@oneuptime/common 14.0.13 → 14.0.14

package/Server/Services/FormService.ts

@@ -3,6 +3,7 @@ import CreateBy from "../Types/Database/CreateBy";
 import UpdateBy from "../Types/Database/UpdateBy";
 import { IsBillingEnabled, getAllEnvVars } from "../EnvironmentConfig";
 import DatabaseService from "./DatabaseService";
+import FileService, { FileFacts } from "./FileService";
 import FormSubmissionService from "./FormSubmissionService";
 import ProjectService, { CurrentPlan } from "./ProjectService";
 import SubscriptionPlan, {
@@ -12,6 +13,11 @@ import LIMIT_MAX from "../../Types/Database/LimitMax";
 import Dictionary from "../../Types/Dictionary";
 import Email from "../../Types/Email";
 import BadDataException from "../../Types/Exception/BadDataException";
+import {
+  FORM_BRANDING_IMAGES,
+  FormBrandingImageDefinition,
+  getFormBrandingImageProblem,
+} from "../../Types/Form/FormBranding";
 import ForbiddenException from "../../Types/Exception/ForbiddenException";
 import NotFoundException from "../../Types/Exception/NotFoundException";
 import ServerException from "../../Types/Exception/ServerException";
@@ -66,10 +72,12 @@ import {
   neutralizeUntrustedMarkdown,
   neutralizeUntrustedPlainText,
 } from "../../Utils/Markdown/UntrustedMarkdown";
+import File from "../../Models/DatabaseModels/File";
 import Model from "../../Models/DatabaseModels/Form";
 import FormSubmission from "../../Models/DatabaseModels/FormSubmission";
 import FormRateLimit from "../Middleware/FormRateLimit";
 import CaptchaUtil from "../Utils/Captcha";
+import RelationIdUtil from "../Utils/Database/RelationIdUtil";
 import FormRecordOptions from "../Utils/Form/FormRecordOptions";
 import { getFormSubmissionNote } from "../Utils/Form/FormSubmissionNote";
 import {
@@ -100,6 +108,8 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
  *     without asked;
  *   - its settings are that target's settings (validateFormTargetSettings);
  *   - its IP allowlist holds only entries the public routes can match;
+ *   - its logo and favicon, when it has them, are files uploaded in its own
+ *     project, of a type the public page draws and small (FormBranding);
  *   - every record its settings and questions name - a severity, monitors
  *     offered to choose from, a custom field, an owner - belongs to its own
  *     project, because every submission is created in that project with them.
@@ -135,6 +145,16 @@ export const FORM_NOT_AVAILABLE_MESSAGE: string =
 export const FORM_NETWORK_NOT_ALLOWED_MESSAGE: string =
   "This form can only be opened from an allowed network.";
 
+/*
+ * A form a branding write is for, as the check needs it: the project its
+ * images must come from, and the files it shows now.
+ */
+interface BrandingCheckForm {
+  projectId: ObjectID | undefined;
+  logoFileId?: ObjectID | null | undefined;
+  faviconFileId?: ObjectID | null | undefined;
+}
+
 /*
  * Creating the submission's record itself failed. Why is logged with the
  * form and the project; the submitter, who can only try again, is not
@@ -255,6 +275,14 @@ export class Service extends DatabaseService<Model> {
       targetType,
     });
     this.assertValidIpAllowlist(createBy.data.ipWhitelist);
+    await this.assertValidBrandingImages({
+      values: createBy.data as unknown as Dictionary<unknown>,
+      forms: [
+        {
+          projectId: createBy.props.tenantId || createBy.data.projectId,
+        },
+      ],
+    });
 
     const projectId: ObjectID | undefined =
       createBy.props.tenantId || createBy.data.projectId;
@@ -299,6 +327,57 @@ export class Service extends DatabaseService<Model> {
       throw new BadDataException(FORM_TARGET_TYPE_MESSAGE);
     }
 
