@oneuptime/common 14.0.0 → 14.0.2

package/Models/DatabaseModels/WorkflowVariable.ts

@@ -19,8 +19,14 @@ import TableMetadata from "../../Types/Database/TableMetadata";
 import TenantColumn from "../../Types/Database/TenantColumn";
 import UniqueColumnBy from "../../Types/Database/UniqueColumnBy";
 import IconProp from "../../Types/Icon/IconProp";
+import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
 import Permission from "../../Types/Permission";
+import {
+  OAuth2ClientAuthenticationMethod,
+  OAuth2GrantType,
+  WorkflowVariableType,
+} from "../../Types/Workflow/WorkflowVariableOAuth";
 import { Column, Entity, Index, JoinColumn, ManyToOne } from "typeorm";
 
 @EnableDocumentation()
@@ -316,11 +322,19 @@ export default class WorkflowVariable extends BaseModel {
       Permission.EditWorkflowVariable,
     ],
   })
+  /*
+   * Required for a Static variable only. An OAuth 2.0 variable has no value to
+   * type in - its value is the access token OneUptime fetches - so the
+   * requirement moved to WorkflowVariableService.onBeforeCreate, which knows
+   * the variable's type. The column itself stays NOT NULL; an OAuth variable
+   * stores the empty string here.
+   */
   @TableColumn({
-    required: true,
+    required: false,
     type: TableColumnType.VeryLongText,
     title: "Content",
-    description: "Content of the variable",
+    description:
+      "Content of the variable. Required for Static variables. Not used by OAuth 2.0 variables, whose value is the access token OneUptime fetches.",
   })
   @Column({
     nullable: false,
@@ -382,6 +396,469 @@ export default class WorkflowVariable extends BaseModel {
   })
   public isSecret?: string = undefined;
 
