@oneuptime/common 12.0.6 → 12.0.7

package/Models/DatabaseModels/Monitor.ts

@@ -479,6 +479,117 @@ export default class Monitor extends BaseModel {
   })
   public labels?: Array<Label> = undefined;
 
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.MonitorAdmin,
+      Permission.MonitorMember,
+      Permission.CreateProjectMonitor,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.MonitorAdmin,
+      Permission.MonitorMember,
+      Permission.MonitorViewer,
+      Permission.ReadProjectMonitor,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.MonitorAdmin,
+      Permission.MonitorMember,
+      Permission.EditProjectMonitor,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: Monitor,
+    title: "Depends On Monitors",
+    description:
+      "Parent monitors this monitor depends on. When a parent is offline (or in one of the configured suppression statuses), alerts and incidents from this monitor are suppressed at creation time — the monitor keeps evaluating and its status timeline still updates.",
+  })
+  @ManyToMany(
+    () => {
+      return Monitor;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "MonitorDependency",
+    inverseJoinColumn: {
+      name: "dependsOnMonitorId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "monitorId",
+      referencedColumnName: "_id",
+    },
+  })
+  public dependsOnMonitors?: Array<Monitor> = undefined;
+
+  @ColumnAccessControl({
+    create: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.MonitorAdmin,
+      Permission.MonitorMember,
+      Permission.CreateProjectMonitor,
+    ],
+    read: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.Viewer,
+      Permission.MonitorAdmin,
+      Permission.MonitorMember,
+      Permission.MonitorViewer,
+      Permission.ReadProjectMonitor,
+    ],
+    update: [
+      Permission.ProjectOwner,
+      Permission.ProjectAdmin,
+      Permission.ProjectMember,
+      Permission.MonitorAdmin,
+      Permission.MonitorMember,
+      Permission.EditProjectMonitor,
+    ],
+  })
+  @TableColumn({
+    required: false,
+    type: TableColumnType.EntityArray,
+    modelType: MonitorStatus,
+    title: "Suppress Alerts When Parent Monitor Status Is",
+    description:
+      "Parent monitor statuses that suppress this monitor's alerts and incidents. When empty, statuses flagged as offline suppress (the default). Only used when Depends On Monitors is set.",
+  })
+  @ManyToMany(
+    () => {
+      return MonitorStatus;
+    },
+    { eager: false },
+  )
+  @JoinTable({
+    name: "MonitorDependencySuppressionStatus",
+    inverseJoinColumn: {
+      name: "monitorStatusId",
+      referencedColumnName: "_id",
+    },
+    joinColumn: {
+      name: "monitorId",
+      referencedColumnName: "_id",
+    },
+  })
+  public suppressAlertsWhenParentMonitorStatuses?: Array<MonitorStatus> =
+    undefined;
+
   @ColumnAccessControl({
     create: [
       Permission.ProjectOwner,

