@oneuptime/common 14.0.7 → 14.0.9

package/build/dist/Server/Services/IncidentService.js

@@ -14,6 +14,9 @@ import QueryHelper from "../Types/Database/QueryHelper";
 import DatabaseService from "./DatabaseService";
 import IncidentCustomField from "../../Models/DatabaseModels/IncidentCustomField";
 import CustomFieldMappingService from "./CustomFieldMappingService";
+import IncidentCustomFieldService from "./IncidentCustomFieldService";
+import { mergeTemplateCustomFields } from "../../Types/CustomField/CustomFieldTemplateMerge";
+import { formatCustomFieldValueValidationErrors, validateCustomFieldValues, } from "../../Types/CustomField/CustomFieldValueValidator";
 import AIRunService from "./AIRunService";
 import AIRunType from "../../Types/AI/AIRunType";
 import AIRunStatus from "../../Types/AI/AIRunStatus";
@@ -39,6 +42,14 @@ import { getAffectedResourceRelations } from "../Utils/Database/AffectedResource
 import SloRecordReferenceValidator from "../Utils/Slo/SloRecordReferenceValidator";
 import UserNotificationEventType from "../../Types/UserNotification/UserNotificationEventType";
 import StatusPageSubscriberNotificationStatus from "../../Types/StatusPage/StatusPageSubscriberNotificationStatus";
+import IncidentCreatedRenotify from "../../Types/StatusPage/IncidentCreatedRenotify";
+import IncidentCreatedResend from "../../Types/StatusPage/IncidentCreatedResend";
+import IncidentScopeAddedPagesNotification, { IncidentScopeAddedPagesNotificationAction, } from "../../Types/StatusPage/IncidentScopeAddedPagesNotification";
+import NotAuthorizedException from "../../Types/Exception/NotAuthorizedException";
+import StatusPage from "../../Models/DatabaseModels/StatusPage";
+import StatusPageService from "./StatusPageService";
+import StatusPageReadAccess from "../Utils/StatusPage/StatusPageReadAccess";
+import SubscriberNotificationResendAccess from "../Utils/StatusPage/SubscriberNotificationResendAccess";
 import DockerHost from "../../Models/DatabaseModels/DockerHost";
 import PodmanHost from "../../Models/DatabaseModels/PodmanHost";
 import Host from "../../Models/DatabaseModels/Host";
@@ -57,6 +68,7 @@ import ServiceType from "../../Types/Telemetry/ServiceType";
 import OneUptimeDate from "../../Types/Date";
 import TelemetryUtil from "../Utils/Telemetry/Telemetry";
 import MetricResourceAttributeUtil from "../../Utils/Metrics/MetricResourceAttributeUtil";
+import { escapeMarkdownInline } from "../../Utils/Markdown/MarkdownEscape";
 import logger from "../Utils/Logger";
 import ProductAnalytics from "../Utils/ProductAnalytics";
 import Semaphore from "../Infrastructure/Semaphore";
@@ -316,18 +328,36 @@ export class Service extends DatabaseService {
     }
     async onBeforeUpdate(updateBy) {
         /*
-         * get monitors for this incident.
-         * if the monitors are removed then change them to operational state.
-         * then change all of the monitors in this incident to the changeMonitorStatusToId.
+         * Records which monitors the update takes off and puts on each incident,
+         * the monitor status it writes, and whether the incident was resolved
+         * before it, for onUpdateSuccess to decide what that does to the
+         * monitors (updateMonitorsForIncidentEdit).
          */
-        var _a, _b, _c, _d, _e, _f, _g, _h, _j;
         updateBy.query = applyIncidentSelfPrivacyFilter(updateBy.query, updateBy.props);
         if (updateBy.data.isPrivate === true) {
             updateBy.data.isVisibleOnStatusPage = false;
         }
+        this.stripServiceOwnedScopeColumns(updateBy);
+        /*
+         * Before anything below adds values of its own to customFields (the
+         * mapped values copied from monitors), so only what the caller wrote is
+         * checked.
+         */
+        await this.validateCustomFieldValuesOnUpdate(updateBy);
+        // Before the hooks below add a Pending of their own.
+        const isCreatedNotificationResendRequested = this.isCreatedNotificationResendRequested(updateBy);
         await this.validateProjectScopedReferences(updateBy);
         const carryForward = {};
-        if (updateBy.data.monitors ||
+        const data = updateBy.data;
+        /*
+         * Only an update that sends the monitor list changes which monitors the
+         * incident holds. One that sends just the monitor status (the API, the
+         * CLI or a workflow) takes no monitor off: reading the missing list as
+         * empty would restore every monitor, and walking it threw. A list set to
+         * null is sent: TypeORM clears a many-to-many set to null, like [].
+         */
+        const isMonitorListUpdated = data["monitors"] !== undefined;
+        if (isMonitorListUpdated ||
             updateBy.data.changeMonitorStatusTo ||
             updateBy.data.changeMonitorStatusToId) {
             const incidentsToUpdate = await this.findBy({
@@ -343,46 +373,54 @@ export class Service extends DatabaseService {
                 skip: 0,
                 props: updateBy.props,
             });
+            /*
+             * The monitor status the update writes, in any shape the API accepts
+             * (an id, a bare uuid string or a relation object), so the status an
+             * update writes is never mistaken for one it leaves alone.
+             */
+            const monitorStatusIdInUpdate = resolveReferenceId(data["changeMonitorStatusToId"]) ||
+                resolveReferenceId(data["changeMonitorStatusTo"]);
+            const newMonitorChangeStatusIdTo = monitorStatusIdInUpdate
+                ? new ObjectID(monitorStatusIdInUpdate.toString())
+                : undefined;
+            const isChangeMonitorStatusToCleared = !newMonitorChangeStatusIdTo &&
+                (data["changeMonitorStatusToId"] === null ||
+                    data["changeMonitorStatusTo"] === null);
+            const monitorIdsAfterUpdate = isMonitorListUpdated
+                ? this.getMonitorIdsInUpdate(data["monitors"])
+                : [];
             for (const incident of incidentsToUpdate) {
+                const storedMonitors = incident.monitors || [];
+                const storedMonitorIds = storedMonitors.map((monitor) => {
+                    return this.getMonitorIdForComparison(monitor);
+                });
+                const monitorsRemoved = isMonitorListUpdated
+                    ? storedMonitors.filter((monitor) => {
+                        return !monitorIdsAfterUpdate.includes(this.getMonitorIdForComparison(monitor));
+                    })
+                    : [];
                 carryForward[incident.id.toString()] = {
-                    monitorsRemoved: [],
-                    monitorsAdded: [],
+                    monitorsRemoved: monitorsRemoved,
+                    /*
+                     * Read now, before the write: an update that resolves the incident
+                     * and takes a monitor off must still restore that monitor, and one
+                     * that reopens a resolved incident must not restore it twice.
+                     * After the write, the state no longer tells these cases apart.
+                     */
+                    isResolvedBeforeUpdate: monitorsRemoved.length > 0
+                        ? await this.isIncidentResolved({ incidentId: incident.id })
+                        : undefined,
+                    monitorsAdded: monitorIdsAfterUpdate
+                        .filter((monitorId) => {
+                        return !storedMonitorIds.includes(monitorId);
+                    })
+                        .map((monitorId) => {
+                        return new Monitor(new ObjectID(monitorId));
+                    }),
                     oldChangeMonitorStatusIdTo: incident.changeMonitorStatusToId,
-                    newMonitorChangeStatusIdTo: updateBy.data.changeMonitorStatusToId ||
-                        ((_a = updateBy.data.changeMonitorStatusTo) === null || _a === void 0 ? void 0 : _a._id) ||
-                        undefined,
+                    newMonitorChangeStatusIdTo: newMonitorChangeStatusIdTo,
+                    isChangeMonitorStatusToCleared: isChangeMonitorStatusToCleared,
                 };
-                for (const monitor of incident.monitors || []) {
-                    // check if this monitor is actually removed.
