@oneuptime/common 13.0.8 → 14.0.0

package/Types/Database/AccessControl/ColumnAccessControl.ts

@@ -1,5 +1,6 @@
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import { ColumnAccessControl } from "../../BaseDatabase/AccessControl";
+import getCanonicalModelInstance from "../CanonicalModelInstance";
 import Dictionary from "../../Dictionary";
 import { ReflectionMetadataType } from "../../Reflection";
 import "reflect-metadata";
@@ -31,10 +32,12 @@ type GetColumnAccessControlForAllColumnsFunction = <T extends BaseModel>(
 ) => Dictionary<ColumnAccessControl>;
 
 /*
- * Per-class cache. Safe to key on the constructor because every decorated
- * column is initialised to `undefined` in the class body, so Object.keys()
- * is identical for every instance of a class (see OwnerOnlyColumn.ts).
- * Callers must treat the returned dictionary as read-only.
+ * Per-class cache, keyed on the constructor and built from a canonical
+ * instance of that class rather than from whichever instance asked first, so
+ * a caller that has deleted a column off its own instance cannot define what
+ * the class reports for the rest of the process. See
+ * CanonicalModelInstance.ts for the bug this prevents. Callers must treat the
+ * returned dictionary as read-only.
  */
 const accessControlCache: WeakMap<
   { new (): BaseModel },
@@ -50,12 +53,14 @@ export const getColumnAccessControlForAllColumns: GetColumnAccessControlForAllCo
       accessControlCache.get(modelClass);
 
     if (!cached) {
+      const canonical: T | null = getCanonicalModelInstance(target);
+      const metadataSource: T = canonical || target;
       const dictonary: Dictionary<ColumnAccessControl> = {};
-      const keys: Array<string> = Object.keys(target);
+      const keys: Array<string> = Object.keys(metadataSource);
 
       for (const key of keys) {
         const accessControl: ColumnAccessControl | undefined =
-          Reflect.getMetadata(accessControlSymbol, target, key) as
+          Reflect.getMetadata(accessControlSymbol, metadataSource, key) as
             | ColumnAccessControl
             | undefined;
         if (accessControl) {
@@ -64,7 +69,14 @@ export const getColumnAccessControlForAllColumns: GetColumnAccessControlForAllCo
       }
 
       cached = dictonary;
-      accessControlCache.set(modelClass, cached);
+      /*
+       * No canonical instance (see CanonicalModelInstance): answer from the
+       * instance we were handed, but do NOT cache it for the class - that
+       * instance may be a mutilated one, and a cached answer outlives it.
+       */
+      if (canonical) {
+        accessControlCache.set(modelClass, cached);
+      }
     }
 
     return cached;

package/Types/Database/AccessControl/ColumnBillingAccessControl.ts

@@ -1,5 +1,6 @@
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import ColumnBillingAccessControl from "../../BaseDatabase/ColumnBillingAccessControl";
+import getCanonicalModelInstance from "../CanonicalModelInstance";
 import Dictionary from "../../Dictionary";
 import { ReflectionMetadataType } from "../../Reflection";
 import "reflect-metadata";
@@ -31,10 +32,12 @@ type GetColumnBillingAccessControlForAllColumnsFunction = <T extends BaseModel>(
 ) => Dictionary<ColumnBillingAccessControl>;
 
 /*
- * Per-class cache. Safe to key on the constructor because every decorated
- * column is initialised to `undefined` in the class body, so Object.keys()
- * is identical for every instance of a class (see OwnerOnlyColumn.ts).
- * Callers must treat the returned dictionary as read-only.
+ * Per-class cache, keyed on the constructor and built from a canonical
+ * instance of that class rather than from whichever instance asked first, so
+ * a caller that has deleted a column off its own instance cannot define what
+ * the class reports for the rest of the process. See
+ * CanonicalModelInstance.ts for the bug this prevents. Callers must treat the
+ * returned dictionary as read-only.
  */
 const billingAccessControlCache: WeakMap<
   { new (): BaseModel },
@@ -50,12 +53,14 @@ export const getColumnBillingAccessControlForAllColumns: GetColumnBillingAccessC
       billingAccessControlCache.get(modelClass);
 
     if (!cached) {
+      const canonical: T | null = getCanonicalModelInstance(target);
+      const metadataSource: T = canonical || target;
       const dictonary: Dictionary<ColumnBillingAccessControl> = {};
-      const keys: Array<string> = Object.keys(target);
+      const keys: Array<string> = Object.keys(metadataSource);
 
