@oneuptime/common 12.0.17 → 12.0.19

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -540,6 +540,10 @@ import { AddLlmModelPrice1788300000000 } from "./1788300000000-AddLlmModelPrice"
 import { AddMarketingConversionAttribution1788400000000 } from "./1788400000000-AddMarketingConversionAttribution";
 import { RemoveLlmCostBudgetAlertColumns1788500000000 } from "./1788500000000-RemoveLlmCostBudgetAlertColumns";
 import { AddDetectionRuleIncidentColumns1788600000000 } from "./1788600000000-AddDetectionRuleIncidentColumns";
+import { RemoveMarketingConversionUploadState1788700000000 } from "./1788700000000-RemoveMarketingConversionUploadState";
+import { DropMarketingConversionAddEnterpriseLicenseEmail1788800000000 } from "./1788800000000-DropMarketingConversionAddEnterpriseLicenseEmail";
+import { RedactStoredMonitorIngestSecrets1788900000000 } from "./1788900000000-RedactStoredMonitorIngestSecrets";
+import { AddUserSlackAndMicrosoftTeams1789000000000 } from "./1789000000000-AddUserSlackAndMicrosoftTeams";
 import { MigrationName1787142779538 } from "./1787142779538-MigrationName";
 import { MigrationName1787156982416 } from "./1787156982416-MigrationName";
 
@@ -1088,4 +1092,8 @@ export default [
   AddMarketingConversionAttribution1788400000000,
   RemoveLlmCostBudgetAlertColumns1788500000000,
   AddDetectionRuleIncidentColumns1788600000000,
+  RemoveMarketingConversionUploadState1788700000000,
+  DropMarketingConversionAddEnterpriseLicenseEmail1788800000000,
+  RedactStoredMonitorIngestSecrets1788900000000,
+  AddUserSlackAndMicrosoftTeams1789000000000,
 ];

package/Server/Infrastructure/Queue.ts

@@ -17,6 +17,13 @@ export enum QueueName {
   Worker = "Worker",
   Telemetry = "Telemetry",
   Runbook = "Runbook",
+  /*
+   * Outbound marketing conversion webhooks. Data-carrying (the job holds the
+   * whole event), unlike Worker, which looks its function up by name. Nothing
+   * stores these events, so this queue is the only thing that survives a
+   * receiver being briefly unreachable.
+   */
+  MarketingEvent = "MarketingEvent",
 }
 
 export type QueueJob = Job;

package/Server/Services/BillingService.ts

@@ -2074,6 +2074,14 @@ export class BillingService extends BaseService {
       return "price_1U0iWJANuQdJ93r7iVAXwhdP";
     }
 
+    if (productType === ProductType.SecurityEvents) {
+      if (this.isTestEnvironment()) {
+        return "price_1U7efaANuQdJ93r74hFVOgdS";
+      }
+
+      return "price_1U7edTANuQdJ93r7hR9jpBfv";
+    }
+
     throw new BadDataException(
       "Plan with productType " + productType + " not found",
     );