package/Models/DatabaseModels/Project.ts

@@ -1654,7 +1654,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Boolean,
     title: "Enable Automatic Incident Code Fixes",
     description:
-      "When enabled, an incident AI investigation that ends with a confident, evidenced root cause analysis and recommends a repository code change automatically queues an AI agent task that opens a draft fix pull request from that analysis — the automatic form of the 'Open Fix PR from this analysis' button. Operational, infrastructure, external, user-error and inconclusive findings do not offer or open code-fix pull requests. Requires a repository connected through the GitHub App and a Runner with the code-fix capability. Pull requests are always human-reviewed — nothing merges automatically.",
+      "When enabled, an incident AI investigation that ends with a confident, evidenced root cause analysis and recommends a repository code change automatically queues an AI agent task that opens a fix pull request, ready for review, from that analysis — the automatic form of the 'Open Fix PR from this analysis' button. Operational, infrastructure, external, user-error and inconclusive findings do not offer or open code-fix pull requests. Requires a repository connected through the GitHub App and a Runner with the code-fix capability. Pull requests are always human-reviewed — nothing merges automatically.",
     defaultValue: false,
     example: true,
   })
@@ -1684,7 +1684,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Boolean,
     title: "Enable Automatic Alert Code Fixes",
     description:
-      "When enabled, an alert AI investigation that ends with a confident, evidenced root cause analysis and recommends a repository code change automatically queues an AI agent task that opens a draft fix pull request from that analysis — the automatic form of the 'Open Fix PR from this analysis' button. Operational, infrastructure, external, user-error and inconclusive findings do not offer or open code-fix pull requests. Requires a repository connected through the GitHub App and a Runner with the code-fix capability. Pull requests are always human-reviewed — nothing merges automatically.",
+      "When enabled, an alert AI investigation that ends with a confident, evidenced root cause analysis and recommends a repository code change automatically queues an AI agent task that opens a fix pull request, ready for review, from that analysis — the automatic form of the 'Open Fix PR from this analysis' button. Operational, infrastructure, external, user-error and inconclusive findings do not offer or open code-fix pull requests. Requires a repository connected through the GitHub App and a Runner with the code-fix capability. Pull requests are always human-reviewed — nothing merges automatically.",
     defaultValue: false,
     example: true,
   })
@@ -1744,7 +1744,7 @@ export default class Project extends TenantModel {
     type: TableColumnType.Boolean,
     title: "Enable Insight Fix Tasks",
     description:
-      "When enabled, insights whose deterministic evidence points at code (new or spiking exceptions with a resolvable repository, trace-latency regressions with span-tree findings) automatically queue an AI agent task that opens a draft pull request with a proposed fix. Honors the daily fix task budget and per-repository open-PR caps. Pull requests are always human-reviewed — nothing merges automatically.",
+      "When enabled, insights whose deterministic evidence points at code (new or spiking exceptions with a resolvable repository, trace-latency regressions with span-tree findings) automatically queue an AI agent task that opens a pull request with a proposed fix, ready for review. Honors the daily fix task budget and per-repository open-PR caps. Pull requests are always human-reviewed — nothing merges automatically.",
     defaultValue: false,
     example: true,
   })

package/Models/DatabaseModels/WorkspaceProjectAuthToken.ts

@@ -36,6 +36,23 @@ export interface MicrosoftTeamsChat {
   addedAt?: string | undefined;
 }
 
+/*
+ * A team the OneUptime app has actually been installed into, captured from the
+ * bot's install / conversationUpdate events.
+ *
+ * Graph can list every team in the tenant with app-only permissions, but the
+ * Bot Framework will only accept a proactive post into a team the app is a
+ * roster member of. Listing a team is therefore NOT evidence that we can post
+ * to it — this record is, which is why channel sends check it before calling
+ * the Bot Framework.
+ */
+export interface MicrosoftTeamsInstalledTeam {
+  id: string; // Teams team (group) id.
+  name?: string | undefined;
+  serviceUrl?: string | undefined; // Bot Framework service URL captured on install. Required for GCC/DoD.
+  addedAt?: string | undefined;
+}
+
 export interface SlackMiscData extends MiscData {
   teamId: string;
   teamName: string;
@@ -59,9 +76,10 @@ export interface MicrosoftTeamsMiscData extends MiscData {
   lastAppTokenIssuedAt?: string;
   adminConsentGrantedAt?: string;
   adminConsentGrantedBy?: string;
-  availableTeams?: Record<string, MicrosoftTeamsTeam>;
+  availableTeams?: Record<string, MicrosoftTeamsTeam>; // keyed by team id. Every team Graph can see in the tenant.
   appAccessTokenExpiresAt?: string;
   availableChats?: Record<string, MicrosoftTeamsChat>; // keyed by chat id. Chats the OneUptime app has been added to.
+  installedTeams?: Record<string, MicrosoftTeamsInstalledTeam>; // keyed by team id. Teams the OneUptime app has been added to.
 }
 
 export type WorkspaceMiscData = SlackMiscData | MicrosoftTeamsMiscData;

package/Server/API/FileAPI.ts

@@ -32,6 +32,17 @@ const isAuthenticatedRequest: (req: ExpressRequest) => boolean = (
   }
 };
 
