@oneuptime/common 14.0.10 → 14.0.12

package/build/dist/Server/Utils/Mcp/McpOAuthSecret.js

@@ -0,0 +1,118 @@
+import crypto from "crypto";
+import McpOAuthTokenType from "../../../Types/Mcp/McpOAuthTokenType";
+/*
+ * The secrets the MCP authorization server issues, and how they are kept.
+ *
+ * SHAPE
+ *
+ * 256 bits from the CSPRNG as base64url (43 characters) behind a short prefix
+ * that says what the secret is:
+ *
+ *   oumcp_ac_…  authorization code
+ *   oumcp_at_…  access token
+ *   oumcp_rt_…  refresh token
+ *   oumcp_cs_…  client secret (confidential registered clients)
+ *
+ * The prefix earns its place twice. The MCP endpoint accepts an API key and
+ * an OAuth access token in the same `Authorization: Bearer` header, and the
+ * prefix is how it tells them apart without a database lookup - an API key is
+ * a UUID and can never start with `oumcp_`. And a secret that says what it is
+ * can be recognised by a scanner when it turns up in a log or a repository.
+ *
+ * STORAGE
+ *
+ * Only the unkeyed SHA-256 hex of the whole secret (prefix included) is ever
+ * stored. See McpOAuthToken for why the hash is unkeyed.
+ */
+// crypto.randomBytes(32) -> 32 bytes -> ceil(32 * 8 / 6) = 43 base64url chars.
+const SECRET_BYTE_LENGTH = 32;
+const SECRET_BODY_PATTERN = "[A-Za-z0-9_-]{43}";
+const SECRET_NAMESPACE = "oumcp_";
+export const MCP_OAUTH_AUTHORIZATION_CODE_PREFIX = `${SECRET_NAMESPACE}ac_`;
+export const MCP_OAUTH_ACCESS_TOKEN_PREFIX = `${SECRET_NAMESPACE}at_`;
+export const MCP_OAUTH_REFRESH_TOKEN_PREFIX = `${SECRET_NAMESPACE}rt_`;
+export const MCP_OAUTH_CLIENT_SECRET_PREFIX = `${SECRET_NAMESPACE}cs_`;
+const PREFIX_BY_TOKEN_TYPE = {
+    [McpOAuthTokenType.AuthorizationCode]: MCP_OAUTH_AUTHORIZATION_CODE_PREFIX,
+    [McpOAuthTokenType.AccessToken]: MCP_OAUTH_ACCESS_TOKEN_PREFIX,
+    [McpOAuthTokenType.RefreshToken]: MCP_OAUTH_REFRESH_TOKEN_PREFIX,
+};
+const buildPattern = (prefix) => {
+    return new RegExp(`^${prefix}${SECRET_BODY_PATTERN}$`);
+};
+const PATTERN_BY_TOKEN_TYPE = {
+    [McpOAuthTokenType.AuthorizationCode]: buildPattern(MCP_OAUTH_AUTHORIZATION_CODE_PREFIX),
+    [McpOAuthTokenType.AccessToken]: buildPattern(MCP_OAUTH_ACCESS_TOKEN_PREFIX),
+    [McpOAuthTokenType.RefreshToken]: buildPattern(MCP_OAUTH_REFRESH_TOKEN_PREFIX),
+};
+const CLIENT_SECRET_PATTERN = buildPattern(MCP_OAUTH_CLIENT_SECRET_PREFIX);
+export default class McpOAuthSecret {
+    static mint(tokenType) {
+        return `${PREFIX_BY_TOKEN_TYPE[tokenType]}${McpOAuthSecret.randomBody()}`;
+    }
+    static mintClientSecret() {
+        return `${MCP_OAUTH_CLIENT_SECRET_PREFIX}${McpOAuthSecret.randomBody()}`;
+    }
+    /*
+     * Unkeyed SHA-256 of the secret, lowercase hex (64 characters): the value
+     * stored and the value looked up by. Deterministic by construction.
+     */
+    static hash(secret) {
+        return crypto.createHash("sha256").update(secret, "utf8").digest("hex");
+    }
+    /*
+     * True when the value has exactly the shape a minted secret of that type
+     * has. The shape guard in front of every lookup: anything else cannot be a
+     * credential this server issued, so it is refused before it costs a query.
+     */
+    static isValidShape(secret, tokenType) {
+        return (typeof secret === "string" &&
+            PATTERN_BY_TOKEN_TYPE[tokenType].test(secret));
+    }
+    static isValidClientSecretShape(secret) {
+        return typeof secret === "string" && CLIENT_SECRET_PATTERN.test(secret);
+    }
+    /*
+     * Whether a bearer value CLAIMS to be an OAuth access token. Looser than
+     * isValidShape on purpose: it decides which kind of credential the caller
+     * is attempting, so a mangled access token is answered as a bad OAuth token
+     * (401 with a challenge, which makes the client refresh) instead of being
+     * passed along as an API key that will never match.
+     */
+    static looksLikeAccessToken(value) {
+        return (typeof value === "string" &&
+            value.startsWith(MCP_OAUTH_ACCESS_TOKEN_PREFIX));
+    }
+    /*
+     * Whether a value is one of this server's own secrets of ANY kind - an
+     * authorization code, a refresh token, a client secret - going by its
+     * namespace alone. The MCP endpoint asks so that such a value, put where a
+     * credential goes, is refused there rather than passed along as an API key:
+     * it is not one, and a long-lived secret has no business being forwarded.
+     */
+    static looksLikeIssuedSecret(value) {
+        return typeof value === "string" && value.startsWith(SECRET_NAMESPACE);
+    }
+    /*
+     * Constant-time comparison of two digests held in memory. A length mismatch
+     * is answered false without comparing content.
