@oneuptime/common 12.0.18 → 12.0.20

package/Server/Views/Partials/AnalyticsConsent.ejs

@@ -0,0 +1,533 @@
+<%#
+    Consent Mode v2 and attribution capture, shared by every OneUptime-owned
+    origin that loads the Google Tag Manager container.
+
+    This lived only in Home/Views/head-basic.ejs, which meant the marketing site
+    denied storage by default and asked the visitor, while /accounts and
+    /dashboard loaded the same container with no consent signal at all and
+    captured nothing. Two consequences, both bad: somebody who pressed "Reject
+    all" on the marketing site was tracked anyway the moment they reached the
+    signup page — which is exactly where the conversion fires — and an ad
+    pointed straight at /accounts/register?gclid=... stored no click id, so
+    that signup was permanently unattributable.
+
+    It is one file rather than a copy per origin because the storage contract
+    has to stay byte-identical: the same 'cookiesAccepted' values, the same
+    'clickIds' and 'firstTouch' JSON shapes. Three copies is how those stop
+    agreeing.
+
+    Include this BEFORE the Google Tag Manager snippet. Consent Mode defaults
+    are only meaningful if they are on the dataLayer before the container reads
+    it.
+
+    Home resolves this as ../../Common/Server/Views/Partials/AnalyticsConsent
+    and the App FeatureSets as ../../../../Common/Server/Views/Partials/...;
+    /usr/src/Common is present in both images.
+
+    Deliberately NOT here: the PostHog loader (its project key is Home's) and
+    the home/-prefixed page view and CTA listeners. Those are Home's alone and
+    stay in head-basic.ejs. Reporting on a captured touch is handed back to
+    the page through window.oneUptimeOnAttributionCaptured for the same
+    reason. The Cal booking helper does live here: it is a pure reader over
+    the shared attribution store, and splitting it from the store it reads
+    would be worse than sharing an unused function definition.
+-%>
+<!--
+    Consent.
+
+    This block runs BEFORE Google Tag Manager and before PostHog, because both
+    of the things it does are only meaningful ahead of them: Consent Mode's
+    defaults have to be on the dataLayer before the container reads it, and
+    PostHog must not be loaded at all until there is consent to load it.
+
+    Three states, not two. `granted` and `denied` are the visitor's explicit
+    choices; `unset` is the state before they have answered, and it is treated
+    as denied for storage purposes rather than as permission-by-silence.
+
+    What that costs, stated plainly: a visitor who never touches the banner is
+    not measured, and their attribution is not stored. What stops that from
+    losing an ad click outright is the pending-attribution buffer further
+    down — attribution seen on this page is held in memory and written the
+    moment consent is granted, so accepting the banner on the landing page
+    keeps everything the click carried.
+-->
+<% if(typeof enableGoogleTagManager !== 'undefined' ? enableGoogleTagManager : false){ %>
+<!--
+    The dataLayer and the gtag shim, defined before both the consent signals
+    below and the container itself.
+
+    Deliberately inside the enableGoogleTagManager gate. A self-hosted install
+    loads no Google tag at all, and every OneUptime event guards on
+    `typeof dataLayer !== 'undefined'` — so creating the array there would turn
+    those no-ops into an array that grows for the life of the page and that
+    nothing will ever read.
+-->
+<script>
+    window.dataLayer = window.dataLayer || [];
+    function gtag() { dataLayer.push(arguments); }
+</script>
+<% } %>
+
+<script>
+    window.oneUptimeConsent = (function () {
+        var STORAGE_KEY = 'cookiesAccepted';
+        var listeners = [];
+
+        function readRaw() {
+            try {
+                return window.localStorage.getItem(STORAGE_KEY);
+            } catch (e) {
+                /*
+                 * Private mode, disabled storage, or a cross-origin sandbox.
+                 * Unreadable storage is not consent.
+                 */
+                return null;
+            }
+        }
+
+        function state() {
+            var raw = readRaw();
+            if (raw === 'true') { return 'granted'; }
