@oneuptime/common 12.0.29 → 12.0.31

package/Server/Services/OnCallDutyPolicyUserOverrideService.ts

@@ -18,12 +18,124 @@ import Timezone from "../../Types/Timezone";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import logger from "../Utils/Logger";
+import { OnCallShiftChangeReason } from "../Utils/OnCall/OnCallShiftChangeListeners";
+
+/*
+ * The (project, overridden user, substitute) triple an override names; the
+ * hooks capture it before an update / delete so the schedules of the OLD
+ * users can be refreshed and re-versioned once the row has changed.
+ */
+interface OverrideUserPair {
+  projectId: ObjectID;
+  overrideUserId: ObjectID;
+  routeAlertsToUserId?: ObjectID | undefined;
+}
+
+/*
+ * The subset of OnCallDutyPolicyScheduleService the override hooks call.
+ * Lazily required (see refreshRostersForOverrideUser) because that service
+ * imports this one.
+ */
+interface ScheduleServiceForOverrides {
+  refreshRostersForUserInProject: (d: {
+    projectId: ObjectID;
+    userId: ObjectID;
+  }) => Promise<void>;
+  getScheduleIdsForUsersInProject: (d: {
+    projectId: ObjectID;
+    userIds: Array<ObjectID>;
+  }) => Promise<Array<ObjectID>>;
+  propagateShiftConfigChange: (d: {
+    scheduleIds: Array<ObjectID>;
+    projectId?: ObjectID | null | undefined;
+    userIds?: Array<ObjectID> | undefined;
+    reason: OnCallShiftChangeReason;
+  }) => Promise<void>;
+}
 
 export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
   public constructor() {
     super(OnCallDutyPolicyUserOverride);
   }
 
+  private getScheduleService(): ScheduleServiceForOverrides {
+    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+    return require("./OnCallDutyPolicyScheduleService").default;
+  }
+
+  /**
+   * An override changes who is on call on every schedule that contains the
+   * overridden user, and it changes the SUBSTITUTE's personal calendar too.
+   * Find those schedules with the same layer-user query the roster refresh
+   * uses (for every overridden user, old and new), then bump their
+   * shiftConfigVersion, drop the feed caches — the substitutes' personal
+   * caches included — and let the shift-change listeners re-plan reminders.
+   * One call per project; best-effort, never throws into the CRUD path.
+   */
+  private async propagateShiftChangeForOverrides(
+    pairs: Array<OverrideUserPair>,
+  ): Promise<void> {
+    const byProject: Map<
+      string,
+      {
+        projectId: ObjectID;
+        overrideUserIds: Array<ObjectID>;
+        allUserIds: Array<ObjectID>;
+      }
+    > = new Map();
+
+    for (const pair of pairs) {
+      if (!pair.projectId || !pair.overrideUserId) {
+        continue;
+      }
+
+      const key: string = pair.projectId.toString();
+      const entry: {
+        projectId: ObjectID;
+        overrideUserIds: Array<ObjectID>;
+        allUserIds: Array<ObjectID>;
+      } = byProject.get(key) || {
+        projectId: pair.projectId,
+        overrideUserIds: [],
+        allUserIds: [],
+      };
+
+      entry.overrideUserIds.push(pair.overrideUserId);
+      entry.allUserIds.push(pair.overrideUserId);
+
+      if (pair.routeAlertsToUserId) {
+        entry.allUserIds.push(pair.routeAlertsToUserId);
+      }
+
+      byProject.set(key, entry);
+    }
+
+    for (const entry of byProject.values()) {
+      try {
+        const scheduleService: ScheduleServiceForOverrides =
+          this.getScheduleService();
+
+        const scheduleIds: Array<ObjectID> =
+          await scheduleService.getScheduleIdsForUsersInProject({
+            projectId: entry.projectId,
+            userIds: entry.overrideUserIds,
+          });
+
+        await scheduleService.propagateShiftConfigChange({
+          scheduleIds,
+          projectId: entry.projectId,
+          userIds: entry.allUserIds,
+          reason: OnCallShiftChangeReason.OverrideChanged,
+        });
+      } catch (err) {
+        logger.error(
+          "Error propagating a user override change to the calendar feeds (best-effort).",
+        );
+        logger.error(err);
+      }
+    }
+  }
+
   /**
    * Re-resolve the persisted roster of every schedule in the project that
    * contains the override user, so a created / updated / deleted override is
@@ -41,13 +153,8 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
     }
 
     try {
-      const scheduleService: {
-        refreshRostersForUserInProject: (d: {
-          projectId: ObjectID;
-          userId: ObjectID;
-        }) => Promise<void>;
-        // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
-      } = require("./OnCallDutyPolicyScheduleService").default;
+      const scheduleService: ScheduleServiceForOverrides =
+        this.getScheduleService();
 
       await scheduleService.refreshRostersForUserInProject({
         projectId: data.projectId,
@@ -190,6 +297,16 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       overrideUserId,
     });
 
