@oneuptime/common 13.0.8 → 14.0.1

package/Server/Services/DatabaseService.ts

@@ -76,6 +76,7 @@ import Typeof from "../../Types/Typeof";
 import API from "../../Utils/API";
 import Slug from "../../Utils/Slug";
 import { getRuleCriteriaValidationError } from "../../Utils/Rules/RuleCriteriaMatcher";
+import { getMonitorTypeCriteriaValidationError } from "../../Utils/Rules/MonitorTypeRuleCriteria";
 import RuleCriteria, {
   RULE_CRITERIA_LEGACY_NEVER_MATCH_PATTERN,
   RuleCriteriaOperator,
@@ -852,6 +853,15 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         );
       }
 
+      if (metadata.type === TableColumnType.MonitorType) {
+        const validationError: string | null =
+          getMonitorTypeCriteriaValidationError(filter);
+
+        if (validationError) {
+          throw new BadDataException(validationError);
+        }
+      }
+
       const isRelationField: boolean =
         metadata.type === TableColumnType.EntityArray;
       const isRelationOperator: boolean = RULE_CRITERIA_RELATION_OPERATORS.has(

package/Server/Services/EnterpriseLicenseService.ts

@@ -3,11 +3,26 @@ import EnterpriseLicense from "../../Models/DatabaseModels/EnterpriseLicense";
 import MarketingEventUtil from "../Utils/Marketing/MarketingEventUtil";
 import { MarketingEventType } from "../../Types/Marketing/MarketingEvent";
 import { OnCreate } from "../Types/Database/Hooks";
+import CreateBy from "../Types/Database/CreateBy";
 import OneUptimeDate from "../../Types/Date";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import ObjectID from "../../Types/ObjectID";
 import Semaphore, { SemaphoreMutex } from "../Infrastructure/Semaphore";
 import logger from "../Utils/Logger";
+import crypto from "crypto";
+
+/*
+ * Random bytes in a license key generated by the server: 256 bits, written as
+ * 64 hex characters (the column holds 100). Keys issued before server-side
+ * generation are browser-made UUIDs and keep working unchanged.
+ */
+export const ENTERPRISE_LICENSE_KEY_RANDOM_BYTES: number = 32;
+
+export const generateEnterpriseLicenseKey: () => string = (): string => {
+  return crypto
+    .randomBytes(ENTERPRISE_LICENSE_KEY_RANDOM_BYTES)
+    .toString("hex");
+};
 
 export const ENTERPRISE_LICENSE_USAGE_AGGREGATION_LOCK_NAMESPACE: string =
   "EnterpriseLicenseService.usageAggregation";
@@ -66,6 +81,29 @@ export class Service extends DatabaseService<EnterpriseLicense> {
     }
   }
 
+  /*
+   * A license created with no key (the Admin Dashboard's "leave blank to
+   * auto-generate") gets one from the server's CSPRNG here, instead of from
+   * the browser. A key typed by the admin is kept, trimmed: installations
+   * trim the key they send, so stored whitespace would make it unmatchable.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<EnterpriseLicense>,
+  ): Promise<OnCreate<EnterpriseLicense>> {
+    const providedKey: string =
+      typeof createBy.data.licenseKey === "string"
+        ? createBy.data.licenseKey.trim()
+        : "";
+
+    createBy.data.licenseKey = providedKey || generateEnterpriseLicenseKey();
+
+    return {
+      createBy,
+      carryForward: undefined,
+    };
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<EnterpriseLicense>,

package/Server/Services/GlobalConfigService.ts

@@ -2,13 +2,45 @@ import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalConfig";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 import ObjectID from "../../Types/ObjectID";
-import { OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import TelegramVerificationToken from "../Utils/TelegramVerificationToken";
 import GlobalCache from "../Infrastructure/GlobalCache";
 
