@oneuptime/common 14.0.10 → 14.0.11

package/Server/Utils/RelaxedScimTeamLocksReport.ts

@@ -0,0 +1,245 @@
+import EnterpriseEdition, {
+  EnterpriseFeatureStateChange,
+} from "../Enterprise/EnterpriseEdition";
+import EnterpriseFeature from "../Enterprise/EnterpriseFeature";
+import {
+  ENTERPRISE_LICENSE_GRACE_PERIOD_IN_DAYS,
+  ENTERPRISE_LICENSE_TRIAL_PERIOD_IN_DAYS,
+} from "../Enterprise/EnterpriseLicenseSnapshot";
+import ProjectSCIMService from "../Services/ProjectSCIMService";
+import logger from "./Logger";
+import PositiveNumber from "../../Types/PositiveNumber";
+import ProjectSCIM from "../../Models/DatabaseModels/ProjectSCIM";
+
+// How many project ids the log line names; the count is always exact.
+export const MAX_IDS_LISTED: number = 20;
+
+/*
+ * The SCIM Push Groups team locks that are configured but not enforced (see
+ * EditionEnforcement.areScimTeamLocksEnforced): left over from an Enterprise
+ * Edition install on a Community Edition process, or configured on an
+ * Enterprise install whose license no longer covers SCIM.
+ */
+export interface RelaxedScimTeamLocksSummary {
+  scimConfigurationsWithPushGroups: number;
+  projectIdsWithScimPushGroups: Array<string>;
+}
+
+/*
+ * Why the locks in a report are not enforced:
+ *
+ *   community        a Community Edition process, which has no SCIM endpoint
+ *                    at all;
+ *   lapsed-license   an Enterprise install whose license no longer covers
+ *                    SCIM (EnterpriseEdition.isFeatureActive). Nothing is
+ *                    reported unless isScimRelaxed.
+ */
+export type RelaxedScimTeamLocksContext =
+  | { reason: "community" }
+  | { reason: "lapsed-license"; isScimRelaxed: boolean };
+
+const COMMUNITY_CONTEXT: RelaxedScimTeamLocksContext = { reason: "community" };
+
+/*
+ * Tells the operator which SCIM Push Groups team locks this server is not
+ * enforcing, so that never happens silently:
+ *
+ *   - Community Edition: moving from the Enterprise image to the Community
+ *     one keeps the database as it is, so a SCIM configuration with Push
+ *     Groups on still says so - but the SCIM endpoints are part of the
+ *     Enterprise Edition, so its team locks are relaxed rather than leaving
+ *     teams nobody can manage. Logged once per process at boot.
+ *   - Enterprise Edition: when the license stops covering SCIM, the same
+ *     locks are relaxed until a license is activated. Logged each time SCIM
+ *     stops (EnterpriseEdition reports each change once), including a
+ *     license that has already lapsed at boot.
+ */
+export default class RelaxedScimTeamLocksReport {
+  private static hasRun: boolean = false;
+
+  private static stopWatchingLicense: (() => void) | null = null;
+
+  /*
+   * Called once at boot, after the enterprise loader. On the Community
+   * Edition it logs the relaxed locks once per process. On the Enterprise
+   * Edition it starts watching the license (once per process) and reports
+   * whenever SCIM stops. Never throws: a failed check is logged and boot
+   * carries on. Returns what the Community Edition report found (null when
+   * it did not run or the check failed).
+   */
+  public static async logRelaxedEnforcementOnce(): Promise<RelaxedScimTeamLocksSummary | null> {
+    if (EnterpriseEdition.isLoaded()) {
+      RelaxedScimTeamLocksReport.watchLicenseOnce();
+      return null;
+    }
+
+    if (RelaxedScimTeamLocksReport.hasRun) {
+      return null;
+    }
+
+    RelaxedScimTeamLocksReport.hasRun = true;
+
+    return await RelaxedScimTeamLocksReport.report(COMMUNITY_CONTEXT);
+  }
+
+  /*
+   * Collects and logs the relaxed locks. Never throws. Returns what it found
+   * (null when the check failed).
+   */
+  public static async report(
+    context: RelaxedScimTeamLocksContext,
+  ): Promise<RelaxedScimTeamLocksSummary | null> {
+    try {
+      const summary: RelaxedScimTeamLocksSummary =
+        await RelaxedScimTeamLocksReport.collect();
+
+      const message: string | null = RelaxedScimTeamLocksReport.describe(
+        summary,
+        context,
+      );
+
+      if (message) {
+        logger.warn(message);
+      }
+
+      return summary;
+    } catch (err) {
+      logger.error(
+        context.reason === "community"
+          ? "Community Edition: could not check for SCIM Push Groups team locks left over from an Enterprise Edition install."
+          : "OneUptime Enterprise license lapsed: could not check which SCIM Push Groups team locks are no longer enforced.",
+      );
+      logger.error(err);
+      return null;
