@oneuptime/common 13.0.5 → 13.0.7

package/Server/Utils/Dashboard/PublicDashboardResourceListPolicy.ts

@@ -12,7 +12,16 @@ import { JSONObject, JSONValue } from "../../../Types/JSON";
 import JSONFunctions from "../../../Types/JSONFunctions";
 import PublicDashboardSloWidget, {
   PublicDashboardSloWidgetConfig,
+  PublicDashboardSloWidgetTargetKind,
 } from "./PublicDashboardSloWidget";
+import { SLO_WIDGET_NAME_MATCH_LIMIT } from "../../../Utils/Dashboard/SloWidgetSource";
+import {
+  getSloListStatusFilterQuery,
+  SLO_LIST_ATTRIBUTE_TO_COLUMN,
+  SLO_LIST_DEFAULT_MAX_ROWS,
+  SLO_LIST_SORT,
+  SLO_LIST_STATUS_FILTER_VALUES,
+} from "../../../Utils/Slo/SloListWidgetFormat";
 import {
   LogFilter,
   queryStringToFilter,
@@ -539,9 +548,9 @@ export default class PublicDashboardResourceListPolicy {
       /*
        * Exactly the seven display fields the SLO widget renders. Everything
        * else the model carries — description, slug, the bound monitors and
-       * labels, the metric query config, the evaluation schedule, createdBy —
-       * stays private: an SLO's headline numbers are publishable, its
-       * definition is not.
+       * labels, the metric query config, the evaluation schedule, the archive
+       * stamps, createdBy — stays private: an SLO's headline numbers are
+       * publishable, its definition is not.
        */
       case DashboardComponentType.Slo:
         return {
@@ -554,6 +563,26 @@ export default class PublicDashboardResourceListPolicy {
           currentBurnRate: true,
           sloStatus: true,
         };
+      /*
+       * The same seven per row, plus `isEnabled`. A disabled SLO is not
+       * evaluated and keeps the status and budget it had when it was switched
+       * off, so without the flag the list would publish that frozen status as
+       * live and count it in its status strip — the browser list reads the
+       * same column for the same reason. The flag says whether an objective
+       * is being measured, nothing about how it is defined.
+       */
+      case DashboardComponentType.SloList:
+        return {
+          _id: true,
+          name: true,
+          targetPercentage: true,
+          currentSliPercentage: true,
+          errorBudgetRemainingPercentage: true,
+          errorBudgetRemainingSeconds: true,
+          currentBurnRate: true,
+          sloStatus: true,
+          isEnabled: true,
+        };
       default:
         throw new BadDataException(
           "This dashboard widget cannot list public resources.",
@@ -770,6 +799,12 @@ export default class PublicDashboardResourceListPolicy {
       case DashboardComponentType.Slo:
         return PublicDashboardResourceListPolicy.buildSloPolicy(
           argumentsObject,
+          variables,
+        );
+      case DashboardComponentType.SloList:
+        return PublicDashboardResourceListPolicy.buildSloListPolicy(
+          argumentsObject,
+          variables,
         );
       default:
         throw new BadDataException(
@@ -1578,24 +1613,121 @@ export default class PublicDashboardResourceListPolicy {
   }
 
   /*
-   * The SLO widget renders exactly one SLO — the one its author picked — so
-   * the stored id IS the whole query. Pinning `_id` to it and capping the
-   * read at a single row means the route can return that SLO's headline
-   * numbers and nothing else: it can neither be walked across the project's
-   * other SLOs nor turned into a filter oracle, because it accepts no filter
-   * at all.
+   * The SLO widget renders exactly one SLO.
+   *
+   * PINNED (an id stored on the widget): the stored id IS the whole query.
+   * Pinning `_id` to it and capping the read at a single row means the route
+   * can return that SLO's headline numbers and nothing else: it can neither
+   * be walked across the project's other SLOs nor turned into a filter
+   * oracle, because it accepts no filter at all.
+   *
+   * FOLLOWING a variable: the author bound the widget to a toolbar variable,
+   * which is their opt-in to publishing whichever ACTIVE SLO a viewer names
+   * (see PublicDashboardSloWidget). The name is an exact-match equality —
+   * never a search, never an IN-list — archived objectives are excluded like
+   * every other SLO list, and the read is capped at two rows: one to show,
+   * and one more so a name two SLOs share is reported as ambiguous instead
+   * of silently serving whichever sorted first.
    */
   private static buildSloPolicy(
     argumentsObject: Record<string, unknown>,
+    variables: Array<DashboardVariable>,
   ): PolicyDraft {
     const config: PublicDashboardSloWidgetConfig =
-      PublicDashboardSloWidget.readConfigFromArguments(argumentsObject);
+      PublicDashboardSloWidget.readConfigFromArguments(
+        argumentsObject,
+        variables,
+      );
+
+    if (config.target.kind === PublicDashboardSloWidgetTargetKind.Pinned) {
+      return {
+        resourceType: "slo",
+        query: { _id: config.target.serviceLevelObjectiveId },
+        sort: { name: SortOrder.Ascending },
+        limit: 1,
+      };
+    }
 