package/Server/Services/EnterpriseLicenseService.ts

@@ -1,10 +1,70 @@
 import DatabaseService from "./DatabaseService";
 import EnterpriseLicense from "../../Models/DatabaseModels/EnterpriseLicense";
+import MarketingEventUtil from "../Utils/Marketing/MarketingEventUtil";
+import { MarketingEventType } from "../../Types/Marketing/MarketingEvent";
+import { OnCreate } from "../Types/Database/Hooks";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 export class Service extends DatabaseService<EnterpriseLicense> {
   public constructor() {
     super(EnterpriseLicense);
   }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<EnterpriseLicense>,
+    createdItem: EnterpriseLicense,
+  ): Promise<EnterpriseLicense> {
+    /*
+     * The outbound enterprise_license_issued conversion.
+     *
+     * This is where sales-led revenue enters the funnel. Everything else
+     * OneUptime emits is self-serve and knows its own value from the plan
+     * table; an enterprise contract is negotiated, so annualContractValue is
+     * the only place the number exists at all.
+     *
+     * Emitted even with no email and no ACV. A licence issued without either
+     * is still a licence issued, and a receiver that sees the event can chase
+     * the missing detail — one that never sees it cannot. The two nulls are
+     * reported honestly rather than defaulted to zero, which would quietly
+     * drag reported contract value down.
+     */
+    MarketingEventUtil.emitInBackground(
+      MarketingEventUtil.buildEvent({
+        eventType: MarketingEventType.EnterpriseLicenseIssued,
+        eventId: `${MarketingEventType.EnterpriseLicenseIssued}:${createdItem.id?.toString()}`,
+        occurredAt: createdItem.createdAt || new Date(),
+        email: createdItem.email?.toString(),
+        /*
+         * No attribution source. A licence row is typed in by a human and
+         * carries no session, so its campaign is whatever the meeting_booked
+         * sharing its email carried — the join the receiver makes on
+         * emailHash, not something OneUptime can restate here.
+         */
+        data: {
+          enterpriseLicenseId: createdItem.id?.toString() || "",
+          companyName: createdItem.companyName || "",
+          annualContractValueInUSD:
+            createdItem.annualContractValue === undefined ||
+            createdItem.annualContractValue === null
+              ? null
+              : createdItem.annualContractValue,
+          currency: "USD",
+          isEvaluationLicense: Boolean(createdItem.isEvaluationLicense),
+          userLimit:
+            createdItem.userLimit === undefined ||
+            createdItem.userLimit === null
+              ? null
+              : createdItem.userLimit,
+          expiresAt: createdItem.expiresAt
+            ? createdItem.expiresAt.toISOString()
+            : null,
+        },
+      }),
+    );
+
+    return createdItem;
+  }
 }
 
 export default new Service();

package/Server/Services/Index.ts

@@ -145,7 +145,6 @@ import GlobalOidcProjectService from "./GlobalOidcProjectService";
 import PromoCodeService from "./PromoCodeService";
 import EnterpriseLicenseService from "./EnterpriseLicenseService";
 import EnterpriseLicenseInstanceService from "./EnterpriseLicenseInstanceService";
-import MarketingConversionService from "./MarketingConversionService";
 import OpenSourceDeploymentService from "./OpenSourceDeploymentService";
 import RecommendationDismissalService from "./RecommendationDismissalService";
 import ResellerPlanService from "./ResellerPlanService";
@@ -213,6 +212,8 @@ import UserSmsService from "./UserSmsService";
 import UserIncomingCallNumberService from "./UserIncomingCallNumberService";
 import UserWhatsAppService from "./UserWhatsAppService";
 import UserTelegramService from "./UserTelegramService";
+import UserSlackService from "./UserSlackService";
+import UserMicrosoftTeamsService from "./UserMicrosoftTeamsService";
 import WorkflowLogService from "./WorkflowLogService";
 // Workflows.
 import WorkflowService from "./WorkflowService";
@@ -292,6 +293,7 @@ import WorkspaceSettingService from "./WorkspaceSettingService";
 import WorkspaceNotificationRuleService from "./WorkspaceNotificationRuleService";
 import WorkspaceNotificationLogService from "./WorkspaceNotificationLogService";
 import WorkspaceNotificationSummaryService from "./WorkspaceNotificationSummaryService";
+import WorkspaceUserNotificationService from "./WorkspaceUserNotificationService";
 import OnCallDutyPolicyUserOverrideService from "./OnCallDutyPolicyUserOverrideService";
 
 import MonitorLogService from "./MonitorLogService";
@@ -309,7 +311,6 @@ const services: Array<BaseService> = [
   PromoCodeService,
   EnterpriseLicenseService,
   EnterpriseLicenseInstanceService,
-  MarketingConversionService,
   OpenSourceDeploymentService,
 
