@oneuptime/common 12.0.32 → 12.0.34

package/Server/API/UserNotificationSettingAPI.ts

@@ -0,0 +1,55 @@
+import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import RoutineEmailSettingsService from "../Services/RoutineEmailSettingsService";
+import UserNotificationSettingService, {
+  Service as UserNotificationSettingServiceType,
+} from "../Services/UserNotificationSettingService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import UserNotificationSetting from "../../Models/DatabaseModels/UserNotificationSetting";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { ROUTINE_EMAIL_EVENT_TYPES } from "../../Types/NotificationSetting/RoutineEmailEvents";
+import ObjectID from "../../Types/ObjectID";
+
+export default class UserNotificationSettingAPI extends BaseAPI<
+  UserNotificationSetting,
+  UserNotificationSettingServiceType
+> {
+  public constructor() {
+    super(UserNotificationSetting, UserNotificationSettingService);
+
+    this.router.post(
+      "/user-notification-setting/reduce-routine-emails",
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+
+          /*
+           * The model grants CurrentUser access. A member may change their own
+           * settings, regardless of role, and may never select another user.
+           */
+          await RoutineEmailSettingsService.reduceRoutineEmails({
+            userId: props.userId!,
+            projectId: projectId,
+          });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            success: true,
+            routineEventTypeCount: ROUTINE_EMAIL_EVENT_TYPES.length,
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+}

package/Server/API/UserTelegramAPI.ts

@@ -1,4 +1,7 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import GlobalConfigService from "../Services/GlobalConfigService";
 import UserTelegramService, {
   Service as UserTelegramServiceType,
@@ -26,6 +29,7 @@ export default class UserTelegramAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verification-info`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -46,7 +50,6 @@ export default class UserTelegramAPI extends BaseAPI<
             select: {
               userId: true,
               projectId: true,
-              verificationCode: true,
               isVerified: true,
             },
           });
@@ -70,6 +73,21 @@ export default class UserTelegramAPI extends BaseAPI<
             );
           }
 
+          if (
+            !item.projectId ||
+            !item.userId ||
+            !(await this.service.hasActiveProjectMembership({
+              projectId: item.projectId,
+              userId: item.userId,
+            }))
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("Item not found"),
+            );
+          }
+
           const globalConfig: GlobalConfig | null =
             await GlobalConfigService.findOneBy({
               query: {
@@ -96,12 +114,18 @@ export default class UserTelegramAPI extends BaseAPI<
             );
           }
 
+          const verificationCode: string = item.isVerified
+            ? ""
+            : await this.service.getVerificationCode(item.id!);
+
           return Response.sendJsonObjectResponse(req, res, {
-            verificationCode: item.verificationCode as string,
+            verificationCode,
             telegramBotUsername: botUsername,
             isVerified: Boolean(item.isVerified),
-            deepLinkUrl: `https://t.me/${botUsername}?start=${item.verificationCode}`,
-            startCommand: `/start ${item.verificationCode}`,
+            deepLinkUrl: verificationCode
+              ? `https://t.me/${botUsername}?start=${verificationCode}`
+              : "",
+            startCommand: verificationCode ? `/start ${verificationCode}` : "",
           });
         } catch (err) {
           return next(err);
@@ -114,6 +138,10 @@ export default class UserTelegramAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -133,6 +161,7 @@ export default class UserTelegramAPI extends BaseAPI<
             },
             select: {
               userId: true,
+              projectId: true,
             },
           });
 
@@ -155,6 +184,21 @@ export default class UserTelegramAPI extends BaseAPI<
             );
           }
 
+          if (
+            !item.projectId ||
+            !item.userId ||
+            !(await this.service.hasActiveProjectMembership({
+              projectId: item.projectId,
+              userId: item.userId,
+            }))
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("Item not found"),
+            );
+          }
+
           await this.service.regenerateVerificationCode(req.body.itemId);
 
           return Response.sendEmptySuccessResponse(req, res);

package/Server/EnvironmentConfig.ts

@@ -42,8 +42,8 @@ const FRONTEND_ENV_ALLOW_LIST: Array<string> = [
   "ANALYTICS_HOST",
   "GIT_SHA",
   "APP_VERSION",
-  "OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
-  "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY",
   "DISABLE_TELEMETRY",
   "SLACK_APP_CLIENT_ID",
   "MICROSOFT_TEAMS_APP_CLIENT_ID",
@@ -54,6 +54,32 @@ const FRONTEND_ENV_ALLOW_LIST: Array<string> = [
   "INBOUND_EMAIL_DOMAIN",
 ];
 
