@oneuptime/common 12.0.5 → 12.0.6

package/Server/API/DataSourceAPI.ts

@@ -0,0 +1,268 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import CommonAPI from "./CommonAPI";
+import DataSourceService, {
+  Service as DataSourceServiceType,
+} from "../Services/DataSourceService";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import BaseAPI from "./BaseAPI";
+import DataSource from "../../Models/DatabaseModels/DataSource";
+import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { JSONObject } from "../../Types/JSON";
+import ObjectID from "../../Types/ObjectID";
+import AggregatedResult from "../../Types/BaseDatabase/AggregatedResult";
+import DataSourceTableResult from "../../Types/DataSource/DataSourceTableResult";
+import { DataSourceResultKind } from "../../Types/DataSource/DataSourceQueryConfig";
+import {
+  DataSourceConnectionSettings,
+  DataSourceConnector,
+} from "../Utils/DataSource/Types";
+import ConnectorRegistry from "../Utils/DataSource/ConnectorRegistry";
+import logger from "../Utils/Logger";
+
+/*
+ * Upper bound on stored/ad-hoc query text. Real PromQL/SQL/DSL queries are
+ * a few KB; anything beyond this is abuse or a mistake.
+ */
+const MAX_QUERY_LENGTH: number = 100_000;
+
+export default class DataSourceAPI extends BaseAPI<
+  DataSource,
+  DataSourceServiceType
+> {
+  public constructor() {
+    super(DataSource, DataSourceService);
+
+    /*
+     * Test a data source's connectivity + credentials. Authenticated
+     * users only; access is checked by reading the record with the
+     * caller's own permissions before any root read of credentials.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/test`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const body: JSONObject = req.body;
+
+          const dataSource: DataSource = await this.getAccessibleDataSource({
+            req,
+            dataSourceId: body["dataSourceId"] as string,
+          });
+
+          const settings: DataSourceConnectionSettings =
+            await this.getConnectionSettings(dataSource);
+
+          const connector: DataSourceConnector = ConnectorRegistry.getConnector(
+            settings.dataSourceType,
+          );
+
+          try {
+            await connector.testConnection(settings);
+          } catch (err) {
+            logger.error(err);
+            return Response.sendJsonObjectResponse(req, res, {
+              ok: false,
+              message: this.toFriendlyErrorMessage(err),
+            });
+          }
+
+          return Response.sendJsonObjectResponse(req, res, {
+            ok: true,
+            message: "Connection successful.",
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
+    /*
+     * Execute a query against a data source and return normalized time
+     * series (for chart/value/gauge widgets) or rows (for the table
+     * widget).
+     *
+     * SECURITY: authenticated project users only — this route must NEVER
+     * be reachable from the anonymous public-dashboard surface, because
+     * it executes caller-supplied query text. Public dashboards render a
+     * placeholder for data-source widgets instead.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/query`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const body: JSONObject = req.body;
+
+          const query: string = (body["query"] as string) || "";
+          if (!query || query.trim().length === 0) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("query is required"),
+            );
+          }
+          if (query.length > MAX_QUERY_LENGTH) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException("query is too long"),
+            );
+          }
+
+          const resultKind: DataSourceResultKind =
+            body["resultKind"] === DataSourceResultKind.Table
+              ? DataSourceResultKind.Table
+              : DataSourceResultKind.TimeSeries;
+
+          const startDate: Date = new Date(body["startDate"] as string);
+          const endDate: Date = new Date(body["endDate"] as string);
+          if (
+            isNaN(startDate.getTime()) ||
+            isNaN(endDate.getTime()) ||
+            startDate.getTime() >= endDate.getTime()
