@oneuptime/common 12.0.15 → 12.0.17

package/Models/DatabaseModels/WorkflowOwnerRule.ts

@@ -41,6 +41,9 @@ import {
     Permission.ProjectAdmin,
     Permission.ProjectMember,
     Permission.Viewer,
+    Permission.WorkflowAdmin,
+    Permission.WorkflowMember,
+    Permission.WorkflowViewer,
     Permission.ReadWorkflowOwnerRule,
   ],
   delete: [
@@ -84,6 +87,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [],
@@ -120,6 +126,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [],
@@ -150,6 +159,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -184,6 +196,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -216,6 +231,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -251,6 +269,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -288,6 +309,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -334,6 +358,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -367,6 +394,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -402,6 +432,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -448,6 +481,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [
@@ -494,6 +530,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [],
@@ -531,6 +570,9 @@ export default class WorkflowOwnerRule extends BaseModel {
       Permission.ProjectAdmin,
       Permission.ProjectMember,
       Permission.Viewer,
+      Permission.WorkflowAdmin,
+      Permission.WorkflowMember,
+      Permission.WorkflowViewer,
       Permission.ReadWorkflowOwnerRule,
     ],
     update: [],

package/Server/API/TelemetryAPI.ts

@@ -18,12 +18,17 @@ import LogAggregationService, {
   HistogramRequest,
   FacetValue,
   FacetRequest,
+  LogAttributeFilters,
   AnalyticsRequest,
   AnalyticsChartType,
   AnalyticsAggregation,
   AnalyticsTimeseriesRow,
   AnalyticsTopItem,
   AnalyticsTableRow,
+  ErrorPatternFilters,
+  ErrorPatternTimelineRequest,
+  TopErrorPattern,
+  TopErrorPatternsRequest,
 } from "../Services/LogAggregationService";
 import TraceAggregationService, {
   HistogramBucket as TraceHistogramBucket,
@@ -455,10 +460,9 @@ router.post(
         ? (body["sessionIds"] as Array<string>)
         : undefined;
 
-      const attributes: Record<string, string | Array<string>> | undefined =
-        body["attributes"]
-          ? (body["attributes"] as Record<string, string | Array<string>>)
-          : undefined;
+      const attributes: LogAttributeFilters | undefined = body["attributes"]
+        ? (body["attributes"] as LogAttributeFilters)
+        : undefined;
 
       const resourceScopes: Array<ResourceEntityScope> | undefined =
         await resolveResourceScopesFromBody(body, databaseProps.tenantId);
@@ -559,8 +563,8 @@ router.post(
         ? (body["sessionIds"] as Array<string>)
         : undefined;
 
-      const attributes: Record<string, string> | undefined = body["attributes"]
-        ? (body["attributes"] as Record<string, string>)
+      const attributes: LogAttributeFilters | undefined = body["attributes"]
+        ? (body["attributes"] as LogAttributeFilters)
         : undefined;
 
       /*
@@ -1918,6 +1922,248 @@ router.post(
   },
 );
 
