@oneuptime/common 14.0.8 → 14.0.9

package/build/dist/Server/Services/TeamComplianceSettingService.js

@@ -7,32 +7,840 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
 var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
+import AlertSeverityService from "./AlertSeverityService";
 import DatabaseService from "./DatabaseService";
+import IncidentSeverityService from "./IncidentSeverityService";
+import AlertSeverity from "../../Models/DatabaseModels/AlertSeverity";
+import IncidentSeverity from "../../Models/DatabaseModels/IncidentSeverity";
 import Model from "../../Models/DatabaseModels/TeamComplianceSetting";
+import ModelPermission from "../Types/Database/Permissions/Index";
+import QueryHelper from "../Types/Database/QueryHelper";
+import Includes from "../../Types/BaseDatabase/Includes";
+import { LIMIT_PER_PROJECT } from "../../Types/Database/LimitMax";
 import BadDataException from "../../Types/Exception/BadDataException";
+import ObjectID from "../../Types/ObjectID";
+import ComplianceRule, { ComplianceSeverityKind, } from "../../Types/Team/ComplianceRule";
+import ComplianceRuleType from "../../Types/Team/ComplianceRuleType";
 import CaptureSpan from "../Utils/Telemetry/CaptureSpan";
+export const DUPLICATE_COMPLIANCE_RULE_MESSAGE = "This team already has a compliance rule that checks exactly the same thing. Edit that rule instead of adding another.";
+/*
+ * The key a severity delete sets to true in TeamComplianceSetting.options on
+ * a rule it left with none of the severities it was scoped to (see SEVERITY
+ * DELETES below). Such a rule checks nothing until an admin picks new
+ * severities: it is paused, it cannot be turned back on as it is, it is no
+ * duplicate of anything, and the compliance page says why. Any update that
+ * changes the rule's scope removes the key.
+ */
+export const SEVERITIES_DELETED_OPTION = "severitiesDeleted";
+export const SEVERITIES_DELETED_ENABLE_MESSAGE = "Every severity this rule was scoped to has been deleted. Edit the rule to choose new severities before turning it back on.";
+export const OPTIONS_DIFFER_MESSAGE = "These compliance rules carry different options, so their scope cannot be changed in one update. Update them one at a time.";
+/*
+ * The two severity relations, and the model each one's items are written as.
+ * Every list a payload carries for them is rewritten through
+ * normaliseSeverityLists before anything is checked.
+ */
+const SEVERITY_LISTS = [
+    {
+        key: "incidentSeverities",
+        kind: ComplianceSeverityKind.Incident,
+        buildItem: (id) => {
+            const severity = new IncidentSeverity();
+            severity._id = id;
+            return severity;
+        },
+    },
+    {
+        key: "alertSeverities",
+        kind: ComplianceSeverityKind.Alert,
+        buildItem: (id) => {
+            const severity = new AlertSeverity();
+            severity._id = id;
+            return severity;
+        },
+    },
+];
 export class TeamComplianceSettingService extends DatabaseService {
     constructor() {
         super(Model);
     }
     async onBeforeCreate(createBy) {
-        // Check if a compliance setting with the same teamId and ruleType already exists
-        const existingSetting = await this.findOneBy({
+        /*
+         * Authorisation first. DatabaseService.create only checks the caller's
+         * create permission AFTER this hook, and every check below reads as root
+         * in the project the request names - which a caller picks with a header,
+         * member of that project or not. Answering "that severity is not in this
+         * project" or "that team already has this rule" before the permission
+         * refusal would describe another project's severities and rules to
+         * anyone signed in. The columns this hook clears later carry the same
+         * create permissions, so the check DatabaseService repeats still passes.
