@oneuptime/common 14.0.7 → 14.0.9

package/Server/Infrastructure/Postgres/SchemaMigrations/1796000000000-AddTeamComplianceRuleScope.ts

@@ -0,0 +1,99 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Team compliance rules scoped by severity and channel.
+ *
+ * - "notificationChannel": the channel an on-call compliance rule insists on
+ *   (Call, Push, ...). Nullable with no default, so every existing rule reads
+ *   as "any channel" - exactly what it checked before.
+ * - "TeamComplianceSettingIncidentSeverity" / "...AlertSeverity": the
+ *   severities an on-call compliance rule is scoped to. Empty means every
+ *   severity, which is again what every existing rule already checked. Both
+ *   cascade from the rule and from the severity.
+ * - The unique ("teamId", "ruleType") index goes: "Call for Critical
+ *   incidents" and "Push for Critical incidents" are both
+ *   HasIncidentOnCallRules on one team. TeamComplianceSettingService rejects
+ *   exact duplicates instead. Existing data cannot violate the change - it only
+ *   relaxes a constraint.
+ */
+export class AddTeamComplianceRuleScope1796000000000
+  implements MigrationInterface
+{
+  public name: string = "AddTeamComplianceRuleScope1796000000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_ef7342919ff02501c2b0ddc029"`,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "TeamComplianceSettingIncidentSeverity" ("teamComplianceSettingId" uuid NOT NULL, "incidentSeverityId" uuid NOT NULL, CONSTRAINT "PK_0071a6d21730a2ed9e098873b2e" PRIMARY KEY ("teamComplianceSettingId", "incidentSeverityId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_013768788937d0e484fb3c1bcb" ON "TeamComplianceSettingIncidentSeverity" ("teamComplianceSettingId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6e477b60ddefe41bfdee3e6142" ON "TeamComplianceSettingIncidentSeverity" ("incidentSeverityId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "TeamComplianceSettingAlertSeverity" ("teamComplianceSettingId" uuid NOT NULL, "alertSeverityId" uuid NOT NULL, CONSTRAINT "PK_ba665b5e7d6413db2be11bf2f09" PRIMARY KEY ("teamComplianceSettingId", "alertSeverityId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_c01a8eeea98cb41a45806fe5c7" ON "TeamComplianceSettingAlertSeverity" ("teamComplianceSettingId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_573637e6a2df47b516b0f955d9" ON "TeamComplianceSettingAlertSeverity" ("alertSeverityId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSetting" ADD "notificationChannel" character varying(100)`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingIncidentSeverity" ADD CONSTRAINT "FK_013768788937d0e484fb3c1bcb8" FOREIGN KEY ("teamComplianceSettingId") REFERENCES "TeamComplianceSetting"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingIncidentSeverity" ADD CONSTRAINT "FK_6e477b60ddefe41bfdee3e61424" FOREIGN KEY ("incidentSeverityId") REFERENCES "IncidentSeverity"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingAlertSeverity" ADD CONSTRAINT "FK_c01a8eeea98cb41a45806fe5c77" FOREIGN KEY ("teamComplianceSettingId") REFERENCES "TeamComplianceSetting"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingAlertSeverity" ADD CONSTRAINT "FK_573637e6a2df47b516b0f955d96" FOREIGN KEY ("alertSeverityId") REFERENCES "AlertSeverity"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingAlertSeverity" DROP CONSTRAINT "FK_573637e6a2df47b516b0f955d96"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingAlertSeverity" DROP CONSTRAINT "FK_c01a8eeea98cb41a45806fe5c77"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingIncidentSeverity" DROP CONSTRAINT "FK_6e477b60ddefe41bfdee3e61424"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSettingIncidentSeverity" DROP CONSTRAINT "FK_013768788937d0e484fb3c1bcb8"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "TeamComplianceSetting" DROP COLUMN "notificationChannel"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_573637e6a2df47b516b0f955d9"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_c01a8eeea98cb41a45806fe5c7"`,
+    );
+    await queryRunner.query(`DROP TABLE "TeamComplianceSettingAlertSeverity"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6e477b60ddefe41bfdee3e6142"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_013768788937d0e484fb3c1bcb"`,
+    );
+    await queryRunner.query(
+      `DROP TABLE "TeamComplianceSettingIncidentSeverity"`,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_ef7342919ff02501c2b0ddc029" ON "TeamComplianceSetting" ("teamId", "ruleType") `,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1796100000000-AddKubernetesAiAgentAndAiDefaults.ts

