@oneuptime/common 14.0.11 → 14.0.12

package/Server/API/StatusPageAPI.ts

@@ -130,6 +130,7 @@ import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
 } from "../Services/StatusPageSubscriberNotificationTemplateService";
 import { canServeStatusPageCustomizations } from "../Utils/StatusPageCustomizationAccess";
+import ArchivedMonitorResources from "../../Utils/StatusPage/ArchivedMonitorResources";
 import IncidentStatusPageScope, {
   INCIDENT_SCOPE_SELECT,
 } from "../Utils/StatusPage/IncidentStatusPageScope";
@@ -299,6 +300,7 @@ export default class StatusPageAPI extends BaseAPI<
               name: true,
               defaultLanguage: true,
               enableSearchEngineIndexing: true,
+              isArchived: true,
             },
             props: {
               isRoot: true,
@@ -306,7 +308,8 @@ export default class StatusPageAPI extends BaseAPI<
           },
         );
 
-        if (!statusPage) {
+        // An archived page is offline: it reads as a page that does not exist.
+        if (!statusPage || statusPage.isArchived) {
           return Response.sendErrorResponse(
             req,
             res,
@@ -344,6 +347,8 @@ export default class StatusPageAPI extends BaseAPI<
             await StatusPageService.findOneBy({
               query: {
                 _id: statusPageId,
+                // An archived page serves none of its branding.
+                isArchived: false,
               },
               select: {
                 faviconFile: {
@@ -404,6 +409,8 @@ export default class StatusPageAPI extends BaseAPI<
             await StatusPageService.findOneBy({
               query: {
                 _id: statusPageId,
+                // An archived page serves none of its branding.
+                isArchived: false,
               },
               select: {
                 logoFile: {
@@ -454,6 +461,8 @@ export default class StatusPageAPI extends BaseAPI<
             await StatusPageService.findOneBy({
               query: {
                 _id: statusPageId,
+                // An archived page serves none of its branding.
+                isArchived: false,
               },
               select: {
                 coverImageFile: {
@@ -586,6 +595,8 @@ export default class StatusPageAPI extends BaseAPI<
                 _id: statusPageId,
                 enableEmbeddedOverallStatus: true,
                 embeddedOverallStatusToken: token,
+                // An archived page has no status to show, embedded or not.
+                isArchived: false,
               },
               select: {
                 _id: true,
@@ -603,26 +614,32 @@ export default class StatusPageAPI extends BaseAPI<
             return res.status(404).send("Status badge not found or disabled");
           }
 
-          // Get status page resources and current statuses
+          /*
+           * Get status page resources and current statuses. An archived
+           * monitor's frozen status must not color the badge.
+           */
           const statusPageResources: Array<StatusPageResource> =
-            await StatusPageResourceService.findBy({
-              query: {
-                statusPageId: statusPageId,
-              },
-              select: {
-                _id: true,
-                monitor: {
+            ArchivedMonitorResources.withoutArchivedMonitors(
+              await StatusPageResourceService.findBy({
+                query: {
+                  statusPageId: statusPageId,
+                },
+                select: {
                   _id: true,
-                  currentMonitorStatusId: true,
+                  monitor: {
+                    _id: true,
+                    currentMonitorStatusId: true,
+                    isArchived: true,
+                  },
+                  monitorGroupId: true,
                 },
-                monitorGroupId: true,
-              },
-              limit: LIMIT_PER_PROJECT,
-              skip: 0,
-              props: {
-                isRoot: true,
-              },
-            });
+                limit: LIMIT_PER_PROJECT,
+                skip: 0,
+                props: {
+                  isRoot: true,
+                },
+              }),
+            );
 
           // Get monitor statuses
           const monitorStatuses: Array<MonitorStatus> =
@@ -1121,6 +1138,7 @@ export default class StatusPageAPI extends BaseAPI<
             showSubscriberPageOnStatusPage: true,
             defaultLanguage: true,
             enabledLanguages: true,
+            isArchived: true,
           };
 
           if (allowStatusPageCustomizations) {
@@ -1149,10 +1167,17 @@ export default class StatusPageAPI extends BaseAPI<
             },
           });
 
