@oneuptime/common 14.0.2 → 14.0.5

package/Server/Services/IoTDeviceService.ts

@@ -78,6 +78,123 @@ const UPSERT_COLUMNS: Array<string> = [
   "version",
 ];
 
+/*
+ * One entry per column of the `FROM (VALUES ...) AS v(...)` source in
+ * bulkUpdateLatestMetrics(). The placeholder tuple, the alias list, the
+ * bound params and the SET clause are all generated from this table, so
+ * they cannot drift apart: a hand-written tuple once carried 9
+ * placeholders against 10 aliases and 10 params, and Postgres rejected
+ * every mirror write (GitHub #3998).
+ *
+ * mirrorColumn: the IoTDevice column the value is COALESCEd into, or
+ * null for the join keys and observedAt, which the statement uses
+ * directly.
+ */
+export interface LatestMetricColumn {
+  alias: string;
+  cast: string | null;
+  mirrorColumn: string | null;
+  value: (metric: IoTDeviceLatestMetric) => unknown;
+}
+
+const nullableNumber: (value: number | null | undefined) => number | null = (
+  value: number | null | undefined,
+): number | null => {
+  return value !== null && value !== undefined ? value : null;
+};
+
+// bigint params go over the wire as integer strings: a JS number past 2^53 loses precision.
+const nullableBigInt: (value: number | null | undefined) => string | null = (
+  value: number | null | undefined,
+): string | null => {
+  return value !== null && value !== undefined
+    ? Math.trunc(value).toString()
+    : null;
+};
+
+export const LATEST_METRIC_COLUMNS: ReadonlyArray<LatestMetricColumn> = [
+  {
+    alias: "kind",
+    cast: null,
+    mirrorColumn: null,
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return m.kind;
+    },
+  },
+  {
+    alias: "externalId",
+    cast: null,
+    mirrorColumn: null,
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return m.externalId;
+    },
+  },
+  {
+    alias: "cpu",
+    cast: "numeric",
+    mirrorColumn: "latestCpuPercent",
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return nullableNumber(m.cpuPercent);
+    },
+  },
+  {
+    alias: "mem",
+    cast: "bigint",
+    mirrorColumn: "latestMemoryBytes",
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return nullableBigInt(m.memoryBytes);
+    },
+  },
+  {
+    alias: "maxMem",
+    cast: "bigint",
+    mirrorColumn: "maxMemoryBytes",
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return nullableBigInt(m.maxMemoryBytes);
+    },
+  },
+  {
+    alias: "memPct",
+    cast: "numeric",
+    mirrorColumn: "latestMemoryPercent",
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return nullableNumber(m.memoryPercent);
+    },
+  },
+  {
+    alias: "battery",
+    cast: "numeric",
+    mirrorColumn: "latestBatteryPercent",
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return nullableNumber(m.batteryPercent);
+    },
+  },
+  {
+    alias: "signal",
+    cast: "numeric",
+    mirrorColumn: "latestSignalStrengthDbm",
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return nullableNumber(m.signalStrengthDbm);
+    },
+  },
+  {
+    alias: "temp",
+    cast: "numeric",
+    mirrorColumn: "latestTemperatureCelsius",
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return nullableNumber(m.temperatureCelsius);
+    },
+  },
+  {
+    alias: "observedAt",
+    cast: "timestamptz",
+    mirrorColumn: null,
+    value: (m: IoTDeviceLatestMetric): unknown => {
+      return m.observedAt;
+    },
+  },
+];
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -260,6 +377,22 @@ export class Service extends DatabaseService<Model> {
       return;
     }
 
+    const aliases: string = LATEST_METRIC_COLUMNS.map(
+      (column: LatestMetricColumn) => {
+        return `"${column.alias}"`;
+      },
+    ).join(", ");
+
+    const assignments: string = LATEST_METRIC_COLUMNS.filter(
+      (column: LatestMetricColumn) => {
+        return column.mirrorColumn !== null;
+      },
+    )
+      .map((column: LatestMetricColumn) => {
+        return `"${column.mirrorColumn}" = COALESCE(v."${column.alias}", p."${column.mirrorColumn}"),`;
+      })
+      .join("\n          ");
+
     for (let i: number = 0; i < metrics.length; i += UPSERT_BATCH_SIZE) {
       const chunk: Array<IoTDeviceLatestMetric> = metrics.slice(
         i,
@@ -274,51 +407,26 @@ export class Service extends DatabaseService<Model> {
       let paramIndex: number = 3;
 
