@oneuptime/common 12.0.33 → 13.0.0

package/Server/API/UserNotificationSettingAPI.ts

@@ -0,0 +1,55 @@
+import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+import UserMiddleware from "../Middleware/UserAuthorization";
+import RoutineEmailSettingsService from "../Services/RoutineEmailSettingsService";
+import UserNotificationSettingService, {
+  Service as UserNotificationSettingServiceType,
+} from "../Services/UserNotificationSettingService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import UserNotificationSetting from "../../Models/DatabaseModels/UserNotificationSetting";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { ROUTINE_EMAIL_EVENT_TYPES } from "../../Types/NotificationSetting/RoutineEmailEvents";
+import ObjectID from "../../Types/ObjectID";
+
+export default class UserNotificationSettingAPI extends BaseAPI<
+  UserNotificationSetting,
+  UserNotificationSettingServiceType
+> {
+  public constructor() {
+    super(UserNotificationSetting, UserNotificationSettingService);
+
+    this.router.post(
+      "/user-notification-setting/reduce-routine-emails",
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+          const projectId: ObjectID =
+            CommonAPI.assertAuthenticatedProjectMember(props);
+
+          /*
+           * The model grants CurrentUser access. A member may change their own
+           * settings, regardless of role, and may never select another user.
+           */
+          await RoutineEmailSettingsService.reduceRoutineEmails({
+            userId: props.userId!,
+            projectId: projectId,
+          });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            success: true,
+            routineEventTypeCount: ROUTINE_EMAIL_EVENT_TYPES.length,
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+}

package/Server/API/UserTelegramAPI.ts

@@ -1,4 +1,7 @@
 import UserMiddleware from "../Middleware/UserAuthorization";
+import VerificationCodeRateLimit, {
+  VerificationCodeRateLimitBucket,
+} from "../Middleware/VerificationCodeRateLimit";
 import GlobalConfigService from "../Services/GlobalConfigService";
 import UserTelegramService, {
   Service as UserTelegramServiceType,
@@ -26,6 +29,7 @@ export default class UserTelegramAPI extends BaseAPI<
     this.router.post(
       `${new this.entityType().getCrudApiPath()?.toString()}/verification-info`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -46,7 +50,6 @@ export default class UserTelegramAPI extends BaseAPI<
             select: {
               userId: true,
               projectId: true,
-              verificationCode: true,
               isVerified: true,
             },
           });
@@ -70,6 +73,21 @@ export default class UserTelegramAPI extends BaseAPI<
             );
           }
 
+          if (
+            !item.projectId ||
+            !item.userId ||
+            !(await this.service.hasActiveProjectMembership({
+              projectId: item.projectId,
+              userId: item.userId,
+            }))
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("Item not found"),
+            );
+          }
+
           const globalConfig: GlobalConfig | null =
             await GlobalConfigService.findOneBy({
               query: {
@@ -96,12 +114,18 @@ export default class UserTelegramAPI extends BaseAPI<
             );
           }
 
+          const verificationCode: string = item.isVerified
+            ? ""
+            : await this.service.getVerificationCode(item.id!);
+
           return Response.sendJsonObjectResponse(req, res, {
-            verificationCode: item.verificationCode as string,
+            verificationCode,
             telegramBotUsername: botUsername,
             isVerified: Boolean(item.isVerified),
-            deepLinkUrl: `https://t.me/${botUsername}?start=${item.verificationCode}`,
-            startCommand: `/start ${item.verificationCode}`,
+            deepLinkUrl: verificationCode
+              ? `https://t.me/${botUsername}?start=${verificationCode}`
+              : "",
+            startCommand: verificationCode ? `/start ${verificationCode}` : "",
           });
         } catch (err) {
           return next(err);
@@ -114,6 +138,10 @@ export default class UserTelegramAPI extends BaseAPI<
         .getCrudApiPath()
         ?.toString()}/resend-verification-code`,
       UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      VerificationCodeRateLimit.getMiddleware(
+        VerificationCodeRateLimitBucket.Resend,
+      ),
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
           req = req as OneUptimeRequest;
@@ -133,6 +161,7 @@ export default class UserTelegramAPI extends BaseAPI<
             },
             select: {
               userId: true,
+              projectId: true,
             },
           });
 
