@oneuptime/common 14.0.6 → 14.0.8

package/Server/Utils/StatusPage/StatusPageExclusion.ts

@@ -0,0 +1,18 @@
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+
+/*
+ * Why a status page that lists an incident's monitors does not reach it (see
+ * IncidentStatusPageScope). Kept on its own so the delivery record can name
+ * the reason without loading the services the scope helper queries.
+ */
+export enum StatusPageExclusionReason {
+  // The incident is limited to other status pages.
+  OutsideIncidentScope = "OutsideIncidentScope",
+  // The page only shows incidents limited to it, and this one is not.
+  OnlyShowsScopedIncidents = "OnlyShowsScopedIncidents",
+}
+
+export interface ExcludedStatusPage {
+  statusPage: StatusPage;
+  reason: StatusPageExclusionReason;
+}

package/Server/Utils/StatusPage/StatusPageReadAccess.ts

@@ -0,0 +1,125 @@
+import StatusPage from "../../../Models/DatabaseModels/StatusPage";
+import DatabaseCommonInteractionProps from "../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import LIMIT_MAX from "../../../Types/Database/LimitMax";
+import NotAuthorizedException from "../../../Types/Exception/NotAuthorizedException";
+import IncidentScopeAddedPagesNotification from "../../../Types/StatusPage/IncidentScopeAddedPagesNotification";
+import StatusPageService from "../../Services/StatusPageService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+
+/*
+ * Which status pages a caller may pick for an incident or an incident
+ * template to be limited to.
+ *
+ * Limiting an incident to a status page decides who is told about it, so
+ * picking a page needs read access to it - the way picking an incident's
+ * monitors needs monitor read access. Incident roles do not read status
+ * pages, and status page access can be limited to pages with some labels, so
+ * someone who may edit an incident may still be unable to see some (or all)
+ * of the project's status pages. The dashboard's picker only lists the pages
+ * the person can read; this is the same rule for the API, so an incident
+ * member cannot reach a page they were deliberately not given through a
+ * hand-written request.
+ *
+ * Only pages being added are checked. Pages an incident or template is
+ * already limited to stay, even when the person saving cannot read them
+ * (IncidentService keeps them on every edit).
+ */
+export default class StatusPageReadAccess {
+  /*
+   * Which of these status pages the caller can read, through the status page
+   * permissions and labels they actually hold, lower-cased. A caller with no
+   * status page read access at all can read none of them.
+   */
+  public static async getReadableStatusPageIds(data: {
+    statusPageIds: Array<string>;
+    props: DatabaseCommonInteractionProps;
+  }): Promise<Array<string>> {
+    const statusPageIds: Array<string> =
+      IncidentScopeAddedPagesNotification.normalizeStatusPageIds(
+        data.statusPageIds,
+      );
+
+    if (statusPageIds.length === 0) {
+      return [];
+    }
+
+    if (data.props.isRoot) {
+      return statusPageIds;
+    }
+
+    try {
+      const statusPages: Array<StatusPage> = await StatusPageService.findBy({
+        query: {
+          _id: QueryHelper.any(statusPageIds),
+        },
+        select: {
+          _id: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: data.props,
+      });
+
+      return IncidentScopeAddedPagesNotification.normalizeStatusPageIds(
+        statusPages,
+      );
+    } catch (err) {
+      if (err instanceof NotAuthorizedException) {
+        return [];
+      }
+
+      throw err;
+    }
+  }
+
+  /*
+   * Refuses status pages the caller cannot read. `allowedStatusPageIds` are
+   * pages the caller may pick without reading them - an incident template's
+   * pages, which a project admin chose for everyone who declares from it.
+   * Root (internal) callers pick any page.
+   */
+  public static async assertCallerCanPickStatusPages(data: {
+    statusPageIds: Array<string>;
+    props: DatabaseCommonInteractionProps;
+    // "incident" or "incident template", for the message.
+    subject: string;
+    allowedStatusPageIds?: Array<string> | undefined;
+  }): Promise<void> {
+    if (data.props.isRoot) {
+      return;
+    }
+
+    const allowed: Array<string> =
+      IncidentScopeAddedPagesNotification.normalizeStatusPageIds(
+        data.allowedStatusPageIds || [],
+      );
+
+    const toCheck: Array<string> =
+      IncidentScopeAddedPagesNotification.normalizeStatusPageIds(
+        data.statusPageIds,
+      ).filter((id: string): boolean => {
+        return !allowed.includes(id);
+      });
+
+    if (toCheck.length === 0) {
+      return;
+    }
+
+    const readable: Array<string> = await this.getReadableStatusPageIds({
+      statusPageIds: toCheck,
+      props: data.props,
+    });
+
+    const unreadable: Array<string> = toCheck.filter((id: string): boolean => {
+      return !readable.includes(id);
+    });
+
+    if (unreadable.length > 0) {
+      throw new NotAuthorizedException(this.getRefusalMessage(data.subject));
+    }
+  }
+
+  public static getRefusalMessage(subject: string): string {
+    return `You do not have access to some of the status pages you picked, so this ${subject} cannot be limited to them. Picking status pages needs a role that can read them, such as Status Page Viewer (it can be limited to pages with certain labels).`;
+  }
+}

