@oneuptime/common 14.0.1 → 14.0.2

package/Server/API/WorkflowVariableAPI.ts

@@ -0,0 +1,156 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import WorkflowVariableService, {
+  Service as WorkflowVariableServiceType,
+} from "../Services/WorkflowVariableService";
+import ModelPermission from "../Types/Database/Permissions/Index";
+import Query from "../Types/Database/Query";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import WorkflowVariableOAuthToken, {
+  WorkflowVariableAccessToken,
+} from "../Utils/Workflow/WorkflowVariableOAuthToken";
+import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+import WorkflowVariable from "../../Models/DatabaseModels/WorkflowVariable";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import ObjectID from "../../Types/ObjectID";
+import { isOAuth2WorkflowVariable } from "../../Types/Workflow/WorkflowVariableOAuth";
+
+/*
+ * ------------------------------------------------------------------
+ * WorkflowVariableAPI
+ *
+ *   POST /workflow-variable/:id/refresh-oauth-token
+ *
+ * "Refresh now" for an OAuth 2.0 workflow variable: fetch a new access
+ * token from the identity provider now, whether or not the cached one has
+ * expired. It is how somebody checks new settings without running a
+ * workflow, and how they recover after fixing whatever made the last refresh
+ * fail.
+ *
+ * The answer says when the new token expires and never contains it. The
+ * access token is as unreadable through the API as a variable's content is;
+ * this endpoint must not become a way around that.
+ *
+ * A refresh writes to the variable (the token, and a rotated refresh token),
+ * so it needs the same update permission as editing the variable. Access is
+ * checked in two steps, like the Data Source test route: the row is read
+ * with the caller's own permissions first - another project's id, or one the
+ * caller may not read, answers exactly like an id that does not exist - and
+ * only then is the update permission checked and the credentials read as
+ * root.
+ * ------------------------------------------------------------------
+ */
+
+const NOT_FOUND_MESSAGE: string =
+  "Workflow variable not found, or you do not have access to it.";
+
+function readVariableId(req: ExpressRequest): ObjectID {
+  const id: string | undefined = req.params["id"];
+
+  /*
+   * ObjectID's constructor takes any string, so a malformed id would
+   * otherwise reach Postgres and come back as a syntax error, not a 400.
+   */
+  if (!id || !ObjectID.isValidUUID(id)) {
+    throw new BadDataException(NOT_FOUND_MESSAGE);
+  }
+
+  return new ObjectID(id);
+}
+
+export default class WorkflowVariableAPI extends BaseAPI<
+  WorkflowVariable,
+  WorkflowVariableServiceType
+> {
+  public constructor() {
+    super(WorkflowVariable, WorkflowVariableService);
+
+    this.router.post(
+      `${new this.entityType()
+        .getCrudApiPath()
+        ?.toString()}/:id/refresh-oauth-token`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          CommonAPI.assertAuthenticatedProjectPrincipal(props);
+
+          const variableId: ObjectID = readVariableId(req);
+
+          const variable: WorkflowVariable | null =
+            await WorkflowVariableService.findOneById({
+              id: variableId,
+              select: {
+                _id: true,
+                name: true,
+                variableType: true,
+              },
+              props: props,
+            });
+
+          if (!variable) {
+            throw new BadDataException(NOT_FOUND_MESSAGE);
+          }
+
+          await ModelPermission.checkUpdateQueryPermissions(
+            WorkflowVariable,
+            { _id: variableId.toString() } as Query<WorkflowVariable>,
+            {},
+            props,
+          );
+
+          if (!isOAuth2WorkflowVariable(variable.variableType)) {
+            throw new BadDataException(
+              `"${variable.name || "This variable"}" is not an OAuth 2.0 variable, so it has no access token to refresh.`,
+            );
+          }
+
+          let token: WorkflowVariableAccessToken;
+
+          try {
+            token = await WorkflowVariableOAuthToken.getAccessToken({
+              variableId: variableId,
+              forceRefresh: true,
+            });
+          } catch (err) {
+            /*
+             * The identity provider's answer is the useful part - it is what
+             * the person has to fix - so it goes back as the error message.
+             * WorkflowVariableOAuthToken has already written it to the
+             * variable, where its page's Access Token card shows it.
+             */
+            return Response.sendErrorResponse(
+              req,
+              res,
+              err instanceof Exception
+                ? err
+                : new BadDataException(
+                    "Could not refresh the access token. Try again in a few minutes.",
+                  ),
+            );
+          }
+
+          return Response.sendJsonObjectResponse(req, res, {
+            oauthAccessTokenExpiresAt: token.expiresAt
+              ? token.expiresAt.toISOString()
+              : null,
+            oauthLastRefreshedAt: token.refreshedAt
+              ? token.refreshedAt.toISOString()
+              : null,
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+}

package/Server/Infrastructure/GlobalCache.ts

@@ -328,6 +328,41 @@ export default abstract class GlobalCache {
     return result === 1;
   }
 
