@oneuptime/common 13.0.1 → 13.0.3

package/Server/Services/IncomingCallPolicyPhoneNumberService.ts

@@ -0,0 +1,184 @@
+import DatabaseService from "./DatabaseService";
+import IncomingCallPolicyPhoneNumber from "../../Models/DatabaseModels/IncomingCallPolicyPhoneNumber";
+import IncomingCallPolicy from "../../Models/DatabaseModels/IncomingCallPolicy";
+import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import DeleteBy from "../Types/Database/DeleteBy";
+import ObjectID from "../../Types/ObjectID";
+import SortOrder from "../../Types/BaseDatabase/SortOrder";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import logger from "../Utils/Logger";
+
+const incomingCallPolicyDatabaseService: DatabaseService<IncomingCallPolicy> =
+  new DatabaseService<IncomingCallPolicy>(IncomingCallPolicy);
+
+const compatibilityPolicyDatabaseService: {
+  updateOneById: (data: {
+    id: ObjectID;
+    data: Partial<IncomingCallPolicy>;
+    props: { isRoot: boolean };
+  }) => Promise<unknown>;
+} = incomingCallPolicyDatabaseService as unknown as {
+  updateOneById: (data: {
+    id: ObjectID;
+    data: Partial<IncomingCallPolicy>;
+    props: { isRoot: boolean };
+  }) => Promise<unknown>;
+};
+
+export class Service extends DatabaseService<IncomingCallPolicyPhoneNumber> {
+  public constructor() {
+    super(IncomingCallPolicyPhoneNumber);
+  }
+
+  /**
+   * The child rows are the source of truth, but older dashboard clients still
+   * read the scalar phone-number fields on IncomingCallPolicy. Mirror the
+   * oldest attached number there until those clients have all migrated.
+   */
+  public async syncPrimaryPhoneNumberToPolicy(
+    incomingCallPolicyId: ObjectID,
+  ): Promise<void> {
+    const primaryPhoneNumber: IncomingCallPolicyPhoneNumber | null =
+      await this.findOneBy({
+        query: {
+          incomingCallPolicyId,
+        },
+        select: {
+          phoneNumber: true,
+          callProviderPhoneNumberId: true,
+          projectCallSMSConfigId: true,
+          countryCode: true,
+          areaCode: true,
+          phoneNumberPurchasedAt: true,
+        },
+        sort: {
+          createdAt: SortOrder.Ascending,
+          _id: SortOrder.Ascending,
+        },
+        props: {
+          isRoot: true,
+        },
+      });
+
+    const compatibilityData: Partial<IncomingCallPolicy> = {
+      routingPhoneNumber: primaryPhoneNumber?.phoneNumber ?? null,
+      callProviderPhoneNumberId:
+        primaryPhoneNumber?.callProviderPhoneNumberId ?? null,
+      phoneNumberCountryCode: primaryPhoneNumber?.countryCode ?? null,
+      phoneNumberAreaCode: primaryPhoneNumber?.areaCode ?? null,
+      phoneNumberPurchasedAt:
+        primaryPhoneNumber?.phoneNumberPurchasedAt ?? null,
+      /*
+       * Database columns are nullable even though PartialEntity does not
+       * currently model null separately from undefined.
+       */
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    } as any;
+
+    /*
+     * All attached numbers normally share a config. Promoting the primary
+     * child's config also repairs older mixed-config data after one config is