+    if (
+      FORM_BRANDING_IMAGES.some(
+        (image: FormBrandingImageDefinition): boolean => {
+          return has(image.idColumn) || has(image.relationColumn);
+        },
+      )
+    ) {
+      const forms: Array<Model> = await this.findBy({
+        query: updateBy.query,
+        select: {
+          _id: true,
+          projectId: true,
+          logoFileId: true,
+          faviconFileId: true,
+        },
+        limit: LIMIT_MAX,
+        skip: 0,
+        props: {
+          isRoot: true,
+        },
+      });
+
+      /*
+       * Hooks run before the permission layer narrows the update to the
+       * request's project, so the forms read here may be another project's.
+       * The files must then come from the request's project, as every other
+       * reference a form names does, and what such a form shows now is not
+       * used: an update aimed at another project's form is refused alike
+       * whichever file it names, and so tells nothing about that project.
+       */
+      const tenantId: ObjectID | undefined = updateBy.props.tenantId;
+
+      await this.assertValidBrandingImages({
+        values: data,
+        forms: forms.map((form: Model): BrandingCheckForm => {
+          const isRequestsOwn: boolean =
+            !tenantId ||
+            Boolean(
+              form.projectId &&
+                form.projectId.toString() === tenantId.toString(),
+            );
+
+          return {
+            projectId: tenantId || form.projectId,
+            logoFileId: isRequestsOwn ? form.logoFileId : undefined,
+            faviconFileId: isRequestsOwn ? form.faviconFileId : undefined,
+          };
+        }),
+      });
+    }
+
     const changesQuestions: boolean = has("fields");
     const changesTarget: boolean = has("targetType");
     const changesSettings: boolean = has("targetSettings");
@@ -375,7 +454,11 @@ export class Service extends DatabaseService<Model> {
    * What the public page shows for the form a link names: its questions, in
    * the safe subset buildPublicForm builds question by question - never the
    * form's id, project, target, settings, link key or allowlist, never a
-   * custom field or record the form does not offer.
+   * custom field or record the form does not offer - and its branding: its
+   * logo, the logo's alt text and its favicon, when it has them, the images
+   * themselves inside the answer (FormBranding). This is the only way a
+   * form's images reach anyone without an account: through this form, after
+   * every check its questions are behind, and never by a file's id.
    *
    * clientIp is the trusted client address (resolveClientIp), or undefined
    * when there is none; a form with an IP allowlist refuses the latter.
@@ -385,7 +468,11 @@ export class Service extends DatabaseService<Model> {
     shareKey: string | undefined;
     clientIp: string | undefined;
   }): Promise<PublicForm> {
-    const form: Model = await this.getFormForPublicRequest(data);
+    const form: Model = await this.getFormForPublicRequest({
+      shareKey: data.shareKey,
+      clientIp: data.clientIp,
+      includeBranding: true,
+    });
     const built: BuiltPublicForm = await this.buildPublicFormFor(form);
 
     return built.form;
@@ -675,6 +762,10 @@ export class Service extends DatabaseService<Model> {
         description: form.description,
         fields: form.fields,
         targetType: targetType,
+        // Read for the public page only (getPublicForm); a submission has none.
+        logoFile: this.getOwnBrandingFile(form, form.logoFile),
+        logoAltText: form.logoAltText,
+        faviconFile: this.getOwnBrandingFile(form, form.faviconFile),
       },
       customFields: customFields,
       recordOptions: recordOptions,
@@ -685,6 +776,29 @@ export class Service extends DatabaseService<Model> {
     });
   }
 