@@ -0,0 +1,137 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * The Kubernetes AI agent, and AI on by default.
+ *
+ * Schema (generated):
+ *   - KubernetesAiAgent: one row per cluster for the slim in-cluster kubectl
+ *     executor the kubernetes-agent chart now installs (its own identity,
+ *     never a Runner). Unique per cluster; cascades with its project and
+ *     cluster.
+ *   - RunnerJob.targetKubernetesAiAgentId: the agent an AI kubectl job is
+ *     targeted at (SET NULL when the agent row goes).
+ *   - Project.enableAutomaticPostmortemDraft: drafting a postmortem on
+ *     resolve, split off enableAutomaticIncidentInvestigation.
+ *   - KubernetesCluster.isAiInvestigationEnabled now defaults to true.
+ *
+ * Data (hand-added after the DDL, in this order):
+ *   1. Postmortem drafts keep working exactly where they worked: the new
+ *      flag is copied from the investigation flag it used to ride on. The
+ *      column was just added as NOT NULL DEFAULT false, so setting it to true
+ *      where investigation is on is the whole copy, and it rewrites only
+ *      those rows.
+ *   2. Clusters nobody ever configured AI access for (aiAccessConfiguredAt
+ *      IS NULL) get investigation on, like a new cluster. A cluster an
+ *      operator configured keeps its switch, whatever it is.
+ *   3. Revocations carry over. Before the AI agent, unbinding or deleting a
+ *      cluster's Runner was the off switch: the cluster has no Runner now
+ *      but one was bound once, or AI already ran (or failed to run) kubectl
+ *      on it. The agent must not quietly switch AI back on there, so
+ *      investigation goes off and remediation goes to Disabled. Runs after
+ *      2, so a revocation always wins.
+ *   4. No unattended surprise. Cluster rounds through the in-cluster agent
+ *      no longer need the project's "Enable AI command execution" opt-in, so
+ *      a cluster left in Automatic or Bypass approval in a project that never
+ *      opted in would start changing the cluster without a human on upgrade.
+ *      Those clusters drop to RequireApproval: fixes are proposed, a human
+ *      approves each.
+ *
+ * down() reverts the defaults and the schema only. The data updates are not
+ * reverted: afterwards those rows are indistinguishable from choices an
+ * operator made, and flipping them back could switch AI on or off for
+ * somebody who chose it.
+ */
+export class AddKubernetesAiAgentAndAiDefaults1796100000000
+  implements MigrationInterface
+{
+  public name: string = "AddKubernetesAiAgentAndAiDefaults1796100000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "KubernetesAiAgent" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "kubernetesClusterId" uuid NOT NULL, "keyHash" character varying(100), "agentVersion" character varying(100), "posture" jsonb, "lastAliveAt" TIMESTAMP WITH TIME ZONE, "connectionStatus" character varying(100) NOT NULL DEFAULT 'disconnected', "lastRegisteredAt" TIMESTAMP WITH TIME ZONE, "registeredWithIngestionKeyId" uuid, "lastRefusedRegistrationAt" TIMESTAMP WITH TIME ZONE, "lastRefusedRegistrationReason" character varying(100), CONSTRAINT "PK_7d9287fc069699b2f22ad4f88ee" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_33622e9406d3bffee1ca9c3a6a" ON "KubernetesAiAgent" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE UNIQUE INDEX "IDX_KubernetesAiAgent_kubernetesClusterId" ON "KubernetesAiAgent" ("kubernetesClusterId") WHERE "deletedAt" IS