@oneuptime/common 14.0.13 → 14.0.14

package/Server/Services/DashboardService.ts

@@ -16,6 +16,7 @@ import { IsBillingEnabled } from "../EnvironmentConfig";
 import { PlanType } from "../../Types/Billing/SubscriptionPlan";
 import DashboardViewConfigUtil from "../../Utils/Dashboard/DashboardViewConfig";
 import {
+  DASHBOARD_TEMPLATE_MISC_DATA_KEY,
   DashboardTemplateType,
   getTemplateConfig,
 } from "../../Types/Dashboard/DashboardTemplates";
@@ -29,6 +30,12 @@ import {
   DASHBOARD_MASTER_PASSWORD_COOKIE_IDENTIFIER,
   DASHBOARD_MASTER_PASSWORD_REQUIRED_MESSAGE,
 } from "../../Types/Dashboard/MasterPassword";
+import {
+  DashboardAccessState,
+  isDashboardLockedWithoutPassword,
+  isDashboardMasterPasswordRequired,
+  isDashboardPublic,
+} from "../../Types/Dashboard/DashboardAccess";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -65,7 +72,7 @@ export class Service extends DatabaseService<Model> {
 
     // Check if a template type was provided via miscDataProps
     const templateType: string | undefined = createBy.miscDataProps?.[
-      "dashboardTemplateType"
+      DASHBOARD_TEMPLATE_MISC_DATA_KEY
     ] as string | undefined;
 
     if (
@@ -158,12 +165,25 @@ export class Service extends DatabaseService<Model> {
         },
       });
 
+      /*
+       * Who can view it, by the one rule the Sharing page shows and writes
+       * (Types/Dashboard/DashboardAccess).
+       */
+      const accessState: DashboardAccessState = {
+        isPublicDashboard: dashboard?.isPublicDashboard,
+        enableMasterPassword: dashboard?.enableMasterPassword,
+        hasMasterPassword: Boolean(dashboard?.masterPassword),
+      };
+
       /*
        * If dashboard is not public, deny access. An archived dashboard is
        * not public either, whatever its public setting says: the setting is
        * kept so unarchiving puts the public link back exactly as it was.
        */
-      if (dashboard && (!dashboard.isPublicDashboard || dashboard.isArchived)) {
+      if (
+        dashboard &&
+        (!isDashboardPublic(accessState) || dashboard.isArchived)
+      ) {
         return {
           hasReadAccess: false,
           error: new NotAuthenticatedException(
@@ -216,14 +236,16 @@ export class Service extends DatabaseService<Model> {
       }
 
       const shouldEnforceMasterPassword: boolean = Boolean(
-        dashboard &&
-          dashboard.isPublicDashboard &&
-          dashboard.enableMasterPassword,
+        dashboard && isDashboardMasterPasswordRequired(accessState),
       );
 
       if (shouldEnforceMasterPassword) {
-        // Fail closed if protection was enabled before a password was set.
-        if (!dashboard?.masterPassword) {
+        /*
+         * Fail closed if protection was enabled before a password was set.
+         * The Sharing page never writes this state (picking the password
+         * asks for one), but the API can, and so could the old page.
+         */
+        if (isDashboardLockedWithoutPassword(accessState)) {
           return {
             hasReadAccess: false,
             error: new MasterPasswordRequiredException(
@@ -253,7 +275,7 @@ export class Service extends DatabaseService<Model> {
       }
 
       // Public dashboard without master password - grant access
-      if (dashboard && dashboard.isPublicDashboard) {
+      if (dashboard && isDashboardPublic(accessState)) {
         return {
           hasReadAccess: true,
         };

package/Server/Services/DatabaseService.ts

@@ -366,11 +366,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     createBy: CreateBy<TBaseModel>,
   ): Promise<OnCreate<TBaseModel>> {
     // Private method that runs before create.
-    const projectIdColumn: string | null = this.model.getTenantColumn();
-
-    if (projectIdColumn && createBy.props.tenantId) {
-      (createBy.data as any)[projectIdColumn] = createBy.props.tenantId;
-    }
+    this.stampTenantOnCreate(createBy.data, createBy.props);
 
     return await this.onBeforeCreate(createBy);
   }
@@ -723,6 +719,36 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     return Promise.resolve({ findBy, carryForward: null });
   }
 