+/*
+ * The columns that hold this installation's license state and identity. They
+ * are written only by OneUptime itself - the license client (activation,
+ * refresh, the daily usage report), the first-boot stamp of the Enterprise
+ * Edition and the data migrations - and every one of those writes runs with
+ * isRoot. A master admin reaches GlobalConfig through the generic CRUD API
+ * too, and master admins bypass the (empty) column ACLs, so without this list
+ * one PUT could forge a license expiry, raise the seat limit, restart the
+ * unlicensed trial or swap the instance id an instance-bound license
+ * is checked against.
+ *
+ * enterpriseLicenseNotificationEmail and enterpriseLicenseExpiryReminderDays
+ * are deliberately NOT here: they are settings the oneuptime.com admin edits
+ * from the Admin Dashboard.
+ */
+export const ROOT_ONLY_LICENSE_COLUMNS: ReadonlyArray<keyof Model> = [
+  "instanceId",
+  "enterpriseCompanyName",
+  "enterpriseLicenseKey",
+  "enterpriseLicenseExpiresAt",
+  "enterpriseLicenseToken",
+  "enterpriseLicenseIsEvaluation",
+  "enterpriseLicenseUserLimit",
+  "enterpriseLicenseCurrentUserCount",
+  "enterpriseLicenseUserCountUpdatedAt",
+  "enterpriseLicenseInstances",
+  "enterpriseEditionFirstSeenAt",
+];
+
 const TELEGRAM_WEBHOOK_SECRET_CACHE_NAMESPACE: string =
   "global-config-security";
 const TELEGRAM_WEBHOOK_SECRET_GENERATION_KEY: string =
@@ -203,10 +235,57 @@ export class Service extends DatabaseService<Model> {
     );
   }
 
+  /*
+   * Refuses any write to ROOT_ONLY_LICENSE_COLUMNS that does not come from
+   * OneUptime itself. An explicit null counts as a write: clearing the license
+   * token is as much a forgery as setting one.
+   */
+  public assertLicenseColumnsWrittenByRootOnly(
+    data: unknown,
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    if (props.isRoot) {
+      return;
+    }
+
+    const writtenColumns: Array<string> = ROOT_ONLY_LICENSE_COLUMNS.filter(
+      (column: keyof Model): boolean => {
+        return (
+          (data as Record<string, unknown>)[column as string] !== undefined
+        );
+      },
+    ).map((column: keyof Model): string => {
+      return column as string;
+    });
+
+    if (writtenColumns.length === 0) {
+      return;
+    }
+
+    throw new NotAuthorizedException(
+      `${writtenColumns.join(", ")} can only be changed by OneUptime itself. ` +
+        "Use the license dialog in the Admin Dashboard to activate or refresh the Enterprise license.",
+    );
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    this.assertLicenseColumnsWrittenByRootOnly(createBy.data, createBy.props);
+
+    return {
+      createBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    this.assertLicenseColumnsWrittenByRootOnly(updateBy.data, updateBy.props);
+
     if (updateBy.data.telegramWebhookSecretToken !== undefined) {
       const secret: unknown = updateBy.data.telegramWebhookSecretToken;
 

package/Server/Services/Index.ts

@@ -384,6 +384,8 @@ import ServiceLevelObjectiveOwnerUserService from "./ServiceLevelObjectiveOwnerU
 import ServiceLevelObjectiveOwnerTeamService from "./ServiceLevelObjectiveOwnerTeamService";
 import ServiceLevelObjectiveMonitorRuleService from "./ServiceLevelObjectiveMonitorRuleService";
 import ServiceLevelObjectiveFeedService from "./ServiceLevelObjectiveFeedService";
+import ServiceLevelObjectiveOwnerRuleService from "./ServiceLevelObjectiveOwnerRuleService";
+import ServiceLevelObjectiveLabelRuleService from "./ServiceLevelObjectiveLabelRuleService";
 import SloHistoryService from "./SloHistoryService";
 import IncidentReminderRuleService from "./IncidentReminderRuleService";
 import AlertReminderRuleService from "./AlertReminderRuleService";
@@ -818,6 +820,8 @@ const services: Array<BaseService> = [
   ServiceLevelObjectiveOwnerTeamService,
   ServiceLevelObjectiveMonitorRuleService,
   ServiceLevelObjectiveFeedService,
+  ServiceLevelObjectiveOwnerRuleService,
+  ServiceLevelObjectiveLabelRuleService,
   IncidentReminderRuleService,
   AlertReminderRuleService,
   ScheduledMaintenanceReminderRuleService,

package/Server/Services/MonitorProbeService.ts

@@ -13,14 +13,66 @@ import MonitorService from "./MonitorService";
 import ProbeService from "./ProbeService";
 import { MonitorTypeHelper } from "../../Types/Monitor/MonitorType";
 import CronTab from "../Utils/CronTab";
-import logger, { LogAttributes } from "../Utils/Logger";
+import logger, { EXTERNAL_FAULT, LogAttributes } from "../Utils/Logger";
 import { SubscriptionStatusUtil } from "../../Types/Billing/SubscriptionStatus";
+import MonitoringIntervalValidator from "../Utils/Monitor/MonitoringIntervalValidator";
 
 export class Service extends DatabaseService<MonitorProbe> {
   public constructor() {
     super(MonitorProbe);
   }
 