     return {
       resourceType: "slo",
-      query: { _id: config.serviceLevelObjectiveId },
+      query: {
+        name: config.target.serviceLevelObjectiveName,
+        isArchived: false,
+      },
       sort: { name: SortOrder.Ascending },
-      limit: 1,
+      limit: SLO_WIDGET_NAME_MATCH_LIMIT,
+    };
+  }
+
+  /*
+   * The SLO List widget publishes the headline numbers of every ACTIVE SLO in
+   * the project: archived objectives are hidden from every SLO list and are
+   * no longer evaluated, so their frozen numbers never reach a public page.
+   * Disabled objectives are listed, but the select carries `isEnabled` so the
+   * page marks them Disabled instead of presenting their frozen status as
+   * live, and the shared sort puts them after every enabled one.
+   *
+   * The stored status and label filters narrow it (a status filter matches
+   * enabled SLOs only, through the same getSloListStatusFilterQuery the
+   * browser uses), and a Telemetry Attribute variable on `sloName` narrows it
+   * to the picked objective through the same column map the browser applies
+   * (SLO_LIST_ATTRIBUTE_TO_COLUMN). The order and the row cap come from the
+   * widget, never from the request.
+   */
+  private static buildSloListPolicy(
+    argumentsObject: Record<string, unknown>,
+    variables: Array<DashboardVariable>,
+  ): PolicyDraft {
+    const query: Record<string, unknown> = { isArchived: false };
+
+    const sloStatuses: Array<string> | undefined =
+      PublicDashboardResourceListPolicy.optionalStringArray(
+        argumentsObject,
+        "sloStatuses",
+      );
+
+    if (sloStatuses && sloStatuses.length > 0) {
+      for (const sloStatus of sloStatuses) {
+        if (
+          !(SLO_LIST_STATUS_FILTER_VALUES as Array<string>).includes(sloStatus)
+        ) {
+          throw new BadDataException(
+            "Dashboard widget sloStatuses contains an invalid value.",
+          );
+        }
+      }
+
+      Object.assign(query, getSloListStatusFilterQuery(sloStatuses));
+    }
+
+    const labels: ReturnType<typeof DashboardLabelVariable.getFilter> =
+      DashboardLabelVariable.getFilter({
+        labelIds: PublicDashboardResourceListPolicy.optionalStringArray(
+          argumentsObject,
+          "labelIds",
+        ),
+        labelVariableId: PublicDashboardResourceListPolicy.optionalString(
+          argumentsObject,
+          "labelVariableId",
+          false,
+        ),
+        variables,
+      });
+
+    if (labels) {
+      query["labels"] = labels;
+    }
+
+    return {
+      ...PublicDashboardResourceListPolicy.listDraft({
+        resourceType: "slo-list",
+        query,
+        sort: { ...SLO_LIST_SORT },
+        argumentsObject,
+        // The widget's own default, so an unset maxRows reads the same page.
+        fallbackLimit: SLO_LIST_DEFAULT_MAX_ROWS,
+      }),
+      attributeToColumn: SLO_LIST_ATTRIBUTE_TO_COLUMN,
     };
   }
 
@@ -1775,7 +1907,13 @@ export default class PublicDashboardResourceListPolicy {
     );
   }
 
