@oneuptime/common 12.0.14 → 12.0.16

package/Models/DatabaseModels/WorkflowOwnerRule.ts

@@ -41,6 +41,9 @@ import {
     Permission.ProjectAdmin,
     Permission.ProjectMember,
     Permission.Viewer,
+    Permission.WorkflowAdmin,
+    Permission.WorkflowMember,
+    Permission.WorkflowViewer,
     Permission.ReadWorkflowOwnerRule,
   ],
   delete: [
@@ -84,6 +87,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [],
@@ -120,6 +126,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [],
@@ -150,6 +159,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -184,6 +196,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -216,6 +231,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -251,6 +269,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -288,6 +309,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -334,6 +358,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -367,6 +394,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -402,6 +432,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -448,6 +481,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -494,6 +530,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [],
@@ -531,6 +570,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [],

package/Server/API/StatusPageAPI.ts

@@ -117,6 +117,7 @@ import StatusPageSubscriberNotificationTemplate from "../../Models/DatabaseModel
 import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
 } from "../Services/StatusPageSubscriberNotificationTemplateService";
+import { canServeStatusPageCustomizations } from "../Utils/StatusPageCustomizationAccess";
 
 type EscapeXmlFunction = (text: string) => string;
 
@@ -860,6 +861,12 @@ export default class StatusPageAPI extends BaseAPI<
           ObjectID.validateUUID(statusPageIdParam);
           const objectId: ObjectID = new ObjectID(statusPageIdParam);
 
+          const allowStatusPageCustomizations: boolean =
+            await canServeStatusPageCustomizations({
+              req,
+              statusPageId: objectId,
+            });
+
           const select: Select<StatusPage> = {
             _id: true,
             slug: true,
@@ -870,11 +877,7 @@ export default class StatusPageAPI extends BaseAPI<
             pageTitle: true,
             pageDescription: true,
             copyrightText: true,
-            customCSS: true,
-            customJavaScript: true,
             hidePoweredByOneUptimeBranding: true,
-            headerHTML: true,
-            footerHTML: true,
             enableEmailSubscribers: true,
             enableSlackSubscribers: true,
             enableMicrosoftTeamsSubscribers: true,
@@ -911,6 +914,13 @@ export default class StatusPageAPI extends BaseAPI<
             enabledLanguages: true,
           };
 
+          if (allowStatusPageCustomizations) {
+            select.customCSS = true;
+            select.customJavaScript = true;
+            select.headerHTML = true;
+            select.footerHTML = true;
+          }
+
           const hasEnabledSSO: PositiveNumber =
             await StatusPageSsoService.countBy({
               query: {
@@ -934,6 +944,20 @@ export default class StatusPageAPI extends BaseAPI<
             throw new BadDataException("Status Page not found");
           }
 
+          if (!allowStatusPageCustomizations) {
+            /*
+             * The conditional select above keeps these values out of the
+             * normal database result. Explicit redaction is the second half
+             * of the boundary: it prevents a future eager-load, hook, cache,
+             * or over-populated service result from serializing tenant code
+             * onto the authenticated application's origin.
+             */
+            delete item.customCSS;
+            delete item.customJavaScript;
+            delete item.headerHTML;
+            delete item.footerHTML;
+          }
+
           const footerLinks: Array<StatusPageFooterLink> =
             await StatusPageFooterLinkService.findBy({
               query: {
@@ -987,6 +1011,7 @@ export default class StatusPageAPI extends BaseAPI<
               StatusPageHeaderLink,
             ),
             hasEnabledSSO: hasEnabledSSO.toNumber(),
+            allowStatusPageCustomizations,
           };
 
           return Response.sendJsonObjectResponse(req, res, response);

package/Server/API/TelemetryAPI.ts

@@ -18,12 +18,17 @@ import LogAggregationService, {
   HistogramRequest,
   FacetValue,
   FacetRequest,
+  LogAttributeFilters,
   AnalyticsRequest,
   AnalyticsChartType,
   AnalyticsAggregation,
   AnalyticsTimeseriesRow,
   AnalyticsTopItem,
   AnalyticsTableRow,
+  ErrorPatternFilters,
+  ErrorPatternTimelineRequest,
+  TopErrorPattern,
+  TopErrorPatternsRequest,
 } from "../Services/LogAggregationService";
 import TraceAggregationService, {
   HistogramBucket as TraceHistogramBucket,
@@ -455,10 +460,9 @@ router.post(
         ? (body["sessionIds"] as Array<string>)
         : undefined;
 
