@oneuptime/common 12.0.27 → 12.0.29

package/Server/Utils/SecurityEvent/GoogleSecOps/GoogleSecOpsPoller.ts

@@ -16,7 +16,7 @@ import CaptureSpan from "../../Telemetry/CaptureSpan";
 import ConnectorErrorMessage from "../ConnectorErrorMessage";
 import { buildSecurityEventDbRow } from "../SecurityEventRow";
 import ThreatIntelEnricher from "../ThreatIntel/ThreatIntelEnricher";
-import GoogleSecOpsClient from "./GoogleSecOpsClient";
+import GoogleSecOpsClient, { FetchAlertsResult } from "./GoogleSecOpsClient";
 
 const SECOPS_SERVICE_NAME: string = "Google SecOps";
 
@@ -31,6 +31,10 @@ const MAX_LOOKBACK_IN_MINUTES: number = 24 * 60;
 /*
  * Overlap between windows so boundary alerts are never missed; the
  * eventUid content hash keeps redelivered alerts deduplicatable.
+ *
+ * Still open (out of scope here): the overlap does produce genuine
+ * duplicate rows, because SecurityEvent is a plain MergeTree with
+ * eventUid outside the sort key, so nothing collapses them at write time.
  */
 const WINDOW_OVERLAP_IN_MINUTES: number = 1;
 
@@ -80,7 +84,18 @@ export default class GoogleSecOpsPoller {
       }
 
       try {
-        await this.pollConnection(connection);
+        const ingested: number = await this.pollConnection(connection);
+
+        /*
+         * The count used to be returned and dropped on the floor, which
+         * left "polling healthy but quiet" and "polling silently broken"
+         * looking identical from outside the process. At info rather than
+         * debug for that reason — a number nobody sees at the default log
+         * level answers the question no better than not having it.
+         */
+        logger.info(
+          `GoogleSecOpsPoller: connection ${connection.id?.toString()} ingested ${ingested} security events.`,
+        );
       } catch (error) {
         logger.error(
           `GoogleSecOpsPoller: error polling connection ${connection.id?.toString()}:`,
@@ -134,6 +149,8 @@ export default class GoogleSecOpsPoller {
       );
     }
 
+    const connectionId: string = connection.id.toString();
+
     const client: GoogleSecOpsClient =
       clientOverride ||
       new GoogleSecOpsClient({
@@ -149,26 +166,96 @@ export default class GoogleSecOpsPoller {
       -MAX_LOOKBACK_IN_MINUTES,
     );
 
-    let startTime: Date = connection.cursor
-      ? OneUptimeDate.addRemoveMinutes(
-          new Date(connection.cursor),
+    const defaultStartTime: Date = OneUptimeDate.addRemoveMinutes(
+      endTime,
+      -DEFAULT_LOOKBACK_IN_MINUTES,
+    );
+
+    let startTime: Date = defaultStartTime;
+
+    if (connection.cursor) {
+      const cursorTime: Date = new Date(connection.cursor);
+
+      if (Number.isNaN(cursorTime.getTime())) {
+        /*
+         * An unreadable cursor used to share a branch with a stale one and
+         * open the full 24 hour window — the widest possible blast radius
+         * for the least trustworthy input. It means "no usable cursor",
+         * which is what a first poll means too.
+         */
+        logger.warn(
+          `GoogleSecOpsPoller: connection ${connectionId} has an unreadable cursor ${JSON.stringify(
+            connection.cursor,
+          )}; polling the default ${DEFAULT_LOOKBACK_IN_MINUTES} minute window instead.`,
+        );
+      } else {
+        startTime = OneUptimeDate.addRemoveMinutes(
+          cursorTime,
           -WINDOW_OVERLAP_IN_MINUTES,
-        )
-      : OneUptimeDate.addRemoveMinutes(endTime, -DEFAULT_LOOKBACK_IN_MINUTES);
+        );
+      }
+    }
+
+    if (OneUptimeDate.isBefore(startTime, earliestAllowed)) {
+      /*
+       * The alerts between the cursor and the cap are skipped and will
+       * never be fetched again, so the gap has to be stated. Silently
+       * truncating it is how a connector comes back from an outage
+       * looking healthy while a day of detections is simply missing.
+       */
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} would poll from ${startTime.toISOString()}, ${OneUptimeDate.getMinutesBetweenTwoDates(
+          startTime,
+          endTime,
+        )} minutes back and past the ${MAX_LOOKBACK_IN_MINUTES} minute cap; alerts before ${earliestAllowed.toISOString()} are skipped and will not be fetched again.`,
+      );
 