+  /**
+   * The next time a monitor with this interval is due, or `fallback`.
+   *
+   * Exported on the class (and covered directly by tests) because both
+   * scheduling paths — the batch claim query and the single-monitor refresh
+   * after an edit — have to agree about what a stored interval means. They
+   * did not before: the claim query swallowed a parse failure silently and
+   * fell back to one minute, so a monitor asking for five minutes was probed
+   * four times more often than requested, indefinitely and invisibly.
+   *
+   * Order is load-bearing. cron-parser gets the RAW value first, so the
+   * thousands of rows that were always valid take a byte-identical path and
+   * anything the parser understands but our grammar does not ("@hourly") is
+   * still honoured. Only when that fails do we try to read the value as a
+   * human cadence ("5m", "Every 5 minutes"), which is what makes those rows
+   * schedule correctly on deploy — before the data migration has run, and
+   * for any row that later arrives through a hook-free write or a restore.
+   */
+  public static resolveNextPingAt(data: {
+    monitoringInterval: string | null | undefined;
+    fallback: Date;
+    onUnreadable?: (() => void) | undefined;
+  }): Date {
+    if (!data.monitoringInterval) {
+      return data.fallback;
+    }
+
+    try {
+      return CronTab.getNextExecutionTime(data.monitoringInterval);
+    } catch {
+      // Not a cron expression. Try to read it as a human cadence instead.
+    }
+
+    const normalizedCron: string | null =
+      MonitoringIntervalValidator.normalizeForRead(data.monitoringInterval);
+
+    if (normalizedCron) {
+      try {
+        return CronTab.getNextExecutionTime(normalizedCron);
+      } catch {
+        // Normalizer produced something cron-parser rejects. Report it.
+      }
+    }
+
+    if (data.onUnreadable) {
+      data.onUnreadable();
+    }
+
+    return data.fallback;
+  }
+
   public async pruneStaleLastMonitoringLogEntries(data: {
     monitorId: ObjectID;
     validMonitorStepIds: Array<string>;
@@ -103,20 +155,28 @@ export class Service extends DatabaseService<MonitorProbe> {
         continue;
       }
 
-      let nextPing: Date = OneUptimeDate.addRemoveMinutes(
-        OneUptimeDate.getCurrentDate(),
-        1,
-      );
-
-      try {
-        nextPing = CronTab.getNextExecutionTime(
-          monitorProbe?.monitor?.monitoringInterval as string,
-        );
-      } catch (err) {
-        logger.error(err, {
-          monitorId: data.monitorId?.toString(),
-        } as LogAttributes);
-      }
+      /*
+       * The falsy guard matters: a Manual monitor (and every other row with
+       * no interval) reaches here with undefined, and the old unguarded call
+       * handed that straight to cron-parser, which threw and logged an error
+       * for a perfectly ordinary row on every single interval edit.
+       */
+      const nextPing: Date = Service.resolveNextPingAt({
+        monitoringInterval: monitorProbe?.monitor?.monitoringInterval,
+        fallback: OneUptimeDate.addRemoveMinutes(
+          OneUptimeDate.getCurrentDate(),
+          1,
+        ),
+        onUnreadable: () => {
+          logger.error(
+            `updateNextPingAtForMonitor: monitoringInterval "${monitorProbe?.monitor?.monitoringInterval}" cannot be read as a schedule; falling back to a 1-minute cadence.`,
+            {
+              ...EXTERNAL_FAULT,
+              monitorId: data.monitorId?.toString(),
+            } as LogAttributes,
+          );
+        },
+      });
 
       if (nextPing && monitorProbe.id) {
         await this.updateOneById({
@@ -223,6 +283,17 @@ export class Service extends DatabaseService<MonitorProbe> {
         const nextPingDates: Array<Date> = [];
         const caseFragments: Array<string> = [];
 