+  /*
+   * Atomic read-and-remove: return the value and delete the key in one
+   * evaluation, so exactly one caller ever sees it.
+   *
+   * This is the primitive for single-use tokens (OAuth `state` nonces and the
+   * like). `getString()` followed by `deleteKey()` is a check-then-act race:
+   * two requests replaying the same token in the same instant would both read
+   * it before either deleted it, and both would be honoured. A Lua script
+   * rather than GETDEL keeps this working on Redis versions older than 6.2.
+   *
+   * The key is passed as KEYS[1] rather than inlined into the script body so
+   * the script stays correct on Redis Cluster, which routes by declared keys.
+   */
+  @CaptureSpan()
+  public static async getAndDeleteString(
+    namespace: string,
+    key: string,
+  ): Promise<string | null> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const result: unknown = await client.eval(
+      "local value = redis.call('GET', KEYS[1]) " +
+        "if value then redis.call('DEL', KEYS[1]) end " +
+        "return value",
+      1,
+      `${namespace}-${key}`,
+    );
+
+    return typeof result === "string" && result ? result : null;
+  }
+
   @CaptureSpan()
   public static async deleteKey(namespace: string, key: string): Promise<void> {
     const client: ClientType | null = Redis.getClient();

package/Server/Infrastructure/Postgres/SchemaMigrations/1794300000000-AddOAuth2WorkflowVariables.ts

@@ -0,0 +1,97 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddOAuth2WorkflowVariables1794300000000
+  implements MigrationInterface
+{
+  public name: string = "AddOAuth2WorkflowVariables1794300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "variableType" character varying(100) NOT NULL DEFAULT 'Static'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthGrantType" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthTokenUrl" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthClientId" character varying(500)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthClientSecret" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthRefreshToken" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthScope" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthAdditionalParameters" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthClientAuthenticationMethod" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthAccessToken" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthAccessTokenExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthLastRefreshedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthLastRefreshError" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthLastRefreshErrorAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthLastRefreshErrorAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthLastRefreshError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthLastRefreshedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthAccessTokenExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthAccessToken"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthClientAuthenticationMethod"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthAdditionalParameters"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthScope"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthRefreshToken"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthClientSecret"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthClientId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthTokenUrl"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthGrantType"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "variableType"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794400000000-AddKubernetesClusterAiAccess.ts

@@ -0,0 +1,129 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration, then trimmed to this
+ * change. OneUptime AI access to a Kubernetes cluster: the cluster binds the
+ * Runner (and optional Kubernetes credential) AI uses for kubectl, plus its
+ * investigation switch, remediation mode and allowlist. RunnerJob and
+ * AutoRemediationSuggestion gain the cluster a kubectl command ran against
+ * so the cluster's AI page can list every command AI ran on it.
+ */
+export class AddKubernetesClusterAiAccess1794400000000
+  implements MigrationInterface
+{
+  public name: string = "AddKubernetesClusterAiAccess1794400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessRunnerId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessCredentialId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiKubectlCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessRunnerBoundAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "kubernetesClusterId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD "kubernetesClusterId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_9cfdcee74d277dcb577dd5889d" ON "KubernetesCluster" ("aiAccessRunnerId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_d3aac9a59774cca6c0f0299992" ON "RunnerJob" ("kubernetesClusterId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_8730770e8d450cbfa54236ed13" ON "AutoRemediationSuggestion" ("kubernetesClusterId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_9cfdcee74d277dcb577dd5889d5" FOREIGN KEY ("aiAccessRunnerId") REFERENCES "Runner"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_b4a0ae50ee63ca22e46e396ca3e" FOREIGN KEY ("aiAccessCredentialId") REFERENCES "RunbookCredential"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD CONSTRAINT "FK_d3aac9a59774cca6c0f0299992a" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD CONSTRAINT "FK_8730770e8d450cbfa54236ed13a" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP CONSTRAINT "FK_8730770e8d450cbfa54236ed13a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP CONSTRAINT "FK_d3aac9a59774cca6c0f0299992a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_b4a0ae50ee63ca22e46e396ca3e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_9cfdcee74d277dcb577dd5889d5"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_8730770e8d450cbfa54236ed13"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_d3aac9a59774cca6c0f0299992"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_9cfdcee74d277dcb577dd5889d"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP COLUMN "kubernetesClusterId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "kubernetesClusterId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessRunnerBoundAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiKubectlCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessCredentialId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessRunnerId"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794500000000-AddIncomingEmailCustomAddressToMonitor.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddIncomingEmailCustomAddressToMonitor1794500000000
+  implements MigrationInterface
+{
+  public name: string = "AddIncomingEmailCustomAddressToMonitor1794500000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD "incomingEmailCustomLocalPart" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD CONSTRAINT "UQ_7abf86b592dbbe8bf8a38bad6e5" UNIQUE ("incomingEmailCustomLocalPart")`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP CONSTRAINT "UQ_7abf86b592dbbe8bf8a38bad6e5"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP COLUMN "incomingEmailCustomLocalPart"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794600000000-AddAuthTokenExpiresAtToWorkspaceProjectAuthToken.ts

