@oneuptime/common 13.0.7 → 14.0.0

package/Server/Types/Database/Permissions/Index.ts

@@ -7,9 +7,40 @@ import ReadPermission, { CheckReadPermissionType } from "./ReadPermission";
 import UpdatePermission from "./UpdatePermission";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil from "../../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
+import NotAuthenticatedException from "../../../../Types/Exception/NotAuthenticatedException";
+import NotAuthorizedException from "../../../../Types/Exception/NotAuthorizedException";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 
 export default class ModelPermission {
+  /*
+   * A refusal of a caller with no credentials at all is a 401.
+   *
+   * The login check near the top of every permission check passes an
+   * anonymous caller straight through on models that are readable (or
+   * creatable) by Public - Probe, AIAgent, LlmProvider and friends - and the
+   * column, select and query checks that follow then refuse it with 422
+   * NotAuthorizedException. For the dashboard that caller is a signed-in user
+   * whose access-token cookie expired, and only a 401 makes the browser client
+   * refresh the session and replay the request. Callers with credentials keep
+   * the 422 they always got; the message is kept either way.
+   */
+  private static toAnonymousRefusal(
+    error: unknown,
+    props: DatabaseCommonInteractionProps,
+  ): unknown {
+    if (
+      error instanceof NotAuthorizedException &&
+      !props.isRoot &&
+      !props.isMasterAdmin &&
+      DatabaseCommonInteractionPropsUtil.isAnonymous(props)
+    ) {
+      return new NotAuthenticatedException(error.message);
+    }
+
+    return error;
+  }
+
   @CaptureSpan()
   public static async checkDeletePermissionByModel<
     TBaseModel extends BaseModel,
@@ -18,7 +49,11 @@ export default class ModelPermission {
     fetchModelWithAccessControlIds: () => Promise<TBaseModel | null>;
     props: DatabaseCommonInteractionProps;
   }): Promise<void> {
-    return DeletePermission.checkDeletePermissionByModel(data);
+    try {
+      return await DeletePermission.checkDeletePermissionByModel(data);
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, data.props);
+    }
   }
 
   @CaptureSpan()
@@ -29,7 +64,11 @@ export default class ModelPermission {
     fetchModelWithAccessControlIds: () => Promise<TBaseModel | null>;
     props: DatabaseCommonInteractionProps;
   }): Promise<void> {
-    return UpdatePermission.checkUpdatePermissionByModel(data);
+    try {
+      return await UpdatePermission.checkUpdatePermissionByModel(data);
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, data.props);
+    }
   }
 
   @CaptureSpan()
@@ -38,7 +77,15 @@ export default class ModelPermission {
     query: Query<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
-    return DeletePermission.checkDeletePermission(modelType, query, props);
+    try {
+      return await DeletePermission.checkDeletePermission(
+        modelType,
+        query,
+        props,
+      );
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, props);
+    }
   }
 
   @CaptureSpan()
@@ -48,12 +95,16 @@ export default class ModelPermission {
     data: QueryDeepPartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
-    return UpdatePermission.checkUpdatePermissions(
-      modelType,
-      query,
-      data,
-      props,
-    );
+    try {
+      return await UpdatePermission.checkUpdatePermissions(
+        modelType,
+        query,
+        data,
+        props,
+      );
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, props);
+    }
   }
 
   @CaptureSpan()
@@ -62,7 +113,11 @@ export default class ModelPermission {
     data: TBaseModel,
     props: DatabaseCommonInteractionProps,
   ): void {
-    return CreatePermission.checkCreatePermissions(modelType, data, props);
+    try {
+      return CreatePermission.checkCreatePermissions(modelType, data, props);
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, props);
+    }
   }
 
   @CaptureSpan()
@@ -72,6 +127,15 @@ export default class ModelPermission {
     select: Select<TBaseModel> | null,
     props: DatabaseCommonInteractionProps,
   ): Promise<CheckReadPermissionType<TBaseModel>> {
-    return ReadPermission.checkReadPermission(modelType, query, select, props);
+    try {
+      return await ReadPermission.checkReadPermission(
+        modelType,
+        query,
+        select,
+        props,
+      );
+    } catch (error) {
+      throw ModelPermission.toAnonymousRefusal(error, props);
+    }
   }
 }

package/Server/Types/Database/Permissions/TablePermission.ts

@@ -57,10 +57,17 @@ export default class TablePermission {
     BillingPermissions.checkBillingPermissions(modelType, props, type);
 
