@oneuptime/common 14.0.7 → 14.0.9

package/build/dist/Server/Services/StatusPageSubscriberService.js

@@ -13,8 +13,10 @@ import { AllowedSubscribersCountInFreePlan, IsBillingEnabled, } from "../Environ
 import ProjectSMTPConfigService from "../Services/ProjectSmtpConfigService";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import QueryHelper from "../Types/Database/QueryHelper";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import logger from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
+import GlobalCache from "../Infrastructure/GlobalCache";
 import MailService from "./MailService";
 import ProjectCallSMSConfigService from "./ProjectCallSMSConfigService";
 import ProjectService from "./ProjectService";
@@ -36,12 +38,109 @@ import MicrosoftTeamsUtil from "../Utils/Workspace/MicrosoftTeams/MicrosoftTeams
 import StatusPageSubscriberWebhookUtil from "../Utils/StatusPageSubscriberWebhook";
 import SSRFProtection from "../Utils/SSRFProtection";
 import StatusPageSubscriberNotificationTemplateService, { Service as StatusPageSubscriberNotificationTemplateServiceClass, } from "./StatusPageSubscriberNotificationTemplateService";
+import TeamMemberService from "./TeamMemberService";
+import UserService from "./UserService";
+import OneUptimeDate from "../../Types/Date";
+import ModelEventType from "../../Types/Realtime/ModelEventType";
+import StatusPageSubscriberUnsubscribe, { StatusPageSubscriberUnsubscribeState, } from "../../Types/StatusPage/StatusPageSubscriberUnsubscribe";
+import StatusPageSubscriberUnsubscribeToken from "../Utils/StatusPage/StatusPageSubscriberUnsubscribeToken";
+import StatusPageSubscriberUnsubscribeNotice, { StatusPageSubscriberUnsubscribeSource, } from "../Utils/StatusPage/StatusPageSubscriberUnsubscribeNotice";
+const returnedRows = (result) => {
+    if (!Array.isArray(result)) {
+        return [];
+    }
+    if (result.length === 2 &&
+        Array.isArray(result[0]) &&
+        typeof result[1] === "number") {
+        return result[0];
+    }
+    return result.filter((row) => {
+        return Boolean(row) && typeof row === "object" && !Array.isArray(row);
+    });
+};
+const affectedRowCount = (result) => {
+    if (Array.isArray(result) &&
+        result.length === 2 &&
+        typeof result[1] === "number") {
+        return result[1];
+    }
+    return 0;
+};
+/*
+ * The subscriber rows being created for a visitor who signed up on the status
+ * page itself (see createFromStatusPageSignUp). Every other create - a
+ * teammate on the dashboard, an API key, a workflow - is the team adding a
+ * subscriber, and onBeforeCreate marks it so (Is Added By Team).
+ *
+ * The very model instances, held only for the length of the create: nothing
+ * a request body carries can put a row in here, so no client can pass its
+ * subscriber off as a sign-up and keep the page's owners from hearing when
+ * it unsubscribes.
+ */
+const statusPageSignUps = new WeakSet();
+// How many subscribers the backfill and the token top-up handle per statement.
+const UNSUBSCRIBE_COLUMNS_BATCH_SIZE = 1000;
 export class Service extends DatabaseService {
     constructor() {
         super(Model);
     }
+    /*
+     * A create hands its caller the row it saved, and every caller passes it
+     * on whole: BaseAPI serializes it into the response of POST
+     * /status-page-subscriber without a column read check (a teammate's Add
+     * Subscriber and Add in Bulk, any API key), and a workflow's Create Status
+     * Page Subscriber step returns it, to be kept in the workflow's logs.
+     *
+     * So the two secrets onBeforeCreate minted are taken off it first: the
+     * unsubscribe token, which lets whoever holds it cancel the subscription
+     * without signing in - and makes the team's notice say the subscriber did -
+     * and the six-digit confirmation code. Nobody can read either column
+     * (read: []). They leave the server only inside the messages to the
+     * subscription's own contact, which onCreateSuccess has sent by now; the
+     * confirmation email reads its code back from the database.
+     */
+    async create(createBy) {
+        const created = await super.create(createBy);
+        /*
+         * Cleared rather than deleted, as BaseAPI.createItem clears a model's
+         * `_id`: an unset column holds undefined, which serializes as nothing.
+         */
+        const row = created;
+        row["unsubscribeToken"] = undefined;
+        row["subscriptionConfirmationToken"] = undefined;
+        return created;
+    }
+    /*
+     * Create the subscriber a visitor signed up for on the status page itself
+     * (StatusPageAPI's subscribe endpoint). The one create that is not the team
+     * adding a subscriber: it is created as root, like the rest of that
+     * endpoint, and Is Added By Team is left off.
+     */
+    async createFromStatusPageSignUp(data) {
+        statusPageSignUps.add(data);
+        try {
+            return await this.create({
+                data: data,
+                props: {
+                    isRoot: true,
+                },
+            });
+        }
+        finally {
+            statusPageSignUps.delete(data);
+        }
+    }
+    /*
+     * Whether the team added this subscriber, rather than it signing up on the
+     * status page. Is Added By Team says so for every subscriber created since
+     * it existed; Created By is read as well for the ones created before, until
+     * the backfill has marked them (every create with a creator is the team's).
+     */
+    isAddedByTeam(subscriber) {
+        return (subscriber.isAddedByTeam === true || Boolean(subscriber.createdByUserId));
+    }
     async onBeforeCreate(data) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, _25, _26, _27, _28, _29, _30, _31, _32, _33, _34, _35, _36, _37;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10, _11, _12, _13, _14, _15, _16, _17, _18, _19, _20, _21, _22, _23, _24, _25, _26, _27, _28, _29, _30, _31, _32, _33, _34, _35;
         logger.debug("onBeforeCreate called with data:", {
             projectId: (_a = data.data.projectId) === null || _a === void 0 ? void 0 : _a.toString(),
             statusPageId: (_b = data.data.statusPageId) === null || _b === void 0 ? void 0 : _b.toString(),
@@ -282,26 +381,434 @@ export class Service extends DatabaseService {
             await SSRFProtection.validateWebhookTargetIsSafe(data.data.subscriberWebhook);
         }
         data.data.subscriptionConfirmationToken = NumberUtil.getRandomNumber(100000, 999999).toString();
+        /*
+         * The secret in this subscriber's unsubscribe link. Always minted here,
+         * whatever the request carried: the column is computed, so the create
+         * column check lets a client send one, and a token the client chose would
+         * be one somebody else could know. A re-subscribe deletes the old row
+         * above and gets a new token, so links to the old subscription stop
+         * working.
+         */
+        data.data.unsubscribeToken =
+            StatusPageSubscriberUnsubscribeToken.generate();
+        /*
+         * Never taken from a client either: whether the team added this
+         * subscriber. Only a sign-up on the status page is not the team's, and
+         * only createFromStatusPageSignUp creates one. A teammate's create carries
+         * a creator (Created By) but an API key's or a workflow's does not, so
+         * this is the column that says it for all of them.
+         */
+        data.data.isAddedByTeam = !statusPageSignUps.has(data.data);
+        /*
+         * Likewise never taken from a client. A subscriber is only ever created
+         * unsubscribed through the API, and then it was cancelled now.
+         */
+        if (data.data.isUnsubscribed) {
+            data.data.unsubscribedAt = OneUptimeDate.getCurrentDate();
+        }
+        else {
+            delete data.data.unsubscribedAt;
+        }
         logger.debug(`Subscription Confirmation Token: ${data.data.subscriptionConfirmationToken}`, {
             projectId: (_32 = data.data.projectId) === null || _32 === void 0 ? void 0 : _32.toString(),
             statusPageId: (_33 = data.data.statusPageId) === null || _33 === void 0 ? void 0 : _33.toString(),
         });
-        logger.debug("onBeforeCreate processed data:", {
+        // Not the data itself: it now carries the unsubscribe token.
+        logger.debug("onBeforeCreate processed data.", {
             projectId: (_34 = data.data.projectId) === null || _34 === void 0 ? void 0 : _34.toString(),
             statusPageId: (_35 = data.data.statusPageId) === null || _35 === void 0 ? void 0 : _35.toString(),
         });
-        logger.debug(data, {
-            projectId: (_36 = data.data.projectId) === null || _36 === void 0 ? void 0 : _36.toString(),
-            statusPageId: (_37 = data.data.statusPageId) === null || _37 === void 0 ? void 0 : _37.toString(),
-        });
         return { createBy: data, carryForward: statuspage };
     }
+    /*
+     * Unsubscribed At follows Is Unsubscribed on every write that sets it - a
+     * teammate's toggle on the dashboard, the API, a workflow - not only on the
+     * unsubscribe link, which sets both itself (see unsubscribe()).