       for (const key of keys) {
         const accessControl: ColumnBillingAccessControl | undefined =
-          Reflect.getMetadata(accessControlSymbol, target, key) as
+          Reflect.getMetadata(accessControlSymbol, metadataSource, key) as
             | ColumnBillingAccessControl
             | undefined;
         if (accessControl) {
@@ -64,7 +69,14 @@ export const getColumnBillingAccessControlForAllColumns: GetColumnBillingAccessC
       }
 
       cached = dictonary;
-      billingAccessControlCache.set(modelClass, cached);
+      /*
+       * No canonical instance (see CanonicalModelInstance): answer from the
+       * instance we were handed, but do NOT cache it for the class - that
+       * instance may be a mutilated one, and a cached answer outlives it.
+       */
+      if (canonical) {
+        billingAccessControlCache.set(modelClass, cached);
+      }
     }
 
     return cached;

package/Types/Database/AccessControl/OwnerOnlyColumn.ts

@@ -1,4 +1,5 @@
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import getCanonicalModelInstance from "../CanonicalModelInstance";
 import { ReflectionMetadataType } from "../../Reflection";
 import "reflect-metadata";
 
@@ -66,10 +67,14 @@ type GetOwnerOnlyColumnsFunction = <T extends BaseModel>(
 ) => Array<string>;
 
 /**
- * Every owner-only column on this model. Enumerating requires the property to
- * exist on the instance, which it does for every declared column because model
- * columns are initialised to `undefined` in the class body - the same
- * assumption getTableColumns() already makes.
+ * Every owner-only column on this model. Which columns a MODEL marks is a
+ * property of the class, so the enumeration reads a canonical instance of the
+ * class rather than the caller's own instance: a caller that had deleted a
+ * key off its instance would otherwise get an answer that silently omits a
+ * marked column, and this list is what OwnerOnlyColumnPermission enforces
+ * against. See CanonicalModelInstance.ts. (Enumerating at all relies on every
+ * declared column being initialised to `undefined` in the class body - the
+ * same assumption getTableColumns() makes.)
  */
 export const getOwnerOnlyColumns: GetOwnerOnlyColumnsFunction = <
   T extends BaseModel,
@@ -77,9 +82,13 @@ export const getOwnerOnlyColumns: GetOwnerOnlyColumnsFunction = <
   target: T,
 ): Array<string> => {
   const columns: Array<string> = [];
+  // Nothing is cached here, so falling back to the caller's instance is safe.
+  const metadataSource: T = getCanonicalModelInstance(target) || target;
 
-  for (const key of Object.keys(target)) {
-    if (Reflect.getMetadata(ownerOnlyColumnSymbol, target, key) === true) {
+  for (const key of Object.keys(metadataSource)) {
+    if (
+      Reflect.getMetadata(ownerOnlyColumnSymbol, metadataSource, key) === true
+    ) {
       columns.push(key);
     }
   }

