@oneuptime/common 12.0.2 → 12.0.4

package/Server/API/UserAPI.ts

@@ -1,10 +1,29 @@
+import Team from "../../Models/DatabaseModels/Team";
+import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import User from "../../Models/DatabaseModels/User";
+import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Query from "../../Types/BaseDatabase/Query";
+import LIMIT_MAX, { DEFAULT_LIMIT } from "../../Types/Database/LimitMax";
+import BadDataException from "../../Types/Exception/BadDataException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
+import { JSONArray, JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import TeamMembersByProject, {
+  UserProjectMembership,
+} from "../../Utils/TeamMembersByProject";
+import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
+import TeamMemberService from "../Services/TeamMemberService";
 import UserService, {
   Service as UserServiceType,
 } from "../Services/UserService";
-import { ExpressRequest, ExpressResponse } from "../Utils/Express";
+import CommonAPI from "./CommonAPI";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
 import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
@@ -16,6 +35,162 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
   public constructor() {
     super(User, UserService);
 
+    /*
+     * Every project one user belongs to, one row per project, for the Admin
+     * Dashboard's User > Projects page.
+     *
+     * There is no CRUD list that answers this. `GET /team-member` scoped to a
+     * user returns MEMBERSHIPS - a (user, team) pair - so a user on three teams
+     * of one project comes back as three rows and reads as three projects. This
+     * endpoint folds those into one row per project carrying every team the
+     * user is on there, which is both what the page renders and what any
+     * caller asking "which projects is this person in?" actually wants.
+     *
+     * Master-admin only: it deliberately reads across every tenant, which is
+     * exactly what no project-scoped caller is allowed to do. The middleware is
+     * the gate; the read below runs as root because a master admin is not a
+     * member of the projects being listed and so has no tenant permissions to
+     * read them with.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/projects`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const memberships: Array<TeamMember> = await TeamMemberService.findBy(
+            {
+              query: {
+                userId: userId,
+              },
+              select: {
+                _id: true,
+                projectId: true,
+                teamId: true,
+                hasAcceptedInvitation: true,
+                createdAt: true,
+                project: {
+                  _id: true,
+                  name: true,
+                  slug: true,
+                },
+                team: {
+                  _id: true,
+                  name: true,
+                },
+              },
+              limit: LIMIT_MAX,
+              skip: 0,
+              sort: {},
+              props: {
+                isRoot: true,
+              },
+            },
+          );
+
+          const rows: Array<UserProjectMembership> =
+            TeamMembersByProject.sortByProjectName(
+              TeamMembersByProject.groupByProject(memberships),
+            );
+
+          const skip: number = UserAPI.getPositiveIntegerParam(
+            req.query["skip"],
+            0,
+          );
+          const limit: number = UserAPI.getPositiveIntegerParam(
+            req.query["limit"],
+            DEFAULT_LIMIT,
+          );
+
+          const page: Array<UserProjectMembership> = rows.slice(
+            skip,
+            skip + limit,
+          );
+
+          return Response.sendJsonArrayResponse(
+            req,
+            res,
+            page.map((row: UserProjectMembership) => {
+              return UserAPI.serializeUserProjectMembership(userId, row);
+            }),
+            new PositiveNumber(rows.length),
+          );
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Removes one user from one project - every team they belong to in it - in
+     * a single call.
+     *
+     * A row on the User > Projects page is a project, so "remove" there means
+     * "remove from the project". Doing that as N separate DELETEs from the
+     * browser is not equivalent: TeamMemberService.onBeforeDelete refuses to
+     * remove the last accepted member of a team that shouldHaveAtLeastOneMember
+     * (the Owners team), and it refuses per request - so a client-side loop
+     * deletes every other membership first and only then reports the failure,
+     * leaving the user stripped of the teams the admin was just told they had
+     * not lost. One deleteBy over the whole set runs that guard against all of
+     * the user's memberships in the project before anything is deleted.
+     *
+     * This is the master-admin twin of
+     * POST /team-member/remove-user-from-project, which takes its project from
+     * the request's tenant. A master admin is not a member of the project and
+     * sends no tenant, so the project is named in the body here - the
+     * master-admin middleware, not a tenant, is what authorizes the call.
+     *
+     * The delete runs with the CALLER'S props rather than as root, so the
+     * Owners-team and SCIM Push Groups guards still apply: a master admin can
+     * remove people, but not leave a project ownerless or fight the customer's
+     * identity provider behind its back.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/remove-from-project`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const projectIdParam: string = (
+            (req.body?.["projectId"] as string) || ""
+          ).trim();
+
+          if (!projectIdParam) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("Project ID is required"),
+            );
+          }
+
+          ObjectID.validateUUID(projectIdParam);
+
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          const numberOfMembershipsDeleted: number =
+            await TeamMemberService.deleteBy({
+              query: {
+                userId: userId,
+                projectId: new ObjectID(projectIdParam),
+              } as Query<TeamMember>,
+              limit: LIMIT_MAX,
+              skip: 0,
+              props: props,
+            });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            numberOfMembershipsDeleted: numberOfMembershipsDeleted,
+          });
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/profile-picture/:userId`,
       async (req: ExpressRequest, res: ExpressResponse) => {
@@ -78,6 +253,93 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
     );
   }
 
