@oneuptime/common 13.0.7 → 14.0.0

package/build/dist/Server/Utils/CommunityEditionSsoReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CommunityEditionSsoReport.js","sourceRoot":"","sources":["../../../../Server/Utils/CommunityEditionSsoReport.ts"],"names":[],"mappings":"AAAA,OAAO,iBAEN,MAAM,iCAAiC,CAAC;AACzC,OAAO,iBAAiB,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACL,uCAAuC,EACvC,uCAAuC,GACxC,MAAM,yCAAyC,CAAC;AACjD,OAAO,mBAAmB,MAAM,iCAAiC,CAAC;AAClE,OAAO,kBAAkB,MAAM,gCAAgC,CAAC;AAChE,OAAO,cAAc,MAAM,4BAA4B,CAAC;AACxD,OAAO,iBAAiB,MAAM,+BAA+B,CAAC;AAC9D,OAAO,MAAM,MAAM,UAAU,CAAC;AAM9B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,uBAAuB,GAAW,EAAE,CAAC;AA+BlD,MAAM,iBAAiB,GAA8B,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AAE7E;;;;;;;;;;;;;GAaG;AACH,MAAqB,yBAAyB;IAK5C;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,yBAAyB;QAC3C,IAAI,iBAAiB,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,yBAAyB,CAAC,gBAAgB,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,yBAAyB,CAAC,MAAM,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,yBAAyB,CAAC,MAAM,GAAG,IAAI,CAAC;QAExC,OAAO,MAAM,yBAAyB,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACnE,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,KAAK,CAAC,MAAM,CACxB,OAAkC;QAElC,IAAI,CAAC;YACH,MAAM,OAAO,GACX,MAAM,yBAAyB,CAAC,OAAO,EAAE,CAAC;YAE5C,MAAM,OAAO,GAAkB,yBAAyB,CAAC,QAAQ,CAC/D,OAAO,EACP,OAAO,CACR,CAAC;YAEF,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvB,CAAC;YAED,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,OAAO,CAAC,MAAM,KAAK,WAAW;gBAC5B,CAAC,CAAC,2HAA2H;gBAC7H,CAAC,CAAC,yHAAyH,CAC9H,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,gBAAgB;QAC7B,IAAI,yBAAyB,CAAC,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;QAED,yBAAyB,CAAC,mBAAmB;YAC3C,iBAAiB,CAAC,oBAAoB,CACpC,CAAC,MAAoC,EAAQ,EAAE;gBAC7C,yBAAyB,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;YACzD,CAAC,CACF,CAAC;QAEJ,IAAI,CAAC;YACH,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACzD,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,oBAAoB,CACjC,MAAoC;QAEpC,MAAM,YAAY,GAAY,MAAM,CAAC,OAAO,CAAC,QAAQ,CACnD,iBAAiB,CAAC,GAAG,CACtB,CAAC;QACF,MAAM,aAAa,GAAY,MAAM,CAAC,OAAO,CAAC,QAAQ,CACpD,iBAAiB,CAAC,IAAI,CACvB,CAAC;QAEF,IAAI,CAAC,YAAY,IAAI,CAAC,aAAa,EAAE,CAAC;YACpC,OAAO;QACT,CAAC;QAED,KAAK,yBAAyB,CAAC,MAAM,CAAC;YACpC,MAAM,EAAE,gBAAgB;YACxB,YAAY;YACZ,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED,2EAA2E;IACpE,MAAM,CAAC,KAAK,CAAC,OAAO;QACzB,MAAM,CACJ,mBAAmB,EACnB,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,WAAW,EACX,SAAS,EACT,kBAAkB,EACnB,GAQG,MAAM,OAAO,CAAC,GAAG,CAAC;YACpB,mBAAmB,CAAC,qBAAqB,EAAE;YAC3C,cAAc,CAAC,OAAO,CAAC;gBACrB,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;gBACnC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC;YACF,cAAc,CAAC,MAAM,CAAC;gBACpB,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;gBACnC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACrB,KAAK,EAAE,uBAAuB;gBAC9B,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC;YACF,iBAAiB,CAAC,OAAO,CAAC;gBACxB,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;gBACnC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC;YACF,iBAAiB,CAAC,MAAM,CAAC;gBACvB,KAAK,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE;gBACnC,MAAM,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE;gBACrB,KAAK,EAAE,uBAAuB;gBAC9B,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC;YACF,kBAAkB,CAAC,OAAO,CAAC;gBACzB,KAAK,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;gBACjC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC;YACF,kBAAkB,CAAC,MAAM,CAAC;gBACxB,KAAK,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE;gBACjC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE;gBAC3B,KAAK,EAAE,uBAAuB;gBAC9B,IAAI,EAAE,CAAC;gBACP,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;aACxB,CAAC;SACH,CAAC,CAAC;QAEH,OAAO;YACL,mBAAmB,EAAE,OAAO,CAAC,mBAAmB,CAAC;YACjD,oBAAoB,EAAE,YAAY,CAAC,QAAQ,EAAE;YAC7C,sBAAsB,EAAE,yBAAyB,CAAC,KAAK,CACrD,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAgB,EAAE,EAAE;;gBAChC,OAAO,CAAA,MAAA,OAAO,CAAC,EAAE,0CAAE,QAAQ,EAAE,MAAI,MAAA,OAAO,CAAC,GAAG,0CAAE,QAAQ,EAAE,CAAA,CAAC;YAC3D,CAAC,CAAC,CACH;YACD,uBAAuB,EAAE,eAAe,CAAC,QAAQ,EAAE;YACnD,yBAAyB,EAAE,yBAAyB,CAAC,KAAK,CACxD,WAAW,CAAC,GAAG,CAAC,CAAC,UAAsB,EAAE,EAAE;;gBACzC,OAAO,CAAA,MAAA,UAAU,CAAC,EAAE,0CAAE,QAAQ,EAAE,MAAI,MAAA,UAAU,CAAC,GAAG,0CAAE,QAAQ,EAAE,CAAA,CAAC;YACjE,CAAC,CAAC,CACH;YACD,gCAAgC,EAAE,SAAS,CAAC,QAAQ,EAAE;YACtD,4BAA4B,EAAE,yBAAyB,CAAC,KAAK,CAC3D,kBAAkB,CAAC,GAAG,CAAC,CAAC,IAAiB,EAAE,EAAE;;gBAC3C,OAAO,MAAA,IAAI,CAAC,SAAS,0CAAE,QAAQ,EAAE,CAAC;YACpC,CAAC,CAAC,CACH;SACF,CAAC;IACJ,CAAC;IAED,iDAAiD;IAC1C,MAAM,CAAC,QAAQ,CACpB,OAAkC,EAClC,UAAqC,iBAAiB;QAEtD,MAAM,YAAY,GAChB,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC;QACzD,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,aAAa,CAAC;QAE1D,MAAM,OAAO,GAAkB,EAAE,CAAC;QAElC,IAAI,YAAY,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC;YAChD,OAAO,CAAC,IAAI,CACV,iGAAiG,CAClG,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,IAAI,OAAO,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,IAAI,CACV,GAAG,OAAO,CAAC,oBAAoB,yCAAyC,yBAAyB,CAAC,WAAW,CAC3G,OAAO,CAAC,sBAAsB,EAC9B,OAAO,CAAC,oBAAoB,CAC7B,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,IAAI,OAAO,CAAC,uBAAuB,GAAG,CAAC,EAAE,CAAC;YACxD,OAAO,CAAC,IAAI,CACV,GAAG,OAAO,CAAC,uBAAuB,qDAAqD,yBAAyB,CAAC,WAAW,CAC1H,OAAO,CAAC,yBAAyB,EACjC,OAAO,CAAC,uBAAuB,CAChC,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,aAAa,IAAI,OAAO,CAAC,gCAAgC,GAAG,CAAC,EAAE,CAAC;YAClE,OAAO,CAAC,IAAI,CACV,GAAG,OAAO,CAAC,gCAAgC,2FAA2F,yBAAyB,CAAC,WAAW,CACzK,OAAO,CAAC,4BAA4B,EACpC,OAAO,CAAC,gCAAgC,EACxC,aAAa,CACd,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YACxC,MAAM,OAAO,GACX,YAAY,IAAI,aAAa;gBAC3B,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,YAAY;oBACZ,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,uBAAuB,CAAC;YAEhC,OAAO,CACL,qGAAqG;gBACrG,WAAW,OAAO,0CAA0C,YAAY,IAAI,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,iBAAiB;gBAC1H,CAAC,YAAY;oBACX,CAAC,CAAC,sJAAsJ;oBACxJ,CAAC,CAAC,EAAE,CAAC;gBACP,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBACvC,8GAA8G,CAC/G,CAAC;QACJ,CAAC;QAED,OAAO,CACL,oHAAoH;YACpH,wFAAwF;YACxF,oFAAoF;YACpF,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YACvC,iJAAiJ,uCAAuC,sBAAsB,uCAAuC,6CAA6C,CACnS,CAAC;IACJ,CAAC;IAED,wEAAwE;IACjE,MAAM,CAAC,aAAa;QACzB,yBAAyB,CAAC,MAAM,GAAG,KAAK,CAAC;QAEzC,IAAI,yBAAyB,CAAC,mBAAmB,EAAE,CAAC;YAClD,yBAAyB,CAAC,mBAAmB,EAAE,CAAC;YAChD,yBAAyB,CAAC,mBAAmB,GAAG,IAAI,CAAC;QACvD,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,KAAK,CAAC,MAAiC;QACpD,OAAO,MAAM;aACV,MAAM,CAAC,CAAC,KAAyB,EAAmB,EAAE;YACrD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACvC,CAAC;IAEO,MAAM,CAAC,WAAW,CACxB,GAAkB,EAClB,KAAa,EACb,QAAgB,KAAK;QAErB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,IAAI,GACR,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,GAAG,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAE9D,OAAO,KAAK,KAAK,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC;IACjD,CAAC;;AApSc,gCAAM,GAAY,KAAK,CAAC;AAExB,6CAAmB,GAAwB,IAAI,CAAC;eAH5C,yBAAyB"}