+// --- Log Error Pattern Endpoints ---
+
+/*
+ * Shared body parsing for the two error-pattern endpoints. Both take the
+ * same filter shape as the histogram/facet endpoints so the Insights page
+ * can hand its one scope (time range, service selection, severities) to
+ * every panel it draws; the detail endpoint adds the pattern itself.
+ *
+ * Defensive about shapes throughout: these bodies come from the browser,
+ * and a stringly-typed or null field must mean "no filter" rather than
+ * becoming an active predicate that silently narrows the result.
+ */
+function parseErrorPatternFilterBody(
+  body: JSONObject,
+  projectId: ObjectID,
+): Omit<ErrorPatternFilters, "startTime" | "endTime"> {
+  const stringArray: (value: unknown) => Array<string> | undefined = (
+    value: unknown,
+  ): Array<string> | undefined => {
+    if (!Array.isArray(value)) {
+      return undefined;
+    }
+
+    const values: Array<string> = (value as Array<unknown>).filter(
+      (item: unknown): item is string => {
+        return typeof item === "string" && item.length > 0;
+      },
+    );
+
+    return values.length > 0 ? values : undefined;
+  };
+
+  const serviceIdStrings: Array<string> | undefined = stringArray(
+    body["serviceIds"],
+  );
+
+  return {
+    projectId,
+    serviceIds: serviceIdStrings
+      ? serviceIdStrings.map((id: string): ObjectID => {
+          return new ObjectID(id);
+        })
+      : undefined,
+    entityKeys: stringArray(body["entityKeys"]),
+    severityTexts: stringArray(body["severityTexts"]),
+    bodySearchText:
+      typeof body["bodySearchText"] === "string" &&
+      body["bodySearchText"].trim().length > 0
+        ? (body["bodySearchText"] as string)
+        : undefined,
+    traceIds: stringArray(body["traceIds"]),
+    spanIds: stringArray(body["spanIds"]),
+    sessionIds: stringArray(body["sessionIds"]),
+    attributes:
+      body["attributes"] && typeof body["attributes"] === "object"
+        ? (body["attributes"] as Record<string, string | Array<string>>)
+        : undefined,
+  };
+}
+
+/*
+ * Default window for the error-pattern endpoints: 24 hours rather than the
+ * one hour the histogram defaults to. "Top errors" is a question about a
+ * period long enough for a pattern to establish itself; an hour of a quiet
+ * service routinely has nothing in it.
+ */
+function parseErrorPatternWindow(body: JSONObject): {
+  startTime: Date;
+  endTime: Date;
+} {
+  const endTime: Date = body["endTime"]
+    ? OneUptimeDate.fromString(body["endTime"] as string)
+    : OneUptimeDate.getCurrentDate();
+
+  const startTime: Date = body["startTime"]
+    ? OneUptimeDate.fromString(body["startTime"] as string)
+    : OneUptimeDate.addRemoveHours(endTime, -24);
+
+  return { startTime, endTime };
+}
+
+router.post(
+  "/telemetry/logs/error-patterns",
+  ...requireLogReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+      const window: { startTime: Date; endTime: Date } =
+        parseErrorPatternWindow(body);
+
+      const request: TopErrorPatternsRequest = {
+        ...parseErrorPatternFilterBody(body, databaseProps.tenantId),
+        ...window,
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+        limit: typeof body["limit"] === "number" ? body["limit"] : undefined,
+      };
+
+      const patterns: Array<TopErrorPattern> =
+        await LogAggregationService.getTopErrorPatterns(request);
+
+      return Response.sendJsonObjectResponse(req, res, {
+        patterns: patterns as unknown as JSONObject,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
+/*
+ * Everything the UI needs to explain ONE error pattern, in a single round
+ * trip: when it fired, what else fired alongside it, what the occurrences
+ * have in common, which resources and traces carry it, and a handful of
+ * raw lines.
+ *
+ * The six aggregations run concurrently and each degrades to an empty
+ * result on its own failure. A correlation panel is supplementary
+ * information — one slow or unlucky sub-query should cost the user that
+ * section, not the whole page.
+ */
+router.post(
+  "/telemetry/logs/error-pattern-correlation",
+  ...requireLogReadAccess,
+  async (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ): Promise<void> => {
+    try {
+      const databaseProps: DatabaseCommonInteractionProps =
+        await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+      if (!databaseProps?.tenantId) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("Invalid Project ID"),
+        );
+      }
+
+      const body: JSONObject = req.body as JSONObject;
+
+      const pattern: string =
+        typeof body["pattern"] === "string" ? (body["pattern"] as string) : "";
+
+      if (pattern.trim().length === 0) {
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new BadDataException("pattern is required"),
+        );
+      }
+
+      const window: { startTime: Date; endTime: Date } =
+        parseErrorPatternWindow(body);
+
+      const bucketSizeInMinutes: number =
+        typeof body["bucketSizeInMinutes"] === "number" &&
+        body["bucketSizeInMinutes"] > 0
+          ? (body["bucketSizeInMinutes"] as number)
+          : computeDefaultBucketSize(window.startTime, window.endTime);
+
+      const detailRequest: ErrorPatternTimelineRequest = {
+        ...parseErrorPatternFilterBody(body, databaseProps.tenantId),
+        ...window,
+        resourceScopes: await resolveResourceScopesFromBody(
+          body,
+          databaseProps.tenantId,
+        ),
+        pattern,
+        bucketSizeInMinutes,
+        limit: typeof body["limit"] === "number" ? body["limit"] : undefined,
+      };
+
+      const degradeToEmpty: <T>(
+        promise: Promise<Array<T>>,
+      ) => Promise<Array<T>> = async <T>(
+        promise: Promise<Array<T>>,
+      ): Promise<Array<T>> => {
+        try {
+          return await promise;
+        } catch {
+          return [];
+        }
+      };
+
+      const [timeline, coOccurring, attributes, resources, traces, samples] =
+        await Promise.all([
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternTimeline(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternCoOccurrences(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternAttributes(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternResources(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternTraces(detailRequest),
+          ),
+          degradeToEmpty(
+            LogAggregationService.getErrorPatternSamples(detailRequest),
+          ),
+        ]);
+
+      return Response.sendJsonObjectResponse(req, res, {
+        pattern,
+        bucketSizeInMinutes,
+        timeline: timeline as unknown as JSONObject,
+        coOccurringPatterns: coOccurring as unknown as JSONObject,
+        attributes: attributes as unknown as JSONObject,
+        resources: resources as unknown as JSONObject,
+        traces: traces as unknown as JSONObject,
+        samples: samples as unknown as JSONObject,
+      });
+    } catch (err: unknown) {
+      next(err);
+    }
+  },
+);
+
 // --- Log Export Endpoint ---
 
