@oneuptime/common 14.0.7 → 14.0.9

package/build/dist/Server/API/StatusPageAPI.js

@@ -105,6 +105,9 @@ import StatusPageSubscriberNotificationEventType from "../../Types/StatusPage/St
 import StatusPageSubscriberNotificationMethod from "../../Types/StatusPage/StatusPageSubscriberNotificationMethod";
 import StatusPageSubscriberNotificationTemplateService, { Service as StatusPageSubscriberNotificationTemplateServiceClass, } from "../Services/StatusPageSubscriberNotificationTemplateService";
 import { canServeStatusPageCustomizations } from "../Utils/StatusPageCustomizationAccess";
+import IncidentStatusPageScope, { INCIDENT_SCOPE_SELECT, } from "../Utils/StatusPage/IncidentStatusPageScope";
+import { StatusPageSubscriberUnsubscribeSource } from "../Utils/StatusPage/StatusPageSubscriberUnsubscribeNotice";
+import StatusPageSubscriberUnsubscribe from "../../Types/StatusPage/StatusPageSubscriberUnsubscribe";
 /*
  * A manage-subscription request is unauthenticated, and one Slack or Microsoft
  * Teams workspace name can match several subscriptions. Cap how many of them a
@@ -176,7 +179,7 @@ class StatusPageAPI extends BaseAPI {
         }
     }
     constructor() {
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9;
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q, _r, _s, _t, _u, _v, _w, _x, _y, _z, _0, _1, _2, _3, _4, _5, _6, _7, _8, _9, _10;
         super(StatusPage, StatusPageService);
         // get title, description of the page.  This is used for SEO.
         this.router.get(`${(_a = new this.entityType().getCrudApiPath()) === null || _a === void 0 ? void 0 : _a.toString()}/seo/:statusPageIdOrDomain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res) => {
@@ -522,9 +525,65 @@ class StatusPageAPI extends BaseAPI {
             });
             return Response.sendEmptySuccessResponse(req, res);
         });
+        /*
+         * The unsubscribe link in every subscriber notification opens the status
+         * page's unsubscribe page ({statusPageUrl}/unsubscribe/{id}-{token}, see
+         * Common/Types/StatusPage/StatusPageSubscriberUnsubscribe), which reads
+         * what the link belongs to with GET and cancels it with POST.
+         *
+         * - GET changes nothing. Mail scanners and link previewers fetch every
+         *   link in a message; they must not unsubscribe anybody.
+         * - POST unsubscribes, and is idempotent. It answers whatever its body is
+         *   - the page sends none, and an RFC 8058 one-click request sends
+         *   "List-Unsubscribe=One-Click" - because holding the token is the whole
+         *   authorisation.
+         *
+         * Deliberately no read-access check: a private status page's subscribers
+         * are exactly the people who may not be able to sign in to it, and the
+         * token proves the request came from the subscription's own inbox (or
+         * phone, or channel). Nothing but the subscription's own contact is ever
+         * returned - no page content - so a private page stays private.
+         *
+         * Every bad link answers the same Invalid, so the endpoint cannot be used
+         * to learn which subscriptions exist; see
+         * StatusPageSubscriberService.getUnsubscribeLinkDetails.
+         */
+        const unsubscribeApiPath = `${(_m = new this.entityType()
+            .getCrudApiPath()) === null || _m === void 0 ? void 0 : _m.toString()}/unsubscribe/:statusPageId/:subscriberId/:token`;
+        this.router.get(unsubscribeApiPath, async (req, res, next) => {
+            try {
+                const details = await StatusPageSubscriberService.getUnsubscribeLinkDetails({
+                    statusPageId: req.params["statusPageId"],
+                    subscriberId: req.params["subscriberId"],
+                    token: req.params["token"],
+                });
+                // A token-bearing answer: never let a shared cache keep it.
+                Response.setNoCacheHeaders(res);
+                return Response.sendJsonObjectResponse(req, res, details);
+            }
+            catch (err) {
+                next(err);
+            }
+        });
+        this.router.post(unsubscribeApiPath, async (req, res, next) => {
+            try {
+                const state = await StatusPageSubscriberService.unsubscribeWithLink({
+                    statusPageId: req.params["statusPageId"],
+                    subscriberId: req.params["subscriberId"],
+                    token: req.params["token"],
+                });
+                Response.setNoCacheHeaders(res);
+                return Response.sendJsonObjectResponse(req, res, {
+                    state: state,
+                });
+            }
+            catch (err) {
+                next(err);
+            }
+        });
         // CNAME verification api
-        this.router.get(`${(_m = new this.entityType()
-            .getCrudApiPath()) === null || _m === void 0 ? void 0 : _m.toString()}/cname-verification/:token`, async (req, res) => {
+        this.router.get(`${(_o = new this.entityType()
+            .getCrudApiPath()) === null || _o === void 0 ? void 0 : _o.toString()}/cname-verification/:token`, async (req, res) => {
             const host = req.get("host");
             if (!host) {
                 throw new BadDataException("Host not found");
@@ -549,8 +608,8 @@ class StatusPageAPI extends BaseAPI {
             return Response.sendEmptySuccessResponse(req, res);
         });
         // ACME Challenge Validation.
-        this.router.get(`${(_o = new this.entityType()
-            .getCrudApiPath()) === null || _o === void 0 ? void 0 : _o.toString()}/.well-known/acme-challenge/:token`, async (req, res) => {
+        this.router.get(`${(_p = new this.entityType()
+            .getCrudApiPath()) === null || _p === void 0 ? void 0 : _p.toString()}/.well-known/acme-challenge/:token`, async (req, res) => {
             logger.debug(`ACME challenge validation request received for token: ${req.params["token"]} from host: ${req.headers["host"]}`, getLogAttributesFromRequest(req));
             const challenge = await AcmeChallengeService.findOneBy({
                 query: {
@@ -574,7 +633,7 @@ class StatusPageAPI extends BaseAPI {
          * is gated like editing the status page: an authenticated member of the
          * project that owns it who could update this particular page.
