@oneuptime/common 11.0.2 → 11.0.4

package/Server/Middleware/UserAuthorization.ts

@@ -1,8 +1,8 @@
 import AccessTokenService from "../Services/AccessTokenService";
+import GlobalConfigService from "../Services/GlobalConfigService";
 import ProjectService from "../Services/ProjectService";
 import TeamMemberService from "../Services/TeamMemberService";
 import UserService from "../Services/UserService";
-import QueryHelper from "../Types/Database/QueryHelper";
 import CookieUtil from "../Utils/Cookie";
 import {
   ExpressRequest,
@@ -16,7 +16,6 @@ import logger, { getLogAttributesFromRequest } from "../Utils/Logger";
 import Response from "../Utils/Response";
 import ProjectMiddleware from "./ProjectAuthorization";
 import SpanUtil from "../Utils/Telemetry/SpanUtil";
-import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import Dictionary from "../../Types/Dictionary";
 import Exception from "../../Types/Exception/Exception";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
@@ -35,7 +34,6 @@ import Permission, {
   UserTenantAccessPermission,
 } from "../../Types/Permission";
 import UserType from "../../Types/UserType";
-import Project from "../../Models/DatabaseModels/Project";
 import UserPermissionUtil from "../Utils/UserPermission/UserPermission";
 
 export default class UserMiddleware {
@@ -170,6 +168,7 @@ export default class UserMiddleware {
     req: ExpressRequest,
     projectId: ObjectID,
     userId: ObjectID,
+    requiredSsoProviderId?: ObjectID | undefined,
   ): boolean {
     const ssoTokens: Dictionary<string> = this.getSsoTokens(req);
 
@@ -181,6 +180,25 @@ export default class UserMiddleware {
         decodedData.projectId?.toString() === projectId.toString() &&
         decodedData.userId.toString() === userId.toString()
       ) {
+        /*
+         * Specific-IdP enforcement: when the project requires a specific SSO
+         * provider, the token must carry a matching `ssoProviderId`
+         * discriminator. Tokens issued before this field existed (no
+         * discriminator) do not satisfy a specific-provider requirement.
+         */
+        if (requiredSsoProviderId) {
+          const tokenProviderId: string | undefined = decodedData.ssoProviderId
+            ? decodedData.ssoProviderId.toString()
+            : undefined;
+
+          if (
+            !tokenProviderId ||
+            tokenProviderId !== requiredSsoProviderId.toString()
+          ) {
+            return false;
+          }
+        }
+
         return true;
       }
     }
@@ -493,12 +511,15 @@ export default class UserMiddleware {
   }): Promise<UserTenantAccessPermission | null> {
     const { req, tenantId, userId } = data;
 
+    const isMasterAdmin: boolean =
+      (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
+
     /*
      * Resolve the SSO requirement and the tenant permission in parallel.
      * `getRequireSsoForLogin` is cached in-process for 60s, so this is
      * usually free; the tenant permission lookup is the expensive call.
      */
-    const [requireSsoForLogin, tenantPermission]: [
+    const [projectRequireSsoForLogin, tenantPermission]: [
       boolean,
       UserTenantAccessPermission | null,
     ] = await Promise.all([
@@ -515,11 +536,42 @@ export default class UserMiddleware {
       AccessTokenService.getUserTenantAccessPermission(userId, tenantId),
     ]);
 
