@oneuptime/common 13.0.1 → 13.0.3

package/Server/Services/ServiceLevelObjectiveService.ts

@@ -221,9 +221,10 @@ export class Service extends DatabaseService<Model> {
     updatedItemIds: Array<ObjectID>,
   ): Promise<OnUpdate<Model>> {
     /*
-     * When an SLO is disabled, resolve its open burn-rate alerts — the
-     * evaluation worker skips disabled SLOs, so nothing else would ever
-     * resolve them (and their on-call escalations would stay open forever).
+     * When an SLO is disabled, resolve everything its burn-rate rules have
+     * open — the evaluation worker skips disabled SLOs, so nothing else
+     * would ever resolve them (and their on-call escalations would stay
+     * open forever).
      */
     if ((onUpdate.updateBy.data.isEnabled as boolean | undefined) === false) {
       for (const updatedItemId of updatedItemIds) {
@@ -242,13 +243,13 @@ export class Service extends DatabaseService<Model> {
             continue;
           }
 
-          await this.resolveOpenBurnRateAlertsForSlo({
+          await this.resolveOpenBurnRateAlertsAndIncidentsForSlo({
             sloId: updatedItemId,
             projectId: slo.projectId,
           });
         } catch (err) {
           logger.error(
-            `Error resolving open burn rate alerts for disabled SLO ${updatedItemId.toString()}: ${err}`,
+            `Error resolving open burn rate alerts and incidents for disabled SLO ${updatedItemId.toString()}: ${err}`,
           );
         }
       }
@@ -332,13 +333,13 @@ export class Service extends DatabaseService<Model> {
       }
 
       try {
-        await this.resolveOpenBurnRateAlertsForSlo({
+        await this.resolveOpenBurnRateAlertsAndIncidentsForSlo({
           sloId: item.id,
           projectId: item.projectId,
         });
       } catch (err) {
         logger.error(
-          `Error resolving open burn rate alerts for SLO ${item.id?.toString()} before delete: ${err}`,
+          `Error resolving open burn rate alerts and incidents for SLO ${item.id?.toString()} before delete: ${err}`,
           { projectId: item.projectId?.toString() } as LogAttributes,
         );
       }
@@ -353,11 +354,12 @@ export class Service extends DatabaseService<Model> {
   }
 
   /*
-   * Resolve every open Alert fired by any of this SLO's burn rate rules.
-   * Called when the SLO is disabled or deleted.
+   * Resolve everything any of this SLO's burn rate rules has left open — the
+   * Alerts they raised and the Incidents they declared. Called when the SLO is
+   * disabled or deleted, and by the worker's Misconfigured / Paused guards.
    */
   @CaptureSpan()
-  public async resolveOpenBurnRateAlertsForSlo(data: {
+  public async resolveOpenBurnRateAlertsAndIncidentsForSlo(data: {
     sloId: ObjectID;
     projectId: ObjectID;
   }): Promise<void> {
@@ -377,28 +379,68 @@ export class Service extends DatabaseService<Model> {
         },
       });
 
+    /*
+     * One rule failing must not skip the rest — but the failure must still
+     * REACH the caller. The worker's guard path (Paused / Misconfigured)
+     * deliberately resolves before it commits the new status so that a failed
+     * resolve is retried on the next tick; swallowing the error here would
+     * hand it a success, let it commit, and the next tick would see no
+     * transition and never retry, stranding the record and its on-call
+     * escalation forever. So: attempt every rule, then rethrow the first
+     * error.
+     *
+     * The lifecycle-hook callers (SLO disabled / deleted) already wrap this in
+     * their own try/catch, so propagating changes nothing for them.
+     */
+    let firstError: unknown = null;
+
     for (const rule of burnRateRules) {
       if (!rule.id) {
         continue;
       }
 