+/*
+ * These values are credentials (or may contain credentials) for backend
+ * exporters. Keep this denylist even though none of them is in the allowlist:
+ * it makes the security boundary explicit and ensures that a future broad
+ * prefix or an accidental allowlist addition cannot publish them in env.js.
+ *
+ * Browser telemetry has its own deliberately public endpoint and Browser
+ * ingestion key above. Browser keys are origin-bound, surface-limited and
+ * rate-limited by TelemetryIngest; a Server key is none of those things.
+ */
+const FRONTEND_ENV_DENY_LIST: ReadonlySet<string> = new Set<string>([
+  "OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+  "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+]);
+
+/*
+ * PUBLIC_ is an intentional escape hatch for browser-readable settings, but it
+ * must not turn a renamed OTLP header variable into an escape hatch for an
+ * arbitrary bearer token. Cover the OpenTelemetry-standard OTEL spelling, the
+ * historical OneUptime OPENTELEMETRY spelling, generic headers and every
+ * signal-specific/future extension ending in _HEADERS. Endpoint and dedicated
+ * Browser-key names remain unaffected.
+ */
+const FRONTEND_OTLP_HEADERS_PATTERN: RegExp =
+  /^PUBLIC_(?:OTEL|OPENTELEMETRY)_EXPORTER_OTLP(?:_[A-Z0-9]+)*_HEADERS$/i;
+
 const FRONTEND_ENV_ALLOW_PREFIXES: Array<string> = [
   "SUBSCRIPTION_PLAN_",
   "PUBLIC_",
@@ -63,6 +89,13 @@ export const getFrontendEnvVars: () => JSONObject = (): JSONObject => {
   const frontendEnv: JSONObject = {};
 
   for (const key of Object.keys(process.env)) {
+    if (
+      FRONTEND_ENV_DENY_LIST.has(key) ||
+      FRONTEND_OTLP_HEADERS_PATTERN.test(key)
+    ) {
+      continue;
+    }
+
     const shouldInclude: boolean =
       FRONTEND_ENV_ALLOW_LIST.includes(key) ||
       FRONTEND_ENV_ALLOW_PREFIXES.some((prefix: string) => {
@@ -830,6 +863,20 @@ export const IpWhitelist: string = process.env["IP_WHITELIST"] || "";
 export const DisableTelemetry: boolean =
   process.env["DISABLE_TELEMETRY"] === "true";
 
+/*
+ * Master switch for fault classification (code-fault / user-error /
+ * expected-denial / infrastructure). When false, ErrorClassResolver reports
+ * CodeFault for everything, so every thrown value is recorded as an exception
+ * event, marked ERROR and logged at ERROR — exactly the pre-classification
+ * behaviour.
+ *
+ * Default ON. It exists so a regression in classification is a config flip on
+ * a running fleet rather than a redeploy, which matters because this runs on
+ * the universal error path of every decorated method in the product.
+ */
+export const TelemetryErrorClassEnabled: boolean =
+  process.env["TELEMETRY_ERROR_CLASS_ENABLED"] !== "false";
+
 /*
  * Opt out of the daily "is a newer OneUptime released?" check against the
  * GitHub API. Deliberately separate from DISABLE_TELEMETRY, which turns off

package/Server/Infrastructure/Postgres/SchemaMigrations/1790700000000-AddNetworkSiteTypeParentHierarchy.ts

