@oneuptime/common 12.0.18 → 12.0.20

package/Tests/Server/Services/NotificationDeletionImpact.test.ts

@@ -15,12 +15,14 @@ import ProjectService from "../../../Server/Services/ProjectService";
 import TeamMemberService from "../../../Server/Services/TeamMemberService";
 import UserCallService from "../../../Server/Services/UserCallService";
 import UserEmailService from "../../../Server/Services/UserEmailService";
+import UserMicrosoftTeamsService from "../../../Server/Services/UserMicrosoftTeamsService";
 import UserNotificationRuleService, {
   CoverageLossCell,
   NotificationDeletionImpact,
   PostDeletionReachability,
 } from "../../../Server/Services/UserNotificationRuleService";
 import UserPushService from "../../../Server/Services/UserPushService";
+import UserSlackService from "../../../Server/Services/UserSlackService";
 import UserSmsService from "../../../Server/Services/UserSmsService";
 import UserTelegramService from "../../../Server/Services/UserTelegramService";
 import UserWebhookService from "../../../Server/Services/UserWebhookService";
@@ -31,8 +33,10 @@ import IncidentSeverity from "../../../Models/DatabaseModels/IncidentSeverity";
 import Project from "../../../Models/DatabaseModels/Project";
 import UserCall from "../../../Models/DatabaseModels/UserCall";
 import UserEmail from "../../../Models/DatabaseModels/UserEmail";
+import UserMicrosoftTeams from "../../../Models/DatabaseModels/UserMicrosoftTeams";
 import UserNotificationRule from "../../../Models/DatabaseModels/UserNotificationRule";
 import UserPush from "../../../Models/DatabaseModels/UserPush";
+import UserSlack from "../../../Models/DatabaseModels/UserSlack";
 import UserSMS from "../../../Models/DatabaseModels/UserSMS";
 import UserTelegram from "../../../Models/DatabaseModels/UserTelegram";
 import UserWebhook from "../../../Models/DatabaseModels/UserWebhook";
@@ -57,7 +61,7 @@ import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
  *       is the only thing left for Sev1 incidents" is written nowhere.
  *
  *   (b) Deleting a METHOD, which CASCADES. Every method foreign key on
- *       UserNotificationRule is onDelete: "CASCADE" - and six of the seven
+ *       UserNotificationRule is onDelete: "CASCADE" - and eight of the nine
  *       method services delete the rows themselves in onBeforeDelete besides -
  *       so removing one phone number destroys every rule that pointed at it.
  *       The delete dialog for a phone number mentions notification rules
@@ -90,8 +94,9 @@ import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
  *   A rule read through the wrong column matches no page at runtime, so
  *   counting it as coverage would certify a gap as covered.
  *
- *   CERTAINTY ABOUT REACHABILITY. Push, Email and Webhook have no project
- *   switch, which is what makes "a verified one of those survives" a certain
+ *   CERTAINTY ABOUT REACHABILITY. Push, Email, Slack, Microsoft Teams and
+ *   Webhook have no project switch, which is what makes "a verified one of
+ *   those survives" a certain
  *   answer and "only paid channels survive" an honest "depends". Inventing a
  *   green in the second case is the exact false reassurance this whole feature
  *   exists to prevent.
@@ -191,6 +196,8 @@ let callFindOneBy: jest.SpyInstance;
 let pushFindOneBy: jest.SpyInstance;
 let whatsAppFindOneBy: jest.SpyInstance;
 let telegramFindOneBy: jest.SpyInstance;
+let slackFindOneBy: jest.SpyInstance;
+let microsoftTeamsFindOneBy: jest.SpyInstance;
 let webhookFindOneBy: jest.SpyInstance;
 let escalationUserFindBy: jest.SpyInstance;
 let escalationTeamFindBy: jest.SpyInstance;
@@ -211,6 +218,8 @@ function rule(data: {
   userPushId?: ObjectID | undefined;
   userWhatsAppId?: ObjectID | undefined;
   userTelegramId?: ObjectID | undefined;
+  userSlackId?: ObjectID | undefined;
+  userMicrosoftTeamsId?: ObjectID | undefined;
   userWebhookId?: ObjectID | undefined;
 }): UserNotificationRule {
   const model: UserNotificationRule = new UserNotificationRule();
@@ -258,6 +267,14 @@ function rule(data: {
     model.userTelegramId = data.userTelegramId;
   }
 