@@ -0,0 +1,20 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkspaceProjectAuthToken" ADD "authTokenExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkspaceProjectAuthToken" DROP COLUMN "authTokenExpiresAt"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794700000000-RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData.ts

@@ -0,0 +1,38 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Data cleanup: take the Microsoft Graph app token out of
+ * WorkspaceProjectAuthToken.miscData.
+ *
+ * Microsoft Teams connections cached the tenant's app-only Graph token, and
+ * its expiry, in miscData. That column is readable by every project Viewer
+ * through the CRUD API. The token now lives only in the server-only
+ * `authToken` / `authTokenExpiresAt` columns (`authToken` always held the same
+ * token), so the copies in miscData are deleted here.
+ *
+ * `authTokenExpiresAt` is deliberately not backfilled from the old miscData
+ * value. A Teams connection with no recorded expiry mints a fresh token on its
+ * next Graph call, and that records one.
+ *
+ * Only JSON objects are touched: `-` raises on a JSON scalar, and `?|` would
+ * match a scalar string equal to one of the keys.
+ *
+ * down() restores nothing. The values were short-lived credentials the server
+ * mints again on demand, and putting them back would reopen the exposure.
+ */
+export class RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000
+  implements MigrationInterface
+{
+  public name: string =
+    "RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `UPDATE "WorkspaceProjectAuthToken" SET "miscData" = "miscData" - 'appAccessToken' - 'appAccessTokenExpiresAt' - 'lastAppTokenIssuedAt' WHERE jsonb_typeof("miscData") = 'object' AND "miscData" ?| ARRAY['appAccessToken', 'appAccessTokenExpiresAt', 'lastAppTokenIssuedAt']`,
+    );
+  }
+
+  public async down(_queryRunner: QueryRunner): Promise<void> {
+    // Nothing to restore; see the note above.
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -3,6 +3,11 @@ import { RemoveMonitorDescriptionLengthLimit1793800000000 } from "./179380000000
 import { AddEnterpriseEditionFirstSeenAt1793900000000 } from "./1793900000000-AddEnterpriseEditionFirstSeenAt";
 import { AddSloLabelAndOwnerRules1794100000000 } from "./1794100000000-AddSloLabelAndOwnerRules";
 import { AddSloMonitorRuleMonitorType1794200000000 } from "./1794200000000-AddSloMonitorRuleMonitorType";
+import { AddOAuth2WorkflowVariables1794300000000 } from "./1794300000000-AddOAuth2WorkflowVariables";
+import { AddKubernetesClusterAiAccess1794400000000 } from "./1794400000000-AddKubernetesClusterAiAccess";
+import { AddIncomingEmailCustomAddressToMonitor1794500000000 } from "./1794500000000-AddIncomingEmailCustomAddressToMonitor";
+import { AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000 } from "./1794600000000-AddAuthTokenExpiresAtToWorkspaceProjectAuthToken";
+import { RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000 } from "./1794700000000-RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1206,4 +1211,9 @@ export default [
   AddEnterpriseEditionFirstSeenAt1793900000000,
   AddSloLabelAndOwnerRules1794100000000,
   AddSloMonitorRuleMonitorType1794200000000,
+  AddOAuth2WorkflowVariables1794300000000,
+  AddKubernetesClusterAiAccess1794400000000,
+  AddIncomingEmailCustomAddressToMonitor1794500000000,
+  AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000,
+  RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000,
 ];

package/Server/Middleware/MasterAdminAuthorization.ts

@@ -1,5 +1,6 @@
 import UserMiddleware from "./UserAuthorization";
 import ProjectMiddleware from "./ProjectAuthorization";
+import UserService from "../Services/UserService";
 import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import {
@@ -7,6 +8,8 @@ import {
   ExpressResponse,
   NextFunction,
 } from "../Utils/Express";
+import Exception from "../../Types/Exception/Exception";
+import ExceptionMessages from "../../Types/Exception/ExceptionMessages";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
 import JSONWebTokenData from "../../Types/JsonWebTokenData";
@@ -54,6 +57,31 @@ export default class MasterAdminAuthorization {
         return;
       }
 