+  /*
+   * A logo or favicon the form's page may be handed: only a file of the
+   * form's own project. Every write is checked for that already
+   * (assertValidBrandingImages); this checks again as the page reads it,
+   * whatever wrote the row, so not even a reference no write check saw can
+   * hand the page a file of another project, or one uploaded with none.
+   */
+  private getOwnBrandingFile(
+    form: Model,
+    file: File | undefined,
+  ): File | undefined {
+    if (
+      !file ||
+      !file.projectId ||
+      !form.projectId ||
+      file.projectId.toString() !== form.projectId.toString()
+    ) {
+      return undefined;
+    }
+
+    return file;
+  }
+
   private async loadRecordOptions(data: {
     projectId: ObjectID;
     targetType: FormTargetType;
@@ -795,10 +909,16 @@ export class Service extends DatabaseService<Model> {
    * order, each needing the one before: the link has a share key's shape
    * (so junk never reaches Postgres), a form holds that key, the form is on,
    * its project's plan includes forms, and the visitor's network is allowed.
+   *
+   * includeBranding reads the form's logo and favicon - the images
+   * themselves and the project each was uploaded in, through the form's own
+   * relations - with the form, in the same query: for the public page's
+   * read. A submission never needs them, so it never pays for them.
    */
   private async getFormForPublicRequest(data: {
     shareKey: string | undefined;
     clientIp: string | undefined;
+    includeBranding?: boolean | undefined;
   }): Promise<Model> {
     const shareKey: string =
       typeof data.shareKey === "string"
@@ -824,6 +944,21 @@ export class Service extends DatabaseService<Model> {
         targetSettings: true,
         successMessage: true,
         ipWhitelist: true,
+        ...(data.includeBranding
+          ? {
+              logoAltText: true,
+              logoFile: {
+                file: true,
+                fileType: true,
+                projectId: true,
+              },
+              faviconFile: {
+                file: true,
+                fileType: true,
+                projectId: true,
+              },
+            }
+          : {}),
       },
       props: {
         isRoot: true,
@@ -1128,6 +1263,81 @@ export class Service extends DatabaseService<Model> {
     }
   }
 
+  /*
+   * A logo or favicon a write points a form at must be a File uploaded in
+   * that form's own project (FileService stamps every upload with the
+   * request's project), of a type the public page draws, and small
+   * (getFormBrandingImageProblem): the page is handed it inside the form, to
+   * anyone with the link, every time it opens. So a form can never be used
+   * to show - or to learn about - a file of another project: such a file,
+   * one uploaded with no project, a missing one and a reference that is not
+   * an id are all the same "not found". The file itself is never made
+   * public.
+   *
+   * Either spelling of the reference is read - the dashboard's forms write
+   * the relation, server-side callers and the API the id - and two that
+   * disagree are refused (RelationIdUtil). An empty one clears the image, as
+   * null does, so it never reaches the uuid column. A file the form already
+   * shows is not checked again: the dashboard's dialog sends the whole form
+   * back, and nothing about a file can change once it is uploaded. The check
+   * reads a file's type, size and project, never its bytes.
+   */
+  private async assertValidBrandingImages(data: {
+    values: Dictionary<unknown>;
+    // Every form the write is for: its project, and the files it shows now.
+    forms: Array<BrandingCheckForm>;
+  }): Promise<void> {
+    for (const image of FORM_BRANDING_IMAGES) {
+      for (const key of [image.idColumn, image.relationColumn]) {
+        if (data.values[key] === "") {
+          data.values[key] = null;
+        }
+      }
+
+      const fileId: ObjectID | null = RelationIdUtil.readConsistent(
+        data.values as Record<string, unknown>,
+        [image.idColumn, image.relationColumn],
+        image.name,
+      );
+
+      if (!fileId) {
+        continue;
+      }
+
+      let facts: FileFacts | null | undefined = undefined;
+
+      for (const form of data.forms) {
+        const held: ObjectID | null | undefined = form[image.idColumn];
+
+        if (held && held.toString() === fileId.toString()) {
+          continue;
+        }
+
+        if (facts === undefined) {
+          facts = await FileService.getFileFacts(fileId);
+        }
+
+        const isFormsOwn: boolean = Boolean(
+          facts &&
+            facts.projectId &&
+            form.projectId &&
+            facts.projectId.toString() === form.projectId.toString(),
+        );
+
+        const problem: string | null = isFormsOwn
+          ? getFormBrandingImageProblem({
+              image: image,
+              file: facts,
+            })
+          : image.notFoundMessage;
+
+        if (problem) {
+          throw new BadDataException(problem);
+        }
+      }
+    }
+  }
+
   /*
    * Every line an entry the public routes can match (see FormIpAllowlist):
    * an entry that can never match would lock everyone on that network out,

package/Server/Services/GlobalOidcService.ts

@@ -1,6 +1,7 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalOidc";
 import ObjectID from "../../Types/ObjectID";
+import { fillOidcProviderDefaults } from "../../Types/SSO/OidcProviderDefaults";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
@@ -121,10 +122,19 @@ export class Service extends DatabaseService<Model> {
     return onDelete;
   }
 
