@oneuptime/common 12.0.17 → 12.0.19

package/build/dist/Server/Utils/Monitor/MonitorPayloadRedaction.js

@@ -0,0 +1,233 @@
+import { isSensitiveLogKey, REDACTED } from "../LogRedaction";
+/*
+ * Credential stripping for monitor ingest payloads.
+ *
+ * https://github.com/OneUptime/oneuptime/issues/3360
+ *
+ * The infrastructure agent authenticates by putting the monitor's
+ * `serverMonitorSecretKey` in BOTH the ingest URL and the JSON body
+ * (`ServerMonitorReport.SecretKey`, `json:"secretKey"`). The URL copy is
+ * transient. The body copy is not: the deserialized body becomes
+ * `dataToProcess`, and `dataToProcess` is written verbatim to three places
+ * that a read-only principal can select from:
+ *
+ *   - `MonitorLog.logBody` (ClickHouse, `Permission.Viewer` readable),
+ *   - `Monitor.serverMonitorResponse` (Postgres jsonb, `Viewer` readable),
+ *   - `MonitorProbe.lastMonitoringLog`.
+ *
+ * So the shared secret that authenticates every agent in the project sat at
+ * rest, in plaintext, behind the lowest privilege OneUptime grants. Rotating
+ * did not help: the replacement re-entered the payload on the very next beat.
+ *
+ * Two entry points, because the two sinks want different things:
+ *
+ *   - `stripAgentCredentials` DELETES the key. It runs at the ingest boundary,
+ *     before `dataToProcess` exists, so the secret never reaches any sink and
+ *     never enters the process's monitor-evaluation state at all. Deleting
+ *     rather than masking keeps `Monitor.serverMonitorResponse` faithful to
+ *     the `ServerMonitorResponse` interface, which declares no `secretKey`.
+ *
+ *   - `redactForPersistence` MASKS the value with `[REDACTED]`. It runs on the
+ *     copy `MonitorLogUtil` writes to `logBody`. Masking is the better choice
+ *     there because `logBody` is a diagnostic record: an operator debugging an
+ *     API monitor wants to see THAT an `Authorization` header was sent without
+ *     seeing what it was. It is also the net underneath the boundary strip —
+ *     it applies to every monitor type and every future payload field, so a
+ *     credential added to some other ingest path does not silently start
+ *     accumulating in ClickHouse.
+ *
+ * What counts as a credential is delegated to `isSensitiveLogKey`, the same
+ * deny-by-default classifier the logger uses, so there is one list to keep
+ * current rather than two. It is structural only (decided by key name): the
+ * textual sweeps in `redactLogString` are right for log lines but would mangle
+ * a captured HTTP response body, which is legitimate monitor evidence.
+ */
+// Deep enough for any real ingest payload, shallow enough to bound the walk.
+const MAX_DEPTH = 12;
+/*
+ * One walker, two behaviours. `drop` picks whether a sensitive key is removed
+ * from its parent object or kept with its value replaced.
+ *
+ * Always returns a new object/array rather than mutating in place. The ingest
+ * caller hands us an object it is about to keep using, and `MonitorLogUtil`
+ * hands us a payload that is still being read by the criteria evaluator — so
+ * mutating the input would change what the monitor evaluates, not just what
+ * gets stored.
+ */
+const walk = (value, drop, depth) => {
+    /*
+     * Past the depth ceiling we cannot keep vouching for what is nested below,
+     * and a payload that deep is not something a monitor legitimately reports.
+     * Drop the subtree instead of passing it through unredacted.
+     */
+    if (depth > MAX_DEPTH) {
+        return null;
+    }
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => {
+            return walk(item, drop, depth + 1);
+        });
+    }
+    /*
+     * Dates and ObjectIDs survive the JSON round-trip as strings, but callers
+     * may hand us live instances (the ingest boundary runs before
+     * `JSON.stringify`). Anything that is not a plain object is a leaf.
