (field: Field<T>): boolean => {
+                                  const fieldName: string = getFieldName(field);
+                                  return Boolean(
+                                    touched[fieldName] && errors[fieldName],
+                                  );
+                                },
+                              )}
+                              validationAttempt={validationAttempt}
+                              className={fullRowSpan}
+                            >
+                              <div
+                                className={`grid md:grid-cols-${activeColumns} grid-cols-1 gap-x-4 gap-y-3`}
+                              >
+                                {fields}
+                              </div>
+                            </CollapsibleFormSection>
+                          );
+                        })}
 
                         {/* If Summary, show Model detail  */}
 

package/UI/Components/Forms/CollapsibleFormSection.tsx

@@ -0,0 +1,63 @@
+import useTranslateValue from "../../Utils/Translation";
+import CollapsibleSection from "../CollapsibleSection/CollapsibleSection";
+import React, {
+  FunctionComponent,
+  ReactElement,
+  useEffect,
+  useState,
+} from "react";
+
+export interface ComponentProps {
+  title: string;
+  description?: string | undefined;
+  isConfigured: boolean;
+  hasError: boolean;
+  validationAttempt: number;
+  className: string;
+  children: ReactElement;
+}
+
+const CollapsibleFormSection: FunctionComponent<ComponentProps> = (
+  props: ComponentProps,
+): ReactElement => {
+  const { translateString } = useTranslateValue();
+  const [isCollapsed, setIsCollapsed] = useState<boolean>(!props.isConfigured);
+
+  useEffect(() => {
+    // Field defaults can arrive after the form has loaded its field definitions.
+    if (props.isConfigured) {
+      setIsCollapsed(false);
+    }
+  }, [props.isConfigured]);
+
+  useEffect(() => {
+    if (props.hasError) {
+      setIsCollapsed(false);
+    }
+  }, [props.hasError, props.validationAttempt]);
+
+  return (
+    <CollapsibleSection
+      title={translateString(props.title) ?? props.title}
+      description={
+        props.description
+          ? translateString(props.description) ?? props.description
+          : undefined
+      }
+      variant="bordered"
+      className={props.className}
+      isCollapsed={isCollapsed}
+      onToggle={setIsCollapsed}
+      badge={
+        props.isConfigured
+          ? translateString("Configured") ?? "Configured"
+          : undefined
+      }
+    >
+      {/* Keep editors mounted without leaving collapsed controls focusable. */}
+      <div hidden={isCollapsed}>{props.children}</div>
+    </CollapsibleSection>
+  );
+};
+
+export default CollapsibleFormSection;