+    }
+  }
+
+  /*
+   * Watches the Enterprise license for SCIM stopping, once per process. The
+   * first look happens here, so a license that has already lapsed at boot is
+   * reported like a lapse at runtime.
+   */
+  private static watchLicenseOnce(): void {
+    if (RelaxedScimTeamLocksReport.stopWatchingLicense) {
+      return;
+    }
+
+    RelaxedScimTeamLocksReport.stopWatchingLicense =
+      EnterpriseEdition.onFeatureStateChange(
+        (change: EnterpriseFeatureStateChange): void => {
+          RelaxedScimTeamLocksReport.onFeatureStateChange(change);
+        },
+      );
+
+    try {
+      EnterpriseEdition.isFeatureActive(EnterpriseFeature.SCIM);
+    } catch (err) {
+      logger.error(err);
+    }
+  }
+
+  private static onFeatureStateChange(
+    change: EnterpriseFeatureStateChange,
+  ): void {
+    if (!change.stopped.includes(EnterpriseFeature.SCIM)) {
+      return;
+    }
+
+    void RelaxedScimTeamLocksReport.report({
+      reason: "lapsed-license",
+      isScimRelaxed: true,
+    });
+  }
+
+  // Reads the stored settings, as root.
+  public static async collect(): Promise<RelaxedScimTeamLocksSummary> {
+    const [scimCount, scimConfigurations]: [
+      PositiveNumber,
+      Array<ProjectSCIM>,
+    ] = await Promise.all([
+      ProjectSCIMService.countBy({
+        query: { enablePushGroups: true },
+        props: { isRoot: true },
+      }),
+      ProjectSCIMService.findBy({
+        query: { enablePushGroups: true },
+        select: { projectId: true },
+        limit: MAX_IDS_LISTED,
+        skip: 0,
+        props: { isRoot: true },
+      }),
+    ]);
+
+    return {
+      scimConfigurationsWithPushGroups: scimCount.toNumber(),
+      projectIdsWithScimPushGroups: RelaxedScimTeamLocksReport.toIds(
+        scimConfigurations.map((scim: ProjectSCIM) => {
+          return scim.projectId?.toString();
+        }),
+      ),
+    };
+  }
+
+  // The log line, or null when nothing is relaxed.
+  public static describe(
+    summary: RelaxedScimTeamLocksSummary,
+    context: RelaxedScimTeamLocksContext = COMMUNITY_CONTEXT,
+  ): string | null {
+    const isScimRelaxed: boolean =
+      context.reason === "community" || context.isScimRelaxed;
+
+    if (!isScimRelaxed || summary.scimConfigurationsWithPushGroups <= 0) {
+      return null;
+    }
+
+    const relaxed: string = `${summary.scimConfigurationsWithPushGroups} SCIM configuration(s) with Push Groups on, whose teams can be edited in OneUptime again${RelaxedScimTeamLocksReport.describeIds(
+      summary.projectIdsWithScimPushGroups,
+      summary.scimConfigurationsWithPushGroups,
+    )}`;
+
+    if (context.reason === "lapsed-license") {
+      return (
+        "OneUptime Enterprise license lapsed: this server has SCIM Push Groups team locks that it no longer enforces, " +
+        "because SCIM provisioning has stopped until a license that includes it is activated. " +
+        `Not enforced: ${relaxed}. ` +
+        "The settings are kept unchanged and are enforced again as soon as a license is activated, without a restart."
+      );
+    }
+
+    return (
+      "Community Edition: this server has SCIM Push Groups team locks from an Enterprise Edition install that it does not enforce, " +
+      "because SCIM provisioning is part of the OneUptime Enterprise Edition. " +
+      `Not enforced: ${relaxed}. ` +
+      `The settings are kept unchanged and are enforced again when this server runs the Enterprise Edition image with a valid license (or during its ${ENTERPRISE_LICENSE_TRIAL_PERIOD_IN_DAYS}-day trial, or the ${ENTERPRISE_LICENSE_GRACE_PERIOD_IN_DAYS}-day grace period after a license expires).`
+    );
+  }
+
+  // Test suites only: allow the next call to run again and stop watching.
+  public static resetForTests(): void {
+    RelaxedScimTeamLocksReport.hasRun = false;
+
+    if (RelaxedScimTeamLocksReport.stopWatchingLicense) {
+      RelaxedScimTeamLocksReport.stopWatchingLicense();
+      RelaxedScimTeamLocksReport.stopWatchingLicense = null;
+    }
+  }
+
+  private static toIds(values: Array<string | undefined>): Array<string> {
+    return values
+      .filter((value: string | undefined): value is string => {
+        return Boolean(value);
+      })
+      .slice(0, MAX_IDS_LISTED);
+  }
+
+  private static describeIds(ids: Array<string>, total: number): string {
+    if (ids.length === 0) {
+      return "";
+    }
+
+    const more: string =
+      total > ids.length ? ` and ${total - ids.length} more` : "";
+
+    return ` (project ids: ${ids.join(", ")}${more})`;
+  }
+}

