@oneuptime/common 11.3.26 → 11.3.28

package/Server/Services/OnCallDutyPolicyTimeLogService.ts

@@ -2,6 +2,7 @@ import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/OnCallDutyPolicyTimeLog";
+import QueryHelper from "../Types/Database/QueryHelper";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -25,16 +26,33 @@ export class Service extends DatabaseService<Model> {
       startsAt,
     } = data;
 
-    // check if the time log already exists for the user.
-
+    /*
+     * Check if an OPEN (not-yet-ended) time log already exists for the user.
+     * The endsAt IS NULL filter is essential: without it, a user who rotated
+     * off and later rotates back on would match their already-CLOSED prior log
+     * and skip creating a new one, so their later on-call stints would never be
+     * recorded (and a "who is on call now" query filtering endsAt IS NULL would
+     * miss them). Each distinct on-call stint must be its own row.
+     */
     const existingTimeLog: Model | null = await this.findOneBy({
       query: {
         projectId: data.projectId,
         onCallDutyPolicyId,
         onCallDutyPolicyEscalationRuleId: data.onCallDutyPolicyEscalationRuleId,
         userId,
-        ...(teamId && { teamId }),
-        ...(onCallDutyPolicyScheduleId && { onCallDutyPolicyScheduleId }),
+        /*
+         * Scope the context columns explicitly so a direct-user log dedups only
+         * against other direct logs, a team log only against team logs, and a
+         * schedule log only against schedule logs. The old `...(x && {x})`
+         * OMITTED the column when absent, so an absent column matched ANY value:
+         * a direct-user start then deduped against an already-open schedule/team
+         * log and never created the direct log, leaving the user with zero open
+         * logs once that schedule/team log closed (audit L4).
+         */
+        teamId: teamId ?? QueryHelper.isNull(),
+        onCallDutyPolicyScheduleId:
+          onCallDutyPolicyScheduleId ?? QueryHelper.isNull(),
+        endsAt: QueryHelper.isNull(),
       },
       props: {
         isRoot: true,
@@ -74,9 +92,11 @@ export class Service extends DatabaseService<Model> {
   }): Promise<void> {
     const { endsAt, onCallDutyPolicyScheduleId } = data;
     await this.updateBy({
+      // only close still-open logs; never overwrite historical closed intervals.
       query: {
         projectId: data.projectId,
         onCallDutyPolicyScheduleId,
+        endsAt: QueryHelper.isNull(),
       },
       data: {
         endsAt: endsAt,
@@ -96,9 +116,11 @@ export class Service extends DatabaseService<Model> {
   }): Promise<void> {
     const { endsAt, teamId } = data;
     await this.updateBy({
+      // only close still-open logs; never overwrite historical closed intervals.
       query: {
         projectId: data.projectId,
         teamId,
+        endsAt: QueryHelper.isNull(),
       },
 
       limit: LIMIT_PER_PROJECT,
@@ -115,13 +137,22 @@ export class Service extends DatabaseService<Model> {
   public async endTimeForUser(data: {
     projectId: ObjectID;
     userId: ObjectID;
+    /*
+     * When set, only close logs derived from this team. Leaving one team must
+     * not close a user's still-active logs from other teams, direct escalation
+     * assignments, or schedule rosters (audit F17).
+     */
+    teamId?: ObjectID | undefined;
     endsAt: Date;
   }): Promise<void> {
-    const { endsAt, userId } = data;
+    const { endsAt, userId, teamId } = data;
     await this.updateBy({
+      // only close still-open logs; never overwrite historical closed intervals.
       query: {
         projectId: data.projectId,
         userId,
+        ...(teamId && { teamId }),
+        endsAt: QueryHelper.isNull(),
       },
       limit: LIMIT_PER_PROJECT,
       skip: 0,
@@ -152,13 +183,24 @@ export class Service extends DatabaseService<Model> {
     } = data;
 