       try {
-        await ServiceLevelObjectiveBurnRateRuleService.resolveOpenAlertsForRule(
+        await ServiceLevelObjectiveBurnRateRuleService.resolveOpenAlertsAndIncidentsForRule(
           {
             serviceLevelObjectiveId: data.sloId,
             burnRateRuleId: rule.id,
             projectId: data.projectId,
             rootCause:
-              "Alert auto-resolved because the Service Level Objective was disabled or deleted.",
+              "Auto-resolved because the Service Level Objective was disabled or deleted.",
+          },
+        );
+
+        /*
+         * The rule's own lifecycle columns still say it has something open —
+         * this path deliberately does not stamp a resolve, because that would
+         * start a re-fire suppression window of up to the rule's long window.
+         * But the evaluation worker reads those same columns to decide whether
+         * an output is already open, so leaving them set silences the rule for
+         * the rest of the burn once the SLO is re-enabled. Forget the open
+         * state instead: nothing is open, and nothing just recovered.
+         */
+        await ServiceLevelObjectiveBurnRateRuleService.clearOpenOutputStateForRule(
+          {
+            burnRateRuleId: rule.id,
+            clearAlert: true,
+            clearIncident: true,
           },
         );
       } catch (err) {
         logger.error(
-          `Error resolving open alerts for burn rate rule ${rule.id?.toString()} of SLO ${data.sloId?.toString()}: ${err}`,
+          `Error resolving open alerts and incidents for burn rate rule ${rule.id?.toString()} of SLO ${data.sloId?.toString()}: ${err}`,
           { projectId: data.projectId?.toString() } as LogAttributes,
         );
+
+        if (firstError === null) {
+          firstError = err;
+        }
       }
     }
+
+    if (firstError !== null) {
+      throw firstError;
+    }
   }
 
   /*

package/Server/Services/ServiceOwnerRuleEngineService.ts

@@ -14,6 +14,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class ServiceOwnerRuleEngineServiceClass {
@@ -40,6 +41,7 @@ class ServiceOwnerRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             notifyOwners: true,
             serviceLabels: { _id: true },
             serviceNamePattern: true,
@@ -183,6 +185,24 @@ class ServiceOwnerRuleEngineServiceClass {
   private doesServiceMatchRule(
     service: Service,
     rule: ServiceOwnerRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "serviceLabels",
+        "serviceNamePattern",
+        "serviceDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (serviceRule: ServiceOwnerRule): boolean => {
+        return this.doesServiceMatchRuleLegacy(service, serviceRule);
+      },
+    });
+  }
+
+  private doesServiceMatchRuleLegacy(
+    service: Service,
+    rule: ServiceOwnerRule,
   ): boolean {
     if (rule.serviceLabels && rule.serviceLabels.length > 0) {
       if (!service.labels || service.labels.length === 0) {

package/Server/Services/StatusPageLabelRuleEngineService.ts

@@ -7,6 +7,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class StatusPageLabelRuleEngineServiceClass {
@@ -33,6 +34,7 @@ class StatusPageLabelRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             statusPageLabels: { _id: true },
             statusPageNamePattern: true,
             statusPageDescriptionPattern: true,
@@ -143,6 +145,24 @@ class StatusPageLabelRuleEngineServiceClass {
   private doesStatusPageMatchRule(
     statusPage: StatusPage,
     rule: StatusPageLabelRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "statusPageLabels",
+        "statusPageNamePattern",
+        "statusPageDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (statusPageRule: StatusPageLabelRule): boolean => {
+        return this.doesStatusPageMatchRuleLegacy(statusPage, statusPageRule);
+      },
+    });
+  }
+
+  private doesStatusPageMatchRuleLegacy(
+    statusPage: StatusPage,
+    rule: StatusPageLabelRule,
   ): boolean {
     if (rule.statusPageLabels && rule.statusPageLabels.length > 0) {
       if (!statusPage.labels || statusPage.labels.length === 0) {