+  /*
+   * Runs on a create once the caller has passed the permission checks, just
+   * before the @UniqueColumnBy and @UniqueColumnsTogether checks, which
+   * refuse a clash with an existing row as "<Model> with the same <column>
+   * already exists.". Override it to refuse a clash in words of your own:
+   * the caller may create the row, so a refusal may say what exists (see
+   * DiscoveredResourceCreate.refuseClash). Skipped with ignoreHooks.
+   */
+  protected async onBeforeCreateUniqueCheck(
+    _createBy: CreateBy<TBaseModel>,
+  ): Promise<void> {
+    // A place holder method used for overriding.
+    return Promise.resolve();
+  }
+
+  /*
+   * The same for an update: runs once the caller has passed the permission
+   * checks, with the query already narrowed to the rows they may write and
+   * before the data is serialized, so it may still adjust what is written.
+   * Unlike onBeforeUpdate - which runs before any check - a refusal here
+   * may say what exists (see DiscoveredResourceUpdate.checkMatchColumn).
+   * Skipped with ignoreHooks.
+   */
+  protected async onBeforeUpdateUniqueCheck(
+    _updateBy: UpdateBy<TBaseModel>,
+  ): Promise<void> {
+    // A place holder method used for overriding.
+    return Promise.resolve();
+  }
+
   protected async onCreateSuccess(
     _onCreate: OnCreate<TBaseModel>,
     createdItem: TBaseModel,
@@ -1093,6 +1119,100 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       RULE_CRITERIA_LEGACY_NEVER_MATCH_PATTERN;
   }
 