       for (const m of chunk) {
-        valueFragments.push(
-          `($${paramIndex++}, $${paramIndex++}, $${paramIndex++}::numeric, $${paramIndex++}::bigint, $${paramIndex++}::bigint, $${paramIndex++}::numeric, $${paramIndex++}::numeric, $${paramIndex++}::numeric, $${paramIndex++}::timestamptz)`,
-        );
-        params.push(
-          m.kind,
-          m.externalId,
-          m.cpuPercent !== null && m.cpuPercent !== undefined
-            ? m.cpuPercent
-            : null,
-          m.memoryBytes !== null && m.memoryBytes !== undefined
-            ? Math.trunc(m.memoryBytes).toString()
-            : null,
-          m.maxMemoryBytes !== null && m.maxMemoryBytes !== undefined
-            ? Math.trunc(m.maxMemoryBytes).toString()
-            : null,
-          m.memoryPercent !== null && m.memoryPercent !== undefined
-            ? m.memoryPercent
-            : null,
-          m.batteryPercent !== null && m.batteryPercent !== undefined
-            ? m.batteryPercent
-            : null,
-          m.signalStrengthDbm !== null && m.signalStrengthDbm !== undefined
-            ? m.signalStrengthDbm
-            : null,
-          m.temperatureCelsius !== null && m.temperatureCelsius !== undefined
-            ? m.temperatureCelsius
-            : null,
-          m.observedAt,
-        );
+        const placeholders: Array<string> = [];
+        for (const column of LATEST_METRIC_COLUMNS) {
+          placeholders.push(
+            column.cast
+              ? `$${paramIndex++}::${column.cast}`
+              : `$${paramIndex++}`,
+          );
+          params.push(column.value(m));
+        }
+        valueFragments.push(`(${placeholders.join(", ")})`);
       }
 
       const sql: string = `
         UPDATE "IoTDevice" AS p
         SET
-          "latestCpuPercent" = COALESCE(v."cpu", p."latestCpuPercent"),
-          "latestMemoryBytes" = COALESCE(v."mem", p."latestMemoryBytes"),
-          "maxMemoryBytes" = COALESCE(v."maxMem", p."maxMemoryBytes"),
-          "latestMemoryPercent" = COALESCE(v."memPct", p."latestMemoryPercent"),
-          "latestBatteryPercent" = COALESCE(v."battery", p."latestBatteryPercent"),
-          "latestSignalStrengthDbm" = COALESCE(v."signal", p."latestSignalStrengthDbm"),
-          "latestTemperatureCelsius" = COALESCE(v."temp", p."latestTemperatureCelsius"),
+          ${assignments}
           "metricsUpdatedAt" = v."observedAt",
           "updatedAt" = now()
         FROM (VALUES ${valueFragments.join(", ")})
-          AS v("kind", "externalId", "cpu", "mem", "maxMem", "memPct", "battery", "signal", "temp", "observedAt")
+          AS v(${aliases})
         WHERE
           p."projectId" = $1
           AND p."iotFleetId" = $2

package/Server/Services/OpenTelemetryIngestService.ts

@@ -25,6 +25,7 @@ import KubernetesCluster from "../../Models/DatabaseModels/KubernetesCluster";
 import ProxmoxCluster from "../../Models/DatabaseModels/ProxmoxCluster";
 import VMwareVCenter from "../../Models/DatabaseModels/VMwareVCenter";
 import CephCluster from "../../Models/DatabaseModels/CephCluster";
+import DatabaseServer from "../../Models/DatabaseModels/DatabaseServer";
 import DockerSwarmCluster from "../../Models/DatabaseModels/DockerSwarmCluster";
 import ServerlessFunction from "../../Models/DatabaseModels/ServerlessFunction";
 import CloudResource from "../../Models/DatabaseModels/CloudResource";
@@ -37,6 +38,7 @@ import KubernetesClusterService from "./KubernetesClusterService";
 import ProxmoxClusterService from "./ProxmoxClusterService";
 import VMwareVCenterService from "./VMwareVCenterService";
 import CephClusterService from "./CephClusterService";
+import DatabaseServerService from "./DatabaseServerService";
 import DockerSwarmClusterService from "./DockerSwarmClusterService";
 import ServerlessFunctionService from "./ServerlessFunctionService";
 import CloudResourceService from "./CloudResourceService";
@@ -1060,6 +1062,23 @@ export default class OTelIngestService {
         telemetryRetentionConfig: cluster?.telemetryRetentionConfig ?? null,
       };
     }
+    if (primaryEntityType === ServiceType.DatabaseServer) {
+      const databaseServer: DatabaseServer | null =
+        await DatabaseServerService.findOneById({
+          id: resourceId,
+          select: {
+            retainTelemetryDataForDays: true,
+            telemetryRetentionConfig: true,
+          },
+          props: { isRoot: true },
+        });
+      return {
+        retainTelemetryDataForDays:
+          databaseServer?.retainTelemetryDataForDays ?? null,
+        telemetryRetentionConfig:
+          databaseServer?.telemetryRetentionConfig ?? null,
+      };
+    }
     if (primaryEntityType === ServiceType.DockerSwarmCluster) {
       const cluster: DockerSwarmCluster | null =
         await DockerSwarmClusterService.findOneById({