+     * deleted. Do not clear the config when the final number is removed: the
+     * policy needs that selection in order to add its next number.
+     */
+    if (primaryPhoneNumber?.projectCallSMSConfigId) {
+      compatibilityData.projectCallSMSConfigId =
+        primaryPhoneNumber.projectCallSMSConfigId;
+    }
+
+    await compatibilityPolicyDatabaseService.updateOneById({
+      id: incomingCallPolicyId,
+      data: compatibilityData,
+      props: {
+        isRoot: true,
+      },
+    });
+  }
+
+  private async syncPrimaryPhoneNumberToPolicyBestEffort(
+    incomingCallPolicyId: ObjectID,
+  ): Promise<void> {
+    try {
+      await this.syncPrimaryPhoneNumberToPolicy(incomingCallPolicyId);
+    } catch (error) {
+      /*
+       * The child row has already been committed/deleted when success hooks
+       * run. Do not turn a compatibility-mirror failure into a false provider
+       * rollback or a failed release response; the child table remains the
+       * authoritative state and a later mutation will repair the mirror.
+       */
+      logger.error(
+        `Failed to mirror incoming call phone numbers to policy ${incomingCallPolicyId.toString()}`,
+      );
+      logger.error(error);
+    }
+  }
+
+  protected override async onCreateSuccess(
+    _onCreate: OnCreate<IncomingCallPolicyPhoneNumber>,
+    createdItem: IncomingCallPolicyPhoneNumber,
+  ): Promise<IncomingCallPolicyPhoneNumber> {
+    if (createdItem.incomingCallPolicyId) {
+      await this.syncPrimaryPhoneNumberToPolicyBestEffort(
+        createdItem.incomingCallPolicyId,
+      );
+    }
+
+    return createdItem;
+  }
+
+  protected override async onBeforeDelete(
+    deleteBy: DeleteBy<IncomingCallPolicyPhoneNumber>,
+  ): Promise<OnDelete<IncomingCallPolicyPhoneNumber>> {
+    const phoneNumbers: Array<IncomingCallPolicyPhoneNumber> =
+      await this.findBy({
+        query: deleteBy.query,
+        select: {
+          incomingCallPolicyId: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+    const incomingCallPolicyIdMap: Map<string, ObjectID> = new Map();
+    for (const phoneNumber of phoneNumbers) {
+      if (phoneNumber.incomingCallPolicyId) {
+        incomingCallPolicyIdMap.set(
+          phoneNumber.incomingCallPolicyId.toString(),
+          phoneNumber.incomingCallPolicyId,
+        );
+      }
+    }
+
+    const incomingCallPolicyIds: Array<ObjectID> = Array.from(
+      incomingCallPolicyIdMap.values(),
+    );
+
+    return {
+      deleteBy,
+      carryForward: incomingCallPolicyIds,
+    };
+  }
+
+  protected override async onDeleteSuccess(
+    onDelete: OnDelete<IncomingCallPolicyPhoneNumber>,
+    _itemIdsBeforeDelete: Array<ObjectID>,
+  ): Promise<OnDelete<IncomingCallPolicyPhoneNumber>> {
+    const incomingCallPolicyIds: Array<ObjectID> =
+      (onDelete.carryForward as Array<ObjectID>) || [];
+
+    for (const incomingCallPolicyId of incomingCallPolicyIds) {
+      await this.syncPrimaryPhoneNumberToPolicyBestEffort(incomingCallPolicyId);
+    }
+
+    return {
+      deleteBy: onDelete.deleteBy,
+      carryForward: null,
+    };
+  }
+}
+
+export default new Service();