+/*
+ * isPublic is a real boolean column, but this stays deliberately strict.
+ * It was created as a varchar, so every row held the STRING 'true'/'false'
+ * — and 'false' is truthy, which silently disabled both gates below. Treat
+ * anything that is not exactly `true` as private so a loose value can never
+ * re-open them.
+ */
+const isFilePublic: (file: File) => boolean = (file: File): boolean => {
+  return (file.isPublic as unknown) === true;
+};
+
 export default class FileAPI extends BaseAPI<File, FileServiceType> {
   public constructor() {
     super(File, FileService);
@@ -74,6 +85,7 @@ export default class FileAPI extends BaseAPI<File, FileServiceType> {
             file: true,
             fileType: true,
             isPublic: true,
+            name: true,
           },
         });
 
@@ -85,7 +97,7 @@ export default class FileAPI extends BaseAPI<File, FileServiceType> {
           );
         }
 
-        if (!file.isPublic && !isAuthenticatedRequest(req)) {
+        if (!isFilePublic(file) && !isAuthenticatedRequest(req)) {
           return Response.sendErrorResponse(
             req,
             res,
@@ -120,10 +132,11 @@ export default class FileAPI extends BaseAPI<File, FileServiceType> {
             file: true,
             fileType: true,
             isPublic: true,
+            name: true,
           },
         });
 
-        if (!file || !file.file || !file.fileType || !file.isPublic) {
+        if (!file || !file.file || !file.fileType || !isFilePublic(file)) {
           return Response.sendErrorResponse(
             req,
             res,

package/Server/API/MicrosoftTeamsAPI.ts

@@ -799,7 +799,12 @@ export default class MicrosoftTeamsAPI {
                     id: t["id"] as string,
                     name: (t["displayName"] as string) || "Unnamed Team",
                   };
-                  acc[team.name] = team;
+                  /*
+                   * Keyed by id, not display name — Teams allows duplicate
+                   * team names, and keying by name silently collapsed them so
+                   * only the last one of each name was selectable.
+                   */
+                  acc[team.id] = team;
                   return acc;
                 },
                 {} as Record<string, MicrosoftTeamsTeam>,

package/Server/API/ProjectAPI.ts

@@ -3,6 +3,7 @@ import MasterAdminAuthorization from "../Middleware/MasterAdminAuthorization";
 import UserMiddleware from "../Middleware/UserAuthorization";
 import ProjectService, {
   ProjectService as ProjectServiceType,
+  ProjectBalanceAdjustmentResult,
 } from "../Services/ProjectService";
 import ResellerService from "../Services/ResellerService";
 import TeamMemberService from "../Services/TeamMemberService";
@@ -17,6 +18,7 @@ import {
 import JSONWebToken from "../Utils/JsonWebToken";
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
 import BillingService from "../Services/BillingService";
 import Errors from "../Utils/Errors";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
@@ -28,9 +30,17 @@ import TeamMember from "../../Models/DatabaseModels/TeamMember";
 import BadDataException from "../../Types/Exception/BadDataException";
 import OneUptimeDate from "../../Types/Date";
 import Permission, { UserPermission } from "../../Types/Permission";
+import ProjectBalanceType from "../../Types/Billing/ProjectBalanceType";
+import BalanceAdjustmentType from "../../Types/Billing/BalanceAdjustmentType";
 import ObjectID from "../../Types/ObjectID";
 import { JSONObject, JSONValue } from "../../Types/JSON";
 
+/*
+ * The reason is free text a customer types into the delete confirmation. The
+ * column is unbounded text, so the cap is here.
+ */
+export const MAX_DELETION_REASON_LENGTH: number = 5000;
+
 export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
   public constructor() {
     super(Project, ProjectService);
@@ -137,6 +147,76 @@ export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
       },
     );
 