package/build/dist/Server/Utils/EditionEnforcement.js

@@ -0,0 +1,187 @@
+import EnterpriseEdition from "../Enterprise/EnterpriseEdition";
+import EnterpriseFeature from "../Enterprise/EnterpriseFeature";
+import { ENTERPRISE_LICENSE_GRACE_PERIOD_IN_DAYS, ENTERPRISE_LICENSE_TRIAL_PERIOD_IN_DAYS, } from "../Enterprise/EnterpriseLicenseSnapshot";
+import logger from "./Logger";
+import PaymentRequiredException from "../../Types/Exception/PaymentRequiredException";
+/*
+ * Which enterprise identity controls are live in this process.
+ *
+ * Every answer here follows the RUNTIME state of the feature behind it
+ * (EnterpriseEdition.isFeatureActive): SSO for the SSO requirements, the
+ * SAML/OIDC sign-in routes and the provider listings, SCIM for the SCIM Push
+ * Groups team locks. A feature is active when the Enterprise Edition is loaded
+ * and, with billing off, its license covers the feature (valid, in the grace
+ * period after it expired, or - with no license - inside the trial).
+ *
+ * The controls are relaxed where they cannot work:
+ *   - on the Community Edition, which has no SAML/OIDC sign-in routes and no
+ *     SCIM endpoints;
+ *   - on an Enterprise install whose license has lapsed, where those routes
+ *     refuse (ee/Server/Identity).
+ * Enforcing a leftover "Require SSO for login" there would lock every user
+ * out, and a leftover SCIM Push Groups lock would leave teams nobody can
+ * manage. Users sign in with their password instead (users who only ever used
+ * SSO reset it). The configuration itself is kept untouched - reads made for
+ * a caller report the requirement as off, and a caller's write can neither
+ * switch it off nor set it meanwhile (guardSsoRequirementWrite) - so running
+ * the Enterprise Edition again (with a valid license, or during its trial or
+ * grace period), or renewing the license, restores enforcement without a
+ * restart.
+ *
+ * Failure direction: an error while deciding answers "enforce", and an
+ * unknown license state counts as active (see isFeatureActive), so a read
+ * error never switches a control off.
+ */
+class EditionEnforcement {
+    /*
+     * Whether configured SSO requirements - a project's requireSsoForLogin (and
+     * its required provider), the instance-wide requireSsoForLogin and a status
+     * page's requireSsoForLogin - are enforced.
+     */
+    static isSsoEnforced() {
+        try {
+            return EnterpriseEdition.isFeatureActive(EnterpriseFeature.SSO);
+        }
+        catch (err) {
+            logger.error("EditionEnforcement: could not tell whether SSO is enforced; enforcing it.");
+            logger.error(err);
+            return true;
+        }
+    }
+    // A configured SSO requirement that is also enforced in this process.
+    static isSsoRequired(configuredRequirement) {
+        if (!configuredRequirement) {
+            return false;
+        }
+        return EditionEnforcement.isSsoEnforced();
+    }
+    /*
+     * Whether SCIM Push Groups owns team membership: while a project's SCIM
+     * configuration has Push Groups on, teams and team members can only be
+     * changed by the identity provider. Relaxed on the Community Edition, and
+     * while the license does not cover SCIM, because then no SCIM endpoint
+     * answers the identity provider and nobody else could manage those teams.
+     */
+    static areScimTeamLocksEnforced() {
+        try {
+            return EnterpriseEdition.isFeatureActive(EnterpriseFeature.SCIM);
+        }
+        catch (err) {
+            logger.error("EditionEnforcement: could not tell whether SCIM team locks apply; applying them.");
+            logger.error(err);
+            return true;
+        }
+    }
+    /*
+     * Whether the SAML/OIDC sign-in routes answer right now. Provider listings
+     * (the lists a sign-in page offers) are empty when they do not, so no client
+     * sends a user into a route that answers 404 (Community Edition) or refuses
+     * because the license lapsed (Enterprise Edition).
+     */
+    static areSsoRoutesServed() {
+        try {
+            return EnterpriseEdition.isFeatureActive(EnterpriseFeature.SSO);
+        }
+        catch (err) {
+            logger.error("EditionEnforcement: could not tell whether the SSO routes are served; serving them.");
+            logger.error(err);
+            return true;
+        }
+    }
+    /*
+     * Whether a read should report the EFFECTIVE SSO requirement (false)
+     * instead of the stored one. Clients - the mobile app in particular, whose
+     * store builds cannot be patched - decide from these columns whether to
+     * start an SSO flow, and while SSO is not active that flow does not exist
+     * (Community Edition) or refuses (lapsed license).
+     *
+     * Only reads made for a caller are masked. Internal (root) reads see the
+     * stored value, and a read never writes, so the configuration is intact
+     * when SSO is active again. The write half is guardSsoRequirementWrite.
+     */
+    static shouldMaskSsoRequirementOnRead(props) {
+        if (!props || props.isRoot) {
+            return false;
+        }
+        return !EditionEnforcement.isSsoEnforced();
+    }
+    /*
+     * The write half of shouldMaskSsoRequirementOnRead, for the services'
+     * onBeforeUpdate. A caller whose reads are masked has only ever seen the
+     * requirement as off (no required provider), so what it writes to those
+     * columns cannot be taken at face value: a settings form, or an API client
+     * doing a read-modify-write, sends back the masked value it read. Saving it
+     * would switch a configured requirement off without anybody deciding to,
+     * and it would stay off once SSO is active again.
+     *
+     * So while this caller's reads are masked:
+     *   - a write of the masked value (false, or no provider) is dropped from
+     *     `data`, and the stored requirement is kept;
+     *   - a write that would set a requirement (true, or a provider) is
+     *     refused: it could neither be seen nor enforced until SSO is active;
+     *   - a write that is left with nothing else to save is refused with the
+     *     same explanation, rather than reporting a save that did not happen.
+     *
+     * Root writes, and every write while SSO is active, are left alone.
+     * Mutates `data`. Throws PaymentRequiredException.
+     */
+    static guardSsoRequirementWrite(input) {
+        if (!EditionEnforcement.shouldMaskSsoRequirementOnRead(input.props)) {
+            return;
+        }
+        const writtenColumns = input.columns.filter((column) => {
+            return input.data[column] !== undefined;
+        });
+        if (writtenColumns.length === 0) {
+            return;
+        }
+        const setsRequirement = writtenColumns.some((column) => {
+            return !EditionEnforcement.isMaskedSsoRequirementValue(input.data[column]);
+        });
+        if (setsRequirement) {
+            throw EditionEnforcement.createSsoRequirementUnchangeableException();
+        }
+        for (const column of writtenColumns) {
+            delete input.data[column];
+        }
+        /*
+         * `data` is the plain update onBeforeUpdate receives (a model instance
+         * has already been reduced to its set columns by
+         * DatabaseService.sanitizeUpdateData); a key left undefined writes
+         * nothing, so it does not count.
+         */
+        const hasOtherColumns = Object.keys(input.data).some((key) => {
+            return input.data[key] !== undefined;
+        });
+        if (!hasOtherColumns) {
+            throw EditionEnforcement.createSsoRequirementUnchangeableException();
+        }
+    }
+    // What a masked read reports for a requirement column: false or null.
+    static isMaskedSsoRequirementValue(value) {
+        return value === false || value === null;
+    }
+    static createSsoRequirementUnchangeableException() {
+        let isEnterpriseEditionLoaded = true;
+        try {
+            isEnterpriseEditionLoaded = EnterpriseEdition.isLoaded();
+        }
+        catch (err) {
+            logger.error(err);
+        }
+        return new PaymentRequiredException(isEnterpriseEditionLoaded
+            ? EditionEnforcement.SSO_REQUIREMENT_UNCHANGEABLE_LICENSE_MESSAGE
+            : EditionEnforcement.SSO_REQUIREMENT_UNCHANGEABLE_COMMUNITY_MESSAGE);
+    }
+}
+// Why guardSsoRequirementWrite refuses a write, on the Community Edition.
+EditionEnforcement.SSO_REQUIREMENT_UNCHANGEABLE_COMMUNITY_MESSAGE = 'Single sign-on is part of the OneUptime Enterprise Edition and this server runs the Community Edition, so "Require SSO for login" shows as off, is not enforced and cannot be changed here. ' +
+    `A setting saved earlier is kept, and it is enforced again when this server runs the Enterprise Edition image with a valid license (or during its ${ENTERPRISE_LICENSE_TRIAL_PERIOD_IN_DAYS}-day trial, or the ${ENTERPRISE_LICENSE_GRACE_PERIOD_IN_DAYS}-day grace period after a license expires).`;
+/*
+ * Why guardSsoRequirementWrite refuses a write, on an Enterprise install
+ * whose license does not cover SSO right now.
+ */
+EditionEnforcement.SSO_REQUIREMENT_UNCHANGEABLE_LICENSE_MESSAGE = 'Single sign-on has stopped because the OneUptime Enterprise license is missing, expired or does not include SSO, so "Require SSO for login" shows as off, is not enforced and cannot be changed. ' +
+    "The saved setting is kept, and it is enforced again as soon as a master admin activates or renews the license from the edition label in the Admin Dashboard header.";
+export default EditionEnforcement;
+//# sourceMappingURL=EditionEnforcement.js.map

