@oneuptime/common 12.0.14 → 12.0.16

package/Server/Utils/CronTab.ts

@@ -15,4 +15,77 @@ export default class CronTab {
       throw new BadDataException(`Invalid cron expression: ${crontab}`);
     }
   }
+
+  /**
+   * Longest gap (in seconds) between two consecutive runs of this cron.
+   *
+   * Used to reason about how much data an evaluation window can possibly
+   * contain: a monitor polled once every five minutes produces at most one
+   * sample per five minutes, so "all values over the last 5 minutes" can
+   * never be backed by more than one sample. Callers use this to decide
+   * whether a window is actually covered by data or is merely still
+   * filling up.
+   *
+   * The *longest* gap is deliberate. Irregular expressions (say
+   * `0,1,30 * * * *`) have both very short and very long gaps; taking the
+   * shortest would make callers demand data at a cadence the cron does not
+   * actually deliver, and they would wait forever.
+   *
+   * Returns null when the expression is missing or unparseable so callers
+   * can fall back to inferring the cadence from the data itself.
+   */
+  @CaptureSpan()
+  public static getIntervalInSeconds(
+    crontab: string | undefined | null,
+    referenceDate?: Date | undefined,
+  ): number | null {
+    if (!crontab) {
+      return null;
+    }
+
+    try {
+      const interval: CronExpression = CronParser.parseExpression(crontab, {
+        currentDate: referenceDate || new Date(),
+      });
+
+      /*
+       * Six executions -> five gaps. Enough to cover a full hour-wrap for
+       * every interval offered in the UI without walking the schedule far
+       * into the future.
+       */
+      const executionTimes: Array<Date> = [];
+
+      for (let i: number = 0; i < 6; i++) {
+        executionTimes.push(interval.next().toDate());
+      }
+
+      let longestGapInSeconds: number = 0;
+
+      for (let i: number = 1; i < executionTimes.length; i++) {
+        const gapInSeconds: number =
+          (executionTimes[i]!.getTime() - executionTimes[i - 1]!.getTime()) /
+          1000;
+
+        if (gapInSeconds > longestGapInSeconds) {
+          longestGapInSeconds = gapInSeconds;
+        }
+      }
+
+      if (longestGapInSeconds <= 0) {
+        return null;
+      }
+
+      return longestGapInSeconds;
+    } catch (error) {
+      /*
+       * Debug rather than error: this runs on the criteria-evaluation hot
+       * path, and monitors created before the interval was a cron (or
+       * through a Terraform example using the "Every 5 minutes" label) would
+       * otherwise log on every single check. Callers treat null as "cadence
+       * unknown" and fall back to inferring it from the data.
+       */
+      logger.debug(error);
+      return null;
+    }
+  }
 }

