@oneuptime/common 10.8.2 → 11.0.1

package/Server/Types/AnalyticsDatabase/ModelPermission.ts

@@ -359,6 +359,13 @@ export default class ModelPermission {
       "deletedAt",
       "updatedAt",
       "version",
+      /*
+       * Synthetic query key compiled by StatementGenerator to
+       * (hasAny(entityKeys, ...) OR attributes[...] = ...) — not a real
+       * column; it only narrows rows on models that have entityKeys and
+       * never widens access (authorization stays on primaryEntityId).
+       */
+      "entityScope",
     ];
 
     return returnArr;
@@ -825,10 +832,44 @@ export default class ModelPermission {
     }
 
     const fkColumn: string = model.ownedThrough.fkColumn;
-    const idList: Array<string> =
+    const sentinelNoMatch: Array<string> = [
+      ObjectID.getZeroObjectID().toString(),
+    ];
+    let idList: Array<string> =
       allowedResourceIds.size > 0
         ? Array.from(allowedResourceIds)
-        : [ObjectID.getZeroObjectID().toString()]; // sentinel: match nothing
+        : sentinelNoMatch;
+
+    /*
+     * Intersect with any caller-supplied FK filter (e.g. a per-service
+     * telemetry page querying primaryEntityId) instead of overwriting it —
+     * overwriting would widen the query to every allowed resource. The FK
+     * is a scalar column, so set intersection is exact.
+     */
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const existingFkFilter: unknown = (query as any)[fkColumn];
+    if (existingFkFilter instanceof Includes) {
+      const requestedIds: Set<string> = new Set<string>(
+        existingFkFilter.values.map((value: string | ObjectID | number) => {
+          return value.toString();
+        }),
+      );
+      idList = idList.filter((id: string) => {
+        return requestedIds.has(id);
+      });
+    } else if (
+      typeof existingFkFilter === "string" ||
+      existingFkFilter instanceof ObjectID
+    ) {
+      const requestedId: string = existingFkFilter.toString();
+      idList = idList.filter((id: string) => {
+        return id === requestedId;
+      });
+    }
+
+    if (idList.length === 0) {
+      idList = sentinelNoMatch;
+    }
 
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     (query as any)[fkColumn] = new Includes(idList);

package/Server/Types/Database/Permissions/AccessControlPermission.ts

@@ -19,6 +19,9 @@ import Permission, {
   PermissionHelper,
   UserPermission,
 } from "../../../../Types/Permission";
+import { combineWithPrivacyClause } from "../../../Utils/PrivacyFilterUtil";
+import QueryHelper from "../QueryHelper";
+import QueryUtil from "../QueryUtil";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 
 export default class AccessControlPermission {
@@ -232,8 +235,50 @@ export default class AccessControlPermission {
         this.getAccessControlIdsForQuery(modelType, query, select, props, type);
 
       if (accessControlIds.length > 0) {
-        (query as any)[model.getAccessControlColumn() as string] =
-          accessControlIds;
+        const accessControlColumn: string =
+          model.getAccessControlColumn() as string;
+        const existingFilter: unknown = (query as any)[accessControlColumn];
+
+        if (existingFilter === undefined || existingFilter === null) {
+          (query as any)[accessControlColumn] = accessControlIds;
+        } else {
+          /*
+           * The caller already filters on the access-control column (e.g.
+           * "show monitors with label X"). Overwriting that filter with the
+           * permitted set would silently widen it to "any permitted label".
+           * Both predicates must hold independently — a record with labels
+           * {X, Y} (X requested, Y permitted) must match even when X itself
+           * is not permitted — so keep the caller's filter on the relation
+           * key and AND the permitted-set predicate onto _id as a join-table
+           * subquery.
+           */
+          const manyToManyMeta: {
+            joinTableName: string;
+            ownerColumnName: string;
+            relationColumnName: string;
+          } | null = QueryUtil.getManyToManyRelationMetadata(
+            modelType,
+            accessControlColumn,
+          );
+
+          if (manyToManyMeta) {
+            (query as any)._id = combineWithPrivacyClause(
+              (query as any)._id,
+              QueryHelper.anyOfEntitiesInManyToMany({
+                values: accessControlIds,
+                joinTableName: manyToManyMeta.joinTableName,
+                ownerColumnName: manyToManyMeta.ownerColumnName,
+                relationColumnName: manyToManyMeta.relationColumnName,
+              }),
+            );
+          } else {
+            /*
+             * Join metadata unavailable — fail closed to the permitted set.
+             * The caller's filter is dropped, but access never widens.
+             */
+            (query as any)[accessControlColumn] = accessControlIds;
+          }
+        }
       }
     }
 

