@oneuptime/common 12.0.32 → 12.0.34

package/Server/Services/RoutineEmailSettingsService.ts

@@ -0,0 +1,73 @@
+import DatabaseService, { EntityManager } from "./DatabaseService";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import UserNotificationSetting from "../../Models/DatabaseModels/UserNotificationSetting";
+import { ROUTINE_EMAIL_EVENT_TYPES } from "../../Types/NotificationSetting/RoutineEmailEvents";
+import ObjectID from "../../Types/ObjectID";
+
+export class Service extends DatabaseService<UserNotificationSetting> {
+  public constructor() {
+    super(UserNotificationSetting);
+  }
+
+  /*
+   * The API authorizes the authenticated user's own settings before calling
+   * this method. Every statement remains scoped to that user and project.
+   */
+  @CaptureSpan()
+  public async reduceRoutineEmails(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<void> {
+    await this.executeTransaction(async (manager: EntityManager) => {
+      /*
+       * There is no unique constraint on (user, project, event). Serializing
+       * preset requests also protects the missing-row insert on a double click.
+       */
+      await manager.query(
+        "SELECT pg_advisory_xact_lock(hashtextextended($1, 0))",
+        [
+          `routine-email-settings:${data.projectId.toString()}:${data.userId.toString()}`,
+        ],
+      );
+
+      const parameters: [string, string, ReadonlyArray<string>] = [
+        data.userId.toString(),
+        data.projectId.toString(),
+        ROUTINE_EMAIL_EVENT_TYPES,
+      ];
+
+      /*
+       * Update every matching row, including historical duplicates. Changing
+       * only email avoids overwriting another channel edited concurrently.
+       */
+      await manager.query(
+        `UPDATE "UserNotificationSetting"
+         SET "alertByEmail" = false, "updatedAt" = now(), "version" = "version" + 1
+         WHERE "userId" = $1 AND "projectId" = $2
+           AND "eventType" = ANY($3::text[])
+           AND "deletedAt" IS NULL AND "alertByEmail" = true`,
+        parameters,
+      );
+
+      /*
+       * Persist an explicit opt-out for missing events so later default
+       * seeding sees the user's choice. Other channels keep their false defaults.
+       */
+      await manager.query(
+        `INSERT INTO "UserNotificationSetting"
+           ("userId", "projectId", "eventType", "alertByEmail", "createdByUserId", "version")
+         SELECT $1::uuid, $2::uuid, event."eventType", false, $1::uuid, 1
+         FROM unnest($3::text[]) AS event("eventType")
+         WHERE NOT EXISTS (
+           SELECT 1 FROM "UserNotificationSetting" setting
+           WHERE setting."userId" = $1 AND setting."projectId" = $2
+             AND setting."eventType" = event."eventType"
+             AND setting."deletedAt" IS NULL
+         )`,
+        parameters,
+      );
+    });
+  }
+}
+
+export default new Service();

package/Server/Services/RumSessionReplayViewService.ts

@@ -1,5 +1,6 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/RumSessionReplayView";
+import QueryHelper from "../Types/Database/QueryHelper";
 import ColumnLength from "../../Types/Database/ColumnLength";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
@@ -19,6 +20,45 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
  * modelled on, the whole point of the audit is that it outlives the
  * recording it describes.
  */
+
+/*
+ * The heartbeat cadence the player reports on. secondsWatched is floored
+ * to it so a chatty client costs at most one write per bucket, and the
+ * figure shown to viewers ("watched 1m 30s") never pretends to more
+ * precision than the heartbeat had.
+ */
+export const SESSION_REPLAY_WATCH_BUCKET_SECONDS: number = 15;
+
+/*
+ * Ceiling on one view's watched time: the longest session the recorder
+ * will ever produce, at the slowest speed anyone would watch it, with
+ * headroom for pauses. A client cannot report more than this; the audit
+ * figure is a privacy control shown to other viewers, and an unbounded
+ * number would let a buggy or hostile client render a nonsense one.
+ */
+export const SESSION_REPLAY_MAX_SECONDS_WATCHED: number = 24 * 60 * 60;
+
+/*
+ * Floor a client-reported figure to the heartbeat bucket and clamp it.
+ * Module-level so the route and the service agree on the one rounding
+ * rule without the route reaching for the class behind the instance.
+ */
+export function normalizeSecondsWatched(secondsWatched: number): number {
+  if (!Number.isFinite(secondsWatched) || secondsWatched <= 0) {
+    return 0;
+  }
+
+  const clamped: number = Math.min(
+    secondsWatched,
+    SESSION_REPLAY_MAX_SECONDS_WATCHED,
+  );
+
+  return (
+    Math.floor(clamped / SESSION_REPLAY_WATCH_BUCKET_SECONDS) *
+    SESSION_REPLAY_WATCH_BUCKET_SECONDS
+  );
+}
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -64,12 +104,13 @@ export class Service extends DatabaseService<Model> {
     }
 
