@oneuptime/common 14.0.7 → 14.0.8

package/Server/Services/DatabaseService.ts

@@ -109,6 +109,15 @@ const RULE_CRITERIA_RELATION_OPERATORS: ReadonlySet<RuleCriteriaOperator> =
     RuleCriteriaOperator.HasNoneOf,
   ]);
 
+// A hook-free write to one row by id, ready to run (see buildColumnsByIdUpdateStatement).
+interface ColumnsByIdUpdateStatement {
+  tableName: string;
+  primaryColumnName: string;
+  setSql: string;
+  whereSql: string;
+  params: Array<unknown>;
+}
+
 class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
   public modelType!: { new (): TBaseModel };
   private model!: TBaseModel;
@@ -3821,6 +3830,78 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
      */
     skipUpdateDateColumn?: boolean;
   }): Promise<void> {
+    const statement: ColumnsByIdUpdateStatement | null =
+      this.buildColumnsByIdUpdateStatement(
+        input,
+        "updateColumnsByIdWithoutHooks",
+      );
+
+    if (!statement) {
+      return;
+    }
+
+    const sql: string = `UPDATE "${statement.tableName}" SET ${statement.setSql} WHERE ${statement.whereSql}`;
+
+    await this.getRepository().manager.query(sql, statement.params);
+  }
+
+  /*
+   * The same single-statement, hook-free, no-version-bump write as
+   * `updateColumnsByIdWithoutHooks` with its `expectedData` guard, which
+   * also says whether it happened: true when the row matched every expected
+   * value and was written, false when another writer had changed it first
+   * (or it no longer exists).
+   *
+   * This is what lets two workers race for one row and have exactly one of
+   * them win - a job claiming a Pending notification by moving it to
+   * InProgress, say, where both would otherwise send it. The check and the
+   * write are one statement, so there is no window between them.
+   *
+   * The UPDATE sits in a CTE so the statement is a SELECT of the rows it
+   * wrote (see updateColumnsByIdIfUnlockedWithoutHooks for why a bare
+   * UPDATE ... RETURNING cannot tell the two cases apart through TypeORM).
+   */
+  @CaptureSpan()
+  public async compareAndSetColumnsByIdWithoutHooks(input: {
+    id: ObjectID;
+    data: PartialEntity<TBaseModel>;
+    expectedData: PartialEntity<TBaseModel>;
+    skipUpdateDateColumn?: boolean;
+  }): Promise<boolean> {
+    const statement: ColumnsByIdUpdateStatement | null =
+      this.buildColumnsByIdUpdateStatement(
+        input,
+        "compareAndSetColumnsByIdWithoutHooks",
+      );
+
+    if (!statement) {
+      return false;
+    }
+
+    const sql: string = `WITH "updated" AS (UPDATE "${statement.tableName}" SET ${statement.setSql} WHERE ${statement.whereSql} RETURNING "${statement.primaryColumnName}") SELECT "${statement.primaryColumnName}" FROM "updated"`;
+
+    const result: unknown = await this.getRepository().manager.query(
+      sql,
+      statement.params,
+    );
+
+    return Array.isArray(result) && result.length > 0;
+  }
+
+  /*
+   * The SET and WHERE clauses of a hook-free write to one row by id, with
+   * every value bound as a parameter. Null when there is nothing to set.
+   * `methodName` is the public method the errors are reported under.
+   */
+  private buildColumnsByIdUpdateStatement(
+    input: {
+      id: ObjectID;
+      data: PartialEntity<TBaseModel>;
+      expectedData?: PartialEntity<TBaseModel> | undefined;
+      skipUpdateDateColumn?: boolean | undefined;
+    },
+    methodName: string,
+  ): ColumnsByIdUpdateStatement | null {
     if (!input.id) {
       throw new BadDataException("id is required");
     }
@@ -3846,7 +3927,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
         metadata.findColumnWithPropertyName(propertyName);
       if (!column) {
         throw new BadDataException(
-          `updateColumnsByIdWithoutHooks: unknown column "${propertyName}" on "${metadata.tableName}"`,
+          `${methodName}: unknown column "${propertyName}" on "${metadata.tableName}"`,
         );
       }
       /*
@@ -3857,7 +3938,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
        */
       if (typeof value === "function") {
         throw new BadDataException(
-          `updateColumnsByIdWithoutHooks: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`,
+          `${methodName}: SQL-expression values are not supported (column "${propertyName}"); pass a literal value.`,
         );
       }
       /*
@@ -3872,7 +3953,7 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
     }
 