@@ -0,0 +1,55 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddNetworkSiteTypeParentHierarchy1790700000000
+  implements MigrationInterface
+{
+  public name: string = "AddNetworkSiteTypeParentHierarchy1790700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP CONSTRAINT "FK_33a461f17262b0a4d5be6948ebe"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP CONSTRAINT "FK_7de8eaaa47632114c6864d67d35"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSiteType" ADD "parentNetworkSiteTypeId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_d693eaf5e12242179e348daf09" ON "NetworkSiteType" ("projectId", "parentNetworkSiteTypeId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSiteType" ADD CONSTRAINT "FK_ee9400ec824926d129b31d5fcf0" FOREIGN KEY ("parentNetworkSiteTypeId") REFERENCES "NetworkSiteType"("_id") ON DELETE NO ACTION ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD CONSTRAINT "FK_7de8eaaa47632114c6864d67d35" FOREIGN KEY ("networkSiteTypeId") REFERENCES "NetworkSiteType"("_id") ON DELETE NO ACTION ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD CONSTRAINT "FK_33a461f17262b0a4d5be6948ebe" FOREIGN KEY ("parentSiteId") REFERENCES "NetworkSite"("_id") ON DELETE NO ACTION ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP CONSTRAINT "FK_33a461f17262b0a4d5be6948ebe"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" DROP CONSTRAINT "FK_7de8eaaa47632114c6864d67d35"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSiteType" DROP CONSTRAINT "FK_ee9400ec824926d129b31d5fcf0"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_d693eaf5e12242179e348daf09"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSiteType" DROP COLUMN "parentNetworkSiteTypeId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD CONSTRAINT "FK_7de8eaaa47632114c6864d67d35" FOREIGN KEY ("networkSiteTypeId") REFERENCES "NetworkSiteType"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "NetworkSite" ADD CONSTRAINT "FK_33a461f17262b0a4d5be6948ebe" FOREIGN KEY ("parentSiteId") REFERENCES "NetworkSite"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790900000000-AddEnterpriseLicenseUsageProvenance.ts

@@ -0,0 +1,31 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddEnterpriseLicenseUsageProvenance1790900000000
+  implements MigrationInterface
+{
+  public name: string = "AddEnterpriseLicenseUsageProvenance1790900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" ADD "userCountSource" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" ADD "legacyUserCount" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" ADD "legacyUserCountUpdatedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" DROP COLUMN "legacyUserCountUpdatedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" DROP COLUMN "legacyUserCount"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "EnterpriseLicense" DROP COLUMN "userCountSource"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1790900000000-AddTelemetryExceptionErrorClass.ts