-    if (
-      requireSsoForLogin &&
-      !UserMiddleware.doesSsoTokenForProjectExist(req, tenantId, userId)
-    ) {
-      throw new SsoAuthorizationException();
+    /*
+     * The instance-wide "Require SSO for Login" flag (GlobalConfig) forces SSO
+     * on every project. Master admins are exempt so a misconfigured global SSO
+     * can't lock them out — a project's own requireSsoForLogin still applies to
+     * them. Only checked when the project doesn't already enforce SSO.
+     */
+    let requireSsoForLogin: boolean = projectRequireSsoForLogin;
+    if (!requireSsoForLogin && !isMasterAdmin) {
+      requireSsoForLogin =
+        await GlobalConfigService.getRequireSsoForLogin().catch(() => {
+          return false;
+        });
+    }
+
+    if (requireSsoForLogin) {
+      /*
+       * Only resolve the specific-provider requirement when SSO is enforced.
+       * The provider-id cache is already warm from getRequireSsoForLogin above.
+       */
+      const requiredSsoProviderId: ObjectID | null =
+        await ProjectService.getRequireSsoWithSsoProviderId(tenantId).catch(
+          () => {
+            return null;
+          },
+        );
+
+      if (
+        !UserMiddleware.doesSsoTokenForProjectExist(
+          req,
+          tenantId,
+          userId,
+          requiredSsoProviderId ?? undefined,
+        )
+      ) {
+        throw new SsoAuthorizationException();
+      }
     }
 
     return tenantPermission;
@@ -535,48 +587,67 @@ export default class UserMiddleware {
       return null;
     }
 
-    const projects: Array<Project> = await ProjectService.findBy({
-      query: {
-        _id: QueryHelper.any(
-          projectIds.map((i: ObjectID) => {
-            return i.toString();
-          }) || [],
-        ),
-      },
-      select: {
-        requireSsoForLogin: true,
-      },
-      limit: LIMIT_PER_PROJECT,
-      skip: 0,
-      props: {
-        isRoot: true,
-      },
-    });
+    const isMasterAdmin: boolean =
+      (req as OneUptimeRequest).userAuthorization?.isMasterAdmin === true;
+
+    /*
+     * Instance-wide "Require SSO for Login" forces SSO on every project. Master
+     * admins are exempt. Resolved once (cached) rather than per project.
+     */
+    const globalRequireSsoForLogin: boolean = isMasterAdmin
+      ? false
+      : await GlobalConfigService.getRequireSsoForLogin().catch(() => {
+          return false;
+        });
 
     /*
-     * Resolve permissions for every project in parallel. With the previous
-     * for-await loop this scaled linearly with project count, adding one
-     * round-trip per project even on cache hits.
+     * Resolve permissions for every project in parallel. A project's own
+     * requireSsoForLogin is read through the cached getter; the global flag is
+     * OR'd in so enforcement matches the single-tenant path.
      */
     const resolved: Array<{
       projectId: ObjectID;
       permission: UserTenantAccessPermission | null;
     }> = await Promise.all(
       projectIds.map(async (projectId: ObjectID) => {
-        if (
-          projects.find((p: Project) => {
-            return p._id === projectId.toString() && p.requireSsoForLogin;
-          }) &&
-          !UserMiddleware.doesSsoTokenForProjectExist(req, projectId, userId)
-        ) {
-          return {
-            projectId,
-            permission:
-              UserPermissionUtil.getDefaultUserTenantAccessPermission(
-                projectId,
-              ),
-          };
+        const projectRequireSsoForLogin: boolean =
+          await ProjectService.getRequireSsoForLogin(projectId).catch(() => {
+            /*
+             * Unknown/inaccessible project: do not enforce SSO here. Actual
+             * access is still gated by AccessTokenService below.
+             */
+            return false;
+          });
+
+        const requireSsoForLogin: boolean =
+          projectRequireSsoForLogin || globalRequireSsoForLogin;
+
+        if (requireSsoForLogin) {
+          const requiredSsoProviderId: ObjectID | null =
+            await ProjectService.getRequireSsoWithSsoProviderId(
+              projectId,
+            ).catch(() => {
+              return null;
+            });
+
+          if (
+            !UserMiddleware.doesSsoTokenForProjectExist(
+              req,
+              projectId,
+              userId,
+              requiredSsoProviderId ?? undefined,
+            )
+          ) {
+            return {
+              projectId,
+              permission:
+                UserPermissionUtil.getDefaultUserTenantAccessPermission(
+                  projectId,
+                ),
+            };
+          }
         }
+
         return {
           projectId,
           permission: await AccessTokenService.getUserTenantAccessPermission(