   ResellerService,
@@ -490,6 +491,8 @@ const services: Array<BaseService> = [
   UserIncomingCallNumberService,
   UserWhatsAppService,
   UserTelegramService,
+  UserSlackService,
+  UserMicrosoftTeamsService,
   UserTotpAuthService,
   UserWebAuthnService,
 
@@ -587,6 +590,7 @@ const services: Array<BaseService> = [
   WorkspaceNotificationRuleService,
   WorkspaceNotificationLogService,
   WorkspaceNotificationSummaryService,
+  WorkspaceUserNotificationService,
 
   ProjectSCIMLogService,
   StatusPageSCIMLogService,

package/Server/Services/LlmLogService.ts

@@ -57,24 +57,40 @@ export class Service extends DatabaseService<Model> {
     const incidentRunMembership: string = `EXISTS (SELECT 1 FROM "AIRun" AS "run" WHERE "run"."_id" = "log"."aiRunId" AND "run"."triggeredByIncidentId" IS NOT NULL AND "run"."triggeredByAlertId" IS NULL)`;
     const alertRunMembership: string = `EXISTS (SELECT 1 FROM "AIRun" AS "run" WHERE "run"."_id" = "log"."aiRunId" AND "run"."triggeredByIncidentId" IS NULL AND "run"."triggeredByAlertId" IS NOT NULL)`;
 
-    let subjectClause: string = `AND "log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND NOT ("log"."feature" = ANY($4)) AND NOT ("log"."feature" = ANY($5)) AND NOT (${incidentRunMembership}) AND NOT (${alertRunMembership})`;
+    /*
+     * Placeholders and bindings are built together, per branch, because
+     * PostgreSQL derives a prepared statement's parameter count from the
+     * HIGHEST $n present in the text — not from what the driver sends. A
+     * branch that binds an argument it never references is rejected outright
+     * at Bind (bind message supplies 5 parameters, but prepared statement
+     * requires 4), and a branch that skips a placeholder is rejected at Parse
+     * (could not determine data type of parameter $4). Both are runtime-only
+     * failures no compiler catches, so the parameter array is grown next to
+     * the clause that reads it and never assembled apart from it.
+     */
+    const params: Array<unknown> = [
+      data.projectId.toString(), // $1
+      data.since, // $2
+      data.features, // $3
+    ];
+
+    let subjectClause: string;
 
     if (data.incidentId) {
+      params.push(legacyIncidentFeatures); // $4
       subjectClause = `AND (("log"."incidentId" IS NOT NULL AND "log"."alertId" IS NULL) OR ("log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND (("log"."feature" = ANY($4)) OR ${incidentRunMembership})))`;
     } else if (data.alertId) {
-      subjectClause = `AND (("log"."incidentId" IS NULL AND "log"."alertId" IS NOT NULL) OR ("log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND (("log"."feature" = ANY($5)) OR ${alertRunMembership})))`;
+      params.push(legacyAlertFeatures); // $4
+      subjectClause = `AND (("log"."incidentId" IS NULL AND "log"."alertId" IS NOT NULL) OR ("log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND (("log"."feature" = ANY($4)) OR ${alertRunMembership})))`;
+    } else {
+      params.push(legacyIncidentFeatures, legacyAlertFeatures); // $4, $5
+      subjectClause = `AND "log"."incidentId" IS NULL AND "log"."alertId" IS NULL AND NOT ("log"."feature" = ANY($4)) AND NOT ("log"."feature" = ANY($5)) AND NOT (${incidentRunMembership}) AND NOT (${alertRunMembership})`;
     }
 
     const rows: Array<{ total: string | number | null }> =
       await this.getRepository().manager.query(
         `SELECT COALESCE(SUM("log"."totalTokens"), 0) AS "total" FROM "LlmLog" AS "log" WHERE "log"."projectId" = $1 AND "log"."createdAt" >= $2 AND "log"."feature" = ANY($3) ${subjectClause} AND "log"."deletedAt" IS NULL`,
-        [
-          data.projectId.toString(),
-          data.since,
-          data.features,
-          legacyIncidentFeatures,
-          legacyAlertFeatures,
-        ],
+        params,
       );
 