+        /*
+         * Rows whose interval neither cron-parser nor the normalizer could
+         * read. Collected and logged ONCE per batch below rather than per
+         * row: this loop runs for every claimed monitor, every minute, on
+         * every probe-ingest instance, so a per-row log line would flood.
+         */
+        const unreadableIntervals: Array<{
+          monitorProbeId: string;
+          monitoringInterval: string;
+        }> = [];
+
         for (let i: number = 0; i < selectedRows.length; i++) {
           const row: { _id: string; monitoringInterval: string | null } =
             selectedRows[i]!;
@@ -230,11 +301,16 @@ export class Service extends DatabaseService<MonitorProbe> {
 
           let nextPing: Date = defaultNextPing;
           if (row.monitoringInterval) {
-            try {
-              nextPing = CronTab.getNextExecutionTime(row.monitoringInterval);
-            } catch {
-              // fall back to default 1 minute
-            }
+            nextPing = Service.resolveNextPingAt({
+              monitoringInterval: row.monitoringInterval,
+              fallback: defaultNextPing,
+              onUnreadable: () => {
+                unreadableIntervals.push({
+                  monitorProbeId: row._id,
+                  monitoringInterval: row.monitoringInterval as string,
+                });
+              },
+            });
           }
 
           nextPingDates.push(nextPing);
@@ -243,6 +319,26 @@ export class Service extends DatabaseService<MonitorProbe> {
           );
         }
 
+        /*
+         * One aggregated line per batch, at error level with EXTERNAL_FAULT.
+         *
+         * Not debug: LOG_LEVEL=ERROR is what ships, so a debug or warn line
+         * here is deleted from stdout on exactly the installs where an
+         * operator would go looking. This condition used to be swallowed by
+         * a bare `catch {}`, which is why a monitor storing "5m" was probed
+         * every minute instead of every five for as long as the row existed,
+         * with nothing anywhere to grep for. EXTERNAL_FAULT marks it as
+         * tenant data rather than our own failure, so it does not page us.
+         */
+        if (unreadableIntervals.length > 0) {
+          logger.error(
+            `claimMonitorProbesForProbing: ${unreadableIntervals.length} monitor(s) have a monitoringInterval that cannot be read as a schedule and are falling back to a 1-minute cadence. Fix the stored value - "*/5 * * * *" means every 5 minutes. Offenders: ${JSON.stringify(
+              unreadableIntervals.slice(0, 20),
+            )}`,
+            EXTERNAL_FAULT,
+          );
+        }
+
         const updateQuery: string = `
         UPDATE "MonitorProbe"
         SET "lastPingAt" = $1,

package/Server/Services/MonitorService.ts

@@ -39,6 +39,7 @@ import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
+import MonitoringIntervalValidator from "../Utils/Monitor/MonitoringIntervalValidator";
 import { JSONObject, JSONValue } from "../../Types/JSON";
 import MonitorType, {
   MonitorTypeHelper,
@@ -97,6 +98,7 @@ import { WhatsAppMessagePayload } from "../../Types/WhatsApp/WhatsAppMessage";
 import MonitorTemplateService from "./MonitorTemplateService";
 import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
+import HostAddressUtil from "../../Utils/HostAddressUtil";
 import NetworkDeviceMonitorTemplateUtil from "../../Utils/Monitor/NetworkDeviceMonitorTemplateUtil";
 
 const MONITOR_TEMPLATE_RELATION_KEYS: Array<string> = [
@@ -195,7 +197,17 @@ export class Service extends DatabaseService<Model> {
         ) {
           const port: string = firstStep.data.monitorDestinationPort.toString();
           if (monitorDestination && port) {
-            monitorDestination = `${monitorDestination}:${port}`;
+            /*
+             * Bracketed when the host is an IPv6 literal. Plain
+             * concatenation there does not merely look odd: "2001:db8::1" +
+             * ":179" is "2001:db8::1:179", which is itself a valid IPv6
+             * address — a DIFFERENT host from the one being monitored, named
+             * in an alert somebody is about to act on.
+             */
+            monitorDestination = HostAddressUtil.formatHostAndPort({
+              host: monitorDestination,
+              port: port,
+            });
           }
         }
 