     if (setClauses.length === 0) {
-      return;
+      return null;
     }
 
     // The raw path has no entity machinery to touch updateDate — do it here.
@@ -3898,13 +3979,13 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
 
       if (!column) {
         throw new BadDataException(
-          `updateColumnsByIdWithoutHooks: unknown expected column "${propertyName}" on "${metadata.tableName}"`,
+          `${methodName}: unknown expected column "${propertyName}" on "${metadata.tableName}"`,
         );
       }
 
       if (typeof value === "function") {
         throw new BadDataException(
-          `updateColumnsByIdWithoutHooks: SQL-expression expected values are not supported (column "${propertyName}"); pass a literal value.`,
+          `${methodName}: SQL-expression expected values are not supported (column "${propertyName}"); pass a literal value.`,
         );
       }
 
@@ -3914,11 +3995,13 @@ class DatabaseService<TBaseModel extends BaseModel> extends BaseService {
       );
     }
 
-    const sql: string = `UPDATE "${metadata.tableName}" SET ${setClauses.join(
-      ", ",
-    )} WHERE ${whereClauses.join(" AND ")}`;
-
-    await repository.manager.query(sql, params);
+    return {
+      tableName: metadata.tableName,
+      primaryColumnName: primaryColumnName,
+      setSql: setClauses.join(", "),
+      whereSql: whereClauses.join(" AND "),
+      params: params,
+    };
   }
 
   /*

package/Server/Services/IncidentCustomFieldService.ts

@@ -1,7 +1,16 @@
 import DatabaseService from "./DatabaseService";
+import IncidentService from "./IncidentService";
+import IncidentTemplateService from "./IncidentTemplateService";
 import Model from "../../Models/DatabaseModels/IncidentCustomField";
+import BadDataException from "../../Types/Exception/BadDataException";
+import { INCIDENT_CUSTOM_FIELD_TABLE_VIEW_IDS } from "../../Types/CustomField/CustomFieldSavedViews";
+import { generateCustomFieldVariableKey } from "../../Types/CustomField/CustomFieldVariableKey";
+import LIMIT_MAX from "../../Types/Database/LimitMax";
+import Dictionary from "../../Types/Dictionary";
 import ObjectID from "../../Types/ObjectID";
 import CreateBy from "../Types/Database/CreateBy";
+import QueryHelper from "../Types/Database/QueryHelper";
+import Query from "../Types/Database/Query";
 import UpdateBy from "../Types/Database/UpdateBy";
 import { OnCreate, OnUpdate } from "../Types/Database/Hooks";
 import { backfillMappedCustomFieldValues } from "../Utils/CustomField/CustomFieldDefinitionMappingHooks";
@@ -9,6 +18,7 @@ import {
   validateCustomFieldMappingOnCreate,
   validateCustomFieldMappingOnUpdate,
 } from "../Utils/CustomField/CustomFieldMappingValidator";
+import { renameCustomField } from "../Utils/CustomField/CustomFieldRename";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
 
 /*
@@ -17,7 +27,27 @@ import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
  * (OneUptime/oneuptime#3549). These hooks are the two halves of that
  * configuration being saved: refusing a mapping that could never resolve, and
  * filling in the incidents that already exist once one is saved.
+ *
+ * They also look after the two things an incident field is known by besides
+ * its settings:
+ *
+ *   - its template key (variableKey), made from the name on create and never
+ *     changed afterwards, so templates that use {{customFields.<key>}} keep
+ *     working whatever the field is renamed to;
+ *   - its name, which is what incidents store its values under. Renaming a
+ *     field moves those values, and the saved views that name it, to the new
+ *     name (see onUpdateSuccess).
  */
+
+/*
+ * What onBeforeUpdate hands to onUpdateSuccess: for a write that renames a
+ * field, the name each field had before it, by field id.
+ */
+type RenameCarryForward = Dictionary<{
+  oldName: string;
+  projectId: ObjectID;
+}> | null;
+
 export class Service extends DatabaseService<Model> {
   public constructor() {
     super(Model);
@@ -32,6 +62,8 @@ export class Service extends DatabaseService<Model> {
       createBy: createBy,
     });
 
+    createBy.data.variableKey = await this.generateVariableKey(createBy);
+
     return { createBy, carryForward: null };
   }
 