package/Server/Utils/StatusPage/StatusPageSubscriberUnsubscribeNotice.ts

@@ -0,0 +1,151 @@
+import Markdown from "../../Types/Markdown";
+import OneUptimeDate from "../../../Types/Date";
+import {
+  StatusPageSubscriberContact,
+  StatusPageSubscriberUnsubscribeChannel,
+} from "../../../Types/StatusPage/StatusPageSubscriberUnsubscribe";
+
+/*
+ * The email a status page's team gets when a subscriber the team added
+ * unsubscribes itself.
+ *
+ * Anyone who can read a mailbox can unsubscribe it. For an address somebody
+ * signed up themselves that is the point; for one the team added - a site's
+ * mailing list, say site03-all@ - it means one reader can take a whole site
+ * off the page before the next outage, and nobody would notice until then. So
+ * when a subscriber the team added (StatusPageSubscriber.isAddedByTeam: from
+ * the dashboard, with an API key or by a workflow, never a sign-up on the
+ * status page) unsubscribes through its link or the manage page, the page's
+ * owners and the teammate who added it, if a teammate did, are told
+ * (StatusPageSubscriberService.notifyTeamOfUnsubscribe). Without a teammate -
+ * an API key or a workflow added it - the email says someone on the team did.
+ *
+ * Kept free of database access so what the email says can be pinned by a
+ * test. It is sent through the SimpleMessage template, whose `message` is
+ * inserted as HTML, so every value from a subscriber or a teammate is escaped
+ * here.
+ */
+
+// How the subscription was cancelled, which the email names.
+export enum StatusPageSubscriberUnsubscribeSource {
+  // The link at the bottom of a notification (the status page's unsubscribe page).
+  UnsubscribeLink = "UnsubscribeLink",
+  // The Update Subscription page, where a subscriber can also change preferences.
+  ManageSubscriptionPage = "ManageSubscriptionPage",
+}
+
+export interface StatusPageSubscriberUnsubscribeNoticeInput {
+  statusPageName: string;
+  contact: StatusPageSubscriberContact;
+  source: StatusPageSubscriberUnsubscribeSource;
+  unsubscribedAt: Date;
+  /*
+   * The teammate who added the subscriber, when a teammate did and they are
+   * still known (an API key or a workflow has no name to give).
+   */
+  addedByName?: string | undefined;
+  addedAt?: Date | undefined;
+  // The status page's list of subscribers on this channel, in the dashboard.
+  subscriberListUrl: string;
+}
+
+export interface StatusPageSubscriberUnsubscribeNoticeEmail {
+  subject: string;
+  // HTML for SimpleMessage's `message`; every interpolated value is escaped.
+  message: string;
+}
+
+const SUBSCRIBER_LIST_ROUTES: Record<
+  StatusPageSubscriberUnsubscribeChannel,
+  string
+> = {
+  [StatusPageSubscriberUnsubscribeChannel.Email]: "email-subscribers",
+  [StatusPageSubscriberUnsubscribeChannel.SMS]: "sms-subscribers",
+  [StatusPageSubscriberUnsubscribeChannel.Slack]: "slack-subscribers",
+  [StatusPageSubscriberUnsubscribeChannel.MicrosoftTeams]:
+    "microsoft-teams-subscribers",
+  [StatusPageSubscriberUnsubscribeChannel.Webhook]: "webhook-subscribers",
+};
+
+const CHANNEL_NAMES: Record<StatusPageSubscriberUnsubscribeChannel, string> = {
+  [StatusPageSubscriberUnsubscribeChannel.Email]: "email subscriber",
+  [StatusPageSubscriberUnsubscribeChannel.SMS]: "SMS subscriber",
+  [StatusPageSubscriberUnsubscribeChannel.Slack]: "Slack subscriber",