-      const attributes: Record<string, string | Array<string>> | undefined =
-        body["attributes"]
-          ? (body["attributes"] as Record<string, string | Array<string>>)
-          : undefined;
+      const attributes: LogAttributeFilters | undefined = body["attributes"]
+        ? (body["attributes"] as LogAttributeFilters)
+        : undefined;
 
       const resourceScopes: Array<ResourceEntityScope> | undefined =
         await resolveResourceScopesFromBody(body, databaseProps.tenantId);
@@ -559,8 +563,8 @@ router.post(
         ? (body["sessionIds"] as Array<string>)
         : undefined;
 
-      const attributes: Record<string, string> | undefined = body["attributes"]
-        ? (body["attributes"] as Record<string, string>)
+      const attributes: LogAttributeFilters | undefined = body["attributes"]
+        ? (body["attributes"] as LogAttributeFilters)
         : undefined;
 
       /*
@@ -1918,6 +1922,248 @@ router.post(
   },
 );
 
+// --- Log Error Pattern Endpoints ---
+
+/*
+ * Shared body parsing for the two error-pattern endpoints. Both take the
+ * same filter shape as the histogram/facet endpoints so the Insights page
+ * can hand its one scope (time range, service selection, severities) to
+ * every panel it draws; the detail endpoint adds the pattern itself.
+ *
+ * Defensive about shapes throughout: these bodies come from the browser,
+ * and a stringly-typed or null field must mean "no filter" rather than
+ * becoming an active predicate that silently narrows the result.
+ */
+function parseErrorPatternFilterBody(
+  body: JSONObject,
+  projectId: ObjectID,
+): Omit<ErrorPatternFilters, "startTime" | "endTime"> {
+  const stringArray: (value: unknown) => Array<string> | undefined = (
+    value: unknown,
+  ): Array<string> | undefined => {
+    if (!Array.isArray(value)) {
+      return undefined;
+    }
+
+    const values: Array<string> = (value as Array<unknown>).filter(
+      (item: unknown): item is string => {
+        return typeof item === "string" && item.length > 0;
+      },
+    );
+
+    return values.length > 0 ? values : undefined;
+  };
+
+  const serviceIdStrings: Array<string> | undefined = stringArray(
+    body["serviceIds"],
+  );
+
+  return {
+    projectId,
+    serviceIds: serviceIdStrings
+      ? serviceIdStrings.map((id: string): ObjectID => {
+          return new ObjectID(id);
+        })
+      : undefined,
+    entityKeys: stringArray(body["entityKeys"]),
+    severityTexts: stringArray(body["severityTexts"]),
+    bodySearchText:
+      typeof body["bodySearchText"] === "string" &&
+      body["bodySearchText"].trim().length > 0
+        ? (body["bodySearchText"] as string)
+        : undefined,
+    traceIds: stringArray(body["traceIds"]),
+    spanIds: stringArray(body["spanIds"]),
+    sessionIds: stringArray(body["sessionIds"]),
+    attributes:
+      body["attributes"] && typeof body["attributes"] === "object"
+        ? (body["attributes"] as Record<string, string | Array<string>>)
+        : undefined,
+  };
+}
+
+/*
+ * Default window for the error-pattern endpoints: 24 hours rather than the
+ * one hour the histogram defaults to. "Top errors" is a question about a
+ * period long enough for a pattern to establish itself; an hour of a quiet
+ * service routinely has nothing in it.
+ */
+function parseErrorPatternWindow(body: JSONObject): {
+  startTime: Date;
+  endTime: Date;
+} {
+  const endTime: Date = body["endTime"]
+    ? OneUptimeDate.fromString(body["endTime"] as string)
+    : OneUptimeDate.getCurrentDate();
+
+  const startTime: Date = body["startTime"]
+    ? OneUptimeDate.fromString(body["startTime"] as string)
+    : OneUptimeDate.addRemoveHours(endTime, -24);
+
+  return { startTime, endTime };
+}
+
+router.post(
+  "/telemetry/logs/error-patterns",
