@oneuptime/common 12.0.28 → 12.0.29

package/Models/DatabaseModels/DashboardDomain.ts

@@ -754,4 +754,47 @@ export default class DashboardDomain extends BaseModel {
     default: false,
   })
   public isCustomCertificate?: boolean = undefined;
+
+  /*
+   * When a reissue of this domain's Let's Encrypt certificate was last
+   * REQUESTED from the dashboard - not when one last succeeded.
+   *
+   * This is the whole state behind the reissue cooldown. Certificates come
+   * from a Let's Encrypt account shared by every customer on the
+   * installation, and a failed order still spends a validation attempt
+   * against that account, so the stamp is written before the order is
+   * attempted and is left in place whether the order succeeds or fails.
+   *
+   * Null means this domain has never had a reissue requested; automated
+   * renewal never writes here, so the cron keeping a certificate fresh can
+   * never be the reason a customer's button is refused.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.SettingsAdmin,
+      Permission.SettingsMember,
+      Permission.SettingsViewer,
+      Permission.ReadDashboardDomain,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    computed: true,
+    type: TableColumnType.Date,
+    title: "Certificate Reissue Requested At",
+    description:
+      "When a reissue of the SSL certificate for this domain was last requested. Used to rate limit how often a certificate can be reissued.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+    unique: false,
+  })
+  public certificateReissueRequestedAt?: Date = undefined;
 }

package/Models/DatabaseModels/MonitorTemplate.ts

@@ -313,15 +313,27 @@ export default class MonitorTemplate extends BaseModel {
       Permission.EditMonitorTemplate,
     ],
   })
+  /*
+   * OPTIONAL, and the reason it is optional is the whole of issue #3486.
+   *
+   * A Network Device auto-import rule names every monitor it provisions
+   * "<device> - <this>". While this column was required, an operator who only
+   * wanted the device's own name had nothing to type that would not become a
+   * suffix on every imported router in the estate. Left blank, the monitor is
+   * named after the resource alone.
+   *
+   * Nullable rather than defaulted: a default would put the same invented
+   * suffix back on every template that never asked for one.
+   */
   @TableColumn({
-    required: true,
+    required: false,
     type: TableColumnType.ShortText,
     title: "Monitor Name",
     description:
-      "Default name applied to monitors created from this template. Users can override on creation.",
+      "Default name applied to monitors created from this template. Users can override on creation. Leave it blank to name each monitor after the resource it watches.",
   })
   @Column({
-    nullable: false,
+    nullable: true,
     type: ColumnType.ShortText,
     length: ColumnLength.ShortText,
   })

package/Models/DatabaseModels/StatusPageDomain.ts

@@ -761,4 +761,47 @@ export default class StatusPageDomain extends BaseModel {
     default: false, // default is false
   })
   public isCustomCertificate?: boolean = undefined;
+
+  /*
+   * When a reissue of this domain's Let's Encrypt certificate was last
+   * REQUESTED from the dashboard - not when one last succeeded.
+   *
+   * This is the whole state behind the reissue cooldown. Certificates come
+   * from a Let's Encrypt account shared by every customer on the
+   * installation, and a failed order still spends a validation attempt
+   * against that account, so the stamp is written before the order is
+   * attempted and is left in place whether the order succeeds or fails.
+   *
+   * Null means this domain has never had a reissue requested; automated
+   * renewal never writes here, so the cron keeping a certificate fresh can
+   * never be the reason a customer's button is refused.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.StatusPageAdmin,
+      Permission.StatusPageMember,
+      Permission.StatusPageViewer,
+      Permission.ReadStatusPageDomain,
+    ],
+    update: [],
+  })
+  @TableColumn({
+    required: false,
+    computed: true,
+    type: TableColumnType.Date,
+    title: "Certificate Reissue Requested At",
+    description:
+      "When a reissue of the SSL certificate for this domain was last requested. Used to rate limit how often a certificate can be reissued.",
+  })
+  @Column({
+    type: ColumnType.Date,
+    nullable: true,
+    unique: false,
+  })
+  public certificateReissueRequestedAt?: Date = undefined;
 }

