@oneuptime/common 14.0.7 → 14.0.8

package/build/dist/Server/Middleware/SubscriberNotificationTestSendRateLimit.js

@@ -0,0 +1,190 @@
+import Redis from "../Infrastructure/Redis";
+import logger from "../Utils/Logger";
+import Response from "../Utils/Response";
+import ObjectID from "../../Types/ObjectID";
+import ServiceUnavailableException from "../../Types/Exception/ServiceUnavailableException";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+/*
+ * Request limiting for "Send test to me" (POST /send-test on the subscriber
+ * notification preview router), which emails the signed-in user the status
+ * page subscriber email they are previewing.
+ *
+ * The route only ever sends to the caller's own verified account email, so
+ * what this bounds is volume: every allowed request is a real email, through
+ * the status page's own SMTP server or the instance's mail provider, and
+ * nothing else stops a script (or a held-down button) from sending hundreds.
+ * The counter is per user, across every project, status page and incident:
+ * a user is one inbox.
+ *
+ * THIS FAILS CLOSED
+ *
+ * If Redis is unreachable, the test is refused with "try again later". That
+ * is the opposite of the choice VerificationCodeRateLimit makes, and the
+ * difference is what else bounds the requests: there, the code's expiry, its
+ * attempt counter and the resend cooldown all live in Postgres and stay in
+ * force; here this counter is the only bound on how much mail is sent. A
+ * test email is a convenience, and a Redis blip costs nothing but a retry.
+ */
+export var SubscriberNotificationTestSendRateLimitOutcome;
+(function (SubscriberNotificationTestSendRateLimitOutcome) {
+    SubscriberNotificationTestSendRateLimitOutcome["Allowed"] = "allowed";
+    SubscriberNotificationTestSendRateLimitOutcome["RateLimited"] = "rate-limited";
+    // Redis is unreachable, so the limit cannot be honoured.
+    SubscriberNotificationTestSendRateLimitOutcome["CounterUnavailable"] = "counter-unavailable";
+})(SubscriberNotificationTestSendRateLimitOutcome || (SubscriberNotificationTestSendRateLimitOutcome = {}));
+const KEY_PREFIX = "subnotiftest:rl:";
+/*
+ * Counter keys outlive their window by one full window, so a request landing
+ * on a boundary cannot read a key that was reclaimed mid-window.
+ */
+const TTL_MULTIPLIER = 2;
+// How often the "counter unavailable" condition may be logged.
+const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS = 60 * 1000;
+class SubscriberNotificationTestSendRateLimit {
+    // The limit in force, for tests and for operators' diagnostics.
+    static getConfig() {
+        return Object.assign({}, SubscriberNotificationTestSendRateLimit.config);
+    }
+    /*
+     * The signed-in user the request is billed to. The route sits behind
+     * UserMiddleware.requireUserAuthentication, so there always is one; if
+     * somehow there is not, every such request shares one bucket rather than
+     * each getting its own.
+     */
+    static resolveUserKey(req) {
+        var _a;
+        const userId = (_a = req === null || req === void 0 ? void 0 : req.userAuthorization) === null || _a === void 0 ? void 0 : _a.userId;
+        if (!userId) {
+            return "anonymous";
+        }
+        const key = userId.toString().toLowerCase();
+        return ObjectID.isValidUUID(key) ? key : "invalid";
+    }
+    /*
+     * Count this request against the user and decide. The counter is
+     * incremented on every request, a rejected one included, so a caller who
+     * keeps trying keeps their window pinned rather than getting a fresh
+     * allowance for free.
+     */
+    static async consume(data) {
+        const client = Redis.getClient();
+        if (!client || !Redis.isConnected()) {
+            return {
+                outcome: SubscriberNotificationTestSendRateLimitOutcome.CounterUnavailable,
+            };
+        }
+        const config = SubscriberNotificationTestSendRateLimit.config;
+        const windowMs = config.windowSeconds * 1000;
+        const windowIndex = Math.floor(Date.now() / windowMs);
+        const counterKey = `${KEY_PREFIX}u:${data.userKey}:${windowIndex}`;
+        try {
+            const count = await client.incr(counterKey);
+            if (typeof count !== "number") {
+                throw new Error("Rate limit counter returned a non-numeric value");
+            }
+            /*
+             * The expiry is set only by the request that created the key: setting
+             * it on every increment would slide the window for as long as the
+             * requests keep coming.
