release 1.0.3

README.md

@@ -16,14 +16,14 @@
   <a href="https://codecov.io/gh/logtide-dev/logtide"><img src="https://codecov.io/gh/logtide-dev/logtide/branch/main/graph/badge.svg" alt="Coverage"></a>
   <a href="https://hub.docker.com/r/logtide/backend"><img src="https://img.shields.io/docker/v/logtide/backend?label=docker&logo=docker" alt="Docker"></a>
   <a href="https://artifacthub.io/packages/helm/logtide/logtide"><img src="https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/logtide" alt="Artifact Hub"></a>
-  <img src="https://img.shields.io/badge/version-1.0.2-blue.svg" alt="Version">
+  <img src="https://img.shields.io/badge/version-1.0.3-blue.svg" alt="Version">
   <img src="https://img.shields.io/badge/license-AGPLv3-blue.svg" alt="License">
   <img src="https://img.shields.io/badge/status-beta-success.svg" alt="Status">
 </div>
 
 <br />
 
-> **🌊 LogTide 1.0.2 (public beta):** unified **Logs, Traces & Metrics** with a built-in **SIEM**, multi-engine storage (TimescaleDB / ClickHouse / MongoDB), uptime monitoring, parsing pipelines, and custom dashboards.
+> **🌊 LogTide 1.0.3 (public beta):** unified **Logs, Traces & Metrics** with a built-in **SIEM**, multi-engine storage (TimescaleDB / ClickHouse / MongoDB), uptime monitoring, parsing pipelines, and custom dashboards.
 
 ---
 
@@ -124,7 +124,7 @@ We host it for you. Perfect for testing. [**Sign up at logtide.dev**](https://lo
 
 ---
 
-## ✨ Core Features (v1.0.2)
+## ✨ Core Features (v1.0.3)
 
 ### Monitoring, Pipelines & Dashboards
 * 🩺 **Uptime Monitoring & Status Pages:** HTTP/TCP/heartbeat monitors with configurable thresholds, auto-created SIEM incidents on failure, scheduled maintenances, and public Uptime-Kuma-style status pages per project.

SECURITY.md

@@ -37,6 +37,7 @@ We thank the following researchers for responsibly disclosing security issues:
 
 - **Bertie** — cross-tenant authorization gaps in project-scoped routes (alert preview/creation, monitor creation, source map list/delete) and SSRF / internal port-scanning via HTTP/TCP monitors and webhook delivery. Fixed in 0.9.6.
 - **tonghuaroot** — SSRF in the alert/Sigma webhook delivery path, which still used the bypassable inline filter instead of the centralized `safeFetch` guard (incomplete-fix sibling-gap of the 0.9.6 hardening). Fixed in 0.9.7. (GHSA-7v53-pw6r-99vj)
+- **KIberblick.de** ([kiberblick.de](https://kiberblick.de)) — cross-tenant read on the dashboard API endpoints (organization taken from the attacker-supplied query string under API-key auth) and stored XSS via OTLP `service.name` in the service map; plus an open redirect on the auth-free login/register path, a DNS-rebinding gap in the SSRF guard's HTTP path, a first-admin bootstrap promotion race, and a capability-limit check-then-act race. Fixed in 1.0.3.
 
 ## Supported Versions
 

package.json

@@ -1,13 +1,13 @@
 {
   "name": "logtide",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "private": true,
   "description": "LogTide - Self-hosted log management platform",
   "author": "LogTide Team",
   "license": "AGPL-3.0",
   "pnpm": {
     "overrides": {
-      "esbuild": ">=0.28.1",
+      "esbuild": ">=0.25.0 <0.26.0",
       "shell-quote": ">=1.8.4",
       "form-data": ">=4.0.6",
       "vite": ">=6.4.3",

packages/backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logtide/backend",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "private": true,
   "description": "LogTide Backend API",
   "type": "module",
@@ -70,6 +70,7 @@
     "safe-regex2": "^5.0.0",
     "source-map": "^0.7.6",
     "tsx": "^4.21.0",
+    "undici": "^7.28.0",
     "zod": "^3.25.76"
   },
   "devDependencies": {

