@oneuptime/common 14.0.11 → 14.0.12

package/Server/Services/DatabaseServerService.ts

@@ -58,8 +58,10 @@ import {
   ManualDatabaseEndpoint,
   buildDatabaseServerDisplayName,
   buildDatabaseServerIdentifier,
+  EPHEMERAL_PORT_RANGE_START,
   formatDatabaseEndpoint,
   getDatabaseEndpointScope,
+  isClientSocketDatabaseEndpoint,
   isKubernetesServiceDnsHost,
   parseDatabaseEndpointString,
   parseManualDatabaseEndpoint,
@@ -119,6 +121,14 @@ const MIN_AUTO_ARCHIVE_DAYS: number = 1;
 // Rows archived per sweep; the rest wait for the next five-minute run.
 const AUTO_ARCHIVE_BATCH_SIZE: number = 500;
 
+/*
+ * The client-socket sweep (deleteClientSocketDatabaseServers): rows deleted
+ * per run, and how far it pages through candidates looking for them.
+ */
+const CLIENT_SOCKET_DELETE_BATCH_SIZE: number = 500;
+const CLIENT_SOCKET_SWEEP_PAGE_SIZE: number = 500;
+const CLIENT_SOCKET_SWEEP_MAX_PAGES: number = 20;
+
 /*
  * A person's Restore holds the sweep off this long (or the archive window,
  * if that is longer) unless discovery sees the database again first.
@@ -1337,6 +1347,135 @@ export class Service extends DatabaseService<Model> {
     return rows.length;
   }
 