package/Types/Database/CanonicalModelInstance.ts

@@ -0,0 +1,102 @@
+/*
+ * The one instance of a model class that column-metadata enumeration is
+ * allowed to look at.
+ *
+ * WHY THIS EXISTS.
+ *
+ * Every "which columns does this model have" lookup in this directory answers
+ * the question by enumerating an INSTANCE's own keys (Object.keys) and then
+ * caching the answer per CLASS. That is only sound while every instance of a
+ * class has the same own keys. The class bodies do guarantee that - each
+ * decorated column is initialised to `undefined` - right up until some caller
+ * deletes a key off a live instance.
+ *
+ * One caller did. BaseAPI.createItem used to `delete item._id` before handing
+ * the model to the service, and DatabaseService.create asks that very instance
+ * for its columns (generateDefaultValues). Whenever the mutilated instance was
+ * the first to ask, the class's cached column list was built WITHOUT `_id` -
+ * permanently, for the life of the process, for every later caller - and since
+ * DatabaseBaseModel.toJSONObject serialises a row by iterating exactly that
+ * list, every API response for that model silently lost its id. A single
+ * create was enough, including a create that was refused, because the columns
+ * are read before the permission check. Rows still carried their real `_id` in
+ * memory and in the SQL projection; it was dropped on the way out.
+ *
+ * So enumeration stopped reading the caller's instance. It reads a frozen,
+ * private instance of the caller's CLASS instead - constructed here, reachable
+ * by nobody, impossible to mutate - so what a class reports about itself can
+ * never depend on which instance happened to ask first, or on what anyone did
+ * to that instance. Reads already constructed a throwaway instance for exactly
+ * this purpose (SelectPermission, QueryPermission, ColumnPermission all do
+ * `new modelType()`), which is why a single read of a model was enough to make
+ * the same create harmless; this makes that the only behaviour.
+ *
+ * Every database model is no-arg constructible (Models/DatabaseModels/Index.ts
+ * relies on it already, in getModelTypeByName), and a fresh instance carries
+ * every declared column - both facts are asserted by
+ * Tests/Types/Database/CanonicalModelInstance.test.ts against all 400+ models.
+ */
+
+type NoArgConstructor = new () => unknown;
+
+const canonicalInstanceCache: WeakMap<NoArgConstructor, unknown> =
+  new WeakMap();
+
+/*
+ * Classes whose canonical instance is being constructed right now. A model
+ * constructor that asked for its own columns would otherwise recurse forever;
+ * such a call gets the caller's instance instead, which is the old behaviour.
+ */
+const beingConstructed: WeakSet<NoArgConstructor> = new WeakSet();
+
+/**
+ * A frozen, shared instance of `target`'s class, safe to enumerate for
+ * metadata - or NULL when no such instance can be made: a class that needs
+ * constructor arguments, a class still being defined (circular imports), a
+ * constructor that throws, or a plain object with no useful constructor.
+ *
+ * Null, rather than falling back to `target`, because the two are NOT
+ * interchangeable and treating them as if they were is how this bug worked in
+ * the first place. A caller with no canonical instance may still answer from
+ * whatever instance it was handed - a metadata lookup must never be the reason
+ * a process fails to boot - but it must not then CACHE that answer for the
+ * class, because the instance it read may be a mutilated one and the cached
+ * answer would outlive it. Returning null forces each caller to make that
+ * decision in the open; the four caches in this directory all take the same
+ * route, and say so where they do it.
+ */
+export default function getCanonicalModelInstance<T>(target: T): T | null {
+  const modelClass: NoArgConstructor | undefined = (
+    target as { constructor?: NoArgConstructor } | null | undefined
+  )?.constructor;
+
+  if (typeof modelClass !== "function") {
+    return null;
+  }
+
+  const cached: unknown = canonicalInstanceCache.get(modelClass);
+
+  if (cached) {
+    return cached as T;
+  }
+
+  if (beingConstructed.has(modelClass)) {
+    return null;
+  }
+
+  let canonical: T;
+
+  beingConstructed.add(modelClass);
+
+  try {
+    canonical = Object.freeze(new modelClass()) as T;
+  } catch {
+    return null;
+  } finally {
+    beingConstructed.delete(modelClass);
+  }
+
+  canonicalInstanceCache.set(modelClass, canonical);
+
+  return canonical;
+}

package/Types/Database/TableColumn.ts

@@ -1,4 +1,5 @@
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import getCanonicalModelInstance from "./CanonicalModelInstance";
 import Dictionary from "../Dictionary";
 import { JSONObject } from "../JSON";
 import { ReflectionMetadataType } from "../Reflection";
@@ -99,9 +100,12 @@ type GetTableColumnsFunction = <T extends BaseModel>(
 ) => Dictionary<TableColumnMetadata>;
 
 /*
- * Per-class cache. Safe to key on the constructor because every decorated
- * column is initialised to `undefined` in the class body, so Object.keys()
- * is identical for every instance of a class (see OwnerOnlyColumn.ts).
+ * Per-class cache, keyed on the constructor and built from a canonical
+ * instance of that class - never from the instance that happened to ask
+ * first. A caller that had deleted a column off its own instance (BaseAPI's
+ * create path used to delete `_id`) would otherwise define the class's column
+ * list without that column for the whole process, and every response for that
+ * model would lose it. See CanonicalModelInstance.ts.
  */
 const tableColumnsCache: WeakMap<
   { new (): BaseModel },
@@ -118,13 +122,15 @@ export const getTableColumns: GetTableColumnsFunction = <T extends BaseModel>(
     tableColumnsCache.get(modelClass);
 