-                    let isRemoved = true;
-                    for (const updatedMonitor of (_b = updateBy.data) === null || _b === void 0 ? void 0 : _b.monitors) {
-                        if (updatedMonitor._id &&
-                            updatedMonitor._id.toString() === ((_c = monitor._id) === null || _c === void 0 ? void 0 : _c.toString())) {
-                            isRemoved = false;
-                            break;
-                        }
-                    }
-                    if (isRemoved) {
-                        (_e = (_d = carryForward[incident.id.toString()]) === null || _d === void 0 ? void 0 : _d.monitorsRemoved) === null || _e === void 0 ? void 0 : _e.push(monitor);
-                    }
-                }
-                if (updateBy.data.monitors && updateBy.data.monitors.length > 0) {
-                    for (const monitor of (_f = updateBy.data) === null || _f === void 0 ? void 0 : _f.monitors) {
-                        // check if this monitor is actually added.
-                        let isAdded = true;
-                        for (const existingMonitor of incident.monitors || []) {
-                            if (existingMonitor._id &&
-                                existingMonitor._id.toString() === ((_g = monitor._id) === null || _g === void 0 ? void 0 : _g.toString())) {
-                                isAdded = false;
-                                break;
-                            }
-                        }
-                        if (isAdded) {
-                            // this monitor is added.
-                            (_j = (_h = carryForward[incident.id.toString()]) === null || _h === void 0 ? void 0 : _h.monitorsAdded) === null || _j === void 0 ? void 0 : _j.push(monitor);
-                        }
-                    }
-                }
             }
         }
         // Set notification status based on shouldStatusPageSubscribersBeNotifiedOnIncidentCreated if it's being updated
@@ -401,6 +439,30 @@ export class Service extends DatabaseService {
                     StatusPageSubscriberNotificationStatus.Pending;
             }
         }
+        await this.queueCreatedNotificationResendToAllStatusPagesIfRequested(updateBy);
+        /*
+         * Retry or Resend - a user's Pending - over a notification that is
+         * being sent would let a second run send it alongside, or be
+         * overwritten when the send settles (SubscriberNotificationResendAccess).
+         * 'Resend to all pages' above has refused that already, with its own
+         * reason; the hooks below queue their own Pending only from a settled
+         * state.
+         */
+        await SubscriberNotificationResendAccess.assertNotQueuedWhileBeingSent({
+            modelType: Model,
+            service: this,
+            updateBy: updateBy,
+            statusColumns: [
+                "subscriberNotificationStatusOnIncidentCreated",
+                "subscriberNotificationStatusOnPostmortemPublished",
+            ],
+        });
+        await this.clearCreatedNotificationRecordOnResend({
+            updateBy: updateBy,
+            isResendRequested: isCreatedNotificationResendRequested,
+        });
+        await this.queueCreatedNotificationOnPublishIfRequested(updateBy);
+        await this.applyStatusPageScopeToUpdate(updateBy, carryForward);
         /*
          * Re-apply mapped custom field values. Covers the Custom Fields modal
          * saving the whole bag back over a mapped value, and the incident's
@@ -417,6 +479,839 @@ export class Service extends DatabaseService {
             carryForward: carryForward,
         };
     }
+    /*
+     * The ids of the monitors an update's list holds, deduplicated and
+     * lowercased like getMonitorIdForComparison. The list reaches the hook as
+     * models, `{ _id }` objects, ObjectIDs or bare uuid strings (API update),
+     * and comparing only `_id` read every bare id as a monitor taken off and
+     * put back on again.
+     */
+    getMonitorIdsInUpdate(monitors) {
+        const monitorIds = [];
+        for (const monitorId of resolveReferenceIds(monitors)) {
+            const normalizedMonitorId = monitorId
+                .toString()
+                .trim()
+                .toLowerCase();
+            if (!monitorIds.includes(normalizedMonitorId)) {
+                monitorIds.push(normalizedMonitorId);
+            }
+        }
+        return monitorIds;
+    }
+    // A monitor's id as getMonitorIdsInUpdate writes it, for comparing the two.
+    getMonitorIdForComparison(monitor) {
+        var _a;
+        return (((_a = monitor._id) === null || _a === void 0 ? void 0 : _a.toString()) || "").trim().toLowerCase();
+    }
+    /*
+     * The incidents an update will write to, as they are stored, for the hooks
+     * below that decide what else joins the update.
+     *
+     * Read as root: the answer only decides which columns join this update, and
+     * the update itself is still checked against the caller's permissions
+     * afterwards. Reading with the caller's props would fail the whole edit for
+     * a role that may edit incidents but not read these columns. The query
+     * already carries the caller's privacy filter (applyIncidentSelfPrivacyFilter),
+     * but not their tenant: the update's permission check adds it only after
+     * this hook runs. So a non-root caller's read is limited to their own
+     * project here, or a request for another project's incident id would be
+     * answered with that incident's state (a refusal that depends on it)
+     * instead of the usual "nothing updated".
+     */
+    async findIncidentsForUpdateHook(data) {
+        const updateBy = data.updateBy;
+        const query = !updateBy.props.isRoot && updateBy.props.tenantId
+            ? Object.assign(Object.assign({}, updateBy.query), { projectId: updateBy.props.tenantId }) : updateBy.query;
+        return await this.findBy({
+            query: query,
+            select: data.select,
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+    }
+    /*
+     * CUSTOM FIELD VALUES must fit their fields: a Number field holds a number,
+     * a Dropdown one of its options (CustomFieldValueValidator has the rules).
+     *
+     * Only for writes a user or an API key makes. Root writes - the server's
+     * own, such as values copied from monitors or an incident template - are
+     * trusted, and the mapped values are added after this runs, so they never
+     * reach it. Only the keys a write changes are checked, so a value stored
+     * before these checks, or a dropdown option removed since, does not stop
+     * someone saving the rest of the card.
+     *
+     * "Required on create" is not enforced here: incidents created by
+     * monitors, the API, Slack, Microsoft Teams or AI cannot fill in a form.
+     */
+    async getCustomFieldDefinitionsForValidation(projectId) {
+        const definitions = await IncidentCustomFieldService.findBy({
+            query: {
+                projectId: projectId,
+            },
+            select: {
+                name: true,
+                customFieldType: true,
+                dropdownOptions: true,
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        const result = [];
+        for (const definition of definitions) {
+            if (typeof definition.name !== "string") {
+                continue;
+            }
+            result.push({
+                name: definition.name,
+                customFieldType: definition.customFieldType,
+                dropdownOptions: definition.dropdownOptions,
+            });
+        }
+        return result;
+    }
+    hasCustomFieldValuesToValidate(customFields) {
+        return (customFields !== null &&
+            typeof customFields === "object" &&
+            !Array.isArray(customFields) &&
+            Object.keys(customFields).length > 0);
+    }
+    throwIfCustomFieldValuesInvalid(errors) {
+        if (errors.length > 0) {
+            throw new BadDataException(formatCustomFieldValueValidationErrors(errors));
+        }
+    }
+    async validateCustomFieldValuesOnCreate(data) {
+        const customFields = data.createBy.data.customFields;
+        if (data.createBy.props.isRoot ||
+            !data.projectId ||
+            !this.hasCustomFieldValuesToValidate(customFields)) {
+            return;
+        }
+        this.throwIfCustomFieldValuesInvalid(validateCustomFieldValues({
+            definitions: await this.getCustomFieldDefinitionsForValidation(data.projectId),
+            customFields: customFields,
+            storedCustomFields: {},
+        }));
+    }
+    /*
+     * Checked against each incident the update writes, because what counts as
+     * changed depends on what that incident already holds.
+     */
+    async validateCustomFieldValuesOnUpdate(updateBy) {
+        const customFields = updateBy.data.customFields;
+        if (updateBy.props.isRoot ||
+            !this.hasCustomFieldValuesToValidate(customFields)) {
+            return;
+        }
+        const incidents = await this.findIncidentsForUpdateHook({
+            updateBy: updateBy,
+            select: {
+                _id: true,
+                projectId: true,
+                customFields: true,
+            },
+        });
+        const definitionsByProject = new Map();
+        for (const incident of incidents) {
+            if (!incident.projectId) {
+                continue;
+            }
+            const projectKey = incident.projectId.toString();
+            if (!definitionsByProject.has(projectKey)) {
+                definitionsByProject.set(projectKey, await this.getCustomFieldDefinitionsForValidation(incident.projectId));
+            }
+            this.throwIfCustomFieldValuesInvalid(validateCustomFieldValues({
+                definitions: definitionsByProject.get(projectKey),
+                customFields: customFields,
+                storedCustomFields: incident.customFields,
+            }));
+        }
+    }
+    /*
+     * isScopedToStatusPages and statusPagesNotifiedOnCreation are this
+     * service's to write. A client value for either is dropped before any hook
+     * runs, so what the hooks write is all that is written: the flag is derived
+     * from statusPages (applyStatusPageScopeToUpdate), and the record is the
+     * notification job's - a client must not be able to seed it and so keep
+     * pages from ever hearing about the incident, or clear it and have them
+     * told twice. Root (internal) callers keep the record they send.
