@oneuptime/common 14.0.6 → 14.0.8

package/Server/Middleware/SubscriberNotificationTestSendRateLimit.ts

@@ -0,0 +1,304 @@
+import Redis, { ClientType } from "../Infrastructure/Redis";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+  OneUptimeRequest,
+} from "../Utils/Express";
+import logger from "../Utils/Logger";
+import Response from "../Utils/Response";
+import ObjectID from "../../Types/ObjectID";
+import ServiceUnavailableException from "../../Types/Exception/ServiceUnavailableException";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+
+/*
+ * Request limiting for "Send test to me" (POST /send-test on the subscriber
+ * notification preview router), which emails the signed-in user the status
+ * page subscriber email they are previewing.
+ *
+ * The route only ever sends to the caller's own verified account email, so
+ * what this bounds is volume: every allowed request is a real email, through
+ * the status page's own SMTP server or the instance's mail provider, and
+ * nothing else stops a script (or a held-down button) from sending hundreds.
+ * The counter is per user, across every project, status page and incident:
+ * a user is one inbox.
+ *
+ * THIS FAILS CLOSED
+ *
+ * If Redis is unreachable, the test is refused with "try again later". That
+ * is the opposite of the choice VerificationCodeRateLimit makes, and the
+ * difference is what else bounds the requests: there, the code's expiry, its
+ * attempt counter and the resend cooldown all live in Postgres and stay in
+ * force; here this counter is the only bound on how much mail is sent. A
+ * test email is a convenience, and a Redis blip costs nothing but a retry.
+ */
+
+export enum SubscriberNotificationTestSendRateLimitOutcome {
+  Allowed = "allowed",
+  RateLimited = "rate-limited",
+
+  // Redis is unreachable, so the limit cannot be honoured.
+  CounterUnavailable = "counter-unavailable",
+}
+
+export interface SubscriberNotificationTestSendRateLimitDecision {
+  outcome: SubscriberNotificationTestSendRateLimitOutcome;
+  retryAfterSeconds?: number | undefined;
+  /*
+   * True only on the request that first crossed the line in this window, so
+   * a flood produces one log line per user per window.
+   */
+  isFirstRejectionInWindow?: boolean | undefined;
+}
+
+export interface SubscriberNotificationTestSendRateLimitConfig {
+  windowSeconds: number;
+  perUserLimit: number;
+}
+
+const KEY_PREFIX: string = "subnotiftest:rl:";
+
+/*
+ * Counter keys outlive their window by one full window, so a request landing
+ * on a boundary cannot read a key that was reclaimed mid-window.
+ */
+const TTL_MULTIPLIER: number = 2;
+
+// How often the "counter unavailable" condition may be logged.
+const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS: number = 60 * 1000;
+
+export default class SubscriberNotificationTestSendRateLimit {
+  /*
+   * Ten test emails a quarter of an hour: someone checking each status
+   * page's email in turn, or trying a template change a few times, is
+   * nowhere near it.
+   */
+  private static readonly config: SubscriberNotificationTestSendRateLimitConfig =
+    {
+      windowSeconds: 15 * 60,
+      perUserLimit: 10,
+    };
+
+  private static counterUnavailableLastLoggedAt: number = 0;
+
+  // The limit in force, for tests and for operators' diagnostics.
+  public static getConfig(): SubscriberNotificationTestSendRateLimitConfig {
+    return { ...SubscriberNotificationTestSendRateLimit.config };
+  }
+
+  /*
+   * The signed-in user the request is billed to. The route sits behind
+   * UserMiddleware.requireUserAuthentication, so there always is one; if
+   * somehow there is not, every such request shares one bucket rather than
+   * each getting its own.
+   */
+  public static resolveUserKey(req: ExpressRequest): string {
+    const userId: ObjectID | undefined = (req as OneUptimeRequest)
+      ?.userAuthorization?.userId;
+
+    if (!userId) {
+      return "anonymous";
+    }
+
+    const key: string = userId.toString().toLowerCase();
+
+    return ObjectID.isValidUUID(key) ? key : "invalid";
+  }
+
+  /*
+   * Count this request against the user and decide. The counter is
+   * incremented on every request, a rejected one included, so a caller who
+   * keeps trying keeps their window pinned rather than getting a fresh
+   * allowance for free.
+   */
+  public static async consume(data: {
+    userKey: string;
+  }): Promise<SubscriberNotificationTestSendRateLimitDecision> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      return {
+        outcome:
+          SubscriberNotificationTestSendRateLimitOutcome.CounterUnavailable,
+      };
+    }
+
+    const config: SubscriberNotificationTestSendRateLimitConfig =
+      SubscriberNotificationTestSendRateLimit.config;
+    const windowMs: number = config.windowSeconds * 1000;
+    const windowIndex: number = Math.floor(Date.now() / windowMs);
+    const counterKey: string = `${KEY_PREFIX}u:${data.userKey}:${windowIndex}`;
+
+    try {
+      const count: number = await client.incr(counterKey);
+