NULL`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" ADD "enableAutomaticPostmortemDraft" boolean NOT NULL DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD "targetKubernetesAiAgentId" uuid`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ALTER COLUMN "isAiInvestigationEnabled" SET DEFAULT true`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_df20ccc2683c9be5fbc8399e09" ON "RunnerJob" ("targetKubernetesAiAgentId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesAiAgent" ADD CONSTRAINT "FK_33622e9406d3bffee1ca9c3a6a9" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesAiAgent" ADD CONSTRAINT "FK_d6ed70c680c438a5ea3080071ca" FOREIGN KEY ("kubernetesClusterId") REFERENCES "KubernetesCluster"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" ADD CONSTRAINT "FK_df20ccc2683c9be5fbc8399e098" FOREIGN KEY ("targetKubernetesAiAgentId") REFERENCES "KubernetesAiAgent"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+
+    // 1. Postmortem drafts stay on wherever investigations were on.
+    await queryRunner.query(
+      `UPDATE "Project" SET "enableAutomaticPostmortemDraft" = true WHERE "enableAutomaticIncidentInvestigation" = true`,
+    );
+
+    // 2. Never-configured clusters investigate, like a new cluster.
+    await queryRunner.query(
+      `UPDATE "KubernetesCluster" SET "isAiInvestigationEnabled" = true WHERE "aiAccessConfiguredAt" IS NULL`,
+    );
+
+    /*
+     * 3. A cluster whose Runner was unbound or deleted stays off. It is also
+     * marked configured, so the Kubernetes AI agent's first-connection
+     * defaults (which only touch never-configured clusters) can never switch
+     * a revoked cluster back on.
+     */
+    await queryRunner.query(
+      `UPDATE "KubernetesCluster" SET "isAiInvestigationEnabled" = false, "aiRemediationMode" = 'Disabled', "aiAccessConfiguredAt" = COALESCE("aiAccessConfiguredAt", NOW()) WHERE "aiAccessRunnerId" IS NULL AND ("aiAccessRunnerBoundAt" IS NOT NULL OR "aiAccessLastVerifiedAt" IS NOT NULL OR "aiAccessLastError" IS NOT NULL)`,
+    );
+
+    // 4. No unattended mode goes live without the project's opt-in.
+    await queryRunner.query(
+      `UPDATE "KubernetesCluster" c SET "aiRemediationMode" = 'RequireApproval' FROM "Project" p WHERE c."projectId" = p."_id" AND p."enableAiCommandExecution" IS NOT TRUE AND c."aiRemediationMode" IN ('Automatic','BypassApproval')`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP CONSTRAINT "FK_df20ccc2683c9be5fbc8399e098"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesAiAgent" DROP CONSTRAINT "FK_d6ed70c680c438a5ea3080071ca"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesAiAgent" DROP CONSTRAINT "FK_33622e9406d3bffee1ca9c3a6a9"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_df20ccc2683c9be5fbc8399e09"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "KubernetesCluster" ALTER COLUMN "isAiInvestigationEnabled" SET DEFAULT false`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunnerJob" DROP COLUMN "targetKubernetesAiAgentId"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Project" DROP COLUMN "enableAutomaticPostmortemDraft"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_KubernetesAiAgent_kubernetesClusterId"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_33622e9406d3bffee1ca9c3a6a"`,
+    );
+    await queryRunner.query(`DROP TABLE "KubernetesAiAgent"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1796200000000-AddProxmoxResourceNativePushColumns.ts