package/Server/API/DashboardDomainAPI.ts

@@ -238,5 +238,79 @@ export default class DashboardDomainAPI extends BaseAPI<
         }
       },
     );
+
+    /*
+     * Reissue SSL API. Backs the "Reissue SSL Certificate" button in the
+     * dashboard, for a customer who wants a fresh certificate now rather than
+     * whenever the renewal cron next gets to this domain.
+     *
+     * The throttle that keeps this from becoming a way to spend the shared
+     * Let's Encrypt allowance lives in the service, alongside the write that
+     * claims it - a check here would be a check the automated callers do not
+     * share, and one an extra caller could forget.
+     */
+    this.router.get(
+      `${new this.entityType().getCrudApiPath()?.toString()}/reissue-ssl/:id`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          if (!DashboardCNameRecord) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                `Custom Domains not enabled for this
+                                OneUptime installation. Please contact
+                                your server admin to enable this
+                                feature.`,
+              ),
+            );
+          }
+
+          const databaseProps: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          const id: ObjectID = new ObjectID(req.params["id"] as string);
+
+          /*
+           * Scoped by the caller's own props, so a domain in someone else's
+           * project is indistinguishable from one that does not exist.
+           */
+          const domainCount: PositiveNumber =
+            await DashboardDomainService.countBy({
+              query: {
+                _id: id.toString(),
+              },
+              props: databaseProps,
+            });
+
+          if (domainCount.toNumber() === 0) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "The domain does not exist or user does not have access to it.",
+              ),
+            );
+          }
+
+          logger.debug(
+            "Reissuing SSL",
+            getLogAttributesFromRequest(req as OneUptimeRequest),
+          );
+
+          await DashboardDomainService.reissueCert(id);
+
+          logger.debug(
+            "SSL reissued for domain id - " + id.toString(),
+            getLogAttributesFromRequest(req as OneUptimeRequest),
+          );
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (e) {
+          next(e);
+        }
+      },
+    );
   }
 }

package/Server/API/MicrosoftTeamsAPI.ts

@@ -32,14 +32,6 @@ import ObjectID from "../../Types/ObjectID";
 import WorkspaceUserAuthTokenService from "../Services/WorkspaceUserAuthTokenService";
 import WorkspaceUserAuthToken from "../../Models/DatabaseModels/WorkspaceUserAuthToken";
 import WorkspaceType from "../../Types/Workspace/WorkspaceType";
-import MicrosoftTeamsAuthAction, {
-  MicrosoftTeamsRequest,
-} from "../Utils/Workspace/MicrosoftTeams/Actions/Auth";
-import MicrosoftTeamsIncidentActions from "../Utils/Workspace/MicrosoftTeams/Actions/Incident";
-import MicrosoftTeamsAlertActions from "../Utils/Workspace/MicrosoftTeams/Actions/Alert";
-import MicrosoftTeamsScheduledMaintenanceActions from "../Utils/Workspace/MicrosoftTeams/Actions/ScheduledMaintenance";
-import MicrosoftTeamsMonitorActions from "../Utils/Workspace/MicrosoftTeams/Actions/Monitor";
-import MicrosoftTeamsOnCallDutyActions from "../Utils/Workspace/MicrosoftTeams/Actions/OnCallDutyPolicy";
 import MicrosoftTeamsUtil from "../Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
 import archiver, { Archiver } from "archiver";
 import LocalFile from "../Utils/LocalFile";
@@ -927,63 +919,78 @@ export default class MicrosoftTeamsAPI {
       },
     );
 