@@ -207,7 +219,10 @@ export class Service extends DatabaseService<Model> {
           monitorDestination = firstStep.data.snmpMonitor.hostname || "";
           const port: number = firstStep.data.snmpMonitor.port || 161;
           if (monitorDestination && port) {
-            monitorDestination = `${monitorDestination}:${port}`;
+            monitorDestination = HostAddressUtil.formatHostAndPort({
+              host: monitorDestination,
+              port: port,
+            });
           }
         }
 
@@ -239,7 +254,10 @@ export class Service extends DatabaseService<Model> {
             databaseName: string;
           } = firstStep.data.sqlMonitor;
           if (sql.host) {
-            monitorDestination = `${sql.host}:${sql.port}/${sql.databaseName}`;
+            monitorDestination = `${HostAddressUtil.formatHostAndPort({
+              host: sql.host,
+              port: sql.port,
+            })}/${sql.databaseName}`;
           }
         }
 
@@ -254,7 +272,10 @@ export class Service extends DatabaseService<Model> {
             databaseName: string;
           } = firstStep.data.databaseMonitor;
           if (database.host) {
-            monitorDestination = `${database.host}:${database.port}/${database.databaseName}`;
+            monitorDestination = `${HostAddressUtil.formatHostAndPort({
+              host: database.host,
+              port: database.port,
+            })}/${database.databaseName}`;
           }
         }
       }
@@ -604,6 +625,21 @@ export class Service extends DatabaseService<Model> {
       resolveReferenceId(updateBy.data.currentMonitorStatus);
 
     const updateDataKeys: Array<string> = Object.keys(updateBy.data || {});
+
+    /*
+     * Key presence, never truthiness or the stored value: renaming one of
+     * the monitors that already holds a broken interval sends only {name},
+     * and gating on the stored value would make those monitors un-editable
+     * — punishing the customer for our validation gap.
+     */
+    if (updateDataKeys.includes("monitoringInterval")) {
+      (updateBy.data as unknown as Record<string, unknown>)[
+        "monitoringInterval"
+      ] = MonitoringIntervalValidator.validateAndNormalize(
+        updateBy.data.monitoringInterval as string | null | undefined,
+      );
+    }
+
     const isMonitorStepsWritten: boolean =
       updateDataKeys.includes("monitorSteps");
     const isMonitorTemplateWritten: boolean = RelationIdUtil.isWritten(
@@ -1265,14 +1301,15 @@ export class Service extends DatabaseService<Model> {
     }
 
     /*
-     * SLO monitor rules match on labels, name and description, so an edit to
-     * any of the three can pull this monitor into an SLO's error budget or
+     * SLO monitor rules match on labels, type, name and description, so an edit to
+     * any of those fields can pull this monitor into an SLO's error budget or
      * push it out of one. Keyed on `!== undefined` rather than on a non-empty
      * value: clearing every label arrives as `[]`, and that is precisely the
      * edit that should detach the monitor from every rule-driven SLO.
      */
     if (
       (onUpdate.updateBy.data.labels !== undefined ||
+        onUpdate.updateBy.data.monitorType !== undefined ||
         onUpdate.updateBy.data.name !== undefined ||
         onUpdate.updateBy.data.description !== undefined) &&
       updatedItemIds.length > 0
@@ -1359,6 +1396,22 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("ProjectId required to create monitor.");
     }
 
+    /*
+     * Canonicalize the monitoring interval before anything is persisted.
+     *
+     * Gated on key presence, not truthiness: createBy.data is a model
+     * INSTANCE whose columns are all declared `= undefined`, and null is a
+     * meaningful value here ("no schedule"), so a truthiness test would skip
+     * exactly the writes that need checking.
+     */
+    if (createBy.data.monitoringInterval !== undefined) {
+      (createBy.data as unknown as Record<string, unknown>)[
+        "monitoringInterval"
+      ] = MonitoringIntervalValidator.validateAndNormalize(
+        createBy.data.monitoringInterval,
+      );
+    }
+
     /*
      * Validate the request's shape before consulting billing. A conflicting
      * Monitor Template reference, or one hidden by the caller's read scope, is