+     *
+     * Which rows an update cancels has to be known before it runs: afterwards
+     * every matched row reads unsubscribed, and a row that already was would
+     * get today's date for a cancellation that happened long ago (or before the
+     * column existed). The stamp itself is written after the update, as root,
+     * by a plain UPDATE: through updateBy it would be a second update of the
+     * row and fire the "on update" workflow trigger a second time.
+     */
+    async onBeforeUpdate(updateBy) {
+        var _a;
+        const isUnsubscribed = (_a = updateBy.data) === null || _a === void 0 ? void 0 : _a["isUnsubscribed"];
+        const carryForward = {
+            isUnsubscribed: typeof isUnsubscribed === "boolean" ? isUnsubscribed : null,
+            subscriberIdsBeingUnsubscribed: [],
+        };
+        if (carryForward.isUnsubscribed === true) {
+            const matched = await this.findBy({
+                query: updateBy.query,
+                select: {
+                    _id: true,
+                    isUnsubscribed: true,
+                },
+                skip: 0,
+                limit: LIMIT_MAX,
+                props: {
+                    isRoot: true,
+                    ignoreHooks: true,
+                },
+            });
+            carryForward.subscriberIdsBeingUnsubscribed = matched
+                .filter((subscriber) => {
+                return Boolean(subscriber._id) && subscriber.isUnsubscribed !== true;
+            })
+                .map((subscriber) => {
+                return subscriber._id.toString();
+            });
+        }
+        return { updateBy, carryForward };
+    }
+    async onUpdateSuccess(onUpdate, updatedItemIds) {
+        const carryForward = onUpdate.carryForward;
+        if (!carryForward || carryForward.isUnsubscribed === null) {
+            return onUpdate;
+        }
+        const updatedIds = updatedItemIds.map((id) => {
+            return id.toString();
+        });
+        if (carryForward.isUnsubscribed === true) {
+            const cancelledIds = carryForward.subscriberIdsBeingUnsubscribed.filter((id) => {
+                return updatedIds.includes(id);
+            });
+            if (cancelledIds.length > 0) {
+                await this.getRepository().manager.query(`UPDATE "StatusPageSubscriber" SET "unsubscribedAt" = $1 WHERE "_id" = ANY($2::uuid[]) AND "isUnsubscribed" = true AND "unsubscribedAt" IS NULL`, [OneUptimeDate.getCurrentDate(), cancelledIds]);
+            }
+            return onUpdate;
+        }
+        // Subscribed again: the old date no longer describes this subscription.
+        if (updatedIds.length > 0) {
+            await this.getRepository().manager.query(`UPDATE "StatusPageSubscriber" SET "unsubscribedAt" = NULL WHERE "_id" = ANY($1::uuid[]) AND "isUnsubscribed" = false AND "unsubscribedAt" IS NOT NULL`, [updatedIds]);
+        }
+        return onUpdate;
+    }
+    /*
+     * Cancel a subscription, once. Returns whether this call cancelled it:
+     * false when it was already cancelled (or does not exist), which makes the
+     * unsubscribe link idempotent.
+     *
+     * ONE STATEMENT, ON PURPOSE: the WHERE clause's `"isUnsubscribed" = false`
+     * lets Postgres decide which of two simultaneous requests - a double click,
+     * a mail client that follows the confirmation twice - cancels the
+     * subscription, so its Unsubscribed At is written once and the team is told
+     * once. `RETURNING` is what tells this call whether it was the one.
+     *
+     * Written as raw SQL because no DatabaseService write both takes that
+     * predicate and reports what it matched. That skips the update hooks, so
+     * the "on update" workflow trigger and the realtime event a DatabaseService
+     * update fires are fired here, by hand, with the two columns this wrote.
+     */
+    async unsubscribe(data) {
+        var _a;
+        const unsubscribedAt = OneUptimeDate.getCurrentDate();
+        const rows = returnedRows(await this.getRepository().manager.query(`UPDATE "StatusPageSubscriber"
+            SET "isUnsubscribed" = true,
+                "unsubscribedAt" = $1,
+                "updatedAt" = CURRENT_TIMESTAMP
+          WHERE "_id" = $2
+            AND "isUnsubscribed" = false
+            AND "deletedAt" IS NULL
+      RETURNING "_id", "projectId"`, [unsubscribedAt, data.subscriberId.toString()]));
+        const row = rows[0];
+        if (!row || !row["_id"]) {
+            return false;
+        }
+        const projectId = row["projectId"]
+            ? new ObjectID(row["projectId"].toString())
+            : null;
+        if (projectId) {
+            if ((_a = this.getModel().enableWorkflowOn) === null || _a === void 0 ? void 0 : _a.update) {
+                await this.onTriggerWorkflow(data.subscriberId, projectId, "on-update", {
+                    updatedFields: {
+                        isUnsubscribed: true,
+                        unsubscribedAt: unsubscribedAt.toISOString(),
+                    },
+                });
+            }
+            await this.onTriggerRealtime(data.subscriberId, projectId, ModelEventType.Update);
+        }
+        /*
+         * The subscription is cancelled either way; a failure to tell the team
+         * must not turn that into an error for the person who asked.
+         */
+        try {
+            await this.notifyTeamOfUnsubscribe({
+                subscriberId: data.subscriberId,
+                source: data.source,
+                unsubscribedAt: unsubscribedAt,
+            });
+        }
+        catch (err) {
+            logger.error(err, {
+                statusPageSubscriberId: data.subscriberId.toString(),
+            });
+        }
+        return true;
+    }
+    /*
+     * What the status page's unsubscribe page shows for a link, before anything
+     * is changed. Opening the page calls this; only a POST unsubscribes.
+     *
+     * Every way a link can be wrong - a malformed id or token, no such
+     * subscriber, a deleted one, one on another status page, a token that does
+     * not match - reads the same, Invalid, after the same constant-time token
+     * comparison, so the answer cannot be used to tell them apart.
+     */
+    async getUnsubscribeLinkDetails(data) {
+        const subscriber = await this.findSubscriberByUnsubscribeLink(data);
+        if (!subscriber) {
+            return { state: StatusPageSubscriberUnsubscribeState.Invalid };
+        }
+        const contact = StatusPageSubscriberUnsubscribe.describeContact(subscriber);
+        return {
+            state: subscriber.isUnsubscribed
+                ? StatusPageSubscriberUnsubscribeState.Unsubscribed
+                : StatusPageSubscriberUnsubscribeState.Subscribed,
+            channel: contact === null || contact === void 0 ? void 0 : contact.channel,
+            contact: contact === null || contact === void 0 ? void 0 : contact.contact,
+            wasAddedByTeam: this.isAddedByTeam(subscriber),
+        };
+    }
+    /*
+     * The unsubscribe page's POST: cancel the subscription the link belongs to.
+     * Idempotent - a second confirmation, or one for a subscription already
+     * cancelled some other way, answers Unsubscribed again and changes nothing.
+     * A bad link answers Invalid, exactly as getUnsubscribeLinkDetails does.
+     */
+    async unsubscribeWithLink(data) {
+        const subscriber = await this.findSubscriberByUnsubscribeLink(data);
+        if (!subscriber || !subscriber.id) {
+            return StatusPageSubscriberUnsubscribeState.Invalid;
+        }
+        if (!subscriber.isUnsubscribed) {
+            await this.unsubscribe({
+                subscriberId: subscriber.id,
+                source: StatusPageSubscriberUnsubscribeSource.UnsubscribeLink,
+            });
+        }
+        return StatusPageSubscriberUnsubscribeState.Unsubscribed;
+    }
+    /*
+     * The subscriber a link belongs to, or null when the link is not good. The
+     * subscriber is found by its primary key, never by the token, and the token
+     * is then compared in constant time - a query on the token would let the
+     * database's own comparison time a guess. The comparison runs even when
+     * there is no subscriber to compare with.
