@oneuptime/common 12.0.6 → 12.0.7

package/Server/Infrastructure/Postgres/SchemaMigrations/1786449497966-AddMonitorDependency.ts

@@ -0,0 +1,67 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddMonitorDependency1786449497966 implements MigrationInterface {
+  public name = "AddMonitorDependency1786449497966";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "MonitorDependency" ("monitorId" uuid NOT NULL, "dependsOnMonitorId" uuid NOT NULL, CONSTRAINT "PK_26790391f134c5a87b2aa70a902" PRIMARY KEY ("monitorId", "dependsOnMonitorId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_953533a93dba2f345283474c60" ON "MonitorDependency" ("monitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_43f849731e1bda0ada73b3d887" ON "MonitorDependency" ("dependsOnMonitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "MonitorDependencySuppressionStatus" ("monitorId" uuid NOT NULL, "monitorStatusId" uuid NOT NULL, CONSTRAINT "PK_2889f58c301e8a07d46dd82382c" PRIMARY KEY ("monitorId", "monitorStatusId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_747378c59669e4639c4209adc7" ON "MonitorDependencySuppressionStatus" ("monitorId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_354bf0c679a6dfd64910eb6441" ON "MonitorDependencySuppressionStatus" ("monitorStatusId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" ADD CONSTRAINT "FK_953533a93dba2f345283474c60f" FOREIGN KEY ("monitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" ADD CONSTRAINT "FK_43f849731e1bda0ada73b3d8874" FOREIGN KEY ("dependsOnMonitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" ADD CONSTRAINT "FK_747378c59669e4639c4209adc78" FOREIGN KEY ("monitorId") REFERENCES "Monitor"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" ADD CONSTRAINT "FK_354bf0c679a6dfd64910eb64418" FOREIGN KEY ("monitorStatusId") REFERENCES "MonitorStatus"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" DROP CONSTRAINT "FK_354bf0c679a6dfd64910eb64418"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependencySuppressionStatus" DROP CONSTRAINT "FK_747378c59669e4639c4209adc78"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" DROP CONSTRAINT "FK_43f849731e1bda0ada73b3d8874"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "MonitorDependency" DROP CONSTRAINT "FK_953533a93dba2f345283474c60f"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_354bf0c679a6dfd64910eb6441"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_747378c59669e4639c4209adc7"`,
+    );
+    await queryRunner.query(`DROP TABLE "MonitorDependencySuppressionStatus"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_43f849731e1bda0ada73b3d887"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_953533a93dba2f345283474c60"`,
+    );
+    await queryRunner.query(`DROP TABLE "MonitorDependency"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1786461136170-AddDeletedProjectTable.ts

@@ -0,0 +1,39 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddDeletedProjectTable1786461136170 implements MigrationInterface {
+  public name: string = "AddDeletedProjectTable1786461136170";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "DeletedProject" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "projectName" character varying(100) NOT NULL, "projectSlug" character varying(100), "projectCreatedAt" TIMESTAMP WITH TIME ZONE, "projectDeletedAt" TIMESTAMP WITH TIME ZONE NOT NULL, "deletionReason" text, "projectDeletedByUserId" uuid, "projectDeletedByUserName" character varying(50), "projectDeletedByUserEmail" character varying(100), "projectCreatedByUserId" uuid, "projectCreatedByUserName" character varying(50), "projectCreatedByUserEmail" character varying(100), "companyName" character varying(100), "companyPhoneNumber" character varying(30), "companySize" character varying(100), "jobRole" character varying(100), "planName" character varying(100), "paymentProviderPlanId" character varying(100), "paymentProviderCustomerId" character varying(100), "paymentProviderSubscriptionId" character varying(100), "paymentProviderSubscriptionStatus" character varying(100), "paymentProviderSubscriptionSeats" integer, "trialEndsAt" TIMESTAMP WITH TIME ZONE, "activeMonitorCount" integer, "wasProjectBlocked" boolean, CONSTRAINT "PK_bd397da7b51a8649b38c3c8b272" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "idx_deleted_project_project_id" ON "DeletedProject" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "idx_deleted_project_project_deleted_at" ON "DeletedProject" ("projectDeletedAt") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" ADD CONSTRAINT "FK_bb76f7ebe3ee418ffd79346f203" FOREIGN KEY ("projectDeletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" ADD CONSTRAINT "FK_084492367421031e80cd0fdbf1e" FOREIGN KEY ("projectCreatedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" DROP CONSTRAINT "FK_084492367421031e80cd0fdbf1e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "DeletedProject" DROP CONSTRAINT "FK_bb76f7ebe3ee418ffd79346f203"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."idx_deleted_project_project_deleted_at"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."idx_deleted_project_project_id"`,
+    );
+    await queryRunner.query(`DROP TABLE "DeletedProject"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -512,6 +512,9 @@ import { AddInvestigationCodeFixRecommendation1786500000000 } from "./1786500000
 import { AddInvestigationAnalysisTldr1786600000000 } from "./1786600000000-AddInvestigationAnalysisTldr";
 import { DropProjectCallSMSConfigCredentialUniques1786700000000 } from "./1786700000000-DropProjectCallSMSConfigCredentialUniques";
 import { AddDataSourceTable1786303472848 } from "./1786303472848-AddDataSourceTable";
+import { MigrationName1786446545142 } from "./1786446545142-MigrationName";
+import { AddMonitorDependency1786449497966 } from "./1786449497966-AddMonitorDependency";
+import { AddDeletedProjectTable1786461136170 } from "./1786461136170-AddDeletedProjectTable";
 
