@oneuptime/common 12.0.3 → 12.0.5

package/Models/DatabaseModels/Project.ts

@@ -1592,9 +1592,9 @@ export default class Project extends TenantModel {
     required: true,
     isDefaultValueColumn: true,
     type: TableColumnType.Boolean,
-    title: "Enable Instrumentation Fix Tasks",
+    title: "Enable Incident Instrumentation Fix Tasks",
     description:
-      "When enabled, an AI investigation that ends inconclusive (telemetry was insufficient to determine a root cause) automatically queues an AI agent task that opens a pull request adding the missing instrumentation to the implicated code paths. Requires a repository connected through the GitHub App. Pull requests are always human-reviewed — nothing merges automatically.",
+      "When enabled, an incident AI investigation that ends inconclusive (telemetry was insufficient to determine a root cause) automatically queues an AI agent task that opens a pull request adding the missing instrumentation to the implicated code paths. Requires a repository connected through the GitHub App. Pull requests are always human-reviewed — nothing merges automatically.",
     defaultValue: false,
     example: true,
   })
@@ -1603,7 +1603,7 @@ export default class Project extends TenantModel {
     default: false,
     type: ColumnType.Boolean,
   })
-  public enableInstrumentationFixTasks?: boolean = undefined;
+  public enableIncidentInstrumentationFixTasks?: boolean = undefined;
 
   @ColumnAccessControl({
     create: [],
@@ -1622,9 +1622,9 @@ export default class Project extends TenantModel {
     required: true,
     isDefaultValueColumn: true,
     type: TableColumnType.Boolean,
-    title: "Enable Automatic Code Fixes",
+    title: "Enable Alert Instrumentation Fix Tasks",
     description:
-      "When enabled, an AI investigation that ends with a confident, evidenced root cause analysis automatically queues an AI agent task that opens a draft fix pull request from that analysis — the automatic form of the 'Open Fix PR from this analysis' button. Requires a repository connected through the GitHub App and a Runner with the code-fix capability. Pull requests are always human-reviewed — nothing merges automatically.",
+      "When enabled, an alert AI investigation that ends inconclusive (telemetry was insufficient to determine a root cause) automatically queues an AI agent task that opens a pull request adding the missing instrumentation to the implicated code paths. Requires a repository connected through the GitHub App. Pull requests are always human-reviewed — nothing merges automatically.",
     defaultValue: false,
     example: true,
   })
@@ -1633,7 +1633,67 @@ export default class Project extends TenantModel {
     default: false,
     type: ColumnType.Boolean,
   })
-  public enableAutomaticCodeFixes?: boolean = undefined;
+  public enableAlertInstrumentationFixTasks?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: true,
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Enable Automatic Incident Code Fixes",
+    description:
+      "When enabled, an incident AI investigation that ends with a confident, evidenced root cause analysis and recommends a repository code change automatically queues an AI agent task that opens a draft fix pull request from that analysis — the automatic form of the 'Open Fix PR from this analysis' button. Operational, infrastructure, external, user-error and inconclusive findings do not offer or open code-fix pull requests. Requires a repository connected through the GitHub App and a Runner with the code-fix capability. Pull requests are always human-reviewed — nothing merges automatically.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    nullable: false,
+    default: false,
+    type: ColumnType.Boolean,
+  })
+  public enableAutomaticIncidentCodeFixes?: boolean = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: true,
+    isDefaultValueColumn: true,
+    type: TableColumnType.Boolean,
+    title: "Enable Automatic Alert Code Fixes",
+    description:
+      "When enabled, an alert AI investigation that ends with a confident, evidenced root cause analysis and recommends a repository code change automatically queues an AI agent task that opens a draft fix pull request from that analysis — the automatic form of the 'Open Fix PR from this analysis' button. Operational, infrastructure, external, user-error and inconclusive findings do not offer or open code-fix pull requests. Requires a repository connected through the GitHub App and a Runner with the code-fix capability. Pull requests are always human-reviewed — nothing merges automatically.",
+    defaultValue: false,
+    example: true,
+  })
+  @Column({
+    nullable: false,
+    default: false,
+    type: ColumnType.Boolean,
+  })
+  public enableAutomaticAlertCodeFixes?: boolean = undefined;
 