+      if (typeof count !== "number") {
+        throw new Error("Rate limit counter returned a non-numeric value");
+      }
+
+      /*
+       * The expiry is set only by the request that created the key: setting
+       * it on every increment would slide the window for as long as the
+       * requests keep coming.
+       */
+      if (count === 1) {
+        await client.expire(counterKey, config.windowSeconds * TTL_MULTIPLIER);
+      }
+
+      if (count > config.perUserLimit) {
+        return {
+          outcome: SubscriberNotificationTestSendRateLimitOutcome.RateLimited,
+          retryAfterSeconds:
+            SubscriberNotificationTestSendRateLimit.getSecondsUntilWindowEnd(
+              config.windowSeconds,
+            ),
+          isFirstRejectionInWindow: count === config.perUserLimit + 1,
+        };
+      }
+
+      return {
+        outcome: SubscriberNotificationTestSendRateLimitOutcome.Allowed,
+      };
+    } catch (err) {
+      if (
+        SubscriberNotificationTestSendRateLimit.shouldLogCounterUnavailable()
+      ) {
+        logger.warn(
+          `SubscriberNotificationTestSendRateLimit: counter failed for user ${data.userKey}`,
+        );
+        logger.warn(err);
+      }
+
+      return {
+        outcome:
+          SubscriberNotificationTestSendRateLimitOutcome.CounterUnavailable,
+      };
+    }
+  }
+
+  /*
+   * Express middleware. Register after UserMiddleware (the counter is per
+   * user) and before the handler, so a flood is refused before it reads a
+   * single row.
+   */
+  public static getMiddleware(): (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ) => Promise<void> {
+    return async (
+      req: ExpressRequest,
+      res: ExpressResponse,
+      next: NextFunction,
+    ): Promise<void> => {
+      const userKey: string =
+        SubscriberNotificationTestSendRateLimit.resolveUserKey(req);
+
+      const decision: SubscriberNotificationTestSendRateLimitDecision =
+        await SubscriberNotificationTestSendRateLimit.consume({
+          userKey: userKey,
+        });
+
+      if (
+        decision.outcome ===
+        SubscriberNotificationTestSendRateLimitOutcome.RateLimited
+      ) {
+        if (decision.retryAfterSeconds) {
+          SubscriberNotificationTestSendRateLimit.setRetryAfterHeader(
+            res,
+            decision.retryAfterSeconds,
+          );
+        }
+
+        if (decision.isFirstRejectionInWindow) {
+          logger.warn(
+            `SubscriberNotificationTestSendRateLimit: rejected test emails from user ${userKey} for the rest of this window`,
+          );
+        }
+
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new TooManyRequestsException(
+            "You have sent yourself too many test emails. Please try again later.",
+          ),
+        );
+      }
+
+      if (
+        decision.outcome ===
+        SubscriberNotificationTestSendRateLimitOutcome.CounterUnavailable
+      ) {
+        // Fails closed: see the note at the top of this file.
+        if (
+          SubscriberNotificationTestSendRateLimit.shouldLogCounterUnavailable()
+        ) {
+          logger.warn(
+            "SubscriberNotificationTestSendRateLimit: rate limit counter unavailable, refusing test emails",
+          );
+        }
+
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new ServiceUnavailableException(
+            "Test emails cannot be sent right now. Please try again in a few minutes.",
+          ),
+        );
+      }
+
+      return next();
+    };
+  }
+
+  /*
+   * Remaining seconds in the current fixed window, so a refused caller is
+   * told to come back when the window actually rolls. The preview limiter
+   * (SubscriberNotificationPreviewRateLimit) counts in the same fixed
+   * windows, and uses this too.
+   */
+  public static getSecondsUntilWindowEnd(windowSeconds: number): number {
+    const windowMs: number = windowSeconds * 1000;
+    const msIntoWindow: number = Date.now() % windowMs;
+
+    return Math.max(1, Math.ceil((windowMs - msIntoWindow) / 1000));
+  }
+
+  /*
+   * A Redis outage means every request takes the unavailable path; one log
+   * line per interval makes the condition visible without burying the rest.
+   */
+  private static shouldLogCounterUnavailable(): boolean {
+    const now: number = Date.now();
+
+    if (
+      now -
+        SubscriberNotificationTestSendRateLimit.counterUnavailableLastLoggedAt <
+      COUNTER_UNAVAILABLE_LOG_INTERVAL_MS
+    ) {
+      return false;
+    }
+
+    SubscriberNotificationTestSendRateLimit.counterUnavailableLastLoggedAt =
+      now;
+
+    return true;
+  }
+
+  private static setRetryAfterHeader(
+    res: ExpressResponse,
+    retryAfterSeconds: number,
+  ): void {
+    const setHeader: unknown = (res as unknown as Record<string, unknown>)[
+      "setHeader"
+    ];
+
+    if (typeof setHeader === "function") {
+      (setHeader as (name: string, value: string) => void).call(
+        res,
+        "Retry-After",
+        String(retryAfterSeconds),
+      );
+    }
+  }
+}

package/Server/Services/AlertService.ts

@@ -20,7 +20,9 @@ import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import TeamMemberService from "./TeamMemberService";
 import UserService from "./UserService";
 import URL from "../../Types/API/URL";
-import { getSloAffectedResourceMarkdownLines } from "../../Utils/Slo/SloAffectedResourceMarkdown";
+import LinkedAffectedResources, {
+  LinkedAffectedResource,
+} from "../Utils/AffectedResources/LinkedAffectedResources";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
@@ -73,7 +75,6 @@ import AlertReminderRule from "../../Models/DatabaseModels/AlertReminderRule";
 import WorkspaceType from "../../Types/Workspace/WorkspaceType";
 import NotificationRuleWorkspaceChannel from "../../Types/Workspace/NotificationRules/NotificationRuleWorkspaceChannel";
 import AlertWorkspaceMessages from "../Utils/Workspace/WorkspaceMessages/Alert";
-import Monitor from "../../Models/DatabaseModels/Monitor";
 import ServiceLevelObjective from "../../Models/DatabaseModels/ServiceLevelObjective";
 import MonitorService from "./MonitorService";
 import { MessageBlocksByWorkspaceType } from "./WorkspaceNotificationRuleService";
@@ -1024,19 +1025,6 @@ export class Service extends DatabaseService<Model> {
           labels: {
             name: true,
           },
-          monitor: {
-            name: true,
-            _id: true,
-          },
-          /*
-           * This read runs as root, so projectId comes along and the feed
-           * names only this project's SLOs (getSloAffectedResourceMarkdownLines).
-           */
-          serviceLevelObjectives: {
-            name: true,
-            _id: true,
-            projectId: true,
-          },
         },
         props: {
           isRoot: true,
@@ -1067,31 +1055,28 @@ ${alert.description || "No description provided."}
       }
 