 export default [
   InitialMigration,
@@ -1028,4 +1031,7 @@ export default [
   AddInvestigationAnalysisTldr1786600000000,
   DropProjectCallSMSConfigCredentialUniques1786700000000,
   AddDataSourceTable1786303472848,
+  MigrationName1786446545142,
+  AddMonitorDependency1786449497966,
+  AddDeletedProjectTable1786461136170,
 ];

package/Server/Services/AIAgentService.ts

@@ -15,6 +15,7 @@ import AIAgentOwnerTeamService from "./AIAgentOwnerTeamService";
 import TeamMemberService from "./TeamMemberService";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ProjectService from "./ProjectService";
+import FileService from "./FileService";
 import Dictionary from "../../Types/Dictionary";
 import OneUptimeDate from "../../Types/Date";
 import UserNotificationSettingService from "./UserNotificationSettingService";
@@ -174,6 +175,21 @@ export class Service extends DatabaseService<Model> {
     return { createBy: createBy, carryForward: [] };
   }
 
+  /*
+   * An AI agent icon is rendered by the id-based image route, which
+   * serves only public files. The file picker uploads it private, so
+   * attaching it to an agent is the point at which it becomes public.
+   */
+  @CaptureSpan()
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<Model>,
+    createdItem: Model,
+  ): Promise<Model> {
+    await FileService.makeFilePublic(createdItem.iconFileId);
+
+    return createdItem;
+  }
+
   @CaptureSpan()
   public async getOwners(aiAgentId: ObjectID): Promise<Array<User>> {
     if (!aiAgentId) {
@@ -339,6 +355,10 @@ export class Service extends DatabaseService<Model> {
     onUpdate: OnUpdate<Model>,
     _updatedItemIds: Array<ObjectID>,
   ): Promise<OnUpdate<Model>> {
+    await FileService.makeFilePublic(
+      onUpdate.updateBy.data.iconFileId as ObjectID | undefined,
+    );
+
     if (
       onUpdate.carryForward &&
       onUpdate.carryForward.aiAgentsToNotifyOwners.length > 0

package/Server/Services/DashboardDomainService.ts

@@ -1,18 +1,17 @@
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import GreenlockUtil from "../Utils/Greenlock/Greenlock";
 import logger, { LogAttributes } from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import DomainService from "./DomainService";
 import HTTPErrorResponse from "../../Types/API/HTTPErrorResponse";
 import HTTPResponse from "../../Types/API/HTTPResponse";
-import URL from "../../Types/API/URL";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import { JSONObject } from "../../Types/JSON";
 import ObjectID from "../../Types/ObjectID";
-import API from "../../Utils/API";
 import AcmeCertificate from "../../Models/DatabaseModels/AcmeCertificate";
 import DomainModel from "../../Models/DatabaseModels/Domain";
 import DashboardDomain from "../../Models/DatabaseModels/DashboardDomain";
@@ -22,11 +21,60 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import { DashboardCNameRecord } from "../EnvironmentConfig";
 import Domain from "../Types/Domain";
 