+            if (raw === 'false') { return 'denied'; }
+            return 'unset';
+        }
+
+        function isGranted() {
+            return state() === 'granted';
+        }
+
+        /*
+         * Consent Mode v2. `security_storage` is granted because it covers
+         * things like fraud prevention that are not analytics; everything that
+         * feeds advertising or measurement starts denied.
+         *
+         * wait_for_update gives the container half a second to see an update
+         * before it decides how to behave, which is what makes a visitor who
+         * accepts immediately still count.
+         */
+        function pushConsentSignal(mode, granted) {
+            /*
+             * No tag, nothing to tell. On a self-hosted install gtag is never
+             * defined, and consent is still tracked — it gates the attribution
+             * capture and PostHog either way.
+             */
+            if (typeof window.gtag !== 'function') {
+                return;
+            }
+
+            window.gtag('consent', mode, {
+                ad_storage: granted ? 'granted' : 'denied',
+                ad_user_data: granted ? 'granted' : 'denied',
+                ad_personalization: granted ? 'granted' : 'denied',
+                analytics_storage: granted ? 'granted' : 'denied',
+                functionality_storage: granted ? 'granted' : 'denied',
+                personalization_storage: granted ? 'granted' : 'denied',
+                security_storage: 'granted',
+                wait_for_update: 500
+            });
+        }
+
+        pushConsentSignal('default', false);
+
+        // An earlier visit already answered: tell Google before the tag loads.
+        if (isGranted()) {
+            pushConsentSignal('update', true);
+        }
+
+        function set(granted) {
+            try {
+                window.localStorage.setItem(STORAGE_KEY, granted ? 'true' : 'false');
+            } catch (e) {
+                // Nothing to persist to. The in-page decision still applies.
+            }
+
+            pushConsentSignal('update', granted);
+
+            for (var i = 0; i < listeners.length; i++) {
+                try {
+                    listeners[i](granted);
+                } catch (e) {
+                    // One bad listener must not stop the others.
+                }
+            }
+        }
+
+        return {
+            state: state,
+            isGranted: isGranted,
+            grant: function () { set(true); },
+            deny: function () { set(false); },
+            onChange: function (listener) {
+                if (typeof listener === 'function') {
+                    listeners.push(listener);
+                }
+            }
+        };
+    })();
+</script>
+
+<!--
+    Attribution capture (UTM parameters + ad platform click IDs), and the
+    readers that hand it on to the two places it has to reach: the signup form
+    (through localStorage, same origin) and a Cal.com booking (through the
+    embed's metadata).
+
+    STORAGE MODEL
+
+    - Last-touch UTM values live in the individual utm* localStorage keys, read
+      by the signup page and stored on the User record.
+    - Last-touch click IDs live as a JSON object under 'clickIds'.
+    - The visitor's first attributed visit is preserved as JSON under
+      'firstTouch' and never overwritten.
+
+    A visit counts as a new "touch" if it carries ANY utm parameter or ad click
+    ID — Google Ads auto-tagging sends only gclid, no UTMs.
+
+    CONSENT
+
+    Nothing is written without consent. Attribution seen before the visitor has
+    answered the banner is held in memory and flushed if they accept, so the
+    ordinary case — land on an ad, accept, sign up — keeps everything. An
+    explicit refusal clears anything a previous visit stored.
+-->
+<script>
+    (function () {
+        var UTM_KEY_MAP = {
+            'utm_source': 'utmSource',
+            'utm_medium': 'utmMedium',
+            'utm_campaign': 'utmCampaign',
+            'utm_term': 'utmTerm',
+            'utm_content': 'utmContent'
+        };
+
+        /*
+         * Must stay in step with AdClickIdKeys in
+         * Common/Types/Marketing/Attribution.ts — the server whitelists on that