package/Server/Utils/Rules/RuleRun/RuleRunRegistry.ts

@@ -75,6 +75,11 @@ import KubernetesClusterLabelRule from "../../../../Models/DatabaseModels/Kubern
 import KubernetesClusterOwnerRule from "../../../../Models/DatabaseModels/KubernetesClusterOwnerRule";
 import KubernetesClusterOwnerTeam from "../../../../Models/DatabaseModels/KubernetesClusterOwnerTeam";
 import KubernetesClusterOwnerUser from "../../../../Models/DatabaseModels/KubernetesClusterOwnerUser";
+import MessageQueue from "../../../../Models/DatabaseModels/MessageQueue";
+import MessageQueueLabelRule from "../../../../Models/DatabaseModels/MessageQueueLabelRule";
+import MessageQueueOwnerRule from "../../../../Models/DatabaseModels/MessageQueueOwnerRule";
+import MessageQueueOwnerTeam from "../../../../Models/DatabaseModels/MessageQueueOwnerTeam";
+import MessageQueueOwnerUser from "../../../../Models/DatabaseModels/MessageQueueOwnerUser";
 import Monitor from "../../../../Models/DatabaseModels/Monitor";
 import MonitorLabelRule from "../../../../Models/DatabaseModels/MonitorLabelRule";
 import MonitorOwnerRule from "../../../../Models/DatabaseModels/MonitorOwnerRule";
@@ -230,6 +235,11 @@ import KubernetesClusterLabelRuleService from "../../../Services/KubernetesClust
 import KubernetesClusterOwnerRuleEngineService from "../../../Services/KubernetesClusterOwnerRuleEngineService";
 import KubernetesClusterOwnerRuleService from "../../../Services/KubernetesClusterOwnerRuleService";
 import KubernetesClusterService from "../../../Services/KubernetesClusterService";
+import MessageQueueLabelRuleEngineService from "../../../Services/MessageQueueLabelRuleEngineService";
+import MessageQueueLabelRuleService from "../../../Services/MessageQueueLabelRuleService";
+import MessageQueueOwnerRuleEngineService from "../../../Services/MessageQueueOwnerRuleEngineService";
+import MessageQueueOwnerRuleService from "../../../Services/MessageQueueOwnerRuleService";
+import MessageQueueService from "../../../Services/MessageQueueService";
 import MonitorLabelRuleEngineService from "../../../Services/MonitorLabelRuleEngineService";
 import MonitorLabelRuleService from "../../../Services/MonitorLabelRuleService";
 import MonitorOwnerRuleEngineService from "../../../Services/MonitorOwnerRuleEngineService";
@@ -599,6 +609,21 @@ const RULE_RUN_DEFINITIONS: Record<ResourceRuleRunType, RuleRunDefinition> = {
     engine: KubernetesClusterOwnerRuleEngineService,
     ownerModelTypes: [KubernetesClusterOwnerUser, KubernetesClusterOwnerTeam],
   }),
+  [RuleRunType.MessageQueueLabelRule]: defineRuleRun({
+    ruleModelType: MessageQueueLabelRule,
+    resourceModelType: MessageQueue,
+    ruleService: MessageQueueLabelRuleService,
+    resourceService: MessageQueueService,
+    engine: MessageQueueLabelRuleEngineService,
+  }),
+  [RuleRunType.MessageQueueOwnerRule]: defineRuleRun({
+    ruleModelType: MessageQueueOwnerRule,
+    resourceModelType: MessageQueue,
+    ruleService: MessageQueueOwnerRuleService,
+    resourceService: MessageQueueService,
+    engine: MessageQueueOwnerRuleEngineService,
+    ownerModelTypes: [MessageQueueOwnerUser, MessageQueueOwnerTeam],
+  }),
   [RuleRunType.MonitorLabelRule]: defineRuleRun({
     ruleModelType: MonitorLabelRule,
     resourceModelType: Monitor,