package/Server/Services/IncomingCallPolicyService.ts

@@ -2,22 +2,227 @@ import DatabaseService from "./DatabaseService";
 import IncomingCallPolicy from "../../Models/DatabaseModels/IncomingCallPolicy";
 import IncomingCallPolicyLabelRuleEngineService from "./IncomingCallPolicyLabelRuleEngineService";
 import IncomingCallPolicyOwnerRuleEngineService from "./IncomingCallPolicyOwnerRuleEngineService";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import DeleteBy from "../Types/Database/DeleteBy";
-import LIMIT_MAX from "../../Types/Database/LimitMax";
+import UpdateBy from "../Types/Database/UpdateBy";
 import releaseIncomingCallPhoneNumber from "../Utils/IncomingCallPhoneNumber";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
+import IncomingCallPolicyPhoneNumberService from "./IncomingCallPolicyPhoneNumberService";
+import IncomingCallPolicyPhoneNumber from "../../Models/DatabaseModels/IncomingCallPolicyPhoneNumber";
+import BadDataException from "../../Types/Exception/BadDataException";
+import QueryHelper from "../Types/Database/QueryHelper";
+import ObjectID from "../../Types/ObjectID";
+import ModelPermission from "../Types/Database/Permissions/Index";
+
+function normalizeProjectCallSMSConfigIdValue(
+  value: unknown,
+): string | null | undefined {
+  if (value === null) {
+    return null;
+  }
+
+  if (typeof value === "string" || value instanceof ObjectID) {
+    return value.toString().trim().toLowerCase();
+  }
+
+  return undefined;
+}
+
+function normalizeProjectCallSMSConfigId(
+  value: unknown,
+): string | null | undefined {
+  const directId: string | null | undefined =
+    normalizeProjectCallSMSConfigIdValue(value);
+
+  if (directId !== undefined) {
+    return directId;
+  }
+
+  if (typeof value !== "object" || value === undefined) {
+    return undefined;
+  }
+
+  const relation: { id?: unknown; _id?: unknown } = value as {
+    id?: unknown;
+    _id?: unknown;
+  };
+  const persistedId: string | null | undefined =
+    normalizeProjectCallSMSConfigIdValue(relation._id);
+  const publicId: string | null | undefined =
+    normalizeProjectCallSMSConfigIdValue(relation.id);
+
+  if (
+    persistedId !== undefined &&
+    publicId !== undefined &&
+    persistedId !== publicId
+  ) {
+    throw new BadDataException(
+      "Conflicting Twilio configuration identifiers were provided.",
+    );
+  }
+
+  /*
+   * TypeORM persists `_id`, while model instances also expose `id`. Prefer the
+   * persisted value after proving both representations agree so a crafted
+   * relation object cannot make the invariant inspect one config and save
+   * another.
+   */
+  return persistedId !== undefined ? persistedId : publicId;
+}
 
 export class Service extends DatabaseService<IncomingCallPolicy> {
   public constructor() {
     super(IncomingCallPolicy);
   }
 