-    if (
-      Number.isNaN(startTime.getTime()) ||
-      OneUptimeDate.isBefore(startTime, earliestAllowed)
-    ) {
       startTime = earliestAllowed;
     }
 
-    const alerts: Array<JSONObject> = await client.fetchDetectionAlerts({
+    if (!OneUptimeDate.isBefore(startTime, endTime)) {
+      /*
+       * A cursor in the future — clock skew on the writer, or a restored
+       * backup — used to send Chronicle an inverted timeRange, which is
+       * neither an error the operator sees nor a window that returns
+       * anything.
+       */
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} cursor resolves to ${startTime.toISOString()}, at or after the current time; polling the default ${DEFAULT_LOOKBACK_IN_MINUTES} minute window instead.`,
+      );
+
+      startTime = defaultStartTime;
+    }
+
+    const fetched: FetchAlertsResult = await client.fetchDetectionAlerts({
       startTime,
       endTime,
     });
 
-    let ingested: number = 0;
+    if (fetched.truncatedByCount) {
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} window ${startTime.toISOString()} to ${endTime.toISOString()} matched more alerts than Chronicle will return, and this endpoint has no pagination — alerts in this window were dropped. Lower pollIntervalInMinutes.`,
+      );
+    }
+
+    if (fetched.truncatedByBytes) {
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} window ${startTime.toISOString()} to ${endTime.toISOString()} was truncated by Chronicle's memory limit — alerts in this window were dropped. Lower pollIntervalInMinutes.`,
+      );
+    }
+
+    const alerts: Array<JSONObject> = fetched.alerts;
+
+    const normalizedAlerts: Array<NormalizedSecurityEvent> = [];
+
+    /*
+     * Objects the alert gate refused, and objects that blew up on the way
+     * through it. They are kept apart because they mean opposite things
+     * for the cursor: a refusal is deterministic and re-fetching it would
+     * refuse it again forever, a failure may well succeed next time.
+     */
+    let rejectedCount: number = 0;
+    let failedCount: number = 0;
 
     if (alerts.length > 0) {
       const serviceMetadata: TelemetryServiceMetadata =
@@ -185,17 +272,34 @@ export default class GoogleSecOpsPoller {
         projectRetentionInDays: serviceMetadata.projectRetentionInDays,
       });
 
-      const normalizedAlerts: Array<NormalizedSecurityEvent> = [];
-
       for (const alert of alerts) {
         try {
+          /*
+           * The normalizer is a total function whose class, category,
+           * vendor and product are constants, so anything handed to it
+           * comes back out as a plausible Detection Finding row. The gate
+           * is what keeps a stray envelope chunk from being stored as a
+           * severity-Unknown detection nobody can tell from a real one.
+           */
+          if (!GoogleSecOpsAlertNormalizer.isGoogleSecOpsAlert(alert)) {
+            rejectedCount++;
+            continue;
+          }
+
           normalizedAlerts.push(GoogleSecOpsAlertNormalizer.normalize(alert));
         } catch (normalizeError) {
+          failedCount++;
           logger.error("GoogleSecOpsPoller: error normalizing alert");
           logger.error(normalizeError);
         }
       }
 
+      if (rejectedCount > 0) {
+        logger.warn(
+          `GoogleSecOpsPoller: connection ${connectionId} discarded ${rejectedCount} of ${alerts.length} fetched objects that do not look like Google SecOps alerts.`,
+        );
+      }
+
       /*
        * Threat-intel enrichment before row building, same seam as the
        * HTTP ingest path — polled alerts get the same threat.* stamps.
@@ -218,15 +322,43 @@ export default class GoogleSecOpsPoller {
 
       if (rows.length > 0) {
         await SecurityEventService.insertJsonRows(rows);
-        ingested = rows.length;
       }
     }
 