 router.post(

package/Server/API/UserAPI.ts

@@ -325,6 +325,94 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
       },
     );
 
+    /*
+     * Require -- or stop requiring -- two factor auth for one user.
+     *
+     * Master-admin only, and its own route rather than a PUT to /user/:id
+     * carrying `enableTwoFactorAuth` for a reason that is not cosmetic: the
+     * generic write would succeed (a master admin bypasses the column's ACL)
+     * but it would NOT revoke the user's sessions, so "two factor auth is now
+     * required" would be a promise the product silently failed to keep for
+     * everybody already signed in. That revocation lives in
+     * UserService.setTwoFactorAuthRequired, where a caller cannot forget it.
+     *
+     * Session-only middleware, deliberately. This route WRITES, and the
+     * instance-wide master API key is scoped to reads for exactly this class
+     * of reason: a leaked static key that can read discloses, but one that can
+     * turn two factor auth off across every account on the instance is an
+     * account takeover with the safety catch removed.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/set-two-factor-auth-required`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const isRequired: unknown = req.body?.["isRequired"];
+
+          /*
+           * Type-checked rather than cast, and the check has to be `typeof`
+           * rather than truthiness. `Boolean(req.body["isRequired"])` would
+           * read a missing field, a null, or the string "false" as a request
+           * to turn the requirement OFF -- silently weakening an account's
+           * security in response to a malformed call.
+           */
+          if (typeof isRequired !== "boolean") {
+            throw new BadDataException(
+              "isRequired is required and must be a boolean.",
+            );
+          }
+
+          await UserService.setTwoFactorAuthRequired({
+            userId: userId,
+            isRequired: isRequired,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Clear everything one user has set up for two factor auth.
+     *
+     * This is the lost-device escape hatch. Two factor auth is self-service
+     * everywhere else in the product, which works right up until the phone
+     * holding the authenticator is gone: the user cannot produce a code, so
+     * they cannot sign in, so they cannot reach the page that would let them
+     * enrol a new one. Somebody outside the account has to be able to cut the
+     * knot.
+     *
+     * It does NOT turn the requirement off -- see
+     * UserService.resetTwoFactorAuth. Reset means "start again from a fresh QR
+     * code", not "you may now sign in with a password alone", and an operator
+     * helping with a lost phone should not have to notice that they had just
+     * downgraded the account.
+     *
+     * Takes no body: there is nothing to configure, and a route that ignores
+     * its body cannot be steered by one.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/reset-two-factor-auth`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          await UserService.resetTwoFactorAuth({
+            userId: userId,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/profile-picture/:userId`,
       async (req: ExpressRequest, res: ExpressResponse) => {