+  /*
+   * Static or OAuth 2.0. Fixed at creation: the two kinds store different
+   * things, and turning one into the other in place would leave a Static
+   * variable with credentials nobody entered or an OAuth variable with a
+   * pasted value that is silently ignored. Delete and recreate under the same
+   * name instead - workflows refer to a variable by name, so they keep
+   * working.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: true,
+    type: TableColumnType.ShortText,
+    canReadOnRelationQuery: true,
+    title: "Variable Type",
+    description:
+      "Static: the content you save is used as is. OAuth 2.0: OneUptime fetches an access token from your identity provider and refreshes it automatically when a workflow uses it after it has expired.",
+    defaultValue: WorkflowVariableType.Static,
+    example: "OAuth 2.0",
+  })
+  @Column({
+    nullable: false,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    default: WorkflowVariableType.Static,
+  })
+  public variableType?: WorkflowVariableType = undefined;
+
+  /*
+   * Fixed at creation for the same reason as variableType: the two grants need
+   * different credentials, and the edit form cannot collect a refresh token
+   * (it is write-only), so switching grant in place would produce a variable
+   * that fails on its first use.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "OAuth Grant Type",
+    description:
+      "OAuth 2.0 variables only. Client Credentials for machine-to-machine access, or Refresh Token to keep delegated access alive with a refresh token you obtained once.",
+    example: "Client Credentials",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public oauthGrantType?: OAuth2GrantType = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditWorkflowVariable,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.LongURL,
+    title: "OAuth Token URL",
+    description:
+      "OAuth 2.0 variables only. The token endpoint of your identity provider.",
+    example:
+      "https://login.microsoftonline.com/your-tenant-id/oauth2/v2.0/token",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.LongURL,
+  })
+  public oauthTokenUrl?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditWorkflowVariable,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.LongText,
+    title: "OAuth Client ID",
+    description:
+      "OAuth 2.0 variables only. The client ID of the application registered with your identity provider.",
+    example: "12345678-1234-1234-1234-123456789012",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.LongText,
+    length: ColumnLength.LongText,
+  })
+  public oauthClientId?: string = undefined;
+
+  /*
+   * Write-only, like content: nobody can read it back through the API, not
+   * even a project owner. Encrypted at rest.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditWorkflowVariable,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.VeryLongText,
+    encrypted: true,
+    title: "OAuth Client Secret",
+    description:
+      "OAuth 2.0 variables only. The client secret of the application. Required for the Client Credentials grant; optional for the Refresh Token grant (public clients have none). Encrypted, and never readable through the API.",
+    example: "your-client-secret",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.VeryLongText,
+  })
+  public oauthClientSecret?: string = undefined;
+
+  /*
+   * Write-only and encrypted. OneUptime replaces it with the new refresh token
+   * whenever the identity provider rotates it during a refresh.
+   */
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditWorkflowVariable,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.VeryLongText,
+    encrypted: true,
+    title: "OAuth Refresh Token",
+    description:
+      "OAuth 2.0 variables using the Refresh Token grant only. OneUptime exchanges it for access tokens and stores the replacement when your identity provider rotates it. Encrypted, and never readable through the API.",
+    example: "1//0g-refresh-token",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.VeryLongText,
+  })
+  public oauthRefreshToken?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditWorkflowVariable,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.VeryLongText,
+    title: "OAuth Scope",
+    description:
+      "OAuth 2.0 variables only. Space-separated scopes to request. Leave empty to use the scopes your identity provider grants by default.",
+    example: "https://graph.microsoft.com/.default",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.VeryLongText,
+  })
+  public oauthScope?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditWorkflowVariable,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.JSON,
+    title: "OAuth Additional Parameters",
+    description:
+      "OAuth 2.0 variables only. Extra form parameters sent with every token request, such as audience for Auth0 or resource for Azure AD v1. Readable by anyone who can read the variable, so do not put secrets here.",
+    example: '{"audience": "https://api.example.com"}',
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.JSON,
+  })
+  public oauthAdditionalParameters?: JSONObject = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.CreateWorkflowVariable,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.EditWorkflowVariable,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.ShortText,
+    title: "OAuth Client Authentication",
+    description:
+      "OAuth 2.0 variables only. How the client ID and secret are sent: in an HTTP Basic header (client_secret_basic, the default) or in the request body (client_secret_post).",
+    example: "HTTP Basic Header",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+  })
+  public oauthClientAuthenticationMethod?: OAuth2ClientAuthenticationMethod =
+    undefined;
+
+  /*
+   * The cached access token. Written only by OneUptime
+   * (WorkflowVariableOAuthToken), never through the API in either direction,
+   * and encrypted at rest.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.VeryLongText,
+    encrypted: true,
+    title: "OAuth Access Token",
+    description:
+      "The access token OneUptime last fetched for this OAuth 2.0 variable. Managed by OneUptime, encrypted, and never readable through the API.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.VeryLongText,
+  })
+  public oauthAccessToken?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "OAuth Access Token Expires At",
+    description:
+      "When the cached access token expires, as reported by the identity provider (expires_in) or by the token itself (the JWT exp claim). Empty when neither says.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Date,
+  })
+  public oauthAccessTokenExpiresAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "OAuth Last Refreshed At",
+    description:
+      "When OneUptime last fetched an access token for this variable. Cleared when the OAuth settings change.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Date,
+  })
+  public oauthLastRefreshedAt?: Date = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.VeryLongText,
+    title: "OAuth Last Refresh Error",
+    description:
+      "Why the last attempt to fetch an access token failed. Cleared by the next successful refresh.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.VeryLongText,
+  })
+  public oauthLastRefreshError?: string = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
+      Permission.ReadWorkflowVariable,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Date,
+    title: "OAuth Last Refresh Error At",
+    description:
+      "When the last failed attempt to fetch an access token happened.",
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Date,
+  })
+  public oauthLastRefreshErrorAt?: Date = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/WorkspaceProjectAuthToken.ts

@@ -79,44 +79,70 @@ export interface MicrosoftTeamsInstalledTeam {
   addedAt?: string | undefined;
 }
 
+export interface SlackChannelCacheEntry {
+  id: string;
+  name: string;
+  lastUpdated: string;
+}
+
+// Keyed by the lower-cased channel name.
+export interface SlackChannelCache {
+  [channelName: string]: SlackChannelCacheEntry;
+}
+
 export interface SlackMiscData extends MiscData {
   teamId: string;
   teamName: string;
   botUserId: string;
-  channelCache?: {
-    [channelName: string]: {
-      id: string;
-      name: string;
-      lastUpdated: string;
-    };
-  };
+  channelCache?: SlackChannelCache;
 }
 
