@oneuptime/common 14.0.1 → 14.0.3

package/Server/API/WorkflowVariableAPI.ts

@@ -0,0 +1,156 @@
+import UserMiddleware from "../Middleware/UserAuthorization";
+import WorkflowVariableService, {
+  Service as WorkflowVariableServiceType,
+} from "../Services/WorkflowVariableService";
+import ModelPermission from "../Types/Database/Permissions/Index";
+import Query from "../Types/Database/Query";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import Response from "../Utils/Response";
+import WorkflowVariableOAuthToken, {
+  WorkflowVariableAccessToken,
+} from "../Utils/Workflow/WorkflowVariableOAuthToken";
+import BaseAPI from "./BaseAPI";
+import CommonAPI from "./CommonAPI";
+import WorkflowVariable from "../../Models/DatabaseModels/WorkflowVariable";
+import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import BadDataException from "../../Types/Exception/BadDataException";
+import Exception from "../../Types/Exception/Exception";
+import ObjectID from "../../Types/ObjectID";
+import { isOAuth2WorkflowVariable } from "../../Types/Workflow/WorkflowVariableOAuth";
+
+/*
+ * ------------------------------------------------------------------
+ * WorkflowVariableAPI
+ *
+ *   POST /workflow-variable/:id/refresh-oauth-token
+ *
+ * "Refresh now" for an OAuth 2.0 workflow variable: fetch a new access
+ * token from the identity provider now, whether or not the cached one has
+ * expired. It is how somebody checks new settings without running a
+ * workflow, and how they recover after fixing whatever made the last refresh
+ * fail.
+ *
+ * The answer says when the new token expires and never contains it. The
+ * access token is as unreadable through the API as a variable's content is;
+ * this endpoint must not become a way around that.
+ *
+ * A refresh writes to the variable (the token, and a rotated refresh token),
+ * so it needs the same update permission as editing the variable. Access is
+ * checked in two steps, like the Data Source test route: the row is read
+ * with the caller's own permissions first - another project's id, or one the
+ * caller may not read, answers exactly like an id that does not exist - and
+ * only then is the update permission checked and the credentials read as
+ * root.
+ * ------------------------------------------------------------------
+ */
+
+const NOT_FOUND_MESSAGE: string =
+  "Workflow variable not found, or you do not have access to it.";
+
+function readVariableId(req: ExpressRequest): ObjectID {
+  const id: string | undefined = req.params["id"];
+
+  /*
+   * ObjectID's constructor takes any string, so a malformed id would
+   * otherwise reach Postgres and come back as a syntax error, not a 400.
+   */
+  if (!id || !ObjectID.isValidUUID(id)) {
+    throw new BadDataException(NOT_FOUND_MESSAGE);
+  }
+
+  return new ObjectID(id);
+}
+
+export default class WorkflowVariableAPI extends BaseAPI<
+  WorkflowVariable,
+  WorkflowVariableServiceType
+> {
+  public constructor() {
+    super(WorkflowVariable, WorkflowVariableService);
+
+    this.router.post(
+      `${new this.entityType()
+        .getCrudApiPath()
+        ?.toString()}/:id/refresh-oauth-token`,
+      UserMiddleware.getUserMiddleware,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          const props: DatabaseCommonInteractionProps =
+            await CommonAPI.getDatabaseCommonInteractionProps(req);
+
+          CommonAPI.assertAuthenticatedProjectPrincipal(props);
+
+          const variableId: ObjectID = readVariableId(req);
+
+          const variable: WorkflowVariable | null =
+            await WorkflowVariableService.findOneById({
+              id: variableId,
+              select: {
+                _id: true,
+                name: true,
+                variableType: true,
+              },
+              props: props,
+            });
+
+          if (!variable) {
+            throw new BadDataException(NOT_FOUND_MESSAGE);
+          }
+
+          await ModelPermission.checkUpdateQueryPermissions(
+            WorkflowVariable,
+            { _id: variableId.toString() } as Query<WorkflowVariable>,
+            {},
+            props,
+          );
+
+          if (!isOAuth2WorkflowVariable(variable.variableType)) {
+            throw new BadDataException(
+              `"${variable.name || "This variable"}" is not an OAuth 2.0 variable, so it has no access token to refresh.`,
+            );
+          }
+
+          let token: WorkflowVariableAccessToken;
+
+          try {
+            token = await WorkflowVariableOAuthToken.getAccessToken({
+              variableId: variableId,
+              forceRefresh: true,
+            });
+          } catch (err) {
+            /*
+             * The identity provider's answer is the useful part - it is what
+             * the person has to fix - so it goes back as the error message.
+             * WorkflowVariableOAuthToken has already written it to the
+             * variable, where its page's Access Token card shows it.
+             */
+            return Response.sendErrorResponse(
+              req,
+              res,
+              err instanceof Exception
+                ? err
+                : new BadDataException(
+                    "Could not refresh the access token. Try again in a few minutes.",
+                  ),
+            );
+          }
+
+          return Response.sendJsonObjectResponse(req, res, {
+            oauthAccessTokenExpiresAt: token.expiresAt
+              ? token.expiresAt.toISOString()
+              : null,
+            oauthLastRefreshedAt: token.refreshedAt
+              ? token.refreshedAt.toISOString()
+              : null,
+          });
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+  }
+}