packages/backend/src/capabilities/index.ts

@@ -32,3 +32,4 @@ export {
 
 export { quotaFlagCache } from './quota-cache.js';
 export { QuotaEvaluator } from './quota-evaluator.js';
+export { withLimitLock } from './limit-lock.js';

packages/backend/src/capabilities/limit-lock.ts

@@ -0,0 +1,73 @@
+import { sql } from 'kysely';
+import { db } from '../database/connection.js';
+
+// Namespace for the (int4, int4) Postgres advisory lock keyspace used by
+// capability limit enforcement, kept distinct from other advisory locks.
+const CAP_LOCK_NAMESPACE = 0x4c54; // 'LT'
+
+/** Deterministic 32-bit signed hash (FNV-1a) for advisory lock keys. */
+function hash32(input: string): number {
+  let h = 2166136261;
+  for (let i = 0; i < input.length; i++) {
+    h ^= input.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return h | 0; // coerce to signed int32 for pg_advisory_xact_lock(int4, int4)
+}
+
+// In-process serialization tails, keyed by org+capability. This bounds the
+// number of callers that block on the DB advisory lock to ONE per key per
+// process, so concurrent requests don't each hold a transaction connection
+// while waiting (which would exhaust the pool).
+const localTails = new Map<string, Promise<void>>();
+
+async function runExclusiveInProcess<T>(key: string, fn: () => Promise<T>): Promise<T> {
+  const prevTail = localTails.get(key) ?? Promise.resolve();
+  let release!: () => void;
+  const tail = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  localTails.set(key, tail);
+  await prevTail; // wait for the previous holder of this key
+  try {
+    return await fn();
+  } finally {
+    release();
+    // Drop the entry once we are the last in line, to keep the map bounded.
+    if (localTails.get(key) === tail) localTails.delete(key);
+  }
+}
+
+/**
+ * Serialize a "count current usage -> assert under limit -> create" sequence
+ * against concurrent callers for the same (organization, capability).
+ *
+ * The enforcement pattern (COUNT -> assertWithinLimit -> insert) is a
+ * check-then-act: without serialization, parallel requests can each read a count
+ * below the limit and then all insert, pushing usage past a finite cap.
+ *
+ * Serialization happens at two levels: an in-process mutex per org+capability
+ * (so within one backend instance only one such create runs at a time, and
+ * waiters do not hold a database connection while queued), wrapping a
+ * transaction-scoped Postgres advisory lock on the same key (so the guarantee
+ * also holds across multiple backend instances sharing the database). The
+ * advisory lock is released automatically on commit/rollback.
+ *
+ * Different organizations and different capabilities use distinct keys and do
+ * not contend. When no finite limit is configured (the OSS default) the only
+ * added cost is one advisory lock/unlock round-trip.
+ */
+export async function withLimitLock<T>(
+  organizationId: string,
+  capabilityKey: string,
+  fn: () => Promise<T>,
+): Promise<T> {
+  const key = `${organizationId}:${capabilityKey}`;
+  const key2 = hash32(key);
+  return runExclusiveInProcess(key, () =>
+    db.transaction().execute(async (trx) => {
+      await sql`SELECT pg_advisory_xact_lock(${CAP_LOCK_NAMESPACE}, ${key2})`.execute(trx);
+      return fn();
+    }),
+  );
+}

packages/backend/src/modules/alerts/routes.ts

@@ -8,7 +8,7 @@ import { OrganizationsService } from '../organizations/service.js';
 import { projectsService } from '../projects/service.js';
 import { notificationChannelsService } from '../notification-channels/index.js';
 import { auditLogService } from '../audit-log/index.js';
-import { assertWithinLimit } from '../../capabilities/index.js';
+import { assertWithinLimit, withLimitLock } from '../../capabilities/index.js';
 
 const organizationsService = new OrganizationsService();
 