package/Server/Utils/GlobalSsoAuthorization.ts

@@ -0,0 +1,175 @@
+import ObjectID from "../../Types/ObjectID";
+import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
+
+/*
+ * The stateful half of Global SSO enforcement.
+ *
+ * A Global SSO/OIDC token is a 30-day, self-contained JWT with no project
+ * binding, so on its own it answers only "this person authenticated against
+ * SOME instance-wide identity provider at some point in the last month". Two
+ * questions it cannot answer:
+ *
+ *   1. IS THE PROVIDER STILL TRUSTED? Turning a provider off, or deleting it,
+ *      has to actually cut off access. Without a check at request time the
+ *      "Enabled" toggle does nothing to anyone already signed in, for up to
+ *      thirty days. This check is UNCONDITIONAL - "disabled" has only one
+ *      possible meaning.
+ *
+ *   2. DOES THE PROVIDER GOVERN THIS PROJECT? Deliberately OPT-IN, per
+ *      provider, via `restrictToAttachedProjects`. The attachment rows
+ *      (GlobalSsoProject / GlobalOidcProject) were introduced as the
+ *      PROVISIONING allow-list - "a SAML assertion can only ever provision a
+ *      user into projects that a master admin has explicitly attached here",
+ *      per the model's own docstring - and the login routers gate a session on
+ *      membership of ANY project, not of an attached one. Reading attachments
+ *      as an access boundary by default would therefore lock existing users
+ *      out of projects they legitimately reach today, immediately on upgrade,
+ *      with no way to recover from inside the product. So it stays off unless
+ *      an admin asks for it.
+ *
+ * Both answers come from Postgres and run on every authenticated request
+ * against an SSO-enforced project, so both are cached in-process for 60
+ * seconds, and concurrent misses share one query.
+ */
+
+export const GLOBAL_SSO_AUTHORIZATION_CACHE_TTL_MS: number = 60_000;
+
+/** What the enforcement path needs to know about a global provider. */
+export interface GlobalProviderTrust {
+  // The provider row exists and its "Enabled" toggle is on.
+  isUsable: boolean;
+  // The admin opted this provider into attachment-scoped access.
+  restrictToAttachedProjects: boolean;
+}
+
+/*
+ * Absence of an entry means "not yet looked up", which is why these are read
+ * with an explicit `undefined` check rather than a truthiness test: a cached
+ * "this provider is disabled" must not be mistaken for a cache miss and
+ * re-queried on every single request.
+ */
+export const globalSsoProviderTrustCache: InMemoryTTLCache<GlobalProviderTrust> =
+  new InMemoryTTLCache(10_000);
+
+/**
+ * A provider's attachment rows.
+ *
+ * `hasAnyAttachmentRows` distinguishes "this provider has no attachments at
+ * all" from "it has attachments but every one of them is disabled". Collapsing
+ * those two would mean an admin disabling the last attachment WIDENS the
+ * provider to every project - the exact opposite of the intent.
+ */
+export interface GlobalProviderAttachments {
+  hasAnyAttachmentRows: boolean;
+  enabledProjectIds: Array<string>;
+}
+
+export const globalSsoAttachmentsCache: InMemoryTTLCache<GlobalProviderAttachments> =
+  new InMemoryTTLCache(10_000);
+
+export type GlobalProviderKind = "sso" | "oidc";
+
+/*
+ * Namespaced by kind. A Global SSO provider and a Global OIDC provider are
+ * different rows in different tables and could in principle share an id;
+ * collapsing the keys would let one vouch for the other.
+ */
+export function globalProviderCacheKey(
+  providerKind: GlobalProviderKind,
+  providerId: ObjectID,
+): string {
+  return `${providerKind}:${providerId.toString()}`;
+}
+
+/**
+ * Decides whether a provider's attachments cover `projectId`, for a provider
+ * that has opted into attachment-scoped access.
+ *
+ * A provider with no attachment rows at all is instance-wide, matching the
+ * "default-all" reading the login routers use. A provider that HAS attachment
+ * rows governs exactly the enabled ones - so disabling them all denies rather
+ * than widens.
+ */
+export function doAttachmentsGovernProject(
+  attachments: GlobalProviderAttachments,
+  projectId: ObjectID,
+): boolean {
+  if (!attachments.hasAnyAttachmentRows) {
+    return true;
+  }
+
+  return attachments.enabledProjectIds.includes(projectId.toString());
+}
+
+/** Drops every cached answer. Used by the write hooks and by tests. */
+export function clearGlobalSsoAuthorizationCaches(): void {
+  globalSsoProviderTrustCache.clear();
+  globalSsoAttachmentsCache.clear();
+  inFlightTrustLookups.clear();
+  inFlightAttachmentLookups.clear();
+}
+
+/*
+ * In-flight de-duplication.
+ *
+ * The multi-tenant permission path fans out over every project the user
+ * belongs to CONCURRENTLY. Without this, a cold cache means N simultaneous
+ * copies of the same two queries - for a user in fifty projects, a hundred
+ * queries where two would do. Worse, failures are never cached, so a database
+ * that is already struggling gets the full fan-out again on every request.
+ *
+ * Sharing the promise collapses all of that to one query per provider, and a
+ * rejection is shared too rather than being retried N times in the same tick.
+ */
+const inFlightTrustLookups: Map<
+  string,
+  Promise<GlobalProviderTrust>
+> = new Map();
+const inFlightAttachmentLookups: Map<
+  string,
+  Promise<GlobalProviderAttachments>
+> = new Map();
+
+async function loadOnce<T>(
+  inFlight: Map<string, Promise<T>>,
+  key: string,
+  load: () => Promise<T>,
+): Promise<T> {
+  const existing: Promise<T> | undefined = inFlight.get(key);
+
+  if (existing) {
+    return existing;
+  }
+
+  const pending: Promise<T> = load().finally((): void => {
+    /*
+     * Only clear the slot if it is still OURS. A cache clear between the two
+     * (every write to a Global SSO/OIDC service does exactly that, twice) lets
+     * a NEWER lookup take the key while this one is still on the wire; a blind
+     * delete would evict that newer entry when this one settles, and the fan-
+     * out that follows would stop de-duplicating - the one situation this
+     * exists for.
+     */
+    if (inFlight.get(key) === pending) {
+      inFlight.delete(key);
+    }
+  });
+
+  inFlight.set(key, pending);
+
+  return pending;
+}
+
+export function loadTrustOnce(
+  key: string,
+  load: () => Promise<GlobalProviderTrust>,
+): Promise<GlobalProviderTrust> {
+  return loadOnce(inFlightTrustLookups, key, load);
+}
+
+export function loadAttachmentsOnce(
+  key: string,
+  load: () => Promise<GlobalProviderAttachments>,
+): Promise<GlobalProviderAttachments> {
+  return loadOnce(inFlightAttachmentLookups, key, load);
+}