     /*
-     * All three come straight off an untrusted request: a header, or a
+     * All four come straight off an untrusted request: a header, or a
      * free-text field in the body. Truncated rather than validated because
      * failing the audit write would fail the playback it is auditing, and
      * DatabaseService.checkMaxLengthOfFields throws on anything longer
-     * than the column. An oversized user agent must not be able to stop a
-     * read from being recorded.
+     * than the column. An oversized user agent - or a fingerprint longer
+     * than its ShortText column - must not be able to stop a read from
+     * being recorded.
      */
     if (data.ipAddress) {
       item.ipAddress = data.ipAddress.substring(0, ColumnLength.ShortText);
@@ -88,7 +129,8 @@ export class Service extends DatabaseService<Model> {
     }
 
     if (data.linkedExceptionFingerprint) {
-      item.linkedExceptionFingerprint = data.linkedExceptionFingerprint;
+      item.linkedExceptionFingerprint =
+        data.linkedExceptionFingerprint.substring(0, ColumnLength.ShortText);
     }
 
     return await this.create({
@@ -98,47 +140,85 @@ export class Service extends DatabaseService<Model> {
   }
 
   /*
-   * Advance how much of the recording was actually watched, from the
-   * player's throttled heartbeat.
-   *
-   * Monotonic on purpose: the heartbeat carries a cumulative total, and a
-   * player that seeks backwards or reloads would otherwise walk the
-   * recorded figure back down and make a full viewing look like a glance.
+   * The caller's OWN view row, or null. The heartbeat and the manifest
+   * refresh both need "does this viewId belong to this user, this
+   * project, and (for the refresh) this session" answered in one lookup,
+   * and both must refuse somebody else's row indistinguishably from a
+   * missing one: secondsWatched is a privacy control, and the refresh
+   * would otherwise let a caller reuse a colleague's audit row.
    */
   @CaptureSpan()
-  public async recordSecondsWatched(data: {
+  public async findOwnView(data: {
     viewId: ObjectID;
     projectId: ObjectID;
-    secondsWatched: number;
-  }): Promise<void> {
-    if (!Number.isFinite(data.secondsWatched) || data.secondsWatched <= 0) {
-      return;
-    }
-
-    const existing: Model | null = await this.findOneBy({
+    viewedByUserId: ObjectID;
+    sessionId?: string | undefined;
+  }): Promise<Model | null> {
+    return await this.findOneBy({
       query: {
         _id: data.viewId.toString(),
         projectId: data.projectId,
+        viewedByUserId: data.viewedByUserId,
+        ...(data.sessionId !== undefined && { sessionId: data.sessionId }),
       },
       select: {
         _id: true,
+        rumApplicationId: true,
+        sessionId: true,
         secondsWatched: true,
       },
       props: { isRoot: true },
     });
+  }
+
+  /*
+   * Advance how much of the recording was actually watched.
+   *
+   * SEMANTICS: secondsWatched is the cumulative number of seconds of
+   * footage the player has PLAYED for this view - accumulated client-side
+   * only while playback is running, scaled by speed - not the furthest
+   * offset the playhead reached. Dragging the scrubber to the end of a
+   * recording is not watching it, and the audit figure is shown to other
+   * viewers as "who watched how much", so it must not over-report.
+   *
+   * Monotonic on purpose: the heartbeat carries a cumulative total, and a
+   * player that reloads would otherwise walk the recorded figure back
+   * down and make a full viewing look like a glance. The guard is in the
+   * UPDATE's own predicate (secondsWatched < new value) rather than in a
+   * read-then-write, so two heartbeats racing for the same row cannot
+   * regress it; a heartbeat that does not advance writes nothing.
+   *
+   * When the caller already holds the row's current figure (the route
+   * reads it in the same lookup that proves ownership) it passes it as
+   * currentSecondsWatched and a non-advancing heartbeat costs no query at
+   * all.
+   */
+  @CaptureSpan()
+  public async recordSecondsWatched(data: {
+    viewId: ObjectID;
+    projectId: ObjectID;
+    secondsWatched: number;
+    currentSecondsWatched?: number | undefined;
+  }): Promise<void> {
+    const seconds: number = normalizeSecondsWatched(data.secondsWatched);
 