+    const ingested: number = normalizedAlerts.length;
+
+    /*
+     * Nothing storable came out of a window that did contain alerts, and
+     * the reason was a failure rather than a refusal — so the alerts still
+     * exist at Chronicle and the window has to be re-fetched. Advancing
+     * here is what turned a normalizer fault into permanent, silent data
+     * loss: the insert-failure path leaves the cursor alone by throwing,
+     * and this path did not.
+     */
+    const advanceCursor: boolean = ingested > 0 || failedCount === 0;
+
+    if (!advanceCursor) {
+      logger.warn(
+        `GoogleSecOpsPoller: connection ${connectionId} normalized none of its ${alerts.length} fetched alerts; holding the cursor so the window is polled again rather than skipped.`,
+      );
+    }
+
+    const cursorUpdate: { cursor?: string } = advanceCursor
+      ? {
+          /*
+           * Still open (out of scope here): this stores the end of the
+           * window rather than the newest detection timestamp actually
+           * ingested, which is what the column documents itself as.
+           */
+          cursor: endTime.toISOString(),
+        }
+      : {};
+
     await GoogleSecOpsConnectionService.updateOneById({
       id: connection.id,
       data: {
         lastPolledAt: endTime,
-        cursor: endTime.toISOString(),
+        ...cursorUpdate,
         lastError: null as unknown as string,
       },
       props: {
@@ -234,6 +366,10 @@ export default class GoogleSecOpsPoller {
       },
     });
 
+    logger.debug(
+      `GoogleSecOpsPoller: connection ${connectionId} fetched ${alerts.length} alerts and ingested ${ingested} security events for ${startTime.toISOString()} to ${endTime.toISOString()}.`,
+    );
+
     return ingested;
   }
 }

package/Server/Utils/SessionReplay/SessionReplayGateCache.ts

@@ -105,11 +105,18 @@ export interface SessionReplayGatePolicy {
   isAppEnabled: boolean;
 
   /*
-   * Empty means REFUSED, not allow-all. This is the only anti-forgery
-   * control available: a TelemetryIngestionKey has no expiry, no scope and
-   * no origin binding, and the docs tell customers to paste it into
-   * browser JavaScript, so anyone who scrapes the key could otherwise
-   * write recordings into the victim's project.
+   * Empty means ANY ORIGIN, which is the shipped default (the column
+   * defaults to '[]') and what isOriginAllowed below actually implements -
+   * this doc used to claim the opposite ("empty means REFUSED"), in the one
+   * direction where being wrong matters, since a reader would conclude the
+   * feature was locked down out of the box.
+   *
+   * Filling it in is the only anti-forgery control available: a
+   * TelemetryIngestionKey has no expiry, no scope and no origin binding, and
+   * the docs tell customers to paste it into browser JavaScript, so anyone
+   * who scrapes the key can write recordings into the victim's project until
+   * this list names the customer's own domains. The installation-test panel
+   * flags an empty list as a warning for exactly that reason.
    */
   allowedOrigins: Array<string>;
 