     await this.updateBy({
+      // only close the still-open stint; leave prior closed stints intact.
       query: {
         projectId: data.projectId,
         onCallDutyPolicyId,
         onCallDutyPolicyEscalationRuleId: data.onCallDutyPolicyEscalationRuleId,
         userId,
-        ...(teamId && { teamId }),
-        ...(onCallDutyPolicyScheduleId && { onCallDutyPolicyScheduleId }),
+        /*
+         * Constrain the context columns to IS NULL when not supplied so each
+         * context closes ONLY its own stint. The old `...(x && {x})` omitted the
+         * column, so ending a direct-user assignment (no teamId/scheduleId)
+         * matched — and closed — that user's still-open SCHEDULE and TEAM logs
+         * for the same rule too, leaving a permanent hole in the "who is on call
+         * now" view until the next roster change (audit M3).
+         */
+        teamId: teamId ?? QueryHelper.isNull(),
+        onCallDutyPolicyScheduleId:
+          onCallDutyPolicyScheduleId ?? QueryHelper.isNull(),
+        endsAt: QueryHelper.isNull(),
       },
       limit: LIMIT_PER_PROJECT,
       skip: 0,

package/Server/Services/OnCallDutyPolicyUserOverrideService.ts

@@ -4,7 +4,8 @@ import DatabaseConfig from "../DatabaseConfig";
 import URL from "../../Types/API/URL";
 import OnCallDutyPolicyUserOverride from "../../Models/DatabaseModels/OnCallDutyPolicyUserOverride";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import OneUptimeDate from "../../Types/Date";
 import BadDataException from "../../Types/Exception/BadDataException";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
@@ -16,12 +17,50 @@ import OnCallDutyPolicyService from "./OnCallDutyPolicyService";
 import Timezone from "../../Types/Timezone";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
   public constructor() {
     super(OnCallDutyPolicyUserOverride);
   }
 
+  /**
+   * Re-resolve the persisted roster of every schedule in the project that
+   * contains the override user, so a created / updated / deleted override is
+   * reflected in the dashboard roster, handoff notifications and on-call time
+   * logs mid-period instead of only at the next natural handoff (audit F4).
+   * Best-effort: never throws into the CRUD path. Lazy require avoids a static
+   * circular import (OnCallDutyPolicyScheduleService imports this service).
+   */
+  private async refreshRostersForOverrideUser(data: {
+    projectId: ObjectID | null | undefined;
+    overrideUserId: ObjectID | null | undefined;
+  }): Promise<void> {
+    if (!data.projectId || !data.overrideUserId) {
+      return;
+    }
+
+    try {
+      const scheduleService: {
+        refreshRostersForUserInProject: (d: {
+          projectId: ObjectID;
+          userId: ObjectID;
+        }) => Promise<void>;
+        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+      } = require("./OnCallDutyPolicyScheduleService").default;
+
+      await scheduleService.refreshRostersForUserInProject({
+        projectId: data.projectId,
+        userId: data.overrideUserId,
+      });
+    } catch (err) {
+      logger.error(
+        "Error refreshing rosters after a user override change (best-effort).",
+      );
+      logger.error(err);
+    }
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<OnCallDutyPolicyUserOverride>,
@@ -30,8 +69,14 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       throw new BadDataException("Start time and end time are required");
     }
 
-    // make sure start time is before end time
-    if (OneUptimeDate.isAfter(createBy.data.startsAt, createBy.data.endsAt)) {
+    /*
+     * make sure start time is STRICTLY before end time. Using !isBefore (rather
+     * than isAfter) also rejects equal start/end and same-second reversed
+     * sub-second values, which the downstream event splitter would otherwise
+     * turn into a zero-length / inverted substitution segment and a spurious
+     * "you are next on-call" notification.
+     */
+    if (!OneUptimeDate.isBefore(createBy.data.startsAt, createBy.data.endsAt)) {
       throw new BadDataException("Start time must be before end time");
     }
 
@@ -139,9 +184,164 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       });
     }
 
+    // Reflect the new override in the persisted roster immediately (audit F4).
+    await this.refreshRostersForOverrideUser({
+      projectId,
+      overrideUserId,
+    });
+
     return createdItem;
   }
 