+  [StatusPageSubscriberUnsubscribeChannel.MicrosoftTeams]:
+    "Microsoft Teams subscriber",
+  [StatusPageSubscriberUnsubscribeChannel.Webhook]: "webhook subscriber",
+};
+
+export default class StatusPageSubscriberUnsubscribeNotice {
+  /*
+   * The team is told about one subscriber unsubscribing at most once in this
+   * many hours (StatusPageSubscriberService.notifyTeamOfUnsubscribe): the
+   * public manage page can re-subscribe and cancel a subscription over and
+   * over, and each cancellation would otherwise email every owner.
+   */
+  public static readonly noticeWindowInHours: number = 24;
+
+  // Where the time of each subscriber's last notice is kept.
+  public static readonly noticeCacheNamespace: string =
+    "status-page-subscriber-unsubscribe-notice";
+
+  /*
+   * The dashboard route, under the status page, of the list a channel's
+   * subscribers are on (Dashboard RouteMap, STATUS_PAGE_VIEW_*_SUBSCRIBERS).
+   */
+  public static getSubscriberListRoute(
+    channel: StatusPageSubscriberUnsubscribeChannel,
+  ): string {
+    return SUBSCRIBER_LIST_ROUTES[channel];
+  }
+
+  public static build(
+    input: StatusPageSubscriberUnsubscribeNoticeInput,
+  ): StatusPageSubscriberUnsubscribeNoticeEmail {
+    const escape: (text: string) => string = Markdown.escapeHtml;
+
+    const channelName: string = CHANNEL_NAMES[input.contact.channel];
+    const contact: string = input.contact.contact.trim();
+
+    const who: string = contact
+      ? `The ${channelName} <strong>${escape(contact)}</strong>`
+      : `A ${channelName}`;
+
+    const how: string =
+      input.source === StatusPageSubscriberUnsubscribeSource.UnsubscribeLink
+        ? "using the unsubscribe link in a notification"
+        : "on the status page's Update Subscription page";
+
+    const addedBy: string = input.addedByName?.trim()
+      ? escape(input.addedByName.trim())
+      : "Someone on your team";
+
+    const addedOn: string = input.addedAt
+      ? ` on ${escape(StatusPageSubscriberUnsubscribeNotice.formatDate(input.addedAt))}`
+      : "";
+
+    const statusPageName: string = escape(input.statusPageName);
+    const subscriberListUrl: string = escape(input.subscriberListUrl);
+
+    const message: string = [
+      `<p>${who} unsubscribed from the status page <strong>${statusPageName}</strong> ${how}, at ${escape(
+        StatusPageSubscriberUnsubscribeNotice.formatDate(input.unsubscribedAt),
+      )}. It will not receive this page's notifications any more.</p>`,
+      `<p>${addedBy} added this subscriber${addedOn}. Anyone who reads a shared address, such as a mailing list, can unsubscribe it for everyone who reads it. If that is what happened, add it back or add the people who still need these notifications.</p>`,
+      `<p>You are receiving this because you own this status page or added this subscriber. <a href="${subscriberListUrl}">View the status page's subscribers</a>.</p>`,
+    ].join("");
+
+    return {
+      subject: `A subscriber your team added unsubscribed from ${input.statusPageName}`,
+      message: message,
+    };
+  }
+
+  private static formatDate(date: Date): string {
+    return OneUptimeDate.getDateAsFormattedStringInTimezone({
+      date: date,
+      timezone: "UTC",
+      use12HourFormat: false,
+    });
+  }
+}