package/Server/Services/AlertLabelRuleEngineService.ts

@@ -6,11 +6,13 @@ import Host from "../../Models/DatabaseModels/Host";
 import KubernetesCluster from "../../Models/DatabaseModels/KubernetesCluster";
 import Label from "../../Models/DatabaseModels/Label";
 import Monitor from "../../Models/DatabaseModels/Monitor";
+import PodmanHost from "../../Models/DatabaseModels/PodmanHost";
 import Service from "../../Models/DatabaseModels/Service";
 import AlertFeedService from "./AlertFeedService";
 import AlertLabelRuleService from "./AlertLabelRuleService";
 import AlertService from "./AlertService";
 import DockerHostService from "./DockerHostService";
+import PodmanHostService from "./PodmanHostService";
 import HostService from "./HostService";
 import KubernetesClusterService from "./KubernetesClusterService";
 import LabelService from "./LabelService";
@@ -33,6 +35,7 @@ class AlertLabelRuleEngineServiceClass {
    *   - all labels of the alert's hosts when `inheritLabelsFromHosts`
    *   - all labels of the alert's Kubernetes clusters when `inheritLabelsFromKubernetesClusters`
    *   - all labels of the alert's Docker hosts when `inheritLabelsFromDockerHosts`
+   *   - all labels of the alert's Podman hosts when `inheritLabelsFromPodmanHosts`
    *   - all labels of the alert's services when `inheritLabelsFromServices`
    * The union is deduped against labels already on the alert before insert
    * to avoid PK conflicts on the AlertLabel join table.
@@ -66,6 +69,7 @@ class AlertLabelRuleEngineServiceClass {
           inheritLabelsFromHosts: true,
           inheritLabelsFromKubernetesClusters: true,
           inheritLabelsFromDockerHosts: true,
+          inheritLabelsFromPodmanHosts: true,
           inheritLabelsFromServices: true,
         },
         limit: 100,
@@ -81,6 +85,7 @@ class AlertLabelRuleEngineServiceClass {
       let inheritFromHosts: boolean = false;
       let inheritFromKubernetesClusters: boolean = false;
       let inheritFromDockerHosts: boolean = false;
+      let inheritFromPodmanHosts: boolean = false;
       let inheritFromServices: boolean = false;
       const matchedRules: Array<AlertLabelRule> = [];
 
@@ -107,6 +112,9 @@ class AlertLabelRuleEngineServiceClass {
         if (rule.inheritLabelsFromDockerHosts) {
           inheritFromDockerHosts = true;
         }
+        if (rule.inheritLabelsFromPodmanHosts) {
+          inheritFromPodmanHosts = true;
+        }
         if (rule.inheritLabelsFromServices) {
           inheritFromServices = true;
         }
@@ -116,6 +124,7 @@ class AlertLabelRuleEngineServiceClass {
         inheritFromHosts ||
         inheritFromKubernetesClusters ||
         inheritFromDockerHosts ||
+        inheritFromPodmanHosts ||
         inheritFromServices;
 
       let alertWithResources: Alert | null = null;
@@ -126,6 +135,7 @@ class AlertLabelRuleEngineServiceClass {
             hosts: { _id: true },
             kubernetesClusters: { _id: true },
             dockerHosts: { _id: true },
+            podmanHosts: { _id: true },
             services: { _id: true },
           },
           props: { isRoot: true },
@@ -204,6 +214,25 @@ class AlertLabelRuleEngineServiceClass {
         }
       }
 