package/build/dist/Server/Utils/EditionEnforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"EditionEnforcement.js","sourceRoot":"","sources":["../../../../Server/Utils/EditionEnforcement.ts"],"names":[],"mappings":"AAAA,OAAO,iBAAiB,MAAM,iCAAiC,CAAC;AAChE,OAAO,iBAAiB,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACL,uCAAuC,EACvC,uCAAuC,GACxC,MAAM,yCAAyC,CAAC;AACjD,OAAO,MAAM,MAAM,UAAU,CAAC;AAE9B,OAAO,wBAAwB,MAAM,gDAAgD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAqB,kBAAkB;IAcrC;;;;OAIG;IACI,MAAM,CAAC,aAAa;QACzB,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,2EAA2E,CAC5E,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,sEAAsE;IAC/D,MAAM,CAAC,aAAa,CACzB,qBAAiD;QAEjD,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,kBAAkB,CAAC,aAAa,EAAE,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,wBAAwB;QACpC,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,kFAAkF,CACnF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,kBAAkB;QAC9B,IAAI,CAAC;YACH,OAAO,iBAAiB,CAAC,eAAe,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAClE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CACV,qFAAqF,CACtF,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACI,MAAM,CAAC,8BAA8B,CAC1C,KAAwD;QAExD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,kBAAkB,CAAC,aAAa,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;;;;;;;;;;OAmBG;IACI,MAAM,CAAC,wBAAwB,CAAC,KAKtC;QACC,IAAI,CAAC,kBAAkB,CAAC,8BAA8B,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACpE,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAkB,KAAK,CAAC,OAAO,CAAC,MAAM,CACxD,CAAC,MAAc,EAAW,EAAE;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,SAAS,CAAC;QAC1C,CAAC,CACF,CAAC;QAEF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO;QACT,CAAC;QAED,MAAM,eAAe,GAAY,cAAc,CAAC,IAAI,CAClD,CAAC,MAAc,EAAW,EAAE;YAC1B,OAAO,CAAC,kBAAkB,CAAC,2BAA2B,CACpD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CACnB,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,kBAAkB,CAAC,yCAAyC,EAAE,CAAC;QACvE,CAAC;QAED,KAAK,MAAM,MAAM,IAAI,cAAc,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,CAAC;QAED;;;;;WAKG;QACH,MAAM,eAAe,GAAY,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAC3D,CAAC,GAAW,EAAW,EAAE;YACvB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QACvC,CAAC,CACF,CAAC;QAEF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,kBAAkB,CAAC,yCAAyC,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED,sEAAsE;IAC9D,MAAM,CAAC,2BAA2B,CAAC,KAAc;QACvD,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC;IAC3C,CAAC;IAEO,MAAM,CAAC,yCAAyC;QACtD,IAAI,yBAAyB,GAAY,IAAI,CAAC;QAE9C,IAAI,CAAC;YACH,yBAAyB,GAAG,iBAAiB,CAAC,QAAQ,EAAE,CAAC;QAC3D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,wBAAwB,CACjC,yBAAyB;YACvB,CAAC,CAAC,kBAAkB,CAAC,4CAA4C;YACjE,CAAC,CAAC,kBAAkB,CAAC,8CAA8C,CACtE,CAAC;IACJ,CAAC;;AA/LD,0EAA0E;AACnD,iEAA8C,GACnE,8LAA8L;IAC9L,oJAAoJ,uCAAuC,sBAAsB,uCAAuC,6CAA6C,CAAC;AAExS;;;GAGG;AACoB,+DAA4C,GACjE,mMAAmM;IACnM,qKAAqK,CAAC;eAZrJ,kBAAkB"}

package/build/dist/Server/Utils/FrontendEnvironment.js

@@ -1,6 +1,35 @@
-import { getFrontendEnvVars } from "../EnvironmentConfig";
+import { getFrontendEnvVars, isEnterpriseEditionRequested, } from "../EnvironmentConfig";
+import EnterpriseEdition from "../Enterprise/EnterpriseEdition";
 import Response from "./Response";
 export const FRONTEND_ENVIRONMENT_CACHE_CONTROL = "private, no-store, no-cache, must-revalidate";
+/*
+ * The edition the frontends are told about is the EFFECTIVE one: whether the
+ * enterprise module actually loaded in this process, not what the raw
+ * IS_ENTERPRISE_EDITION variable claims. A Community image with a leftover
+ * IS_ENTERPRISE_EDITION=true must not show enterprise pages whose server
+ * routes do not exist; ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED lets the
+ * admin UI explain that mismatch to a master admin instead.
+ *
+ * "Requested" is EnvironmentConfig's isEnterpriseEditionRequested, the same
+ * definition the App's boot guard uses: an explicit ONEUPTIME_EDITION=community
+ * withdraws the request, so the Enterprise image (which bakes
+ * IS_ENTERPRISE_EDITION=true) run as the Community Edition on purpose is not
+ * told to switch images. It is read on every call, like the rest of the
+ * environment served here.
+ */
+export const getFrontendEnvironmentVariables = () => {
+    const frontendEnv = getFrontendEnvVars();
+    const isEnterpriseEditionLoaded = EnterpriseEdition.isLoaded();
+    const isEnterpriseEditionExpected = isEnterpriseEditionRequested(process.env);
+    frontendEnv["IS_ENTERPRISE_EDITION"] = isEnterpriseEditionLoaded
+        ? "true"
+        : "false";
+    frontendEnv["ENTERPRISE_EDITION_REQUESTED_BUT_NOT_LOADED"] =
+        isEnterpriseEditionExpected && !isEnterpriseEditionLoaded
+            ? "true"
+            : "false";
+    return frontendEnv;
+};
 /*
  * The combined App server and the five standalone frontend servers must emit
  * exactly the same environment payload. Keeping the serializer here prevents
@@ -15,7 +44,7 @@ if(!window.process){
 if(!window.process.env){
   window.process.env = {}
 }
-window.process.env = ${JSON.stringify(getFrontendEnvVars())};
+window.process.env = ${JSON.stringify(getFrontendEnvironmentVariables())};
 `;
 };
 /*