+  ...requireLogReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+      const window: { startTime: Date; endTime: Date } =
+        parseErrorPatternWindow(body);
+
+      const request: TopErrorPatternsRequest = {
+        ...parseErrorPatternFilterBody(body, databaseProps.tenantId),
+        ...window,
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+        limit: typeof body["limit"] === "number" ? body["limit"] : undefined,
+      };
+
+      const patterns: Array<TopErrorPattern> =
+        await LogAggregationService.getTopErrorPatterns(request);
+
+      return Response.sendJsonObjectResponse(req, res, {
+        patterns: patterns as unknown as JSONObject,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
+/*
+ * Everything the UI needs to explain ONE error pattern, in a single round
+ * trip: when it fired, what else fired alongside it, what the occurrences
+ * have in common, which resources and traces carry it, and a handful of
+ * raw lines.
+ *
+ * The six aggregations run concurrently and each degrades to an empty
+ * result on its own failure. A correlation panel is supplementary
+ * information — one slow or unlucky sub-query should cost the user that
+ * section, not the whole page.
+ */
+router.post(
+  "/telemetry/logs/error-pattern-correlation",
+  ...requireLogReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+
+      const pattern: string =
+        typeof body["pattern"] === "string" ? (body["pattern"] as string) : "";
+
+      if (pattern.trim().length === 0) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("pattern is required"),
+        );
+      }
+
+      const window: { startTime: Date; endTime: Date } =
+        parseErrorPatternWindow(body);
+
+      const bucketSizeInMinutes: number =
+        typeof body["bucketSizeInMinutes"] === "number" &&
+        body["bucketSizeInMinutes"] > 0
+          ? (body["bucketSizeInMinutes"] as number)
+          : computeDefaultBucketSize(window.startTime, window.endTime);
+
+      const detailRequest: ErrorPatternTimelineRequest = {
+        ...parseErrorPatternFilterBody(body, databaseProps.tenantId),
+        ...window,
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+        pattern,
+        bucketSizeInMinutes,
+        limit: typeof body["limit"] === "number" ? body["limit"] : undefined,
+      };
+
+      const degradeToEmpty: <T>(
+        promise: Promise<Array<T>>,
+      ) => Promise<Array<T>> = async <T>(
+        promise: Promise<Array<T>>,
+      ): Promise<Array<T>> => {
+        try {
+          return await promise;
+        } catch {
+          return [];
+        }
+      };
+
+      const [timeline, coOccurring, attributes, resources, traces, samples] =
+        await Promise.all([
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternTimeline(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternCoOccurrences(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternAttributes(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternResources(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternTraces(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternSamples(detailRequest),
+          ),
+        ]);
+
+      return Response.sendJsonObjectResponse(req, res, {
+        pattern,
+        bucketSizeInMinutes,
+        timeline: timeline as unknown as JSONObject,
+        coOccurringPatterns: coOccurring as unknown as JSONObject,
+        attributes: attributes as unknown as JSONObject,
+        resources: resources as unknown as JSONObject,
+        traces: traces as unknown as JSONObject,
+        samples: samples as unknown as JSONObject,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 // --- Log Export Endpoint ---
 
 router.post(

package/Server/API/UserAPI.ts

@@ -325,6 +325,94 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
       },
     );
 