+    if (projectId && overrideUserId) {
+      await this.propagateShiftChangeForOverrides([
+        {
+          projectId,
+          overrideUserId,
+          routeAlertsToUserId: routeAlertsToUserId || undefined,
+        },
+      ]);
+    }
+
     return createdItem;
   }
 
@@ -207,10 +324,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
      * schedules by the NEW user only (audit M2). Mirrors the onBeforeDelete
      * carry-forward pattern used by the delete path.
      */
-    const previous: Array<{
-      projectId: ObjectID;
-      overrideUserId: ObjectID;
-    }> = [];
+    const previous: Array<OverrideUserPair> = [];
 
     try {
       const rows: Array<OnCallDutyPolicyUserOverride> = await this.findBy({
@@ -218,6 +332,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
         select: {
           projectId: true,
           overrideUserId: true,
+          routeAlertsToUserId: true,
         },
         props: {
           isRoot: true,
@@ -231,8 +346,14 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
           row.projectId || row.project?.id;
         const overrideUserId: ObjectID | undefined | null =
           row.overrideUserId || row.overrideUser?.id;
+        const routeAlertsToUserId: ObjectID | undefined | null =
+          row.routeAlertsToUserId || row.routeAlertsToUser?.id;
         if (projectId && overrideUserId) {
-          previous.push({ projectId, overrideUserId });
+          previous.push({
+            projectId,
+            overrideUserId,
+            routeAlertsToUserId: routeAlertsToUserId || undefined,
+          });
         }
       }
     } catch (err) {
@@ -279,11 +400,11 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
     };
 
     // OLD override users captured before the update.
-    const previous: Array<{ projectId: ObjectID; overrideUserId: ObjectID }> =
-      (onUpdate.carryForward as Array<{
-        projectId: ObjectID;
-        overrideUserId: ObjectID;
-      }>) || [];
+    const previous: Array<OverrideUserPair> =
+      (onUpdate.carryForward as Array<OverrideUserPair>) || [];
+
+    // Everyone the edit touched, old and new, for the feed / reminder pass.
+    const affectedPairs: Array<OverrideUserPair> = [...previous];
 
     for (const entry of previous) {
       await refreshPair(entry.projectId, entry.overrideUserId);
@@ -296,6 +417,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
         select: {
           projectId: true,
           overrideUserId: true,
+          routeAlertsToUserId: true,
         },
         props: {
           isRoot: true,
@@ -306,12 +428,26 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
         continue;
       }
 
-      await refreshPair(
-        item.projectId || item.project?.id,
-        item.overrideUserId || item.overrideUser?.id,
-      );
+      const newProjectId: ObjectID | undefined | null =
+        item.projectId || item.project?.id;
+      const newOverrideUserId: ObjectID | undefined | null =
+        item.overrideUserId || item.overrideUser?.id;
+      const newRouteAlertsToUserId: ObjectID | undefined | null =
+        item.routeAlertsToUserId || item.routeAlertsToUser?.id;
+
+      await refreshPair(newProjectId, newOverrideUserId);
+
+      if (newProjectId && newOverrideUserId) {
+        affectedPairs.push({
+          projectId: newProjectId,
+          overrideUserId: newOverrideUserId,
+          routeAlertsToUserId: newRouteAlertsToUserId || undefined,
+        });
+      }
     }
 
+    await this.propagateShiftChangeForOverrides(affectedPairs);
+
     return onUpdate;
   }
 
@@ -326,11 +462,8 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
      * than waiting for the next natural handoff (audit F4). The affected
      * project/user pairs were captured in onBeforeDelete (the rows are gone now).
      */
-    const affected: Array<{ projectId: ObjectID; overrideUserId: ObjectID }> =
-      (onDelete.carryForward as Array<{
-        projectId: ObjectID;
-        overrideUserId: ObjectID;
-      }>) || [];
+    const affected: Array<OverrideUserPair> =
+      (onDelete.carryForward as Array<OverrideUserPair>) || [];
 
     for (const entry of affected) {
       await this.refreshRostersForOverrideUser({
@@ -339,6 +472,8 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
       });
     }
 
+    await this.propagateShiftChangeForOverrides(affected);
+
     return onDelete;
   }
 