+     */
+    async findSubscriberByUnsubscribeLink(data) {
+        const isWellFormed = ObjectID.isValidUUID(data.statusPageId) &&
+            ObjectID.isValidUUID(data.subscriberId);
+        const subscriber = isWellFormed
+            ? await this.findOneBy({
+                query: {
+                    _id: data.subscriberId,
+                    statusPageId: new ObjectID(data.statusPageId),
+                },
+                select: {
+                    _id: true,
+                    statusPageId: true,
+                    unsubscribeToken: true,
+                    isUnsubscribed: true,
+                    isAddedByTeam: true,
+                    createdByUserId: true,
+                    subscriberEmail: true,
+                    subscriberPhone: true,
+                    slackIncomingWebhookUrl: true,
+                    slackWorkspaceName: true,
+                    microsoftTeamsIncomingWebhookUrl: true,
+                    microsoftTeamsWorkspaceName: true,
+                    subscriberWebhook: true,
+                },
+                props: {
+                    isRoot: true,
+                    ignoreHooks: true,
+                },
+            })
+            : null;
+        const tokenMatches = StatusPageSubscriberUnsubscribeToken.matches({
+            stored: subscriber === null || subscriber === void 0 ? void 0 : subscriber.unsubscribeToken,
+            presented: data.token,
+        });
+        if (!subscriber || !tokenMatches) {
+            return null;
+        }
+        return subscriber;
+    }
+    /*
+     * Tell the team that a subscriber it added has unsubscribed itself (see
+     * StatusPageSubscriberUnsubscribeNotice for why). Subscribers people signed
+     * up for themselves on the status page tell nobody.
+     *
+     * A subscriber the team added is one with Is Added By Team - from the
+     * dashboard, with an API key or by a workflow - or, created before that
+     * column, with a creator (see isAddedByTeam).
+     *
+     * It goes to the status page's owners - its owner users and the members of
+     * its owner teams - and to the teammate who added the subscriber, when a
+     * teammate did, each once and only while they are still members of the
+     * project, as one plain email through MailService rather than a
+     * notification rule: it is about a subscriber list, not an event anyone is
+     * on call for. A page with no owners tells only the teammate who added the
+     * subscriber; one an API key or a workflow added, on a page with no owners,
+     * tells nobody.
+     */
+    async notifyTeamOfUnsubscribe(data) {
+        var _a, _b, _c;
+        const subscriber = await this.findOneById({
+            id: data.subscriberId,
+            select: {
+                _id: true,
+                projectId: true,
+                statusPageId: true,
+                isAddedByTeam: true,
+                createdByUserId: true,
+                createdAt: true,
+                subscriberEmail: true,
+                subscriberPhone: true,
+                slackIncomingWebhookUrl: true,
+                slackWorkspaceName: true,
+                microsoftTeamsIncomingWebhookUrl: true,
+                microsoftTeamsWorkspaceName: true,
+                subscriberWebhook: true,
+            },
+            props: {
+                isRoot: true,
+                ignoreHooks: true,
+            },
+        });
+        if (!subscriber ||
+            !this.isAddedByTeam(subscriber) ||
+            !subscriber.projectId ||
+            !subscriber.statusPageId) {
+            return;
+        }
+        const contact = StatusPageSubscriberUnsubscribe.describeContact(subscriber, {
+            maskPhone: false,
+        });
+        if (!contact) {
+            return;
+        }
+        const statusPage = await StatusPageService.findOneById({
+            id: subscriber.statusPageId,
+            select: {
+                _id: true,
+                name: true,
+                pageTitle: true,
+            },
+            props: {
+                isRoot: true,
+                ignoreHooks: true,
+            },
+        });
+        if (!statusPage) {
+            return;
+        }
+        // Only a teammate's create has a creator; an API key's or a workflow's does not.
+        const creator = subscriber.createdByUserId
+            ? await UserService.findOneById({
+                id: subscriber.createdByUserId,
+                select: {
+                    _id: true,
+                    name: true,
+                    email: true,
+                },
+                props: {
+                    isRoot: true,
+                },
+            })
+            : null;
+        const candidates = [
+            ...(await StatusPageService.findOwners(subscriber.statusPageId)),
+            ...(creator ? [creator] : []),
+        ];
+        const recipients = [];
+        const seenUserIds = new Set();
+        for (const user of await TeamMemberService.filterUsersToProjectMembers({
+            projectId: subscriber.projectId,
+            users: candidates,
+        })) {
+            const userId = ((_a = user.id) === null || _a === void 0 ? void 0 : _a.toString().toLowerCase()) || "";
+            if (!userId || !user.email || seenUserIds.has(userId)) {
+                continue;
+            }
+            seenUserIds.add(userId);
+            recipients.push(user);
+        }
+        if (recipients.length === 0) {
+            return;
+        }
+        if (!(await this.isFirstUnsubscribeNoticeInWindow(subscriber.id))) {
+            logger.debug(`The team was told about subscriber ${subscriber.id.toString()} unsubscribing within the last ${StatusPageSubscriberUnsubscribeNotice.noticeWindowInHours} hours; not telling it again.`, {
+                projectId: subscriber.projectId.toString(),
+                statusPageId: subscriber.statusPageId.toString(),
+            });
+            return;
+        }
+        const subscriberListUrl = (await StatusPageService.getStatusPageLinkInDashboard(subscriber.projectId, subscriber.statusPageId))
+            .addRoute(`/${StatusPageSubscriberUnsubscribeNotice.getSubscriberListRoute(contact.channel)}`)
+            .toString();
+        const email = StatusPageSubscriberUnsubscribeNotice.build({
+            statusPageName: statusPage.name || statusPage.pageTitle || "Status Page",
+            contact: contact,
+            source: data.source,
+            unsubscribedAt: data.unsubscribedAt,
+            addedByName: ((_b = creator === null || creator === void 0 ? void 0 : creator.name) === null || _b === void 0 ? void 0 : _b.toString()) || ((_c = creator === null || creator === void 0 ? void 0 : creator.email) === null || _c === void 0 ? void 0 : _c.toString()),
+            addedAt: subscriber.createdAt,
+            subscriberListUrl: subscriberListUrl,
+        });
+        for (const recipient of recipients) {
+            MailService.sendMail({
+                toEmail: recipient.email,
+                templateType: EmailTemplateType.SimpleMessage,
+                vars: {
+                    subject: email.subject,
+                    message: email.message,
+                },
+                subject: email.subject,
+                isSubjectLiteral: true,
+            }, {
+                projectId: subscriber.projectId,
+                userId: recipient.id,
+            }).catch((err) => {
+                var _a, _b;
+                logger.error(err, {
+                    projectId: (_a = subscriber.projectId) === null || _a === void 0 ? void 0 : _a.toString(),
+                    statusPageId: (_b = subscriber.statusPageId) === null || _b === void 0 ? void 0 : _b.toString(),
+                });
+            });
+        }
+    }
+    /*
+     * The team is told about a subscriber unsubscribing at most once per
+     * window. The public manage page both re-subscribes a subscriber and
+     * cancels it again, and it is open to anyone who can see the status page
+     * and knows the subscriber's id (it is in the manage link), so without this
+     * a loop of the two would email every owner of the page on every turn.
+     *
+     * One atomic SET NX per subscriber: exactly one notice wins the window
+     * however many cancellations arrive together. If the cache cannot be
+     * reached the notice goes out: telling the team twice is better than not
+     * at all.
+     */
+    async isFirstUnsubscribeNoticeInWindow(subscriberId) {
+        try {
+            return await GlobalCache.setStringIfNotExists(StatusPageSubscriberUnsubscribeNotice.noticeCacheNamespace, subscriberId.toString().toLowerCase(), OneUptimeDate.getCurrentDate().toISOString(), {
+                expiresInSeconds: StatusPageSubscriberUnsubscribeNotice.noticeWindowInHours * 60 * 60,
+            });
+        }
+        catch (err) {
+            logger.warn(`Could not check when the team was last told about subscriber ${subscriberId.toString()} unsubscribing; telling it: ${err instanceof Error ? err.message : String(err)}`);
+            return true;
+        }
+    }
     async onCreateSuccess(onCreate, createdItem) {
         var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u;
-        logger.debug("onCreateSuccess called with createdItem:", {
-            projectId: (_a = createdItem.projectId) === null || _a === void 0 ? void 0 : _a.toString(),
-        });
-        logger.debug(createdItem, {
+        // Not the item itself: it carries the unsubscribe token.