-    if (!existing) {
+    if (seconds <= 0) {
       return;
     }
 
-    const seconds: number = Math.floor(data.secondsWatched);
-
-    if ((existing.secondsWatched || 0) >= seconds) {
+    if (
+      data.currentSecondsWatched !== undefined &&
+      data.currentSecondsWatched >= seconds
+    ) {
       return;
     }
 
-    await this.updateOneById({
-      id: data.viewId,
+    await this.updateOneBy({
+      query: {
+        _id: data.viewId.toString(),
+        projectId: data.projectId,
+        secondsWatched: QueryHelper.lessThanOrNull(seconds),
+      },
       data: {
         secondsWatched: seconds,
       },

package/Server/Services/ScheduledMaintenanceCustomFieldService.ts

@@ -1,9 +1,107 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/ScheduledMaintenanceCustomField";
+import ObjectID from "../../Types/ObjectID";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import { backfillMappedCustomFieldValues } from "../Utils/CustomField/CustomFieldDefinitionMappingHooks";
+import {
+  validateCustomFieldMappingOnCreate,
+  validateCustomFieldMappingOnUpdate,
+} from "../Utils/CustomField/CustomFieldMappingValidator";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
+/*
+ * A scheduled maintenance custom field can take its value from the same field
+ * on the event's monitors instead of being typed in again
+ * (OneUptime/oneuptime#3549). These hooks are the two halves of that
+ * configuration being saved: refusing a mapping that could never resolve, and
+ * filling in the events that already exist once one is saved.
+ */
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
   }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    await validateCustomFieldMappingOnCreate({
+      definitionModelType: Model,
+      createBy: createBy,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    await validateCustomFieldMappingOnUpdate({
+      definitionModelType: Model,
+      definitionService: this,
+      updateBy: updateBy,
+    });
+
+    return { updateBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    backfillMappedCustomFieldValues({
+      definitionModelType: Model,
+      projectId: createdItem.projectId,
+      definitionName: "scheduled maintenance custom field",
+    });
+
+    return createdItem;
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<Model>> {
+    if (updatedItemIds.length > 0) {
+      backfillMappedCustomFieldValues({
+        definitionModelType: Model,
+        projectId: await this.getProjectIdForBackfill(onUpdate, updatedItemIds),
+        definitionName: "scheduled maintenance custom field",
+      });
+    }
+
+    return onUpdate;
+  }
+
+  /*
+   * `props.tenantId` is set on every dashboard write but not on internal
+   * root-scoped ones, so fall back to the row itself rather than skipping the
+   * backfill for a mapping that was changed by a script.
+   */
+  private async getProjectIdForBackfill(
+    onUpdate: OnUpdate<Model>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<ObjectID | undefined> {
+    const tenantId: ObjectID | undefined = onUpdate.updateBy.props.tenantId as
+      | ObjectID
+      | undefined;
+
+    if (tenantId) {
+      return tenantId;
+    }
+
+    const item: Model | null = await this.findOneById({
+      id: updatedItemIds[0]!,
+      select: { projectId: true },
+      props: { isRoot: true },
+    });
+
+    return item?.projectId;
+  }
 }
 export default new Service();

package/Server/Services/ScheduledMaintenanceService.ts

@@ -6,6 +6,8 @@ import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseService from "./DatabaseService";
+import ScheduledMaintenanceCustomField from "../../Models/DatabaseModels/ScheduledMaintenanceCustomField";
+import CustomFieldMappingService from "./CustomFieldMappingService";
 import MonitorService from "./MonitorService";
 import ScheduledMaintenanceOwnerTeamService from "./ScheduledMaintenanceOwnerTeamService";
 import ScheduledMaintenanceOwnerUserService from "./ScheduledMaintenanceOwnerUserService";
@@ -609,6 +611,17 @@ ${resourcesAffected ? `**Resources Affected:** ${resourcesAffected}` : ""}
 
     await this.validateProjectScopedReferences(updateBy);
 
+    /*
+     * Re-apply mapped custom field values. Covers the Custom Fields modal
+     * saving the whole bag back over a mapped value, and the event's monitors
+     * changing — both change what a mapped field should hold, and folding the
+     * answer into this payload keeps it one write with a truthful audit entry.
+     */
+    await CustomFieldMappingService.applyMappingsToUpdate({
+      definitionModelType: ScheduledMaintenanceCustomField,
+      updateBy: updateBy,
+    });
+
     return {
       updateBy,
       carryForward: null,
@@ -937,6 +950,19 @@ ${resourcesAffected ? `**Resources Affected:** ${resourcesAffected}` : ""}
         StatusPageSubscriberNotificationStatus.Pending;
     }
 