+     */
+    stripServiceOwnedScopeColumns(updateBy) {
+        const data = updateBy.data;
+        delete data["isScopedToStatusPages"];
+        if (!updateBy.props.isRoot) {
+            delete data["statusPagesNotifiedOnCreation"];
+        }
+    }
+    /*
+     * Whether an update itself asks for the 'created' notification to go out
+     * again: it sets the status to Pending - the API route of resending it,
+     * and the dashboard's Retry - turns notifying on creation on, which
+     * onBeforeUpdate maps to Pending, or asks for it to be sent to every
+     * status page again (IncidentCreatedResend, the dashboard's Resend). Read
+     * before any hook adds a Pending of its own.
+     */
+    isCreatedNotificationResendRequested(updateBy) {
+        return (updateBy.data.subscriberNotificationStatusOnIncidentCreated ===
+            StatusPageSubscriberNotificationStatus.Pending ||
+            updateBy.data.shouldStatusPageSubscribersBeNotifiedOnIncidentCreated ===
+                true ||
+            IncidentCreatedResend.isRequested(updateBy.miscDataProps));
+    }
+    /*
+     * 'Resend to all pages' (see IncidentCreatedResend): the 'created'
+     * notification goes back to Pending with a message saying so, and
+     * clearCreatedNotificationRecordOnResend empties its record of told pages
+     * in the same write, so the job sends it to every page the incident
+     * reaches now - after a failure too, where a plain Retry would resume.
+     *
+     * Everything is written into the caller's own update, so it lands with the
+     * rest of it or not at all, and the column check that runs after this hook
+     * still decides whether the caller may write the status. That check is
+     * also made here first, before the incidents are read: the refusals below
+     * depend on the notification's state, and a caller who may not send it
+     * again is told only that. The incidents are then read with the caller's
+     * own permissions (and the privacy filter already on the query), so an
+     * incident they cannot see never decides the answer; when they can see
+     * none of those the update matches, nothing is queued.
+     *
+     * Refused - with the reason, rather than silently dropped, because asking
+     * for it is the whole point of the request - when any matched incident's
+     * notification did not go out (Skipped) or is on its way (Pending,
+     * InProgress), and when the same update sets the status to anything but
+     * Pending.
+     */
+    async queueCreatedNotificationResendToAllStatusPagesIfRequested(updateBy) {
+        if (!IncidentCreatedResend.isRequested(updateBy.miscDataProps)) {
+            return;
+        }
+        const requestedStatus = updateBy.data.subscriberNotificationStatusOnIncidentCreated;
+        if (requestedStatus !== undefined &&
+            requestedStatus !== StatusPageSubscriberNotificationStatus.Pending) {
+            throw new BadDataException(IncidentCreatedResend.conflictingStatusMessage);
+        }
+        SubscriberNotificationResendAccess.assertCallerMayUpdateColumns({
+            modelType: Model,
+            columns: {
+                subscriberNotificationStatusOnIncidentCreated: StatusPageSubscriberNotificationStatus.Pending,
+                subscriberNotificationStatusMessage: IncidentCreatedResend.queuedMessage,
+                statusPagesNotifiedOnCreation: [],
+            },
+            props: updateBy.props,
+            refusal: IncidentCreatedResend.noPermissionMessage,
+        });
+        const incidents = await this.findBy({
+            query: updateBy.query,
+            select: {
+                _id: true,
+                subscriberNotificationStatusOnIncidentCreated: true,
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: updateBy.props,
+        });
+        for (const incident of incidents) {
+            const refusal = IncidentCreatedResend.getRefusalReason(incident.subscriberNotificationStatusOnIncidentCreated);
+            if (refusal) {
+                throw new BadDataException(refusal);
+            }
+        }
+        if (incidents.length === 0) {
+            return;
+        }
+        updateBy.data.subscriberNotificationStatusOnIncidentCreated =
+            StatusPageSubscriberNotificationStatus.Pending;
+        if (updateBy.data.subscriberNotificationStatusMessage === undefined) {
+            updateBy.data.subscriberNotificationStatusMessage =
+                IncidentCreatedResend.queuedMessage;
+        }
+    }
+    /*
+     * A resend asked for by the update itself (see
+     * isCreatedNotificationResendRequested) goes to every status page, as it
+     * always did. The job skips the pages in its record of told pages
+     * (Incident.statusPagesNotifiedOnCreation), so without this a resend of a
+     * notification that went out would reach nobody: the record is emptied in
+     * the same write.
+     *
+     * It is kept in three cases:
+     * - Failed: Retry resumes where the failed send stopped, so the pages it
+     *   told are not told twice - unless the update asks for it to go to every
+     *   page again (IncidentCreatedResend), which is what that request is for;
+     * - Pending or InProgress: the notification is on its way already, and its
+     *   record is what keeps a send queued for added pages from reaching the
+     *   pages told before (IncidentCreatedResend refuses these);
+     * - a root caller that writes the record itself.
+     *
+     * An update matching several incidents empties the record when any of them
+     * would otherwise be resent to nobody, because the write applies the same
+     * data to all of them.
+     */
+    async clearCreatedNotificationRecordOnResend(data) {
+        const updateBy = data.updateBy;
+        if (!data.isResendRequested) {
+            return;
+        }
+        if (updateBy.data["statusPagesNotifiedOnCreation"] !== undefined) {
+            return;
+        }
+        if (IncidentCreatedResend.isRequested(updateBy.miscDataProps)) {
+            /*
+             * Queued for every page by
+             * queueCreatedNotificationResendToAllStatusPagesIfRequested, which
+             * left the status alone when the caller can see none of the incidents
+             * the update matches: nothing to read to decide.
+             */
+            if (updateBy.data.subscriberNotificationStatusOnIncidentCreated ===
+                StatusPageSubscriberNotificationStatus.Pending) {
+                updateBy.data.statusPagesNotifiedOnCreation = [];
+            }
+            return;
+        }
+        const incidents = await this.findIncidentsForUpdateHook({
+            updateBy: updateBy,
+            select: {
+                _id: true,
+                subscriberNotificationStatusOnIncidentCreated: true,
+            },
+        });
+        const someIncidentWouldReachNobody = incidents.some((incident) => {
+            return ![
+                StatusPageSubscriberNotificationStatus.Failed,
+                StatusPageSubscriberNotificationStatus.Pending,
+                StatusPageSubscriberNotificationStatus.InProgress,
+            ].includes(incident.subscriberNotificationStatusOnIncidentCreated);
+        });
+        if (someIncidentWouldReachNobody) {
+            updateBy.data.statusPagesNotifiedOnCreation = [];
+        }
+    }
+    /*
+     * Publishing a hidden incident can announce it: when the editor turns
+     * 'Visible on Status Page' on and ticks "Notify subscribers that this
+     * incident was created" (see IncidentCreatedRenotify), the incident's
+     * 'created' notification goes back to Pending, and the
+     * Incident:SendNotificationToSubscribers job sends it now that the incident
+     * is visible - to the pages its record of told pages does not list, so an
+     * incident whose notification went out before it was hidden tells only the
+     * pages added while it was hidden.
+     *
+     * It only ever re-queues a notification with someone left to tell, for an
+     * incident that is hidden today, not private, and meant to notify on
+     * creation, so a stray request cannot email subscribers twice or break a
+     * deliberate "don't notify". The status is written into this same update,
+     * so it lands together with the visibility change or not at all. The
+     * column (and its message) are computed, but their update ACL lists the
+     * incident roles, so a non-root edit still passes the column check that
+     * runs after this hook.
+     *
+     * An update that sets the status itself - the API route of resetting it to
+     * Pending, or the notify-on-create flag above - is left alone. An update
+     * that matches several incidents queues only when every one of them
+     * qualifies, because the write applies the same data to all of them.
+     */
+    async queueCreatedNotificationOnPublishIfRequested(updateBy) {
+        if (!IncidentCreatedRenotify.isRequested(updateBy.miscDataProps)) {
+            return;
+        }
+        if (updateBy.data.isVisibleOnStatusPage !== true) {
+            return;
+        }
+        if (updateBy.data.subscriberNotificationStatusOnIncidentCreated !== undefined) {
+            return;
+        }
+        const incidents = await this.findIncidentsForUpdateHook({
+            updateBy: updateBy,
+            select: {
+                _id: true,
+                isVisibleOnStatusPage: true,
+                isPrivate: true,
+                subscriberNotificationStatusOnIncidentCreated: true,
+                shouldStatusPageSubscribersBeNotifiedOnIncidentCreated: true,
+                statusPagesNotifiedOnCreation: true,
+                statusPages: {
+                    _id: true,
+                },
+            },
+        });
+        if (incidents.length === 0) {
+            return;
+        }
+        const everyIncidentQualifies = incidents.every((incident) => {
+            return IncidentCreatedRenotify.canRenotifyOnPublish({
+                isVisibleOnStatusPage: incident.isVisibleOnStatusPage,
+                isPrivate: updateBy.data.isPrivate !== undefined &&
+                    updateBy.data.isPrivate !== null
+                    ? updateBy.data.isPrivate
+                    : incident.isPrivate,
+                subscriberNotificationStatusOnIncidentCreated: incident.subscriberNotificationStatusOnIncidentCreated,
+                shouldStatusPageSubscribersBeNotifiedOnIncidentCreated: incident.shouldStatusPageSubscribersBeNotifiedOnIncidentCreated,
+                // The pages it is limited to once this update is written.
+                statusPages: updateBy.data.statusPages !== undefined
+                    ? updateBy.data.statusPages
+                    : incident.statusPages,
+                statusPagesNotifiedOnCreation: incident.statusPagesNotifiedOnCreation,
+            });
+        });
+        if (!everyIncidentQualifies) {
+            logger.debug(`Not re-queueing the incident created notification on publish: ${incidents.length} incident(s) matched and not all of them were hidden, set to notify subscribers and had subscribers left to tell.`);
+            return;
+        }
+        updateBy.data.subscriberNotificationStatusOnIncidentCreated =
+            StatusPageSubscriberNotificationStatus.Pending;
+        updateBy.data.subscriberNotificationStatusMessage =
+            IncidentCreatedRenotify.queuedMessage;
+    }
+    /*
+     * The status pages a new incident is limited to (Incident.statusPages), and
+     * the two columns that follow from them.
+     *
+     * isScopedToStatusPages is derived from the list, whatever the caller sent
+     * for it: the column is computed, which exempts it from the column check on
+     * create, so a client value would otherwise be stored as is - and a scoped
+     * flag with no pages hides the incident from every status page.
+     *
+     * statusPagesNotifiedOnCreation is the created-notification job's record of
+     * the pages it told. A client must not be able to seed it and so keep pages
+     * from ever hearing about the incident; only root (internal) callers keep
+     * what they send.
+     *
+     * The pages a non-root caller picks must be pages they can read (see
+     * StatusPageReadAccess), except the pages of an incident template they can
+     * read: the dashboard fills a template's pages in for everyone who declares
+     * from it, which is what the template is for. Pages copied from a template
+     * on the server are not the caller's pick. That is checked once the pages
+     * are known to be the project's (assertCallerCanPickStatusPagesOnCreate).
+     *
+     * `isScopedToNothingByTemplate`: declared through the API from a template
+     * whose status pages were all deleted. The incident is scoped with no
+     * pages - hidden from every status page - rather than unscoped.
+     */
+    applyStatusPageScopeToCreate(data) {
+        const createBy = data.createBy;
+        if (!createBy.props.isRoot) {
+            delete createBy.data.statusPagesNotifiedOnCreation;
+        }
+        const statusPageIds = IncidentScopeAddedPagesNotification.normalizeStatusPageIds(createBy.data.statusPages);
+        if (createBy.data.statusPages !== undefined &&
+            createBy.data.statusPages !== null) {
+            createBy.data.statusPages = this.toStatusPageStubs(statusPageIds);
+        }
+        createBy.data.isScopedToStatusPages =
+            statusPageIds.length > 0 || data.isScopedToNothingByTemplate === true;
+    }
+    /*
+     * The pages a non-root caller picks for a new incident must be pages they
+     * can read (see applyStatusPageScopeToCreate). Runs after the project check,
+     * so another project's page, or one that does not exist, is reported as
+     * such rather than as a page the caller cannot read.
+     */
+    async assertCallerCanPickStatusPagesOnCreate(data) {
+        const createBy = data.createBy;
+        const statusPageIds = IncidentScopeAddedPagesNotification.normalizeStatusPageIds(createBy.data.statusPages);
+        if (createBy.props.isRoot ||
+            !data.statusPagesFromCaller ||
+            statusPageIds.length === 0) {
+            return;
+        }
+        const readableStatusPageIds = await StatusPageReadAccess.getReadableStatusPageIds({
+            statusPageIds: statusPageIds,
+            props: createBy.props,
+        });
+        let unreadableStatusPageIds = statusPageIds.filter((id) => {
+            return !readableStatusPageIds.includes(id);
+        });
+        if (unreadableStatusPageIds.length > 0) {
+            const templateStatusPageIds = await this.getStatusPageIdsOfTemplatesReadableByCaller({
+                projectId: data.projectId,
+                props: createBy.props,
+            });
+            unreadableStatusPageIds = unreadableStatusPageIds.filter((id) => {
+                return !templateStatusPageIds.includes(id);
+            });
+        }
+        if (unreadableStatusPageIds.length > 0) {
+            throw new NotAuthorizedException(StatusPageReadAccess.getRefusalMessage("incident"));
+        }
+    }
+    /*
+     * The status pages the incident templates the caller can read are limited
+     * to. Such a page may be picked for a new incident without reading it:
+     * declaring from the template picks it anyway. The templates are read with
+     * the caller's permissions (and labels); their pages as root. A caller who
+     * cannot read templates at all gets none.
+     */
+    async getStatusPageIdsOfTemplatesReadableByCaller(data) {
+        let templates = [];
+        try {
+            templates = await IncidentTemplateService.findBy({
+                query: {
+                    projectId: data.projectId,
+                },
+                select: {
+                    _id: true,
+                },
+                limit: LIMIT_MAX,
+                skip: 0,
+                props: data.props,
+            });
+        }
+        catch (err) {
+            // No access to templates (or not on a plan that has them): no pages.
+            logger.debug(`Could not read the caller's incident templates while checking the status pages of a new incident: ${err}`);
+            return [];
+        }
+        if (templates.length === 0) {
+            return [];
+        }
+        const templatesWithPages = await IncidentTemplateService.findBy({
+            query: {
+                _id: QueryHelper.any(templates.map((template) => {
+                    return template.id.toString();
+                })),
+                projectId: data.projectId,
+            },
+            select: {
+                _id: true,
+                statusPages: {
+                    _id: true,
+                },
+            },
+            limit: LIMIT_MAX,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        return IncidentScopeAddedPagesNotification.normalizeStatusPageIds(templatesWithPages.flatMap((template) => {
+            return template.statusPages || [];
+        }));
+    }
+    /*
+     * The status pages an incident is limited to, on update. Everything that
+     * follows from a write to Incident.statusPages happens here, in the
+     * caller's own update, so the list, the flag and a re-queued notification
+     * land together or not at all:
+     *
+     * - isScopedToStatusPages is derived from the list the update writes (a
+     *   value the caller sent for it was dropped by
+     *   stripServiceOwnedScopeColumns). Nothing else ever sets it, and it is
+     *   never recomputed when join rows disappear: deleting the only page an
+     *   incident is scoped to leaves it scoped to nothing, hidden from every
+     *   page, rather than widened to all of them;
+     * - a non-root caller's list is topped up with the pages the incident is
+     *   scoped to that the caller cannot read. Status pages are label-scoped,
+     *   so an editor may see only some of an incident's pages, and a list write
+     *   replaces the whole list (the dashboard sends back what the editor
+     *   sees). Without this, saving the incident would silently drop every page
+     *   the editor was not shown;
+     * - the pages a non-root caller adds must be pages they can read (see
+     *   StatusPageReadAccess);
+     * - with IncidentScopeAddedPagesNotification requested, the 'created'
+     *   notification is queued again for the pages the update adds;
+     * - what was added and removed is carried forward for the feed item
+     *   onUpdateSuccess writes, and so is whether the notification was on its
+     *   way already, which onUpdateSuccess checks again once the pages are
+     *   written.
+     *
+     * The flag and the notification columns are computed, but their update
+     * access control lists every role that may edit statusPages, so a non-root
+     * edit passes the column check that runs after this hook.
+     */
+    async applyStatusPageScopeToUpdate(updateBy, carryForward) {
+        const data = updateBy.data;
+        if (data["statusPages"] === undefined) {
+            return;
+        }
+        const incidents = await this.findIncidentsForUpdateHook({
+            updateBy: updateBy,
+            select: {
+                _id: true,
+                statusPages: {
+                    _id: true,
+                },
+                isVisibleOnStatusPage: true,
+                isPrivate: true,
+                subscriberNotificationStatusOnIncidentCreated: true,
+                shouldStatusPageSubscribersBeNotifiedOnIncidentCreated: true,
+                statusPagesNotifiedOnCreation: true,
+            },
+        });
+        const requestedStatusPageIds = IncidentScopeAddedPagesNotification.normalizeStatusPageIds(data["statusPages"]);
+        const hiddenStatusPageIds = updateBy.props.isRoot
+            ? []
+            : await this.getScopedStatusPageIdsHiddenFromCaller({
+                incidents: incidents,
+                props: updateBy.props,
+            });
+        const statusPageIds = [
+            ...requestedStatusPageIds,
+            ...hiddenStatusPageIds.filter((id) => {
+                return !requestedStatusPageIds.includes(id);
+            }),
+        ];
+        if (!updateBy.props.isRoot) {
+            await StatusPageReadAccess.assertCallerCanPickStatusPages({
+                statusPageIds: this.getStatusPageIdsAddedToAny({
+                    incidents: incidents,
+                    statusPageIds: statusPageIds,
+                }),
+                props: updateBy.props,
+                subject: "incident",
+            });
+        }
+        data["statusPages"] = this.toStatusPageStubs(statusPageIds);
+        data["isScopedToStatusPages"] = statusPageIds.length > 0;
+        const decisions = [];
+        for (const incident of incidents) {
+            const incidentId = incident.id.toString();
+            const change = IncidentScopeAddedPagesNotification.getScopeChange({
+                before: incident.statusPages,
+                after: statusPageIds,
+            });
+            const action = IncidentScopeAddedPagesNotification.getAction({
+                addedStatusPageIds: change.addedStatusPageIds,
+                incident: {
+                    subscriberNotificationStatusOnIncidentCreated: incident.subscriberNotificationStatusOnIncidentCreated,
+                    shouldStatusPageSubscribersBeNotifiedOnIncidentCreated: incident.shouldStatusPageSubscribersBeNotifiedOnIncidentCreated,
+                    isVisibleOnStatusPage: this.getValueAfterUpdate(updateBy.data.isVisibleOnStatusPage, incident.isVisibleOnStatusPage),
+                    isPrivate: this.getValueAfterUpdate(updateBy.data.isPrivate, incident.isPrivate),
+                    statusPagesNotifiedOnCreation: incident.statusPagesNotifiedOnCreation,
+                },
+            });
+            carryForward[incidentId] = Object.assign(Object.assign({ monitorsRemoved: [], monitorsAdded: [], oldChangeMonitorStatusIdTo: undefined, newMonitorChangeStatusIdTo: undefined }, carryForward[incidentId]), { statusPageScopeChange: Object.assign(Object.assign({}, change), { isScoped: statusPageIds.length > 0, notificationQueued: false, 
+                    /*
+                     * On its way already, and nothing in this update sets the status:
+                     * onUpdateSuccess makes sure the send did not finish without the
+                     * added pages in the meantime.
+                     */
+                    notificationAlreadyQueued: action ===
+                        IncidentScopeAddedPagesNotificationAction.AlreadyQueued &&
+                        updateBy.data.subscriberNotificationStatusOnIncidentCreated ===
+                            undefined }) });
+            decisions.push({
+                incidentId: incidentId,
+                action: action,
+                recordToSeed: action === IncidentScopeAddedPagesNotificationAction.Queue
+                    ? IncidentScopeAddedPagesNotification.getRecordToSeedOnQueue({
+                        statusPagesNotifiedOnCreation: incident.statusPagesNotifiedOnCreation,
+                        statusPageIdsBeforeUpdate: incident.statusPages,
+                    })
+                    : undefined,
+            });
+        }
+        this.queueCreatedNotificationForAddedStatusPagesIfRequested({
+            updateBy: updateBy,
+            decisions: decisions,
+            carryForward: carryForward,
+        });
+    }
+    /*
+     * The pages an update writing `statusPageIds` adds to at least one of the
+     * incidents it matches.
+     */
+    getStatusPageIdsAddedToAny(data) {
+        const added = [];
+        for (const incident of data.incidents) {
+            for (const id of IncidentScopeAddedPagesNotification.getScopeChange({
+                before: incident.statusPages,
+                after: data.statusPageIds,
+            }).addedStatusPageIds) {
+                if (!added.includes(id)) {
+                    added.push(id);
+                }
+            }
+        }
+        return added;
+    }
+    /*
+     * Adding status pages to an incident's scope can tell them the incident was
+     * created: with IncidentScopeAddedPagesNotification requested, the 'created'
+     * notification goes back to Pending, and the job sends it to the pages it
+     * has no record of telling (Incident.statusPagesNotifiedOnCreation). See
+     * IncidentScopeAddedPagesNotification.getAction for when it applies.
+     *
+     * A notification that was never sent has no record yet, so the pages the
+     * incident was limited to before are written in as the record in the same
+     * write (getRecordToSeedOnQueue): the job then tells only the added pages.
+     *
+     * An update that sets the status itself - the API route of resetting it to
+     * Pending, the notify-on-create flag, or publishing a hidden incident - is
+     * left alone. An update that matches several incidents queues only when it
+     * may for every one of them, because the write applies the same data to
+     * all. For the same reason it cannot write a record that differs between
+     * them, or overwrite the record of an incident that has one, and is refused
+     * instead.
+     */
+    queueCreatedNotificationForAddedStatusPagesIfRequested(data) {
+        var _a;
+        const updateBy = data.updateBy;
+        if (!IncidentScopeAddedPagesNotification.isRequested(updateBy.miscDataProps)) {
+            return;
+        }
+        if (updateBy.data.subscriberNotificationStatusOnIncidentCreated !== undefined) {
+            return;
+        }
+        const actions = data.decisions.map((decision) => {
+            return decision.action;
+        });
+        if (!actions.includes(IncidentScopeAddedPagesNotificationAction.Queue)) {
+            return;
+        }
+        const everyIncidentMayQueue = actions.every((action) => {
+            return (action === IncidentScopeAddedPagesNotificationAction.Queue ||
+                action === IncidentScopeAddedPagesNotificationAction.AlreadyQueued);
+        });
+        if (!everyIncidentMayQueue) {
+            logger.debug(`Not queueing the incident created notification for added status pages: ${actions.length} incident(s) matched and not all of them gained status pages and may be announced.`);
+            return;
+        }
+        const recordsToSeed = data.decisions
+            .map((decision) => {
+            return decision.recordToSeed;
+        })
+            .filter((record) => {
+            return record !== undefined;
+        });
+        if (recordsToSeed.length > 0) {
+            const recordToSeed = recordsToSeed[0];
+            const everyIncidentTakesTheSameRecord = recordsToSeed.length === data.decisions.length &&
+                recordsToSeed.every((record) => {
+                    return ([...record].sort().join(",") === [...recordToSeed].sort().join(","));
+                });
+            if (!everyIncidentTakesTheSameRecord) {
+                throw new BadDataException("These incidents cannot be sent the incident-created notification for their added status pages together: they were limited to different status pages, or not all of them were ever announced. Change them one at a time.");
+            }
+            updateBy.data.statusPagesNotifiedOnCreation = recordToSeed;
+        }
+        updateBy.data.subscriberNotificationStatusOnIncidentCreated =
+            StatusPageSubscriberNotificationStatus.Pending;
+        updateBy.data.subscriberNotificationStatusMessage =
+            IncidentScopeAddedPagesNotification.queuedMessage;
+        for (const decision of data.decisions) {
+            const scopeChange = (_a = data.carryForward[decision.incidentId]) === null || _a === void 0 ? void 0 : _a.statusPageScopeChange;
+            if (scopeChange &&
+                decision.action === IncidentScopeAddedPagesNotificationAction.Queue) {
+                scopeChange.notificationQueued = true;
+            }
+        }
+    }
+    /*
+     * An update that added pages while the 'created' notification was Pending
+     * or being sent left the status alone: the queued send reads the scope when
+     * it goes out, and a running send reads it again once it has finished (see
+     * the Incident:SendNotificationToSubscribers job). One case slips between
+     * the two: the whole send started after this update read the status and
+     * finished before it wrote the pages. Once the pages are written, this
+     * checks for exactly that - the send finished, and an added page is not in
+     * its record - and queues the notification again for the pages it missed.