+     */
+    static isHashEqual(a, b) {
+        /*
+         * Plain Uint8Arrays rather than Buffers: the App build's @types/node
+         * rejects Buffer where an ArrayBufferView is expected (the mismatch
+         * CalendarFeedToken documents), and TextEncoder is global on every
+         * supported Node.
+         */
+        const bytesA = new TextEncoder().encode(a);
+        const bytesB = new TextEncoder().encode(b);
+        if (bytesA.length !== bytesB.length) {
+            return false;
+        }
+        return crypto.timingSafeEqual(bytesA, bytesB);
+    }
+    static randomBody() {
+        return crypto.randomBytes(SECRET_BYTE_LENGTH).toString("base64url");
+    }
+}
+//# sourceMappingURL=McpOAuthSecret.js.map

package/build/dist/Server/Utils/Mcp/McpOAuthSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpOAuthSecret.js","sourceRoot":"","sources":["../../../../../Server/Utils/Mcp/McpOAuthSecret.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,iBAAiB,MAAM,sCAAsC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,+EAA+E;AAC/E,MAAM,kBAAkB,GAAW,EAAE,CAAC;AACtC,MAAM,mBAAmB,GAAW,mBAAmB,CAAC;AAExD,MAAM,gBAAgB,GAAW,QAAQ,CAAC;AAE1C,MAAM,CAAC,MAAM,mCAAmC,GAAW,GAAG,gBAAgB,KAAK,CAAC;AACpF,MAAM,CAAC,MAAM,6BAA6B,GAAW,GAAG,gBAAgB,KAAK,CAAC;AAC9E,MAAM,CAAC,MAAM,8BAA8B,GAAW,GAAG,gBAAgB,KAAK,CAAC;AAC/E,MAAM,CAAC,MAAM,8BAA8B,GAAW,GAAG,gBAAgB,KAAK,CAAC;AAE/E,MAAM,oBAAoB,GAAsC;IAC9D,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,mCAAmC;IAC1E,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,6BAA6B;IAC9D,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,8BAA8B;CACjE,CAAC;AAEF,MAAM,YAAY,GAA+B,CAAC,MAAc,EAAU,EAAE;IAC1E,OAAO,IAAI,MAAM,CAAC,IAAI,MAAM,GAAG,mBAAmB,GAAG,CAAC,CAAC;AACzD,CAAC,CAAC;AAEF,MAAM,qBAAqB,GAAsC;IAC/D,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,YAAY,CACjD,mCAAmC,CACpC;IACD,CAAC,iBAAiB,CAAC,WAAW,CAAC,EAAE,YAAY,CAAC,6BAA6B,CAAC;IAC5E,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,YAAY,CAC5C,8BAA8B,CAC/B;CACF,CAAC;AAEF,MAAM,qBAAqB,GAAW,YAAY,CAChD,8BAA8B,CAC/B,CAAC;AAEF,MAAM,CAAC,OAAO,OAAO,cAAc;IAC1B,MAAM,CAAC,IAAI,CAAC,SAA4B;QAC7C,OAAO,GAAG,oBAAoB,CAAC,SAAS,CAAC,GAAG,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC;IAC5E,CAAC;IAEM,MAAM,CAAC,gBAAgB;QAC5B,OAAO,GAAG,8BAA8B,GAAG,cAAc,CAAC,UAAU,EAAE,EAAE,CAAC;IAC3E,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,IAAI,CAAC,MAAc;QAC/B,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1E,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,YAAY,CACxB,MAAe,EACf,SAA4B;QAE5B,OAAO,CACL,OAAO,MAAM,KAAK,QAAQ;YAC1B,qBAAqB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAC9C,CAAC;IACJ,CAAC;IAEM,MAAM,CAAC,wBAAwB,CAAC,MAAe;QACpD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC1E,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,oBAAoB,CAAC,KAAc;QAC/C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,CAAC,UAAU,CAAC,6BAA6B,CAAC,CAChD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACI,MAAM,CAAC,qBAAqB,CAAC,KAAc;QAChD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;IACzE,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,WAAW,CAAC,CAAS,EAAE,CAAS;QAC5C;;;;;WAKG;QACH,MAAM,MAAM,GAAe,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACvD,MAAM,MAAM,GAAe,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAEvD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChD,CAAC;IAEO,MAAM,CAAC,UAAU;QACvB,OAAO,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACtE,CAAC;CACF"}

package/build/dist/Server/Utils/Mcp/McpOAuthSignedToken.js

@@ -0,0 +1,126 @@
+import crypto from "crypto";
+import { EncryptionSecret } from "../../EnvironmentConfig";
+const TOKEN_VERSION_PREFIX = "v1";
+// "v1." + base64url payload + "." + base64url HMAC-SHA256 (always 43 chars).
+const TOKEN_PATTERN = /^v1\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]{43}$/;
+/*
+ * How far in the future an issuance time may be: slack for clock disagreement
+ * between the pods behind one hostname. Beyond it the token was not minted by
+ * an honest clock.
+ */
+const MAX_ISSUED_AT_CLOCK_SKEW_IN_MS = 5 * 60 * 1000;
+export default class McpOAuthSignedToken {
+    /*
+     * null when the result would not verify - a payload past the purpose's
+     * length cap. Callers treat that as "this request is too large".
+     */
+    static sign(data) {
+        const now = data.now || new Date();
+        const issuedAtMs = now.getTime();
+        const payload = JSON.stringify({
+            v: 1,
+            c: data.claims,
+            i: issuedAtMs,
+            x: issuedAtMs + data.expiresInSeconds * 1000,
+        });
+        const payloadB64 = Buffer.from(payload, "utf8").toString("base64url");
+        const token = `${TOKEN_VERSION_PREFIX}.${payloadB64}.${McpOAuthSignedToken.signature(data.purpose, payloadB64)}`;
+        /*
+         * Round-tripped through verify() so sign() can never hand out a token
+         * that would then be refused.