package/Server/Utils/Marketing/ConversionUploadProvider.ts

@@ -1,6 +1,11 @@
 import { AxiosError } from "axios";
+import Attribution from "../Attribution";
 import { JSONObject } from "../../../Types/JSON";
-import { MarketingConversionType } from "../../../Types/Marketing/MarketingConversion";
+import {
+  AdUploadableMarketingConversionTypes,
+  LeadMarketingConversionTypes,
+  MarketingConversionType,
+} from "../../../Types/Marketing/MarketingConversion";
 import MarketingConversion from "../../../Models/DatabaseModels/MarketingConversion";
 
 /*
@@ -11,15 +16,34 @@ import MarketingConversion from "../../../Models/DatabaseModels/MarketingConvers
  *
  * Contract:
  * - getSkipReason returns a human-readable reason when this conversion can
- *   never be uploaded to this platform (wrong/missing click id, outside the
- *   platform's upload window, provider not configured for this conversion
- *   type). Null means uploadable.
+ *   never be uploaded to this platform (conversion type with no ad-platform
+ *   mapping, no identifier this platform can match on, outside the platform's
+ *   upload window, provider not configured for this conversion type). Null
+ *   means uploadable. It is implemented here and must not be overridden —
+ *   providers implement getProviderSkipReason instead, which only runs for
+ *   conversion types that are ad-uploadable at all.
  * - upload() sends one batch. Per-conversion PERMANENT rejections are
  *   returned in the result keyed by array index; they will not be retried.
  *   Transport/auth-level failures must THROW — the whole batch stays pending
  *   and is retried on the next run (bounded by the job's attempt cap), so
  *   providers should be safe against duplicate delivery where the platform
  *   supports an idempotency/dedup key.
+ *
+ * IDENTIFIERS
+ *
+ * A conversion can be matched to an ad click two ways, and most platforms
+ * accept either:
+ *
+ *   - the click id the visitor carried (gclid, fbclid, msclkid, ...), which is
+ *     exact but only survives as far as the browser storage that held it; and
+ *   - the SHA-256 of the person's email, which every platform calls "enhanced
+ *     conversions"/"enhanced matching" and which survives a change of device,
+ *     a cleared browser, and the weeks between a demo and the deal it led to.
+ *
+ * Providers must consider a conversion uploadable when EITHER is present.
+ * Requiring the click id — which is what every provider here used to do — threw
+ * away exactly the sales-led conversions the enhanced-matching mechanism was
+ * designed for.
  */
 