@@ -0,0 +1,124 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The fault class becomes a first-class, always-populated column on the
+ * exception group, instead of a nullable AI verdict.
+ *
+ * Both columns are NOT NULL DEFAULT on purpose, and that is the whole point of
+ * this migration rather than an incidental choice. The Issues list scopes with
+ * `IncludesNone(NON_ACTIONABLE_ERROR_CLASSES)`, which compiles to SQL
+ * `"errorClass" NOT IN ('user-error', 'expected-denial')`. In SQL,
+ * `NULL NOT IN (...)` evaluates to NULL — falsy, not true — so with a nullable
+ * column every unclassified row would fail that predicate and vanish from the
+ * "show me the real failures" view. That is the exact inverse of the intended
+ * fail-safe. With NOT NULL DEFAULT 'unknown', a row nobody classified carries
+ * a value that is not in the suppressed set, so it is an Issue by
+ * construction, and the ADD COLUMN backfills every existing row in one pass.
+ *
+ * aiClassification is left in place: it is the same vocabulary under its older
+ * name (see Types/Telemetry/ErrorClass) and is still what the triage runner
+ * writes, so dropping it here would break that writer. It is copied across
+ * below and can be retired once every writer has moved to errorClass.
+ */
+export class AddTelemetryExceptionErrorClass1790900000000
+  implements MigrationInterface
+{
+  public name: string = "AddTelemetryExceptionErrorClass1790900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" ADD "errorClass" character varying(100) NOT NULL DEFAULT 'unknown'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" ADD "errorClassSource" character varying(100) NOT NULL DEFAULT 'default'`,
+    );
+
+    /*
+     * Carry the existing AI verdicts over. Same five string values, so this is
+     * a rename rather than a translation.
+     *
+     * Deliberately not filtered to the known enum members: a value this does
+     * not recognise still fails the `NOT IN ('user-error', 'expected-denial')`
+     * scope and therefore stays visible, which is the safe direction. Silently
+     * dropping it to 'unknown' would lose information for no gain.
+     */
+    await queryRunner.query(`
+      UPDATE "TelemetryException"
+      SET "errorClass" = "aiClassification", "errorClassSource" = 'ai'
+      WHERE "aiClassification" IS NOT NULL
+    `);
+
+    /*
+     * Reconstruct what the emitting code would have declared, for groups the
+     * AI never looked at, so the Issues list is quiet on day one instead of
+     * only for exceptions raised after this deploy.
+     *
+     * Every class listed here overrides getErrorClass to UserError or
+     * ExpectedDenial. Both collapse to 'user-error' here: the two are
+     * interchangeable for the only thing this backfill drives (they are the
+     * two members of NON_ACTIONABLE_ERROR_CLASSES), and guessing the finer
+     * split from a type name alone would be inventing precision the data does
+     * not have. Live traffic re-stamps the precise class on the next
+     * occurrence.
+     *
+     * Spelling matters here and is easy to get wrong: exceptionType comes from
+     * the constructor name, so it is 'SSOAuthorizationException' (the file is
+     * SsoAuthorizationException.ts) and 'UnableToReachServer' (no trailing
+     * Exception). MasterPasswordRequiredException carries no override of its
+     * own — it inherits ExpectedDenial from NotAuthenticatedException — so it
+     * has to be listed explicitly.
+     *
+     * The bare numeric values are the same exceptions seen through an older
+     * emit path (and through third-party SDKs), which reported the numeric
+     * status as exception.type rather than the class name. 408 and 415 are
+     * deliberately ABSENT: they are TimeoutException and UnableToReachServer,
+     * which are Infrastructure — real failures that must keep showing up as
+     * Issues. 500 and 503 are absent for the same reason.
+     *
+     * Guarded on "aiClassification" IS NULL so it cannot overwrite an AI
+     * verdict. Type name is a class-level GENERALISATION ("BadDataException
+     * usually means the caller sent something wrong"), whereas the AI looked
+     * at this specific group; and the only disagreement that matters is one
+     * where the AI said code-fault and this would flip it to user-error, i.e.
+     * hide a real failure. Deferring keeps the failure mode as
+     * over-reporting.
+     */
+    await queryRunner.query(`
+      UPDATE "TelemetryException"
+      SET "errorClass" = 'user-error', "errorClassSource" = 'declared'
+      WHERE "aiClassification" IS NULL
+        AND (
+          "exceptionType" IN (
+            'BadDataException',
+            'BadRequestException',
+            'NotFoundException',
+            'PayloadTooLargeException',
+            'TenantNotFoundException',
+            'ForbiddenException',
+            'NotAuthenticatedException',
+            'NotAuthorizedException',
+            'PaymentRequiredException',
+            'SSOAuthorizationException',
+            'MasterPasswordRequiredException',
+            'TooManyRequestsException'
+          )
+          OR "exceptionType" IN (
+            '400', '401', '402', '403', '404', '405', '406', '413', '422', '429'
+          )
+        )
+    `);
+  }
+
+  /*
+   * Nothing to un-backfill: both columns go away, and aiClassification — the
+   * only source the backfill read — was never modified.
+   */
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" DROP COLUMN "errorClassSource"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryException" DROP COLUMN "errorClass"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1791000000000-AddUserNotificationEmailRollup.ts

