@oneuptime/common 14.0.7 → 14.0.9

package/Server/API/StatusPageSubscriberAPI.ts

@@ -1,6 +1,7 @@
 import StatusPageSubscriberService, {
   Service as StatusPageSubscriberServiceType,
 } from "../Services/StatusPageSubscriberService";
+import StatusPageService from "../Services/StatusPageService";
 import {
   ExpressRequest,
   ExpressResponse,
@@ -9,6 +10,15 @@ import {
 import Response from "../Utils/Response";
 import BaseAPI from "./BaseAPI";
 import StatusPageSubscriber from "../../Models/DatabaseModels/StatusPageSubscriber";
+import ObjectID from "../../Types/ObjectID";
+import StatusPageSubscriberUnsubscribe from "../../Types/StatusPage/StatusPageSubscriberUnsubscribe";
+
+/*
+ * What the old unsubscribe route answers for an id that is not a
+ * subscriber's. Static, so nothing from the request is ever echoed into it.
+ */
+export const OUT_OF_DATE_UNSUBSCRIBE_LINK_HTML: string =
+  '<!DOCTYPE html><html lang="en"><head><meta charset="utf-8" /><meta name="robots" content="noindex" /><meta name="referrer" content="no-referrer" /><title>Unsubscribe link out of date</title></head><body><p>This unsubscribe link is out of date. To unsubscribe, use the unsubscribe link at the bottom of a recent message from the status page.</p></body></html>';
 
 export default class StatusPageSubscriberAPI extends BaseAPI<
   StatusPageSubscriber,
@@ -17,27 +27,65 @@ export default class StatusPageSubscriberAPI extends BaseAPI<
   public constructor() {
     super(StatusPageSubscriber, StatusPageSubscriberService);
 
+    /*
+     * The unsubscribe link notifications carried until the end of 2023:
+     * /api/status-page-subscriber/unsubscribe/{subscriberId}. It used to
+     * unsubscribe on the GET itself, knowing only the id - so a mail scanner
+     * fetching the link, or an <img> pointed at it from anywhere, cancelled
+     * the subscription.
+     *
+     * It no longer changes anything. An old link still leads somewhere
+     * useful: the status page's unsubscribe page, told only the id, which
+     * says the link is out of date and to use the one in a recent message
+     * (and, on a public page, offers the subscriber's manage page). It never
+     * hands out the subscriber's unsubscribe token - that would make the id
+     * alone enough to unsubscribe again. Notifications now carry
+     * {statusPageUrl}/unsubscribe/{id}-{token}, which asks before it acts.
+     */
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/unsubscribe/:id`,
       async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
         try {
-          await this.service.updateOneBy({
-            query: {
-              _id: req.params["id"] as string,
-            },
-            data: {
-              isUnsubscribed: true,
-            },
-            props: {
-              isRoot: true,
-              ignoreHooks: true,
-            },
-          });
-
-          return Response.sendHtmlResponse(
+          const subscriberId: string = (req.params["id"] as string) || "";
+
+          const subscriber: StatusPageSubscriber | null = ObjectID.isValidUUID(
+            subscriberId,
+          )
+            ? await this.service.findOneBy({
+                query: {
+                  _id: subscriberId,
+                },
+                select: {
+                  _id: true,
+                  statusPageId: true,
+                },
+                props: {
+                  isRoot: true,
+                  ignoreHooks: true,
+                },
+              })
+            : null;
+
+          Response.setNoCacheHeaders(res);
+
+          if (!subscriber || !subscriber.id || !subscriber.statusPageId) {
+            res.status(404);
+            res.setHeader("Content-Type", "text/html; charset=utf-8");
+            res.send(OUT_OF_DATE_UNSUBSCRIBE_LINK_HTML);
+            return;
+          }
+
+          const statusPageUrl: string =
+            await StatusPageService.getStatusPageURL(subscriber.statusPageId);
+
+          return Response.redirect(
             req,
             res,
-            "<html><body><p> You have been unsubscribed.</p><body><html>",
+            StatusPageSubscriberUnsubscribe.buildLink({
+              statusPageUrl: statusPageUrl,
+              subscriberId: subscriber.id,
+              unsubscribeToken: null,
+            }),
           );
         } catch (err) {
           next(err);

package/Server/Infrastructure/GlobalCache.ts

@@ -136,6 +136,38 @@ export default abstract class GlobalCache {
     return value;
   }
 