+         */
+        return McpOAuthSignedToken.verify({
+            purpose: data.purpose,
+            token,
+            now,
+        })
+            ? token
+            : null;
+    }
+    /*
+     * The claims, or null. NEVER throws: anything that is not a valid, current
+     * token of this purpose is null.
+     */
+    static verify(data) {
+        try {
+            const token = data.token;
+            if (typeof token !== "string") {
+                return null;
+            }
+            if (token.length > data.purpose.maxLength || !TOKEN_PATTERN.test(token)) {
+                return null;
+            }
+            const parts = token.split(".");
+            if (parts.length !== 3) {
+                return null;
+            }
+            const payloadB64 = parts[1] || "";
+            const suppliedSignature = parts[2] || "";
+            const expectedSignature = McpOAuthSignedToken.signature(data.purpose, payloadB64);
+            /*
+             * Uint8Arrays rather than Buffers: see McpOAuthSecret.isHashEqual. The
+             * pattern above pinned the supplied signature to 43 characters, so the
+             * length check only returns early on input that could never match.
+             */
+            const suppliedBytes = new TextEncoder().encode(suppliedSignature);
+            const expectedBytes = new TextEncoder().encode(expectedSignature);
+            if (suppliedBytes.length !== expectedBytes.length ||
+                !crypto.timingSafeEqual(suppliedBytes, expectedBytes)) {
+                return null;
+            }
+            const envelope = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+            if (!envelope ||
+                typeof envelope !== "object" ||
+                Array.isArray(envelope)) {
+                return null;
+            }
+            const version = envelope["v"];
+            const claims = envelope["c"];
+            const issuedAtMs = envelope["i"];
+            const expiresAtMs = envelope["x"];
+            if (version !== 1) {
+                return null;
+            }
+            if (!claims || typeof claims !== "object" || Array.isArray(claims)) {
+                return null;
+            }
+            if (typeof issuedAtMs !== "number" ||
+                typeof expiresAtMs !== "number" ||
+                !Number.isSafeInteger(issuedAtMs) ||
+                !Number.isSafeInteger(expiresAtMs)) {
+                return null;
+            }
+            const nowMs = (data.now || new Date()).getTime();
+            if (!(issuedAtMs <= nowMs + MAX_ISSUED_AT_CLOCK_SKEW_IN_MS)) {
+                return null;
+            }
+            if (!(nowMs < expiresAtMs)) {
+                return null;
+            }
+            return claims;
+        }
+        catch (_a) {
+            /*
+             * Every failure above is already a null; this makes "never throws" true
+             * of anything not anticipated, because callers treat a throw (a server
+             * fault) and a forgery (a refusal) very differently.
+             */
+            return null;
+        }
+    }
+    /*
+     * The key is derived per call rather than cached, so a process that has its
+     * secret swapped under it (tests, above all) never signs with a stale one.
+     */
+    static signature(purpose, payloadB64) {
+        const key = crypto
+            .createHmac("sha256", EncryptionSecret.toString())
+            .update(purpose.keyDerivationLabel)
+            .digest();
+        return crypto
+            .createHmac("sha256", key)
+            .update(`${TOKEN_VERSION_PREFIX}.${payloadB64}`)
+            .digest("base64url");
+    }
+}
+//# sourceMappingURL=McpOAuthSignedToken.js.map

package/build/dist/Server/Utils/Mcp/McpOAuthSignedToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpOAuthSignedToken.js","sourceRoot":"","sources":["../../../../../Server/Utils/Mcp/McpOAuthSignedToken.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AA2C3D,MAAM,oBAAoB,GAAW,IAAI,CAAC;AAE1C,6EAA6E;AAC7E,MAAM,aAAa,GAAW,yCAAyC,CAAC;AAExE;;;;GAIG;AACH,MAAM,8BAA8B,GAAW,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAE7D,MAAM,CAAC,OAAO,OAAO,mBAAmB;IACtC;;;OAGG;IACI,MAAM,CAAC,IAAI,CAAC,IAKlB;QACC,MAAM,GAAG,GAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACzC,MAAM,UAAU,GAAW,GAAG,CAAC,OAAO,EAAE,CAAC;QAEzC,MAAM,OAAO,GAAW,IAAI,CAAC,SAAS,CAAC;YACrC,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,MAAM;YACd,CAAC,EAAE,UAAU;YACb,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC,gBAAgB,GAAG,IAAI;SAC7C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAC9D,WAAW,CACZ,CAAC;QAEF,MAAM,KAAK,GAAW,GAAG,oBAAoB,IAAI,UAAU,IAAI,mBAAmB,CAAC,SAAS,CAC1F,IAAI,CAAC,OAAO,EACZ,UAAU,CACX,EAAE,CAAC;QAEJ;;;WAGG;QACH,OAAO,mBAAmB,CAAC,MAAM,CAAC;YAChC,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK;YACL,GAAG;SACJ,CAAC;YACA,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED;;;OAGG;IACI,MAAM,CAAC,MAAM,CAAC,IAIpB;QACC,IAAI,CAAC;YACH,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC;YAElC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACxE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAkB,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAE9C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,UAAU,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC1C,MAAM,iBAAiB,GAAW,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACjD,MAAM,iBAAiB,GAAW,mBAAmB,CAAC,SAAS,CAC7D,IAAI,CAAC,OAAO,EACZ,UAAU,CACX,CAAC;YAEF;;;;eAIG;YACH,MAAM,aAAa,GAAe,IAAI,WAAW,EAAE,CAAC,MAAM,CACxD,iBAAiB,CAClB,CAAC;YACF,MAAM,aAAa,GAAe,IAAI,WAAW,EAAE,CAAC,MAAM,CACxD,iBAAiB,CAClB,CAAC;YAEF,IACE,aAAa,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM;gBAC7C,CAAC,MAAM,CAAC,eAAe,CAAC,aAAa,EAAE,aAAa,CAAC,EACrD,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,QAAQ,GAAY,IAAI,CAAC,KAAK,CAClC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACtD,CAAC;YAEF,IACE,CAAC,QAAQ;gBACT,OAAO,QAAQ,KAAK,QAAQ;gBAC5B,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EACvB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,OAAO,GAAa,QAAoC,CAAC,GAAG,CAAC,CAAC;YACpE,MAAM,MAAM,GAAa,QAAoC,CAAC,GAAG,CAAC,CAAC;YACnE,MAAM,UAAU,GAAa,QAAoC,CAAC,GAAG,CAAC,CAAC;YACvE,MAAM,WAAW,GAAa,QAAoC,CAAC,GAAG,CAAC,CAAC;YAExE,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAClB,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACnE,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IACE,OAAO,UAAU,KAAK,QAAQ;gBAC9B,OAAO,WAAW,KAAK,QAAQ;gBAC/B,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC;gBACjC,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,EAClC,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,KAAK,GAAW,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;YAEzD,IAAI,CAAC,CAAC,UAAU,IAAI,KAAK,GAAG,8BAA8B,CAAC,EAAE,CAAC;gBAC5D,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YAED,OAAO,MAAoB,CAAC;QAC9B,CAAC;QAAC,WAAM,CAAC;YACP;;;;eAIG;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,SAAS,CACtB,OAAmC,EACnC,UAAkB;QAElB,MAAM,GAAG,GAAW,MAAM;aACvB,UAAU,CAAC,QAAQ,EAAE,gBAAgB,CAAC,QAAQ,EAAE,CAAC;aACjD,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC;aAClC,MAAM,EAAE,CAAC;QAEZ,OAAO,MAAM;aACV,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;aACzB,MAAM,CAAC,GAAG,oBAAoB,IAAI,UAAU,EAAE,CAAC;aAC/C,MAAM,CAAC,WAAW,CAAC,CAAC;IACzB,CAAC;CACF"}

package/build/dist/Server/Utils/Mcp/McpOAuthSso.js

@@ -0,0 +1,159 @@
+import UserMiddleware from "../../Middleware/UserAuthorization";
+import GlobalConfigService from "../../Services/GlobalConfigService";
+import ProjectService from "../../Services/ProjectService";
+import CookieUtil from "../Cookie";
+import JSONWebToken from "../JsonWebToken";
+import OneUptimeDate from "../../../Types/Date";
+import ObjectID from "../../../Types/ObjectID";
+import SsoProviderType from "../../../Types/SSO/SsoProviderType";
+const GLOBAL_SSO_TOKEN_HEADER = "x-global-sso-token";
+export default class McpOAuthSso {
+    /*
+     * Whether this project needs SSO from this member right now.
+     *
+     * The same reading UserMiddleware.getUserTenantAccessPermissionWithTenantId
+     * makes: the project's own switch, else the instance-wide one - from which
+     * master admins are exempt, so a misconfigured instance SSO cannot lock
+     * them out. A project that does not exist throws, as it does there.
+     */
+    static async getRequirement(data) {
+        let isRequired = await ProjectService.getRequireSsoForLogin(data.projectId);
+        if (!isRequired && !data.isMasterAdmin) {
+            isRequired = await GlobalConfigService.getRequireSsoForLogin().catch(() => {
+                return false;
+            });
+        }
+        if (!isRequired) {
+            return { isRequired: false, requiredSsoProviderId: null };
+        }
+        const requiredSsoProviderId = await ProjectService.getRequireSsoWithSsoProviderId(data.projectId).catch(() => {
+            return null;
+        });
+        return { isRequired: true, requiredSsoProviderId };
+    }
+    /*
+     * What this browser request can show for SSO in this project, or null if it
+     * does not satisfy the requirement.
+     *
+     * Asked in the same order as UserMiddleware.isSsoSatisfiedForProject: the
+     * project's own token first, then the instance's Global one (which also has
+     * to pass the provider-trust and project-governance checks).
+     */
+    static async captureEvidence(data) {
+        var _a;
+        const requiredSsoProviderId = (_a = data.requiredSsoProviderId) !== null && _a !== void 0 ? _a : undefined;
+        if (UserMiddleware.doesProjectScopedSsoTokenExist(data.req, data.projectId, data.userId, requiredSsoProviderId)) {
+            const rawToken = UserMiddleware.getSsoTokens(data.req)[data.projectId.toString()];
+            /*
+             * A per-project token minted before provider discriminators existed
+             * carries neither field. It is recorded as a project SSO sign-in with
+             * no provider id, which satisfies "any provider" and nothing stricter -
+             * the reading UserMiddleware gives the token itself.
+             */
+            return McpOAuthSso.toEvidence(rawToken, SsoProviderType.ProjectSSO);
+        }
+        const globalSsoTokenData = UserMiddleware.getStatelessValidGlobalSsoTokenData(data.req, data.userId, requiredSsoProviderId);
+        if (!globalSsoTokenData) {
+            return null;
+        }
+        if (!(await UserMiddleware.isGlobalSsoTokenAuthorizedForProject({
+            globalSsoTokenData,
+            projectId: data.projectId,
+        }))) {
+            return null;
+        }
+        return McpOAuthSso.toEvidence(McpOAuthSso.getRawGlobalSsoToken(data.req), undefined);
+    }
+    /*
+     * Whether a grant's stored evidence still satisfies the project's SSO
+     * requirement. No evidence never does.
