@oneuptime/common 12.0.18 → 12.0.20

package/Types/Marketing/MarketingEvent.ts

@@ -0,0 +1,140 @@
+import { JSONObject } from "../JSON";
+
+/*
+ * The outbound marketing event contract.
+ *
+ * OneUptime does not keep a conversion ledger. The moments worth
+ * measuring are emitted as signed webhooks at the instant they happen and are
+ * not stored here afterwards, so this interface — not a database table — is
+ * the whole record of what a conversion looks like.
+ *
+ * Two consequences follow from having no store, and both are the receiver's
+ * job rather than ours:
+ *
+ *   - DEDUPLICATION. `eventId` is stable for a given real-world occurrence, so
+ *     a redelivery carries the id the first attempt did. Retries are expected
+ *     (the queue retries, and Cal retries into us), so a receiver that keys on
+ *     anything else will double-count.
+ *   - ORDERING. Events are delivered per-occurrence with no sequence number.
+ *     A signup and a plan change seconds apart may arrive either way round;
+ *     order by `occurredAt`, never by arrival.
+ *
+ * Names are the same snake_case the browser funnel uses
+ * (Common/Types/Analytics/RevenueEvent.ts) so one event means one thing on
+ * both sides. Adding a property is safe; changing what an existing one means
+ * requires a new schema version.
+ */
+export enum MarketingEventType {
+  SignUp = "sign_up",
+  MeetingBooked = "meeting_booked",
+  /*
+   * A project's first paid subscription, created together with the project.
+   *
+   * Deliberately not a subscription_upgraded. An upgrade is a movement between
+   * two tiers and reports expansion; this has no previous tier at all and is
+   * new business. Reporting one as the other mixes net-new with expansion
+   * revenue, and nothing downstream could separate them again.
+   */
+  SubscriptionStarted = "subscription_started",
+  SubscriptionUpgraded = "subscription_upgraded",
+  SubscriptionDowngraded = "subscription_downgraded",
+  /*
+   * A sales-led licence was issued, carrying its annual contract value.
+   *
+   * This is the only event that reports enterprise revenue, and the only one
+   * whose email is typed in by a human rather than captured from a session —
+   * which is exactly what makes it joinable: set EnterpriseLicense.email to
+   * the address the customer booked with and this event shares an identity
+   * with the meeting_booked that preceded it, months earlier.
+   */
+  EnterpriseLicenseIssued = "enterprise_license_issued",
+}
+
+/*
+ * Which conversation a booked meeting actually is.
+ *
+ * All three Cal embeds book the same event type (oneuptimehq/demo), so without
+ * this the webhook cannot tell a free user's support call from a net-new
+ * enterprise demo — they arrive as one undifferentiated `meeting_booked`, and
+ * anything bidding on or reporting against that count values them identically.
+ *
+ * The browser event has carried this since the embeds were instrumented; the
+ * webhook did not, which meant the authoritative record was the one that could
+ * not make the distinction.
+ *
+ * `Unknown` is a real state, not a failure: a booking made through a Cal link
+ * that was not one of the instrumented embeds genuinely has no kind, and is
+ * still a booking worth emitting.
+ */
+export enum MeetingBookingKind {
+  EnterpriseDemo = "enterprise_demo",
+  SupportCall = "support_call",
+  ArchitectureAssessment = "architecture_assessment",
+  Unknown = "unknown",
+}
+
+/*
+ * The Cal booking-metadata key the embeds write and the webhook reads. Shared
+ * so a rename cannot land on one side only - the failure mode there is silent,
+ * because a booking with no recognised kind still succeeds.
+ */
+export const BOOKING_KIND_METADATA_KEY: string = "ou_booking_kind";
+
+export const MeetingBookingKinds: Array<string> =
+  Object.values(MeetingBookingKind);
+
+export const MARKETING_EVENT_SCHEMA_VERSION: number = 1;
+
+/*
+ * The campaign the converting visitor carried.
+ *
+ * Copied from the User or Project row for a signup or a plan change, and read
+ * out of Cal booking metadata for a booked meeting. Every field is optional:
+ * a conversion with no attribution at all is still a conversion, and is still
+ * emitted.
+ */
+export interface MarketingEventAttribution extends JSONObject {
+  utmSource?: string | undefined;
+  utmMedium?: string | undefined;
+  utmCampaign?: string | undefined;
+  utmTerm?: string | undefined;
+  utmContent?: string | undefined;
+  utmUrl?: string | undefined;
+  clickIds: JSONObject;
+  firstTouch: JSONObject;
+}
+
+export interface MarketingEvent extends JSONObject {
+  schemaVersion: number;
+  /*
+   * Stable per real-world occurrence, and the receiver's deduplication key:
+   *
+   *   sign_up:{userId}
+   *   meeting_booked:{calBookingUid}
+   *   subscription_started:{projectId}
+   *   subscription_upgraded:{projectId}:{occurredAt}
+   *   subscription_downgraded:{projectId}:{occurredAt}
+   *   enterprise_license_issued:{enterpriseLicenseId}
+   *
+   * Four of these are naturally unique — a user signs up once, a booking has
+   * one uid, a project has one first subscription, a licence row is issued
+   * once — so Cal retrying a delivery or the queue retrying a job cannot
+   * produce a second conversion. A plan change can legitimately recur for one
+   * project, so its id carries the instant it happened.
+   */
+  eventId: string;
+  eventType: MarketingEventType;
+  // ISO 8601, UTC. The moment the conversion happened, not the moment it was sent.
+  occurredAt: string;
+  /*
+   * Identity. Both forms are sent: the address for a direct CRM join, and its
+   * SHA-256 (trimmed and lowercased before hashing, per the usual ad-platform
+   * normalisation) for anywhere a digest is wanted instead. Absent only when
+   * OneUptime genuinely has no address for the conversion.
+   */
+  email?: string | undefined;
+  emailHash?: string | undefined;
+  attribution: MarketingEventAttribution;
+  // Event-specific detail. See the per-event builders in MarketingEventUtil.
+  data: JSONObject;
+}

