@oneuptime/common 14.0.13 → 14.0.14

package/Types/StatusPage/StatusPageAccess.ts

@@ -0,0 +1,215 @@
+/*
+ * Who can see a status page: one choice of three.
+ *
+ *   Anyone with the link      the page is public.
+ *   Only people who sign in   private users, and people the page's SSO or
+ *                             OIDC provider lets in, sign in first.
+ *   Anyone with the password  visitors enter one shared password.
+ *
+ * The choice is stored in three columns, which the API and Terraform read
+ * and write as they always have: isPublicStatusPage (on by default),
+ * enableMasterPassword (off by default) and masterPassword (a hash). The
+ * server asks for the password only on a page that is not public and has a
+ * password set (StatusPageService.hasReadAccess); anything else with
+ * enableMasterPassword on is a sign-in page, or a public one. So:
+ *
+ *   isPublicStatusPage on                                 -> Anyone
+ *   off, enableMasterPassword on and a password set       -> Password
+ *   off, otherwise                                        -> Sign in
+ *
+ * That rule lives here, once, and everything that has to agree on it reads
+ * it from here: the server's read check, the status page app's "does this
+ * page ask for a password?" (the master-page answer), and the dashboard's
+ * Access page, which shows the choice and writes it.
+ *
+ * Writing a choice writes only the columns whose value changes
+ * (getStatusPageAccessChanges): isPublicStatusPage needs the Growth plan to
+ * change on OneUptime Cloud, and a write that carries it - changed or not -
+ * is refused below Growth, so moving between the two private choices must
+ * leave it out.
+ */
+
+export enum StatusPageAccess {
+  Anyone = "Anyone",
+  SignIn = "SignIn",
+  Password = "Password",
+}
+
+// The order the choices are offered in.
+export const STATUS_PAGE_ACCESS_CHOICES: ReadonlyArray<StatusPageAccess> = [
+  StatusPageAccess.Anyone,
+  StatusPageAccess.SignIn,
+  StatusPageAccess.Password,
+];
+
+// What a status page holds that decides who can see it.
+export interface StatusPageAccessState {
+  // Nothing stored reads as the column's default: public.
+  isPublicStatusPage?: boolean | null | undefined;
+  // Nothing stored reads as the column's default: off.
+  enableMasterPassword?: boolean | null | undefined;
+  // Whether a master password is stored (its hash is never shown).
+  hasMasterPassword: boolean;
+}
+
+// The two switches each choice stores.
+export interface StatusPageAccessColumns {
+  isPublicStatusPage: boolean;
+  enableMasterPassword: boolean;
+}
+
+export const STATUS_PAGE_ACCESS_COLUMNS: Record<
+  StatusPageAccess,
+  StatusPageAccessColumns
+> = {
+  [StatusPageAccess.Anyone]: {
+    isPublicStatusPage: true,
+    /*
+     * A public page never asks for the password, so the switch did nothing
+     * while it was on. Turning it off means making the page private later
+     * never brings back a password nobody remembers asking for.
+     */
+    enableMasterPassword: false,
+  },
+  [StatusPageAccess.SignIn]: {
+    isPublicStatusPage: false,
+    enableMasterPassword: false,
+  },
+  [StatusPageAccess.Password]: {
+    isPublicStatusPage: false,
+    enableMasterPassword: true,
+  },
+};
+
+// The columns a choice writes, in the order they are written.
+export type StatusPageAccessColumn = keyof StatusPageAccessColumns;
+
+export const STATUS_PAGE_ACCESS_COLUMN_NAMES: ReadonlyArray<StatusPageAccessColumn> =
+  ["isPublicStatusPage", "enableMasterPassword"];
+
+// The column the password is written to, beside the choice's columns.