-          if (!item) {
+          /*
+           * The first thing the status page app loads. An archived page stops
+           * here with the same answer a missing one gets.
+           */
+          if (!item || item.isArchived) {
             throw new BadDataException("Status Page not found");
           }
 
+          // Not part of what the page renders.
+          delete item.isArchived;
+
           if (!allowStatusPageCustomizations) {
             /*
              * The conditional select above keeps these values out of the
@@ -1271,13 +1296,14 @@ export default class StatusPageAPI extends BaseAPI<
                 masterPassword: true,
                 masterPasswordSalt: true,
                 isPublicStatusPage: true,
+                isArchived: true,
               },
               props: {
                 isRoot: true,
               },
             });
 
-          if (!statusPage) {
+          if (!statusPage || statusPage.isArchived) {
             throw new NotFoundException("Status Page not found");
           }
 
@@ -1427,6 +1453,10 @@ export default class StatusPageAPI extends BaseAPI<
                   name: true,
                   order: true,
                 },
+                monitor: {
+                  _id: true,
+                  isArchived: true,
+                },
               },
               limit: LIMIT_PER_PROJECT,
               skip: 0,
@@ -1435,11 +1465,22 @@ export default class StatusPageAPI extends BaseAPI<
               },
             });
 
+          /*
+           * A subscriber cannot pick a resource the page does not show. The
+           * monitor was only read to decide that, so it is not sent.
+           */
+          const subscribableResources: Array<StatusPageResource> =
+            ArchivedMonitorResources.withoutArchivedMonitors(resources);
+
+          for (const resource of subscribableResources) {
+            delete resource.monitor;
+          }
+
           return Response.sendEntityArrayResponse(
             req,
             res,
-            resources,
-            new PositiveNumber(resources.length),
+            subscribableResources,
+            new PositiveNumber(subscribableResources.length),
             StatusPageResource,
           );
         } catch (err) {
@@ -2691,39 +2732,42 @@ export default class StatusPageAPI extends BaseAPI<
         },
       });
 
-    // get monitors on status page.
+    // get monitors on status page, leaving out archived ones.
     const statusPageResources: Array<StatusPageResource> =
-      await StatusPageResourceService.findBy({
-        query: {
-          statusPageId: statusPageId,
-        },
-        select: {
-          statusPageGroupId: true,
-          statusPageGroup: {
-            name: true,
-            viewMode: true,
-            rowAxisLabel: true,
-            columnAxisLabel: true,
+      ArchivedMonitorResources.withoutArchivedMonitors(
+        await StatusPageResourceService.findBy({
+          query: {
+            statusPageId: statusPageId,
           },
-          monitorId: true,
-          displayTooltip: true,
-          displayDescription: true,
-          displayName: true,
-          rowAxisValue: true,
-          columnAxisValue: true,
-          monitorGroupId: true,
-          monitor: {
-            _id: true,
-            currentMonitorStatusId: true,
+          select: {
+            statusPageGroupId: true,
+            statusPageGroup: {
+              name: true,
+              viewMode: true,
+              rowAxisLabel: true,
+              columnAxisLabel: true,
+            },
+            monitorId: true,
+            displayTooltip: true,
+            displayDescription: true,
+            displayName: true,
+            rowAxisValue: true,
+            columnAxisValue: true,
+            monitorGroupId: true,
+            monitor: {
+              _id: true,
+              currentMonitorStatusId: true,
+              isArchived: true,
+            },
           },
-        },
 
-        skip: 0,
-        limit: LIMIT_PER_PROJECT,
-        props: {
-          isRoot: true,
-        },
-      });
+          skip: 0,
+          limit: LIMIT_PER_PROJECT,
+          props: {
+            isRoot: true,
+          },
+        }),
+      );
 
     const monitorGroupIds: Array<ObjectID> = statusPageResources
       .map((resource: StatusPageResource) => {
@@ -4817,46 +4861,53 @@ export default class StatusPageAPI extends BaseAPI<
       },
     });
 