package/Server/Utils/SameOriginRequest.ts

@@ -0,0 +1,203 @@
+import { Host, HttpProtocol } from "../EnvironmentConfig";
+import { URL as NodeURL } from "url";
+
+/*
+ * WHETHER A BROWSER SENT THIS REQUEST FROM A PAGE THAT IS NOT THIS
+ * INSTANCE'S OWN.
+ *
+ * The API answers every origin (Access-Control-Allow-Origin: *, and cors()
+ * approves any preflight), so any website can have a visitor's browser send
+ * a request to an anonymous route - an auto-submitted <form method=POST>
+ * needs no preflight at all - from the visitor's own network address. For a
+ * route that trusts where a request comes from (an IP allowlist, a
+ * per-address budget), every visitor inside the allowed network becomes a
+ * relay for whoever wrote that page.
+ *
+ * A browser says where a request came from, in two headers no page can set,
+ * and the request is refused when either says it came from somewhere else:
+ *
+ *   - Sec-Fetch-Site (sent over HTTPS and to localhost): only "same-origin",
+ *     or "none" for a request the visitor made themselves (the address bar,
+ *     a bookmark), passes; "same-site" and "cross-site" are another page.
+ *
+ *   - Origin (sent with every POST, and with every CORS request - a fetch
+ *     or XMLHttpRequest to another origin - but not with a no-cors GET, such
+ *     as an <img>, a <script>, a link followed or a frame, nor with a GET to
+ *     the page's own origin): must be this instance's origin as it is
+ *     configured - HTTP_PROTOCOL and HOST, from which the dashboard and the
+ *     Accounts pages build the API's address, and with which the passkey
+ *     sign-in compares a browser's Origin too. A HOST with a port
+ *     (localhost:3000 in development) keeps it, as the browser's Origin
+ *     does. It is read even when Sec-Fetch-Site says "same-origin", because
+ *     that only says the page is on the host the request went to, and this
+ *     app answers for more hosts than its own: a status page on its owner's
+ *     domain, and a DNS-rebinding page whose name was pointed at this
+ *     server, both call their requests to it "same-origin". "null" - an
+ *     opaque origin, such as a sandboxed frame's - is never this instance.
+ *
+ * The Host header is not compared: it names whatever host the browser went
+ * to - the rebinding page's own name included - and our nginx forwards it
+ * without the port.
+ *
+ * A request with neither header is not refused here, and it need not come
+ * from curl or a server-side client: over plain HTTP (to anywhere but
+ * localhost) a browser sends no Sec-Fetch-Site at all, and a no-cors GET -
+ * another site's <img> pointed at a route - carries no Origin either. The
+ * page behind such a request cannot read the answer, but the request still
+ * spends whatever the route counts per address. A POST always carries its
+ * Origin, so a route that takes writes is covered by the rule above. A
+ * route that must know a GET came from its own page also requires a header
+ * only that page's script adds (hasPageScriptHeader): nothing a page can
+ * have a browser send without a script - an <img>, a link, a frame, a
+ * no-cors fetch - can carry one, and another origin's script that adds one
+ * is preflighted, then sends the Origin read above.
+ *
+ * What neither can tell apart is a page the browser takes for this
+ * instance's own. A DNS-rebinding page whose name was pointed at this
+ * server, or a status page on its owner's domain running its owner's
+ * script, sends its GETs with no Origin and may add any header it likes -
+ * so it can read what a GET answers, through a visitor inside an IP
+ * allowlist too. It cannot write: its POST carries its own Origin.
+ */
+
+const SAME_ORIGIN_FETCH_SITES: ReadonlyArray<string> = ["same-origin", "none"];
+
+// The one media type another site cannot have a browser send unpreflighted.
+const JSON_MEDIA_TYPE: string = "application/json";
+
+export interface BrowserRequestHeaders {
+  "sec-fetch-site"?: string | Array<string> | undefined;