+  /**
+   * The `:userId` in the path, rejected loudly if it is not a uuid.
+   *
+   * Validating rather than trusting matters even behind the master-admin gate:
+   * the value flows into a query, and a malformed id should fail as bad input
+   * rather than reach the database layer.
+   */
+  private static getUserIdFromParams(req: ExpressRequest): ObjectID {
+    const userIdParam: string = ((req.params["userId"] as string) || "").trim();
+
+    if (!userIdParam) {
+      throw new BadDataException("User ID is required");
+    }
+
+    ObjectID.validateUUID(userIdParam);
+
+    return new ObjectID(userIdParam);
+  }
+
+  /**
+   * A non-negative integer from a query string, or the fallback.
+   *
+   * Anything unparseable (missing, "abc", "-5", "1e9999") falls back rather
+   * than becoming NaN - a NaN skip/limit turns Array.slice into "return
+   * everything from 0", which would silently ignore paging instead of failing.
+   */
+  private static getPositiveIntegerParam(
+    value: unknown,
+    fallback: number,
+  ): number {
+    if (value === undefined || value === null || value === "") {
+      return fallback;
+    }
+
+    const parsed: number = Number(value.toString());
+
+    if (!Number.isFinite(parsed) || !Number.isInteger(parsed) || parsed < 0) {
+      return fallback;
+    }
+
+    return parsed;
+  }
+
+  /**
+   * One grouped row as JSON.
+   *
+   * The row is sent as a TeamMember - the model the row is built from, and the
+   * one the Admin Dashboard's table is typed against - carrying the project it
+   * stands for. The aggregate fields (`teams`, the counts) are not columns of
+   * TeamMember, so they are attached after serialization; the client reads them
+   * off the raw JSON before hydrating the model.
+   */
+  private static serializeUserProjectMembership(
+    userId: ObjectID,
+    row: UserProjectMembership,
+  ): JSONObject {
+    const teamMember: TeamMember = new TeamMember();
+
+    if (row.id) {
+      teamMember._id = row.id;
+    }
+
+    teamMember.userId = userId;
+    teamMember.hasAcceptedInvitation = row.hasAcceptedInvitation;
+
+    if (row.projectId) {
+      teamMember.projectId = row.projectId;
+    }
+
+    if (row.project) {
+      teamMember.project = row.project;
+    }
+
+    if (row.joinedAt) {
+      teamMember.createdAt = row.joinedAt;
+    }
+
+    const json: JSONObject = BaseModel.toJSON(teamMember, TeamMember);
+
+    json["teams"] = BaseModel.toJSONArray(row.teams, Team) as JSONArray;
+    json["teamCount"] = row.teams.length;
+    json["pendingTeamCount"] = row.pendingTeamCount;
+    json["teamMemberIds"] = [...row.teamMemberIds];
+
+    return json;
+  }
+
   private sendBlankProfile(req: ExpressRequest, res: ExpressResponse): void {
     Response.setNoCacheHeaders(res);
 

package/Server/EnvironmentConfig.ts

@@ -167,13 +167,43 @@ export const PostgresStatementTimeoutMs: number = parseInt(
   10,
 );
 
