@oneuptime/common 13.0.7 → 14.0.0

package/Server/Services/RumSessionPinService.ts

@@ -1,10 +1,17 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/RumSessionPin";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import ObjectID from "../../Types/ObjectID";
 import OneUptimeDate from "../../Types/Date";
+import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import CreateBy from "../Types/Database/CreateBy";
 import { OnCreate } from "../Types/Database/Hooks";
+import CreatePermission from "../Types/Database/Permissions/CreatePermission";
+import ReadPermission from "../Types/Database/Permissions/ReadPermission";
+import TablePermission from "../Types/Database/Permissions/TablePermission";
 import QueryHelper from "../Types/Database/QueryHelper";
 import PostgresErrorTranslator from "../Utils/Database/PostgresErrorTranslator";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -24,6 +31,62 @@ const isUniqueViolation: IsUniqueViolationFunction = (
   return PostgresErrorTranslator.isUniqueViolation(error);
 };
 
+/* What the unique index keys a pin on. */
+interface PinKey {
+  projectId: ObjectID;
+  rumApplicationId: ObjectID;
+  sessionId: string;
+}
+
+type IsSameIdFunction = (a: ObjectID, b: ObjectID) => boolean;
+
+/*
+ * ObjectID.equals compares the strings as given, but a UUID is the same
+ * project in any case - and the tenant an API key resolves to comes back
+ * from Postgres in lower case whatever the client typed.
+ */
+const isSameId: IsSameIdFunction = (a: ObjectID, b: ObjectID): boolean => {
+  return a.toString().toLowerCase() === b.toString().toLowerCase();
+};
+
+type ToPlainIdFunction = (
+  value: unknown,
+  field: string,
+) => ObjectID | undefined;
+
+/*
+ * An id from the request body as a plain ObjectID. The body is deserialized
+ * generically, so a field typed as an id can arrive as some other object.
+ */
+const toPlainId: ToPlainIdFunction = (
+  value: unknown,
+  field: string,
+): ObjectID | undefined => {
+  if (value === undefined || value === null) {
+    return undefined;
+  }
+
+  if (value instanceof ObjectID || typeof value === "string") {
+    const id: string = value.toString();
+
+    if (ObjectID.isValidUUID(id)) {
+      return new ObjectID(id);
+    }
+  }
+
+  throw new BadDataException(`${field} must be an ID.`);
+};
+
+type IsInternalCallerFunction = (
+  props: DatabaseCommonInteractionProps,
+) => boolean;
+
+const isInternalCaller: IsInternalCallerFunction = (
+  props: DatabaseCommonInteractionProps,
+): boolean => {
+  return Boolean(props.isRoot || props.isMasterAdmin);
+};
+
 /*
  * Pins that keep a session recording past its retention window.
  *
@@ -88,27 +151,55 @@ export class Service extends DatabaseService<Model> {
    *
    * The pre-check handles the common case and the catch closes the race
    * between two concurrent pins of the same session.
+   *
+   * Both lookups read as root, so neither may run until the caller has
+   * passed the create check that super.create would otherwise have been the
+   * first to apply, and what they find is handed back only as far as the
+   * caller could have read it.
    */
   @CaptureSpan()
   public override async create(createBy: CreateBy<Model>): Promise<Model> {
-    const projectId: ObjectID | undefined = createBy.data.projectId;
-    const rumApplicationId: ObjectID | undefined =
-      createBy.data.rumApplicationId;
-    const sessionId: string | undefined = createBy.data.sessionId;
+    this.assertCallerMayCreatePins(createBy.props);
+
+    if (!isInternalCaller(createBy.props)) {
+      /*
+       * The database keeps these for itself; a request does not set them.
+       *
+       * Cleared rather than deleted: `createBy.data` is a live model instance,
+       * and the column-metadata lookups downstream used to enumerate the own
+       * keys of whichever instance reached them first and cache that as the
+       * CLASS's column list - so deleting `_id` off this instance taught the
+       * whole process that RumSessionPin has no id, and every later response
+       * for it lost one. TableColumn.ts no longer reads the caller's instance
+       * (see CanonicalModelInstance.ts), so this is defence in depth. An
+       * unset column holds `undefined` anyway, which TypeORM and the write
+       * path treat exactly as an absent key - the save is still an INSERT.
+       */
+      const databaseManagedColumns: Array<string> = [
+        "_id",
+        "createdAt",
+        "updatedAt",
+        "deletedAt",
+        "version",
+      ];
 