+export const STATUS_PAGE_MASTER_PASSWORD_COLUMN: string = "masterPassword";
+
+const isPublic: (state: StatusPageAccessState) => boolean = (
+  state: StatusPageAccessState,
+): boolean => {
+  return state.isPublicStatusPage !== false;
+};
+
+const isMasterPasswordSwitchOn: (state: StatusPageAccessState) => boolean = (
+  state: StatusPageAccessState,
+): boolean => {
+  return state.enableMasterPassword === true;
+};
+
+/*
+ * Whether visitors have to enter the master password: the page is not
+ * public, the switch is on and a password is set. The one rule the server
+ * enforces (StatusPageService.hasReadAccess) and tells the status page app
+ * (the master-page answer's enableMasterPassword).
+ */
+export const isStatusPageMasterPasswordRequired: (
+  state: StatusPageAccessState,
+) => boolean = (state: StatusPageAccessState): boolean => {
+  return (
+    !isPublic(state) &&
+    isMasterPasswordSwitchOn(state) &&
+    state.hasMasterPassword
+  );
+};
+
+// Who can see the page now, by the rule the server enforces.
+export const getStatusPageAccess: (
+  state: StatusPageAccessState,
+) => StatusPageAccess = (state: StatusPageAccessState): StatusPageAccess => {
+  if (isPublic(state)) {
+    return StatusPageAccess.Anyone;
+  }
+
+  if (isStatusPageMasterPasswordRequired(state)) {
+    return StatusPageAccess.Password;
+  }
+
+  return StatusPageAccess.SignIn;
+};
+
+/*
+ * The columns to write to move a page to a choice: only those whose stored
+ * value differs from what the choice stores. Empty when nothing changes -
+ * the page already holds it, or (to Password) only the password is missing.
+ */
+export const getStatusPageAccessChanges: (data: {
+  from: StatusPageAccessState;
+  to: StatusPageAccess;
+}) => Partial<StatusPageAccessColumns> = (data: {
+  from: StatusPageAccessState;
+  to: StatusPageAccess;
+}): Partial<StatusPageAccessColumns> => {
+  const target: StatusPageAccessColumns = STATUS_PAGE_ACCESS_COLUMNS[data.to];
+  const changes: Partial<StatusPageAccessColumns> = {};
+
+  if (isPublic(data.from) !== target.isPublicStatusPage) {
+    changes.isPublicStatusPage = target.isPublicStatusPage;
+  }
+
+  if (isMasterPasswordSwitchOn(data.from) !== target.enableMasterPassword) {
+    changes.enableMasterPassword = target.enableMasterPassword;
+  }
+
+  return changes;
+};
+
+// The columns a move to a choice writes (see getStatusPageAccessChanges).
+export const getStatusPageAccessColumnsWritten: (data: {
+  from: StatusPageAccessState;
+  to: StatusPageAccess;
+}) => Array<StatusPageAccessColumn> = (data: {
+  from: StatusPageAccessState;
+  to: StatusPageAccess;
+}): Array<StatusPageAccessColumn> => {
+  const changes: Partial<StatusPageAccessColumns> =
+    getStatusPageAccessChanges(data);
+
+  return STATUS_PAGE_ACCESS_COLUMN_NAMES.filter(
+    (column: StatusPageAccessColumn): boolean => {
+      return changes[column] !== undefined;
+    },
+  );
+};
+
+/*
+ * Whether moving to a choice has to ask for a password: Password, on a page
+ * with none stored. Without one the server would not ask visitors for it,
+ * and the page would be a sign-in page that only looks like it is protected
+ * by a password.
+ */
+export const isStatusPagePasswordNeededFor: (data: {
+  from: StatusPageAccessState;
+  to: StatusPageAccess;
+}) => boolean = (data: {
+  from: StatusPageAccessState;
+  to: StatusPageAccess;
+}): boolean => {
+  return data.to === StatusPageAccess.Password && !data.from.hasMasterPassword;
+};
+
+/*
+ * The page as it is once a move is written, password included when one is
+ * entered with it: what the server then enforces is getStatusPageAccess of
+ * this, which is the choice made.