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<OnCallDutyPolicyUserOverride>,
+  ): Promise<OnUpdate<OnCallDutyPolicyUserOverride>> {
+    /*
+     * Capture each affected override's PRE-update project + overrideUserId so
+     * onUpdateSuccess can also refresh the OLD user's schedules. onUpdateSuccess
+     * otherwise only sees the post-update overrideUserId; when an edit changes
+     * overrideUserId from A to A2, schedules that contained A (but not A2) would
+     * keep showing the substitute forever — until the next natural handoff the
+     * cron happens to re-select — because refreshRostersForUserInProject selects
+     * schedules by the NEW user only (audit M2). Mirrors the onBeforeDelete
+     * carry-forward pattern used by the delete path.
+     */
+    const previous: Array<{
+      projectId: ObjectID;
+      overrideUserId: ObjectID;
+    }> = [];
+
+    try {
+      const rows: Array<OnCallDutyPolicyUserOverride> = await this.findBy({
+        query: updateBy.query,
+        select: {
+          projectId: true,
+          overrideUserId: true,
+        },
+        props: {
+          isRoot: true,
+        },
+        skip: 0,
+        limit: LIMIT_PER_PROJECT,
+      });
+
+      for (const row of rows) {
+        const projectId: ObjectID | undefined | null =
+          row.projectId || row.project?.id;
+        const overrideUserId: ObjectID | undefined | null =
+          row.overrideUserId || row.overrideUser?.id;
+        if (projectId && overrideUserId) {
+          previous.push({ projectId, overrideUserId });
+        }
+      }
+    } catch (err) {
+      logger.error(err);
+    }
+
+    return {
+      updateBy,
+      carryForward: previous,
+    };
+  }
+
+  @CaptureSpan()
+  protected override async onUpdateSuccess(
+    onUpdate: OnUpdate<OnCallDutyPolicyUserOverride>,
+    updatedItemIds: Array<ObjectID>,
+  ): Promise<OnUpdate<OnCallDutyPolicyUserOverride>> {
+    /*
+     * An override edit (times, route target, or the override user) must be
+     * reflected in the persisted roster (audit F4). Refresh the schedules of
+     * BOTH the NEW override user (post-update) and the OLD override user captured
+     * in onBeforeUpdate, so a change of overrideUserId also restores the roster
+     * of schedules that only contained the previous user (audit M2). Deduped so
+     * an unchanged overrideUserId refreshes each schedule set only once.
+     */
+    const refreshed: Set<string> = new Set<string>();
+
+    const refreshPair: (
+      projectId: ObjectID | null | undefined,
+      overrideUserId: ObjectID | null | undefined,
+    ) => Promise<void> = async (
+      projectId: ObjectID | null | undefined,
+      overrideUserId: ObjectID | null | undefined,
+    ): Promise<void> => {
+      if (!projectId || !overrideUserId) {
+        return;
+      }
+      const key: string = `${projectId.toString()}:${overrideUserId.toString()}`;
+      if (refreshed.has(key)) {
+        return;
+      }
+      refreshed.add(key);
+      await this.refreshRostersForOverrideUser({ projectId, overrideUserId });
+    };
+
+    // OLD override users captured before the update.
+    const previous: Array<{ projectId: ObjectID; overrideUserId: ObjectID }> =
+      (onUpdate.carryForward as Array<{
+        projectId: ObjectID;
+        overrideUserId: ObjectID;
+      }>) || [];
+
+    for (const entry of previous) {
+      await refreshPair(entry.projectId, entry.overrideUserId);
+    }
+
+    // NEW override users (post-update).
+    for (const id of updatedItemIds) {
+      const item: OnCallDutyPolicyUserOverride | null = await this.findOneById({
+        id: id,
+        select: {
+          projectId: true,
+          overrideUserId: true,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+      if (!item) {
+        continue;
+      }
+
+      await refreshPair(
+        item.projectId || item.project?.id,
+        item.overrideUserId || item.overrideUser?.id,
+      );
+    }
+
+    return onUpdate;
+  }
+
+  @CaptureSpan()
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<OnCallDutyPolicyUserOverride>,
+    _itemIdsBeforeDelete: ObjectID[],
+  ): Promise<OnDelete<OnCallDutyPolicyUserOverride>> {
+    /*
+     * After an override is removed, recompute the roster so the original user
+     * (or whoever the schedule now resolves to) is reflected immediately, rather
+     * than waiting for the next natural handoff (audit F4). The affected
+     * project/user pairs were captured in onBeforeDelete (the rows are gone now).
+     */
+    const affected: Array<{ projectId: ObjectID; overrideUserId: ObjectID }> =
+      (onDelete.carryForward as Array<{
+        projectId: ObjectID;
+        overrideUserId: ObjectID;
+      }>) || [];
+
+    for (const entry of affected) {
+      await this.refreshRostersForOverrideUser({
+        projectId: entry.projectId,
+        overrideUserId: entry.overrideUserId,
+      });
+    }
+
+    return onDelete;
+  }
+
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<OnCallDutyPolicyUserOverride>,
   ): Promise<OnDelete<OnCallDutyPolicyUserOverride>> {
@@ -163,6 +363,16 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       limit: LIMIT_PER_PROJECT,
     });
 