@@ -0,0 +1,132 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The two tables behind owner email burst coalescing: a queue of notifications
+ * that is simultaneously the product's first per-recipient email volume record,
+ * and a ledger of the flushes that drained it.
+ *
+ * Regenerating this migration would silently reverse four decisions, so each is
+ * written down here rather than left to be rediscovered.
+ *
+ * The UNIQUE index on UserNotificationEmailRollupBatch (projectId, userId,
+ * toEmail, claimEpochStartsAt) IS the exactly-once mechanism across worker
+ * replicas, not an integrity nicety. A conditional UPDATE cannot substitute for
+ * it: DatabaseService._updateBy resolves its predicate in a separate _findBy and
+ * then writes per row by _id, never re-checking the predicate at write time, so
+ * "update the row if nobody has claimed it" is a check-then-act race. An INSERT
+ * under this index is atomic in Postgres, and the loser's unique violation is
+ * how the second replica learns to stand down. Because claimEpochStartsAt is a
+ * five-minute wall-clock bucket, the same index also hard-caps a recipient at
+ * twelve rollup emails an hour.
+ *
+ * All four projectId / userId foreign keys are ON DELETE CASCADE. Queued mail
+ * about a deleted project, addressed to a deleted user, must go with them; there
+ * is nothing to preserve and nothing sensible to send.
+ *
+ * rollupBatchId deliberately carries NO foreign key. A CASCADE would delete
+ * items when their batch is pruned at thirty days while the items themselves are
+ * kept for seven, and a SET NULL would un-stamp already-sent items and re-send a
+ * month-old rollup. The column is a stamp, not a relation.
+ *
+ * sentAt is nullable with no default because NULL means "still pending", which
+ * is exactly true of every row that will ever exist. That is what removes the
+ * need for any data migration or backfill: both tables start empty, which is the
+ * correct state on every install, new or upgraded.
+ *
+ * eventType is character varying(500), not (100) like most short text in this
+ * schema. The stored NotificationSettingEventType values are English prose
+ * sentences - the longest today is 92 characters - and
+ * DatabaseService.checkMaxLengthOfFields throws on overflow, which on this code
+ * path would route every notification through the write path's fail-open catch.
+ */
+export class AddUserNotificationEmailRollup1791000000000
+  implements MigrationInterface
+{
+  public name: string = "AddUserNotificationEmailRollup1791000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "UserNotificationEmailRollupItem" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "userId" uuid NOT NULL, "toEmail" character varying(100) NOT NULL, "eventType" character varying(500) NOT NULL, "rollupCategory" character varying(100) NOT NULL, "subject" character varying(500) NOT NULL, "viewLink" text, "sentAt" TIMESTAMP WITH TIME ZONE, "rollupBatchId" uuid, CONSTRAINT "PK_7a4125bfac97ef5ab00115dda89" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_a801450828b245c04caa1903bb" ON "UserNotificationEmailRollupItem" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_45ee190ea4724e6795ff3d0402" ON "UserNotificationEmailRollupItem" ("userId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_519a1a3aba8c1de67d63137e30" ON "UserNotificationEmailRollupItem" ("rollupBatchId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_103a2b3c5914ddfd4088942798" ON "UserNotificationEmailRollupItem" ("sentAt", "createdAt") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_ed339bd9a070c8299e9ba0a4ad" ON "UserNotificationEmailRollupItem" ("projectId", "userId", "toEmail", "rollupCategory", "createdAt") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "UserNotificationEmailRollupBatch" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "userId" uuid NOT NULL, "toEmail" character varying(100) NOT NULL, "claimEpochStartsAt" TIMESTAMP WITH TIME ZONE NOT NULL, "claimedAt" TIMESTAMP WITH TIME ZONE NOT NULL, "sentAt" TIMESTAMP WITH TIME ZONE, "itemCount" integer, "status" character varying(100) NOT NULL, "statusMessage" character varying(500), CONSTRAINT "PK_b4fdcbba719e877a310525c134f" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_2ae4bc5b89abee188172985d93" ON "UserNotificationEmailRollupBatch" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_c6d5acfdf3f3781427a5ff8349" ON "UserNotificationEmailRollupBatch" ("userId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_6f9067198db90df3e5e4c1d2a2" ON "UserNotificationEmailRollupBatch" ("projectId", "userId", "toEmail", "claimEpochStartsAt") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" ADD CONSTRAINT "FK_a801450828b245c04caa1903bb7" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" ADD CONSTRAINT "FK_45ee190ea4724e6795ff3d04027" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupBatch" ADD CONSTRAINT "FK_2ae4bc5b89abee188172985d93a" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupBatch" ADD CONSTRAINT "FK_c6d5acfdf3f3781427a5ff83498" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupBatch" DROP CONSTRAINT "FK_c6d5acfdf3f3781427a5ff83498"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupBatch" DROP CONSTRAINT "FK_2ae4bc5b89abee188172985d93a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" DROP CONSTRAINT "FK_45ee190ea4724e6795ff3d04027"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupItem" DROP CONSTRAINT "FK_a801450828b245c04caa1903bb7"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6f9067198db90df3e5e4c1d2a2"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_c6d5acfdf3f3781427a5ff8349"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_2ae4bc5b89abee188172985d93"`,
+    );
+    await queryRunner.query(`DROP TABLE "UserNotificationEmailRollupBatch"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ed339bd9a070c8299e9ba0a4ad"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_103a2b3c5914ddfd4088942798"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_519a1a3aba8c1de67d63137e30"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_45ee190ea4724e6795ff3d0402"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_a801450828b245c04caa1903bb"`,
+    );
+    await queryRunner.query(`DROP TABLE "UserNotificationEmailRollupItem"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1791100000000-AddUserNotificationEmailRollupSetting.ts

