@oneuptime/common 13.0.6 → 13.0.7

package/Server/Services/ScheduledMaintenanceService.ts

@@ -23,7 +23,6 @@ import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import ObjectID from "../../Types/ObjectID";
-import Typeof from "../../Types/Typeof";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import Model from "../../Models/DatabaseModels/ScheduledMaintenance";
@@ -75,6 +74,7 @@ import NotificationRuleWorkspaceChannel from "../../Types/Workspace/Notification
 import { MessageBlocksByWorkspaceType } from "./WorkspaceNotificationRuleService";
 import ScheduledMaintenanceWorkspaceMessages from "../Utils/Workspace/WorkspaceMessages/ScheduledMaintenance";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import ProjectService from "./ProjectService";
 import StatusPageSubscriberNotificationTemplateService, {
   Service as StatusPageSubscriberNotificationTemplateServiceClass,
@@ -1447,39 +1447,18 @@ ${scheduledMaintenance.description || "No description provided."}
     notifyOwners: boolean,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: ScheduledMaintenanceOwnerTeam =
-        new ScheduledMaintenanceOwnerTeam();
-      teamOwner.scheduledMaintenanceId = scheduledMaintenanceId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-
-      await ScheduledMaintenanceOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: ScheduledMaintenanceOwnerUser =
-        new ScheduledMaintenanceOwnerUser();
-      teamOwner.scheduledMaintenanceId = scheduledMaintenanceId;
-      teamOwner.projectId = projectId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-      teamOwner.userId = userId;
-      await ScheduledMaintenanceOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the event are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: ScheduledMaintenanceOwnerUserService,
+      ownerTeamService: ScheduledMaintenanceOwnerTeamService,
+      resourceIdColumn: "scheduledMaintenanceId",
+      resourceId: scheduledMaintenanceId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      isOwnerNotified: !notifyOwners,
+      props: props,
+    });
   }
 
   @CaptureSpan()

package/Server/Services/ScheduledMaintenanceTemplateService.ts

@@ -4,7 +4,6 @@ import ScheduledMaintenanceTemplateOwnerTeamService from "./ScheduledMaintenance
 import ScheduledMaintenanceTemplateOwnerUserService from "./ScheduledMaintenanceTemplateOwnerUserService";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import ObjectID from "../../Types/ObjectID";
-import Typeof from "../../Types/Typeof";
 import Model from "../../Models/DatabaseModels/ScheduledMaintenanceTemplate";
 import MonitorStatusService from "./MonitorStatusService";
 import Dictionary from "../../Types/Dictionary";
@@ -12,8 +11,6 @@ import ProjectScopedReferenceValidator, {
   ProjectScopedReference,
   resolveReferenceId,
 } from "../Utils/Database/ProjectScopedReferenceValidator";
-import ScheduledMaintenanceTemplateOwnerTeam from "../../Models/DatabaseModels/ScheduledMaintenanceTemplateOwnerTeam";
-import ScheduledMaintenanceTemplateOwnerUser from "../../Models/DatabaseModels/ScheduledMaintenanceTemplateOwnerUser";
 import CreateBy from "../Types/Database/CreateBy";
 import OneUptimeDate from "../../Types/Date";
 import Recurring from "../../Types/Events/Recurring";
@@ -22,6 +19,7 @@ import QueryDeepPartialEntity from "../../Types/Database/PartialEntity";
 import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -385,37 +383,17 @@ export class Service extends DatabaseService<Model> {
     teamIds: Array<ObjectID>,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: ScheduledMaintenanceTemplateOwnerTeam =
-        new ScheduledMaintenanceTemplateOwnerTeam();
-      teamOwner.scheduledMaintenanceTemplateId = scheduledMaintenanceTemplateId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-
-      await ScheduledMaintenanceTemplateOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: ScheduledMaintenanceTemplateOwnerUser =
-        new ScheduledMaintenanceTemplateOwnerUser();
-      teamOwner.scheduledMaintenanceTemplateId = scheduledMaintenanceTemplateId;
-      teamOwner.projectId = projectId;
-      teamOwner.userId = userId;
-      await ScheduledMaintenanceTemplateOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the template are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: ScheduledMaintenanceTemplateOwnerUserService,
+      ownerTeamService: ScheduledMaintenanceTemplateOwnerTeamService,
+      resourceIdColumn: "scheduledMaintenanceTemplateId",
+      resourceId: scheduledMaintenanceTemplateId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      props: props,
+    });
   }
 }
 export default new Service();

package/Server/Services/ServerlessFunctionOwnerRuleEngineService.ts

@@ -240,11 +240,15 @@ class ServerlessFunctionOwnerRuleEngineServiceClass
         owner.projectId = serverlessFunction.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await ServerlessFunctionOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: ServerlessFunctionOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -254,11 +258,15 @@ class ServerlessFunctionOwnerRuleEngineServiceClass
         owner.projectId = serverlessFunction.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await ServerlessFunctionOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: ServerlessFunctionOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/ServiceOwnerRuleEngineService.ts