+const DASHBOARD_DOMAIN_EGRESS_LABEL: string = "Dashboard domain";
+
 export class Service extends DatabaseService<DashboardDomain> {
   public constructor() {
     super(DashboardDomain);
   }
 
+  /*
+   * Normalize a submitted subdomain and reject anything that is not a plain
+   * DNS label chain.
+   *
+   * fullDomain is built as `${subdomain}.${baseDomain}` and then interpolated
+   * into "https://" + fullDomain + "/dashboard-api/..." — and URL parsing
+   * treats everything before the first "/" as the host. Without this check a
+   * subdomain of "169.254.169.254/latest/meta-data/#" hands an attacker the
+   * host, the port and the path of a request the certificate cron then makes
+   * unattended, every 15 minutes, from inside the cluster.
+   */
+  private static normalizeAndValidateSubdomain(
+    subdomain: string | undefined,
+  ): string {
+    const normalized: string = subdomain?.trim().toLowerCase() || "";
+
+    // "@" is the documented way to ask for the root domain.
+    if (normalized === "" || normalized === "@") {
+      return "";
+    }
+
+    if (!Domain.isValidSubdomain(normalized)) {
+      throw new BadDataException(
+        `Subdomain ${normalized} is not valid. Use a plain subdomain such as "dashboard" — schemes, ports, paths and "/" are not allowed.`,
+      );
+    }
+
+    return normalized;
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<DashboardDomain>,
+  ): Promise<OnUpdate<DashboardDomain>> {
+    /*
+     * Create-time validation alone leaves the value editable afterwards —
+     * subdomain is ProjectMember-updatable.
+     */
+    if (updateBy.data.subdomain !== undefined) {
+      updateBy.data.subdomain = Service.normalizeAndValidateSubdomain(
+        updateBy.data.subdomain as string,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<DashboardDomain>,
@@ -48,14 +96,11 @@ export class Service extends DatabaseService<DashboardDomain> {
       );
     }
 
-    let normalizedSubdomain: string =
-      createBy.data.subdomain?.trim().toLowerCase() || "";
-
-    if (normalizedSubdomain === "@") {
-      normalizedSubdomain = "";
-    }
+    createBy.data.subdomain = Service.normalizeAndValidateSubdomain(
+      createBy.data.subdomain,
+    );
 
-    createBy.data.subdomain = normalizedSubdomain;
+    const normalizedSubdomain: string = createBy.data.subdomain;
 
     if (domain) {
       const baseDomain: string =
@@ -230,13 +275,13 @@ export class Service extends DatabaseService<DashboardDomain> {
   ): Promise<boolean> {
     try {
       const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
-        await API.get({
-          url: URL.fromString(
+        await Domain.getForDomainVerification({
+          url:
             "https://" +
-              fulldomain +
-              "/dashboard-api/cname-verification/" +
-              token,
-          ),
+            fulldomain +
+            "/dashboard-api/cname-verification/" +
+            token,
+          targetLabel: DASHBOARD_DOMAIN_EGRESS_LABEL,
         });
 
       if (result.isFailure()) {
@@ -317,13 +362,13 @@ export class Service extends DatabaseService<DashboardDomain> {
 
       try {
         const result: HTTPErrorResponse | HTTPResponse<JSONObject> =
-          await API.get({
-            url: URL.fromString(
+          await Domain.getForDomainVerification({
+            url:
               "http://" +
-                fullDomain +
-                "/dashboard-api/cname-verification/" +
-                token,
-            ),
+              fullDomain +
+              "/dashboard-api/cname-verification/" +
+              token,
+            targetLabel: DASHBOARD_DOMAIN_EGRESS_LABEL,
           });
 
         logger.debug("CNAME verification result", {
@@ -348,13 +393,13 @@ export class Service extends DatabaseService<DashboardDomain> {
 