+    /*
+     * Capture the project + override-user of each row being deleted so
+     * onDeleteSuccess can refresh those schedules' rosters AFTER the rows are
+     * gone (audit F4). Collected for global overrides too (no policy id).
+     */
+    const affectedRosters: Array<{
+      projectId: ObjectID;
+      overrideUserId: ObjectID;
+    }> = [];
+
     for (const item of itemsToDelete) {
       const onCallDutyPolicyId: ObjectID | undefined | null =
         item.onCallDutyPolicyId || item.onCallDutyPolicy?.id;
@@ -176,6 +386,10 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       const routeAlertsToUserId: ObjectID | undefined | null =
         item.routeAlertsToUserId || item.routeAlertsToUser?.id;
 
+      if (projectId && overrideUserId) {
+        affectedRosters.push({ projectId, overrideUserId });
+      }
+
       if (
         onCallDutyPolicyId &&
         projectId &&
@@ -233,7 +447,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
 
     return {
       deleteBy,
-      carryForward: null,
+      carryForward: affectedRosters,
     };
   }
 

package/Server/Services/ProjectCallSMSConfigService.ts

@@ -5,10 +5,14 @@ import Model from "../../Models/DatabaseModels/ProjectCallSMSConfig";
 import Phone from "../../Types/Phone";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
-import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DeleteBy from "../Types/Database/DeleteBy";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
 import QueryHelper from "../Types/Database/QueryHelper";
+import IncomingCallPolicyService from "./IncomingCallPolicyService";
+import IncomingCallPolicy from "../../Models/DatabaseModels/IncomingCallPolicy";
+import releaseIncomingCallPhoneNumber from "../Utils/IncomingCallPhoneNumber";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 export class Service extends DatabaseService<Model> {
@@ -92,6 +96,83 @@ export class Service extends DatabaseService<Model> {
     return { updateBy, carryForward: null };
   }
 