package/Server/Utils/StatusPage/StatusPageSubscriberUnsubscribeToken.ts

@@ -0,0 +1,70 @@
+import StatusPageSubscriberUnsubscribe from "../../../Types/StatusPage/StatusPageSubscriberUnsubscribe";
+import crypto from "crypto";
+
+/*
+ * The secret half of a status page subscriber's unsubscribe link
+ * (StatusPageSubscriber.unsubscribeToken; the link itself is built by
+ * Common/Types/StatusPage/StatusPageSubscriberUnsubscribe).
+ *
+ * Server-only on purpose, like VerificationCode: a token is minted from
+ * Node's CSPRNG and nothing here falls back to Math.random. If the platform
+ * cannot produce secure randomness, generation throws and the subscriber is
+ * not created, rather than being given a guessable link.
+ *
+ * It is not the six-digit subscriptionConfirmationToken. That one only has to
+ * survive the few minutes until an address confirms, and a million guesses
+ * cover it; this one stays valid for as long as the subscription does.
+ */
+
+/*
+ * What a presented token is compared against when there is nothing real to
+ * compare it with - no subscriber, no stored token, or a malformed value - so
+ * that a refusal costs the same full-length comparison as a wrong token.
+ */
+const COMPARISON_PLACEHOLDER: string = "0".repeat(
+  StatusPageSubscriberUnsubscribe.TOKEN_LENGTH,
+);
+
+export default class StatusPageSubscriberUnsubscribeToken {
+  // 32 random bytes as 64 lowercase hex characters, the pattern of PasswordHash.generateSalt.
+  public static generate(): string {
+    return crypto.randomBytes(32).toString("hex");
+  }
+
+  /*
+   * Whether the token from a link is the subscription's token.
+   *
+   * Constant time: `===` stops at the first differing character, which would
+   * tell someone guessing how much of a guess was right. Both sides are
+   * well-formed 64-character strings by the time they reach timingSafeEqual
+   * (which throws on a length mismatch); anything else is swapped for a
+   * placeholder of the same length first and the answer is false regardless,
+   * so a missing subscriber, a missing stored token and a wrong token all
+   * take the same path.
+   */
+  public static matches(data: {
+    stored: string | null | undefined;
+    presented: string | null | undefined;
+  }): boolean {
+    const presented: string =
+      typeof data.presented === "string" ? data.presented.toLowerCase() : "";
+
+    const storedIsUsable: boolean =
+      StatusPageSubscriberUnsubscribe.isWellFormedToken(data.stored);
+    const presentedIsUsable: boolean =
+      StatusPageSubscriberUnsubscribe.isWellFormedToken(presented);
+
+    const isEqual: boolean = crypto.timingSafeEqual(
+      Buffer.from(
+        storedIsUsable ? (data.stored as string) : COMPARISON_PLACEHOLDER,
+        "utf8",
+      ),
+      Buffer.from(
+        presentedIsUsable ? presented : COMPARISON_PLACEHOLDER,
+        "utf8",
+      ),
+    );
+
+    return storedIsUsable && presentedIsUsable && isEqual;
+  }
+}