@oneuptime/common 14.0.6 → 14.0.8

package/Server/Infrastructure/Postgres/SchemaMigrations/1795800000000-AddIncidentCustomFieldCreateAndNotificationSettings.ts

@@ -0,0 +1,168 @@
+import { generateCustomFieldVariableKey } from "../../../../Types/CustomField/CustomFieldVariableKey";
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Incident custom field settings for declaring incidents and for subscriber
+ * emails (OneUptime/oneuptime#4035):
+ *
+ * - isRequiredOnCreate, sortOrder, showOnCreate and
+ *   includeInSubscriberNotifications: plain settings. The three flags start
+ *   off, and no field has an order, so every existing field behaves as it did.
+ * - variableKey: the key templates reach a field by, {{customFields.<key>}}.
+ *   Unique per project (the index), made from the name when a field is
+ *   created and never changed afterwards. Nullable only because the table
+ *   already has rows; the backfill below gives each of them a key.
+ *
+ * The backfill runs here, in the same transaction as the columns, rather than
+ * in a batched data migration like the subscriber tokens: definition tables
+ * hold a few dozen rows a project, and a key has to exist before anything
+ * lists a field's template variable. Keys are made by the same generator the
+ * service uses for a new field, so an existing field gets the key it would
+ * have got had it been created today. Within a project the oldest field wins
+ * the plain key and later ones get _2, _3, ...
+ *
+ * down() drops the columns and the index; the keys cannot be recovered, and
+ * templates that use them stop filling in.
+ */
+
+// Rows written per UPDATE: two parameters each, well under Postgres' limit.
+const BACKFILL_BATCH_SIZE: number = 500;
+
+type BackfillQueryRunner = Pick<QueryRunner, "query">;
+
+interface FieldRow {
+  _id: string;
+  projectId: string;
+  name: string | null;
+  variableKey: string | null;
+}
+
+/**
+ * Give every incident custom field without a template key one. Idempotent:
+ * a key already there is kept, and counted as taken for the others.
+ * Returns how many fields it gave a key.
+ */
+export const backfillIncidentCustomFieldVariableKeys: (
+  queryRunner: BackfillQueryRunner,
+) => Promise<number> = async (
+  queryRunner: BackfillQueryRunner,
+): Promise<number> => {
+  const rows: Array<FieldRow> = await queryRunner.query(
+    `SELECT "_id", "projectId", "name", "variableKey" FROM "IncidentCustomField" ORDER BY "projectId" ASC, "createdAt" ASC, "_id" ASC`,
+  );
+
+  const takenByProject: Map<string, Set<string>> = new Map<
+    string,
+    Set<string>
+  >();
+
+  for (const row of rows) {
+    const taken: Set<string> =
+      takenByProject.get(row.projectId) || new Set<string>();
+
+    if (row.variableKey) {
+      taken.add(row.variableKey);
+    }
+
+    takenByProject.set(row.projectId, taken);
+  }
+
+  const assignments: Array<{ id: string; variableKey: string }> = [];
+
+  for (const row of rows) {
+    if (row.variableKey) {
+      continue;
+    }
+
+    const taken: Set<string> = takenByProject.get(row.projectId)!;
+
+    const variableKey: string = generateCustomFieldVariableKey({
+      name: row.name || "",
+      existingKeys: taken,
+    });
+
+    taken.add(variableKey);
+    assignments.push({ id: row._id, variableKey: variableKey });
+  }
+
+  for (
+    let start: number = 0;
+    start < assignments.length;
+    start += BACKFILL_BATCH_SIZE
+  ) {
+    const batch: Array<{ id: string; variableKey: string }> = assignments.slice(
+      start,
+      start + BACKFILL_BATCH_SIZE,
+    );
+
+    const values: Array<string> = [];
+    const parameters: Array<string> = [];
+
+    for (const assignment of batch) {
+      parameters.push(assignment.id, assignment.variableKey);
+      values.push(
+        `($${parameters.length - 1}::uuid, $${parameters.length}::varchar)`,
+      );
+    }
+
+    await queryRunner.query(
+      `UPDATE "IncidentCustomField" AS "field" SET "variableKey" = "keys"."variableKey" FROM (VALUES ${values.join(
+        ", ",
+      )}) AS "keys"("_id", "variableKey") WHERE "field"."_id" = "keys"."_id" AND "field"."variableKey" IS NULL`,
+      parameters,
+    );
+  }
+
+  return assignments.length;
+};
+
+export class AddIncidentCustomFieldCreateAndNotificationSettings1795800000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddIncidentCustomFieldCreateAndNotificationSettings1795800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "isRequiredOnCreate" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "sortOrder" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "showOnCreate" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "includeInSubscriberNotifications" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "variableKey" character varying(100)`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_0a49bcb055baad4356af439169" ON "IncidentCustomField" ("projectId", "variableKey") `,
+    );
+
+    await backfillIncidentCustomFieldVariableKeys(queryRunner);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0a49bcb055baad4356af439169"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "variableKey"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "includeInSubscriberNotifications"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "showOnCreate"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "sortOrder"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "isRequiredOnCreate"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1795900000000-AddSubscriberNotificationClaimedAt.ts