package/Server/Types/Database/Permissions/BasePermission.ts

@@ -13,6 +13,7 @@ import TenantPermission from "./TenantPermission";
 import UserPermissions from "./UserPermission";
 import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import DatabaseCommonInteractionProps from "../../../../Types/BaseDatabase/DatabaseCommonInteractionProps";
+import { JSONObject } from "../../../../Types/JSON";
 import { TableColumnMetadata } from "../../../../Types/Database/TableColumn";
 import TableColumnType from "../../../../Types/Database/TableColumnType";
 import ObjectID from "../../../../Types/ObjectID";
@@ -121,10 +122,45 @@ export default class BasePermission {
               const tableColumnMetadataModel: BaseModel =
                 new tableColumnMetadata.modelType();
 
-              (query as any)[model.canAccessIfCanReadOn as string] = {
+              const accessControlQuery: JSONObject = {
                 [tableColumnMetadataModel.getAccessControlColumn() as string]:
                   accessControlIds,
               };
+
+              /*
+               * Preserve any caller-supplied filter on the relation key
+               * instead of overwriting it. Plain relation objects are
+               * merged (the access-control predicate wins on a key
+               * collision — fail closed, access never widens); a scalar
+               * id filter is folded in as the relation's _id. Anything
+               * else falls back to the access-control query alone.
+               */
+              const existingRelationFilter: unknown = (query as any)[
+                model.canAccessIfCanReadOn as string
+              ];
+
+              if (
+                typeof existingRelationFilter === "string" ||
+                existingRelationFilter instanceof ObjectID
+              ) {
+                (query as any)[model.canAccessIfCanReadOn as string] = {
+                  _id: existingRelationFilter.toString(),
+                  ...accessControlQuery,
+                };
+              } else if (
+                existingRelationFilter &&
+                typeof existingRelationFilter === "object" &&
+                !Array.isArray(existingRelationFilter) &&
+                existingRelationFilter.constructor === Object
+              ) {
+                (query as any)[model.canAccessIfCanReadOn as string] = {
+                  ...(existingRelationFilter as JSONObject),
+                  ...accessControlQuery,
+                };
+              } else {
+                (query as any)[model.canAccessIfCanReadOn as string] =
+                  accessControlQuery;
+              }
             }
           }
         }

package/Server/Types/Database/Permissions/OwnedScopePermission.ts

@@ -24,6 +24,7 @@ import Permission, {
   PermissionHelper,
   UserPermission,
 } from "../../../../Types/Permission";
+import { combineWithPrivacyClause } from "../../../Utils/PrivacyFilterUtil";
 import CaptureSpan from "../../../Utils/Telemetry/CaptureSpan";
 
 /*
@@ -133,8 +134,17 @@ export default class OwnedScopePermission {
           ObjectID.getZeroObjectID().toString(),
         );
       } else {
+        /*
+         * AND-combine with any caller-supplied FK filter (e.g. the
+         * dashboard's `incidentId: <this incident>`) — overwriting it would
+         * widen the query to every owned parent.
+         */
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        (query as any)[fkColumn] = QueryHelper.any(allowedIds);
+        (query as any)[fkColumn] = combineWithPrivacyClause(
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          (query as any)[fkColumn],
+          QueryHelper.any(allowedIds),
+        );
       }
     } else if (allowedIds.length === 0) {
       // Top-level operational resource: no accessible IDs -> match nothing.
@@ -143,9 +153,17 @@ export default class OwnedScopePermission {
         ObjectID.getZeroObjectID().toString(),
       );
     } else {
-      // Top-level operational resource: filter on _id.
+      /*
+       * Top-level operational resource: filter on _id, AND-combined with any
+       * caller-supplied _id (get/update of a specific record) — overwriting
+       * it would resolve the request against a different owned record.
+       */
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      (query as any)._id = QueryHelper.any(allowedIds);
+      (query as any)._id = combineWithPrivacyClause(
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        (query as any)._id,
+        QueryHelper.any(allowedIds),
+      );
     }
 
     return query;