+     */
+    if (typeof value !== "object" ||
+        Object.getPrototypeOf(value) !== Object.prototype) {
+        return value;
+    }
+    const source = value;
+    const result = {};
+    for (const key of Object.keys(source)) {
+        const child = source[key];
+        if (isSensitiveLogKey(key, child)) {
+            if (drop) {
+                continue;
+            }
+            result[key] = REDACTED;
+            continue;
+        }
+        result[key] = walk(child, drop, depth + 1);
+    }
+    return result;
+};
+/*
+ * Ingest boundary. Removes agent-supplied credentials from a freshly
+ * deserialized payload so the secret never becomes part of `dataToProcess`.
+ *
+ * Generic over the payload type because the caller immediately treats the
+ * result as its declared interface (`ServerMonitorResponse` and friends) —
+ * none of which declare a credential field, so removing one cannot invalidate
+ * the type.
+ */
+export const stripAgentCredentials = (payload) => {
+    if (payload === null || payload === undefined) {
+        return payload;
+    }
+    return walk(payload, true, 0);
+};
+/*
+ * Storage boundary. Masks credentials in the copy that is about to be written
+ * to `MonitorLog.logBody`.
+ */
+export const redactForPersistence = (payload) => {
+    if (payload === null || payload === undefined) {
+        return payload;
+    }
+    return walk(payload, false, 0);
+};
+/*
+ * Value boundary. Masks every textual occurrence of ONE monitor's own secret
+ * key inside an ingest payload.
+ *
+ * The two walkers above are structural: they decide by key name, which is the
+ * right test when a credential arrives as its own field (`secretKey`). The
+ * incoming-email path has the other shape. There the secret is not a field at
+ * all -- it is baked into a value that is otherwise legitimate evidence.
+ * `MonitorService` mints `incomingEmailSecretKey`, and
+ * `SendGridInboundProvider.generateMonitorEmailAddress` turns it into the
+ * monitor's ingest address, `monitor-{secretKey}@{inboundDomain}`. The address
+ * IS the credential -- `extractSecretKeyFromEmail` parses the key straight back
+ * out of it -- so everything that quotes the recipient quotes the key:
+ * `emailTo`, the `To:` header, and the `Received:` / `Delivered-To:` headers a
+ * relay adds on the way in.
+ *
+ * No key name marks any of those as sensitive, and none of them can simply be
+ * dropped. `IncomingEmailCriteria` evaluates `emailTo` for the "Email to"
+ * check, and mail that reaches the monitor through an alias or a forwarding
+ * rule carries a genuinely different -- and genuinely interesting -- recipient.
+ * So this masks the secret substring and leaves the rest of the value intact:
+ * domain, alias and relay chain all survive, and a filter written against them
+ * keeps matching.
+ *
+ * Matching is case-insensitive because the key is a UUID that reaches us
+ * through address normalisation (`extractEmailAddress` lowercases) and through
+ * relay headers that preserve whatever case the sender happened to use.
+ */
+/*
+ * A secret shorter than this is not a key we minted -- `ObjectID.generate()`
+ * returns a 36-character UUID. Sweeping for a short string would mask ordinary
+ * text that merely contains it, destroying the evidence this is trying to keep
+ * readable, so treat it as nothing to do rather than over-redact.
+ */
+const MIN_SWEEPABLE_SECRET_LENGTH = 8;
+/*
+ * Case-insensitive replace-all done by scan rather than by `RegExp`, so a
+ * secret that happens to contain regex metacharacters needs no escaping and
+ * cannot alter the pattern. Compares on lowercased copies but slices from the
+ * original, so the surrounding text keeps its own casing.
+ */
+const replaceAllInsensitive = (haystack, needle) => {
+    const lowerHaystack = haystack.toLowerCase();
+    const lowerNeedle = needle.toLowerCase();
+    let result = "";
+    let cursor = 0;
+    let index = lowerHaystack.indexOf(lowerNeedle, cursor);
+    while (index !== -1) {
+        result += haystack.slice(cursor, index) + REDACTED;
+        cursor = index + lowerNeedle.length;
+        index = lowerHaystack.indexOf(lowerNeedle, cursor);
+    }
+    return result + haystack.slice(cursor);
+};
+const sweep = (value, secret, depth) => {
+    // Same reasoning as `walk`: below the ceiling we cannot vouch for the value.
