@oneuptime/common 12.0.5 → 12.0.7

package/Server/API/UserAPI.ts

@@ -12,8 +12,10 @@ import PositiveNumber from "../../Types/PositiveNumber";
 import TeamMembersByProject, {
   UserProjectMembership,
 } from "../../Utils/TeamMembersByProject";
+import Email from "../../Types/Email";
 import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import TeamMemberService from "../Services/TeamMemberService";
+import UserAuthenticationStatus from "../../Types/UserAuthenticationStatus";
 import UserService, {
   Service as UserServiceType,
 } from "../Services/UserService";
@@ -191,6 +193,123 @@ export default class UserAPI extends BaseAPI<User, UserServiceType> {
       },
     );
 
+    /*
+     * How one user can sign in, for Admin Dashboard > User > Authentication.
+     *
+     * A dedicated endpoint rather than extra columns on the CRUD read, because
+     * the interesting fact -- "does this account have a password at all?" --
+     * cannot be answered from the CRUD API without shipping the password
+     * column itself. A master admin bypasses column read permissions, so
+     * selecting `password` in the browser would put every user's scrypt digest
+     * in a page's network tab. The booleans below are derived server-side and
+     * nothing secret crosses the wire.
+     */
+    this.router.get(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/authentication-status`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const status: UserAuthenticationStatus =
+            await UserService.getAuthenticationStatus(userId);
+
+          /*
+           * Whether an account has a password is exactly the sort of answer a
+           * shared cache must not keep -- and it changes the moment either
+           * action below is used.
+           */
+          Response.setNoCacheHeaders(res);
+
+          return Response.sendJsonObjectResponse(
+            req,
+            res,
+            status as unknown as JSONObject,
+          );
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Set a user's password on their behalf.
+     *
+     * Master-admin only, and deliberately its own route rather than a PUT to
+     * /user/:id with a password in it. That generic write would work -- a
+     * master admin bypasses the password column's `update: [CurrentUser]` ACL
+     * -- but nothing about the URL would say so, the password policy could not
+     * be enforced, and the payload would have to be a hand-serialized
+     * HashedString. Here the gate is a middleware anyone can grep for, and the
+     * body is a plain string.
+     *
+     * Session revocation and the "Password Changed." email happen in
+     * UserService's update hook, not here, so they cannot be forgotten by a
+     * caller and cannot fire twice.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/set-password`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const password: unknown = req.body?.["password"];
+
+          /*
+           * Type-checked rather than cast. `as string` on a JSON body is a
+           * lie the moment somebody posts {"password": {...}} or a number, and
+           * the value flows into the hasher.
+           */
+          if (typeof password !== "string") {
+            throw new BadDataException("Password is required");
+          }
+
+          await UserService.setPassword({
+            userId: userId,
+            password: password,
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
+    /*
+     * Email the user a link that lets them choose their own password.
+     *
+     * The counterpart to setting one for them: it never puts the operator in
+     * possession of the user's credentials, which is the better default when
+     * the point is simply to get somebody back into a locked-out account. The
+     * link is the same one /forgot-password sends, redeemed by the same page.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:userId/send-password-reset-link`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const userId: ObjectID = UserAPI.getUserIdFromParams(req);
+
+          const email: Email = await UserService.sendPasswordResetLink({
+            userId: userId,
+          });
+
+          /*
+           * Echoed back so the page can say where the link went. The caller is
+           * a master admin who can already read this user's email through the
+           * CRUD API, so this discloses nothing new.
+           */
+          return Response.sendJsonObjectResponse(req, res, {
+            email: email.toString(),
+          });
+        } catch (err) {
+          return next(err);
+        }
+      },
+    );
+
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/profile-picture/:userId`,
       async (req: ExpressRequest, res: ExpressResponse) => {

package/Server/Infrastructure/ClickhouseConfig.ts

@@ -23,6 +23,52 @@ const hostProtocol: string = ClickHouseIsHostHttps ? "https" : "http";
 const clickhouseHost: Hostname = ClickhouseHost || new Hostname("clickhouse");
 const clickhousePort: string = (ClickhousePort || 8123).toString();
 