package/Server/Types/Database/Permissions/OwnerTableRegistry.ts

@@ -154,6 +154,7 @@ const ownerTableRegistry: Map<string, OwnerTablePair> = new Map<
     {
       ownerUserService: ServiceOwnerUserService,
       ownerTeamService: ServiceOwnerTeamService,
+      // FK column on the Postgres ServiceOwnerUser/Team tables, not the ClickHouse telemetry column.
       fkColumn: "serviceId",
       canOwnTelemetry: true,
       modelService: ServiceService,

package/Server/Types/Database/QueryHelper.ts

@@ -289,6 +289,47 @@ export default class QueryHelper {
     );
   }
 
+  /**
+   * Returns a filter that matches owner rows that are linked to *any* of the
+   * provided related entity ids through a many-to-many join table. The
+   * returned FindOperator is intended to be applied to the primary id column
+   * of the owner entity. An empty values array matches nothing (fail closed).
+   */
+  @CaptureSpan()
+  public static anyOfEntitiesInManyToMany(data: {
+    values: Array<string | ObjectID>;
+    joinTableName: string;
+    ownerColumnName: string;
+    relationColumnName: string;
+  }): FindWhereProperty<any> {
+    const values: Array<string> = data.values.map(
+      (value: string | ObjectID) => {
+        return value.toString();
+      },
+    );
+
+    if (!values || values.length === 0) {
+      return Raw(() => {
+        return `TRUE = FALSE`;
+      }, {});
+    }
+
+    const valuesRid: string = Text.generateRandomText(10);
+
+    const joinTable: string = data.joinTableName.replace(/"/g, '""');
+    const ownerCol: string = data.ownerColumnName.replace(/"/g, '""');
+    const relationCol: string = data.relationColumnName.replace(/"/g, '""');
+
+    return Raw(
+      (alias: string) => {
+        return `(${alias} IN (SELECT "${joinTable}"."${ownerCol}" FROM "${joinTable}" WHERE "${joinTable}"."${relationCol}" IN (:...${valuesRid})))`;
+      },
+      {
+        [valuesRid]: values,
+      },
+    );
+  }
+
   /**
    * Matches owner rows that have no rows in the join table — i.e. the
    * many-to-many collection is empty. Apply to the owner's primary id column.

package/Server/Utils/Alert/AlertPrivacyFilter.ts

@@ -5,6 +5,7 @@ import Permission, {
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
 import Text from "../../../Types/Text";
+import { combineWithPrivacyClause } from "../PrivacyFilterUtil";
 import { Raw } from "typeorm";
 
 /*
@@ -124,7 +125,10 @@ export function applyAlertSelfPrivacyFilter<T>(
     return { isPrivate: rawClause } as unknown as T;
   }
 
-  (query as any).isPrivate = rawClause;
+  (query as any).isPrivate = combineWithPrivacyClause(
+    (query as any).isPrivate,
+    rawClause,
+  );
   return query;
 }
 
@@ -143,6 +147,9 @@ export function applyAlertRelatedRecordPrivacyFilter<T>(
     return { alertId: rawClause } as unknown as T;
   }
 
-  (query as any).alertId = rawClause;
+  (query as any).alertId = combineWithPrivacyClause(
+    (query as any).alertId,
+    rawClause,
+  );
   return query;
 }

package/Server/Utils/AlertEpisode/AlertEpisodePrivacyFilter.ts

@@ -5,6 +5,7 @@ import Permission, {
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
 import Text from "../../../Types/Text";
+import { combineWithPrivacyClause } from "../PrivacyFilterUtil";
 import { Raw } from "typeorm";
 
 export function shouldBypassAlertEpisodePrivacy(
@@ -107,7 +108,10 @@ export function applyAlertEpisodeSelfPrivacyFilter<T>(
     return { isPrivate: rawClause } as unknown as T;
   }
 
-  (query as any).isPrivate = rawClause;
+  (query as any).isPrivate = combineWithPrivacyClause(
+    (query as any).isPrivate,
+    rawClause,
+  );
   return query;
 }
 
@@ -126,6 +130,9 @@ export function applyAlertEpisodeRelatedRecordPrivacyFilter<T>(
     return { alertEpisodeId: rawClause } as unknown as T;
   }
 
