@oneuptime/common 14.0.10 → 14.0.11

package/Server/Services/OpenTelemetryIngestService.ts

@@ -44,6 +44,8 @@ import ServerlessFunctionService from "./ServerlessFunctionService";
 import CloudResourceService from "./CloudResourceService";
 import RumApplicationService from "./RumApplicationService";
 import IoTFleetService from "./IoTFleetService";
+import EnterpriseEdition from "../Enterprise/EnterpriseEdition";
+import EnterpriseFeature from "../Enterprise/EnterpriseFeature";
 import GlobalCache from "../Infrastructure/GlobalCache";
 import InProcessMemo from "../Utils/InProcessMemo";
 import ColumnLength from "../../Types/Database/ColumnLength";
@@ -472,6 +474,37 @@ export default class OTelIngestService {
     return context;
   }
 
+  /*
+   * Retention overrides - retention by telemetry type (project-wide and per
+   * service or resource) and per-service or per-resource retention - are an
+   * Enterprise feature (EnterpriseFeature.TelemetryRetention). While it is
+   * not active (the Community Edition, or a self-hosted license that lapsed
+   * or leaves it out) every row gets the project's default retention, and the
+   * configured overrides are kept, unused, until it is active again.
+   *
+   * Asked each time metadata is built, not when the caches above are warmed,
+   * so a license change takes effect on the next row without waiting for a
+   * cache to expire. Every signal resolves its retention from this metadata
+   * (resolveTelemetryRetentionInDays), so this is the one place to decide.
+   */
+  public static applyRetentionOverrideEdition(
+    metadata: TelemetryServiceMetadata,
+  ): TelemetryServiceMetadata {
+    if (
+      EnterpriseEdition.isFeatureActive(EnterpriseFeature.TelemetryRetention)
+    ) {
+      return metadata;
+    }
+
+    return {
+      ...metadata,
+      dataRententionInDays: metadata.projectRetentionInDays,
+      serviceRetentionConfig: null,
+      serviceRetentionInDays: null,
+      projectRetentionConfig: null,
+    };
+  }
+
   @CaptureSpan()
   public static async telemetryServiceFromName(data: {
     serviceName: string;
@@ -746,7 +779,7 @@ export default class OTelIngestService {
     ): TelemetryServiceMetadata => {
       const serviceLevelRetention: number | null =
         resolved.retainTelemetryDataForDays ?? null;
-      return {
+      return this.applyRetentionOverrideEdition({
         serviceName: data.serviceName,
         primaryEntityId: new ObjectID(resolved.serviceId),
         primaryEntityType: ServiceType.OpenTelemetry,
@@ -766,7 +799,7 @@ export default class OTelIngestService {
         serviceRetentionInDays: serviceLevelRetention,
         projectRetentionConfig: projectContext.projectRetentionConfig,
         projectRetentionInDays: projectContext.projectRetentionInDays,
-      };
+      });
     };
 
     if (!resolution) {
@@ -863,7 +896,7 @@ export default class OTelIngestService {
     const resourceRetention: ResourceRetention =
       await this.getResourceRetention(data.resourceId, data.primaryEntityType);
 
-    return {
+    return this.applyRetentionOverrideEdition({
       serviceName: data.serviceName,
       primaryEntityId: data.resourceId,
       primaryEntityType: data.primaryEntityType,
@@ -874,7 +907,7 @@ export default class OTelIngestService {
       serviceRetentionInDays: resourceRetention.retainTelemetryDataForDays,
       projectRetentionConfig: projectContext.projectRetentionConfig,
       projectRetentionInDays: projectContext.projectRetentionInDays,
-    };
+    });
   }
 
   /*

package/Server/Services/ProjectService.ts

@@ -14,7 +14,6 @@ import { OnCreate, OnDelete, OnFind, OnUpdate } from "../Types/Database/Hooks";
 import QueryHelper from "../Types/Database/QueryHelper";
 import UpdateBy from "../Types/Database/UpdateBy";
 import logger, { LogAttributes } from "../Utils/Logger";
-import EditionEnforcement from "../Utils/EditionEnforcement";
 import EnterpriseEdition from "../Enterprise/EnterpriseEdition";
 import EnterpriseFeature from "../Enterprise/EnterpriseFeature";
 import Errors from "../Utils/Errors";
@@ -145,15 +144,6 @@ export type ProjectBalanceColumnName =
  */
 export const MAX_BALANCE_ADJUSTMENT_IN_USD_CENTS: number = 10_000 * 100;
 
-/*
- * The project columns that hold its SSO requirement: the ones onFindSuccess
- * masks and onBeforeUpdate guards while SSO is not active.
- */
-export const PROJECT_SSO_REQUIREMENT_COLUMNS: ReadonlyArray<string> = [
-  "requireSsoForLogin",
-  "requireSsoWithSsoProviderId",
-];
-
 // The project columns that decide what the audit log records and keeps.
 export interface ProjectAuditLogSettings {
   enableAuditLogs: boolean;
@@ -693,17 +683,6 @@ export class ProjectService extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
-    /*
-     * While SSO is not active this caller only ever read the requirement as
-     * off (see onFindSuccess), so a write of it must not switch the stored
-     * requirement off, or set one nobody could see. Drops or refuses it.
-     */
-    EditionEnforcement.guardSsoRequirementWrite({
-      props: updateBy.props,
-      data: updateBy.data as unknown as Record<string, unknown>,
-      columns: PROJECT_SSO_REQUIREMENT_COLUMNS,
-    });
-
     /*
      * Any project field could have changed; invalidate the in-process cache
      * of the SSO flag. Cheap to refetch on the next request.
@@ -2857,44 +2836,6 @@ These are no longer recorded against the project and have to be cancelled by han
     return { findBy, carryForward: null };
   }
 
-  /*
-   * While SSO is not active a project's SSO requirement is not enforced: on
-   * the Community Edition (the SSO login routes are part of the Enterprise
-   * Edition), and on an Enterprise install whose license is lapsed or does
-   * not include SSO (the routes refuse). Reads made for a caller then report
-   * the EFFECTIVE value: not required, no required provider. Clients decide
-   * from these columns whether to start an SSO flow - the mobile app hides a
-   * project's on-call data behind an SSO login it cannot complete, and its
-   * store builds cannot be patched.
-   *
-   * Only the returned objects change. Internal (root) reads, and the stored
-   * row, keep the real value, and onBeforeUpdate keeps a caller from writing
-   * the masked value back. So running the Enterprise Edition with a valid
-   * license (or in its trial or grace period) again restores enforcement
-   * exactly as configured.
-   */
-  @CaptureSpan()
-  protected override async onFindSuccess(
-    onFind: OnFind<Model>,
-    items: Array<Model>,
-  ): Promise<OnFind<Model>> {
-    if (
-      EditionEnforcement.shouldMaskSsoRequirementOnRead(onFind.findBy.props)
-    ) {
-      for (const item of items) {
-        if (item.requireSsoForLogin !== undefined) {
-          item.requireSsoForLogin = false;
-        }
-
-        if (item.requireSsoWithSsoProviderId !== undefined) {
-          item.requireSsoWithSsoProviderId = null!;
-        }
-      }
-    }
-
-    return { ...onFind, carryForward: items };
-  }
-
   @CaptureSpan()
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<Model>,

package/Server/Services/StatusPagePrivateUserService.ts

@@ -4,7 +4,6 @@ import { EncryptionSecret } from "../EnvironmentConfig";
 import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
-import EditionEnforcement from "../Utils/EditionEnforcement";
 import logger from "../Utils/Logger";
 import DatabaseService from "./DatabaseService";
 import MailService from "./MailService";
@@ -190,10 +189,8 @@ export class Service extends DatabaseService<Model> {
     /*
      * SCIM and admin-created users must follow the page's login policy too.
      * Do not create a password-reset credential when only SSO can be used.
-     * On the Community Edition there is no SSO login for status pages, so a
-     * leftover requirement is not enforced and the user gets a password link.
      */
-    if (EditionEnforcement.isSsoRequired(statusPage.requireSsoForLogin)) {
+    if (statusPage.requireSsoForLogin) {
       return createdItem;
     }
 

package/Server/Services/StatusPageService.ts

@@ -1,10 +1,9 @@
 import DatabaseConfig from "../DatabaseConfig";
 import InMemoryTTLCache from "../Infrastructure/InMemoryTTLCache";
 import CreateBy from "../Types/Database/CreateBy";
-import { OnCreate, OnFind, OnUpdate } from "../Types/Database/Hooks";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import UpdateBy from "../Types/Database/UpdateBy";
 import CookieUtil from "../Utils/Cookie";
-import EditionEnforcement from "../Utils/EditionEnforcement";
 import { ExpressRequest } from "../Utils/Express";
 import JSONWebToken from "../Utils/JsonWebToken";
 import logger, { LogAttributes } from "../Utils/Logger";
@@ -115,14 +114,6 @@ export {
   StatusPageReportRow,
 };
 
-/*
- * The status page column that holds its SSO requirement: the one
- * onFindSuccess masks and onBeforeUpdate guards while SSO is not active.
- */
-export const STATUS_PAGE_SSO_REQUIREMENT_COLUMNS: ReadonlyArray<string> = [
-  "requireSsoForLogin",
-];
-
 /*
  * What a report's incident counts read of the status page: which project's
  * incidents to count, and whether the page only shows incidents limited to
@@ -298,36 +289,6 @@ export class Service extends DatabaseService<StatusPage> {
     return this.getDefaultEmailFooterText();
   }
 
-  /*
-   * While SSO is not active a status page's SSO requirement is not enforced:
-   * on the Community Edition (status page SSO login is part of the
-   * Enterprise Edition), and on an Enterprise install whose license is
-   * lapsed or does not include SSO (the SSO routes refuse). Reads made for a
-   * caller then report the EFFECTIVE value: not required. Internal (root)
-   * reads and the stored row keep the real value, and onBeforeUpdate keeps a
-   * caller from writing the masked value back, so running the Enterprise
-   * Edition with a valid license (or in its trial or grace period) again
-   * restores enforcement exactly as configured. The public master-page route
-   * reads as root and applies the same rule itself.
-   */
-  @CaptureSpan()
-  protected override async onFindSuccess(
-    onFind: OnFind<StatusPage>,
-    items: Array<StatusPage>,
-  ): Promise<OnFind<StatusPage>> {
-    if (
-      EditionEnforcement.shouldMaskSsoRequirementOnRead(onFind.findBy.props)
-    ) {
-      for (const item of items) {
-        if (item.requireSsoForLogin !== undefined) {
-          item.requireSsoForLogin = false;
-        }
-      }
-    }
-
-    return { ...onFind, carryForward: items };
-  }
-
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<StatusPage>,
@@ -1130,17 +1091,6 @@ export class Service extends DatabaseService<StatusPage> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<StatusPage>,
   ): Promise<OnUpdate<StatusPage>> {
-    /*
-     * While SSO is not active this caller only ever read the requirement as
-     * off (see onFindSuccess), so a write of it must not switch the stored
-     * requirement off, or set one nobody could see. Drops or refuses it.
-     */
-    EditionEnforcement.guardSsoRequirementWrite({
-      props: updateBy.props,
-      data: updateBy.data as unknown as Record<string, unknown>,
-      columns: STATUS_PAGE_SSO_REQUIREMENT_COLUMNS,
-    });
-
     // is enabling SMS subscribers.
 
     if (updateBy.data.enableSmsSubscribers) {

package/Server/Services/TeamComplianceSettingService.ts

@@ -24,18 +24,25 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 /*
  * The part of a compliance rule that decides what it checks: its type, the
- * channel it insists on (null = any) and the severities it is scoped to
+ * channels it insists on (empty = any) and the severities it is scoped to
  * (empty = every severity of its kind). Two rules with the same scope check
  * exactly the same thing, which is what "duplicate" means here.
  */
 export interface ComplianceRuleScope {
   ruleType: ComplianceRuleType;
-  notificationChannel: ComplianceNotificationChannel | null;
+  // In catalog order, each once (ComplianceRule.normaliseChannels).
+  notificationChannels: Array<ComplianceNotificationChannel>;
   severityKind: ComplianceSeverityKind | null;
   // Sorted, de-duplicated ids of the severity list the rule's kind uses.
   severityIds: Array<string>;
 }
 
+// The two columns a rule's channels are stored in.
+export interface StoredChannelColumns {
+  notificationChannels?: unknown;
+  notificationChannel?: unknown;
+}
+
 // A severity about to be deleted, as the severity services read it.
 export interface DeletedSeverity {
   _id?: string | undefined;
@@ -122,10 +129,10 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
       createBy.data.ruleType,
     );
 
-    this.assertValidChannel(createBy.data.notificationChannel);
+    TeamComplianceSettingService.normaliseChannelFields(createBy.data);
 
     /*
-     * Normalise before anything is stored: a method rule carries no channel
+     * Normalise before anything is stored: a method rule carries no channels
      * or severities, and an incident rule carries no alert severities. The
      * form hides the fields that do not apply, but the API accepts whatever it
      * is sent, and a stray alert severity on an incident rule would otherwise
@@ -150,7 +157,9 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
     const scope: ComplianceRuleScope = TeamComplianceSettingService.getScope({
       ruleType: ruleType,
-      notificationChannel: createBy.data.notificationChannel,
+      notificationChannels: TeamComplianceSettingService.getStoredChannels(
+        createBy.data,
+      ),
       incidentSeverities: createBy.data.incidentSeverities,
       alertSeverities: createBy.data.alertSeverities,
     });
@@ -183,6 +192,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
     const changesScope: boolean =
       data["ruleType"] !== undefined ||
+      data["notificationChannels"] !== undefined ||
       data["notificationChannel"] !== undefined ||
       data["incidentSeverities"] !== undefined ||
       data["alertSeverities"] !== undefined;
@@ -211,7 +221,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
         ? this.assertKnownRuleType(data["ruleType"])
         : undefined;
 
-    this.assertValidChannel(data["notificationChannel"]);
+    TeamComplianceSettingService.normaliseChannelFields(data);
 
     if (newRuleType) {
       /*
@@ -237,6 +247,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
         teamId: true,
         projectId: true,
         ruleType: true,
+        notificationChannels: true,
         notificationChannel: true,
         options: true,
         incidentSeverities: {
@@ -328,10 +339,10 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
       const scope: ComplianceRuleScope = TeamComplianceSettingService.getScope({
         ruleType: ruleType,
-        notificationChannel:
-          data["notificationChannel"] !== undefined
-            ? data["notificationChannel"]
-            : existing.notificationChannel,
+        // Sent as a pair by normaliseChannelFields, or not at all.
+        notificationChannels: TeamComplianceSettingService.getStoredChannels(
+          data["notificationChannels"] !== undefined ? data : existing,
+        ),
         incidentSeverities:
           data["incidentSeverities"] !== undefined
             ? data["incidentSeverities"]
@@ -727,7 +738,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
     for (const group of toPause.values()) {
       /*
-       * Neither the type, the channel nor a severity list: the update hook
+       * Neither the type, the channels nor a severity list: the update hook
        * reads nothing for it. (Cast: the write type of a JSON column is too
        * deep for the compiler to spell out.)
        */
@@ -754,23 +765,24 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
   /*
    * What a rule checks, from its stored (or about-to-be-stored) fields. Only
-   * the options its type uses count: a channel on a method rule, or alert
+   * the options its type uses count: channels on a method rule, or alert
    * severities on an incident rule, change nothing about what is checked.
+   * `notificationChannels` is a list; see getStoredChannels for reading one
+   * off a row.
    */
   public static getScope(data: {
     ruleType: ComplianceRuleType;
-    notificationChannel: unknown;
+    notificationChannels: unknown;
     incidentSeverities: unknown;
     alertSeverities: unknown;
   }): ComplianceRuleScope {
     const severityKind: ComplianceSeverityKind | undefined =
       ComplianceRule.getSeverityKind(data.ruleType);
 
-    const notificationChannel: ComplianceNotificationChannel | null =
-      ComplianceRule.supportsChannel(data.ruleType) &&
-      ComplianceRule.isKnownChannel(data.notificationChannel)
-        ? data.notificationChannel
-        : null;
+    const notificationChannels: Array<ComplianceNotificationChannel> =
+      ComplianceRule.supportsChannel(data.ruleType)
+        ? ComplianceRule.normaliseChannels(data.notificationChannels)
+        : [];
 
     let severityIds: Array<string> = [];
 
@@ -784,23 +796,144 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
 
     return {
       ruleType: data.ruleType,
-      notificationChannel: notificationChannel,
+      notificationChannels: notificationChannels,
       severityKind: severityKind || null,
       severityIds: severityIds,
     };
   }
 
+  /*
+   * Both lists are canonical - channels in catalog order, severity ids sorted
+   * - so the same selection compares equal however it was picked.
+   */
   public static isSameScope(
     a: ComplianceRuleScope,
     b: ComplianceRuleScope,
   ): boolean {
     return (
       a.ruleType === b.ruleType &&
-      a.notificationChannel === b.notificationChannel &&
+      a.notificationChannels.join(",") === b.notificationChannels.join(",") &&
       a.severityIds.join(",") === b.severityIds.join(",")
     );
   }
 
+  /*
+   * CHANNELS. What a rule insists on is the list in notificationChannels -
+   * every one of them - and the older notificationChannel column holds the
+   * first of that list, for everything that only knows the one column (see
+   * the model). What follows keeps the two in step.
+   */
+
+  /*
+   * The channels a row holds, from its two columns. Every build that knows
+   * the list writes the pair together, the single column always the list's
+   * first channel. A build that does not - an older replica still serving
+   * during an upgrade, or a downgrade - writes only the single column and
+   * leaves the list as it was. So a row with no list, or whose list the
+   * single column no longer agrees with, was last written by such a build,
+   * and its single column is what the rule says; otherwise the list is.
+   * Rows from before the list existed have it backfilled by
+   * AddTeamComplianceRuleNotificationChannels.
+   *
+   * The comparison is on the stored values, before anything unknown is
+   * dropped, so a list a newer build wrote with a channel this one does not
+   * know still counts - for the channels it does know.
+   */
+  public static getStoredChannels(
+    row: StoredChannelColumns,
+  ): Array<ComplianceNotificationChannel> {
+    const single: unknown = row.notificationChannel ?? null;
+
+    if (Array.isArray(row.notificationChannels)) {
+      const first: unknown = row.notificationChannels[0] ?? null;
+
+      if (first === single) {
+        return ComplianceRule.normaliseChannels(row.notificationChannels);
+      }
+    }
+
+    return ComplianceRule.isKnownChannel(single) ? [single] : [];
+  }
+
+  /*
+   * The channels a SENT list asks for, as the list that will be stored:
+   * catalog order, each once (the order they were picked in is not part of
+   * the rule). Null is no channels - any channel. Anything else that is not
+   * a list of channels this build knows is refused rather than dropped: a
+   * list that silently lost a channel checks less than the admin asked for,
+   * and one that lost its only channel checks every channel.
+   */
+  public static resolveSentChannels(
+    value: unknown,
+  ): Array<ComplianceNotificationChannel> {
+    if (value === null) {
+      return [];
+    }
+
+    if (!Array.isArray(value)) {
+      throw new BadDataException(
+        "The notification channels of a compliance rule must be a list of channels.",
+      );
+    }
+
+    for (const item of value) {
+      TeamComplianceSettingService.assertKnownChannel(item);
+    }
+
+    return ComplianceRule.normaliseChannels(value);
+  }
+
+  /*
+   * Rewrites whichever channel column a payload sends into the pair that is
+   * stored: the list, and the single column set to its first channel. A
+   * payload that sends the list is taken at its list, whatever single
+   * channel rides along - a client that read a rule and sends it back sends
+   * both, and after the list changes the single one it holds is stale. One
+   * that sends only the single column (a client from before the list, or an
+   * older Dashboard) asks for exactly that channel, or for any channel when
+   * it is null. A payload that sends neither leaves both unsent.
+   */
+  public static normaliseChannelFields(data: Model | JSONObject): void {
+    const target: JSONObject = data as JSONObject;
+    const sentList: unknown = target["notificationChannels"];
+    const sentSingle: unknown = target["notificationChannel"];
+
+    if (sentList === undefined && sentSingle === undefined) {
+      return;
+    }
+
+    // Null / undefined is "any channel"; anything else must be a channel.
+    if (sentSingle !== undefined && sentSingle !== null) {
+      TeamComplianceSettingService.assertKnownChannel(sentSingle);
+    }
+
+    let channels: Array<ComplianceNotificationChannel> = [];
+
+    if (sentList !== undefined) {
+      channels = TeamComplianceSettingService.resolveSentChannels(sentList);
+    } else if (ComplianceRule.isKnownChannel(sentSingle)) {
+      channels = [sentSingle];
+    }
+
+    TeamComplianceSettingService.setChannels(target, channels);
+  }
+
+  private static setChannels(
+    target: JSONObject,
+    channels: Array<ComplianceNotificationChannel>,
+  ): void {
+    target["notificationChannels"] = channels;
+    target["notificationChannel"] = channels[0] ?? null;
+  }
+
+  private static assertKnownChannel(value: unknown): void {
+    if (!ComplianceRule.isKnownChannel(value)) {
+      throw new BadDataException(
+        `"${String(value)}" is not a notification channel a compliance rule can require.`,
+      );
+    }
+  }
+
   /*
    * Severity ids from a severity list as it is STORED (or once a payload has
    * been through normaliseSeverityLists): an id string, an ObjectID, a model,
@@ -992,22 +1125,10 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
     return value;
   }
 
-  // Null / undefined is "any channel" and always valid.
-  private assertValidChannel(value: unknown): void {
-    if (value === undefined || value === null) {
-      return;
-    }
-
-    if (!ComplianceRule.isKnownChannel(value)) {
-      throw new BadDataException(
-        `"${String(value)}" is not a notification channel a compliance rule can require.`,
-      );
-    }
-  }
-
   /*
    * `clearUnsentOptions` also clears the options `data` does not mention, so
    * an update writes them empty on the row instead of leaving what is stored.
+   * Channels arrive here already paired by normaliseChannelFields.
    */
   private clearOptionsThatDoNotApply(
     data: Model | JSONObject,
@@ -1018,14 +1139,12 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
     const severityKind: ComplianceSeverityKind | undefined =
       ComplianceRule.getSeverityKind(ruleType);
 
-    if (!ComplianceRule.supportsChannel(ruleType)) {
-      if (
-        options.clearUnsentOptions ||
-        (target["notificationChannel"] !== undefined &&
-          target["notificationChannel"] !== null)
-      ) {
-        target["notificationChannel"] = null;
-      }
+    if (
+      !ComplianceRule.supportsChannel(ruleType) &&
+      (options.clearUnsentOptions ||
+        target["notificationChannels"] !== undefined)
+    ) {
+      TeamComplianceSettingService.setChannels(target, []);
     }
 
     if (
@@ -1112,6 +1231,7 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
       select: {
         _id: true,
         ruleType: true,
+        notificationChannels: true,
         notificationChannel: true,
         options: true,
         incidentSeverities: {
@@ -1142,7 +1262,8 @@ export class TeamComplianceSettingService extends DatabaseService<Model> {
       const siblingScope: ComplianceRuleScope =
         TeamComplianceSettingService.getScope({
           ruleType: data.scope.ruleType,
-          notificationChannel: sibling.notificationChannel,
+          notificationChannels:
+            TeamComplianceSettingService.getStoredChannels(sibling),
           incidentSeverities: sibling.incidentSeverities,
           alertSeverities: sibling.alertSeverities,
         });

package/Server/Services/UserNotificationRuleService.ts

@@ -7,6 +7,7 @@ import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
 import DatabaseRequestType from "../Types/BaseDatabase/DatabaseRequestType";
 import TenantPermission from "../Types/Database/Permissions/TenantPermission";
 import Markdown, { MarkdownContentType } from "../Types/Markdown";
+import { escapeMarkdownValue } from "../../Utils/Markdown/MarkdownEscape";
 import CallService from "./CallService";
 import DatabaseService from "./DatabaseService";
 import IncidentService from "./IncidentService";
@@ -4218,7 +4219,13 @@ export class Service extends DatabaseService<Model> {
     const lines: Array<string> = [
       `🚨 **${data.headline}**`,
       "",
-      `📋 **${data.identifier}**`,
+      /*
+       * The identifier ends with a title - plain text, which anyone holding
+       * an incident form's link may have typed - escaped as MarkdownEscape
+       * says a title must be, so it cannot become an image or a link that
+       * hides where it goes.
+       */
+      `📋 **${escapeMarkdownValue(data.identifier)}**`,
       "",
       "👤 You're getting this because you're on call.",
     ];

package/Server/Services/WorkspaceNotificationSummaryService.ts

@@ -812,8 +812,16 @@ export class Service extends DatabaseService<WorkspaceNotificationSummary> {
           .toString();
         const td: TimelineData | undefined = tlMap.get(id);
 
-        // Title line with link
-        let text: string = `${Service.bold(Service.link(linkUrl, `${display} — ${inc.title || "Untitled"}`))}`;
+        /*
+         * Title line with link. The title - plain text, which anyone
+         * holding an incident form's link may have typed - sits inside the
+         * link's text, so it is escaped like the names in these summaries:
+         * a "]" cannot end that text early and point the rest somewhere
+         * else, and "![...](...)" is no image. (Escaping brackets alone is
+         * not enough inside a link's text: marked, for one, undoes "\[" and
+         * "\]" there before reading it.)
+         */
+        let text: string = `${Service.bold(Service.link(linkUrl, `${display} — ${escapeMarkdownInline(inc.title || "Untitled")}`))}`;
 
         // Meta line
         const meta: Array<string> = [];
@@ -998,7 +1006,8 @@ export class Service extends DatabaseService<WorkspaceNotificationSummary> {
           .addRoute(`/${projectId.toString()}/incidents/episodes/${id}`)
           .toString();
 
-        let text: string = `${Service.bold(Service.link(linkUrl, ep.title || "Untitled Episode"))}`;
+        // The title inside the link's text, escaped as an incident's is.
+        let text: string = `${Service.bold(Service.link(linkUrl, escapeMarkdownInline(ep.title || "Untitled Episode")))}`;
         const meta: Array<string> = [];
         if (ep.incidentSeverity?.name) {
           meta.push(`Severity: ${Service.bold(ep.incidentSeverity.name)}`);