+     *
+     * Never throws: the update is already written.
+     */
+    async requeueCreatedNotificationIfAddedPagesWereMissed(data) {
+        var _a, _b;
+        if (!((_a = data.change) === null || _a === void 0 ? void 0 : _a.notificationAlreadyQueued) ||
+            data.change.addedStatusPageIds.length === 0) {
+            return;
+        }
+        try {
+            const incident = await this.findOneById({
+                id: data.incidentId,
+                select: {
+                    subscriberNotificationStatusOnIncidentCreated: true,
+                    statusPagesNotifiedOnCreation: true,
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+            if ((incident === null || incident === void 0 ? void 0 : incident.subscriberNotificationStatusOnIncidentCreated) !==
+                StatusPageSubscriberNotificationStatus.Success) {
+                // Still on its way (it will see the pages), or settled otherwise.
+                return;
+            }
+            const recorded = IncidentScopeAddedPagesNotification.getRecordedStatusPageIds(incident.statusPagesNotifiedOnCreation) || [];
+            const missed = data.change.addedStatusPageIds.some((id) => {
+                return !recorded.includes(id);
+            });
+            if (!missed) {
+                return;
+            }
+            await this.updateOneById({
+                id: data.incidentId,
+                data: {
+                    subscriberNotificationStatusOnIncidentCreated: StatusPageSubscriberNotificationStatus.Pending,
+                    subscriberNotificationStatusMessage: IncidentScopeAddedPagesNotification.queuedMessage,
+                },
+                props: {
+                    isRoot: true,
+                    ignoreHooks: true,
+                },
+            });
+        }
+        catch (err) {
+            logger.error(`Failed to check whether the incident created notification reached the status pages added to the incident: ${err}`, {
+                incidentId: (_b = data.incidentId) === null || _b === void 0 ? void 0 : _b.toString(),
+            });
+        }
+    }
+    /*
+     * The pages the matched incidents are scoped to that the caller cannot
+     * read, which a list write from them must keep (see
+     * applyStatusPageScopeToUpdate). A bulk update writes the same list onto
+     * every incident it matches, so it can only keep them when every matched
+     * incident holds the same hidden pages; otherwise it would scope some of
+     * them to pages they were never scoped to, and it is refused.
+     */
+    async getScopedStatusPageIdsHiddenFromCaller(data) {
+        const heldByIncident = data.incidents.map((incident) => {
+            return IncidentScopeAddedPagesNotification.normalizeStatusPageIds(incident.statusPages);
+        });
+        const heldIds = IncidentScopeAddedPagesNotification.normalizeStatusPageIds(heldByIncident.flat());
+        if (heldIds.length === 0) {
+            return [];
+        }
+        const readableIds = await StatusPageReadAccess.getReadableStatusPageIds({
+            statusPageIds: heldIds,
+            props: data.props,
+        });
+        const hiddenByIncident = heldByIncident.map((held) => {
+            return held
+                .filter((id) => {
+                return !readableIds.includes(id);
+            })
+                .sort();
+        });
+        const hiddenIds = hiddenByIncident[0] || [];
+        const everyIncidentHidesTheSame = hiddenByIncident.every((hidden) => {
+            return hidden.join(",") === hiddenIds.join(",");
+        });
+        if (!everyIncidentHidesTheSame) {
+            throw new BadDataException("These incidents are limited to different status pages that you do not have access to, so their status pages cannot be changed together. Change them one at a time.");
+        }
+        return hiddenIds;
+    }
+    toStatusPageStubs(statusPageIds) {
+        return statusPageIds.map((statusPageId) => {
+            const statusPage = new StatusPage();
+            statusPage._id = statusPageId;
+            return statusPage;
+        });
+    }
+    // A column's value once an update is written: the update's, else the stored.
+    getValueAfterUpdate(updatedValue, storedValue) {
+        if (updatedValue !== undefined && updatedValue !== null) {
+            return updatedValue;
+        }
+        return storedValue;
+    }
     /*
      * An update can repoint an incident at another project's state, severity or
      * monitor status just as easily as a create can, and the result is the same:
@@ -533,6 +1428,16 @@ export class Service extends DatabaseService {
                 modelName: "On-Call Policy",
                 service: OnCallDutyPolicyService,
             },
+            /*
+             * The status pages the incident is limited to. Another project's page
+             * here would put that project's page name into this incident's feed and
+             * scope it to a page it can never show on.
+             */
+            {
+                column: "statusPages",
+                modelName: "Status Page",
+                service: StatusPageService,
+            },
             ...getAffectedResourceRelations(this.getModel()),
         ];
     }
@@ -567,6 +1472,20 @@ export class Service extends DatabaseService {
                 false;
         }
         const projectId = createBy.props.tenantId || createBy.data.projectId;
+        /*
+         * The values the caller sent, before a template or a mapping adds any:
+         * those are not the caller's to get wrong.
+         */
+        await this.validateCustomFieldValuesOnCreate({
+            createBy: createBy,
+            projectId: projectId,
+        });
+        /*
+         * Status pages the caller picked, as opposed to ones copied from a
+         * template below (see applyStatusPageScopeToCreate).
+         */
+        const statusPagesFromCaller = createBy.data.statusPages !== undefined &&
+            createBy.data.statusPages !== null;
         /*
          * Declaring the incident from alerts. The alert ids are checked here,
          * before the incident number is taken and before anything is written, so
@@ -626,6 +1545,8 @@ export class Service extends DatabaseService {
         }
         // Determine the initial incident state
         let initialIncidentStateId = undefined;
+        // Declared from a template whose status pages were all deleted.
+        let isScopedToNothingByTemplate = false;
         // If currentIncidentStateId is already provided (manual selection), use it
         if (createBy.data.currentIncidentStateId) {
             initialIncidentStateId = createBy.data.currentIncidentStateId;
@@ -676,6 +1597,9 @@ export class Service extends DatabaseService {
                     services: { _id: true },
                     onCallDutyPolicies: { _id: true },
                     labels: { _id: true },
+                    statusPages: { _id: true },
+                    isScopedToStatusPages: true,
+                    customFields: true,
                 },
                 props: {
                     isRoot: true,
@@ -782,8 +1706,43 @@ export class Service extends DatabaseService {
                         createBy.data.labels = stubs;
                     }
                 }
+                // Applying a template that has status pages scopes the incident.
+                if (createBy.data.statusPages === undefined) {
+                    const stubs = stubBy(StatusPage, incidentTemplate.statusPages);
+                    if (stubs && stubs.length > 0) {
+                        createBy.data.statusPages = stubs;
+                    }
+                    else if (incidentTemplate.isScopedToStatusPages) {
+                        /*
+                         * A template limited to status pages that have all been deleted
+                         * since. Its incidents stay limited - to nothing - like an
+                         * incident whose pages were deleted, rather than reaching every
+                         * page that lists their monitors.