+  /**
+   * Delete the databases application traces created for the CLIENT end of
+   * a connection (isClientSocketDatabaseEndpoint): eBPF instrumentation
+   * swapped the connection's two ends, and before the create policy refused
+   * such endpoints, every connection became a database named after its
+   * ephemeral port. They were never databases. They fill the list, use up
+   * the project's auto-create budget, and stay "seen" for as long as their
+   * connection lives.
+   *
+   * Deleted, not archived. An archived row keeps its endpoints, so the next
+   * swapped span to name one would restore it. A deleted row frees them, and
+   * the create policy no longer makes anything of them.
+   *
+   * Only rows that nothing but that mistake explains are deleted. Each one
+   * was created by application traces (never a workload's row) and still
+   * has the name discovery gave it, with no description. A person never
+   * archived or restored it, and nobody invested in it
+   * (UNTOUCHED_DATABASE_SERVER_PREDICATE). Every endpoint it has, its own
+   * address and port included, is a client socket of its engine
+   * (isClientSocketDatabaseServerRow). A real database on an ephemeral port
+   * that someone looked after stays. Pages through candidates by id, so the
+   * rows SQL cannot rule out (a renamed one, Db2 on its default 50000) never
+   * hide the rest. Bounded per run. Returns how many rows were deleted.
+   */
+  @CaptureSpan()
+  public async deleteClientSocketDatabaseServers(): Promise<number> {
+    let deleted: number = 0;
+    let afterId: string | null = null;
+
+    for (let page: number = 0; page < CLIENT_SOCKET_SWEEP_MAX_PAGES; page++) {
+      const candidates: unknown = await this.getRepository().manager.query(
+        `SELECT ds."_id" AS "_id", ds."projectId" AS "projectId", ds."name" AS "name",
+            ds."dbSystem" AS "dbSystem", ds."serverAddress" AS "serverAddress",
+            ds."serverPort" AS "serverPort",
+            ARRAY(
+              SELECT e."endpoint"::text FROM "DatabaseServerEndpoint" e
+              WHERE e."databaseServerId" = ds."_id"
+                AND e."projectId" = ds."projectId"
+                AND e."deletedAt" IS NULL
+            ) AS "endpoints"
+          FROM "DatabaseServer" ds
+          WHERE ds."deletedAt" IS NULL
+            AND ds."discoverySource" = $1
+            AND ds."workloadIdentifier" IS NULL
+            AND ds."serverPort" >= $2
+            AND ds."manuallyRestoredAt" IS NULL
+            AND (ds."isArchived" = false OR ds."autoArchivedAt" IS NOT NULL)
+            AND COALESCE(BTRIM(ds."description"), '') = ''
+            AND ($4::uuid IS NULL OR ds."_id" > $4::uuid)
+            AND ${UNTOUCHED_DATABASE_SERVER_PREDICATE}
+          ORDER BY ds."_id" ASC
+          LIMIT $3`,
+        [
+          DatabaseServerDiscoverySource.ClientSpans,
+          EPHEMERAL_PORT_RANGE_START,
+          CLIENT_SOCKET_SWEEP_PAGE_SIZE,
+          afterId,
+        ],
+      );
+
+      const rows: Array<ClientSocketDatabaseServerRow> = Array.isArray(
+        candidates,
+      )
+        ? (candidates as Array<ClientSocketDatabaseServerRow>)
+        : [];
+
+      for (const row of rows) {
+        if (deleted >= CLIENT_SOCKET_DELETE_BATCH_SIZE) {
+          return deleted;
+        }
+
+        if (!row || !row._id || !row.projectId) {
+          continue;
+        }
+
+        if (!isClientSocketDatabaseServerRow(row)) {
+          continue;
+        }
+
+        const projectId: ObjectID = new ObjectID(row.projectId.toString());
+
+        let count: number = 0;
+
+        try {
+          // With hooks: the delete also removes the row's resource AI agent.
+          count = await this.deleteBy({
+            query: {
+              _id: row._id.toString(),
+              projectId: projectId,
+            },
+            limit: 1,
+            skip: 0,
+            props: {
+              isRoot: true,
+            },
+          });
+        } catch (error) {
+          // One row that cannot be deleted never holds up the rest.
+          logger.warn(
+            `DatabaseServerService: could not delete database ${row._id.toString()}, which application traces created for the client end of a connection: ${
+              error instanceof Error ? error.message : String(error)
+            }`,
+            { projectId: projectId.toString() } as LogAttributes,
+          );
+          continue;
+        }
+
+        if (count > 0) {
+          deleted++;
+
+          logger.info(
+            `DatabaseServerService: deleted database ${row._id.toString()} (${String(
+              row.name || "",
+            )}): application traces created it for the client end of a connection, not for a database server.`,
+            { projectId: projectId.toString() } as LogAttributes,
+          );
+        }
+      }
+
+      if (rows.length < CLIENT_SOCKET_SWEEP_PAGE_SIZE) {
+        break;
+      }
+
+      afterId = String(rows[rows.length - 1]!._id);
+    }
+
+    return deleted;
+  }
+
   /*
    * How many discovered databases (collector, client spans, Kubernetes,
    * Docker, Podman) a project may accumulate before discovery stops creating
@@ -4577,6 +4716,86 @@ function findGeneratedNameForm(
   return null;
 }
 