     return Number(rows[0]?.total || 0);

package/Server/Services/OnCallReadinessService.ts

@@ -16,6 +16,8 @@ import UserPushService from "./UserPushService";
 import UserService from "./UserService";
 import UserSmsService from "./UserSmsService";
 import UserTelegramService from "./UserTelegramService";
+import UserSlackService from "./UserSlackService";
+import UserMicrosoftTeamsService from "./UserMicrosoftTeamsService";
 import UserWebhookService from "./UserWebhookService";
 import UserWhatsAppService from "./UserWhatsAppService";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
@@ -51,6 +53,8 @@ import UserNotificationRule from "../../Models/DatabaseModels/UserNotificationRu
 import UserPush from "../../Models/DatabaseModels/UserPush";
 import UserSMS from "../../Models/DatabaseModels/UserSMS";
 import UserTelegram from "../../Models/DatabaseModels/UserTelegram";
+import UserSlack from "../../Models/DatabaseModels/UserSlack";
+import UserMicrosoftTeams from "../../Models/DatabaseModels/UserMicrosoftTeams";
 import UserWebhook from "../../Models/DatabaseModels/UserWebhook";
 import UserWhatsApp from "../../Models/DatabaseModels/UserWhatsApp";
 
@@ -116,7 +120,7 @@ export enum ResponderSource {
 }
 
 /**
- * The seven channels a page can be delivered on. These strings are the same literals the
+ * The nine channels a page can be delivered on. These strings are the same literals the
  * fallback uses for `channelsUsed` (UserNotificationRuleService.chooseFallbackChannels),
  * deliberately: an operator reading "notified via fallback (Push, Email)" in an execution
  * log and "Push, Email" in the readiness table must not have to translate between two
@@ -129,6 +133,8 @@ export enum ReadinessMethodType {
   Call = "Call",
   WhatsApp = "WhatsApp",
   Telegram = "Telegram",
+  Slack = "Slack",
+  MicrosoftTeams = "Microsoft Teams",
   Webhook = "Webhook",
 }
 
@@ -436,6 +442,8 @@ const RULE_TYPE_SCOPES: Array<RuleTypeScope> = [
 const METHOD_DISPLAY_ORDER: Array<ReadinessMethodType> = [
   ReadinessMethodType.Push,
   ReadinessMethodType.Email,
+  ReadinessMethodType.Slack,
+  ReadinessMethodType.MicrosoftTeams,
   ReadinessMethodType.SMS,
   ReadinessMethodType.Call,
   ReadinessMethodType.WhatsApp,
@@ -2194,6 +2202,74 @@ export default class OnCallReadinessService {
       },
     });
 