package/Server/Services/PodmanResourceService.ts

@@ -39,6 +39,19 @@ export interface ParsedPodmanContainer {
   cpuPercent: number | null;
   memoryBytes: number | null;
   observedAt: Date;
+  /*
+   * The container labels the agent copies onto its metrics (Compose /
+   * Testcontainers keys, see CONTAINER_CLASSIFIER_LABEL_KEYS): MERGED into
+   * the row's labels, never replacing what the inventory snapshot wrote.
+   * Null / omitted leaves the labels alone.
+   */
+  labels?: JSONObject | null | undefined;
+  /*
+   * When the container's current run started (metric time − container.uptime).
+   * Fills an empty resourceCreationTimestamp, and moves it forward when
+   * the container was restarted or recreated under the same name.
+   */
+  startedAt?: Date | null | undefined;
 }
 
 export interface ParsedPodmanResource {
@@ -141,7 +154,7 @@ export class Service extends DatabaseService<Model> {
 
       for (const c of chunk) {
         valueFragments.push(
-          `($${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}::numeric, $${p++}::bigint, $${p++}::timestamptz, $${p++}::timestamptz, $${p++})`,
+          `($${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}, $${p++}::numeric, $${p++}::bigint, $${p++}::timestamptz, $${p++}::timestamptz, $${p++}, $${p++}::jsonb, $${p++}::timestamptz)`,
         );
         params.push(
           data.projectId.toString(),
@@ -160,15 +173,27 @@ export class Service extends DatabaseService<Model> {
           c.observedAt,
           c.observedAt,
           0, // version (BaseModel @VersionColumn)
+          c.labels && Object.keys(c.labels).length > 0
+            ? JSON.stringify(c.labels)
+            : null,
+          c.startedAt || null,
         );
       }
 
+      /*
+       * The same container name with a different id is a recreated
+       * container: its labels and start time replace the old ones. Else
+       * the metric labels are merged into whatever the inventory wrote,
+       * and the start time only moves forward (a restart) — by more than
+       * a minute, so clock jitter between scrapes never rewrites it.
+       */
       const sql: string = `
         INSERT INTO "PodmanResource" (
           "projectId", "podmanHostId", "kind", "name",
           "containerId", "imageName", "state",
           "latestCpuPercent", "latestMemoryBytes",
-          "metricsUpdatedAt", "lastSeenAt", "version"
+          "metricsUpdatedAt", "lastSeenAt", "version",
+          "labels", "resourceCreationTimestamp"
         )
         VALUES ${valueFragments.join(", ")}
         ON CONFLICT ("projectId", "podmanHostId", "kind", "name")
@@ -180,6 +205,22 @@ export class Service extends DatabaseService<Model> {
           "latestMemoryBytes" = COALESCE(EXCLUDED."latestMemoryBytes", "PodmanResource"."latestMemoryBytes"),
           "metricsUpdatedAt" = EXCLUDED."metricsUpdatedAt",
           "lastSeenAt" = EXCLUDED."lastSeenAt",
+          "labels" = CASE
+            WHEN EXCLUDED."labels" IS NULL THEN "PodmanResource"."labels"
+            WHEN lower(left(EXCLUDED."containerId", 12)) <> lower(left("PodmanResource"."containerId", 12))
+              THEN EXCLUDED."labels"
+            WHEN jsonb_typeof("PodmanResource"."labels") = 'object'
+              THEN "PodmanResource"."labels" || EXCLUDED."labels"
+            ELSE EXCLUDED."labels"
+          END,
+          "resourceCreationTimestamp" = CASE
+            WHEN EXCLUDED."resourceCreationTimestamp" IS NULL THEN "PodmanResource"."resourceCreationTimestamp"
+            WHEN "PodmanResource"."resourceCreationTimestamp" IS NULL
+              OR lower(left(EXCLUDED."containerId", 12)) <> lower(left("PodmanResource"."containerId", 12))
+              OR EXCLUDED."resourceCreationTimestamp" > "PodmanResource"."resourceCreationTimestamp" + interval '1 minute'
+              THEN EXCLUDED."resourceCreationTimestamp"
+            ELSE "PodmanResource"."resourceCreationTimestamp"
+          END,
           "updatedAt" = now()
         WHERE EXCLUDED."lastSeenAt" >= "PodmanResource"."lastSeenAt"
       `;