-    // Microsoft Teams webhook endpoint for interactive messages (legacy)
-    router.post(
-      "/microsoft-teams/webhook",
-      async (req: ExpressRequest, res: ExpressResponse) => {
-        logger.debug(
-          "Microsoft Teams Webhook Request: ",
-          getLogAttributesFromRequest(req as any),
-        );
-        logger.debug(req.body, getLogAttributesFromRequest(req as any));
-
-        try {
-          const authResult: MicrosoftTeamsRequest =
-            await MicrosoftTeamsAuthAction.isAuthorized({
-              req: req,
-            });
-
-          logger.debug(
-            "Microsoft Teams Auth Result: ",
-            getLogAttributesFromRequest(req as any),
-          );
-          logger.debug(authResult, getLogAttributesFromRequest(req as any));
-
-          if (authResult.isAuthorized === false) {
-            return Response.sendTextResponse(req, res, "");
-          }
-
-          // Handle different types of Teams activities
-          const activity: JSONObject = req.body as JSONObject;
-          const activityType: string = activity["type"] as string;
-
-          if (activityType === "message") {
-            // Handle bot mentions or direct messages
-            return MicrosoftTeamsAPI.handleMessageActivity(
-              req,
-              res,
-              authResult,
-              activity,
-            );
-          } else if (activityType === "invoke") {
-            // Handle adaptive card actions
-            return MicrosoftTeamsAPI.handleInvokeActivity(
-              req,
-              res,
-              authResult,
-              activity,
-            );
-          }
-
-          return Response.sendTextResponse(req, res, "");
-        } catch (error) {
-          logger.error(
-            "Error processing Teams webhook:",
-            getLogAttributesFromRequest(req as any),
-          );
-          logger.error(error, getLogAttributesFromRequest(req as any));
-          return Response.sendTextResponse(req, res, "");
-        }
+    /*
+     * The same path, answering the browser.
+     *
+     * Azure Bot Service only ever POSTs here, so for a long time GET fell
+     * through to the catch-all 404 in StartServer and answered
+     * "Page not found - /api/microsoft-bot/messages". That is the single
+     * cheapest thing an admin can do to check their messaging endpoint, and
+     * OneUptime replied with the words for "this route does not exist" — so
+     * admins concluded the route had been dropped from the build and went
+     * looking for a regression, while the actual fault (Azure cannot reach
+     * this deployment) sat untouched. The 404 was true of the method and false
+     * of the endpoint, and nothing in the response said which.
+     *
+     * 405 is the honest answer, and it is honest in a way a human reads at a
+     * glance: the route is here, the deployment is reachable from wherever the
+     * request came from, and POST is what it wants. Everything else in the
+     * body exists to redirect the next hour of debugging away from OneUptime's
+     * routing table and towards the network path Azure has to traverse.
+     */
+    router.get(
+      "/microsoft-bot/messages",
+      (_req: ExpressRequest, res: ExpressResponse) => {
+        res.setHeader("Allow", "POST");
+
+        /*
+         * Written straight onto the response rather than through
+         * Response.sendJsonObjectResponse, whose ?output-type=csv branch
+         * answers 200 regardless of the status code it was handed. The status
+         * code is the entire point of this route — it is what distinguishes
+         * "wrong method" from "no such route" — so no query parameter gets to
+         * rewrite it.
+         */