-  (query as any).alertEpisodeId = rawClause;
+  (query as any).alertEpisodeId = combineWithPrivacyClause(
+    (query as any).alertEpisodeId,
+    rawClause,
+  );
   return query;
 }

package/Server/Utils/AnalyticsDatabase/QuerySettingsHelper.ts

@@ -0,0 +1,95 @@
+/**
+ * Builder for the trailing ` SETTINGS ...` clause appended to ClickHouse
+ * read queries.
+ *
+ * Every read built through this helper carries a per-query memory ceiling
+ * (max_memory_usage) and spills oversized GROUP BY / ORDER BY states to
+ * disk (max_bytes_before_external_group_by / _sort) instead of letting a
+ * single dashboard query take down the server — historically no layer
+ * bounded per-query memory at all. Execution-time caps and overflow
+ * behavior stay per-call-site: each caller keeps the value it shipped
+ * with.
+ *
+ * All values emitted here MUST be trusted literals (numbers / hardcoded
+ * strings) — the clause is appended verbatim to SQL, never parameterized.
+ */
+
+export type TimeoutOverflowMode = "break" | "throw";
+
+// 3 GiB.
+export const DEFAULT_MAX_MEMORY_USAGE_IN_BYTES: number = 3221225472;
+
+// 1.5 GiB — half the memory ceiling so spill kicks in before the cap.
+export const DEFAULT_MAX_BYTES_BEFORE_EXTERNAL_GROUP_BY_IN_BYTES: number = 1610612736;
+
+// 1.5 GiB.
+export const DEFAULT_MAX_BYTES_BEFORE_EXTERNAL_SORT_IN_BYTES: number = 1610612736;
+
+export interface QuerySettingsOptions {
+  /**
+   * Wall-clock cap in seconds (max_execution_time). Omitted from the
+   * clause entirely when undefined, leaving the server default in force.
+   */
+  maxExecutionTimeInSeconds?: number | undefined;
+  /**
+   * What ClickHouse does when max_execution_time fires: 'break' returns
+   * partial results, 'throw' fails the query (the server default).
+   * Omitted from the clause when undefined.
+   */
+  timeoutOverflowMode?: TimeoutOverflowMode | undefined;
+  maxMemoryUsageInBytes?: number | undefined;
+  maxBytesBeforeExternalGroupByInBytes?: number | undefined;
+  maxBytesBeforeExternalSortInBytes?: number | undefined;
+  /**
+   * Site-specific passthrough settings (e.g. optimize_use_projections,
+   * optimize_aggregation_in_order, max_threads). Keys and values are
+   * emitted verbatim — string values are single-quoted.
+   */
+  additionalSettings?: Record<string, number | string> | undefined;
+}
+
+export function getQuerySettings(options?: QuerySettingsOptions): string {
+  const parts: Array<string> = [];
+
+  if (options?.maxExecutionTimeInSeconds !== undefined) {
+    parts.push(`max_execution_time = ${options.maxExecutionTimeInSeconds}`);
+  }
+
+  if (options?.timeoutOverflowMode !== undefined) {
+    parts.push(`timeout_overflow_mode = '${options.timeoutOverflowMode}'`);
+  }
+
+  parts.push(
+    `max_memory_usage = ${
+      options?.maxMemoryUsageInBytes ?? DEFAULT_MAX_MEMORY_USAGE_IN_BYTES
+    }`,
+  );
+  parts.push(
+    `max_bytes_before_external_group_by = ${
+      options?.maxBytesBeforeExternalGroupByInBytes ??
+      DEFAULT_MAX_BYTES_BEFORE_EXTERNAL_GROUP_BY_IN_BYTES
+    }`,
+  );
+  parts.push(
+    `max_bytes_before_external_sort = ${
+      options?.maxBytesBeforeExternalSortInBytes ??
+      DEFAULT_MAX_BYTES_BEFORE_EXTERNAL_SORT_IN_BYTES
+    }`,
+  );
+
+  if (options?.additionalSettings) {
+    for (const [key, value] of Object.entries(options.additionalSettings)) {
+      parts.push(
+        typeof value === "string" ? `${key} = '${value}'` : `${key} = ${value}`,
+      );
+    }
+  }
+
+  return ` SETTINGS ${parts.join(", ")}`;
+}
+
+export default class QuerySettingsHelper {
+  public static getQuerySettings(options?: QuerySettingsOptions): string {
+    return getQuerySettings(options);
+  }
+}

package/Server/Utils/AnalyticsDatabase/StatementGenerator.ts

@@ -46,6 +46,20 @@ import AggregateBy, {
 import CaptureSpan from "../Telemetry/CaptureSpan";
 import { getPercentileLevel } from "../../../Types/BaseDatabase/AggregationType";
 