+  origin?: string | Array<string> | undefined;
+}
+
+// Every header of a request, by its lower-case name, as Node hands them over.
+export interface RequestHeaders {
+  [name: string]: string | Array<string> | undefined;
+}
+
+type HeaderValueFunction = (
+  value: string | Array<string> | undefined,
+) => string;
+
+/*
+ * A header as one string, "" when it was not sent. A header sent twice is
+ * joined, so it matches no accepted value and is refused: this is an access
+ * decision, and every doubt is a no.
+ */
+const headerValue: HeaderValueFunction = (
+  value: string | Array<string> | undefined,
+): string => {
+  if (value === undefined) {
+    return "";
+  }
+
+  return (Array.isArray(value) ? value.join(",") : value).trim();
+};
+
+type OriginOfFunction = (url: string) => string | null;
+
+/*
+ * The origin an http(s) URL names, written the way a browser writes one in
+ * an Origin header: scheme and host in lower case, an IDN in punycode, the
+ * scheme's default port left out. Null for anything else.
+ */
+const originOf: OriginOfFunction = (url: string): string | null => {
+  try {
+    const parsed: NodeURL = new NodeURL(url);
+
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return null;
+    }
+
+    return parsed.origin;
+  } catch {
+    return null;
+  }
+};
+
+export default class SameOriginRequest {
+  /**
+   * This instance's origin as it is configured (see above). Null when HOST
+   * is not set, or names no host.
+   */
+  public static getInstanceOrigin(): string | null {
+    if (!Host) {
+      return null;
+    }
+
+    return originOf(`${HttpProtocol}${Host}`);
+  }
+
+  /**
+   * True when a browser sent the request from a page that is not this
+   * instance's own (see above). With no configured origin to compare, a
+   * request carrying an Origin is refused: it cannot be shown to be ours.
+   */
+  public static isForeignPageRequest(data: {
+    headers: BrowserRequestHeaders;
+    // getInstanceOrigin(), passed in so the rule can be tested on its own.
+    instanceOrigin: string | null;
+  }): boolean {
+    const fetchSite: string = headerValue(
+      data.headers["sec-fetch-site"],
+    ).toLowerCase();
+
+    if (fetchSite !== "" && !SAME_ORIGIN_FETCH_SITES.includes(fetchSite)) {
+      return true;
+    }
+
+    const origin: string = headerValue(data.headers.origin);
+
+    if (origin === "") {
+      return false;
+    }
+
+    const requestOrigin: string | null =
+      origin === "null" ? null : originOf(origin);
+
+    return (
+      !requestOrigin ||
+      !data.instanceOrigin ||
+      requestOrigin !== data.instanceOrigin
+    );
+  }
+
+  /**
+   * Whether a request carries the header a page's own script adds to its
+   * requests, set to exactly the value that script gives it (see above).
+   * Only a script can add a header, and only a preflighted one when the
+   * script is on another origin, so a request without it did not come from
+   * that page. A header sent twice matches no value, and is refused.
+   */
+  public static hasPageScriptHeader(data: {
+    headers: RequestHeaders;
+    // The header's name, in lower case, as Node keys a request's headers.
+    name: string;
+    value: string;
+  }): boolean {
+    // A header that was not sent reads as "", which no expected value is.
+    if (!data.value) {
+      return false;
+    }
+
+    return headerValue(data.headers[data.name]) === data.value;
+  }
+
+  /**
+   * Whether a request's Content-Type is JSON ("application/json", with or
+   * without parameters such as a charset). Another site's page can have a
+   * browser send a urlencoded, multipart or plain text body without a
+   * preflight; a JSON one it cannot, and the request that follows the
+   * preflight carries the Origin isForeignPageRequest reads.
+   */
+  public static isJsonContentType(
+    value: string | Array<string> | undefined,
+  ): boolean {
+    const mediaType: string = headerValue(value)
+      .split(";")[0]!
+      .trim()
+      .toLowerCase();
+
+    return mediaType === JSON_MEDIA_TYPE;
+  }
+}