-    if (!projectId || !rumApplicationId || !sessionId) {
+      for (const columnName of databaseManagedColumns) {
+        (createBy.data as unknown as Record<string, unknown>)[columnName] =
+          undefined;
+      }
+    }
+
+    const pinKey: PinKey | null = this.resolvePinKey(createBy);
+
+    if (!pinKey) {
       /* Let onBeforeCreate produce the specific validation message. */
       return await super.create(createBy);
     }
 
-    const existingPin: Model | null = await this.getPinForSession({
-      projectId: projectId,
-      rumApplicationId: rumApplicationId,
-      sessionId: sessionId,
-    });
+    const existingPin: Model | null = await this.getPinForSession(pinKey);
 
     if (existingPin) {
-      return existingPin;
+      return await this.presentExistingPin(existingPin, pinKey, createBy.props);
     }
 
     try {
@@ -118,27 +209,204 @@ export class Service extends DatabaseService<Model> {
         throw err;
       }
 
-      const racedPin: Model | null = await this.getPinForSession({
-        projectId: projectId,
-        rumApplicationId: rumApplicationId,
-        sessionId: sessionId,
-      });
+      const racedPin: Model | null = await this.getPinForSession(pinKey);
 
       if (racedPin) {
-        return racedPin;
+        return await this.presentExistingPin(racedPin, pinKey, createBy.props);
+      }
+
+      throw err;
+    }
+  }
+
+  /*
+   * The table half of ModelPermission.checkCreatePermissions: signed in or
+   * holding an API key, and granted something on the model's create list in
+   * the tenant. The column half stays with super.create, which runs it after
+   * onBeforeCreate has stripped the fields it rewrites; the idempotent path
+   * writes no columns for it to judge.
+   */
+  private assertCallerMayCreatePins(
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    if (isInternalCaller(props)) {
+      return;
+    }
+
+    CreatePermission.checkCreateBlockPermissions(Model, props);
+
+    TablePermission.checkTableLevelPermissions(
+      Model,
+      props,
+      DatabaseRequestType.Create,
+    );
+  }
+
+  /*
+   * The (projectId, rumApplicationId, sessionId) this request would insert,
+   * which is therefore what both lookups must search - or null when a part
+   * is missing, so that onBeforeCreate can say which. The lookups are
+   * queries, so every part has to be a plain id or string.
+   *
+   * projectId is the one super.create will write: the caller's tenant when
+   * there is one, otherwise the projectId an internal caller passed. A
+   * request naming any other project is refused, because the caller's
+   * grants were checked in the tenant and nowhere else; internal callers
+   * keep DatabaseService's rule that the tenant replaces it.
+   *
+   * The project and the application can also be named through the `project`
+   * and `rumApplication` relations. Each shares its scalar's column and wins
+   * over it when TypeORM saves, so a relation that disagrees is refused and
+   * both are dropped, leaving the scalars as the only thing saved.
+   */
+  private resolvePinKey(createBy: CreateBy<Model>): PinKey | null {
+    const props: DatabaseCommonInteractionProps = createBy.props;
+    const isInternal: boolean = isInternalCaller(props);
+
+    const claimedProjectId: ObjectID | undefined = toPlainId(
+      createBy.data.projectId,
+      "projectId",
+    );
+    const rumApplicationId: ObjectID | undefined = toPlainId(
+      createBy.data.rumApplicationId,
+      "rumApplicationId",
+    );
+
+    const rawSessionId: unknown = createBy.data.sessionId;
+
+    if (
+      rawSessionId !== undefined &&
+      rawSessionId !== null &&
+      typeof rawSessionId !== "string"
+    ) {
+      throw new BadDataException("sessionId must be a string.");
+    }
+
+    const sessionId: string | undefined =
+      typeof rawSessionId === "string" ? rawSessionId : undefined;
+
+    const projectRelationId: ObjectID | undefined = toPlainId(
+      createBy.data.project?._id,
+      "project",
+    );