+         * list, so a key sent from here that is missing there is silently
+         * dropped on arrival.
+         */
+        var CLICK_ID_PARAMS = ['gclid', 'wbraid', 'gbraid', 'fbclid', 'msclkid', 'li_fat_id', 'twclid', 'rdt_cid'];
+
+        // Mirrors MaxAttributionValueLength on the server.
+        var MAX_VALUE_LENGTH = 500;
+
+        // Mirrors MAX_FIRST_TOUCH_LENGTH in App/API/CalWebhook.ts.
+        var MAX_FIRST_TOUCH_LENGTH = 4000;
+
+        // Attribution seen on this page but not yet allowed to be stored.
+        var pending = null;
+
+        function canStore() {
+            return Boolean(window.oneUptimeConsent && window.oneUptimeConsent.isGranted());
+        }
+
+        function setItem(key, value) {
+            try {
+                window.localStorage.setItem(key, value);
+            } catch (e) {
+                // Storage unavailable; attribution is best-effort.
+            }
+        }
+
+        function removeItem(key) {
+            try {
+                window.localStorage.removeItem(key);
+            } catch (e) {
+                // Nothing to remove from.
+            }
+        }
+
+        function getItem(key) {
+            try {
+                return window.localStorage.getItem(key);
+            } catch (e) {
+                return null;
+            }
+        }
+
+        function bound(value) {
+            return String(value).slice(0, MAX_VALUE_LENGTH);
+        }
+
+        function readTouchFromUrl() {
+            var urlParams = new URLSearchParams(window.location.search);
+
+            var utmValues = {};
+            var hasUtm = false;
+            Object.keys(UTM_KEY_MAP).forEach(function (param) {
+                var value = urlParams.get(param);
+                if (value) {
+                    utmValues[UTM_KEY_MAP[param]] = bound(value);
+                    hasUtm = true;
+                }
+            });
+
+            var clickIds = {};
+            var hasClickId = false;
+            CLICK_ID_PARAMS.forEach(function (param) {
+                var value = urlParams.get(param);
+                if (value) {
+                    clickIds[param] = bound(value);
+                    hasClickId = true;
+                }
+            });
+
+            if (!hasUtm && !hasClickId) {
+                return null;
+            }
+
+            return {
+                utmValues: utmValues,
+                clickIds: clickIds,
+                hasClickId: hasClickId,
+                url: window.location.href,
+                referrer: document.referrer || '',
+                timestamp: new Date().toISOString()
+            };
+        }
+
+        function storeTouch(touch) {
+            // New touch: clear previous last-touch values, then store this visit's.
+            Object.keys(UTM_KEY_MAP).forEach(function (param) {
+                removeItem(UTM_KEY_MAP[param]);
+            });
+            Object.keys(touch.utmValues).forEach(function (key) {
+                setItem(key, touch.utmValues[key]);
+            });
+            setItem('utmUrl', touch.url);
+
+            if (touch.hasClickId) {
+                setItem('clickIds', JSON.stringify(touch.clickIds));
+            } else {
+                removeItem('clickIds');
+            }
+
+            // Preserve the first attributed touch forever.
+            if (!getItem('firstTouch')) {
+                var firstTouch = {};
+                Object.keys(touch.utmValues).forEach(function (key) {
+                    firstTouch[key] = touch.utmValues[key];
+                });
+                if (touch.hasClickId) {
+                    firstTouch.clickIds = touch.clickIds;
+                }
+                firstTouch.landingUrl = touch.url;
+                firstTouch.referrer = touch.referrer;
+                firstTouch.timestamp = touch.timestamp;
+                setItem('firstTouch', JSON.stringify(firstTouch));
+            }
+        }
+
+        function clearStoredAttribution() {
+            Object.keys(UTM_KEY_MAP).forEach(function (param) {
+                removeItem(UTM_KEY_MAP[param]);
+            });
+            removeItem('utmUrl');
+            removeItem('clickIds');
+            removeItem('firstTouch');
+        }
+
+        function parseStoredJson(key) {
+            var raw = getItem(key);