@@ -184,26 +184,27 @@ export async function alertsRoutes(fastify: FastifyInstance) {
       // Session-auth requests don't populate request.organizationId in the ALS
       // context, so we establish a scoped system context with the org from the
       // validated body. Same pattern as otlp/trace-routes.ts.
-      // Note: count -> insert is not atomic; a concurrent create can briefly
-      // exceed the cap by one. Acceptable for user-initiated rule creation.
-      await context.runAsSystem('alerts:create-limit-check', async () => {
-        await context.with({ organizationId: body.organizationId }, async () => {
-          const currentRuleCount = await alertsService.countAlertRules(body.organizationId);
-          await assertWithinLimit('alerts.max_rules', currentRuleCount);
-        });
-      });
-
+      // The count -> insert is serialized per org via withLimitLock so concurrent
+      // creates can't race past the cap.
       const { channelIds, alertType, baselineType, deviationMultiplier, minBaselineValue, cooldownMinutes, sustainedMinutes, metadataFilters, ...alertData } = body;
-      const alertRule = await alertsService.createAlertRule({
-        ...alertData,
-        alertType: alertType || 'threshold',
-        baselineType: baselineType || null,
-        deviationMultiplier: deviationMultiplier ?? null,
-        minBaselineValue: minBaselineValue ?? null,
-        cooldownMinutes: cooldownMinutes ?? null,
-        sustainedMinutes: sustainedMinutes ?? null,
-        emailRecipients: alertData.emailRecipients || [],
-        metadataFilters: metadataFilters ?? [],
+      const alertRule = await withLimitLock(body.organizationId, 'alerts.max_rules', async () => {
+        await context.runAsSystem('alerts:create-limit-check', async () => {
+          await context.with({ organizationId: body.organizationId }, async () => {
+            const currentRuleCount = await alertsService.countAlertRules(body.organizationId);
+            await assertWithinLimit('alerts.max_rules', currentRuleCount);
+          });
+        });
+        return alertsService.createAlertRule({
+          ...alertData,
+          alertType: alertType || 'threshold',
+          baselineType: baselineType || null,
+          deviationMultiplier: deviationMultiplier ?? null,
+          minBaselineValue: minBaselineValue ?? null,
+          cooldownMinutes: cooldownMinutes ?? null,
+          sustainedMinutes: sustainedMinutes ?? null,
+          emailRecipients: alertData.emailRecipients || [],
+          metadataFilters: metadataFilters ?? [],
+        });
       });
 
       // Associate channels with the alert rule

packages/backend/src/modules/api-keys/routes.ts

@@ -6,7 +6,7 @@ import { apiKeysService } from './service.js';
 import { authenticate } from '../auth/middleware.js';
 import { projectsService } from '../projects/service.js';
 import { auditLogService } from '../audit-log/index.js';
-import { assertWithinLimit } from '../../capabilities/index.js';
+import { assertWithinLimit, withLimitLock } from '../../capabilities/index.js';
 import { CapabilityError } from '../../capabilities/errors.js';
 
 const createApiKeySchema = z.object({
@@ -72,18 +72,20 @@ export async function apiKeysRoutes(fastify: FastifyInstance) {
         });
       }
 
-      await context.runAsSystem('apikeys:create-limit-check', async () => {
-        await context.with({ organizationId: project.organizationId }, async () => {
-          const count = await apiKeysService.countKeysForOrg(project.organizationId);
-          await assertWithinLimit('apikeys.max', count);
+      const result = await withLimitLock(project.organizationId, 'apikeys.max', async () => {
+        await context.runAsSystem('apikeys:create-limit-check', async () => {
+          await context.with({ organizationId: project.organizationId }, async () => {
+            const count = await apiKeysService.countKeysForOrg(project.organizationId);
+            await assertWithinLimit('apikeys.max', count);
+          });
         });
-      });
 
-      const result = await apiKeysService.createApiKey({
-        projectId,
-        name: body.name,
-        type: body.type,
-        allowedOrigins: body.allowedOrigins ?? null,
+        return apiKeysService.createApiKey({
+          projectId,
+          name: body.name,
+          type: body.type,
+          allowedOrigins: body.allowedOrigins ?? null,
+        });
       });
 
       await auditLogService.record({