@oneuptime/common 13.0.8 → 14.0.1

package/Types/Database/AccessControl/ColumnAccessControl.ts

@@ -1,5 +1,6 @@
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import { ColumnAccessControl } from "../../BaseDatabase/AccessControl";
+import getCanonicalModelInstance from "../CanonicalModelInstance";
 import Dictionary from "../../Dictionary";
 import { ReflectionMetadataType } from "../../Reflection";
 import "reflect-metadata";
@@ -31,10 +32,12 @@ type GetColumnAccessControlForAllColumnsFunction = <T extends BaseModel>(
 ) => Dictionary<ColumnAccessControl>;
 
 /*
- * Per-class cache. Safe to key on the constructor because every decorated
- * column is initialised to `undefined` in the class body, so Object.keys()
- * is identical for every instance of a class (see OwnerOnlyColumn.ts).
- * Callers must treat the returned dictionary as read-only.
+ * Per-class cache, keyed on the constructor and built from a canonical
+ * instance of that class rather than from whichever instance asked first, so
+ * a caller that has deleted a column off its own instance cannot define what
+ * the class reports for the rest of the process. See
+ * CanonicalModelInstance.ts for the bug this prevents. Callers must treat the
+ * returned dictionary as read-only.
  */
 const accessControlCache: WeakMap<
   { new (): BaseModel },
@@ -50,12 +53,14 @@ export const getColumnAccessControlForAllColumns: GetColumnAccessControlForAllCo
       accessControlCache.get(modelClass);
 
     if (!cached) {
+      const canonical: T | null = getCanonicalModelInstance(target);
+      const metadataSource: T = canonical || target;
       const dictonary: Dictionary<ColumnAccessControl> = {};
-      const keys: Array<string> = Object.keys(target);
+      const keys: Array<string> = Object.keys(metadataSource);
 
       for (const key of keys) {
         const accessControl: ColumnAccessControl | undefined =
-          Reflect.getMetadata(accessControlSymbol, target, key) as
+          Reflect.getMetadata(accessControlSymbol, metadataSource, key) as
             | ColumnAccessControl
             | undefined;
         if (accessControl) {
@@ -64,7 +69,14 @@ export const getColumnAccessControlForAllColumns: GetColumnAccessControlForAllCo
       }
 
       cached = dictonary;
-      accessControlCache.set(modelClass, cached);
+      /*
+       * No canonical instance (see CanonicalModelInstance): answer from the
+       * instance we were handed, but do NOT cache it for the class - that
+       * instance may be a mutilated one, and a cached answer outlives it.
+       */
+      if (canonical) {
+        accessControlCache.set(modelClass, cached);
+      }
     }
 
     return cached;

package/Types/Database/AccessControl/ColumnBillingAccessControl.ts

@@ -1,5 +1,6 @@
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
 import ColumnBillingAccessControl from "../../BaseDatabase/ColumnBillingAccessControl";
+import getCanonicalModelInstance from "../CanonicalModelInstance";
 import Dictionary from "../../Dictionary";
 import { ReflectionMetadataType } from "../../Reflection";
 import "reflect-metadata";
@@ -31,10 +32,12 @@ type GetColumnBillingAccessControlForAllColumnsFunction = <T extends BaseModel>(
 ) => Dictionary<ColumnBillingAccessControl>;
 
 /*
- * Per-class cache. Safe to key on the constructor because every decorated
- * column is initialised to `undefined` in the class body, so Object.keys()
- * is identical for every instance of a class (see OwnerOnlyColumn.ts).
- * Callers must treat the returned dictionary as read-only.
+ * Per-class cache, keyed on the constructor and built from a canonical
+ * instance of that class rather than from whichever instance asked first, so
+ * a caller that has deleted a column off its own instance cannot define what
+ * the class reports for the rest of the process. See
+ * CanonicalModelInstance.ts for the bug this prevents. Callers must treat the
+ * returned dictionary as read-only.
  */
 const billingAccessControlCache: WeakMap<
   { new (): BaseModel },
@@ -50,12 +53,14 @@ export const getColumnBillingAccessControlForAllColumns: GetColumnBillingAccessC
       billingAccessControlCache.get(modelClass);
 
     if (!cached) {
+      const canonical: T | null = getCanonicalModelInstance(target);
+      const metadataSource: T = canonical || target;
       const dictonary: Dictionary<ColumnBillingAccessControl> = {};
-      const keys: Array<string> = Object.keys(target);
+      const keys: Array<string> = Object.keys(metadataSource);
 
       for (const key of keys) {
         const accessControl: ColumnBillingAccessControl | undefined =
-          Reflect.getMetadata(accessControlSymbol, target, key) as
+          Reflect.getMetadata(accessControlSymbol, metadataSource, key) as
             | ColumnBillingAccessControl
             | undefined;
         if (accessControl) {
@@ -64,7 +69,14 @@ export const getColumnBillingAccessControlForAllColumns: GetColumnBillingAccessC
       }
 
       cached = dictonary;
-      billingAccessControlCache.set(modelClass, cached);
+      /*
+       * No canonical instance (see CanonicalModelInstance): answer from the
+       * instance we were handed, but do NOT cache it for the class - that
+       * instance may be a mutilated one, and a cached answer outlives it.
+       */
+      if (canonical) {
+        billingAccessControlCache.set(modelClass, cached);
+      }
     }
 
     return cached;

package/Types/Database/AccessControl/OwnerOnlyColumn.ts

@@ -1,4 +1,5 @@
 import BaseModel from "../../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import getCanonicalModelInstance from "../CanonicalModelInstance";
 import { ReflectionMetadataType } from "../../Reflection";
 import "reflect-metadata";
 
@@ -66,10 +67,14 @@ type GetOwnerOnlyColumnsFunction = <T extends BaseModel>(
 ) => Array<string>;
 
 /**
- * Every owner-only column on this model. Enumerating requires the property to
- * exist on the instance, which it does for every declared column because model
- * columns are initialised to `undefined` in the class body - the same
- * assumption getTableColumns() already makes.
+ * Every owner-only column on this model. Which columns a MODEL marks is a
+ * property of the class, so the enumeration reads a canonical instance of the
+ * class rather than the caller's own instance: a caller that had deleted a
+ * key off its instance would otherwise get an answer that silently omits a
+ * marked column, and this list is what OwnerOnlyColumnPermission enforces
+ * against. See CanonicalModelInstance.ts. (Enumerating at all relies on every
+ * declared column being initialised to `undefined` in the class body - the
+ * same assumption getTableColumns() makes.)
  */
 export const getOwnerOnlyColumns: GetOwnerOnlyColumnsFunction = <
   T extends BaseModel,
@@ -77,9 +82,13 @@ export const getOwnerOnlyColumns: GetOwnerOnlyColumnsFunction = <
   target: T,
 ): Array<string> => {
   const columns: Array<string> = [];
+  // Nothing is cached here, so falling back to the caller's instance is safe.
+  const metadataSource: T = getCanonicalModelInstance(target) || target;
 
-  for (const key of Object.keys(target)) {
-    if (Reflect.getMetadata(ownerOnlyColumnSymbol, target, key) === true) {
+  for (const key of Object.keys(metadataSource)) {
+    if (
+      Reflect.getMetadata(ownerOnlyColumnSymbol, metadataSource, key) === true
+    ) {
       columns.push(key);
     }
   }

package/Types/Database/CanonicalModelInstance.ts

@@ -0,0 +1,102 @@
+/*
+ * The one instance of a model class that column-metadata enumeration is
+ * allowed to look at.
+ *
+ * WHY THIS EXISTS.
+ *
+ * Every "which columns does this model have" lookup in this directory answers
+ * the question by enumerating an INSTANCE's own keys (Object.keys) and then
+ * caching the answer per CLASS. That is only sound while every instance of a
+ * class has the same own keys. The class bodies do guarantee that - each
+ * decorated column is initialised to `undefined` - right up until some caller
+ * deletes a key off a live instance.
+ *
+ * One caller did. BaseAPI.createItem used to `delete item._id` before handing
+ * the model to the service, and DatabaseService.create asks that very instance
+ * for its columns (generateDefaultValues). Whenever the mutilated instance was
+ * the first to ask, the class's cached column list was built WITHOUT `_id` -
+ * permanently, for the life of the process, for every later caller - and since
+ * DatabaseBaseModel.toJSONObject serialises a row by iterating exactly that
+ * list, every API response for that model silently lost its id. A single
+ * create was enough, including a create that was refused, because the columns
+ * are read before the permission check. Rows still carried their real `_id` in
+ * memory and in the SQL projection; it was dropped on the way out.
+ *
+ * So enumeration stopped reading the caller's instance. It reads a frozen,
+ * private instance of the caller's CLASS instead - constructed here, reachable
+ * by nobody, impossible to mutate - so what a class reports about itself can
+ * never depend on which instance happened to ask first, or on what anyone did
+ * to that instance. Reads already constructed a throwaway instance for exactly
+ * this purpose (SelectPermission, QueryPermission, ColumnPermission all do
+ * `new modelType()`), which is why a single read of a model was enough to make
+ * the same create harmless; this makes that the only behaviour.
+ *
+ * Every database model is no-arg constructible (Models/DatabaseModels/Index.ts
+ * relies on it already, in getModelTypeByName), and a fresh instance carries
+ * every declared column - both facts are asserted by
+ * Tests/Types/Database/CanonicalModelInstance.test.ts against all 400+ models.
+ */
+
+type NoArgConstructor = new () => unknown;
+
+const canonicalInstanceCache: WeakMap<NoArgConstructor, unknown> =
+  new WeakMap();
+
+/*
+ * Classes whose canonical instance is being constructed right now. A model
+ * constructor that asked for its own columns would otherwise recurse forever;
+ * such a call gets the caller's instance instead, which is the old behaviour.
+ */
+const beingConstructed: WeakSet<NoArgConstructor> = new WeakSet();
+
+/**
+ * A frozen, shared instance of `target`'s class, safe to enumerate for
+ * metadata - or NULL when no such instance can be made: a class that needs
+ * constructor arguments, a class still being defined (circular imports), a
+ * constructor that throws, or a plain object with no useful constructor.
+ *
+ * Null, rather than falling back to `target`, because the two are NOT
+ * interchangeable and treating them as if they were is how this bug worked in
+ * the first place. A caller with no canonical instance may still answer from
+ * whatever instance it was handed - a metadata lookup must never be the reason
+ * a process fails to boot - but it must not then CACHE that answer for the
+ * class, because the instance it read may be a mutilated one and the cached
+ * answer would outlive it. Returning null forces each caller to make that
+ * decision in the open; the four caches in this directory all take the same
+ * route, and say so where they do it.
+ */
+export default function getCanonicalModelInstance<T>(target: T): T | null {
+  const modelClass: NoArgConstructor | undefined = (
+    target as { constructor?: NoArgConstructor } | null | undefined
+  )?.constructor;
+
+  if (typeof modelClass !== "function") {
+    return null;
+  }
+
+  const cached: unknown = canonicalInstanceCache.get(modelClass);
+
+  if (cached) {
+    return cached as T;
+  }
+
+  if (beingConstructed.has(modelClass)) {
+    return null;
+  }
+
+  let canonical: T;
+
+  beingConstructed.add(modelClass);
+
+  try {
+    canonical = Object.freeze(new modelClass()) as T;
+  } catch {
+    return null;
+  } finally {
+    beingConstructed.delete(modelClass);
+  }
+
+  canonicalInstanceCache.set(modelClass, canonical);
+
+  return canonical;
+}

package/Types/Database/TableColumn.ts

@@ -1,4 +1,5 @@
 import BaseModel from "../../Models/DatabaseModels/DatabaseBaseModel/DatabaseBaseModel";
+import getCanonicalModelInstance from "./CanonicalModelInstance";
 import Dictionary from "../Dictionary";
 import { JSONObject } from "../JSON";
 import { ReflectionMetadataType } from "../Reflection";
@@ -99,9 +100,12 @@ type GetTableColumnsFunction = <T extends BaseModel>(
 ) => Dictionary<TableColumnMetadata>;
 
 /*
- * Per-class cache. Safe to key on the constructor because every decorated
- * column is initialised to `undefined` in the class body, so Object.keys()
- * is identical for every instance of a class (see OwnerOnlyColumn.ts).
+ * Per-class cache, keyed on the constructor and built from a canonical
+ * instance of that class - never from the instance that happened to ask
+ * first. A caller that had deleted a column off its own instance (BaseAPI's
+ * create path used to delete `_id`) would otherwise define the class's column
+ * list without that column for the whole process, and every response for that
+ * model would lose it. See CanonicalModelInstance.ts.
  */
 const tableColumnsCache: WeakMap<
   { new (): BaseModel },
@@ -118,13 +122,15 @@ export const getTableColumns: GetTableColumnsFunction = <T extends BaseModel>(
     tableColumnsCache.get(modelClass);
 
   if (!cached) {
+    const canonical: T | null = getCanonicalModelInstance(target);
+    const metadataSource: T = canonical || target;
     const dictonary: Dictionary<TableColumnMetadata> = {};
-    const keys: Array<string> = Object.keys(target);
+    const keys: Array<string> = Object.keys(metadataSource);
 
     for (const key of keys) {
       const metadata: TableColumnMetadata | undefined = Reflect.getMetadata(
         tableColumn,
-        target,
+        metadataSource,
         key,
       ) as TableColumnMetadata | undefined;
       if (metadata) {
@@ -133,7 +139,15 @@ export const getTableColumns: GetTableColumnsFunction = <T extends BaseModel>(
     }
 
     cached = dictonary;
-    tableColumnsCache.set(modelClass, cached);
+
+    /*
+     * No canonical instance (see CanonicalModelInstance): answer from the
+     * instance we were handed, but do NOT cache it for the class - that
+     * instance may be a mutilated one, and a cached answer outlives it.
+     */
+    if (canonical) {
+      tableColumnsCache.set(modelClass, cached);
+    }
   }
 
   /*

package/Types/EnterpriseLicense/EnterpriseLicensePeriods.ts

@@ -0,0 +1,29 @@
+/*
+ * The two periods a self-hosted Enterprise Edition install runs without a
+ * current license. They are different periods with different lengths, and
+ * the product must never call one by the other's name:
+ *
+ *   trial  an Enterprise install that has never had a license, counted from
+ *          GlobalConfig.enterpriseEditionFirstSeenAt
+ *   grace  a license that expired (a verified license's signed expiry, or an
+ *          unverified legacy license's stored expiry column), counted from
+ *          its expiry
+ *
+ * Until either ends nothing changes; after it, enterprise configuration
+ * becomes read-only and SSO, SCIM and audit logging stop
+ * (EnterpriseEdition.isFeatureActive) until a license is activated.
+ *
+ * They live here, with no server dependency, so the copy that states them in
+ * the browser (the edition dialog, the enterprise banners) derives the
+ * numbers from the same place the license classifier does. Server code reads
+ * them through Common/Server/Enterprise/EnterpriseLicenseSnapshot.
+ */
+
+// How long an expired license keeps working, counted from its expiry.
+export const ENTERPRISE_LICENSE_GRACE_PERIOD_IN_DAYS: number = 30;
+
+/*
+ * How long an Enterprise install with no license at all is on trial, counted
+ * from GlobalConfig.enterpriseEditionFirstSeenAt.
+ */
+export const ENTERPRISE_LICENSE_TRIAL_PERIOD_IN_DAYS: number = 14;

package/Types/IP/IPv6.ts

@@ -1,7 +1,12 @@
 import BadDataException from "../Exception/BadDataException";
 import IP from "./IP";
 
-export default class IPv4 extends IP {
+/*
+ * The class used to be declared `class IPv4 extends IP` here — a copy-paste
+ * that the default export hid from every import site, while leaving
+ * IPv6.name === "IPv4" in error messages, serialized output and API docs.
+ */
+export default class IPv6 extends IP {
   public constructor(ip: string) {
     super(ip);
 

package/Types/Monitor/MetricMonitor/MetricCriteriaContext.ts

@@ -25,7 +25,8 @@ export interface MetricBreachingSample {
 
 /**
  * Descriptor for one variable referenced by a formula, used to label
- * table columns and render the Metric Details section. Name is the
+ * each breaching sample's component values and render the Metric
+ * Details section. Name is the
  * metric display name (usually the metric name, sometimes the formula
  * expression for nested formulas) and unit is the variable's native
  * unit as configured.
@@ -103,8 +104,8 @@ export default interface MetricCriteriaContext {
   breachingSample?: MetricBreachingSample | undefined;
   /**
    * All samples in the evaluation window that breached the threshold,
-   * in chronological order. Used to render a table of timestamps and
-   * values on the incident root-cause page.
+   * in chronological order. Used to render the Breaching Samples list
+   * of timestamps and values on the incident root-cause page.
    */
   breachingSamples?: Array<MetricBreachingSample> | undefined;
   /**
@@ -116,8 +117,8 @@ export default interface MetricCriteriaContext {
   /**
    * For formulas: metadata for each variable the formula references,
    * in the order they appear in the expression. Consumers use this to
-   * label breakdown columns and to surface underlying units/metric
-   * names in the Metric Details section.
+   * label each breaching sample's component values and to surface
+   * underlying units/metric names in the Metric Details section.
    */
   components?: Array<MetricComponent> | undefined;
 }

package/Types/Monitor/MetricMonitor/MetricMonitorResponse.ts

@@ -13,7 +13,16 @@ export interface KubernetesAffectedResource {
   containerName?: string | undefined;
   workloadType?: string | undefined;
   workloadName?: string | undefined;
+  /** Highest sample seen for this resource in the monitoring window. */
   metricValue: number;
+  /**
+   * Lowest sample seen for this resource in the monitoring window. A
+   * criteria that fires when the metric FALLS (node Ready = 0, etcd has
+   * leader = 0) breached on this value, not on `metricValue`: a node that
+   * was NotReady for one scrape and Ready for the rest has a highest of 1.
+   * Absent on breakdowns built before this field existed.
+   */
+  lowestMetricValue?: number | undefined;
 }
 
 export interface KubernetesResourceBreakdown {

package/Types/Monitor/MonitorStep.ts

@@ -497,8 +497,13 @@ export default class MonitorStep extends DatabaseProperty {
     return this;
   }
 
+  /*
+   * `undefined` clears it. The form needs that: a destination that no longer
+   * parses must not leave the previously parsed one sitting in the step,
+   * where it would be saved as if the operator had meant it.
+   */
   public setMonitorDestination(
-    monitorDestination: URL | IP | Hostname,
+    monitorDestination: URL | IP | Hostname | undefined,
   ): MonitorStep {
     this.data!.monitorDestination = monitorDestination;
     return this;

package/Types/Monitor/ProxmoxAlertTemplates.ts

@@ -897,7 +897,7 @@ const guestNotBackedUpTemplate: ProxmoxAlertTemplate = {
         /*
          * Cluster-level gauge from the backup-info collector — one
          * series, no `id` label, so no groupBy: one incident per
-         * cluster. Per-guest naming belongs to the breakdown table
+         * cluster. Per-guest naming belongs to the Affected Resources list
          * (pve_not_backed_up_info grouped by `id`), not the alert.
          */
         metricName: "pve_not_backed_up_total",

package/Types/Permission.ts

@@ -2018,6 +2018,18 @@ enum Permission {
   EditServiceLevelObjectiveOwnerTeam = "EditServiceLevelObjectiveOwnerTeam",
   ReadServiceLevelObjectiveOwnerTeam = "ReadServiceLevelObjectiveOwnerTeam",
 
+  // Service Level Objective Owner Rule Permissions
+  CreateServiceLevelObjectiveOwnerRule = "CreateServiceLevelObjectiveOwnerRule",
+  DeleteServiceLevelObjectiveOwnerRule = "DeleteServiceLevelObjectiveOwnerRule",
+  EditServiceLevelObjectiveOwnerRule = "EditServiceLevelObjectiveOwnerRule",
+  ReadServiceLevelObjectiveOwnerRule = "ReadServiceLevelObjectiveOwnerRule",
+
+  // Service Level Objective Label Rule Permissions
+  CreateServiceLevelObjectiveLabelRule = "CreateServiceLevelObjectiveLabelRule",
+  DeleteServiceLevelObjectiveLabelRule = "DeleteServiceLevelObjectiveLabelRule",
+  EditServiceLevelObjectiveLabelRule = "EditServiceLevelObjectiveLabelRule",
+  ReadServiceLevelObjectiveLabelRule = "ReadServiceLevelObjectiveLabelRule",
+
   /*
    * Wildcard permissions covering all models marked @OperationalResource().
    * These short-circuit table-level checks for that resource class. Scope on
@@ -16140,6 +16152,84 @@ export class PermissionHelper {
         group: PermissionGroup.SLO,
       },
 