+        logger.debug(`onCreateSuccess called with createdItem ${(_a = createdItem.id) === null || _a === void 0 ? void 0 : _a.toString()}.`, {
             projectId: (_b = createdItem.projectId) === null || _b === void 0 ? void 0 : _b.toString(),
         });
         if (!createdItem.statusPageId) {
@@ -320,15 +827,13 @@ export class Service extends DatabaseService {
         logger.debug(`Status Page Name: ${statusPageName}`, {
             projectId: (_e = createdItem.projectId) === null || _e === void 0 ? void 0 : _e.toString(),
         });
-        const unsubscribeLink = this.getUnsubscribeLink(URL.fromString(statusPageURL), createdItem.id).toString();
-        logger.debug(`Unsubscribe Link: ${unsubscribeLink}`, {
-            projectId: (_f = createdItem.projectId) === null || _f === void 0 ? void 0 : _f.toString(),
-        });
+        // createdItem carries the unsubscribe token onBeforeCreate minted.
+        const unsubscribeLink = this.getUnsubscribeLink(URL.fromString(statusPageURL), createdItem).toString();
         if (createdItem.statusPageId &&
             createdItem.subscriberPhone &&
             createdItem._id &&
             createdItem.sendYouHaveSubscribedMessage) {
-            logger.debug("Subscriber has a phone number and sendYouHaveSubscribedMessage is true.", { projectId: (_g = createdItem.projectId) === null || _g === void 0 ? void 0 : _g.toString() });
+            logger.debug("Subscriber has a phone number and sendYouHaveSubscribedMessage is true.", { projectId: (_f = createdItem.projectId) === null || _f === void 0 ? void 0 : _f.toString() });
             const statusPage = await StatusPageService.findOneBy({
                 query: {
                     _id: createdItem.statusPageId.toString(),
@@ -349,14 +854,25 @@ export class Service extends DatabaseService {
             });
             if (!statusPage) {
                 logger.debug("Status Page not found.", {
-                    projectId: (_h = createdItem.projectId) === null || _h === void 0 ? void 0 : _h.toString(),
+                    projectId: (_g = createdItem.projectId) === null || _g === void 0 ? void 0 : _g.toString(),
                 });
                 return createdItem;
             }
-            logger.debug(`Status Page Call SMS Config: ${JSON.stringify(statusPage.callSmsConfig)}`, { projectId: (_j = createdItem.projectId) === null || _j === void 0 ? void 0 : _j.toString() });
+            logger.debug(`Status Page Call SMS Config: ${JSON.stringify(statusPage.callSmsConfig)}`, { projectId: (_h = createdItem.projectId) === null || _h === void 0 ? void 0 : _h.toString() });
+            /*
+             * On a public status page the SMS keeps the shorter manage link, which
+             * works there without signing in: an SMS is billed by the segment (see
+             * StatusPageSubscriberUnsubscribe.buildSmsLink).
+             */
+            const smsUnsubscribeLink = StatusPageSubscriberUnsubscribe.buildSmsLink({
+                isPublicStatusPage: (_j = onCreate.carryForward) === null || _j === void 0 ? void 0 : _j.isPublicStatusPage,
+                statusPageUrl: statusPageURL,
+                subscriberId: createdItem.id,
+                unsubscribeUrl: unsubscribeLink,
+            });
             SmsService.sendSms({
                 to: createdItem.subscriberPhone,
-                message: `You have been subscribed to ${statusPageName}. To unsubscribe, click on the link: ${unsubscribeLink}`,
+                message: `You have been subscribed to ${statusPageName}. To unsubscribe, click on the link: ${smsUnsubscribeLink}`,
             }, {
                 projectId: createdItem.projectId,
                 isSensitive: false,
@@ -402,7 +918,7 @@ export class Service extends DatabaseService {
 **You have successfully subscribed to receive status updates!**
 
 🔗 **Status Page:** [${statusPageName}](${statusPageURL})
-📧 **Manage Subscription:** [Update preferences or unsubscribe](${unsubscribeLink})
+🔕 **Unsubscribe:** [Stop these notifications](${unsubscribeLink})
 
 You will receive real-time notifications for:
 • Incidents and outages 
@@ -480,7 +996,7 @@ Stay informed about service availability! 🚀`;
 **You have successfully subscribed to receive status updates!**
 
 🔗 **Status Page:** [${statusPageName}](${statusPageURL})
-📧 **Manage Subscription:** [Update preferences or unsubscribe](${unsubscribeLink})
+🔕 **Unsubscribe:** [Stop these notifications](${unsubscribeLink})
 
 You will receive real-time notifications for:
 • Incidents and outages 
@@ -537,22 +1053,25 @@ Stay informed about service availability! 🚀`;
                 projectId: true,
                 subscriptionConfirmationToken: true,
                 sendYouHaveSubscribedMessage: true,
+                unsubscribeToken: true,
             },
             props: {
                 isRoot: true,
                 ignoreHooks: true,
             },
         });
-        logger.debug(`Found Subscriber: ${JSON.stringify(subscriber)}`, {
-            statusPageSubscriberId: (_c = data.subscriberId) === null || _c === void 0 ? void 0 : _c.toString(),
+        logger.debug(`Found Subscriber: ${(_c = subscriber === null || subscriber === void 0 ? void 0 : subscriber.id) === null || _c === void 0 ? void 0 : _c.toString()}`, {
+            statusPageSubscriberId: (_d = data.subscriberId) === null || _d === void 0 ? void 0 : _d.toString(),
         });
         // get status page
         if (!subscriber || !subscriber.statusPageId) {
             logger.debug("Subscriber or Status Page ID is missing.", {
-                statusPageSubscriberId: (_d = data.subscriberId) === null || _d === void 0 ? void 0 : _d.toString(),
+                statusPageSubscriberId: (_e = data.subscriberId) === null || _e === void 0 ? void 0 : _e.toString(),
             });
             return;
         }
+        // Its unsubscribe link needs its token (see ensureUnsubscribeTokens).
+        await this.ensureUnsubscribeTokens([subscriber]);
         const statusPage = await StatusPageService.findOneBy({
             query: {
                 _id: subscriber.statusPageId.toString(),
@@ -586,46 +1105,43 @@ Stay informed about service availability! 🚀`;
             },
         });
         logger.debug(`Found Status Page: ${JSON.stringify(statusPage)}`, {
-            statusPageSubscriberId: (_e = data.subscriberId) === null || _e === void 0 ? void 0 : _e.toString(),
+            statusPageSubscriberId: (_f = data.subscriberId) === null || _f === void 0 ? void 0 : _f.toString(),
         });
         if (!statusPage || !statusPage.id) {
             logger.debug("Status Page not found or ID is missing.", {
-                statusPageSubscriberId: (_f = data.subscriberId) === null || _f === void 0 ? void 0 : _f.toString(),
+                statusPageSubscriberId: (_g = data.subscriberId) === null || _g === void 0 ? void 0 : _g.toString(),
             });
             return;
         }
         const statusPageURL = await StatusPageService.getStatusPageURL(statusPage.id);
         logger.debug(`Status Page URL: ${statusPageURL}`, {
-            statusPageSubscriberId: (_g = data.subscriberId) === null || _g === void 0 ? void 0 : _g.toString(),
+            statusPageSubscriberId: (_h = data.subscriberId) === null || _h === void 0 ? void 0 : _h.toString(),
         });
         const statusPageName = statusPage.pageTitle || statusPage.name || "Status Page";
         logger.debug(`Status Page Name: ${statusPageName}`, {
-            statusPageSubscriberId: (_h = data.subscriberId) === null || _h === void 0 ? void 0 : _h.toString(),
+            statusPageSubscriberId: (_j = data.subscriberId) === null || _j === void 0 ? void 0 : _j.toString(),
         });
         const host = await DatabaseConfig.getHost();
         logger.debug(`Host: ${host}`, {
-            statusPageSubscriberId: (_j = data.subscriberId) === null || _j === void 0 ? void 0 : _j.toString(),
+            statusPageSubscriberId: (_k = data.subscriberId) === null || _k === void 0 ? void 0 : _k.toString(),
         });
         const httpProtocol = await DatabaseConfig.getHttpProtocol();
         logger.debug(`HTTP Protocol: ${httpProtocol}`, {
-            statusPageSubscriberId: (_k = data.subscriberId) === null || _k === void 0 ? void 0 : _k.toString(),
+            statusPageSubscriberId: (_l = data.subscriberId) === null || _l === void 0 ? void 0 : _l.toString(),
         });
-        const statusPageIdString = ((_l = statusPage.id) === null || _l === void 0 ? void 0 : _l.toString()) || ((_m = statusPage._id) === null || _m === void 0 ? void 0 : _m.toString()) || null;
+        const statusPageIdString = ((_m = statusPage.id) === null || _m === void 0 ? void 0 : _m.toString()) || ((_o = statusPage._id) === null || _o === void 0 ? void 0 : _o.toString()) || null;
         const confirmSubscriptionLink = this.getConfirmSubscriptionLink({
             statusPageUrl: statusPageURL,
             confirmationToken: subscriber.subscriptionConfirmationToken || "",
             statusPageSubscriberId: subscriber.id,
         }).toString();
         logger.debug(`Confirm Subscription Link: ${confirmSubscriptionLink}`, {
-            statusPageSubscriberId: (_o = data.subscriberId) === null || _o === void 0 ? void 0 : _o.toString(),
+            statusPageSubscriberId: (_p = data.subscriberId) === null || _p === void 0 ? void 0 : _p.toString(),
         });
         if (subscriber.statusPageId &&
             subscriber.subscriberEmail &&
             subscriber._id) {
-            const unsubscribeUrl = this.getUnsubscribeLink(URL.fromString(statusPageURL), subscriber.id).toString();
-            logger.debug(`Unsubscribe URL: ${unsubscribeUrl}`, {
-                statusPageSubscriberId: (_p = data.subscriberId) === null || _p === void 0 ? void 0 : _p.toString(),
-            });
+            const unsubscribeUrl = this.getUnsubscribeLink(URL.fromString(statusPageURL), subscriber).toString();
             const customTemplate = await StatusPageSubscriberNotificationTemplateService.getTemplateForStatusPage({
                 statusPageId: statusPage.id,
                 eventType: StatusPageSubscriberNotificationEventType.SubscriberSubscriptionConfirmation,
@@ -643,7 +1159,8 @@ Stay informed about service availability! 🚀`;
                  * pattern used elsewhere — without custom SMTP we keep the styled
                  * OneUptime default so emails still look right out-of-the-box).