+/*
+ * How long the client keeps an idle pooled HTTP socket alive before
+ * destroying it (keep_alive.idle_socket_ttl). @clickhouse/client enables
+ * keep-alive by default but expires idle sockets after only 2500ms, while
+ * the telemetry fan-in writer's flush window (TELEMETRY_FANIN_MAX_WAIT_MS,
+ * see TelemetryFanInWriter.ts) defaults to 5000ms — so under sub-saturation
+ * ingest load every pooled socket was destroyed between flushes and every
+ * flush paid TCP (+TLS) connection setup again. The default here is bounded
+ * on both sides:
+ *
+ *   - ABOVE the 5000ms fan-in flush window, so the socket a flush opened is
+ *     still alive when the next flush fires and gets reused instead of
+ *     being re-established;
+ *   - BELOW the ClickHouse server's keep_alive_timeout of 10s (the bundled
+ *     Clickhouse/config.xml pins <keep_alive_timeout>10</keep_alive_timeout>,
+ *     which is also the server default since 23.11), so the CLIENT always
+ *     retires an idle socket before the SERVER does. Operators who lower
+ *     the server's keep_alive_timeout below this TTL must lower
+ *     CLICKHOUSE_KEEP_ALIVE_IDLE_SOCKET_TTL_MS along with it (keeping it a
+ *     fair bit under the server value) — otherwise the client reuses
+ *     sockets the server has already closed and requests fail with
+ *     ECONNRESET.
+ *
+ * The value must be a positive number of milliseconds; unset, non-numeric,
+ * zero and negative values all fall back to the default. Zero is rejected
+ * deliberately: the client treats 0 as "disable idle-socket reaping
+ * entirely", which reintroduces the server-closes-first ECONNRESET failure
+ * mode this TTL exists to prevent.
+ */
+const DEFAULT_KEEP_ALIVE_IDLE_SOCKET_TTL_MS: number = 8000;
+
+const keepAliveIdleSocketTtlRawValue: string = (
+  process.env["CLICKHOUSE_KEEP_ALIVE_IDLE_SOCKET_TTL_MS"] || ""
+).trim();
+
+const keepAliveIdleSocketTtlParsedValue: number = parseInt(
+  keepAliveIdleSocketTtlRawValue,
+  10,
+);
+
+const keepAliveIdleSocketTtlInMs: number =
+  Number.isFinite(keepAliveIdleSocketTtlParsedValue) &&
+  keepAliveIdleSocketTtlParsedValue > 0
+    ? keepAliveIdleSocketTtlParsedValue
+    : DEFAULT_KEEP_ALIVE_IDLE_SOCKET_TTL_MS;
+
 const options: ClickHouseClientConfigOptions = {
   url: `${hostProtocol}://${clickhouseHost.toString()}:${clickhousePort}`,
   username: ClickhouseUsername,
@@ -72,6 +118,19 @@ const options: ClickHouseClientConfigOptions = {
     request: true,
     response: true,
   },
+  /*
+   * Reuse pooled sockets across fan-in flush windows — see the note on
+   * keepAliveIdleSocketTtlInMs above for both bounds on the TTL and the
+   * operator warning about the server's keep_alive_timeout. `enabled: true`
+   * restates the client default explicitly so the pairing with
+   * idle_socket_ttl is visible here rather than implied. This lives on the
+   * shared `options` object, so every pool derived from it (query, ingest,
+   * migration, test) gets the same keep-alive behavior.
+   */
+  keep_alive: {
+    enabled: true,
+    idle_socket_ttl: keepAliveIdleSocketTtlInMs,
+  },
 };
 
 if (ShouldClickhouseSslEnable && ClickhouseTlsCa) {

package/Server/Infrastructure/Postgres/SchemaMigrations/1786303472848-AddDataSourceTable.ts

@@ -0,0 +1,39 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddDataSourceTable1786303472848 implements MigrationInterface {
+  public name: string = "AddDataSourceTable1786303472848";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "DataSource" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "slug" character varying(100) NOT NULL, "description" character varying(500), "dataSourceType" character varying(100) NOT NULL, "url" character varying, "databaseHost" character varying(100), "databasePort" integer, "databaseName" character varying(100), "username" character varying(100), "password" text, "apiToken" text, "customHeaders" jsonb, "additionalOptions" jsonb, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_49141becafea4a0574d9b5219ca" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_0e559ea9d7fbc66d014a29c380" ON "DataSource" ("projectId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" ADD CONSTRAINT "FK_0e559ea9d7fbc66d014a29c3804" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" ADD CONSTRAINT "FK_38843f53e5ca0ce0bf4de525d6f" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" ADD CONSTRAINT "FK_29f0d663494b52c4ed2c0cc8e88" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" DROP CONSTRAINT "FK_29f0d663494b52c4ed2c0cc8e88"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" DROP CONSTRAINT "FK_38843f53e5ca0ce0bf4de525d6f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DataSource" DROP CONSTRAINT "FK_0e559ea9d7fbc66d014a29c3804"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0e559ea9d7fbc66d014a29c380"`,
+    );
+    await queryRunner.query(`DROP TABLE "DataSource"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786446545142-MigrationName.ts