+             */
+            if (count === 1) {
+                await client.expire(counterKey, config.windowSeconds * TTL_MULTIPLIER);
+            }
+            if (count > config.perUserLimit) {
+                return {
+                    outcome: SubscriberNotificationTestSendRateLimitOutcome.RateLimited,
+                    retryAfterSeconds: SubscriberNotificationTestSendRateLimit.getSecondsUntilWindowEnd(config.windowSeconds),
+                    isFirstRejectionInWindow: count === config.perUserLimit + 1,
+                };
+            }
+            return {
+                outcome: SubscriberNotificationTestSendRateLimitOutcome.Allowed,
+            };
+        }
+        catch (err) {
+            if (SubscriberNotificationTestSendRateLimit.shouldLogCounterUnavailable()) {
+                logger.warn(`SubscriberNotificationTestSendRateLimit: counter failed for user ${data.userKey}`);
+                logger.warn(err);
+            }
+            return {
+                outcome: SubscriberNotificationTestSendRateLimitOutcome.CounterUnavailable,
+            };
+        }
+    }
+    /*
+     * Express middleware. Register after UserMiddleware (the counter is per
+     * user) and before the handler, so a flood is refused before it reads a
+     * single row.
+     */
+    static getMiddleware() {
+        return async (req, res, next) => {
+            const userKey = SubscriberNotificationTestSendRateLimit.resolveUserKey(req);
+            const decision = await SubscriberNotificationTestSendRateLimit.consume({
+                userKey: userKey,
+            });
+            if (decision.outcome ===
+                SubscriberNotificationTestSendRateLimitOutcome.RateLimited) {
+                if (decision.retryAfterSeconds) {
+                    SubscriberNotificationTestSendRateLimit.setRetryAfterHeader(res, decision.retryAfterSeconds);
+                }
+                if (decision.isFirstRejectionInWindow) {
+                    logger.warn(`SubscriberNotificationTestSendRateLimit: rejected test emails from user ${userKey} for the rest of this window`);
+                }
+                return Response.sendErrorResponse(req, res, new TooManyRequestsException("You have sent yourself too many test emails. Please try again later."));
+            }
+            if (decision.outcome ===
+                SubscriberNotificationTestSendRateLimitOutcome.CounterUnavailable) {
+                // Fails closed: see the note at the top of this file.
+                if (SubscriberNotificationTestSendRateLimit.shouldLogCounterUnavailable()) {
+                    logger.warn("SubscriberNotificationTestSendRateLimit: rate limit counter unavailable, refusing test emails");
+                }
+                return Response.sendErrorResponse(req, res, new ServiceUnavailableException("Test emails cannot be sent right now. Please try again in a few minutes."));
+            }
+            return next();
+        };
+    }
+    /*
+     * Remaining seconds in the current fixed window, so a refused caller is
+     * told to come back when the window actually rolls. The preview limiter
+     * (SubscriberNotificationPreviewRateLimit) counts in the same fixed
+     * windows, and uses this too.
+     */
+    static getSecondsUntilWindowEnd(windowSeconds) {
+        const windowMs = windowSeconds * 1000;
+        const msIntoWindow = Date.now() % windowMs;
+        return Math.max(1, Math.ceil((windowMs - msIntoWindow) / 1000));
+    }
+    /*
+     * A Redis outage means every request takes the unavailable path; one log
+     * line per interval makes the condition visible without burying the rest.
+     */
+    static shouldLogCounterUnavailable() {
+        const now = Date.now();
+        if (now -
+            SubscriberNotificationTestSendRateLimit.counterUnavailableLastLoggedAt <
+            COUNTER_UNAVAILABLE_LOG_INTERVAL_MS) {
+            return false;
+        }
+        SubscriberNotificationTestSendRateLimit.counterUnavailableLastLoggedAt =
+            now;
+        return true;
+    }
+    static setRetryAfterHeader(res, retryAfterSeconds) {
+        const setHeader = res["setHeader"];
+        if (typeof setHeader === "function") {
+            setHeader.call(res, "Retry-After", String(retryAfterSeconds));
+        }
+    }
+}
+/*
+ * Ten test emails a quarter of an hour: someone checking each status
+ * page's email in turn, or trying a template change a few times, is
+ * nowhere near it.