+         */
+        if (!createBy.props.isRoot && !createBy.props.isMasterAdmin) {
+            ModelPermission.checkCreatePermissions(this.modelType, createBy.data, createBy.props);
+        }
+        const ruleType = this.assertKnownRuleType(createBy.data.ruleType);
+        this.assertValidChannel(createBy.data.notificationChannel);
+        /*
+         * Normalise before anything is stored: a method rule carries no channel
+         * or severities, and an incident rule carries no alert severities. The
+         * form hides the fields that do not apply, but the API accepts whatever it
+         * is sent, and a stray alert severity on an incident rule would otherwise
+         * sit in the database looking like part of the rule.
+         */
+        this.clearOptionsThatDoNotApply(createBy.data, ruleType, {
+            clearUnsentOptions: false,
+        });
+        TeamComplianceSettingService.normaliseSeverityLists(createBy.data);
+        const projectId = createBy.data.projectId || createBy.props.tenantId;
+        if (!projectId) {
+            throw new BadDataException("Project ID is required.");
+        }
+        if (!createBy.data.teamId) {
+            throw new BadDataException("Team ID is required.");
+        }
+        const scope = TeamComplianceSettingService.getScope({
+            ruleType: ruleType,
+            notificationChannel: createBy.data.notificationChannel,
+            incidentSeverities: createBy.data.incidentSeverities,
+            alertSeverities: createBy.data.alertSeverities,
+        });
+        await this.assertSeveritiesBelongToProject(projectId, scope);
+        await this.assertNoIdenticalRule({
+            teamId: createBy.data.teamId,
+            projectId: projectId,
+            scope: scope,
+            excludeSettingId: undefined,
+        });
+        return { createBy, carryForward: null };
+    }
+    /*
+     * Toggling a rule on or off touches none of the fields that define it, so a
+     * disable returns before reading anything: it must never fail because of
+     * the rule's configuration. Turning a rule ON reads one thing - whether a
+     * severity delete left it with nothing to check (SEVERITIES_DELETED_OPTION)
+     * - because turning such a rule on as it is would make it check every
+     * severity of its kind, a rule nobody wrote.
+     */
+    async onBeforeUpdate(updateBy) {
+        const data = updateBy.data;
+        const changesScope = data["ruleType"] !== undefined ||
+            data["notificationChannel"] !== undefined ||
+            data["incidentSeverities"] !== undefined ||
+            data["alertSeverities"] !== undefined;
+        if (!changesScope) {
+            if (data["enabled"] === true) {
+                await this.assertNoRuleLeftWithoutSeveritiesIsTurnedOn(updateBy);
+            }
+            return { updateBy, carryForward: null };
+        }
+        /*
+         * As on create: _updateBy checks the caller's update permission only
+         * after this hook, and updateBy / updateOneBy do not check it before. The
+         * reads below are scoped to the caller's project, but that project is
+         * whatever the request named, so a caller who may not change rules there
+         * is refused before any of them can answer.
+         */
+        if (!updateBy.props.isRoot && !updateBy.props.isMasterAdmin) {
+            await this.assertMayUpdate(updateBy);
+        }
+        const newRuleType = data["ruleType"] !== undefined
+            ? this.assertKnownRuleType(data["ruleType"])
+            : undefined;
+        this.assertValidChannel(data["notificationChannel"]);
+        if (newRuleType) {
+            /*
+             * A new type makes the row's STORED options stale too, not only the ones
+             * this update sends: switching "Call for Critical incidents" to
+             * "Verified email" must not leave Call and Critical on the row, to come
+             * back as the scope if the type is ever switched again.
+             */
+            this.clearOptionsThatDoNotApply(data, newRuleType, {
+                clearUnsentOptions: true,
+            });
+        }
+        /*
+         * The rows being changed, read to work out what each will check once the
+         * update lands. Scoped to the caller's project when there is one, so the
+         * rows of another project are never checked, let alone described.