@@ -0,0 +1,50 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1786446545142 implements MigrationInterface {
+  public name = "MigrationName1786446545142";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * "File"."isPublic" backs a `boolean` field but was created as varchar,
+     * so every row holds the STRING 'true'/'false' and every server-side
+     * `!file.isPublic` gate was inert — 'false' is truthy in JS.
+     *
+     * Convert in place. TypeORM generates a DROP COLUMN + ADD COLUMN for
+     * this change, which would discard every stored value and re-default
+     * the whole table to public — the exact opposite of the fix.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" DROP DEFAULT`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" TYPE boolean USING (lower("isPublic") IN ('true', 't', 'yes', 'y', '1'))`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" SET DEFAULT true`,
+    );
+
+    /*
+     * Probe and AI agent icons are the only consumers of the id-based
+     * image route, which serves public files only. Both upload through the
+     * file picker, which marks uploads private, so every icon attached
+     * before this migration would 404 once the gate starts working.
+     * ProbeService/AIAgentService now flip the icon public on attach; this
+     * backfills the rows attached before that hook existed.
+     */
+    await queryRunner.query(
+      `UPDATE "File" SET "isPublic" = true WHERE "_id" IN (SELECT "iconFileId" FROM "Probe" WHERE "iconFileId" IS NOT NULL UNION SELECT "iconFileId" FROM "AIAgent" WHERE "iconFileId" IS NOT NULL)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" DROP DEFAULT`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" TYPE character varying(100) USING (CASE WHEN "isPublic" THEN 'true' ELSE 'false' END)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" SET DEFAULT true`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786449497966-AddMonitorDependency.ts

@@ -0,0 +1,67 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddMonitorDependency1786449497966 implements MigrationInterface {
+  public name = "AddMonitorDependency1786449497966";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "MonitorDependency" ("monitorId" uuid NOT NULL, "dependsOnMonitorId" uuid NOT NULL, CONSTRAINT "PK_26790391f134c5a87b2aa70a902" PRIMARY KEY ("monitorId", "dependsOnMonitorId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_953533a93dba2f345283474c60" ON "MonitorDependency" ("monitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_43f849731e1bda0ada73b3d887" ON "MonitorDependency" ("dependsOnMonitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "MonitorDependencySuppressionStatus" ("monitorId" uuid NOT NULL, "monitorStatusId" uuid NOT NULL, CONSTRAINT "PK_2889f58c301e8a07d46dd82382c" PRIMARY KEY ("monitorId", "monitorStatusId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_747378c59669e4639c4209adc7" ON "MonitorDependencySuppressionStatus" ("monitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_354bf0c679a6dfd64910eb6441" ON "MonitorDependencySuppressionStatus" ("monitorStatusId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" ADD CONSTRAINT "FK_953533a93dba2f345283474c60f" FOREIGN KEY ("monitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" ADD CONSTRAINT "FK_43f849731e1bda0ada73b3d8874" FOREIGN KEY ("dependsOnMonitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" ADD CONSTRAINT "FK_747378c59669e4639c4209adc78" FOREIGN KEY ("monitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" ADD CONSTRAINT "FK_354bf0c679a6dfd64910eb64418" FOREIGN KEY ("monitorStatusId") REFERENCES "MonitorStatus"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" DROP CONSTRAINT "FK_354bf0c679a6dfd64910eb64418"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" DROP CONSTRAINT "FK_747378c59669e4639c4209adc78"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" DROP CONSTRAINT "FK_43f849731e1bda0ada73b3d8874"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" DROP CONSTRAINT "FK_953533a93dba2f345283474c60f"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_354bf0c679a6dfd64910eb6441"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_747378c59669e4639c4209adc7"`,
+    );
+    await queryRunner.query(`DROP TABLE "MonitorDependencySuppressionStatus"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_43f849731e1bda0ada73b3d887"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_953533a93dba2f345283474c60"`,
+    );
+    await queryRunner.query(`DROP TABLE "MonitorDependency"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786461136170-AddDeletedProjectTable.ts