@@ -0,0 +1,79 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The per-user escape hatch from owner email burst rollup: one row per
+ * (user, project) saying whether that person's notification emails may be
+ * coalesced during a burst.
+ *
+ * Two decisions here that a regeneration would silently reverse.
+ *
+ * isEnabled is NOT NULL DEFAULT TRUE, and the table starts empty. Rollup is on
+ * by default and there is no backfill, so almost nobody will ever have a row;
+ * the read path treats an absent row and isEnabled = true identically, which
+ * is what lets this ship without writing a row for a single existing member.
+ * Flip the default to false and every project member silently opts out of a
+ * feature they were never asked about.
+ *
+ * Both foreign keys are ON DELETE CASCADE. A preference about a deleted
+ * project, held by a deleted user, has nothing left to express - and the
+ * tenant column is NOT NULL, so SET NULL could not be satisfied anyway.
+ *
+ * There is deliberately no UNIQUE index on (projectId, userId), even though
+ * the service treats the pair as unique. The dashboard creates the row lazily
+ * on the first toggle and the service's check-then-create narrows the race;
+ * adding the constraint would be a correctness improvement but it would turn
+ * the losing side of that race from a harmless duplicate into a 500 on a
+ * settings page, and both rows say the same thing in every flow the UI can
+ * produce. Worth revisiting if the row ever carries more than one field.
+ */
+export class AddUserNotificationEmailRollupSetting1791100000000
+  implements MigrationInterface
+{
+  public name: string = "AddUserNotificationEmailRollupSetting1791100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "UserNotificationEmailRollupSetting" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "userId" uuid NOT NULL, "isEnabled" boolean NOT NULL DEFAULT true, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_2d06015d532e73decda61f6c729" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_fc43fd93f6c9b84517ec70a756" ON "UserNotificationEmailRollupSetting" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_0eb2b532417a885a83ef3a246c" ON "UserNotificationEmailRollupSetting" ("userId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" ADD CONSTRAINT "FK_fc43fd93f6c9b84517ec70a756e" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" ADD CONSTRAINT "FK_0eb2b532417a885a83ef3a246cf" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" ADD CONSTRAINT "FK_b3e85e262ece458665f3b67ec9c" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" ADD CONSTRAINT "FK_4f8b04650019cb0b9e4cee5f561" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" DROP CONSTRAINT "FK_4f8b04650019cb0b9e4cee5f561"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" DROP CONSTRAINT "FK_b3e85e262ece458665f3b67ec9c"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" DROP CONSTRAINT "FK_0eb2b532417a885a83ef3a246cf"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "UserNotificationEmailRollupSetting" DROP CONSTRAINT "FK_fc43fd93f6c9b84517ec70a756e"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0eb2b532417a885a83ef3a246c"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_fc43fd93f6c9b84517ec70a756"`,
+    );
+    await queryRunner.query(`DROP TABLE "UserNotificationEmailRollupSetting"`);
+  }
+}