+      if (inheritFromPodmanHosts && alertWithResources?.podmanHosts?.length) {
+        for (const alertPodmanHost of alertWithResources.podmanHosts) {
+          if (!alertPodmanHost.id) {
+            continue;
+          }
+          const podmanHost: PodmanHost | null =
+            await PodmanHostService.findOneById({
+              id: alertPodmanHost.id,
+              select: { labels: { _id: true } },
+              props: { isRoot: true },
+            });
+          for (const label of podmanHost?.labels || []) {
+            if (label.id) {
+              labelIdsToAdd.add(label.id.toString());
+            }
+          }
+        }
+      }
+
       if (inheritFromServices && alertWithResources?.services?.length) {
         for (const alertService of alertWithResources.services) {
           if (!alertService.id) {

package/Server/Services/AlertOwnerRuleEngineService.ts

@@ -14,6 +14,9 @@ import Label from "../../Models/DatabaseModels/Label";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import MonitorOwnerTeam from "../../Models/DatabaseModels/MonitorOwnerTeam";
 import MonitorOwnerUser from "../../Models/DatabaseModels/MonitorOwnerUser";
+import PodmanHost from "../../Models/DatabaseModels/PodmanHost";
+import PodmanHostOwnerTeam from "../../Models/DatabaseModels/PodmanHostOwnerTeam";
+import PodmanHostOwnerUser from "../../Models/DatabaseModels/PodmanHostOwnerUser";
 import Service from "../../Models/DatabaseModels/Service";
 import ServiceOwnerTeam from "../../Models/DatabaseModels/ServiceOwnerTeam";
 import ServiceOwnerUser from "../../Models/DatabaseModels/ServiceOwnerUser";
@@ -31,6 +34,8 @@ import KubernetesClusterOwnerUserService from "./KubernetesClusterOwnerUserServi
 import MonitorOwnerTeamService from "./MonitorOwnerTeamService";
 import MonitorOwnerUserService from "./MonitorOwnerUserService";
 import MonitorService from "./MonitorService";
+import PodmanHostOwnerTeamService from "./PodmanHostOwnerTeamService";
+import PodmanHostOwnerUserService from "./PodmanHostOwnerUserService";
 import ServiceOwnerTeamService from "./ServiceOwnerTeamService";
 import ServiceOwnerUserService from "./ServiceOwnerUserService";
 import TeamService from "./TeamService";
@@ -79,6 +84,7 @@ class AlertOwnerRuleEngineServiceClass {
           inheritOwnersFromHosts: true,
           inheritOwnersFromKubernetesClusters: true,
           inheritOwnersFromDockerHosts: true,
+          inheritOwnersFromPodmanHosts: true,
           inheritOwnersFromServices: true,
         },
         limit: 100,
@@ -105,6 +111,7 @@ class AlertOwnerRuleEngineServiceClass {
       let inheritFromHosts: boolean = false;
       let inheritFromKubernetesClusters: boolean = false;
       let inheritFromDockerHosts: boolean = false;
+      let inheritFromPodmanHosts: boolean = false;
       let inheritFromServices: boolean = false;
       const inheritNotifyMode: { value: boolean | null } = { value: null };
 
@@ -153,6 +160,12 @@ class AlertOwnerRuleEngineServiceClass {
           inheritNotifyMode.value =
             inheritNotifyMode.value === true ? true : notify;
         }
+        if (rule.inheritOwnersFromPodmanHosts) {
+          inheritFromPodmanHosts = true;
+          ruleAddedAny = true;
+          inheritNotifyMode.value =
+            inheritNotifyMode.value === true ? true : notify;
+        }
         if (rule.inheritOwnersFromServices) {
           inheritFromServices = true;
           ruleAddedAny = true;
@@ -172,6 +185,8 @@ class AlertOwnerRuleEngineServiceClass {
       const inheritedFromKubernetesClusterTeamIds: Set<string> = new Set();
       const inheritedFromDockerHostUserIds: Set<string> = new Set();
       const inheritedFromDockerHostTeamIds: Set<string> = new Set();
+      const inheritedFromPodmanHostUserIds: Set<string> = new Set();
+      const inheritedFromPodmanHostTeamIds: Set<string> = new Set();
       const inheritedFromServiceUserIds: Set<string> = new Set();
       const inheritedFromServiceTeamIds: Set<string> = new Set();
 
