@oneuptime/common 14.0.1 → 14.0.3

package/Server/Middleware/MasterAdminAuthorization.ts

@@ -1,5 +1,6 @@
 import UserMiddleware from "./UserAuthorization";
 import ProjectMiddleware from "./ProjectAuthorization";
+import UserService from "../Services/UserService";
 import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import {
@@ -7,6 +8,8 @@ import {
   ExpressResponse,
   NextFunction,
 } from "../Utils/Express";
+import Exception from "../../Types/Exception/Exception";
+import ExceptionMessages from "../../Types/Exception/ExceptionMessages";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
 import JSONWebTokenData from "../../Types/JsonWebTokenData";
@@ -54,6 +57,31 @@ export default class MasterAdminAuthorization {
         return;
       }
 
+      /*
+       * These routes read the JWT themselves rather than going through
+       * UserAuthorization, so they need the same blocked-user check: a
+       * blocked master admin's access token is still valid for up to 15
+       * minutes. Its own try, so a failed lookup is reported as what it is
+       * rather than as the invalid-token 401 below.
+       */
+      let isUserBlocked: boolean;
+
+      try {
+        isUserBlocked = await UserService.isUserBlocked(authData.userId);
+      } catch (err) {
+        Response.sendErrorResponse(req, res, err as Exception);
+        return;
+      }
+
+      if (isUserBlocked) {
+        Response.sendErrorResponse(
+          req,
+          res,
+          new NotAuthenticatedException(ExceptionMessages.UserBlocked),
+        );
+        return;
+      }
+
       next();
     } catch {
       Response.sendErrorResponse(

package/Server/Middleware/TelemetryIngest.ts

@@ -71,8 +71,19 @@ const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS: number = 60 * 1000;
  */
 const UNNAMED_SURFACE_READABLE_NAME: string = "this ingest endpoint";
 
+/*
+ * The ceiling a server key gets on the Kubernetes agent Runner registration
+ * surface when its policy names none. Registration is a handful of calls
+ * per agent pod lifetime (start-up, then heartbeats through the Runner's
+ * own credential), so a leaked ingestion key hammering it is abuse, not
+ * traffic - unlike OTLP ingest, where "no limit" is the historical contract
+ * and must stay that way. An explicit per-key limit still wins.
+ */
+export const DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE: number = 30;
+
 type GetEffectiveRequestsPerMinuteLimitFunction = (
   policy: TelemetryIngestionKeyPolicy,
+  surface?: TelemetryIngestSurface | null | undefined,
 ) => number | null;
 
 /*
@@ -89,9 +100,18 @@ type GetEffectiveRequestsPerMinuteLimitFunction = (
  * with NULL falls back to the shipped default instead, because a public key
  * with no ceiling is the thing we are trying to stop shipping: "the customer
  * did not configure a limit" cannot be allowed to mean "unlimited" there.
+ *
+ * The one surface-dependent case is Kubernetes agent Runner registration:
+ * a server key with no configured limit is held to a conservative default
+ * there (see DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE), because
+ * that endpoint mints Runner identities rather than accepting telemetry.
+ * Every other surface keeps the server-key contract above untouched.
  */
 export const getEffectiveRequestsPerMinuteLimit: GetEffectiveRequestsPerMinuteLimitFunction =
-  (policy: TelemetryIngestionKeyPolicy): number | null => {
+  (
+    policy: TelemetryIngestionKeyPolicy,
+    surface?: TelemetryIngestSurface | null | undefined,
+  ): number | null => {
     /*
      * An explicit limit wins for both key types, including a Server key: a
      * customer who deliberately set a ceiling on a server key asked for one
@@ -109,6 +129,10 @@ export const getEffectiveRequestsPerMinuteLimit: GetEffectiveRequestsPerMinuteLi
       return DEFAULT_BROWSER_KEY_REQUESTS_PER_MINUTE;
     }
 
+    if (surface === TelemetryIngestSurface.KubernetesAgentRunner) {
+      return DEFAULT_KUBERNETES_AGENT_RUNNER_REQUESTS_PER_MINUTE;
+    }
+
     return null;
   };
 