package/build/dist/Server/Utils/FrontendEnvironment.js.map

@@ -1 +1 @@
-{"version":3,"file":"FrontendEnvironment.js","sourceRoot":"","sources":["../../../../Server/Utils/FrontendEnvironment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,OAAO,QAAQ,MAAM,YAAY,CAAC;AAElC,MAAM,CAAC,MAAM,kCAAkC,GAC7C,8CAA8C,CAAC;AAEjD;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAiB,GAAW,EAAE;IACrE,OAAO;;;;;;;;uBAQc,IAAI,CAAC,SAAS,CAAC,kBAAkB,EAAE,CAAC;CAC1D,CAAC;AACF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAGhC,CAAC,GAAmB,EAAE,GAAoB,EAAQ,EAAE;IAC9D,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACnE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,4BAA4B,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC"}
+{"version":3,"file":"FrontendEnvironment.js","sourceRoot":"","sources":["../../../../Server/Utils/FrontendEnvironment.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,4BAA4B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,iBAAiB,MAAM,iCAAiC,CAAC;AAEhE,OAAO,QAAQ,MAAM,YAAY,CAAC;AAGlC,MAAM,CAAC,MAAM,kCAAkC,GAC7C,8CAA8C,CAAC;AAEjD;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,GAAe,EAAE;IACf,MAAM,WAAW,GAAe,kBAAkB,EAAE,CAAC;IACrD,MAAM,yBAAyB,GAAY,iBAAiB,CAAC,QAAQ,EAAE,CAAC;IACxE,MAAM,2BAA2B,GAAY,4BAA4B,CACvE,OAAO,CAAC,GAAG,CACZ,CAAC;IAEF,WAAW,CAAC,uBAAuB,CAAC,GAAG,yBAAyB;QAC9D,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC;IACZ,WAAW,CAAC,6CAA6C,CAAC;QACxD,2BAA2B,IAAI,CAAC,yBAAyB;YACvD,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,OAAO,CAAC;IAEd,OAAO,WAAW,CAAC;AACrB,CAAC,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAiB,GAAW,EAAE;IACrE,OAAO;;;;;;;;uBAQc,IAAI,CAAC,SAAS,CAAC,+BAA+B,EAAE,CAAC;CACvE,CAAC;AACF,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAGhC,CAAC,GAAmB,EAAE,GAAoB,EAAQ,EAAE;IAC9D,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAChC,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,kCAAkC,CAAC,CAAC;IACnE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,4BAA4B,EAAE,CAAC,CAAC;AAC5E,CAAC,CAAC"}