+     *
+     * THROWS when a Global provider's standing cannot be looked up, for the
+     * reason isGlobalSsoTokenAuthorizedForProject does: "this provider is not
+     * allowed here" and "we could not find out" are different answers, and a
+     * database blip must not read as a permission decision.
+     */
+    static async isEvidenceSatisfied(data) {
+        var _a;
+        const evidence = data.evidence;
+        if (!evidence) {
+            return false;
+        }
+        const now = data.now || OneUptimeDate.getCurrentDate();
+        if (new Date(evidence.expiresAt).getTime() <= now.getTime()) {
+            return false;
+        }
+        if (data.requiredSsoProviderId) {
+            if (!evidence.ssoProviderId ||
+                evidence.ssoProviderId.toString() !==
+                    data.requiredSsoProviderId.toString()) {
+                return false;
+            }
+        }
+        const isGlobalProvider = evidence.ssoProviderType === SsoProviderType.GlobalSSO ||
+            evidence.ssoProviderType === SsoProviderType.GlobalOIDC;
+        if (!isGlobalProvider) {
+            // A project's own provider is decided statelessly, as its token is.
+            return true;
+        }
+        /*
+         * A Global sign-in is only as good as its provider is today: still
+         * present, still enabled, and - if the instance restricts it - still
+         * governing this project. The check reads only the two provider fields.
+         */
+        return await UserMiddleware.isGlobalSsoTokenAuthorizedForProject({
+            globalSsoTokenData: {
+                ssoProviderType: evidence.ssoProviderType,
+                ssoProviderId: (_a = evidence.ssoProviderId) !== null && _a !== void 0 ? _a : undefined,
+            },
+            projectId: data.projectId,
+        });
+    }
+    /*
+     * The provider fields and the expiry of a raw SSO token. null if the token
+     * is missing, no longer verifies, or carries no expiry - evidence that
+     * cannot say when it lapses is no evidence.
+     */
+    static toEvidence(rawToken, providerTypeIfAbsent) {
+        if (!rawToken) {
+            return null;
+        }
+        let payload;
+        try {
+            payload = JSONWebToken.decodeJsonPayload(rawToken);
+        }
+        catch (_a) {
+            return null;
+        }
+        const expiresAtSeconds = payload["exp"];
+        if (typeof expiresAtSeconds !== "number" || !isFinite(expiresAtSeconds)) {
+            return null;
+        }
+        const ssoProviderType = payload["ssoProviderType"] ||
+            providerTypeIfAbsent;
+        if (!ssoProviderType ||
+            !Object.values(SsoProviderType).includes(ssoProviderType)) {
+            return null;
+        }
+        const ssoProviderId = payload["ssoProviderId"];
+        return {
+            ssoProviderType,
+            ssoProviderId: typeof ssoProviderId === "string" && ObjectID.isValidUUID(ssoProviderId)
+                ? new ObjectID(ssoProviderId)
+                : null,
+            expiresAt: new Date(expiresAtSeconds * 1000),
+        };
+    }
+    // The cookie (web) or header (mobile) UserMiddleware reads the token from.
+    static getRawGlobalSsoToken(req) {
+        const cookieToken = CookieUtil.getCookieFromExpressRequest(req, CookieUtil.getGlobalSSOKey());
+        if (cookieToken) {
+            return cookieToken;
+        }
+        const headerToken = req.headers[GLOBAL_SSO_TOKEN_HEADER];
+        return typeof headerToken === "string" && headerToken
+            ? headerToken
+            : undefined;
+    }
+}
+//# sourceMappingURL=McpOAuthSso.js.map

package/build/dist/Server/Utils/Mcp/McpOAuthSso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"McpOAuthSso.js","sourceRoot":"","sources":["../../../../../Server/Utils/Mcp/McpOAuthSso.