@@ -334,6 +349,47 @@ class AlertOwnerRuleEngineServiceClass {
         }
       }
 
+      if (inheritFromPodmanHosts && alert.podmanHosts?.length) {
+        const podmanHostIds: Array<ObjectID> = alert.podmanHosts
+          .map((p: PodmanHost) => {
+            return p.id;
+          })
+          .filter((id: ObjectID | null | undefined): id is ObjectID => {
+            return Boolean(id);
+          });
+        if (podmanHostIds.length > 0) {
+          const [podmanHostOwnerUsers, podmanHostOwnerTeams]: [
+            Array<PodmanHostOwnerUser>,
+            Array<PodmanHostOwnerTeam>,
+          ] = await Promise.all([
+            PodmanHostOwnerUserService.findBy({
+              query: { podmanHostId: QueryHelper.any(podmanHostIds) },
+              select: { userId: true },
+              props: { isRoot: true },
+              limit: LIMIT_MAX,
+              skip: 0,
+            }),
+            PodmanHostOwnerTeamService.findBy({
+              query: { podmanHostId: QueryHelper.any(podmanHostIds) },
+              select: { teamId: true },
+              props: { isRoot: true },
+              limit: LIMIT_MAX,
+              skip: 0,
+            }),
+          ]);
+          for (const ownerUser of podmanHostOwnerUsers) {
+            if (ownerUser.userId) {
+              inheritedFromPodmanHostUserIds.add(ownerUser.userId.toString());
+            }
+          }
+          for (const ownerTeam of podmanHostOwnerTeams) {
+            if (ownerTeam.teamId) {
+              inheritedFromPodmanHostTeamIds.add(ownerTeam.teamId.toString());
+            }
+          }
+        }
+      }
+
       if (inheritFromServices && alert.services?.length) {
         const serviceIds: Array<ObjectID> = alert.services
           .map((s: Service) => {
@@ -380,6 +436,7 @@ class AlertOwnerRuleEngineServiceClass {
         ...inheritedFromHostUserIds,
         ...inheritedFromKubernetesClusterUserIds,
         ...inheritedFromDockerHostUserIds,
+        ...inheritedFromPodmanHostUserIds,
         ...inheritedFromServiceUserIds,
       ]);
       const inheritedTeamIds: Set<string> = new Set([
@@ -387,6 +444,7 @@ class AlertOwnerRuleEngineServiceClass {
         ...inheritedFromHostTeamIds,
         ...inheritedFromKubernetesClusterTeamIds,
         ...inheritedFromDockerHostTeamIds,
+        ...inheritedFromPodmanHostTeamIds,
         ...inheritedFromServiceTeamIds,
       ]);
 
@@ -458,6 +516,10 @@ class AlertOwnerRuleEngineServiceClass {
           inheritedFromDockerHostUserIds.size +
             inheritedFromDockerHostTeamIds.size >
           0,
+        inheritedFromPodmanHosts:
+          inheritedFromPodmanHostUserIds.size +
+            inheritedFromPodmanHostTeamIds.size >
+          0,
         inheritedFromServices:
           inheritedFromServiceUserIds.size + inheritedFromServiceTeamIds.size >
           0,
@@ -480,6 +542,7 @@ class AlertOwnerRuleEngineServiceClass {
     inheritedFromHosts: boolean;
     inheritedFromKubernetesClusters: boolean;
     inheritedFromDockerHosts: boolean;
+    inheritedFromPodmanHosts: boolean;
     inheritedFromServices: boolean;
   }): Promise<void> {
     const {
@@ -491,6 +554,7 @@ class AlertOwnerRuleEngineServiceClass {
       inheritedFromHosts,
       inheritedFromKubernetesClusters,
       inheritedFromDockerHosts,
+      inheritedFromPodmanHosts,
       inheritedFromServices,
     } = data;
     if (
@@ -575,6 +639,9 @@ class AlertOwnerRuleEngineServiceClass {
       if (inheritedFromDockerHosts) {
         inheritedSources.push("Docker hosts");
       }
+      if (inheritedFromPodmanHosts) {
+        inheritedSources.push("Podman hosts");
+      }
       if (inheritedFromServices) {
         inheritedSources.push("services");
       }