+    /*
+     * Custom fields configured to inherit from the event's monitors are
+     * stamped here rather than in onCreateSuccess: `customFields` is a column
+     * on this row and the onCreateSuccess chain is un-awaited, so a value
+     * written there would be missing from the event the caller gets back.
+     * Written not to throw — a field failing to inherit must not stop an event
+     * from being scheduled.
+     */
+    await CustomFieldMappingService.applyMappingsToCreate({
+      definitionModelType: ScheduledMaintenanceCustomField,
+      createBy: createBy,
+    });
+
     return { createBy, carryForward: null };
   }
 
@@ -1562,6 +1588,12 @@ ${scheduledMaintenance.description || "No description provided."}
     onUpdate: OnUpdate<Model>,
     updatedItemIds: ObjectID[],
   ): Promise<OnUpdate<Model>> {
+    CustomFieldMappingService.restampAfterMultiRowUpdate({
+      definitionModelType: ScheduledMaintenanceCustomField,
+      updateBy: onUpdate.updateBy,
+      updatedItemIds: updatedItemIds,
+    });
+
     /*
      * Rescheduling the planned window is the whole point of making these
      * fields editable, so the numbers derived from them have to move. Without

package/Server/Services/StatusPagePrivateUserService.ts

@@ -1,6 +1,8 @@
 import DatabaseConfig from "../DatabaseConfig";
+import { EncryptionSecret } from "../EnvironmentConfig";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import logger from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import MailService from "./MailService";
@@ -13,6 +15,9 @@ import Protocol from "../../Types/API/Protocol";
 import URL from "../../Types/API/URL";
 import OneUptimeDate from "../../Types/Date";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import Email from "../../Types/Email";
+import HashedString from "../../Types/HashedString";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
 import StatusPage from "../../Models/DatabaseModels/StatusPage";
@@ -55,17 +60,112 @@ export class Service extends DatabaseService<Model> {
     };
   }
 
+  /**
+   * Kill any outstanding password-reset link for a status page user whose
+   * email address is about to change.
+   *
+   * Same invariant, and the same reasoning, as
+   * `UserService.expirePasswordResetTokensForEmailChange`: the link is a
+   * bearer credential addressed to one mailbox, and `/status-page-api/
+   * reset-password` finds the row by token hash and status page alone, never
+   * by the address the link was mailed to. Left unexpired, a link sent to the
+   * old address keeps working against the account at its new one.
+   *
+   * This path is worth closing even though a status page user cannot edit
+   * their own email: project admins can (the column carries `update` for
+   * ProjectAdmin and StatusPageAdmin), and `StatusPageSCIM.ts` rewrites it
+   * from the directory. "Move this subscriber to their new address" is the
+   * same rescue action, done by somebody else on the user's behalf, and it has
+   * to invalidate old links for the same reason.
+   *
+   * Cleared before the write, and only for rows whose address actually
+   * changes, so a SCIM push that re-sends an unchanged address does not
+   * invalidate a reset link the user is part-way through using.
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.email) {
+      const newEmail: string = (updateBy.data.email as Email)
+        .toString()
+        .toLowerCase();
+
+      const existingUsers: Array<Model> = await this.findBy({
+        query: updateBy.query,
+        select: {
+          _id: true,
+          email: true,
+        },
+        props: updateBy.props,
+        limit: LIMIT_MAX,
+        skip: 0,
+      });
+
+      for (const user of existingUsers) {
+        if (!user.id) {
+          continue;
+        }
+
+        /*
+         * A row whose `email` did not come back is treated as changed -- that
+         * only happens when the caller could not read the column, and on a
+         * credential the safe assumption is the one that expires the token.
+         */
+        const currentEmail: string | undefined = user.email
+          ?.toString()
+          .toLowerCase();
+
+        if (currentEmail === newEmail) {
+          continue;
+        }
+
+        await this.updateOneById({
+          id: user.id,
+          data: {
+            resetPasswordToken: null!,
+            resetPasswordExpires: null!,
+          },
+          props: {
+            isRoot: true,
+            ignoreHooks: true,
+          },
+        });
+      }
+    }
+
+    return {
+      updateBy: updateBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onCreateSuccess(
     _onCreate: OnCreate<Model>,
     createdItem: Model,
   ): Promise<Model> {
-    // send email to the user.
+    /*
+     * The invite link doubles as this user's first password-reset link, so the
+     * column has to hold what `/status-page-api/reset-password` looks rows up
+     * by: the SHA-256 of the token, never the token itself. That endpoint
+     * hashes whatever the link carried and queries by the digest, so a raw
+     * token stored here matches nothing and the welcome link is dead on
+     * arrival -- and it would also leave a working bearer credential sitting
+     * in the database in plaintext.
+     *
+     * Same split as `/status-page-api/forgot-password`: the digest is
+     * persisted, the raw token is only ever mailed.
+     */
     const token: string = ObjectID.generate().toString();
+    const hashedToken: string = await HashedString.hashValue(
+      token,
+      EncryptionSecret,
+    );
     await this.updateOneById({
       id: createdItem.id!,
       data: {
-        resetPasswordToken: token,
+        resetPasswordToken: hashedToken,
         resetPasswordExpires: OneUptimeDate.getOneDayAfter(),
       },
       props: {