 export interface ConversionUploadBatchResult {
@@ -30,14 +54,28 @@ export interface ConversionUploadBatchResult {
 export interface ConversionSkip {
   reason: string;
   /*
-   * Permanent skips (missing click id, outside the platform's upload window)
-   * are recorded as Skipped and never revisited. Non-permanent skips
+   * Permanent skips (no usable identifier, outside the platform's upload
+   * window) are recorded as Skipped and never revisited. Non-permanent skips
    * (missing provider configuration such as a conversion action id) leave
    * the conversion pending so it uploads once the configuration is added.
    */
   isPermanent: boolean;
 }
 
+/*
+ * A per-conversion-type mapping. Written as a Record over the enum rather than
+ * a switch or a two-way branch on purpose: the compiler refuses a Record that
+ * omits a member, so adding a MarketingConversionType is a build error in every
+ * provider until that provider states what the new type means on its platform.
+ *
+ * That is the guarantee Docs/analytics/enterprise-conversion-tracking.md asks
+ * for. Before it existed, providers chose their conversion action with
+ * `isSignUp(conversion) ? signUp : paidSubscription`, so a booked meeting added
+ * to the uploadable list would have been reported to every ad platform as a
+ * purchase.
+ */
+export type ConversionTypeMapping<T> = Record<MarketingConversionType, T>;
+
 export default abstract class ConversionUploadProvider {
   // Stable key used in MarketingConversion.uploadState. Never change it.
   public abstract readonly key: string;
@@ -52,7 +90,28 @@ export default abstract class ConversionUploadProvider {
 
   public abstract isConfigured(): boolean;
 
-  public abstract getSkipReason(
+  /*
+   * Screens conversion types the ledger records but no ad platform has a
+   * mapping for, before any provider sees them.
+   */
+  public getSkipReason(conversion: MarketingConversion): ConversionSkip | null {
+    if (
+      !AdUploadableMarketingConversionTypes.includes(
+        conversion.conversionType as MarketingConversionType,
+      )
+    ) {
+      return {
+        reason: `Conversion type ${
+          conversion.conversionType || "unknown"
+        } has no ad platform conversion mapping`,
+        isPermanent: true,
+      };
+    }
+
+    return this.getProviderSkipReason(conversion);
+  }
+
+  protected abstract getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null;
 
@@ -69,7 +128,64 @@ export default abstract class ConversionUploadProvider {
     return typeof value === "string" && value ? value : undefined;
   }
 