package/Server/EnvironmentConfig.ts

@@ -400,11 +400,35 @@ export const GoogleAdsLoginCustomerId: string =
  */
 export const GoogleAdsApiVersion: string =
   process.env["GOOGLE_ADS_API_VERSION"] || "v23";
-// Numeric conversion action ids from Google Ads (Goals -> Conversions).
+/*
+ * Numeric conversion action ids from Google Ads (Goals -> Conversions). One
+ * per conversion type: the provider maps types to actions exhaustively, and an
+ * empty value leaves that type pending rather than uploading it under some
+ * other type's action.
+ */
 export const GoogleAdsSignUpConversionActionId: string =
   process.env["GOOGLE_ADS_SIGNUP_CONVERSION_ACTION_ID"] || "";
 export const GoogleAdsPaidSubscriptionConversionActionId: string =
   process.env["GOOGLE_ADS_PAID_SUBSCRIPTION_CONVERSION_ACTION_ID"] || "";
+export const GoogleAdsMeetingBookedConversionActionId: string =
+  process.env["GOOGLE_ADS_MEETING_BOOKED_CONVERSION_ACTION_ID"] || "";
+
+/*
+ * Enhanced conversions for leads: upload a conversion identified ONLY by a
+ * hashed email, with no gclid at all.
+ *
+ * This is the mechanism that makes a sales-led funnel measurable — a demo
+ * booked in June and a licence signed in October share an email and nothing
+ * else. It is off by default because it is not purely a OneUptime-side switch:
+ * the Google Ads account must have enhanced conversions for leads turned on
+ * and the conversion action configured for it, and uploading email-only
+ * conversions to an account without that returns a per-conversion rejection.
+ *
+ * Hashing the email ALONGSIDE a click id needs no flag and is always sent — it
+ * only improves the match rate of a conversion that was uploadable anyway.
+ */
+export const GoogleAdsEnhancedConversionsForLeadsEnabled: boolean =
+  process.env["GOOGLE_ADS_ENHANCED_CONVERSIONS_FOR_LEADS_ENABLED"] === "true";
 
 // Meta (Facebook) Conversions API. Server-only secrets.
 export const MetaConversionsPixelId: string =
@@ -432,6 +456,8 @@ export const MicrosoftAdsSignUpConversionName: string =
   process.env["MICROSOFT_ADS_SIGNUP_CONVERSION_NAME"] || "";
 export const MicrosoftAdsPaidSubscriptionConversionName: string =
   process.env["MICROSOFT_ADS_PAID_SUBSCRIPTION_CONVERSION_NAME"] || "";
+export const MicrosoftAdsMeetingBookedConversionName: string =
+  process.env["MICROSOFT_ADS_MEETING_BOOKED_CONVERSION_NAME"] || "";
 
 // LinkedIn Conversions API. Server-only secrets.
 export const LinkedInConversionsAccessToken: string =
@@ -448,6 +474,8 @@ export const LinkedInSignUpConversionId: string =
   process.env["LINKEDIN_SIGNUP_CONVERSION_ID"] || "";
 export const LinkedInPaidSubscriptionConversionId: string =
   process.env["LINKEDIN_PAID_SUBSCRIPTION_CONVERSION_ID"] || "";
+export const LinkedInMeetingBookedConversionId: string =
+  process.env["LINKEDIN_MEETING_BOOKED_CONVERSION_ID"] || "";
 
 // Reddit Conversions API. Server-only secrets.
 export const RedditAdsOAuthClientId: string =
@@ -827,6 +855,13 @@ export const AverageSessionReplaySessionSizeInBytes: number =
 export const AverageProfileSampleRowSizeInBytes: number =
   parsePositiveNumberFromEnv("AVERAGE_PROFILE_SAMPLE_ROW_SIZE_IN_BYTES", 512);
 
