@oneuptime/common 13.0.4 → 13.0.6

package/Server/Utils/Database/RelationValueUtil.ts

@@ -0,0 +1,106 @@
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * A relation (Entity / EntityArray) value reaches the write path in several
+ * shapes: a model instance, a plain `{ _id }` object from a request body, a
+ * bare id string, or an ObjectID. A model instance and a plain object both
+ * stringify to "[object Object]", so a comparison through toString() cannot
+ * tell one set of related rows from another. These helpers reduce every shape
+ * to the ids it refers to - the only thing that identifies a relation.
+ */
+
+const ID_KEYS: ReadonlyArray<string> = ["_id", "id"];
+
+export default class RelationValueUtil {
+  /*
+   * The id a single relation value refers to, or null when it carries none
+   * (null, an unsaved model, an object that is not a reference).
+   */
+  public static getRelationId(value: unknown): string | null {
+    if (value === null || value === undefined) {
+      return null;
+    }
+
+    if (value instanceof ObjectID || typeof value === "string") {
+      const id: string = value.toString();
+      return id.length > 0 ? id : null;
+    }
+
+    if (typeof value !== "object" || Array.isArray(value)) {
+      return null;
+    }
+
+    const record: Record<string, unknown> = value as Record<string, unknown>;
+
+    for (const key of ID_KEYS) {
+      const candidate: unknown = record[key];
+
+      if (candidate instanceof ObjectID || typeof candidate === "string") {
+        const id: string = candidate.toString();
+
+        if (id.length > 0) {
+          return id;
+        }
+      }
+    }
+
+    return null;
+  }
+
+  /*
+   * The sorted, de-duplicated ids a relation value refers to: every element
+   * of a many-to-many value, or the single id of a many-to-one value. Ids are
+   * compared case-insensitively, as Postgres compares uuids.
+   *
+   * Null when the value cannot be compared by id - it is absent (not loaded,
+   * or cleared to null) or holds an element that is not a reference - so a
+   * caller can fall back to its own comparison instead of guessing.
+   */
+  public static getRelationIdSet(value: unknown): Array<string> | null {
+    if (value === null || value === undefined) {
+      return null;
+    }
+
+    const elements: Array<unknown> = Array.isArray(value) ? value : [value];
+    const ids: Set<string> = new Set<string>();
+
+    for (const element of elements) {
+      const id: string | null = RelationValueUtil.getRelationId(element);
+
+      if (!id) {
+        return null;
+      }
+
+      ids.add(id.toLowerCase());
+    }
+
+    return Array.from(ids).sort();
+  }
+
+  /*
+   * Whether two relation values refer to the same rows, ignoring order and
+   * duplicates: the order a relation array comes back in carries no meaning.
+   * Null when either side cannot be compared by id (see getRelationIdSet).
+   */
+  public static haveSameRelationIds(
+    current: unknown,
+    updated: unknown,
+  ): boolean | null {
+    const currentIds: Array<string> | null =
+      RelationValueUtil.getRelationIdSet(current);
+    const updatedIds: Array<string> | null =
+      RelationValueUtil.getRelationIdSet(updated);
+
+    if (!currentIds || !updatedIds) {
+      return null;
+    }
+
+    if (currentIds.length !== updatedIds.length) {
+      return false;
+    }
+
+    return currentIds.every((id: string, index: number): boolean => {
+      return id === updatedIds[index];
+    });
+  }
+}

package/Server/Utils/Monitor/Criteria/CompareCriteria.ts

@@ -2,6 +2,7 @@ import logger from "../../../Utils/Logger";
 import {
   CheckOn,
   CriteriaFilter,
+  CriteriaFilterUtil,
   EvaluateOverTimeType,
   FilterType,
 } from "../../../../Types/Monitor/CriteriaFilter";
@@ -655,8 +656,12 @@ export default class CompareCriteria {
     let message: string = "";
     let breachSummary: string = "";
 
+    /*
+     * Name the type the window was judged with. A boolean series saved with
+     * an aggregate is judged as All Values, so it must not read as an average.
+     */
     let evaluationType: EvaluateOverTimeType | undefined =
-      data.criteriaFilter.evaluateOverTimeOptions?.evaluateOverTimeType;
+      CriteriaFilterUtil.getEffectiveEvaluateOverTimeType(data.criteriaFilter);
 
     if (data.criteriaFilter.metricMonitorOptions?.metricAggregationType) {
       evaluationType =

package/Server/Utils/Monitor/Criteria/EvaluateOverTime.ts

@@ -3,8 +3,8 @@ import { LIMIT_PER_PROJECT } from "../../../../Types/Database/LimitMax";
 import OneUptimeDate from "../../../../Types/Date";
 import { JSONObject } from "../../../../Types/JSON";
 import {
-  CheckOn,
   CriteriaFilter,
+  CriteriaFilterUtil,
   EvaluateOverTimeOptions,
   EvaluateOverTimeType,
   NoDataPolicy,
@@ -170,19 +170,13 @@ export default class EvaluateOverTime {
     if (policy === NoDataPolicy.TreatAsZero) {
       /*
        * Zero for numeric series, and its boolean equivalent (false) for the
-       * online/timeout series, which EvaluateOverTime already maps 1 -> true.
+       * boolean series, whose samples evaluateOverTime maps 1 -> true.
        */
-      const isBooleanSeries: boolean =
-        data.criteriaFilter.checkOn === CheckOn.IsOnline ||
-        data.criteriaFilter.checkOn === CheckOn.IsRequestTimeout ||
-        data.criteriaFilter.checkOn === CheckOn.DnsIsOnline ||
-        data.criteriaFilter.checkOn === CheckOn.SnmpIsOnline ||
-        data.criteriaFilter.checkOn === CheckOn.DatabaseIsOnline ||
-        data.criteriaFilter.checkOn === CheckOn.ExternalStatusPageIsOnline;
-
       return {
         earlyReturn: null,
-        value: isBooleanSeries ? [false] : [0],
+        value: CriteriaFilterUtil.isBooleanSeries(data.criteriaFilter.checkOn)
+          ? [false]
+          : [0],
       };
     }
 
@@ -308,6 +302,18 @@ export default class EvaluateOverTime {
       };
     }
 
+    const isBooleanSeries: boolean = CriteriaFilterUtil.isBooleanSeries(
+      data.criteriaFilter.checkOn,
+    );
+
+    /*
+     * A boolean series saved with Average / Sum / Maximum / Minimum is judged
+     * as All Values. Reducing it would hand the True / False comparators a
+     * number such as 0.6, which matches neither, so the filter never fired.
+     */
+    const evaluateOverTimeType: EvaluateOverTimeType | undefined =
+      CriteriaFilterUtil.getEffectiveEvaluateOverTimeType(data.criteriaFilter);
+
     const sampleTimes: Array<Date> = [];
 
     const values: Array<number | boolean> = [];
@@ -317,13 +323,7 @@ export default class EvaluateOverTime {
         continue;
       }
 
-      if (
-        data.criteriaFilter.checkOn === CheckOn.IsOnline ||
-        data.criteriaFilter.checkOn === CheckOn.IsRequestTimeout ||
-        data.criteriaFilter.checkOn === CheckOn.DnsIsOnline ||
-        data.criteriaFilter.checkOn === CheckOn.SnmpIsOnline ||
-        data.criteriaFilter.checkOn === CheckOn.ExternalStatusPageIsOnline
-      ) {
+      if (isBooleanSeries) {
         values.push(item.value === 1);
       } else {
         values.push(item.value);
@@ -355,10 +355,7 @@ export default class EvaluateOverTime {
      * aggregates (Average / Sum / Min / Max) are meaningful over a partial
      * window, so they are left alone.
      */
-    if (
-      evaluateOverTimeOptions.evaluateOverTimeType ===
-      EvaluateOverTimeType.AllValues
-    ) {
+    if (evaluateOverTimeType === EvaluateOverTimeType.AllValues) {
       const isCovered: boolean = this.isWindowCovered({
         windowStart: windowStart,
         windowEnd: now,
@@ -378,10 +375,8 @@ export default class EvaluateOverTime {
     }
 
     if (
-      evaluateOverTimeOptions.evaluateOverTimeType ===
-        EvaluateOverTimeType.AnyValue ||
-      evaluateOverTimeOptions.evaluateOverTimeType ===
-        EvaluateOverTimeType.AllValues
+      evaluateOverTimeType === EvaluateOverTimeType.AnyValue ||
+      evaluateOverTimeType === EvaluateOverTimeType.AllValues
     ) {
       // if its any or all then return the values. Otherwise compute the value based on the type
       return {
@@ -397,7 +392,7 @@ export default class EvaluateOverTime {
       status: OverTimeEvaluationStatus.Evaluated,
       value: this.getValueByEvaluationType({
         values: values as Array<number>,
-        evaluateOverTimeType: evaluateOverTimeOptions.evaluateOverTimeType!,
+        evaluateOverTimeType: evaluateOverTimeType!,
       }),
       sampleCount: values.length,
       noDataReason: null,

package/Server/Utils/Monitor/MonitorCriteriaEvaluator.ts

@@ -198,7 +198,7 @@ export default class MonitorCriteriaEvaluator {
        */
       if (criteriaInstance.data?.isEnabled === false) {
         const skipReason: string =
-          "This criteria is disabled and was not evaluated.";
+          "This criterion is disabled, so it was not evaluated.";
         const skippedCriteriaResult: MonitorEvaluationCriteriaResult = {
           criteriaId: criteriaInstance.data?.id,
           criteriaName: criteriaInstance.data?.name,
@@ -209,6 +209,7 @@ export default class MonitorCriteriaEvaluator {
           filters: [],
           skipped: true,
           skipReason: skipReason,
+          skipCause: "disabled",
         };
 
         input.evaluationSummary.criteriaResults.push(skippedCriteriaResult);
@@ -469,8 +470,8 @@ ${contextBlock}
     evaluationSummary: MonitorEvaluationSummary;
   }): void {
     const skipReason: string =
-      "An earlier criteria already matched. This monitor raises a single " +
-      "alert for the whole monitor, so evaluation stops at the first match.";
+      "An earlier criterion already matched. Criteria are evaluated in order " +
+      "for this monitor, so evaluation stopped at the first match.";
 
     input.evaluationSummary.criteriaResults.push({
       criteriaId: input.criteriaInstance.data?.id,
@@ -482,6 +483,7 @@ ${contextBlock}
       filters: [],
       skipped: true,
       skipReason: skipReason,
+      skipCause: "earlier-criterion-matched",
     });
   }
 

package/Server/Utils/Monitor/MonitorCriteriaExpectationBuilder.ts

@@ -1,5 +1,6 @@
 import {
   CriteriaFilter,
+  CriteriaFilterUtil,
   FilterType,
 } from "../../../Types/Monitor/CriteriaFilter";
 import MetricValueFormatter from "../../../Utils/Monitor/MetricValueFormatter";
@@ -207,8 +208,9 @@ export default class MonitorCriteriaExpectationBuilder {
       );
     }
 
+    // A boolean series saved with an aggregate is judged as All Values.
     const aggregation: string | undefined =
-      criteriaFilter.evaluateOverTimeOptions?.evaluateOverTimeType ||
+      CriteriaFilterUtil.getEffectiveEvaluateOverTimeType(criteriaFilter) ||
       criteriaFilter.metricMonitorOptions?.metricAggregationType;
 
     if (aggregation) {

package/Server/Utils/Monitor/MonitorStepsProjectValidator.ts

@@ -48,30 +48,60 @@ import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/
  * is known to point at a specific model.
  */
 
+/*
+ * Every entry is a getter, not a direct reference.
+ *
+ * The services import each other in a cycle, and this module is part of it:
+ * UserService -> ... -> MonitorService -> ... -> NetworkDeviceService ->
+ * NetworkAlertPolicyEngineService -> MonitorTemplateService -> this module.
+ * Loaded from the API server's entry point, this module runs while UserService
+ * and NetworkDeviceService are still loading. A plain object literal captured
+ * both as `undefined`, and kept them that way for the life of the process. Any
+ * monitorSteps that named an owner user, an incident member or a monitored
+ * network device then failed inside ProjectScopedReferenceValidator with
+ *   TypeError: Cannot read properties of undefined (reading 'getModel')
+ * which the API reports as a bare 500 "Server Error". Monitor creates and
+ * updates, and monitor template saves, all failed this way.
+ *
+ * Which entries a cycle leaves half initialized depends on the whole app's
+ * import graph, so every entry is lazy, not only the two that broke. A getter
+ * defers the lookup to the first property access, by which time every module
+ * has finished initializing. See SerializableObjectDictionary for the same fix.
+ */
 const SERVICE_BY_MODEL: Record<
   MonitorStepsReferenceModel,
   DatabaseService<DatabaseBaseModel>
 > = {
-  [MonitorStepsReferenceModel.MonitorStatus]:
-    MonitorStatusService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.IncidentSeverity]:
-    IncidentSeverityService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.AlertSeverity]:
-    AlertSeverityService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.OnCallDutyPolicy]:
-    OnCallDutyPolicyService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.Label]:
-    LabelService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.Team]:
-    TeamService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.User]:
-    UserService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.IncidentRole]:
-    IncidentRoleService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.TelemetryService]:
-    ServiceService as unknown as DatabaseService<DatabaseBaseModel>,
-  [MonitorStepsReferenceModel.NetworkDevice]:
-    NetworkDeviceService as unknown as DatabaseService<DatabaseBaseModel>,
+  get [MonitorStepsReferenceModel.MonitorStatus](): DatabaseService<DatabaseBaseModel> {
+    return MonitorStatusService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.IncidentSeverity](): DatabaseService<DatabaseBaseModel> {
+    return IncidentSeverityService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.AlertSeverity](): DatabaseService<DatabaseBaseModel> {
+    return AlertSeverityService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.OnCallDutyPolicy](): DatabaseService<DatabaseBaseModel> {
+    return OnCallDutyPolicyService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.Label](): DatabaseService<DatabaseBaseModel> {
+    return LabelService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.Team](): DatabaseService<DatabaseBaseModel> {
+    return TeamService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.User](): DatabaseService<DatabaseBaseModel> {
+    return UserService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.IncidentRole](): DatabaseService<DatabaseBaseModel> {
+    return IncidentRoleService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.TelemetryService](): DatabaseService<DatabaseBaseModel> {
+    return ServiceService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
+  get [MonitorStepsReferenceModel.NetworkDevice](): DatabaseService<DatabaseBaseModel> {
+    return NetworkDeviceService as unknown as DatabaseService<DatabaseBaseModel>;
+  },
 };
 
 export default class MonitorStepsProjectValidator {

package/Server/Utils/Monitor/NetworkDeviceHydrationUtil.ts

@@ -516,6 +516,19 @@ export default class NetworkDeviceHydrationUtil {
    * its site's profile" unrepresentable. The caller chooses what to collect
    * (OIDs / interface walk) — for device polling those come from the
    * device's own snmpOids/walkInterfaces columns.
+   *
+   * `retries` is left out on purpose. A device (like its site and credential
+   * profile) has no retry setting, so there is no user value to carry, and a
+   * number restated here means whatever the probe reading it thinks it
+   * means. It used to be `retries: 3`, written when probes read it as total
+   * attempts; probes now read it as retries after the first attempt, so the
+   * same 3 became four attempts per poll. Absent, every probe version lands
+   * on three attempts from its own default (older probes `?? 3` total, newer
+   * ones two retries), and a failed walk is retried by the next poll cycle
+   * anyway. For Network Device monitors and tests, an absent value falls
+   * through to the step's retry count and then PROBE_MONITOR_RETRY_LIMIT,
+   * like every other monitor type. The timeout is fixed for the same reason:
+   * a device has no setting for it.
    */
   public static buildSnmpMonitorConfig(data: {
     hostname: string;
@@ -533,7 +546,6 @@ export default class NetworkDeviceHydrationUtil {
       snmpV3Auth: NetworkDeviceHydrationUtil.buildSnmpV3Auth(data.credentials),
       oids: data.oids,
       timeout: 5000,
-      retries: 3,
       monitorInterfaces: data.monitorInterfaces,
     };
   }

package/Server/Utils/Monitor/NetworkDeviceMetricUtil.ts

@@ -21,20 +21,15 @@ import SnmpMonitorResponse, {
 import ObjectID from "../../../Types/ObjectID";
 import OneUptimeDate from "../../../Types/Date";
 import CaptureSpan from "../Telemetry/CaptureSpan";
+import { NETWORK_DEVICE_PING_ROUND_TRIP_TIME_METRIC_NAME } from "../../../Types/NetworkDevice/NetworkDevicePingMetricNames";
 
 /*
- * Ping round-trip time of a network device, in ms.
- *
- * Ping monitors write their RTT into MonitorMetricType.ResponseTime, but on
- * a network device that series is the SNMP walk's time (and is absent on a
- * ping-only poll), so the RTT needs a series of its own. It sits in the
- * `oneuptime.monitor.ping.*` namespace beside PacketLossPercent and Jitter,
- * which ARE reused from the Ping monitor. MonitorMetricType has no member
- * for it yet; this constant should graduate into that enum (and the device
- * metric catalog) rather than be duplicated.
+ * Ping round-trip time of a network device, in ms. Defined in Common/Types
+ * (NetworkDevicePingMetricNames) because the dashboard reads the series
+ * back and cannot import this server module; re-exported here under the
+ * same name so nothing that already imports it from here has to move.
  */
-export const NETWORK_DEVICE_PING_ROUND_TRIP_TIME_METRIC_NAME: string =
-  "oneuptime.monitor.ping.round.trip.time";
+export { NETWORK_DEVICE_PING_ROUND_TRIP_TIME_METRIC_NAME };
 
 /*
  * Emits device-scoped metrics from each device poll — reachability, ping

package/Server/Utils/Rules/MonitorRulePatternValidator.ts

@@ -0,0 +1,51 @@
+import BadDataException from "../../../Types/Exception/BadDataException";
+import RulePatternMatchUtil from "../../../Utils/Rules/RulePatternMatchUtil";
+
+/*
+ * Write-time validation for the monitor name / description patterns on the
+ * rules that attach monitors to something - status page monitor rules and SLO
+ * monitor rules.
+ *
+ * The rule engines accept a case-insensitive regex or a '*' wildcard glob, the
+ * same two syntaxes the network device rules take. Anything else - `api-(01`,
+ * `[unclosed` - compiles to nothing and matches nothing, and the engine can
+ * only log about it long after the user left the form. Reject it at the write
+ * instead, exactly as NetworkDeviceRulePatternValidator does
+ * (OneUptime/oneuptime#2940).
+ *
+ * The messages name the field ("Monitor Name Pattern"), never the product the
+ * rule belongs to, which is what lets every monitor rule share this one
+ * validator instead of drifting apart copy by copy.
+ */
+export default class MonitorRulePatternValidator {
+  public static validate(data: {
+    namePattern?: string | null | undefined;
+    descriptionPattern?: string | null | undefined;
+  }): void {
+    MonitorRulePatternValidator.validateOne(
+      "Monitor Name Pattern",
+      data.namePattern,
+    );
+    MonitorRulePatternValidator.validateOne(
+      "Monitor Description Pattern",
+      data.descriptionPattern,
+    );
+  }
+
+  private static validateOne(
+    title: string,
+    pattern: string | null | undefined,
+  ): void {
+    if (!pattern) {
+      return;
+    }
+
+    if (RulePatternMatchUtil.isSupportedPattern(pattern)) {
+      return;
+    }
+
+    throw new BadDataException(
+      `${title} "${pattern}" is not a valid regular expression, and contains no '*' wildcard to fall back on, so it would never match a monitor. Use a regex such as api-.* or a wildcard such as *api*.`,
+    );
+  }
+}

package/Server/Utils/Rules/OwnerRuleAssignment.ts

@@ -0,0 +1,110 @@
+import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
+import ObjectID from "../../../Types/ObjectID";
+import DatabaseService from "../../Services/DatabaseService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import Query from "../../Types/Database/Query";
+
+/*
+ * Owner rows are plain join rows with no unique constraint, so creating one for
+ * a user who already owns the resource produces a duplicate owner - shown
+ * twice, and notified twice. A resource created a moment ago rarely has owners
+ * yet, but the create form can assign some before the owner rules run, and a
+ * rule run over existing resources meets owners on almost every one of them.
+ * Every owner rule engine filters its owner set through this first.
+ */
+
+export interface OwnersToAssign {
+  userIds: Array<ObjectID>;
+  teamIds: Array<ObjectID>;
+}
+
+function uniqueIds(ids: Array<ObjectID | string>): Array<ObjectID> {
+  const seen: Set<string> = new Set<string>();
+  const result: Array<ObjectID> = [];
+
+  for (const id of ids) {
+    const value: string = id?.toString() || "";
+
+    if (!value || seen.has(value)) {
+      continue;
+    }
+
+    seen.add(value);
+    result.push(new ObjectID(value));
+  }
+
+  return result;
+}
+
+export default class OwnerRuleAssignment {
+  /*
+   * The users and teams from `userIds` / `teamIds` that do not already own the
+   * resource. Duplicates within the input collapse to one.
+   */
+  public static async getOwnersNotYetAssigned<
+    TOwnerUser extends BaseModel,
+    TOwnerTeam extends BaseModel,
+  >(data: {
+    ownerUserService: DatabaseService<TOwnerUser>;
+    ownerTeamService: DatabaseService<TOwnerTeam>;
+    // The owner rows' column holding the resource id, e.g. "monitorId".
+    resourceIdColumn: string;
+    resourceId: ObjectID;
+    userIds: Array<ObjectID | string>;
+    teamIds: Array<ObjectID | string>;
+  }): Promise<OwnersToAssign> {
+    const userIds: Array<ObjectID> = uniqueIds(data.userIds);
+    const teamIds: Array<ObjectID> = uniqueIds(data.teamIds);
+
+    const [existingUsers, existingTeams]: [
+      Array<TOwnerUser>,
+      Array<TOwnerTeam>,
+    ] = await Promise.all([
+      userIds.length > 0
+        ? data.ownerUserService.findBy({
+            query: {
+              [data.resourceIdColumn]: data.resourceId,
+              userId: QueryHelper.any(userIds),
+            } as unknown as Query<TOwnerUser>,
+            select: { userId: true } as never,
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: { isRoot: true },
+          })
+        : Promise.resolve([] as Array<TOwnerUser>),
+      teamIds.length > 0
+        ? data.ownerTeamService.findBy({
+            query: {
+              [data.resourceIdColumn]: data.resourceId,
+              teamId: QueryHelper.any(teamIds),
+            } as unknown as Query<TOwnerTeam>,
+            select: { teamId: true } as never,
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: { isRoot: true },
+          })
+        : Promise.resolve([] as Array<TOwnerTeam>),
+    ]);
+
+    const assignedUserIds: Set<string> = new Set<string>(
+      existingUsers.map((row: TOwnerUser): string => {
+        return row.getColumnValue("userId")?.toString() || "";
+      }),
+    );
+    const assignedTeamIds: Set<string> = new Set<string>(
+      existingTeams.map((row: TOwnerTeam): string => {
+        return row.getColumnValue("teamId")?.toString() || "";
+      }),
+    );
+
+    return {
+      userIds: userIds.filter((id: ObjectID): boolean => {
+        return !assignedUserIds.has(id.toString());
+      }),
+      teamIds: teamIds.filter((id: ObjectID): boolean => {
+        return !assignedTeamIds.has(id.toString());
+      }),
+    };
+  }
+}

