@oneuptime/common 13.0.6 → 13.0.8

package/Server/Services/StatusPagePrivateUserService.ts

@@ -145,35 +145,6 @@ export class Service extends DatabaseService<Model> {
     _onCreate: OnCreate<Model>,
     createdItem: Model,
   ): Promise<Model> {
-    /*
-     * The invite link doubles as this user's first password-reset link, so the
-     * column has to hold what `/status-page-api/reset-password` looks rows up
-     * by: the SHA-256 of the token, never the token itself. That endpoint
-     * hashes whatever the link carried and queries by the digest, so a raw
-     * token stored here matches nothing and the welcome link is dead on
-     * arrival -- and it would also leave a working bearer credential sitting
-     * in the database in plaintext.
-     *
-     * Same split as `/status-page-api/forgot-password`: the digest is
-     * persisted, the raw token is only ever mailed.
-     */
-    const token: string = ObjectID.generate().toString();
-    const hashedToken: string = await HashedString.hashValue(
-      token,
-      EncryptionSecret,
-    );
-    await this.updateOneById({
-      id: createdItem.id!,
-      data: {
-        resetPasswordToken: hashedToken,
-        resetPasswordExpires: OneUptimeDate.getOneDayAfter(),
-      },
-      props: {
-        isRoot: true,
-        ignoreHooks: true,
-      },
-    });
-
     if (createdItem.isSsoUser) {
       return createdItem;
     }
@@ -190,6 +161,7 @@ export class Service extends DatabaseService<Model> {
         pageTitle: true,
         logoFileId: true,
         projectId: true,
+        requireSsoForLogin: true,
         smtpConfig: {
           _id: true,
           transportType: true,
@@ -214,6 +186,43 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException("Status Page not found");
     }
 
+    /*
+     * SCIM and admin-created users must follow the page's login policy too.
+     * Do not create a password-reset credential when only SSO can be used.
+     */
+    if (statusPage.requireSsoForLogin) {
+      return createdItem;
+    }
+
+    /*
+     * The invite link doubles as this user's first password-reset link, so the
+     * column has to hold what `/status-page-api/reset-password` looks rows up
+     * by: the SHA-256 of the token, never the token itself. That endpoint
+     * hashes whatever the link carried and queries by the digest, so a raw
+     * token stored here matches nothing and the welcome link is dead on
+     * arrival -- and it would also leave a working bearer credential sitting
+     * in the database in plaintext.
+     *
+     * Same split as `/status-page-api/forgot-password`: the digest is
+     * persisted, the raw token is only ever mailed.
+     */
+    const token: string = ObjectID.generate().toString();
+    const hashedToken: string = await HashedString.hashValue(
+      token,
+      EncryptionSecret,
+    );
+    await this.updateOneById({
+      id: createdItem.id!,
+      data: {
+        resetPasswordToken: hashedToken,
+        resetPasswordExpires: OneUptimeDate.getOneDayAfter(),
+      },
+      props: {
+        isRoot: true,
+        ignoreHooks: true,
+      },
+    });
+
     const statusPageName: string | undefined =
       statusPage.pageTitle || statusPage.name;
 

package/Server/Services/StatusPagePrivateUserSessionService.ts

@@ -1,4 +1,5 @@
 import DatabaseService from "./DatabaseService";
+import StatusPagePrivateUserService from "./StatusPagePrivateUserService";
 import Model from "../../Models/DatabaseModels/StatusPagePrivateUserSession";
 import ObjectID from "../../Types/ObjectID";
 import { JSONObject } from "../../Types/JSON";
@@ -9,7 +10,7 @@ import Text from "../../Types/Text";
 import logger from "../Utils/Logger";
 import Exception from "../../Types/Exception/Exception";
 import BadDataException from "../../Types/Exception/BadDataException";
-import { JsonContains, MoreThan, UpdateResult } from "typeorm";
+import { IsNull, JsonContains, MoreThan, UpdateResult } from "typeorm";
 
 export interface SessionMetadata {
   session: Model;
@@ -75,6 +76,12 @@ export class Service extends DatabaseService<Model> {
 
   public constructor() {
     super(Model);
+
+    /*
+     * Login codes use this same column for their five-minute expiry. Purge
+     * expired credentials and their device metadata after 30 more days.
+     */
+    this.hardDeleteItemsOlderThanInDays("refreshTokenExpiresAt", 30);
   }
 
   public async createSession(
@@ -98,6 +105,9 @@ export class Service extends DatabaseService<Model> {
         },
       });
 