+ */
+export const getStatusPageAccessStateAfter: (data: {
+  from: StatusPageAccessState;
+  to: StatusPageAccess;
+  isPasswordEntered: boolean;
+}) => StatusPageAccessState = (data: {
+  from: StatusPageAccessState;
+  to: StatusPageAccess;
+  isPasswordEntered: boolean;
+}): StatusPageAccessState => {
+  return {
+    ...data.from,
+    ...getStatusPageAccessChanges({ from: data.from, to: data.to }),
+    hasMasterPassword: data.from.hasMasterPassword || data.isPasswordEntered,
+  };
+};

package/Types/StatusPage/StatusPagesListingMonitors.ts

@@ -0,0 +1,150 @@
+import { JSONObject } from "../JSON";
+import StatusPageEventType from "./StatusPageEventType";
+
+/*
+ * Which status pages list some monitors: where a scheduled maintenance event
+ * or an announcement about those monitors belongs. The dashboard suggests
+ * these pages under the status page picker of those forms - "Status pages
+ * that show the affected monitors: Public, EU · Add all" - so nobody has to
+ * guess which pages their customers read about those monitors on. It only
+ * suggests: nothing is picked without a click, because picking a page
+ * publishes the event there and tells the page's subscribers.
+ *
+ * POST /status-page/listing-monitors (StatusPageAPI) answers it, from
+ * StatusPageResourceService.findByMonitors - the lookup the subscriber jobs
+ * use, so a page that lists a monitor through a monitor group, or through a
+ * monitor rule that added it, counts the same way it does when the
+ * notifications go out.
+ *
+ * What a caller learns is bounded by what they may read
+ * (StatusPagesListingMonitorsBuilder): only the monitors they can read are
+ * looked up, and only the status pages they can read are named - status page
+ * access can be limited to pages with some labels, and a page outside those
+ * is neither named nor counted. An archived page, or one that does not show
+ * the kind of event asked about, is left out: adding the event to it would
+ * show nobody anything.
+ *
+ * Everything here is shared by the server, which builds the answer, and the
+ * dashboard, which reads it, so the two cannot drift apart.
+ */
+
+// A status page that lists some of the monitors, by name.
+export interface StatusPageListingMonitors {
+  statusPageId: string;
+  name: string;
+}
+
+export interface StatusPagesListingMonitorsResult {
+  // In name order.
+  statusPages: Array<StatusPageListingMonitors>;
+}
+
+export default class StatusPagesListingMonitors {
+  // The route, under the API's base URL.
+  public static readonly apiPath: string = "/status-page/listing-monitors";
+
+  // How many monitors one request may name.
+  public static readonly maxIdsPerRequest: number = 1000;
+
+  /*
+   * The kinds of event a request may ask about. A page that does not show
+   * that kind of event (StatusPage.showScheduledMaintenanceEventsOnStatusPage,
+   * showAnnouncementsOnStatusPage) is not suggested for it. Incidents are not
+   * here: an incident already reaches every page that lists its monitors, and
+   * picking pages for one only narrows that (IncidentStatusPageScope).
+   */
+  public static readonly eventTypes: ReadonlyArray<StatusPageEventType> = [
+    StatusPageEventType.ScheduledEvent,
+    StatusPageEventType.Announcement,
+  ];
+
+  public static isEventType(value: unknown): value is StatusPageEventType {
+    return (
+      typeof value === "string" &&
+      (this.eventTypes as ReadonlyArray<string>).includes(value)
+    );
+  }
+
+  /*
+   * The server's answer as the dashboard receives it. Read defensively: the
+   * suggestion is advisory, and a field that is missing or of the wrong type
+   * must read as "nothing to suggest" rather than break the form it sits
+   * on. A page without an id is dropped, and so is a second mention of one.
