@oneuptime/common 10.2.22 → 10.3.0

package/Server/Infrastructure/Postgres/SchemaMigrations/1778800000000-AddTeamPermissionScope.ts

@@ -0,0 +1,15 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddTeamPermissionScope1778800000000 implements MigrationInterface {
+  public name: string = "AddTeamPermissionScope1778800000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TeamPermission" ADD "scope" character varying(100) NOT NULL DEFAULT 'All'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "TeamPermission" DROP COLUMN "scope"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1778834788959-SwitchRunbookAgentTagsToAgentId.ts

@@ -0,0 +1,64 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class SwitchRunbookAgentTagsToAgentId1778834788959
+  implements MigrationInterface
+{
+  public name: string = "SwitchRunbookAgentTagsToAgentId1778834788959";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    /*
+     * Switch Runbook Agent routing from "step picks a tag, any agent with the
+     * tag claims it" to "step picks the agent directly".
+     *
+     *  - Drop the now-unused `tags` column on RunbookAgent.
+     *  - Replace RunbookAgentJob.requiredTag (text) with targetAgentId (uuid
+     *    FK to RunbookAgent). The old varchar values are not portable to
+     *    UUIDs, so existing rows lose their routing target — any in-flight
+     *    job from before this migration becomes unclaimable and will time
+     *    out cleanly.
+     *  - The pre-existing assignedAgentId FK was removed alongside the
+     *    @ManyToOne decorator on the model; we drop its constraint here.
+     */
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" DROP CONSTRAINT "FK_eec146ac21d97c2731c73ae9410"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6791164943615abf539651d14e"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" DROP COLUMN "requiredTag"`,
+    );
+    await queryRunner.query(`ALTER TABLE "RunbookAgent" DROP COLUMN "tags"`);
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" ADD "targetAgentId" uuid`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_5c9d1810e0fda27177cd41ea73" ON "RunbookAgentJob" ("targetAgentId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" ADD CONSTRAINT "FK_5c9d1810e0fda27177cd41ea738" FOREIGN KEY ("targetAgentId") REFERENCES "RunbookAgent"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" DROP CONSTRAINT "FK_5c9d1810e0fda27177cd41ea738"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_5c9d1810e0fda27177cd41ea73"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" DROP COLUMN "targetAgentId"`,
+    );
+    await queryRunner.query(`ALTER TABLE "RunbookAgent" ADD "tags" jsonb`);
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" ADD "requiredTag" character varying(100)`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6791164943615abf539651d14e" ON "RunbookAgentJob" ("requiredTag") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentJob" ADD CONSTRAINT "FK_eec146ac21d97c2731c73ae9410" FOREIGN KEY ("assignedAgentId") REFERENCES "RunbookAgent"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1778842348388-AddRunbookAgentOwnersAndLabels.ts