package/Server/Services/ScheduledMaintenanceReminderRuleService.ts

@@ -102,10 +102,34 @@ export class Service extends DatabaseService<Model> {
     return onDelete;
   }
 
+  /*
+   * Re-matches the reminder rule for every open scheduled maintenance in the
+   * project and rewrites its nextReminderNotificationAt.
+   *
+   * Without options that is one read of at most LIMIT_MAX open scheduled
+   * maintenances, and it must stay one: the rule create, update and delete
+   * hooks run it inside the API request.
+   *
+   * `onlyWithoutNextReminder` narrows that to open scheduled maintenances with
+   * no reminder scheduled at all, and reads every one of them, in `_id`-ordered
+   * pages of LIMIT_MAX. It exists for backfills (see the
+   * ScheduleRemindersMissedByReminderRuleLookup data migration), which run in a
+   * worker rather than a request and must reach every such scheduled
+   * maintenance of the project, however many there are. The pages are cursored
+   * by `_id`, not offset, because refreshing a scheduled maintenance can take
+   * it out of the set being paged. A scheduled maintenance that already has a
+   * timestamp is left alone, because re-scheduling it would push a reminder
+   * that is due, or overdue, one full interval later.
+   */
   @CaptureSpan()
   public async refreshSchedulesForOpenScheduledMaintenances(
     projectId: ObjectID,
+    options?: { onlyWithoutNextReminder?: boolean | undefined } | undefined,
   ): Promise<void> {
+    const onlyWithoutNextReminder: boolean = Boolean(
+      options?.onlyWithoutNextReminder,
+    );
+
     try {
       const openStates: Array<ScheduledMaintenanceState> =
         await ScheduledMaintenanceStateService.findBy({
@@ -133,34 +157,55 @@ export class Service extends DatabaseService<Model> {
         return;
       }
 
-      const openScheduledMaintenances: Array<ScheduledMaintenance> =
-        await ScheduledMaintenanceService.findBy({
-          query: {
-            projectId: projectId,
-            currentScheduledMaintenanceStateId: QueryHelper.any(openStateIds),
-          },
-          select: {
-            _id: true,
-          },
-          limit: LIMIT_MAX,
-          skip: 0,
-          props: {
-            isRoot: true,
-          },
-        });
+      let afterId: ObjectID | null = null;
 
