@oneuptime/common 11.5.8 → 11.5.10

package/UI/Utils/DownloadFile.ts

@@ -0,0 +1,54 @@
+/*
+ * Triggers a browser download for content generated in the page.
+ *
+ * The object URL is revoked once the click has been dispatched so a large
+ * export (a PDF can run to megabytes) is not pinned in memory until the user
+ * navigates away.
+ */
+export default function downloadFile(data: {
+  content: Blob | string;
+  filename: string;
+  mimeType?: string | undefined;
+}): void {
+  const blob: Blob =
+    data.content instanceof Blob
+      ? data.content
+      : new Blob([data.content], {
+          type: data.mimeType || "text/plain;charset=utf-8;",
+        });
+
+  const url: string = window.URL.createObjectURL(blob);
+  const anchor: HTMLAnchorElement = document.createElement("a");
+  anchor.href = url;
+  anchor.download = data.filename;
+  anchor.rel = "noopener";
+  document.body.appendChild(anchor);
+  anchor.click();
+  document.body.removeChild(anchor);
+  window.URL.revokeObjectURL(url);
+}
+
+/*
+ * Slugifies a label and stamps it with the export time, so repeated exports of
+ * the same conversation land as distinct files. Mirrors the naming used by the
+ * CSV export (TableColumnsToCsv.getExportFilename).
+ */
+export function getExportFilename(data: {
+  label: string;
+  extension: string;
+  exportedAt: Date;
+}): string {
+  const slug: string =
+    data.label
+      .replace(/[^a-zA-Z0-9-_]+/g, "-")
+      .replace(/^-+|-+$/g, "")
+      .toLowerCase()
+      .substring(0, 60) || "ai-conversation";
+
+  const timestamp: string = data.exportedAt
+    .toISOString()
+    .replace(/[:.]/g, "-")
+    .slice(0, 19);
+
+  return `${slug}-${timestamp}.${data.extension}`;
+}

package/UI/Utils/User.ts

@@ -213,15 +213,54 @@ export default class UserUtil {
     const result: Dictionary<string> = {};
 
     for (const key in localStorageItems) {
-      if (!localStorageItems[key]) {
+      const value: string = localStorageItems[key] as string;
+
+      /*
+       * Older versions of the marketing site stored the literal strings
+       * "null" / "undefined" for missing utm params. Filter those out so
+       * they never end up on the User record.
+       */
+      if (!value || value === "null" || value === "undefined") {
         continue;
       }
 
       if (key.startsWith("utm")) {
-        result[key] = localStorageItems[key] as string;
+        result[key] = value;
       }
     }
 
     return result;
   }
+
+  // Ad platform click IDs (gclid, fbclid, etc.) stored by the marketing site.
+  public static getAttributionClickIds(): JSONObject | null {
+    return UserUtil.parseJsonLocalStorageItem("clickIds");
+  }
+
+  // First attributed touch (utm params, click IDs, landing URL) — never overwritten.
+  public static getFirstTouchAttribution(): JSONObject | null {
+    return UserUtil.parseJsonLocalStorageItem("firstTouch");
+  }
+
+  private static parseJsonLocalStorageItem(key: string): JSONObject | null {
+    /*
+     * LocalStorage.getItem JSON-parses stored strings when it can, so this
+     * may already be an object; fall back to parsing the raw string.
+     */
+    let value: JSONValue = LocalStorage.getItem(key);
+
+    if (typeof value === "string") {
+      try {
+        value = JSON.parse(value);
+      } catch {
+        return null;
+      }
+    }
+
+    if (value && typeof value === "object" && !Array.isArray(value)) {
+      return value as JSONObject;
+    }
+
+    return null;
+  }
 }

package/Utils/Analytics.ts

@@ -33,14 +33,16 @@ export default class Analytics {
   }
 
   public capture(eventName: string, data?: JSONObject): void {
-    if (!this.isInitialized) {
-      return;
-    }
-
     // PostHog tracking
-    posthog.capture(eventName, data);
+    if (this.isInitialized) {
+      posthog.capture(eventName, data);
+    }
 
-    // GA4 tracking via dataLayer (for Google Analytics conversion tracking)
+    /*
+     * GA4 tracking via dataLayer (for Google Analytics / Google Ads conversion
+     * tracking). This must not depend on PostHog being configured — GTM is
+     * loaded independently of ANALYTICS_KEY / ANALYTICS_HOST.
+     */
     if (typeof window !== "undefined" && (window as any).dataLayer) {
       (window as any).dataLayer.push({
         event: eventName,

package/Utils/EnterpriseLicense/EnterpriseLicenseUsage.ts

@@ -13,6 +13,33 @@ export interface EnterpriseLicenseInstanceUsage {
 }
 
 export default class EnterpriseLicenseUsageUtil {
+  /*
+   * How many days before a license expires that expiry reminder emails
+   * start going out, unless overridden in GlobalConfig
+   * (enterpriseLicenseExpiryReminderDays).
+   */
+  public static readonly defaultExpiryReminderDays: number = 45;
+
+  /*
+   * Expired licenses keep getting a daily "expired" email for this many
+   * days after expiry, then go quiet — an abandoned license should not be
+   * emailed forever.
+   */
+  public static readonly expiredNotificationCutoffDays: number = 30;
+
+  /*
+   * License keys are shown/emailed masked — enough to identify the key
+   * without exposing it in full.
+   */
+  public static maskLicenseKey(licenseKey: string): string {
+    if (licenseKey.length <= 8) {
+      return "••••••••";
+    }
+
+    return `${licenseKey.substring(0, 4)}••••${licenseKey.substring(
+      licenseKey.length - 4,
+    )}`;
+  }
   /*
    * Instances that stopped reporting (for example a decommissioned staging
    * environment) stop counting towards the seat total after this many days,
@@ -25,6 +52,53 @@ export default class EnterpriseLicenseUsageUtil {
 
   public static readonly maxEmailHashesPerInstance: number = 200_000;
 
+  /*
+   * Master admin emails are used to contact the customer about license
+   * issues — a handful per instance is plenty, and the cap keeps a
+   * misbehaving client from storing an unbounded list.
+   */
+  public static readonly maxMasterAdminEmailsPerInstance: number = 50;
+
+  // Deliberately loose: rejects garbage, accepts anything email-shaped.
+  private static readonly emailRegex: RegExp = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+  /*
+   * Normalizes a client-provided list of master admin emails: keeps only
+   * email-shaped strings, lowercases them, removes duplicates and caps the
+   * list size. Returns an empty array for anything that is not an array.
+   */
+  public static sanitizeMasterAdminEmails(value: unknown): Array<string> {
+    if (!Array.isArray(value)) {
+      return [];
+    }
+
+    const emails: Set<string> = new Set<string>();
+
+    for (const item of value) {
+      if (emails.size >= this.maxMasterAdminEmailsPerInstance) {
+        break;
+      }
+
+      if (typeof item !== "string") {
+        continue;
+      }
+
+      const normalized: string = item.trim().toLowerCase();
+
+      if (
+        !normalized ||
+        normalized.length > 320 ||
+        !this.emailRegex.test(normalized)
+      ) {
+        continue;
+      }
+
+      emails.add(normalized);
+    }
+
+    return Array.from(emails);
+  }
+
   /*
    * Normalizes a client-provided list of email hashes: keeps only valid
    * SHA-256 hex strings, lowercases them, removes duplicates and caps the