+    await this.readEveryPage<UserSlack>({
+      description: "Slack notification methods",
+      projectId: projectId,
+      completeness: completeness,
+      service: UserSlackService,
+      query: {
+        projectId: projectId,
+        userId: new Includes(userIds),
+      },
+      /*
+       * The username only — never slackUserId. The member id is the
+       * addressable target the bot sends to; the username is the human-facing
+       * label, and it is the one a user can recognise as theirs.
+       */
+      select: {
+        _id: true,
+        userId: true,
+        slackUserName: true,
+        isVerified: true,
+      },
+      consumePage: (rows: Array<UserSlack>): void => {
+        for (const row of rows) {
+          addMethod(row, {
+            methodType: ReadinessMethodType.Slack,
+            maskedIdentifier: maskIdentifier(
+              row.slackUserName,
+              MaskedIdentifierKind.Handle,
+            ),
+            isVerified: Boolean(row.isVerified),
+          });
+        }
+      },
+    });
+
+    await this.readEveryPage<UserMicrosoftTeams>({
+      description: "Microsoft Teams notification methods",
+      projectId: projectId,
+      completeness: completeness,
+      service: UserMicrosoftTeamsService,
+      query: {
+        projectId: projectId,
+        userId: new Includes(userIds),
+      },
+      /*
+       * The display name only — never microsoftTeamsUserId. The Entra id is
+       * the addressable target the bot sends to; the display name is the
+       * human-facing label, and it is the one a user can recognise as theirs.
+       */
+      select: {
+        _id: true,
+        userId: true,
+        microsoftTeamsUserName: true,
+        isVerified: true,
+      },
+      consumePage: (rows: Array<UserMicrosoftTeams>): void => {
+        for (const row of rows) {
+          addMethod(row, {
+            methodType: ReadinessMethodType.MicrosoftTeams,
+            maskedIdentifier: maskIdentifier(
+              row.microsoftTeamsUserName,
+              MaskedIdentifierKind.Handle,
+            ),
+            isVerified: Boolean(row.isVerified),
+          });
+        }
+      },
+    });
+
     await this.readEveryPage<UserWebhook>({
       description: "webhook notification methods",
       projectId: projectId,
@@ -2677,7 +2753,7 @@ export default class OnCallReadinessService {
    * the real thing rather than a hopeful "some verified method".
    *
    * This mirrors UserNotificationRuleService.chooseFallbackChannels exactly, including
-   * the project switches: zero-cost channels first and BOTH of them if present, then one
+   * the project switches: zero-cost channels first and ALL of them if present, then one
    * paid channel in escalating-intrusiveness order, then webhook. If that function's
    * order ever changes, this one has to change with it — a readiness surface promising
    * "falls back to SMS" for a project that has SMS switched off is worse than saying
@@ -2709,6 +2785,14 @@ export default class OnCallReadinessService {
       zeroCost.push(ReadinessMethodType.Email);
     }
 
+    if (has(ReadinessMethodType.Slack)) {
+      zeroCost.push(ReadinessMethodType.Slack);
+    }
+
+    if (has(ReadinessMethodType.MicrosoftTeams)) {
+      zeroCost.push(ReadinessMethodType.MicrosoftTeams);
+    }
+
     if (zeroCost.length > 0) {
       return zeroCost;
     }