+/*
+ * Security events are wider than log rows (typed entity columns plus a
+ * fully flattened source payload), so the fallback average is 2 KiB.
+ */
+export const AverageSecurityEventRowSizeInBytes: number =
+  parsePositiveNumberFromEnv("AVERAGE_SECURITY_EVENT_ROW_SIZE_IN_BYTES", 2048);
+
 export const SlackAppClientId: string | null =
   process.env["SLACK_APP_CLIENT_ID"] || null;
 export const SlackAppClientSecret: string | null =

package/Server/Infrastructure/Postgres/SchemaMigrations/1788000000000-AddDetectionRuleAndGoogleSecOpsConnection.ts

@@ -0,0 +1,88 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddDetectionRuleAndGoogleSecOpsConnection1788000000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddDetectionRuleAndGoogleSecOpsConnection1788000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "DetectionRule" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(50) NOT NULL, "description" character varying(500), "sigmaRuleYaml" text NOT NULL, "isEnabled" boolean NOT NULL DEFAULT true, "evaluationIntervalInMinutes" integer NOT NULL DEFAULT '1', "groupByField" character varying(100), "shouldCreateAlert" boolean NOT NULL DEFAULT true, "shouldWriteDetectionFinding" boolean NOT NULL DEFAULT true, "alertSeverityId" uuid, "lastEvaluatedAt" TIMESTAMP WITH TIME ZONE, "lastMatchAt" TIMESTAMP WITH TIME ZONE, "lastError" character varying(500), "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_4c12aeb76297c2c78a1e708ad6d" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_edcda59471223b272610e40e3b" ON "DetectionRule" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_861e04579580210cd030048d73" ON "DetectionRule" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "GoogleSecOpsConnection" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(50) NOT NULL, "region" character varying(100) NOT NULL, "instanceResourceName" character varying(500) NOT NULL, "serviceAccountJson" text NOT NULL, "isEnabled" boolean NOT NULL DEFAULT true, "pollIntervalInMinutes" integer NOT NULL DEFAULT '5', "lastPolledAt" TIMESTAMP WITH TIME ZONE, "cursor" character varying(500), "lastError" character varying(500), "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_fbdcd1f7453680c7f366cc80c07" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_e59b999458abf1dea973d32fc5" ON "GoogleSecOpsConnection" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_9fa67f61a03217dd86fab69fe7" ON "GoogleSecOpsConnection" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD CONSTRAINT "FK_edcda59471223b272610e40e3b1" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD CONSTRAINT "FK_62fd7565adf068755445ef78509" FOREIGN KEY ("alertSeverityId") REFERENCES "AlertSeverity"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD CONSTRAINT "FK_81bc91fe3e02553aad48fc2785f" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" ADD CONSTRAINT "FK_30f12b8514cc8ebb336988ebf68" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ADD CONSTRAINT "FK_e59b999458abf1dea973d32fc53" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ADD CONSTRAINT "FK_7df7932fd07705129a78d75c39a" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" ADD CONSTRAINT "FK_1fff38e9cdc1d04b44dfdd9c1cc" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" DROP CONSTRAINT "FK_1fff38e9cdc1d04b44dfdd9c1cc"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" DROP CONSTRAINT "FK_7df7932fd07705129a78d75c39a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "GoogleSecOpsConnection" DROP CONSTRAINT "FK_e59b999458abf1dea973d32fc53"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP CONSTRAINT "FK_30f12b8514cc8ebb336988ebf68"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP CONSTRAINT "FK_81bc91fe3e02553aad48fc2785f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP CONSTRAINT "FK_62fd7565adf068755445ef78509"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DetectionRule" DROP CONSTRAINT "FK_edcda59471223b272610e40e3b1"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_9fa67f61a03217dd86fab69fe7"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_e59b999458abf1dea973d32fc5"`,
+    );
+    await queryRunner.query(`DROP TABLE "GoogleSecOpsConnection"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_861e04579580210cd030048d73"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_edcda59471223b272610e40e3b"`,
+    );
+    await queryRunner.query(`DROP TABLE "DetectionRule"`);
+  }
+}