-    // get monitors on status page.
+    /*
+     * get monitors on status page. An archived monitor is retired and its
+     * status frozen: it is not shown, and its timeline is not read
+     * (ArchivedMonitorResources).
+     */
     const statusPageResources: Array<StatusPageResource> =
-      await StatusPageResourceService.findBy({
-        query: {
-          statusPageId: objectId,
-        },
-        select: {
-          statusPageGroupId: true,
-          statusPageGroup: {
-            name: true,
-            viewMode: true,
-            rowAxisLabel: true,
-            columnAxisLabel: true,
+      ArchivedMonitorResources.withoutArchivedMonitors(
+        await StatusPageResourceService.findBy({
+          query: {
+            statusPageId: objectId,
           },
-          monitorId: true,
-          displayTooltip: true,
-          displayDescription: true,
-          displayName: true,
-          showStatusHistoryChart: true,
-          showCurrentStatus: true,
-          order: true,
-          monitor: {
-            _id: true,
-            currentMonitorStatusId: true,
+          select: {
+            statusPageGroupId: true,
+            statusPageGroup: {
+              name: true,
+              viewMode: true,
+              rowAxisLabel: true,
+              columnAxisLabel: true,
+            },
+            monitorId: true,
+            displayTooltip: true,
+            displayDescription: true,
+            displayName: true,
+            showStatusHistoryChart: true,
+            showCurrentStatus: true,
+            order: true,
+            monitor: {
+              _id: true,
+              currentMonitorStatusId: true,
+              isArchived: true,
+            },
+            monitorGroupId: true,
+            showUptimePercent: true,
+            uptimePercentPrecision: true,
+            rowAxisValue: true,
+            columnAxisValue: true,
           },
-          monitorGroupId: true,
-          showUptimePercent: true,
-          uptimePercentPrecision: true,
-          rowAxisValue: true,
-          columnAxisValue: true,
-        },
-        sort: {
-          order: SortOrder.Ascending,
-        },
-        skip: 0,
-        limit: LIMIT_PER_PROJECT,
-        props: {
-          isRoot: true,
-        },
-      });
+          sort: {
+            order: SortOrder.Ascending,
+          },
+          skip: 0,
+          limit: LIMIT_PER_PROJECT,
+          props: {
+            isRoot: true,
+          },
+        }),
+      );
 
     const monitorGroupIds: Array<ObjectID> = statusPageResources
       .map((resource: StatusPageResource) => {
@@ -6643,7 +6694,10 @@ export default class StatusPageAPI extends BaseAPI<
   }): Promise<void> {
     const accessResult: {
       hasReadAccess: boolean;
-      error?: NotAuthenticatedException | ForbiddenException;
+      error?:
+        | NotAuthenticatedException
+        | ForbiddenException
+        | NotFoundException;
     } = await this.service.hasReadAccess({
       statusPageId: data.statusPageId,
       req: data.req,

package/Server/EnvironmentConfig.ts

@@ -956,6 +956,33 @@ export const OnCallCalendarFeedRateLimitPerIpPerWindow: number =
     3000,
   );
 
+/*
+ * OAuth sign-in for the MCP server: the authorization server under
+ * /mcp/oauth, its discovery documents under /.well-known, and the consent
+ * screen at /accounts/mcp-authorize, which together let an MCP client connect
+ * by having a project member sign in instead of being handed an API key.
+ *
+ * Kill switch. When true none of that is served and an OAuth access token is
+ * refused wherever it is presented, so the MCP server behaves exactly as it
+ * did before OAuth existed: API keys only. Nothing is deleted - the grants
+ * people made are still there when it is flipped back.
+ */
+export const DisableMcpOAuth: boolean =
+  process.env["DISABLE_MCP_OAUTH"] === "true";
+
+/*
+ * A client may identify itself with a Client ID Metadata Document: its client
+ * id is an https URL, and this server fetches that URL to learn the client's
+ * name and redirect URIs. That is an outbound request to wherever the client
+ * says, so it only works on an instance that can reach the internet.
+ *
+ * Set this on an instance that cannot. The authorization server then stops
+ * advertising the feature and clients fall back to registering themselves
+ * (Dynamic Client Registration), which needs no outbound request at all.
+ */
+export const DisableMcpOAuthClientIdMetadataDocuments: boolean =
+  process.env["DISABLE_MCP_OAUTH_CLIENT_ID_METADATA_DOCUMENTS"] === "true";
+
 /*
  * Source map ingestion and resolution limits.
  *