package/Server/Infrastructure/GlobalCache.ts

@@ -328,6 +328,41 @@ export default abstract class GlobalCache {
     return result === 1;
   }
 
+  /*
+   * Atomic read-and-remove: return the value and delete the key in one
+   * evaluation, so exactly one caller ever sees it.
+   *
+   * This is the primitive for single-use tokens (OAuth `state` nonces and the
+   * like). `getString()` followed by `deleteKey()` is a check-then-act race:
+   * two requests replaying the same token in the same instant would both read
+   * it before either deleted it, and both would be honoured. A Lua script
+   * rather than GETDEL keeps this working on Redis versions older than 6.2.
+   *
+   * The key is passed as KEYS[1] rather than inlined into the script body so
+   * the script stays correct on Redis Cluster, which routes by declared keys.
+   */
+  @CaptureSpan()
+  public static async getAndDeleteString(
+    namespace: string,
+    key: string,
+  ): Promise<string | null> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const result: unknown = await client.eval(
+      "local value = redis.call('GET', KEYS[1]) " +
+        "if value then redis.call('DEL', KEYS[1]) end " +
+        "return value",
+      1,
+      `${namespace}-${key}`,
+    );
+
+    return typeof result === "string" && result ? result : null;
+  }
+
   @CaptureSpan()
   public static async deleteKey(namespace: string, key: string): Promise<void> {
     const client: ClientType | null = Redis.getClient();

package/Server/Infrastructure/Postgres/SchemaMigrations/1794300000000-AddOAuth2WorkflowVariables.ts

@@ -0,0 +1,97 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddOAuth2WorkflowVariables1794300000000
+  implements MigrationInterface
+{
+  public name: string = "AddOAuth2WorkflowVariables1794300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "variableType" character varying(100) NOT NULL DEFAULT 'Static'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthGrantType" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthTokenUrl" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthClientId" character varying(500)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthClientSecret" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthRefreshToken" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthScope" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthAdditionalParameters" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthClientAuthenticationMethod" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthAccessToken" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthAccessTokenExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthLastRefreshedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthLastRefreshError" text`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" ADD "oauthLastRefreshErrorAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthLastRefreshErrorAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthLastRefreshError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthLastRefreshedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthAccessTokenExpiresAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthAccessToken"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthClientAuthenticationMethod"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthAdditionalParameters"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthScope"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthRefreshToken"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthClientSecret"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthClientId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthTokenUrl"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "oauthGrantType"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "WorkflowVariable" DROP COLUMN "variableType"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794400000000-AddKubernetesClusterAiAccess.ts