+  /*
+   * The hashed email this conversion can be matched on, or undefined.
+   *
+   * Prefers the stored emailHash and falls back to hashing the email column,
+   * so rows written before emailHash existed still match. Both paths go
+   * through Attribution so the digest is identical whichever one produced it.
+   */
+  protected getHashedEmail(
+    conversion: MarketingConversion,
+  ): string | undefined {
+    if (conversion.emailHash) {
+      return conversion.emailHash;
+    }
+
+    return Attribution.hashEmail(conversion.email) || undefined;
+  }
+
+  /*
+   * Resolve a per-type value, or undefined when the column holds a string that
+   * is not a known conversion type. The column is a plain varchar, so this
+   * cannot be assumed away even though the mapping itself is exhaustive.
+   */
+  protected resolveByConversionType<T>(
+    conversion: MarketingConversion,
+    mapping: ConversionTypeMapping<T>,
+  ): T | undefined {
+    const conversionType: MarketingConversionType =
+      conversion.conversionType as MarketingConversionType;
+
+    if (!Object.values(MarketingConversionType).includes(conversionType)) {
+      return undefined;
+    }
+
+    return mapping[conversionType];
+  }
+
+  /*
+   * A sales-led lead (booked meeting, enterprise licence request) rather than
+   * a completed transaction.
+   */
+  protected isLead(conversion: MarketingConversion): boolean {
+    return LeadMarketingConversionTypes.includes(
+      conversion.conversionType as MarketingConversionType,
+    );
+  }
+
+  /*
+   * The revenue to report for this conversion, in USD.
+   *
+   * Leads return undefined regardless of what the row holds. A booked meeting
+   * is not money, and reporting one as revenue would let a bidding algorithm
+   * optimise towards booking meetings that never close.
+   */
   protected getValueInUSD(conversion: MarketingConversion): number | undefined {
+    if (this.isLead(conversion)) {
+      return undefined;
+    }
+
     if (
       conversion.conversionValueInUSDCents === undefined ||
       conversion.conversionValueInUSDCents === null ||
@@ -80,10 +196,6 @@ export default abstract class ConversionUploadProvider {
     return conversion.conversionValueInUSDCents / 100;
   }
 
-  protected isSignUp(conversion: MarketingConversion): boolean {
-    return conversion.conversionType === MarketingConversionType.SignUp;
-  }
-
   protected isOlderThanDays(
     conversion: MarketingConversion,
     days: number,

package/Server/Utils/Marketing/Providers/GoogleAds.ts

@@ -3,7 +3,9 @@ import {
   GoogleAdsApiVersion,
   GoogleAdsCustomerId,
   GoogleAdsDeveloperToken,
+  GoogleAdsEnhancedConversionsForLeadsEnabled,
   GoogleAdsLoginCustomerId,
+  GoogleAdsMeetingBookedConversionActionId,
   GoogleAdsOAuthClientId,
   GoogleAdsOAuthClientSecret,
   GoogleAdsOAuthRefreshToken,
@@ -12,9 +14,11 @@ import {
 } from "../../../EnvironmentConfig";
 import ConversionUploadProvider, {
   ConversionSkip,
+  ConversionTypeMapping,
   ConversionUploadBatchResult,
 } from "../ConversionUploadProvider";
 import { JSONObject } from "../../../../Types/JSON";
+import { MarketingConversionType } from "../../../../Types/Marketing/MarketingConversion";
 import MarketingConversion from "../../../../Models/DatabaseModels/MarketingConversion";
 import logger from "../../Logger";
 
@@ -26,8 +30,16 @@ const GOOGLE_MAX_CONVERSION_AGE_IN_DAYS: number = 90;
 /*
  * Google Ads offline click conversions
  * (customers/{id}:uploadClickConversions) with OAuth2 refresh-token auth.
- * Supports gclid, wbraid and gbraid click ids. Uses partialFailure so valid
- * conversions succeed even when others in the batch fail.
+ * Supports gclid, wbraid and gbraid click ids, plus enhanced conversions — a
+ * SHA-256 email in userIdentifiers. Uses partialFailure so valid conversions
+ * succeed even when others in the batch fail.
+ *
+ * A hashed email is attached to EVERY upload that has one, which only improves
+ * matching. Uploading a conversion that has ONLY a hashed email — enhanced
+ * conversions for leads, and the only way a sales-led deal months after the
+ * click is ever attributed — additionally requires the account to be set up
+ * for it, so it is gated on
+ * GOOGLE_ADS_ENHANCED_CONVERSIONS_FOR_LEADS_ENABLED.
  */
 export default class GoogleAdsProvider extends ConversionUploadProvider {
   public override readonly key: string = "google";
@@ -46,12 +58,17 @@ export default class GoogleAdsProvider extends ConversionUploadProvider {
     );
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
-    if (!this.getGoogleClickId(conversion)) {
+    if (
+      !this.getGoogleClickId(conversion) &&
+      !this.canUploadAsLead(conversion)
+    ) {
       return {
-        reason: "No Google click id (gclid/wbraid/gbraid)",
+        reason: GoogleAdsEnhancedConversionsForLeadsEnabled
+          ? "No Google click id (gclid/wbraid/gbraid) and no email to match on"
+          : "No Google click id (gclid/wbraid/gbraid)",
         isPermanent: true,
       };
     }
@@ -94,10 +111,49 @@ export default class GoogleAdsProvider extends ConversionUploadProvider {
     return null;
   }
 