@@ -0,0 +1,133 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddRunbookAgentOwnersAndLabels1778842348388
+  implements MigrationInterface
+{
+  public name: string = "AddRunbookAgentOwnersAndLabels1778842348388";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "RunbookAgentOwnerTeam" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "runbookAgentId" uuid NOT NULL, "teamId" uuid NOT NULL, "createdByUserId" uuid, "deletedByUserId" uuid, "isOwnerNotified" boolean NOT NULL DEFAULT false, CONSTRAINT "PK_ac81e767045913728c22fb4e0be" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6a653cf53a14952d83acaa39e1" ON "RunbookAgentOwnerTeam" ("runbookAgentId", "teamId", "projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "RunbookAgentOwnerUser" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "runbookAgentId" uuid NOT NULL, "userId" uuid NOT NULL, "createdByUserId" uuid, "deletedByUserId" uuid, "isOwnerNotified" boolean NOT NULL DEFAULT false, CONSTRAINT "PK_ca52de57e3f3953c545a21632a8" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_b1c4d4dc5b58c7a827157edcd0" ON "RunbookAgentOwnerUser" ("runbookAgentId", "userId", "projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "RunbookAgentLabel" ("runbookAgentId" uuid NOT NULL, "labelId" uuid NOT NULL, CONSTRAINT "PK_08bd9ba1a96b4b6ed259b7fe429" PRIMARY KEY ("runbookAgentId", "labelId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_c88840425bae4caee4e4553927" ON "RunbookAgentLabel" ("runbookAgentId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_d14e093b375792c7507fb6f8e2" ON "RunbookAgentLabel" ("labelId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyScheduleLayer" ALTER COLUMN "rotation" SET DEFAULT '{"_type":"Recurring","value":{"intervalType":"Day","intervalCount":{"_type":"PositiveNumber","value":1}}}'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyScheduleLayer" ALTER COLUMN "restrictionTimes" SET DEFAULT '{"_type":"RestrictionTimes","value":{"restictionType":"None","dayRestrictionTimes":null,"weeklyRestrictionTimes":[]}}'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" ADD CONSTRAINT "FK_a24dd370690da68a5101fba0827" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" ADD CONSTRAINT "FK_060e3fdce32f2ae3e8af08113af" FOREIGN KEY ("runbookAgentId") REFERENCES "RunbookAgent"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" ADD CONSTRAINT "FK_59cd65c91e9ae10bd861103bb10" FOREIGN KEY ("teamId") REFERENCES "Team"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" ADD CONSTRAINT "FK_72c74137f08535200785cec3eb3" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" ADD CONSTRAINT "FK_92018b0daeac19524b45c43cb7f" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" ADD CONSTRAINT "FK_545f95aef235cd8abbd2d4a11ca" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" ADD CONSTRAINT "FK_2b1b7db69ee94cef9eab74b85ae" FOREIGN KEY ("runbookAgentId") REFERENCES "RunbookAgent"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" ADD CONSTRAINT "FK_c0d14dc88c9c009c0e352fa9274" FOREIGN KEY ("userId") REFERENCES "User"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" ADD CONSTRAINT "FK_5e51e566f7eb7ff47a8d9c11c50" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" ADD CONSTRAINT "FK_7db69d7207d704e770bb40a0c5a" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentLabel" ADD CONSTRAINT "FK_c88840425bae4caee4e45539275" FOREIGN KEY ("runbookAgentId") REFERENCES "RunbookAgent"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentLabel" ADD CONSTRAINT "FK_d14e093b375792c7507fb6f8e24" FOREIGN KEY ("labelId") REFERENCES "Label"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentLabel" DROP CONSTRAINT "FK_d14e093b375792c7507fb6f8e24"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentLabel" DROP CONSTRAINT "FK_c88840425bae4caee4e45539275"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" DROP CONSTRAINT "FK_7db69d7207d704e770bb40a0c5a"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" DROP CONSTRAINT "FK_5e51e566f7eb7ff47a8d9c11c50"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" DROP CONSTRAINT "FK_c0d14dc88c9c009c0e352fa9274"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" DROP CONSTRAINT "FK_2b1b7db69ee94cef9eab74b85ae"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerUser" DROP CONSTRAINT "FK_545f95aef235cd8abbd2d4a11ca"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" DROP CONSTRAINT "FK_92018b0daeac19524b45c43cb7f"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" DROP CONSTRAINT "FK_72c74137f08535200785cec3eb3"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" DROP CONSTRAINT "FK_59cd65c91e9ae10bd861103bb10"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" DROP CONSTRAINT "FK_060e3fdce32f2ae3e8af08113af"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookAgentOwnerTeam" DROP CONSTRAINT "FK_a24dd370690da68a5101fba0827"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyScheduleLayer" ALTER COLUMN "restrictionTimes" SET DEFAULT '{"_type": "RestrictionTimes", "value": {"restictionType": "None", "dayRestrictionTimes": null, "weeklyRestrictionTimes": []}}'`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "OnCallDutyPolicyScheduleLayer" ALTER COLUMN "rotation" SET DEFAULT '{"_type": "Recurring", "value": {"intervalType": "Day", "intervalCount": {"_type": "PositiveNumber", "value": 1}}}'`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_d14e093b375792c7507fb6f8e2"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_c88840425bae4caee4e4553927"`,
+    );
+    await queryRunner.query(`DROP TABLE "RunbookAgentLabel"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_b1c4d4dc5b58c7a827157edcd0"`,
+    );
+    await queryRunner.query(`DROP TABLE "RunbookAgentOwnerUser"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6a653cf53a14952d83acaa39e1"`,
+    );
+    await queryRunner.query(`DROP TABLE "RunbookAgentOwnerTeam"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1778851431287-AddRunbookSecret.ts