   @ColumnAccessControl({
     create: [],
@@ -1806,7 +1866,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Number,
     title: "Daily Autonomous AI Token Limit",
     description:
-      "Maximum tokens per UTC day that autonomous AI investigations may consume for this project. When the limit is reached, new autonomous investigations are skipped until the next day — interactive AI chat is never blocked. Unset means no limit.",
+      "Fallback maximum tokens per UTC day for autonomous AI work that is not associated with an incident or alert. When the limit is reached, new autonomous work is skipped until the next day — interactive AI chat is never blocked. Unset means no limit.",
     example: 500000,
   })
   @Column({
@@ -1815,6 +1875,60 @@ export default class Project extends TenantModel {
   })
   public aiDailyAutonomousTokenLimit?: number = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Number,
+    title: "Daily Incident AI Token Limit",
+    description:
+      "Maximum tokens per UTC day that autonomous incident-linked AI work may consume for this project, including investigations, remediation, and follow-up fix tasks. When the limit is reached, new incident-linked AI work is skipped until the next day — interactive AI chat is never blocked. Unset means no limit.",
+    example: 500000,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Number,
+  })
+  public incidentAiDailyAutonomousTokenLimit?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Number,
+    title: "Daily Alert AI Token Limit",
+    description:
+      "Maximum tokens per UTC day that autonomous alert-linked AI work may consume for this project, including investigations, remediation, and follow-up fix tasks. When the limit is reached, new alert-linked AI work is skipped until the next day — interactive AI chat is never blocked. Unset means no limit.",
+    example: 500000,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Number,
+  })
+  public alertAiDailyAutonomousTokenLimit?: number = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [
@@ -1833,7 +1947,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Number,
     title: "Daily AI Fix Task Limit",
     description:
-      "Maximum AI fix tasks (agent runs that open pull requests) that may be created per UTC day for this project, across every fix recipe and trigger. Unset means the default of 25 per day; 0 pauses AI fix tasks entirely.",
+      "Fallback maximum AI fix tasks (agent runs that open pull requests) that may be created per UTC day for work not associated with an incident or alert, across every fix recipe and trigger. Unset means the default of 25 per day; 0 pauses these AI fix tasks entirely.",
     example: 25,
   })
   @Column({
@@ -1842,6 +1956,60 @@ export default class Project extends TenantModel {
   })
   public aiDailyFixTaskLimit?: number = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Number,
+    title: "Daily Incident AI Fix Task Limit",
+    description:
+      "Maximum AI fix tasks derived from incidents that may be created per UTC day for this project. Unset means the default of 25 per day; 0 pauses incident AI fix tasks entirely.",
+    example: 25,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Number,
+  })
+  public incidentAiDailyFixTaskLimit?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Number,
+    title: "Daily Alert AI Fix Task Limit",
+    description:
+      "Maximum AI fix tasks derived from alerts that may be created per UTC day for this project. Unset means the default of 25 per day; 0 pauses alert AI fix tasks entirely.",
+    example: 25,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Number,
+  })
+  public alertAiDailyFixTaskLimit?: number = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [
@@ -1976,7 +2144,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Number,
     title: "Max Concurrent Investigations",
     description:
-      "How many AI investigations may run at the same time for this project, shared across incidents and alerts. Unset means the default of 3. Minimum 1 — pause investigations with the opt-in toggles or a daily token limit of 0 instead.",
+      "Fallback maximum number of non-incident and non-alert AI investigations that may run at the same time for this project. Unset means the default of 3. Minimum 1 — pause autonomous work with its opt-in toggle or a daily token limit of 0 instead.",
     example: 3,
   })
   @Column({
@@ -1985,6 +2153,60 @@ export default class Project extends TenantModel {
   })
   public aiMaxConcurrentInvestigations?: number = undefined;
 