          */
-        this.router.post(`${(_p = new this.entityType().getCrudApiPath()) === null || _p === void 0 ? void 0 : _p.toString()}/test-email-report`, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
+        this.router.post(`${(_q = new this.entityType().getCrudApiPath()) === null || _q === void 0 ? void 0 : _q.toString()}/test-email-report`, UserMiddleware.getUserMiddleware, UserMiddleware.requireUserAuthentication, async (req, res, next) => {
             try {
                 /*
                  * This route acts on one page in one project, and the permission
@@ -627,7 +686,7 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_q = new this.entityType().getCrudApiPath()) === null || _q === void 0 ? void 0 : _q.toString()}/domain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_r = new this.entityType().getCrudApiPath()) === null || _r === void 0 ? void 0 : _r.toString()}/domain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 if (!req.body["domain"]) {
                     throw new BadDataException("domain is required in request body");
@@ -659,8 +718,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_r = new this.entityType()
-            .getCrudApiPath()) === null || _r === void 0 ? void 0 : _r.toString()}/master-page/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_s = new this.entityType()
+            .getCrudApiPath()) === null || _s === void 0 ? void 0 : _s.toString()}/master-page/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const statusPageIdParam = req.params["statusPageId"];
                 ObjectID.validateUUID(statusPageIdParam);
@@ -831,8 +890,8 @@ class StatusPageAPI extends BaseAPI {
          * a refused attempt costs neither a session lookup nor a hash. See
          * PublicDashboardRateLimit for the budget and why it fails closed.
          */
-        this.router.post(`${(_s = new this.entityType()
-            .getCrudApiPath()) === null || _s === void 0 ? void 0 : _s.toString()}/master-password/:statusPageId`, PublicDashboardRateLimit.getMiddleware(PublicDashboardRateLimitBucket.StatusPageMasterPassword), UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_t = new this.entityType()
+            .getCrudApiPath()) === null || _t === void 0 ? void 0 : _t.toString()}/master-password/:statusPageId`, PublicDashboardRateLimit.getMiddleware(PublicDashboardRateLimitBucket.StatusPageMasterPassword), UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 if (!req.params["statusPageId"]) {
                     throw new BadDataException("Status Page ID not found");
@@ -883,7 +942,7 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_t = new this.entityType().getCrudApiPath()) === null || _t === void 0 ? void 0 : _t.toString()}/sso/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_u = new this.entityType().getCrudApiPath()) === null || _u === void 0 ? void 0 : _u.toString()}/sso/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = new ObjectID(req.params["statusPageId"]);
                 /*
@@ -915,7 +974,7 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_u = new this.entityType().getCrudApiPath()) === null || _u === void 0 ? void 0 : _u.toString()}/oidc/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_v = new this.entityType().getCrudApiPath()) === null || _v === void 0 ? void 0 : _v.toString()}/oidc/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = new ObjectID(req.params["statusPageId"]);
                 /*
@@ -947,8 +1006,8 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         // Get all status page resources for subscriber to subscribe to.
-        this.router.post(`${(_v = new this.entityType()
-            .getCrudApiPath()) === null || _v === void 0 ? void 0 : _v.toString()}/resources/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_w = new this.entityType()
+            .getCrudApiPath()) === null || _w === void 0 ? void 0 : _w.toString()}/resources/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const statusPageId = new ObjectID(req.params["statusPageId"]);
                 await this.checkHasReadAccess({
@@ -981,8 +1040,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_w = new this.entityType()
-            .getCrudApiPath()) === null || _w === void 0 ? void 0 : _w.toString()}/uptime/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_x = new this.entityType()
+            .getCrudApiPath()) === null || _x === void 0 ? void 0 : _x.toString()}/uptime/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             var _a, _b;
             try {
                 // This reosurce ID can be of a status page resource OR a status page group.
@@ -1299,8 +1358,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         };
-        const overviewApiPath = `${(_x = new this.entityType()
-            .getCrudApiPath()) === null || _x === void 0 ? void 0 : _x.toString()}/overview/:statusPageIdOrDomain`;
+        const overviewApiPath = `${(_y = new this.entityType()
+            .getCrudApiPath()) === null || _y === void 0 ? void 0 : _y.toString()}/overview/:statusPageIdOrDomain`;
         this.router.post(overviewApiPath, UserMiddleware.getPublicRouteUserMiddleware, overviewHandler);
         /*
          * GET variant of the overview endpoint. Same middleware and same handler
@@ -1308,8 +1367,8 @@ class StatusPageAPI extends BaseAPI {
          * unauthenticated callers exactly as they are on POST.