+/*
+ * A candidate row of the client-socket sweep, as its SQL reads it:
+ * `endpoints` holds every live endpoint the row owns, formatted.
+ */
+export interface ClientSocketDatabaseServerRow {
+  _id?: unknown;
+  projectId?: unknown;
+  name?: unknown;
+  dbSystem?: unknown;
+  serverAddress?: unknown;
+  serverPort?: unknown;
+  endpoints?: unknown;
+}
+
+/**
+ * True when a trace-created row describes nothing but the client end of a
+ * connection: it still has the name discovery generated for it (nobody
+ * renamed it), and its own address and port, and every endpoint it owns,
+ * are client sockets of its engine (isClientSocketDatabaseEndpoint). An
+ * endpoint that does not parse, or a row with no address at all, is never
+ * one. The sweep's SQL has already checked everything else
+ * (deleteClientSocketDatabaseServers).
+ */
+export function isClientSocketDatabaseServerRow(
+  row: ClientSocketDatabaseServerRow | null | undefined,
+): boolean {
+  if (!row) {
+    return false;
+  }
+
+  const dbSystem: string =
+    typeof row.dbSystem === "string" ? row.dbSystem.trim() : "";
+  const serverAddress: string =
+    typeof row.serverAddress === "string" ? row.serverAddress.trim() : "";
+  const serverPort: number = Number(row.serverPort);
+
+  if (!dbSystem || !serverAddress || !Number.isInteger(serverPort)) {
+    return false;
+  }
+
+  if (
+    !hasDiscoveryGeneratedName({
+      name: typeof row.name === "string" ? row.name : undefined,
+      dbSystem: dbSystem,
+      serverAddress: serverAddress,
+      serverPort: serverPort,
+    })
+  ) {
+    return false;
+  }
+
+  const endpoints: Array<DatabaseEndpoint> = [
+    { host: serverAddress, port: serverPort },
+  ];
+
+  const stored: Array<unknown> = Array.isArray(row.endpoints)
+    ? row.endpoints
+    : [];
+
+  for (const value of stored) {
+    const endpoint: DatabaseEndpoint | null = parseDatabaseEndpointString(
+      value,
+      { system: dbSystem },
+    );
+
+    if (!endpoint) {
+      return false;
+    }
+
+    endpoints.push(endpoint);
+  }
+
+  return endpoints.every((endpoint: DatabaseEndpoint): boolean => {
+    return isClientSocketDatabaseEndpoint({
+      system: dbSystem,
+      endpoint: endpoint,
+    });
+  });
+}
+
 /*
  * Every catalogued engine of `system`'s family, the family's own engine
  * first ("valkey" -> redis, valkey, keydb, ...). An engine outside the

package/Server/Services/DatabaseService.ts

@@ -50,6 +50,7 @@ import Protocol from "../../Types/API/Protocol";
 import Route from "../../Types/API/Route";
 import URL from "../../Types/API/URL";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import DatabaseCommonInteractionPropsUtil from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
 import Sort from "../../Types/BaseDatabase/Sort";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import { getMaxLengthFromTableColumnType } from "../../Types/Database/ColumnLength";
@@ -310,23 +311,34 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   }
 
   /*
-   * The permission layer's login check, run BEFORE the hooks instead of only
-   * after them.
+   * The refusals that do not depend on what a hook would do, made BEFORE the
+   * hooks run instead of only after them.
    *
-   * The hooks run first, and many of them key off props.userId: a missing one
-   * reads as "userId is required" (400), "User should be logged in" (422), or,
-   * for Project reads, an empty list with a 200. For an anonymous caller that
-   * is almost always a dashboard tab whose access-token cookie expired, and
-   * only a 401 makes the browser client refresh the session and replay the
-   * request. Everything this admits, the permission check would have admitted
-   * too (same condition, same exemptions for API keys and public models), so
-   * it only changes which refusal an anonymous caller gets, and it keeps hooks
-   * with side effects from running for them at all.
+   * The login check: the hooks run first, and many of them key off
+   * props.userId: a missing one reads as "userId is required" (400), "User
+   * should be logged in" (422), or, for Project reads, an empty list with a
+   * 200. For an anonymous caller that is almost always a dashboard tab whose
+   * access-token cookie expired, and only a 401 makes the browser client
+   * refresh the session and replay the request. Everything this admits, the
+   * permission check would have admitted too (same condition, same exemptions
+   * for API keys and public models), so it only changes which refusal an
+   * anonymous caller gets, and it keeps hooks with side effects from running
+   * for them at all.
+   *
+   * The read-only credential check, for the same reason: a create, update or
+   * delete made with a credential that may only read is going to be refused
+   * whatever the caller's permissions are (the permission entry points ask
+   * the same question), so no hook - several of which write on the caller's
+   * behalf - should have run for it first.
    */
-  private checkIfUserIsLoggedInBeforeHooks(
+  private checkCallerBeforeHooks(
     props: DatabaseCommonInteractionProps,
     type: DatabaseRequestType,
   ): void {
+    if (type !== DatabaseRequestType.Read) {
+      DatabaseCommonInteractionPropsUtil.assertCredentialCanWrite(props);
+    }
+
     if (props.isRoot || props.isMasterAdmin) {
       return;
     }
@@ -1560,10 +1572,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
   @CaptureSpan()
   public async create(createBy: CreateBy<TBaseModel>): Promise<TBaseModel> {
-    this.checkIfUserIsLoggedInBeforeHooks(
-      createBy.props,
-      DatabaseRequestType.Create,
-    );
+    this.checkCallerBeforeHooks(createBy.props, DatabaseRequestType.Create);
 