package/Server/Services/TeamMemberService.ts

@@ -16,6 +16,8 @@ import BillingService from "./BillingService";
 import DatabaseService from "./DatabaseService";
 import MailService from "./MailService";
 import ProjectService from "./ProjectService";
+import TeamPermissionService from "./TeamPermissionService";
+import TeamService from "./TeamService";
 import UserNotificationRuleService from "./UserNotificationRuleService";
 import UserNotificationSettingService from "./UserNotificationSettingService";
 import UserService from "./UserService";
@@ -32,9 +34,11 @@ import Email from "../../Types/Email";
 import EmailTemplateType from "../../Types/Email/EmailTemplateType";
 import Name from "../../Types/Name";
 import BadDataException from "../../Types/Exception/BadDataException";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import ObjectID from "../../Types/ObjectID";
 import PositiveNumber from "../../Types/PositiveNumber";
 import Project from "../../Models/DatabaseModels/Project";
+import Team from "../../Models/DatabaseModels/Team";
 import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import User from "../../Models/DatabaseModels/User";
 import OnCallDutyPolicyTimeLogService from "./OnCallDutyPolicyTimeLogService";
@@ -102,6 +106,56 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
   protected override async onBeforeCreate(
     createBy: CreateBy<TeamMember>,
   ): Promise<OnCreate<TeamMember>> {
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+    const teamId: ObjectID | null =
+      createBy.data.teamId || createBy.data.team?.id || null;
+
+    if (!projectId) {
+      throw new BadDataException("Project Id is required to invite a member");
+    }
+
+    if (!teamId) {
+      throw new BadDataException("Team Id is required to invite a member");
+    }
+
+    createBy.data.projectId = projectId;
+    createBy.data.teamId = teamId;
+
+    if (!createBy.props.isRoot && !createBy.props.isMasterAdmin) {
+      if (
+        !createBy.props.tenantId ||
+        createBy.props.tenantId.toString() !== projectId.toString()
+      ) {
+        throw new NotAuthorizedException(
+          "Team members can only be managed inside the current project.",
+        );
+      }
+
+      const team: Team | null = await TeamService.findOneBy({
+        query: {
+          _id: teamId,
+          projectId: projectId,
+        },
+        select: {
+          _id: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+      if (!team) {
+        throw new BadDataException("Invalid Team ID");
+      }
+
+      await TeamPermissionService.assertCanGrantTeamPermissions({
+        teamId: teamId,
+        projectId: projectId,
+        props: createBy.props,
+      });
+    }
+
     // Check if SCIM is enabled for the project
     if (
       !createBy.props.isRoot &&
@@ -366,6 +420,30 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
     return { createBy, carryForward: null };
   }
 
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<TeamMember>,
+  ): Promise<OnUpdate<TeamMember>> {
+    /*
+     * CurrentUser may set this column so an invitee can accept a pending
+     * invitation. The inverse transition is not a safe way to leave: merely
+     * flipping the flag bypasses the delete hook that removes notification
+     * settings, on-call assignments, calendar feeds, and cached permissions.
+     * Force ordinary users through the established delete/leave path instead.
+     */
+    if (
+      updateBy.data.hasAcceptedInvitation === false &&
+      !updateBy.props.isRoot &&
+      !updateBy.props.isMasterAdmin
+    ) {
+      throw new NotAuthorizedException(
+        "An accepted team membership must be removed through the leave flow.",
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
   @CaptureSpan()
   public async refreshTokens(
     userId: ObjectID,