+   */
+  public static fromJSON(json: JSONObject): StatusPagesListingMonitorsResult {
+    const items: Array<unknown> = Array.isArray(json["statusPages"])
+      ? (json["statusPages"] as Array<unknown>)
+      : [];
+
+    const statusPages: Array<StatusPageListingMonitors> = [];
+
+    for (const item of items) {
+      if (!item || typeof item !== "object" || Array.isArray(item)) {
+        continue;
+      }
+
+      const record: JSONObject = item as JSONObject;
+
+      const statusPageId: string = String(record["statusPageId"] || "")
+        .trim()
+        .toLowerCase();
+
+      if (
+        !statusPageId ||
+        statusPages.some((existing: StatusPageListingMonitors): boolean => {
+          return existing.statusPageId === statusPageId;
+        })
+      ) {
+        continue;
+      }
+
+      statusPages.push({
+        statusPageId: statusPageId,
+        name: String(record["name"] || "").trim(),
+      });
+    }
+
+    return { statusPages: statusPages };
+  }
+
+  public static toJSON(result: StatusPagesListingMonitorsResult): JSONObject {
+    return {
+      statusPages: result.statusPages.map(
+        (statusPage: StatusPageListingMonitors): JSONObject => {
+          return {
+            statusPageId: statusPage.statusPageId,
+            name: statusPage.name,
+          };
+        },
+      ),
+    };
+  }
+
+  /*
+   * The order the server answers in: by name, the way people read a list of
+   * names - case-insensitive, and "Site 2" before "Site 10" - with a page
+   * without a name last. It has no reader's language to go by; the dashboard
+   * orders the suggestions again in the reader's.
+   */
+  public static compareByName(
+    a: StatusPageListingMonitors,
+    b: StatusPageListingMonitors,
+  ): number {
+    const aName: string = a.name.trim();
+    const bName: string = b.name.trim();
+
+    if (!aName || !bName) {
+      return (
+        Number(!aName) - Number(!bName) ||
+        a.statusPageId.localeCompare(b.statusPageId)
+      );
+    }
+
+    return (
+      aName.localeCompare(bName, "en", {
+        sensitivity: "base",
+        numeric: true,
+      }) || a.statusPageId.localeCompare(b.statusPageId)
+    );
+  }
+}

package/Types/Telemetry/ScrubRule.ts

@@ -0,0 +1,240 @@
+import LogScrubAction from "../Log/LogScrubAction";
+import LogScrubField from "../Log/LogScrubField";
+import LogScrubPatternType from "../Log/LogScrubPatternType";
+import TraceScrubAction from "../Trace/TraceScrubAction";
+import TraceScrubField from "../Trace/TraceScrubField";
+import TraceScrubPatternType from "../Trace/TraceScrubPatternType";
+
+/*
+ * WHAT A LOG OR TRACE SCRUB RULE STARTS WITH, AND WHAT MAKES ONE SCRUB
+ * NOTHING.
+ *
+ * Shared by the models (their column defaults), the server's save-time check
+ * (Server/Utils/ScrubRuleValidation.ts), the ingest engines
+ * (App/FeatureSet/Telemetry/Services/LogScrubRuleService.ts and
+ * TraceScrubRuleService.ts) and the dashboard's create forms, so the four can
+ * never disagree on what a rule does.
+ *
+ * The bug this file is the fix for: a "Custom Regex" rule could be saved with
+ * an empty pattern, or one that does not compile. Ingest skips such a rule
+ * (it has nothing to match with), so the rule looked active in the rules
+ * table while the personal data it was made for was stored in the clear. A
+ * rule is now refused unless ingest can actually use it, and the rules table
+ * flags the ones saved before that.
+ */
+
+// The pattern type whose matches are found with the rule's own regex.
+export const SCRUB_RULE_CUSTOM_PATTERN_TYPE: string =
+  LogScrubPatternType.Custom;
+
+/*
+ * The pattern type that scrubs the whole value of an attribute whose key
+ * looks sensitive (password, token, ...). It reads attribute keys, so a
+ * rule's fields-to-scrub choice does not apply to it: logs scrub attributes,
+ * spans their attributes and event attributes.
