@oneuptime/common 13.0.7 → 14.0.0

package/Types/SecurityEvent/SigmaRule.ts

@@ -1,5 +1,6 @@
 import Dictionary from "../Dictionary";
 import { JSONValue } from "../JSON";
+import OcsfSeverity from "./OcsfSeverity";
 
 /*
  * Typed representation of a parsed Sigma rule — the subset OneUptime's
@@ -17,6 +18,56 @@ export enum SigmaLevel {
   Critical = "critical",
 }
 
+/*
+ * The level a rule gets when its YAML has no `level:` or one outside the
+ * enum above. The parser applies it; the dashboard's rule guide states it.
+ */
+export const SIGMA_DEFAULT_LEVEL: SigmaLevel = SigmaLevel.Medium;
+
+/*
+ * Sigma level -> OCSF severity stamped on a rule's Detection Finding rows.
+ * Lives here rather than in the evaluator so the dashboard's rule guide
+ * renders its severity table from the same map the engine writes with.
+ */
+export const SIGMA_LEVEL_TO_OCSF_SEVERITY: Record<SigmaLevel, OcsfSeverity> = {
+  [SigmaLevel.Informational]: OcsfSeverity.Informational,
+  [SigmaLevel.Low]: OcsfSeverity.Low,
+  [SigmaLevel.Medium]: OcsfSeverity.Medium,
+  [SigmaLevel.High]: OcsfSeverity.High,
+  [SigmaLevel.Critical]: OcsfSeverity.Critical,
+};
+
+/*
+ * Levels that rank onto a project's MOST severe alert/incident severity
+ * when no severity is set on the rule and none is named after the level;
+ * every other level ranks onto the least severe.
+ */
+export function isSevereSigmaLevel(level: SigmaLevel): boolean {
+  return level === SigmaLevel.Critical || level === SigmaLevel.High;
+}
+
+/*
+ * Field modifiers (`field|modifier: value`) the parser accepts. Anything
+ * else is rejected at save time — listed here so the dashboard's rule
+ * guide cannot advertise a modifier the parser refuses, or miss one it
+ * takes.
+ */
+export const SIGMA_SUPPORTED_MODIFIERS: ReadonlyArray<string> = [
+  "contains",
+  "startswith",
+  "endswith",
+  "all",
+  "re",
+  "cased",
+  "gt",
+  "gte",
+  "lt",
+  "lte",
+  "cidr",
+  "exists",
+  "windash",
+];
+
 /*
  * One `field|modifier: value` requirement inside a selection map. `values`
  * always has at least one entry; multiple entries are OR-ed (AND-ed when

package/Types/SecurityEvent/ThreatIntelConstants.ts

@@ -105,6 +105,24 @@ export function ocsfSeverityForConfidence(confidence: number): OcsfSeverity {
 export const THREAT_INTEL_MINIMUM_CONFIDENCE_MIN: number = 0;
 export const THREAT_INTEL_MINIMUM_CONFIDENCE_MAX: number = 100;
 
+/*
+ * Save-time bounds and default for ThreatIntelFeed.pollIntervalInMinutes —
+ * shared by the server validator, the poller's fallback and the dashboard
+ * form, so the three cannot drift apart.
+ */
+export const THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES: number = 1;
+export const THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES: number = 1440;
+export const THREAT_INTEL_DEFAULT_POLL_INTERVAL_IN_MINUTES: number = 60;
+
+// Cap on one match evaluation's scan, whatever lastEvaluatedAt says.
+export const THREAT_INTEL_MATCH_MAX_LOOKBACK_IN_MINUTES: number = 24 * 60;
+
+// First-ever match evaluation window for a feed.
+export const THREAT_INTEL_FIRST_MATCH_WINDOW_IN_MINUTES: number = 15;
+
+// One alert per distinct indicator value per cycle, at most.
+export const THREAT_INTEL_MAX_INDICATORS_PER_EVALUATION: number = 100;
+
 /*
  * Indicators whose STIX object carries no valid_until stay active this
  * long after valid_from. STIX says "valid until revoked"; unbounded