package/build/dist/Server/Utils/InstanceHealth/RedisHealth.js

@@ -1,36 +1,4 @@
 import Redis from "../../Infrastructure/Redis";
-/*
- * Where the previous counter sample is kept so a later run can turn Redis'
- * monotonic counters into "did this happen since we last looked".
- *
- * Redis stores its own history here on purpose: the counters and the sample
- * then share a lifetime, so a Redis restart clears both together and cannot
- * leave a stale baseline that fabricates an enormous delta. The uptime guard
- * below covers the case where the sample somehow outlives a restart anyway.
- *
- * Under memory pressure with an eviction policy this key can itself be evicted,
- * which costs one interval of eviction detection: the next run finds no sample,
- * re-seeds it, and reports deltas again from there.
- */
-const COUNTER_SAMPLE_KEY = "oneuptime-instance-health-redis-sample";
-const COUNTER_SAMPLE_TTL_IN_SECONDS = 60 * 60;
-/*
- * The minimum age of the baseline the counter deltas are measured against, so
- * every evaluation answers "did this happen in at least the last half hour"
- * rather than "did it happen in the last five minutes".
- *
- * That span is what keeps an edge-triggered signal from flapping. Evictions
- * arriving in bursts would otherwise clear on the first quiet tick and fire
- * again on the next, emailing every other cycle.
- *
- * Two samples are kept rather than one because a single rolling baseline is a
- * TUMBLING window, not a sliding one: the tick immediately after a roll would
- * compare against a five-minute-old sample and a lone quiet tick there would
- * resolve the notification, re-notifying on the next burst of the same ongoing
- * incident. Measuring against the OLDER of two samples makes the lookback
- * always at least this long (and at most twice it).
- */
-export const COUNTER_WINDOW_IN_SECONDS = 30 * 60;
 /*
  * INFO is a flat `field:value` document split into `# Section` blocks. Section
  * headers and comment lines are dropped; field names are unique across sections
@@ -110,103 +78,11 @@ async function getMaxClients(client, info) {
     }
     return null;
 }
-function parseCounterSample(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value)) {
-        return null;
-    }
-    const sample = value;
-    const evictedKeys = Number(sample["evictedKeys"]);
-    const rejectedConnections = Number(sample["rejectedConnections"]);
-    const uptimeInSeconds = Number(sample["uptimeInSeconds"]);
-    if (!Number.isFinite(evictedKeys) ||
-        !Number.isFinite(rejectedConnections) ||
-        !Number.isFinite(uptimeInSeconds)) {
-        return null;
-    }
-    return { evictedKeys, rejectedConnections, uptimeInSeconds };
-}
-async function readCounterSamples(client) {
-    try {
-        const raw = await client.get(COUNTER_SAMPLE_KEY);
-        if (!raw) {
-            return null;
-        }
-        const parsed = JSON.parse(raw);
-        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-            return null;
-        }
-        const stored = parsed;
-        const older = parseCounterSample(stored["older"]);
-        const newer = parseCounterSample(stored["newer"]);
-        if (older && newer) {
-            return { older, newer };
-        }
-        /*
-         * A single-sample payload is what the previous release wrote. Treat it as
-         * both ends of the pair so an upgrade keeps its baseline instead of going
-         * blind for a window.
-         */
-        const legacy = parseCounterSample(parsed);
-        return legacy ? { older: legacy, newer: legacy } : null;
-    }
-    catch (_a) {
-        // A missing or unreadable sample simply means no delta this run.
-        return null;
-    }
-}
 /*
- * Returns whether the baseline was actually stored. The caller needs to know,
- * because a write can fail for a reason that does not stop the key from being
- * kept alive by other means — see getRedisHealthSnapshot.
+ * One INFO read, plus the CONFIG fallback for maxclients. Exported so the
+ * Enterprise worker's snapshot reads Redis exactly the way this file does.
  */
-async function writeCounterSamples(client, samples) {
-    try {
-        await client.set(COUNTER_SAMPLE_KEY, JSON.stringify(samples), "EX", COUNTER_SAMPLE_TTL_IN_SECONDS);
-        return true;
-    }
-    catch (_a) {
-        /*
-         * Losing the baseline must never fail the health evaluation that produced
-         * this snapshot, so the error is swallowed and reported through the return.
-         */
-        return false;
-    }
-}
-// Keep a baseline alive across the runs that do not rewrite it.
-async function refreshCounterSampleTtl(client) {
-    try {
-        await client.expire(COUNTER_SAMPLE_KEY, COUNTER_SAMPLE_TTL_IN_SECONDS);
-    }
-    catch (_a) {
-        // Same reasoning as writeCounterSamples: never fail the evaluation over this.
-    }
-}
-/*
- * The pair rolls only once the NEWER sample has aged past the window, which
- * promotes it to `older` and starts a fresh one. Deltas are always measured
- * against `older`, so the lookback never drops below the window. Redis' own
- * uptime measures that age, which avoids trusting either machine's clock.
- */
-export function shouldRollCounterSamples(data) {
-    if (!data.previous || data.didRestart) {
-        return true;
-    }
-    return (data.currentUptimeInSeconds - data.previous.newer.uptimeInSeconds >=
-        COUNTER_WINDOW_IN_SECONDS);
-}
-/*
- * Compare a monotonic counter against its previous value. A decrease, or a
- * shorter uptime than the sample was taken at, means Redis restarted and the
- * counter began again from zero — the difference is meaningless, so report no
- * delta rather than a fabricated spike.
- */
-export function getCounterDelta(data) {
-    if (data.didRestart || data.current < data.previous) {
-        return null;
-    }
-    return data.current - data.previous;
-}
-async function readInfoSnapshot(client) {
+export async function readInfoSnapshot(client) {
     const info = parseRedisInfo(await client.info());
     return buildRedisInfoSnapshot({
         info,
@@ -215,9 +91,9 @@ async function readInfoSnapshot(client) {
 }
 /*
  * Read-only view for the admin health API. It deliberately does NOT touch the
- * stored counter sample: advancing that baseline here would consume the delta
- * the worker needs, so a page refresh could hide an eviction burst from the
- * notification that exists to catch it.
+ * counter sample the Enterprise health worker keeps: advancing that baseline
+ * here would consume the delta the worker needs, so a page refresh could hide
+ * an eviction burst from the notification that exists to catch it.
  */
 export async function getRedisInfoSnapshot() {
     const client = Redis.getClient();
@@ -226,67 +102,4 @@ export async function getRedisInfoSnapshot() {
     }
     return await readInfoSnapshot(client);
 }
-/*
- * The evaluating worker's view: the same INFO read, plus the counter deltas
- * that turn cumulative totals into "did this happen in roughly the last
- * COUNTER_WINDOW_IN_SECONDS". Returns null when Redis is unreachable, which the
- * caller treats as "cannot evaluate" rather than "healthy".
- */
-export async function getRedisHealthSnapshot() {
-    const client = Redis.getClient();
-    if (!client || !Redis.isConnected()) {
-        return null;
-    }
-    const snapshot = await readInfoSnapshot(client);
-    const previousSamples = await readCounterSamples(client);
-    const didRestart = Boolean(previousSamples &&
-        previousSamples.older.uptimeInSeconds > snapshot.uptimeInSeconds);
-    // Deltas always measure against the older half, never the freshly rolled one.
-    const baseline = previousSamples
-        ? previousSamples.older
-        : null;
-    const current = {
-        evictedKeys: snapshot.evictedKeys,
-        rejectedConnections: snapshot.rejectedConnections,
-        uptimeInSeconds: snapshot.uptimeInSeconds,
-    };
-    const wantsRoll = shouldRollCounterSamples({
-        previous: previousSamples,
-        currentUptimeInSeconds: snapshot.uptimeInSeconds,
-        didRestart,
-    });
-    const didRoll = wantsRoll
-        ? await writeCounterSamples(client, {
-            older: previousSamples && !didRestart ? previousSamples.newer : current,
-            newer: current,
-        })
-        : false;
-    /*
-     * Keep the existing samples alive whenever they were not rolled — including
-     * when the roll FAILED, which is the case that matters most. Under the
-     * noeviction policy Redis rejects SET once it is out of memory but still
-     * serves EXPIRE, so letting a failed write skip the refresh would expire the
-     * baseline precisely when memory is full: eviction detection would then go
-     * permanently blind at the moment it is needed, because every later write
-     * fails the same way and the key never returns.
-     */
-    if (!didRoll) {
-        await refreshCounterSampleTtl(client);
-    }
-    return Object.assign(Object.assign({}, snapshot), { counterWindowInSeconds: baseline
-            ? snapshot.uptimeInSeconds - baseline.uptimeInSeconds
-            : null, evictedKeysDelta: baseline
-            ? getCounterDelta({
-                current: snapshot.evictedKeys,
-                previous: baseline.evictedKeys,
-                didRestart,
-            })
-            : null, rejectedConnectionsDelta: baseline
-            ? getCounterDelta({
-                current: snapshot.rejectedConnections,
-                previous: baseline.rejectedConnections,
-                didRestart,
-            })
-            : null });
-}
 //# sourceMappingURL=RedisHealth.js.map