+/**
+ * Value carried under the synthetic query key "entityScope": the
+ * entity-membership read with an attribute OR-fallback. Rows stamped with
+ * `entityKeys` are matched via the bloom-indexed membership column; rows
+ * ingested before the column existed (empty array, no backfill by decision)
+ * still match via the resource attribute. See
+ * Internal/Docs/OpenTelemetryEntities.md (phase-4 read-switch).
+ */
+export interface EntityScopeQueryValue {
+  entityKeys: Array<string>;
+  attributeKey: string;
+  attributeValue: string;
+}
+
 export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
   public model!: TBaseModel;
   public modelType!: { new (): TBaseModel };
@@ -267,6 +281,10 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
       value = `CAST(${this.escapeStringLiteral(value.toString())} AS Int128)`;
     }
 
+    if (column.type === TableColumnType.UInt64) {
+      value = `CAST(${this.escapeStringLiteral(value.toString())} AS UInt64)`;
+    }
+
     if (column.type === TableColumnType.BigNumber) {
       if (typeof value === "string") {
         value = parseInt(value);
@@ -411,6 +429,88 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
         continue;
       }
 
+      /*
+       * "entityScope" is a synthetic query key (not a column):
+       * { entityKeys, attributeKey, attributeValue } compiles to
+       *   (hasAny(entityKeys, [...]) OR attributes['k'] = 'v')
+       * so new rows ride the bloom-indexed `entityKeys` membership column
+       * while pre-column rows (empty array — no backfill by decision) still
+       * match via the resource attribute. Both sides are parameter-bound:
+       * the array exactly like the Includes/hasAny path above, the
+       * attribute lookup exactly like the map-equality fast path below.
+       * Ignored (no predicate, no throw) for models without an
+       * `entityKeys` Array(String) column.
+       */
+      if (key === "entityScope") {
+        const scope: EntityScopeQueryValue | undefined = value as
+          | EntityScopeQueryValue
+          | undefined;
+
+        const entityKeysColumn: AnalyticsTableColumn | null =
+          this.model.getTableColumn("entityKeys");
+
+        if (
+          !scope ||
+          !entityKeysColumn ||
+          entityKeysColumn.type !== TableColumnType.ArrayText
+        ) {
+          continue;
+        }
+
+        const scopeEntityKeys: Array<string> = scope.entityKeys || [];
+
+        const attributesColumn: AnalyticsTableColumn | null =
+          this.model.getTableColumn("attributes");
+        const hasAttributeFallback: boolean =
+          Boolean(scope.attributeKey) &&
+          Boolean(attributesColumn) &&
+          attributesColumn!.type === TableColumnType.MapStringString;
+
+        if (scopeEntityKeys.length === 0 && !hasAttributeFallback) {
+          continue;
+        }
+
+        if (first) {
+          first = false;
+        } else {
+          whereStatement.append(SQL` `);
+        }
+
+        if (scopeEntityKeys.length > 0 && hasAttributeFallback) {
+          whereStatement.append(
+            SQL`AND (hasAny(${entityKeysColumn.key}, ${{
+              value: scopeEntityKeys,
+              type: TableColumnType.ArrayText,
+            }}) OR ${attributesColumn!.key}[${{
+              value: scope.attributeKey,
+              type: TableColumnType.Text,
+            }}] = ${{
+              value: String(scope.attributeValue ?? ""),
+              type: TableColumnType.Text,
+            }})`,
+          );
+        } else if (scopeEntityKeys.length > 0) {
+          whereStatement.append(
+            SQL`AND hasAny(${entityKeysColumn.key}, ${{
+              value: scopeEntityKeys,
+              type: TableColumnType.ArrayText,
+            }})`,
+          );
+        } else {
+          whereStatement.append(
+            SQL`AND ${attributesColumn!.key}[${{
+              value: scope.attributeKey,
+              type: TableColumnType.Text,
+            }}] = ${{
+              value: String(scope.attributeValue ?? ""),
+              type: TableColumnType.Text,
+            }}`,
+          );
+        }
+
+        continue;
+      }
+
       const tableColumn: AnalyticsTableColumn | null =
         this.model.getTableColumn(key);
 