     /*
      * A non-root create must not pin the row's own primary key. save() treats
@@ -2520,10 +2529,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   @CaptureSpan()
   public async hardDeleteBy(deleteBy: DeleteBy<TBaseModel>): Promise<number> {
     try {
-      this.checkIfUserIsLoggedInBeforeHooks(
-        deleteBy.props,
-        DatabaseRequestType.Delete,
-      );
+      this.checkCallerBeforeHooks(deleteBy.props, DatabaseRequestType.Delete);
 
       const onDelete: OnDelete<TBaseModel> = deleteBy.props.ignoreHooks
         ? { deleteBy, carryForward: [] }
@@ -2587,10 +2593,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(deleteBy.props);
 
-      this.checkIfUserIsLoggedInBeforeHooks(
-        deleteBy.props,
-        DatabaseRequestType.Delete,
-      );
+      this.checkCallerBeforeHooks(deleteBy.props, DatabaseRequestType.Delete);
 
       if (this.doNotAllowDelete && !deleteBy.props.isRoot) {
         throw new BadDataException("Delete not allowed");
@@ -2826,10 +2829,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(findBy.props);
 
-      this.checkIfUserIsLoggedInBeforeHooks(
-        findBy.props,
-        DatabaseRequestType.Read,
-      );
+      this.checkCallerBeforeHooks(findBy.props, DatabaseRequestType.Read);
 
       if (!findBy.sort || Object.keys(findBy.sort).length === 0) {
         findBy.sort = {
@@ -3211,10 +3211,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     try {
       this.setTelemetryContextFromProps(updateBy.props);
 
-      this.checkIfUserIsLoggedInBeforeHooks(
-        updateBy.props,
-        DatabaseRequestType.Update,
-      );
+      this.checkCallerBeforeHooks(updateBy.props, DatabaseRequestType.Update);
 
       updateBy.data = this.sanitizeUpdateData(updateBy.data);
 

package/Server/Services/InboundEmail/InboundEmailProvider.ts

@@ -1,8 +1,24 @@
 import { JSONObject } from "../../../Types/JSON";
+import EmailAddressList from "../../../Utils/Email/EmailAddressList";
 
 export interface ParsedInboundEmail {
   from: string;
   to: string;
+  /*
+   * Every address in the To and Cc headers, lowercased. `to` above is kept as
+   * it always was, because Incoming Email monitors evaluate it.
+   */
+  toAddresses?: Array<string> | undefined;
+  ccAddresses?: Array<string> | undefined;
+  /*
+   * Who this delivery is for: the SMTP recipients (RCPT TO) on the inbound
+   * domain, when the provider says. They need not appear in To or Cc at all -
+   * a Bcc, a forwarding rule, a mailing list - and when they are known they
+   * are the only recipients that count. SendGrid posts one webhook per
+   * recipient, so routing by the headers instead would hand an email sent to
+   * two addresses to both of them twice.
+   */
+  envelopeRecipients?: Array<string> | undefined;
   subject: string;
   body: string;
   bodyHtml?: string | undefined;
@@ -17,6 +33,34 @@ export interface ParsedInboundEmail {
     | undefined;
 }
 