@@ -368,10 +503,7 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
      * onDeleteSuccess can refresh those schedules' rosters AFTER the rows are
      * gone (audit F4). Collected for global overrides too (no policy id).
      */
-    const affectedRosters: Array<{
-      projectId: ObjectID;
-      overrideUserId: ObjectID;
-    }> = [];
+    const affectedRosters: Array<OverrideUserPair> = [];
 
     for (const item of itemsToDelete) {
       const onCallDutyPolicyId: ObjectID | undefined | null =
@@ -387,7 +519,11 @@ export class Service extends DatabaseService<OnCallDutyPolicyUserOverride> {
         item.routeAlertsToUserId || item.routeAlertsToUser?.id;
 
       if (projectId && overrideUserId) {
-        affectedRosters.push({ projectId, overrideUserId });
+        affectedRosters.push({
+          projectId,
+          overrideUserId,
+          routeAlertsToUserId: routeAlertsToUserId || undefined,
+        });
       }
 
       if (

package/Server/Services/PodmanHostLabelRuleEngineService.ts

@@ -9,6 +9,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class PodmanHostLabelRuleEngineServiceClass {
   /**
@@ -38,10 +40,16 @@ class PodmanHostLabelRuleEngineServiceClass {
             podmanHostDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "PodmanHostLabelRule",
+        projectId: podmanHost.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/PodmanHostOwnerRuleEngineService.ts

@@ -13,6 +13,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class PodmanHostOwnerRuleEngineServiceClass {
   /**
@@ -45,10 +47,16 @@ class PodmanHostOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "PodmanHostOwnerRule",
+        projectId: podmanHost.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/ProjectOnCallCalendarFeedService.ts

@@ -0,0 +1,192 @@
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import DatabaseService from "./DatabaseService";
+import {
+  MAX_MINIMUM_GAP_MINUTES,
+  MIN_MINIMUM_GAP_MINUTES,
+} from "./OnCallDutyPolicyScheduleCalendarFeedService";
+import CalendarFeedToken, {
+  CalendarFeedRotation,
+} from "../Utils/OnCall/CalendarFeedToken";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import Model from "../../Models/DatabaseModels/ProjectOnCallCalendarFeed";
+import BadDataException from "../../Types/Exception/BadDataException";
+import NotFoundException from "../../Types/Exception/NotFoundException";
+import CalendarFeedWindow from "../../Types/OnCallDutyPolicy/CalendarFeedWindow";
+import ObjectID from "../../Types/ObjectID";
+import PositiveNumber from "../../Types/PositiveNumber";
+
+/*
+ * The project-wide shared calendar feed: at most one row per project.
+ *
+ * The same guarantees as OnCallDutyPolicyScheduleCalendarFeedService minus
+ * the schedule check: one feed per project (unique index + a readable
+ * message), the token minted here on every create whatever the request
+ * carried, window and gap settings bounded on every write, root-only
+ * rotation with the 30-day grace hash.
+ */
+export class Service extends DatabaseService<Model> {
+  public constructor() {
+    super(Model);
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    const projectId: ObjectID | undefined =
+      createBy.data.projectId || createBy.props.tenantId;
+
+    if (!projectId) {
+      throw new BadDataException("projectId is required");
+    }
+
+    createBy.data.projectId = projectId;
+
+    const existing: PositiveNumber = await this.countBy({
+      query: {
+        projectId: projectId,
+      },
+      props: {
+        isRoot: true,
+      },
+    });
+
+    if (existing.toNumber() > 0) {
+      throw new BadDataException(
+        "This project already has a shared calendar feed. Regenerate or edit the existing one instead.",
+      );
+    }
+
+    // A request body never chooses the secret; only root may pre-mint one.
+    CalendarFeedToken.applyTokenColumnsOnCreate(createBy.data, {
+      trustSuppliedToken: createBy.props.isRoot === true,
+    });
+
+    createBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+      createBy.data.pastDays,
+    );
+    createBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+      createBy.data.futureDays,
+    );
+
+    if (createBy.data.minimumGapMinutes !== undefined) {
+      createBy.data.minimumGapMinutes = Service.validateMinimumGapMinutes(
+        createBy.data.minimumGapMinutes,
+      );
+    }
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    if (updateBy.data.pastDays !== undefined) {
+      updateBy.data.pastDays = CalendarFeedWindow.clampPastDays(
+        updateBy.data.pastDays,
+      );
+    }
+
+    if (updateBy.data.futureDays !== undefined) {
+      updateBy.data.futureDays = CalendarFeedWindow.clampFutureDays(
+        updateBy.data.futureDays,
+      );
+    }
+
+    if (updateBy.data.minimumGapMinutes !== undefined) {
+      updateBy.data.minimumGapMinutes = Service.validateMinimumGapMinutes(
+        updateBy.data.minimumGapMinutes,
+      );
+    }
+
+    return { updateBy, carryForward: null };
+  }
+
+  public static validateMinimumGapMinutes(value: unknown): number {
+    const parsed: number =
+      typeof value === "string" && value.trim() !== ""
+        ? Number(value)
+        : (value as number);
+
+    if (
+      typeof parsed !== "number" ||
+      !Number.isInteger(parsed) ||
+      parsed < MIN_MINIMUM_GAP_MINUTES ||
+      parsed > MAX_MINIMUM_GAP_MINUTES
+    ) {
+      throw new BadDataException(
+        `Minimum gap must be a whole number of minutes between ${MIN_MINIMUM_GAP_MINUTES} and ${MAX_MINIMUM_GAP_MINUTES}.`,
+      );
+    }
+
+    return parsed;
+  }
+
+  /**
+   * Rotate the token of an existing feed. Returns the new plaintext token
+   * ONCE. Root write; the caller purges caches.
+   */
+  @CaptureSpan()
+  public async rotateTokenById(data: {
+    id: ObjectID;
+  }): Promise<CalendarFeedRotation> {
+    const existing: Model | null = await this.findOneBy({
+      query: { _id: data.id },
+      select: { _id: true, tokenHash: true },
+      props: { isRoot: true, ignoreHooks: true },
+    });
+
+    if (!existing) {
+      throw new NotFoundException("Calendar feed not found.");
+    }
+
+    const rotation: CalendarFeedRotation = CalendarFeedToken.buildRotation({
+      currentTokenHash: existing.tokenHash,
+    });
+
+    await this.updateOneById({
+      id: data.id,
+      data: CalendarFeedToken.toRotationUpdateData(rotation),
+      props: { isRoot: true },
+    });
+
+    return rotation;
+  }
+
+  /**
+   * Rotate the project's feed when a member leaves, if it is enabled and
+   * opted in. Returns the rotated id (at most one) for cache purging.
+   */
+  @CaptureSpan()
+  public async rotateFeedsForMemberLeave(data: {
+    projectId: ObjectID;
+  }): Promise<Array<ObjectID>> {
+    const feed: Model | null = await this.findOneBy({
+      query: {
+        projectId: data.projectId,
+        isEnabled: true,
+        rotateWhenMemberLeaves: true,
+      },
+      select: {
+        _id: true,
+      },
+      props: {
+        isRoot: true,
+        ignoreHooks: true,
+      },
+    });
+
+    if (!feed || !feed.id) {
+      return [];
+    }
+
+    await this.rotateTokenById({ id: feed.id });
+
+    return [feed.id];
+  }
+}
+
+export default new Service();