@@ -490,6 +590,29 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
             type: tableColumn.type,
           }}`,
         );
+      } else if (
+        value instanceof Includes &&
+        tableColumn.type === TableColumnType.ArrayText
+      ) {
+        /*
+         * Array(String) membership (e.g. `entityKeys` / `attributeKeys`):
+         * `hasAny(col, [v1, v2])` — true when the row's array contains any
+         * of the values. Repurposes Includes for array columns, where the
+         * scalar `col IN (...)` form is invalid. The bloom_filter skip index
+         * on these columns prunes granules for this predicate. An empty
+         * Includes drops to no predicate (mirrors the map-Includes behavior),
+         * never `hasAny(col, [])`.
+         */
+        const arrayIncludeValues: Array<string> =
+          ((value as Includes).values as Array<string>) || [];
+        if (arrayIncludeValues.length > 0) {
+          whereStatement.append(
+            SQL`AND hasAny(${key}, ${{
+              value: arrayIncludeValues,
+              type: TableColumnType.ArrayText,
+            }})`,
+          );
+        }
       } else if (value instanceof Includes) {
         whereStatement.append(
           SQL`AND ${key} IN ${{
@@ -1046,6 +1169,7 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
       Int32: TableColumnType.Number,
       Int64: TableColumnType.BigNumber,
       Int128: TableColumnType.LongNumber,
+      UInt64: TableColumnType.UInt64,
       Float32: TableColumnType.Decimal,
       Float64: TableColumnType.Decimal,
       DateTime: TableColumnType.Date,
@@ -1097,6 +1221,7 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
       [TableColumnType.BigNumber]: SQL`Int64`,
       [TableColumnType.MapStringString]: SQL`Map(String, String)`,
       [TableColumnType.UInt8]: SQL`UInt8`,
+      [TableColumnType.UInt64]: SQL`UInt64`,
     }[column.type];
 
     if (!statement) {
@@ -1296,6 +1421,14 @@ export default class StatementGenerator<TBaseModel extends AnalyticsBaseModel> {
       statement.append(`\nTTL ${this.model.ttlExpression}`);
     }
 
+    /*
+     * Append table-level SETTINGS if specified (e.g. ttl_only_drop_parts = 1
+     * so TTL drops whole time-partitions instead of rewriting parts).
+     */
+    if (this.model.tableSettings) {
+      statement.append(`\nSETTINGS ${this.model.tableSettings}`);
+    }
+
     /* eslint-enable prettier/prettier */
 
     logger.debug(`${this.model.tableName} Table Create Statement`);

package/Server/Utils/Incident/IncidentPrivacyFilter.ts

@@ -5,6 +5,7 @@ import Permission, {
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
 import Text from "../../../Types/Text";
+import { combineWithPrivacyClause } from "../PrivacyFilterUtil";
 import { Raw } from "typeorm";
 
 /*
@@ -124,7 +125,10 @@ export function applyIncidentSelfPrivacyFilter<T>(
     return { isPrivate: rawClause } as unknown as T;
   }
 
-  (query as any).isPrivate = rawClause;
+  (query as any).isPrivate = combineWithPrivacyClause(
+    (query as any).isPrivate,
+    rawClause,
+  );
   return query;
 }
 
@@ -143,6 +147,9 @@ export function applyIncidentRelatedRecordPrivacyFilter<T>(
     return { incidentId: rawClause } as unknown as T;
   }
 
-  (query as any).incidentId = rawClause;
+  (query as any).incidentId = combineWithPrivacyClause(
+    (query as any).incidentId,
+    rawClause,
+  );
   return query;
 }

package/Server/Utils/IncidentEpisode/IncidentEpisodePrivacyFilter.ts

@@ -5,6 +5,7 @@ import Permission, {
   UserTenantAccessPermission,
 } from "../../../Types/Permission";
 import Text from "../../../Types/Text";
+import { combineWithPrivacyClause } from "../PrivacyFilterUtil";
 import { Raw } from "typeorm";
 
 /*
@@ -113,7 +114,10 @@ export function applyIncidentEpisodeSelfPrivacyFilter<T>(
     return { isPrivate: rawClause } as unknown as T;
   }
 
-  (query as any).isPrivate = rawClause;
+  (query as any).isPrivate = combineWithPrivacyClause(
+    (query as any).isPrivate,
+    rawClause,
+  );
   return query;
 }
 
@@ -132,6 +136,9 @@ export function applyIncidentEpisodeRelatedRecordPrivacyFilter<T>(
     return { incidentEpisodeId: rawClause } as unknown as T;
   }
 
-  (query as any).incidentEpisodeId = rawClause;
+  (query as any).incidentEpisodeId = combineWithPrivacyClause(
+    (query as any).incidentEpisodeId,
+    rawClause,
+  );
   return query;
 }