package/Server/Utils/Rules/RuleRun/RuleApplication.ts

@@ -0,0 +1,81 @@
+import BaseModel from "../../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import Select from "../../../Types/Database/Select";
+
+/*
+ * The contract between a rule engine and a rule run.
+ *
+ * Every label, owner and privacy rule engine already knows how to apply its
+ * project's rules to one freshly created resource. A rule run needs exactly
+ * that, applied to a resource that already exists and restricted to the one
+ * rule being run - so each engine exposes the same evaluation behind a second
+ * entry point instead of the run re-implementing matching, inheritance and
+ * feed items next to it.
+ */
+
+// What applying rules to one resource did.
+export interface RuleApplicationResult {
+  // At least one of the given rules matched the resource.
+  matched: boolean;
+  // The resource was changed: a label attached, an owner added, made private.
+  updated: boolean;
+  // How many labels or owners were added (1 for a resource made private).
+  itemsAdded: number;
+  // Applying threw. The engine has already logged why.
+  failed: boolean;
+}
+
+export interface ApplyRulesToExistingResourceData<TResource, TRule> {
+  resource: TResource;
+  rules: Array<TRule>;
+  /*
+   * Owner rules only. When false, owners are added silently even if the rule
+   * asks for notifications - a manual run over hundreds of resources must not
+   * turn into hundreds of emails unless the person running it opted in.
+   */
+  allowOwnerNotification: boolean;
+}
+
+export interface RuleRunEngine<
+  TResource extends BaseModel,
+  TRule extends BaseModel,
+> {
+  // Everything evaluation reads off a rule.
+  readonly ruleSelect: Select<TRule>;
+  /*
+   * Everything evaluation reads off the resource object it is handed. The
+   * create hook passes the freshly created row; a run reads these columns so
+   * that the resource it passes carries the same information.
+   */
+  readonly resourceSelectForRuleRun: Select<TResource>;
+  applyRulesToExistingResource(
+    data: ApplyRulesToExistingResourceData<TResource, TRule>,
+  ): Promise<RuleApplicationResult>;
+}
+
+export class RuleApplicationResultUtil {
+  public static noMatch(): RuleApplicationResult {
+    return { matched: false, updated: false, itemsAdded: 0, failed: false };
+  }
+
+  // Matched, but the resource already had everything the rules add.
+  public static alreadyApplied(): RuleApplicationResult {
+    return { matched: true, updated: false, itemsAdded: 0, failed: false };
+  }
+
+  public static updated(itemsAdded: number): RuleApplicationResult {
+    return {
+      matched: true,
+      updated: itemsAdded > 0,
+      itemsAdded: itemsAdded,
+      failed: false,
+    };
+  }
+
+  /*
+   * Counted as matched: the run reports failures as "could not be updated",
+   * and a resource whose evaluation threw is one it tried to update.
+   */
+  public static failed(): RuleApplicationResult {
+    return { matched: true, updated: false, itemsAdded: 0, failed: true };
+  }
+}