                  */
-                const compiledBody = StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate(customTemplate.templateBody, templateVariables);
+                // The body is HTML, so the (plain-text) values are escaped into it.
+                const compiledBody = StatusPageSubscriberNotificationTemplateServiceClass.compileEmailBodyTemplate(customTemplate.templateBody, templateVariables);
                 const compiledSubject = customTemplate.emailSubject
                     ? StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate(customTemplate.emailSubject, templateVariables)
                     : "Confirm your subscription to " + statusPageName;
@@ -727,22 +1244,25 @@ Stay informed about service availability! 🚀`;
                 subscriberPhone: true,
                 projectId: true,
                 sendYouHaveSubscribedMessage: true,
+                unsubscribeToken: true,
             },
             props: {
                 isRoot: true,
                 ignoreHooks: true,
             },
         });
-        logger.debug(`Found Subscriber: ${JSON.stringify(subscriber)}`, {
-            statusPageSubscriberId: (_c = data.subscriberId) === null || _c === void 0 ? void 0 : _c.toString(),
+        logger.debug(`Found Subscriber: ${(_c = subscriber === null || subscriber === void 0 ? void 0 : subscriber.id) === null || _c === void 0 ? void 0 : _c.toString()}`, {
+            statusPageSubscriberId: (_d = data.subscriberId) === null || _d === void 0 ? void 0 : _d.toString(),
         });
         // get status page
         if (!subscriber || !subscriber.statusPageId) {
             logger.debug("Subscriber or Status Page ID is missing.", {
-                statusPageSubscriberId: (_d = data.subscriberId) === null || _d === void 0 ? void 0 : _d.toString(),
+                statusPageSubscriberId: (_e = data.subscriberId) === null || _e === void 0 ? void 0 : _e.toString(),
             });
             return;
         }
+        // Its unsubscribe link needs its token (see ensureUnsubscribeTokens).
+        await this.ensureUnsubscribeTokens([subscriber]);
         const statusPage = await StatusPageService.findOneBy({
             query: {
                 _id: subscriber.statusPageId.toString(),
@@ -776,35 +1296,32 @@ Stay informed about service availability! 🚀`;
             },
         });
         logger.debug(`Found Status Page: ${JSON.stringify(statusPage)}`, {
-            statusPageSubscriberId: (_e = data.subscriberId) === null || _e === void 0 ? void 0 : _e.toString(),
+            statusPageSubscriberId: (_f = data.subscriberId) === null || _f === void 0 ? void 0 : _f.toString(),
         });
         if (!statusPage || !statusPage.id) {
             logger.debug("Status Page not found or ID is missing.", {
-                statusPageSubscriberId: (_f = data.subscriberId) === null || _f === void 0 ? void 0 : _f.toString(),
+                statusPageSubscriberId: (_g = data.subscriberId) === null || _g === void 0 ? void 0 : _g.toString(),
             });
             return;
         }
         const statusPageURL = await StatusPageService.getStatusPageURL(statusPage.id);
         logger.debug(`Status Page URL: ${statusPageURL}`, {
-            statusPageSubscriberId: (_g = data.subscriberId) === null || _g === void 0 ? void 0 : _g.toString(),
+            statusPageSubscriberId: (_h = data.subscriberId) === null || _h === void 0 ? void 0 : _h.toString(),
         });
         const statusPageName = statusPage.pageTitle || statusPage.name || "Status Page";
         logger.debug(`Status Page Name: ${statusPageName}`, {
-            statusPageSubscriberId: (_h = data.subscriberId) === null || _h === void 0 ? void 0 : _h.toString(),
+            statusPageSubscriberId: (_j = data.subscriberId) === null || _j === void 0 ? void 0 : _j.toString(),
         });
         const host = await DatabaseConfig.getHost();
         logger.debug(`Host: ${host}`, {
-            statusPageSubscriberId: (_j = data.subscriberId) === null || _j === void 0 ? void 0 : _j.toString(),
+            statusPageSubscriberId: (_k = data.subscriberId) === null || _k === void 0 ? void 0 : _k.toString(),
         });
         const httpProtocol = await DatabaseConfig.getHttpProtocol();
         logger.debug(`HTTP Protocol: ${httpProtocol}`, {
-            statusPageSubscriberId: (_k = data.subscriberId) === null || _k === void 0 ? void 0 : _k.toString(),
-        });
-        const statusPageIdString = ((_l = statusPage.id) === null || _l === void 0 ? void 0 : _l.toString()) || ((_m = statusPage._id) === null || _m === void 0 ? void 0 : _m.toString()) || null;
-        const unsubscribeLink = this.getUnsubscribeLink(URL.fromString(statusPageURL), subscriber.id).toString();
-        logger.debug(`Unsubscribe Link: ${unsubscribeLink}`, {
-            statusPageSubscriberId: (_o = data.subscriberId) === null || _o === void 0 ? void 0 : _o.toString(),
+            statusPageSubscriberId: (_l = data.subscriberId) === null || _l === void 0 ? void 0 : _l.toString(),
         });
+        const statusPageIdString = ((_m = statusPage.id) === null || _m === void 0 ? void 0 : _m.toString()) || ((_o = statusPage._id) === null || _o === void 0 ? void 0 : _o.toString()) || null;
+        const unsubscribeLink = this.getUnsubscribeLink(URL.fromString(statusPageURL), subscriber).toString();
         if (subscriber.statusPageId &&
             subscriber.subscriberEmail &&
             subscriber._id) {
@@ -822,7 +1339,8 @@ Stay informed about service availability! 🚀`;
                 unsubscribeUrl: unsubscribeLink,
             };
             if ((customTemplate === null || customTemplate === void 0 ? void 0 : customTemplate.templateBody) && statusPage.smtpConfig) {
-                const compiledBody = StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate(customTemplate.templateBody, templateVariables);
+                // The body is HTML, so the (plain-text) values are escaped into it.