+    /*
+     * Deletes a project, carrying the reason the customer gave for deleting it.
+     * The plain DELETE /project/:id route still works and still records the
+     * deletion - this one exists only because a DELETE has nowhere to put the
+     * answer to "why are you deleting this project?".
+     *
+     * The delete itself goes through deleteOneById with the caller's own props,
+     * so ModelPermission enforces ProjectOwner / DeleteProject exactly as it
+     * does on the plain route.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:id/delete-project`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const idParam: string = req.params["id"] as string;
+          ObjectID.validateUUID(idParam);
+          const projectId: ObjectID = new ObjectID(idParam);
+
+          /*
+           * Same guard as change-plan: permissions are resolved for the
+           * authenticated tenant, so the project in the URL has to be that
+           * tenant or permissions on one project would authorize deleting
+           * another.
+           */
+          const tenantId: ObjectID | null = this.getTenantId(req);
+
+          if (!tenantId || tenantId.toString() !== projectId.toString()) {
+            throw new BadDataException(
+              "Project ID in the URL does not match the project the request is authenticated for",
+            );
+          }
+
+          const body: JSONObject = (req.body as JSONObject) || {};
+          const data: JSONObject = (body["data"] as JSONObject) || {};
+          const deletionReasonValue: JSONValue = data["deletionReason"];
+
+          let deletionReason: string | undefined = undefined;
+
+          if (typeof deletionReasonValue === "string") {
+            /*
+             * Free text from a form field. Bound what a client can store, and
+             * drop NUL bytes: Postgres rejects them in a text column, and the
+             * write that fails here is the audit record of a project that has
+             * already been deleted - there is no second chance at it.
+             */
+            const cleaned: string = deletionReasonValue
+              // eslint-disable-next-line no-control-regex
+              .replace(/\u0000/g, "")
+              .trim()
+              .substring(0, MAX_DELETION_REASON_LENGTH);
+
+            if (cleaned) {
+              deletionReason = cleaned;
+            }
+          }
+
+          await ProjectService.deleteOneById({
+            id: projectId,
+            deletionReason: deletionReason,
+            props: await CommonAPI.getDatabaseCommonInteractionProps(req),
+          });
+
+          return Response.sendEmptySuccessResponse(req, res);
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
     /*
      * Extends a project's trial. Master-admin only: this hands out free
      * service and moves the customer's next invoice, so it is deliberately not
@@ -212,6 +292,140 @@ export default class ProjectAPI extends BaseAPI<Project, ProjectServiceType> {
       },
     );
 