package/Types/StatusPage/UptimeDailyAggregate.ts

@@ -0,0 +1,110 @@
+/*
+ * Per-monitor, per-day status durations for the status-page uptime bars.
+ *
+ * WHY THIS TYPE EXISTS
+ *
+ * The bars used to be painted from raw MonitorStatusTimeline rows shipped to
+ * the browser under a single `limit: LIMIT_MAX` (10,000) across EVERY monitor
+ * on the page, sorted `startsAt DESC`.
+ *
+ * That cap is a silent, history-destroying bound. Measured on a real status
+ * page: 254,550 rows matched the 60-day window and 10,000 came back - 3.9%.
+ * The oldest surviving row started four days before the request, so 56 of the
+ * 60 bars were painted from data that had been dropped.
+ *
+ * Worse, the cap is GLOBAL across monitors and the sort is newest-first, so a
+ * few high-churn monitors starve the quiet ones out of the result set
+ * entirely. On the page that reported this, three flapping monitors held
+ * 9,995 of the 10,000 slots. A quiet, healthy monitor's covering row has an
+ * OLD `startsAt` and therefore sorts last - so the healthier a monitor is,
+ * the more likely it is to lose its whole history to a noisy neighbour.
+ *
+ * Shipping more rows cannot fix it. One row serializes to ~431 bytes in this
+ * codebase's typed JSON, so 254,550 rows is ~105 MB - into a response that is
+ * held in a 500-entry in-memory cache on the hottest public endpoint, and
+ * then filtered per-bar on the client's main thread.
+ *
+ * So the server sends DURATIONS instead of rows. The size is structural -
+ * O(monitors x days x statuses) - rather than O(status transitions), and it
+ * cannot be blown up by a flapping monitor.
+ */
+
+import ObjectID from "../ObjectID";
+
+/**
+ * Seconds spent in one monitor status, inside one day bucket.
+ */
+export interface UptimeStatusDuration {
+  monitorStatusId: ObjectID;
+  seconds: number;
+}
+
+/**
+ * One monitor's reading for one day bucket.
+ */
+export interface UptimeDayBucket {
+  /* Start of the bucket, as a UTC instant. */
+  bucketStart: Date;
+
+  /* End of the bucket, as a UTC instant. */
+  bucketEnd: Date;
+
+  /*
+   * Wall-clock seconds in the bucket.
+   *
+   * NOT hardcoded to 86400. The window's first and last buckets are clipped
+   * to the window, and a local calendar day that crosses a DST boundary is
+   * genuinely 23 or 25 hours long.
+   */
+  daySeconds: number;
+
+  /*
+   * Seconds of this bucket actually covered by a timeline row.
+   *
+   * This is the field the whole fix turns on. `coveredSeconds === 0` means
+   * "nothing was ever recorded for this day" - the monitor did not exist yet,
+   * or there is a hole in the record. Such a day must never be painted as
+   * uptime, which is exactly what the old code did by falling through to the
+   * status page's `defaultBarColor` (green on 4,642 status pages).
+   *
+   * `0 < coveredSeconds < daySeconds` is NOT a no-data day. It is a real
+   * reading of a shorter interval - the day a monitor was created, say - and
+   * its percentage is taken over what was measured.
+   */
+  coveredSeconds: number;
+
+  /* Seconds spent in each status, summed within the bucket. */
+  statusDurations: Array<UptimeStatusDuration>;
+}
+
+/**
+ * Every day bucket for one monitor.
+ */
+export interface MonitorUptimeDailyAggregate {
+  monitorId: ObjectID;
+  buckets: Array<UptimeDayBucket>;
+}
+
+/**
+ * The full aggregate for a status page request.
+ */
+export interface UptimeDailyAggregate {
+  monitors: Array<MonitorUptimeDailyAggregate>;
+
+  /*
+   * False when the server could not vouch for the whole window.
+   *
+   * There is no silent cap in the aggregate path, so this is normally true.
+   * It exists because a bound that is ever added later must SHOW, not be
+   * absorbed into a green bar - which is the failure this whole change is
+   * about. When false, `completeFrom` says where the trustworthy data starts
+   * and the client renders everything older as no-data rather than guessing.
+   */
+  isComplete: boolean;
+
+  /*
+   * The earliest instant the aggregate can vouch for, when `isComplete` is
+   * false. Null when the whole window is covered.
+   */
+  completeFrom: Date | null;
+}

package/UI/Components/AttachmentList/EventAttachmentList.tsx

@@ -1,3 +1,4 @@
+import { handleAuthenticatedLinkClick } from "../../Utils/OpenAuthenticatedUrl";
 import React, { FunctionComponent, ReactElement } from "react";
 
 export interface EventAttachment {
@@ -12,6 +13,14 @@ export interface EventAttachmentListProps {
   showHeader?: boolean;
   showCount?: boolean;
   className?: string;
+  /*
+   * Set when the download URLs are behind a session that can lapse while the
+   * page is open (a private status page). A click then refreshes the session
+   * before the new tab loads the file, so a reader who has had the page open
+   * past the access token's lifetime gets the attachment, not a 401. Left
+   * unset, the cards are plain links.
+   */
+  refreshSession?: (() => Promise<boolean>) | undefined;
 }
 