+    const applicationRelationId: ObjectID | undefined = toPlainId(
+      createBy.data.rumApplication?._id,
+      "rumApplication",
+    );
+
+    delete createBy.data.project;
+    delete createBy.data.rumApplication;
+
+    const projectId: ObjectID | undefined = isInternal
+      ? props.tenantId || claimedProjectId
+      : props.tenantId;
+
+    const projectClaims: Array<ObjectID> = [];
+
+    if (projectRelationId) {
+      projectClaims.push(projectRelationId);
+    }
+
+    if (claimedProjectId && !isInternal) {
+      projectClaims.push(claimedProjectId);
+    }
+
+    for (const projectClaim of projectClaims) {
+      if (!projectId || !isSameId(projectClaim, projectId)) {
+        throw isInternal
+          ? new BadDataException("project does not match projectId.")
+          : new NotAuthorizedException(
+              "You are not authorized to pin recordings in this project.",
+            );
+      }
+    }
+
+    if (
+      applicationRelationId &&
+      !(rumApplicationId && isSameId(applicationRelationId, rumApplicationId))
+    ) {
+      throw new BadDataException(
+        "rumApplication does not match rumApplicationId.",
+      );
+    }
+
+    if (!claimedProjectId || !projectId || !rumApplicationId || !sessionId) {
+      return null;
+    }
+
+    createBy.data.projectId = projectId;
+    createBy.data.rumApplicationId = rumApplicationId;
+
+    return {
+      projectId: projectId,
+      rumApplicationId: rumApplicationId,
+      sessionId: sessionId,
+    };
+  }
+
+  /*
+   * An existing pin was read as root, and passing the create check says
+   * nothing about reading it: CreateRumSessionReplay, the ingest grant, is
+   * on the create list but not the read list, and a team can block reads
+   * alone. Such a caller learns that the recording is pinned, which is all
+   * pinning it again needs, and nothing that somebody else wrote on the pin.
+   */
+  private async presentExistingPin(
+    pin: Model,
+    pinKey: PinKey,
+    props: DatabaseCommonInteractionProps,
+  ): Promise<Model> {
+    if (await this.callerMayReadPins(props)) {
+      return pin;
+    }
+
+    /*
+     * Not even the pin's id: it is what the update and delete endpoints
+     * take, and this caller could not have listed it.
+     */
+    const acknowledgement: Model = new Model();
+    acknowledgement.projectId = pinKey.projectId;
+    acknowledgement.rumApplicationId = pinKey.rumApplicationId;
+    acknowledgement.sessionId = pinKey.sessionId;
+
+    return acknowledgement;
+  }
+
+  /*
+   * The gates a read of this table applies, answered instead of thrown: the
+   * read block list (label-scoped blocks included, which this model cannot
+   * narrow to rows and so refuses outright) and the read list itself. Any
+   * refusal, whatever its type, means the caller does not get the pin.
+   */
+  private async callerMayReadPins(
+    props: DatabaseCommonInteractionProps,
+  ): Promise<boolean> {
+    if (isInternalCaller(props)) {
+      return true;
+    }
+
+    try {
+      await ReadPermission.checkReadBlockPermission(Model, {}, props);
+
+      TablePermission.checkTableLevelPermissions(
+        Model,
+        props,
+        DatabaseRequestType.Read,
+      );
+    } catch (err) {
+      if (err instanceof Exception) {
+        return false;
       }
 
       throw err;
     }
+
+    return true;
   }
 
   /* Null when the recording is not pinned. */
   @CaptureSpan()
-  public async getPinForSession(data: {
-    projectId: ObjectID;
-    rumApplicationId: ObjectID;
-    sessionId: string;
-  }): Promise<Model | null> {
+  public async getPinForSession(data: PinKey): Promise<Model | null> {
     return await this.findOneBy({
       query: {
         projectId: data.projectId,
@@ -147,6 +415,9 @@ export class Service extends DatabaseService<Model> {
       },
       select: {
         _id: true,
+        projectId: true,
+        rumApplicationId: true,
+        sessionId: true,
         reason: true,
         incidentId: true,
         alertId: true,