@@ -428,6 +452,27 @@ export default class TelemetryIngest {
         }
       }
 
+      /*
+       * Kubernetes agent Runner registration mints a Runner identity — the
+       * one every kubectl job for a cluster is targeted at — so it takes a
+       * project-wide server key. A key pinned to one service's name was
+       * scoped by its owner to that service's telemetry; it is refused here
+       * rather than letting it stand up cluster access it was never meant
+       * to reach.
+       */
+      if (
+        surface === TelemetryIngestSurface.KubernetesAgentRunner &&
+        policy.pinnedServiceName
+      ) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new NotAuthorizedException(
+            "This telemetry ingestion key is pinned to a single service, so it cannot register the Kubernetes agent's in-cluster Runner. Use an unpinned server ingestion key for the Kubernetes agent.",
+          ),
+        );
+      }
+
       /*
        * Rate limit.
        *
@@ -440,7 +485,7 @@ export default class TelemetryIngest {
        * today's ingest slower.
        */
       const effectiveLimitPerMinute: number | null =
-        getEffectiveRequestsPerMinuteLimit(policy);
+        getEffectiveRequestsPerMinuteLimit(policy, surface);
 
       if (effectiveLimitPerMinute !== null) {
         const decision: TelemetryIngestionKeyLimitDecision =

package/Server/Middleware/UserAuthorization.ts

@@ -18,6 +18,7 @@ import ProjectMiddleware from "./ProjectAuthorization";
 import SpanUtil from "../Utils/Telemetry/SpanUtil";
 import Dictionary from "../../Types/Dictionary";
 import Exception from "../../Types/Exception/Exception";
+import ExceptionMessages from "../../Types/Exception/ExceptionMessages";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
 import SsoAuthorizationException from "../../Types/Exception/SsoAuthorizationException";
 import TenantNotFoundException from "../../Types/Exception/TenantNotFoundException";
@@ -590,6 +591,42 @@ export default class UserMiddleware {
       );
     }
 
+    /*
+     * The access token is a stateless JWT that lives for 15 minutes, and
+     * blocking a user revokes their sessions but cannot recall a token already
+     * issued. Without this check a blocked user keeps full access until it
+     * expires. The answer is cached per node (UserService.isUserBlocked), so
+     * this is one primary-key lookup per user per minute, not per request.
+     *
+     * A 401, like an expired token: the client asks /refresh-token for a new
+     * one, which is refused for a blocked user, and signs them out. A lookup
+     * that fails is an error, not a pass.
+     */
+    let isUserBlocked: boolean;
+
+    try {
+      isUserBlocked = await UserService.isUserBlocked(
+        oneuptimeRequest.userAuthorization.userId,
+      );
+    } catch (err) {
+      return Response.sendErrorResponse(req, res, err as Exception);
+    }
+
+    if (isUserBlocked) {
+      if (options.treatInvalidAccessTokenAsAnonymous) {
+        // As for a token that does not decode: the public routes never read who is asking.
+        delete oneuptimeRequest.userAuthorization;
+        oneuptimeRequest.userType = UserType.Public;
+        return next();
+      }
+
+      return Response.sendErrorResponse(
+        req,
+        res,
+        new NotAuthenticatedException(ExceptionMessages.UserBlocked),
+      );
+    }
+
     if (oneuptimeRequest.userAuthorization.isMasterAdmin) {
       oneuptimeRequest.userType = UserType.MasterAdmin;
     } else {
@@ -642,6 +679,7 @@ export default class UserMiddleware {
             req,
             tenantId,
             userId: new ObjectID(userId),
+            userGlobalAccessPermission: userGlobalAccessPermissionPromise,
           }),
           TeamMemberService.getTeamIdsForUser(new ObjectID(userId), tenantId),
         ]);
@@ -689,6 +727,7 @@ export default class UserMiddleware {
             req,
             new ObjectID(userId),
             userGlobalAccessPermission.projectIds,
+            userGlobalAccessPermission,
           );
 