-      for (const scheduledMaintenance of openScheduledMaintenances) {
-        try {
-          await ScheduledMaintenanceService.refreshReminderSchedule({
-            scheduledMaintenanceId: scheduledMaintenance.id!,
+      while (true) {
+        const openScheduledMaintenances: Array<ScheduledMaintenance> =
+          await this.findOpenScheduledMaintenances({
             projectId: projectId,
+            openStateIds: openStateIds,
+            onlyWithoutNextReminder: onlyWithoutNextReminder,
+            afterId: afterId,
           });
-        } catch (error) {
-          logger.error(
-            `Failed to refresh reminder schedule for scheduled maintenance ${scheduledMaintenance.id}: ${error}`,
-            { projectId: projectId?.toString() } as LogAttributes,
+
+        for (const scheduledMaintenance of openScheduledMaintenances) {
+          try {
+            await ScheduledMaintenanceService.refreshReminderSchedule({
+              scheduledMaintenanceId: scheduledMaintenance.id!,
+              projectId: projectId,
+            });
+          } catch (error) {
+            logger.error(
+              `Failed to refresh reminder schedule for scheduled maintenance ${scheduledMaintenance.id}: ${error}`,
+              { projectId: projectId?.toString() } as LogAttributes,
+            );
+          }
+        }
+
+        // Without the option, the one read above is all there is.
+        if (
+          !onlyWithoutNextReminder ||
+          openScheduledMaintenances.length < LIMIT_MAX
+        ) {
+          return;
+        }
+
+        const lastId: ObjectID | null =
+          openScheduledMaintenances[openScheduledMaintenances.length - 1]!.id;
+
+        if (!lastId || (afterId && lastId.toString() <= afterId.toString())) {
+          /*
+           * A full page whose last row does not move the cursor forward
+           * would be read again forever. Not reachable with `_id ASC` and a
+           * `> afterId` filter; guarded so a broken sort cannot hang the
+           * backfill.
+           */
+          throw new Error(
+            "the open scheduled maintenance page did not advance its _id cursor",
           );
         }
+
+        afterId = lastId;
       }
     } catch (error) {
       logger.error(
@@ -170,6 +215,45 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /*
+   * One read of the project's open scheduled maintenances: those whose current
+   * state is one of `openStateIds`. Both paths of
+   * refreshSchedulesForOpenScheduledMaintenances read through here, so what
+   * "open" means is written once.
+   *
+   * With `onlyWithoutNextReminder`, only those with no reminder scheduled,
+   * `_id` ascending and after `afterId` when there is one. Without it, no
+   * cursor and the default order: the read the rule hooks have always made.
+   */
+  private async findOpenScheduledMaintenances(data: {
+    projectId: ObjectID;
+    openStateIds: Array<ObjectID>;
+    onlyWithoutNextReminder: boolean;
+    afterId: ObjectID | null;
+  }): Promise<Array<ScheduledMaintenance>> {
+    return await ScheduledMaintenanceService.findBy({
+      query: {
+        projectId: data.projectId,
+        currentScheduledMaintenanceStateId: QueryHelper.any(data.openStateIds),
+        ...(data.onlyWithoutNextReminder
+          ? { nextReminderNotificationAt: QueryHelper.isNull() }
+          : {}),
+        ...(data.afterId ? { _id: QueryHelper.greaterThan(data.afterId) } : {}),
+      },
+      select: {
+        _id: true,
+      },
+      ...(data.onlyWithoutNextReminder
+        ? { sort: { _id: SortOrder.Ascending } }
+        : {}),
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
   @CaptureSpan()
   public async findMatchingRule(data: {
     projectId: ObjectID;

package/Server/Services/ServiceService.ts

@@ -502,7 +502,7 @@ export class Service extends DatabaseService<Model> {
     };
 
     return crypto
-      .createHash("sha1")
+      .createHash("sha256")
       .update(JSON.stringify(normalized))
       .digest("hex");
   }