-  private static resolveDashboardVariableSelections(data: {
+  /*
+   * Public so the SLO history route resolves a viewer's toolbar selections
+   * through exactly the same validation as this route: stored variables are
+   * the source of every id, type and attribute key, and the request only ever
+   * contributes bounded selected values.
+   */
+  public static resolveDashboardVariableSelections(data: {
     dashboardViewConfig: unknown;
     requestedVariables: unknown;
   }): Array<DashboardVariable> {

package/Server/Utils/Dashboard/PublicDashboardSloHistoryPolicy.ts

@@ -2,14 +2,15 @@ import AggregationInterval from "../../../Types/BaseDatabase/AggregationInterval
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 import OneUptimeDate from "../../../Types/Date";
 import { SloWidgetDisplayType } from "../../../Types/Dashboard/DashboardComponents/DashboardSloComponent";
+import DashboardVariable from "../../../Types/Dashboard/DashboardVariable";
 import BadDataException from "../../../Types/Exception/BadDataException";
-import ObjectID from "../../../Types/ObjectID";
 import {
   getSloChartAggregationInterval,
   getSloHistoryMetricName,
 } from "../../../Utils/Slo/SloWidgetFormat";
 import PublicDashboardSloWidget, {
   PublicDashboardSloWidgetConfig,
+  PublicDashboardSloWidgetTarget,
 } from "./PublicDashboardSloWidget";
 
 /*
@@ -24,7 +25,13 @@ import PublicDashboardSloWidget, {
  * do I want to see".
  */
 export interface PublicDashboardSloHistoryPolicyResult {
-  serviceLevelObjectiveId: ObjectID;
+  /*
+   * WHICH SLO: a pinned id straight from stored config, or the SLO NAME a
+   * variable-bound widget's toolbar selection resolved to. The route turns a
+   * name into an id inside the dashboard's own project before it aggregates
+   * (DashboardAPI.resolvePublicSloWidgetTarget).
+   */
+  target: PublicDashboardSloWidgetTarget;
   /** SloHistory.metricName for the widget's chosen series. */
   metricName: string;
   startDate: Date;
@@ -37,6 +44,12 @@ export interface BuildPublicDashboardSloHistoryPolicyData {
   widget: unknown;
   /** The caller's `aggregateBy`, already JSONFunctions.deserialize'd. */
   requestedAggregateBy: unknown;
+  /*
+   * The dashboard's stored variables with the viewer's selections applied
+   * (PublicDashboardResourceListPolicy.resolveDashboardVariableSelections).
+   * Only a widget that follows an SLO variable reads them.
+   */
+  variables?: Array<DashboardVariable> | undefined;
 }
 
 /*
@@ -59,7 +72,7 @@ export default class PublicDashboardSloHistoryPolicy {
     data: BuildPublicDashboardSloHistoryPolicyData,
   ): PublicDashboardSloHistoryPolicyResult {
     const config: PublicDashboardSloWidgetConfig =
-      PublicDashboardSloWidget.readConfig(data.widget);
+      PublicDashboardSloWidget.readConfig(data.widget, data.variables);
 
     /*
      * Only a Chart widget publishes the SERIES. A Tile widget publishes the
@@ -110,7 +123,7 @@ export default class PublicDashboardSloHistoryPolicy {
     );
 
     return {
-      serviceLevelObjectiveId: config.serviceLevelObjectiveId,
+      target: config.target,
       metricName: getSloHistoryMetricName(config.sloMetric),
       startDate: clampedStartDate,
       endDate,

package/Server/Utils/Dashboard/PublicDashboardSloWidget.ts

@@ -2,8 +2,14 @@ import {
   SloWidgetDisplayType,
   SloWidgetMetric,
 } from "../../../Types/Dashboard/DashboardComponents/DashboardSloComponent";
+import DashboardVariable from "../../../Types/Dashboard/DashboardVariable";
 import BadDataException from "../../../Types/Exception/BadDataException";
 import ObjectID from "../../../Types/ObjectID";
+import {
+  resolveSloWidgetSource,
+  SloWidgetSource,
+  SloWidgetSourceState,
+} from "../../../Utils/Dashboard/SloWidgetSource";
 