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<IncomingCallPolicy>,
+  ): Promise<OnUpdate<IncomingCallPolicy>> {
+    const hasProjectCallSMSConfigId: boolean =
+      Object.prototype.hasOwnProperty.call(
+        updateBy.data,
+        "projectCallSMSConfigId",
+      );
+    const hasProjectCallSMSConfig: boolean =
+      Object.prototype.hasOwnProperty.call(
+        updateBy.data,
+        "projectCallSMSConfig",
+      );
+
+    const requestedProjectCallSMSConfigIds: Array<string | null> = [];
+
+    if (hasProjectCallSMSConfigId) {
+      const configId: string | null | undefined =
+        normalizeProjectCallSMSConfigId(updateBy.data.projectCallSMSConfigId);
+
+      if (configId !== undefined) {
+        requestedProjectCallSMSConfigIds.push(configId);
+      }
+    }
+
+    if (hasProjectCallSMSConfig) {
+      const configId: string | null | undefined =
+        normalizeProjectCallSMSConfigId(updateBy.data.projectCallSMSConfig);
+
+      if (configId !== undefined) {
+        requestedProjectCallSMSConfigIds.push(configId);
+      }
+    }
+
+    if (requestedProjectCallSMSConfigIds.length > 0) {
+      /*
+       * Hooks run before DatabaseService applies update permissions. Scope the
+       * query here before inspecting rows, otherwise the invariant itself can
+       * disclose or block policies that the caller is not allowed to update.
+       * DatabaseService deliberately checks it again immediately before the
+       * write, preserving its normal authorization boundary.
+       */
+      updateBy.query = await ModelPermission.checkUpdateQueryPermissions(
+        IncomingCallPolicy,
+        updateBy.query,
+        updateBy.data,
+        updateBy.props,
+      );
+
+      const policies: Array<IncomingCallPolicy> = await this.findBy({
+        query: updateBy.query,
+        select: {
+          _id: true,
+          projectCallSMSConfigId: true,
+          routingPhoneNumber: true,
+          callProviderPhoneNumberId: true,
+        },
+        limit: updateBy.limit,
+        skip: updateBy.skip,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      const policiesChangingConfig: Array<IncomingCallPolicy> = policies.filter(
+        (policy: IncomingCallPolicy): boolean => {
+          const currentConfigId: string | null =
+            policy.projectCallSMSConfigId?.toString().trim().toLowerCase() ||
+            null;
+
+          return requestedProjectCallSMSConfigIds.some(
+            (requestedConfigId: string | null): boolean => {
+              return requestedConfigId !== currentConfigId;
+            },
+          );
+        },
+      );
+
+      const hasLegacyPhoneNumber: boolean = policiesChangingConfig.some(
+        (policy: IncomingCallPolicy): boolean => {
+          return Boolean(
+            policy.routingPhoneNumber || policy.callProviderPhoneNumberId,
+          );
+        },
+      );
+
+      if (hasLegacyPhoneNumber) {
+        throw new BadDataException(
+          "Release all phone numbers before changing the Twilio configuration.",
+        );
+      }
+
+      const policyIds: Array<ObjectID> = policiesChangingConfig
+        .map((policy: IncomingCallPolicy): ObjectID | null | undefined => {
+          return policy.id;
+        })
+        .filter(
+          (policyId: ObjectID | null | undefined): policyId is ObjectID => {
+            return Boolean(policyId);
+          },
+        );
+
+      if (policyIds.length > 0) {
+        const attachedPhoneNumber: IncomingCallPolicyPhoneNumber | null =
+          await IncomingCallPolicyPhoneNumberService.findOneBy({
+            query: {
+              incomingCallPolicyId: QueryHelper.any(policyIds),
+            },
+            select: {
+              _id: true,
+            },
+            props: {
+              isRoot: true,
+            },
+          });
+
+        if (attachedPhoneNumber) {
+          throw new BadDataException(
+            "Release all phone numbers before changing the Twilio configuration.",
+          );
+        }
+      }
+    }
+
+    return {
+      updateBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<IncomingCallPolicy>,
   ): Promise<OnDelete<IncomingCallPolicy>> {
+    /*
+     * The delete hook performs provider side effects before DatabaseService's
+     * normal delete permission check. Apply that exact scope first so a
+     * denied delete cannot release phone numbers belonging to another tenant
+     * or access-control scope.
+     */
+    deleteBy.query = await ModelPermission.checkDeleteQueryPermission(
+      IncomingCallPolicy,
+      deleteBy.query,
+      deleteBy.props,
+    );
+
     /*
      * Release any provisioned numbers before the policy rows are removed so we
      * don't leave paid, orphaned numbers on the provider that can never be
@@ -30,15 +235,81 @@ export class Service extends DatabaseService<IncomingCallPolicy> {
         callProviderPhoneNumberId: true,
         projectCallSMSConfigId: true,
       },
-      limit: LIMIT_MAX,
-      skip: 0,
+      limit: deleteBy.limit,
+      skip: deleteBy.skip,
       props: {
         isRoot: true,
       },
     });
 