       /*
-       * The monitor, then the SLOs this alert is linked to. A burn-rate alert
-       * has no monitor, so its SLO is the only resource there is to name -
-       * and the feed's only way back to the objective that raised it. The SLO
-       * link is built inline: ServiceLevelObjectiveService cannot be imported
-       * here (it reaches this service through the burn-rate rule service).
+       * Everything the alert's Affected Resources card lists: its monitor,
+       * the hosts, clusters and services it is attached to, then its SLOs. A
+       * burn-rate alert has no monitor, so its SLO is the only resource there
+       * is to name - and the feed's only way back to the objective that
+       * raised it.
        */
-      const sloLines: Array<string> =
-        alert.serviceLevelObjectives && alert.serviceLevelObjectives.length > 0
-          ? getSloAffectedResourceMarkdownLines({
-              dashboardUrl: await DatabaseConfig.getDashboardUrl(),
-              projectId: alert.projectId!,
-              serviceLevelObjectives: alert.serviceLevelObjectives,
-            })
-          : [];
+      const resources: Array<LinkedAffectedResource> =
+        await LinkedAffectedResources.readForAlert({
+          service: this,
+          projectId: alert.projectId!,
+          alertId: alert.id!,
+        });
 
-      if (alert.monitor || sloLines.length > 0) {
+      if (resources.length > 0) {
         feedInfoInMarkdown += `🌎 **Resources Affected**:\n`;
 
-        if (alert.monitor) {
-          const monitor: Monitor = alert.monitor;
-          feedInfoInMarkdown += `- [${monitor.name}](${(await MonitorService.getMonitorLinkInDashboard(alert.projectId!, monitor.id!)).toString()})\n`;
-        }
-
-        for (const sloLine of sloLines) {
-          feedInfoInMarkdown += `${sloLine}\n`;
+        for (const resourceLine of LinkedAffectedResources.getMarkdownLines({
+          dashboardUrl: await DatabaseConfig.getDashboardUrl(),
+          projectId: alert.projectId!,
+          resources: resources,
+        })) {
+          feedInfoInMarkdown += `${resourceLine}\n`;
         }
 
         feedInfoInMarkdown += `\n\n`;
@@ -1768,6 +1753,12 @@ ${alertSeverity.name}
     notifyOwners: boolean;
     rootCause: string | undefined;
     stateChangeLog: JSONObject | undefined;
+    /*
+     * The user the change is credited to (the alert's feed names them), for
+     * a change a user asked for that is written on their behalf. Unset for
+     * changes the system makes on its own.
+     */
+    createdByUserId?: ObjectID | undefined;
     props: DatabaseCommonInteractionProps | undefined;
   }): Promise<void> {
     const {
@@ -1777,6 +1768,7 @@ ${alertSeverity.name}
       notifyOwners,
       rootCause,
       stateChangeLog,
+      createdByUserId,
       props,
     } = data;
 
@@ -1822,6 +1814,10 @@ ${alertSeverity.name}
       statusTimeline.rootCause = rootCause;
     }
 
+    if (createdByUserId) {
+      statusTimeline.createdByUserId = createdByUserId;
+    }
+
     await AlertStateTimelineService.create({
       data: statusTimeline,
       props: props || {},

package/Server/Services/DatabaseService.ts

@@ -109,6 +109,15 @@ const RULE_CRITERIA_RELATION_OPERATORS: ReadonlySet<RuleCriteriaOperator> =
     RuleCriteriaOperator.HasNoneOf,
   ]);
 