package/Server/Utils/TeamMember/ProjectLeaveResourceCleanup.ts

@@ -30,6 +30,7 @@ import IncidentTemplateOwnerUserService from "../../Services/IncidentTemplateOwn
 import IncomingCallPolicyOwnerUserService from "../../Services/IncomingCallPolicyOwnerUserService";
 import IoTFleetOwnerUserService from "../../Services/IoTFleetOwnerUserService";
 import KubernetesClusterOwnerUserService from "../../Services/KubernetesClusterOwnerUserService";
+import MessageQueueOwnerUserService from "../../Services/MessageQueueOwnerUserService";
 import MonitorGroupOwnerUserService from "../../Services/MonitorGroupOwnerUserService";
 import MonitorOwnerUserService from "../../Services/MonitorOwnerUserService";
 import NetworkDeviceOwnerUserService from "../../Services/NetworkDeviceOwnerUserService";
@@ -162,6 +163,7 @@ export default class ProjectLeaveResourceCleanup {
       ),
       ownerUserTable(IoTFleetOwnerUserService, "iotFleetId"),
       ownerUserTable(KubernetesClusterOwnerUserService, "kubernetesClusterId"),
+      ownerUserTable(MessageQueueOwnerUserService, "messageQueueId"),
       ownerUserTable(MonitorGroupOwnerUserService, "monitorGroupId"),
       ownerUserTable(MonitorOwnerUserService, "monitorId"),
       ownerUserTable(NetworkDeviceOwnerUserService, "networkDeviceId"),

package/Server/Utils/Telemetry/EntityRegistry.ts

@@ -42,7 +42,9 @@ import crypto from "crypto";
  * would mint a fresh registry row per instance. `database.server` is
  * membership-only by design: its keys are appended to signals so the
  * Databases product can scope telemetry, and the typed DatabaseServer table
- * (not the registry) is the row a user sees.
+ * (not the registry) is the row a user sees. `message.queue` is the same for
+ * the Queues product and its MessageQueue table — an OTLP entity_ref of the
+ * type still only adds a membership key.
  */
 const MEMBERSHIP_ONLY_TYPES: ReadonlySet<EntityType> = new Set<EntityType>([
   EntityType.Container,
@@ -50,6 +52,7 @@ const MEMBERSHIP_ONLY_TYPES: ReadonlySet<EntityType> = new Set<EntityType>([
   EntityType.ServiceInstance,
   EntityType.TelemetrySdk,
   EntityType.DatabaseServer,
+  EntityType.MessageQueue,
 ]);
 
 /*