          */
         this.router.get(overviewApiPath, UserMiddleware.getPublicRouteUserMiddleware, overviewHandler);
-        this.router.put(`${(_y = new this.entityType()
-            .getCrudApiPath()) === null || _y === void 0 ? void 0 : _y.toString()}/update-subscription/:statusPageId/:subscriberId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.put(`${(_z = new this.entityType()
+            .getCrudApiPath()) === null || _z === void 0 ? void 0 : _z.toString()}/update-subscription/:statusPageId/:subscriberId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.subscribeToStatusPage(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1318,8 +1377,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_z = new this.entityType()
-            .getCrudApiPath()) === null || _z === void 0 ? void 0 : _z.toString()}/get-subscription/:statusPageId/:subscriberId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_0 = new this.entityType()
+            .getCrudApiPath()) === null || _0 === void 0 ? void 0 : _0.toString()}/get-subscription/:statusPageId/:subscriberId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const subscriber = await this.getSubscriber(req);
                 return Response.sendEntityResponse(req, res, subscriber, StatusPageSubscriber);
@@ -1328,8 +1387,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_0 = new this.entityType()
-            .getCrudApiPath()) === null || _0 === void 0 ? void 0 : _0.toString()}/subscribe/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_1 = new this.entityType()
+            .getCrudApiPath()) === null || _1 === void 0 ? void 0 : _1.toString()}/subscribe/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.subscribeToStatusPage(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1338,8 +1397,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_1 = new this.entityType()
-            .getCrudApiPath()) === null || _1 === void 0 ? void 0 : _1.toString()}/manage-subscription/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_2 = new this.entityType()
+            .getCrudApiPath()) === null || _2 === void 0 ? void 0 : _2.toString()}/manage-subscription/:statusPageId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 await this.manageExistingSubscription(req);
                 return Response.sendEmptySuccessResponse(req, res);
@@ -1364,8 +1423,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         };
-        const incidentsListApiPath = `${(_2 = new this.entityType()
-            .getCrudApiPath()) === null || _2 === void 0 ? void 0 : _2.toString()}/incidents/:statusPageIdOrDomain`;
+        const incidentsListApiPath = `${(_3 = new this.entityType()
+            .getCrudApiPath()) === null || _3 === void 0 ? void 0 : _3.toString()}/incidents/:statusPageIdOrDomain`;
         this.router.post(incidentsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, incidentsListHandler);
         this.router.get(incidentsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, incidentsListHandler);
         /*
@@ -1385,8 +1444,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         };
-        const scheduledMaintenanceEventsListApiPath = `${(_3 = new this.entityType()
-            .getCrudApiPath()) === null || _3 === void 0 ? void 0 : _3.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain`;
+        const scheduledMaintenanceEventsListApiPath = `${(_4 = new this.entityType()
+            .getCrudApiPath()) === null || _4 === void 0 ? void 0 : _4.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain`;
         this.router.post(scheduledMaintenanceEventsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, scheduledMaintenanceEventsListHandler);
         this.router.get(scheduledMaintenanceEventsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, scheduledMaintenanceEventsListHandler);
         /*
@@ -1405,12 +1464,12 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         };
-        const announcementsListApiPath = `${(_4 = new this.entityType()
-            .getCrudApiPath()) === null || _4 === void 0 ? void 0 : _4.toString()}/announcements/:statusPageIdOrDomain`;
+        const announcementsListApiPath = `${(_5 = new this.entityType()
+            .getCrudApiPath()) === null || _5 === void 0 ? void 0 : _5.toString()}/announcements/:statusPageIdOrDomain`;
         this.router.post(announcementsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, announcementsListHandler);
         this.router.get(announcementsListApiPath, UserMiddleware.getPublicRouteUserMiddleware, announcementsListHandler);
-        this.router.post(`${(_5 = new this.entityType()
-            .getCrudApiPath()) === null || _5 === void 0 ? void 0 : _5.toString()}/incidents/:statusPageIdOrDomain/:incidentId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_6 = new this.entityType()
+            .getCrudApiPath()) === null || _6 === void 0 ? void 0 : _6.toString()}/incidents/:statusPageIdOrDomain/:incidentId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const incidentId = new ObjectID(req.params["incidentId"]);
@@ -1421,8 +1480,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_6 = new this.entityType()
-            .getCrudApiPath()) === null || _6 === void 0 ? void 0 : _6.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain/:scheduledMaintenanceId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_7 = new this.entityType()
+            .getCrudApiPath()) === null || _7 === void 0 ? void 0 : _7.toString()}/scheduled-maintenance-events/:statusPageIdOrDomain/:scheduledMaintenanceId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const scheduledMaintenanceId = new ObjectID(req.params["scheduledMaintenanceId"]);
@@ -1433,8 +1492,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_7 = new this.entityType()
-            .getCrudApiPath()) === null || _7 === void 0 ? void 0 : _7.toString()}/announcements/:statusPageIdOrDomain/:announcementId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_8 = new this.entityType()
+            .getCrudApiPath()) === null || _8 === void 0 ? void 0 : _8.toString()}/announcements/:statusPageIdOrDomain/:announcementId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const announcementId = new ObjectID(req.params["announcementId"]);
@@ -1446,8 +1505,8 @@ class StatusPageAPI extends BaseAPI {
             }
         });
         // Episodes endpoints
-        this.router.post(`${(_8 = new this.entityType()
-            .getCrudApiPath()) === null || _8 === void 0 ? void 0 : _8.toString()}/episodes/:statusPageIdOrDomain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_9 = new this.entityType()
+            .getCrudApiPath()) === null || _9 === void 0 ? void 0 : _9.toString()}/episodes/:statusPageIdOrDomain`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const response = await this.getEpisodes(objectId, null, req);
@@ -1457,8 +1516,8 @@ class StatusPageAPI extends BaseAPI {
                 next(err);
             }
         });
-        this.router.post(`${(_9 = new this.entityType()
-            .getCrudApiPath()) === null || _9 === void 0 ? void 0 : _9.toString()}/episodes/:statusPageIdOrDomain/:episodeId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
+        this.router.post(`${(_10 = new this.entityType()
+            .getCrudApiPath()) === null || _10 === void 0 ? void 0 : _10.toString()}/episodes/:statusPageIdOrDomain/:episodeId`, UserMiddleware.getPublicRouteUserMiddleware, async (req, res, next) => {
             try {
                 const objectId = await resolveStatusPageIdOrThrow(req.params["statusPageIdOrDomain"]);
                 const episodeId = new ObjectID(req.params["episodeId"]);
@@ -1932,23 +1991,43 @@ class StatusPageAPI extends BaseAPI {
          */
         let lookupQuery;
         let lookupSelect;
+        /*
+         * The unsubscribe token is read too: the message carries the
+         * subscription's unsubscribe link as well as its manage link.