package/UI/Components/Charts/Area/AreaChart.tsx

@@ -181,7 +181,14 @@ const AreaChartElement: FunctionComponent<AreaInternalProps> = (
 
   return (
     <div
-      className="relative flex flex-1"
+      /*
+       * `isolate` opens a stacking context so the recharts tooltip's
+       * z-index competes only inside this chart — without it the tooltip
+       * (zIndex 10, pinned to the chart's top edge) ties with the app
+       * header's sticky z-10 in the root context and paints over the
+       * navbar on half-scrolled charts.
+       */
+      className="relative isolate flex flex-1"
       style={props.heightInPx ? { height: `${props.heightInPx}px` } : undefined}
     >
       <AreaChart

package/UI/Components/Charts/Bar/BarChart.tsx

@@ -115,7 +115,14 @@ const BarChartElement: FunctionComponent<BarInternalProps> = (
 
   return (
     <div
-      className="relative flex flex-1"
+      /*
+       * `isolate` opens a stacking context so the recharts tooltip's
+       * z-index competes only inside this chart — without it the tooltip
+       * (zIndex 10, pinned to the chart's top edge) ties with the app
+       * header's sticky z-10 in the root context and paints over the
+       * navbar on half-scrolled charts.
+       */
+      className="relative isolate flex flex-1"
       style={props.heightInPx ? { height: `${props.heightInPx}px` } : undefined}
     >
       <BarChart

package/UI/Components/Charts/ChartLibrary/AreaChart/AreaChart.tsx

@@ -39,6 +39,10 @@ import {
 import { cx } from "../Utils/Cx";
 import { getYAxisDomain } from "../Utils/GetYAxisDomain";
 import { hasOnlyOneValueForKey } from "../Utils/HasOnlyOneValueForKey";
+import {
+  PreparedTooltipEntries,
+  prepareTooltipEntries,
+} from "../Utils/TooltipEntries";
 import ChartCurve from "../../Types/ChartCurve";
 
 /*
@@ -475,9 +479,15 @@ const ChartTooltip: ({
   valueFormatter,
 }: ChartTooltipProps): React.JSX.Element | null => {
   if (active && payload && payload.length) {
-    const legendPayload: PayloadItem[] = payload.filter((item: PayloadItem) => {
-      return item.type !== "none";
-    });
+    /*
+     * Highest value at the hovered timestamp first, capped — on a grouped
+     * chart (one series per host/pod), the spiking series must be the
+     * first line of the tooltip, not buried at its alphabetical position.
+     */
+    const {
+      entries: legendPayload,
+      overflowCount,
+    }: PreparedTooltipEntries<PayloadItem> = prepareTooltipEntries(payload);
     return (
       <div
         className={cx(
@@ -531,6 +541,11 @@ const ChartTooltip: ({
               );
             },
           )}
+          {overflowCount > 0 ? (
+            <p className={cx("pt-1 text-xs", "text-gray-400")}>
+              +{overflowCount} more series — highest values shown
+            </p>
+          ) : null}
         </div>
       </div>
     );
@@ -1426,4 +1441,4 @@ const AreaChart: React.ForwardRefExoticComponent<
 