+ */
+SubscriberNotificationTestSendRateLimit.config = {
+    windowSeconds: 15 * 60,
+    perUserLimit: 10,
+};
+SubscriberNotificationTestSendRateLimit.counterUnavailableLastLoggedAt = 0;
+export default SubscriberNotificationTestSendRateLimit;
+//# sourceMappingURL=SubscriberNotificationTestSendRateLimit.js.map

package/build/dist/Server/Middleware/SubscriberNotificationTestSendRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SubscriberNotificationTestSendRateLimit.js","sourceRoot":"","sources":["../../../../Server/Middleware/SubscriberNotificationTestSendRateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,KAAqB,MAAM,yBAAyB,CAAC;AAO5D,OAAO,MAAM,MAAM,iBAAiB,CAAC;AACrC,OAAO,QAAQ,MAAM,mBAAmB,CAAC;AACzC,OAAO,QAAQ,MAAM,sBAAsB,CAAC;AAC5C,OAAO,2BAA2B,MAAM,mDAAmD,CAAC;AAC5F,OAAO,wBAAwB,MAAM,gDAAgD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,MAAM,CAAN,IAAY,8CAMX;AAND,WAAY,8CAA8C;IACxD,qEAAmB,CAAA;IACnB,8EAA4B,CAAA;IAE5B,yDAAyD;IACzD,4FAA0C,CAAA;AAC5C,CAAC,EANW,8CAA8C,KAA9C,8CAA8C,QAMzD;AAiBD,MAAM,UAAU,GAAW,kBAAkB,CAAC;AAE9C;;;GAGG;AACH,MAAM,cAAc,GAAW,CAAC,CAAC;AAEjC,+DAA+D;AAC/D,MAAM,mCAAmC,GAAW,EAAE,GAAG,IAAI,CAAC;AAE9D,MAAqB,uCAAuC;IAc1D,gEAAgE;IACzD,MAAM,CAAC,SAAS;QACrB,yBAAY,uCAAuC,CAAC,MAAM,EAAG;IAC/D,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,cAAc,CAAC,GAAmB;;QAC9C,MAAM,MAAM,GAAyB,MAAC,GAAwB,aAAxB,GAAG,uBAAH,GAAG,CACrC,iBAAiB,0CAAE,MAAM,CAAC;QAE9B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,MAAM,GAAG,GAAW,MAAM,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC;QAEpD,OAAO,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAE3B;QACC,MAAM,MAAM,GAAsB,KAAK,CAAC,SAAS,EAAE,CAAC;QAEpD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACpC,OAAO;gBACL,OAAO,EACL,8CAA8C,CAAC,kBAAkB;aACpE,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GACV,uCAAuC,CAAC,MAAM,CAAC;QACjD,MAAM,QAAQ,GAAW,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QACrD,MAAM,WAAW,GAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAW,GAAG,UAAU,KAAK,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;QAE3E,IAAI,CAAC;YACH,MAAM,KAAK,GAAW,MAAM,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAEpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YAED;;;;eAIG;YACH,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAChB,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,aAAa,GAAG,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,IAAI,KAAK,GAAG,MAAM,CAAC,YAAY,EAAE,CAAC;gBAChC,OAAO;oBACL,OAAO,EAAE,8CAA8C,CAAC,WAAW;oBACnE,iBAAiB,EACf,uCAAuC,CAAC,wBAAwB,CAC9D,MAAM,CAAC,aAAa,CACrB;oBACH,wBAAwB,EAAE,KAAK,KAAK,MAAM,CAAC,YAAY,GAAG,CAAC;iBAC5D,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,8CAA8C,CAAC,OAAO;aAChE,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,uCAAuC,CAAC,2BAA2B,EAAE,EACrE,CAAC;gBACD,MAAM,CAAC,IAAI,CACT,oEAAoE,IAAI,CAAC,OAAO,EAAE,CACnF,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnB,CAAC;YAED,OAAO;gBACL,OAAO,EACL,8CAA8C,CAAC,kBAAkB;aACpE,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,aAAa;QAKzB,OAAO,KAAK,EACV,GAAmB,EACnB,GAAoB,EACpB,IAAkB,EACH,EAAE;YACjB,MAAM,OAAO,GACX,uCAAuC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAE9D,MAAM,QAAQ,GACZ,MAAM,uCAAuC,CAAC,OAAO,CAAC;gBACpD,OAAO,EAAE,OAAO;aACjB,CAAC,CAAC;YAEL,IACE,QAAQ,CAAC,OAAO;gBAChB,8CAA8C,CAAC,WAAW,EAC1D,CAAC;gBACD,IAAI,QAAQ,CAAC,iBAAiB,EAAE,CAAC;oBAC/B,uCAAuC,CAAC,mBAAmB,CACzD,GAAG,EACH,QAAQ,CAAC,iBAAiB,CAC3B,CAAC;gBACJ,CAAC;gBAED,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;oBACtC,MAAM,CAAC,IAAI,CACT,2EAA2E,OAAO,8BAA8B,CACjH,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,wBAAwB,CAC1B,sEAAsE,CACvE,CACF,CAAC;YACJ,CAAC;YAED,IACE,QAAQ,CAAC,OAAO;gBAChB,8CAA8C,CAAC,kBAAkB,EACjE,CAAC;gBACD,sDAAsD;gBACtD,IACE,uCAAuC,CAAC,2BAA2B,EAAE,EACrE,CAAC;oBACD,MAAM,CAAC,IAAI,CACT,+FAA+F,CAChG,CAAC;gBACJ,CAAC;gBAED,OAAO,QAAQ,CAAC,iBAAiB,CAC/B,GAAG,EACH,GAAG,EACH,IAAI,2BAA2B,CAC7B,0EAA0E,CAC3E,CACF,CAAC;YACJ,CAAC;YAED,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACI,MAAM,CAAC,wBAAwB,CAAC,aAAqB;QAC1D,MAAM,QAAQ,GAAW,aAAa,GAAG,IAAI,CAAC;QAC9C,MAAM,YAAY,GAAW,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;QAEnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC;IAED;;;OAGG;IACK,MAAM,CAAC,2BAA2B;QACxC,MAAM,GAAG,GAAW,IAAI,CAAC,GAAG,EAAE,CAAC;QAE/B,IACE,GAAG;YACD,uCAAuC,CAAC,8BAA8B;YACxE,mCAAmC,EACnC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,uCAAuC,CAAC,8BAA8B;YACpE,GAAG,CAAC;QAEN,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,MAAM,CAAC,mBAAmB,CAChC,GAAoB,EACpB,iBAAyB;QAEzB,MAAM,SAAS,GAAa,GAA0C,CACpE,WAAW,CACZ,CAAC;QAEF,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YACnC,SAAmD,CAAC,IAAI,CACvD,GAAG,EACH,aAAa,EACb,MAAM,CAAC,iBAAiB,CAAC,CAC1B,CAAC;QACJ,CAAC;IACH,CAAC;;AAxOD;;;;GAIG;AACqB,8CAAM,GAC5B;IACE,aAAa,EAAE,EAAE,GAAG,EAAE;IACtB,YAAY,EAAE,EAAE;CACjB,CAAC;AAEW,sEAA8B,GAAW,CAAC,CAAC;eAZvC,uCAAuC"}

package/build/dist/Server/Services/DatabaseService.js

@@ -2677,6 +2677,44 @@ class DatabaseService extends BaseService {
      * caller of this path gets it, including ones not written yet.
      */
     async updateColumnsByIdWithoutHooks(input) {
+        const statement = this.buildColumnsByIdUpdateStatement(input, "updateColumnsByIdWithoutHooks");
+        if (!statement) {
+            return;
+        }
+        const sql = `UPDATE "${statement.tableName}" SET ${statement.setSql} WHERE ${statement.whereSql}`;
+        await this.getRepository().manager.query(sql, statement.params);
+    }
+    /*
+     * The same single-statement, hook-free, no-version-bump write as
+     * `updateColumnsByIdWithoutHooks` with its `expectedData` guard, which
+     * also says whether it happened: true when the row matched every expected
+     * value and was written, false when another writer had changed it first
+     * (or it no longer exists).
+     *
+     * This is what lets two workers race for one row and have exactly one of
+     * them win - a job claiming a Pending notification by moving it to
+     * InProgress, say, where both would otherwise send it. The check and the
+     * write are one statement, so there is no window between them.