+        res.status(405).json({
+          status:
+            "This is the OneUptime Microsoft Teams bot messaging endpoint. It exists, and it accepts POST only.",
+          allow: ["POST"],
+          messagingEndpoint: `${AppApiClientUrl.toString()}/microsoft-bot/messages`,
+          /*
+           * Stated as a fact about this response rather than as advice,
+           * because it is the one thing the admin has actually proven by
+           * getting here and it is easy to under-read.
+           */
+          whatThisProves:
+            "You reached OneUptime. This endpoint is registered and this deployment served your request, so the messaging endpoint is not missing.",
+          whatThisDoesNotProve:
+            "That Azure Bot Service can reach this URL. Azure calls it from the public internet, and your browser or terminal may not be on the same path.",
+          /*
+           * A 404 on this path does NOT mean the request failed to arrive, and
+           * saying so would repeat the mistake this endpoint exists to end.
+           * OneUptime's own catch-all (StartServer's app.get("*")) answers an
+           * unmatched GET with a 404 whose body is
+           * {"message":"Page not found - <path>"} — 58 bytes for this path,
+           * which is exactly the `404 58` an admin sees in their access log.
+           * That 404 is proof the request arrived, not proof it did not. Only
+           * the body separates it from a proxy's own 404, so point at the body.
+           */
+          ifYouGetA404InsteadOfThis:
+            'Read the body, not just the status code. A body of {"message":"Page not found - /api/microsoft-bot/messages"} comes from OneUptime itself, which means the request DID arrive: either this deployment predates this 405 response (the path was POST-only, so a GET fell through to the generic not-found handler), or something in front of OneUptime rewrote the path and stripped the /api prefix before the app saw it. An HTML error page from nginx, your ingress or a load balancer means the opposite — the request never reached OneUptime.',
+          /*
+           * Ordered by what actually goes wrong on self-hosted deployments.
+           * Outbound-works-inbound-fails leads because it is the state that
+           * makes people doubt the route: alerts arrive in Teams, so the
+           * integration looks live, and only the interactive half is dead.
+           */
+          ifTeamsSaysUnableToReachApp: [
+            "Working outbound alerts prove nothing here. OneUptime posts cards by calling Microsoft, which needs no inbound access. Card buttons, bot commands and chat registration all travel the other way — Azure Bot Service POSTs to this URL — and that is the direction that is failing.",
+            "Confirm this exact URL is set as the messaging endpoint on the Azure Bot resource, then check that it resolves publicly. A private DNS name or an internal-only ingress is the most common cause.",
+            "Azure requires HTTPS with a publicly trusted certificate served with its full chain. A self-signed certificate, an internal CA, or a missing intermediate fails the TLS handshake before OneUptime ever sees the request, so nothing appears in your access log.",
+            "Then look for the POST, not the 404, in your access log: `grep 'POST /api/microsoft-bot/messages' <access log>`. No POST lines at all means Azure never got through, and the fault is the network path rather than OneUptime.",
+          ],
+          nextStep: `GET ${AppApiClientUrl.toString()}/microsoft-bot/test to see this deployment's bot id, and compare it with the bot id of the OneUptime app package installed in Microsoft Teams.`,
+        });
       },
     );
 