+    const policyIds: Array<ObjectID> = policies
+      .map((policy: IncomingCallPolicy): ObjectID | null => {
+        return policy.id;
+      })
+      .filter((policyId: ObjectID | null): policyId is ObjectID => {
+        return Boolean(policyId);
+      });
+
+    /*
+     * Provider calls can take long enough for the original offset/limit window
+     * to shift. Pin the final database delete to this exact snapshot before
+     * making any external calls. DatabaseService re-applies permissions to
+     * this id query immediately before deleting.
+     */
+    deleteBy.query = {
+      _id: QueryHelper.any(policyIds),
+    };
+    deleteBy.skip = 0;
+    deleteBy.limit = policyIds.length;
+
     for (const policy of policies) {
-      if (policy.callProviderPhoneNumberId && policy.projectCallSMSConfigId) {
+      if (!policy.id) {
+        continue;
+      }
+
+      const phoneNumbers: Array<IncomingCallPolicyPhoneNumber> =
+        await IncomingCallPolicyPhoneNumberService.findAllBy({
+          query: {
+            incomingCallPolicyId: policy.id,
+          },
+          select: {
+            callProviderPhoneNumberId: true,
+            projectCallSMSConfigId: true,
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+
+      const releasedProviderPhoneNumberIds: Set<string> = new Set();
+
+      for (const phoneNumber of phoneNumbers) {
+        if (
+          !phoneNumber.callProviderPhoneNumberId ||
+          !phoneNumber.projectCallSMSConfigId
+        ) {
+          continue;
+        }
+
+        await releaseIncomingCallPhoneNumber({
+          projectCallSMSConfigId: phoneNumber.projectCallSMSConfigId,
+          callProviderPhoneNumberId: phoneNumber.callProviderPhoneNumberId,
+        });
+
+        releasedProviderPhoneNumberIds.add(
+          phoneNumber.callProviderPhoneNumberId,
+        );
+      }
+
+      /*
+       * Compatibility for policies which still use the scalar-only layout:
+       * do not orphan their provider number while normalized rows are absent.
+       */
+      if (
+        policy.callProviderPhoneNumberId &&
+        policy.projectCallSMSConfigId &&
+        !releasedProviderPhoneNumberIds.has(policy.callProviderPhoneNumberId)
+      ) {
         await releaseIncomingCallPhoneNumber({
           projectCallSMSConfigId: policy.projectCallSMSConfigId,
           callProviderPhoneNumberId: policy.callProviderPhoneNumberId,

package/Server/Services/Index.ts

@@ -415,6 +415,7 @@ import HostOwnerRuleService from "./HostOwnerRuleService";
 import HostOwnerTeamService from "./HostOwnerTeamService";
 import HostOwnerUserService from "./HostOwnerUserService";
 import IncomingCallPolicyService from "./IncomingCallPolicyService";
+import IncomingCallPolicyPhoneNumberService from "./IncomingCallPolicyPhoneNumberService";
 import PushNotificationLogService from "./PushNotificationLogService";
 import RunnerOwnerTeamService from "./RunnerOwnerTeamService";
 import RunnerOwnerUserService from "./RunnerOwnerUserService";
@@ -854,6 +855,7 @@ const services: Array<BaseService> = [
   HostOwnerTeamService,
   HostOwnerUserService,
   IncomingCallPolicyService,
+  IncomingCallPolicyPhoneNumberService,
   IncomingCallPolicyEscalationRuleService,
   IncomingCallPolicyLabelRuleService,
   IncomingCallPolicyOwnerRuleService,

package/Server/Services/IoTFleetLabelRuleEngineService.ts

@@ -7,6 +7,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class IoTFleetLabelRuleEngineServiceClass {
@@ -32,6 +33,7 @@ class IoTFleetLabelRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             iotFleetLabels: { _id: true },
             iotFleetNamePattern: true,
             iotFleetDescriptionPattern: true,
@@ -141,6 +143,24 @@ class IoTFleetLabelRuleEngineServiceClass {
   private doesIoTFleetMatchRule(
     iotFleet: IoTFleet,
     rule: IoTFleetLabelRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule,
+      legacyFields: [
+        "iotFleetLabels",
+        "iotFleetNamePattern",
+        "iotFleetDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (legacyRule: IoTFleetLabelRule): boolean => {
+        return this.doesIoTFleetMatchLegacyRule(iotFleet, legacyRule);
+      },
+    });
+  }
+
+  private doesIoTFleetMatchLegacyRule(
+    iotFleet: IoTFleet,
+    rule: IoTFleetLabelRule,
   ): boolean {
     if (rule.iotFleetLabels && rule.iotFleetLabels.length > 0) {
       if (!iotFleet.labels || iotFleet.labels.length === 0) {