package/Server/Services/ProjectService.ts

@@ -16,6 +16,8 @@ import UpdateBy from "../Types/Database/UpdateBy";
 import logger, { LogAttributes } from "../Utils/Logger";
 import Errors from "../Utils/Errors";
 import ProductAnalytics from "../Utils/ProductAnalytics";
+import MarketingEventUtil from "../Utils/Marketing/MarketingEventUtil";
+import { MarketingEventType } from "../../Types/Marketing/MarketingEvent";
 import SessionReplayGateCacheStore from "../Utils/SessionReplay/SessionReplayGateCacheStore";
 import AccessTokenService from "./AccessTokenService";
 import BillingService from "./BillingService";
@@ -558,10 +560,21 @@ export class ProjectService extends DatabaseService<Model> {
         trialEndsAt: true,
         paymentProviderCustomerId: true,
         createdOwnerEmail: true,
+        /*
+         * The full attribution set, not just the three UTMs the analytics
+         * properties carry: the outbound plan-change conversion is the only
+         * place the campaign that won a customer is ever reported, and a
+         * column left unselected reaches the receiver as empty rather than as
+         * an error.
+         */
         utmSource: true,
         utmMedium: true,
         utmCampaign: true,
+        utmTerm: true,
+        utmContent: true,
+        utmUrl: true,
         clickIds: true,
+        firstTouchAttribution: true,
       },
       props: {
         isRoot: true,
@@ -982,6 +995,60 @@ These are no longer recorded against the project and have to be cancelled by han
       distinctId: data.project.createdOwnerEmail.toString(),
       properties: properties,
     });
+
+    this.emitPlanChangeMarketingEvent({
+      project: data.project,
+      properties: properties,
+      isUpgrade: properties["is_upgrade"] === true,
+      isDowngrade: properties["is_downgrade"] === true,
+    });
+  }
+
+  /*
+   * The outbound subscription_upgraded / subscription_downgraded conversions.
+   *
+   * Rides on the analytics pass above rather than on the plan-change path
+   * directly, because that is where "is this an upgrade" is already decided —
+   * by plan ORDER, not price, so a monthly-to-yearly switch at the same tier
+   * is neither. Duplicating that comparison here is how the two would
+   * eventually disagree about what a customer did.
+   *
+   * Only real tier movements are emitted. A first plan on a project with no
+   * previous one has no direction (both flags read false, since oldPlanOrder
+   * is null), and an interval change is not a conversion — sending either as
+   * an upgrade would inflate exactly the number this exists to report.
+   */
+  private emitPlanChangeMarketingEvent(data: {
+    project: Model;
+    properties: JSONObject;
+    isUpgrade: boolean;
+    isDowngrade: boolean;
+  }): void {
+    if (!data.isUpgrade && !data.isDowngrade) {
+      return;
+    }
+
+    const eventType: MarketingEventType = data.isUpgrade
+      ? MarketingEventType.SubscriptionUpgraded
+      : MarketingEventType.SubscriptionDowngraded;
+
+    const occurredAt: Date = new Date();
+
+    MarketingEventUtil.emitInBackground(
+      MarketingEventUtil.buildEvent({
+        eventType: eventType,
+        /*
+         * A project can legitimately upgrade, downgrade and upgrade again, so
+         * unlike a signup or a booking there is no naturally unique key —
+         * the instant is what separates one change from the next.
+         */
+        eventId: `${eventType}:${data.project.id?.toString()}:${occurredAt.toISOString()}`,
+        occurredAt: occurredAt,
+        email: data.project.createdOwnerEmail?.toString(),
+        attributionSource: data.project,
+        data: data.properties,
+      }),
+    );
   }
 