+  /*
+   * Whether this model's tenant column is its own primary key - true of
+   * Project alone (`@TenantColumn("_id")`). A project IS its tenant, so its
+   * reads, updates and deletes are scoped to the request's project by `_id`.
+   * A create is the exception: it mints a new tenant, and the request's
+   * tenant is some other project that already exists.
+   */
+  private isTenantColumnPrimaryKey(): boolean {
+    return this.model.getTenantColumn() === "_id";
+  }
+
+  /*
+   * Writes the request's tenant onto a row being created, so a create made in
+   * a project lands in that project whatever the payload said.
+   *
+   * Skipped for a model whose tenant column is its own primary key. There the
+   * stamp hands the new row the id of the project the request was made in,
+   * and save() takes an entity carrying an existing id as an UPDATE of that
+   * row: POST /api/project with a tenantid header answered 500 only because
+   * the stamped value was an ObjectID, which Postgres could not read as a
+   * uuid, instead of overwriting the project the header named.
+   *
+   * The tenant is ignored for that create, not refused. It names the project
+   * the caller is working in, which says nothing about a project that does
+   * not exist yet, and some callers cannot leave it off: an API key's or an
+   * MCP grant's tenant comes from the credential. Whether the caller may
+   * create a project at all is for the permission checks and ProjectService's
+   * hooks to answer. (The Dashboard sends no tenant for this create - see
+   * isMultiTenantRequest in ProjectPicker.)
+   */
+  private stampTenantOnCreate(
+    data: TBaseModel,
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    const tenantColumn: string | null = this.model.getTenantColumn();
+
+    if (!tenantColumn || !props.tenantId || this.isTenantColumnPrimaryKey()) {
+      return;
+    }
+
+    data.setColumnValue(tenantColumn, props.tenantId);
+  }
+
+  /*
+   * The last check a create makes before save(), on the entity save() is
+   * actually handed. save() chooses between INSERT and UPDATE by that
+   * entity's primary key: one carrying the id of an existing row is loaded
+   * and UPDATEd in place, so a create that reaches it with an id rewrites a
+   * record nobody asked to change.
+   *
+   * create() refuses a caller-supplied id up front, but the hooks, the tenant
+   * stamp and the rest of the pipeline all write to the same entity after
+   * that check - the tenant stamp is how a new Project came to carry the id
+   * of the project the request was made in. So, once more, here:
+   *
+   *  - a non-root create may not carry an id, whatever put it there;
+   *  - no create, root included, of a model whose tenant column is its own
+   *    primary key may carry the request tenant's id. Root callers may
+   *    assign ids, but this one can only come from a generic tenant stamp -
+   *    workflow components create as root WITH a tenant, after
+   *    applyTenantColumn has written the tenant column - and it would make
+   *    the create an update of the caller's own project.
+   *
+   * The ids are compared as text, case-insensitively: the id may be an
+   * ObjectID or a plain string, and Postgres reads a uuid in either case.
+   */
+  private assertCreateWillInsert(
+    data: TBaseModel,
+    props: DatabaseCommonInteractionProps,
+  ): void {
+    const suppliedId: unknown = data._id;
+
+    if (!suppliedId) {
+      return;
+    }
+
+    if (!props.isRoot && !props.isMasterAdmin) {
+      throw new BadDataException(
+        `An id cannot be supplied when creating ${this.model.singularName}.`,
+      );
+    }
+
+    if (
+      this.isTenantColumnPrimaryKey() &&
+      props.tenantId &&
+      String(suppliedId).toLowerCase() ===
+        props.tenantId.toString().toLowerCase()
+    ) {
+      throw new BadDataException(
+        `A new ${this.model.singularName} cannot take the id of the ${this.model.singularName} this request is made in.`,
+      );
+    }
+  }
+
   /*
    * A tenant model declares its tenant TWICE: a scalar column (e.g.
    * `projectId`) AND a ManyToOne relation (`project`) whose @JoinColumn names
@@ -1588,7 +1708,9 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
      * this guards every other non-root caller (custom routes, workflow
      * components) too. Root/internal seeding legitimately assigns ids and is
      * exempt. Only the top-level primary key is checked - nested relation
-     * `_id`s reference existing related rows and are fine.
+     * `_id`s reference existing related rows and are fine. Asked again just
+     * before save(), once the hooks and the tenant stamp have had their turn
+     * (assertCreateWillInsert).
      */
     if (
       !createBy.props.isRoot &&
@@ -1617,12 +1739,8 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
     let data: TBaseModel = _createdBy.data;
 
-    // add tenantId if present.
-    const tenantColumnName: string | null = data.getTenantColumn();
-
-    if (tenantColumnName && _createdBy.props.tenantId) {
-      data.setColumnValue(tenantColumnName, _createdBy.props.tenantId);
-    }
+    // add tenantId if present, unless it is the row's own id. See the helper.
+    this.stampTenantOnCreate(data, _createdBy.props);
 
     /*
      * The tenant scalar has just been stamped to the request tenant, but the
@@ -1671,6 +1789,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
     createBy.data = data;
 
+    // A service's own words for a clash, before the generic checks below.
+    if (!createBy.props.ignoreHooks) {
+      await this.onBeforeCreateUniqueCheck(createBy);
+    }
+
     // check uniqueColumns by:
     createBy = await this.checkUniqueColumnBy(createBy);
 
@@ -1682,6 +1805,9 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       createBy.props,
     )) as TBaseModel;
 
+    // Whatever has written to it since the top of create(), this must INSERT.
+    this.assertCreateWillInsert(createBy.data, createBy.props);
+
     try {
       createBy.data = await this.getRepository().save(createBy.data);
       this.applyRuleCriteriaEffectiveEnabledToItem(createBy.data);
@@ -3531,6 +3657,11 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         beforeUpdateBy.props,
       );
 