@@ -0,0 +1,42 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Two ProxmoxResource columns for Proxmox VE's built-in OpenTelemetry push,
+ * where each node reports only itself:
+ *
+ * - "isNativePush": the row comes from the native push rather than the
+ *   Proxmox Agent. Such a Node row is kept — and reported Offline by the
+ *   nodes still alive — for the retention window instead of being pruned
+ *   after 15 minutes, because the native push carries no membership.
+ * - "notReportingMarkedAt": when the nodes still alive last reported this
+ *   node as having stopped reporting; cleared by its own next report. It
+ *   lets those reports carry on through a short gap in OneUptime's own
+ *   processing.
+ *
+ * Both nullable with no default: every existing row reads as an agent row
+ * that was never reported down, which keeps the behaviour it already had,
+ * and the next push of a native-push cluster sets them.
+ */
+export class AddProxmoxResourceNativePushColumns1796200000000
+  implements MigrationInterface
+{
+  public name: string = "AddProxmoxResourceNativePushColumns1796200000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxResource" ADD "isNativePush" boolean`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxResource" ADD "notReportingMarkedAt" TIMESTAMP WITH TIME ZONE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxResource" DROP COLUMN "notReportingMarkedAt"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "ProxmoxResource" DROP COLUMN "isNativePush"`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -13,6 +13,16 @@ import { AddIncidentAlert1794900000000 } from "./1794900000000-AddIncidentAlert"
 import { AddDatabaseServerTables1795000000000 } from "./1795000000000-AddDatabaseServerTables";
 import { AddUserProjectSsoConsent1795100000000 } from "./1795100000000-AddUserProjectSsoConsent";
 import { AddInventoryItemProjectEntityKeyIndex1795200000000 } from "./1795200000000-AddInventoryItemProjectEntityKeyIndex";
+import { SkipHiddenIncidentCreatedNotifications1795300000000 } from "./1795300000000-SkipHiddenIncidentCreatedNotifications";
+import { AddIncidentStatusPageScope1795400000000 } from "./1795400000000-AddIncidentStatusPageScope";
+import { AddIncidentTemplateStatusPageScopeFlag1795500000000 } from "./1795500000000-AddIncidentTemplateStatusPageScopeFlag";
+import { AddStatusPageSubscriberUnsubscribeToken1795600000000 } from "./1795600000000-AddStatusPageSubscriberUnsubscribeToken";
+import { AddStatusPageSubscriberIsAddedByTeam1795700000000 } from "./1795700000000-AddStatusPageSubscriberIsAddedByTeam";
+import { AddIncidentCustomFieldCreateAndNotificationSettings1795800000000 } from "./1795800000000-AddIncidentCustomFieldCreateAndNotificationSettings";
+import { AddSubscriberNotificationClaimedAt1795900000000 } from "./1795900000000-AddSubscriberNotificationClaimedAt";
+import { AddTeamComplianceRuleScope1796000000000 } from "./1796000000000-AddTeamComplianceRuleScope";
+import { AddKubernetesAiAgentAndAiDefaults1796100000000 } from "./1796100000000-AddKubernetesAiAgentAndAiDefaults";
+import { AddProxmoxResourceNativePushColumns1796200000000 } from "./1796200000000-AddProxmoxResourceNativePushColumns";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1226,4 +1236,14 @@ export default [
   AddDatabaseServerTables1795000000000,
   AddUserProjectSsoConsent1795100000000,
   AddInventoryItemProjectEntityKeyIndex1795200000000,
+  SkipHiddenIncidentCreatedNotifications1795300000000,
+  AddIncidentStatusPageScope1795400000000,
+  AddIncidentTemplateStatusPageScopeFlag1795500000000,
+  AddStatusPageSubscriberUnsubscribeToken1795600000000,
+  AddStatusPageSubscriberIsAddedByTeam1795700000000,
+  AddIncidentCustomFieldCreateAndNotificationSettings1795800000000,
+  AddSubscriberNotificationClaimedAt1795900000000,
+  AddTeamComplianceRuleScope1796000000000,
+  AddKubernetesAiAgentAndAiDefaults1796100000000,
+  AddProxmoxResourceNativePushColumns1796200000000,
 ];