 AreaChart.displayName = "AreaChart";
 
-export { AreaChart, type AreaChartEventProps, type TooltipProps };
+export { AreaChart, ChartTooltip, type AreaChartEventProps, type TooltipProps };

package/UI/Components/Charts/ChartLibrary/BarChart/BarChart.tsx

@@ -33,6 +33,10 @@ import {
 } from "../Utils/ChartColors";
 import { cx } from "../Utils/Cx";
 import { getYAxisDomain } from "../Utils/GetYAxisDomain";
+import {
+  PreparedTooltipEntries,
+  prepareTooltipEntries,
+} from "../Utils/TooltipEntries";
 import { useOnWindowResize } from "../Utils/UseWindowOnResize";
 
 /*
@@ -562,6 +566,15 @@ const ChartTooltip: React.FunctionComponent<ChartTooltipProps> = ({
   valueFormatter,
 }: ChartTooltipProps): React.ReactElement | null => {
   if (active && payload && payload.length) {
+    /*
+     * Highest value at the hovered bucket first, capped — on a grouped
+     * chart (one series per host/pod), the spiking series must be the
+     * first line of the tooltip, not buried at its alphabetical position.
+     */
+    const {
+      entries: sortedPayload,
+      overflowCount,
+    }: PreparedTooltipEntries<PayloadItem> = prepareTooltipEntries(payload);
     return (
       <div
         className={cx(
@@ -586,7 +599,7 @@ const ChartTooltip: React.FunctionComponent<ChartTooltipProps> = ({
           </p>
         </div>
         <div className={cx("space-y-1 px-4 py-2")}>
-          {payload.map(
+          {sortedPayload.map(
             ({ value, category, color }: PayloadItem, index: number) => {
               return (
                 <div
@@ -631,6 +644,11 @@ const ChartTooltip: React.FunctionComponent<ChartTooltipProps> = ({
               );
             },
           )}
+          {overflowCount > 0 ? (
+            <p className={cx("pt-1 text-xs", "text-gray-400")}>
+              +{overflowCount} more series — highest values shown
+            </p>
+          ) : null}
         </div>
       </div>
     );
@@ -1194,4 +1212,4 @@ const BarChart: React.ForwardRefExoticComponent<
 
 BarChart.displayName = "BarChart";
 
-export { BarChart, type BarChartEventProps, type TooltipProps };
+export { BarChart, ChartTooltip, type BarChartEventProps, type TooltipProps };

package/UI/Components/Charts/ChartLibrary/LineChart/LineChart.tsx

@@ -40,6 +40,10 @@ import {
 import { cx } from "../Utils/Cx";
 import { getYAxisDomain } from "../Utils/GetYAxisDomain";
 import { hasOnlyOneValueForKey } from "../Utils/HasOnlyOneValueForKey";
+import {
+  PreparedTooltipEntries,
+  prepareTooltipEntries,
+} from "../Utils/TooltipEntries";
 import ChartCurve from "../../Types/ChartCurve";
 
 /*
@@ -478,9 +482,15 @@ const ChartTooltip: ({
   valueFormatter,
 }: ChartTooltipProps): React.JSX.Element | null => {
   if (active && payload && payload.length) {
-    const legendPayload: PayloadItem[] = payload.filter((item: PayloadItem) => {
-      return item.type !== "none";
-    });
+    /*
+     * Highest value at the hovered timestamp first, capped — on a grouped
+     * chart (one series per host/pod), the spiking series must be the
+     * first line of the tooltip, not buried at its alphabetical position.
+     */
+    const {
+      entries: legendPayload,
+      overflowCount,
+    }: PreparedTooltipEntries<PayloadItem> = prepareTooltipEntries(payload);
     return (
       <div
         className={cx(
@@ -550,6 +560,11 @@ const ChartTooltip: ({
               );
             },
           )}
+          {overflowCount > 0 ? (
+            <p className={cx("pt-1 text-xs", "text-gray-400")}>
+              +{overflowCount} more series — highest values shown
+            </p>
+          ) : null}
         </div>
       </div>
     );
@@ -1419,4 +1434,4 @@ const LineChart: React.ForwardRefExoticComponent<
 