@@ -1031,6 +1038,15 @@ export default class MicrosoftTeamsAPI {
           notVerified: [
             "That an Azure Bot resource exists for this client id",
             "That the Azure Bot's messaging endpoint points at this deployment",
+            /*
+             * Reachability is listed separately from the endpoint being
+             * configured, because they fail separately and look identical from
+             * in here. A correctly configured endpoint on a deployment Azure
+             * cannot dial produces working outbound alerts and a completely
+             * dead bot, which reads as a half-broken integration rather than a
+             * network problem.
+             */
+            "That Azure Bot Service can actually reach this deployment over the public internet — outbound notifications work without it, so a working alert does not test this",
             "That the Azure Bot has the Microsoft Teams channel enabled",
             "That the client secret is valid and has not expired",
             "That the Teams app package installed in your teams was built from this deployment",
@@ -1238,119 +1254,4 @@ export default class MicrosoftTeamsAPI {
 
     return router;
   }
-
-  private static async handleMessageActivity(
-    _req: ExpressRequest,
-    res: ExpressResponse,
-    authResult: MicrosoftTeamsRequest,
-    activity: JSONObject,
-  ): Promise<void> {
-    // Handle direct messages to bot or @mentions
-    const messageText: string = (activity["text"] as string) || "";
-    const from: JSONObject = activity["from"] as JSONObject;
-
-    if (messageText.toLowerCase().includes("help")) {
-      // Send help message
-      const helpMessage: any = {
-        _type: "WorkspacePayloadText",
-        text: "Hello! I'm the OneUptime bot. I can help you:\n\n• Get notifications about incidents\n• Acknowledge alerts\n• View system status\n\nType 'status' to see current system status.",
-      };
-
-      await MicrosoftTeamsUtil.sendDirectMessageToUser({
-        authToken: authResult.authToken,
-        workspaceUserId: from["id"] as string,
-        messageBlocks: [helpMessage],
-      });
-    }
-
-    Response.sendTextResponse(_req, res, "");
-  }
-
-  private static async handleInvokeActivity(
-    req: ExpressRequest,
-    res: ExpressResponse,
-    authResult: MicrosoftTeamsRequest,
-    _activity: JSONObject,
-  ): Promise<void> {
-    /*
-     * Handle adaptive card button clicks
-     * const value: JSONObject = activity["value"] as JSONObject;
-     * const actionType: string = value["action"] as string;
-     */
-
-    for (const action of authResult.actions || []) {
-      if (!action.actionType) {
-        continue;
-      }
-
-      if (
-        MicrosoftTeamsIncidentActions.isIncidentAction({
-          actionType: action.actionType,
-        })
-      ) {
-        return MicrosoftTeamsIncidentActions.handleIncidentAction({
-          teamsRequest: authResult,
-          action: action,
-          req: req,
-          res: res,
-        });
-      }
-
-      if (
-        MicrosoftTeamsAlertActions.isAlertAction({
-          actionType: action.actionType,
-        })
-      ) {
-        return MicrosoftTeamsAlertActions.handleAlertAction({
-          teamsRequest: authResult,
-          action: action,
-          req: req,
-          res: res,
-        });
-      }
-
-      if (
-        MicrosoftTeamsScheduledMaintenanceActions.isScheduledMaintenanceAction({
-          actionType: action.actionType,
-        })
-      ) {
-        return MicrosoftTeamsScheduledMaintenanceActions.handleScheduledMaintenanceAction(
-          {
-            teamsRequest: authResult,
-            action: action,
-            req: req,
-            res: res,
-          },
-        );
-      }
-
-      if (
-        MicrosoftTeamsMonitorActions.isMonitorAction({
-          actionType: action.actionType,
-        })
-      ) {
-        return MicrosoftTeamsMonitorActions.handleMonitorAction({
-          teamsRequest: authResult,
-          action: action,
-          req: req,
-          res: res,
-        });
-      }
-
-      if (
-        MicrosoftTeamsOnCallDutyActions.isOnCallDutyAction({
-          actionType: action.actionType,
-        })
-      ) {
-        return MicrosoftTeamsOnCallDutyActions.handleOnCallDutyAction({
-          teamsRequest: authResult,
-          action: action,
-          req: req,
-          res: res,
-        });
-      }
-    }
-
-    Response.sendTextResponse(req, res, "");
-  }
 }