@@ -0,0 +1,44 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * When a subscriber job claimed the 'incident created', 'postmortem' and
+ * 'episode created' notifications (SubscriberNotificationClaim), for the
+ * sweeper (StatusPageSubscriber:TimeoutStuckNotifications) to time an
+ * interrupted send from. It used updatedAt, which other code writes on a
+ * schedule while an incident or episode is open - the owners' reminders,
+ * state changes, incidents joining an episode - so a send cut off by a
+ * redeploy could stay In progress until the incident went quiet.
+ *
+ * Nullable timestamps with no default: adding them rewrites nothing. A row
+ * claimed before they existed has none, and the sweeper times it from
+ * updatedAt, as before.
+ */
+export class AddSubscriberNotificationClaimedAt1795900000000
+  implements MigrationInterface
+{
+  public name: string = "AddSubscriberNotificationClaimedAt1795900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentEpisode" ADD "subscriberNotificationClaimedAtOnEpisodeCreated" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" ADD "subscriberNotificationClaimedAtOnIncidentCreated" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" ADD "subscriberNotificationClaimedAtOnPostmortemPublished" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Incident" DROP COLUMN "subscriberNotificationClaimedAtOnPostmortemPublished"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" DROP COLUMN "subscriberNotificationClaimedAtOnIncidentCreated"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentEpisode" DROP COLUMN "subscriberNotificationClaimedAtOnEpisodeCreated"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -12,6 +12,14 @@ import { AddSessionReplaySameOriginTracePropagation1794800000000 } from "./17948
 import { AddIncidentAlert1794900000000 } from "./1794900000000-AddIncidentAlert";
 import { AddDatabaseServerTables1795000000000 } from "./1795000000000-AddDatabaseServerTables";
 import { AddUserProjectSsoConsent1795100000000 } from "./1795100000000-AddUserProjectSsoConsent";
+import { AddInventoryItemProjectEntityKeyIndex1795200000000 } from "./1795200000000-AddInventoryItemProjectEntityKeyIndex";
+import { SkipHiddenIncidentCreatedNotifications1795300000000 } from "./1795300000000-SkipHiddenIncidentCreatedNotifications";
+import { AddIncidentStatusPageScope1795400000000 } from "./1795400000000-AddIncidentStatusPageScope";
+import { AddIncidentTemplateStatusPageScopeFlag1795500000000 } from "./1795500000000-AddIncidentTemplateStatusPageScopeFlag";
+import { AddStatusPageSubscriberUnsubscribeToken1795600000000 } from "./1795600000000-AddStatusPageSubscriberUnsubscribeToken";
+import { AddStatusPageSubscriberIsAddedByTeam1795700000000 } from "./1795700000000-AddStatusPageSubscriberIsAddedByTeam";
+import { AddIncidentCustomFieldCreateAndNotificationSettings1795800000000 } from "./1795800000000-AddIncidentCustomFieldCreateAndNotificationSettings";
+import { AddSubscriberNotificationClaimedAt1795900000000 } from "./1795900000000-AddSubscriberNotificationClaimedAt";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1224,4 +1232,12 @@ export default [
   AddIncidentAlert1794900000000,
   AddDatabaseServerTables1795000000000,
   AddUserProjectSsoConsent1795100000000,
+  AddInventoryItemProjectEntityKeyIndex1795200000000,
+  SkipHiddenIncidentCreatedNotifications1795300000000,
+  AddIncidentStatusPageScope1795400000000,
+  AddIncidentTemplateStatusPageScopeFlag1795500000000,
+  AddStatusPageSubscriberUnsubscribeToken1795600000000,
+  AddStatusPageSubscriberIsAddedByTeam1795700000000,
+  AddIncidentCustomFieldCreateAndNotificationSettings1795800000000,
+  AddSubscriberNotificationClaimedAt1795900000000,
 ];