+            if (!raw) { return null; }
+            try {
+                var parsed = JSON.parse(raw);
+                return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : null;
+            } catch (e) {
+                return null;
+            }
+        }
+
+        /*
+         * Everything known about where this visitor came from, whether it has
+         * been written to storage yet or is still only in memory.
+         *
+         * The in-memory touch wins: it is this page load, and the stored copy
+         * is at best the same thing and at worst an older visit.
+         */
+        window.oneUptimeGetAttribution = function () {
+            var utm = {};
+            Object.keys(UTM_KEY_MAP).forEach(function (param) {
+                var key = UTM_KEY_MAP[param];
+                var value = (pending && pending.utmValues[key]) || getItem(key);
+                if (value && value !== 'null' && value !== 'undefined') {
+                    utm[key] = value;
+                }
+            });
+
+            var utmUrl = (pending && pending.url) || getItem('utmUrl');
+            if (utmUrl) {
+                utm.utmUrl = utmUrl;
+            }
+
+            var clickIds = (pending && pending.hasClickId ? pending.clickIds : null) || parseStoredJson('clickIds') || {};
+
+            var firstTouch = parseStoredJson('firstTouch');
+
+            if (!firstTouch && pending) {
+                firstTouch = {};
+                Object.keys(pending.utmValues).forEach(function (key) {
+                    firstTouch[key] = pending.utmValues[key];
+                });
+                if (pending.hasClickId) {
+                    firstTouch.clickIds = pending.clickIds;
+                }
+                firstTouch.landingUrl = pending.url;
+                firstTouch.referrer = pending.referrer;
+                firstTouch.timestamp = pending.timestamp;
+            }
+
+            return {
+                utm: utm,
+                clickIds: clickIds,
+                firstTouch: firstTouch
+            };
+        };
+
+        /*
+         * The same attribution, flattened into the scalar string map Cal.com
+         * accepts as booking metadata.
+         *
+         * Keys are the snake_case wire spelling the server parses in
+         * App/API/CalWebhook.ts. The first touch is a nested object, and Cal
+         * metadata values are scalars, so it travels as one JSON string under
+         * ou_first_touch — which is exactly what the webhook expects to parse.
+         *
+         * Returns {} when there is nothing to attribute, so a caller can spread
+         * it unconditionally without sending an empty metadata bag.
+         */
+        /*
+         * `bookingKind` says which conversation this embed books. All three
+         * embeds use the same Cal event type, so without it the webhook cannot
+         * tell a support call from an enterprise demo. It travels in the same
+         * bracketed metadata bag as the attribution and is read back by
+         * App/API/CalWebhook.ts, which allowlists the value.
+         */
+        window.oneUptimeCalAttributionMetadata = function (bookingKind) {
+            var attribution = window.oneUptimeGetAttribution();
+            var config = {};
+
+            /*
+             * Cal takes booking metadata as FLAT, BRACKETED keys on the embed
+             * config — `metadata[utm_source]` — and hands them back on the
+             * webhook as payload.metadata.utm_source.
+             *
+             * Not as a nested `metadata: { utm_source: ... }` object. Cal
+             * serialises each config value into a query parameter, so a nested
+             * object becomes the string "[object Object]" and every key inside
+             * it is lost. Nothing errors; bookings keep being recorded, they
+             * just arrive attributable to nothing — which is precisely the bug
+             * this whole path exists to fix, so getting the shape wrong here
+             * would have been indistinguishable from not having done the work.
+             *
+             * https://cal.com/help/embedding/prefill-booking-form-embed
+             */
+            function put(key, value, maxLength) {
+                if (value) {
+                    config['metadata[' + key + ']'] =