+  @CaptureSpan()
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<Model>,
+  ): Promise<OnDelete<Model>> {
+    /*
+     * When a Call/SMS config is deleted, release any incoming-call numbers
+     * provisioned through it (so they don't keep billing on the provider) and
+     * clear the now-dangling number fields on those policies. The config still
+     * exists at this point, so the provider can be built to release the numbers.
+     */
+    const configs: Array<Model> = await this.findBy({
+      query: deleteBy.query,
+      select: {
+        _id: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const config of configs) {
+      if (!config.id) {
+        continue;
+      }
+
+      const policies: Array<IncomingCallPolicy> =
+        await IncomingCallPolicyService.findBy({
+          query: {
+            projectCallSMSConfigId: config.id,
+          },
+          select: {
+            _id: true,
+            callProviderPhoneNumberId: true,
+            projectCallSMSConfigId: true,
+          },
+          limit: LIMIT_MAX,
+          skip: 0,
+          props: {
+            isRoot: true,
+          },
+        });
+
+      for (const policy of policies) {
+        if (
+          !policy.callProviderPhoneNumberId ||
+          !policy.projectCallSMSConfigId
+        ) {
+          continue;
+        }
+
+        await releaseIncomingCallPhoneNumber({
+          projectCallSMSConfigId: policy.projectCallSMSConfigId,
+          callProviderPhoneNumberId: policy.callProviderPhoneNumberId,
+        });
+
+        await IncomingCallPolicyService.updateOneById({
+          id: policy.id!,
+          data: {
+            routingPhoneNumber: null,
+            callProviderPhoneNumberId: null,
+            phoneNumberCountryCode: null,
+            phoneNumberAreaCode: null,
+            phoneNumberPurchasedAt: null,
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+          } as any,
+          props: {
+            isRoot: true,
+          },
+        });
+      }
+    }
+
+    return { deleteBy, carryForward: null };
+  }
+
   @CaptureSpan()
   public async getProjectDefaultTwilioConfig(
     projectId: ObjectID | undefined,

package/Server/Services/TeamMemberService.ts

@@ -383,6 +383,12 @@ export class TeamMemberService extends DatabaseService<TeamMember> {
       OnCallDutyPolicyTimeLogService.endTimeForUser({
         projectId: member.projectId!,
         userId: member.userId!,
+        /*
+         * scope to the team being left so the user's still-active logs from
+         * other teams, direct escalation assignments, and schedule rosters stay
+         * open (audit F17).
+         */
+        teamId: member.teamId!,
         endsAt: OneUptimeDate.getCurrentDate(),
       }).catch((err: Error) => {
         logger.error(err, {

package/Server/Services/UserNotificationRuleService.ts

@@ -24,7 +24,6 @@ import URL from "../../Types/API/URL";
 import CallRequest from "../../Types/Call/CallRequest";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import QueryHelper from "../Types/Database/QueryHelper";
-import OneUptimeDate from "../../Types/Date";
 import Dictionary from "../../Types/Dictionary";
 import Email from "../../Types/Email";
 import EmailMessage from "../../Types/Email/EmailMessage";
@@ -109,52 +108,24 @@ export class Service extends DatabaseService<Model> {
       onCallScheduleId?: ObjectID | undefined;
     },
   ): Promise<void> {
-    // get user notification log and see if this rule has already been executed. If so then skip.
-
-    const userOnCallLog: UserOnCallLog | null =
-      await UserOnCallLogService.findOneById({
-        id: options.userNotificationLogId,
-        props: {
-          isRoot: true,
-        },
-        select: {
-          _id: true,
-          executedNotificationRules: true,
-        },
+    /*
+     * Atomically claim this rule for this on-call log BEFORE sending, so two
+     * overlapping cron runs cannot both mark the rule un-executed and both
+     * notify — double-paging the responder for one escalation (audit F7). The
+     * previous read-check-then-blind-save was a non-atomic TOCTOU. If the claim
+     * was already taken (or the log is gone), skip.
+     */
+    const claimedRuleExecution: boolean =
+      await UserOnCallLogService.claimNotificationRuleExecution({
+        userOnCallLogId: options.userNotificationLogId,
+        userNotificationRuleId: userNotificationRuleId,
       });
 
-    if (!userOnCallLog) {
-      throw new BadDataException("User notification log not found.");
-    }
-
-    if (
-      Object.keys(userOnCallLog.executedNotificationRules || {}).includes(
-        userNotificationRuleId.toString(),
-      )
-    ) {
-      // already executed.
+    if (!claimedRuleExecution) {
+      // already executed by this or a concurrent run.
       return;
     }
 