+         */
         if (email) {
             lookupQuery = { subscriberEmail: email };
-            lookupSelect = { _id: true, subscriberEmail: true };
+            lookupSelect = {
+                _id: true,
+                subscriberEmail: true,
+                unsubscribeToken: true,
+            };
         }
         else if (phone) {
             lookupQuery = { subscriberPhone: phone };
-            lookupSelect = { _id: true, subscriberPhone: true };
+            lookupSelect = {
+                _id: true,
+                subscriberPhone: true,
+                unsubscribeToken: true,
+            };
         }
         else if (slackWorkspaceName) {
             lookupQuery = { slackWorkspaceName: slackWorkspaceName };
-            lookupSelect = { _id: true, slackIncomingWebhookUrl: true };
+            lookupSelect = {
+                _id: true,
+                slackIncomingWebhookUrl: true,
+                unsubscribeToken: true,
+            };
         }
         else {
             lookupQuery = {
                 microsoftTeamsWorkspaceName: microsoftTeamsWorkspaceName,
             };
-            lookupSelect = { _id: true, microsoftTeamsIncomingWebhookUrl: true };
+            lookupSelect = {
+                _id: true,
+                microsoftTeamsIncomingWebhookUrl: true,
+                unsubscribeToken: true,
+            };
         }
         logger.debug(`Looking up subscribers by email: ${email}, phone: ${phone}, Slack workspace: ${slackWorkspaceName}, or Microsoft Teams workspace: ${microsoftTeamsWorkspaceName}`, getLogAttributesFromRequest(req));
         /*
@@ -1993,6 +2072,12 @@ class StatusPageAPI extends BaseAPI {
     async sendManageSubscriptionLinks(data) {
         var _a, _b;
         const { statusPageId, subscribers, req } = data;
+        /*
+         * Their unsubscribe links need their tokens, as every other sender's do:
+         * a subscriber the backfill has not reached yet is given one first,
+         * rather than sent a link to the "out of date" page.
+         */
+        await StatusPageSubscriberService.ensureUnsubscribeTokens(subscribers);
         const statusPageURL = await StatusPageService.getStatusPageURL(statusPageId);
         const statusPages = await StatusPageSubscriberService.getStatusPagesToSendNotification([
             statusPageId,
@@ -2031,16 +2116,19 @@ class StatusPageAPI extends BaseAPI {
                 const subscriberPhone = statusPageSubscriber.subscriberPhone;
                 const slackIncomingWebhookUrl = statusPageSubscriber.slackIncomingWebhookUrl;
                 const microsoftTeamsIncomingWebhookUrl = statusPageSubscriber.microsoftTeamsIncomingWebhookUrl;
-                const manageUrlink = StatusPageSubscriberService.getUnsubscribeLink(URL.fromString(statusPageURL), statusPageSubscriber.id).toString();
+                const manageUrlink = StatusPageSubscriberService.getManageSubscriptionLink(URL.fromString(statusPageURL), statusPageSubscriber.id).toString();
                 /*
-                 * The manage link is the subscriber's update-subscription page, which
-                 * is the same URL every other sender passes as unsubscribeUrl, so a
-                 * template may use either name for it.
+                 * The visitor asked to manage their subscription, so the message
+                 * links to its Update Subscription page. It also hands templates the
+                 * unsubscribe link every other sender passes as unsubscribeUrl: that
+                 * one works without signing in, which the manage page on a private
+                 * status page does not.
                  */
+                const unsubscribeUrl = StatusPageSubscriberService.getUnsubscribeLink(URL.fromString(statusPageURL), statusPageSubscriber).toString();
                 const manageTemplateVariables = {
                     statusPageName: statusPageNameStr,
                     statusPageUrl: statusPageURL,
-                    unsubscribeUrl: manageUrlink,
+                    unsubscribeUrl: unsubscribeUrl,
                     manageSubscriptionUrl: manageUrlink,
                 };
                 const defaultChatMessage = `You have selected to manage your subscription for the status page: ${statusPageNameStr}. You can manage your subscription here: ${manageUrlink}`;
@@ -2049,7 +2137,8 @@ class StatusPageAPI extends BaseAPI {
                     const httpProtocol = await DatabaseConfig.getHttpProtocol();
                     const statusPageIdString = ((_a = statusPage.id) === null || _a === void 0 ? void 0 : _a.toString()) || ((_b = statusPage._id) === null || _b === void 0 ? void 0 : _b.toString()) || null;
                     if ((manageEmailTemplate === null || manageEmailTemplate === void 0 ? void 0 : manageEmailTemplate.templateBody) && statusPage.smtpConfig) {
-                        const compiledBody = StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate(manageEmailTemplate.templateBody, manageTemplateVariables);
+                        // The body is HTML, so the (plain-text) values are escaped into it.
+                        const compiledBody = StatusPageSubscriberNotificationTemplateServiceClass.compileEmailBodyTemplate(manageEmailTemplate.templateBody, manageTemplateVariables);
                         const compiledSubject = manageEmailTemplate.emailSubject
                             ? StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate(manageEmailTemplate.emailSubject, manageTemplateVariables)
                             : "Manage your Subscription for " + statusPageNameStr;
@@ -2098,8 +2187,19 @@ class StatusPageAPI extends BaseAPI {
                 if (subscriberPhone) {
                     let smsMessage;
                     if ((manageSmsTemplate === null || manageSmsTemplate === void 0 ? void 0 : manageSmsTemplate.templateBody) && statusPage.callSmsConfig) {
+                        /*
+                         * On a public status page an SMS carries the shorter manage link
+                         * where other messages carry the unsubscribe link: an SMS is
+                         * billed by the segment (see
+                         * StatusPageSubscriberUnsubscribe.buildSmsLink).