+                        String(value).slice(0, maxLength || MAX_VALUE_LENGTH);
+                }
+            }
+
+            Object.keys(UTM_KEY_MAP).forEach(function (param) {
+                put(param, attribution.utm[UTM_KEY_MAP[param]]);
+            });
+
+            put('utm_url', attribution.utm.utmUrl);
+
+            Object.keys(attribution.clickIds).forEach(function (param) {
+                put(param, attribution.clickIds[param]);
+            });
+
+            if (attribution.firstTouch) {
+                var serialized = JSON.stringify(attribution.firstTouch);
+                /*
+                 * The first touch is JSON, so it gets the JSON bound, NOT the
+                 * 500-char per-value one. A realistic first touch — five UTM
+                 * values, a click id, and a landing URL that repeats them all
+                 * as query parameters — runs past 500 characters easily, and
+                 * truncating JSON produces a string the webhook's JSON.parse
+                 * rejects. It would drop the whole first touch, silently.
+                 *
+                 * Mirrors MAX_FIRST_TOUCH_LENGTH in App/API/CalWebhook.ts.
+                 */
+                if (serialized.length <= MAX_FIRST_TOUCH_LENGTH) {
+                    put('ou_first_touch', serialized, MAX_FIRST_TOUCH_LENGTH);
+                }
+            }
+
+            /*
+             * Unconditional, unlike everything above it. The attribution keys
+             * describe the visitor and are absent when there is nothing to say
+             * about them; the booking kind describes the embed, which always
+             * knows what it is. A booking from a visitor who refused
+             * attribution storage still arrives knowing it was a demo.
+             */
+            if (bookingKind) {
+                config['metadata[ou_booking_kind]'] = String(bookingKind).slice(0, MAX_VALUE_LENGTH);
+            }
+
+            return config;
+        };
+
+        var touch = readTouchFromUrl();
+
+        if (touch) {
+            if (canStore()) {
+                storeTouch(touch);
+            } else {
+                /*
+                 * Held, not dropped. A visitor who accepts the banner on this
+                 * very page — the ordinary path for someone arriving from an
+                 * ad — keeps the click id that brought them here.
+                 */
+                pending = touch;
+            }
+        }
+
+        if (window.oneUptimeConsent) {
+            window.oneUptimeConsent.onChange(function (granted) {
+                if (granted) {
+                    if (pending) {
+                        storeTouch(pending);
+                    }
+                    return;
+                }
+
+                // Refused: forget what earlier visits stored, and this page's touch.
+                pending = null;
+                clearStoredAttribution();
+            });
+        }
+
+        /*
+         * Reporting is the including page's business, not this partial's.
+         *
+         * The marketing site emits a `home/`-prefixed PostHog event from here;
+         * the product origins emit nothing, and must not start emitting under
+         * a `home/` name just because they now share the capture code. So the
+         * touch is handed out and the page decides what, if anything, to do
+         * with it.
+         *
+         * Wire keys (utm_source), not property keys (utmSource): this is what
+         * arrived on the URL.
+         */
+        document.addEventListener('DOMContentLoaded', function () {
+            if (!touch || typeof window.oneUptimeOnAttributionCaptured !== 'function') {
+                return;
+            }
+
+            var eventProps = { utm_url: touch.url };
+            Object.keys(UTM_KEY_MAP).forEach(function (param) {
+                if (touch.utmValues[UTM_KEY_MAP[param]]) {
+                    eventProps[param] = touch.utmValues[UTM_KEY_MAP[param]];
+                }
+            });
+            Object.keys(touch.clickIds).forEach(function (param) {
+                eventProps[param] = touch.clickIds[param];
+            });
+
+            window.oneUptimeOnAttributionCaptured(eventProps);
+        });
+    })();
+</script>