+      // Password sign-in and both SSO callbacks issue their session here.
+      await this.recordSuccessfulSignIn(options);
+
       return {
         session: createdSession,
         refreshToken,
@@ -233,6 +243,8 @@ export class Service extends DatabaseService<Model> {
     if (
       !session?.id ||
       !session.statusPageId ||
+      !session.statusPagePrivateUserId ||
+      !session.projectId ||
       !this.isLoginCodeSession(session) ||
       session.statusPageId.toString() !== options.statusPageId.toString()
     ) {
@@ -291,6 +303,12 @@ export class Service extends DatabaseService<Model> {
 
     Object.assign(session, updatePayload);
 
+    await this.recordSuccessfulSignIn({
+      projectId: session.projectId,
+      statusPageId: session.statusPageId,
+      statusPagePrivateUserId: session.statusPagePrivateUserId,
+    });
+
     return {
       session,
       refreshToken,
@@ -365,6 +383,36 @@ export class Service extends DatabaseService<Model> {
     await this.revokeSessionById(session.id, options);
   }
 
+  private async recordSuccessfulSignIn(
+    options: Pick<
+      CreateSessionOptions,
+      "projectId" | "statusPageId" | "statusPagePrivateUserId"
+    >,
+  ): Promise<void> {
+    /*
+     * Scope the write to the complete identity carried by the session. A
+     * deleted or moved user must not gain activity from an old login code.
+     */
+    try {
+      await StatusPagePrivateUserService.getRepository().update(
+        {
+          _id: options.statusPagePrivateUserId.toString(),
+          projectId: options.projectId,
+          statusPageId: options.statusPageId,
+          deletedAt: IsNull(),
+        },
+        {
+          lastActive: OneUptimeDate.getCurrentDate(),
+        },
+      );
+    } catch {
+      // Activity bookkeeping must not burn an already-consumed login code.
+      logger.warn(
+        `Failed to record sign-in activity for status page private user ${options.statusPagePrivateUserId.toString()}`,
+      );
+    }
+  }
+
   private buildSessionModel(
     options: CreateSessionOptions,
     tokenMeta: { refreshToken: string; refreshTokenExpiresAt: Date },