+                const compiledBody = StatusPageSubscriberNotificationTemplateServiceClass.compileEmailBodyTemplate(customTemplate.templateBody, templateVariables);
                 const compiledSubject = customTemplate.emailSubject
                     ? StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate(customTemplate.emailSubject, templateVariables)
                     : "You have been subscribed to " + statusPageName;
@@ -903,7 +1421,19 @@ Stay informed about service availability! 🚀`;
         });
         return confirmSubscriptionLink;
     }
-    async getSubscribersByStatusPage(statusPageId, props) {
+    /*
+     * The confirmed, still-subscribed subscribers of a status page, in _id
+     * order, at most `limit` (LIMIT_MAX by default) of them.
+     *
+     * One read stops at the limit, so a page with more subscribers than that
+     * is read in batches: pass the _id of the last subscriber of one batch as
+     * `afterId` to read the next, until a batch comes back smaller than the
+     * limit (SubscriberNotificationFanOut does this for the subscriber jobs).
+     * The cursor is an _id rather than an offset, so a subscriber who
+     * unsubscribes while a send is part-way through cannot shift the rows
+     * after it into a batch already read, and nobody is skipped.
+     */
+    async getSubscribersByStatusPage(statusPageId, props, options) {
         logger.debug("getSubscribersByStatusPage called with statusPageId:", {
             statusPageId: statusPageId === null || statusPageId === void 0 ? void 0 : statusPageId.toString(),
         });
@@ -917,11 +1447,9 @@ Stay informed about service availability! 🚀`;
             statusPageId: statusPageId === null || statusPageId === void 0 ? void 0 : statusPageId.toString(),
         });
         const subscribers = await this.findBy({
-            query: {
-                statusPageId: statusPageId,
-                isUnsubscribed: false,
-                isSubscriptionConfirmed: true,
-            },
+            query: Object.assign({ statusPageId: statusPageId, isUnsubscribed: false, isSubscriptionConfirmed: true }, ((options === null || options === void 0 ? void 0 : options.afterId)
+                ? { _id: QueryHelper.greaterThan(options.afterId) }
+                : {})),
             select: {
                 _id: true,
                 subscriberEmail: true,
@@ -933,53 +1461,278 @@ Stay informed about service availability! 🚀`;
                 statusPageResources: true,
                 isSubscribedToAllEventTypes: true,
                 statusPageEventTypes: true,
+                // Every sender puts this subscriber's unsubscribe link in its message.
+                unsubscribeToken: true,
+                /*
+                 * Whether the team added this subscriber rather than it signing up
+                 * on the status page (see isAddedByTeam).
+                 */
+                isAddedByTeam: true,
+                createdByUserId: true,
+            },
+            // A stable order, which the afterId cursor reads on from.
+            sort: {
+                _id: SortOrder.Ascending,
             },
             skip: 0,
-            limit: LIMIT_MAX,
+            limit: (options === null || options === void 0 ? void 0 : options.limit) || LIMIT_MAX,
             props: props,
         });
-        logger.debug("Found subscribers:", {
-            statusPageId: statusPageId === null || statusPageId === void 0 ? void 0 : statusPageId.toString(),
-        });
-        logger.debug(subscribers, {
+        await this.ensureUnsubscribeTokens(subscribers);
+        /*
+         * The count, not the rows: each row now carries its unsubscribe token,
+         * which is a credential and has no place in a log line.
+         */
+        logger.debug(`Found ${subscribers.length} subscribers.`, {
             statusPageId: statusPageId === null || statusPageId === void 0 ? void 0 : statusPageId.toString(),
         });
         return subscribers;
     }
-    getUnsubscribeLink(statusPageUrl, statusPageSubscriberId) {
-        logger.debug("getUnsubscribeLink called with statusPageUrl:", {
-            statusPageSubscriberId: statusPageSubscriberId === null || statusPageSubscriberId === void 0 ? void 0 : statusPageSubscriberId.toString(),
-        });
-        logger.debug(statusPageUrl, {
-            statusPageSubscriberId: statusPageSubscriberId === null || statusPageSubscriberId === void 0 ? void 0 : statusPageSubscriberId.toString(),
-        });
-        logger.debug("statusPageSubscriberId:", {
-            statusPageSubscriberId: statusPageSubscriberId === null || statusPageSubscriberId === void 0 ? void 0 : statusPageSubscriberId.toString(),
-        });
-        logger.debug(statusPageSubscriberId, {
-            statusPageSubscriberId: statusPageSubscriberId === null || statusPageSubscriberId === void 0 ? void 0 : statusPageSubscriberId.toString(),
+    /*
+     * How many subscribers of each status page each channel reaches, for the
+     * audience summary shown before an incident or a public note is sent
+     * (IncidentSubscriberAudience). The same subscribers getSubscribersByStatusPage
+     * sends to - confirmed, not unsubscribed - counted per channel in one
+     * aggregate query rather than read out: it never loads an address.
+     *
+     * A channel counts a subscriber whenever the job would send on it, which is
+     * whenever that column holds a value; a subscription with both an email and
+     * a phone counts once on each. Rows are pinned to the project, whatever ids
+     * the caller passes.
+     *
+     * Keyed by the lower-cased status page id. A page with no active subscriber
+     * has no entry.
+     */
+    async countActiveSubscribersByChannel(data) {
+        const counts = {};
+        const statusPageIds = [];
+        for (const statusPageId of data.statusPageIds) {
+            const id = statusPageId.toString().trim().toLowerCase();
+            if (id && !statusPageIds.includes(id)) {
+                statusPageIds.push(id);
+            }
+        }
+        if (statusPageIds.length === 0) {
+            return counts;
+        }
+        const rows = await this.getRepository().manager.query(`SELECT
+         "statusPageId"::text AS "statusPageId",
+         COUNT(*) FILTER (WHERE NULLIF(TRIM("subscriberEmail"), '') IS NOT NULL)::text AS "email",
+         COUNT(*) FILTER (WHERE NULLIF(TRIM("subscriberPhone"), '') IS NOT NULL)::text AS "sms",
+         COUNT(*) FILTER (WHERE NULLIF(TRIM("slackIncomingWebhookUrl"), '') IS NOT NULL)::text AS "slack",
+         COUNT(*) FILTER (WHERE NULLIF(TRIM("microsoftTeamsIncomingWebhookUrl"), '') IS NOT NULL)::text AS "microsoftTeams",
+         COUNT(*) FILTER (WHERE NULLIF(TRIM("subscriberWebhook"), '') IS NOT NULL)::text AS "webhook"
+       FROM "StatusPageSubscriber"
+       WHERE "projectId" = $1
+         AND "statusPageId" = ANY($2::uuid[])
+         AND "isUnsubscribed" = false
+         AND "isSubscriptionConfirmed" = true
+         AND "deletedAt" IS NULL
+       GROUP BY "statusPageId"`, [data.projectId.toString(), statusPageIds]);
+        const toCount = (value) => {
+            const count = parseInt(value || "0", 10);
+            return Number.isFinite(count) && count > 0 ? count : 0;
+        };
+        for (const row of rows) {
+            counts[row.statusPageId.toLowerCase()] = {
+                email: toCount(row.email),
+                sms: toCount(row.sms),
+                slack: toCount(row.slack),
+                microsoftTeams: toCount(row.microsoftTeams),
+                webhook: toCount(row.webhook),
+            };
+        }
+        return counts;
+    }
+    /*
+     * The link to a subscriber's unsubscribe page, which every notification to
+     * it carries: {statusPageUrl}/unsubscribe/{id}-{token}. It works on public
+     * and private status pages alike and without signing in, and it only ever
+     * asks - the page unsubscribes when its reader confirms (see
+     * Common/Types/StatusPage/StatusPageSubscriberUnsubscribe).
+     *
+     * Pass the subscriber read with its unsubscribeToken: every loader that
+     * feeds a sender selects it (getSubscribersByStatusPage and the subscribe
+     * and manage emails). A subscriber without one still gets a link, to the
+     * page that says the link is out of date, rather than none; that is logged,
+     * because only a subscriber created around the migration that added the
+     * token, or one written with hooks skipped, can lack it.