+  /*
+   * A provider created without a discovery URL, scopes, claim names or a
+   * description gets the usual ones (Types/SSO/OidcProviderDefaults), before
+   * the required-field check runs: the columns stay required, so the API and
+   * Terraform keep their contract, and a caller may leave them out. What the
+   * caller sent is kept.
+   */
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
+    fillOidcProviderDefaults(createBy.data);
+
     clearGlobalSsoAuthorizationCaches();
     return { createBy, carryForward: null };
   }

package/Server/Services/GlobalSsoService.ts

@@ -1,6 +1,7 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/GlobalSso";
 import ObjectID from "../../Types/ObjectID";
+import { fillSamlProviderDefaults } from "../../Types/SSO/SamlProviderDefaults";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
@@ -121,10 +122,19 @@ export class Service extends DatabaseService<Model> {
     return onDelete;
   }
 
+  /*
+   * A SAML provider created without a signature method, a digest method or
+   * a description gets the usual ones (Types/SSO/SamlProviderDefaults),
+   * before the required-field check runs: the columns stay required, so the
+   * API and Terraform keep their contract, and a caller may leave them out.
+   * What the caller sent is kept.
+   */
   @CaptureSpan()
   protected override async onBeforeCreate(
     createBy: CreateBy<Model>,
   ): Promise<OnCreate<Model>> {
+    fillSamlProviderDefaults(createBy.data);
+
     clearGlobalSsoAuthorizationCaches();
     return { createBy, carryForward: null };
   }

package/Server/Services/HostService.ts

@@ -20,6 +20,15 @@ import { JSONObject } from "../../Types/JSON";
 import URL from "../../Types/API/URL";
 import DatabaseConfig from "../DatabaseConfig";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import DiscoveredResourceCreate, {
+  DiscoveredResourceNaming,
+  NamedAfterIdentityOptions,
+  namedAfterIdentity,
+} from "../Utils/Telemetry/DiscoveredResourceCreate";
+import DiscoveredResourceUpdate, {
+  MatchColumn,
+  matchedOnIdentifier,
+} from "../Utils/Telemetry/DiscoveredResourceUpdate";
 import ResourceHeartbeat from "../Utils/Telemetry/ResourceHeartbeat";
 import ObjectID from "../../Types/ObjectID";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -37,6 +46,21 @@ const LAST_SEEN_THROTTLE_SECONDS: number = 60;
 const LABELS_APPLIED_CACHE_NAMESPACE: string = "host-labels-applied";
 const LABELS_APPLIED_CACHE_TTL_SECONDS: number = 60;
 
+/*
+ * A host is matched to its telemetry by host.name, and named after it unless
+ * somebody gives it a display name of their own (DiscoveredResourceCreate).
+ */
+const HOST_IDENTITY: NamedAfterIdentityOptions = {
+  identityColumn: "hostIdentifier",
+  resourceName: "host",
+  identityName: "host name",
+};
+
+const HOST_NAMING: DiscoveredResourceNaming<Model> =
+  namedAfterIdentity<Model>(HOST_IDENTITY);
+
+const HOST_MATCH_COLUMN: MatchColumn = matchedOnIdentifier(HOST_IDENTITY);
+
 /*
  * What `findOrCreateByHostIdentifier` memoizes: the resolved row's id plus
  * the identifier it converged to. A flat shape rather than the Model itself
@@ -811,9 +835,43 @@ export class Service extends DatabaseService<Model> {
       createBy,
     });
 
+    // Named after its host name when nobody gave it a name.
+    DiscoveredResourceCreate.fillName({ createBy, naming: HOST_NAMING });
+
     return { createBy, carryForward: null };
   }
 