+          ) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "A valid startDate and endDate are required (startDate must be before endDate).",
+              ),
+            );
+          }
+
+          let stepInSeconds: number | undefined = undefined;
+          if (body["stepInSeconds"] !== undefined) {
+            const parsedStep: number = Number(body["stepInSeconds"]);
+            if (Number.isFinite(parsedStep) && parsedStep > 0) {
+              // Floor, but never to 0 — Loki/Prometheus reject step=0.
+              stepInSeconds = Math.max(1, Math.floor(parsedStep));
+            }
+          }
+
+          const dataSource: DataSource = await this.getAccessibleDataSource({
+            req,
+            dataSourceId: body["dataSourceId"] as string,
+          });
+
+          const settings: DataSourceConnectionSettings =
+            await this.getConnectionSettings(dataSource);
+
+          const connector: DataSourceConnector = ConnectorRegistry.getConnector(
+            settings.dataSourceType,
+          );
+
+          try {
+            if (resultKind === DataSourceResultKind.Table) {
+              const tableResult: DataSourceTableResult =
+                await connector.queryTable(settings, query, {
+                  startDate,
+                  endDate,
+                  stepInSeconds,
+                });
+              return Response.sendJsonObjectResponse(req, res, {
+                resultKind: DataSourceResultKind.Table,
+                result: tableResult as unknown as JSONObject,
+              });
+            }
+
+            const timeSeriesResult: AggregatedResult =
+              await connector.queryTimeSeries(settings, query, {
+                startDate,
+                endDate,
+                stepInSeconds,
+              });
+
+            return Response.sendJsonObjectResponse(req, res, {
+              resultKind: DataSourceResultKind.TimeSeries,
+              result: timeSeriesResult as unknown as JSONObject,
+            });
+          } catch (err) {
+            logger.error(err);
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                `Data source query failed: ${this.toFriendlyErrorMessage(err)}`,
+              ),
+            );
+          }
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+
+  /*
+   * Two-phase access pattern (same as LlmProviderAPI /test): first read
+   * the record with the CALLER'S permissions — wrong project or missing
+   * ReadDataSource yields null — and only then may callers proceed to a
+   * root read of credentials.
+   */
+  private async getAccessibleDataSource(data: {
+    req: ExpressRequest;
+    dataSourceId: string;
+  }): Promise<DataSource> {
+    if (!data.dataSourceId) {
+      throw new BadDataException("dataSourceId is required");
+    }
+
+    if (!ObjectID.isValidUUID(data.dataSourceId)) {
+      throw new BadDataException(
+        "Data source not found, or you do not have access to it.",
+      );
+    }
+
+    const props: DatabaseCommonInteractionProps =
+      await CommonAPI.getDatabaseCommonInteractionProps(data.req);
+
+    const accessibleDataSource: DataSource | null =
+      await DataSourceService.findOneById({
+        id: new ObjectID(data.dataSourceId),
+        select: {
+          _id: true,
+          projectId: true,
+          dataSourceType: true,
+        },
+        props: props,
+      });
+
+    if (!accessibleDataSource) {
+      throw new BadDataException(
+        "Data source not found, or you do not have access to it.",
+      );
+    }
+
+    return accessibleDataSource;
+  }
+
+  private async getConnectionSettings(
+    dataSource: DataSource,
+  ): Promise<DataSourceConnectionSettings> {
+    const settings: DataSourceConnectionSettings | null =
+      await DataSourceService.getConnectionSettingsById(dataSource.id!);
+
+    if (!settings) {
+      throw new BadDataException("Data source configuration is incomplete.");
+    }
+
+    return settings;
+  }
+
+  private toFriendlyErrorMessage(err: unknown): string {
+    const message: string =
+      err instanceof Exception
+        ? err.message
+        : "Could not reach the data source. Please verify the connection details.";
+    return message.substring(0, 1000);
+  }
+}