package/Server/Infrastructure/Semaphore.ts

@@ -81,6 +81,12 @@ export default class Semaphore {
     acquireTimeout?: number | undefined;
     acquireAttemptsLimit?: number | undefined;
     retryInterval?: number | undefined;
+    /*
+     * Called when a held permit could not be refreshed and has lapsed. By
+     * default redis-semaphore throws from its refresh timer, which nothing
+     * can catch; a holder that runs for long should pass one.
+     */
+    onLockLost?: ((err: Error) => void) | undefined;
   }): Promise<SemaphorePermit> {
     if (!Number.isInteger(data.limit) || data.limit <= 0) {
       throw new Error("Semaphore permit limit must be a positive integer");
@@ -108,6 +114,10 @@ export default class Semaphore {
       lockOptions.retryInterval = data.retryInterval;
     }
 
+    if (data.onLockLost) {
+      lockOptions.onLockLost = data.onLockLost;
+    }
+
     const permit: SemaphorePermit = new RedisSemaphore(
       client,
       `${data.namespace}-${data.key}`,

package/Server/Middleware/IdentityRateLimit.ts

@@ -74,6 +74,17 @@ import TooManyRequestsException from "../../Types/Exception/TooManyRequestsExcep
  * DatabaseNotConnectedException when Redis is down. Logging in is already
  * impossible in that state; the difference this makes is a 503 that says to
  * come back shortly instead of a 500.
+ *
+ * ONE ROUTE HERE SENDS MAIL RATHER THAN CHECKING A CREDENTIAL
+ *
+ * POST /resend-verification-email (Authentication.ts) is limited by this
+ * middleware too, on a bucket of its own. It is not a guessing oracle against
+ * a stored credential -- the credential it takes is server-minted and signed,
+ * or a random UUID from an emailed link -- but every request that gets past its
+ * checks makes the server send an email, and an anonymous route that sends
+ * mail needs a ceiling in front of its database reads and its caps. It shares
+ * the fail-closed choice for the same reason: its own cooldown fence lives in
+ * Redis, so with Redis down it could not bound anything either.
  */
 
 /*
@@ -144,6 +155,15 @@ export enum IdentityRateLimitBucket {
 
   // Discoverable passkey requests have no account identifier until verified.
   Passkey = "passkey",
+
+  /*
+   * POST /resend-verification-email -- an unverified account asking for its
+   * verification link again. Mail, not guessing: see
+   * VERIFICATION_EMAIL_RESEND_BUCKET. Its own counter so that a user mashing
+   * "resend" cannot spend the sign-in attempts they are about to need, and so
+   * that sign-in noise cannot refuse the resend.
+   */
+  VerificationEmailResend = "verification-email-resend",
 }
 
 export enum IdentityRateLimitScope {
@@ -413,6 +433,55 @@ const PASSKEY_BUCKET: BucketConfig = {
   perIpLimit: PASSKEY_RATE_LIMIT,
 };
 