+  /*
+   * Enhanced conversions for leads: this conversion has no click id, but it
+   * has an email and the account is configured to match on one.
+   */
+  private canUploadAsLead(conversion: MarketingConversion): boolean {
+    return Boolean(
+      GoogleAdsEnhancedConversionsForLeadsEnabled &&
+        this.getHashedEmail(conversion),
+    );
+  }
+
+  /*
+   * userIdentifiers per the enhanced-conversions spec. FIRST_PARTY is the
+   * correct source: the address was given to OneUptime directly, not bought or
+   * inferred.
+   */
+  private getUserIdentifiers(
+    conversion: MarketingConversion,
+  ): Array<JSONObject> {
+    const hashedEmail: string | undefined = this.getHashedEmail(conversion);
+
+    if (!hashedEmail) {
+      return [];
+    }
+
+    return [
+      {
+        hashedEmail: hashedEmail,
+        userIdentifierSource: "FIRST_PARTY",
+      },
+    ];
+  }
+
   private getConversionActionId(conversion: MarketingConversion): string {
-    return this.isSignUp(conversion)
-      ? GoogleAdsSignUpConversionActionId
-      : GoogleAdsPaidSubscriptionConversionActionId;
+    const mapping: ConversionTypeMapping<string> = {
+      [MarketingConversionType.SignUp]: GoogleAdsSignUpConversionActionId,
+      [MarketingConversionType.MeetingBooked]:
+        GoogleAdsMeetingBookedConversionActionId,
+      [MarketingConversionType.PaidSubscription]:
+        GoogleAdsPaidSubscriptionConversionActionId,
+    };
+
+    return this.resolveByConversionType(conversion, mapping) || "";
   }
 
   private async getAccessToken(): Promise<string> {
@@ -174,6 +230,13 @@ export default class GoogleAdsProvider extends ConversionUploadProvider {
           ),
         };
 
+        const userIdentifiers: Array<JSONObject> =
+          this.getUserIdentifiers(conversion);
+
+        if (userIdentifiers.length > 0) {
+          payload["userIdentifiers"] = userIdentifiers;
+        }
+
         const valueInUSD: number | undefined = this.getValueInUSD(conversion);
 
         if (valueInUSD !== undefined) {

package/Server/Utils/Marketing/Providers/LinkedIn.ts

@@ -2,14 +2,17 @@ import axios, { AxiosError } from "axios";
 import {
   LinkedInApiVersion,
   LinkedInConversionsAccessToken,
+  LinkedInMeetingBookedConversionId,
   LinkedInPaidSubscriptionConversionId,
   LinkedInSignUpConversionId,
 } from "../../../EnvironmentConfig";
 import ConversionUploadProvider, {
   ConversionSkip,
+  ConversionTypeMapping,
   ConversionUploadBatchResult,
 } from "../ConversionUploadProvider";
 import { JSONObject } from "../../../../Types/JSON";
+import { MarketingConversionType } from "../../../../Types/Marketing/MarketingConversion";
 import MarketingConversion from "../../../../Models/DatabaseModels/MarketingConversion";
 
 const REQUEST_TIMEOUT_MS: number = 30000;
@@ -18,11 +21,12 @@ const REQUEST_TIMEOUT_MS: number = 30000;
 const LINKEDIN_MAX_CONVERSION_AGE_IN_DAYS: number = 90;
 