package/Server/Services/StatusPageMonitorRuleEngineService.ts

@@ -5,6 +5,7 @@ import StatusPageResource from "../../Models/DatabaseModels/StatusPageResource";
 import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import ObjectID from "../../Types/ObjectID";
 import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
+import RuleCriteriaMatcher from "../../Utils/Rules/RuleCriteriaMatcher";
 import RulePatternMatchUtil from "../../Utils/Rules/RulePatternMatchUtil";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -71,6 +72,7 @@ const RULE_SELECT: {
   monitorLabels: { _id: true },
   monitorNamePattern: true,
   monitorDescriptionPattern: true,
+  criteria: true,
   showCurrentStatus: true,
   showUptimePercent: true,
   uptimePercentPrecision: true,
@@ -356,6 +358,27 @@ export class StatusPageMonitorRuleEngineServiceClass {
   public doesMonitorMatchRule(data: {
     monitor: Monitor;
     rule: StatusPageMonitorRule;
+  }): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: data.rule,
+      legacyFields: [
+        "monitorLabels",
+        "monitorNamePattern",
+        "monitorDescriptionPattern",
+      ],
+      emptyResult: false,
+      matchesLegacyRule: (legacyRule: StatusPageMonitorRule): boolean => {
+        return this.doesMonitorMatchLegacyRule({
+          monitor: data.monitor,
+          rule: legacyRule,
+        });
+      },
+    });
+  }
+
+  private doesMonitorMatchLegacyRule(data: {
+    monitor: Monitor;
+    rule: StatusPageMonitorRule;
   }): boolean {
     const { monitor, rule } = data;
 
@@ -436,8 +459,14 @@ export class StatusPageMonitorRuleEngineServiceClass {
     const hasDescriptionCriteria: boolean = Boolean(
       rule.monitorDescriptionPattern,
     );
+    const hasConfiguredCriteria: boolean = Boolean(rule.criteria);
 
-    if (!hasLabelCriteria && !hasNameCriteria && !hasDescriptionCriteria) {
+    if (
+      !hasConfiguredCriteria &&
+      !hasLabelCriteria &&
+      !hasNameCriteria &&
+      !hasDescriptionCriteria
+    ) {
       return [];
     }
 
@@ -448,7 +477,7 @@ export class StatusPageMonitorRuleEngineServiceClass {
       projectId: rule.projectId,
     };
 
-    if (hasLabelCriteria) {
+    if (!hasConfiguredCriteria && hasLabelCriteria) {
       query.labels = (rule.monitorLabels || [])
         .filter((label: Label) => {
           return Boolean(label.id);

package/Server/Services/StatusPageMonitorRuleService.ts

@@ -19,6 +19,10 @@ import ProjectScopedReferenceValidator, {
 } from "../Utils/Database/ProjectScopedReferenceValidator";
 import StatusPageMonitorRulePatternValidator from "../Utils/StatusPage/MonitorRulePatternValidator";
 import logger, { LogAttributes } from "../Utils/Logger";
+import {
+  getRuleCriteriaValidationError,
+  isValidRuleCriteria,
+} from "../../Utils/Rules/RuleCriteriaMatcher";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -39,6 +43,7 @@ export class Service extends DatabaseService<Model> {
       monitorLabelCount: (createBy.data.monitorLabels || []).length,
       monitorNamePattern: createBy.data.monitorNamePattern,
       monitorDescriptionPattern: createBy.data.monitorDescriptionPattern,
+      criteria: createBy.data.criteria,
     });
 
     StatusPageMonitorRulePatternValidator.validate({
@@ -356,7 +361,29 @@ export class Service extends DatabaseService<Model> {
     monitorLabelCount: number;
     monitorNamePattern?: string | undefined;
     monitorDescriptionPattern?: string | undefined;
+    criteria?: Model["criteria"];
   }): void {
+    if (data.criteria !== undefined && data.criteria !== null) {
+      const validationError: string | null = getRuleCriteriaValidationError(
+        data.criteria,
+      );
+
+      if (validationError) {
+        throw new BadDataException(validationError);
+      }
+
+      if (
+        isValidRuleCriteria(data.criteria) &&
+        data.criteria.filters.length > 0
+      ) {
+        return;
+      }
+
+      throw new BadDataException(
+        "A status page monitor rule needs at least one match condition.",
+      );
+    }
+
     if (
       data.monitorLabelCount === 0 &&
       !data.monitorNamePattern &&
@@ -400,6 +427,7 @@ export class Service extends DatabaseService<Model> {
         },
         monitorNamePattern: true,
         monitorDescriptionPattern: true,
+        criteria: true,
       },
       limit: LIMIT_PER_PROJECT,
       skip: 0,
@@ -419,7 +447,8 @@ export class Service extends DatabaseService<Model> {
     const touchesCriteria: boolean =
       updateBy.data.monitorLabels !== undefined ||
       updateBy.data.monitorNamePattern !== undefined ||
-      updateBy.data.monitorDescriptionPattern !== undefined;
+      updateBy.data.monitorDescriptionPattern !== undefined ||
+      updateBy.data.criteria !== undefined;
 
     if (!touchesCriteria) {
       return;
@@ -444,6 +473,10 @@ export class Service extends DatabaseService<Model> {
           updateBy.data.monitorDescriptionPattern === undefined
             ? rule.monitorDescriptionPattern
             : (updateBy.data.monitorDescriptionPattern as string | undefined),
+        criteria:
+          updateBy.data.criteria === undefined
+            ? rule.criteria
+            : (updateBy.data.criteria as Model["criteria"]),
       });
     }
   }

package/Server/Services/StatusPageOwnerRuleEngineService.ts

@@ -7,6 +7,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class StatusPageOwnerRuleEngineServiceClass {
@@ -33,6 +34,7 @@ class StatusPageOwnerRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             notifyOwners: true,
             statusPageLabels: { _id: true },
             statusPageNamePattern: true,
@@ -160,6 +162,24 @@ class StatusPageOwnerRuleEngineServiceClass {
   private doesStatusPageMatchRule(
     statusPage: StatusPage,
     rule: StatusPageOwnerRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "statusPageLabels",
+        "statusPageNamePattern",
+        "statusPageDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (statusPageRule: StatusPageOwnerRule): boolean => {
+        return this.doesStatusPageMatchRuleLegacy(statusPage, statusPageRule);
+      },
+    });
+  }
+
+  private doesStatusPageMatchRuleLegacy(
+    statusPage: StatusPage,
+    rule: StatusPageOwnerRule,
   ): boolean {
     if (rule.statusPageLabels && rule.statusPageLabels.length > 0) {
       if (!statusPage.labels || statusPage.labels.length === 0) {

package/Server/Services/UserService.ts

@@ -8,6 +8,7 @@ import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
+import OwnerOnlyColumnPermission from "../Types/Database/Permissions/OwnerOnlyColumnPermission";
 import Attribution from "../Utils/Attribution";
 import logger, { LogAttributes } from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
@@ -336,6 +337,14 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    // Reject values that could bypass the exact-false ownership check below.
+    if (
+      updateBy.data.enableTwoFactorAuth !== undefined &&
+      typeof updateBy.data.enableTwoFactorAuth !== "boolean"
+    ) {
+      throw new BadDataException("enableTwoFactorAuth must be a boolean.");
+    }
+
     let carryForward: Array<Model> = [];
 
     if (updateBy.data.password || updateBy.data.email) {
@@ -361,58 +370,22 @@ export class Service extends DatabaseService<Model> {
     }
 
     /*
-     * There used to be a guard here refusing to set `enableTwoFactorAuth` on
-     * an account with no verified authenticator, on the grounds that doing so
-     * locked the user out: login demanded a second factor, found none, and
-     * said "contact your admin".
-     *
-     * That is no longer true, and the guard was the single thing standing in
-     * the way of the feature it appeared to protect. Login now sends an
-     * account in that state through ENROLMENT -- a QR code and a code to type
-     * back -- rather than refusing it (see App/FeatureSet/Identity/API/
-     * Authentication.ts). "Required, nothing set up yet" is therefore an
-     * ordinary, recoverable state, and it is exactly the state an admin
-     * creates on purpose when they mandate two factor auth for somebody who
-     * has never used it.
-     *
-     * Keeping the guard would have meant an admin could only require two
-     * factor auth from users who had already volunteered for it, which is the
-     * opposite of what a mandate is for.
-     *
-     * What replaces it is the guard below, which protects the opposite
-     * direction.
-     */
-
-    /*
-     * TURNING THE REQUIREMENT OFF IS A MASTER-ADMIN ACTION, NOT A USER ONE.
-     *
-     * `enableTwoFactorAuth` carries `update: [Permission.CurrentUser]` and the
-     * User table's row ACL scopes updates to the caller's own id, so without
-     * this every signed-in user can clear their own flag with an ordinary
-     * `PUT /user/<their own id>` -- and the product ships the button that does
-     * it, at Dashboard > Profile > Two Factor Authentication.
-     *
-     * That makes an admin mandate self-undoing. The admin requires two factor
-     * auth, the user is marched through enrolment at their next sign-in, and
-     * then, from the session they just earned, they switch it straight back
-     * off and delete the factor. The account is password-only again and the
-     * Authentication page reports the mandate as simply absent.
-     *
-     * So: anybody may turn the requirement ON for themselves -- self-service
-     * enrolment is a feature and taking it away would help nobody -- but only
-     * a root caller may turn it OFF. The one root caller is
-     * `setTwoFactorAuthRequired` below, reached through the master-admin
-     * endpoint. A user who wants two factor auth removed now has to ask an
-     * administrator, which is the point of the feature.
-     *
-     * Keyed on `isRoot` rather than on a master-admin check because a master
-     * admin editing their OWN row through the CRUD API is still that user, and
-     * the flag should move through the endpoint that also revokes sessions
-     * either way.
+     * Users may turn off two factor authentication for their own account.
+     * This hook runs before row scoping, so require an exact owner predicate.
+     * Changes to other accounts still use the master-admin endpoints, whose
+     * root writes retain session revocation when enabling the requirement.
      */
-    if (updateBy.data.enableTwoFactorAuth === false && !updateBy.props.isRoot) {
+    if (
+      updateBy.data.enableTwoFactorAuth === false &&
+      !updateBy.props.isRoot &&
+      !OwnerOnlyColumnPermission.isQueryPinnedToCurrentUser(
+        Model,
+        updateBy.query,
+        updateBy.props,
+      )
+    ) {
       throw new BadDataException(
-        "Only an administrator can turn off two factor authentication for this account.",
+        "You can only turn off two factor authentication for your own account.",
       );
     }
 

package/Server/Services/VMwareVCenterLabelRuleEngineService.ts

@@ -10,6 +10,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class VMwareVCenterLabelRuleEngineServiceClass {
@@ -37,6 +38,7 @@ class VMwareVCenterLabelRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             vmwareVCenterLabels: { _id: true },
             vmwareVCenterNamePattern: true,
             vmwareVCenterDescriptionPattern: true,
@@ -173,6 +175,29 @@ class VMwareVCenterLabelRuleEngineServiceClass {
   private doesVMwareVCenterMatchRule(
     vmwareVCenter: VMwareVCenter,
     rule: VMwareVCenterLabelRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "vmwareVCenterLabels",
+        "vmwareVCenterNamePattern",
+        "vmwareVCenterDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (
+        vmwareVCenterRule: VMwareVCenterLabelRule,
+      ): boolean => {
+        return this.doesVMwareVCenterMatchRuleLegacy(
+          vmwareVCenter,
+          vmwareVCenterRule,
+        );
+      },
+    });
+  }
+
+  private doesVMwareVCenterMatchRuleLegacy(
+    vmwareVCenter: VMwareVCenter,
+    rule: VMwareVCenterLabelRule,
   ): boolean {
     if (rule.vmwareVCenterLabels && rule.vmwareVCenterLabels.length > 0) {
       if (!vmwareVCenter.labels || vmwareVCenter.labels.length === 0) {