package/Server/Utils/SessionReplay/SessionReplayIdentity.ts

@@ -0,0 +1,102 @@
+import crypto from "crypto";
+import { EncryptionSecret } from "../../EnvironmentConfig";
+import ObjectID from "../../../Types/ObjectID";
+import { SESSION_REPLAY_MAX_USER_REF_LENGTH } from "../../../Types/Rum/SessionReplay";
+
+/*
+ * "Whose session is this?"
+ *
+ * A page that has an end-user reference hands it to the recorder
+ * (data-oneuptime-user-ref, or the init global). When the application has
+ * identity capture switched on, the recorder puts that reference on the
+ * chunk envelope's meta, and this module turns it into the two columns the
+ * session header carries:
+ *
+ *   identifiedUserKey    HMAC(EncryptionSecret, "<projectId>:<userRef>")
+ *   identifiedUserLabel  the reference itself, behind its own column ACL
+ *
+ * The key is what makes a reference SEARCHABLE and ERASABLE without storing
+ * it in a lookup-friendly form: a support engineer filtering by user, and a
+ * right-to-erasure request naming one, both resolve to the same digest. The
+ * label is what makes a session READABLE - "jane@example.com" rather than a
+ * 64-character hash - and is why it sits behind a narrower ACL than the rest
+ * of the session metadata.
+ *
+ * Scoped by project and NOT by application, deliberately. A project-wide
+ * erasure request (ProcessSessionErasureRequests filters on projectId with
+ * the application clause optional) has to be able to reach every session for
+ * that person, including ones recorded by sibling applications. An
+ * application-scoped digest would make that request silently under-delete,
+ * which is the failure mode with legal consequences.
+ *
+ * Deliberately NOT reusing SessionReplayTargeting.buildTargetKey: that one
+ * is application-scoped and prefixed for a Redis keyspace. Both are HMACs of
+ * a user reference, and conflating them would tie an erasure lookup to the
+ * shape of a Redis key.
+ */
+
+export interface SessionReplayUserKeyInput {
+  projectId: ObjectID;
+  userRef: string;
+}
+
+export default class SessionReplayIdentity {
+  /*
+   * Usable when non-empty and within the shared cap. The cap matters on both
+   * sides of the comparison: the recorder slices the reference to the same
+   * length before sending it, so anything longer could never match a stored
+   * key anyway, and hashing an unbounded string here would be the only
+   * unbounded work on this path.
+   */
+  public static isUsableUserRef(userRef: unknown): userRef is string {
+    return (
+      typeof userRef === "string" &&
+      userRef.trim().length > 0 &&
+      userRef.length <= SESSION_REPLAY_MAX_USER_REF_LENGTH
+    );
+  }
+
+  /*
+   * The project scope lives in the KEY, not in the message.
+   *
+   * HMAC takes arbitrary key material, so deriving a per-project key from
+   * the instance secret and the project id gives real domain separation:
+   * two projects cannot produce the same digest for the same person even
+   * if one of them learns the other's project id, which prefixing the
+   * message only achieves by convention. It is also what makes the
+   * "per-project" wording on the identity columns literally true.
+   *
+   * The reference is trimmed but NOT lower-cased. End-user references are
+   * opaque to us - "U-1000" and "u-1000" may well be two different
+   * customers in the host application's own database - so folding case here
+   * would merge two people's recordings under one key, and an erasure for
+   * one would delete the other's. Targeting lower-cases the APPLICATION
+   * identifier for the same reason in reverse: that one is ours and is
+   * case-insensitive.
+   *
+   * A slow KDF (bcrypt / scrypt / argon2) is deliberately NOT used and
+   * would not help. This is a keyed pseudonym, not a stored password: it
+   * has to be DETERMINISTIC so the session filter and a right-to-erasure
+   * request months later resolve the same digest, and those algorithms are
+   * salted per invocation. What defends the digest is the key - without
+   * EncryptionSecret an attacker holding the column cannot test candidate
+   * references at all, at any work factor.
+   */
+  public static buildUserKey(data: SessionReplayUserKeyInput): string {
+    const projectKey: string = `${EncryptionSecret.toString()}:${data.projectId.toString()}`;
+
+    return crypto
+      .createHmac("sha256", projectKey)
+      .update(data.userRef.trim())
+      .digest("hex");
+  }
+
+  /*
+   * The label as stored. Trimmed and capped to the same length the recorder
+   * enforces, so the column can never hold something the wire could not have
+   * carried.
+   */
+  public static buildUserLabel(userRef: string): string {
+    return userRef.trim().slice(0, SESSION_REPLAY_MAX_USER_REF_LENGTH);
+  }
+}

package/Server/Utils/SessionReplay/SessionReplayReadService.ts

@@ -1341,13 +1341,22 @@ export default class SessionReplayReadService {
       );
     }
 
-    if (filters.hasFrustration === true) {
+    if (filters.hasFrustration !== undefined) {
       /*
        * Over the argMax aliases, like every HAVING predicate here — the
        * raw columns would sum across ReplacingMergeTree versions.
+       *
+       * `!== undefined` rather than `=== true`, so `false` means "sessions
+       * with NO frustration signals" instead of being silently dropped. The
+       * route admits any boolean, and hasError / isFinalized beside it both
+       * honour false, so accepting the value and ignoring it returned the
+       * whole unfiltered list with a 200 and no indication why.
        */
+      const total: string =
+        "(aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount)";
+
       statement.append(
-        " AND (aggRageClickCount + aggDeadClickCount + aggErrorClickCount + aggRefreshRageCount) > 0",
+        filters.hasFrustration ? ` AND ${total} > 0` : ` AND ${total} = 0`,
       );
     }
 

package/Server/Utils/Workspace/MicrosoftTeams/Actions/Alert.ts

@@ -18,6 +18,8 @@ import AlertStateService from "../../../../Services/AlertStateService";
 import UserNotificationEventType from "../../../../../Types/UserNotification/UserNotificationEventType";
 import OnCallDutyPolicy from "../../../../../Models/DatabaseModels/OnCallDutyPolicy";
 import AlertState from "../../../../../Models/DatabaseModels/AlertState";
+import DatabaseCommonInteractionProps from "../../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import MicrosoftTeamsActionAuthorization from "./Authorization";
 
 export default class MicrosoftTeamsAlertActions {
   @CaptureSpan()
@@ -255,6 +257,7 @@ export default class MicrosoftTeamsAlertActions {
     value: JSONObject;
     projectId: ObjectID;
     oneUptimeUserId: ObjectID;
+    databaseProps: DatabaseCommonInteractionProps;
     turnContext: TurnContext;
   }): Promise<void> {
     const {
@@ -263,6 +266,7 @@ export default class MicrosoftTeamsAlertActions {
       value,
       projectId,
       oneUptimeUserId,
+      databaseProps,
       turnContext,
     } = data;
 
@@ -274,10 +278,15 @@ export default class MicrosoftTeamsAlertActions {
         return;
       }
 
-      await AlertService.acknowledgeAlert(
-        new ObjectID(actionValue),
-        oneUptimeUserId,
-      );
+      const alertId: ObjectID = new ObjectID(actionValue);
+
+      await MicrosoftTeamsActionAuthorization.assertCanUpdateAlert({
+        alertId: alertId,
+        projectId: projectId,
+        props: databaseProps,
+      });
+
+      await AlertService.acknowledgeAlert(alertId, oneUptimeUserId);
       await turnContext.sendActivity("✅ Alert acknowledged.");
       return;
     }
@@ -288,10 +297,15 @@ export default class MicrosoftTeamsAlertActions {
         return;
       }
 
-      await AlertService.resolveAlert(
-        new ObjectID(actionValue),
-        oneUptimeUserId,
-      );
+      const alertId: ObjectID = new ObjectID(actionValue);
+
+      await MicrosoftTeamsActionAuthorization.assertCanUpdateAlert({
+        alertId: alertId,
+        projectId: projectId,
+        props: databaseProps,
+      });
+
+      await AlertService.resolveAlert(alertId, oneUptimeUserId);
       await turnContext.sendActivity("✅ Alert resolved.");
       return;
     }
@@ -506,9 +520,7 @@ export default class MicrosoftTeamsAlertActions {
           data: {
             currentAlertStateId: new ObjectID(alertStateId.toString()),
           },
-          props: {
-            isRoot: true,
-          },
+          props: databaseProps,
         });
 
         await turnContext.sendActivity("✅ Alert state changed successfully.");

package/Server/Utils/Workspace/MicrosoftTeams/Actions/Auth.ts

@@ -1,8 +1,5 @@
-import { ExpressRequest } from "../../../Express";
 import { JSONObject } from "../../../../../Types/JSON";
 import ObjectID from "../../../../../Types/ObjectID";
-import WorkspaceProjectAuthToken from "../../../../../Models/DatabaseModels/WorkspaceProjectAuthToken";
-import WorkspaceProjectAuthTokenService from "../../../../Services/WorkspaceProjectAuthTokenService";
 import WorkspaceType from "../../../../../Types/Workspace/WorkspaceType";
 import logger from "../../../Logger";
 import CaptureSpan from "../../../Telemetry/CaptureSpan";
@@ -30,173 +27,6 @@ export interface MicrosoftTeamsRequest {
 }
 
 export default class MicrosoftTeamsAuthAction {
-  @CaptureSpan()
-  public static async isAuthorized(data: {
-    req: ExpressRequest;
-  }): Promise<MicrosoftTeamsRequest> {
-    const req: ExpressRequest = data.req;
-    let payload: JSONObject = {};
-    let tenantId: string = "";
-
-    try {
-      payload = req.body as JSONObject;
-      logger.debug("Microsoft Teams payload received:");
-      logger.debug(payload);
-    } catch (error) {
-      logger.debug("Failed to parse Microsoft Teams payload:");
-      logger.debug(error);
-      return {
-        isAuthorized: false,
-        projectId: new ObjectID(""),
-        authToken: "",
-        payloadType: "unknown",
-        tenantId: tenantId,
-      };
-    }
-
-    // Microsoft Teams sends different types of activities
-    const activityType: string = payload["type"] as string;
-    const from: JSONObject = payload["from"] as JSONObject;
-    const conversation: JSONObject = payload["conversation"] as JSONObject;
-    const channelData: JSONObject = payload["channelData"] as JSONObject;
-
-    let teamId: string = "";
-    let channelId: string = "";
-    let userId: string = "";
-
-    // Extract team and channel information
-    if (channelData && channelData["team"]) {
-      teamId = (channelData["team"] as JSONObject)["id"] as string;
-    }
-
-    if (conversation && conversation["id"]) {
-      // For channel messages, conversation ID contains channel info
-      channelId = conversation["id"] as string;
-    }
-
-    if (from && from["id"]) {
-      userId = from["id"] as string;
-    }
-
-    if (channelData && channelData["tenant"]) {
-      tenantId = (channelData["tenant"] as JSONObject)["id"] as string;
-    }
-
-    // Handle different activity types
-    if (activityType === "installationUpdate") {
-      // Bot was installed or uninstalled
-      const action: string = payload["action"] as string;
-      if (action === "remove") {
-        return {
-          isAuthorized: true,
-          projectId: new ObjectID(""), // We'll need to find the project
-          authToken: "",
-          payloadType: "app_uninstall",
-          teamId: teamId,
-          tenantId: tenantId,
-        };
-      }
-    }
-
-    // Find the project associated with this team
-    if (!teamId) {
-      logger.debug("No team ID found in payload", {
-        tenantId: tenantId,
-      });
-      return {
-        isAuthorized: false,
-        projectId: new ObjectID(""),
-        authToken: "",
-        payloadType: activityType,
-        tenantId: tenantId,
-      };
-    }
-
-    let projectAuthToken: WorkspaceProjectAuthToken | null = null;
-
-    try {
-      // Find project auth token by checking if miscData contains the teamId
-      projectAuthToken = await WorkspaceProjectAuthTokenService.findOneBy({
-        query: {
-          workspaceType: WorkspaceType.MicrosoftTeams,
-          workspaceProjectId: tenantId,
-        },
-        select: {
-          _id: true,
-          projectId: true,
-          authToken: true,
-          miscData: true,
-        },
-        props: {
-          isRoot: true,
-        },
-      });
-    } catch (error) {
-      logger.debug("Error finding project auth token:", {
-        teamId: teamId,
-        tenantId: tenantId,
-      });
-      logger.debug(error);
-      return {
-        isAuthorized: false,
-        projectId: new ObjectID(""),
-        authToken: "",
-        payloadType: activityType,
-        tenantId: tenantId,
-      };
-    }
-
-    if (!projectAuthToken) {
-      logger.debug(`No project auth token found for team: ${teamId}`, {
-        teamId: teamId,
-        tenantId: tenantId,
-      });
-      return {
-        isAuthorized: false,
-        projectId: new ObjectID(""),
-        authToken: "",
-        payloadType: activityType,
-        tenantId: tenantId,
-      };
-    }
-
-    // Parse actions from the payload
-    const actions: Array<MicrosoftTeamsAction> = [];
-
-    if (activityType === "invoke") {
-      // Handle adaptive card button clicks
-      const value: JSONObject = payload["value"] as JSONObject;
-      if (value && value["action"]) {
-        actions.push({
-          actionType: value["action"] as string,
-          actionValue: value["actionValue"] as string,
-        });
-      }
-    } else if (activityType === "message") {
-      // Handle text messages to the bot
-      const text: string = (payload["text"] as string) || "";
-      if (text.toLowerCase().includes("help")) {
-        actions.push({
-          actionType: "help",
-        });
-      }
-    }
-
-    return {
-      isAuthorized: true,
-      projectId: projectAuthToken.projectId!,
-      authToken: projectAuthToken.authToken!,
-      payloadType: activityType,
-      actions: actions,
-      userId: userId,
-      teamId: teamId,
-      tenantId: tenantId,
-      channelId: channelId,
-      messageId: payload["id"] as string,
-      payload: payload,
-    };
-  }
-
   @CaptureSpan()
   public static async getOneUptimeUserIdFromTeamsUserId(data: {
     teamsUserId: string;