   private async sendSubscriptionChangeWebhookSlackNotification(

package/Server/Services/UserMicrosoftTeamsService.ts

@@ -0,0 +1,208 @@
+import CreateBy from "../Types/Database/CreateBy";
+import DeleteBy from "../Types/Database/DeleteBy";
+import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import UserNotificationRuleService, {
+  NotificationDeletionImpact,
+  NotificationMethodChannel,
+} from "./UserNotificationRuleService";
+import WorkspaceProjectAuthTokenService from "./WorkspaceProjectAuthTokenService";
+import WorkspaceUserAuthTokenService from "./WorkspaceUserAuthTokenService";
+import logger from "../Utils/Logger";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
+import { JSONObject } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
+import WorkspaceType from "../../Types/Workspace/WorkspaceType";
+import WorkspaceProjectAuthToken from "../../Models/DatabaseModels/WorkspaceProjectAuthToken";
+import WorkspaceUserAuthToken from "../../Models/DatabaseModels/WorkspaceUserAuthToken";
+import Model from "../../Models/DatabaseModels/UserMicrosoftTeams";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    const itemsToDelete: Array<Model> = await this.findBy({
+      query: deleteBy.query,
+      select: {
+        _id: true,
+        projectId: true,
+      },
+      skip: 0,
+      limit: LIMIT_MAX,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const item of itemsToDelete) {
+      await UserNotificationRuleService.deleteBy({
+        query: {
+          userMicrosoftTeamsId: item.id!,
+          projectId: item.projectId!,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+    }
+
+    return {
+      deleteBy,
+      carryForward: null,
+    };
+  }
+
+  /**
+   * What this user would lose if this Microsoft Teams account were deleted.
+   * Ask BEFORE calling delete; nothing here refuses anything.
+   *
+   * The hook directly above deletes every UserNotificationRule that points at
+   * this account, and the foreign key is onDelete: "CASCADE" so the rows would
+   * go even if it did not.
+   */
+  @CaptureSpan()
+  public async getDeletionImpact(data: {
+    itemId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<NotificationDeletionImpact> {
+    return UserNotificationRuleService.getNotificationMethodDeletionImpact({
+      projectId: data.projectId,
+      methodType: NotificationMethodChannel.MicrosoftTeams,
+      methodId: data.itemId,
+    });
+  }
+
+  /*
+   * A Microsoft Teams notification method is a POINTER at the user's existing
+   * workspace link, not a hand-typed address: the Microsoft Entra user id is
+   * resolved from the user's own WorkspaceUserAuthToken and never accepted
+   * from the request. That is why creation IS verification — the OAuth dance
+   * that wrote the auth-token row already proved the person controls that
+   * Microsoft Teams account.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    if (!createBy.props.isRoot && createBy.data.isVerified) {
+      throw new BadDataException("isVerified cannot be set to true");
+    }
+
+    if (!createBy.props.isRoot && createBy.data.microsoftTeamsUserId) {
+      throw new BadDataException("microsoftTeamsUserId cannot be set directly");
+    }
+
+    if (!createBy.data.projectId || !createBy.data.userId) {
+      throw new BadDataException("projectId and userId are required");
+    }
+
+    const projectId: ObjectID = new ObjectID(
+      createBy.data.projectId.toString(),
+    );
+    const userId: ObjectID = new ObjectID(createBy.data.userId.toString());
+
+    /*
+     * One workspace link per (user, project) means a second row would be an
+     * exact duplicate of the first.
+     */
+    const existingCount: number = (
+      await this.countBy({
+        query: {
+          projectId: projectId,
+          userId: userId,
+        },
+        props: {
+          isRoot: true,
+        },
+      })
+    ).toNumber();
+
+    if (existingCount > 0) {
+      throw new BadDataException(
+        "Microsoft Teams is already added as a notification method for this project.",
+      );
+    }
+
+    const projectAuth: WorkspaceProjectAuthToken | null =
+      await WorkspaceProjectAuthTokenService.getProjectAuth({
+        projectId: projectId,
+        workspaceType: WorkspaceType.MicrosoftTeams,
+      });
+
+    if (!projectAuth || !projectAuth.authToken) {
+      throw new BadDataException(
+        "This project is not connected to Microsoft Teams. Please ask a project admin to connect Microsoft Teams in Project Settings > Microsoft Teams Integration.",
+      );
+    }
+
+    const userAuth: WorkspaceUserAuthToken | null =
+      await WorkspaceUserAuthTokenService.getUserAuth({
+        projectId: projectId,
+        userId: userId,
+        workspaceType: WorkspaceType.MicrosoftTeams,
+      });
+
+    if (!userAuth || !userAuth.workspaceUserId) {
+      throw new BadDataException(
+        "Your Microsoft Teams account is not connected to OneUptime for this project. Please go to User Settings > Microsoft Teams Integration and connect your Microsoft Teams account first.",
+      );
+    }
+
+    createBy.data.microsoftTeamsUserId = userAuth.workspaceUserId;
+    createBy.data.isVerified = true;
+
+    /* Display label only — captured when the user linked their account. */
+    const displayName: string | undefined = (
+      userAuth.miscData as JSONObject | undefined
+    )?.["displayName"] as string | undefined;
+
+    if (displayName) {
+      createBy.data.microsoftTeamsUserName = displayName;
+    }
+
+    return {
+      createBy,
+      carryForward: null,
+    };
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    /*
+     * The row is born verified (creation is gated on the live workspace
+     * link), so default on-call rules are seeded at create time — same as
+     * webhooks.
+     */
+    if (createdItem.projectId && createdItem.userId && createdItem.id) {
+      try {
+        await UserNotificationRuleService.addDefaultNotificationRulesForVerifiedMethod(
+          {
+            projectId: createdItem.projectId,
+            userId: createdItem.userId,
+            notificationMethod: {
+              userMicrosoftTeamsId: createdItem.id,
+            },
+          },
+        );
+      } catch (err) {
+        logger.error(err);
+      }
+    }
+
+    return createdItem;
+  }
+}
+
+export default new Service();