+     */
+    getUnsubscribeLink(statusPageUrl, subscriber) {
+        const subscriberId = subscriber.id;
+        if (!subscriberId) {
+            throw new BadDataException("A subscriber id is required to build an unsubscribe link.");
+        }
+        if (!StatusPageSubscriberUnsubscribe.isWellFormedToken(subscriber.unsubscribeToken)) {
+            logger.error(`Status page subscriber ${subscriberId.toString()} has no unsubscribe token; its unsubscribe link leads to the out-of-date link page.`, {
+                statusPageSubscriberId: subscriberId.toString(),
+            });
+        }
+        return StatusPageSubscriberUnsubscribe.buildLink({
+            statusPageUrl: statusPageUrl,
+            subscriberId: subscriberId,
+            unsubscribeToken: subscriber.unsubscribeToken,
         });
-        const unsubscribeLink = URL.fromString(statusPageUrl.toString()).addRoute("/update-subscription/" + statusPageSubscriberId.toString());
-        logger.debug("Generated Unsubscribe Link:", {
-            statusPageSubscriberId: statusPageSubscriberId === null || statusPageSubscriberId === void 0 ? void 0 : statusPageSubscriberId.toString(),
+    }
+    /*
+     * The subscriber's Update Subscription page, where it can choose resources
+     * and event types (and unsubscribe). The "manage your subscription" email a
+     * visitor asks for from the Subscribe page links here. On a private status
+     * page it needs a signed-in visitor, like the rest of the page.
+     */
+    getManageSubscriptionLink(statusPageUrl, statusPageSubscriberId) {
+        return StatusPageSubscriberUnsubscribe.buildManageSubscriptionLink({
+            statusPageUrl: statusPageUrl,
+            subscriberId: statusPageSubscriberId,
         });
-        logger.debug(unsubscribeLink, {
-            statusPageSubscriberId: statusPageSubscriberId === null || statusPageSubscriberId === void 0 ? void 0 : statusPageSubscriberId.toString(),
+    }
+    /*
+     * Give every subscriber in the list an unsubscribe token it lacks, in place,
+     * so the links built from them work. Every create mints one, and the
+     * BackfillStatusPageSubscriberUnsubscribeColumns data migration gives one
+     * to every subscriber that existed before; this covers the ones that
+     * migration has not reached yet (it runs after the upgrade, in batches), a
+     * subscriber created in between, and one written with hooks skipped.
+     *
+     * One statement per batch of subscribers, not per subscriber: until the
+     * backfill has run, a whole page's list can be missing its tokens.
+     *
+     * The write only fills an empty column, so two senders racing on the same
+     * subscriber - or a sender and the backfill - cannot hand out two different
+     * tokens: the loser reads back the winner's.
+     */
+    async ensureUnsubscribeTokens(subscribers) {
+        // The rows that lack one, by id: a list can hold the same subscriber twice.
+        const missing = new Map();
+        for (const subscriber of subscribers) {
+            if (!subscriber._id ||
+                StatusPageSubscriberUnsubscribe.isWellFormedToken(subscriber.unsubscribeToken)) {
+                continue;
+            }
+            const id = subscriber._id.toString().toLowerCase();
+            missing.set(id, [...(missing.get(id) || []), subscriber]);
+        }
+        const ids = Array.from(missing.keys());
+        for (let start = 0; start < ids.length; start += UNSUBSCRIBE_COLUMNS_BATCH_SIZE) {
+            const batch = ids.slice(start, start + UNSUBSCRIBE_COLUMNS_BATCH_SIZE);
+            await this.fillMissingUnsubscribeTokens(batch);
+            const stored = await this.findBy({
+                query: {
+                    _id: QueryHelper.any(batch),
+                },
+                select: {
+                    _id: true,
+                    unsubscribeToken: true,
+                },
+                skip: 0,
+                limit: batch.length,
+                props: {
+                    isRoot: true,
+                    ignoreHooks: true,
+                },
+            });
+            for (const row of stored) {
+                if (!row._id ||
+                    !StatusPageSubscriberUnsubscribe.isWellFormedToken(row.unsubscribeToken)) {
+                    continue;
+                }
+                for (const subscriber of missing.get(row._id.toString().toLowerCase()) || []) {
+                    subscriber.unsubscribeToken = row.unsubscribeToken;
+                }
+            }
+        }
+    }
+    /*
+     * The BackfillStatusPageSubscriberUnsubscribeColumns data migration: give
+     * every subscriber that existed before the upgrade its unsubscribe token,
+     * and mark the ones with a creator as added by the team (Is Added By
+     * Team). Soft-deleted subscribers are included: one that is restored must
+     * not come back without a token.
+     *
+     * The table is walked in primary key order, a batch of ids at a time, and
+     * each batch is written by primary key in short statements of their own.
+     * So however large the table, no statement holds its rows for long or runs
+     * into the connection's statement timeout, and notifications, sign-ups and
+     * the subscriber lists carry on while it runs - which one UPDATE of every
+     * row, in the migration that added the columns, would have stopped.
+     *
+     * Idempotent, and safe to run twice at once (the data migration runner is
+     * not serialized): every write only fills what is still empty, and
+     * re-checks that under the row lock, so a token a sender has already put
+     * in a message is never replaced.
+     */
+    async backfillUnsubscribeColumns(options) {
+        const batchSize = Math.max(1, Math.floor((options === null || options === void 0 ? void 0 : options.batchSize) || UNSUBSCRIBE_COLUMNS_BATCH_SIZE));
+        const result = {
+            tokensGiven: 0,
+            markedAddedByTeam: 0,
+        };
+        let lastId = null;
+        for (;;) {
+            const rows = await this.getRepository().manager.query(`SELECT "_id"::text AS "_id",
+                ("unsubscribeToken" IS NULL) AS "needsToken",
+                ("isAddedByTeam" = false AND "createdByUserId" IS NOT NULL) AS "needsAddedByTeam"
+           FROM "StatusPageSubscriber"
+          WHERE ($2::uuid IS NULL OR "_id" > $2::uuid)
+          ORDER BY "_id" ASC
+          LIMIT $1`, [batchSize, lastId]);
+            if (rows.length === 0) {
+                break;
+            }
+            const needToken = rows
+                .filter((row) => {
+                return row.needsToken === true;
+            })
+                .map((row) => {
+                return row._id;
+            });
+            const needAddedByTeam = rows
+                .filter((row) => {
+                return row.needsAddedByTeam === true;
+            })
+                .map((row) => {
+                return row._id;
+            });
+            result.tokensGiven += await this.fillMissingUnsubscribeTokens(needToken);
+            if (needAddedByTeam.length > 0) {
+                result.markedAddedByTeam += affectedRowCount(await this.getRepository().manager.query(`UPDATE "StatusPageSubscriber" SET "isAddedByTeam" = true WHERE "_id" = ANY($1::uuid[]) AND "createdByUserId" IS NOT NULL AND "isAddedByTeam" = false`, [needAddedByTeam]));
+            }
+            lastId = rows[rows.length - 1]._id;
+            if (rows.length < batchSize) {
+                break;
+            }
+        }
+        return result;
+    }
+    /*
+     * Mint a token, from Node's CSPRNG like every other, for each of these
+     * subscribers that has none, in one statement. Returns how many were given
+     * one. `"unsubscribeToken" IS NULL` is checked again under each row's lock,
+     * so a token another writer stored first is kept.
+     */
+    async fillMissingUnsubscribeTokens(subscriberIds) {
+        if (subscriberIds.length === 0) {
+            return 0;
+        }
+        const tokens = subscriberIds.map(() => {
+            return StatusPageSubscriberUnsubscribeToken.generate();
         });
-        return unsubscribeLink;
+        return affectedRowCount(await this.getRepository().manager.query(`UPDATE "StatusPageSubscriber" AS "subscriber" SET "unsubscribeToken" = "minted"."token" FROM unnest($1::uuid[], $2::text[]) AS "minted"("id", "token") WHERE "subscriber"."_id" = "minted"."id" AND "subscriber"."unsubscribeToken" IS NULL`, [subscriberIds, tokens]));
     }
     shouldSendNotification(data) {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1;
-        logger.debug("shouldSendNotification called with data:", {
-            statusPageId: (_b = (_a = data.statusPage) === null || _a === void 0 ? void 0 : _a.id) === null || _b === void 0 ? void 0 : _b.toString(),
-        });
-        logger.debug(data, {
-            statusPageId: (_d = (_c = data.statusPage) === null || _c === void 0 ? void 0 : _c.id) === null || _d === void 0 ? void 0 : _d.toString(),
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2;
+        /*
+         * Ids only: the subscriber carries its unsubscribe token, which is a
+         * credential (it cancels the subscription, private pages included), and
+         * every subscriber job calls this for every subscriber.