+/*
+ * Postgres-side lock timeout (ms). Caps how long a statement will WAIT for a
+ * row/table lock before giving up — distinct from statement_timeout, which
+ * caps total execution.
+ *
+ * Without it, contention on a hot row degrades into a strictly-ordered queue:
+ * every waiter pins a backend for the sum of everyone ahead of it. That is the
+ * row-lock convoy that took production down — 892 connections parked on locks,
+ * the tail waiting 3.7 hours — and no amount of database capacity changes it,
+ * because the queue itself is the failure. A short lock_timeout converts an
+ * unbounded wait into a fast, retryable error.
+ *
+ * Must stay well below statement_timeout so a lock wait surfaces as
+ * `lock_not_available` (55P03) rather than a generic statement timeout — the
+ * two want very different handling.
+ */
+export const PostgresLockTimeoutMs: number = parseInt(
+  process.env["DATABASE_LOCK_TIMEOUT_MS"] || "3000",
+  10,
+);
+
 /*
  * Node-postgres client-side query timeout (ms). Belt-and-braces for the
  * server-side statement_timeout — fires even if the connection has gone
  * silent or the server-side timeout doesn't kick in.
+ *
+ * Deliberately LONGER than statement_timeout. These two used to be equal, and
+ * because the client timer starts before the packet even reaches the backend,
+ * the client always won by a round trip — so the app never observed Postgres's
+ * real SQLSTATE and, worse, the client-side timeout only ABANDONS the query:
+ * the backend keeps running and keeps its place in the lock queue. Letting the
+ * server win means contention is cancelled server-side instead of accumulating
+ * invisibly behind a pooler.
  */
 export const PostgresQueryTimeoutMs: number = parseInt(
-  process.env["DATABASE_QUERY_TIMEOUT_MS"] || "30000",
+  process.env["DATABASE_QUERY_TIMEOUT_MS"] ||
+    String(PostgresStatementTimeoutMs + 5000),
   10,
 );
 
@@ -447,10 +477,14 @@ export const DisableQueueWorkers: boolean =
  * When "false", this process does NOT run schema or data migrations on boot.
  * Set on runtime pods (app/worker/nginx) when a dedicated one-shot migrate Job
  * (App/Migrate.ts) owns migrations instead, so the fleet's many replicas never
- * run them — which is what makes PgBouncer transaction-mode pooling safe (the
- * data-migration session advisory lock then only ever runs in the single Job).
+ * run them — which keeps boot DDL off pooled connections and, since the data
+ * migration runner no longer takes an advisory lock, is also what keeps two
+ * replicas from running the same migration concurrently.
+ *
  * Default true preserves the original self-migrating-on-boot behavior used by
- * docker-compose and any deploy that does not run the migrate Job.
+ * docker-compose and any deploy that does not run the migrate Job. Those
+ * deployments DO run several unserialized runners, so data migrations must be
+ * written to tolerate it (see Workers/Utils/DataMigration.ts).
  */
 export const RunDatabaseMigrationsOnBoot: boolean =
   process.env["RUN_DATABASE_MIGRATIONS_ON_BOOT"] !== "false";

package/Server/Infrastructure/GlobalCache.ts

@@ -176,6 +176,158 @@ export default abstract class GlobalCache {
     await client.set(`${namespace}-${key}`, value, "EX", expiresInSeconds);
   }
 