   if (!cached) {
+    const canonical: T | null = getCanonicalModelInstance(target);
+    const metadataSource: T = canonical || target;
     const dictonary: Dictionary<TableColumnMetadata> = {};
-    const keys: Array<string> = Object.keys(target);
+    const keys: Array<string> = Object.keys(metadataSource);
 
     for (const key of keys) {
       const metadata: TableColumnMetadata | undefined = Reflect.getMetadata(
         tableColumn,
-        target,
+        metadataSource,
         key,
       ) as TableColumnMetadata | undefined;
       if (metadata) {
@@ -133,7 +139,15 @@ export const getTableColumns: GetTableColumnsFunction = <T extends BaseModel>(
     }
 
     cached = dictonary;
-    tableColumnsCache.set(modelClass, cached);
+
+    /*
+     * No canonical instance (see CanonicalModelInstance): answer from the
+     * instance we were handed, but do NOT cache it for the class - that
+     * instance may be a mutilated one, and a cached answer outlives it.
+     */
+    if (canonical) {
+      tableColumnsCache.set(modelClass, cached);
+    }
   }
 
   /*

package/Types/EnterpriseLicense/EnterpriseLicensePeriods.ts

@@ -0,0 +1,29 @@
+/*
+ * The two periods a self-hosted Enterprise Edition install runs without a
+ * current license. They are different periods with different lengths, and
+ * the product must never call one by the other's name:
+ *
+ *   trial  an Enterprise install that has never had a license, counted from
+ *          GlobalConfig.enterpriseEditionFirstSeenAt
+ *   grace  a license that expired (a verified license's signed expiry, or an
+ *          unverified legacy license's stored expiry column), counted from
+ *          its expiry
+ *
+ * Until either ends nothing changes; after it, enterprise configuration
+ * becomes read-only and SSO, SCIM and audit logging stop
+ * (EnterpriseEdition.isFeatureActive) until a license is activated.
+ *
+ * They live here, with no server dependency, so the copy that states them in
+ * the browser (the edition dialog, the enterprise banners) derives the
+ * numbers from the same place the license classifier does. Server code reads
+ * them through Common/Server/Enterprise/EnterpriseLicenseSnapshot.
+ */
+
+// How long an expired license keeps working, counted from its expiry.
+export const ENTERPRISE_LICENSE_GRACE_PERIOD_IN_DAYS: number = 30;
+
+/*
+ * How long an Enterprise install with no license at all is on trial, counted
+ * from GlobalConfig.enterpriseEditionFirstSeenAt.
+ */
+export const ENTERPRISE_LICENSE_TRIAL_PERIOD_IN_DAYS: number = 14;

package/Types/IP/IPv6.ts

@@ -1,7 +1,12 @@
 import BadDataException from "../Exception/BadDataException";
 import IP from "./IP";
 
-export default class IPv4 extends IP {
+/*
+ * The class used to be declared `class IPv4 extends IP` here — a copy-paste
+ * that the default export hid from every import site, while leaving
+ * IPv6.name === "IPv4" in error messages, serialized output and API docs.
+ */
+export default class IPv6 extends IP {
   public constructor(ip: string) {
     super(ip);
 

package/Types/Monitor/MonitorStep.ts

@@ -497,8 +497,13 @@ export default class MonitorStep extends DatabaseProperty {
     return this;
   }
 
+  /*
+   * `undefined` clears it. The form needs that: a destination that no longer
+   * parses must not leave the previously parsed one sitting in the step,
+   * where it would be saved as if the operator had meant it.
+   */
   public setMonitorDestination(
-    monitorDestination: URL | IP | Hostname,
+    monitorDestination: URL | IP | Hostname | undefined,
   ): MonitorStep {
     this.data!.monitorDestination = monitorDestination;
     return this;

package/Types/Monitor/ProxmoxAlertTemplates.ts

@@ -897,7 +897,7 @@ const guestNotBackedUpTemplate: ProxmoxAlertTemplate = {
         /*
          * Cluster-level gauge from the backup-info collector — one
          * series, no `id` label, so no groupBy: one incident per
-         * cluster. Per-guest naming belongs to the breakdown table
+         * cluster. Per-guest naming belongs to the Affected Resources list
          * (pve_not_backed_up_info grouped by `id`), not the alert.
          */
         metricName: "pve_not_backed_up_total",