     /*
-     * 3rd CHECK: Is this an enterprise-only feature being accessed on the
-     * community self-hosted build?
+     * 3rd CHECK: Is this a create of enterprise configuration that the
+     * edition or the license does not allow? (Reads and deletes always pass.)
+     * Updates are checked by UpdatePermission.checkUpdatePermissions instead,
+     * which every update runs and which sees what the update writes: an
+     * update that only tightens security (disabling an identity provider,
+     * rotating a SCIM token) needs no license, and this check, which is not
+     * handed the data, could only refuse it.
      */
-    EditionPermissions.checkEditionPermissions(modelType, props);
+    if (type !== DatabaseRequestType.Update) {
+      EditionPermissions.checkEditionPermissions(modelType, props, type);
+    }
 
     // 4th CHECK: Does user have access to CRUD data on this model.
     const userPermissions: Array<UserPermission> =
@@ -168,35 +175,31 @@ export default class TablePermission {
     const modelPermissions: Array<Permission> =
       TablePermission.getTablePermission(modelType, type);
 
-    const intersectingPermissions: Array<Permission> =
-      PermissionHelper.getIntersectingPermissions(
-        userPermissions.map((userPermission: UserPermission) => {
-          return userPermission.permission;
-        }) || [],
-        modelPermissions,
-      );
-
-    if (intersectingPermissions && intersectingPermissions.length > 0) {
-      for (const permission of intersectingPermissions) {
-        const userPermission: UserPermission = userPermissions.find(
-          (userPermission: UserPermission) => {
-            return userPermission.permission === permission;
-          },
-        ) as UserPermission;
-
-        if (
-          userPermission &&
+    /*
+     * The user gets one block row per TeamPermission across all of their
+     * teams, unmerged and unordered, so the same permission can be blocked
+     * both for some labels and for the whole table. A row without labels
+     * blocks the whole table and must win whichever row comes first:
+     * ReadPermission and AccessControlPermission only enforce the labelled
+     * rows, so an unlabelled row missed here is enforced nowhere.
+     */
+    const tableWideBlock: UserPermission | undefined = userPermissions.find(
+      (userPermission: UserPermission) => {
+        return (
+          modelPermissions.includes(userPermission.permission) &&
           (!userPermission.labelIds || userPermission.labelIds.length === 0)
-        ) {
-          throw new NotAuthorizedException(
-            `You are not authorized to ${type} ${
-              new modelType().singularName
-            } because ${
-              userPermission.permission
-            } is in your team's permission block list.`,
-          );
-        }
-      }
+        );
+      },
+    );
+
+    if (tableWideBlock) {
+      throw new NotAuthorizedException(
+        `You are not authorized to ${type} ${
+          new modelType().singularName
+        } because ${
+          tableWideBlock.permission
+        } is in your team's permission block list.`,
+      );
     }
   }
 }

package/Server/Types/Database/Permissions/UpdatePermission.ts

@@ -3,6 +3,7 @@ import Query from "../Query";
 import AccessControlUtil from "./AccessControlPermission";
 import BasePermission, { CheckPermissionBaseInterface } from "./BasePermission";
 import ColumnPermissions from "./ColumnPermission";
+import EditionPermissions from "./EditionPermission";
 import TablePermission from "./TablePermission";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
@@ -35,6 +36,27 @@ export default class UpdatePermission {
     data: QueryDeepPartialEntity<TBaseModel>,
     props: DatabaseCommonInteractionProps,
   ): Promise<Query<TBaseModel>> {
+    /*
+     * The edition check for updates runs here, the one permission entry
+     * point that sees what the update writes: an update that only tightens
+     * security (disabling an identity provider, rotating a SCIM token) needs
+     * no license, anything else does (see EditionPermission). TablePermission
+     * leaves updates to this method for that reason.
+     *
+     * Master admins skip every table-level check below, but not the edition
+     * check: changing enterprise configuration (global SSO/OIDC providers are
+     * only ever edited by master admins) needs the license for them too.
+     * Everyone else gets it right after the table-level check.
+     */
+    if (props.isMasterAdmin && !props.isRoot) {
+      EditionPermissions.checkEditionPermissions(
+        modelType,
+        props,
+        DatabaseRequestType.Update,
+        data,
+      );
+    }
+
     if (props.isRoot || props.isMasterAdmin) {
       // If system is making this query then let the query run!
       return query;
@@ -46,6 +68,13 @@ export default class UpdatePermission {
       DatabaseRequestType.Update,
     );
 