+  if (data.userSlackId) {
+    model.userSlackId = data.userSlackId;
+  }
+
+  if (data.userMicrosoftTeamsId) {
+    model.userMicrosoftTeamsId = data.userMicrosoftTeamsId;
+  }
+
   if (data.userWebhookId) {
     model.userWebhookId = data.userWebhookId;
   }
@@ -500,6 +517,20 @@ beforeEach(() => {
   telegramRow.userId = USER_ID;
   telegramRow.isVerified = true;
 
+  /*
+   * Born verified: a UserSlack / UserMicrosoftTeams row is a pointer at the
+   * owner's own OAuth workspace link, so creation is verification.
+   */
+  const slackRow: UserSlack = new UserSlack();
+  slackRow.id = SMS_METHOD_ID;
+  slackRow.userId = USER_ID;
+  slackRow.isVerified = true;
+
+  const microsoftTeamsRow: UserMicrosoftTeams = new UserMicrosoftTeams();
+  microsoftTeamsRow.id = SMS_METHOD_ID;
+  microsoftTeamsRow.userId = USER_ID;
+  microsoftTeamsRow.isVerified = true;
+
   /*
    * Deliberately carries NO isVerified. UserWebhook has no such column at all,
    * and the service has to treat presence as the whole test - a fixture that
@@ -527,6 +558,12 @@ beforeEach(() => {
   telegramFindOneBy = jest
     .spyOn(UserTelegramService, "findOneBy")
     .mockResolvedValue(telegramRow as never);
+  slackFindOneBy = jest
+    .spyOn(UserSlackService, "findOneBy")
+    .mockResolvedValue(slackRow as never);
+  microsoftTeamsFindOneBy = jest
+    .spyOn(UserMicrosoftTeamsService, "findOneBy")
+    .mockResolvedValue(microsoftTeamsRow as never);
   webhookFindOneBy = jest
     .spyOn(UserWebhookService, "findOneBy")
     .mockResolvedValue(webhookRow as never);
@@ -1117,7 +1154,7 @@ describe("deleting a notification method: the cascade", () => {
     expect(impact.coverageLost).toHaveLength(0);
   });
 
-  test("each of the seven channels reads its own foreign key", async () => {
+  test("each of the nine channels reads its own foreign key", async () => {
     const cases: Array<{
       methodType: ReadinessMethodType;
       makeRule: () => UserNotificationRule;
@@ -1188,6 +1225,28 @@ describe("deleting a notification method: the cascade", () => {
           });
         },
       },
+      {
+        methodType: ReadinessMethodType.Slack,
+        makeRule: (): UserNotificationRule => {
+          return rule({
+            id: RULE_1_ID,
+            ruleType: NotificationRuleType.ON_CALL_EXECUTED_INCIDENT,
+            incidentSeverityId: SEV1_ID,
+            userSlackId: SMS_METHOD_ID,
+          });
+        },
+      },
+      {
+        methodType: ReadinessMethodType.MicrosoftTeams,
+        makeRule: (): UserNotificationRule => {
+          return rule({
+            id: RULE_1_ID,
+            ruleType: NotificationRuleType.ON_CALL_EXECUTED_INCIDENT,
+            incidentSeverityId: SEV1_ID,
+            userMicrosoftTeamsId: SMS_METHOD_ID,
+          });
+        },
+      },
       {
         methodType: ReadinessMethodType.Webhook,
         makeRule: (): UserNotificationRule => {
@@ -1315,8 +1374,9 @@ describe("deleting a notification method: the cascade", () => {
  * (F) Reachability after the deletion.
  *
  * Two of the four answers are certain and two are not, and the split is
- * structural: a method must be VERIFIED to be used at all, and Push, Email and
- * Webhook have no project switch that can turn them off. Anything that turns
+ * structural: a method must be VERIFIED to be used at all, and Push, Email,
+ * Slack, Microsoft Teams and Webhook have no project switch that can turn
+ * them off. Anything that turns
  * the honest "depends" into a green is a false reassurance in the one dialog
  * where it costs a page.
  * ---------------------------------------------------------------------------
@@ -1380,6 +1440,42 @@ describe("reachability after the deletion", () => {
     expect(impact.reachability).toBe(PostDeletionReachability.Reachable);
   });
 
+  test("a surviving verified Slack account is equally certain - no project switch exists for it", async () => {
+    readinessRows = [
+      readiness({
+        methods: [
+          method(ReadinessMethodType.SMS),
+          method(ReadinessMethodType.Slack),
+        ],
+      }),
+    ];
+
+    const impact: NotificationDeletionImpact = await methodDeletionImpact(
+      ReadinessMethodType.SMS,
+      SMS_METHOD_ID,
+    );
+
+    expect(impact.reachability).toBe(PostDeletionReachability.Reachable);
+  });
+
+  test("a surviving verified Microsoft Teams account is equally certain", async () => {
+    readinessRows = [
+      readiness({
+        methods: [
+          method(ReadinessMethodType.SMS),
+          method(ReadinessMethodType.MicrosoftTeams),
+        ],
+      }),
+    ];
+
+    const impact: NotificationDeletionImpact = await methodDeletionImpact(
+      ReadinessMethodType.SMS,
+      SMS_METHOD_ID,
+    );
+
+    expect(impact.reachability).toBe(PostDeletionReachability.Reachable);
+  });
+
   test("a surviving Webhook counts, because a webhook has no verification concept", async () => {
     readinessRows = [
       readiness({
@@ -2055,7 +2151,7 @@ describe("paging the rule read", () => {
  * ---------------------------------------------------------------------------
  * (L) The per-method-service entry points.
  *
- * Each of the seven notification-method services can answer for its own row,
+ * Each of the nine notification-method services can answer for its own row,
  * which is where the delete is actually initiated from. Each must name its own
  * channel: a service that passed the wrong one would preview the cascade of a
  * method the user is not deleting.
@@ -2159,6 +2255,36 @@ describe("the per-method-service entry points", () => {
           userTelegramId: SMS_METHOD_ID,
         }),
       },
+      {
+        name: "UserSlackService",
+        call: (): Promise<NotificationDeletionImpact> => {
+          return UserSlackService.getDeletionImpact({
+            itemId: SMS_METHOD_ID,
+            projectId: PROJECT_ID,
+          });
+        },
+        ruleWithThisMethod: rule({
+          id: RULE_1_ID,
+          ruleType: NotificationRuleType.ON_CALL_EXECUTED_INCIDENT,
+          incidentSeverityId: SEV1_ID,
+          userSlackId: SMS_METHOD_ID,
+        }),
+      },
+      {
+        name: "UserMicrosoftTeamsService",
+        call: (): Promise<NotificationDeletionImpact> => {
+          return UserMicrosoftTeamsService.getDeletionImpact({
+            itemId: SMS_METHOD_ID,
+            projectId: PROJECT_ID,
+          });
+        },
+        ruleWithThisMethod: rule({
+          id: RULE_1_ID,
+          ruleType: NotificationRuleType.ON_CALL_EXECUTED_INCIDENT,
+          incidentSeverityId: SEV1_ID,
+          userMicrosoftTeamsId: SMS_METHOD_ID,
+        }),
+      },
       {
         name: "UserWebhookService",
         call: (): Promise<NotificationDeletionImpact> => {
@@ -2229,7 +2355,7 @@ describe("the per-method-service entry points", () => {
     expect(impact.reachability).toBe(PostDeletionReachability.NotReachable);
   });
 
-  test("the seven services do not read each other's tables", async () => {
+  test("the nine services do not read each other's tables", async () => {
     ruleRows = [];
 
     await UserTelegramService.getDeletionImpact({
@@ -2243,6 +2369,8 @@ describe("the per-method-service entry points", () => {
     expect(callFindOneBy).not.toHaveBeenCalled();
     expect(pushFindOneBy).not.toHaveBeenCalled();
     expect(whatsAppFindOneBy).not.toHaveBeenCalled();
+    expect(slackFindOneBy).not.toHaveBeenCalled();
+    expect(microsoftTeamsFindOneBy).not.toHaveBeenCalled();
     expect(webhookFindOneBy).not.toHaveBeenCalled();
   });
 });

package/Tests/Server/Services/OnCallNotificationFallback.test.ts

@@ -3,6 +3,7 @@ import OnCallNotificationAlertingService from "../../../Server/Services/OnCallNo
 import ProjectService from "../../../Server/Services/ProjectService";
 import UserCallService from "../../../Server/Services/UserCallService";
 import UserEmailService from "../../../Server/Services/UserEmailService";
+import UserMicrosoftTeamsService from "../../../Server/Services/UserMicrosoftTeamsService";
 import UserNotificationRuleService, {
   ExecuteFallbackNotificationOptions,
   ExecuteNotificationRuleOptions,
@@ -15,6 +16,7 @@ import UserOnCallLogService, {
 } from "../../../Server/Services/UserOnCallLogService";
 import UserPushService from "../../../Server/Services/UserPushService";
 import UserService from "../../../Server/Services/UserService";
+import UserSlackService from "../../../Server/Services/UserSlackService";
 import UserSmsService from "../../../Server/Services/UserSmsService";
 import UserTelegramService from "../../../Server/Services/UserTelegramService";
 import UserWebhookService from "../../../Server/Services/UserWebhookService";
@@ -43,10 +45,12 @@ import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
  * verified. This file pins the four things about it that are easy to get subtly,
  * silently wrong:
  *
- *   1. WHICH CHANNELS. Zero-cost first: a responder with a verified push device
- *      and a verified email gets both, because there is no reason to choose and
- *      neither costs the project anything. Only a responder with neither is
- *      worth spending money on, and then exactly once, down the ladder
+ *   1. WHICH CHANNELS. Zero-cost first: a responder with any of a verified push
+ *      device, a verified email, a linked Slack account or a linked Microsoft
+ *      Teams account gets ALL of those they have, because there is no reason to
+ *      choose and none of them costs the project anything. Only a responder
+ *      with none of the four is worth spending money on, and then exactly once,
+ *      down the ladder
  *      SMS -> Call -> WhatsApp -> Telegram -> Webhook - and only through
  *      channels the PROJECT still has switched on. That last clause is the one
  *      with a bill attached: SmsService and CallService check their project flag
@@ -83,7 +87,7 @@ import { afterEach, beforeEach, describe, expect, test } from "@jest/globals";
  *
  * Nothing here touches a database or a sender: deliverNotificationForRule is
  * stubbed at the service boundary (it fans out into template generation, short
- * links, seven providers and the timeline writer), and every lookup is a
+ * links, nine providers and the timeline writer), and every lookup is a
  * jest.spyOn. What is under test is the fallback's own decision-making.
  */
 
@@ -126,6 +130,12 @@ const TELEGRAM_METHOD_ID: ObjectID = new ObjectID(
 const WEBHOOK_METHOD_ID: ObjectID = new ObjectID(
   "a7a7a7a7-a7a7-4a7a-8a7a-a7a7a7a7a7a7",
 );
+const SLACK_METHOD_ID: ObjectID = new ObjectID(
+  "a8a8a8a8-a8a8-4a8a-8a8a-a8a8a8a8a8a8",
+);
+const MICROSOFT_TEAMS_METHOD_ID: ObjectID = new ObjectID(
+  "a9a9a9a9-a9a9-4a9a-8a9a-a9a9a9a9a9a9",
+);
 
 const RESPONDER_EMAIL: string = "responder@company.com";
 const SEVERITY_NAME: string = "Sev4";
@@ -179,6 +189,31 @@ function makeVerifiedEmail(): Record<string, unknown> {
   };
 }
 
+/*
+ * Slack and Microsoft Teams rows are born verified - they come from the user's
+ * own OAuth workspace link, not a verification-code flow - but the fallback
+ * still queries on isVerified, so the fixtures carry it.
+ */
+function makeVerifiedSlack(): Record<string, unknown> {
+  return {
+    id: SLACK_METHOD_ID,
+    _id: SLACK_METHOD_ID.toString(),
+    slackUserId: "U0123456789",
+    slackUserName: "responder",
+    isVerified: true,
+  };
+}
+
+function makeVerifiedMicrosoftTeams(): Record<string, unknown> {
+  return {
+    id: MICROSOFT_TEAMS_METHOD_ID,
+    _id: MICROSOFT_TEAMS_METHOD_ID.toString(),
+    microsoftTeamsUserId: "teams-user-1",
+    microsoftTeamsUserName: RESPONDER_NAME,
+    isVerified: true,
+  };
+}
+
 function makeVerifiedSms(): Record<string, unknown> {
   return {
     id: SMS_METHOD_ID,
@@ -308,6 +343,8 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
   let ruleCreateSpy: jest.SpyInstance;
   let pushFindSpy: jest.SpyInstance;
   let emailFindSpy: jest.SpyInstance;
+  let slackFindSpy: jest.SpyInstance;
+  let microsoftTeamsFindSpy: jest.SpyInstance;
   let smsFindSpy: jest.SpyInstance;
   let callFindSpy: jest.SpyInstance;
   let whatsAppFindSpy: jest.SpyInstance;
@@ -329,7 +366,7 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
 
     /*
      * Stubbed at the service boundary. The real method fans out into template
-     * generation, short-link creation, seven providers and the timeline writer;
+     * generation, short-link creation, nine providers and the timeline writer;
      * its return value ("was a page actually handed to a sender") is the only
      * part of it the fallback reasons about.
      */
@@ -348,6 +385,12 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
     emailFindSpy = jest
       .spyOn(UserEmailService, "findOneBy")
       .mockResolvedValue(null as never);
+    slackFindSpy = jest
+      .spyOn(UserSlackService, "findOneBy")
+      .mockResolvedValue(null as never);
+    microsoftTeamsFindSpy = jest
+      .spyOn(UserMicrosoftTeamsService, "findOneBy")
+      .mockResolvedValue(null as never);
     smsFindSpy = jest
       .spyOn(UserSmsService, "findOneBy")
       .mockResolvedValue(null as never);
@@ -426,7 +469,7 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
    * -----------------------------------------------------------------------
    */
 
-  describe("channel selection: the zero-cost pair", () => {
+  describe("channel selection: the zero-cost tier", () => {
     test("a responder with a verified push device AND a verified email gets BOTH", async () => {
       pushFindSpy.mockResolvedValue(makeVerifiedPush() as never);
       emailFindSpy.mockResolvedValue(makeVerifiedEmail() as never);
@@ -466,6 +509,86 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
       }
     });
 
+    test('a verified Slack account alone is chosen, as "Slack", with the relation AND the FK', async () => {
+      const slack: Record<string, unknown> = makeVerifiedSlack();
+      slackFindSpy.mockResolvedValue(slack as never);
+
+      const result: FallbackNotificationResult = await runFallback();
+
+      expect(result.channelsUsed).toEqual(["Slack"]);
+      expect(result.notified).toBe(true);
+      expect(result.outcome).toBe(FallbackNotificationOutcome.Delivered);
+
+      /*
+       * The relation, not merely the FK: the Slack channel block reads
+       * `userSlack?.slackUserId && userSlack?.isVerified` off the loaded
+       * relation and never dereferences the id, so a rule carrying only
+       * userSlackId would sail through delivery sending nothing at all.
+       */
+      const rule: UserNotificationRule = deliveredRules()[0]!;
+      expect(rule.userSlack).toBe(slack);
+      expect(rule.userSlackId!.toString()).toBe(SLACK_METHOD_ID.toString());
+
+      for (const spy of everyPaidChannelFindSpy()) {
+        expect(spy).not.toHaveBeenCalled();
+      }
+      expect(webhookFindSpy).not.toHaveBeenCalled();
+    });
+
+    test('a verified Microsoft Teams account alone is chosen, as "Microsoft Teams", with the relation AND the FK', async () => {
+      const microsoftTeams: Record<string, unknown> =
+        makeVerifiedMicrosoftTeams();
+      microsoftTeamsFindSpy.mockResolvedValue(microsoftTeams as never);
+
+      const result: FallbackNotificationResult = await runFallback();
+
+      expect(result.channelsUsed).toEqual(["Microsoft Teams"]);
+      expect(result.notified).toBe(true);
+      expect(result.outcome).toBe(FallbackNotificationOutcome.Delivered);
+
+      const rule: UserNotificationRule = deliveredRules()[0]!;
+      expect(rule.userMicrosoftTeams).toBe(microsoftTeams);
+      expect(rule.userMicrosoftTeamsId!.toString()).toBe(
+        MICROSOFT_TEAMS_METHOD_ID.toString(),
+      );
+
+      for (const spy of everyPaidChannelFindSpy()) {
+        expect(spy).not.toHaveBeenCalled();
+      }
+      expect(webhookFindSpy).not.toHaveBeenCalled();
+    });
+
+    test("a responder with push, email, Slack AND Microsoft Teams gets ALL FOUR, in this order", async () => {
+      pushFindSpy.mockResolvedValue(makeVerifiedPush() as never);
+      emailFindSpy.mockResolvedValue(makeVerifiedEmail() as never);
+      slackFindSpy.mockResolvedValue(makeVerifiedSlack() as never);
+      microsoftTeamsFindSpy.mockResolvedValue(
+        makeVerifiedMicrosoftTeams() as never,
+      );
+
+      const result: FallbackNotificationResult = await runFallback();
+
+      /*
+       * The zero-cost tier takes everything present, never a subset: none of
+       * the four costs the project anything, so there is no reason to pick
+       * between them and every reason to maximise the chance of reaching a
+       * human wherever they happen to be looking.
+       */
+      expect(result.channelsUsed).toEqual([
+        "Push",
+        "Email",
+        "Slack",
+        "Microsoft Teams",
+      ]);
+      expect(result.notified).toBe(true);
+      expect(result.outcome).toBe(FallbackNotificationOutcome.Delivered);
+      // Four channels, four delivery calls, each with its own rule.
+      expect(deliverSpy).toHaveBeenCalledTimes(4);
+      for (const spy of everyPaidChannelFindSpy()) {
+        expect(spy).not.toHaveBeenCalled();
+      }
+    });
+
     test("with a zero-cost channel available the project settings are never even read", async () => {
       emailFindSpy.mockResolvedValue(makeVerifiedEmail() as never);
 
@@ -509,6 +632,34 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
       expect((query["userId"] as ObjectID).toString()).toBe(USER_ID.toString());
       expect(query["isVerified"]).toBe(true);
     });
+
+    test("the Slack lookup is scoped to this project, this user, and verified accounts only", async () => {
+      slackFindSpy.mockResolvedValue(makeVerifiedSlack() as never);
+
+      await runFallback();
+
+      const query: Record<string, unknown> = queryOf(slackFindSpy);
+      expect((query["projectId"] as ObjectID).toString()).toBe(
+        PROJECT_ID.toString(),
+      );
+      expect((query["userId"] as ObjectID).toString()).toBe(USER_ID.toString());
+      expect(query["isVerified"]).toBe(true);
+    });
+
+    test("the Microsoft Teams lookup is scoped to this project, this user, and verified accounts only", async () => {
+      microsoftTeamsFindSpy.mockResolvedValue(
+        makeVerifiedMicrosoftTeams() as never,
+      );
+
+      await runFallback();
+
+      const query: Record<string, unknown> = queryOf(microsoftTeamsFindSpy);
+      expect((query["projectId"] as ObjectID).toString()).toBe(
+        PROJECT_ID.toString(),
+      );
+      expect((query["userId"] as ObjectID).toString()).toBe(USER_ID.toString());
+      expect(query["isVerified"]).toBe(true);
+    });
   });
 
   /*
@@ -659,7 +810,7 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
       },
     );
 
-    test("the paid ladder is only reached when BOTH zero-cost channels are missing", async () => {
+    test("the paid ladder is only reached when ALL FOUR zero-cost channels are missing", async () => {
       pushFindSpy.mockResolvedValue(makeVerifiedPush() as never);
       giveResponderEveryPaidMethod();
       projectFindSpy.mockResolvedValue(
@@ -671,6 +822,36 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
       expect(result.channelsUsed).toEqual(["Push"]);
       expect(smsFindSpy).not.toHaveBeenCalled();
     });
+
+    test("a Slack account alone keeps the paid ladder shut - the project row is never even read", async () => {
+      slackFindSpy.mockResolvedValue(makeVerifiedSlack() as never);
+      giveResponderEveryPaidMethod();
+      projectFindSpy.mockResolvedValue(
+        makeProject({ [SMS_FLAG]: true }) as never,
+      );
+
+      const result: FallbackNotificationResult = await runFallback();
+
+      expect(result.channelsUsed).toEqual(["Slack"]);
+      expect(projectFindSpy).not.toHaveBeenCalled();
+      expect(smsFindSpy).not.toHaveBeenCalled();
+    });
+
+    test("a Microsoft Teams account alone keeps the paid ladder shut too", async () => {
+      microsoftTeamsFindSpy.mockResolvedValue(
+        makeVerifiedMicrosoftTeams() as never,
+      );
+      giveResponderEveryPaidMethod();
+      projectFindSpy.mockResolvedValue(
+        makeProject({ [SMS_FLAG]: true }) as never,
+      );
+
+      const result: FallbackNotificationResult = await runFallback();
+
+      expect(result.channelsUsed).toEqual(["Microsoft Teams"]);
+      expect(projectFindSpy).not.toHaveBeenCalled();
+      expect(smsFindSpy).not.toHaveBeenCalled();
+    });
   });
 
   /*
@@ -795,6 +976,8 @@ describe("UserNotificationRuleService.executeFallbackNotification", () => {
           rule.userCall,
           rule.userWhatsApp,
           rule.userTelegram,
+          rule.userSlack,
+          rule.userMicrosoftTeams,
           rule.userWebhook,
         ].filter((method: unknown): boolean => {
           return Boolean(method);