+    /*
+     * Manually corrects a project's SMS/Call or AI balance. Master-admin only,
+     * for the same reason extend-trial is: it hands out (or claws back) paid
+     * service with no payment behind it, so project-level billing permissions
+     * must not reach it - only OneUptime staff acting from the Admin
+     * Dashboard.
+     */
+    this.router.put(
+      `${new this.entityType().getCrudApiPath()?.toString()}/:id/adjust-balance`,
+      MasterAdminAuthorization.isAuthorizedMasterAdminMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          if (!IsBillingEnabled) {
+            throw new BadDataException(
+              "Billing is not enabled for this server",
+            );
+          }
+
+          const projectId: ObjectID = new ObjectID(req.params["id"] as string);
+
+          const body: JSONObject = (req.body as JSONObject) || {};
+          const data: JSONObject = (body["data"] as JSONObject) || {};
+
+          const balanceTypeValue: JSONValue = data["balanceType"];
+          const adjustmentTypeValue: JSONValue = data["adjustmentType"];
+          const amountInUSDValue: JSONValue = data["amountInUSD"];
+          const reasonValue: JSONValue = data["reason"];
+
+          if (
+            !balanceTypeValue ||
+            typeof balanceTypeValue !== "string" ||
+            !Object.values(ProjectBalanceType).includes(
+              balanceTypeValue as ProjectBalanceType,
+            )
+          ) {
+            throw new BadDataException(
+              `Balance type must be one of: ${Object.values(
+                ProjectBalanceType,
+              ).join(", ")}`,
+            );
+          }
+
+          if (
+            !adjustmentTypeValue ||
+            typeof adjustmentTypeValue !== "string" ||
+            !Object.values(BalanceAdjustmentType).includes(
+              adjustmentTypeValue as BalanceAdjustmentType,
+            )
+          ) {
+            throw new BadDataException(
+              `Adjustment type must be one of: ${Object.values(
+                BalanceAdjustmentType,
+              ).join(", ")}`,
+            );
+          }
+
+          /*
+           * The form posts dollars because that is what staff think in, but
+           * the column is cents. A JSON body can carry a numeric string, so
+           * accept both and reject anything that does not parse - Number("")
+           * and Number([]) are 0, which would otherwise read as a real
+           * "set to zero" instruction.
+           */
+          if (
+            typeof amountInUSDValue !== "number" &&
+            typeof amountInUSDValue !== "string"
+          ) {
+            throw new BadDataException("Amount is not a valid number");
+          }
+
+          const amountInUSD: number =
+            typeof amountInUSDValue === "number"
+              ? amountInUSDValue
+              : Number(amountInUSDValue.trim());
+
+          if (
+            !Number.isFinite(amountInUSD) ||
+            (typeof amountInUSDValue === "string" &&
+              amountInUSDValue.trim() === "")
+          ) {
+            throw new BadDataException("Amount is not a valid number");
+          }
+
+          if (typeof reasonValue !== "string" || !reasonValue.trim()) {
+            throw new BadDataException(
+              "A reason is required to adjust the balance",
+            );
+          }
+
+          /*
+           * Dollars carry at most two decimal places, and floating point
+           * multiplication does not (20.15 * 100 is 2014.9999...). Round to
+           * the nearest cent so the stored amount is the one that was typed.
+           */
+          const amountInUSDCents: number = Math.round(amountInUSD * 100);
+
+          /*
+           * The master admin middleware verifies the token but does not put
+           * the decoded payload on the request, so read it again here - who
+           * moved the balance is the only audit trail this action has.
+           */
+          let adjustedByUserId: ObjectID | undefined = undefined;
+
+          try {
+            const accessToken: string | undefined =
+              UserMiddleware.getAccessTokenFromExpressRequest(req);
+
+            if (accessToken) {
+              adjustedByUserId = JSONWebToken.decode(accessToken).userId;
+            }
+          } catch {
+            // Only used for the log line - never block the adjustment on it.
+          }
+
+          const result: ProjectBalanceAdjustmentResult =
+            await ProjectService.adjustBalance({
+              projectId: projectId,
+              balanceType: balanceTypeValue as ProjectBalanceType,
+              adjustmentType: adjustmentTypeValue as BalanceAdjustmentType,
+              amountInUSDCents: amountInUSDCents,
+              reason: reasonValue,
+              adjustedByUserId: adjustedByUserId,
+            });
+
+          return Response.sendJsonObjectResponse(req, res, {
+            previousBalanceInUSDCents: result.previousBalanceInUSDCents,
+            newBalanceInUSDCents: result.newBalanceInUSDCents,
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
     /*
      * This API lists all the projects where user is its team member.
      * This API is usually used to show project selector dropdown in the UI

package/Server/API/StatusPageAPI.ts

@@ -113,6 +113,23 @@ import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
 } from "../Services/StatusPageSubscriberNotificationTemplateService";
 