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,MAAM,oCAAoC,CAAC;AAChE,OAAO,mBAAmB,MAAM,oCAAoC,CAAC;AAErE,OAAO,cAAc,MAAM,+BAA+B,CAAC;AAC3D,OAAO,UAAU,MAAM,WAAW,CAAC;AAEnC,OAAO,YAAY,MAAM,iBAAiB,CAAC;AAC3C,OAAO,aAAa,MAAM,qBAAqB,CAAC;AAGhD,OAAO,QAAQ,MAAM,yBAAyB,CAAC;AAC/C,OAAO,eAAe,MAAM,oCAAoC,CAAC;AAgCjE,MAAM,uBAAuB,GAAW,oBAAoB,CAAC;AAE7D,MAAM,CAAC,OAAO,OAAO,WAAW;IAC9B;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAGlC;QACC,IAAI,UAAU,GAAY,MAAM,cAAc,CAAC,qBAAqB,CAClE,IAAI,CAAC,SAAS,CACf,CAAC;QAEF,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACvC,UAAU,GAAG,MAAM,mBAAmB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAClE,GAAG,EAAE;gBACH,OAAO,KAAK,CAAC;YACf,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC;QAC5D,CAAC;QAED,MAAM,qBAAqB,GACzB,MAAM,cAAc,CAAC,8BAA8B,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CACvE,GAAG,EAAE;YACH,OAAO,IAAI,CAAC;QACd,CAAC,CACF,CAAC;QAEJ,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC;IACrD,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAKnC;;QACC,MAAM,qBAAqB,GACzB,MAAA,IAAI,CAAC,qBAAqB,mCAAI,SAAS,CAAC;QAE1C,IACE,cAAc,CAAC,8BAA8B,CAC3C,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,MAAM,EACX,qBAAqB,CACtB,EACD,CAAC;YACD,MAAM,QAAQ,GAAuB,cAAc,CAAC,YAAY,CAC9D,IAAI,CAAC,GAAG,CACT,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YAE7B;;;;;eAKG;YACH,OAAO,WAAW,CAAC,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;QACtE,CAAC;QAED,MAAM,kBAAkB,GACtB,cAAc,CAAC,mCAAmC,CAChD,IAAI,CAAC,GAAG,EACR,IAAI,CAAC,MAAM,EACX,qBAAqB,CACtB,CAAC;QAEJ,IAAI,CAAC,kBAAkB,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IACE,CAAC,CAAC,MAAM,cAAc,CAAC,oCAAoC,CAAC;YAC1D,kBAAkB;YAClB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC,EACH,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,WAAW,CAAC,UAAU,CAC3B,WAAW,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,EAC1C,SAAS,CACV,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,IAKvC;;QACC,MAAM,QAAQ,GAAoC,IAAI,CAAC,QAAQ,CAAC;QAEhE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,GAAG,GAAS,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,cAAc,EAAE,CAAC;QAE7D,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,IACE,CAAC,QAAQ,CAAC,aAAa;gBACvB,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE;oBAC/B,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,EACvC,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,MAAM,gBAAgB,GACpB,QAAQ,CAAC,eAAe,KAAK,eAAe,CAAC,SAAS;YACtD,QAAQ,CAAC,eAAe,KAAK,eAAe,CAAC,UAAU,CAAC;QAE1D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,oEAAoE;YACpE,OAAO,IAAI,CAAC;QACd,CAAC;QAED;;;;WAIG;QACH,OAAO,MAAM,cAAc,CAAC,oCAAoC,CAAC;YAC/D,kBAAkB,EAAE;gBAClB,eAAe,EAAE,QAAQ,CAAC,eAAe;gBACzC,aAAa,EAAE,MAAA,QAAQ,CAAC,aAAa,mCAAI,SAAS;aACpB;YAChC,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACK,MAAM,CAAC,UAAU,CACvB,QAA4B,EAC5B,oBAAiD;QAEjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,OAAmB,CAAC;QAExB,IAAI,CAAC;YACH,OAAO,GAAG,YAAY,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAY,OAAO,CAAC,KAAK,CAAC,CAAC;QAEjD,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,eAAe,GAClB,OAAO,CAAC,iBAAiB,CAAiC;YAC3D,oBAAoB,CAAC;QAEvB,IACE,CAAC,eAAe;YAChB,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAY,OAAO,CAAC,eAAe,CAAC,CAAC;QAExD,OAAO;YACL,eAAe;YACf,aAAa,EACX,OAAO,aAAa,KAAK,QAAQ,IAAI,QAAQ,CAAC,WAAW,CAAC,aAAa,CAAC;gBACtE,CAAC,CAAC,IAAI,QAAQ,CAAC,aAAa,CAAC;gBAC7B,CAAC,CAAC,IAAI;YACV,SAAS,EAAE,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;SAC7C,CAAC;IACJ,CAAC;IAED,2EAA2E;IACnE,MAAM,CAAC,oBAAoB,CAAC,GAAmB;QACrD,MAAM,WAAW,GACf,UAAU,CAAC,2BAA2B,CAAC,GAAG,EAAE,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC;QAE5E,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,WAAW,GAAY,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAElE,OAAO,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW;YACnD,CAAC,CAAC,WAAW;YACb,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;CACF"}

package/build/dist/Server/Utils/Monitor/MonitorPayloadRedaction.js

@@ -289,10 +289,35 @@ export const redactMonitorEmailAddress = (payload, address) => {
         return replaceAddressLocalPart(text, needle, localPart.length);
     }, 0);
 };
+const UUID_TEXT = "[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}";
+/*
+ * Value boundary for the OTHER generated addresses on the inbound email
+ * domain: `monitor-{key}@` (Incoming Email monitors) and `workflow-{key}@`
+ * (a workflow's Incoming Email trigger).
+ *
+ * One email can be sent to several of them at once - a monitor in To and a
+ * workflow in Cc - and each receiver keeps a copy of the whole email. The
+ * value boundaries above mask the receiver's OWN address only, so without
+ * this a monitor's stored email would carry a workflow's address, and a
+ * workflow's run would carry a monitor's, to people who may read the one but
+ * not the other. Generated keys have a fixed shape - a prefix and a whole
+ * UUID - so they are found by it, whoever they belong to; the prefix and the
+ * domain are kept, as with the receiver's own key.