package/Server/Infrastructure/Semaphore.ts

@@ -81,6 +81,12 @@ export default class Semaphore {
     acquireTimeout?: number | undefined;
     acquireAttemptsLimit?: number | undefined;
     retryInterval?: number | undefined;
+    /*
+     * Called when a held permit could not be refreshed and has lapsed. By
+     * default redis-semaphore throws from its refresh timer, which nothing
+     * can catch; a holder that runs for long should pass one.
+     */
+    onLockLost?: ((err: Error) => void) | undefined;
   }): Promise<SemaphorePermit> {
     if (!Number.isInteger(data.limit) || data.limit <= 0) {
       throw new Error("Semaphore permit limit must be a positive integer");
@@ -108,6 +114,10 @@ export default class Semaphore {
       lockOptions.retryInterval = data.retryInterval;
     }
 
+    if (data.onLockLost) {
+      lockOptions.onLockLost = data.onLockLost;
+    }
+
     const permit: SemaphorePermit = new RedisSemaphore(
       client,
       `${data.namespace}-${data.key}`,

package/Server/Middleware/IdentityRateLimit.ts

@@ -74,6 +74,17 @@ import TooManyRequestsException from "../../Types/Exception/TooManyRequestsExcep
  * DatabaseNotConnectedException when Redis is down. Logging in is already
  * impossible in that state; the difference this makes is a 503 that says to
  * come back shortly instead of a 500.
+ *
+ * ONE ROUTE HERE SENDS MAIL RATHER THAN CHECKING A CREDENTIAL
+ *
+ * POST /resend-verification-email (Authentication.ts) is limited by this
+ * middleware too, on a bucket of its own. It is not a guessing oracle against
+ * a stored credential -- the credential it takes is server-minted and signed,
+ * or a random UUID from an emailed link -- but every request that gets past its
+ * checks makes the server send an email, and an anonymous route that sends
+ * mail needs a ceiling in front of its database reads and its caps. It shares
+ * the fail-closed choice for the same reason: its own cooldown fence lives in
+ * Redis, so with Redis down it could not bound anything either.
  */
 
 /*
@@ -144,6 +155,15 @@ export enum IdentityRateLimitBucket {
 
   // Discoverable passkey requests have no account identifier until verified.
   Passkey = "passkey",
+
+  /*
+   * POST /resend-verification-email -- an unverified account asking for its
+   * verification link again. Mail, not guessing: see
+   * VERIFICATION_EMAIL_RESEND_BUCKET. Its own counter so that a user mashing
+   * "resend" cannot spend the sign-in attempts they are about to need, and so
+   * that sign-in noise cannot refuse the resend.
+   */
+  VerificationEmailResend = "verification-email-resend",
 }
 
 export enum IdentityRateLimitScope {
@@ -413,6 +433,55 @@ const PASSKEY_BUCKET: BucketConfig = {
   perIpLimit: PASSKEY_RATE_LIMIT,
 };
 
+/*
+ * Verification email resend budget.
+ *
+ * Shaped like the passkey bucket, and for the same reason: the request carries
+ * no email address (it carries a signed resend token or a verification link
+ * token instead), so resolveAccountKey answers "none" and the account counter
+ * is keyed on the client address alone. Both counters are therefore the same
+ * per-address budget and are given the same number; a caller who adds an
+ * `email` field to rotate the account key still meets the address ceiling.
+ *
+ * This is NOT what bounds mail to any one inbox. The route's own caps do that
+ * per account -- a cooldown between sends, a per-hour cap, and a small fixed
+ * number of sends per credential (VerificationEmailResendPolicy) -- and those
+ * hold however many addresses a caller has. What this bounds is how much work
+ * one address can make the route do before those caps are even consulted:
+ * token verification, a verification-token lookup, a user lookup and a Redis
+ * read per request.
+ *
+ * Twenty a quarter hour is far past an honest user, who presses the button a
+ * handful of times at most because the page itself counts the cooldown down,
+ * and still generous to an office behind one NAT where several people are
+ * finishing signup at once.
+ */
+const VERIFICATION_EMAIL_RESEND_RATE_LIMIT: number = parsePositiveIntFromEnv(
+  "IDENTITY_VERIFICATION_EMAIL_RESEND_RATE_LIMIT_PER_IP_PER_WINDOW",
+  20,
+);
+const VERIFICATION_EMAIL_RESEND_BUCKET: BucketConfig = {
+  windowSeconds: parsePositiveIntFromEnv(
+    "IDENTITY_VERIFICATION_EMAIL_RESEND_RATE_LIMIT_WINDOW_SECONDS",
+    15 * 60,
+  ),
+  perAccountLimit: VERIFICATION_EMAIL_RESEND_RATE_LIMIT,
+  perIpLimit: VERIFICATION_EMAIL_RESEND_RATE_LIMIT,
+};
+
+/*
+ * What a refused caller is told. See getRefusalMessages for why the sign-in
+ * routes all share one pair and the resend route has its own.
+ */
+export const IDENTITY_RATE_LIMITED_MESSAGE: string =
+  "Too many sign-in attempts. Please try again later.";
+export const IDENTITY_COUNTER_UNAVAILABLE_MESSAGE: string =
+  "Unable to sign you in right now. Please try again shortly.";
+export const VERIFICATION_EMAIL_RESEND_RATE_LIMITED_MESSAGE: string =
+  "Too many requests for a new verification email. Please try again later.";
+export const VERIFICATION_EMAIL_RESEND_UNAVAILABLE_MESSAGE: string =
+  "Unable to send a verification email right now. Please try again shortly.";
+
 const KEY_PREFIX: string = "identity:rl:";
 