+    if (depth > MAX_DEPTH) {
+        return null;
+    }
+    if (value === null || value === undefined) {
+        return value;
+    }
+    if (typeof value === "string") {
+        return replaceAllInsensitive(value, secret);
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => {
+            return sweep(item, secret, depth + 1);
+        });
+    }
+    /*
+     * Leaf. Dates and ObjectIDs land here as live instances on the ingest side;
+     * neither can carry the secret as text, so they pass through untouched.
+     */
+    if (typeof value !== "object" ||
+        Object.getPrototypeOf(value) !== Object.prototype) {
+        return value;
+    }
+    const source = value;
+    const result = {};
+    /*
+     * Keys are swept too. `emailHeaders` is a `Dictionary<string>` built from
+     * whatever header names the relay sent, so a key is no more trustworthy than
+     * a value -- and a redacted key still serialises into the stored jsonb.
+     */
+    for (const key of Object.keys(source)) {
+        result[replaceAllInsensitive(key, secret)] = sweep(source[key], secret, depth + 1);
+    }
+    return result;
+};
+/*
+ * Generic over the payload type for the same reason as `stripAgentCredentials`:
+ * the caller goes on treating the result as its declared interface. Masking
+ * only ever rewrites strings in place, so every field keeps its declared type.
+ */
+export const redactMonitorSecret = (payload, secret) => {
+    if (payload === null || payload === undefined) {
+        return payload;
+    }
+    if (typeof secret !== "string" ||
+        secret.length < MIN_SWEEPABLE_SECRET_LENGTH) {
+        return payload;
+    }
+    return sweep(payload, secret, 0);
+};
+export default {
+    stripAgentCredentials,
+    redactForPersistence,
+    redactMonitorSecret,
+};
+//# sourceMappingURL=MonitorPayloadRedaction.js.map

package/build/dist/Server/Utils/Monitor/MonitorPayloadRedaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MonitorPayloadRedaction.js","sourceRoot":"","sources":["../../../../../Server/Utils/Monitor/MonitorPayloadRedaction.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AAEH,6EAA6E;AAC7E,MAAM,SAAS,GAAW,EAAE,CAAC;AAQ7B;;;;;;;;;GASG;AACH,MAAM,IAAI,GAAiB,CACzB,KAAgB,EAChB,IAAa,EACb,KAAa,EACF,EAAE;IACb;;;;OAIG;IACH,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE;YACnC,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAe,KAAmB,CAAC;IAC/C,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAc,MAAM,CAAC,GAAG,CAAc,CAAC;QAElD,IAAI,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YAClC,IAAI,IAAI,EAAE,CAAC;gBACT,SAAS;YACX,CAAC;YAED,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACvB,SAAS;QACX,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAIF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAkC,CAClE,OAAU,EACP,EAAE;IACL,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC,OAAoB,EAAE,IAAI,EAAE,CAAC,CAAM,CAAC;AAClD,CAAC,CAAC;AAIF;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiC,CAChE,OAAkB,EACP,EAAE;IACb,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;AACjC,CAAC,CAAC;AAOF;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH;;;;;GAKG;AACH,MAAM,2BAA2B,GAAW,CAAC,CAAC;AAO9C;;;;;GAKG;AACH,MAAM,qBAAqB,GAAkC,CAC3D,QAAgB,EAChB,MAAc,EACN,EAAE;IACV,MAAM,aAAa,GAAW,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrD,MAAM,WAAW,GAAW,MAAM,CAAC,WAAW,EAAE,CAAC;IAEjD,IAAI,MAAM,GAAW,EAAE,CAAC;IACxB,IAAI,MAAM,GAAW,CAAC,CAAC;IACvB,IAAI,KAAK,GAAW,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAE/D,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC;QACnD,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC;QACpC,KAAK,GAAG,aAAa,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACrD,CAAC;IAED,OAAO,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC,CAAC;AAQF,MAAM,KAAK,GAAkB,CAC3B,KAAgB,EAChB,MAAc,EACd,KAAa,EACF,EAAE;IACb,6EAA6E;IAC7E,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAe,EAAE,EAAE;YACnC,OAAO,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,SAAS,EACjD,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAe,KAAmB,CAAC;IAC/C,MAAM,MAAM,GAAe,EAAE,CAAC;IAE9B;;;;OAIG;IACH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,GAAG,KAAK,CAChD,MAAM,CAAC,GAAG,CAAc,EACxB,MAAM,EACN,KAAK,GAAG,CAAC,CACV,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAgC,CAC9D,OAAU,EACV,MAAiC,EAC9B,EAAE;IACL,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,CAAC,MAAM,GAAG,2BAA2B,EAC3C,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC,OAAoB,EAAE,MAAM,EAAE,CAAC,CAAM,CAAC;AACrD,CAAC,CAAC;AAEF,eAAe;IACb,qBAAqB;IACrB,oBAAoB;IACpB,mBAAmB;CACpB,CAAC"}

package/build/dist/Server/Utils/Workspace/MicrosoftTeams/MicrosoftTeams.js

@@ -605,6 +605,115 @@ class MicrosoftTeamsUtil extends WorkspaceBase {
             },
         });
     }
+    /*
+     * Sends a 1:1 message to a Teams user as the OneUptime bot, addressed by the
+     * user's Microsoft Entra object id (which is what WorkspaceUserAuthToken
+     * stores as workspaceUserId).