+ */
+export const redactGeneratedInboundAddressKeys = (payload, prefixes) => {
+    if (payload === null || payload === undefined || prefixes.length === 0) {
+        return payload;
+    }
+    const pattern = new RegExp(`\\b(${prefixes.join("|")})-${UUID_TEXT}\\b`, "gi");
+    return sweep(payload, (text) => {
+        return text.replace(pattern, `$1-${REDACTED}`);
+    }, 0);
+};
 export default {
     stripAgentCredentials,
     redactForPersistence,
     redactMonitorSecret,
     redactMonitorEmailAddress,
+    redactGeneratedInboundAddressKeys,
 };
 //# sourceMappingURL=MonitorPayloadRedaction.js.map

package/build/dist/Server/Utils/Monitor/MonitorPayloadRedaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"MonitorPayloadRedaction.js","sourceRoot":"","sources":["../../../../../Server/Utils/Monitor/MonitorPayloadRedaction.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,6EAA6E;AAC7E,MAAM,SAAS,GAAW,EAAE,CAAC;AAQ7B;;;;;;;;;GASG;AACH,MAAM,IAAI,GAAiB,CACzB,KAAgB,EAChB,IAAa,EACb,KAAa,EACF,EAAE;IACb;;;;OAIG;IACH,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE;YACnC,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAe,KAAmB,CAAC;IAC/C,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAc,MAAM,CAAC,GAAG,CAAc,CAAC;QAElD,IAAI,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAIF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAkC,CAClE,OAAU,EACP,EAAE;IACL,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC,OAAoB,EAAE,IAAI,EAAE,CAAC,CAAM,CAAC;AAClD,CAAC,CAAC;AAIF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC,CAChE,OAAkB,EACP,EAAE;IACb,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC;AAOF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;GAKG;AACH,MAAM,2BAA2B,GAAW,CAAC,CAAC;AAO9C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAkC,CAC3D,QAAgB,EAChB,MAAc,EACN,EAAE;IACV,MAAM,aAAa,GAAW,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,WAAW,GAAW,MAAM,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,MAAM,GAAW,EAAE,CAAC;IACxB,IAAI,MAAM,GAAW,CAAC,CAAC;IACvB,IAAI,KAAK,GAAW,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC;QACnD,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QACpC,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC,CAAC;AAcF,MAAM,KAAK,GAAkB,CAC3B,KAAgB,EAChB,UAA8B,EAC9B,KAAa,EACF,EAAE;IACb,6EAA6E;IAC7E,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE;YACnC,OAAO,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAe,KAAmB,CAAC;IAC/C,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B;;;;OAIG;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAC7B,MAAM,CAAC,GAAG,CAAc,EACxB,UAAU,EACV,KAAK,GAAG,CAAC,CACV,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,CAC9D,OAAU,EACV,MAAiC,EAC9B,EAAE;IACL,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,MAAM,GAAG,2BAA2B,EAC3C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CACV,OAAoB,EACpB,CAAC,IAAY,EAAU,EAAE;QACvB,OAAO,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC,EACD,CAAC,CACG,CAAC;AACT,CAAC,CAAC;AAUF,gFAAgF;AAChF,MAAM,oBAAoB,GAAW,+BAA+B,CAAC;AAQrE;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAoC,CAC/D,QAAgB,EAChB,MAAc,EACd,eAAuB,EACf,EAAE;IACV,MAAM,aAAa,GAAW,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,WAAW,GAAW,MAAM,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,MAAM,GAAW,EAAE,CAAC;IACxB,IAAI,MAAM,GAAW,CAAC,CAAC;IACvB,IAAI,KAAK,GAAW,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvD,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,QAAQ,GACZ,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAErD,MAAM,cAAc,GAClB,QAAQ,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjE,oEAAoE;QACpE,IAAI,cAAc,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC;YACnD,MAAM,GAAG,KAAK,GAAG,eAAe,CAAC;QACnC,CAAC;QAED,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsC,CAC1E,OAAU,EACV,OAGC,EACE,EAAE;IACL,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAW,OAAO,CAAC,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAW,OAAO,CAAC,MAAM;QACnC,CAAC,CAAC,GAAG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC;IAEpB,OAAO,KAAK,CACV,OAAoB,EACpB,CAAC,IAAY,EAAU,EAAE;QACvB,OAAO,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC,EACD,CAAC,CACG,CAAC;AACT,CAAC,CAAC;AAEF,eAAe;IACb,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;CAC1B,CAAC"}
+{"version":3,"file":"MonitorPayloadRedaction.js","sourceRoot":"","sources":["../../../../../Server/Utils/Monitor/MonitorPayloadRedaction.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,6EAA6E;AAC7E,MAAM,SAAS,GAAW,EAAE,CAAC;AAQ7B;;;;;;;;;GASG;AACH,MAAM,IAAI,GAAiB,CACzB,KAAgB,EAChB,IAAa,EACb,KAAa,EACF,EAAE;IACb;;;;OAIG;IACH,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE;YACnC,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAe,KAAmB,CAAC;IAC/C,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAc,MAAM,CAAC,GAAG,CAAc,CAAC;QAElD,IAAI,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAIF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAkC,CAClE,OAAU,EACP,EAAE;IACL,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC,OAAoB,EAAE,IAAI,EAAE,CAAC,CAAM,CAAC;AAClD,CAAC,CAAC;AAIF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC,CAChE,OAAkB,EACP,EAAE;IACb,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC;AAOF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;GAKG;AACH,MAAM,2BAA2B,GAAW,CAAC,CAAC;AAO9C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAkC,CAC3D,QAAgB,EAChB,MAAc,EACN,EAAE;IACV,MAAM,aAAa,GAAW,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,WAAW,GAAW,MAAM,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,MAAM,GAAW,EAAE,CAAC;IACxB,IAAI,MAAM,GAAW,CAAC,CAAC;IACvB,IAAI,KAAK,GAAW,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC;QACnD,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QACpC,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC,CAAC;AAcF,MAAM,KAAK,GAAkB,CAC3B,KAAgB,EAChB,UAA8B,EAC9B,KAAa,EACF,EAAE;IACb,6EAA6E;IAC7E,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE;YACnC,OAAO,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAe,KAAmB,CAAC;IAC/C,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B;;;;OAIG;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAC7B,MAAM,CAAC,GAAG,CAAc,EACxB,UAAU,EACV,KAAK,GAAG,CAAC,CACV,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,CAC9D,OAAU,EACV,MAAiC,EAC9B,EAAE;IACL,