+  /*
+   * Several keys of one namespace in a single round-trip (MGET). The result
+   * is positional: one entry per requested key, null where the key is
+   * missing or empty.
+   */
+  @CaptureSpan()
+  public static async getStrings(
+    namespace: string,
+    keys: Array<string>,
+  ): Promise<Array<string | null>> {
+    if (keys.length === 0) {
+      return [];
+    }
+
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const values: Array<string | null> = await client.mget(
+      keys.map((key: string) => {
+        return `${namespace}-${key}`;
+      }),
+    );
+
+    return keys.map((_key: string, index: number) => {
+      const value: string | null | undefined = values[index];
+      return value ? value : null;
+    });
+  }
+
   @CaptureSpan()
   public static async setJSON(
     namespace: string,

package/Server/Infrastructure/Postgres/SchemaMigrations/1795300000000-SkipHiddenIncidentCreatedNotifications.ts

@@ -0,0 +1,49 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Data fix: settle the 'incident created' subscriber notification of hidden
+ * incidents that the worker left InProgress.
+ *
+ * Incident:SendNotificationToSubscribers used to mark an incident's 'created'
+ * notification InProgress and then, when the incident was not visible on
+ * status pages, move on without settling it. The job only ever picks up
+ * Pending rows, so those rows stayed InProgress forever: the dashboard showed
+ * "Notifications Being Sent" for good, and nothing could ever send them once
+ * the incident was published. The worker now marks them Skipped with a
+ * reason, and publishing such an incident can re-queue the notification (see
+ * IncidentCreatedRenotify) - but only from Skipped. This moves the rows the old
+ * worker stranded to the same Skipped state and reason, so they get that
+ * option too.
+ *
+ * Only hidden incidents are touched. `IS NOT TRUE` also covers a NULL
+ * visibility, which the worker treated as hidden. A visible incident that is
+ * InProgress may really be sending right now, and is left alone.
+ *
+ * The message is written out rather than imported so the migration keeps
+ * doing what it did when it shipped. It matches
+ * IncidentCreatedRenotify.hiddenFromStatusPagesMessage, which is what the
+ * worker writes, so migrated rows read exactly like newly skipped ones (a
+ * test pins the two together).
+ *
+ * down() restores nothing: putting rows back into a state that nothing ever
+ * leaves would only break them again.
+ */
+export const HIDDEN_FROM_STATUS_PAGES_MESSAGE: string =
+  "Incident is not visible on status pages. Skipping notifications to subscribers.";
+
+export class SkipHiddenIncidentCreatedNotifications1795300000000
+  implements MigrationInterface
+{
+  public name: string = "SkipHiddenIncidentCreatedNotifications1795300000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `UPDATE "Incident" SET "subscriberNotificationStatusOnIncidentCreated" = 'Skipped', "subscriberNotificationStatusMessage" = $1 WHERE "subscriberNotificationStatusOnIncidentCreated" = 'InProgress' AND "isVisibleOnStatusPage" IS NOT TRUE`,
+      [HIDDEN_FROM_STATUS_PAGES_MESSAGE],
+    );
+  }
+
+  public async down(_queryRunner: QueryRunner): Promise<void> {
+    // Nothing to restore; see the note above.
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1795400000000-AddIncidentStatusPageScope.ts

@@ -0,0 +1,108 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Per-incident status page scope (Incident.statusPages).
+ *
+ * - IncidentStatusPage: the status pages an incident is limited to. Its join
+ *   rows cascade when either side is deleted.
+ * - Incident.isScopedToStatusPages: whether the incident is limited to its
+ *   status pages, so the status page queries can split on it in SQL. Existing
+ *   incidents are unscoped, which is today's behaviour, so the default needs
+ *   no backfill. It is never recomputed when join rows cascade away: an
+ *   incident whose only scoped page is deleted stays scoped - to nothing - and
+ *   is hidden rather than widened to every page its monitors reach. It is not
+ *   indexed: false on nearly every row, and an index built here would hold
+ *   this transaction's lock on Incident, reads included, for the whole build.
+ *   Adding the NOT NULL DEFAULT false column itself does not rewrite the
+ *   table.
+ * - Incident.statusPagesNotifiedOnCreation: the pages already sent the
+ *   incident's 'created' notification, so a page added later is told once.
+ * - IncidentTemplateStatusPage: the scope an incident template applies.
+ * - StatusPage.onlyShowScopedIncidents: pages that never show or notify an
+ *   unscoped incident. Off for every existing page.
+ */
+export class AddIncidentStatusPageScope1795400000000
+  implements MigrationInterface
+{
+  public name: string = "AddIncidentStatusPageScope1795400000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "IncidentStatusPage" ("incidentId" uuid NOT NULL, "statusPageId" uuid NOT NULL, CONSTRAINT "PK_704cbe88e7fbb614b8276db4326" PRIMARY KEY ("incidentId", "statusPageId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_a4ad6eb224d14cc17708420961" ON "IncidentStatusPage" ("incidentId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_12a8bd395d53349410e5fce974" ON "IncidentStatusPage" ("statusPageId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "IncidentTemplateStatusPage" ("incidentTemplateId" uuid NOT NULL, "statusPageId" uuid NOT NULL, CONSTRAINT "PK_24de18b6b85dd0baf4e0016a807" PRIMARY KEY ("incidentTemplateId", "statusPageId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_20db51def3a2086a8bf62294a1" ON "IncidentTemplateStatusPage" ("incidentTemplateId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_b1a0dee8efae60ea4a0c37f6b8" ON "IncidentTemplateStatusPage" ("statusPageId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" ADD "onlyShowScopedIncidents" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" ADD "isScopedToStatusPages" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" ADD "statusPagesNotifiedOnCreation" jsonb`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentStatusPage" ADD CONSTRAINT "FK_a4ad6eb224d14cc177084209619" FOREIGN KEY ("incidentId") REFERENCES "Incident"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentStatusPage" ADD CONSTRAINT "FK_12a8bd395d53349410e5fce9743" FOREIGN KEY ("statusPageId") REFERENCES "StatusPage"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentTemplateStatusPage" ADD CONSTRAINT "FK_20db51def3a2086a8bf62294a1f" FOREIGN KEY ("incidentTemplateId") REFERENCES "IncidentTemplate"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentTemplateStatusPage" ADD CONSTRAINT "FK_b1a0dee8efae60ea4a0c37f6b81" FOREIGN KEY ("statusPageId") REFERENCES "StatusPage"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentTemplateStatusPage" DROP CONSTRAINT "FK_b1a0dee8efae60ea4a0c37f6b81"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentTemplateStatusPage" DROP CONSTRAINT "FK_20db51def3a2086a8bf62294a1f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentStatusPage" DROP CONSTRAINT "FK_12a8bd395d53349410e5fce9743"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentStatusPage" DROP CONSTRAINT "FK_a4ad6eb224d14cc177084209619"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" DROP COLUMN "statusPagesNotifiedOnCreation"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" DROP COLUMN "isScopedToStatusPages"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPage" DROP COLUMN "onlyShowScopedIncidents"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b1a0dee8efae60ea4a0c37f6b8"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_20db51def3a2086a8bf62294a1"`,
+    );
+    await queryRunner.query(`DROP TABLE "IncidentTemplateStatusPage"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_12a8bd395d53349410e5fce974"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_a4ad6eb224d14cc17708420961"`,
+    );
+    await queryRunner.query(`DROP TABLE "IncidentStatusPage"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1795500000000-AddIncidentTemplateStatusPageScopeFlag.ts

@@ -0,0 +1,33 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * IncidentTemplate.isScopedToStatusPages: whether a template limits the
+ * incidents declared from it to status pages, kept apart from its list of
+ * pages so that a template whose every page was deleted (the join rows
+ * cascade away) does not start declaring incidents that reach every status
+ * page (see the column in IncidentTemplate).
+ *
+ * Templates that already list status pages are scoped, so the flag is set for
+ * them. Nothing else changes: a template with no pages stays unscoped.
+ */
+export class AddIncidentTemplateStatusPageScopeFlag1795500000000
+  implements MigrationInterface
+{
+  public name: string = "AddIncidentTemplateStatusPageScopeFlag1795500000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentTemplate" ADD "isScopedToStatusPages" boolean NOT NULL DEFAULT false`,
+    );
+
+    await queryRunner.query(
+      `UPDATE "IncidentTemplate" SET "isScopedToStatusPages" = true WHERE "_id" IN (SELECT "incidentTemplateId" FROM "IncidentTemplateStatusPage")`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentTemplate" DROP COLUMN "isScopedToStatusPages"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1795600000000-AddStatusPageSubscriberUnsubscribeToken.ts

@@ -0,0 +1,51 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Unsubscribing without signing in (StatusPageSubscriber.unsubscribeToken,
+ * StatusPageSubscriber.unsubscribedAt).
+ *
+ * - unsubscribeToken: the random secret in each subscriber's unsubscribe
+ *   link, {statusPageUrl}/unsubscribe/{id}-{token}. Holding the link is what
+ *   lets a subscriber of a private status page unsubscribe without an account
+ *   on it. New subscribers get one from StatusPageSubscriberService.
+ * - unsubscribedAt: when a subscription was cancelled. Subscriptions
+ *   cancelled before this column existed have none - there is no record of
+ *   when they were - and are left empty rather than given a made-up date.
+ *
+ * Only the two nullable columns, which Postgres adds without rewriting the
+ * table. Existing subscribers are given their tokens by the
+ * BackfillStatusPageSubscriberUnsubscribeTokens data migration, in batches
+ * and outside this migration's transaction: one UPDATE of every row here
+ * would hold ADD COLUMN's exclusive lock on the table - blocking every
+ * notification, subscribe and subscriber list - for as long as it took, and
+ * on a large table it would run into the connection's statement timeout and
+ * fail the deploy. Until the backfill reaches a subscriber, the first sender
+ * to need its link gives it one (StatusPageSubscriberService
+ * .ensureUnsubscribeTokens).
+ *
+ * down() drops both columns; the tokens cannot be recovered afterwards, and
+ * every link already sent stops working.
+ */
+export class AddStatusPageSubscriberUnsubscribeToken1795600000000
+  implements MigrationInterface
+{
+  public name: string = "AddStatusPageSubscriberUnsubscribeToken1795600000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageSubscriber" ADD "unsubscribedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageSubscriber" ADD "unsubscribeToken" character varying(100)`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageSubscriber" DROP COLUMN "unsubscribeToken"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageSubscriber" DROP COLUMN "unsubscribedAt"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1795700000000-AddStatusPageSubscriberIsAddedByTeam.ts

@@ -0,0 +1,33 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * StatusPageSubscriber.isAddedByTeam: whether the status page's team added a
+ * subscriber (from the dashboard, with an API key or by a workflow) rather
+ * than the subscriber signing up on the status page. It decides whether the
+ * page's owners are told when the subscriber unsubscribes itself - Created
+ * By cannot, because an API key's or a workflow's create carries no user.
+ *
+ * Postgres 11 and later add a NOT NULL column with a constant default without
+ * rewriting the table. Subscribers that already exist are marked from Created
+ * By by the BackfillStatusPageSubscriberUnsubscribeTokens data migration, in
+ * batches outside this transaction (see
+ * 1795600000000-AddStatusPageSubscriberUnsubscribeToken for why); until it
+ * reaches one, StatusPageSubscriberService reads Created By as well.
+ */
+export class AddStatusPageSubscriberIsAddedByTeam1795700000000
+  implements MigrationInterface
+{
+  public name: string = "AddStatusPageSubscriberIsAddedByTeam1795700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageSubscriber" ADD "isAddedByTeam" boolean NOT NULL DEFAULT false`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "StatusPageSubscriber" DROP COLUMN "isAddedByTeam"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1795800000000-AddIncidentCustomFieldCreateAndNotificationSettings.ts

