@oneuptime/common 12.0.14 → 12.0.15

package/Server/Services/GlobalSsoProjectService.ts

@@ -4,18 +4,138 @@ import Team from "../../Models/DatabaseModels/Team";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import validateGlobalProviderProjectTeams, {
   resolveAttachmentProjectId,
 } from "../Utils/ValidateGlobalProviderProjectTeams";
+import {
+  GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS,
+  GlobalProviderAttachments,
+  clearGlobalSsoAuthorizationCaches,
+  doAttachmentsGovernProject,
+  globalProviderCacheKey,
+  globalSsoAttachmentsCache,
+  loadAttachmentsOnce,
+} from "../Utils/GlobalSsoAuthorization";
+import DeleteBy from "../Types/Database/DeleteBy";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
 
+  /**
+   * Whether this provider's attachments cover `projectId`.
+   *
+   * Only consulted when the provider has `restrictToAttachedProjects` on -
+   * attachments are the PROVISIONING allow-list by default, not an access
+   * boundary, and reading them as one without the admin asking would lock
+   * existing users out of projects they legitimately reach.
+   *
+   * "No attachment rows at all" means instance-wide, matching the login
+   * router's default-all mode. "Rows exist but none are enabled" is a
+   * different answer and denies - otherwise an admin disabling the last
+   * attachment would WIDEN the provider to every project.
+   *
+   * Cached for 60s, with concurrent misses sharing one query.
+   */
+  @CaptureSpan()
+  public async doesProviderGovernProject(data: {
+    globalSsoId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<boolean> {
+    const key: string = globalProviderCacheKey("sso", data.globalSsoId);
+
+    const cached: GlobalProviderAttachments | undefined =
+      globalSsoAttachmentsCache.get(key);
+
+    if (cached !== undefined) {
+      return doAttachmentsGovernProject(cached, data.projectId);
+    }
+
+    const attachments: GlobalProviderAttachments = await loadAttachmentsOnce(
+      key,
+      async (): Promise<GlobalProviderAttachments> => {
+        /*
+         * Fetched WITHOUT the isEnabled filter so a disabled row still counts
+         * as "this provider has attachments"; the enabled ones are selected
+         * out below.
+         */
+        const rows: Array<Model> = await this.findBy({
+          query: { globalSsoId: data.globalSsoId },
+          select: { _id: true, projectId: true, isEnabled: true },
+          limit: LIMIT_PER_PROJECT,
+          skip: 0,
+          props: { isRoot: true },
+        });
+
+        const loaded: GlobalProviderAttachments = {
+          hasAnyAttachmentRows: rows.length > 0,
+          enabledProjectIds: rows
+            .filter((row: Model) => {
+              return Boolean(row.isEnabled) && Boolean(row.projectId);
+            })
+            .map((row: Model) => {
+              return row.projectId!.toString();
+            }),
+        };
+
+        globalSsoAttachmentsCache.set(
+          key,
+          loaded,
+          GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS,
+        );
+
+        return loaded;
+      },
+    );
+
+    return doAttachmentsGovernProject(attachments, data.projectId);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    // Detaching a project has to take effect now, not in 60s, on this node.
+    clearGlobalSsoAuthorizationCaches();
+    return { deleteBy, carryForward: null };
+  }
+
+  /*
+   * Cleared again AFTER the write commits. A clear that runs before the row
+   * lands can be immediately re-filled with the pre-change answer by a
+   * concurrent request, handing the old attachment set another full TTL.
+   */
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<Model>,
+    _itemIdsBeforeDelete: Array<ObjectID>,
+  ): Promise<OnDelete<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return onDelete;
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    clearGlobalSsoAuthorizationCaches();
+    return createdItem;
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    _updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return onUpdate;
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
@@ -38,6 +158,9 @@ export class Service extends DatabaseService<Model> {
       projectId,
     });
 
+    // A new attachment narrows (or widens) which projects the provider governs.
+    clearGlobalSsoAuthorizationCaches();
+
     return { createBy, carryForward: null };
   }
 
@@ -78,6 +201,8 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    clearGlobalSsoAuthorizationCaches();
+
     return { updateBy, carryForward: null };
   }
 }

package/Server/Services/GlobalSsoService.ts

@@ -1,10 +1,142 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalSso";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import {
+  GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS,
+  GlobalProviderTrust,
+  clearGlobalSsoAuthorizationCaches,
+  globalProviderCacheKey,
+  globalSsoProviderTrustCache,
+  loadTrustOnce,
+} from "../Utils/GlobalSsoAuthorization";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  /**
+   * What the SSO-enforcement middleware needs to know about this provider:
+   * whether it is still usable at all, and whether the admin opted it into
+   * attachment-scoped access.
+   *
+   * Called on every authenticated request against an SSO-enforced project, so
+   * the answer is cached for 60s and concurrent misses share one query.
+   * Without this lookup, turning a provider off leaves every token it ever
+   * issued working until each one expires - up to thirty days.
+   */
+  @CaptureSpan()
+  public async getProviderTrust(
+    providerId: ObjectID,
+  ): Promise<GlobalProviderTrust> {
+    const key: string = globalProviderCacheKey("sso", providerId);
+
+    const cached: GlobalProviderTrust | undefined =
+      globalSsoProviderTrustCache.get(key);
+
+    if (cached !== undefined) {
+      return cached;
+    }
+
+    return loadTrustOnce(key, async (): Promise<GlobalProviderTrust> => {
+      const provider: Model | null = await this.findOneBy({
+        query: { _id: providerId.toString() },
+        select: {
+          _id: true,
+          isEnabled: true,
+          restrictToAttachedProjects: true,
+        },
+        props: { isRoot: true },
+      });
+
+      /*
+       * A deleted provider and a disabled one are the same answer: no. Both
+       * are cached, so a revoked provider does not cost a query per request.
+       */
+      const trust: GlobalProviderTrust = {
+        isUsable: Boolean(provider && provider.isEnabled),
+        restrictToAttachedProjects: Boolean(
+          provider && provider.restrictToAttachedProjects,
+        ),
+      };
+
+      globalSsoProviderTrustCache.set(
+        key,
+        trust,
+        GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS,
+      );
+
+      return trust;
+    });
+  }
+
+  /*
+   * Cache invalidation runs in the SUCCESS hooks, not the before-hooks: a
+   * clear that happens before the row is written can be immediately re-filled
+   * with the pre-change answer by a concurrent request, which would hand a
+   * disabled provider another full TTL of life on the very node that served
+   * the disable. Clearing in both is deliberate - the before-hook narrows the
+   * window, the success hook closes it.
+   *
+   * These caches are per-process, so the hooks make a change immediate on the
+   * node that served it and the TTL bounds every other node.
+   */
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    _updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return onUpdate;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return { deleteBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<Model>,
+    _itemIdsBeforeDelete: Array<ObjectID>,
+  ): Promise<OnDelete<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return onDelete;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    clearGlobalSsoAuthorizationCaches();
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    clearGlobalSsoAuthorizationCaches();
+    return createdItem;
+  }
 }
 
 export default new Service();

package/Server/Services/UserEmailService.ts

@@ -117,10 +117,10 @@ export class Service extends DatabaseService<Model> {
        * create response for it to confirm the address the way a user would.
        *
        * It is gated on an environment variable that is unset in every shipped
-       * config and set true ONLY in the CI e2e job (docker-compose passes it
-       * through, .github/workflows/test-release.yaml sets it for the SaaS run).
-       * In production the flag is absent, this branch never runs, and the code
-       * never leaves the mail path.
+       * config and set true ONLY in the CI e2e jobs (docker-compose passes it
+       * through; both SaaS e2e jobs set it — test-release.yaml for master and
+       * release.yml for the release branch). In production the flag is absent,
+       * this branch never runs, and the code never leaves the mail path.
        */
       if (
         process.env["EXPOSE_VERIFICATION_CODE_IN_API_RESPONSE_FOR_E2E"] ===

package/Server/Utils/CronTab.ts

@@ -15,4 +15,77 @@ export default class CronTab {
       throw new BadDataException(`Invalid cron expression: ${crontab}`);
     }
   }
+
+  /**
+   * Longest gap (in seconds) between two consecutive runs of this cron.
+   *
+   * Used to reason about how much data an evaluation window can possibly
+   * contain: a monitor polled once every five minutes produces at most one
+   * sample per five minutes, so "all values over the last 5 minutes" can
+   * never be backed by more than one sample. Callers use this to decide
+   * whether a window is actually covered by data or is merely still
+   * filling up.
+   *
+   * The *longest* gap is deliberate. Irregular expressions (say
+   * `0,1,30 * * * *`) have both very short and very long gaps; taking the
+   * shortest would make callers demand data at a cadence the cron does not
+   * actually deliver, and they would wait forever.
+   *
+   * Returns null when the expression is missing or unparseable so callers
+   * can fall back to inferring the cadence from the data itself.
+   */
+  @CaptureSpan()
+  public static getIntervalInSeconds(
+    crontab: string | undefined | null,
+    referenceDate?: Date | undefined,
+  ): number | null {
+    if (!crontab) {
+      return null;
+    }
+
+    try {
+      const interval: CronExpression = CronParser.parseExpression(crontab, {
+        currentDate: referenceDate || new Date(),
+      });
+
+      /*
+       * Six executions -> five gaps. Enough to cover a full hour-wrap for
+       * every interval offered in the UI without walking the schedule far
+       * into the future.
+       */
+      const executionTimes: Array<Date> = [];
+
+      for (let i: number = 0; i < 6; i++) {
+        executionTimes.push(interval.next().toDate());
+      }
+
+      let longestGapInSeconds: number = 0;
+
+      for (let i: number = 1; i < executionTimes.length; i++) {
+        const gapInSeconds: number =
+          (executionTimes[i]!.getTime() - executionTimes[i - 1]!.getTime()) /
+          1000;
+
+        if (gapInSeconds > longestGapInSeconds) {
+          longestGapInSeconds = gapInSeconds;
+        }
+      }
+
+      if (longestGapInSeconds <= 0) {
+        return null;
+      }
+
+      return longestGapInSeconds;
+    } catch (error) {
+      /*
+       * Debug rather than error: this runs on the criteria-evaluation hot
+       * path, and monitors created before the interval was a cron (or
+       * through a Terraform example using the "Every 5 minutes" label) would
+       * otherwise log on every single check. Callers treat null as "cadence
+       * unknown" and fall back to inferring it from the data.
+       */
+      logger.debug(error);
+      return null;
+    }
+  }
 }

package/Server/Utils/GlobalSsoAuthorization.ts

@@ -0,0 +1,175 @@
+import ObjectID from "../../Types/ObjectID";
+import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+
+/*
+ * The stateful half of Global SSO enforcement.
+ *
+ * A Global SSO/OIDC token is a 30-day, self-contained JWT with no project
+ * binding, so on its own it answers only "this person authenticated against
+ * SOME instance-wide identity provider at some point in the last month". Two
+ * questions it cannot answer:
+ *
+ *   1. IS THE PROVIDER STILL TRUSTED? Turning a provider off, or deleting it,
+ *      has to actually cut off access. Without a check at request time the
+ *      "Enabled" toggle does nothing to anyone already signed in, for up to
+ *      thirty days. This check is UNCONDITIONAL - "disabled" has only one
+ *      possible meaning.
+ *
+ *   2. DOES THE PROVIDER GOVERN THIS PROJECT? Deliberately OPT-IN, per
+ *      provider, via `restrictToAttachedProjects`. The attachment rows
+ *      (GlobalSsoProject / GlobalOidcProject) were introduced as the
+ *      PROVISIONING allow-list - "a SAML assertion can only ever provision a
+ *      user into projects that a master admin has explicitly attached here",
+ *      per the model's own docstring - and the login routers gate a session on
+ *      membership of ANY project, not of an attached one. Reading attachments
+ *      as an access boundary by default would therefore lock existing users
+ *      out of projects they legitimately reach today, immediately on upgrade,
+ *      with no way to recover from inside the product. So it stays off unless
+ *      an admin asks for it.
+ *
+ * Both answers come from Postgres and run on every authenticated request
+ * against an SSO-enforced project, so both are cached in-process for 60
+ * seconds, and concurrent misses share one query.
+ */
+
+export const GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS: number = 60_000;
+
+/** What the enforcement path needs to know about a global provider. */
+export interface GlobalProviderTrust {
+  // The provider row exists and its "Enabled" toggle is on.
+  isUsable: boolean;
+  // The admin opted this provider into attachment-scoped access.
+  restrictToAttachedProjects: boolean;
+}
+
+/*
+ * Absence of an entry means "not yet looked up", which is why these are read
+ * with an explicit `undefined` check rather than a truthiness test: a cached
+ * "this provider is disabled" must not be mistaken for a cache miss and
+ * re-queried on every single request.
+ */
+export const globalSsoProviderTrustCache: InMemoryTTLCache<GlobalProviderTrust> =
+  new InMemoryTTLCache(10_000);
+
+/**
+ * A provider's attachment rows.
+ *
+ * `hasAnyAttachmentRows` distinguishes "this provider has no attachments at
+ * all" from "it has attachments but every one of them is disabled". Collapsing
+ * those two would mean an admin disabling the last attachment WIDENS the
+ * provider to every project - the exact opposite of the intent.
+ */
+export interface GlobalProviderAttachments {
+  hasAnyAttachmentRows: boolean;
+  enabledProjectIds: Array<string>;
+}
+
+export const globalSsoAttachmentsCache: InMemoryTTLCache<GlobalProviderAttachments> =
+  new InMemoryTTLCache(10_000);
+
+export type GlobalProviderKind = "sso" | "oidc";
+
+/*
+ * Namespaced by kind. A Global SSO provider and a Global OIDC provider are
+ * different rows in different tables and could in principle share an id;
+ * collapsing the keys would let one vouch for the other.
+ */
+export function globalProviderCacheKey(
+  providerKind: GlobalProviderKind,
+  providerId: ObjectID,
+): string {
+  return `${providerKind}:${providerId.toString()}`;
+}
+
+/**
+ * Decides whether a provider's attachments cover `projectId`, for a provider
+ * that has opted into attachment-scoped access.
+ *
+ * A provider with no attachment rows at all is instance-wide, matching the
+ * "default-all" reading the login routers use. A provider that HAS attachment
+ * rows governs exactly the enabled ones - so disabling them all denies rather
+ * than widens.
+ */
+export function doAttachmentsGovernProject(
+  attachments: GlobalProviderAttachments,
+  projectId: ObjectID,
+): boolean {
+  if (!attachments.hasAnyAttachmentRows) {
+    return true;
+  }
+
+  return attachments.enabledProjectIds.includes(projectId.toString());
+}
+
+/** Drops every cached answer. Used by the write hooks and by tests. */
+export function clearGlobalSsoAuthorizationCaches(): void {
+  globalSsoProviderTrustCache.clear();
+  globalSsoAttachmentsCache.clear();
+  inFlightTrustLookups.clear();
+  inFlightAttachmentLookups.clear();
+}
+
+/*
+ * In-flight de-duplication.
+ *
+ * The multi-tenant permission path fans out over every project the user
+ * belongs to CONCURRENTLY. Without this, a cold cache means N simultaneous
+ * copies of the same two queries - for a user in fifty projects, a hundred
+ * queries where two would do. Worse, failures are never cached, so a database
+ * that is already struggling gets the full fan-out again on every request.
+ *
+ * Sharing the promise collapses all of that to one query per provider, and a
+ * rejection is shared too rather than being retried N times in the same tick.
+ */
+const inFlightTrustLookups: Map<
+  string,
+  Promise<GlobalProviderTrust>
+> = new Map();
+const inFlightAttachmentLookups: Map<
+  string,
+  Promise<GlobalProviderAttachments>
+> = new Map();
+
+async function loadOnce<T>(
+  inFlight: Map<string, Promise<T>>,
+  key: string,
+  load: () => Promise<T>,
+): Promise<T> {
+  const existing: Promise<T> | undefined = inFlight.get(key);
+
+  if (existing) {
+    return existing;
+  }
+
+  const pending: Promise<T> = load().finally((): void => {
+    /*
+     * Only clear the slot if it is still OURS. A cache clear between the two
+     * (every write to a Global SSO/OIDC service does exactly that, twice) lets
+     * a NEWER lookup take the key while this one is still on the wire; a blind
+     * delete would evict that newer entry when this one settles, and the fan-
+     * out that follows would stop de-duplicating - the one situation this
+     * exists for.
+     */
+    if (inFlight.get(key) === pending) {
+      inFlight.delete(key);
+    }
+  });
+
+  inFlight.set(key, pending);
+
+  return pending;
+}
+
+export function loadTrustOnce(
+  key: string,
+  load: () => Promise<GlobalProviderTrust>,
+): Promise<GlobalProviderTrust> {
+  return loadOnce(inFlightTrustLookups, key, load);
+}
+
+export function loadAttachmentsOnce(
+  key: string,
+  load: () => Promise<GlobalProviderAttachments>,
+): Promise<GlobalProviderAttachments> {
+  return loadOnce(inFlightAttachmentLookups, key, load);
+}

package/Server/Utils/Marketing/ConversionUploadProvider.ts

@@ -1,6 +1,9 @@
 import { AxiosError } from "axios";
 import { JSONObject } from "../../../Types/JSON";
-import { MarketingConversionType } from "../../../Types/Marketing/MarketingConversion";
+import {
+  AdUploadableMarketingConversionTypes,
+  MarketingConversionType,
+} from "../../../Types/Marketing/MarketingConversion";
 import MarketingConversion from "../../../Models/DatabaseModels/MarketingConversion";
 
 /*
@@ -11,9 +14,12 @@ import MarketingConversion from "../../../Models/DatabaseModels/MarketingConvers
  *
  * Contract:
  * - getSkipReason returns a human-readable reason when this conversion can
- *   never be uploaded to this platform (wrong/missing click id, outside the
- *   platform's upload window, provider not configured for this conversion
- *   type). Null means uploadable.
+ *   never be uploaded to this platform (conversion type with no ad-platform
+ *   mapping, wrong/missing click id, outside the platform's upload window,
+ *   provider not configured for this conversion type). Null means uploadable.
+ *   It is implemented here and must not be overridden — providers implement
+ *   getProviderSkipReason instead, which only runs for conversion types that
+ *   are ad-uploadable at all.
  * - upload() sends one batch. Per-conversion PERMANENT rejections are
  *   returned in the result keyed by array index; they will not be retried.
  *   Transport/auth-level failures must THROW — the whole batch stays pending
@@ -52,7 +58,31 @@ export default abstract class ConversionUploadProvider {
 
   public abstract isConfigured(): boolean;
 
-  public abstract getSkipReason(
+  /*
+   * Every provider maps a conversion onto a platform conversion action by
+   * branching on isSignUp() — so a conversion type the ad platforms have no
+   * mapping for (a booked meeting) would otherwise be silently uploaded as a
+   * purchase. Screen those out here, before any provider sees them, so no
+   * provider or call site can skip the check.
+   */
+  public getSkipReason(conversion: MarketingConversion): ConversionSkip | null {
+    if (
+      !AdUploadableMarketingConversionTypes.includes(
+        conversion.conversionType as MarketingConversionType,
+      )
+    ) {
+      return {
+        reason: `Conversion type ${
+          conversion.conversionType || "unknown"
+        } has no ad platform conversion mapping`,
+        isPermanent: true,
+      };
+    }
+
+    return this.getProviderSkipReason(conversion);
+  }
+
+  protected abstract getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null;
 

package/Server/Utils/Marketing/Providers/GoogleAds.ts

@@ -46,7 +46,7 @@ export default class GoogleAdsProvider extends ConversionUploadProvider {
     );
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getGoogleClickId(conversion)) {

package/Server/Utils/Marketing/Providers/LinkedIn.ts

@@ -41,7 +41,7 @@ export default class LinkedInProvider extends ConversionUploadProvider {
     return Boolean(LinkedInConversionsAccessToken);
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getClickId(conversion, "li_fat_id")) {

package/Server/Utils/Marketing/Providers/Meta.ts

@@ -32,7 +32,7 @@ export default class MetaProvider extends ConversionUploadProvider {
     return Boolean(MetaConversionsPixelId && MetaConversionsAccessToken);
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getClickId(conversion, "fbclid")) {

package/Server/Utils/Marketing/Providers/MicrosoftAds.ts

@@ -45,7 +45,7 @@ export default class MicrosoftAdsProvider extends ConversionUploadProvider {
     );
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getClickId(conversion, "msclkid")) {

package/Server/Utils/Marketing/Providers/Reddit.ts

@@ -41,7 +41,7 @@ export default class RedditProvider extends ConversionUploadProvider {
     );
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
     if (!this.getClickId(conversion, "rdt_cid")) {