+      // Service Level Objective Owner Rule Permissions
+      {
+        permission: Permission.CreateServiceLevelObjectiveOwnerRule,
+        title: "Create SLO Owner Rule",
+        description:
+          "Permission to create SLO Owner Rules, which add owner users and teams to matching SLOs, in this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.SLO,
+      },
+      {
+        permission: Permission.DeleteServiceLevelObjectiveOwnerRule,
+        title: "Delete SLO Owner Rule",
+        description: "Permission to delete SLO Owner Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.SLO,
+      },
+      {
+        permission: Permission.EditServiceLevelObjectiveOwnerRule,
+        title: "Edit SLO Owner Rule",
+        description: "Permission to edit SLO Owner Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.SLO,
+      },
+      {
+        permission: Permission.ReadServiceLevelObjectiveOwnerRule,
+        title: "Read SLO Owner Rule",
+        description: "Permission to read SLO Owner Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.SLO,
+      },
+
+      // Service Level Objective Label Rule Permissions
+      {
+        permission: Permission.CreateServiceLevelObjectiveLabelRule,
+        title: "Create SLO Label Rule",
+        description:
+          "Permission to create SLO Label Rules, which attach labels to matching SLOs, in this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.SLO,
+      },
+      {
+        permission: Permission.DeleteServiceLevelObjectiveLabelRule,
+        title: "Delete SLO Label Rule",
+        description: "Permission to delete SLO Label Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.SLO,
+      },
+      {
+        permission: Permission.EditServiceLevelObjectiveLabelRule,
+        title: "Edit SLO Label Rule",
+        description: "Permission to edit SLO Label Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.SLO,
+      },
+      {
+        permission: Permission.ReadServiceLevelObjectiveLabelRule,
+        title: "Read SLO Label Rule",
+        description: "Permission to read SLO Label Rules of this project.",
+        isAssignableToTenant: true,
+        isAccessControlPermission: false,
+        isRolePermission: false,
+        group: PermissionGroup.SLO,
+      },
+
       // Operational Resource Wildcard Permissions
       {
         permission: Permission.ReadAllOperationalResources,

package/Types/Rules/RuleCriteriaFieldRegistry.ts

@@ -379,11 +379,22 @@ export const RULE_CRITERIA_FIELDS_BY_MODEL: Readonly<
     "serviceNamePattern",
     "serviceDescriptionPattern",
   ],
+  ServiceLevelObjectiveLabelRule: [
+    "serviceLevelObjectiveLabels",
+    "serviceLevelObjectiveNamePattern",
+    "serviceLevelObjectiveDescriptionPattern",
+  ],
   ServiceLevelObjectiveMonitorRule: [
     "monitorLabels",
+    "monitorType",
     "monitorNamePattern",
     "monitorDescriptionPattern",
   ],
+  ServiceLevelObjectiveOwnerRule: [
+    "serviceLevelObjectiveLabels",
+    "serviceLevelObjectiveNamePattern",
+    "serviceLevelObjectiveDescriptionPattern",
+  ],
   ServiceOwnerRule: [
     "serviceLabels",
     "serviceNamePattern",

package/Types/Rules/RuleRun.ts

@@ -92,7 +92,9 @@ export enum RuleRunType {
   ServerlessFunctionLabelRule = "ServerlessFunctionLabelRule",
   ServerlessFunctionOwnerRule = "ServerlessFunctionOwnerRule",
   ServiceLabelRule = "ServiceLabelRule",
+  ServiceLevelObjectiveLabelRule = "ServiceLevelObjectiveLabelRule",
   ServiceLevelObjectiveMonitorRule = "ServiceLevelObjectiveMonitorRule",
+  ServiceLevelObjectiveOwnerRule = "ServiceLevelObjectiveOwnerRule",
   ServiceOwnerRule = "ServiceOwnerRule",
   StatusPageLabelRule = "StatusPageLabelRule",
   StatusPageOwnerRule = "StatusPageOwnerRule",
@@ -316,11 +318,13 @@ export const RULE_RUN_TYPE_METADATA: Readonly<
     "serverless functions",
   ),
   [RuleRunType.ServiceLabelRule]: metadata(Labels, "service", "services"),
+  [RuleRunType.ServiceLevelObjectiveLabelRule]: metadata(Labels, "SLO", "SLOs"),
   [RuleRunType.ServiceLevelObjectiveMonitorRule]: metadata(
     RuleRunAction.SyncSloMonitors,
     "monitor",
     "monitors",
   ),
+  [RuleRunType.ServiceLevelObjectiveOwnerRule]: metadata(Owners, "SLO", "SLOs"),
   [RuleRunType.ServiceOwnerRule]: metadata(Owners, "service", "services"),
   [RuleRunType.StatusPageLabelRule]: metadata(
     Labels,