@@ -0,0 +1,67 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class AddRunbookSecret1778851431287 implements MigrationInterface {
+  public name: string = "AddRunbookSecret1778851431287";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `CREATE TABLE "RunbookSecret" ("_id" uuid NOT NULL DEFAULT uuid_generate_v4(), "createdAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "updatedAt" TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT now(), "deletedAt" TIMESTAMP WITH TIME ZONE, "version" integer NOT NULL, "projectId" uuid NOT NULL, "name" character varying(100) NOT NULL, "description" character varying(500), "secretValue" text, "createdByUserId" uuid, "deletedByUserId" uuid, CONSTRAINT "PK_35a43e225e44f7dfd33e0137354" PRIMARY KEY ("_id"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_717b3c993d94aa5b4c3f0dda5c" ON "RunbookSecret" ("projectId") `,
+    );
+    await queryRunner.query(
+      `CREATE TABLE "RunbookSecretRunbookAgent" ("runbookSecretId" uuid NOT NULL, "runbookAgentId" uuid NOT NULL, CONSTRAINT "PK_2a4703128457e9019b1eabf0a8f" PRIMARY KEY ("runbookSecretId", "runbookAgentId"))`,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_dfcaca6663d57a8ca0cd045339" ON "RunbookSecretRunbookAgent" ("runbookSecretId") `,
+    );
+    await queryRunner.query(
+      `CREATE INDEX "IDX_6b1307a959a26116c4a3f2a33a" ON "RunbookSecretRunbookAgent" ("runbookAgentId") `,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecret" ADD CONSTRAINT "FK_717b3c993d94aa5b4c3f0dda5cf" FOREIGN KEY ("projectId") REFERENCES "Project"("_id") ON DELETE CASCADE ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecret" ADD CONSTRAINT "FK_37b8e5e3018b3a5e2cccf1c1004" FOREIGN KEY ("createdByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecret" ADD CONSTRAINT "FK_66b41715de1e904ea9d3c82ae91" FOREIGN KEY ("deletedByUserId") REFERENCES "User"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecretRunbookAgent" ADD CONSTRAINT "FK_dfcaca6663d57a8ca0cd045339d" FOREIGN KEY ("runbookSecretId") REFERENCES "RunbookSecret"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecretRunbookAgent" ADD CONSTRAINT "FK_6b1307a959a26116c4a3f2a33ae" FOREIGN KEY ("runbookAgentId") REFERENCES "RunbookAgent"("_id") ON DELETE CASCADE ON UPDATE CASCADE`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecretRunbookAgent" DROP CONSTRAINT "FK_6b1307a959a26116c4a3f2a33ae"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecretRunbookAgent" DROP CONSTRAINT "FK_dfcaca6663d57a8ca0cd045339d"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecret" DROP CONSTRAINT "FK_66b41715de1e904ea9d3c82ae91"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecret" DROP CONSTRAINT "FK_37b8e5e3018b3a5e2cccf1c1004"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "RunbookSecret" DROP CONSTRAINT "FK_717b3c993d94aa5b4c3f0dda5cf"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_6b1307a959a26116c4a3f2a33a"`,
+    );
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_dfcaca6663d57a8ca0cd045339"`,
+    );
+    await queryRunner.query(`DROP TABLE "RunbookSecretRunbookAgent"`);
+    await queryRunner.query(
+      `DROP INDEX "public"."IDX_717b3c993d94aa5b4c3f0dda5c"`,
+    );
+    await queryRunner.query(`DROP TABLE "RunbookSecret"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1778877094014-UpdateTeamPermissionScopeDefault.ts

@@ -0,0 +1,19 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+export class UpdateTeamPermissionScopeDefault1778877094014
+  implements MigrationInterface
+{
+  public name: string = "UpdateTeamPermissionScopeDefault1778877094014";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TeamPermission" ALTER COLUMN "scope" SET DEFAULT 'All'`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "TeamPermission" ALTER COLUMN "scope" SET DEFAULT 'Labels'`,
+    );
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/1778900000000-MigrateLegacyManagerRolesToAdmin.ts