package/Server/Services/VMwareVCenterOwnerRuleEngineService.ts

@@ -14,6 +14,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class VMwareVCenterOwnerRuleEngineServiceClass {
@@ -42,6 +43,7 @@ class VMwareVCenterOwnerRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             notifyOwners: true,
             vmwareVCenterLabels: { _id: true },
             vmwareVCenterNamePattern: true,
@@ -185,6 +187,29 @@ class VMwareVCenterOwnerRuleEngineServiceClass {
   private doesVMwareVCenterMatchRule(
     vmwareVCenter: VMwareVCenter,
     rule: VMwareVCenterOwnerRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "vmwareVCenterLabels",
+        "vmwareVCenterNamePattern",
+        "vmwareVCenterDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (
+        vmwareVCenterRule: VMwareVCenterOwnerRule,
+      ): boolean => {
+        return this.doesVMwareVCenterMatchRuleLegacy(
+          vmwareVCenter,
+          vmwareVCenterRule,
+        );
+      },
+    });
+  }
+
+  private doesVMwareVCenterMatchRuleLegacy(
+    vmwareVCenter: VMwareVCenter,
+    rule: VMwareVCenterOwnerRule,
   ): boolean {
     if (rule.vmwareVCenterLabels && rule.vmwareVCenterLabels.length > 0) {
       if (!vmwareVCenter.labels || vmwareVCenter.labels.length === 0) {

package/Server/Services/WorkflowLabelRuleEngineService.ts

@@ -7,6 +7,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class WorkflowLabelRuleEngineServiceClass {
@@ -32,6 +33,7 @@ class WorkflowLabelRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             workflowLabels: { _id: true },
             workflowNamePattern: true,
             workflowDescriptionPattern: true,
@@ -141,6 +143,24 @@ class WorkflowLabelRuleEngineServiceClass {
   private doesWorkflowMatchRule(
     workflow: Workflow,
     rule: WorkflowLabelRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "workflowLabels",
+        "workflowNamePattern",
+        "workflowDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (workflowRule: WorkflowLabelRule): boolean => {
+        return this.doesWorkflowMatchRuleLegacy(workflow, workflowRule);
+      },
+    });
+  }
+
+  private doesWorkflowMatchRuleLegacy(
+    workflow: Workflow,
+    rule: WorkflowLabelRule,
   ): boolean {
     if (rule.workflowLabels && rule.workflowLabels.length > 0) {
       if (!workflow.labels || workflow.labels.length === 0) {

package/Server/Services/WorkflowOwnerRuleEngineService.ts

@@ -11,6 +11,7 @@ import ObjectID from "../../Types/ObjectID";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
 import { MAX_RULES_EVALUATED_PER_PROJECT } from "../../Utils/Rules/RuleEngineLimits";
+import { RuleCriteriaMatcher } from "../../Utils/Rules/RuleCriteriaMatcher";
 import logIfRuleReadWasTruncated from "../Utils/Rules/RuleEngineRuleRead";
 
 class WorkflowOwnerRuleEngineServiceClass {
@@ -37,6 +38,7 @@ class WorkflowOwnerRuleEngineServiceClass {
           select: {
             _id: true,
             name: true,
+            criteria: true,
             notifyOwners: true,
             workflowLabels: { _id: true },
             workflowNamePattern: true,
@@ -159,6 +161,24 @@ class WorkflowOwnerRuleEngineServiceClass {
   private doesWorkflowMatchRule(
     workflow: Workflow,
     rule: WorkflowOwnerRule,
+  ): boolean {
+    return RuleCriteriaMatcher.matchesWithLegacySync({
+      rule: rule,
+      legacyFields: [
+        "workflowLabels",
+        "workflowNamePattern",
+        "workflowDescriptionPattern",
+      ],
+      emptyResult: true,
+      matchesLegacyRule: (workflowRule: WorkflowOwnerRule): boolean => {
+        return this.doesWorkflowMatchRuleLegacy(workflow, workflowRule);
+      },
+    });
+  }
+
+  private doesWorkflowMatchRuleLegacy(
+    workflow: Workflow,
+    rule: WorkflowOwnerRule,
   ): boolean {
     if (rule.workflowLabels && rule.workflowLabels.length > 0) {
       if (!workflow.labels || workflow.labels.length === 0) {