package/Server/Services/StatusPageService.ts

@@ -17,6 +17,7 @@ import StatusPageLabelRuleEngineService from "./StatusPageLabelRuleEngineService
 import StatusPageOwnerRuleEngineService from "./StatusPageOwnerRuleEngineService";
 import StatusPageOwnerTeamService from "./StatusPageOwnerTeamService";
 import StatusPageOwnerUserService from "./StatusPageOwnerUserService";
+import StatusPagePrivateUserSessionService from "./StatusPagePrivateUserSessionService";
 import TeamMemberService from "./TeamMemberService";
 import Hostname from "../../Types/API/Hostname";
 import Protocol from "../../Types/API/Protocol";
@@ -28,12 +29,12 @@ import BadDataException from "../../Types/Exception/BadDataException";
 import JSONWebTokenData from "../../Types/JsonWebTokenData";
 import ObjectID from "../../Types/ObjectID";
 import PositiveNumber from "../../Types/PositiveNumber";
-import Typeof from "../../Types/Typeof";
 import MonitorStatus from "../../Models/DatabaseModels/MonitorStatus";
 import StatusPage from "../../Models/DatabaseModels/StatusPage";
 import StatusPageDomain from "../../Models/DatabaseModels/StatusPageDomain";
 import StatusPageOwnerTeam from "../../Models/DatabaseModels/StatusPageOwnerTeam";
 import StatusPageOwnerUser from "../../Models/DatabaseModels/StatusPageOwnerUser";
+import StatusPagePrivateUserSession from "../../Models/DatabaseModels/StatusPagePrivateUserSession";
 import User from "../../Models/DatabaseModels/User";
 import {
   AllowedStatusPageCountInFreePlan,
@@ -69,6 +70,7 @@ import UptimeUtil, { UptimeWindow } from "../../Utils/Uptime/UptimeUtil";
 import UptimePrecision from "../../Types/StatusPage/UptimePrecision";
 import IP from "../../Types/IP/IP";
 import { resolveClientIp } from "../Utils/ClientIp";
+import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
 import NotAuthenticatedException from "../../Types/Exception/NotAuthenticatedException";
 import ForbiddenException from "../../Types/Exception/ForbiddenException";
 import MasterPasswordRequiredException from "../../Types/Exception/MasterPasswordRequiredException";
@@ -509,37 +511,18 @@ export class Service extends DatabaseService<StatusPage> {
     notifyOwners: boolean,
     props: DatabaseCommonInteractionProps,
   ): Promise<void> {
-    for (let teamId of teamIds) {
-      if (typeof teamId === Typeof.String) {
-        teamId = new ObjectID(teamId.toString());
-      }
-
-      const teamOwner: StatusPageOwnerTeam = new StatusPageOwnerTeam();
-      teamOwner.statusPageId = statusPageId;
-      teamOwner.projectId = projectId;
-      teamOwner.teamId = teamId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-
-      await StatusPageOwnerTeamService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
-
-    for (let userId of userIds) {
-      if (typeof userId === Typeof.String) {
-        userId = new ObjectID(userId.toString());
-      }
-      const teamOwner: StatusPageOwnerUser = new StatusPageOwnerUser();
-      teamOwner.statusPageId = statusPageId;
-      teamOwner.projectId = projectId;
-      teamOwner.userId = userId;
-      teamOwner.isOwnerNotified = !notifyOwners;
-      await StatusPageOwnerUserService.create({
-        data: teamOwner,
-        props: props,
-      });
-    }
+    // Owners already on the status page are skipped, not added a second time.
+    await OwnerRuleAssignment.addOwners({
+      ownerUserService: StatusPageOwnerUserService,
+      ownerTeamService: StatusPageOwnerTeamService,
+      resourceIdColumn: "statusPageId",
+      resourceId: statusPageId,
+      projectId: projectId,
+      userIds: userIds,
+      teamIds: teamIds,
+      isOwnerNotified: !notifyOwners,
+      props: props,
+    });
   }
 
   @CaptureSpan()
@@ -658,10 +641,50 @@ export class Service extends DatabaseService<StatusPage> {
             token as string,
           );
 
-          if (decoded.statusPageId?.toString() === statusPageId.toString()) {
-            return {
-              hasReadAccess: true,
-            };
+          if (
+            statusPage &&
+            decoded.statusPageId?.toString() === statusPageId.toString() &&
+            decoded.sessionId &&
+            ObjectID.isValidUUID(decoded.sessionId.toString()) &&
+            decoded.userId &&
+            ObjectID.isValidUUID(decoded.userId.toString())
+          ) {
+            /*
+             * One primary-key lookup joined to the private user. Do not cache
+             * authorization: revocation and soft deletion must take effect on
+             * the next request, even while the access JWT remains unexpired.
+             */
+            const session: StatusPagePrivateUserSession | null =
+              await StatusPagePrivateUserSessionService.getQueryBuilder(
+                "session",
+              )
+                .select(["session._id", "session.additionalInfo"])
+                .innerJoin("session.statusPagePrivateUser", "privateUser")
+                .where("session._id = :sessionId", {
+                  sessionId: decoded.sessionId.toString(),
+                })
+                .andWhere("session.statusPageId = :statusPageId", {
+                  statusPageId: statusPageId.toString(),
+                })
+                .andWhere("session.statusPagePrivateUserId = :userId", {
+                  userId: decoded.userId.toString(),
+                })
+                .andWhere("privateUser.statusPageId = :statusPageId")
+                .andWhere("privateUser.deletedAt IS NULL")
+                .andWhere("session.isRevoked = false")
+                .andWhere("session.refreshTokenExpiresAt > :now", {
+                  now: OneUptimeDate.getCurrentDate(),
+                })
+                .getOne();
+
+            if (
+              session &&
+              !StatusPagePrivateUserSessionService.isLoginCodeSession(session)
+            ) {
+              return {
+                hasReadAccess: true,
+              };
+            }
           }
         } catch (err) {
           logger.error(err, {