@@ -0,0 +1,168 @@
+import { generateCustomFieldVariableKey } from "../../../../Types/CustomField/CustomFieldVariableKey";
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Incident custom field settings for declaring incidents and for subscriber
+ * emails (OneUptime/oneuptime#4035):
+ *
+ * - isRequiredOnCreate, sortOrder, showOnCreate and
+ *   includeInSubscriberNotifications: plain settings. The three flags start
+ *   off, and no field has an order, so every existing field behaves as it did.
+ * - variableKey: the key templates reach a field by, {{customFields.<key>}}.
+ *   Unique per project (the index), made from the name when a field is
+ *   created and never changed afterwards. Nullable only because the table
+ *   already has rows; the backfill below gives each of them a key.
+ *
+ * The backfill runs here, in the same transaction as the columns, rather than
+ * in a batched data migration like the subscriber tokens: definition tables
+ * hold a few dozen rows a project, and a key has to exist before anything
+ * lists a field's template variable. Keys are made by the same generator the
+ * service uses for a new field, so an existing field gets the key it would
+ * have got had it been created today. Within a project the oldest field wins
+ * the plain key and later ones get _2, _3, ...
+ *
+ * down() drops the columns and the index; the keys cannot be recovered, and
+ * templates that use them stop filling in.
+ */
+
+// Rows written per UPDATE: two parameters each, well under Postgres' limit.
+const BACKFILL_BATCH_SIZE: number = 500;
+
+type BackfillQueryRunner = Pick<QueryRunner, "query">;
+
+interface FieldRow {
+  _id: string;
+  projectId: string;
+  name: string | null;
+  variableKey: string | null;
+}
+
+/**
+ * Give every incident custom field without a template key one. Idempotent:
+ * a key already there is kept, and counted as taken for the others.
+ * Returns how many fields it gave a key.
+ */
+export const backfillIncidentCustomFieldVariableKeys: (
+  queryRunner: BackfillQueryRunner,
+) => Promise<number> = async (
+  queryRunner: BackfillQueryRunner,
+): Promise<number> => {
+  const rows: Array<FieldRow> = await queryRunner.query(
+    `SELECT "_id", "projectId", "name", "variableKey" FROM "IncidentCustomField" ORDER BY "projectId" ASC, "createdAt" ASC, "_id" ASC`,
+  );
+
+  const takenByProject: Map<string, Set<string>> = new Map<
+    string,
+    Set<string>
+  >();
+
+  for (const row of rows) {
+    const taken: Set<string> =
+      takenByProject.get(row.projectId) || new Set<string>();
+
+    if (row.variableKey) {
+      taken.add(row.variableKey);
+    }
+
+    takenByProject.set(row.projectId, taken);
+  }
+
+  const assignments: Array<{ id: string; variableKey: string }> = [];
+
+  for (const row of rows) {
+    if (row.variableKey) {
+      continue;
+    }
+
+    const taken: Set<string> = takenByProject.get(row.projectId)!;
+
+    const variableKey: string = generateCustomFieldVariableKey({
+      name: row.name || "",
+      existingKeys: taken,
+    });
+
+    taken.add(variableKey);
+    assignments.push({ id: row._id, variableKey: variableKey });
+  }
+
+  for (
+    let start: number = 0;
+    start < assignments.length;
+    start += BACKFILL_BATCH_SIZE
+  ) {
+    const batch: Array<{ id: string; variableKey: string }> = assignments.slice(
+      start,
+      start + BACKFILL_BATCH_SIZE,
+    );
+
+    const values: Array<string> = [];
+    const parameters: Array<string> = [];
+
+    for (const assignment of batch) {
+      parameters.push(assignment.id, assignment.variableKey);
+      values.push(
+        `($${parameters.length - 1}::uuid, $${parameters.length}::varchar)`,
+      );
+    }
+
+    await queryRunner.query(
+      `UPDATE "IncidentCustomField" AS "field" SET "variableKey" = "keys"."variableKey" FROM (VALUES ${values.join(
+        ", ",
+      )}) AS "keys"("_id", "variableKey") WHERE "field"."_id" = "keys"."_id" AND "field"."variableKey" IS NULL`,
+      parameters,
+    );
+  }
+
+  return assignments.length;
+};
+
+export class AddIncidentCustomFieldCreateAndNotificationSettings1795800000000
+  implements MigrationInterface
+{
+  public name: string =
+    "AddIncidentCustomFieldCreateAndNotificationSettings1795800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "isRequiredOnCreate" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "sortOrder" integer`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "showOnCreate" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "includeInSubscriberNotifications" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" ADD "variableKey" character varying(100)`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_0a49bcb055baad4356af439169" ON "IncidentCustomField" ("projectId", "variableKey") `,
+    );
+
+    await backfillIncidentCustomFieldVariableKeys(queryRunner);
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_0a49bcb055baad4356af439169"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "variableKey"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "includeInSubscriberNotifications"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "showOnCreate"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "sortOrder"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentCustomField" DROP COLUMN "isRequiredOnCreate"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1795900000000-AddSubscriberNotificationClaimedAt.ts

@@ -0,0 +1,44 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * When a subscriber job claimed the 'incident created', 'postmortem' and
+ * 'episode created' notifications (SubscriberNotificationClaim), for the
+ * sweeper (StatusPageSubscriber:TimeoutStuckNotifications) to time an
+ * interrupted send from. It used updatedAt, which other code writes on a
+ * schedule while an incident or episode is open - the owners' reminders,
+ * state changes, incidents joining an episode - so a send cut off by a
+ * redeploy could stay In progress until the incident went quiet.
+ *
+ * Nullable timestamps with no default: adding them rewrites nothing. A row
+ * claimed before they existed has none, and the sweeper times it from
+ * updatedAt, as before.
+ */
+export class AddSubscriberNotificationClaimedAt1795900000000
+  implements MigrationInterface
+{
+  public name: string = "AddSubscriberNotificationClaimedAt1795900000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "IncidentEpisode" ADD "subscriberNotificationClaimedAtOnEpisodeCreated" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" ADD "subscriberNotificationClaimedAtOnIncidentCreated" TIMESTAMP WITH TIME ZONE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" ADD "subscriberNotificationClaimedAtOnPostmortemPublished" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Incident" DROP COLUMN "subscriberNotificationClaimedAtOnPostmortemPublished"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Incident" DROP COLUMN "subscriberNotificationClaimedAtOnIncidentCreated"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "IncidentEpisode" DROP COLUMN "subscriberNotificationClaimedAtOnEpisodeCreated"`,
+    );
+  }
+}