@@ -0,0 +1,39 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddDeletedProjectTable1786461136170 implements MigrationInterface {
+  public name: string = "AddDeletedProjectTable1786461136170";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "DeletedProject" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "projectName" character varying(100) NOT NULL, "projectSlug" character varying(100), "projectCreatedAt" TIMESTAMP WITH TIME ZONE, "projectDeletedAt" TIMESTAMP WITH TIME ZONE NOT NULL, "deletionReason" text, "projectDeletedByUserId" uuid, "projectDeletedByUserName" character varying(50), "projectDeletedByUserEmail" character varying(100), "projectCreatedByUserId" uuid, "projectCreatedByUserName" character varying(50), "projectCreatedByUserEmail" character varying(100), "companyName" character varying(100), "companyPhoneNumber" character varying(30), "companySize" character varying(100), "jobRole" character varying(100), "planName" character varying(100), "paymentProviderPlanId" character varying(100), "paymentProviderCustomerId" character varying(100), "paymentProviderSubscriptionId" character varying(100), "paymentProviderSubscriptionStatus" character varying(100), "paymentProviderSubscriptionSeats" integer, "trialEndsAt" TIMESTAMP WITH TIME ZONE, "activeMonitorCount" integer, "wasProjectBlocked" boolean, CONSTRAINT "PK_bd397da7b51a8649b38c3c8b272" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "idx_deleted_project_project_id" ON "DeletedProject" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "idx_deleted_project_project_deleted_at" ON "DeletedProject" ("projectDeletedAt") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" ADD CONSTRAINT "FK_bb76f7ebe3ee418ffd79346f203" FOREIGN KEY ("projectDeletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" ADD CONSTRAINT "FK_084492367421031e80cd0fdbf1e" FOREIGN KEY ("projectCreatedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" DROP CONSTRAINT "FK_084492367421031e80cd0fdbf1e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" DROP CONSTRAINT "FK_bb76f7ebe3ee418ffd79346f203"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."idx_deleted_project_project_deleted_at"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."idx_deleted_project_project_id"`,
+    );
+    await queryRunner.query(`DROP TABLE "DeletedProject"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786600000000-AddInvestigationAnalysisTldr.ts

@@ -0,0 +1,24 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with `npm run generate-postgres-migration` after adding
+ * AIRun.analysisTldr — the AI-written one or two sentence summary of a
+ * completed investigation's posted report. Nullable: legacy runs, runs that
+ * published no report, and runs whose bounded TL;DR call failed simply have
+ * none, and the panel omits the TL;DR block for them.
+ */
+export class AddInvestigationAnalysisTldr1786600000000
+  implements MigrationInterface
+{
+  public name = "AddInvestigationAnalysisTldr1786600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AIRun" ADD "analysisTldr" character varying(500)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "AIRun" DROP COLUMN "analysisTldr"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786700000000-DropProjectCallSMSConfigCredentialUniques.ts