@@ -39,13 +71,22 @@ export class Service extends DatabaseService<Model> {
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    /*
+     * The template key never changes after create. Dropped rather than
+     * refused, so a client that saves back the whole record it read (key
+     * included) is not rejected for it.
+     */
+    delete (updateBy.data as Dictionary<unknown>)["variableKey"];
+
     await validateCustomFieldMappingOnUpdate({
       definitionModelType: Model,
       definitionService: this,
       updateBy: updateBy,
     });
 
-    return { updateBy, carryForward: null };
+    const carryForward: RenameCarryForward = await this.prepareRename(updateBy);
+
+    return { updateBy, carryForward: carryForward };
   }
 
   @CaptureSpan()
@@ -67,6 +108,16 @@ export class Service extends DatabaseService<Model> {
     onUpdate: OnUpdate<Model>,
     updatedItemIds: Array<ObjectID>,
   ): Promise<OnUpdate<Model>> {
+    /*
+     * Before the mapping backfill below, which writes mapped values under the
+     * field's name: by then the values already stored have to be under the
+     * new name too.
+     */
+    await this.moveValuesOfRenamedFields({
+      carryForward: onUpdate.carryForward as RenameCarryForward,
+      updatedItemIds: updatedItemIds,
+    });
+
     if (updatedItemIds.length > 0) {
       backfillMappedCustomFieldValues({
         definitionModelType: Model,
@@ -78,6 +129,230 @@ export class Service extends DatabaseService<Model> {
     return onUpdate;
   }
 
+  /*
+   * The key for a new field: made from its name, and not one another field of
+   * the project already has. Whatever the client sent is replaced, like the
+   * other columns this service owns.
+   *
+   * Two fields created at the same moment could both be handed the same key;
+   * the unique (projectId, variableKey) index then refuses the second create,
+   * which can simply be retried, rather than letting two fields share a key.
+   */
+  private async generateVariableKey(
+    createBy: CreateBy<Model>,
+  ): Promise<string> {
+    const projectId: ObjectID | undefined =
+      (createBy.props.tenantId as ObjectID | undefined) ||
+      createBy.data.projectId;
+
+    const existing: Array<Model> = projectId
+      ? await this.findBy({
+          query: {
+            projectId: projectId,
+          },
+          select: {
+            variableKey: true,
+          },
+          limit: LIMIT_MAX,
+          skip: 0,
+          props: {
+            isRoot: true,
+          },
+        })
+      : [];
+
+    return generateCustomFieldVariableKey({
+      name: createBy.data.name || "",
+      existingKeys: existing.map((field: Model) => {
+        return field.variableKey;
+      }),
+    });
+  }
+
+  /*
+   * For a write that sets a name: the fields it renames, with the names they
+   * had, and a refusal when the rename cannot be done safely.
+   *
+   * The store is read as root, like IncidentService reads incidents for its
+   * update hooks, and limited to the caller's project: the update's own
+   * permission check has not run yet, and a non-root caller must not learn
+   * anything about another project's fields from a refusal.
+   */
+  private async prepareRename(
+    updateBy: UpdateBy<Model>,
+  ): Promise<RenameCarryForward> {
+    const newName: unknown = updateBy.data.name;
+
+    if (typeof newName !== "string") {
+      return null;
+    }
+
+    const query: Query<Model> =
+      !updateBy.props.isRoot && updateBy.props.tenantId
+        ? {
+            ...updateBy.query,
+            projectId: updateBy.props.tenantId,
+          }
+        : updateBy.query;
+
+    const fields: Array<Model> = await this.findBy({
+      query: query,
+      select: {
+        _id: true,
+        name: true,
+        projectId: true,
+      },
+      limit: LIMIT_MAX,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    const renamed: Array<Model> = fields.filter((field: Model) => {
+      return Boolean(field.id && field.projectId) && field.name !== newName;
+    });
+
+    if (renamed.length === 0) {
+      return null;
+    }
+
+    /*
+     * One name for several fields would leave them all storing their values
+     * under the same key, merged beyond repair.
+     */
+    if (fields.length > 1) {
+      throw new BadDataException(
+        "Incident custom fields can only be renamed one at a time. Update a single field to change its name.",
+      );
+    }
+
+    const field: Model = renamed[0]!;
+
+    /*
+     * Creating a field already refuses a name another field has
+     * (UniqueColumnBy, case-insensitively), but an update does not check it,
+     * and a rename onto another field's name would move this field's values
+     * over that field's.
+     */
+    const clashes: number = (
+      await this.countBy({
+        query: {
+          projectId: field.projectId!,
+          name: QueryHelper.findWithSameText(newName),
+          _id: QueryHelper.notEquals(field.id!.toString()),
+        },
+        props: {
+          isRoot: true,
+        },
+      })
+    ).toNumber();
+
+    if (clashes > 0) {
+      throw new BadDataException(
+        "Another incident custom field already has this name. Choose a different name.",
+      );
+    }
+
+    return {
+      [field.id!.toString()]: {
+        oldName: field.name || "",
+        projectId: field.projectId!,
+      },
+    };
+  }
+
+  /*
+   * Incidents store a field's values under its name, and incident templates
+   * store the values they fill in the same way, so a renamed field's values
+   * are moved to the new name in both, together with the saved views of the
+   * incidents table that name it. Values a record held under the new name
+   * without holding the old one - a deleted field's, which deleting leaves
+   * behind - are cleared, so the renamed field never shows (or sends to
+   * subscribers) answers that were never its own.
+   *
+   * With raw SQL (CustomFieldRename), not an update through this or any
+   * other service: that would start the "On Update Incident" workflow for
+   * every incident holding a value, and a rename changes no incident's
+   * answers.
+   *
+   * The name is read back from the store rather than taken from the request,
+   * so the values move to exactly the name that was saved. Awaited, so the
+   * card reloading after the save already finds them under the new name.
+   */
+  private async moveValuesOfRenamedFields(data: {
+    carryForward: RenameCarryForward;
+    updatedItemIds: Array<ObjectID>;
+  }): Promise<void> {
+    if (!data.carryForward || data.updatedItemIds.length === 0) {
+      return;
+    }
+
+    const renamedIds: Array<ObjectID> = data.updatedItemIds.filter(
+      (id: ObjectID) => {
+        return Boolean(data.carryForward![id.toString()]);
+      },
+    );
+
+    if (renamedIds.length === 0) {
+      return;
+    }
+
+    const fields: Array<Model> = await this.findBy({
+      query: {
+        _id: QueryHelper.any(
+          renamedIds.map((id: ObjectID) => {
+            return id.toString();
+          }),
+        ),
+      },
+      select: {
+        _id: true,
+        name: true,
+      },
+      limit: renamedIds.length,
+      skip: 0,
+      props: {
+        isRoot: true,
+      },
+    });
+
+    for (const field of fields) {
+      const before: { oldName: string; projectId: ObjectID } | undefined =
+        data.carryForward[field.id!.toString()];
+
+      if (!before || !field.name || field.name === before.oldName) {
+        continue;
+      }
+
+      const newName: string = field.name;
+
+      await renameCustomField({
+        projectId: before.projectId,
+        oldName: before.oldName,
+        newName: newName,
+        valueServices: [IncidentService, IncidentTemplateService],
+        tableViewIds: INCIDENT_CUSTOM_FIELD_TABLE_VIEW_IDS,
+        definitionName: "incident custom field",
+        /*
+         * The values are all still under the old name: so is the field,
+         * again, and the save fails. Left renamed, the field would show
+         * none of its values, and renaming it back would clear them (the
+         * move clears stale values under the name it moves to). Hook-free,
+         * so the rename is not attempted again, and only if nobody has
+         * renamed the field since.
+         */
+        onValuesNotMoved: async (): Promise<void> => {
+          await this.updateColumnsByIdWithoutHooks({
+            id: field.id!,
+            data: { name: before.oldName },
+            expectedData: { name: newName },
+          });
+        },
+      });
+    }
+  }
+
   /*
    * `props.tenantId` is set on every dashboard write but not on internal
    * root-scoped ones, so fall back to the row itself rather than skipping the