+// A hook-free write to one row by id, ready to run (see buildColumnsByIdUpdateStatement).
+interface ColumnsByIdUpdateStatement {
+  tableName: string;
+  primaryColumnName: string;
+  setSql: string;
+  whereSql: string;
+  params: Array<unknown>;
+}
+
 class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   public modelType!: { new (): TBaseModel };
   private model!: TBaseModel;
@@ -3821,6 +3830,78 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
      */
     skipUpdateDateColumn?: boolean;
   }): Promise<void> {
+    const statement: ColumnsByIdUpdateStatement | null =
+      this.buildColumnsByIdUpdateStatement(
+        input,
+        "updateColumnsByIdWithoutHooks",
+      );
+
+    if (!statement) {
+      return;
+    }
+
+    const sql: string = `UPDATE "${statement.tableName}" SET ${statement.setSql} WHERE ${statement.whereSql}`;
+
+    await this.getRepository().manager.query(sql, statement.params);
+  }
+
+  /*
+   * The same single-statement, hook-free, no-version-bump write as
+   * `updateColumnsByIdWithoutHooks` with its `expectedData` guard, which
+   * also says whether it happened: true when the row matched every expected
+   * value and was written, false when another writer had changed it first
+   * (or it no longer exists).
+   *
+   * This is what lets two workers race for one row and have exactly one of
+   * them win - a job claiming a Pending notification by moving it to
+   * InProgress, say, where both would otherwise send it. The check and the
+   * write are one statement, so there is no window between them.
+   *
+   * The UPDATE sits in a CTE so the statement is a SELECT of the rows it
+   * wrote (see updateColumnsByIdIfUnlockedWithoutHooks for why a bare
+   * UPDATE ... RETURNING cannot tell the two cases apart through TypeORM).
+   */
+  @CaptureSpan()
+  public async compareAndSetColumnsByIdWithoutHooks(input: {
+    id: ObjectID;
+    data: PartialEntity<TBaseModel>;
+    expectedData: PartialEntity<TBaseModel>;
+    skipUpdateDateColumn?: boolean;
+  }): Promise<boolean> {
+    const statement: ColumnsByIdUpdateStatement | null =
+      this.buildColumnsByIdUpdateStatement(
+        input,
+        "compareAndSetColumnsByIdWithoutHooks",
+      );
+
+    if (!statement) {
+      return false;
+    }
+
+    const sql: string = `WITH "updated" AS (UPDATE "${statement.tableName}" SET ${statement.setSql} WHERE ${statement.whereSql} RETURNING "${statement.primaryColumnName}") SELECT "${statement.primaryColumnName}" FROM "updated"`;
+
+    const result: unknown = await this.getRepository().manager.query(
+      sql,
+      statement.params,
+    );
+
+    return Array.isArray(result) && result.length > 0;
+  }
+
+  /*
+   * The SET and WHERE clauses of a hook-free write to one row by id, with
+   * every value bound as a parameter. Null when there is nothing to set.
+   * `methodName` is the public method the errors are reported under.
+   */
+  private buildColumnsByIdUpdateStatement(
+    input: {
+      id: ObjectID;
+      data: PartialEntity<TBaseModel>;
+      expectedData?: PartialEntity<TBaseModel> | undefined;
+      skipUpdateDateColumn?: boolean | undefined;
+    },
+    methodName: string,
+  ): ColumnsByIdUpdateStatement | null {
     if (!input.id) {
       throw new BadDataException("id is required");
     }
@@ -3846,7 +3927,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         metadata.findColumnWithPropertyName(propertyName);
       if (!column) {
         throw new BadDataException(
-          `updateColumnsByIdWithoutHooks: unknown column "${propertyName}" on "${metadata.tableName}"`,
+          `${methodName}: unknown column "${propertyName}" on "${metadata.tableName}"`,
         );
       }
       /*
@@ -3857,7 +3938,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
        */
       if (typeof value === "function") {
         throw new BadDataException(
-          `updateColumnsByIdWithoutHooks: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`,
+          `${methodName}: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`,
         );
       }
       /*
@@ -3872,7 +3953,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     }
 
     if (setClauses.length === 0) {
-      return;
+      return null;
     }
 
     // The raw path has no entity machinery to touch updateDate — do it here.
@@ -3898,13 +3979,13 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
       if (!column) {
         throw new BadDataException(
-          `updateColumnsByIdWithoutHooks: unknown expected column "${propertyName}" on "${metadata.tableName}"`,
+          `${methodName}: unknown expected column "${propertyName}" on "${metadata.tableName}"`,
         );
       }
 
       if (typeof value === "function") {
         throw new BadDataException(
-          `updateColumnsByIdWithoutHooks: SQL-expression expected values are not supported (column "${propertyName}"); pass a literal value.`,
+          `${methodName}: SQL-expression expected values are not supported (column "${propertyName}"); pass a literal value.`,
         );
       }
 
@@ -3914,11 +3995,13 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       );
     }
 
-    const sql: string = `UPDATE "${metadata.tableName}" SET ${setClauses.join(
-      ", ",
-    )} WHERE ${whereClauses.join(" AND ")}`;
-
-    await repository.manager.query(sql, params);
+    return {
+      tableName: metadata.tableName,
+      primaryColumnName: primaryColumnName,
+      setSql: setClauses.join(", "),
+      whereSql: whereClauses.join(" AND "),
+      params: params,
+    };
   }
 
   /*