+                         */
                         smsMessage =
-                            StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate(manageSmsTemplate.templateBody, manageTemplateVariables);
+                            StatusPageSubscriberNotificationTemplateServiceClass.compileTemplate(manageSmsTemplate.templateBody, Object.assign(Object.assign({}, manageTemplateVariables), { unsubscribeUrl: StatusPageSubscriberUnsubscribe.buildSmsLink({
+                                    isPublicStatusPage: statusPage.isPublicStatusPage,
+                                    statusPageUrl: statusPageURL,
+                                    subscriberId: statusPageSubscriber.id,
+                                    unsubscribeUrl: unsubscribeUrl,
+                                }) }));
                     }
                     else {
                         smsMessage = defaultChatMessage;
@@ -2335,31 +2435,26 @@ class StatusPageAPI extends BaseAPI {
             statusPageSubscriber.statusPageEventTypes = req.body.data["statusPageEventTypes"];
         }
         if (isUpdate) {
-            // check isUnsubscribed is set to false.
             logger.debug(`Updating subscriber with ID: ${statusPageSubscriber.id}`, getLogAttributesFromRequest(req));
-            statusPageSubscriber.isUnsubscribed = Boolean(req.body.data["isUnsubscribed"]);
+            const wantsToUnsubscribe = Boolean(req.body.data["isUnsubscribed"]);
             await StatusPageSubscriberService.updateOneById({
                 id: statusPageSubscriber.id,
-                data: {
-                    statusPageResources: statusPageSubscriber.statusPageResources,
-                    isSubscribedToAllResources: statusPageSubscriber.isSubscribedToAllResources,
-                    statusPageEventTypes: statusPageSubscriber.statusPageEventTypes,
-                    isSubscribedToAllEventTypes: statusPageSubscriber.isSubscribedToAllEventTypes,
-                    isUnsubscribed: statusPageSubscriber.isUnsubscribed,
-                },
+                data: Object.assign({ statusPageResources: statusPageSubscriber.statusPageResources, isSubscribedToAllResources: statusPageSubscriber.isSubscribedToAllResources, statusPageEventTypes: statusPageSubscriber.statusPageEventTypes, isSubscribedToAllEventTypes: statusPageSubscriber.isSubscribedToAllEventTypes }, (wantsToUnsubscribe ? {} : { isUnsubscribed: false })),
                 props: {
                     isRoot: true,
                 },
             });
+            if (wantsToUnsubscribe) {
+                await StatusPageSubscriberService.unsubscribe({
+                    subscriberId: statusPageSubscriber.id,
+                    source: StatusPageSubscriberUnsubscribeSource.ManageSubscriptionPage,
+                });
+            }
         }
         else {
             logger.debug(`Creating new subscriber: ${JSON.stringify(statusPageSubscriber)}`, getLogAttributesFromRequest(req));
-            await StatusPageSubscriberService.create({
-                data: statusPageSubscriber,
-                props: {
-                    isRoot: true,
-                },
-            });
+            // A sign-up, not a subscriber the team added (Is Added By Team stays off).
+            await StatusPageSubscriberService.createFromStatusPageSignUp(statusPageSubscriber);
         }
         logger.debug(`Subscription process completed for status page with ID: ${objectId}`, getLogAttributesFromRequest(req));
     }
@@ -2410,6 +2505,12 @@ class StatusPageAPI extends BaseAPI {
         }
         return statusPageSubscriber;
     }
+    /*
+     * Every incident a public status page is sent goes through here - the
+     * overview's active and timeline incidents, and the incident list and
+     * detail - so it is where the page's JSON, and the overview cache, are made
+     * safe to serve.
+     */
     serializeIncidentsForStatusPage(incidents) {
         return incidents.map((incident) => {
             const incidentJson = BaseModel.toJSON(incident, Incident);
@@ -2419,9 +2520,32 @@ class StatusPageAPI extends BaseAPI {
                 delete incidentJson["postmortemPostedAt"];
                 delete incidentJson["postmortemAttachments"];
             }
+            /*
+             * Which status pages an incident is limited to names the other
+             * audiences it is shown to. The display queries never select these
+             * columns (IncidentStatusPageScope), so this is a second line of
+             * defence against a select that one day does.
+             */
+            IncidentStatusPageScope.removeScopeColumns(incidentJson);
             return incidentJson;
         });
     }
+    /*
+     * An episode's member incidents, read by id to work out which of the
+     * page's monitors the episode affects, keeping only those this page shows
+     * as far as scope goes. The read selects the scope columns for that
+     * (INCIDENT_SCOPE_SELECT); they are removed again before the incidents are
+     * used, so they cannot reach the page's JSON.
+     */
+    keepMemberIncidentsInScope(data) {
+        return data.incidents
+            .filter((incident) => {
+            return IncidentStatusPageScope.isIncidentInScope(incident, data.statusPage);
+        })
+            .map((incident) => {
+            return IncidentStatusPageScope.removeScopeColumns(incident);
+        });
+    }
     async getIncidents(statusPageId, incidentId, req) {
         await this.checkHasReadAccess({
             statusPageId: statusPageId,
@@ -2437,6 +2561,8 @@ class StatusPageAPI extends BaseAPI {
                 showIncidentHistoryInDays: true,
                 showIncidentLabelsOnStatusPage: true,
                 showIncidentsOnStatusPage: true,
+                // Read by IncidentStatusPageScope to decide which incidents it shows.
+                onlyShowScopedIncidents: true,
             },
             props: {
                 isRoot: true,
@@ -2510,7 +2636,15 @@ class StatusPageAPI extends BaseAPI {
                 } });
         }
         if (monitorsOnStatusPage.length > 0) {
-            incidents = await IncidentService.findBy({
+            /*
+             * Through IncidentStatusPageScope, like every incident read here that
+             * decides what the page shows: an incident limited to other status
+             * pages is left out, and so is an unlimited one when this page only
+             * shows incidents limited to it. The scope is applied in SQL, before
+             * LIMIT_PER_PROJECT cuts the list, not filtered out afterwards.