+/*
+ * Verification email resend budget.
+ *
+ * Shaped like the passkey bucket, and for the same reason: the request carries
+ * no email address (it carries a signed resend token or a verification link
+ * token instead), so resolveAccountKey answers "none" and the account counter
+ * is keyed on the client address alone. Both counters are therefore the same
+ * per-address budget and are given the same number; a caller who adds an
+ * `email` field to rotate the account key still meets the address ceiling.
+ *
+ * This is NOT what bounds mail to any one inbox. The route's own caps do that
+ * per account -- a cooldown between sends, a per-hour cap, and a small fixed
+ * number of sends per credential (VerificationEmailResendPolicy) -- and those
+ * hold however many addresses a caller has. What this bounds is how much work
+ * one address can make the route do before those caps are even consulted:
+ * token verification, a verification-token lookup, a user lookup and a Redis
+ * read per request.
+ *
+ * Twenty a quarter hour is far past an honest user, who presses the button a
+ * handful of times at most because the page itself counts the cooldown down,
+ * and still generous to an office behind one NAT where several people are
+ * finishing signup at once.
+ */
+const VERIFICATION_EMAIL_RESEND_RATE_LIMIT: number = parsePositiveIntFromEnv(
+  "IDENTITY_VERIFICATION_EMAIL_RESEND_RATE_LIMIT_PER_IP_PER_WINDOW",
+  20,
+);
+const VERIFICATION_EMAIL_RESEND_BUCKET: BucketConfig = {
+  windowSeconds: parsePositiveIntFromEnv(
+    "IDENTITY_VERIFICATION_EMAIL_RESEND_RATE_LIMIT_WINDOW_SECONDS",
+    15 * 60,
+  ),
+  perAccountLimit: VERIFICATION_EMAIL_RESEND_RATE_LIMIT,
+  perIpLimit: VERIFICATION_EMAIL_RESEND_RATE_LIMIT,
+};
+
+/*
+ * What a refused caller is told. See getRefusalMessages for why the sign-in
+ * routes all share one pair and the resend route has its own.
+ */
+export const IDENTITY_RATE_LIMITED_MESSAGE: string =
+  "Too many sign-in attempts. Please try again later.";
+export const IDENTITY_COUNTER_UNAVAILABLE_MESSAGE: string =
+  "Unable to sign you in right now. Please try again shortly.";
+export const VERIFICATION_EMAIL_RESEND_RATE_LIMITED_MESSAGE: string =
+  "Too many requests for a new verification email. Please try again later.";
+export const VERIFICATION_EMAIL_RESEND_UNAVAILABLE_MESSAGE: string =
+  "Unable to send a verification email right now. Please try again shortly.";
+
 const KEY_PREFIX: string = "identity:rl:";
 
 /*
@@ -574,9 +643,44 @@ export default class IdentityRateLimit {
       return STATUS_PAGE_LOGIN_BUCKET;
     }
 
+    if (bucket === IdentityRateLimitBucket.VerificationEmailResend) {
+      return VERIFICATION_EMAIL_RESEND_BUCKET;
+    }
+
     return LOGIN_BUCKET;
   }
 
+  /*
+   * What a refused request is told, for the 429 and for the fail-closed 503.
+   *
+   * Every sign-in bucket gets the same pair, byte for byte, whichever counter
+   * fired and whichever route was hit -- see the note in getMiddleware on why
+   * a sign-in limiter must not answer differently for different accounts.
+   *
+   * The resend route gets its own pair because the sign-in wording is simply
+   * wrong there: somebody who pressed "resend verification email" has made no
+   * sign-in attempt, and telling them they made too many would send them
+   * looking for a problem they do not have. The pair is still uniform WITHIN
+   * the route: the same text for every caller, token and account, so it
+   * discloses nothing the sign-in pair does not.
+   */
+  public static getRefusalMessages(bucket: IdentityRateLimitBucket): {
+    rateLimited: string;
+    unavailable: string;
+  } {
+    if (bucket === IdentityRateLimitBucket.VerificationEmailResend) {
+      return {
+        rateLimited: VERIFICATION_EMAIL_RESEND_RATE_LIMITED_MESSAGE,
+        unavailable: VERIFICATION_EMAIL_RESEND_UNAVAILABLE_MESSAGE,
+      };
+    }
+
+    return {
+      rateLimited: IDENTITY_RATE_LIMITED_MESSAGE,
+      unavailable: IDENTITY_COUNTER_UNAVAILABLE_MESSAGE,
+    };
+  }
+
   /*
    * Increment both counters for this request and decide.
    *
@@ -773,13 +877,14 @@ export default class IdentityRateLimit {
          * account exists. These routes are careful not to say which half of a
          * credential was wrong; a limiter that answered differently for a real
          * address than for an invented one would hand back the account
-         * enumeration the handlers withhold.
+         * enumeration the handlers withhold. (The resend route has wording of
+         * its own, but it is just as uniform; see getRefusalMessages.)
          */
         return Response.sendErrorResponse(
           req,
           res,
           new TooManyRequestsException(
-            "Too many sign-in attempts. Please try again later.",
+            IdentityRateLimit.getRefusalMessages(bucket).rateLimited,
           ),
         );
       }
@@ -800,7 +905,7 @@ export default class IdentityRateLimit {
           req,
           res,
           new ServiceUnavailableException(
-            "Unable to sign you in right now. Please try again shortly.",
+            IdentityRateLimit.getRefusalMessages(bucket).unavailable,
           ),
         );
       }