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Number,
+    title: "Max Concurrent Incident Investigations",
+    description:
+      "How many incident AI investigations may run at the same time for this project. Unset means the default of 3. Minimum 1 — pause incident investigations with the opt-in toggle or a daily token limit of 0 instead.",
+    example: 3,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Number,
+  })
+  public incidentAiMaxConcurrentInvestigations?: number = undefined;
+
+  @ColumnAccessControl({
+    create: [],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.ReadProject,
+      Permission.UnAuthorizedSsoUser,
+      Permission.ProjectUser,
+    ],
+    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.Number,
+    title: "Max Concurrent Alert Investigations",
+    description:
+      "How many alert AI investigations may run at the same time for this project. Unset means the default of 3. Minimum 1 — pause alert investigations with the opt-in toggle or a daily token limit of 0 instead.",
+    example: 3,
+  })
+  @Column({
+    nullable: true,
+    type: ColumnType.Number,
+  })
+  public alertAiMaxConcurrentInvestigations?: number = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [
@@ -2583,7 +2805,21 @@ export default class Project extends TenantModel {
   })
   public doNotAddGlobalProbesByDefaultOnNewMonitors?: boolean = undefined;
 
-  // GitHub App Installation ID for this project
+  /*
+   * GitHub App Installation ID for this project.
+   *
+   * This column IS the authority on which GitHub App installation a project
+   * owns — every path that mints a repository token re-derives the binding
+   * from it (see GitHubInstallationBinding). That makes it security state, not
+   * project configuration, so `update` is empty: a Project Owner who could PUT
+   * an arbitrary installation ID here would simply be writing their own
+   * permission slip to another tenant's repositories.
+   *
+   * It is written server-side only, with `isRoot`, by the GitHub App install
+   * callback — and only after the OAuth user-to-server round trip has proved
+   * to GitHub's satisfaction that the installer controls that installation —
+   * and cleared again by the `installation.deleted` webhook.
+   */
   @ColumnAccessControl({
     create: [],
     read: [
@@ -2593,7 +2829,7 @@ export default class Project extends TenantModel {
       Permission.Viewer,
       Permission.ReadProject,
     ],
-    update: [Permission.ProjectOwner, Permission.ProjectAdmin],
+    update: [],
   })
   @TableColumn({
     required: false,

package/Models/DatabaseModels/ProxmoxCluster.ts

@@ -81,6 +81,20 @@ import {
  */
 @Index(["projectId", "name"], { unique: true })
 @Index(["projectId", "isArchived"])
+/*
+ * Restores a UNIQUE index that an autogenerated migration deleted.
+ *
+ * Declared natively and NAMED. TypeORM's schema builder matches database
+ * indexes to entity metadata by name and drops every one it cannot find, which
+ * is how the original was lost: it existed only in a migration, so entity
+ * metadata never mentioned it and `migration:generate` emitted a DROP. Naming
+ * it here keeps the original index name and lets the builder match, compare
+ * uniqueness and columns, and keep it.
+ */
+@Index("IDX_proxmox_cluster_slug", ["slug"], {
+  unique: true,
+  where: '"deletedAt" IS NULL',
+})
 @TableMetadata({
   tableName: "ProxmoxCluster",
   singularName: "Proxmox Cluster",

package/Models/DatabaseModels/ScheduledMaintenance.ts

@@ -1426,6 +1426,7 @@ export default class ScheduledMaintenance extends BaseModel {
     ],
   })
   @TableColumn({
+    computed: true,
     type: TableColumnType.VeryLongText,
     title: "Notification Status Message On Event Scheduled",
     description:

package/Models/DatabaseModels/ScheduledMaintenancePublicNote.ts

@@ -544,6 +544,7 @@ export default class ScheduledMaintenancePublicNote extends BaseModel {
     ],
   })
   @TableColumn({
+    computed: true,
     type: TableColumnType.VeryLongText,
     title: "Notification Status Message",
     description:

package/Models/DatabaseModels/ScheduledMaintenanceStateTimeline.ts

@@ -541,6 +541,7 @@ export default class ScheduledMaintenanceStateTimeline extends BaseModel {
     ],
   })
   @TableColumn({
+    computed: true,
     type: TableColumnType.VeryLongText,
     title: "Notification Status Message",
     description:

package/Models/DatabaseModels/ScheduledMaintenanceTemplateOwnerUser.ts

@@ -239,7 +239,7 @@ export default class ScheduledMaintenanceTemplateOwnerUser extends BaseModel {
       Permission.ProjectMember,
       Permission.ScheduledMaintenanceAdmin,
       Permission.ScheduledMaintenanceMember,
-      Permission.CreateScheduledMaintenanceTemplateOwnerTeam,
+      Permission.CreateScheduledMaintenanceTemplateOwnerUser,
     ],
     read: [
       Permission.ProjectOwner,
@@ -249,7 +249,7 @@ export default class ScheduledMaintenanceTemplateOwnerUser extends BaseModel {
       Permission.ScheduledMaintenanceAdmin,
       Permission.ScheduledMaintenanceMember,
       Permission.ScheduledMaintenanceViewer,
-      Permission.ReadScheduledMaintenanceTemplateOwnerTeam,
+      Permission.ReadScheduledMaintenanceTemplateOwnerUser,
     ],
     update: [],
   })
@@ -283,7 +283,7 @@ export default class ScheduledMaintenanceTemplateOwnerUser extends BaseModel {
       Permission.ProjectMember,
       Permission.ScheduledMaintenanceAdmin,
       Permission.ScheduledMaintenanceMember,
-      Permission.CreateScheduledMaintenanceTemplateOwnerTeam,
+      Permission.CreateScheduledMaintenanceTemplateOwnerUser,
     ],
     read: [
       Permission.ProjectOwner,
@@ -293,7 +293,7 @@ export default class ScheduledMaintenanceTemplateOwnerUser extends BaseModel {
       Permission.ScheduledMaintenanceAdmin,
       Permission.ScheduledMaintenanceMember,
       Permission.ScheduledMaintenanceViewer,
-      Permission.ReadScheduledMaintenanceTemplateOwnerTeam,
+      Permission.ReadScheduledMaintenanceTemplateOwnerUser,
     ],
     update: [],
   })

package/Models/DatabaseModels/Service.ts

@@ -26,6 +26,7 @@ import Permission from "../../Types/Permission";
 import TechStack from "../../Types/Service/TechStack";
 import MetricDownsamplingRetentionDays from "../../Types/Metrics/MetricDownsamplingRetentionDays";
 import TelemetryRetentionConfig from "../../Types/Telemetry/TelemetryRetentionConfig";
+import UNSYNCHRONIZED_INDEX from "../../Types/Database/UnsynchronizedIndex";
 import {
   Column,
   Entity,
@@ -101,6 +102,35 @@ import {
  */
 @Index(["projectId", "name"], { unique: true })
 @Index(["projectId", "isArchived"])
+/*
+ * Serves the hottest read on the telemetry ingest path: OTLP resource
+ * resolution looks a service up by `service.name` case-insensitively, so
+ * `QueryHelper.findWithSameText` emits `LOWER("Service"."name") = $2`. The
+ * unique index above is over the RAW name column and cannot satisfy that
+ * predicate — Postgres can only use its `projectId` prefix as an index qual and
+ * must then heap-fetch and filter every service in the project. The real
+ * definition is an EXPRESSION index and lives in migration
+ * 1786100000000-RestoreServiceLowerNameIndex; `@Index()` cannot express
+ * `LOWER(...)`.
+ *
+ * `synchronize: false` is the load-bearing part of this declaration, and it is
+ * why the index is declared here at all rather than only in the migration.
+ * TypeORM's schema builder matches database indexes to entity metadata BY NAME
+ * and drops every one it cannot find (RdbmsSchemaBuilder.dropOldIndices). An
+ * index created only in a migration is therefore invisible to it and gets
+ * emitted as a DROP by the next autogenerated migration. That is not
+ * hypothetical: this exact index existed once, as
+ * IDX_SERVICE_PROJECT_NAME_UNIQUE in migration 1774559064921, and migration
+ * 1775735059360 dropped it as collateral damage — its down() even "restores"
+ * it without the LOWER(), so the round-trip silently loses the expression.
+ * Naming it here with synchronize:false makes the builder skip it in both
+ * directions: it will never drop it, and it will never try to create it.
+ */
+@Index(
+  "IDX_SERVICE_PROJECT_LOWER_NAME",
+  ["projectId", "name"],
+  UNSYNCHRONIZED_INDEX,
+)
 @TableMetadata({
   tableName: "Service",
   singularName: "Service",