package/Server/Services/TeamPermissionService.ts

@@ -2,6 +2,8 @@ import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
 import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
+import ModelPermission from "../Types/Database/Permissions/Index";
+import QueryHelper from "../Types/Database/QueryHelper";
 import AccessTokenService from "./AccessTokenService";
 import DatabaseService from "./DatabaseService";
 import TeamMemberService from "./TeamMemberService";
@@ -11,7 +13,7 @@ import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCom
 import DatabaseCommonInteractionPropsUtil, {
   PermissionType,
 } from "../../Types/BaseDatabase/DatabaseCommonInteractionPropsUtil";
-import LIMIT_MAX, { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
 import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
 import PermissionScope from "../../Types/Database/AccessControl/PermissionScope";
@@ -112,6 +114,11 @@ export class Service extends DatabaseService<Model> {
         data.props,
         PermissionType.Allow,
       );
+    const callerBlocks: Array<UserPermission> =
+      DatabaseCommonInteractionPropsUtil.getUserPermissions(
+        data.props,
+        PermissionType.Block,
+      );
 
     /*
      * ProjectOwner is the sole tenant-level delegation override. In
@@ -123,6 +130,12 @@ export class Service extends DatabaseService<Model> {
      */
     if (
       callerPermissions.some((permission: UserPermission) => {
+        return (
+          permission.permission === Permission.ProjectOwner &&
+          this.permissionCoversGrant(permission, PermissionScope.All, [])
+        );
+      }) &&
+      !callerBlocks.some((permission: UserPermission) => {
         return permission.permission === Permission.ProjectOwner;
       })
     ) {
@@ -142,7 +155,38 @@ export class Service extends DatabaseService<Model> {
         );
       });
 
-    if (!canDelegate) {
+    const matchingBlocks: Array<UserPermission> = callerBlocks.filter(
+      (permission: UserPermission) => {
+        return permission.permission === data.permission;
+      },
+    );
+    const targetHasLabelScope: boolean =
+      targetLabelIds.length > 0 &&
+      data.scope !== PermissionScope.All &&
+      data.scope !== PermissionScope.Owned;
+    const isBlocked: boolean = matchingBlocks.some(
+      (permission: UserPermission) => {
+        /*
+         * An unrestricted/Owned grant may include resources blocked from the
+         * caller. Ownership also cannot be transferred between principals.
+         */
+        if (
+          !targetHasLabelScope ||
+          permission.scope === PermissionScope.All ||
+          permission.scope === PermissionScope.Owned ||
+          permission.labelIds.length === 0
+        ) {
+          return true;
+        }
+        return permission.labelIds.some((blockedLabelId: ObjectID) => {
+          return targetLabelIds.some((labelId: ObjectID) => {
+            return labelId.toString() === blockedLabelId.toString();
+          });
+        });
+      },
+    );
+
+    if (!canDelegate || isBlocked) {
       throw new NotAuthorizedException(
         `You cannot grant ${data.permission} because your own access does not include that permission at an equal or broader scope.`,
       );
@@ -349,13 +393,33 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
-    const teamPermissions: Array<Model> = await this.findBy({
+    updateBy.query = await ModelPermission.checkUpdateQueryPermissions(
+      Model,
+      updateBy.query,
+      updateBy.data,
+      updateBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: updateBy.query,
+      select: { _id: true },
+      skip: updateBy.skip,
+      limit: updateBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    // Read complete labels independently of any relation filters in the query.
+    const teamPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         teamId: true,
         projectId: true,
         permission: true,
+        isBlockPermission: true,
         labels: {
           _id: true,
         },
@@ -364,8 +428,6 @@ export class Service extends DatabaseService<Model> {
           isPermissionsEditable: true,
         },
       },
-      skip: 0,
-      limit: LIMIT_MAX,
       props: {
         isRoot: true,
       },
@@ -404,6 +466,16 @@ export class Service extends DatabaseService<Model> {
           ? (rawUpdateData.scope as PermissionScope)
           : permission.scope;
 