+type EscapeXmlFunction = (text: string) => string;
+
+/*
+ * The status badge is hand-built SVG served as image/svg+xml, and SVG is a
+ * document - anything interpolated into it is markup, not text. A monitor
+ * status named `</text><script>...` would otherwise run on the status page
+ * origin for anyone who opens the badge URL directly.
+ */
+const escapeXml: EscapeXmlFunction = (text: string): string => {
+  return text
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+};
+
 type ResolveStatusPageIdOrThrowFunction = (
   statusPageIdOrDomain: string,
 ) => Promise<ObjectID>;
@@ -531,9 +548,12 @@ export default class StatusPageAPI extends BaseAPI<
             });
 
           // Generate SVG badge
-          const statusName: string = overallStatus?.name || "Unknown";
-          const statusColor: string =
-            overallStatus?.color?.toString() || "#808080";
+          const statusName: string = escapeXml(
+            overallStatus?.name || "Unknown",
+          );
+          const statusColor: string = escapeXml(
+            overallStatus?.color?.toString() || "#808080",
+          );
 
           const svg: string = `<svg xmlns="http://www.w3.org/2000/svg" width="150" height="20">
   <linearGradient id="b" x2="0" y2="100%">
@@ -558,6 +578,17 @@ export default class StatusPageAPI extends BaseAPI<
 
           res.setHeader("Content-Type", "image/svg+xml");
           res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
+          /*
+           * The badge is only ever loaded through <img>, which ignores both of
+           * these. They exist for the case where someone opens the badge URL
+           * as a top-level document, where the SVG would otherwise be a
+           * scriptable document on this origin.
+           */
+          res.setHeader("X-Content-Type-Options", "nosniff");
+          res.setHeader(
+            "Content-Security-Policy",
+            "sandbox; script-src 'none'; object-src 'none'",
+          );
           return res.send(svg);
         } catch (err) {
           logger.error(err, getLogAttributesFromRequest(req as any));
@@ -786,9 +817,11 @@ export default class StatusPageAPI extends BaseAPI<
       UserMiddleware.getUserMiddleware,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
-          const objectId: ObjectID = new ObjectID(
-            req.params["statusPageId"] as string,
-          );
+          const statusPageIdParam: string = req.params[
+            "statusPageId"
+          ] as string;
+          ObjectID.validateUUID(statusPageIdParam);
+          const objectId: ObjectID = new ObjectID(statusPageIdParam);
 
           const select: Select<StatusPage> = {
             _id: true,

package/Server/Infrastructure/Postgres/SchemaMigrations/1786446545142-MigrationName.ts

@@ -0,0 +1,50 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class MigrationName1786446545142 implements MigrationInterface {
+  public name = "MigrationName1786446545142";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * "File"."isPublic" backs a `boolean` field but was created as varchar,
+     * so every row holds the STRING 'true'/'false' and every server-side
+     * `!file.isPublic` gate was inert — 'false' is truthy in JS.
+     *
+     * Convert in place. TypeORM generates a DROP COLUMN + ADD COLUMN for
+     * this change, which would discard every stored value and re-default
+     * the whole table to public — the exact opposite of the fix.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" DROP DEFAULT`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" TYPE boolean USING (lower("isPublic") IN ('true', 't', 'yes', 'y', '1'))`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" SET DEFAULT true`,
+    );
+
+    /*
+     * Probe and AI agent icons are the only consumers of the id-based
+     * image route, which serves public files only. Both upload through the
+     * file picker, which marks uploads private, so every icon attached
+     * before this migration would 404 once the gate starts working.
+     * ProbeService/AIAgentService now flip the icon public on attach; this
+     * backfills the rows attached before that hook existed.
+     */
+    await queryRunner.query(
+      `UPDATE "File" SET "isPublic" = true WHERE "_id" IN (SELECT "iconFileId" FROM "Probe" WHERE "iconFileId" IS NOT NULL UNION SELECT "iconFileId" FROM "AIAgent" WHERE "iconFileId" IS NOT NULL)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" DROP DEFAULT`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" TYPE character varying(100) USING (CASE WHEN "isPublic" THEN 'true' ELSE 'false' END)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "File" ALTER COLUMN "isPublic" SET DEFAULT true`,
+    );
+  }
+}