+     *
+     * This cannot go through sendDirectMessageToUser above: that method posts to
+     * Graph's /chats/{chatId}/messages, which needs an existing chat id and a
+     * delegated token. A personal chat between the bot and the user may not
+     * exist yet, so this uses the Bot Framework's createConversation, which
+     * resolves (or creates) the 1:1 conversation from the member's Entra id -
+     * provided the OneUptime app is installed for that user. When the personal
+     * chat was already captured from a bot activity, it is reused instead, which
+     * also preserves the regional serviceUrl captured with it.
+     */
+    static async sendDirectMessageToUserAsBot(data) {
+        var _a, _b;
+        const adaptiveCard = this.buildAdaptiveCardFromMessageBlocks({
+            messageBlocks: data.messageBlocks,
+        });
+        const projectAuth = await WorkspaceProjectAuthTokenService.getProjectAuth({
+            projectId: data.projectId,
+            workspaceType: WorkspaceType.MicrosoftTeams,
+        });
+        if (!projectAuth || !projectAuth.miscData) {
+            throw new BadDataException("Microsoft Teams integration not found for this project");
+        }
+        const miscData = projectAuth.miscData;
+        const tenantId = projectAuth.workspaceProjectId;
+        if (!tenantId) {
+            throw new BadDataException("Tenant ID not found in Microsoft Teams integration");
+        }
+        if (!MicrosoftTeamsAppClientId) {
+            throw new BadDataException("Microsoft Teams App Client ID not configured");
+        }
+        /*
+         * Prefer a personal chat that was already captured from a bot activity:
+         * it is known-deliverable and carries the regional serviceUrl.
+         */
+        const capturedPersonalChat = Object.values(miscData.availableChats || {}).find((chat) => {
+            return (chat.chatType === "personal" &&
+                (chat.memberAadObjectIds || []).includes(data.workspaceUserId));
+        });
+        if (capturedPersonalChat) {
+            await this.sendAdaptiveCardToChat({
+                chatId: capturedPersonalChat.id,
+                projectId: data.projectId,
+                adaptiveCard: adaptiveCard,
+            });
+            return;
+        }
+        /*
+         * No captured personal chat - create (or resolve) the 1:1 conversation
+         * proactively. A regional serviceUrl captured from any prior activity is
+         * preferred; the commercial-cloud global endpoint is the fallback.
+         */
+        const serviceUrl = ((_a = Object.values(miscData.availableChats || {}).find((chat) => {
+            return Boolean(chat.serviceUrl);
+        })) === null || _a === void 0 ? void 0 : _a.serviceUrl) ||
+            ((_b = Object.values(miscData.installedTeams || {}).find((team) => {
+                return Boolean(team.serviceUrl);
+            })) === null || _b === void 0 ? void 0 : _b.serviceUrl) ||
+            "https://smba.trafficmanager.net/teams/";
+        const adapter = this.getBotAdapter();
+        const conversationParameters = {
+            isGroup: false,
+            // 28:<appId> is the Teams-side bot account id.