+         */
+        logger.debug(`shouldSendNotification called for subscriber ${((_b = (_a = data.subscriber) === null || _a === void 0 ? void 0 : _a._id) === null || _b === void 0 ? void 0 : _b.toString()) || ""} (${data.eventType}, ${((_c = data.statusPageResources) === null || _c === void 0 ? void 0 : _c.length) || 0} resource(s)).`, {
+            statusPageId: (_e = (_d = data.statusPage) === null || _d === void 0 ? void 0 : _d.id) === null || _e === void 0 ? void 0 : _e.toString(),
         });
         let shouldSendNotification = true; // default to true.
         if (data.subscriber.isUnsubscribed) {
             logger.debug("Subscriber is unsubscribed.", {
-                statusPageId: (_f = (_e = data.statusPage) === null || _e === void 0 ? void 0 : _e.id) === null || _f === void 0 ? void 0 : _f.toString(),
+                statusPageId: (_g = (_f = data.statusPage) === null || _f === void 0 ? void 0 : _f.id) === null || _g === void 0 ? void 0 : _g.toString(),
             });
             shouldSendNotification = false;
             return shouldSendNotification;
@@ -989,29 +1742,29 @@ Stay informed about service availability! 🚀`;
             !(data.eventType === StatusPageEventType.Announcement &&
                 data.statusPageResources.length === 0) // announcements with no monitors don't use resource filtering
         ) {
-            logger.debug("Subscriber can choose resources and is not subscribed to all resources.", { statusPageId: (_h = (_g = data.statusPage) === null || _g === void 0 ? void 0 : _g.id) === null || _h === void 0 ? void 0 : _h.toString() });
-            const subscriberResourceIds = ((_j = data.subscriber.statusPageResources) === null || _j === void 0 ? void 0 : _j.map((resource) => {
+            logger.debug("Subscriber can choose resources and is not subscribed to all resources.", { statusPageId: (_j = (_h = data.statusPage) === null || _h === void 0 ? void 0 : _h.id) === null || _j === void 0 ? void 0 : _j.toString() });
+            const subscriberResourceIds = ((_k = data.subscriber.statusPageResources) === null || _k === void 0 ? void 0 : _k.map((resource) => {
                 var _a;
                 return (_a = resource.id) === null || _a === void 0 ? void 0 : _a.toString();
             })) || [];
             logger.debug(`Subscriber Resource IDs: ${subscriberResourceIds}`, {
-                statusPageId: (_l = (_k = data.statusPage) === null || _k === void 0 ? void 0 : _k.id) === null || _l === void 0 ? void 0 : _l.toString(),
+                statusPageId: (_m = (_l = data.statusPage) === null || _l === void 0 ? void 0 : _l.id) === null || _m === void 0 ? void 0 : _m.toString(),
             });
             let shouldSendNotificationForResource = false;
             if (subscriberResourceIds.length === 0) {
                 logger.debug("Subscriber has no resource IDs.", {
-                    statusPageId: (_o = (_m = data.statusPage) === null || _m === void 0 ? void 0 : _m.id) === null || _o === void 0 ? void 0 : _o.toString(),
+                    statusPageId: (_p = (_o = data.statusPage) === null || _o === void 0 ? void 0 : _o.id) === null || _p === void 0 ? void 0 : _p.toString(),
                 });
                 shouldSendNotificationForResource = false;
             }
             else {
                 for (const resource of data.statusPageResources) {
                     logger.debug(`Checking resource: ${resource.id}`, {
-                        statusPageId: (_q = (_p = data.statusPage) === null || _p === void 0 ? void 0 : _p.id) === null || _q === void 0 ? void 0 : _q.toString(),
+                        statusPageId: (_r = (_q = data.statusPage) === null || _q === void 0 ? void 0 : _q.id) === null || _r === void 0 ? void 0 : _r.toString(),
                     });
-                    if (subscriberResourceIds.includes((_r = resource.id) === null || _r === void 0 ? void 0 : _r.toString())) {
+                    if (subscriberResourceIds.includes((_s = resource.id) === null || _s === void 0 ? void 0 : _s.toString())) {
                         logger.debug("Resource ID matches subscriber's resource ID.", {
-                            statusPageId: (_t = (_s = data.statusPage) === null || _s === void 0 ? void 0 : _s.id) === null || _t === void 0 ? void 0 : _t.toString(),
+                            statusPageId: (_u = (_t = data.statusPage) === null || _t === void 0 ? void 0 : _t.id) === null || _u === void 0 ? void 0 : _u.toString(),
                         });
                         shouldSendNotificationForResource = true;
                     }
@@ -1019,7 +1772,7 @@ Stay informed about service availability! 🚀`;
             }
             if (!shouldSendNotificationForResource) {
                 logger.debug("Should not send notification for resource.", {
-                    statusPageId: (_v = (_u = data.statusPage) === null || _u === void 0 ? void 0 : _u.id) === null || _v === void 0 ? void 0 : _v.toString(),
+                    statusPageId: (_w = (_v = data.statusPage) === null || _v === void 0 ? void 0 : _v.id) === null || _w === void 0 ? void 0 : _w.toString(),
                 });
                 shouldSendNotification = false;
             }
@@ -1027,15 +1780,15 @@ Stay informed about service availability! 🚀`;
         // now do for event types
         if (data.statusPage.allowSubscribersToChooseEventTypes &&
             !data.subscriber.isSubscribedToAllEventTypes) {
-            logger.debug("Subscriber can choose event types and is not subscribed to all event types.", { statusPageId: (_x = (_w = data.statusPage) === null || _w === void 0 ? void 0 : _w.id) === null || _x === void 0 ? void 0 : _x.toString() });
+            logger.debug("Subscriber can choose event types and is not subscribed to all event types.", { statusPageId: (_y = (_x = data.statusPage) === null || _x === void 0 ? void 0 : _x.id) === null || _y === void 0 ? void 0 : _y.toString() });
             const subscriberEventTypes = data.subscriber.statusPageEventTypes || [];
             logger.debug(`Subscriber Event Types: ${subscriberEventTypes}`, {
-                statusPageId: (_z = (_y = data.statusPage) === null || _y === void 0 ? void 0 : _y.id) === null || _z === void 0 ? void 0 : _z.toString(),
+                statusPageId: (_0 = (_z = data.statusPage) === null || _z === void 0 ? void 0 : _z.id) === null || _0 === void 0 ? void 0 : _0.toString(),
             });
             let shouldSendNotificationForEventType = false;
             if (subscriberEventTypes.includes(data.eventType)) {
                 logger.debug("Event type matches subscriber's event type.", {
-                    statusPageId: (_1 = (_0 = data.statusPage) === null || _0 === void 0 ? void 0 : _0.id) === null || _1 === void 0 ? void 0 : _1.toString(),
+                    statusPageId: (_2 = (_1 = data.statusPage) === null || _1 === void 0 ? void 0 : _1.id) === null || _2 === void 0 ? void 0 : _2.toString(),
                 });
                 shouldSendNotificationForEventType = true;
             }
@@ -1110,6 +1863,13 @@ Stay informed about service availability! 🚀`;
                  * every episode notification from being sent.
                  */
                 showEpisodesOnStatusPage: true,
+                /*
+                 * IncidentStatusPageScope decides from this which incidents reach a
+                 * page, and treats a page without it as showing only incidents
+                 * limited to it - so leaving it out would silence every unscoped
+                 * incident's notifications.
+                 */
+                onlyShowScopedIncidents: true,
             },
         });
         logger.debug("Found status pages:", {});
@@ -1226,12 +1986,60 @@ You will receive real-time notifications for:
         }
     }
 }
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "create", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Model]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "createFromStatusPageSignUp", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onBeforeUpdate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "onUpdateSuccess", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "unsubscribe", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "getUnsubscribeLinkDetails", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "unsubscribeWithLink", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "notifyTeamOfUnsubscribe", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
@@ -1253,9 +2061,27 @@ __decorate([
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),
-    __metadata("design:paramtypes", [ObjectID, Object]),
+    __metadata("design:paramtypes", [ObjectID, Object, Object]),
     __metadata("design:returntype", Promise)
 ], Service.prototype, "getSubscribersByStatusPage", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "countActiveSubscribersByChannel", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Array]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "ensureUnsubscribeTokens", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], Service.prototype, "backfillUnsubscribeColumns", null);
 __decorate([
     CaptureSpan(),
     __metadata("design:type", Function),