+      // Retargeting or narrowing a deny also removes its original restriction.
+      if (permission.isBlockPermission) {
+        this.assertCanGrantPermission({
+          permission: permission.permission!,
+          labelIds: this.getLabelIds(permission.labels),
+          scope: permission.scope,
+          props: updateBy.props,
+        });
+      }
+
       this.assertCanGrantPermission({
         permission: requestedPermission,
         labelIds: this.getLabelIds(requestedLabels),
@@ -413,24 +485,7 @@ export class Service extends DatabaseService<Model> {
     }
 
     if (updateBy.data.labels && updateBy.data.labels.length > 0) {
-      const existingPermissions: Array<Model> = await this.findBy({
-        query: updateBy.query,
-        select: {
-          _id: true,
-          labels: true,
-          isBlockPermission: true,
-          projectId: true,
-          teamId: true,
-          permission: true,
-        },
-        limit: LIMIT_PER_PROJECT,
-        skip: 0,
-        props: {
-          isRoot: true,
-        },
-      });
-
-      for (const alreadySavedPermission of existingPermissions) {
+      for (const alreadySavedPermission of teamPermissions) {
         // check if the
 
         const isBlockPermission: boolean =
@@ -471,6 +526,8 @@ export class Service extends DatabaseService<Model> {
       }
     }
 
+    updateBy.query = { ...updateBy.query, _id: QueryHelper.any(selectedIds) };
+    updateBy.skip = 0;
     return { updateBy, carryForward: teamPermissions };
   }
 
@@ -523,31 +580,68 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<Model>,
   ): Promise<OnDelete<Model>> {
-    const teamPermissions: Array<Model> = await this.findBy({
+    // Scope the root lookup using the same delete authorization as the write.
+    deleteBy.query = await ModelPermission.checkDeleteQueryPermission(
+      Model,
+      deleteBy.query,
+      deleteBy.props,
+    );
+    const selectedPermissions: Array<Model> = await this.findAllBy({
       query: deleteBy.query,
+      select: { _id: true },
+      skip: deleteBy.skip,
+      limit: deleteBy.limit,
+      props: { isRoot: true },
+    });
+    const selectedIds: Array<ObjectID> = selectedPermissions.map(
+      (row: Model) => {
+        return row.id!;
+      },
+    );
+    const teamPermissions: Array<Model> = await this.findAllBy({
+      query: { _id: QueryHelper.any(selectedIds) },
       select: {
         _id: true,
         teamId: true,
         projectId: true,
+        permission: true,
+        isBlockPermission: true,
+        labels: { _id: true },
+        scope: true,
         team: {
           isPermissionsEditable: true,
         },
       },
-      skip: 0,
-      limit: LIMIT_MAX,
       props: {
         isRoot: true,
       },
     });
 
     for (const permission of teamPermissions) {
+      this.assertProjectMatchesTenant(permission.projectId!, deleteBy.props);
       if (!permission.team?.isPermissionsEditable) {
         throw new BadDataException(
           "Permissions for this team is not deleteable. You can create a new team and add permissions to that team instead.",
         );
       }
+
+      if (permission.isBlockPermission) {
+        this.assertCanGrantPermission({
+          permission: permission.permission!,
+          labelIds: this.getLabelIds(permission.labels),
+          scope: permission.scope,
+          props: deleteBy.props,
+        });
+      }
     }
 