package/Server/API/StatusPageAPI.ts

@@ -3853,9 +3853,19 @@ export default class StatusPageAPI extends BaseAPI<
         `Updating existing subscriber with ID: ${subscriberId} for status page with ID: ${objectId}`,
         getLogAttributesFromRequest(req as any),
       );
+      /*
+       * Scope the lookup to the status page in the route. This endpoint only
+       * checks read access on that status page, so without the statusPageId
+       * clause anyone holding a subscriber UUID could pass any status page they
+       * can read and edit a subscriber belonging to a different — possibly
+       * private — status page. A subscriber on another page must be
+       * indistinguishable from one that does not exist, so that the shared
+       * "Subscriber not found" below cannot be used to probe for valid UUIDs.
+       */
       statusPageSubscriber = await StatusPageSubscriberService.findOneBy({
         query: {
           _id: subscriberId.toString(),
+          statusPageId: objectId,
         },
         props: {
           isRoot: true,
@@ -3864,7 +3874,7 @@ export default class StatusPageAPI extends BaseAPI<
 
       if (!statusPageSubscriber) {
         logger.debug(
-          `Subscriber not found with ID: ${subscriberId}`,
+          `Subscriber not found with ID: ${subscriberId} on status page with ID: ${objectId}`,
           getLogAttributesFromRequest(req as any),
         );
         throw new BadDataException("Subscriber not found");

package/Server/API/UserAPI.ts

@@ -12,8 +12,10 @@ import PositiveNumber from "../../Types/PositiveNumber";
 import TeamMembersByProject, {
   UserProjectMembership,
 } from "../../Utils/TeamMembersByProject";
+import Email from "../../Types/Email";
 import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import TeamMemberService from "../Services/TeamMemberService";
+import UserAuthenticationStatus from "../../Types/UserAuthenticationStatus";
 import UserService, {
   Service as UserServiceType,
 } from "../Services/UserService";
@@ -191,6 +193,123 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
       },
     );
 
+    /*
+     * How one user can sign in, for Admin Dashboard > User > Authentication.
+     *
+     * A dedicated endpoint rather than extra columns on the CRUD read, because
+     * the interesting fact -- "does this account have a password at all?" --
+     * cannot be answered from the CRUD API without shipping the password
+     * column itself. A master admin bypasses column read permissions, so
+     * selecting `password` in the browser would put every user's scrypt digest
+     * in a page's network tab. The booleans below are derived server-side and
+     * nothing secret crosses the wire.
+     */
+    this.router.get(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/authentication-status`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const status: UserAuthenticationStatus =
+            await UserService.getAuthenticationStatus(userId);
+
+          /*
+           * Whether an account has a password is exactly the sort of answer a
+           * shared cache must not keep -- and it changes the moment either
+           * action below is used.
+           */
+          Response.setNoCacheHeaders(res);
+
+          return Response.sendJsonObjectResponse(
+            req,
+            res,
+            status as unknown as JSONObject,
+          );
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Set a user's password on their behalf.
+     *
+     * Master-admin only, and deliberately its own route rather than a PUT to
+     * /user/:id with a password in it. That generic write would work -- a
+     * master admin bypasses the password column's `update: [CurrentUser]` ACL
+     * -- but nothing about the URL would say so, the password policy could not
+     * be enforced, and the payload would have to be a hand-serialized
+     * HashedString. Here the gate is a middleware anyone can grep for, and the
+     * body is a plain string.
+     *
+     * Session revocation and the "Password Changed." email happen in
+     * UserService's update hook, not here, so they cannot be forgotten by a
+     * caller and cannot fire twice.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/set-password`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const password: unknown = req.body?.["password"];
+
+          /*
+           * Type-checked rather than cast. `as string` on a JSON body is a
+           * lie the moment somebody posts {"password": {...}} or a number, and
+           * the value flows into the hasher.
+           */
+          if (typeof password !== "string") {
+            throw new BadDataException("Password is required");
+          }
+
+          await UserService.setPassword({
+            userId: userId,
+            password: password,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Email the user a link that lets them choose their own password.
+     *
+     * The counterpart to setting one for them: it never puts the operator in
+     * possession of the user's credentials, which is the better default when
+     * the point is simply to get somebody back into a locked-out account. The
+     * link is the same one /forgot-password sends, redeemed by the same page.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/send-password-reset-link`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const email: Email = await UserService.sendPasswordResetLink({
+            userId: userId,
+          });
+
+          /*
+           * Echoed back so the page can say where the link went. The caller is
+           * a master admin who can already read this user's email through the
+           * CRUD API, so this discloses nothing new.
+           */
+          return Response.sendJsonObjectResponse(req, res, {
+            email: email.toString(),
+          });
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/profile-picture/:userId`,
       async (req: ExpressRequest, res: ExpressResponse) => {