@@ -0,0 +1,129 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration, then trimmed to this
+ * change. OneUptime AI access to a Kubernetes cluster: the cluster binds the
+ * Runner (and optional Kubernetes credential) AI uses for kubectl, plus its
+ * investigation switch, remediation mode and allowlist. RunnerJob and
+ * AutoRemediationSuggestion gain the cluster a kubectl command ran against
+ * so the cluster's AI page can list every command AI ran on it.
+ */
+export class AddKubernetesClusterAiAccess1794400000000
+  implements MigrationInterface
+{
+  public name: string = "AddKubernetesClusterAiAccess1794400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessRunnerId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessCredentialId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "isAiInvestigationEnabled" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiRemediationMode" character varying(100) NOT NULL DEFAULT 'Disabled'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiKubectlCommandAllowlist" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessLastVerifiedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessLastError" character varying`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessConfiguredAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD "aiAccessRunnerBoundAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "kubernetesClusterId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD "kubernetesClusterId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_9cfdcee74d277dcb577dd5889d" ON "KubernetesCluster" ("aiAccessRunnerId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_d3aac9a59774cca6c0f0299992" ON "RunnerJob" ("kubernetesClusterId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_8730770e8d450cbfa54236ed13" ON "AutoRemediationSuggestion" ("kubernetesClusterId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_9cfdcee74d277dcb577dd5889d5" FOREIGN KEY ("aiAccessRunnerId") REFERENCES "Runner"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ADD CONSTRAINT "FK_b4a0ae50ee63ca22e46e396ca3e" FOREIGN KEY ("aiAccessCredentialId") REFERENCES "RunbookCredential"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD CONSTRAINT "FK_d3aac9a59774cca6c0f0299992a" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" ADD CONSTRAINT "FK_8730770e8d450cbfa54236ed13a" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP CONSTRAINT "FK_8730770e8d450cbfa54236ed13a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP CONSTRAINT "FK_d3aac9a59774cca6c0f0299992a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_b4a0ae50ee63ca22e46e396ca3e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP CONSTRAINT "FK_9cfdcee74d277dcb577dd5889d5"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_8730770e8d450cbfa54236ed13"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_d3aac9a59774cca6c0f0299992"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_9cfdcee74d277dcb577dd5889d"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "AutoRemediationSuggestion" DROP COLUMN "kubernetesClusterId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "kubernetesClusterId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessRunnerBoundAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessConfiguredAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessLastError"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessLastVerifiedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiKubectlCommandAllowlist"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiRemediationMode"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "isAiInvestigationEnabled"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessCredentialId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" DROP COLUMN "aiAccessRunnerId"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794500000000-AddIncomingEmailCustomAddressToMonitor.ts

@@ -0,0 +1,25 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddIncomingEmailCustomAddressToMonitor1794500000000
+  implements MigrationInterface
+{
+  public name: string = "AddIncomingEmailCustomAddressToMonitor1794500000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD "incomingEmailCustomLocalPart" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" ADD CONSTRAINT "UQ_7abf86b592dbbe8bf8a38bad6e5" UNIQUE ("incomingEmailCustomLocalPart")`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP CONSTRAINT "UQ_7abf86b592dbbe8bf8a38bad6e5"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Monitor" DROP COLUMN "incomingEmailCustomLocalPart"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794600000000-AddAuthTokenExpiresAtToWorkspaceProjectAuthToken.ts

@@ -0,0 +1,20 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkspaceProjectAuthToken" ADD "authTokenExpiresAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "WorkspaceProjectAuthToken" DROP COLUMN "authTokenExpiresAt"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794700000000-RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData.ts

@@ -0,0 +1,38 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Data cleanup: take the Microsoft Graph app token out of
+ * WorkspaceProjectAuthToken.miscData.
+ *
+ * Microsoft Teams connections cached the tenant's app-only Graph token, and
+ * its expiry, in miscData. That column is readable by every project Viewer
+ * through the CRUD API. The token now lives only in the server-only
+ * `authToken` / `authTokenExpiresAt` columns (`authToken` always held the same
+ * token), so the copies in miscData are deleted here.
+ *
+ * `authTokenExpiresAt` is deliberately not backfilled from the old miscData
+ * value. A Teams connection with no recorded expiry mints a fresh token on its
+ * next Graph call, and that records one.
+ *
+ * Only JSON objects are touched: `-` raises on a JSON scalar, and `?|` would
+ * match a scalar string equal to one of the keys.
+ *
+ * down() restores nothing. The values were short-lived credentials the server
+ * mints again on demand, and putting them back would reopen the exposure.
+ */
+export class RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000
+  implements MigrationInterface
+{
+  public name: string =
+    "RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `UPDATE "WorkspaceProjectAuthToken" SET "miscData" = "miscData" - 'appAccessToken' - 'appAccessTokenExpiresAt' - 'lastAppTokenIssuedAt' WHERE jsonb_typeof("miscData") = 'object' AND "miscData" ?| ARRAY['appAccessToken', 'appAccessTokenExpiresAt', 'lastAppTokenIssuedAt']`,
+    );
+  }
+
+  public async down(_queryRunner: QueryRunner): Promise<void> {
+    // Nothing to restore; see the note above.
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794800000000-AddSessionReplaySameOriginTracePropagation.ts

@@ -0,0 +1,28 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration, then renumbered after
+ * the last registered migration. The per-application switch for the browser
+ * recorder's same-origin trace propagation (traceparent plus a tracestate
+ * member carrying the replay session id on requests to the page's own
+ * origin). DEFAULT true turns it on for existing applications as well as new
+ * ones; the column is the way to turn it off without a customer redeploy.
+ */
+export class AddSessionReplaySameOriginTracePropagation1794800000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddSessionReplaySameOriginTracePropagation1794800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" ADD "sessionReplaySameOriginTracePropagation" boolean NOT NULL DEFAULT true`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RumApplication" DROP COLUMN "sessionReplaySameOriginTracePropagation"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1794900000000-AddIncidentAlert.ts