package/Server/Services/ProxmoxClusterLabelRuleEngineService.ts

@@ -9,6 +9,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class ProxmoxClusterLabelRuleEngineServiceClass {
   /**
@@ -40,10 +42,16 @@ class ProxmoxClusterLabelRuleEngineServiceClass {
             proxmoxClusterDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "ProxmoxClusterLabelRule",
+        projectId: proxmoxCluster.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/ProxmoxClusterOwnerRuleEngineService.ts

@@ -13,6 +13,8 @@ import { Purple500 } from "../../Types/BrandColors";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class ProxmoxClusterOwnerRuleEngineServiceClass {
   /**
@@ -47,10 +49,16 @@ class ProxmoxClusterOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "ProxmoxClusterOwnerRule",
+        projectId: proxmoxCluster.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/RumApplicationLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import RumApplicationService from "./RumApplicationService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class RumApplicationLabelRuleEngineServiceClass {
   /**
@@ -37,10 +39,16 @@ class RumApplicationLabelRuleEngineServiceClass {
             descriptionRegexPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "RumApplicationLabelRule",
+        projectId: rumApplication.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/RumApplicationOwnerRuleEngineService.ts

@@ -10,6 +10,8 @@ import RumApplicationService from "./RumApplicationService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class RumApplicationOwnerRuleEngineServiceClass {
   /**
@@ -43,10 +45,16 @@ class RumApplicationOwnerRuleEngineServiceClass {
             ownerUsers: { _id: true },
             ownerTeams: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "RumApplicationOwnerRule",
+        projectId: rumApplication.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }

package/Server/Services/RunbookLabelRuleEngineService.ts

@@ -6,6 +6,8 @@ import RunbookService from "./RunbookService";
 import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class RunbookLabelRuleEngineServiceClass {
   /**
@@ -35,10 +37,16 @@ class RunbookLabelRuleEngineServiceClass {
             runbookDescriptionPattern: true,
             labelsToAdd: { _id: true },
           },
-          limit: 100,
+          limit: MAX_RULES_EVALUATED_PER_PROJECT,
           skip: 0,
         });
 
+      logIfRuleReadWasTruncated({
+        ruleKind: "RunbookLabelRule",
+        projectId: runbook.projectId,
+        rulesRead: rules.length,
+      });
+
       if (rules.length === 0) {
         return;
       }