package/Server/Middleware/SubscriberNotificationPreviewRateLimit.ts

@@ -0,0 +1,237 @@
+import Redis, { ClientType } from "../Infrastructure/Redis";
+import {
+  ExpressRequest,
+  ExpressResponse,
+  NextFunction,
+} from "../Utils/Express";
+import logger from "../Utils/Logger";
+import Response from "../Utils/Response";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
+import SubscriberNotificationTestSendRateLimit from "./SubscriberNotificationTestSendRateLimit";
+
+/*
+ * Request limiting for "Preview notification" (POST /preview on the
+ * subscriber notification preview router).
+ *
+ * A preview sends nothing, but it is not free: it renders the incident's
+ * description and custom fields once, then an email for every status page
+ * the caller can read, and returns all of that HTML in one answer. Any
+ * project member holding one of the audience roles may call it, as often as
+ * they like, so this bounds how much rendering one person can ask the App
+ * server for. The request itself is bounded too
+ * (SubscriberNotificationPreviewBuilder.parseRequest caps the text and the
+ * custom field values).
+ *
+ * The limit is loose: someone writing an incident or a note and previewing
+ * it after each change is nowhere near it. The counter is per user, across
+ * every project and incident, like the test email's
+ * (SubscriberNotificationTestSendRateLimit, whose user key this shares).
+ *
+ * THIS FAILS OPEN
+ *
+ * If Redis is unreachable the preview is served. That is the opposite of the
+ * test email's choice, and the difference is what is at stake: a test email
+ * is real mail, and this counter would be the only bound on it; a preview
+ * sends nothing, its request is size-capped, and refusing it would take the
+ * preview away from everyone for as long as Redis is down.
+ */
+
+export enum SubscriberNotificationPreviewRateLimitOutcome {
+  Allowed = "allowed",
+  RateLimited = "rate-limited",
+
+  // Redis is unreachable: served, since this fails open.
+  CounterUnavailable = "counter-unavailable",
+}
+
+export interface SubscriberNotificationPreviewRateLimitDecision {
+  outcome: SubscriberNotificationPreviewRateLimitOutcome;
+  retryAfterSeconds?: number | undefined;
+  // True only on the request that first crossed the line in this window.
+  isFirstRejectionInWindow?: boolean | undefined;
+}
+
+export interface SubscriberNotificationPreviewRateLimitConfig {
+  windowSeconds: number;
+  perUserLimit: number;
+}
+
+const KEY_PREFIX: string = "subnotifpreview:rl:";
+
+// Counter keys outlive their window by one full window.
+const TTL_MULTIPLIER: number = 2;
+
+// How often the "counter unavailable" condition may be logged.
+const COUNTER_UNAVAILABLE_LOG_INTERVAL_MS: number = 60 * 1000;
+
+export default class SubscriberNotificationPreviewRateLimit {
+  // Sixty previews every ten minutes: one every ten seconds, sustained.
+  private static readonly config: SubscriberNotificationPreviewRateLimitConfig =
+    {
+      windowSeconds: 10 * 60,
+      perUserLimit: 60,
+    };
+
+  private static counterUnavailableLastLoggedAt: number = 0;
+
+  // The limit in force, for tests and for operators' diagnostics.
+  public static getConfig(): SubscriberNotificationPreviewRateLimitConfig {
+    return { ...SubscriberNotificationPreviewRateLimit.config };
+  }
+
+  /*
+   * Count this request against the user and decide. A rejected request is
+   * counted too, so a caller who keeps trying keeps their window pinned.
+   */
+  public static async consume(data: {
+    userKey: string;
+  }): Promise<SubscriberNotificationPreviewRateLimitDecision> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      return {
+        outcome:
+          SubscriberNotificationPreviewRateLimitOutcome.CounterUnavailable,
+      };
+    }
+
+    const config: SubscriberNotificationPreviewRateLimitConfig =
+      SubscriberNotificationPreviewRateLimit.config;
+    const windowMs: number = config.windowSeconds * 1000;
+    const windowIndex: number = Math.floor(Date.now() / windowMs);
+    const counterKey: string = `${KEY_PREFIX}u:${data.userKey}:${windowIndex}`;
+