package/Server/API/StatusPageDomainAPI.ts

@@ -239,5 +239,79 @@ export default class StatusPageDomainAPI extends BaseAPI<
         }
       },
     );
+
+    /*
+     * Reissue SSL API. Backs the "Reissue SSL Certificate" button in the
+     * dashboard, for a customer who wants a fresh certificate now rather than
+     * whenever the renewal cron next gets to this domain.
+     *
+     * The throttle that keeps this from becoming a way to spend the shared
+     * Let's Encrypt allowance lives in the service, alongside the write that
+     * claims it - a check here would be a check the automated callers do not
+     * share, and one an extra caller could forget.
+     */
+    this.router.get(
+      `${new this.entityType().getCrudApiPath()?.toString()}/reissue-ssl/:id`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          if (!StatusPageCNameRecord) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                `Custom Domains not enabled for this
+                                OneUptime installation. Please contact
+                                your server admin to enable this
+                                feature.`,
+              ),
+            );
+          }
+
+          const databaseProps: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          const id: ObjectID = new ObjectID(req.params["id"] as string);
+
+          /*
+           * Scoped by the caller's own props, so a domain in someone else's
+           * project is indistinguishable from one that does not exist.
+           */
+          const domainCount: PositiveNumber =
+            await StatusPageDomainService.countBy({
+              query: {
+                _id: id.toString(),
+              },
+              props: databaseProps,
+            });
+
+          if (domainCount.toNumber() === 0) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "The domain does not exist or user does not have access to it.",
+              ),
+            );
+          }
+
+          logger.debug(
+            "Reissuing SSL",
+            getLogAttributesFromRequest(req as any),
+          );
+
+          await StatusPageDomainService.reissueCert(id);
+
+          logger.debug(
+            "SSL reissued for domain id - " + id.toString(),
+            getLogAttributesFromRequest(req as any),
+          );
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (e) {
+          next(e);
+        }
+      },
+    );
   }
 }

package/Server/Infrastructure/Postgres/SchemaMigrations/1790200000000-AllowNullMonitorNameOnMonitorTemplate.ts

@@ -0,0 +1,43 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * "Default Monitor Name" on a Monitor Template becomes optional (issue #3486).
+ *
+ * A Network Device auto-import rule names every monitor it provisions
+ * "<device> - <template's default monitor name>". While the column was NOT
+ * NULL there was nothing an operator could type that would not become a
+ * suffix on every imported device in the estate — "UN0660WANRTR01 - Unit
+ * Router" for a router whose name is already UN0660WANRTR01. Blank now means
+ * the monitor is named after the device alone.
+ *
+ * Nullable with no default and no backfill: every template that already
+ * exists keeps the name it was created with, so nothing about an existing
+ * project's monitor naming changes when this ships.
+ */
+export class AllowNullMonitorNameOnMonitorTemplate1790200000000
+  implements MigrationInterface
+{
+  public name: string = "AllowNullMonitorNameOnMonitorTemplate1790200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "MonitorTemplate" ALTER COLUMN "monitorName" DROP NOT NULL`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Templates written while the column was nullable have no name, and
+     * restoring NOT NULL would fail on every one of them. "Monitor" is the
+     * exact string the pre-#3486 code substituted when a template's name was
+     * blank, so it is the one value that reconstructs the old behaviour
+     * rather than inventing a new one.
+     */
+    await queryRunner.query(
+      `UPDATE "MonitorTemplate" SET "monitorName" = 'Monitor' WHERE "monitorName" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorTemplate" ALTER COLUMN "monitorName" SET NOT NULL`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790300000000-AddCertificateReissueRequestedAtToDomains.ts

@@ -0,0 +1,40 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * When a customer last asked us to reissue the Let's Encrypt certificate for a
+ * custom domain, on both the status page and the dashboard domain tables.
+ *
+ * This is the state behind the reissue cooldown: certificates are ordered
+ * against a Let's Encrypt account shared by every customer on the
+ * installation, so the dashboard button that spends that account's allowance
+ * is throttled per domain, and this column is what the throttle reads.
+ *
+ * Nullable with no default and no backfill. Null means "never reissued", which
+ * is exactly true of every domain that exists when this ships, and it is the
+ * value that lets the first press of the button through rather than making
+ * every existing customer wait out a cooldown they never triggered.
+ */
+export class AddCertificateReissueRequestedAtToDomains1790300000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddCertificateReissueRequestedAtToDomains1790300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageDomain" ADD "certificateReissueRequestedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DashboardDomain" ADD "certificateReissueRequestedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DashboardDomain" DROP COLUMN "certificateReissueRequestedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageDomain" DROP COLUMN "certificateReissueRequestedAt"`,
+    );
+  }
+}