package/Server/Infrastructure/ClickhouseConfig.ts

@@ -23,6 +23,52 @@ const hostProtocol: string = ClickHouseIsHostHttps ? "https" : "http";
 const clickhouseHost: Hostname = ClickhouseHost || new Hostname("clickhouse");
 const clickhousePort: string = (ClickhousePort || 8123).toString();
 
+/*
+ * How long the client keeps an idle pooled HTTP socket alive before
+ * destroying it (keep_alive.idle_socket_ttl). @clickhouse/client enables
+ * keep-alive by default but expires idle sockets after only 2500ms, while
+ * the telemetry fan-in writer's flush window (TELEMETRY_FANIN_MAX_WAIT_MS,
+ * see TelemetryFanInWriter.ts) defaults to 5000ms — so under sub-saturation
+ * ingest load every pooled socket was destroyed between flushes and every
+ * flush paid TCP (+TLS) connection setup again. The default here is bounded
+ * on both sides:
+ *
+ *   - ABOVE the 5000ms fan-in flush window, so the socket a flush opened is
+ *     still alive when the next flush fires and gets reused instead of
+ *     being re-established;
+ *   - BELOW the ClickHouse server's keep_alive_timeout of 10s (the bundled
+ *     Clickhouse/config.xml pins <keep_alive_timeout>10</keep_alive_timeout>,
+ *     which is also the server default since 23.11), so the CLIENT always
+ *     retires an idle socket before the SERVER does. Operators who lower
+ *     the server's keep_alive_timeout below this TTL must lower
+ *     CLICKHOUSE_KEEP_ALIVE_IDLE_SOCKET_TTL_MS along with it (keeping it a
+ *     fair bit under the server value) — otherwise the client reuses
+ *     sockets the server has already closed and requests fail with
+ *     ECONNRESET.
+ *
+ * The value must be a positive number of milliseconds; unset, non-numeric,
+ * zero and negative values all fall back to the default. Zero is rejected
+ * deliberately: the client treats 0 as "disable idle-socket reaping
+ * entirely", which reintroduces the server-closes-first ECONNRESET failure
+ * mode this TTL exists to prevent.
+ */
+const DEFAULT_KEEP_ALIVE_IDLE_SOCKET_TTL_MS: number = 8000;
+
+const keepAliveIdleSocketTtlRawValue: string = (
+  process.env["CLICKHOUSE_KEEP_ALIVE_IDLE_SOCKET_TTL_MS"] || ""
+).trim();
+
+const keepAliveIdleSocketTtlParsedValue: number = parseInt(
+  keepAliveIdleSocketTtlRawValue,
+  10,
+);
+
+const keepAliveIdleSocketTtlInMs: number =
+  Number.isFinite(keepAliveIdleSocketTtlParsedValue) &&
+  keepAliveIdleSocketTtlParsedValue > 0
+    ? keepAliveIdleSocketTtlParsedValue
+    : DEFAULT_KEEP_ALIVE_IDLE_SOCKET_TTL_MS;
+
 const options: ClickHouseClientConfigOptions = {
   url: `${hostProtocol}://${clickhouseHost.toString()}:${clickhousePort}`,
   username: ClickhouseUsername,
@@ -72,6 +118,19 @@ const options: ClickHouseClientConfigOptions = {
     request: true,
     response: true,
   },
+  /*
+   * Reuse pooled sockets across fan-in flush windows — see the note on
+   * keepAliveIdleSocketTtlInMs above for both bounds on the TTL and the
+   * operator warning about the server's keep_alive_timeout. `enabled: true`
+   * restates the client default explicitly so the pairing with
+   * idle_socket_ttl is visible here rather than implied. This lives on the
+   * shared `options` object, so every pool derived from it (query, ingest,
+   * migration, test) gets the same keep-alive behavior.
+   */
+  keep_alive: {
+    enabled: true,
+    idle_socket_ttl: keepAliveIdleSocketTtlInMs,
+  },
 };
 