@@ -249,11 +249,15 @@ class ServiceOwnerRuleEngineServiceClass
         owner.serviceId = service.id;
         owner.projectId = service.projectId;
         owner.userId = new ObjectID(userId);
-        await ServiceOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: ServiceOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -261,11 +265,15 @@ class ServiceOwnerRuleEngineServiceClass
         owner.serviceId = service.id;
         owner.projectId = service.projectId;
         owner.teamId = new ObjectID(teamId);
-        await ServiceOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: ServiceOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/StatusPagePrivateUserService.ts

@@ -145,35 +145,6 @@ export class Service extends DatabaseService<Model> {
     _onCreate: OnCreate<Model>,
     createdItem: Model,
   ): Promise<Model> {
-    /*
-     * The invite link doubles as this user's first password-reset link, so the
-     * column has to hold what `/status-page-api/reset-password` looks rows up
-     * by: the SHA-256 of the token, never the token itself. That endpoint
-     * hashes whatever the link carried and queries by the digest, so a raw
-     * token stored here matches nothing and the welcome link is dead on
-     * arrival -- and it would also leave a working bearer credential sitting
-     * in the database in plaintext.
-     *
-     * Same split as `/status-page-api/forgot-password`: the digest is
-     * persisted, the raw token is only ever mailed.
-     */
-    const token: string = ObjectID.generate().toString();
-    const hashedToken: string = await HashedString.hashValue(
-      token,
-      EncryptionSecret,
-    );
-    await this.updateOneById({
-      id: createdItem.id!,
-      data: {
-        resetPasswordToken: hashedToken,
-        resetPasswordExpires: OneUptimeDate.getOneDayAfter(),
-      },
-      props: {
-        isRoot: true,
-        ignoreHooks: true,
-      },
-    });
-
     if (createdItem.isSsoUser) {
       return createdItem;
     }
@@ -190,6 +161,7 @@ export class Service extends DatabaseService<Model> {
         pageTitle: true,
         logoFileId: true,
         projectId: true,
+        requireSsoForLogin: true,
         smtpConfig: {
           _id: true,
           transportType: true,
@@ -214,6 +186,43 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Status Page not found");
     }
 
+    /*
+     * SCIM and admin-created users must follow the page's login policy too.
+     * Do not create a password-reset credential when only SSO can be used.
+     */
+    if (statusPage.requireSsoForLogin) {
+      return createdItem;
+    }
+
+    /*
+     * The invite link doubles as this user's first password-reset link, so the
+     * column has to hold what `/status-page-api/reset-password` looks rows up
+     * by: the SHA-256 of the token, never the token itself. That endpoint
+     * hashes whatever the link carried and queries by the digest, so a raw
+     * token stored here matches nothing and the welcome link is dead on
+     * arrival -- and it would also leave a working bearer credential sitting
+     * in the database in plaintext.
+     *
+     * Same split as `/status-page-api/forgot-password`: the digest is
+     * persisted, the raw token is only ever mailed.
+     */
+    const token: string = ObjectID.generate().toString();
+    const hashedToken: string = await HashedString.hashValue(
+      token,
+      EncryptionSecret,
+    );
+    await this.updateOneById({
+      id: createdItem.id!,
+      data: {
+        resetPasswordToken: hashedToken,
+        resetPasswordExpires: OneUptimeDate.getOneDayAfter(),
+      },
+      props: {
+        isRoot: true,
+        ignoreHooks: true,
+      },
+    });
+
     const statusPageName: string | undefined =
       statusPage.pageTitle || statusPage.name;
 

package/Server/Services/StatusPagePrivateUserSessionService.ts

@@ -1,4 +1,5 @@
 import DatabaseService from "./DatabaseService";
+import StatusPagePrivateUserService from "./StatusPagePrivateUserService";
 import Model from "../../Models/DatabaseModels/StatusPagePrivateUserSession";
 import ObjectID from "../../Types/ObjectID";
 import { JSONObject } from "../../Types/JSON";
@@ -9,7 +10,7 @@ import Text from "../../Types/Text";
 import logger from "../Utils/Logger";
 import Exception from "../../Types/Exception/Exception";
 import BadDataException from "../../Types/Exception/BadDataException";
-import { JsonContains, MoreThan, UpdateResult } from "typeorm";
+import { IsNull, JsonContains, MoreThan, UpdateResult } from "typeorm";
 