+/*
+ * The addresses an inbound delivery is for, in the order to try them: the
+ * envelope's recipients when the provider gave them, else everyone in To and
+ * Cc, else the one `to` address. Lowercased, and each once.
+ */
+export const getInboundEmailRecipientAddresses: (
+  email: ParsedInboundEmail,
+) => Array<string> = (email: ParsedInboundEmail): Array<string> => {
+  const envelope: Array<string> = EmailAddressList.merge(
+    email.envelopeRecipients,
+  );
+
+  if (envelope.length > 0) {
+    return envelope;
+  }
+
+  const headers: Array<string> = EmailAddressList.merge(
+    email.toAddresses,
+    email.ccAddresses,
+  );
+
+  if (headers.length > 0) {
+    return headers;
+  }
+
+  return EmailAddressList.merge(email.to ? [email.to] : []);
+};
+
 export interface InboundEmailProviderConfig {
   webhookSecret?: string | undefined;
   inboundDomain: string;

package/Server/Services/InboundEmail/Providers/SendGridInboundProvider.ts

@@ -2,7 +2,8 @@ import InboundEmailProvider, {
   InboundEmailProviderConfig,
   ParsedInboundEmail,
 } from "../InboundEmailProvider";
-import { JSONObject } from "../../../../Types/JSON";
+import { JSONObject, JSONValue } from "../../../../Types/JSON";
+import EmailAddressList from "../../../../Utils/Email/EmailAddressList";
 import IncomingEmailMonitorAddress, {
   IncomingEmailRecipient,
   IncomingEmailRecipientKind,
@@ -18,6 +19,7 @@ export type SendGridInboundConfig = InboundEmailProviderConfig;
  * SendGrid sends emails to the webhook as multipart/form-data with the following fields:
  * - from: Email sender
  * - to: Email recipient(s)
+ * - cc: Copied recipient(s)
  * - subject: Email subject
  * - text: Plain text body
  * - html: HTML body
@@ -45,6 +47,15 @@ export default class SendGridInboundProvider extends InboundEmailProvider {
     const to: string = this.extractEmailAddress(
       rawData["to"]?.toString() || "",
     );
+    const toAddresses: Array<string> = EmailAddressList.parse(
+      rawData["to"]?.toString(),
+    );
+    const ccAddresses: Array<string> = EmailAddressList.parse(
+      rawData["cc"]?.toString(),
+    );
+    const envelopeRecipients: Array<string> = this.parseEnvelopeRecipients(
+      rawData["envelope"],
+    );
     const subject: string = rawData["subject"]?.toString() || "";
     const body: string = rawData["text"]?.toString() || "";
     const bodyHtml: string | undefined = rawData["html"]?.toString();
@@ -58,6 +69,9 @@ export default class SendGridInboundProvider extends InboundEmailProvider {
     return {
       from,
       to,
+      toAddresses,
+      ccAddresses,
+      envelopeRecipients,
       subject,
       body,
       bodyHtml,
@@ -66,6 +80,48 @@ export default class SendGridInboundProvider extends InboundEmailProvider {
     };
   }
 
+  /*
+   * SendGrid's `envelope` field is JSON: {"to": ["rcpt@inbound..."], "from":
+   * "bounce@sender..."}. `to` holds the address this POST was delivered for.
+   * Anything that is not that shape is no envelope at all, and the router
+   * falls back to the To and Cc headers.
+   */
+  private parseEnvelopeRecipients(
+    rawEnvelope: JSONValue | undefined,
+  ): Array<string> {
+    let envelope: JSONValue | undefined = rawEnvelope;
+
+    if (typeof envelope === "string") {
+      try {
+        envelope = JSON.parse(envelope) as JSONValue;
+      } catch {
+        return [];
+      }
+    }
+
+    if (!envelope || typeof envelope !== "object" || Array.isArray(envelope)) {
+      return [];
+    }
+
+    const recipients: JSONValue | undefined = (envelope as JSONObject)["to"];
+
+    if (typeof recipients === "string") {
+      return EmailAddressList.parse(recipients);
+    }
+
+    if (!Array.isArray(recipients)) {
+      return [];
+    }
+
+    return EmailAddressList.merge(
+      recipients.flatMap((recipient: JSONValue): Array<string> => {
+        return typeof recipient === "string"
+          ? EmailAddressList.parse(recipient)
+          : [];
+      }),
+    );
+  }
+
   public async validateWebhook(data: {
     headers: Record<string, string>;
     body: JSONObject | string;