       try {
         const resultHttps: HTTPErrorResponse | HTTPResponse<JSONObject> =
-          await API.get({
-            url: URL.fromString(
+          await Domain.getForDomainVerification({
+            url:
               "https://" +
-                fullDomain +
-                "/dashboard-api/cname-verification/" +
-                token,
-            ),
+              fullDomain +
+              "/dashboard-api/cname-verification/" +
+              token,
+            targetLabel: DASHBOARD_DOMAIN_EGRESS_LABEL,
           });
 
         logger.debug("CNAME verification result for https", {

package/Server/Services/DatabaseService.ts

@@ -1489,6 +1489,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         _id: deleteById.id.toString(),
       } as any,
       deletedByUser: deleteById.deletedByUser,
+      deletionReason: deleteById.deletionReason,
       props: deleteById.props,
     });
   }

package/Server/Services/DeletedProjectService.ts

@@ -0,0 +1,138 @@
+import { IsBillingEnabled } from "../EnvironmentConfig";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import DatabaseService from "./DatabaseService";
+import UserService from "./UserService";
+import Model from "../../Models/DatabaseModels/DeletedProject";
+import Project from "../../Models/DatabaseModels/Project";
+import User from "../../Models/DatabaseModels/User";
+import OneUptimeDate from "../../Types/Date";
+import ObjectID from "../../Types/ObjectID";
+import Phone from "../../Types/Phone";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  /*
+   * Records a project that has just been deleted so the team can follow up with
+   * the customer. The project row is already gone by the time this runs, so
+   * everything written here has to come from the snapshot the caller took
+   * before the delete (ProjectService.onBeforeDelete).
+   *
+   * SaaS only. Self-hosted installs have no one to reach out to, and the
+   * gate lives here rather than at the call site so every caller gets it.
+   *
+   * Returns the row it wrote, or null when logging was skipped.
+   */
+  @CaptureSpan()
+  public async logProjectDeletion(data: {
+    project: Project;
+    deletedByUserId?: ObjectID | undefined;
+    deletionReason?: string | undefined;
+  }): Promise<Model | null> {
+    if (!IsBillingEnabled) {
+      return null;
+    }
+
+    const project: Project = data.project;
+
+    if (!project.id) {
+      return null;
+    }
+
+    /*
+     * Who to reach out to. The user who deleted the project is usually also
+     * the one who created it - reuse the snapshot in that case instead of
+     * spending a query on it.
+     */
+    let deletedByUser: User | null = null;
+
+    if (data.deletedByUserId) {
+      if (
+        project.createdByUser &&
+        project.createdByUserId?.toString() === data.deletedByUserId.toString()
+      ) {
+        deletedByUser = project.createdByUser;
+      } else {
+        deletedByUser = await UserService.findOneById({
+          id: data.deletedByUserId,
+          select: {
+            _id: true,
+            name: true,
+            email: true,
+            companyName: true,
+            companyPhoneNumber: true,
+            companySize: true,
+            jobRole: true,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+      }
+    }
+
+    const createdByUser: User | undefined = project.createdByUser;
+
+    const deletedProject: Model = new Model();
+
+    deletedProject.projectId = project.id;
+    deletedProject.projectName = project.name || "";
+    deletedProject.projectSlug = project.slug;
+    deletedProject.projectCreatedAt = project.createdAt;
+    deletedProject.projectDeletedAt = OneUptimeDate.getCurrentDate();
+    deletedProject.deletionReason = data.deletionReason;
+
+    deletedProject.projectDeletedByUserId = data.deletedByUserId;
+    deletedProject.projectDeletedByUserName = deletedByUser?.name?.toString();
+    deletedProject.projectDeletedByUserEmail = deletedByUser?.email;
+
+    deletedProject.projectCreatedByUserId = project.createdByUserId;
+    deletedProject.projectCreatedByUserName = createdByUser?.name?.toString();
+    deletedProject.projectCreatedByUserEmail = createdByUser?.email;
+
+    /*
+     * Company details are collected at signup and hang off the User, so take
+     * them from whoever created the project and fall back to whoever deleted
+     * it - between the two there is usually one filled-in answer.
+     */
+    const companyName: string | undefined =
+      createdByUser?.companyName || deletedByUser?.companyName;
+    const companyPhoneNumber: Phone | undefined =
+      createdByUser?.companyPhoneNumber || deletedByUser?.companyPhoneNumber;
+    const companySize: string | undefined =
+      createdByUser?.companySize || deletedByUser?.companySize;
+    const jobRole: string | undefined =
+      createdByUser?.jobRole || deletedByUser?.jobRole;
+
+    deletedProject.companyName = companyName;
+    deletedProject.companyPhoneNumber = companyPhoneNumber;
+    deletedProject.companySize = companySize;
+    deletedProject.jobRole = jobRole;
+
+    deletedProject.planName = project.planName;
+    deletedProject.paymentProviderPlanId = project.paymentProviderPlanId;
+    deletedProject.paymentProviderCustomerId =
+      project.paymentProviderCustomerId;
+    deletedProject.paymentProviderSubscriptionId =
+      project.paymentProviderSubscriptionId;
+    deletedProject.paymentProviderSubscriptionStatus =
+      project.paymentProviderSubscriptionStatus;
+    deletedProject.paymentProviderSubscriptionSeats =
+      project.paymentProviderSubscriptionSeats;
+    deletedProject.trialEndsAt = project.trialEndsAt;
+
+    deletedProject.activeMonitorCount = project.currentActiveMonitorsCount;
+    deletedProject.wasProjectBlocked = project.isBlocked ?? false;
+
+    return await this.create({
+      data: deletedProject,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+}
+
+export default new Service();