 /*
  * The stored configuration of ONE SLO widget, read back from the dashboard's
@@ -18,27 +24,91 @@ import ObjectID from "../../../Types/ObjectID";
  * Everything here comes out of a JSONB column that an older (or hand-edited)
  * client may have written, so nothing is trusted to be well typed.
  */
+
+/*
+ * How the widget names its objective.
+ *
+ * - Pinned: the author stored one SLO id. The id IS the authorization
+ *   decision — it comes only from stored config, never from the request, so
+ *   the read can never be pointed at another SLO in the project.
+ *
+ * - Selected: the author bound the widget to a dashboard variable and the
+ *   viewer picked an SLO NAME in the toolbar. Binding a widget to a variable
+ *   is the author's explicit opt-in to publishing ANY active SLO's headline
+ *   numbers (and, for a chart, its history) by name — the same exposure the
+ *   SLO List widget and the `oneuptime.slo.*` metric charts already have. The
+ *   variable itself still comes from stored config (its id, type and key);
+ *   only its selected VALUE comes from the viewer, and it is only ever used as
+ *   an exact-match name within the dashboard's own project.
+ */
+export enum PublicDashboardSloWidgetTargetKind {
+  Pinned = "Pinned",
+  Selected = "Selected",
+}
+
+export type PublicDashboardSloWidgetTarget =
+  | {
+      kind: PublicDashboardSloWidgetTargetKind.Pinned;
+      serviceLevelObjectiveId: ObjectID;
+    }
+  | {
+      kind: PublicDashboardSloWidgetTargetKind.Selected;
+      serviceLevelObjectiveName: string;
+    };
+
 export interface PublicDashboardSloWidgetConfig {
-  serviceLevelObjectiveId: ObjectID;
+  target: PublicDashboardSloWidgetTarget;
   sloMetric: SloWidgetMetric;
   displayType: SloWidgetDisplayType;
 }
 
+/*
+ * Same bounds PublicDashboardResourceListPolicy applies to stored variable
+ * ids and selected values, so an oversized binding is refused here rather
+ * than turned into a query parameter.
+ */
+const MAX_VARIABLE_ID_LENGTH: number = 256;
+const MAX_SLO_NAME_LENGTH: number = 1024;
+
+export const PUBLIC_SLO_WIDGET_NOT_CONFIGURED_MESSAGE: string =
+  "This dashboard widget has no Service Level Objective selected.";
+
+export const PUBLIC_SLO_WIDGET_NO_SELECTION_MESSAGE: string =
+  "Choose a Service Level Objective in this dashboard's toolbar.";
+
+export const PUBLIC_SLO_WIDGET_MULTIPLE_SELECTION_MESSAGE: string =
+  "Choose a single Service Level Objective in this dashboard's toolbar.";
+
+export const PUBLIC_SLO_WIDGET_VARIABLE_MISSING_MESSAGE: string =
+  "This dashboard widget follows a variable this dashboard does not have.";
+
 export default class PublicDashboardSloWidget {
-  /** Read the config off a whole stored widget (`{ arguments: { … } }`). */
-  public static readConfig(widget: unknown): PublicDashboardSloWidgetConfig {
+  /*
+   * Read the config off a whole stored widget (`{ arguments: { … } }`).
+   *
+   * `variables` are the dashboard's STORED variables with the viewer's
+   * selections already validated and applied
+   * (PublicDashboardResourceListPolicy.resolveDashboardVariableSelections).
+   * A pinned widget never reads them; a variable-bound widget without them
+   * fails closed.
+   */
+  public static readConfig(
+    widget: unknown,
+    variables?: Array<DashboardVariable> | undefined,
+  ): PublicDashboardSloWidgetConfig {
     return PublicDashboardSloWidget.readConfigFromArguments(
       PublicDashboardSloWidget.readArguments(widget),
+      variables,
     );
   }
 
   /** Read the config off a widget's already-extracted `arguments` object. */
   public static readConfigFromArguments(
     argumentsObject: Record<string, unknown>,
+    variables?: Array<DashboardVariable> | undefined,
   ): PublicDashboardSloWidgetConfig {
     return {
-      serviceLevelObjectiveId:
-        PublicDashboardSloWidget.readServiceLevelObjectiveId(argumentsObject),
+      target: PublicDashboardSloWidget.readTarget(argumentsObject, variables),
       sloMetric: PublicDashboardSloWidget.readSloMetric(argumentsObject),
       displayType: PublicDashboardSloWidget.readDisplayType(argumentsObject),
     };
@@ -66,6 +136,85 @@ export default class PublicDashboardSloWidget {
     return argumentsObject as Record<string, unknown>;
   }
 