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,MAAM,GAAG,2BAA2B,EAC3C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CACV,OAAoB,EACpB,CAAC,IAAY,EAAU,EAAE;QACvB,OAAO,qBAAqB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,CAAC,EACD,CAAC,CACG,CAAC;AACT,CAAC,CAAC;AAUF,gFAAgF;AAChF,MAAM,oBAAoB,GAAW,+BAA+B,CAAC;AAQrE;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAoC,CAC/D,QAAgB,EAChB,MAAc,EACd,eAAuB,EACf,EAAE;IACV,MAAM,aAAa,GAAW,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,WAAW,GAAW,MAAM,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,MAAM,GAAW,EAAE,CAAC;IACxB,IAAI,MAAM,GAAW,CAAC,CAAC;IACvB,IAAI,KAAK,GAAW,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvD,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,QAAQ,GACZ,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAErD,MAAM,cAAc,GAClB,QAAQ,KAAK,SAAS,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEjE,oEAAoE;QACpE,IAAI,cAAc,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YACtC,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC;YACnD,MAAM,GAAG,KAAK,GAAG,eAAe,CAAC;QACnC,CAAC;QAED,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsC,CAC1E,OAAU,EACV,OAGC,EACE,EAAE;IACL,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAW,OAAO,CAAC,SAAS,CAAC;IAC5C,MAAM,MAAM,GAAW,OAAO,CAAC,MAAM;QACnC,CAAC,CAAC,GAAG,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE;QAClC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC;IAEpB,OAAO,KAAK,CACV,OAAoB,EACpB,CAAC,IAAY,EAAU,EAAE;QACvB,OAAO,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjE,CAAC,EACD,CAAC,CACG,CAAC;AACT,CAAC,CAAC;AAOF,MAAM,SAAS,GACb,8DAA8D,CAAC;AAEjE;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAC5C,CAAI,OAAU,EAAE,QAA+B,EAAK,EAAE;IACpD,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvE,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,OAAO,GAAW,IAAI,MAAM,CAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,KAAK,EAC5C,IAAI,CACL,CAAC;IAEF,OAAO,KAAK,CACV,OAAoB,EACpB,CAAC,IAAY,EAAU,EAAE;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,QAAQ,EAAE,CAAC,CAAC;IACjD,CAAC,EACD,CAAC,CACG,CAAC;AACT,CAAC,CAAC;AAEJ,eAAe;IACb,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,iCAAiC;CAClC,CAAC"}

package/build/dist/Server/Utils/Monitor/MonitorResource.js

@@ -20,6 +20,7 @@ import BadDataException from "../../../Types/Exception/BadDataException";
 import Semaphore from "../../Infrastructure/Semaphore";
 import MonitorType, { MonitorTypeHelper, } from "../../../Types/Monitor/MonitorType";
 import ObjectID from "../../../Types/ObjectID";
+import { MONITOR_PAUSE_FLAGS_SELECT } from "../../../Utils/Monitor/MonitorPauseState";
 import MonitorStatusTimeline from "../../../Models/DatabaseModels/MonitorStatusTimeline";
 import OneUptimeDate from "../../../Types/Date";
 import TelemetryType from "../../../Types/Telemetry/TelemetryType";
@@ -82,24 +83,14 @@ export default class MonitorResourceUtil {
         // fetch monitor
         const monitor = await MonitorService.findOneById({
             id: dataToProcess.monitorId,
-            select: {
-                monitorSteps: true,
-                monitorType: true,
-                projectId: true,
-                disableActiveMonitoring: true,
-                disableActiveMonitoringBecauseOfManualIncident: true,
-                disableActiveMonitoringBecauseOfScheduledMaintenanceEvent: true,
-                currentMonitorStatusId: true,
-                _id: true,
-                name: true,
-                minimumProbeAgreement: true,
+            select: Object.assign(Object.assign({ monitorSteps: true, monitorType: true, projectId: true }, MONITOR_PAUSE_FLAGS_SELECT), { currentMonitorStatusId: true, _id: true, name: true, minimumProbeAgreement: true, 
                 /*
                  * How often this monitor is checked. Over-time criteria filters need
                  * it to work out how many samples a fully covered evaluation window
                  * should hold - without it a monitor that has only just started
                  * looks the same as one whose whole window is breaching.
                  */
-                monitoringInterval: true,
+                monitoringInterval: true, 
                 /*
                  * Recorded as oneuptime.label.* / oneuptime.customField.* attributes on
                  * every monitor metric this result produces, so response time and
@@ -110,8 +101,7 @@ export default class MonitorResourceUtil {
                 labels: {
                     _id: true,
                     name: true,
-                },
-                customFields: true,
+                }, customFields: true, 
                 /*
                  * Alert-dependency suppression inputs. Selected here for the same
                  * reason as labels: this query already loads the monitor on the
@@ -123,11 +113,9 @@ export default class MonitorResourceUtil {
                  */
                 dependsOnMonitors: {
                     _id: true,
-                },
-                suppressAlertsWhenParentMonitorStatuses: {
+                }, suppressAlertsWhenParentMonitorStatuses: {
                     _id: true,
-                },
-            },
+                } }),
             props: {
                 isRoot: true,
             },
@@ -143,6 +131,16 @@ export default class MonitorResourceUtil {
             throw new BadDataException("Monitor does not have a projectId");
         }
         dataToProcess.projectId = monitor.projectId;
+        /*
+         * Archived first: an archived monitor is out of service whatever its
+         * other flags say, and a result that still reaches it (a probe that
+         * claimed it just before it was archived, an incoming request, an email)
+         * must open nothing and change nothing.
+         */
+        if (monitor.isArchived) {
+            logger.debug(`${dataToProcess.monitorId.toString()} Monitor is archived. Unarchive it to start monitoring again.`);
+            throw new BadDataException(ExceptionMessages.MonitorArchived);
+        }
         if (monitor.disableActiveMonitoring) {
             logger.debug(`${dataToProcess.monitorId.toString()} Monitor is disabled. Please enable it to start monitoring again.`);
             throw new BadDataException(ExceptionMessages.MonitorDisabled);