package/Server/Services/FileService.ts

@@ -4,15 +4,30 @@ import FindBy from "../Types/Database/FindBy";
 import { OnCreate, OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import DatabaseService from "./DatabaseService";
+import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import File from "../../Models/DatabaseModels/File";
+import MimeType from "../../Types/File/MimeType";
+import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger from "../Utils/Logger";
 import crypto from "crypto";
 
 const generateImageAccessToken: () => string = (): string => {
   return crypto.randomBytes(32).toString("hex");
 };
 
+/*
+ * fileType is declared as MimeType but persisted as a varchar, so the enum
+ * buys nothing at runtime - the API will happily store "text/html" if a client
+ * asks for it. Response.sendFileResponse refuses to echo an unknown type back,
+ * but keeping junk out of the column in the first place means the stored row
+ * matches what we are willing to serve.
+ */
+const ALLOWED_MIME_TYPES: Set<string> = new Set<string>(
+  Object.values(MimeType),
+);
+
 export class Service extends DatabaseService<File> {
   public constructor() {
     super(File);
@@ -22,6 +37,18 @@ export class Service extends DatabaseService<File> {
   protected override async onBeforeCreate(
     createBy: CreateBy<File>,
   ): Promise<OnCreate<File>> {
+    const fileType: string = (createBy.data.fileType || "")
+      .trim()
+      .toLowerCase();
+
+    if (!ALLOWED_MIME_TYPES.has(fileType)) {
+      throw new BadDataException(
+        "This file type is not supported. Please upload a supported file type.",
+      );
+    }
+
+    createBy.data.fileType = fileType as MimeType;
+
     /*
      * Always generate an unguessable access token server-side. The token
      * is the only safe way to address an inline-uploaded image in
@@ -56,6 +83,40 @@ export class Service extends DatabaseService<File> {
     return { deleteBy, carryForward: null };
   }
 
+  /*
+   * Marks a file as anonymously readable. Uploads from the file picker
+   * arrive private, so attaching one as an intentionally public asset
+   * (probe icon, AI agent icon) is the point at which it becomes public
+   * — those are served by the id-based image route, which serves only
+   * public files. Best-effort: a visibility sync failure must never fail
+   * the write the user actually asked for.
+   */
+  @CaptureSpan()
+  public async makeFilePublic(
+    fileId: ObjectID | undefined | null,
+  ): Promise<void> {
+    if (!fileId) {
+      return;
+    }
+
+    try {
+      await this.updateOneById({
+        id: fileId,
+        data: {
+          isPublic: true,
+        },
+        props: {
+          isRoot: true,
+          ignoreHooks: true,
+        },
+      });
+    } catch (err) {
+      logger.error(
+        `Failed to mark file ${fileId.toString()} public: ${String(err)}`,
+      );
+    }
+  }
+
   @CaptureSpan()
   protected override async onBeforeFind(
     findBy: FindBy<File>,