package/Tests/App/Dashboard/AdminNotificationRulesPage.test.tsx

@@ -59,7 +59,7 @@ import getJestMockFunction, { MockFunction } from "../../MockType";
  *     to be tempted will add a button, not a sentence.
  *
  *   - AN ADMIN READING SOMEBODY ELSE'S PHONE NUMBER, which is the same defect
- *     one step earlier and is what this page originally did. The seven method
+ *     one step earlier and is what this page originally did. The nine method
  *     models are scoped to the person who owns the device - the columns behind
  *     them are the raw number, the webhook bearer url, the push device token,
  *     the telegram chat id and the verification code - and that scope was
@@ -389,8 +389,10 @@ import TeamMember from "../../../Models/DatabaseModels/TeamMember";
 import User from "../../../Models/DatabaseModels/User";
 import UserCall from "../../../Models/DatabaseModels/UserCall";
 import UserEmail from "../../../Models/DatabaseModels/UserEmail";
+import UserMicrosoftTeams from "../../../Models/DatabaseModels/UserMicrosoftTeams";
 import UserNotificationRule from "../../../Models/DatabaseModels/UserNotificationRule";
 import UserPush from "../../../Models/DatabaseModels/UserPush";
+import UserSlack from "../../../Models/DatabaseModels/UserSlack";
 import UserSMS from "../../../Models/DatabaseModels/UserSMS";
 import UserTelegram from "../../../Models/DatabaseModels/UserTelegram";
 import UserWebhook from "../../../Models/DatabaseModels/UserWebhook";
@@ -413,7 +415,7 @@ const PROJECT_ID: ObjectID = new ObjectID(PROJECT_ID_STRING);
 const SIGNED_IN_USER_ID: ObjectID = new ObjectID(SIGNED_IN_USER_ID_STRING);
 
 /*
- * The seven models only their owner may read. They are asserted as a SET because
+ * The nine models only their owner may read. They are asserted as a SET because
  * which one an admin surface reaches for hardly matters - every one of them
  * carries a raw identifier and most carry a credential.
  */
@@ -424,11 +426,13 @@ const NOTIFICATION_METHOD_MODELS: Array<unknown> = [
   UserPush,
   UserWhatsApp,
   UserTelegram,
+  UserSlack,
+  UserMicrosoftTeams,
   UserWebhook,
 ];
 
 /*
- * The RELATION spelling of those same seven, as they appear in a nested select
+ * The RELATION spelling of those same nine, as they appear in a nested select
  * on UserNotificationRule. Selecting any of them pulls a column out of the
  * method model itself - the address, the number, the handle - through a table
  * an administrator may read and which is not row-scoped for them. It is the
@@ -442,6 +446,8 @@ const METHOD_RELATION_KEYS: Array<string> = [
   "userPush",
   "userWhatsApp",
   "userTelegram",
+  "userSlack",
+  "userMicrosoftTeams",
   "userWebhook",
 ];
 
@@ -453,6 +459,8 @@ const METHOD_FOREIGN_KEYS: Array<keyof UserNotificationRule> = [
   "userPushId",
   "userWhatsAppId",
   "userTelegramId",
+  "userSlackId",
+  "userMicrosoftTeamsId",
   "userWebhookId",
 ];
 
@@ -673,7 +681,7 @@ const setUpLists: SetUpListsFunction = (
     }
 
     /*
-     * Anything else, INCLUDING the seven notification-method models - which this
+     * Anything else, INCLUDING the nine notification-method models - which this
      * page must never ask for. A non-empty answer here would make a leak look
      * like a feature working, so the fallback stays empty and the assertion that
      * matters is about the request rather than the response: see "never reads a
@@ -1172,7 +1180,7 @@ afterEach(async (): Promise<void> => {
 
   /*
    * Unmounting stops the RENDERING, not the fetching. A rule table that belongs
-   * to the viewer loads the seven notification-method models one after another,
+   * to the viewer loads the nine notification-method models one after another,
    * so a test that reads its own page leaves a chain of awaits running after its
    * last assertion - and every one of those calls is recorded on the same
    * `getListMock` the next test resets and then asserts against.
@@ -1365,14 +1373,14 @@ describe("the page is read at rest, whichever order its fetches land in", () =>
     assertEveryTableIsSettled();
   });
 