+      /*
+       * These routes read the JWT themselves rather than going through
+       * UserAuthorization, so they need the same blocked-user check: a
+       * blocked master admin's access token is still valid for up to 15
+       * minutes. Its own try, so a failed lookup is reported as what it is
+       * rather than as the invalid-token 401 below.
+       */
+      let isUserBlocked: boolean;
+
+      try {
+        isUserBlocked = await UserService.isUserBlocked(authData.userId);
+      } catch (err) {
+        Response.sendErrorResponse(req, res, err as Exception);
+        return;
+      }
+
+      if (isUserBlocked) {
+        Response.sendErrorResponse(
+          req,
+          res,
+          new NotAuthenticatedException(ExceptionMessages.UserBlocked),
+        );
+        return;
+      }
+
       next();
     } catch {
       Response.sendErrorResponse(

package/Server/Middleware/TelemetryIngest.ts

@@ -71,8 +71,19 @@ const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS: number = 60 * 1000;
  */
 const UNNAMED_SURFACE_READABLE_NAME: string = "this ingest endpoint";
 
+/*
+ * The ceiling a server key gets on the Kubernetes agent Runner registration
+ * surface when its policy names none. Registration is a handful of calls
+ * per agent pod lifetime (start-up, then heartbeats through the Runner's
+ * own credential), so a leaked ingestion key hammering it is abuse, not
+ * traffic - unlike OTLP ingest, where "no limit" is the historical contract
+ * and must stay that way. An explicit per-key limit still wins.
+ */
+export const DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE: number = 30;
+
 type GetEffectiveRequestsPerMinuteLimitFunction = (
   policy: TelemetryIngestionKeyPolicy,
+  surface?: TelemetryIngestSurface | null | undefined,
 ) => number | null;
 
 /*
@@ -89,9 +100,18 @@ type GetEffectiveRequestsPerMinuteLimitFunction = (
  * with NULL falls back to the shipped default instead, because a public key
  * with no ceiling is the thing we are trying to stop shipping: "the customer
  * did not configure a limit" cannot be allowed to mean "unlimited" there.
+ *
+ * The one surface-dependent case is Kubernetes agent Runner registration:
+ * a server key with no configured limit is held to a conservative default
+ * there (see DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE), because
+ * that endpoint mints Runner identities rather than accepting telemetry.
+ * Every other surface keeps the server-key contract above untouched.
  */
 export const getEffectiveRequestsPerMinuteLimit: GetEffectiveRequestsPerMinuteLimitFunction =
-  (policy: TelemetryIngestionKeyPolicy): number | null => {
+  (
+    policy: TelemetryIngestionKeyPolicy,
+    surface?: TelemetryIngestSurface | null | undefined,
+  ): number | null => {
     /*
      * An explicit limit wins for both key types, including a Server key: a
      * customer who deliberately set a ceiling on a server key asked for one
@@ -109,6 +129,10 @@ export const getEffectiveRequestsPerMinuteLimit: GetEffectiveRequestsPerMinuteLi
       return DEFAULT_BROWSER_KEY_REQUESTS_PER_MINUTE;
     }
 
+    if (surface === TelemetryIngestSurface.KubernetesAgentRunner) {
+      return DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE;
+    }
+
     return null;
   };
 
@@ -428,6 +452,27 @@ export default class TelemetryIngest {
         }
       }
 
+      /*
+       * Kubernetes agent Runner registration mints a Runner identity — the
+       * one every kubectl job for a cluster is targeted at — so it takes a
+       * project-wide server key. A key pinned to one service's name was
+       * scoped by its owner to that service's telemetry; it is refused here
+       * rather than letting it stand up cluster access it was never meant
+       * to reach.
+       */
+      if (
+        surface === TelemetryIngestSurface.KubernetesAgentRunner &&
+        policy.pinnedServiceName
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new NotAuthorizedException(
+            "This telemetry ingestion key is pinned to a single service, so it cannot register the Kubernetes agent's in-cluster Runner. Use an unpinned server ingestion key for the Kubernetes agent.",
+          ),
+        );
+      }
+
       /*
        * Rate limit.
        *
@@ -440,7 +485,7 @@ export default class TelemetryIngest {
        * today's ingest slower.
        */
       const effectiveLimitPerMinute: number | null =
-        getEffectiveRequestsPerMinuteLimit(policy);
+        getEffectiveRequestsPerMinuteLimit(policy, surface);
 
       if (effectiveLimitPerMinute !== null) {
         const decision: TelemetryIngestionKeyLimitDecision =