package/build/dist/Server/Utils/InstanceHealth/RedisHealth.js.map

@@ -1 +1 @@
-{"version":3,"file":"RedisHealth.js","sourceRoot":"","sources":["../../../../../Server/Utils/InstanceHealth/RedisHealth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,4BAA4B,CAAC;AAG/D;;;;;;;;;;;;GAYG;AACH,MAAM,kBAAkB,GAAW,wCAAwC,CAAC;AAC5E,MAAM,6BAA6B,GAAW,EAAE,GAAG,EAAE,CAAC;AAEtD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAW,EAAE,GAAG,EAAE,CAAC;AAqDzD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAW,IAAI,CAAC,IAAI,EAAE,CAAC;QAEpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,cAAc,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CACtD,cAAc,GAAG,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,gBAAgB,GAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,iBAAiB,GAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAE1E,OAAO;QACL,iBAAiB;QACjB,gBAAgB;QAChB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,SAAS;QAC3D,wBAAwB,EACtB,gBAAgB,GAAG,CAAC;YAClB,CAAC,CAAC,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,GAAG,GAAG;YAC9C,CAAC,CAAC,IAAI;QACV,gBAAgB;QAChB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,wBAAwB,EACtB,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;YAC7C,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG;YAC5C,CAAC,CAAC,IAAI;QACV,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtD,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,mBAAmB,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAChE,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,SAAS;QACrE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,GAAG;QAC9C,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,SAAS;QACnE,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,SAAS;QAC3E,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,MAAkB,EAClB,IAAwB;IAExB,MAAM,QAAQ,GAAkB,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAExE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,WAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAA4B,KAAgC,CAAC;IACzE,MAAM,WAAW,GAAW,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IAC1D,MAAM,mBAAmB,GAAW,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAC1E,MAAM,eAAe,GAAW,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IAElE,IACE,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAC;QACrC,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EACjC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,eAAe,EAAE,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,MAAkB;IAElB,IAAI,CAAC;QACH,MAAM,GAAG,GAAkB,MAAM,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAEhE,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAExC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAA4B,MAAiC,CAAC;QAC1E,MAAM,KAAK,GAA8B,kBAAkB,CACzD,MAAM,CAAC,OAAO,CAAC,CAChB,CAAC;QACF,MAAM,KAAK,GAA8B,kBAAkB,CACzD,MAAM,CAAC,OAAO,CAAC,CAChB,CAAC;QAEF,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;YACnB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QAC1B,CAAC;QAED;;;;WAIG;QACH,MAAM,MAAM,GAA8B,kBAAkB,CAAC,MAAM,CAAC,CAAC;QAErE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,WAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,MAAkB,EAClB,OAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,GAAG,CACd,kBAAkB,EAClB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvB,IAAI,EACJ,6BAA6B,CAC9B,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,WAAM,CAAC;QACP;;;WAGG;QACH,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,gEAAgE;AAChE,KAAK,UAAU,uBAAuB,CAAC,MAAkB;IACvD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,EAAE,6BAA6B,CAAC,CAAC;IACzE,CAAC;IAAC,WAAM,CAAC;QACP,8EAA8E;IAChF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAIxC;IACC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,CACL,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,eAAe;QACjE,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,IAI/B;IACC,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,MAAkB;IAElB,MAAM,IAAI,GAAuB,cAAc,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAErE,OAAO,sBAAsB,CAAC;QAC5B,IAAI;QACJ,UAAU,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;IAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;IAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAsB,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAEnE,MAAM,eAAe,GACnB,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACnC,MAAM,UAAU,GAAY,OAAO,CACjC,eAAe;QACb,eAAe,CAAC,KAAK,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe,CACnE,CAAC;IACF,8EAA8E;IAC9E,MAAM,QAAQ,GAA8B,eAAe;QACzD,CAAC,CAAC,eAAe,CAAC,KAAK;QACvB,CAAC,CAAC,IAAI,CAAC;IAET,MAAM,OAAO,GAAuB;QAClC,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;QACjD,eAAe,EAAE,QAAQ,CAAC,eAAe;KAC1C,CAAC;IACF,MAAM,SAAS,GAAY,wBAAwB,CAAC;QAClD,QAAQ,EAAE,eAAe;QACzB,sBAAsB,EAAE,QAAQ,CAAC,eAAe;QAChD,UAAU;KACX,CAAC,CAAC;IACH,MAAM,OAAO,GAAY,SAAS;QAChC,CAAC,CAAC,MAAM,mBAAmB,CAAC,MAAM,EAAE;YAChC,KAAK,EAAE,eAAe,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;YACvE,KAAK,EAAE,OAAO;SACf,CAAC;QACJ,CAAC,CAAC,KAAK,CAAC;IAEV;;;;;;;;OAQG;IACH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,uCACK,QAAQ,KACX,sBAAsB,EAAE,QAAQ;YAC9B,CAAC,CAAC,QAAQ,CAAC,eAAe,GAAG,QAAQ,CAAC,eAAe;YACrD,CAAC,CAAC,IAAI,EACR,gBAAgB,EAAE,QAAQ;YACxB,CAAC,CAAC,eAAe,CAAC;gBACd,OAAO,EAAE,QAAQ,CAAC,WAAW;gBAC7B,QAAQ,EAAE,QAAQ,CAAC,WAAW;gBAC9B,UAAU;aACX,CAAC;YACJ,CAAC,CAAC,IAAI,EACR,wBAAwB,EAAE,QAAQ;YAChC,CAAC,CAAC,eAAe,CAAC;gBACd,OAAO,EAAE,QAAQ,CAAC,mBAAmB;gBACrC,QAAQ,EAAE,QAAQ,CAAC,mBAAmB;gBACtC,UAAU;aACX,CAAC;YACJ,CAAC,CAAC,IAAI,IACR;AACJ,CAAC"}
+{"version":3,"file":"RedisHealth.js","sourceRoot":"","sources":["../../../../../Server/Utils/InstanceHealth/RedisHealth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,4BAA4B,CAAC;AAkC/D;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,MAAM,GAAuB,EAAE,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,OAAO,GAAW,IAAI,CAAC,IAAI,EAAE,CAAC;QAEpC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,SAAS;QACX,CAAC;QAED,MAAM,cAAc,GAAW,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAEpD,IAAI,cAAc,IAAI,CAAC,EAAE,CAAC;YACxB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CACtD,cAAc,GAAG,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACzC,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,cAAc,CAAC,KAAyB;IAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAW,MAAM,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAGtC;IACC,MAAM,gBAAgB,GAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAClE,MAAM,iBAAiB,GAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACrE,MAAM,gBAAgB,GAAW,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAE1E,OAAO;QACL,iBAAiB;QACjB,gBAAgB;QAChB,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,SAAS;QAC3D,wBAAwB,EACtB,gBAAgB,GAAG,CAAC;YAClB,CAAC,CAAC,CAAC,iBAAiB,GAAG,gBAAgB,CAAC,GAAG,GAAG;YAC9C,CAAC,CAAC,IAAI;QACV,gBAAgB;QAChB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,wBAAwB,EACtB,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,GAAG,CAAC;YAC7C,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG;YAC5C,CAAC,CAAC,IAAI;QACV,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtD,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAChD,mBAAmB,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QAChE,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC,IAAI,SAAS;QACrE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,GAAG;QAC9C,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,SAAS;QACnE,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,SAAS;QAC3E,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,MAAkB,EAClB,IAAwB;IAExB,MAAM,QAAQ,GAAkB,cAAc,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAEnE,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAY,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;QAExE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;YAC9C,OAAO,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,WAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAkB;IAElB,MAAM,IAAI,GAAuB,cAAc,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAErE,OAAO,sBAAsB,CAAC;QAC5B,IAAI;QACJ,UAAU,EAAE,MAAM,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACxC,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;IAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,MAAM,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/build/dist/Server/Utils/MasterAdminPageAccess.js