package/Server/Services/DockerSwarmClusterLabelRuleEngineService.ts

@@ -0,0 +1,214 @@
+import Label from "../../Models/DatabaseModels/Label";
+import DockerSwarmCluster from "../../Models/DatabaseModels/DockerSwarmCluster";
+import DockerSwarmClusterLabelRule from "../../Models/DatabaseModels/DockerSwarmClusterLabelRule";
+import DockerSwarmClusterLabelRuleService from "./DockerSwarmClusterLabelRuleService";
+import DockerSwarmClusterService from "./DockerSwarmClusterService";
+import ObjectID from "../../Types/ObjectID";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import logger, { LogAttributes } from "../Utils/Logger";
+
+class DockerSwarmClusterLabelRuleEngineServiceClass {
+  /**
+   * Evaluates DockerSwarmClusterLabelRule rows for the given DockerSwarm cluster and attaches matched
+   * labels to it. The union is deduped against labels already on the DockerSwarm cluster
+   * before insert to avoid PK conflicts on the join table.
+   */
+  @CaptureSpan()
+  public async applyRulesToDockerSwarmCluster(
+    dockerSwarmCluster: DockerSwarmCluster,
+  ): Promise<void> {
+    if (!dockerSwarmCluster.id || !dockerSwarmCluster.projectId) {
+      return;
+    }
+
+    try {
+      const rules: Array<DockerSwarmClusterLabelRule> =
+        await DockerSwarmClusterLabelRuleService.findBy({
+          query: {
+            projectId: dockerSwarmCluster.projectId,
+            isEnabled: true,
+          },
+          props: { isRoot: true },
+          select: {
+            _id: true,
+            name: true,
+            dockerSwarmClusterLabels: { _id: true },
+            dockerSwarmClusterNamePattern: true,
+            dockerSwarmClusterDescriptionPattern: true,
+            labelsToAdd: { _id: true },
+          },
+          limit: 100,
+          skip: 0,
+        });
+
+      if (rules.length === 0) {
+        return;
+      }
+
+      const dockerSwarmClusterWithDetails: DockerSwarmCluster | null =
+        await DockerSwarmClusterService.findOneById({
+          id: dockerSwarmCluster.id,
+          select: {
+            name: true,
+            description: true,
+            labels: { _id: true },
+          },
+          props: { isRoot: true },
+        });
+
+      if (!dockerSwarmClusterWithDetails) {
+        return;
+      }
+
+      const labelIdsToAdd: Set<string> = new Set();
+
+      for (const rule of rules) {
+        const matches: boolean = this.doesDockerSwarmClusterMatchRule(
+          dockerSwarmClusterWithDetails,
+          rule,
+        );
+        if (!matches) {
+          continue;
+        }
+        for (const label of rule.labelsToAdd || []) {
+          if (label.id) {
+            labelIdsToAdd.add(label.id.toString());
+          }
+        }
+      }
+
+      if (labelIdsToAdd.size === 0) {
+        return;
+      }
+
+      const existingLabelIds: Set<string> = new Set(
+        (dockerSwarmClusterWithDetails.labels || [])
+          .map((l: Label) => {
+            return l.id?.toString() || "";
+          })
+          .filter((id: string) => {
+            return id !== "";
+          }),
+      );
+
+      const newLabelIds: Array<string> = Array.from(labelIdsToAdd).filter(
+        (id: string) => {
+          return !existingLabelIds.has(id);
+        },
+      );
+      if (newLabelIds.length === 0) {
+        return;
+      }
+
+      await DockerSwarmClusterService.getRepository()
+        .createQueryBuilder()
+        .relation(DockerSwarmCluster, "labels")