+             */
+            incidents = await IncidentStatusPageScope.findIncidentsForStatusPage({
+                statusPage: statusPage,
                 query: incidentQuery,
                 select: selectIncidents,
                 sort: {
@@ -2532,24 +2666,26 @@ class StatusPageAPI extends BaseAPI {
             });
             // If there is no particular incident id to fetch then fetch active incidents.
             if (!incidentId) {
-                activeIncidents = await IncidentService.findBy({
-                    query: {
-                        monitors: monitorsOnStatusPage,
-                        isVisibleOnStatusPage: true,
-                        currentIncidentStateId: QueryHelper.any(unresolvbedIncidentStateIds),
-                        projectId: statusPage.projectId,
-                    },
-                    select: selectIncidents,
-                    sort: {
-                        declaredAt: SortOrder.Descending,
-                        createdAt: SortOrder.Descending,
-                    },
-                    skip: 0,
-                    limit: LIMIT_PER_PROJECT,
-                    props: {
-                        isRoot: true,
-                    },
-                });
+                activeIncidents =
+                    await IncidentStatusPageScope.findIncidentsForStatusPage({
+                        statusPage: statusPage,
+                        query: {
+                            monitors: monitorsOnStatusPage,
+                            isVisibleOnStatusPage: true,
+                            currentIncidentStateId: QueryHelper.any(unresolvbedIncidentStateIds),
+                            projectId: statusPage.projectId,
+                        },
+                        select: selectIncidents,
+                        sort: {
+                            declaredAt: SortOrder.Descending,
+                            createdAt: SortOrder.Descending,
+                        },
+                        skip: 0,
+                        limit: LIMIT_PER_PROJECT,
+                        props: {
+                            isRoot: true,
+                        },
+                    });
             }
             incidents = [...activeIncidents, ...incidents];
             // get distinct by id.
@@ -2652,6 +2788,8 @@ class StatusPageAPI extends BaseAPI {
                 showEpisodeHistoryInDays: true,
                 showEpisodesOnStatusPage: true,
                 showEpisodeLabelsOnStatusPage: true,
+                // Read by IncidentStatusPageScope to decide which incidents it shows.
+                onlyShowScopedIncidents: true,
             },
             props: {
                 isRoot: true,
@@ -2688,11 +2826,22 @@ class StatusPageAPI extends BaseAPI {
         };
         let incidents = [];
         if (monitorsOnStatusPage.length > 0) {
-            incidents = await IncidentService.findBy({
+            /*
+             * An episode is listed through the incidents in it that this page
+             * shows, so an incident limited to other status pages (or an unlimited
+             * one, on a page that only shows incidents limited to it) does not
+             * bring its episode here. Newest first, so that when LIMIT_PER_PROJECT
+             * cuts the list it keeps the recent episodes.
+             */
+            incidents = await IncidentStatusPageScope.findIncidentsForStatusPage({
+                statusPage: statusPage,
                 query: incidentQuery,
                 select: {
                     _id: true,
                 },
+                sort: {
+                    createdAt: SortOrder.Descending,
+                },
                 skip: 0,
                 limit: LIMIT_PER_PROJECT,
                 props: {
@@ -2758,6 +2907,42 @@ class StatusPageAPI extends BaseAPI {
                     isRoot: true,
                 },
             });
+            /*
+             * An episode is this page's to show only through an incident in it
+             * that the page shows: one on a monitor the page lists, and in scope
+             * for the page. Without this check any visible episode of the project
+             * could be read from any of its status pages by id - including an
+             * episode whose incidents are all limited to other status pages. Like
+             * the list, it does not ask whether the incidents themselves are
+             * visible on status pages, and unlike the list, it has no history
+             * window: a link to an older episode keeps working.
+             */
+            const episodeMemberIncidentIds = episodeMembersForSpecificEpisode
+                .map((member) => {
+                return member.incidentId;
+            })
+                .filter((id) => {
+                return Boolean(id);
+            });
+            const incidentShownOnStatusPage = monitorsOnStatusPage.length > 0 && episodeMemberIncidentIds.length > 0
+                ? await IncidentStatusPageScope.findOneIncidentForStatusPage({
+                    statusPage: statusPage,
+                    query: {
+                        _id: QueryHelper.any(episodeMemberIncidentIds),
+                        monitors: monitorsOnStatusPage,
+                        projectId: statusPage.projectId,
+                    },
+                    select: {
+                        _id: true,
+                    },
+                    props: {
+                        isRoot: true,
+                    },
+                })
+                : null;
+            if (!incidentShownOnStatusPage) {
+                throw new NotFoundException("Episode not found");
+            }
             // Merge with existing episode members
             for (const member of episodeMembersForSpecificEpisode) {
                 if (!episodeMembers.some((m) => {
@@ -2863,25 +3048,30 @@ class StatusPageAPI extends BaseAPI {
                 memberIncidentIds.push(member.incidentId);
             }
         }
-        // Fetch incidents with their monitors
+        /*
+         * Fetch incidents with their monitors. Read by id, so the scope is
+         * applied here, in memory: a member incident limited to other status
+         * pages does not tell this page which of its monitors the episode
+         * affects. (An episode viewed by id brings all of its members.)
+         */
         let memberIncidents = [];
         if (memberIncidentIds.length > 0) {
-            memberIncidents = await IncidentService.findBy({
-                query: {
-                    _id: QueryHelper.any(memberIncidentIds),
-                    projectId: statusPage.projectId,
-                },
-                select: {
-                    _id: true,
-                    monitors: {
-                        _id: true,
+            memberIncidents = this.keepMemberIncidentsInScope({
+                incidents: await IncidentService.findBy({
+                    query: {
+                        _id: QueryHelper.any(memberIncidentIds),
+                        projectId: statusPage.projectId,
                     },
-                },
-                skip: 0,
-                limit: LIMIT_PER_PROJECT,
-                props: {
-                    isRoot: true,
-                },
+                    select: Object.assign({ _id: true, monitors: {
+                            _id: true,
+                        } }, INCIDENT_SCOPE_SELECT),
+                    skip: 0,
+                    limit: LIMIT_PER_PROJECT,
+                    props: {
+                        isRoot: true,
+                    },
+                }),
+                statusPage: statusPage,
             });
         }
         // Build a map of incident ID -> monitors
@@ -3038,6 +3228,11 @@ class StatusPageAPI extends BaseAPI {
                 showEpisodesOnStatusPage: true,
                 showScheduledMaintenanceEventsOnStatusPage: true,
                 showUptimeHistoryInDays: true,
+                /*
+                 * Read by IncidentStatusPageScope to decide which incidents the
+                 * overview shows. Not public: the overview removes it again.
+                 */
+                onlyShowScopedIncidents: true,
             },
             props: {
                 isRoot: true,
@@ -3386,24 +3581,27 @@ class StatusPageAPI extends BaseAPI {
                 return state.id;
             });
             if (statusPage.showIncidentsOnStatusPage) {
-                activeIncidents = await IncidentService.findBy({
-                    query: {
-                        monitors: monitorsOnStatusPage,
-                        currentIncidentStateId: QueryHelper.any(unresolvedIncidentStateIds),
-                        isVisibleOnStatusPage: true,
-                        projectId: statusPage.projectId,
-                    },
-                    select: select,
-                    sort: {
-                        declaredAt: SortOrder.Descending,
-                        createdAt: SortOrder.Descending,
-                    },
-                    skip: 0,
-                    limit: LIMIT_PER_PROJECT,
-                    props: {
-                        isRoot: true,
-                    },
-                });
+                // Only the incidents in scope for this page; see getIncidents.
+                activeIncidents =
+                    await IncidentStatusPageScope.findIncidentsForStatusPage({
+                        statusPage: statusPage,
+                        query: {
+                            monitors: monitorsOnStatusPage,
+                            currentIncidentStateId: QueryHelper.any(unresolvedIncidentStateIds),
+                            isVisibleOnStatusPage: true,
+                            projectId: statusPage.projectId,
+                        },
+                        select: select,
+                        sort: {
+                            declaredAt: SortOrder.Descending,
+                            createdAt: SortOrder.Descending,
+                        },
+                        skip: 0,
+                        limit: LIMIT_PER_PROJECT,
+                        props: {
+                            isRoot: true,
+                        },
+                    });
             }
         }
         const incidentsOnStatusPage = activeIncidents.map((incident) => {
@@ -3503,8 +3701,15 @@ class StatusPageAPI extends BaseAPI {
             hasActiveEpisodes = activeEpisodeCount.toNumber() > 0;
         }
         if (hasActiveEpisodes) {
-            // First, get incidents that have monitors on status page
-            const incidentsForEpisodes = await IncidentService.findBy({
+            /*
+             * First, get incidents that have monitors on status page, and are in
+             * scope for it: an episode is shown through the incidents in it that
+             * the page shows (see getEpisodes). Newest first, so that when
+             * LIMIT_PER_PROJECT cuts the list it keeps the incidents most likely
+             * to be in an active episode.
+             */
+            const incidentsForEpisodes = await IncidentStatusPageScope.findIncidentsForStatusPage({
+                statusPage: statusPage,
                 query: {
                     monitors: monitorsOnStatusPage,
                     isVisibleOnStatusPage: true,
@@ -3513,6 +3718,9 @@ class StatusPageAPI extends BaseAPI {
                 select: {
                     _id: true,
                 },
+                sort: {
+                    createdAt: SortOrder.Descending,
+                },
                 skip: 0,
                 limit: LIMIT_PER_PROJECT,
                 props: {
@@ -3617,26 +3825,31 @@ class StatusPageAPI extends BaseAPI {
                             memberIncidentIds.push(member.incidentId);
                         }
                     }
-                    // Fetch incidents with monitors
+                    /*
+                     * Fetch incidents with monitors. Read by id, so the scope is
+                     * applied in memory, as in getEpisodes - these members came from
+                     * incidents in scope, and this keeps it that way should that
+                     * change.
+                     */
                     let memberIncidents = [];
                     if (memberIncidentIds.length > 0) {
-                        memberIncidents = await IncidentService.findBy({
-                            query: {
-                                _id: QueryHelper.any(memberIncidentIds),
-                                isVisibleOnStatusPage: true,
-                                projectId: statusPage.projectId,
-                            },
-                            select: {
-                                _id: true,
-                                monitors: {
-                                    _id: true,
+                        memberIncidents = this.keepMemberIncidentsInScope({
+                            incidents: await IncidentService.findBy({
+                                query: {
+                                    _id: QueryHelper.any(memberIncidentIds),
+                                    isVisibleOnStatusPage: true,
+                                    projectId: statusPage.projectId,
                                 },
-                            },
-                            skip: 0,
-                            limit: LIMIT_PER_PROJECT,
-                            props: {
-                                isRoot: true,
-                            },
+                                select: Object.assign({ _id: true, monitors: {
+                                        _id: true,
+                                    } }, INCIDENT_SCOPE_SELECT),
+                                skip: 0,
+                                limit: LIMIT_PER_PROJECT,
+                                props: {
+                                    isRoot: true,
+                                },
+                            }),
+                            statusPage: statusPage,
                         });
                     }
                     // Build incident -> monitors map
@@ -3937,39 +4150,47 @@ class StatusPageAPI extends BaseAPI {
         let timelineIncidents = [];
         if (monitorsOnStatusPage.length > 0 &&
             statusPage.showIncidentsOnStatusPage) {
-            timelineIncidents = await IncidentService.findBy({
-                query: {
-                    monitors: monitorsOnStatusPage,
-                    declaredAt: QueryHelper.inBetween(startDate, endDate),
-                    isVisibleOnStatusPage: true,
-                    projectId: statusPage.projectId,
-                },
-                select: {
-                    _id: true,
-                    title: true,
-                    declaredAt: true,
-                    incidentSeverity: {
-                        name: true,
-                        color: true,
+            /*
+             * Only the incidents in scope for this page; see getIncidents. The
+             * uptime bars stay as they are - a monitor's status is shared by every
+             * page that lists it - but an incident limited to other pages is not
+             * named in their tooltips.