+  /*
+   * A host that is already there - discovered from its telemetry or added
+   * before - is refused by its host name, not as a clash of names.
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreateUniqueCheck(
+    createBy: CreateBy<Model>,
+  ): Promise<void> {
+    await DiscoveredResourceCreate.refuseClash({
+      service: this,
+      createBy,
+      naming: HOST_NAMING,
+    });
+  }
+
+  /*
+   * A host's host name - edited from the details card on its Settings page - is stored
+   * without the spaces around it, and refused when another one of the
+   * project already has it (DiscoveredResourceUpdate).
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdateUniqueCheck(
+    updateBy: UpdateBy<Model>,
+  ): Promise<void> {
+    await DiscoveredResourceUpdate.checkMatchColumn({
+      service: this,
+      updateBy,
+      matchColumn: HOST_MATCH_COLUMN,
+    });
+  }
+
   /*
    * An operator's write of an AI access setting (the investigation switch, the
    * remediation mode, the command allowlist) is validated and checked against

package/Server/Services/IncidentGroupingEngineService.ts

@@ -5,15 +5,15 @@ import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
 import IncidentEpisodeMember, {
   IncidentEpisodeMemberAddedBy,
 } from "../../Models/DatabaseModels/IncidentEpisodeMember";
-import IncidentEpisodeOwnerUser from "../../Models/DatabaseModels/IncidentEpisodeOwnerUser";
-import IncidentEpisodeOwnerTeam from "../../Models/DatabaseModels/IncidentEpisodeOwnerTeam";
 import IncidentEpisodeRoleMember from "../../Models/DatabaseModels/IncidentEpisodeRoleMember";
 import Label from "../../Models/DatabaseModels/Label";
 import Monitor from "../../Models/DatabaseModels/Monitor";
 import IncidentSeverity from "../../Models/DatabaseModels/IncidentSeverity";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 import logger, { LogAttributes } from "../Utils/Logger";
-import OwnerRuleAssignment from "../Utils/Rules/OwnerRuleAssignment";
+import GroupingRuleEpisodeOwners, {
+  LegacyAssigneeInProject,
+} from "../Utils/Rules/GroupingRuleEpisodeOwners";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import OneUptimeDate from "../../Types/Date";
 import QueryHelper from "../Types/Database/QueryHelper";
@@ -929,13 +929,29 @@ class IncidentGroupingEngineServiceClass {
       newEpisode.incidentSeverityId = incident.incidentSeverityId;
     }
 
-    // Set default ownership from rule
-    if (rule.defaultAssignToUserId) {
-      newEpisode.assignedToUserId = rule.defaultAssignToUserId;
-    }
+    /*
+     * The rule's default assignee, from before the rule asked for episode
+     * owners. Still copied for API readers of the episode - while it names
+     * the project's own team and a member - but no page, notification or
+     * worker reads it: owners are what make people responsible for the
+     * episode (below).
+     */
+    if (rule.defaultAssignToUserId || rule.defaultAssignToTeamId) {
+      const assignee: LegacyAssigneeInProject =
+        await GroupingRuleEpisodeOwners.getLegacyAssigneeInProject({
+          projectId: incident.projectId!,
+          userId: rule.defaultAssignToUserId,
+          teamId: rule.defaultAssignToTeamId,
+          ruleName: rule.name || rule.id?.toString(),
+        });
+
+      if (assignee.userId) {
+        newEpisode.assignedToUserId = assignee.userId;
+      }
 
-    if (rule.defaultAssignToTeamId) {
-      newEpisode.assignedToTeamId = rule.defaultAssignToTeamId;
+      if (assignee.teamId) {
+        newEpisode.assignedToTeamId = assignee.teamId;
+      }
     }
 
     // Copy on-call policies from rule
@@ -957,67 +973,29 @@ class IncidentGroupingEngineServiceClass {
           },
         });
 