 LineChart.displayName = "LineChart";
 
-export { LineChart, type LineChartEventProps, type TooltipProps };
+export { ChartTooltip, LineChart, type LineChartEventProps, type TooltipProps };

package/UI/Components/Charts/ChartLibrary/Utils/TooltipEntries.ts

@@ -0,0 +1,105 @@
+/*
+ * Shared ordering/capping for the hover tooltip of the Area / Line / Bar
+ * charts. With a grouped metric (say 20 hosts on one chart) the recharts
+ * payload arrives in series-render order — effectively alphabetical — so
+ * the series that is actually spiking at the hovered timestamp is buried
+ * mid-list. Sorting by the value AT THE HOVERED POINT puts the top series
+ * first, and capping the list keeps a high-cardinality chart's tooltip
+ * readable (the "+N more" line reports what was elided).
+ */
+
+/*
+ * The slice of a recharts tooltip payload item the ordering needs. The
+ * three chart implementations each declare their own structurally-equal
+ * PayloadItem, so this stays generic instead of importing any of them.
+ */
+export interface SortableTooltipItem {
+  category: string;
+  value: number;
+  type?: string | undefined;
+}
+
+export const DEFAULT_TOOLTIP_MAX_ENTRIES: number = 10;
+
+export interface PreparedTooltipEntries<T extends SortableTooltipItem> {
+  /** Entries to render, highest value first, capped at maxEntries. */
+  entries: Array<T>;
+  /** How many entries the cap hid (0 when everything fits). */
+  overflowCount: number;
+  /** Entry count after filtering, before capping. */
+  totalCount: number;
+}
+
+/*
+ * Natural compare so host names order like cpu0 < cpu2 < cpu10 instead of
+ * lexicographically — mirrors the series chips' name ordering.
+ */
+function compareCategoryNames(a: string, b: string): number {
+  return String(a).localeCompare(String(b), undefined, {
+    numeric: true,
+    sensitivity: "base",
+  });
+}
+
+export function prepareTooltipEntries<T extends SortableTooltipItem>(
+  payload: Array<T> | undefined | null,
+  maxEntries: number = DEFAULT_TOOLTIP_MAX_ENTRIES,
+): PreparedTooltipEntries<T> {
+  /*
+   * `type === "none"` entries are series excluded from legends/tooltips
+   * (recharts tooltipType) — every chart filtered them before this
+   * module existed, so the filter lives here now to stay uniform.
+   */
+  const visibleEntries: Array<T> = (payload || []).filter((item: T) => {
+    return item.type !== "none";
+  });
+
+  const sortedEntries: Array<T> = visibleEntries
+    .slice()
+    .sort((a: T, b: T): number => {
+      /*
+       * Non-finite values (missing points, the anomaly band's [low, high]
+       * array) sort last — they carry no "how high is this series right
+       * now" signal, so they must never displace a real reading.
+       */
+      const aValue: number | null =
+        typeof a.value === "number" && Number.isFinite(a.value)
+          ? a.value
+          : null;
+      const bValue: number | null =
+        typeof b.value === "number" && Number.isFinite(b.value)
+          ? b.value
+          : null;
+
+      if (aValue === null && bValue === null) {
+        return compareCategoryNames(a.category, b.category);
+      }
+      if (aValue === null) {
+        return 1;
+      }
+      if (bValue === null) {
+        return -1;
+      }
+      if (bValue !== aValue) {
+        return bValue - aValue;
+      }
+      return compareCategoryNames(a.category, b.category);
+    });
+
+  const totalCount: number = sortedEntries.length;
+
+  const cap: number =
+    Number.isInteger(maxEntries) && maxEntries > 0
+      ? maxEntries
+      : DEFAULT_TOOLTIP_MAX_ENTRIES;
+
+  if (totalCount <= cap) {
+    return { entries: sortedEntries, overflowCount: 0, totalCount };
+  }
+
+  return {
+    entries: sortedEntries.slice(0, cap),
+    overflowCount: totalCount - cap,
+    totalCount,
+  };
+}