package/Models/DatabaseModels/StatusPage.ts

@@ -1183,6 +1183,7 @@ export default class StatusPage extends BaseModel {
     description:
       "Password required to unlock a private status page. This value is stored as a secure hash.",
     hashed: true,
+    hashSaltColumn: "masterPasswordSalt",
     type: TableColumnType.HashedString,
     placeholder: "Enter a new master password",
   })
@@ -1194,6 +1195,33 @@ export default class StatusPage extends BaseModel {
   })
   public masterPassword?: HashedString = undefined;
 
+  /*
+   * Per-status-page salt mixed into `masterPassword`. Written by the database
+   * write path on every master-password write and never exposed to API
+   * callers. Nullable so existing unsalted hashes can be verified and
+   * upgraded after a successful unlock.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    title: "Master Password Salt",
+    description:
+      "Per-status-page random salt mixed into this status page's master password hash.",
+    computed: true,
+    type: TableColumnType.ShortText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public masterPasswordSalt?: string = undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/StatusPageAnnouncement.ts

@@ -713,6 +713,7 @@ export default class StatusPageAnnouncement extends BaseModel {
     ],
   })
   @TableColumn({
+    computed: true,
     type: TableColumnType.VeryLongText,
     title: "Notification Status Message",
     description:

package/Models/DatabaseModels/StatusPagePrivateUser.ts

@@ -319,6 +319,7 @@ export default class StatusPagePrivateUser extends BaseModel {
   @TableColumn({
     title: "Password",
     hashed: true,
+    hashSaltColumn: "passwordSalt",
     type: TableColumnType.HashedString,
   })
   @Column({
@@ -330,6 +331,35 @@ export default class StatusPagePrivateUser extends BaseModel {
   })
   public password?: HashedString = undefined;
 
+  /*
+   * Per-user salt mixed into `password`'s hash. Written by the database
+   * write path on every password write — never by an API caller, hence the
+   * empty access control and `computed: true`.
+   *
+   * Nullable on purpose: rows that predate per-user salts have none, and are
+   * verified against the legacy unsalted scheme until the next successful
+   * login re-hashes them with a fresh salt.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    title: "Password Salt",
+    description: "Per-user random salt mixed into this user's password hash.",
+    computed: true,
+    type: TableColumnType.ShortText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public passwordSalt?: string = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [],

package/Models/DatabaseModels/User.ts

@@ -140,6 +140,7 @@ class User extends UserModel {
   @TableColumn({
     title: "Password",
     hashed: true,
+    hashSaltColumn: "passwordSalt",
     type: TableColumnType.HashedString,
   })
   @Column({
@@ -151,6 +152,35 @@ class User extends UserModel {
   })
   public password?: HashedString = undefined;
 
+  /*
+   * Per-user salt mixed into `password`'s hash. Written by the database
+   * write path on every password write — never by an API caller, hence the
+   * empty access control and `computed: true`.
+   *
+   * Nullable on purpose: rows that predate per-user salts have none, and are
+   * verified against the legacy unsalted scheme until the next successful
+   * login re-hashes them with a fresh salt.
+   */
+  @ColumnAccessControl({
+    create: [],
+    read: [],
+    update: [],
+  })
+  @TableColumn({
+    title: "Password Salt",
+    description: "Per-user random salt mixed into this user's password hash.",
+    computed: true,
+    type: TableColumnType.ShortText,
+    hideColumnInDocumentation: true,
+  })
+  @Column({
+    type: ColumnType.ShortText,
+    length: ColumnLength.ShortText,
+    unique: false,
+    nullable: true,
+  })
+  public passwordSalt?: string = undefined;
+
   @ColumnAccessControl({
     create: [],
     read: [Permission.CurrentUser],