 function getAttachmentExtensionLabel(fileName?: string | null): string | null {
@@ -31,12 +40,13 @@ function getAttachmentExtensionLabel(fileName?: string | null): string | null {
 
 type AttachmentCardProps = {
   attachment: EventAttachment;
+  refreshSession?: (() => Promise<boolean>) | undefined;
 };
 
 const AttachmentCard: FunctionComponent<AttachmentCardProps> = (
   props: AttachmentCardProps,
 ): ReactElement => {
-  const { attachment } = props;
+  const { attachment, refreshSession } = props;
   const extensionLabel: string | null = getAttachmentExtensionLabel(
     attachment.name,
   );
@@ -47,6 +57,17 @@ const AttachmentCard: FunctionComponent<AttachmentCardProps> = (
         href={attachment.downloadUrl}
         target="_blank"
         rel="noopener noreferrer"
+        onClick={
+          refreshSession
+            ? (event: React.MouseEvent<HTMLAnchorElement>): void => {
+                handleAuthenticatedLinkClick(
+                  event,
+                  attachment.downloadUrl,
+                  refreshSession,
+                );
+              }
+            : undefined
+        }
         title={attachment.name}
         className="group flex items-center justify-between gap-3 rounded-lg border border-gray-200 bg-white px-3 py-2 text-sm text-gray-900 transition hover:border-gray-300 hover:bg-gray-50 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-gray-200"
       >
@@ -81,6 +102,7 @@ const EventAttachmentList: FunctionComponent<EventAttachmentListProps> = (
     showHeader = true,
     showCount = true,
     className = "",
+    refreshSession,
   } = props;
 
   if (!attachments || attachments.length === 0) {
@@ -90,7 +112,13 @@ const EventAttachmentList: FunctionComponent<EventAttachmentListProps> = (
   const attachmentsList: ReactElement = (
     <ul className="space-y-2">
       {attachments.map((attachment: EventAttachment, index: number) => {
-        return <AttachmentCard attachment={attachment} key={index} />;
+        return (
+          <AttachmentCard
+            attachment={attachment}
+            refreshSession={refreshSession}
+            key={index}
+          />
+        );
       })}
     </ul>
   );

package/UI/Components/Dashboard/DashboardVariableControl.tsx

@@ -193,8 +193,16 @@ const DashboardVariableControl: FunctionComponent<ComponentProps> = (
       });
   const selectedValue: string =
     variable.selectedValue ?? variable.defaultValue ?? "";
+  /*
+   * With no option for its value the browser would show "All", while
+   * VariableInterpolation still filters every widget by that value. A project
+   * label can be deleted or disallowed. A telemetry attribute only lists the
+   * first 100 values seen in the last day, and its default is free text, so
+   * its value can be missing from the list and still match data. Skipped
+   * while those values load: the select reads "Loading…" until they arrive.
+   */
   const isUnavailableSelection: boolean = Boolean(
-    isProjectLabel &&
+    (isProjectLabel || (isTelemetryAttribute && !props.isLoadingOptions)) &&
       selectedValue &&
       !options.some((option: DashboardVariableOption) => {
         return option.value === selectedValue;
@@ -253,7 +261,9 @@ const DashboardVariableControl: FunctionComponent<ComponentProps> = (
             {props.isLoadingOptions ? "Loading…" : "All"}
           </option>
           {isUnavailableSelection && (
-            <option value={selectedValue}>Unavailable label</option>
+            <option value={selectedValue}>
+              {isProjectLabel ? "Unavailable label" : selectedValue}
+            </option>
           )}
           {options.map((option: DashboardVariableOption) => {
             return (

package/UI/Components/Dropdown/Dropdown.tsx

@@ -569,13 +569,18 @@ const Dropdown: FunctionComponent<ComponentProps> = (
       return;
     }
 
+    // Uncontrolled selections belong to this component, even if options refresh.
+    if (!("value" in props)) {
+      return;
+    }
+
     const value: DropdownOption | Array<DropdownOption> | undefined =
       getDropdownOptionFromValue(
         props.value === null ? undefined : props.value,
       );
 
     setValue(value);
-  }, [props.value]);
+  }, [props.value, props.options]);
 
   const menuPortalTarget: HTMLElement | null =
     typeof document === "undefined" ? null : document.body;