package/UI/Components/Charts/Line/LineChart.tsx

@@ -161,7 +161,14 @@ const LineChartElement: FunctionComponent<LineInternalProps> = (
 
   return (
     <div
-      className="relative flex flex-1"
+      /*
+       * `isolate` opens a stacking context so the recharts tooltip's
+       * z-index competes only inside this chart — without it the tooltip
+       * (zIndex 10, pinned to the chart's top edge) ties with the app
+       * header's sticky z-10 in the root context and paints over the
+       * navbar on half-scrolled charts.
+       */
+      className="relative isolate flex flex-1"
       style={props.heightInPx ? { height: `${props.heightInPx}px` } : undefined}
     >
       <LineChart

package/UI/Components/Detail/Detail.tsx

@@ -715,7 +715,24 @@ const Detail: DetailFunction = <T extends GenericObject>(
     }
 
     if (field.getElement) {
-      data = field.getElement(props.item);
+      /*
+       * getField runs inside Detail's own render, so a throw out of a field
+       * renderer unwinds the whole route to the app level ErrorBoundary and
+       * replaces the page with "Something went wrong". One misbehaving field
+       * must never cost the entire page: log the misconfiguration and keep
+       * whatever this field type already rendered - the entity badge, or ""
+       * so the placeholder below can stand in.
+       */
+      try {
+        data = field.getElement(props.item);
+      } catch (err) {
+        Logger.error(
+          "Detail: getElement for '" +
+            fieldKeyStr +
+            "' threw and was ignored. " +
+            (err instanceof Error ? err.message : String(err)),
+        );
+      }
     }
 
     let className: string = "sm:col-span-1";

package/UI/Utils/NotificationMethodUtil.ts

@@ -7,6 +7,8 @@ import UserNotificationRule from "../../Models/DatabaseModels/UserNotificationRu
 import UserPush from "../../Models/DatabaseModels/UserPush";
 import UserSMS from "../../Models/DatabaseModels/UserSMS";
 import UserTelegram from "../../Models/DatabaseModels/UserTelegram";
+import UserSlack from "../../Models/DatabaseModels/UserSlack";
+import UserMicrosoftTeams from "../../Models/DatabaseModels/UserMicrosoftTeams";
 import UserWebhook from "../../Models/DatabaseModels/UserWebhook";
 import UserWhatsApp from "../../Models/DatabaseModels/UserWhatsApp";
 import ObjectID from "../../Types/ObjectID";
@@ -37,6 +39,8 @@ export interface NotificationMethodModels {
   userPush: Array<UserPush>;
   userWhatsApps: Array<UserWhatsApp>;
   userTelegrams: Array<UserTelegram>;
+  userSlacks: Array<UserSlack>;
+  userMicrosoftTeamsAccounts: Array<UserMicrosoftTeams>;
   userWebhooks: Array<UserWebhook>;
 }
 
@@ -74,6 +78,16 @@ const NOTIFICATION_METHOD_RELATIONS: Array<NotificationMethodRelation> = [
     title: "Telegram",
     columns: ["telegramUserHandle", "telegramChatId"],
   },
+  {
+    relationName: "userSlack",
+    title: "Slack",
+    columns: ["slackUserName", "slackUserId"],
+  },
+  {
+    relationName: "userMicrosoftTeams",
+    title: "Microsoft Teams",
+    columns: ["microsoftTeamsUserName", "microsoftTeamsUserId"],
+  },
   /*
    * Only `name` is read here. A webhook URL is a bearer credential for
    * Slack/Discord/Teams style hooks, so it is deliberately never selected into
@@ -185,6 +199,24 @@ export default class NotificationMethodUtil {
       );
     }
 
+    if (model instanceof UserSlack) {
+      return (
+        "Slack: " +
+        (NotificationMethodUtil.readColumn(model, "slackUserName") ||
+          NotificationMethodUtil.readColumn(model, "slackUserId") ||
+          "Unknown Account")
+      );
+    }
+
+    if (model instanceof UserMicrosoftTeams) {
+      return (
+        "Microsoft Teams: " +
+        (NotificationMethodUtil.readColumn(model, "microsoftTeamsUserName") ||
+          NotificationMethodUtil.readColumn(model, "microsoftTeamsUserId") ||
+          "Unknown Account")
+      );
+    }
+
     const identifier: string =
       NotificationMethodUtil.readColumn(model, "phone") ||
       NotificationMethodUtil.readColumn(model, "email") ||
@@ -207,7 +239,7 @@ export default class NotificationMethodUtil {
 