 export interface SessionMetadata {
   session: Model;
@@ -75,6 +76,12 @@ export class Service extends DatabaseService<Model> {
 
   public constructor() {
     super(Model);
+
+    /*
+     * Login codes use this same column for their five-minute expiry. Purge
+     * expired credentials and their device metadata after 30 more days.
+     */
+    this.hardDeleteItemsOlderThanInDays("refreshTokenExpiresAt", 30);
   }
 
   public async createSession(
@@ -98,6 +105,9 @@ export class Service extends DatabaseService<Model> {
         },
       });
 
+      // Password sign-in and both SSO callbacks issue their session here.
+      await this.recordSuccessfulSignIn(options);
+
       return {
         session: createdSession,
         refreshToken,
@@ -233,6 +243,8 @@ export class Service extends DatabaseService<Model> {
     if (
       !session?.id ||
       !session.statusPageId ||
+      !session.statusPagePrivateUserId ||
+      !session.projectId ||
       !this.isLoginCodeSession(session) ||
       session.statusPageId.toString() !== options.statusPageId.toString()
     ) {
@@ -291,6 +303,12 @@ export class Service extends DatabaseService<Model> {
 
     Object.assign(session, updatePayload);
 
+    await this.recordSuccessfulSignIn({
+      projectId: session.projectId,
+      statusPageId: session.statusPageId,
+      statusPagePrivateUserId: session.statusPagePrivateUserId,
+    });
+
     return {
       session,
       refreshToken,
@@ -365,6 +383,36 @@ export class Service extends DatabaseService<Model> {
     await this.revokeSessionById(session.id, options);
   }
 
+  private async recordSuccessfulSignIn(
+    options: Pick<
+      CreateSessionOptions,
+      "projectId" | "statusPageId" | "statusPagePrivateUserId"
+    >,
+  ): Promise<void> {
+    /*
+     * Scope the write to the complete identity carried by the session. A
+     * deleted or moved user must not gain activity from an old login code.
+     */
+    try {
+      await StatusPagePrivateUserService.getRepository().update(
+        {
+          _id: options.statusPagePrivateUserId.toString(),
+          projectId: options.projectId,
+          statusPageId: options.statusPageId,
+          deletedAt: IsNull(),
+        },
+        {
+          lastActive: OneUptimeDate.getCurrentDate(),
+        },
+      );
+    } catch {
+      // Activity bookkeeping must not burn an already-consumed login code.
+      logger.warn(
+        `Failed to record sign-in activity for status page private user ${options.statusPagePrivateUserId.toString()}`,
+      );
+    }
+  }
+
   private buildSessionModel(
     options: CreateSessionOptions,
     tokenMeta: { refreshToken: string; refreshTokenExpiresAt: Date },

package/Server/Services/StatusPageService.ts

@@ -17,6 +17,7 @@ import StatusPageLabelRuleEngineService from "./StatusPageLabelRuleEngineService
 import StatusPageOwnerRuleEngineService from "./StatusPageOwnerRuleEngineService";
 import StatusPageOwnerTeamService from "./StatusPageOwnerTeamService";
 import StatusPageOwnerUserService from "./StatusPageOwnerUserService";
+import StatusPagePrivateUserSessionService from "./StatusPagePrivateUserSessionService";
 import TeamMemberService from "./TeamMemberService";
 import Hostname from "../../Types/API/Hostname";
 import Protocol from "../../Types/API/Protocol";
@@ -28,12 +29,12 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import JSONWebTokenData from "../../Types/JsonWebTokenData";
 import ObjectID from "../../Types/ObjectID";
 import PositiveNumber from "../../Types/PositiveNumber";
-import Typeof from "../../Types/Typeof";
 import MonitorStatus from "../../Models/DatabaseModels/MonitorStatus";
 import StatusPage from "../../Models/DatabaseModels/StatusPage";
 import StatusPageDomain from "../../Models/DatabaseModels/StatusPageDomain";
 import StatusPageOwnerTeam from "../../Models/DatabaseModels/StatusPageOwnerTeam";
 import StatusPageOwnerUser from "../../Models/DatabaseModels/StatusPageOwnerUser";
+import StatusPagePrivateUserSession from "../../Models/DatabaseModels/StatusPagePrivateUserSession";
 import User from "../../Models/DatabaseModels/User";
 import {
   AllowedStatusPageCountInFreePlan,
@@ -69,6 +70,7 @@ import UptimeUtil, { UptimeWindow } from "../../Utils/Uptime/UptimeUtil";
 import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
 import IP from "../../Types/IP/IP";
 import { resolveClientIp } from "../Utils/ClientIp";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
 import ForbiddenException from "../../Types/Exception/ForbiddenException";
 import MasterPasswordRequiredException from "../../Types/Exception/MasterPasswordRequiredException";
@@ -509,37 +511,18 @@ export class Service extends DatabaseService<StatusPage> {
     notifyOwners: boolean,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: StatusPageOwnerTeam = new StatusPageOwnerTeam();
-      teamOwner.statusPageId = statusPageId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-
-      await StatusPageOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: StatusPageOwnerUser = new StatusPageOwnerUser();
-      teamOwner.statusPageId = statusPageId;
-      teamOwner.projectId = projectId;
-      teamOwner.userId = userId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-      await StatusPageOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the status page are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: StatusPageOwnerUserService,
+      ownerTeamService: StatusPageOwnerTeamService,
+      resourceIdColumn: "statusPageId",
+      resourceId: statusPageId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      isOwnerNotified: !notifyOwners,
+      props: props,
+    });
   }
 