@@ -0,0 +1,51 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * Migrates legacy single-tier "Manager" role values in TeamPermission to the
+ * new per-domain Admin tier. Existing IncidentManager assignments become
+ * IncidentAdmin, and so on for every domain. The Admin tier is chosen over
+ * Member or Viewer so no existing user loses capabilities they had before.
+ */
+export class MigrateLegacyManagerRolesToAdmin1778900000000
+  implements MigrationInterface
+{
+  public name: string = "MigrateLegacyManagerRolesToAdmin1778900000000";
+
+  private static readonly ROLE_MAP: ReadonlyArray<[string, string]> = [
+    ["IncidentManager", "IncidentAdmin"],
+    ["AlertManager", "AlertAdmin"],
+    ["MonitorManager", "MonitorAdmin"],
+    ["StatusPageManager", "StatusPageAdmin"],
+    ["OnCallManager", "OnCallAdmin"],
+    ["ScheduledMaintenanceManager", "ScheduledMaintenanceAdmin"],
+    ["TelemetryManager", "TelemetryAdmin"],
+    ["SettingsManager", "SettingsAdmin"],
+    ["BillingManager", "BillingAdmin"],
+    ["WorkflowManager", "WorkflowAdmin"],
+    ["RunbookManager", "RunbookAdmin"],
+  ];
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    for (const [
+      legacy,
+      replacement,
+    ] of MigrateLegacyManagerRolesToAdmin1778900000000.ROLE_MAP) {
+      await queryRunner.query(
+        `UPDATE "TeamPermission" SET "permission" = $1 WHERE "permission" = $2`,
+        [replacement, legacy],
+      );
+    }
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    for (const [
+      legacy,
+      replacement,
+    ] of MigrateLegacyManagerRolesToAdmin1778900000000.ROLE_MAP) {
+      await queryRunner.query(
+        `UPDATE "TeamPermission" SET "permission" = $1 WHERE "permission" = $2`,
+        [legacy, replacement],
+      );
+    }
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -318,6 +318,22 @@ import { MigrationName1778521361934 } from "./1778521361934-MigrationName";
 import { AddStatusPageOIDC1778522070962 } from "./1778522070962-AddStatusPageOIDC";
 import { MigrationName1778582583897 } from "./1778582583897-MigrationName";
 import { AddScheduledMaintenanceRules1778703414082 } from "./1778703414082-AddScheduledMaintenanceRules";
+import { MigrationName1778759476700 } from "./1778759476700-MigrationName";
+import { MigrationName1778761532493 } from "./1778761532493-MigrationName";
+import { MigrationName1778776830462 } from "./1778776830462-MigrationName";
+import { MigrationName1778777574869 } from "./1778777574869-MigrationName";
+import { MigrationName1778779608191 } from "./1778779608191-MigrationName";
+import { MigrationName1778782819382 } from "./1778782819382-AddMonitorAndStatusPageOwnerLabelRules";
+import { AddRunbookAgentJobStepType1778784000000 } from "./1778784000000-AddRunbookAgentJobStepType";
+import { MigrationName1778784396629 } from "./1778784396629-AddHostServiceDockerK8sOwnerLabelRules";
+import { MigrationName1778785741500 } from "./1778785741500-AddRunbookOwnerLabelRules";
+import { MigrationName1778791942334 } from "./1778791942334-AddDashboardWorkflowOwnerLabelRules";
+import { AddTeamPermissionScope1778800000000 } from "./1778800000000-AddTeamPermissionScope";
+import { SwitchRunbookAgentTagsToAgentId1778834788959 } from "./1778834788959-SwitchRunbookAgentTagsToAgentId";
+import { AddRunbookAgentOwnersAndLabels1778842348388 } from "./1778842348388-AddRunbookAgentOwnersAndLabels";
+import { AddRunbookSecret1778851431287 } from "./1778851431287-AddRunbookSecret";
+import { UpdateTeamPermissionScopeDefault1778877094014 } from "./1778877094014-UpdateTeamPermissionScopeDefault";
+import { MigrateLegacyManagerRolesToAdmin1778900000000 } from "./1778900000000-MigrateLegacyManagerRolesToAdmin";
 export default [
   InitialMigration,
   MigrationName1717678334852,
@@ -639,4 +655,20 @@ export default [
   AddStatusPageOIDC1778522070962,
   MigrationName1778582583897,
   AddScheduledMaintenanceRules1778703414082,
+  MigrationName1778759476700,
+  MigrationName1778761532493,
+  MigrationName1778776830462,
+  MigrationName1778777574869,
+  MigrationName1778779608191,
+  MigrationName1778782819382,
+  AddRunbookAgentJobStepType1778784000000,
+  MigrationName1778784396629,
+  MigrationName1778785741500,
+  MigrationName1778791942334,
+  AddTeamPermissionScope1778800000000,
+  SwitchRunbookAgentTagsToAgentId1778834788959,
+  AddRunbookAgentOwnersAndLabels1778842348388,
+  AddRunbookSecret1778851431287,
+  UpdateTeamPermissionScopeDefault1778877094014,
+  MigrateLegacyManagerRolesToAdmin1778900000000,
 ];