-      // Add episode owner users from rule
-      if (
-        rule.episodeOwnerUsers &&
-        rule.episodeOwnerUsers.length > 0 &&
-        createdEpisode.id
-      ) {
-        for (const user of rule.episodeOwnerUsers) {
-          if (!user.id) {
-            continue;
-          }
-          try {
-            const ownerUser: IncidentEpisodeOwnerUser =
-              new IncidentEpisodeOwnerUser();
-            ownerUser.projectId = incident.projectId!;
-            ownerUser.incidentEpisodeId = createdEpisode.id;
-            ownerUser.userId = user.id;
-            await OwnerRuleAssignment.createOwner({
-              ownerService: IncidentEpisodeOwnerUserService,
-              owner: ownerUser,
-              props: {
-                isRoot: true,
-              },
-            });
-          } catch (ownerError) {
-            logger.error(
-              `Error adding owner user ${user.id} to episode: ${ownerError}`,
-              { projectId: incident.projectId?.toString() } as LogAttributes,
-            );
-          }
-        }
-      }
-
-      // Add episode owner teams from rule
-      if (
-        rule.episodeOwnerTeams &&
-        rule.episodeOwnerTeams.length > 0 &&
-        createdEpisode.id
-      ) {
-        for (const team of rule.episodeOwnerTeams) {
-          if (!team.id) {
-            continue;
-          }
-          try {
-            const ownerTeam: IncidentEpisodeOwnerTeam =
-              new IncidentEpisodeOwnerTeam();
-            ownerTeam.projectId = incident.projectId!;
-            ownerTeam.incidentEpisodeId = createdEpisode.id;
-            ownerTeam.teamId = team.id;
-            await OwnerRuleAssignment.createOwner({
-              ownerService: IncidentEpisodeOwnerTeamService,
-              owner: ownerTeam,
-              props: {
-                isRoot: true,
-              },
-            });
-          } catch (ownerError) {
-            logger.error(
-              `Error adding owner team ${team.id} to episode: ${ownerError}`,
-              { projectId: incident.projectId?.toString() } as LogAttributes,
-            );
-          }
+      /*
+       * The rule's Episode Owners become owners of the episode - only the
+       * project's own teams and members, as when owners are added by hand
+       * (see GroupingRuleEpisodeOwners). Each one added is notified like any
+       * owner.
+       */
+      if (createdEpisode.id) {
+        try {
+          await GroupingRuleEpisodeOwners.addOwnersToEpisode({
+            projectId: incident.projectId!,
+            episodeId: createdEpisode.id,
+            episodeIdColumn: "incidentEpisodeId",
+            ownerUserService: IncidentEpisodeOwnerUserService,
+            ownerTeamService: IncidentEpisodeOwnerTeamService,
+            users: rule.episodeOwnerUsers,
+            teams: rule.episodeOwnerTeams,
+            ruleName: rule.name || rule.id?.toString(),
+          });
+        } catch (ownerError) {
+          logger.error(
+            `Error adding the grouping rule's owners to episode ${createdEpisode.id.toString()}: ${ownerError}`,
+            { projectId: incident.projectId?.toString() } as LogAttributes,
+          );
         }
       }
 

package/Server/Services/IncidentGroupingRuleService.ts

@@ -1,6 +1,13 @@
 import DatabaseService from "./DatabaseService";
 import Model from "../../Models/DatabaseModels/IncidentGroupingRule";
 import { IsBillingEnabled } from "../EnvironmentConfig";
+import CreateBy from "../Types/Database/CreateBy";
+import UpdateBy from "../Types/Database/UpdateBy";
+import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
+import GroupingRuleEpisodeOwners from "../Utils/Rules/GroupingRuleEpisodeOwners";
+import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+
+const SUBJECT: string = "incident grouping rule";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -9,6 +16,37 @@ export class Service extends DatabaseService<Model> {
       this.hardDeleteItemsOlderThanInDays("createdAt", 3 * 365); // 3 years
     }
   }
+
+  /*
+   * The rule's Episode Owners become owners of every episode it opens, and
+   * the engine opens those as root: who they may be is decided here, where
+   * the rule is written (see GroupingRuleEpisodeOwners).
+   */
+  @CaptureSpan()
+  protected override async onBeforeCreate(
+    createBy: CreateBy<Model>,
+  ): Promise<OnCreate<Model>> {
+    await GroupingRuleEpisodeOwners.validateOwnersOnCreate({
+      projectId: createBy.props.tenantId || createBy.data.projectId,
+      rule: createBy.data,
+      subject: SUBJECT,
+    });
+
+    return { createBy, carryForward: null };
+  }
+
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<Model>,
+  ): Promise<OnUpdate<Model>> {
+    await GroupingRuleEpisodeOwners.validateOwnersOnUpdate({
+      service: this,
+      updateBy: updateBy,
+      subject: SUBJECT,
+    });
+
+    return { updateBy, carryForward: null };
+  }
 }
 
 export default new Service();