+    // Keep the write restricted to the page whose authority was checked.
+    deleteBy.query = {
+      ...deleteBy.query,
+      _id: QueryHelper.any(selectedIds),
+    };
+    deleteBy.skip = 0;
+
     let teamMembers: Array<TeamMember> = [];
 
     for (const permission of teamPermissions) {

package/Server/Services/ThreatIntelFeedService.ts

@@ -9,6 +9,8 @@ import ObjectID from "../../Types/ObjectID";
 import {
   THREAT_INTEL_MINIMUM_CONFIDENCE_MAX,
   THREAT_INTEL_MINIMUM_CONFIDENCE_MIN,
+  THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES,
+  THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES,
 } from "../../Types/SecurityEvent/ThreatIntelConstants";
 import TaxiiClient from "../Utils/SecurityEvent/ThreatIntel/TaxiiClient";
 
@@ -40,11 +42,12 @@ export class Service extends DatabaseService<Model> {
     if (data.pollIntervalInMinutes !== undefined) {
       if (
         !Number.isInteger(data.pollIntervalInMinutes) ||
-        data.pollIntervalInMinutes < 1 ||
-        data.pollIntervalInMinutes > 1440
+        data.pollIntervalInMinutes <
+          THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES ||
+        data.pollIntervalInMinutes > THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES
       ) {
         throw new BadDataException(
-          "Poll interval must be a whole number of minutes between 1 and 1440.",
+          `Poll interval must be a whole number of minutes between ${THREAT_INTEL_POLL_INTERVAL_MIN_IN_MINUTES} and ${THREAT_INTEL_POLL_INTERVAL_MAX_IN_MINUTES}.`,
         );
       }
     }

package/Server/Services/UserSessionService.ts

@@ -58,6 +58,12 @@ export class Service extends DatabaseService<Model> {
 
   public constructor() {
     super(Model);
+
+    /*
+     * Bound retention of expired and revoked sessions, including device data,
+     * without deleting sessions that have renewed their refresh credentials.
+     */
+    this.hardDeleteItemsOlderThanInDays("refreshTokenExpiresAt", 30);
   }
 
   public async createSession(

package/Server/Services/VMwareVCenterOwnerRuleEngineService.ts

@@ -253,11 +253,15 @@ class VMwareVCenterOwnerRuleEngineServiceClass
         owner.projectId = vmwareVCenter.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await VMwareVCenterOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: VMwareVCenterOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -266,11 +270,15 @@ class VMwareVCenterOwnerRuleEngineServiceClass
         owner.projectId = vmwareVCenter.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await VMwareVCenterOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: VMwareVCenterOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }
 

package/Server/Services/WorkflowOwnerRuleEngineService.ts

@@ -245,11 +245,15 @@ class WorkflowOwnerRuleEngineServiceClass
         owner.projectId = workflow.projectId;
         owner.userId = new ObjectID(userId);
         owner.isOwnerNotified = !notify;
-        await WorkflowOwnerUserService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: WorkflowOwnerUserService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
 
       for (const teamId of teamIds) {
@@ -258,11 +262,15 @@ class WorkflowOwnerRuleEngineServiceClass
         owner.projectId = workflow.projectId;
         owner.teamId = new ObjectID(teamId);
         owner.isOwnerNotified = !notify;
-        await WorkflowOwnerTeamService.create({
-          data: owner,
-          props: { isRoot: true },
-        });
-        ownersAdded++;
+        if (
+          await OwnerRuleAssignment.createOwner({
+            ownerService: WorkflowOwnerTeamService,
+            owner: owner,
+            props: { isRoot: true },
+          })
+        ) {
+          ownersAdded++;
+        }
       }
     }