package/Server/Services/IncidentEpisodePublicNoteService.ts

@@ -14,6 +14,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
 import File from "../../Models/DatabaseModels/File";
 import FileAttachmentMarkdownUtil from "../Utils/FileAttachmentMarkdownUtil";
+import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -116,6 +117,17 @@ export class Service extends DatabaseService<Model> {
     const userId: ObjectID | null | undefined =
       createdItem.createdByUserId || createdItem.createdByUser?.id;
 
+    /*
+     * A public note is always rendered on the status page, so any inline
+     * image the markdown editor uploaded as private must flip to public
+     * for anonymous status page viewers to be able to render it.
+     */
+    await syncIsPublicForMarkdownImages(
+      createdItem.note,
+      true,
+      `incident episode public note ${createdItem.id?.toString()}`,
+    );
+
     const incidentEpisodeId: ObjectID = createdItem.incidentEpisodeId!;
     const projectId: ObjectID = createdItem.projectId!;
     const episodeNumberResult: {
@@ -185,6 +197,12 @@ ${(createdItem.note || "") + attachmentsMarkdown}
       for (const updatedItem of updatedItems) {
         const episode: IncidentEpisode = updatedItem.incidentEpisode!;
 
+        await syncIsPublicForMarkdownImages(
+          updatedItem.note,
+          true,
+          `incident episode public note ${updatedItem.id?.toString()}`,
+        );
+
         const attachmentsMarkdown: string = await this.getAttachmentsMarkdown(
           updatedItem.id!,
           "/incident-episode-public-note/attachment",

package/Server/Services/IncidentPublicNoteService.ts

@@ -14,6 +14,7 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
 import File from "../../Models/DatabaseModels/File";
 import FileAttachmentMarkdownUtil from "../Utils/FileAttachmentMarkdownUtil";
+import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -116,6 +117,17 @@ export class Service extends DatabaseService<Model> {
     const userId: ObjectID | null | undefined =
       createdItem.createdByUserId || createdItem.createdByUser?.id;
 
+    /*
+     * A public note is always rendered on the status page, so any inline
+     * image the markdown editor uploaded as private must flip to public
+     * for anonymous status page viewers to be able to render it.
+     */
+    await syncIsPublicForMarkdownImages(
+      createdItem.note,
+      true,
+      `incident public note ${createdItem.id?.toString()}`,
+    );
+
     const incidentId: ObjectID = createdItem.incidentId!;
     const projectId: ObjectID = createdItem.projectId!;
     const incidentNumberResult: {
@@ -187,6 +199,12 @@ ${(createdItem.note || "") + attachmentsMarkdown}
       for (const updatedItem of updatedItems) {
         const incident: Incident = updatedItem.incident!;
 
+        await syncIsPublicForMarkdownImages(
+          updatedItem.note,
+          true,
+          `incident public note ${updatedItem.id?.toString()}`,
+        );
+
         const attachmentsMarkdown: string = await this.getAttachmentsMarkdown(
           updatedItem.id!,
           "/incident-public-note/attachment",

package/Server/Services/Index.ts

@@ -283,10 +283,12 @@ import NetworkFlowService from "./NetworkFlowService";
 import OnCallDutyPolicyTimeLogService from "./OnCallDutyPolicyTimeLogService";
 import ProjectSCIMLogService from "./ProjectSCIMLogService";
 import StatusPageSCIMLogService from "./StatusPageSCIMLogService";
+import DeletedProjectService from "./DeletedProjectService";
 
 const services: Array<BaseService> = [
   OnCallDutyPolicyTimeLogService,
   AcmeCertificateService,
+  DeletedProjectService,
   PromoCodeService,
   EnterpriseLicenseService,
   EnterpriseLicenseInstanceService,