@@ -0,0 +1,76 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Drops the global UNIQUE constraints on ProjectCallSMSConfig's Twilio
+ * credentials. Generated with `npm run generate-postgres-migration` after
+ * flipping both columns to `unique: false`; the statements are the generator's,
+ * renumbered to sort last and given IF EXISTS (see below).
+ *
+ * WHY THEY WERE WRONG
+ *
+ * ProjectCallSMSConfig is tenant-scoped (@TenantColumn("projectId")) and
+ * inherently multi-row: a project has as many configs as it has Twilio
+ * setups. The constraints came from the InitialMigration, where this table's
+ * columns were modelled on GlobalConfig — a singleton table whose every column
+ * carries a pointless `unique: true`. On a singleton that is harmless. Here it
+ * meant no two rows anywhere in the instance could share a Twilio account.
+ *
+ * That is not a constraint anybody wants:
+ *
+ *   - One Twilio account, two numbers. Poland (and several other countries)
+ *     requires a Local number for Voice and a Mobile number for SMS, so a
+ *     single project legitimately needs two configs on one account. This is
+ *     what issue #3020 was reported against.
+ *   - Two projects, one account. On a shared instance the FIRST project to
+ *     save a given account SID locked every other project out of it, across
+ *     the tenant boundary — one tenant could deny another the use of its own
+ *     Twilio credentials, and neither could see why.
+ *
+ * Both surfaced the same way: Postgres raised unique_violation (23505),
+ * which is not a OneUptime Exception, so it fell through to the generic
+ * handler and reached the client as a bare 500 `{"error":"Server Error"}`
+ * with nothing to act on.
+ *
+ * NOT REPLACED WITH A NARROWER UNIQUE
+ *
+ * There is no uniqueness to restore at any scope. Reusing one account across
+ * configs is the supported case, not an accident to be guarded against. Config
+ * identity is `name`, which is already unique per project via
+ * @UniqueColumnBy("projectId"). After this migration ProjectCallSMSConfig has
+ * no UNIQUE constraint on any credential column, which matches every other
+ * tenant-scoped table: theirs are all on slugs, keys and tokens — identifiers
+ * that really are global.
+ *
+ * IF EXISTS
+ *
+ * Self-hosted operators hit by #3020 were told in the issue thread that the
+ * workaround is to drop the constraint by hand. IF EXISTS keeps this migration
+ * from failing on those databases. down() cannot be made safe the same way: it
+ * will fail if duplicates exist by then, which is correct — silently
+ * hard-deleting a project's Twilio config to make room for a constraint would
+ * be worse than a failed rollback.
+ */
+export class DropProjectCallSMSConfigCredentialUniques1786700000000
+  implements MigrationInterface
+{
+  public name: string =
+    "DropProjectCallSMSConfigCredentialUniques1786700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ProjectCallSMSConfig" DROP CONSTRAINT IF EXISTS "UQ_0886139eac04ad49627e446d477"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProjectCallSMSConfig" DROP CONSTRAINT IF EXISTS "UQ_2eb1a240d549a7701b6e82d2f94"`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ProjectCallSMSConfig" ADD CONSTRAINT "UQ_2eb1a240d549a7701b6e82d2f94" UNIQUE ("twilioAuthToken")`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProjectCallSMSConfig" ADD CONSTRAINT "UQ_0886139eac04ad49627e446d477" UNIQUE ("twilioAccountSID")`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -509,6 +509,12 @@ import { RestoreDroppedUniqueIndexes1786200000000 } from "./1786200000000-Restor
 import { QuarantineUnboundGitHubInstallations1786300000000 } from "./1786300000000-QuarantineUnboundGitHubInstallations";
 import { AddMasterPasswordSalt1786400000000 } from "./1786400000000-AddMasterPasswordSalt";
 import { AddInvestigationCodeFixRecommendation1786500000000 } from "./1786500000000-AddInvestigationCodeFixRecommendation";
+import { AddInvestigationAnalysisTldr1786600000000 } from "./1786600000000-AddInvestigationAnalysisTldr";
+import { DropProjectCallSMSConfigCredentialUniques1786700000000 } from "./1786700000000-DropProjectCallSMSConfigCredentialUniques";
+import { AddDataSourceTable1786303472848 } from "./1786303472848-AddDataSourceTable";
+import { MigrationName1786446545142 } from "./1786446545142-MigrationName";
+import { AddMonitorDependency1786449497966 } from "./1786449497966-AddMonitorDependency";
+import { AddDeletedProjectTable1786461136170 } from "./1786461136170-AddDeletedProjectTable";
 
 export default [
   InitialMigration,
@@ -1022,4 +1028,10 @@ export default [
   AddMasterPasswordSalt1786400000000,
   MigrationName1786105470826,
   AddInvestigationCodeFixRecommendation1786500000000,
+  AddInvestigationAnalysisTldr1786600000000,
+  DropProjectCallSMSConfigCredentialUniques1786700000000,
+  AddDataSourceTable1786303472848,
+  MigrationName1786446545142,
+  AddMonitorDependency1786449497966,
+  AddDeletedProjectTable1786461136170,
 ];

package/Server/Infrastructure/Queue.ts

@@ -560,6 +560,32 @@ export default class Queue {
     return waitingCount + activeCount + delayedCount;
   }
 