 if (ShouldClickhouseSslEnable && ClickhouseTlsCa) {

package/Server/Infrastructure/Postgres/SchemaMigrations/1786303472848-AddDataSourceTable.ts

@@ -0,0 +1,39 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddDataSourceTable1786303472848 implements MigrationInterface {
+  public name: string = "AddDataSourceTable1786303472848";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "DataSource" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "slug" character varying(100) NOT NULL, "description" character varying(500), "dataSourceType" character varying(100) NOT NULL, "url" character varying, "databaseHost" character varying(100), "databasePort" integer, "databaseName" character varying(100), "username" character varying(100), "password" text, "apiToken" text, "customHeaders" jsonb, "additionalOptions" jsonb, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_49141becafea4a0574d9b5219ca" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_0e559ea9d7fbc66d014a29c380" ON "DataSource" ("projectId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" ADD CONSTRAINT "FK_0e559ea9d7fbc66d014a29c3804" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" ADD CONSTRAINT "FK_38843f53e5ca0ce0bf4de525d6f" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" ADD CONSTRAINT "FK_29f0d663494b52c4ed2c0cc8e88" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" DROP CONSTRAINT "FK_29f0d663494b52c4ed2c0cc8e88"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" DROP CONSTRAINT "FK_38843f53e5ca0ce0bf4de525d6f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" DROP CONSTRAINT "FK_0e559ea9d7fbc66d014a29c3804"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0e559ea9d7fbc66d014a29c380"`,
+    );
+    await queryRunner.query(`DROP TABLE "DataSource"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786600000000-AddInvestigationAnalysisTldr.ts

@@ -0,0 +1,24 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with `npm run generate-postgres-migration` after adding
+ * AIRun.analysisTldr — the AI-written one or two sentence summary of a
+ * completed investigation's posted report. Nullable: legacy runs, runs that
+ * published no report, and runs whose bounded TL;DR call failed simply have
+ * none, and the panel omits the TL;DR block for them.
+ */
+export class AddInvestigationAnalysisTldr1786600000000
+  implements MigrationInterface
+{
+  public name = "AddInvestigationAnalysisTldr1786600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AIRun" ADD "analysisTldr" character varying(500)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "AIRun" DROP COLUMN "analysisTldr"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786700000000-DropProjectCallSMSConfigCredentialUniques.ts