+  /*
+   * Atomic acquire-once fence: SET ... EX ... NX. Returns true ONLY for the
+   * caller that created the key; every concurrent caller gets false until it
+   * expires.
+   *
+   * This exists because `getString()` followed by `setString()` is a
+   * check-then-act race, and at ingest concurrency that race is not
+   * theoretical — it is the whole problem. When N workers resolve the same
+   * row in the same instant they ALL read a miss and they ALL proceed, so a
+   * fence meant to admit one writer per window admits N. With 100 worker pods
+   * that turned a once-a-minute heartbeat into thousands of simultaneous
+   * UPDATEs against the same handful of rows, and the resulting row-lock
+   * convoy starved the Postgres connection pool (some statements queued for
+   * hours). Redis evaluates SET NX atomically, so exactly one caller wins no
+   * matter how many arrive together.
+   *
+   * Fence keys should carry the TTL jitter from `withJitter()` — see there for
+   * why synchronized expiry re-creates the herd this is meant to prevent.
+   */
+  @CaptureSpan()
+  public static async setStringIfNotExists(
+    namespace: string,
+    key: string,
+    value: string,
+    options?: CacheSetOptions,
+  ): Promise<boolean> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const expiresInSeconds: number =
+      options?.expiresInSeconds ?? OneUptimeDate.getSecondsInDays(30);
+
+    const result: string | null = await client.set(
+      `${namespace}-${key}`,
+      value,
+      "EX",
+      expiresInSeconds,
+      "NX",
+    );
+
+    /*
+     * ioredis resolves to "OK" when the key was created and to null when it
+     * already existed. Anything else (a driver/protocol change) is treated as
+     * "did not acquire" — losing the fence is safe, winning it wrongly is not.
+     */
+    return result === "OK";
+  }
+
+  /*
+   * Atomic compare-and-claim: claim the window unless the key ALREADY holds
+   * `value`. Returns true only for the caller that claimed it.
+   *
+   * `setStringIfNotExists` is the right primitive for a presence fence and the
+   * wrong one for a fingerprint throttle. Plain NX fails whenever the key
+   * exists — including when it holds a STALE fingerprint — so a genuinely
+   * changed payload (a new service.version after a deploy, a changed host IP)
+   * would be suppressed for the whole window and nobody would persist it. This
+   * keeps the bust-on-change behaviour that callers depend on while collapsing
+   * the GET-then-SET race into one atomic evaluation.
+   *
+   * The key is passed as KEYS[1] rather than inlined into the script body so
+   * the script stays correct on Redis Cluster, which routes by declared keys.
+   */
+  @CaptureSpan()
+  public static async setStringIfChanged(
+    namespace: string,
+    key: string,
+    value: string,
+    options?: CacheSetOptions,
+  ): Promise<boolean> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const expiresInSeconds: number =
+      options?.expiresInSeconds ?? OneUptimeDate.getSecondsInDays(30);
+
+    const result: unknown = await client.eval(
+      "if redis.call('GET', KEYS[1]) == ARGV[1] then return 0 " +
+        "else redis.call('SET', KEYS[1], ARGV[1], 'EX', ARGV[2]) return 1 end",
+      1,
+      `${namespace}-${key}`,
+      value,
+      String(expiresInSeconds),
+    );
+
+    return result === 1;
+  }
+
+  /*
+   * Spread a fence TTL over [ttl, ttl + 25%].
+   *
+   * A fixed TTL makes every fence for a fleet of rows expire in lockstep once
+   * their writes have been aligned by a common event — a deploy, a worker
+   * scale-up, a Redis restart. The window then reopens for thousands of rows
+   * in the same second and the herd re-forms on a one-minute period. Jitter
+   * breaks that alignment permanently: the fences drift apart after the first
+   * window and stay apart.
+   *
+   * The upper bound stays well inside the 15-minute disconnection sweep, so a
+   * jittered heartbeat can never make a live resource look disconnected.
+   */
+  public static withJitter(expiresInSeconds: number): number {
+    if (expiresInSeconds <= 0) {
+      return expiresInSeconds;
+    }
+
+    return Math.ceil(expiresInSeconds * (1 + Math.random() * 0.25));
+  }
+
+  /*
+   * Atomic compare-and-delete: drop the key only if it still holds `value`.
+   * Returns true only when this caller's value was the one removed.
+   *
+   * This is the release half of a lease taken with `setStringIfNotExists`, and
+   * the comparison is what makes the release safe. A plain `deleteKey` is a
+   * check-then-act race in disguise: if the holder overruns its TTL the key
+   * expires, a second worker legitimately acquires the lease, and the first
+   * worker's release then deletes the SECOND worker's lease — handing the same
+   * lease to a third. Comparing the holder token collapses that into one
+   * atomic evaluation, so a late release is a no-op instead of a double-grant.
+   *
+   * The key is passed as KEYS[1] rather than inlined into the script body so
+   * the script stays correct on Redis Cluster, which routes by declared keys.
+   */
+  @CaptureSpan()
+  public static async deleteKeyIfValue(
+    namespace: string,
+    key: string,
+    value: string,
+  ): Promise<boolean> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const result: unknown = await client.eval(
+      "if redis.call('GET', KEYS[1]) == ARGV[1] then return redis.call('DEL', KEYS[1]) else return 0 end",
+      1,
+      `${namespace}-${key}`,
+      value,
+    );
+
+    return result === 1;
+  }
+
   @CaptureSpan()
   public static async deleteKey(namespace: string, key: string): Promise<void> {
     const client: ClientType | null = Redis.getClient();