+      // A service's own words for a clash, now the caller may make the write.
+      if (!updateBy.props.ignoreHooks) {
+        await this.onBeforeUpdateUniqueCheck(beforeUpdateBy);
+      }
+
       const data: PartialEntity<TBaseModel> =
         (await this.sanitizeCreateOrUpdate(
           beforeUpdateBy.data,

package/Server/Services/DockerHostService.ts

@@ -20,6 +20,15 @@ import { JSONObject } from "../../Types/JSON";
 import URL from "../../Types/API/URL";
 import DatabaseConfig from "../DatabaseConfig";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import DiscoveredResourceCreate, {
+  DiscoveredResourceNaming,
+  NamedAfterIdentityOptions,
+  namedAfterIdentity,
+} from "../Utils/Telemetry/DiscoveredResourceCreate";
+import DiscoveredResourceUpdate, {
+  MatchColumn,
+  matchedOnIdentifier,
+} from "../Utils/Telemetry/DiscoveredResourceUpdate";
 import ResourceHeartbeat from "../Utils/Telemetry/ResourceHeartbeat";
 import ObjectID from "../../Types/ObjectID";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -35,6 +44,23 @@ const LAST_SEEN_THROTTLE_SECONDS: number = 60;
 const LABELS_APPLIED_CACHE_NAMESPACE: string = "docker-host-labels-applied";
 const LABELS_APPLIED_CACHE_TTL_SECONDS: number = 60;
 
+/*
+ * A Docker host is matched to its telemetry by host.name, and named after it
+ * unless somebody gives it a display name of their own
+ * (DiscoveredResourceCreate).
+ */
+const DOCKER_HOST_IDENTITY: NamedAfterIdentityOptions = {
+  identityColumn: "hostIdentifier",
+  resourceName: "Docker host",
+  identityName: "host name",
+};
+
+const DOCKER_HOST_NAMING: DiscoveredResourceNaming<Model> =
+  namedAfterIdentity<Model>(DOCKER_HOST_IDENTITY);
+
+const DOCKER_HOST_MATCH_COLUMN: MatchColumn =
+  matchedOnIdentifier(DOCKER_HOST_IDENTITY);
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -530,9 +556,43 @@ export class Service extends DatabaseService<Model> {
       createBy,
     });
 
+    // Named after its host name when nobody gave it a name.
+    DiscoveredResourceCreate.fillName({ createBy, naming: DOCKER_HOST_NAMING });
+
     return { createBy, carryForward: null };
   }
 
+  /*
+   * A Docker host that is already there - discovered from its telemetry or
+   * added before - is refused by its host name, not as a clash of names.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreateUniqueCheck(
+    createBy: CreateBy<Model>,
+  ): Promise<void> {
+    await DiscoveredResourceCreate.refuseClash({
+      service: this,
+      createBy,
+      naming: DOCKER_HOST_NAMING,
+    });
+  }
+
+  /*
+   * A Docker host's host name - edited from the details card on its Settings page - is stored
+   * without the spaces around it, and refused when another one of the
+   * project already has it (DiscoveredResourceUpdate).
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdateUniqueCheck(
+    updateBy: UpdateBy<Model>,
+  ): Promise<void> {
+    await DiscoveredResourceUpdate.checkMatchColumn({
+      service: this,
+      updateBy,
+      matchColumn: DOCKER_HOST_MATCH_COLUMN,
+    });
+  }
+
   /*
    * An operator's write of an AI access setting (the investigation switch, the
    * remediation mode, the command allowlist) is validated and checked against

package/Server/Services/DockerSwarmClusterService.ts

@@ -20,6 +20,10 @@ import { JSONObject } from "../../Types/JSON";
 import URL from "../../Types/API/URL";
 import DatabaseConfig from "../DatabaseConfig";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import DiscoveredResourceUpdate, {
+  MatchColumn,
+  matchedOnName,
+} from "../Utils/Telemetry/DiscoveredResourceUpdate";
 import ResourceHeartbeat from "../Utils/Telemetry/ResourceHeartbeat";
 import ObjectID from "../../Types/ObjectID";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -36,11 +40,32 @@ const LABELS_APPLIED_CACHE_NAMESPACE: string =
   "docker-swarm-cluster-labels-applied";
 const LABELS_APPLIED_CACHE_TTL_SECONDS: number = 60;
 