+    /*
+     * Require -- or stop requiring -- two factor auth for one user.
+     *
+     * Master-admin only, and its own route rather than a PUT to /user/:id
+     * carrying `enableTwoFactorAuth` for a reason that is not cosmetic: the
+     * generic write would succeed (a master admin bypasses the column's ACL)
+     * but it would NOT revoke the user's sessions, so "two factor auth is now
+     * required" would be a promise the product silently failed to keep for
+     * everybody already signed in. That revocation lives in
+     * UserService.setTwoFactorAuthRequired, where a caller cannot forget it.
+     *
+     * Session-only middleware, deliberately. This route WRITES, and the
+     * instance-wide master API key is scoped to reads for exactly this class
+     * of reason: a leaked static key that can read discloses, but one that can
+     * turn two factor auth off across every account on the instance is an
+     * account takeover with the safety catch removed.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/set-two-factor-auth-required`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const isRequired: unknown = req.body?.["isRequired"];
+
+          /*
+           * Type-checked rather than cast, and the check has to be `typeof`
+           * rather than truthiness. `Boolean(req.body["isRequired"])` would
+           * read a missing field, a null, or the string "false" as a request
+           * to turn the requirement OFF -- silently weakening an account's
+           * security in response to a malformed call.
+           */
+          if (typeof isRequired !== "boolean") {
+            throw new BadDataException(
+              "isRequired is required and must be a boolean.",
+            );
+          }
+
+          await UserService.setTwoFactorAuthRequired({
+            userId: userId,
+            isRequired: isRequired,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Clear everything one user has set up for two factor auth.
+     *
+     * This is the lost-device escape hatch. Two factor auth is self-service
+     * everywhere else in the product, which works right up until the phone
+     * holding the authenticator is gone: the user cannot produce a code, so
+     * they cannot sign in, so they cannot reach the page that would let them
+     * enrol a new one. Somebody outside the account has to be able to cut the
+     * knot.
+     *
+     * It does NOT turn the requirement off -- see
+     * UserService.resetTwoFactorAuth. Reset means "start again from a fresh QR
+     * code", not "you may now sign in with a password alone", and an operator
+     * helping with a lost phone should not have to notice that they had just
+     * downgraded the account.
+     *
+     * Takes no body: there is nothing to configure, and a route that ignores
+     * its body cannot be steered by one.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/reset-two-factor-auth`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          await UserService.resetTwoFactorAuth({
+            userId: userId,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/profile-picture/:userId`,
       async (req: ExpressRequest, res: ExpressResponse) => {

package/Server/EnvironmentConfig.ts

@@ -368,6 +368,13 @@ export const SubscriptionPlans: Array<SubscriptionPlan> =
 export const AnalyticsKey: string = process.env["ANALYTICS_KEY"] || "";
 export const AnalyticsHost: string = process.env["ANALYTICS_HOST"] || "";
 
+/*
+ * Shared secret Cal.com signs booking webhooks with (App/API/CalWebhook.ts).
+ * Server-only — must never be added to FRONTEND_ENV_ALLOW_LIST. Empty means
+ * the webhook endpoint is disabled and answers 503.
+ */
+export const CalWebhookSecret: string = process.env["CAL_WEBHOOK_SECRET"] || "";
+
 /*
  * Google Ads offline conversion uploads (MarketingConversions worker job).
  * Server-only secrets — must never be added to FRONTEND_ENV_ALLOW_LIST.
@@ -393,11 +400,35 @@ export const GoogleAdsLoginCustomerId: string =
  */
 export const GoogleAdsApiVersion: string =
   process.env["GOOGLE_ADS_API_VERSION"] || "v23";
-// Numeric conversion action ids from Google Ads (Goals -> Conversions).
+/*
+ * Numeric conversion action ids from Google Ads (Goals -> Conversions). One
+ * per conversion type: the provider maps types to actions exhaustively, and an
+ * empty value leaves that type pending rather than uploading it under some
+ * other type's action.
+ */
 export const GoogleAdsSignUpConversionActionId: string =
   process.env["GOOGLE_ADS_SIGNUP_CONVERSION_ACTION_ID"] || "";
 export const GoogleAdsPaidSubscriptionConversionActionId: string =
   process.env["GOOGLE_ADS_PAID_SUBSCRIPTION_CONVERSION_ACTION_ID"] || "";
+export const GoogleAdsMeetingBookedConversionActionId: string =
+  process.env["GOOGLE_ADS_MEETING_BOOKED_CONVERSION_ACTION_ID"] || "";
+
+/*
+ * Enhanced conversions for leads: upload a conversion identified ONLY by a
+ * hashed email, with no gclid at all.
+ *
+ * This is the mechanism that makes a sales-led funnel measurable — a demo
+ * booked in June and a licence signed in October share an email and nothing
+ * else. It is off by default because it is not purely a OneUptime-side switch:
+ * the Google Ads account must have enhanced conversions for leads turned on
+ * and the conversion action configured for it, and uploading email-only
+ * conversions to an account without that returns a per-conversion rejection.
+ *
+ * Hashing the email ALONGSIDE a click id needs no flag and is always sent — it
+ * only improves the match rate of a conversion that was uploadable anyway.
+ */
+export const GoogleAdsEnhancedConversionsForLeadsEnabled: boolean =
+  process.env["GOOGLE_ADS_ENHANCED_CONVERSIONS_FOR_LEADS_ENABLED"] === "true";
 