package/Server/Services/IncidentEpisodePublicNoteService.ts

@@ -19,6 +19,7 @@ import Query from "../Types/Database/Query";
 import File from "../../Models/DatabaseModels/File";
 import FileAttachmentMarkdownUtil from "../Utils/FileAttachmentMarkdownUtil";
 import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
+import SubscriberNotificationResendAccess from "../Utils/StatusPage/SubscriberNotificationResendAccess";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -181,11 +182,24 @@ export class Service extends DatabaseService<Model> {
    * An edit tells subscribers nothing unless the editor asked for it on this
    * edit (see SubscriberUpdateNotification). When they did, queue the update
    * notification; the IncidentEpisodePublicNote worker job sends it.
+   *
+   * Sending the note's 'posted' notification again - its status written back
+   * to Pending, as the dashboard's Retry does - needs the permission to post
+   * a note that notifies subscribers, and a note whose notification can go
+   * out again (see SubscriberNotificationResendAccess). So does telling
+   * subscribers about an edit, which is also refused while that update
+   * notification is being sent.
    */
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    await SubscriberNotificationResendAccess.assertPublicNoteResendAllowed({
+      modelType: Model,
+      service: this,
+      updateBy: updateBy,
+    });
+
     if (SubscriberUpdateNotification.isRequested(updateBy.miscDataProps)) {
       updateBy.data.subscriberNotificationStatusOnNoteUpdated =
         StatusPageSubscriberNotificationStatus.Pending;
@@ -193,6 +207,20 @@ export class Service extends DatabaseService<Model> {
         SubscriberUpdateNotification.queuedMessage;
     }
 
+    /*
+     * Telling subscribers about the edit - asked for above, or written as
+     * Pending directly (the dashboard's Retry of a failed update) - needs
+     * the permission to post a note that notifies subscribers too, and is
+     * refused while the update notification is being sent.
+     */
+    await SubscriberNotificationResendAccess.assertPublicNoteUpdateNotificationAllowed(
+      {
+        modelType: Model,
+        service: this,
+        updateBy: updateBy,
+      },
+    );
+
     return {
       updateBy: updateBy,
       carryForward: null,

package/Server/Services/IncidentEpisodeService.ts

@@ -15,6 +15,7 @@ import IncidentState from "../../Models/DatabaseModels/IncidentState";
 import IncidentSeverity from "../../Models/DatabaseModels/IncidentSeverity";
 import SortOrder from "../../Types/BaseDatabase/SortOrder";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import SubscriberNotificationResendAccess from "../Utils/StatusPage/SubscriberNotificationResendAccess";
 import logger, { LogAttributes } from "../Utils/Logger";
 import DatabaseCommonInteractionProps from "../../Types/BaseDatabase/DatabaseCommonInteractionProps";
 import IncidentEpisodeStateTimeline from "../../Models/DatabaseModels/IncidentEpisodeStateTimeline";
@@ -95,6 +96,20 @@ export class Service extends DatabaseService<Model> {
       updateBy.props,
     );
 
+    /*
+     * Sending the episode's created notification again while it is being
+     * sent would let a second run send it alongside, or be overwritten when
+     * the send settles (SubscriberNotificationResendAccess). No user role may
+     * write its status (update: []), so this only ever stops a master admin;
+     * it is here so the rule holds for every notification the same way.
+     */
+    await SubscriberNotificationResendAccess.assertNotQueuedWhileBeingSent({
+      modelType: Model,
+      service: this,
+      updateBy: updateBy,
+      statusColumns: ["subscriberNotificationStatusOnEpisodeCreated"],
+    });
+
     /*
      * An episode carries the same project-scoped state and severity an
      * incident does, on FKs that are equally ON DELETE NO ACTION, so an id

package/Server/Services/IncidentEpisodeStateTimelineService.ts

@@ -1,6 +1,7 @@
 import CreateBy from "../Types/Database/CreateBy";
 import DeleteBy from "../Types/Database/DeleteBy";
-import { OnCreate, OnDelete } from "../Types/Database/Hooks";
+import { OnCreate, OnDelete, OnUpdate } from "../Types/Database/Hooks";
+import UpdateBy from "../Types/Database/UpdateBy";
 import QueryHelper from "../Types/Database/QueryHelper";
 import DatabaseService from "./DatabaseService";
 import IncidentStateService from "./IncidentStateService";
@@ -15,6 +16,7 @@ import IncidentEpisode from "../../Models/DatabaseModels/IncidentEpisode";
 import IncidentEpisodeStateTimeline from "../../Models/DatabaseModels/IncidentEpisodeStateTimeline";
 import { IsBillingEnabled } from "../EnvironmentConfig";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+import SubscriberNotificationResendAccess from "../Utils/StatusPage/SubscriberNotificationResendAccess";
 import logger, { LogAttributes } from "../Utils/Logger";
 import IncidentEpisodeFeedService from "./IncidentEpisodeFeedService";
 import { IncidentEpisodeFeedEventType } from "../../Models/DatabaseModels/IncidentEpisodeFeed";
@@ -474,6 +476,30 @@ export class Service extends DatabaseService<IncidentEpisodeStateTimeline> {
     return createdItem;
   }
 