@@ -155,6 +184,21 @@ export default class UserTelegramAPI extends BaseAPI<
             );
           }
 
+          if (
+            !item.projectId ||
+            !item.userId ||
+            !(await this.service.hasActiveProjectMembership({
+              projectId: item.projectId,
+              userId: item.userId,
+            }))
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("Item not found"),
+            );
+          }
+
           await this.service.regenerateVerificationCode(req.body.itemId);
 
           return Response.sendEmptySuccessResponse(req, res);

package/Server/EnvironmentConfig.ts

@@ -42,8 +42,8 @@ const FRONTEND_ENV_ALLOW_LIST: Array<string> = [
   "ANALYTICS_HOST",
   "GIT_SHA",
   "APP_VERSION",
-  "OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
-  "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+  "PUBLIC_OPENTELEMETRY_EXPORTER_OTLP_BROWSER_INGESTION_KEY",
   "DISABLE_TELEMETRY",
   "SLACK_APP_CLIENT_ID",
   "MICROSOFT_TEAMS_APP_CLIENT_ID",
@@ -54,6 +54,32 @@ const FRONTEND_ENV_ALLOW_LIST: Array<string> = [
   "INBOUND_EMAIL_DOMAIN",
 ];
 
+/*
+ * These values are credentials (or may contain credentials) for backend
+ * exporters. Keep this denylist even though none of them is in the allowlist:
+ * it makes the security boundary explicit and ensures that a future broad
+ * prefix or an accidental allowlist addition cannot publish them in env.js.
+ *
+ * Browser telemetry has its own deliberately public endpoint and Browser
+ * ingestion key above. Browser keys are origin-bound, surface-limited and
+ * rate-limited by TelemetryIngest; a Server key is none of those things.
+ */
+const FRONTEND_ENV_DENY_LIST: ReadonlySet<string> = new Set<string>([
+  "OPENTELEMETRY_EXPORTER_OTLP_ENDPOINT",
+  "OPENTELEMETRY_EXPORTER_OTLP_HEADERS",
+]);
+
+/*
+ * PUBLIC_ is an intentional escape hatch for browser-readable settings, but it
+ * must not turn a renamed OTLP header variable into an escape hatch for an
+ * arbitrary bearer token. Cover the OpenTelemetry-standard OTEL spelling, the
+ * historical OneUptime OPENTELEMETRY spelling, generic headers and every
+ * signal-specific/future extension ending in _HEADERS. Endpoint and dedicated
+ * Browser-key names remain unaffected.
+ */
+const FRONTEND_OTLP_HEADERS_PATTERN: RegExp =
+  /^PUBLIC_(?:OTEL|OPENTELEMETRY)_EXPORTER_OTLP(?:_[A-Z0-9]+)*_HEADERS$/i;
+
 const FRONTEND_ENV_ALLOW_PREFIXES: Array<string> = [
   "SUBSCRIPTION_PLAN_",
   "PUBLIC_",
@@ -63,6 +89,13 @@ export const getFrontendEnvVars: () => JSONObject = (): JSONObject => {
   const frontendEnv: JSONObject = {};
 
   for (const key of Object.keys(process.env)) {
+    if (
+      FRONTEND_ENV_DENY_LIST.has(key) ||
+      FRONTEND_OTLP_HEADERS_PATTERN.test(key)
+    ) {
+      continue;
+    }
+
     const shouldInclude: boolean =
       FRONTEND_ENV_ALLOW_LIST.includes(key) ||
       FRONTEND_ENV_ALLOW_PREFIXES.some((prefix: string) => {
@@ -439,32 +472,63 @@ export const HomeHostname: Hostname = Hostname.fromString(
 
 export const Env: string = process.env["NODE_ENV"] || "production";
 
-// Redis does not require password.
-export const RedisHostname: string = process.env["REDIS_HOST"] || "redis";
-export const RedisPort: Port = new Port(process.env["REDIS_PORT"] || "6379");
-export const RedisDb: number = Number(process.env["REDIS_DB"]) || 0;
-export const RedisUsername: string = process.env["REDIS_USERNAME"] || "default";
-export const RedisPassword: string =
-  process.env["REDIS_PASSWORD"] || "password";
+/*
+ * The cache and queue tier runs Valkey -- the BSD-licensed fork of Redis 7.2 --
+ * so its settings are named VALKEY_*. Any Redis-protocol server works here,
+ * including real Redis, which is why the in-code names below stay `Redis*`:
+ * they describe the protocol, not the vendor.
+ *
+ * The REDIS_* names these shipped under are still read, so an existing
+ * config.env or values.yaml keeps working untouched. They are DEPRECATED, not
+ * removed; VALKEY_* wins when both are set. Nothing here may start requiring
+ * the new name -- a self-hoster who never edits config.env must keep running.
+ *
+ * `||` here is load-bearing and must not be "modernised" to `??`. Compose
+ * materialises an unset variable as an EMPTY STRING, and docker-compose.base.yml
+ * lists every VALKEY_* name, so the new name is always *defined* inside our
+ * containers. Under `??` an empty VALKEY_PASSWORD would beat the operator's real
+ * REDIS_PASSWORD and the app would silently fall through to the literal default
+ * below.
+ */
+export function getCacheEnvVar(suffix: string): string | undefined {
+  return (
+    process.env[`VALKEY_${suffix}`] ||
+    process.env[`REDIS_${suffix}`] ||
+    undefined
+  );
+}
+
+/*
+ * The cache does not require a password.
+ *
+ * The default hostname stays "redis" even though the compose service is now
+ * `valkey`. This default is only reached when NEITHER variable is set, which
+ * never happens in our own compose or Helm -- both always set them. What it does
+ * cover is hand-written Kubernetes manifests, a bare `docker run`, and third
+ * party compose files, where the Service has been called `redis` for years.
+ * Compose is unaffected either way: its valkey service answers to `redis` too.
+ */
+export const RedisHostname: string = getCacheEnvVar("HOST") || "redis";
+export const RedisPort: Port = new Port(getCacheEnvVar("PORT") || "6379");
+export const RedisDb: number = Number(getCacheEnvVar("DB")) || 0;
+export const RedisUsername: string = getCacheEnvVar("USERNAME") || "default";
+export const RedisPassword: string = getCacheEnvVar("PASSWORD") || "password";
 
-export const RedisTlsCa: string | undefined =
-  process.env["REDIS_TLS_CA"] || undefined;
+export const RedisTlsCa: string | undefined = getCacheEnvVar("TLS_CA");
 
-export const RedisTlsCert: string | undefined =
-  process.env["REDIS_TLS_CERT"] || undefined;
+export const RedisTlsCert: string | undefined = getCacheEnvVar("TLS_CERT");
 
-export const RedisTlsKey: string | undefined =
-  process.env["REDIS_TLS_KEY"] || undefined;
+export const RedisTlsKey: string | undefined = getCacheEnvVar("TLS_KEY");
 
 export const RedisTlsSentinelMode: boolean =
-  process.env["REDIS_TLS_SENTINEL_MODE"] === "true";
+  getCacheEnvVar("TLS_SENTINEL_MODE") === "true";
 
 export const ShouldRedisTlsEnable: boolean = Boolean(
   RedisTlsCa || (RedisTlsCert && RedisTlsKey),
 );
 
-export const RedisIPFamily: number = process.env["REDIS_IP_FAMILY"]
-  ? Number(process.env["REDIS_IP_FAMILY"])
+export const RedisIPFamily: number = getCacheEnvVar("IP_FAMILY")
+  ? Number(getCacheEnvVar("IP_FAMILY"))
   : 4;
 
 export const IsProduction: boolean =

package/Server/Infrastructure/Postgres/SchemaMigrations/1791300000000-AddTelemetryIngestionKeyType.ts

@@ -0,0 +1,91 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Splits TelemetryIngestionKey into two credential classes - Server (what
+ * every existing key is) and Browser (a public, write-only key that is safe to
+ * paste into a web page) - and adds the controls a public key needs to be
+ * safe: an origin allowlist, a pinned service.name, a rate limit, an expiry, a
+ * kill switch, and last-used visibility.
+ *
+ * Every column here is chosen so that this migration is a NO-OP for behaviour
+ * on existing rows, which matters because these keys are live credentials in
+ * customer infrastructure and a schema change must never be the reason a
+ * production collector stops shipping telemetry:
+ *
+ * - "keyType" is NOT NULL DEFAULT 'Server', so the ADD COLUMN backfills every
+ *   existing row to exactly what it already is. Nullable would have been worse
+ *   than useless: the ingest guard would then have to decide what NULL means,
+ *   and every wrong guess there is either "break every existing key" or
+ *   "treat an unknown key as the permissive class".
+ * - "isEnabled" is NOT NULL DEFAULT true - a key that worked yesterday keeps
+ *   working.
+ * - "allowedOrigins" is NOT NULL DEFAULT '[]' and is ignored for Server keys,
+ *   so the backfilled empty list changes nothing. It only becomes a strict
+ *   allowlist on Browser keys, which cannot exist before this migration runs.
+ * - the remaining four are nullable with no default, and NULL means "no
+ *   expiry", "no pinned service name", "never seen used", "no explicit rate
+ *   limit" respectively - each the pre-existing behaviour.
+ *
+ * SQL types mirror what the ORM emits for the corresponding ColumnType
+ * elsewhere in this directory: ShortText -> character varying(100),
+ * JSON -> jsonb, Boolean -> boolean, Date -> TIMESTAMP WITH TIME ZONE,
+ * Number -> integer.
+ */
+export class AddTelemetryIngestionKeyType1791300000000
+  implements MigrationInterface
+{
+  public name: string = "AddTelemetryIngestionKeyType1791300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" ADD "keyType" character varying(100) NOT NULL DEFAULT 'Server'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" ADD "allowedOrigins" jsonb NOT NULL DEFAULT '[]'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" ADD "pinnedServiceName" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" ADD "isEnabled" boolean NOT NULL DEFAULT true`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" ADD "expiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" ADD "lastUsedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" ADD "requestsPerMinuteLimit" integer`,
+    );
+  }
+
+  /*
+   * Drops exactly the seven columns this migration added, in reverse order.
+   * No data is restored on the way down because none was rewritten on the way
+   * up - this migration only ever added columns.
+   */
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" DROP COLUMN "requestsPerMinuteLimit"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" DROP COLUMN "lastUsedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" DROP COLUMN "expiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" DROP COLUMN "isEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" DROP COLUMN "pinnedServiceName"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" DROP COLUMN "allowedOrigins"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TelemetryIngestionKey" DROP COLUMN "keyType"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1791400000000-SessionReplayRecordEverySessionByDefault.ts

@@ -0,0 +1,67 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Record every session by default, not only the ones that broke.
+ *
+ *   - capture trigger: OnErrorOrFrustration -> Always
+ *   - sample percentage: 0 -> 100
+ *
+ * The two together were the reason a fresh install looked broken. The old
+ * pair means the recorder holds a rolling in-memory buffer and uploads
+ * NOTHING until an error, an unhandled rejection, a 5xx or a frustration
+ * signal fires, so the session list filled up with rows carrying signals
+ * and nothing else - and a session with no footage is indistinguishable
+ * from a feature that does not work. Replay is also simply useful on the
+ * sessions where nothing threw: the checkout nobody completed, the form
+ * everybody abandoned, the support call about a page that "looked wrong".
+ *
+ * On the backfill. ALTER COLUMN SET DEFAULT only reaches rows inserted
+ * afterwards, so on its own this would change nothing for any install
+ * that already has applications - which is every install that reported
+ * the problem. The UPDATE is therefore scoped to rows still holding BOTH
+ * previous defaults, which is the closest a migration can get to "was
+ * never configured": the schema keeps no record of whether a value was
+ * chosen or inherited. Requiring both to match is what protects a
+ * deliberate configuration - anyone who set a sample percentage, or who
+ * chose Always, keeps exactly what they set.
+ *
+ * This increases how much end-user data an existing install records and
+ * stores, which is not a change to make quietly, so it is called out in
+ * the changelog as well as here. The controls that bound it are
+ * unchanged and all still apply: the project-wide master switch, the
+ * per-application toggle, masking (sensitive inputs are masked in every
+ * mode), consent mode, and a 7-day default retention.
+ */
+export class SessionReplayRecordEverySessionByDefault1791400000000
+  implements MigrationInterface
+{
+  public name = "SessionReplayRecordEverySessionByDefault1791400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplayCaptureTrigger" SET DEFAULT 'Always'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplaySamplePercentage" SET DEFAULT 100`,
+    );
+
+    await queryRunner.query(
+      `UPDATE "RumApplication" SET "sessionReplayCaptureTrigger" = 'Always', "sessionReplaySamplePercentage" = 100 WHERE "sessionReplayCaptureTrigger" = 'OnErrorOrFrustration' AND "sessionReplaySamplePercentage" = 0`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Defaults only. The backfilled rows are indistinguishable from ones
+     * an operator chose after this migration ran, and moving them back
+     * would silently stop recording sessions somebody may now be relying
+     * on being able to watch.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplaySamplePercentage" SET DEFAULT 0`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ALTER COLUMN "sessionReplayCaptureTrigger" SET DEFAULT 'OnErrorOrFrustration'`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1791500000000-WidenCustomFieldDropdownOptions.ts

@@ -0,0 +1,139 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * dropdownOptions on all nine custom-field tables becomes unbounded text.
+ *
+ * Hand-written ALTER COLUMN ... TYPE rather than the DROP + ADD pair TypeORM
+ * generates for this change: varchar -> text is binary-coercible in Postgres,
+ * so the ALTER rewrites nothing and, unlike DROP + ADD, keeps every option
+ * list customers have already configured.
+ */
+export class WidenCustomFieldDropdownOptions1791500000000
+  implements MigrationInterface
+{
+  public name: string = "WidenCustomFieldDropdownOptions1791500000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Change dropdownOptions from varchar(500) to text on every custom-field
+     * table.
+     *
+     * The column holds the whole option list of a Dropdown / MultiSelectDropdown
+     * custom field, one option per line, so 500 characters is a cap on the
+     * number of options rather than on any single value — roughly 43 short
+     * options. That is too small for the reference lists these fields exist to
+     * model: a country list of 250 entries needs 2716 characters. Since #2974
+     * added per-option colours the list is serialised as JSON whenever any
+     * option carries one, at which point the same 250 entries need about 10 KB.
+     *
+     * There are no indexes, constraints or views on these columns, and nothing
+     * sorts, groups or filters by them, so widening is free.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "AlertCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "InventoryItemCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ScheduledMaintenanceCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamMemberCustomField" ALTER COLUMN "dropdownOptions" TYPE text`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Revert to varchar(500). Truncate first — option lists written since `up`
+     * ran may exceed 500 characters, and Postgres refuses the narrowing cast
+     * with "value too long for type character varying(500)" rather than
+     * truncating for us.
+     *
+     * This direction is lossy by nature, and worse than it first looks. A
+     * plain newline-separated list loses its overflow and its final option is
+     * left half-written. A list where any option carries a colour is stored as
+     * a single-line JSON array, so clipping it yields a truncated fragment:
+     * parseCustomFieldDropdownOptions sees the leading "[", JSON.parse throws,
+     * and the fallback splits on newline and hands back the whole broken
+     * fragment as ONE option. Such a list has to be re-entered by hand after a
+     * downgrade. That is unavoidable for a narrowing cast, and it is the reason
+     * the forward migration is the one worth having.
+     *
+     * Reverse order of `up`, so the two read as inverses of each other — the
+     * shape 1789800000000-WidenSecurityEventLastErrorColumns.ts established.
+     * Atomicity does not come from the ordering: migrationsTransactionMode is
+     * "each" (DataSourceOptions.ts), so all nine tables commit or roll back
+     * together whichever order they are written in.
+     */
+    await queryRunner.query(
+      `UPDATE "TeamMemberCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamMemberCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "TeamCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "StatusPageCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "ScheduledMaintenanceCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ScheduledMaintenanceCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "OnCallDutyPolicyCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "MonitorCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "InventoryItemCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "InventoryItemCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "IncidentCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+    await queryRunner.query(
+      `UPDATE "AlertCustomField" SET "dropdownOptions" = LEFT("dropdownOptions", 500) WHERE LENGTH("dropdownOptions") > 500`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AlertCustomField" ALTER COLUMN "dropdownOptions" TYPE character varying(500)`,
+    );
+  }
+}