package/Server/Services/IoTFleetOwnerRuleEngineService.ts

@@ -11,6 +11,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class IoTFleetOwnerRuleEngineServiceClass {
@@ -37,6 +38,7 @@ class IoTFleetOwnerRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             notifyOwners: true,
             iotFleetLabels: { _id: true },
             iotFleetNamePattern: true,
@@ -159,6 +161,24 @@ class IoTFleetOwnerRuleEngineServiceClass {
   private doesIoTFleetMatchRule(
     iotFleet: IoTFleet,
     rule: IoTFleetOwnerRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule,
+      legacyFields: [
+        "iotFleetLabels",
+        "iotFleetNamePattern",
+        "iotFleetDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (legacyRule: IoTFleetOwnerRule): boolean => {
+        return this.doesIoTFleetMatchLegacyRule(iotFleet, legacyRule);
+      },
+    });
+  }
+
+  private doesIoTFleetMatchLegacyRule(
+    iotFleet: IoTFleet,
+    rule: IoTFleetOwnerRule,
   ): boolean {
     if (rule.iotFleetLabels && rule.iotFleetLabels.length > 0) {
       if (!iotFleet.labels || iotFleet.labels.length === 0) {

package/Server/Services/KubernetesClusterLabelRuleEngineService.ts

@@ -10,6 +10,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class KubernetesClusterLabelRuleEngineServiceClass {
@@ -37,6 +38,7 @@ class KubernetesClusterLabelRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             kubernetesClusterLabels: { _id: true },
             kubernetesClusterNamePattern: true,
             kubernetesClusterDescriptionPattern: true,
@@ -175,6 +177,27 @@ class KubernetesClusterLabelRuleEngineServiceClass {
   private doesKubernetesClusterMatchRule(
     kubernetesCluster: KubernetesCluster,
     rule: KubernetesClusterLabelRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule,
+      legacyFields: [
+        "kubernetesClusterLabels",
+        "kubernetesClusterNamePattern",
+        "kubernetesClusterDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (legacyRule: KubernetesClusterLabelRule): boolean => {
+        return this.doesKubernetesClusterMatchLegacyRule(
+          kubernetesCluster,
+          legacyRule,
+        );
+      },
+    });
+  }
+
+  private doesKubernetesClusterMatchLegacyRule(
+    kubernetesCluster: KubernetesCluster,
+    rule: KubernetesClusterLabelRule,
   ): boolean {
     if (
       rule.kubernetesClusterLabels &&

package/Server/Services/KubernetesClusterOwnerRuleEngineService.ts

@@ -14,6 +14,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class KubernetesClusterOwnerRuleEngineServiceClass {
@@ -42,6 +43,7 @@ class KubernetesClusterOwnerRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             notifyOwners: true,
             kubernetesClusterLabels: { _id: true },
             kubernetesClusterNamePattern: true,
@@ -187,6 +189,27 @@ class KubernetesClusterOwnerRuleEngineServiceClass {
   private doesKubernetesClusterMatchRule(
     kubernetesCluster: KubernetesCluster,
     rule: KubernetesClusterOwnerRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule,
+      legacyFields: [
+        "kubernetesClusterLabels",
+        "kubernetesClusterNamePattern",
+        "kubernetesClusterDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (legacyRule: KubernetesClusterOwnerRule): boolean => {
+        return this.doesKubernetesClusterMatchLegacyRule(
+          kubernetesCluster,
+          legacyRule,
+        );
+      },
+    });
+  }
+
+  private doesKubernetesClusterMatchLegacyRule(
+    kubernetesCluster: KubernetesCluster,
+    rule: KubernetesClusterOwnerRule,
   ): boolean {
     if (
       rule.kubernetesClusterLabels &&