package/Server/Infrastructure/Postgres/SchemaMigrations/1796800000000-FoldAiSwitchesIntoEnableAi.ts

@@ -0,0 +1,105 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Enable AI is the project's only AI switch.
+ *
+ * Schema (generated): Project.enableAutoRemediation (a kill switch, default
+ * on) and Project.enableAiCommandExecution (an opt-in, default off) are
+ * dropped. Auto-remediation and AI commands on Runners now run exactly when
+ * Project.enableAi is on.
+ *
+ * Data (hand-added, before the drops, which they read): no unattended
+ * surprise. Where one of the two switches was holding remediation back, a
+ * rule, cluster or resource set to run without a human would start changing
+ * systems unattended the moment its switch disappeared. Those drop to asking
+ * first, as the AI agent migration (1796100000000) did when cluster rounds
+ * stopped needing the opt-in: fixes are proposed and a human approves each.
+ * Nothing else changes, and nothing is switched off.
+ *
+ *   1. Auto-remediation was off for the project (enableAutoRemediation =
+ *      false): its Full Auto rules go to Suggest, and its clusters and
+ *      resources in Automatic or Bypass approval go to Ask for approval.
+ *   2. The project never opted into AI command execution
+ *      (enableAiCommandExecution not true): its Full Auto rules that compose
+ *      commands go to Suggest, and so do clusters in Automatic or Bypass
+ *      approval that AI reaches through a Runner an operator bound (with a
+ *      Kubernetes credential). Those were the only rounds the opt-in held
+ *      back; a cluster reached through its Kubernetes AI agent, or the
+ *      chart's in-cluster Runner, never needed it, so it keeps its mode. A
+ *      Runner counts as the chart's by the same markers as
+ *      RunnerService.isKubernetesAgentRunnerRow: its kubernetes-agent/ name,
+ *      or an in-cluster posture that names a cluster.
+ *
+ * down() puts the two columns back with their old defaults. The data
+ * updates are not reverted: afterwards those rows are indistinguishable from
+ * choices an operator made.
+ */
+
+/*
+ * RunnerService.isKubernetesAgentRunnerRow in SQL, over a Runner aliased
+ * `runner`: the kubernetes-agent/ name marker (case-insensitive, leading
+ * whitespace ignored), or a posture under hostInfo.kubernetes that says
+ * inCluster and names a cluster. Never NULL.
+ */
+export const IS_KUBERNETES_AGENT_RUNNER_SQL: string = [
+  `(lower(regexp_replace(COALESCE(runner."name", ''), '^\\s+', '')) LIKE 'kubernetes-agent/%'`,
+  `OR COALESCE(jsonb_typeof(runner."hostInfo" -> 'kubernetes') = 'object'`,
+  `AND runner."hostInfo" -> 'kubernetes' -> 'inCluster' = 'true'::jsonb`,
+  `AND regexp_replace(COALESCE(runner."hostInfo" -> 'kubernetes' ->> 'clusterIdentifier', ''), '^\\s+|\\s+$', '', 'g') <> '', false))`,
+].join(" ");
+
+export const TABLES_WITH_AI_REMEDIATION_MODE: Array<string> = [
+  "KubernetesCluster",
+  "Host",
+  "DockerHost",
+  "PodmanHost",
+  "DockerSwarmCluster",
+  "ProxmoxCluster",
+  "VMwareVCenter",
+  "CephCluster",
+  "DatabaseServer",
+];
+
+export class FoldAiSwitchesIntoEnableAi1796800000000
+  implements MigrationInterface
+{
+  public name: string = "FoldAiSwitchesIntoEnableAi1796800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    // 1. Auto-remediation was off: nothing starts without a human.
+    await queryRunner.query(
+      `UPDATE "AutoRemediationRule" r SET "executionMode" = 'Suggest' FROM "Project" p WHERE r."projectId" = p."_id" AND p."enableAutoRemediation" = false AND r."executionMode" = 'FullAuto'`,
+    );
+
+    for (const table of TABLES_WITH_AI_REMEDIATION_MODE) {
+      await queryRunner.query(
+        `UPDATE "${table}" t SET "aiRemediationMode" = 'RequireApproval' FROM "Project" p WHERE t."projectId" = p."_id" AND p."enableAutoRemediation" = false AND t."aiRemediationMode" IN ('Automatic','BypassApproval')`,
+      );
+    }
+
+    // 2. Never opted into AI command execution: its rounds ask first.
+    await queryRunner.query(
+      `UPDATE "AutoRemediationRule" r SET "executionMode" = 'Suggest' FROM "Project" p WHERE r."projectId" = p."_id" AND p."enableAiCommandExecution" IS NOT TRUE AND r."aiComposesCommands" = true AND r."executionMode" = 'FullAuto'`,
+    );
+
+    await queryRunner.query(
+      `UPDATE "KubernetesCluster" c SET "aiRemediationMode" = 'RequireApproval' FROM "Project" p, "Runner" runner WHERE c."projectId" = p."_id" AND runner."_id" = c."aiAccessRunnerId" AND p."enableAiCommandExecution" IS NOT TRUE AND c."aiRemediationMode" IN ('Automatic','BypassApproval') AND NOT ${IS_KUBERNETES_AGENT_RUNNER_SQL}`,
+    );
+
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutoRemediation"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAiCommandExecution"`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAiCommandExecution" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutoRemediation" boolean NOT NULL DEFAULT true`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1796900000000-AddMcpOAuthTables.ts