package/Server/Services/StatusPagePrivateUserService.ts

@@ -1,8 +1,10 @@
+import crypto from "crypto";
 import DatabaseConfig from "../DatabaseConfig";
 import { EncryptionSecret } from "../EnvironmentConfig";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 import logger from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import MailService from "./MailService";
@@ -19,7 +21,6 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import Email from "../../Types/Email";
 import HashedString from "../../Types/HashedString";
 import BadDataException from "../../Types/Exception/BadDataException";
-import ObjectID from "../../Types/ObjectID";
 import StatusPage from "../../Models/DatabaseModels/StatusPage";
 import Model from "../../Models/DatabaseModels/StatusPagePrivateUser";
 
@@ -189,8 +190,10 @@ export class Service extends DatabaseService<Model> {
     /*
      * SCIM and admin-created users must follow the page's login policy too.
      * Do not create a password-reset credential when only SSO can be used.
+     * On the Community Edition there is no SSO login for status pages, so a
+     * leftover requirement is not enforced and the user gets a password link.
      */
-    if (statusPage.requireSsoForLogin) {
+    if (EditionEnforcement.isSsoRequired(statusPage.requireSsoForLogin)) {
       return createdItem;
     }
 
@@ -206,7 +209,8 @@ export class Service extends DatabaseService<Model> {
      * Same split as `/status-page-api/forgot-password`: the digest is
      * persisted, the raw token is only ever mailed.
      */
-    const token: string = ObjectID.generate().toString();
+    // A bearer secret: from the CSPRNG, never ObjectID's non-crypto fallback.
+    const token: string = crypto.randomUUID();
     const hashedToken: string = await HashedString.hashValue(
       token,
       EncryptionSecret,

package/Server/Services/StatusPageService.ts

@@ -1,9 +1,10 @@
 import DatabaseConfig from "../DatabaseConfig";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import CookieUtil from "../Utils/Cookie";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 import { ExpressRequest } from "../Utils/Express";
 import JSONWebToken from "../Utils/JsonWebToken";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -65,6 +66,7 @@ import OneUptimeDate from "../../Types/Date";
 import IncidentService from "./IncidentService";
 import MonitorStatusTimeline from "../../Models/DatabaseModels/MonitorStatusTimeline";
 import MonitorStatusTimelineService from "./MonitorStatusTimelineService";
+import { UptimeDailyAggregate } from "../../Types/StatusPage/UptimeDailyAggregate";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import UptimeUtil, { UptimeWindow } from "../../Utils/Uptime/UptimeUtil";
 import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
@@ -104,6 +106,14 @@ export {
   StatusPageReportRow,
 };
 
+/*
+ * The status page column that holds its SSO requirement: the one
+ * onFindSuccess masks and onBeforeUpdate guards while SSO is not active.
+ */
+export const STATUS_PAGE_SSO_REQUIREMENT_COLUMNS: ReadonlyArray<string> = [
+  "requireSsoForLogin",
+];
+
 export class Service extends DatabaseService<StatusPage> {
   /*
    * Caches the resolved status page URL per statusPageId. `getStatusPageURL`
@@ -268,6 +278,36 @@ export class Service extends DatabaseService<StatusPage> {
     return this.getDefaultEmailFooterText();
   }
 