 // Meta (Facebook) Conversions API. Server-only secrets.
 export const MetaConversionsPixelId: string =
@@ -425,6 +456,8 @@ export const MicrosoftAdsSignUpConversionName: string =
   process.env["MICROSOFT_ADS_SIGNUP_CONVERSION_NAME"] || "";
 export const MicrosoftAdsPaidSubscriptionConversionName: string =
   process.env["MICROSOFT_ADS_PAID_SUBSCRIPTION_CONVERSION_NAME"] || "";
+export const MicrosoftAdsMeetingBookedConversionName: string =
+  process.env["MICROSOFT_ADS_MEETING_BOOKED_CONVERSION_NAME"] || "";
 
 // LinkedIn Conversions API. Server-only secrets.
 export const LinkedInConversionsAccessToken: string =
@@ -441,6 +474,8 @@ export const LinkedInSignUpConversionId: string =
   process.env["LINKEDIN_SIGNUP_CONVERSION_ID"] || "";
 export const LinkedInPaidSubscriptionConversionId: string =
   process.env["LINKEDIN_PAID_SUBSCRIPTION_CONVERSION_ID"] || "";
+export const LinkedInMeetingBookedConversionId: string =
+  process.env["LINKEDIN_MEETING_BOOKED_CONVERSION_ID"] || "";
 
 // Reddit Conversions API. Server-only secrets.
 export const RedditAdsOAuthClientId: string =
@@ -820,6 +855,13 @@ export const AverageSessionReplaySessionSizeInBytes: number =
 export const AverageProfileSampleRowSizeInBytes: number =
   parsePositiveNumberFromEnv("AVERAGE_PROFILE_SAMPLE_ROW_SIZE_IN_BYTES", 512);
 
+/*
+ * Security events are wider than log rows (typed entity columns plus a
+ * fully flattened source payload), so the fallback average is 2 KiB.
+ */
+export const AverageSecurityEventRowSizeInBytes: number =
+  parsePositiveNumberFromEnv("AVERAGE_SECURITY_EVENT_ROW_SIZE_IN_BYTES", 2048);
+
 export const SlackAppClientId: string | null =
   process.env["SLACK_APP_CLIENT_ID"] || null;
 export const SlackAppClientSecret: string | null =

package/Server/Infrastructure/Postgres/SchemaMigrations/1787800000000-AddScopeToNetworkDeviceLinkRule.ts

@@ -0,0 +1,19 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddScopeToNetworkDeviceLinkRule1787800000000
+  implements MigrationInterface
+{
+  public name: string = "AddScopeToNetworkDeviceLinkRule1787800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLinkRule" ADD "scope" character varying(100) DEFAULT 'Project'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkDeviceLinkRule" DROP COLUMN "scope"`,
+    );
+  }
+}