+ */
+export const SCRUB_RULE_SENSITIVE_KEYS_PATTERN_TYPE: string =
+  LogScrubPatternType.SensitiveKeys;
+
+/*
+ * The flags ingest compiles a custom pattern with: every match in the text,
+ * case-sensitive.
+ */
+export const SCRUB_RULE_REGEX_FLAGS: string = "g";
+
+export const LOG_SCRUB_PATTERN_TYPES: ReadonlyArray<string> =
+  Object.values(LogScrubPatternType);
+
+export const TRACE_SCRUB_PATTERN_TYPES: ReadonlyArray<string> = Object.values(
+  TraceScrubPatternType,
+);
+
+export const LOG_SCRUB_FIELDS: ReadonlyArray<string> =
+  Object.values(LogScrubField);
+
+export const TRACE_SCRUB_FIELDS: ReadonlyArray<string> =
+  Object.values(TraceScrubField);
+
+export interface ScrubRuleDefaults {
+  scrubAction: string;
+  fieldsToScrub: string;
+  isEnabled: boolean;
+}
+
+/*
+ * What a new rule does when its creator leaves these alone: replace every
+ * match with [REDACTED], wherever in the record it is, from the moment it is
+ * saved. The models' column defaults (TableColumn and the database's own),
+ * the API schema and the dashboard form all read them from here.
+ */
+export const LOG_SCRUB_RULE_DEFAULTS: ScrubRuleDefaults = {
+  scrubAction: LogScrubAction.Redact,
+  fieldsToScrub: LogScrubField.Both,
+  isEnabled: true,
+};
+
+export const TRACE_SCRUB_RULE_DEFAULTS: ScrubRuleDefaults = {
+  scrubAction: TraceScrubAction.Redact,
+  fieldsToScrub: TraceScrubField.All,
+  isEnabled: true,
+};
+
+export enum ScrubRuleCustomRegexProblem {
+  // No pattern at all, or only spaces.
+  Missing = "Missing",
+  // Not a regular expression the engine can compile.
+  Invalid = "Invalid",
+  /*
+   * Compiles, but matches empty text - "\d*", "(secret)?" - so a global
+   * replace puts the rule's replacement between every character of every
+   * record it reads.
+   */
+  MatchesEmptyText = "MatchesEmptyText",
+}
+
+export interface ScrubRuleCustomRegexCheck {
+  problem: ScrubRuleCustomRegexProblem;
+  // For an Invalid pattern: what the regular expression engine said.
+  reason?: string | undefined;
+}
+
+// "Invalid regular expression: /(/g: Unterminated group" -> its last part.
+const REGEX_SYNTAX_ERROR_PREFIX: RegExp =
+  /^Invalid regular expression: \/[\s\S]*\/[a-z]*: /;
+
+/**
+ * What the regular expression engine says is wrong with a pattern, without
+ * the pattern repeated in front of it: "Unterminated group".
+ */
+export function getRegexSyntaxErrorReason(error: unknown): string {
+  const message: string =
+    error instanceof Error ? error.message : String(error || "");
+
+  return message.replace(REGEX_SYNTAX_ERROR_PREFIX, "").trim() || message;
+}
+
+/**
+ * A custom pattern compiled the way ingest compiles it - ingest calls this -
+ * or null when it cannot be: empty, or not a regular expression. A rule
+ * whose pattern compiles to null scrubs nothing.
+ */
+export function compileScrubRuleCustomRegex(
+  customRegex: unknown,
+): RegExp | null {
+  if (typeof customRegex !== "string" || customRegex.length === 0) {
+    return null;
+  }
+
+  try {
+    return new RegExp(customRegex, SCRUB_RULE_REGEX_FLAGS);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * What stops a custom pattern from being saved, or null when it is one
+ * ingest can scrub with. Stricter than compileScrubRuleCustomRegex, which
+ * says what ingest does with a stored pattern: only spaces count as no
+ * pattern, and one that matches empty text is a mistake to refuse.