+/*
+ * The Microsoft Graph app token is NOT part of this. It is the row's
+ * `authToken`, with its expiry in `authTokenExpiresAt` — both server-only
+ * columns. miscData is readable by every project Viewer, so it must never
+ * hold a credential.
+ */
 export interface MicrosoftTeamsMiscData extends MiscData {
   tenantId: string;
   teamId: string;
   teamName: string;
   botId: string;
-  appAccessToken?: string;
   adminConsentGranted?: boolean;
-  lastAppTokenIssuedAt?: string;
   adminConsentGrantedAt?: string;
   adminConsentGrantedBy?: string;
   availableTeams?: Record<string, MicrosoftTeamsTeam>; // keyed by team id. Every team Graph can see in the tenant.
-  appAccessTokenExpiresAt?: string;
   availableChats?: Record<string, MicrosoftTeamsChat>; // keyed by chat id. Chats the OneUptime app has been added to.
   installedTeams?: Record<string, MicrosoftTeamsInstalledTeam>; // keyed by MicrosoftTeamsInstalledTeam.id — see that type, the key is not always a Graph team id.
 }
 
 export type WorkspaceMiscData = SlackMiscData | MicrosoftTeamsMiscData;
 
+/*
+ * Keys that older releases wrote into miscData and that must never be served
+ * from it again. They held the tenant's live Microsoft Graph app token, and
+ * miscData is readable by every project Viewer. The token now lives only in
+ * the server-only `authToken` / `authTokenExpiresAt` columns; the service
+ * strips these on every read in case a row still carries them.
+ */
+export const LegacyServerOnlyMiscDataKeys: ReadonlyArray<string> = [
+  "appAccessToken",
+  "appAccessTokenExpiresAt",
+  "lastAppTokenIssuedAt",
+];
+
+/*
+ * This row is the binding everything downstream trusts: which Slack workspace
+ * or Microsoft 365 tenant a project's bot token belongs to. For Teams the
+ * server even mints a fresh Graph app token for whatever tenant
+ * `workspaceProjectId` names. So it is created only by the Slack / Microsoft
+ * Teams connect flows, which prove the workspace or tenant before writing it
+ * (see WorkspaceOAuthState), and never through the CRUD API — where it could
+ * name any tenant at all.
+ */
 @TenantColumn("projectId")
 @TableAccessControl({
-  create: [
-    Permission.ProjectOwner,
-    Permission.ProjectAdmin,
-    Permission.ProjectMember,
-  ],
+  create: [],
   read: [
     Permission.ProjectOwner,
     Permission.ProjectAdmin,
@@ -229,6 +255,30 @@ class WorkspaceProjectAuthToken extends BaseModel {
   })
   public authToken?: string = undefined;
 
+  /*
+   * When `authToken` stops working, for workspaces whose token expires. For
+   * Microsoft Teams `authToken` is the tenant's Graph app token and this is
+   * when the server has to mint a new one. Null when the expiry is unknown,
+   * which the Teams path treats as "refresh now".
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    title: "Auth Token Expires At",
+    description: "When the auth token expires, if it expires.",
+    required: false,
+    type: TableColumnType.Date,
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+    unique: false,
+  })
+  public authTokenExpiresAt?: Date = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,
@@ -271,11 +321,8 @@ class WorkspaceProjectAuthToken extends BaseModel {
       Permission.ProjectMember,
       Permission.Viewer,
     ],
-    update: [
-      Permission.ProjectOwner,
-      Permission.ProjectAdmin,
-      Permission.ProjectMember,
-    ],
+    // Repointing a connection to another workspace or tenant is server-only; see the table comment.
+    update: [],
   })
   @TableColumn({
     title: "Project ID in Workspace",
@@ -304,12 +351,19 @@ class WorkspaceProjectAuthToken extends BaseModel {
       Permission.ProjectMember,
       Permission.Viewer,
     ],
-    update: [
-      Permission.ProjectOwner,
-      Permission.ProjectAdmin,
-      Permission.ProjectMember,
-    ],
+    /*
+     * Server-only. For Microsoft Teams this holds values the server trusts:
+     * the Bot Framework service URLs proactive sends go to (with the bot's
+     * token attached), the tenant and its consent state.
+     * The Slack channel cache, the only part the dashboard edits, is saved
+     * through PUT /slack/channel-cache, which writes nothing else.
+     */
+    update: [],
   })
+  /*
+   * Readable by every project Viewer, so it must never hold a credential.
+   * Tokens go in `authToken` / `authTokenExpiresAt`, which are server-only.
+   */
   @TableColumn({
     title: "Misc Data",
     required: true,