+                         */
+                        isScopedToNothingByTemplate = true;
+                    }
+                }
+                /*
+                 * The template's custom field values fill in the fields the caller
+                 * left out; a value the caller sent always wins. Merged, not
+                 * replaced, so the caller's own values are never dropped. They are
+                 * the template's, so the value check above (the caller's values
+                 * only) does not see them, and the mapping below still has the last
+                 * word on a mapped field.
+                 */
+                const customFieldsWithTemplate = mergeTemplateCustomFields({
+                    templateCustomFields: incidentTemplate.customFields,
+                    customFields: createBy.data.customFields,
+                });
+                if (customFieldsWithTemplate) {
+                    createBy.data.customFields = customFieldsWithTemplate;
+                }
             }
         }
+        this.applyStatusPageScopeToCreate({
+            createBy: createBy,
+            isScopedToNothingByTemplate: isScopedToNothingByTemplate,
+        });
         // If no custom state is provided or found, fall back to default created state
         if (!initialIncidentStateId) {
             const incidentState = await IncidentStateService.findOneBy({
@@ -859,6 +1818,12 @@ export class Service extends DatabaseService {
             subject: "incident",
             serviceLevelObjectives: createBy.data.serviceLevelObjectives,
         });
+        // Before the counter increment too, like the checks above.
+        await this.assertCallerCanPickStatusPagesOnCreate({
+            createBy: createBy,
+            projectId: projectId,
+            statusPagesFromCaller: statusPagesFromCaller,
+        });
         const incidentCounterResult = await ProjectService.incrementAndGetIncidentCounter(projectId);
         createBy.data.currentIncidentStateId = initialIncidentStateId;
         createBy.data.incidentNumber = incidentCounterResult.counter;
@@ -964,6 +1929,8 @@ export class Service extends DatabaseService {
                  * The resources named under "Resources Affected" are read by the feed
                  * builder itself (LinkedAffectedResources), one relation at a time.
                  */
+                // The created feed item names the status pages a scoped incident is limited to.
+                isScopedToStatusPages: true,
             },
             props: {
                 isRoot: true,
@@ -1492,6 +2459,37 @@ export class Service extends DatabaseService {
             throw error;
         }
     }
+    /*
+     * The status pages a scoped incident is limited to, as a Markdown list for
+     * its created feed item. Read on their own rather than in onCreateSuccess's
+     * select: a find that selects several many-to-many lists returns a row for
+     * every combination of them.
+     */
+    async getScopedStatusPagesMarkdown(incident) {
+        const incidentWithStatusPages = await this.findOneById({
+            id: incident.id,
+            select: {
+                statusPages: {
+                    _id: true,
+                    name: true,
+                },
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        const statusPages = (incidentWithStatusPages === null || incidentWithStatusPages === void 0 ? void 0 : incidentWithStatusPages.statusPages) || [];
+        if (statusPages.length === 0) {
+            // Scoped to pages that have all been deleted since: hidden everywhere.
+            return `- None: the status pages it was limited to have been deleted, so it is not shown on any status page.\n`;
+        }
+        let markdown = "";
+        for (const statusPage of statusPages) {
+            // A page name is free text: kept from turning into a link or an image.
+            markdown += `- [${escapeMarkdownInline(statusPage.name || "Untitled status page")}](${(await StatusPageService.getStatusPageLinkInDashboard(incident.projectId, statusPage.id)).toString()})\n`;
+        }
+        return markdown;
+    }
     async createIncidentFeedAsync(incident) {
         var _a, _b, _c, _d, _e, _f, _g;
         try {
@@ -1534,6 +2532,11 @@ ${incident.description || "No description provided."}
                 }
                 feedInfoInMarkdown += `\n\n`;
             }
+            if (incident.isScopedToStatusPages) {
+                feedInfoInMarkdown += `📣 **Limited to Status Pages**:\n`;
+                feedInfoInMarkdown += await this.getScopedStatusPagesMarkdown(incident);
+                feedInfoInMarkdown += `\n\n`;
+            }
             if (incident.rootCause) {
                 feedInfoInMarkdown += `\n
 📄 **Root Cause**:
@@ -1812,7 +2815,7 @@ ${incident.remediationNotes || "No remediation notes provided."}
         return URL.fromString(dashboardUrl.toString()).addRoute(`/${projectId.toString()}/incidents/${incidentId.toString()}`);
     }
     async onUpdateSuccess(onUpdate, updatedItemIds) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d;
         CustomFieldMappingService.restampAfterMultiRowUpdate({
             definitionModelType: IncidentCustomField,
             updateBy: onUpdate.updateBy,
@@ -2241,8 +3244,6 @@ ${incidentSeverity.name}
                                     isRoot: true,
                                 },
                             });
-                            // change these monitors back to operational state.
-                            await this.markMonitorsActiveForMonitoring(projectId, incidentCarryForward.monitorsRemoved);
                             feedInfoInMarkdown += `\n\n**🗑️ Monitors Removed**:\n`;
                             for (const monitor of monitorsRemoved) {
                                 feedInfoInMarkdown += `- [${monitor.name}](${(await MonitorService.getMonitorLinkInDashboard(projectId, monitor.id)).toString()})\n`;
@@ -2273,8 +3274,23 @@ ${incidentSeverity.name}
                             }
                             shouldAddIncidentFeed = true;
                         }
+                        const statusPageScopeMarkdown = await this.getStatusPageScopeFeedMarkdown({
+                            projectId: projectId,
+                            incidentId: incidentId,
+                            change: incidentCarryForward.statusPageScopeChange,
+                        });
+                        if (statusPageScopeMarkdown) {
+                            feedInfoInMarkdown += statusPageScopeMarkdown;
+                            shouldAddIncidentFeed = true;
+                        }
+                        await this.requeueCreatedNotificationIfAddedPagesWereMissed({
+                            incidentId: incidentId,
+                            change: incidentCarryForward.statusPageScopeChange,
+                        });
+                        // Saving the status the incident already had changes nothing.
                         if (incidentCarryForward.oldChangeMonitorStatusIdTo &&
-                            incidentCarryForward.newMonitorChangeStatusIdTo) {
+                            incidentCarryForward.newMonitorChangeStatusIdTo &&
+                            this.isMonitorStatusChangedByUpdate(incidentCarryForward)) {
                             const oldMonitorStatus = await MonitorStatusService.findOneBy({
                                 query: {
                                     _id: incidentCarryForward.oldChangeMonitorStatusIdTo,
@@ -2302,33 +3318,13 @@ ${incidentSeverity.name}
                                 shouldAddIncidentFeed = true;
                             }
                         }
-                        const changeNewMonitorStatusTo = incidentCarryForward.newMonitorChangeStatusIdTo ||
-                            incidentCarryForward.oldChangeMonitorStatusIdTo;
-                        if (((_e = incidentCarryForward.monitorsAdded) === null || _e === void 0 ? void 0 : _e.length) > 0) {
-                            await this.disableActiveMonitoringIfManualIncident(incidentId);
-                        }
-                        if (changeNewMonitorStatusTo) {
-                            const incident = await this.findOneById({
-                                id: incidentId,
-                                select: {
-                                    projectId: true,
-                                    monitors: {
-                                        _id: true,
-                                    },
-                                },
-                                props: {
-                                    isRoot: true,
-                                },
-                            });
-                            const monitorsForThisIncident = (incident === null || incident === void 0 ? void 0 : incident.monitors) || [];
-                            await MonitorService.changeMonitorStatus(projectId, monitorsForThisIncident.map((monitor) => {
-                                var _a;
-                                return new ObjectID(((_a = monitor._id) === null || _a === void 0 ? void 0 : _a.toString()) || "");
-                            }), changeNewMonitorStatusTo, true, // notifyMonitorOwners
-                            "Status was changed because Incident " +
-                                incidentNumberDisplay +
-                                " was updated.", undefined, onUpdate.updateBy.props);
-                        }
+                        await this.updateMonitorsForIncidentEdit({
+                            projectId: projectId,
+                            incidentId: incidentId,
+                            incidentNumberDisplay: incidentNumberDisplay,
+                            carryForward: incidentCarryForward,
+                            props: onUpdate.updateBy.props,
+                        });
                     }
                 }
                 if (shouldAddIncidentFeed) {
@@ -2348,6 +3344,189 @@ ${incidentSeverity.name}
         }
         return onUpdate;
     }
+    /*
+     * Whether an update puts the incident's monitors in a different status
+     * from the one it held: it writes a status, and not the same one again.