+/*
+ * A Docker Swarm cluster is matched to its telemetry by its name (docker.swarm.cluster.name),
+ * so a rename is held to the rules a new Docker Swarm cluster is: no spaces around
+ * it, never blank, and never another Docker Swarm cluster's name
+ * (DiscoveredResourceUpdate).
+ */
+const DOCKER_SWARM_CLUSTER_MATCH_COLUMN: MatchColumn = matchedOnName({
+  resourceName: "Docker Swarm cluster",
+});
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  @CaptureSpan()
+  protected override async onBeforeUpdateUniqueCheck(
+    updateBy: UpdateBy<Model>,
+  ): Promise<void> {
+    await DiscoveredResourceUpdate.checkMatchColumn({
+      service: this,
+      updateBy,
+      matchColumn: DOCKER_SWARM_CLUSTER_MATCH_COLUMN,
+    });
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     onCreate: OnCreate<Model>,

package/Server/Services/FileService.ts

@@ -7,6 +7,7 @@ import DatabaseService from "./DatabaseService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import File from "../../Models/DatabaseModels/File";
+import Dictionary from "../../Types/Dictionary";
 import MimeType from "../../Types/File/MimeType";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -28,6 +29,18 @@ const ALLOWED_MIME_TYPES: Set<string> = new Set<string>(
   Object.values(MimeType),
 );
 
+/*
+ * What a caller deciding whether a file may be used somewhere needs to know
+ * about it, without its bytes: its type, how many bytes it holds, and the
+ * project it was uploaded in (null when it was uploaded with none, or before
+ * files recorded it).
+ */
+export interface FileFacts {
+  fileType: string;
+  size: number;
+  projectId: ObjectID | null;
+}
+
 export class Service extends DatabaseService<File> {
   public constructor() {
     super(File);
@@ -58,9 +71,56 @@ export class Service extends DatabaseService<File> {
       createBy.data.imageAccessToken = generateImageAccessToken();
     }
 
+    /*
+     * The project the file is uploaded in is the request's - the
+     * dashboard's tenant, an API key's project - never whatever the body
+     * says, so a file can only ever claim the project it was uploaded from.
+     * A record shown outside the project (a form's logo) uses only a file
+     * of its own project.
+     */
+    (createBy.data as unknown as Dictionary<unknown>)["projectId"] =
+      createBy.props.tenantId || null;
+
     return { createBy, carryForward: null };
   }
 
+  /**
+   * A file's type, size and project, measured in Postgres: a check of
+   * whether a file may be used somewhere never loads its bytes (up to the
+   * 10 MB an upload may be) only to count them. Null when there is no such
+   * file, or the id is not one.
+   */
+  @CaptureSpan()
+  public async getFileFacts(fileId: ObjectID): Promise<FileFacts | null> {
+    if (!ObjectID.isValidUUID(fileId.toString())) {
+      return null;
+    }
+
+    const row:
+      | { fileType?: unknown; size?: unknown; projectId?: unknown }
+      | undefined = await this.getRepository()
+      .createQueryBuilder("file")
+      .select('"file"."fileType"', "fileType")
+      .addSelect('octet_length("file"."file")', "size")
+      .addSelect('"file"."projectId"', "projectId")
+      .where('"file"."_id" = :id', { id: fileId.toString() })
+      .andWhere('"file"."deletedAt" IS NULL')
+      .getRawOne();
+
+    if (!row) {
+      return null;
+    }
+
+    return {
+      fileType: typeof row.fileType === "string" ? row.fileType : "",
+      size: Number(row.size) || 0,
+      projectId:
+        typeof row.projectId === "string" && ObjectID.isValidUUID(row.projectId)
+          ? new ObjectID(row.projectId)
+          : null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<File>,