 /*
@@ -574,9 +643,44 @@ export default class IdentityRateLimit {
       return STATUS_PAGE_LOGIN_BUCKET;
     }
 
+    if (bucket === IdentityRateLimitBucket.VerificationEmailResend) {
+      return VERIFICATION_EMAIL_RESEND_BUCKET;
+    }
+
     return LOGIN_BUCKET;
   }
 
+  /*
+   * What a refused request is told, for the 429 and for the fail-closed 503.
+   *
+   * Every sign-in bucket gets the same pair, byte for byte, whichever counter
+   * fired and whichever route was hit -- see the note in getMiddleware on why
+   * a sign-in limiter must not answer differently for different accounts.
+   *
+   * The resend route gets its own pair because the sign-in wording is simply
+   * wrong there: somebody who pressed "resend verification email" has made no
+   * sign-in attempt, and telling them they made too many would send them
+   * looking for a problem they do not have. The pair is still uniform WITHIN
+   * the route: the same text for every caller, token and account, so it
+   * discloses nothing the sign-in pair does not.
+   */
+  public static getRefusalMessages(bucket: IdentityRateLimitBucket): {
+    rateLimited: string;
+    unavailable: string;
+  } {
+    if (bucket === IdentityRateLimitBucket.VerificationEmailResend) {
+      return {
+        rateLimited: VERIFICATION_EMAIL_RESEND_RATE_LIMITED_MESSAGE,
+        unavailable: VERIFICATION_EMAIL_RESEND_UNAVAILABLE_MESSAGE,
+      };
+    }
+
+    return {
+      rateLimited: IDENTITY_RATE_LIMITED_MESSAGE,
+      unavailable: IDENTITY_COUNTER_UNAVAILABLE_MESSAGE,
+    };
+  }
+
   /*
    * Increment both counters for this request and decide.
    *
@@ -773,13 +877,14 @@ export default class IdentityRateLimit {
          * account exists. These routes are careful not to say which half of a
          * credential was wrong; a limiter that answered differently for a real
          * address than for an invented one would hand back the account
-         * enumeration the handlers withhold.
+         * enumeration the handlers withhold. (The resend route has wording of
+         * its own, but it is just as uniform; see getRefusalMessages.)
          */
         return Response.sendErrorResponse(
           req,
           res,
           new TooManyRequestsException(
-            "Too many sign-in attempts. Please try again later.",
+            IdentityRateLimit.getRefusalMessages(bucket).rateLimited,
           ),
         );
       }
@@ -800,7 +905,7 @@ export default class IdentityRateLimit {
           req,
           res,
           new ServiceUnavailableException(
-            "Unable to sign you in right now. Please try again shortly.",
+            IdentityRateLimit.getRefusalMessages(bucket).unavailable,
           ),
         );
       }