+     */
+    isMonitorStatusChangedByUpdate(carryForward) {
+        var _a;
+        if (!carryForward.newMonitorChangeStatusIdTo) {
+            return false;
+        }
+        return (carryForward.newMonitorChangeStatusIdTo.toString().toLowerCase() !==
+            (((_a = carryForward.oldChangeMonitorStatusIdTo) === null || _a === void 0 ? void 0 : _a.toString()) || "").toLowerCase());
+    }
+    /*
+     * What an edit of an incident's monitors, or of the status it puts them
+     * in, does to the monitors themselves. The feed item records the edit
+     * either way; this only decides which monitors change.
+     *
+     * The monitors taken off the incident are restored, unless another open
+     * incident still holds them (markMonitorsActiveForMonitoring), when the
+     * incident was open before the update. That includes an update that
+     * resolves it as well: resolving restores only the monitors it still
+     * holds (IncidentStateTimelineService), so this is the only restore the
+     * ones taken off get. A monitor taken off an incident that was resolved
+     * already was restored when it resolved, and restoring it again could
+     * overwrite a status set since (maintenance, or a manual monitor's status
+     * set by hand).
+     *
+     * A resolved incident, as it stands after the update, does nothing else
+     * to its monitors. Nothing would clear what it did: an added monitor of a
+     * manual incident would never be probed again, and the incident's status
+     * would sit on its monitors as false downtime.
+     *
+     * An open incident:
+     * - stops probing the monitors of a manual incident when one is added,
+     *   as creating it did (disableActiveMonitoringIfManualIncident);
+     * - puts the monitors added in its status, and all of its monitors only
+     *   when the edit changes that status. Every save used to put all of them
+     *   in it again, overwriting a status a probe had set since.
+     */
+    async updateMonitorsForIncidentEdit(data) {
+        const carryForward = data.carryForward;
+        if (carryForward.monitorsRemoved.length > 0 &&
+            !carryForward.isResolvedBeforeUpdate) {
+            // change these monitors back to operational state.
+            await this.markMonitorsActiveForMonitoring(data.projectId, carryForward.monitorsRemoved);
+        }
+        const isMonitorStatusChanged = this.isMonitorStatusChangedByUpdate(carryForward);
+        if (carryForward.monitorsAdded.length === 0 && !isMonitorStatusChanged) {
+            return;
+        }
+        /*
+         * Read after the update is written, so an edit that resolves the
+         * incident as well counts as resolved: changing the state restored the
+         * monitors it holds, the added ones included.
+         */
+        if (await this.isIncidentResolved({ incidentId: data.incidentId })) {
+            return;
+        }
+        if (carryForward.monitorsAdded.length > 0) {
+            await this.disableActiveMonitoringIfManualIncident(data.incidentId);
+        }
+        // The status the incident puts its monitors in after the update.
+        const monitorStatusIdToApply = carryForward.isChangeMonitorStatusToCleared
+            ? undefined
+            : carryForward.newMonitorChangeStatusIdTo ||
+                carryForward.oldChangeMonitorStatusIdTo;
+        if (!monitorStatusIdToApply ||
+            (!isMonitorStatusChanged && carryForward.monitorsAdded.length === 0)) {
+            return;
+        }
+        const addedMonitorIds = carryForward.monitorsAdded.map((monitor) => {
+            return this.getMonitorIdForComparison(monitor);
+        });
+        /*
+         * The monitors the incident holds now, so a status is only ever put on
+         * a monitor the update left on it.
+         */
+        const incident = await this.findOneById({
+            id: data.incidentId,
+            select: {
+                monitors: {
+                    _id: true,
+                },
+            },
+            props: {
+                isRoot: true,
+            },
+        });
+        const monitorIdsToChange = ((incident === null || incident === void 0 ? void 0 : incident.monitors) || [])
+            .filter((monitor) => {
+            return (isMonitorStatusChanged ||
+                addedMonitorIds.includes(this.getMonitorIdForComparison(monitor)));
+        })
+            .map((monitor) => {
+            var _a;
+            return new ObjectID(((_a = monitor._id) === null || _a === void 0 ? void 0 : _a.toString()) || "");
+        });
+        if (monitorIdsToChange.length === 0) {
+            return;
+        }
+        await MonitorService.changeMonitorStatus(data.projectId, monitorIdsToChange, monitorStatusIdToApply, true, // notifyMonitorOwners
+        "Status was changed because Incident " +
+            data.incidentNumberDisplay +
+            " was updated.", undefined, data.props);
+    }
+    /*
+     * The part of an update's feed item that records a change of the status
+     * pages the incident is limited to: the pages added and removed, whether
+     * the incident is now limited at all, and whether the added pages will be
+     * sent the 'created' notification. Empty when the scope did not change.
+     *
+     * Page names are read as root, like the monitor names above. The pages were
+     * validated as this project's when they were written, and the read is
+     * filtered on the project anyway. Never throws: the update is already
+     * written, and a missing line in the feed must not turn it into an error.
+     */
+    async getStatusPageScopeFeedMarkdown(data) {
+        var _a, _b;
+        const change = data.change;
+        if (!change ||
+            (change.addedStatusPageIds.length === 0 &&
+                change.removedStatusPageIds.length === 0)) {
+            return "";
+        }
+        try {
+            const statusPages = await StatusPageService.findBy({
+                query: {
+                    _id: QueryHelper.any([
+                        ...change.addedStatusPageIds,
+                        ...change.removedStatusPageIds,
+                    ]),
+                    projectId: data.projectId,
+                },
+                select: {
+                    _id: true,
+                    name: true,
+                },
+                limit: LIMIT_MAX,
+                skip: 0,
+                props: {
+                    isRoot: true,
+                },
+            });
+            const statusPageLines = async (ids) => {
+                let lines = "";
+                for (const id of ids) {
+                    const statusPage = statusPages.find((page) => {
+                        var _a;
+                        return ((_a = page.id) === null || _a === void 0 ? void 0 : _a.toString().toLowerCase()) === id;
+                    });
+                    if (!statusPage) {
+                        // Deleted since: its name is gone with it.
+                        lines += `- A deleted status page\n`;
+                        continue;
+                    }
+                    // A page name is free text: kept from turning into a link or an image.
+                    lines += `- [${escapeMarkdownInline(statusPage.name || "Untitled status page")}](${(await StatusPageService.getStatusPageLinkInDashboard(data.projectId, statusPage.id)).toString()})\n`;
+                }
+                return lines;
+            };
+            let markdown = "";
+            if (change.addedStatusPageIds.length > 0) {
+                markdown += `\n\n**📣 Status Pages Added**:\n${await statusPageLines(change.addedStatusPageIds)}`;
+            }
+            if (change.removedStatusPageIds.length > 0) {
+                markdown += `\n\n**🔕 Status Pages Removed**:\n${await statusPageLines(change.removedStatusPageIds)}`;
+            }
+            markdown += change.isScoped
+                ? `\n\nThis incident is shown on, and notifies the subscribers of, only its selected status pages that list its monitors.\n`
+                : `\n\nThis incident is no longer limited to specific status pages: it is shown on every status page that lists its monitors, except pages that only show incidents limited to them.\n`;
+            if (change.notificationQueued) {
+                markdown += `\nSubscribers of the added status pages will be sent the notification that this incident was created.\n`;
+            }
+            return markdown;
+        }
+        catch (err) {
+            logger.error(`Failed to describe the status page scope change in the incident feed: ${err}`, {
+                projectId: (_a = data.projectId) === null || _a === void 0 ? void 0 : _a.toString(),
+                incidentId: (_b = data.incidentId) === null || _b === void 0 ? void 0 : _b.toString(),
+            });
+            return "";
+        }
+    }
     async doesMonitorHasMoreActiveManualIncidents(monitorId, proojectId) {
         const resolvedState = await IncidentStateService.findOneBy({
             query: {