@@ -0,0 +1,89 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration, then renumbered after
+ * the last registered migration. Adds the IncidentAlert link table (alerts
+ * linked to incidents, many-to-many, one row per incident/alert pair) and the
+ * two project switches that let an incident's acknowledge and resolve carry
+ * over to the alerts linked to it. Both switches default to false, so no
+ * existing project changes behaviour.
+ */
+export class AddIncidentAlert1794900000000 implements MigrationInterface {
+  public name: string = "AddIncidentAlert1794900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "IncidentAlert" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "incidentId" uuid NOT NULL, "alertId" uuid NOT NULL, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_cadb02bcf16f34fb6b131ad3a56" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_2456e245d2ac16087057be57ea" ON "IncidentAlert" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_f38346a69539fb7a363ee39e69" ON "IncidentAlert" ("incidentId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_828188b356c5335f78af09466f" ON "IncidentAlert" ("alertId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_b836b78cef9ce62e4d8f2cc586" ON "IncidentAlert" ("incidentId", "alertId", "projectId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "acknowledgeLinkedAlertsWhenIncidentAcknowledged" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "resolveLinkedAlertsWhenIncidentResolved" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_2456e245d2ac16087057be57ea5" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_f38346a69539fb7a363ee39e698" FOREIGN KEY ("incidentId") REFERENCES "Incident"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_828188b356c5335f78af09466fa" FOREIGN KEY ("alertId") REFERENCES "Alert"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_ad078609e5bacad1f7861f92176" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" ADD CONSTRAINT "FK_572a63b76f7053f4fd28e666295" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_572a63b76f7053f4fd28e666295"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_ad078609e5bacad1f7861f92176"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_828188b356c5335f78af09466fa"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_f38346a69539fb7a363ee39e698"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentAlert" DROP CONSTRAINT "FK_2456e245d2ac16087057be57ea5"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "resolveLinkedAlertsWhenIncidentResolved"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "acknowledgeLinkedAlertsWhenIncidentAcknowledged"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b836b78cef9ce62e4d8f2cc586"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_828188b356c5335f78af09466f"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_f38346a69539fb7a363ee39e69"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_2456e245d2ac16087057be57ea"`,
+    );
+    await queryRunner.query(`DROP TABLE "IncidentAlert"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -3,6 +3,13 @@ import { RemoveMonitorDescriptionLengthLimit1793800000000 } from "./179380000000
 import { AddEnterpriseEditionFirstSeenAt1793900000000 } from "./1793900000000-AddEnterpriseEditionFirstSeenAt";
 import { AddSloLabelAndOwnerRules1794100000000 } from "./1794100000000-AddSloLabelAndOwnerRules";
 import { AddSloMonitorRuleMonitorType1794200000000 } from "./1794200000000-AddSloMonitorRuleMonitorType";
+import { AddOAuth2WorkflowVariables1794300000000 } from "./1794300000000-AddOAuth2WorkflowVariables";
+import { AddKubernetesClusterAiAccess1794400000000 } from "./1794400000000-AddKubernetesClusterAiAccess";
+import { AddIncomingEmailCustomAddressToMonitor1794500000000 } from "./1794500000000-AddIncomingEmailCustomAddressToMonitor";
+import { AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000 } from "./1794600000000-AddAuthTokenExpiresAtToWorkspaceProjectAuthToken";
+import { RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000 } from "./1794700000000-RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData";
+import { AddSessionReplaySameOriginTracePropagation1794800000000 } from "./1794800000000-AddSessionReplaySameOriginTracePropagation";
+import { AddIncidentAlert1794900000000 } from "./1794900000000-AddIncidentAlert";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1206,4 +1213,11 @@ export default [
   AddEnterpriseEditionFirstSeenAt1793900000000,
   AddSloLabelAndOwnerRules1794100000000,
   AddSloMonitorRuleMonitorType1794200000000,
+  AddOAuth2WorkflowVariables1794300000000,
+  AddKubernetesClusterAiAccess1794400000000,
+  AddIncomingEmailCustomAddressToMonitor1794500000000,
+  AddAuthTokenExpiresAtToWorkspaceProjectAuthToken1794600000000,
+  RemoveAppAccessTokenFromWorkspaceProjectAuthTokenMiscData1794700000000,
+  AddSessionReplaySameOriginTracePropagation1794800000000,
+  AddIncidentAlert1794900000000,
 ];