+  private static readTarget(
+    argumentsObject: Record<string, unknown>,
+    variables: Array<DashboardVariable> | undefined,
+  ): PublicDashboardSloWidgetTarget {
+    const storedId: unknown = argumentsObject["serviceLevelObjectiveId"];
+
+    /*
+     * ANY stored id that is not plainly absent pins the widget and is then
+     * validated strictly. A malformed id (a number, an array, a non-UUID)
+     * must fail closed — it must never fall through to the variable binding,
+     * which would widen a widget its author pinned to one SLO into one that
+     * serves whichever SLO a viewer names.
+     */
+    const isIdAbsent: boolean =
+      storedId === undefined ||
+      storedId === null ||
+      (typeof storedId === "string" && storedId.trim().length === 0);
+
+    if (!isIdAbsent) {
+      return {
+        kind: PublicDashboardSloWidgetTargetKind.Pinned,
+        serviceLevelObjectiveId:
+          PublicDashboardSloWidget.readServiceLevelObjectiveId(argumentsObject),
+      };
+    }
+
+    const storedVariableId: unknown =
+      argumentsObject["serviceLevelObjectiveVariableId"];
+
+    if (
+      storedVariableId === undefined ||
+      storedVariableId === null ||
+      storedVariableId === ""
+    ) {
+      throw new BadDataException(PUBLIC_SLO_WIDGET_NOT_CONFIGURED_MESSAGE);
+    }
+
+    if (
+      typeof storedVariableId !== "string" ||
+      storedVariableId.length > MAX_VARIABLE_ID_LENGTH
+    ) {
+      throw new BadDataException(
+        "Dashboard widget serviceLevelObjectiveVariableId is invalid.",
+      );
+    }
+
+    // The same resolution the browser renders with (SloWidgetSource).
+    const source: SloWidgetSource = resolveSloWidgetSource({
+      serviceLevelObjectiveVariableId: storedVariableId,
+      variables: variables,
+    });
+
+    switch (source.state) {
+      case SloWidgetSourceState.FollowsSelection: {
+        const sloName: string = source.sloName || "";
+
+        if (sloName.length === 0 || sloName.length > MAX_SLO_NAME_LENGTH) {
+          throw new BadDataException(PUBLIC_SLO_WIDGET_NO_SELECTION_MESSAGE);
+        }
+
+        return {
+          kind: PublicDashboardSloWidgetTargetKind.Selected,
+          serviceLevelObjectiveName: sloName,
+        };
+      }
+      case SloWidgetSourceState.NoSelection:
+        throw new BadDataException(PUBLIC_SLO_WIDGET_NO_SELECTION_MESSAGE);
+      case SloWidgetSourceState.MultipleSelection:
+        throw new BadDataException(
+          PUBLIC_SLO_WIDGET_MULTIPLE_SELECTION_MESSAGE,
+        );
+      case SloWidgetSourceState.Unconfigured:
+        // A whitespace-only binding is no binding.
+        throw new BadDataException(PUBLIC_SLO_WIDGET_NOT_CONFIGURED_MESSAGE);
+      default:
+        throw new BadDataException(PUBLIC_SLO_WIDGET_VARIABLE_MISSING_MESSAGE);
+    }
+  }
+
   /*
    * The SLO the widget's author picked IS the authorization decision: the id
    * comes only from stored config, never from the request, so this endpoint
@@ -81,9 +230,7 @@ export default class PublicDashboardSloWidget {
       typeof serviceLevelObjectiveId !== "string" ||
       serviceLevelObjectiveId.trim().length === 0
     ) {
-      throw new BadDataException(
-        "This dashboard widget has no Service Level Objective selected.",
-      );
+      throw new BadDataException(PUBLIC_SLO_WIDGET_NOT_CONFIGURED_MESSAGE);
     }
 
     const trimmed: string = serviceLevelObjectiveId.trim();

package/Server/Utils/Database/PostgresErrorTranslator.ts

@@ -67,6 +67,20 @@ export default class PostgresErrorTranslator {
     return this.translate(error) as Exception;
   }
 
+  /*
+   * The exception for a duplicate the application found before the database
+   * had to (see @UniqueColumnsTogether). It is tagged exactly like a
+   * translated unique violation, so isUniqueViolation() answers the same way
+   * whichever layer caught the duplicate.
+   */
+  public static createUniqueViolationException(
+    message: string,
+  ): BadDataException {
+    return this.tag(new BadDataException(message), {
+      code: UNIQUE_VIOLATION,
+    });
+  }
+
   /*
    * True for a unique violation whether or not it has been through translate().
    * Callers that recover from a duplicate must use this rather than checking

package/Server/Utils/Database/ProjectScopedReferenceValidator.ts

@@ -5,6 +5,7 @@ import Select from "../../Types/Database/Select";
 import { LIMIT_PER_PROJECT } from "../../../Types/Database/LimitMax";
 import Dictionary from "../../../Types/Dictionary";
 import BadDataException from "../../../Types/Exception/BadDataException";
+import ServerException from "../../../Types/Exception/ServerException";
 import ObjectID from "../../../Types/ObjectID";
 import DatabaseBaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 
@@ -148,6 +149,21 @@ export default class ProjectScopedReferenceValidator {
         continue;
       }
 