+  /*
+   * Sending a state change notification again while it is being sent would
+   * let a second run send it alongside, or be overwritten when the send
+   * settles (SubscriberNotificationResendAccess). No user role may write its
+   * status (update: []), so this only ever stops a master admin; it is here
+   * so the rule holds for every notification the same way.
+   */
+  @CaptureSpan()
+  protected override async onBeforeUpdate(
+    updateBy: UpdateBy<IncidentEpisodeStateTimeline>,
+  ): Promise<OnUpdate<IncidentEpisodeStateTimeline>> {
+    await SubscriberNotificationResendAccess.assertNotQueuedWhileBeingSent({
+      modelType: IncidentEpisodeStateTimeline,
+      service: this,
+      updateBy: updateBy,
+      statusColumns: ["subscriberNotificationStatus"],
+    });
+
+    return {
+      updateBy: updateBy,
+      carryForward: null,
+    };
+  }
+
   @CaptureSpan()
   protected override async onBeforeDelete(
     deleteBy: DeleteBy<IncidentEpisodeStateTimeline>,

package/Server/Services/IncidentPublicNoteService.ts

@@ -19,6 +19,7 @@ import Query from "../Types/Database/Query";
 import File from "../../Models/DatabaseModels/File";
 import FileAttachmentMarkdownUtil from "../Utils/FileAttachmentMarkdownUtil";
 import { syncIsPublicForMarkdownImages } from "../Utils/InlineImageAccessTokenSync";
+import SubscriberNotificationResendAccess from "../Utils/StatusPage/SubscriberNotificationResendAccess";
 
 export class Service extends DatabaseService<Model> {
   public constructor() {
@@ -178,11 +179,24 @@ export class Service extends DatabaseService<Model> {
    * An edit tells subscribers nothing unless the editor asked for it on this
    * edit (see SubscriberUpdateNotification). When they did, queue the update
    * notification; the IncidentPublicNote worker job sends it.
+   *
+   * Sending the note's 'posted' notification again - its status written back
+   * to Pending, as the dashboard's Retry does - needs the permission to post
+   * a note that notifies subscribers, and a note whose notification can go
+   * out again (see SubscriberNotificationResendAccess). So does telling
+   * subscribers about an edit, which is also refused while that update
+   * notification is being sent.
    */
   @CaptureSpan()
   protected override async onBeforeUpdate(
     updateBy: UpdateBy<Model>,
   ): Promise<OnUpdate<Model>> {
+    await SubscriberNotificationResendAccess.assertPublicNoteResendAllowed({
+      modelType: Model,
+      service: this,
+      updateBy: updateBy,
+    });
+
     if (SubscriberUpdateNotification.isRequested(updateBy.miscDataProps)) {
       updateBy.data.subscriberNotificationStatusOnNoteUpdated =
         StatusPageSubscriberNotificationStatus.Pending;
@@ -190,6 +204,20 @@ export class Service extends DatabaseService<Model> {
         SubscriberUpdateNotification.queuedMessage;
     }
 
+    /*
+     * Telling subscribers about the edit - asked for above, or written as
+     * Pending directly (the dashboard's Retry of a failed update) - needs
+     * the permission to post a note that notifies subscribers too, and is
+     * refused while the update notification is being sent.
+     */
+    await SubscriberNotificationResendAccess.assertPublicNoteUpdateNotificationAllowed(
+      {
+        modelType: Model,
+        service: this,
+        updateBy: updateBy,
+      },
+    );
+
     return {
       updateBy: updateBy,
       carryForward: null,
@@ -300,7 +328,8 @@ ${(createdItem.note || "") + attachmentsMarkdown}
         await IncidentFeedService.createIncidentFeedItem({
           incidentId: updatedItem.incidentId!,
           projectId: updatedItem.projectId!,
-          incidentFeedEventType: IncidentFeedEventType.PrivateNote,
+          // An edit to a public note is a public note event, not a private one.
+          incidentFeedEventType: IncidentFeedEventType.PublicNote,
           displayColor: Blue500,
           userId: userId || undefined,