@@ -0,0 +1,39 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import JSONWebToken from "./JsonWebToken";
+import logger from "./Logger";
+import Response from "./Response";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+export const NOT_A_MASTER_ADMIN_MESSAGE = "Unauthorized: Only master admins can access the admin dashboard.";
+/*
+ * Gate for the Admin Dashboard's index page (the HTML shell, not its APIs).
+ *
+ * It refuses only a caller it can positively identify as NOT a master admin.
+ * A missing access token, or one that no longer decodes, is served the shell:
+ * the access-token cookie expires with the JWT inside it, so an admin who
+ * reloads a tab left open past the token lifetime arrives here with no token
+ * at all, and answering that with a 422 JSON page meant the app never loaded
+ * and so never got to refresh the session. The shell holds nothing the public
+ * static bundle does not; once it loads, the SPA sends a signed-out visitor to
+ * the login page, and every admin API it calls refreshes an expired session
+ * (or answers 401) on its own.
+ */
+export const ensureMasterAdminPageAccess = async (data) => {
+    const accessToken = UserMiddleware.getAccessTokenFromExpressRequest(data.req);
+    if (!accessToken) {
+        return {};
+    }
+    let authData;
+    try {
+        authData = JSONWebToken.decode(accessToken);
+    }
+    catch (error) {
+        // Expired or unreadable: let the app load and refresh it.
+        logger.debug(error, { service: data.service });
+        return {};
+    }
+    if (!authData.isMasterAdmin) {
+        Response.sendErrorResponse(data.req, data.res, new NotAuthorizedException(NOT_A_MASTER_ADMIN_MESSAGE));
+    }
+    return {};
+};
+//# sourceMappingURL=MasterAdminPageAccess.js.map

package/build/dist/Server/Utils/MasterAdminPageAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MasterAdminPageAccess.js","sourceRoot":"","sources":["../../../../Server/Utils/MasterAdminPageAccess.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,iCAAiC,CAAC;AAE7D,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAC1C,OAAO,MAAM,MAAM,UAAU,CAAC;AAC9B,OAAO,QAAQ,MAAM,YAAY,CAAC;AAClC,OAAO,sBAAsB,MAAM,8CAA8C,CAAC;AAIlF,MAAM,CAAC,MAAM,0BAA0B,GACrC,kEAAkE,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAIZ,KAAK,EAAE,IAIlC,EAAuB,EAAE;IACxB,MAAM,WAAW,GACf,cAAc,CAAC,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE5D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,QAA0B,CAAC;IAE/B,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0DAA0D;QAC1D,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/C,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,CAAC;QAC5B,QAAQ,CAAC,iBAAiB,CACxB,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,GAAG,EACR,IAAI,sBAAsB,CAAC,0BAA0B,CAAC,CACvD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC,CAAC"}

package/build/dist/Server/Utils/Monitor/AffectedResourceList.js

@@ -0,0 +1,96 @@
+import { escapeMarkdownInline } from "../../../Utils/Markdown/MarkdownEscape";
+class AffectedResourceList {
+    static render(input) {
+        const lines = [];
+        input.entries.forEach((entry, index) => {
+            const marker = `${index + 1}.`;
+            /*
+             * A nested bullet belongs to its item only when it is indented to
+             * the item's content column, which is one past the marker — three
+             * spaces under "1.", four under "10.". A fixed three-space indent
+             * would push item 10's details out into a separate top-level list.
+             */
+            const indent = " ".repeat(marker.length + 1);
+            /*
+             * The kind is bold so each item's first line stands out from the
+             * detail bullets under it — the value at the end of the line is
+             * bold too, so the eye lands on what it is and how bad it is.
+             */
+            const kind = escapeMarkdownInline(entry.kind).trim();
+            const title = [kind ? `**${kind}**` : "", entry.name.trim()]
+                .filter((part) => {
+                return part.length > 0;
+            })
+                .join(" ");
+            lines.push(`${marker} ${title} — ${entry.value}`);
+            for (const detail of entry.details) {
+                if (!detail.value || detail.value.trim().length === 0) {
+                    continue;
+                }
+                lines.push(`${indent}- ${escapeMarkdownInline(detail.label)}: ${detail.value}`);
+            }
+        });
+        const hiddenCount = input.totalCount - input.entries.length;
+        if (hiddenCount > 0) {
+            /*
+             * The blank line matters: without it the summary is a lazy
+             * continuation of the last item's final bullet, not a paragraph of
+             * its own.
+             */
+            lines.push("");
+            lines.push(`*... and ${hiddenCount} more ${escapeMarkdownInline(input.overflowNoun)}*`);
+        }
+        return `\n\n**${escapeMarkdownInline(input.heading)}** (${input.totalCount} total)\n\n${lines.join("\n")}`;
+    }
+    /*
+     * A resource identifier as an inline code span.
+     *
+     * The identifiers come from telemetry attributes, and a VMware VM or a
+     * Proxmox guest can be named anything. Wrapping a name that contains a
+     * backtick in single backticks closes the span early and spills the rest
+     * of the name — and whatever markdown it contains — into the list. So the
+     * fence is always one backtick longer than the longest run inside the
+     * value, and padded with a space on each side when the value has any
+     * backticks at all (CommonMark strips exactly one from each side, so the
+     * padding never shows). Line breaks become spaces: a newline inside a
+     * list item would end the item.
+     */
+    static code(value) {
+        if (value === undefined || value === null) {
+            return "";
+        }
+        const text = String(value)
+            .replace(/\s*[\r\n]+\s*/g, " ")
+            .trim();
+        if (text.length === 0) {
+            return "";
+        }
+        const backtickRuns = text.match(/`+/g) || [];
+        const longestRun = backtickRuns.reduce((longest, run) => {
+            return Math.max(longest, run.length);
+        }, 0);
+        if (longestRun === 0) {
+            return `\`${text}\``;
+        }
+        const fence = "`".repeat(longestRun + 1);
+        return `${fence} ${text} ${fence}`;
+    }
+    /*
+     * A display name alongside the identifier it abbreviates — a Proxmox
+     * guest's name and its `qemu/100` id, a Ceph pool's name and number, a
+     * vSphere resource pool's name and inventory path. Either half may be
+     * missing; when both are the same only one is shown.
+     */
+    static codeWithId(input) {
+        const name = AffectedResourceList.code(input.name);
+        const id = AffectedResourceList.code(input.id);
+        if (name && id && name !== id) {
+            return `${name} (${id})`;
+        }
+        return name || id;
+    }
+}
+// How many resources the list shows before it summarises the rest.
+AffectedResourceList.MAX_ENTRIES = 10;
+export default AffectedResourceList;
+//# sourceMappingURL=AffectedResourceList.js.map