+ */
+export function checkScrubRuleCustomRegex(
+  customRegex: unknown,
+): ScrubRuleCustomRegexCheck | null {
+  if (typeof customRegex !== "string" || customRegex.trim().length === 0) {
+    return { problem: ScrubRuleCustomRegexProblem.Missing };
+  }
+
+  let regex: RegExp;
+
+  try {
+    regex = new RegExp(customRegex, SCRUB_RULE_REGEX_FLAGS);
+  } catch (error: unknown) {
+    return {
+      problem: ScrubRuleCustomRegexProblem.Invalid,
+      reason: getRegexSyntaxErrorReason(error),
+    };
+  }
+
+  if (matchesEmptyText(regex)) {
+    return { problem: ScrubRuleCustomRegexProblem.MatchesEmptyText };
+  }
+
+  return null;
+}
+
+/*
+ * Text that holds the characters scrubbed values sit among - letters,
+ * digits, spaces, separators, an address, a key and its value - so a
+ * pattern that matches nothing but a position somewhere in a record ("\b",
+ * "(?=@)", "(?<=:)\s*", "x*(?=y)") is caught as surely as one that matches
+ * empty text on its own ("\d*").
+ */
+const EMPTY_MATCH_PROBES: ReadonlyArray<string> = [
+  "",
+  "a",
+  "token=abc123; user@example.com",
+  "key: value, x y z",
+  "Aa1 -_.,:;=/\\@#$%&*+?!()[]{}<>'\"`|^~\t\n",
+];
+
+// Whether a compiled pattern ever matches no text at all.
+function matchesEmptyText(regex: RegExp): boolean {
+  // matchAll takes a global pattern only.
+  const global: RegExp = regex.global
+    ? regex
+    : new RegExp(regex.source, `${regex.flags}g`);
+
+  for (const probe of EMPTY_MATCH_PROBES) {
+    // matchAll steps past an empty match, so this always ends.
+    for (const match of probe.matchAll(global)) {
+      if (match[0] === "") {
+        return true;
+      }
+    }
+  }
+
+  return false;
+}
+
+/**
+ * Whether a stored rule scrubs nothing at all: ingest skips a rule of a
+ * pattern type it does not know and a custom rule whose pattern is empty or
+ * does not compile, and a rule whose fields-to-scrub it does not know
+ * matches but scrubs none of the record's fields (a sensitive-keys rule
+ * aside: it always scrubs attributes). The rules tables flag such rules,
+ * saved before the server refused them, so nobody takes them for protection.
+ */
+export function doesScrubRuleScrubNothing(data: {
+  patternType: unknown;
+  customRegex: unknown;
+  fieldsToScrub: unknown;
+  knownPatternTypes: ReadonlyArray<string>;
+  knownFieldsToScrub: ReadonlyArray<string>;
+}): boolean {
+  if (
+    typeof data.patternType !== "string" ||
+    !data.knownPatternTypes.includes(data.patternType)
+  ) {
+    return true;
+  }
+
+  /*
+   * Left empty, ingest scrubs every field; a value it does not know, none of
+   * them.
+   */
+  if (
+    data.patternType !== SCRUB_RULE_SENSITIVE_KEYS_PATTERN_TYPE &&
+    typeof data.fieldsToScrub === "string" &&
+    data.fieldsToScrub.length > 0 &&
+    !data.knownFieldsToScrub.includes(data.fieldsToScrub)
+  ) {
+    return true;
+  }
+
+  if (data.patternType !== SCRUB_RULE_CUSTOM_PATTERN_TYPE) {
+    return false;
+  }
+
+  return compileScrubRuleCustomRegex(data.customRegex) === null;
+}