         if (userTenantAccessPermission) {
@@ -876,8 +915,18 @@ export default class UserMiddleware {
     req: ExpressRequest;
     tenantId: ObjectID;
     userId: ObjectID;
+    /*
+     * The user's global permission, when the caller is already resolving it.
+     * AccessTokenService checks the project against it before serving a cached
+     * permission set.
+     */
+    userGlobalAccessPermission?:
+      | Promise<UserGlobalAccessPermission | null>
+      | UserGlobalAccessPermission
+      | null
+      | undefined;
   }): Promise<UserTenantAccessPermission | null> {
-    const { req, tenantId, userId } = data;
+    const { req, tenantId, userId, userGlobalAccessPermission } = data;
 
     const isMasterAdmin: boolean =
       (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
@@ -912,7 +961,9 @@ export default class UserMiddleware {
         }
         throw err;
       }),
-      AccessTokenService.getUserTenantAccessPermission(userId, tenantId),
+      AccessTokenService.getUserTenantAccessPermission(userId, tenantId, {
+        userGlobalAccessPermission,
+      }),
     ]);
 
     /*
@@ -962,6 +1013,8 @@ export default class UserMiddleware {
     req: ExpressRequest,
     userId: ObjectID,
     projectIds: ObjectID[],
+    // The global permission projectIds came from, so each project skips re-reading it.
+    userGlobalAccessPermission?: UserGlobalAccessPermission | null | undefined,
   ): Promise<Dictionary<UserTenantAccessPermission> | null> {
     if (!projectIds.length) {
       return null;
@@ -1042,6 +1095,7 @@ export default class UserMiddleware {
           permission: await AccessTokenService.getUserTenantAccessPermission(
             userId,
             projectId,
+            { userGlobalAccessPermission },
           ),
         };
       }),

package/Server/Services/AIAgentService.ts

@@ -454,6 +454,7 @@ export class Service extends DatabaseService<Model> {
           templateType: EmailTemplateType.AIAgentConnectionStatusChange,
           vars: vars,
           subject: `[AI Agent ${connectionStatus}] ${aiAgent.name}`,
+          isSubjectLiteral: true,
         };
 
         const sms: SMSMessage = {

package/Server/Services/AccessTokenService.ts

@@ -25,39 +25,11 @@ export class AccessTokenService extends BaseService {
 
   @CaptureSpan()
   public async refreshUserAllPermissions(userId: ObjectID): Promise<void> {
-    await this.refreshUserGlobalAccessPermission(userId);
+    const userGlobalAccessPermission: UserGlobalAccessPermission =
+      await this.refreshUserGlobalAccessPermission(userId);
 
-    // query for all projects user belongs to.
-    let teamMembers: Array<TeamMember> = await TeamMemberService.findBy({
-      query: {
-        userId: userId,
-        hasAcceptedInvitation: true,
-      },
-      select: {
-        projectId: true,
-      },
-      limit: LIMIT_MAX,
-      skip: 0,
-      props: {
-        isRoot: true,
-      },
-    });
-
-    if (!teamMembers) {
-      teamMembers = [];
-    }
-
-    if (teamMembers.length === 0) {
-      return;
-    }
-
-    const projectIds: Array<ObjectID> = teamMembers.map(
-      (teamMember: TeamMember) => {
-        return teamMember.projectId!;
-      },
-    );
-
-    for (const projectId of projectIds) {
+    // every project the user belongs to.
+    for (const projectId of userGlobalAccessPermission.projectIds) {
       await this.refreshUserTenantAccessPermission(userId, projectId);
     }
   }
@@ -66,8 +38,13 @@ export class AccessTokenService extends BaseService {
   public async refreshUserGlobalAccessPermission(
     userId: ObjectID,
   ): Promise<UserGlobalAccessPermission> {
-    // query for all projects user belongs to.
-    let teamMembers: Array<TeamMember> = await TeamMemberService.findBy({
+    /*
+     * Every project the user belongs to - all of them, not a first page.
+     * getUserTenantAccessPermission only serves a cached permission set for a
+     * project on this list, so a project cut off it would have its set rebuilt
+     * on every request.
+     */
+    let teamMembers: Array<TeamMember> = await TeamMemberService.findAllBy({
       query: {
         userId: userId,
         hasAcceptedInvitation: true,
@@ -75,8 +52,6 @@ export class AccessTokenService extends BaseService {
       select: {
         projectId: true,
       },
-      limit: LIMIT_MAX,
-      skip: 0,
       props: {
         isRoot: true,
       },
@@ -86,11 +61,18 @@ export class AccessTokenService extends BaseService {
       teamMembers = [];
     }
 