+    EditionPermissions.checkEditionPermissions(
+      modelType,
+      props,
+      DatabaseRequestType.Update,
+      data,
+    );
+
     const checkBasePermission: CheckPermissionBaseInterface<TBaseModel> =
       await BasePermission.checkPermissions(
         modelType,

package/Server/Types/Markdown.ts

@@ -207,6 +207,47 @@ export default class Markdown {
       );
     };
 
+    /*
+     * Lists. A platform monitor's root cause lists its affected resources
+     * as a numbered list with a bullet list of details nested under each
+     * item, and the cluster and metric details above it are bullets too.
+     *
+     * Left to the client, Gmail and Apple Mail indent every list level by
+     * 40px — close to a tenth of the card, twice over for a nested list —
+     * and Outlook's Word engine ignores padding on <ul>/<ol> and picks its
+     * own margins. So the indent is a margin-left, which Outlook honours,
+     * with padding zeroed: 24px holds a bullet, and 32px holds a numbered
+     * marker up to three digits ("100."). The vertical margins give each
+     * item's nested details a little air above and a gap below that
+     * separates it from the next item.
+     *
+     * margin-left is a physical side, so it is followed by the logical
+     * margin-inline-start / -end: a client that understands them moves
+     * the indent to the marker side in right-to-left text, and one that
+     * does not keeps the margin-left.
+     */
+    renderer.list = function (
+      body: string,
+      ordered: boolean,
+      start: number | "",
+    ): string {
+      const tag: string = ordered ? "ol" : "ul";
+      const startAttribute: string =
+        ordered && start !== "" && start !== 1 ? ` start="${start}"` : "";
+      const indent: string = ordered ? "32px" : "24px";
+
+      return (
+        `<${tag}${startAttribute} style="margin:6px 0 12px 0;` +
+        `margin-left:${indent};margin-inline-start:${indent};` +
+        `margin-inline-end:0;padding:0;">` +
+        `${body}</${tag}>`
+      );
+    };
+
+    renderer.listitem = function (text: string): string {
+      return `<li style="margin:0 0 4px;padding:0;">${text}</li>`;
+    };
+
     /*
      * The root cause backticks metric names, aliases and timestamps. Left
      * bare they were indistinguishable from the prose around them.

package/Server/Utils/AI/AIChatPrivacyFilter.ts

@@ -1,4 +1,5 @@
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil from "../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 
 /*
@@ -16,6 +17,13 @@ export function pinQueryToRequestingUser<TQuery>(
     return query;
   }
 
+  /*
+   * No credentials at all is an expired session, not someone else's data:
+   * 401 so the client refreshes. The countBy overrides reach this before the
+   * permission layer's own login check does.
+   */
+  DatabaseCommonInteractionPropsUtil.assertCredentialsPresent(props);
+
   if (!props.userId) {
     throw new NotAuthorizedException(
       "AI conversations are personal and can only be accessed by the user who created them.",

package/Server/Utils/AI/AIRunPrivacyFilter.ts

@@ -1,4 +1,5 @@
 import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil from "../../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import { FindWhereProperty } from "../../../Types/BaseDatabase/Query";
 import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
 import AIRunType from "../../../Types/AI/AIRunType";
@@ -57,6 +58,13 @@ export function getAIRunPrivacyRaw(
    * /ai-run nor /code-fix-run grants today. That is a separate product
    * decision and must not ride in as a side effect of this filter.
    */
+  /*
+   * No credentials at all is an expired session, not someone else's data:
+   * 401 so the client refreshes. The countBy overrides reach this before the
+   * permission layer's own login check does.
+   */
+  DatabaseCommonInteractionPropsUtil.assertCredentialsPresent(props);
+
   if (!props.userId) {
     throw new NotAuthorizedException(
       "AI runs are personal and can only be accessed by the user who created them.",