package/Server/Services/TelemetryUsageBillingService.ts

@@ -32,6 +32,7 @@ import KubernetesClusterService from "./KubernetesClusterService";
 import ProxmoxClusterService from "./ProxmoxClusterService";
 import VMwareVCenterService from "./VMwareVCenterService";
 import CephClusterService from "./CephClusterService";
+import DatabaseServerService from "./DatabaseServerService";
 import IoTFleetService from "./IoTFleetService";
 import Host from "../../Models/DatabaseModels/Host";
 import DockerHost from "../../Models/DatabaseModels/DockerHost";
@@ -41,6 +42,7 @@ import ProxmoxCluster from "../../Models/DatabaseModels/ProxmoxCluster";
 import VMwareVCenter from "../../Models/DatabaseModels/VMwareVCenter";
 import IoTFleet from "../../Models/DatabaseModels/IoTFleet";
 import CephCluster from "../../Models/DatabaseModels/CephCluster";
+import DatabaseServer from "../../Models/DatabaseModels/DatabaseServer";
 import ServiceType from "../../Types/Telemetry/ServiceType";
 import {
   AverageSpanRowSizeInBytes,
@@ -485,8 +487,8 @@ export class Service extends DatabaseService<Model> {
   /*
    * Map of resourceId -> retainTelemetryDataForDays for every resource in
    * the project that can own telemetry (Service, Host, DockerHost,
-   * KubernetesCluster, ProxmoxCluster, VMwareVCenter, CephCluster). Used to
-   * scale billed
+   * KubernetesCluster, ProxmoxCluster, VMwareVCenter, CephCluster,
+   * DatabaseServer). Used to scale billed
    * cost by the actual retention applied to each resource's telemetry.
    * Resources without an override (and the unattributed bucket) fall back
    * to the project default.
@@ -628,6 +630,31 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    /*
+     * Databases are mostly auto-discovered (collector, client spans,
+     * Kubernetes / Docker / Podman), so a project can hold hundreds of
+     * them. Only rows carrying an override matter here — read just those.
+     */
+    const databaseServers: Array<DatabaseServer> =
+      await DatabaseServerService.findBy({
+        query: {
+          projectId: projectId,
+          retainTelemetryDataForDays: QueryHelper.notNull(),
+        },
+        select: { _id: true, retainTelemetryDataForDays: true },
+        skip: 0,
+        limit: LIMIT_MAX,
+        props: { isRoot: true },
+      });
+    for (const databaseServer of databaseServers) {
+      if (databaseServer.id && databaseServer.retainTelemetryDataForDays) {
+        retentionByServiceId.set(
+          databaseServer.id.toString(),
+          databaseServer.retainTelemetryDataForDays,
+        );
+      }
+    }
+
     const iotFleets: Array<IoTFleet> = await IoTFleetService.findBy({
       query: { projectId: projectId },
       select: { _id: true, retainTelemetryDataForDays: true },

package/Server/Services/UserProjectSsoConsentService.ts

@@ -0,0 +1,74 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/UserProjectSsoConsent";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+/*
+ * See the model for what a row means. Written only from the confirmation link
+ * a project-SSO sign-in emails to the account's own address; read on every
+ * project-SSO sign-in on the hosted service.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  public async hasConsent(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<boolean> {
+    const count: PositiveNumber = await this.countBy({
+      query: {
+        userId: data.userId,
+        projectId: data.projectId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    return count.toNumber() > 0;
+  }
+
+  /*
+   * Idempotent. Two clicks on the same link, or two links for the same
+   * project, must end with one row and no error for whoever clicked second.
+   */
+  @CaptureSpan()
+  public async recordConsent(data: {
+    userId: ObjectID;
+    projectId: ObjectID;
+  }): Promise<void> {
+    if (await this.hasConsent(data)) {
+      return;
+    }
+
+    const consent: Model = new Model();
+    consent.userId = data.userId;
+    consent.projectId = data.projectId;
+
+    try {
+      await this.create({
+        data: consent,
+        props: {
+          isRoot: true,
+        },
+      });
+    } catch (err) {
+      /*
+       * Lost a race with a concurrent click: the unique index turned the
+       * second insert away, and the row it wanted is there. Anything else is
+       * a real failure.
+       */
+      if (await this.hasConsent(data)) {
+        return;
+      }
+
+      throw err;
+    }
+  }
+}
+
+export default new Service();

package/Server/Services/UserService.ts

@@ -799,13 +799,26 @@ export class Service extends DatabaseService<Model> {
    * `isMasterAdmin` on a self-service signup. It always assigns the column, so
    * an `isMasterAdmin: true` smuggled into the request body is overwritten
    * rather than honoured (signup creates with `isRoot: true`, which bypasses
-   * the column's empty `create: []` access control).
+   * the column's empty `create: []` access control). For the same reason it
+   * refuses a user that already carries an `_id`.
    */
   @CaptureSpan()
   public async createUserOnSignup(data: {
     user: Model;
     props: DatabaseCommonInteractionProps;
   }): Promise<Model> {
+    /*
+     * A signup is always a new row. TypeORM's save() turns an entity carrying
+     * an existing primary key into an UPDATE of that row, and this create runs
+     * as root, which DatabaseService.create exempts from its own supplied-id
+     * check -- so an `_id` reaching here would overwrite the email and password
+     * of whichever user it names instead of creating one. /signup builds its
+     * model from an allow-list that never includes `_id`; this is the backstop.
+     */
+    if (data.user._id) {
+      throw new BadDataException("An id cannot be supplied when signing up.");
+    }
+
     // Never inherited from the caller. Decided below, or not at all.
     data.user.isMasterAdmin = false;