+  /*
+   * Backlog = jobs still waiting for a worker (waiting + delayed), for
+   * autoscaling signals. ACTIVE jobs are deliberately excluded: they are
+   * already being served, so to a scaler they are capacity, not demand.
+   * Telemetry jobs in particular sit in the active state for the fan-in
+   * writer's full flush window (up to TELEMETRY_FANIN_MAX_WAIT_MS) while
+   * awaiting their ClickHouse ack, so a fleet scaled on an active-inclusive
+   * count converges on pod count = job rate x ack latency — every new pod
+   * just parks more jobs without shortening the flush window. Scaling on
+   * waiting + delayed only breaks that feedback loop. getQueueSize above
+   * keeps the active-inclusive sum for ingest backpressure checks, where
+   * in-flight work genuinely counts against capacity.
+   */
+  @CaptureSpan()
+  public static async getQueueBacklogSize(
+    queueName: QueueName,
+  ): Promise<number> {
+    const queue: BullQueue = this.getQueue(queueName);
+    const [waitingCount, delayedCount]: [number, number] = await Promise.all([
+      queue.getWaitingCount(),
+      queue.getDelayedCount(),
+    ]);
+
+    return waitingCount + delayedCount;
+  }
+
   @CaptureSpan()
   public static async getQueueStats(queueName: QueueName): Promise<{
     waiting: number;

package/Server/Infrastructure/QueueWorker.ts

@@ -16,6 +16,7 @@ import Telemetry, {
 } from "../Utils/Telemetry";
 import Redis from "./Redis";
 import GracefulShutdown, { ShutdownPriority } from "../Utils/GracefulShutdown";
+import logger from "../Utils/Logger";
 
 export default class QueueWorker {
   @CaptureSpan()
@@ -120,6 +121,22 @@ export default class QueueWorker {
         : {}),
     });
 
+    /*
+     * Always log job failures to the container log, independent of telemetry
+     * configuration. Error visibility used to ride on @CaptureSpan's
+     * exception path, but the decorator is a passthrough when no span
+     * exporter is installed — without this listener a job that throws on
+     * such a deployment lands in the Redis failed set with no log line.
+     */
+    worker.on("failed", (job: QueueJob | undefined, error: Error) => {
+      logger.error(
+        `Queue job failed: ${queueName}/${job?.name || "unknown"} (job ${
+          job?.id ?? "unknown"
+        })`,
+      );
+      logger.error(error);
+    });
+
     /*
      * Stop pulling new jobs and let in-flight ones finish on shutdown. Runs in
      * the Workers tier — before datastores are drained — so jobs mid-flight can

package/Server/Middleware/TelemetryIngest.ts

@@ -73,16 +73,21 @@ export default class TelemetryIngest {
         );
 
       if (!projectId) {
+        /*
+         * The token value itself is deliberately NOT logged: ingestion
+         * keys are secrets, and a mistyped-but-nearly-valid token in a
+         * log line is a credential leak. The request attributes give
+         * operators enough to correlate with the sender.
+         */
         logger.error(
-          "Invalid service token: " + oneuptimeToken,
+          "Invalid service token.",
           getLogAttributesFromRequest(req as any),
         );
 
         /*
          * 401 is deliberate (see the missing-token branch above): a
          * silent 200 drops the payload while the client believes the
-         * export succeeded. The token value is logged server-side but
-         * intentionally not echoed back in the response body.
+         * export succeeded.
          */
         return Response.sendErrorResponse(
           req,

package/Server/Services/AIAgentService.ts

@@ -15,6 +15,7 @@ import AIAgentOwnerTeamService from "./AIAgentOwnerTeamService";
 import TeamMemberService from "./TeamMemberService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ProjectService from "./ProjectService";
+import FileService from "./FileService";
 import Dictionary from "../../Types/Dictionary";
 import OneUptimeDate from "../../Types/Date";
 import UserNotificationSettingService from "./UserNotificationSettingService";
@@ -174,6 +175,21 @@ export class Service extends DatabaseService<Model> {
     return { createBy: createBy, carryForward: [] };
   }
 
+  /*
+   * An AI agent icon is rendered by the id-based image route, which
+   * serves only public files. The file picker uploads it private, so
+   * attaching it to an agent is the point at which it becomes public.
+   */
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    await FileService.makeFilePublic(createdItem.iconFileId);
+
+    return createdItem;
+  }
+
   @CaptureSpan()
   public async getOwners(aiAgentId: ObjectID): Promise<Array<User>> {
     if (!aiAgentId) {
@@ -339,6 +355,10 @@ export class Service extends DatabaseService<Model> {
     onUpdate: OnUpdate<Model>,
     _updatedItemIds: Array<ObjectID>,
   ): Promise<OnUpdate<Model>> {
+    await FileService.makeFilePublic(
+      onUpdate.updateBy.data.iconFileId as ObjectID | undefined,
+    );
+
     if (
       onUpdate.carryForward &&
       onUpdate.carryForward.aiAgentsToNotifyOwners.length > 0