   @CaptureSpan()
@@ -658,10 +641,50 @@ export class Service extends DatabaseService<StatusPage> {
             token as string,
           );
 
-          if (decoded.statusPageId?.toString() === statusPageId.toString()) {
-            return {
-              hasReadAccess: true,
-            };
+          if (
+            statusPage &&
+            decoded.statusPageId?.toString() === statusPageId.toString() &&
+            decoded.sessionId &&
+            ObjectID.isValidUUID(decoded.sessionId.toString()) &&
+            decoded.userId &&
+            ObjectID.isValidUUID(decoded.userId.toString())
+          ) {
+            /*
+             * One primary-key lookup joined to the private user. Do not cache
+             * authorization: revocation and soft deletion must take effect on
+             * the next request, even while the access JWT remains unexpired.
+             */
+            const session: StatusPagePrivateUserSession | null =
+              await StatusPagePrivateUserSessionService.getQueryBuilder(
+                "session",
+              )
+                .select(["session._id", "session.additionalInfo"])
+                .innerJoin("session.statusPagePrivateUser", "privateUser")
+                .where("session._id = :sessionId", {
+                  sessionId: decoded.sessionId.toString(),
+                })
+                .andWhere("session.statusPageId = :statusPageId", {
+                  statusPageId: statusPageId.toString(),
+                })
+                .andWhere("session.statusPagePrivateUserId = :userId", {
+                  userId: decoded.userId.toString(),
+                })
+                .andWhere("privateUser.statusPageId = :statusPageId")
+                .andWhere("privateUser.deletedAt IS NULL")
+                .andWhere("session.isRevoked = false")
+                .andWhere("session.refreshTokenExpiresAt > :now", {
+                  now: OneUptimeDate.getCurrentDate(),
+                })
+                .getOne();
+
+            if (
+              session &&
+              !StatusPagePrivateUserSessionService.isLoginCodeSession(session)
+            ) {
+              return {
+                hasReadAccess: true,
+              };
+            }
           }
         } catch (err) {
           logger.error(err, {

package/Server/Services/UserSessionService.ts

@@ -58,6 +58,12 @@ export class Service extends DatabaseService<Model> {
 
   public constructor() {
     super(Model);
+
+    /*
+     * Bound retention of expired and revoked sessions, including device data,
+     * without deleting sessions that have renewed their refresh credentials.
+     */
+    this.hardDeleteItemsOlderThanInDays("refreshTokenExpiresAt", 30);
   }
 
   public async createSession(

package/Server/Services/VMwareVCenterOwnerRuleEngineService.ts

@@ -253,11 +253,15 @@ class VMwareVCenterOwnerRuleEngineServiceClass
         owner.projectId = vmwareVCenter.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await VMwareVCenterOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: VMwareVCenterOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -266,11 +270,15 @@ class VMwareVCenterOwnerRuleEngineServiceClass
         owner.projectId = vmwareVCenter.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await VMwareVCenterOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: VMwareVCenterOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/WorkflowOwnerRuleEngineService.ts

@@ -245,11 +245,15 @@ class WorkflowOwnerRuleEngineServiceClass
         owner.projectId = workflow.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await WorkflowOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: WorkflowOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -258,11 +262,15 @@ class WorkflowOwnerRuleEngineServiceClass
         owner.projectId = workflow.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await WorkflowOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: WorkflowOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }