@oneuptime/common 14.0.13 → 14.0.14

package/Server/API/StatusPageAPI.ts

@@ -123,6 +123,7 @@ import ForbiddenException from "../../Types/Exception/ForbiddenException";
 import SlackUtil from "../Utils/Workspace/Slack/Slack";
 import MicrosoftTeamsUtil from "../Utils/Workspace/MicrosoftTeams/MicrosoftTeams";
 import { MASTER_PASSWORD_INVALID_MESSAGE } from "../../Types/StatusPage/MasterPassword";
+import { isStatusPageMasterPasswordRequired } from "../../Types/StatusPage/StatusPageAccess";
 import StatusPageSubscriberNotificationEventType from "../../Types/StatusPage/StatusPageSubscriberNotificationEventType";
 import StatusPageSubscriberNotificationMethod from "../../Types/StatusPage/StatusPageSubscriberNotificationMethod";
 import StatusPageSubscriberNotificationTemplate from "../../Models/DatabaseModels/StatusPageSubscriberNotificationTemplate";
@@ -139,6 +140,12 @@ import StatusPageSubscriberUnsubscribe, {
   StatusPageSubscriberUnsubscribeDetails,
   StatusPageSubscriberUnsubscribeState,
 } from "../../Types/StatusPage/StatusPageSubscriberUnsubscribe";
+import StatusPagesListingMonitors, {
+  StatusPagesListingMonitorsResult,
+} from "../../Types/StatusPage/StatusPagesListingMonitors";
+import StatusPagesListingMonitorsBuilder, {
+  StatusPagesListingMonitorsRequest,
+} from "../Utils/StatusPage/StatusPagesListingMonitorsBuilder";
 
 /*
  * A manage-subscription request is unauthenticated, and one Slack or Microsoft
@@ -952,6 +959,26 @@ export default class StatusPageAPI extends BaseAPI<
       },
     );
 
+    /*
+     * The status pages that list some monitors, for the status page pickers
+     * of scheduled maintenance events and announcements to suggest (see
+     * StatusPagesListingMonitors). It only reads, and only names pages and
+     * looks up monitors the caller can read. A POST because the monitors
+     * travel in the body.
+     */
+    this.router.post(
+      `${new this.entityType().getCrudApiPath()?.toString()}/listing-monitors`,
+      UserMiddleware.getUserMiddleware,
+      UserMiddleware.requireUserAuthentication,
+      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
+        try {
+          await this.getStatusPagesListingMonitors(req, res);
+        } catch (err) {
+          next(err);
+        }
+      },
+    );
+
     /*
      * Sends the status page's report to an address the caller chooses, so it
      * is gated like editing the status page: an authenticated member of the
@@ -1111,6 +1138,8 @@ export default class StatusPageAPI extends BaseAPI<
             enableSmsSubscribers: true,
             isPublicStatusPage: true,
             enableMasterPassword: true,
+            // Only to tell whether one is set; never sent (see below).
+            masterPassword: true,
             allowSubscribersToChooseResources: true,
             allowSubscribersToChooseEventTypes: true,
             requireSsoForLogin: true,
@@ -1178,6 +1207,25 @@ export default class StatusPageAPI extends BaseAPI<
           // Not part of what the page renders.
           delete item.isArchived;
 
+          /*
+           * Whether the page asks visitors for the master password, by the
+           * rule the server enforces (Types/StatusPage/StatusPageAccess): not
+           * public, the switch on and a password set. The switch alone said
+           * yes on a private page with no password set, and the app sent
+           * every visitor - private users included - to a password prompt
+           * that could never let anyone in, while the server treated the
+           * page as a sign-in page.
+           */
+          item.enableMasterPassword = isStatusPageMasterPasswordRequired({
+            isPublicStatusPage: Boolean(item.isPublicStatusPage),
+            enableMasterPassword: item.enableMasterPassword,
+            hasMasterPassword: Boolean(item.masterPassword),
+          });
+
+          // The password's hash and salt never leave the server.
+          delete item.masterPassword;
+          delete item.masterPasswordSalt;
+
           if (!allowStatusPageCustomizations) {
             /*
              * The conditional select above keeps these values out of the
@@ -2344,6 +2392,50 @@ export default class StatusPageAPI extends BaseAPI<
     );
   }
 
+  /*
+   * POST /status-page/listing-monitors: which of the caller's readable status
+   * pages list some monitors (StatusPagesListingMonitorsBuilder).
+   */
+  private async getStatusPagesListingMonitors(
+    req: ExpressRequest,
+    res: ExpressResponse,
+  ): Promise<void> {
+    /*
+     * The answer is for one project, and the reads it is built from are
+     * bounded by the caller's permissions in that project, so the request is
+     * never treated as multi-tenant.
+     */
+    const props: DatabaseCommonInteractionProps = {
+      ...(await CommonAPI.getDatabaseCommonInteractionProps(req)),
+      isMultiTenantRequest: false,
+    };
+
+    /*
+     * A member of the project, or one of its API keys. What either may see
+     * is then bounded by the monitor and status page reads below.
+     */
+    const projectId: ObjectID =
+      CommonAPI.assertAuthenticatedProjectPrincipal(props);
+
+    const request: StatusPagesListingMonitorsRequest =
+      StatusPagesListingMonitorsBuilder.parseRequest({
+        body: req.body,
+        projectId: projectId,
+        props: props,
+      });
+
+    const result: StatusPagesListingMonitorsResult =
+      await StatusPagesListingMonitorsBuilder.build(request);
+
+    Response.setNoCacheHeaders(res);
+
+    return Response.sendJsonObjectResponse(
+      req,
+      res,
+      StatusPagesListingMonitors.toJSON(result),
+    );
+  }
+
   @CaptureSpan()
   public async getScheduledMaintenanceEvents(
     statusPageId: ObjectID,

package/Server/API/StatusPageDomainAPI.ts

@@ -14,9 +14,12 @@ import BaseAPI from "./BaseAPI";
 import CommonAPI from "./CommonAPI";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import BadDataException from "../../Types/Exception/BadDataException";
+import TooManyRequestsException from "../../Types/Exception/TooManyRequestsException";
 import ObjectID from "../../Types/ObjectID";
 import PositiveNumber from "../../Types/PositiveNumber";
 import StatusPageDomain from "../../Models/DatabaseModels/StatusPageDomain";
+import CertificateOrder from "../Utils/Greenlock/CertificateOrder";
+import CustomDomainRoutes from "./CustomDomainRoutes";
 
 export default class StatusPageDomainAPI extends BaseAPI<
   StatusPageDomain,
@@ -25,102 +28,34 @@ export default class StatusPageDomainAPI extends BaseAPI<
   public constructor() {
     super(StatusPageDomain, StatusPageDomainService);
 
-    // CNAME verification api. THis API will be used from the dashboard to validate the CNAME MANUALLY.
-    this.router.get(
-      `${new this.entityType().getCrudApiPath()?.toString()}/verify-cname/:id`,
-      UserMiddleware.getUserMiddleware,
-      async (req: ExpressRequest, res: ExpressResponse, next: NextFunction) => {
-        try {
-          if (!StatusPageCNameRecord) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException(
-                `Custom Domains not enabled for this
-                                OneUptime installation. Please contact
-                                your server admin to enable this
-                                feature.`,
-              ),
-            );
-          }
-
-          const databaseProps: DatabaseCommonInteractionProps =
-            await CommonAPI.getDatabaseCommonInteractionProps(req);
-
-          const id: ObjectID = new ObjectID(req.params["id"] as string);
-
-          // check if the user can read the domain.
-
-          const domainCount: PositiveNumber =
-            await StatusPageDomainService.countBy({
-              query: {
-                _id: id.toString(),
-              },
-              props: databaseProps,
-            });
-
-          if (domainCount.toNumber() === 0) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException(
-                "The domain does not exist or user does not have access to it.",
-              ),
-            );
-          }
-
-          const domain: StatusPageDomain | null =
-            await StatusPageDomainService.findOneBy({
-              query: {
-                _id: id.toString(),
-              },
-              select: {
-                _id: true,
-                fullDomain: true,
-              },
-              props: {
-                isRoot: true,
-              },
-            });
-
-          if (!domain) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Invalid token."),
-            );
-          }
-
-          if (!domain.fullDomain) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException("Invalid domain."),
-            );
-          }
-
-          const isValid: boolean = await StatusPageDomainService.isCnameValid(
-            domain.fullDomain!,
-          );
-
-          if (!isValid) {
-            return Response.sendErrorResponse(
-              req,
-              res,
-              new BadDataException(
-                "CNAME is not verified. Please make sure you have the correct record and please verify CNAME again. If you are sure that the record is correct, please wait for some time for the DNS to propagate.",
-              ),
-            );
-          }
-
-          return Response.sendEmptySuccessResponse(req, res);
-        } catch (e) {
-          next(e);
-        }
+    /*
+     * Check now (verify-cname) and the Status column's certificates: the
+     * same routes as a dashboard's custom domains, registered once for both
+     * (CustomDomainRoutes).
+     */
+    CustomDomainRoutes.add({
+      router: this.router,
+      crudApiPath: new this.entityType().getCrudApiPath()?.toString() || "",
+      service: StatusPageDomainService,
+      getCnameRecord: (): string => {
+        return StatusPageCNameRecord;
       },
-    );
+      parentColumn: "statusPageId",
+    });
 
-    // Provision SSL API. THis API will be used from the dashboard to validate the CNAME MANUALLY.
+    /*
+     * Order SSL. The dashboard no longer has a button for this: a domain's
+     * certificate is ordered as soon as its CNAME is verified. It stays for
+     * API callers, and orders the way everything else does, through
+     * orderCertIfMissing: a domain that has its certificate already, or has
+     * one being ordered right now, is not ordered twice.
+     *
+     * It shares Check now's window: one order on demand per domain per 15
+     * minutes, whichever of the two placed it. An order that fails leaves the
+     * domain unordered, so without it a script calling this in a loop placed
+     * an order on every call - against the account the whole installation
+     * shares, and Let's Encrypt's five failed validations per name per hour.
+     */
     this.router.get(
       `${new this.entityType().getCrudApiPath()?.toString()}/order-ssl/:id`,
       UserMiddleware.getUserMiddleware,
@@ -175,6 +110,8 @@ export default class StatusPageDomainAPI extends BaseAPI<
                 cnameVerificationToken: true,
                 isCnameVerified: true,
                 isSslProvisioned: true,
+                isCustomCertificate: true,
+                projectId: true,
               },
               props: {
                 isRoot: true,
@@ -215,6 +152,17 @@ export default class StatusPageDomainAPI extends BaseAPI<
             );
           }
 
+          // The sweeps never order for one either: it serves the upload.
+          if (domain.isCustomCertificate) {
+            return Response.sendErrorResponse(
+              req,
+              res,
+              new BadDataException(
+                "This domain uses a certificate you uploaded, so there is no free SSL certificate to order for it.",
+              ),
+            );
+          }
+
           if (!domain.fullDomain) {
             return Response.sendErrorResponse(
               req,
@@ -225,8 +173,23 @@ export default class StatusPageDomainAPI extends BaseAPI<
 
           logger.debug("Ordering SSL", getLogAttributesFromRequest(req as any));
 
-          // provision SSL
-          await StatusPageDomainService.orderCert(domain);
+          try {
+            await CertificateOrder.orderOnDemand({
+              domain: domain.fullDomain,
+              order: () => {
+                return StatusPageDomainService.orderCertIfMissing(domain, {
+                  onDemand: true,
+                });
+              },
+            });
+          } catch (err) {
+            // Too soon, or nothing ordered: the order's own failures go on.
+            if (err instanceof TooManyRequestsException) {
+              return Response.sendErrorResponse(req, res, err);
+            }
+
+            throw err;
+          }
 
           logger.debug(
             "SSL Provisioned for domain - " + domain.fullDomain,

package/Server/Infrastructure/GlobalCache.ts

@@ -395,6 +395,90 @@ export default abstract class GlobalCache {
     return typeof result === "string" && result ? result : null;
   }
 
+  /*
+   * Adds one to a counter and returns the new count. The first add also
+   * sets the counter's expiry, in the same atomic evaluation, so a counter
+   * is never left without one - the primitive for a fixed-window budget
+   * whose key names its window.
+   *
+   * The key is passed as KEYS[1] rather than inlined into the script body so
+   * the script stays correct on Redis Cluster, which routes by declared keys.
+   */
+  @CaptureSpan()
+  public static async incrementWithExpiry(
+    namespace: string,
+    key: string,
+    options: CacheSetOptions,
+  ): Promise<number> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const result: unknown = await client.eval(
+      "local count = redis.call('INCR', KEYS[1]) " +
+        "if count == 1 then redis.call('EXPIRE', KEYS[1], ARGV[1]) end " +
+        "return count",
+      1,
+      `${namespace}-${key}`,
+      String(options.expiresInSeconds),
+    );
+
+    const count: number = Number(result);
+
+    if (!Number.isFinite(count)) {
+      throw new BadDataException("The cache counter is not a number");
+    }
+
+    return count;
+  }
+
+  /*
+   * Adds one to a counter only while it is below limit, and returns the new
+   * count - or null, adding nothing, once the counter has reached limit. As
+   * with incrementWithExpiry, the first add sets the expiry in the same
+   * atomic evaluation.
+   *
+   * A refusal adds nothing. That is what lets several limits share one
+   * counter: callers that may only take the first few units of a window and
+   * callers that may take all of them can count against the same key, and
+   * the ones refused at the lower limit do not use up what the others still
+   * may take.
+   */
+  @CaptureSpan()
+  public static async incrementIfBelow(
+    namespace: string,
+    key: string,
+    options: CacheSetOptions & { limit: number },
+  ): Promise<number | null> {
+    const client: ClientType | null = Redis.getClient();
+
+    if (!client || !Redis.isConnected()) {
+      throw new DatabaseNotConnectedException("Cache is not connected");
+    }
+
+    const result: unknown = await client.eval(
+      "local current = tonumber(redis.call('GET', KEYS[1]) or '0') " +
+        "if current >= tonumber(ARGV[1]) then return -1 end " +
+        "local count = redis.call('INCR', KEYS[1]) " +
+        "if count == 1 then redis.call('EXPIRE', KEYS[1], ARGV[2]) end " +
+        "return count",
+      1,
+      `${namespace}-${key}`,
+      String(Math.floor(options.limit)),
+      String(options.expiresInSeconds),
+    );
+
+    const count: number = Number(result);
+
+    if (!Number.isFinite(count)) {
+      throw new BadDataException("The cache counter is not a number");
+    }
+
+    return count < 0 ? null : count;
+  }
+
   @CaptureSpan()
   public static async deleteKey(namespace: string, key: string): Promise<void> {
     const client: ClientType | null = Redis.getClient();

package/Server/Infrastructure/Postgres/SchemaMigrations/1797700000000-AddFormBranding.ts

@@ -0,0 +1,47 @@
+import { MigrationInterface, QueryRunner } from "typeorm";
+
+/*
+ * A form's branding (Forms > a form > Build > Branding): the logo its public
+ * page shows in place of the OneUptime logo, what that logo says for screen
+ * readers, and the browser tab's icon. Both images are Files; deleting one
+ * only takes it off the form (ON DELETE SET NULL), never the form with it.
+ * Every existing form starts without either, so its page keeps the
+ * OneUptime logo and favicon.
+ *
+ * Files also learn the project they were uploaded in (File.projectId,
+ * stamped by FileService from the request): a form may only show a file of
+ * its own project. Existing files stay without one - nullable, no default,
+ * so adding it rewrites nothing - and so cannot be a form's logo or favicon:
+ * there is none yet to keep.
+ */
+export class AddFormBranding1797700000000 implements MigrationInterface {
+  public name: string = "AddFormBranding1797700000000";
+
+  public async up(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(`ALTER TABLE "File" ADD "projectId" uuid`);
+    await queryRunner.query(`ALTER TABLE "Form" ADD "logoFileId" uuid`);
+    await queryRunner.query(
+      `ALTER TABLE "Form" ADD "logoAltText" character varying(100)`,
+    );
+    await queryRunner.query(`ALTER TABLE "Form" ADD "faviconFileId" uuid`);
+    await queryRunner.query(
+      `ALTER TABLE "Form" ADD CONSTRAINT "FK_995c34464a0d0e3e6502afef243" FOREIGN KEY ("logoFileId") REFERENCES "File"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Form" ADD CONSTRAINT "FK_2782e1b9491115ab7fee075be25" FOREIGN KEY ("faviconFileId") REFERENCES "File"("_id") ON DELETE SET NULL ON UPDATE NO ACTION`,
+    );
+  }
+
+  public async down(queryRunner: QueryRunner): Promise<void> {
+    await queryRunner.query(
+      `ALTER TABLE "Form" DROP CONSTRAINT "FK_2782e1b9491115ab7fee075be25"`,
+    );
+    await queryRunner.query(
+      `ALTER TABLE "Form" DROP CONSTRAINT "FK_995c34464a0d0e3e6502afef243"`,
+    );
+    await queryRunner.query(`ALTER TABLE "Form" DROP COLUMN "faviconFileId"`);
+    await queryRunner.query(`ALTER TABLE "Form" DROP COLUMN "logoAltText"`);
+    await queryRunner.query(`ALTER TABLE "Form" DROP COLUMN "logoFileId"`);
+    await queryRunner.query(`ALTER TABLE "File" DROP COLUMN "projectId"`);
+  }
+}

package/Server/Infrastructure/Postgres/SchemaMigrations/Index.ts

@@ -37,6 +37,7 @@ import { TurnOnLinkedAlertSwitchesByDefault1797300000000 } from "./1797300000000
 import { MigrateIncidentFormsToForms1797400000000 } from "./1797400000000-MigrateIncidentFormsToForms";
 import { AddRunbookRuleMatchCriteria1797500000000 } from "./1797500000000-AddRunbookRuleMatchCriteria";
 import { AddSeverityAndStateColorsToNotificationEmailRollup1797600000000 } from "./1797600000000-AddSeverityAndStateColorsToNotificationEmailRollup";
+import { AddFormBranding1797700000000 } from "./1797700000000-AddFormBranding";
 import { AddConfigurableRuleCriteria1792500000000 } from "./1792500000000-AddConfigurableRuleCriteria";
 import { AddGoogleSecOpsDiagnostics1792300000000 } from "./1792300000000-AddGoogleSecOpsDiagnostics";
 import { AddIncomingCallPolicyPhoneNumbers1792600000000 } from "./1792600000000-AddIncomingCallPolicyPhoneNumbers";
@@ -1274,4 +1275,5 @@ export default [
   MigrateIncidentFormsToForms1797400000000,
   AddRunbookRuleMatchCriteria1797500000000,
   AddSeverityAndStateColorsToNotificationEmailRollup1797600000000,
+  AddFormBranding1797700000000,
 ];

package/Server/Services/AlertGroupingEngineService.ts

@@ -5,14 +5,14 @@ import AlertEpisode from "../../Models/DatabaseModels/AlertEpisode";
 import AlertEpisodeMember, {
   AlertEpisodeMemberAddedBy,
 } from "../../Models/DatabaseModels/AlertEpisodeMember";
-import AlertEpisodeOwnerUser from "../../Models/DatabaseModels/AlertEpisodeOwnerUser";
-import AlertEpisodeOwnerTeam from "../../Models/DatabaseModels/AlertEpisodeOwnerTeam";
 import Label from "../../Models/DatabaseModels/Label";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import AlertSeverity from "../../Models/DatabaseModels/AlertSeverity";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
-import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
+import GroupingRuleEpisodeOwners, {
+  LegacyAssigneeInProject,
+} from "../Utils/Rules/GroupingRuleEpisodeOwners";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import OneUptimeDate from "../../Types/Date";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -804,13 +804,29 @@ class AlertGroupingEngineServiceClass {
       newEpisode.alertSeverityId = alert.alertSeverityId;
     }
 
-    // Set default ownership from rule
-    if (rule.defaultAssignToUserId) {
-      newEpisode.assignedToUserId = rule.defaultAssignToUserId;
-    }
+    /*
+     * The rule's default assignee, from before the rule asked for episode
+     * owners. Still copied for API readers of the episode - while it names
+     * the project's own team and a member - but no page, notification or
+     * worker reads it: owners are what make people responsible for the
+     * episode (below).
+     */
+    if (rule.defaultAssignToUserId || rule.defaultAssignToTeamId) {
+      const assignee: LegacyAssigneeInProject =
+        await GroupingRuleEpisodeOwners.getLegacyAssigneeInProject({
+          projectId: alert.projectId!,
+          userId: rule.defaultAssignToUserId,
+          teamId: rule.defaultAssignToTeamId,
+          ruleName: rule.name || rule.id?.toString(),
+        });
 
-    if (rule.defaultAssignToTeamId) {
-      newEpisode.assignedToTeamId = rule.defaultAssignToTeamId;
+      if (assignee.userId) {
+        newEpisode.assignedToUserId = assignee.userId;
+      }
+
+      if (assignee.teamId) {
+        newEpisode.assignedToTeamId = assignee.teamId;
+      }
     }
 
     // Copy on-call policies from rule
@@ -831,67 +847,29 @@ class AlertGroupingEngineServiceClass {
         },
       });
 
-      // Add episode owner users from rule
-      if (
-        rule.episodeOwnerUsers &&
-        rule.episodeOwnerUsers.length > 0 &&
-        createdEpisode.id
-      ) {
-        for (const user of rule.episodeOwnerUsers) {
-          if (!user.id) {
-            continue;
-          }
-          try {
-            const ownerUser: AlertEpisodeOwnerUser =
-              new AlertEpisodeOwnerUser();
-            ownerUser.projectId = alert.projectId!;
-            ownerUser.alertEpisodeId = createdEpisode.id;
-            ownerUser.userId = user.id;
-            await OwnerRuleAssignment.createOwner({
-              ownerService: AlertEpisodeOwnerUserService,
-              owner: ownerUser,
-              props: {
-                isRoot: true,
-              },
-            });
-          } catch (ownerError) {
-            logger.error(
-              `Error adding owner user ${user.id} to episode: ${ownerError}`,
-              { projectId: alert.projectId?.toString() } as LogAttributes,
-            );
-          }
-        }
-      }
-
-      // Add episode owner teams from rule
-      if (
-        rule.episodeOwnerTeams &&
-        rule.episodeOwnerTeams.length > 0 &&
-        createdEpisode.id
-      ) {
-        for (const team of rule.episodeOwnerTeams) {
-          if (!team.id) {
-            continue;
-          }
-          try {
-            const ownerTeam: AlertEpisodeOwnerTeam =
-              new AlertEpisodeOwnerTeam();
-            ownerTeam.projectId = alert.projectId!;
-            ownerTeam.alertEpisodeId = createdEpisode.id;
-            ownerTeam.teamId = team.id;
-            await OwnerRuleAssignment.createOwner({
-              ownerService: AlertEpisodeOwnerTeamService,
-              owner: ownerTeam,
-              props: {
-                isRoot: true,
-              },
-            });
-          } catch (ownerError) {
-            logger.error(
-              `Error adding owner team ${team.id} to episode: ${ownerError}`,
-              { projectId: alert.projectId?.toString() } as LogAttributes,
-            );
-          }
+      /*
+       * The rule's Episode Owners become owners of the episode - only the
+       * project's own teams and members, as when owners are added by hand
+       * (see GroupingRuleEpisodeOwners). Each one added is notified like any
+       * owner.
+       */
+      if (createdEpisode.id) {
+        try {
+          await GroupingRuleEpisodeOwners.addOwnersToEpisode({
+            projectId: alert.projectId!,
+            episodeId: createdEpisode.id,
+            episodeIdColumn: "alertEpisodeId",
+            ownerUserService: AlertEpisodeOwnerUserService,
+            ownerTeamService: AlertEpisodeOwnerTeamService,
+            users: rule.episodeOwnerUsers,
+            teams: rule.episodeOwnerTeams,
+            ruleName: rule.name || rule.id?.toString(),
+          });
+        } catch (ownerError) {
+          logger.error(
+            `Error adding the grouping rule's owners to episode ${createdEpisode.id.toString()}: ${ownerError}`,
+            { projectId: alert.projectId?.toString() } as LogAttributes,
+          );
         }
       }
 

package/Server/Services/AlertGroupingRuleService.ts

@@ -1,6 +1,13 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/AlertGroupingRule";
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import GroupingRuleEpisodeOwners from "../Utils/Rules/GroupingRuleEpisodeOwners";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+const SUBJECT: string = "alert grouping rule";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -9,6 +16,37 @@ export class Service extends DatabaseService<Model> {
       this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365); // 3 years
     }
   }
+
+  /*
+   * The rule's Episode Owners become owners of every episode it opens, and
+   * the engine opens those as root: who they may be is decided here, where
+   * the rule is written (see GroupingRuleEpisodeOwners).
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    await GroupingRuleEpisodeOwners.validateOwnersOnCreate({
+      projectId: createBy.props.tenantId || createBy.data.projectId,
+      rule: createBy.data,
+      subject: SUBJECT,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    await GroupingRuleEpisodeOwners.validateOwnersOnUpdate({
+      service: this,
+      updateBy: updateBy,
+      subject: SUBJECT,
+    });
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();