   /*
    * Maps the id chosen in the dropdown back onto the rule being created. The
-   * dropdown is single-select, so at most one of the seven foreign keys is set.
+   * dropdown is single-select, so at most one of the nine foreign keys is set.
    * An id that matches nothing leaves the rule untouched, and the server then
    * rejects the create as having no notification method.
    */
@@ -258,6 +290,12 @@ export default class NotificationMethodUtil {
     assignById(models.userTelegrams, (id: ObjectID) => {
       rule.userTelegramId = id;
     });
+    assignById(models.userSlacks, (id: ObjectID) => {
+      rule.userSlackId = id;
+    });
+    assignById(models.userMicrosoftTeamsAccounts, (id: ObjectID) => {
+      rule.userMicrosoftTeamsId = id;
+    });
     assignById(models.userWebhooks, (id: ObjectID) => {
       rule.userWebhookId = id;
     });
@@ -279,6 +317,8 @@ export default class NotificationMethodUtil {
       ...models.userPush,
       ...models.userWhatsApps,
       ...models.userTelegrams,
+      ...models.userSlacks,
+      ...models.userMicrosoftTeamsAccounts,
       ...models.userWebhooks,
     ];
   }

package/UI/Utils/PermissionGate.ts

@@ -4,6 +4,7 @@ import Permission, {
   PermissionHelper,
   PermissionProps,
 } from "../../Types/Permission";
+import { ColumnAccessControl } from "../../Types/BaseDatabase/AccessControl";
 import PermissionUtil from "./Permission";
 import User from "./User";
 
@@ -52,6 +53,15 @@ export interface PermissionCheckableModel {
   getDeletePermissions: () => Array<Permission>;
 }
 
+/*
+ * A model that declares column-level access control. Separate from
+ * PermissionCheckableModel because column gating answers a different question
+ * ("may this field be SELECTED?") and only the database models carry it.
+ */
+export interface ColumnPermissionCheckableModel {
+  getColumnAccessControlForAllColumns: () => Dictionary<ColumnAccessControl>;
+}
+
 export interface PermissionGateOptions {
   /*
    * Overrides the permissions read from storage. Only used by tests and by
@@ -270,6 +280,52 @@ export default class PermissionGate {
     };
   }
 
+  /*
+   * Whether the signed-in user may SELECT a column.
+   *
+   * Column access control is enforced differently from record access control:
+   * asking for a column you cannot read is not degraded, it is fatal.
+   * ColumnPermission throws `User is not allowed to read on <column> column of
+   * <model>` and the whole request fails, so one unreadable field in a select
+   * takes down the entire page rather than blanking one value. That is why
+   * ModelAction has no column-level members (see the comment on the enum) and
+   * why callers must ask this BEFORE building the select, not after.
+   *
+   * Deliberately fails closed. When the permission snapshot has not landed yet
+   * this returns false and the caller omits the field: the page renders
+   * without that one value, which is recoverable. Failing open would send the
+   * column anyway and hard-fail the request, which is not.
+   *
+   * A column with no declared read ACL is readable - there is nothing to
+   * enforce, and ColumnPermission agrees.
+   */
+  public static canReadColumn(
+    model: ColumnPermissionCheckableModel,
+    columnName: string,
+    options?: PermissionGateOptions | undefined,
+  ): boolean {
+    if (User.isMasterAdmin()) {
+      return true;
+    }
+
+    const accessControl: ColumnAccessControl | undefined =
+      model.getColumnAccessControlForAllColumns()[columnName];
+
+    const columnPermissions: Array<Permission> = accessControl?.read || [];
+
+    if (columnPermissions.length === 0) {
+      return true;
+    }
+
+    const userPermissions: Array<Permission> =
+      options?.permissions ?? PermissionUtil.getAllPermissions();
+
+    return PermissionHelper.doesPermissionsIntersect(
+      userPermissions,
+      columnPermissions,
+    );
+  }
+
   /* Test seam - the props lookup is memoized for the lifetime of the page. */
   public static clearPermissionPropsCache(): void {
     permissionPropsCache = null;