+     *
+     * The UPDATE sits in a CTE so the statement is a SELECT of the rows it
+     * wrote (see updateColumnsByIdIfUnlockedWithoutHooks for why a bare
+     * UPDATE ... RETURNING cannot tell the two cases apart through TypeORM).
+     */
+    async compareAndSetColumnsByIdWithoutHooks(input) {
+        const statement = this.buildColumnsByIdUpdateStatement(input, "compareAndSetColumnsByIdWithoutHooks");
+        if (!statement) {
+            return false;
+        }
+        const sql = `WITH "updated" AS (UPDATE "${statement.tableName}" SET ${statement.setSql} WHERE ${statement.whereSql} RETURNING "${statement.primaryColumnName}") SELECT "${statement.primaryColumnName}" FROM "updated"`;
+        const result = await this.getRepository().manager.query(sql, statement.params);
+        return Array.isArray(result) && result.length > 0;
+    }
+    /*
+     * The SET and WHERE clauses of a hook-free write to one row by id, with
+     * every value bound as a parameter. Null when there is nothing to set.
+     * `methodName` is the public method the errors are reported under.
+     */
+    buildColumnsByIdUpdateStatement(input, methodName) {
         var _a;
         if (!input.id) {
             throw new BadDataException("id is required");
@@ -2695,7 +2733,7 @@ class DatabaseService extends BaseService {
         for (const [propertyName, value] of Object.entries(data)) {
             const column = metadata.findColumnWithPropertyName(propertyName);
             if (!column) {
-                throw new BadDataException(`updateColumnsByIdWithoutHooks: unknown column "${propertyName}" on "${metadata.tableName}"`);
+                throw new BadDataException(`${methodName}: unknown column "${propertyName}" on "${metadata.tableName}"`);
             }
             /*
              * PartialEntity permits `() => string` SQL-expression values, but this
@@ -2704,7 +2742,7 @@ class DatabaseService extends BaseService {
              * loudly rather than binding a function object.
              */
             if (typeof value === "function") {
-                throw new BadDataException(`updateColumnsByIdWithoutHooks: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`);
+                throw new BadDataException(`${methodName}: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`);
             }
             /*
              * Run the value through the driver's persist path so column
@@ -2717,7 +2755,7 @@ class DatabaseService extends BaseService {
             setClauses.push(`"${column.databaseName}" = $${params.length}`);
         }
         if (setClauses.length === 0) {
-            return;
+            return null;
         }
         // The raw path has no entity machinery to touch updateDate — do it here.
         if (metadata.updateDateColumn && !input.skipUpdateDateColumn) {
@@ -2731,16 +2769,21 @@ class DatabaseService extends BaseService {
         for (const [propertyName, value] of Object.entries((input.expectedData || {}))) {
             const column = metadata.findColumnWithPropertyName(propertyName);
             if (!column) {
-                throw new BadDataException(`updateColumnsByIdWithoutHooks: unknown expected column "${propertyName}" on "${metadata.tableName}"`);
+                throw new BadDataException(`${methodName}: unknown expected column "${propertyName}" on "${metadata.tableName}"`);
             }
             if (typeof value === "function") {
-                throw new BadDataException(`updateColumnsByIdWithoutHooks: SQL-expression expected values are not supported (column "${propertyName}"); pass a literal value.`);
+                throw new BadDataException(`${methodName}: SQL-expression expected values are not supported (column "${propertyName}"); pass a literal value.`);
             }
             params.push(driver.preparePersistentValue(value, column));
             whereClauses.push(`"${column.databaseName}" IS NOT DISTINCT FROM $${params.length}`);
         }
-        const sql = `UPDATE "${metadata.tableName}" SET ${setClauses.join(", ")} WHERE ${whereClauses.join(" AND ")}`;
-        await repository.manager.query(sql, params);
+        return {
+            tableName: metadata.tableName,
+            primaryColumnName: primaryColumnName,
+            setSql: setClauses.join(", "),
+            whereSql: whereClauses.join(" AND "),
+            params: params,
+        };
     }
     /*
      * Same single-statement, hook-free, no-version-bump write as
@@ -3122,6 +3165,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], DatabaseService.prototype, "updateColumnsByIdWithoutHooks", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DatabaseService.prototype, "compareAndSetColumnsByIdWithoutHooks", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),