 /*
- * LinkedIn Conversions API (api.linkedin.com/rest/conversionEvents) using
- * the li_fat_id first-party click id. Conversion rules are referenced by
- * urn:lla:llaPartnerConversion:{id}. Events are posted one at a time (small
- * volumes); auth-level failures abort the batch for retry, other per-event
- * rejections are recorded as permanent.
+ * LinkedIn Conversions API (api.linkedin.com/rest/conversionEvents) matching
+ * on the li_fat_id first-party click id, a SHA-256 email, or both — LinkedIn
+ * accepts several userIds and resolves whichever it can. Conversion rules are
+ * referenced by urn:lla:llaPartnerConversion:{id}. Events are posted one at a
+ * time (small volumes); auth-level failures abort the batch for retry, other
+ * per-event rejections are recorded as permanent.
  *
  * Note: LinkedIn access tokens expire (typically 60 days) — the token in
  * LINKEDIN_CONVERSIONS_ACCESS_TOKEN must be rotated externally.
@@ -41,12 +45,12 @@ export default class LinkedInProvider extends ConversionUploadProvider {
     return Boolean(LinkedInConversionsAccessToken);
   }
 
-  public override getSkipReason(
+  protected override getProviderSkipReason(
     conversion: MarketingConversion,
   ): ConversionSkip | null {
-    if (!this.getClickId(conversion, "li_fat_id")) {
+    if (this.getUserIds(conversion).length === 0) {
       return {
-        reason: "No LinkedIn click id (li_fat_id)",
+        reason: "No LinkedIn click id (li_fat_id) and no email to match on",
         isPermanent: true,
       };
     }
@@ -71,9 +75,48 @@ export default class LinkedInProvider extends ConversionUploadProvider {
   }
 
   private getConversionRuleId(conversion: MarketingConversion): string {
-    return this.isSignUp(conversion)
-      ? LinkedInSignUpConversionId
-      : LinkedInPaidSubscriptionConversionId;
+    const mapping: ConversionTypeMapping<string> = {
+      [MarketingConversionType.SignUp]: LinkedInSignUpConversionId,
+      [MarketingConversionType.MeetingBooked]:
+        LinkedInMeetingBookedConversionId,
+      [MarketingConversionType.PaidSubscription]:
+        LinkedInPaidSubscriptionConversionId,
+    };
+
+    return this.resolveByConversionType(conversion, mapping) || "";
+  }
+
+  /*
+   * Every identifier LinkedIn can resolve this person by. Sending both when
+   * both exist raises the match rate; sending only the email is how a demo
+   * booked on one device and a licence signed on another are still joined to
+   * the click that started it.
+   */
+  private getUserIds(conversion: MarketingConversion): Array<JSONObject> {
+    const userIds: Array<JSONObject> = [];
+
+    const clickId: string | undefined = this.getClickId(
+      conversion,
+      "li_fat_id",
+    );
+
+    if (clickId) {
+      userIds.push({
+        idType: "LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID",
+        idValue: clickId,
+      });
+    }
+
+    const hashedEmail: string | undefined = this.getHashedEmail(conversion);
+
+    if (hashedEmail) {
+      userIds.push({
+        idType: "SHA256_EMAIL",
+        idValue: hashedEmail,
+      });
+    }
+
+    return userIds;
   }
 
   public override async upload(
@@ -92,12 +135,7 @@ export default class LinkedInProvider extends ConversionUploadProvider {
         // Dedup key: a retried batch must not double-count conversions.
         eventId: conversion.id!.toString(),
         user: {
-          userIds: [
-            {
-              idType: "LINKEDIN_FIRST_PARTY_ADS_TRACKING_UUID",
-              idValue: this.getClickId(conversion, "li_fat_id") || "",
-            },
-          ],
+          userIds: this.getUserIds(conversion),
         },
       };