+  /*
+   * While SSO is not active a status page's SSO requirement is not enforced:
+   * on the Community Edition (status page SSO login is part of the
+   * Enterprise Edition), and on an Enterprise install whose license is
+   * lapsed or does not include SSO (the SSO routes refuse). Reads made for a
+   * caller then report the EFFECTIVE value: not required. Internal (root)
+   * reads and the stored row keep the real value, and onBeforeUpdate keeps a
+   * caller from writing the masked value back, so running the Enterprise
+   * Edition with a valid license (or in its trial or grace period) again
+   * restores enforcement exactly as configured. The public master-page route
+   * reads as root and applies the same rule itself.
+   */
+  @CaptureSpan()
+  protected override async onFindSuccess(
+    onFind: OnFind<StatusPage>,
+    items: Array<StatusPage>,
+  ): Promise<OnFind<StatusPage>> {
+    if (
+      EditionEnforcement.shouldMaskSsoRequirementOnRead(onFind.findBy.props)
+    ) {
+      for (const item of items) {
+        if (item.requireSsoForLogin !== undefined) {
+          item.requireSsoForLogin = false;
+        }
+      }
+    }
+
+    return { ...onFind, carryForward: items };
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<StatusPage>,
@@ -763,6 +803,32 @@ export class Service extends DatabaseService<StatusPage> {
     return false;
   }
 
+  /**
+   * Per-monitor, per-day status durations for this status page's bars.
+   *
+   * This is what the uptime bars are painted from. It exists because the raw
+   * row fetch below is capped at LIMIT_MAX across EVERY monitor on the page,
+   * sorted newest-first - a bound that silently destroyed history. Measured
+   * on a real page: 254,550 rows matched the window, 10,000 came back, and
+   * three flapping monitors held 9,995 of those slots, starving the quiet
+   * monitors out entirely. See MonitorStatusTimelineService for the full
+   * account and for the traps in the SQL.
+   */
+  @CaptureSpan()
+  public async getUptimeDailyAggregateForStatusPage(data: {
+    monitorIds: Array<ObjectID>;
+    startDate: Date;
+    endDate: Date;
+    timezone?: string | undefined;
+  }): Promise<UptimeDailyAggregate> {
+    return await MonitorStatusTimelineService.getDailyUptimeAggregate({
+      monitorIds: data.monitorIds,
+      startDate: data.startDate,
+      endDate: data.endDate,
+      timezone: data.timezone,
+    });
+  }
+
   @CaptureSpan()
   public async getMonitorStatusTimelineForStatusPage(data: {
     monitorIds: Array<ObjectID>;
@@ -991,6 +1057,17 @@ export class Service extends DatabaseService<StatusPage> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<StatusPage>,
   ): Promise<OnUpdate<StatusPage>> {
+    /*
+     * While SSO is not active this caller only ever read the requirement as
+     * off (see onFindSuccess), so a write of it must not switch the stored
+     * requirement off, or set one nobody could see. Drops or refuses it.
+     */
+    EditionEnforcement.guardSsoRequirementWrite({
+      props: updateBy.props,
+      data: updateBy.data as unknown as Record<string, unknown>,
+      columns: STATUS_PAGE_SSO_REQUIREMENT_COLUMNS,
+    });
+
     // is enabling SMS subscribers.
 
     if (updateBy.data.enableSmsSubscribers) {

package/Server/Services/TeamMemberService.ts

@@ -8,6 +8,7 @@ import QueryHelper from "../Types/Database/QueryHelper";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import Select from "../Types/Database/Select";
 import UpdateBy from "../Types/Database/UpdateBy";
+import EditionEnforcement from "../Utils/EditionEnforcement";
 import Errors from "../Utils/Errors";
 import logger, { LogAttributes } from "../Utils/Logger";
 import ProductAnalytics from "../Utils/ProductAnalytics";
@@ -89,8 +90,18 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     super(TeamMember);
   }
 
+  /*
+   * Whether SCIM Push Groups owns this project's team membership, which locks
+   * member invites and removals made from OneUptime and lifts the one-member
+   * guard. Never on the Community Edition: it serves no SCIM endpoint, so a
+   * leftover Push Groups setting there would leave teams nobody can manage.
+   */
   @CaptureSpan()
   private async isSCIMPushGroupsEnabled(projectId: ObjectID): Promise<boolean> {
+    if (!EditionEnforcement.areScimTeamLocksEnforced()) {
+      return false;
+    }
+
     const count: PositiveNumber = await ProjectSCIMService.countBy({
       query: {
         projectId: projectId,