+        .of(dockerSwarmCluster.id.toString())
+        .add(newLabelIds);
+
+      /*
+       * Sync in-memory dockerSwarmCluster.labels so a downstream owner-rule engine in
+       * the same onCreateSuccess chain can match on rule-added labels.
+       */
+      const mergedLabelIds: Set<string> = new Set([
+        ...existingLabelIds,
+        ...newLabelIds,
+      ]);
+      dockerSwarmCluster.labels = Array.from(mergedLabelIds).map(
+        (id: string) => {
+          const label: Label = new Label();
+          label.id = new ObjectID(id);
+          return label;
+        },
+      );
+
+      logger.debug(
+        `DockerSwarmClusterLabelRuleEngine attached ${newLabelIds.length} labels to DockerSwarm cluster ${dockerSwarmCluster.id}`,
+        { projectId: dockerSwarmCluster.projectId.toString() } as LogAttributes,
+      );
+    } catch (error) {
+      logger.error(`Error applying DockerSwarm cluster label rules: ${error}`, {
+        projectId: dockerSwarmCluster.projectId?.toString(),
+        dockerSwarmClusterId: dockerSwarmCluster.id?.toString(),
+      } as LogAttributes);
+    }
+  }
+
+  private doesDockerSwarmClusterMatchRule(
+    dockerSwarmCluster: DockerSwarmCluster,
+    rule: DockerSwarmClusterLabelRule,
+  ): boolean {
+    if (
+      rule.dockerSwarmClusterLabels &&
+      rule.dockerSwarmClusterLabels.length > 0
+    ) {
+      if (
+        !dockerSwarmCluster.labels ||
+        dockerSwarmCluster.labels.length === 0
+      ) {
+        return false;
+      }
+      const ruleLabelIds: Array<string> = rule.dockerSwarmClusterLabels.map(
+        (l: Label) => {
+          return l.id?.toString() || "";
+        },
+      );
+      const labelIds: Array<string> = dockerSwarmCluster.labels.map(
+        (l: Label) => {
+          return l.id?.toString() || "";
+        },
+      );
+      if (
+        !ruleLabelIds.some((id: string) => {
+          return labelIds.includes(id);
+        })
+      ) {
+        return false;
+      }
+    }
+
+    if (
+      rule.dockerSwarmClusterNamePattern &&
+      (!dockerSwarmCluster.name ||
+        !this.testRegex(
+          rule.dockerSwarmClusterNamePattern,
+          dockerSwarmCluster.name,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    if (
+      rule.dockerSwarmClusterDescriptionPattern &&
+      (!dockerSwarmCluster.description ||
+        !this.testRegex(
+          rule.dockerSwarmClusterDescriptionPattern,
+          dockerSwarmCluster.description,
+          rule,
+        ))
+    ) {
+      return false;
+    }
+
+    return true;
+  }
+
+  private testRegex(
+    pattern: string,
+    value: string,
+    rule: DockerSwarmClusterLabelRule,
+  ): boolean {
+    try {
+      const regex: RegExp = new RegExp(pattern, "i");
+      return regex.test(value);
+    } catch {
+      logger.warn(
+        `Invalid regex in DockerSwarm cluster label rule ${rule.id}: ${pattern}`,
+      );
+      return false;
+    }
+  }
+}
+
+export default new DockerSwarmClusterLabelRuleEngineServiceClass();

package/Server/Services/DockerSwarmClusterLabelRuleService.ts

@@ -0,0 +1,14 @@
+import DatabaseService from "./DatabaseService";
+import Model from "../../Models/DatabaseModels/DockerSwarmClusterLabelRule";
+import { IsBillingEnabled } from "../EnvironmentConfig";
+
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+    if (IsBillingEnabled) {
+      this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365);
+    }
+  }
+}
+
+export default new Service();