package/Types/StatusPage/UptimeDailyAggregate.ts

@@ -0,0 +1,110 @@
+/*
+ * Per-monitor, per-day status durations for the status-page uptime bars.
+ *
+ * WHY THIS TYPE EXISTS
+ *
+ * The bars used to be painted from raw MonitorStatusTimeline rows shipped to
+ * the browser under a single `limit: LIMIT_MAX` (10,000) across EVERY monitor
+ * on the page, sorted `startsAt DESC`.
+ *
+ * That cap is a silent, history-destroying bound. Measured on a real status
+ * page: 254,550 rows matched the 60-day window and 10,000 came back - 3.9%.
+ * The oldest surviving row started four days before the request, so 56 of the
+ * 60 bars were painted from data that had been dropped.
+ *
+ * Worse, the cap is GLOBAL across monitors and the sort is newest-first, so a
+ * few high-churn monitors starve the quiet ones out of the result set
+ * entirely. On the page that reported this, three flapping monitors held
+ * 9,995 of the 10,000 slots. A quiet, healthy monitor's covering row has an
+ * OLD `startsAt` and therefore sorts last - so the healthier a monitor is,
+ * the more likely it is to lose its whole history to a noisy neighbour.
+ *
+ * Shipping more rows cannot fix it. One row serializes to ~431 bytes in this
+ * codebase's typed JSON, so 254,550 rows is ~105 MB - into a response that is
+ * held in a 500-entry in-memory cache on the hottest public endpoint, and
+ * then filtered per-bar on the client's main thread.
+ *
+ * So the server sends DURATIONS instead of rows. The size is structural -
+ * O(monitors x days x statuses) - rather than O(status transitions), and it
+ * cannot be blown up by a flapping monitor.
+ */
+
+import ObjectID from "../ObjectID";
+
+/**
+ * Seconds spent in one monitor status, inside one day bucket.
+ */
+export interface UptimeStatusDuration {
+  monitorStatusId: ObjectID;
+  seconds: number;
+}
+
+/**
+ * One monitor's reading for one day bucket.
+ */
+export interface UptimeDayBucket {
+  /* Start of the bucket, as a UTC instant. */
+  bucketStart: Date;
+
+  /* End of the bucket, as a UTC instant. */
+  bucketEnd: Date;
+
+  /*
+   * Wall-clock seconds in the bucket.
+   *
+   * NOT hardcoded to 86400. The window's first and last buckets are clipped
+   * to the window, and a local calendar day that crosses a DST boundary is
+   * genuinely 23 or 25 hours long.
+   */
+  daySeconds: number;
+
+  /*
+   * Seconds of this bucket actually covered by a timeline row.
+   *
+   * This is the field the whole fix turns on. `coveredSeconds === 0` means
+   * "nothing was ever recorded for this day" - the monitor did not exist yet,
+   * or there is a hole in the record. Such a day must never be painted as
+   * uptime, which is exactly what the old code did by falling through to the
+   * status page's `defaultBarColor` (green on 4,642 status pages).
+   *
+   * `0 < coveredSeconds < daySeconds` is NOT a no-data day. It is a real
+   * reading of a shorter interval - the day a monitor was created, say - and
+   * its percentage is taken over what was measured.
+   */
+  coveredSeconds: number;
+
+  /* Seconds spent in each status, summed within the bucket. */
+  statusDurations: Array<UptimeStatusDuration>;
+}
+
+/**
+ * Every day bucket for one monitor.
+ */
+export interface MonitorUptimeDailyAggregate {
+  monitorId: ObjectID;
+  buckets: Array<UptimeDayBucket>;
+}
+
+/**
+ * The full aggregate for a status page request.
+ */
+export interface UptimeDailyAggregate {
+  monitors: Array<MonitorUptimeDailyAggregate>;
+
+  /*
+   * False when the server could not vouch for the whole window.
+   *
+   * There is no silent cap in the aggregate path, so this is normally true.
+   * It exists because a bound that is ever added later must SHOW, not be
+   * absorbed into a green bar - which is the failure this whole change is
+   * about. When false, `completeFrom` says where the trustworthy data starts
+   * and the client renders everything older as no-data rather than guessing.
+   */
+  isComplete: boolean;
+
+  /*
+   * The earliest instant the aggregate can vouch for, when `isComplete` is
+   * false. Null when the whole window is covered.
+   */
+  completeFrom: Date | null;
+}