+            bot: {
+                id: `28:${MicrosoftTeamsAppClientId}`,
+                name: "OneUptime Bot",
+            },
+            // Teams accepts the member's Microsoft Entra object id here.
+            members: [
+                {
+                    id: data.workspaceUserId,
+                    name: "",
+                },
+            ],
+            tenantId: tenantId,
+            channelData: {
+                tenant: {
+                    id: tenantId,
+                },
+            },
+        };
+        try {
+            await adapter.createConversationAsync(MicrosoftTeamsAppClientId, "msteams", serviceUrl, undefined, conversationParameters, async (context) => {
+                const message = MessageFactory.attachment({
+                    contentType: "application/vnd.microsoft.card.adaptive",
+                    content: adaptiveCard,
+                });
+                await context.sendActivity(message);
+            });
+        }
+        catch (error) {
+            logger.error("Error sending Microsoft Teams direct message via Bot Framework:", {
+                projectId: data.projectId.toString(),
+            });
+            logger.error(error);
+            /*
+             * Microsoft's roster rejection is meaningless to the person being paged.
+             * For a 1:1 conversation it means the OneUptime app is not installed for
+             * this user, so say exactly that.
+             */
+            if (this.isBotNotInConversationRosterError(error)) {
+                throw new BadDataException("The OneUptime app is not installed for this Microsoft Teams user. Ask them to add the OneUptime app in Microsoft Teams (personal scope) so the bot can message them directly.");
+            }
+            throw error;
+        }
+    }
     static async createChannelsIfDoesNotExist(data) {
         logger.debug("Creating channels if they do not exist with data:");
         logger.debug(data);
@@ -2905,6 +3014,15 @@ All monitoring checks are passing normally.`;
             if (data.serviceUrl && chat.serviceUrl !== data.serviceUrl) {
                 return false; // stored serviceUrl is stale.
             }
+            /*
+             * Personal chats captured before member Entra ids were recorded cannot
+             * serve as direct-message targets — treat them as stale so the next
+             * activity on the chat backfills the roster.
+             */
+            if (chat.chatType === "personal" &&
+                (chat.memberAadObjectIds || []).length === 0) {
+                return false;
+            }
         }
         return true;
     }
@@ -2949,6 +3067,7 @@ All monitoring checks are passing normally.`;
             // Resolve a human friendly name for the chat.
             const topic = conversation["name"];
             let memberNames = [];
+            let memberAadObjectIds = [];
             try {
                 const botId = (_b = data.turnContext.activity.recipient) === null || _b === void 0 ? void 0 : _b.id;
                 /*
@@ -2962,13 +3081,24 @@ All monitoring checks are passing normally.`;
                     members.push(...(page.members || []));
                     continuationToken = page.continuationToken;
                 } while (continuationToken);
-                memberNames = members
-                    .filter((member) => {
+                const humanMembers = members.filter((member) => {
                     return member.id !== botId;
-                })
-                    .map((member) => {
+                });
+                memberNames = humanMembers.map((member) => {
                     return member.name || "";
                 });
+                /*
+                 * The Entra object id is what maps a chat member back to the
+                 * OneUptime user who connected that Teams account, so personal chats
+                 * can serve as direct-message delivery targets.
+                 */
+                memberAadObjectIds = humanMembers
+                    .map((member) => {
+                    return member.aadObjectId || "";
+                })
+                    .filter((aadObjectId) => {
+                    return Boolean(aadObjectId);
+                });
             }
             catch (err) {
                 logger.debug("Could not fetch chat members for chat name resolution");
@@ -2984,6 +3114,7 @@ All monitoring checks are passing normally.`;
                 chatType: chatType,
                 serviceUrl: activityServiceUrl,
                 addedAt: OneUptimeDate.getCurrentDate().toISOString(),
+                memberAadObjectIds: memberAadObjectIds,
             };
             await this.saveChatToProjectAuthTokens({
                 tenantId: tenantId,
@@ -4002,6 +4133,12 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], MicrosoftTeamsUtil, "sendDirectMessageToUser", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], MicrosoftTeamsUtil, "sendDirectMessageToUserAsBot", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),