package/Server/Infrastructure/Queue.ts

@@ -16,6 +16,7 @@ export enum QueueName {
   Workflow = "Workflow",
   Worker = "Worker",
   Telemetry = "Telemetry",
+  Runbook = "Runbook",
 }
 
 export type QueueJob = Job;

package/Server/Middleware/UserAuthorization.ts

@@ -1,5 +1,6 @@
 import AccessTokenService from "../Services/AccessTokenService";
 import ProjectService from "../Services/ProjectService";
+import TeamMemberService from "../Services/TeamMemberService";
 import UserService from "../Services/UserService";
 import QueryHelper from "../Types/Database/QueryHelper";
 import CookieUtil from "../Utils/Cookie";
@@ -284,6 +285,18 @@ export default class UserMiddleware {
           oneuptimeRequest.userTenantAccessPermission[tenantId.toString()] =
             userTenantAccessPermission;
         }
+
+        /*
+         * Load the user's team membership for this tenant so that the
+         * `Owned` permission scope can evaluate team-based ownership without
+         * an extra DB roundtrip on every permission check. Absent for non-user
+         * callers (API keys, Probes); `Owned` then evaluates as `All`.
+         */
+        oneuptimeRequest.userTeamIds =
+          await TeamMemberService.getTeamIdsForUser(
+            new ObjectID(userId),
+            tenantId,
+          );
       } catch (error) {
         return Response.sendErrorResponse(req, res, error as Exception);
       }

package/Server/Services/AccessTokenService.ts

@@ -165,6 +165,7 @@ export class AccessTokenService extends BaseService {
             _id: true,
           },
           isBlockPermission: true,
+          scope: true,
         },
         limit: LIMIT_MAX,
         skip: 0,
@@ -186,6 +187,7 @@ export class AccessTokenService extends BaseService {
           return label.id!;
         }),
         isBlockPermission: teamPermission.isBlockPermission,
+        scope: teamPermission.scope,
         _type: "UserPermission",
       });
     }

package/Server/Services/AlertService.ts

@@ -64,6 +64,7 @@ import AlertGroupingEngineService from "./AlertGroupingEngineService";
 import AlertLabelRuleEngineService from "./AlertLabelRuleEngineService";
 import AlertOnCallRuleEngineService from "./AlertOnCallRuleEngineService";
 import AlertOwnerRuleEngineService from "./AlertOwnerRuleEngineService";
+import RunbookRuleEngineService from "./RunbookRuleEngineService";
 import AlertPrivacyRuleEngineService from "./AlertPrivacyRuleEngineService";
 import ProjectService from "./ProjectService";
 
@@ -430,6 +431,19 @@ export class Service extends DatabaseService<Model> {
           );
         }
       })
+      .then(async () => {
+        try {
+          await RunbookRuleEngineService.applyRulesToAlert(createdItem);
+        } catch (error) {
+          logger.error(
+            `Apply runbook rules failed in AlertService.onCreateSuccess: ${error}`,
+            {
+              projectId: createdItem.projectId?.toString(),
+              alertId: createdItem.id?.toString(),
+            } as LogAttributes,
+          );
+        }
+      })
       .then(async () => {
         if (
           createdItem.onCallDutyPolicies?.length &&