@@ -0,0 +1,76 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Drops the global UNIQUE constraints on ProjectCallSMSConfig's Twilio
+ * credentials. Generated with `npm run generate-postgres-migration` after
+ * flipping both columns to `unique: false`; the statements are the generator's,
+ * renumbered to sort last and given IF EXISTS (see below).
+ *
+ * WHY THEY WERE WRONG
+ *
+ * ProjectCallSMSConfig is tenant-scoped (@TenantColumn("projectId")) and
+ * inherently multi-row: a project has as many configs as it has Twilio
+ * setups. The constraints came from the InitialMigration, where this table's
+ * columns were modelled on GlobalConfig — a singleton table whose every column
+ * carries a pointless `unique: true`. On a singleton that is harmless. Here it
+ * meant no two rows anywhere in the instance could share a Twilio account.
+ *
+ * That is not a constraint anybody wants:
+ *
+ *   - One Twilio account, two numbers. Poland (and several other countries)
+ *     requires a Local number for Voice and a Mobile number for SMS, so a
+ *     single project legitimately needs two configs on one account. This is
+ *     what issue #3020 was reported against.
+ *   - Two projects, one account. On a shared instance the FIRST project to
+ *     save a given account SID locked every other project out of it, across
+ *     the tenant boundary — one tenant could deny another the use of its own
+ *     Twilio credentials, and neither could see why.
+ *
+ * Both surfaced the same way: Postgres raised unique_violation (23505),
+ * which is not a OneUptime Exception, so it fell through to the generic
+ * handler and reached the client as a bare 500 `{"error":"Server Error"}`
+ * with nothing to act on.
+ *
+ * NOT REPLACED WITH A NARROWER UNIQUE
+ *
+ * There is no uniqueness to restore at any scope. Reusing one account across
+ * configs is the supported case, not an accident to be guarded against. Config
+ * identity is `name`, which is already unique per project via
+ * @UniqueColumnBy("projectId"). After this migration ProjectCallSMSConfig has
+ * no UNIQUE constraint on any credential column, which matches every other
+ * tenant-scoped table: theirs are all on slugs, keys and tokens — identifiers
+ * that really are global.
+ *
+ * IF EXISTS
+ *
+ * Self-hosted operators hit by #3020 were told in the issue thread that the
+ * workaround is to drop the constraint by hand. IF EXISTS keeps this migration
+ * from failing on those databases. down() cannot be made safe the same way: it
+ * will fail if duplicates exist by then, which is correct — silently
+ * hard-deleting a project's Twilio config to make room for a constraint would
+ * be worse than a failed rollback.
+ */
+export class DropProjectCallSMSConfigCredentialUniques1786700000000
+  implements MigrationInterface
+{
+  public name: string =
+    "DropProjectCallSMSConfigCredentialUniques1786700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ProjectCallSMSConfig" DROP CONSTRAINT IF EXISTS "UQ_0886139eac04ad49627e446d477"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProjectCallSMSConfig" DROP CONSTRAINT IF EXISTS "UQ_2eb1a240d549a7701b6e82d2f94"`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ProjectCallSMSConfig" ADD CONSTRAINT "UQ_2eb1a240d549a7701b6e82d2f94" UNIQUE ("twilioAuthToken")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProjectCallSMSConfig" ADD CONSTRAINT "UQ_0886139eac04ad49627e446d477" UNIQUE ("twilioAccountSID")`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -509,6 +509,9 @@ import { RestoreDroppedUniqueIndexes1786200000000 } from "./1786200000000-Restor
 import { QuarantineUnboundGitHubInstallations1786300000000 } from "./1786300000000-QuarantineUnboundGitHubInstallations";
 import { AddMasterPasswordSalt1786400000000 } from "./1786400000000-AddMasterPasswordSalt";
 import { AddInvestigationCodeFixRecommendation1786500000000 } from "./1786500000000-AddInvestigationCodeFixRecommendation";
+import { AddInvestigationAnalysisTldr1786600000000 } from "./1786600000000-AddInvestigationAnalysisTldr";
+import { DropProjectCallSMSConfigCredentialUniques1786700000000 } from "./1786700000000-DropProjectCallSMSConfigCredentialUniques";
+import { AddDataSourceTable1786303472848 } from "./1786303472848-AddDataSourceTable";
 
 export default [
   InitialMigration,
@@ -1022,4 +1025,7 @@ export default [
   AddMasterPasswordSalt1786400000000,
   MigrationName1786105470826,
   AddInvestigationCodeFixRecommendation1786500000000,
+  AddInvestigationAnalysisTldr1786600000000,
+  DropProjectCallSMSConfigCredentialUniques1786700000000,
+  AddDataSourceTable1786303472848,
 ];