-  test("waits out the seven method reads a self-serve page makes for its owner", async () => {
+  test("waits out the nine method reads a self-serve page makes for its owner", async () => {
     // A self-serve page is always the viewer's own, so this is the owner path.
     await renderSelfServePage(IncidentOnCallRules);
 
     /*
-     * A rule table belonging to the viewer loads the seven notification-method
+     * A rule table belonging to the viewer loads the nine notification-method
      * models one after another, and unmounting the page does not stop that
-     * chain - it stops the rendering. Any of those seven still running when the
+     * chain - it stops the rendering. Any of those nine still running when the
      * next test resets `getListMock` is recorded as that test's request, which
      * is how "never reads a notification method model" comes to fail on a page
      * that never asked for one.
@@ -1484,7 +1492,7 @@ describe("the shared rules table, as the admin page wires it", () => {
     /*
      * The redesign, in one assertion.
      *
-     * These seven models are readable only by the person who owns the row, and
+     * These nine models are readable only by the person who owns the row, and
      * that is the whole protection: the table scope pins every read to the
      * caller. Widening it so this page could fill a dropdown exposed the raw
      * email and phone, the webhook url, the push device token, the telegram chat
@@ -1619,7 +1627,7 @@ describe("the shared rules table, as the admin page wires it", () => {
       });
 
     /*
-     * The seven foreign keys are mutually exclusive, and writing an SMS id into
+     * The nine foreign keys are mutually exclusive, and writing an SMS id into
      * `userEmailId` would page an address instead of a phone without erroring
      * anywhere, so the whole set is asserted rather than the one column.
      */
@@ -1639,7 +1647,7 @@ describe("the shared rules table, as the admin page wires it", () => {
     /*
      * The failure mode this seam had to be designed around. Readiness is the
      * only source of methods here, so when it is down there are none to offer -
-     * and "then read the models directly" is not a fallback, it is seven refused
+     * and "then read the models directly" is not a fallback, it is nine refused
      * requests that would replace the rule tables with an error page. The rules
      * stay editable; only the method choice is missing.
      */
@@ -2002,7 +2010,7 @@ describe("methods are a page of their own now, not a card on this one", () => {
    * It asserted that an administrator was offered NO control for adding a
    * notification method to somebody else's account: a masked, read-only list
    * and a prefilled "please add one yourself" email. That was correct for what
-   * the server could do at the time - the seven method models are scoped to
+   * the server could do at the time - the nine method models are scoped to
    * their owner and the attempt to widen them leaked every raw column behind
    * them - but it left the commonest broken responder, a new joiner with no
    * method at all, fixable by nobody but themselves.
@@ -2167,7 +2175,7 @@ describe("the coverage grid, now shared with the readiness page", () => {
  * The edit path.
  *
  * `isEditable` was hardcoded false on the ModelTable, so this page issued no
- * PATCH at all: the phase opened `notifyAfterMinutes` (and the seven method
+ * PATCH at all: the phase opened `notifyAfterMinutes` (and the nine method
  * foreign keys) to update behind the largest guard in the codebase, and bought
  * zero capability anybody could reach. These assertions are about the two halves
  * of making that real - the editor being on for exactly the viewers allowed to
@@ -2225,7 +2233,7 @@ describe("the rules are editable, not merely addable and removable", () => {
 
     /*
      * The dropdown is an override field: its value travels in `miscDataProps`
-     * and is mapped onto one of the seven foreign keys by `onBeforeCreate`.
+     * and is mapped onto one of the nine foreign keys by `onBeforeCreate`.
      * ModelForm calls that hook only for FormType.Create and BaseAPI.updateItem
      * never reads `miscDataProps`, so on the edit path the choice is discarded
      * in transit. Rendering it anyway would give an administrator a control