+      /*
+       * The type says a service is always there, but a caller that picks it
+       * from a table built at module load can hand over `undefined` when an
+       * import cycle leaves that service half initialized (see
+       * MonitorStepsProjectValidator). Without this check the lookup below
+       * fails with a TypeError, which the API reports as a bare "Server Error"
+       * that names nothing. It is still a bug, so it stays a 500, but the
+       * message says which reference could not be checked.
+       */
+      if (!reference.service) {
+        throw new ServerException(
+          `Unable to check the ${reference.modelName} this ${data.subject || "request"} references because its lookup service is not loaded. Please contact support.`,
+        );
+      }
+
       if (!idsByService.has(reference.service)) {
         idsByService.set(reference.service, new Map());
       }

package/Server/Utils/Database/RelationValueUtil.ts

@@ -0,0 +1,106 @@
+import ObjectID from "../../../Types/ObjectID";
+
+/*
+ * A relation (Entity / EntityArray) value reaches the write path in several
+ * shapes: a model instance, a plain `{ _id }` object from a request body, a
+ * bare id string, or an ObjectID. A model instance and a plain object both
+ * stringify to "[object Object]", so a comparison through toString() cannot
+ * tell one set of related rows from another. These helpers reduce every shape
+ * to the ids it refers to - the only thing that identifies a relation.
+ */
+
+const ID_KEYS: ReadonlyArray<string> = ["_id", "id"];
+
+export default class RelationValueUtil {
+  /*
+   * The id a single relation value refers to, or null when it carries none
+   * (null, an unsaved model, an object that is not a reference).
+   */
+  public static getRelationId(value: unknown): string | null {
+    if (value === null || value === undefined) {
+      return null;
+    }
+
+    if (value instanceof ObjectID || typeof value === "string") {
+      const id: string = value.toString();
+      return id.length > 0 ? id : null;
+    }
+
+    if (typeof value !== "object" || Array.isArray(value)) {
+      return null;
+    }
+
+    const record: Record<string, unknown> = value as Record<string, unknown>;
+
+    for (const key of ID_KEYS) {
+      const candidate: unknown = record[key];
+
+      if (candidate instanceof ObjectID || typeof candidate === "string") {
+        const id: string = candidate.toString();
+
+        if (id.length > 0) {
+          return id;
+        }
+      }
+    }
+
+    return null;
+  }
+
+  /*
+   * The sorted, de-duplicated ids a relation value refers to: every element
+   * of a many-to-many value, or the single id of a many-to-one value. Ids are
+   * compared case-insensitively, as Postgres compares uuids.
+   *
+   * Null when the value cannot be compared by id - it is absent (not loaded,
+   * or cleared to null) or holds an element that is not a reference - so a
+   * caller can fall back to its own comparison instead of guessing.
+   */
+  public static getRelationIdSet(value: unknown): Array<string> | null {
+    if (value === null || value === undefined) {
+      return null;
+    }
+
+    const elements: Array<unknown> = Array.isArray(value) ? value : [value];
+    const ids: Set<string> = new Set<string>();
+
+    for (const element of elements) {
+      const id: string | null = RelationValueUtil.getRelationId(element);
+
+      if (!id) {
+        return null;
+      }
+
+      ids.add(id.toLowerCase());
+    }
+
+    return Array.from(ids).sort();
+  }
+
+  /*
+   * Whether two relation values refer to the same rows, ignoring order and
+   * duplicates: the order a relation array comes back in carries no meaning.
+   * Null when either side cannot be compared by id (see getRelationIdSet).
+   */
+  public static haveSameRelationIds(
+    current: unknown,
+    updated: unknown,
+  ): boolean | null {
+    const currentIds: Array<string> | null =
+      RelationValueUtil.getRelationIdSet(current);
+    const updatedIds: Array<string> | null =
+      RelationValueUtil.getRelationIdSet(updated);
+
+    if (!currentIds || !updatedIds) {
+      return null;
+    }
+
+    if (currentIds.length !== updatedIds.length) {
+      return false;
+    }
+
+    return currentIds.every((id: string, index: number): boolean => {
+      return id === updatedIds[index];
+    });
+  }
+}