@@ -0,0 +1,97 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * OAuth sign-in for the MCP server. Three tables, all new, nothing altered:
+ *
+ *   McpOAuthClient  MCP clients that registered themselves (RFC 7591).
+ *   McpOAuthGrant   "this member let this client act for them in this
+ *                   project" - one row per approval on the consent screen.
+ *   McpOAuthToken   digests of the authorization codes, access tokens and
+ *                   refresh tokens issued under a grant.
+ *
+ * The two foreign keys that matter are the cascades: a grant goes when its
+ * project or its user does, and a token goes when its grant does. Revoking a
+ * client is deleting its grant, and that is what takes its tokens with it.
+ * See the models for everything else.
+ */
+export class AddMcpOAuthTables1796900000000 implements MigrationInterface {
+  public name: string = "AddMcpOAuthTables1796900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "McpOAuthClient" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "clientName" character varying(100) NOT NULL, "clientUri" character varying(500), "redirectUris" jsonb NOT NULL, "tokenEndpointAuthMethod" character varying(100) NOT NULL, "clientSecretHash" character varying(100), "lastUsedAt" TIMESTAMP WITH TIME ZONE NOT NULL, CONSTRAINT "PK_94ef13eabb737f0b5c86a690322" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6aacc7ba7ea7c286faf92e9040" ON "McpOAuthClient" ("lastUsedAt") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "McpOAuthGrant" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "userId" uuid NOT NULL, "name" character varying(100) NOT NULL, "clientId" character varying(500) NOT NULL, "scope" character varying(100) NOT NULL, "resource" character varying(500) NOT NULL, "activatedAt" TIMESTAMP WITH TIME ZONE, "expiresAt" TIMESTAMP WITH TIME ZONE NOT NULL, "lastUsedAt" TIMESTAMP WITH TIME ZONE, "ssoProviderType" character varying(100), "ssoProviderId" uuid, "ssoExpiresAt" TIMESTAMP WITH TIME ZONE, CONSTRAINT "PK_a7a6b978533323bb55d20641683" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_67758231559e66bd2ff39175d9" ON "McpOAuthGrant" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_365e6fce03846cfc6d37bda9d4" ON "McpOAuthGrant" ("userId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_3fd8b786511034c33fdaed67dd" ON "McpOAuthGrant" ("clientId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_707535aed42e89fc694d8098ce" ON "McpOAuthGrant" ("expiresAt") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "McpOAuthToken" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "mcpOAuthGrantId" uuid NOT NULL, "tokenType" character varying(100) NOT NULL, "tokenHash" character varying(100) NOT NULL, "expiresAt" TIMESTAMP WITH TIME ZONE NOT NULL, "consumedAt" TIMESTAMP WITH TIME ZONE, "codeChallenge" character varying(100), "redirectUri" text, CONSTRAINT "UQ_91d0df23a6cd24877fdc020e354" UNIQUE ("tokenHash"), CONSTRAINT "PK_3203512e6e24cc83543a133b8cf" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_a848b7f49a863d67799a117b82" ON "McpOAuthToken" ("mcpOAuthGrantId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_af198aa32ac12d8dc1a2bbf586" ON "McpOAuthToken" ("expiresAt") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "McpOAuthGrant" ADD CONSTRAINT "FK_67758231559e66bd2ff39175d9e" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "McpOAuthGrant" ADD CONSTRAINT "FK_365e6fce03846cfc6d37bda9d4f" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "McpOAuthToken" ADD CONSTRAINT "FK_a848b7f49a863d67799a117b82f" FOREIGN KEY ("mcpOAuthGrantId") REFERENCES "McpOAuthGrant"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "McpOAuthToken" DROP CONSTRAINT "FK_a848b7f49a863d67799a117b82f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "McpOAuthGrant" DROP CONSTRAINT "FK_365e6fce03846cfc6d37bda9d4f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "McpOAuthGrant" DROP CONSTRAINT "FK_67758231559e66bd2ff39175d9e"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_af198aa32ac12d8dc1a2bbf586"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_a848b7f49a863d67799a117b82"`,
+    );
+    await queryRunner.query(`DROP TABLE "McpOAuthToken"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_707535aed42e89fc694d8098ce"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_3fd8b786511034c33fdaed67dd"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_365e6fce03846cfc6d37bda9d4"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_67758231559e66bd2ff39175d9"`,
+    );
+    await queryRunner.query(`DROP TABLE "McpOAuthGrant"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6aacc7ba7ea7c286faf92e9040"`,
+    );
+    await queryRunner.query(`DROP TABLE "McpOAuthClient"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1797000000000-AddWorkflowIncomingEmailSecretKey.ts

@@ -0,0 +1,36 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Generated with npm run generate-postgres-migration, then renumbered after
+ * the last registered migration.
+ *
+ * "incomingEmailSecretKey": the key a workflow's Incoming Email trigger
+ * address is built from (workflow-{key}@{inbound email domain}). NULL until
+ * the workflow's graph first has that trigger, so no existing row needs a
+ * value; WorkflowService gives one when the graph is saved. Unique, because
+ * the inbound webhook finds the workflow by this key alone - two workflows
+ * sharing one would mean one of them receives the other's mail.
+ */
+export class AddWorkflowIncomingEmailSecretKey1797000000000
+  implements MigrationInterface
+{
+  public name: string = "AddWorkflowIncomingEmailSecretKey1797000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" ADD "incomingEmailSecretKey" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" ADD CONSTRAINT "UQ_7451cb0cff5b50e2cfc5863c55e" UNIQUE ("incomingEmailSecretKey")`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" DROP CONSTRAINT "UQ_7451cb0cff5b50e2cfc5863c55e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Workflow" DROP COLUMN "incomingEmailSecretKey"`,
+    );
+  }
+}