+             */
+            timelineIncidents =
+                await IncidentStatusPageScope.findIncidentsForStatusPage({
+                    statusPage: statusPage,
+                    query: {
+                        monitors: monitorsOnStatusPage,
+                        declaredAt: QueryHelper.inBetween(startDate, endDate),
+                        isVisibleOnStatusPage: true,
+                        projectId: statusPage.projectId,
                     },
-                    currentIncidentState: {
+                    select: {
                         _id: true,
-                        name: true,
-                        color: true,
+                        title: true,
+                        declaredAt: true,
+                        incidentSeverity: {
+                            name: true,
+                            color: true,
+                        },
+                        currentIncidentState: {
+                            _id: true,
+                            name: true,
+                            color: true,
+                        },
+                        monitors: {
+                            _id: true,
+                        },
                     },
-                    monitors: {
-                        _id: true,
+                    sort: {
+                        declaredAt: SortOrder.Descending,
                     },
-                },
-                sort: {
-                    declaredAt: SortOrder.Descending,
-                },
-                skip: 0,
-                limit: LIMIT_PER_PROJECT,
-                props: {
-                    isRoot: true,
-                },
-            });
+                    skip: 0,
+                    limit: LIMIT_PER_PROJECT,
+                    props: {
+                        isRoot: true,
+                    },
+                });
         }
         const overallStatus = StatusPageService.getOverallMonitorStatus({
             statusPageResources,
@@ -3999,12 +4220,17 @@ class StatusPageAPI extends BaseAPI {
             statusPage: (() => {
                 const statusPageJson = BaseModel.toJSONObject(statusPage, StatusPage);
                 delete statusPageJson["projectId"];
+                /*
+                 * Read only to decide which incidents the overview shows; the page
+                 * itself has no use for it.
+                 */
+                delete statusPageJson["onlyShowScopedIncidents"];
                 return statusPageJson;
             })(),
             scheduledMaintenanceStateTimelines: BaseModel.toJSONArray(scheduledMaintenanceStateTimelines, ScheduledMaintenanceStateTimeline),
             monitorGroupCurrentStatuses: JSONFunctions.serialize(monitorGroupCurrentStatuses),
             monitorsInGroup: JSONFunctions.serialize(monitorsInGroup),
-            timelineIncidents: BaseModel.toJSONArray(timelineIncidents, Incident),
+            timelineIncidents: this.serializeIncidentsForStatusPage(timelineIncidents),
         };
         return response;
     }
@@ -4214,6 +4440,8 @@ class StatusPageAPI extends BaseAPI {
                 _id: true,
                 projectId: true,
                 showIncidentsOnStatusPage: true,
+                // Read by IncidentStatusPageScope to decide which incidents it shows.
+                onlyShowScopedIncidents: true,
             },
             props: {
                 isRoot: true,
@@ -4230,7 +4458,9 @@ class StatusPageAPI extends BaseAPI {
         if (!monitorsOnStatusPage || monitorsOnStatusPage.length === 0) {
             throw new NotFoundException("Attachment not found");
         }
-        const incident = await IncidentService.findOneBy({
+        // Only an incident this page shows: on its monitors and in its scope.
+        const incident = await IncidentStatusPageScope.findOneIncidentForStatusPage({
+            statusPage: statusPage,
             query: {
                 _id: incidentId.toString(),
                 projectId: statusPage.projectId,
@@ -4304,6 +4534,8 @@ class StatusPageAPI extends BaseAPI {
                 _id: true,
                 projectId: true,
                 showIncidentsOnStatusPage: true,
+                // Read by IncidentStatusPageScope to decide which incidents it shows.
+                onlyShowScopedIncidents: true,
             },
             props: {
                 isRoot: true,
@@ -4321,7 +4553,9 @@ class StatusPageAPI extends BaseAPI {
         if (!monitorsOnStatusPage || monitorsOnStatusPage.length === 0) {
             throw new NotFoundException("Attachment not found");
         }
-        const incident = await IncidentService.findOneBy({
+        // Only an incident this page shows: on its monitors and in its scope.
+        const incident = await IncidentStatusPageScope.findOneIncidentForStatusPage({
+            statusPage: statusPage,
             query: {
                 _id: incidentId.toString(),
                 projectId: statusPage.projectId,
@@ -4407,6 +4641,8 @@ class StatusPageAPI extends BaseAPI {
                 _id: true,
                 projectId: true,
                 showEpisodesOnStatusPage: true,
+                // Read by IncidentStatusPageScope to decide which incidents it shows.
+                onlyShowScopedIncidents: true,
             },
             props: {
                 isRoot: true,
@@ -4449,8 +4685,13 @@ class StatusPageAPI extends BaseAPI {
             .filter((id) => {
             return Boolean(id);
         });
-        // Check if any of the incidents are linked to monitors on the status page
-        const incident = await IncidentService.findOneBy({
+        /*
+         * Check if any of the incidents are linked to monitors on the status
+         * page, and in scope for it: an episode whose incidents are all limited
+         * to other status pages is not this page's to serve.
+         */
+        const incident = await IncidentStatusPageScope.findOneIncidentForStatusPage({
+            statusPage: statusPage,
             query: {
                 _id: QueryHelper.any(incidentIds),
                 projectId: statusPage.projectId,