-    const projectIds: Array<ObjectID> = teamMembers.map(
-      (teamMember: TeamMember) => {
-        return teamMember.projectId!;
-      },
-    );
+    // One row per team, so a project comes back once for each team in it.
+    const projectIds: Array<ObjectID> = [];
+    const seenProjectIds: Set<string> = new Set<string>();
+
+    for (const teamMember of teamMembers) {
+      const projectId: ObjectID | undefined = teamMember.projectId;
+
+      if (projectId && !seenProjectIds.has(projectId.toString())) {
+        seenProjectIds.add(projectId.toString());
+        projectIds.push(projectId);
+      }
+    }
 
     const permissionToStore: UserGlobalAccessPermission = {
       projectIds,
@@ -125,6 +107,14 @@ export class AccessTokenService extends BaseService {
   public async refreshUserTenantAccessPermission(
     userId: ObjectID,
     projectId: ObjectID,
+    options?: {
+      /*
+       * Whether to clear the cached entry when the user turns out not to be a
+       * member. Default true. False only when the caller has just seen there
+       * is no entry, so a non-member probing a project costs no cache write.
+       */
+      clearCacheIfNotMember?: boolean | undefined;
+    },
   ): Promise<UserTenantAccessPermission | null> {
     // query for all projects user belongs to.
     const teamMembers: Array<TeamMember> = await TeamMemberService.findBy({
@@ -150,6 +140,20 @@ export class AccessTokenService extends BaseService {
     );
 
     if (teamIds.length === 0) {
+      /*
+       * Not a member of this project. Clear the cached entry rather than just
+       * returning: when the user's last membership has just been removed, it
+       * still holds everything they could do as a member, and nothing else
+       * ever overwrites it - the request middleware would keep serving it
+       * until it expired, 30 days later.
+       */
+      if (options?.clearCacheIfNotMember !== false) {
+        await GlobalCache.deleteKey(
+          PermissionNamespace.ProjectPermission,
+          UserPermissionUtil.buildTenantPermissionCacheKey(userId, projectId),
+        );
+      }
+
       return null;
     }
 
@@ -227,36 +231,105 @@ export class AccessTokenService extends BaseService {
   }): Promise<DatabaseCommonInteractionProps> {
     const { userId, projectId } = data;
 
+    const userGlobalAccessPermission: UserGlobalAccessPermission | null =
+      await this.getUserGlobalAccessPermission(userId);
+
     return {
       userId: userId,
-      userGlobalAccessPermission:
-        (await this.getUserGlobalAccessPermission(userId)) || undefined,
+      userGlobalAccessPermission: userGlobalAccessPermission || undefined,
       userTenantAccessPermission: {
         [projectId.toString()]: (await this.getUserTenantAccessPermission(
           userId,
           projectId,
+          { userGlobalAccessPermission },
         ))!,
       },
       tenantId: projectId,
     };
   }
 
+  /*
+   * The user's permission set in one project, or null if they are not a member
+   * of it.
+   *
+   * A cached set is only served while the user's global permission still lists
+   * the project. The two are written together whenever a membership changes, so
+   * they disagree only when the cached set is left over from a membership that
+   * has since been removed - or, the other way round, when the global list is
+   * the stale one. The memberships decide which: the set is rebuilt from them,
+   * which also clears it if the user is not a member.
+   *
+   * Pass `userGlobalAccessPermission` when the caller already has it, or is
+   * already fetching it, to save a second read of the same cache key.
+   */
   @CaptureSpan()
   public async getUserTenantAccessPermission(
     userId: ObjectID,
     projectId: ObjectID,
+    options?: {
+      userGlobalAccessPermission?:
+        | UserGlobalAccessPermission
+        | null
+        | Promise<UserGlobalAccessPermission | null>
+        | undefined;
+    },
   ): Promise<UserTenantAccessPermission | null> {
-    const json: UserTenantAccessPermission | null =
-      await UserPermissionUtil.getUserTenantAccessPermissionFromCache(
+    const [json, userGlobalAccessPermission]: [
+      UserTenantAccessPermission | null,
+      UserGlobalAccessPermission | null,
+    ] = await Promise.all([
+      UserPermissionUtil.getUserTenantAccessPermissionFromCache(
         userId,
         projectId,
-      );
+      ),
+      options?.userGlobalAccessPermission !== undefined
+        ? options.userGlobalAccessPermission
+        : this.getUserGlobalAccessPermission(userId),
+    ]);
 
     if (!json) {
-      return await this.refreshUserTenantAccessPermission(userId, projectId);
+      return await this.refreshUserTenantAccessPermission(userId, projectId, {
+        clearCacheIfNotMember: false,
+      });
     }
 
-    return json;
+    if (
+      UserPermissionUtil.isProjectInGlobalAccessPermission(
+        userGlobalAccessPermission,
+        projectId,
+      )
+    ) {
+      return json;
+    }
+
+    const permission: UserTenantAccessPermission | null =
+      await this.refreshUserTenantAccessPermission(userId, projectId);
+
+    if (permission) {
+      // Still a member: it was the global list that was out of date.
+      await this.refreshUserGlobalAccessPermission(userId);
+    }
+
+    return permission;
+  }
+
+  /*
+   * Drops the user's cached global permission and their cached permission set
+   * in one project, so both are rebuilt from their memberships the next time
+   * they are read. The fallback for when refreshing them has failed.
+   */
+  @CaptureSpan()
+  public async clearCachedPermissions(
+    userId: ObjectID,
+    projectId: ObjectID,
+  ): Promise<void> {
+    await Promise.all([
+      GlobalCache.deleteKey("user", userId.toString()),
+      GlobalCache.deleteKey(
+        PermissionNamespace.ProjectPermission,
+        UserPermissionUtil.buildTenantPermissionCacheKey(userId, projectId),
+      ),
+    ]);
   }
 }
 

package/Server/Services/AlertEpisodeMemberService.ts

@@ -40,6 +40,15 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("alertId is required");
     }
 
+    if (
+      !createBy.props.isRoot &&
+      createBy.data.isOwnerNotifiedOfAlertAdded !== undefined
+    ) {
+      throw new BadDataException(
+        "isOwnerNotifiedOfAlertAdded cannot be set directly",
+      );
+    }
+
     // Check if this alert is already in the episode
     const existingMember: Model | null = await this.findOneBy({
       query: {

package/Server/Services/AlertEpisodeService.ts

@@ -1174,6 +1174,7 @@ export class Service extends DatabaseService<Model> {
         },
         select: {
           _id: true,
+          projectId: true,
           user: {
             _id: true,
             email: true,
@@ -1196,6 +1197,7 @@ export class Service extends DatabaseService<Model> {
         },
         select: {
           _id: true,
+          projectId: true,
           teamId: true,
         },
         props: {
@@ -1236,7 +1238,18 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
-    return users;
+    const projectId: ObjectID | undefined =
+      ownerUsers[0]?.projectId || ownerTeams[0]?.projectId;
+
+    if (!projectId) {
+      return [];
+    }
+
+    // Owners who left the project are not notified, nor listed as notified.
+    return await TeamMemberService.filterUsersToProjectMembers({
+      projectId: projectId,
+      users: users,
+    });
   }
 
   @CaptureSpan()