-    if (!userOnCallLog.executedNotificationRules) {
-      userOnCallLog.executedNotificationRules = {};
-    }
-
-    userOnCallLog.executedNotificationRules[userNotificationRuleId.toString()] =
-      OneUptimeDate.getCurrentDate();
-
-    await UserOnCallLogService.updateOneById({
-      id: userOnCallLog.id!,
-      data: {
-        executedNotificationRules: {
-          ...userOnCallLog.executedNotificationRules,
-        },
-      } as any,
-      props: {
-        isRoot: true,
-      },
-    });
-
     // find notification rule item.
     const notificationRuleItem: Model | null = await this.findOneById({
       id: userNotificationRuleId!,

package/Server/Services/UserOnCallLogService.ts

@@ -23,6 +23,9 @@ import AlertEpisode from "../../Models/DatabaseModels/AlertEpisode";
 import AlertEpisodeService from "./AlertEpisodeService";
 import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
 import IncidentEpisodeService from "./IncidentEpisodeService";
+import OneUptimeDate from "../../Types/Date";
+import { JSONObject } from "../../Types/JSON";
+import logger from "../Utils/Logger";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -32,6 +35,93 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /**
+   * Atomically claim the right to execute ONE notification rule for this on-call
+   * log. Overlapping UserOnCallLog:ExecutePendingExecutions runs (a tick that
+   * exceeds the 1-minute cadence, a stalled-job re-delivery, or a burst release
+   * across worker replicas) could both read executedNotificationRules without a
+   * given delayed rule's key, both write it, and both send — double-paging the
+   * responder for a single escalation (audit F7). This mirrors
+   * OnCallDutyPolicyExecutionLogService.claimEscalationAdvance: a single
+   * conditional UPDATE that sets executedNotificationRules[ruleId] only when the
+   * key is absent and RETURNs the affected row, so exactly one concurrent run
+   * wins and the loser skips.
+   *
+   * Fail-safe: if the atomic statement errors for any reason, fall back to the
+   * previous non-atomic read-modify-write so the rule is still marked and sent.
+   * For an on-call system a rare duplicate page (the pre-fix behavior) is far
+   * better than a missed page, so this never makes paging less reliable.
+   *
+   * Returns true when THIS call claimed the rule (caller should send), false when
+   * it was already executed/claimed (caller should skip) or the log is missing.
+   */
+  @CaptureSpan()
+  public async claimNotificationRuleExecution(data: {
+    userOnCallLogId: ObjectID;
+    userNotificationRuleId: ObjectID;
+  }): Promise<boolean> {
+    const ruleKey: string = data.userNotificationRuleId.toString();
+
+    try {
+      const nowIso: string = OneUptimeDate.getCurrentDate().toISOString();
+
+      const rows: Array<{ _id: string }> =
+        await this.getRepository().manager.query(
+          `UPDATE "UserOnCallLog"
+             SET "executedNotificationRules" = jsonb_set(
+                   COALESCE("executedNotificationRules", '{}')::jsonb,
+                   ARRAY[$2::text],
+                   to_jsonb($3::text),
+                   true
+                 )::json
+           WHERE "_id" = $1::uuid
+             AND NOT (COALESCE("executedNotificationRules", '{}')::jsonb ? $2::text)
+           RETURNING "_id"`,
+          [data.userOnCallLogId.toString(), ruleKey, nowIso],
+        );
+
+      return Array.isArray(rows) && rows.length > 0;
+    } catch (err) {
+      logger.error(
+        "claimNotificationRuleExecution atomic claim failed; falling back to non-atomic marking.",
+      );
+      logger.error(err);
+
+      // Fallback: previous non-atomic read-modify-write (reliable marking).
+      const log: Model | null = await this.findOneById({
+        id: data.userOnCallLogId,
+        props: { isRoot: true },
+        select: {
+          _id: true,
+          executedNotificationRules: true,
+        },
+      });
+
+      if (!log) {
+        return false;
+      }
+
+      const executed: JSONObject = log.executedNotificationRules || {};
+
+      if (Object.keys(executed).includes(ruleKey)) {
+        return false;
+      }
+
+      executed[ruleKey] = OneUptimeDate.getCurrentDate();
+
+      await this.updateOneById({
+        id: log.id!,
+        data: {
+          executedNotificationRules: { ...executed },
+          // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        } as any,
+        props: { isRoot: true },
+      });
+
+      return true;
+    }
+  }
+
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,