+    try {
+      const count: number = await client.incr(counterKey);
+
+      if (typeof count !== "number") {
+        throw new Error("Rate limit counter returned a non-numeric value");
+      }
+
+      // Set only by the request that created the key, so the window is fixed.
+      if (count === 1) {
+        await client.expire(counterKey, config.windowSeconds * TTL_MULTIPLIER);
+      }
+
+      if (count > config.perUserLimit) {
+        return {
+          outcome: SubscriberNotificationPreviewRateLimitOutcome.RateLimited,
+          retryAfterSeconds:
+            SubscriberNotificationTestSendRateLimit.getSecondsUntilWindowEnd(
+              config.windowSeconds,
+            ),
+          isFirstRejectionInWindow: count === config.perUserLimit + 1,
+        };
+      }
+
+      return {
+        outcome: SubscriberNotificationPreviewRateLimitOutcome.Allowed,
+      };
+    } catch (err) {
+      if (
+        SubscriberNotificationPreviewRateLimit.shouldLogCounterUnavailable()
+      ) {
+        logger.warn(
+          `SubscriberNotificationPreviewRateLimit: counter failed for user ${data.userKey}`,
+        );
+        logger.warn(err);
+      }
+
+      return {
+        outcome:
+          SubscriberNotificationPreviewRateLimitOutcome.CounterUnavailable,
+      };
+    }
+  }
+
+  /*
+   * Express middleware. Register after UserMiddleware (the counter is per
+   * user) and before the handler, so a flood is refused before it renders
+   * anything.
+   */
+  public static getMiddleware(): (
+    req: ExpressRequest,
+    res: ExpressResponse,
+    next: NextFunction,
+  ) => Promise<void> {
+    return async (
+      req: ExpressRequest,
+      res: ExpressResponse,
+      next: NextFunction,
+    ): Promise<void> => {
+      const userKey: string =
+        SubscriberNotificationTestSendRateLimit.resolveUserKey(req);
+
+      const decision: SubscriberNotificationPreviewRateLimitDecision =
+        await SubscriberNotificationPreviewRateLimit.consume({
+          userKey: userKey,
+        });
+
+      if (
+        decision.outcome ===
+        SubscriberNotificationPreviewRateLimitOutcome.RateLimited
+      ) {
+        if (decision.retryAfterSeconds) {
+          const setHeader: unknown = (
+            res as unknown as Record<string, unknown>
+          )["setHeader"];
+
+          if (typeof setHeader === "function") {
+            (setHeader as (name: string, value: string) => void).call(
+              res,
+              "Retry-After",
+              String(decision.retryAfterSeconds),
+            );
+          }
+        }
+
+        if (decision.isFirstRejectionInWindow) {
+          logger.warn(
+            `SubscriberNotificationPreviewRateLimit: rejected previews from user ${userKey} for the rest of this window`,
+          );
+        }
+
+        return Response.sendErrorResponse(
+          req,
+          res,
+          new TooManyRequestsException(
+            "You have previewed notifications too many times in a short while. Please try again in a few minutes.",
+          ),
+        );
+      }
+
+      if (
+        decision.outcome ===
+          SubscriberNotificationPreviewRateLimitOutcome.CounterUnavailable &&
+        SubscriberNotificationPreviewRateLimit.shouldLogCounterUnavailable()
+      ) {
+        // Fails open: see the note at the top of this file.
+        logger.warn(
+          "SubscriberNotificationPreviewRateLimit: rate limit counter unavailable, serving previews without a limit",
+        );
+      }
+
+      return next();
+    };
+  }
+
+  /*
+   * A Redis outage means every request takes the unavailable path; one log
+   * line per interval makes the condition visible without burying the rest.
+   */
+  private static shouldLogCounterUnavailable(): boolean {
+    const now: number = Date.now();
+
+    if (
+      now -
+        SubscriberNotificationPreviewRateLimit.counterUnavailableLastLoggedAt <
+      COUNTER_UNAVAILABLE_LOG_INTERVAL_MS
+    ) {
+      return false;
+    }
+
+    SubscriberNotificationPreviewRateLimit.counterUnavailableLastLoggedAt = now;
+
+    return true;
+  }
+}