package/Server/Infrastructure/Postgres/DataSourceOptions.ts

@@ -10,6 +10,7 @@ import {
   DatabaseUsername,
   MaxPostgresConnections,
   PostgresConnectionAcquireTimeoutMs,
+  PostgresLockTimeoutMs,
   PostgresIdleInTransactionTimeoutMs,
   PostgresIdleSessionTimeoutMs,
   PostgresIdleTimeoutMs,
@@ -61,6 +62,21 @@ const dataSourceOptions: DataSourceOptions = {
     statement_timeout: PostgresStatementTimeoutMs,
     query_timeout: PostgresQueryTimeoutMs,
     idle_in_transaction_session_timeout: PostgresIdleInTransactionTimeoutMs,
+    /*
+     * Bound how long a statement WAITS for a lock, so contention on a hot row
+     * fails fast instead of forming a queue (see PostgresLockTimeoutMs).
+     *
+     * Excluded on the migration path, and that exclusion is load-bearing:
+     * App/Migrate.ts loads these same options and connects DIRECTLY to the
+     * backend (bypassing any pooler), where startup parameters really do take
+     * effect. A 3s lock_timeout there would abort ACCESS EXCLUSIVE DDL on any
+     * table with live traffic — only the two migrations that set their own
+     * `SET LOCAL lock_timeout` expect to fail that way; the rest must be free
+     * to wait.
+     */
+    ...(PostgresLockTimeoutMs > 0 && !RunDatabaseMigrationsOnBoot
+      ? { lock_timeout: PostgresLockTimeoutMs }
+      : {}),
     /*
      * Detect dead TCP peers (ungraceful client exit / network partition) so
      * orphaned server-side connections get torn down instead of lingering

package/Server/Infrastructure/Postgres/SchemaMigrations/1786005052769-AddStatusPageMonitorRule.ts

@@ -0,0 +1,123 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddStatusPageMonitorRule1786005052769
+  implements MigrationInterface
+{
+  public name = "AddStatusPageMonitorRule1786005052769";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "StatusPageMonitorRule" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "statusPageId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "isEnabled" boolean NOT NULL DEFAULT true, "monitorNamePattern" character varying(500), "monitorDescriptionPattern" character varying(500), "statusPageGroupId" uuid, "showCurrentStatus" boolean NOT NULL DEFAULT true, "showUptimePercent" boolean NOT NULL DEFAULT true, "uptimePercentPrecision" character varying, "showStatusHistoryChart" boolean NOT NULL DEFAULT true, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_f8d44792805d19b9a80921b6aa6" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_1dfd95ad32f7b687ef4d7ba591" ON "StatusPageMonitorRule" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_473317deaa55a8305a047e4098" ON "StatusPageMonitorRule" ("statusPageId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_61196848685b7e7f5a6a54278b" ON "StatusPageMonitorRule" ("name") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_71d1869039530178fd5f7e6faa" ON "StatusPageMonitorRule" ("isEnabled") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_3e6d0bc4d444371aaa13a1c14c" ON "StatusPageMonitorRule" ("statusPageGroupId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "StatusPageMonitorRuleMonitorLabel" ("statusPageMonitorRuleId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_59234d33b435d8e771cd3728ea4" PRIMARY KEY ("statusPageMonitorRuleId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_0eb2b2a3601ea9813b8e162bd3" ON "StatusPageMonitorRuleMonitorLabel" ("statusPageMonitorRuleId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_bc08b888a870ecc9167516230a" ON "StatusPageMonitorRuleMonitorLabel" ("labelId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageResource" ADD "statusPageMonitorRuleId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_4e1ed45d9506da817dc7811601" ON "StatusPageResource" ("statusPageMonitorRuleId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_1dfd95ad32f7b687ef4d7ba5910" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_473317deaa55a8305a047e4098b" FOREIGN KEY ("statusPageId") REFERENCES "StatusPage"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_3e6d0bc4d444371aaa13a1c14cc" FOREIGN KEY ("statusPageGroupId") REFERENCES "StatusPageGroup"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_60d22031be1695cbd1405376cbf" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" ADD CONSTRAINT "FK_3416ec12899c9dde670d8dea290" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageResource" ADD CONSTRAINT "FK_4e1ed45d9506da817dc78116010" FOREIGN KEY ("statusPageMonitorRuleId") REFERENCES "StatusPageMonitorRule"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRuleMonitorLabel" ADD CONSTRAINT "FK_0eb2b2a3601ea9813b8e162bd3b" FOREIGN KEY ("statusPageMonitorRuleId") REFERENCES "StatusPageMonitorRule"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRuleMonitorLabel" ADD CONSTRAINT "FK_bc08b888a870ecc9167516230ad" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRuleMonitorLabel" DROP CONSTRAINT "FK_bc08b888a870ecc9167516230ad"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRuleMonitorLabel" DROP CONSTRAINT "FK_0eb2b2a3601ea9813b8e162bd3b"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageResource" DROP CONSTRAINT "FK_4e1ed45d9506da817dc78116010"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_3416ec12899c9dde670d8dea290"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_60d22031be1695cbd1405376cbf"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_3e6d0bc4d444371aaa13a1c14cc"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_473317deaa55a8305a047e4098b"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageMonitorRule" DROP CONSTRAINT "FK_1dfd95ad32f7b687ef4d7ba5910"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_4e1ed45d9506da817dc7811601"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageResource" DROP COLUMN "statusPageMonitorRuleId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_bc08b888a870ecc9167516230a"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0eb2b2a3601ea9813b8e162bd3"`,
+    );
+    await queryRunner.query(`DROP TABLE "StatusPageMonitorRuleMonitorLabel"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_3e6d0bc4d444371aaa13a1c14c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_71d1869039530178fd5f7e6faa"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_61196848685b7e7f5a6a54278b"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_473317deaa55a8305a047e4098"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_1dfd95ad32f7b687ef4d7ba591"`,
+    );
+    await queryRunner.query(`DROP TABLE "StatusPageMonitorRule"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786018109307-AddPerUserPasswordSalt.ts

@@ -0,0 +1,21 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddPerUserPasswordSalt1786018109307 implements MigrationInterface {
+  public name = "AddPerUserPasswordSalt1786018109307";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "User" ADD "passwordSalt" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPagePrivateUser" ADD "passwordSalt" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPagePrivateUser" DROP COLUMN "passwordSalt"`,
+    );
+    await queryRunner.query(`ALTER TABLE "User" DROP COLUMN "passwordSalt"`);
+  }
+}