+         */
+        const existingSettings = await this.findBy({
+            query: TeamComplianceSettingService.getTargetQuery(updateBy),
+            select: {
+                _id: true,
+                teamId: true,
+                projectId: true,
+                ruleType: true,
+                notificationChannel: true,
+                options: true,
+                incidentSeverities: {
+                    _id: true,
+                },
+                alertSeverities: {
+                    _id: true,
+                },
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        if (!newRuleType) {
+            /*
+             * The type stays, so drop whatever this update sends that the type does
+             * not use - as create does - rather than store alert severities on an
+             * incident rule unvalidated. Only when every row being updated has the
+             * same type, because `data` is written to all of them.
+             */
+            const storedRuleTypes = new Set();
+            for (const existing of existingSettings) {
+                if (ComplianceRule.isKnownRuleType(existing.ruleType)) {
+                    storedRuleTypes.add(existing.ruleType);
+                }
+            }
+            const storedRuleType = Array.from(storedRuleTypes)[0];
+            if (storedRuleTypes.size === 1 && storedRuleType) {
+                this.clearOptionsThatDoNotApply(data, storedRuleType, {
+                    clearUnsentOptions: false,
+                });
+            }
+        }
+        /*
+         * `data` is written to every row the update matches, so the lists it
+         * sends are normalised once, here, and each row below is checked against
+         * exactly what will be written to it.
+         */
+        TeamComplianceSettingService.normaliseSeverityLists(data);
+        /*
+         * Every list this update sends is written to every row it matches, so it
+         * is checked against the project of every one of those rows - by the
+         * list's own kind, not by the row's type. A row whose stored type this
+         * build does not recognise (legacy data, or written by a newer build) is
+         * skipped by the scope checks below, and the relation save would
+         * otherwise link it to another project's severity unchecked.
+         */
+        const projectIds = new Map();
+        for (const existing of existingSettings) {
+            if (existing.projectId) {
+                projectIds.set(existing.projectId.toString(), existing.projectId);
+            }
+        }
+        for (const projectId of projectIds.values()) {
+            for (const list of SEVERITY_LISTS) {
+                if (data[list.key] === undefined) {
+                    continue;
+                }
+                await this.assertSeveritiesBelongToProject(projectId, {
+                    severityKind: list.kind,
+                    severityIds: TeamComplianceSettingService.getIds(data[list.key]),
+                });
+            }
+        }
+        for (const existing of existingSettings) {
+            const ruleType = newRuleType ||
+                (ComplianceRule.isKnownRuleType(existing.ruleType)
+                    ? existing.ruleType
+                    : undefined);
+            if (!ruleType || !existing.teamId || !existing.projectId) {
+                continue;
+            }
+            const scope = TeamComplianceSettingService.getScope({
+                ruleType: ruleType,
+                notificationChannel: data["notificationChannel"] !== undefined
+                    ? data["notificationChannel"]
+                    : existing.notificationChannel,
+                incidentSeverities: data["incidentSeverities"] !== undefined
+                    ? data["incidentSeverities"]
+                    : existing.incidentSeverities,
+                alertSeverities: data["alertSeverities"] !== undefined
+                    ? data["alertSeverities"]
+                    : existing.alertSeverities,
+            });
+            /*
+             * A list this update sends was checked above; one it keeps is the
+             * stored list, re-checked here because a type change can make a list
+             * the rule did not use until now its scope.
+             */
+            const isScopeListSent = SEVERITY_LISTS.some((list) => {
+                return (list.kind === scope.severityKind && data[list.key] !== undefined);
+            });
+            if (!isScopeListSent) {
+                await this.assertSeveritiesBelongToProject(existing.projectId, scope);
+            }
+            await this.assertNoIdenticalRule({
+                teamId: existing.teamId,
+                projectId: existing.projectId,
+                scope: scope,
+                excludeSettingId: existing.id || undefined,
+            });
+        }
+        /*
+         * The admin has chosen what the rule checks now - new severities, or
+         * deliberately every severity - so a rule a severity delete left empty
+         * is an ordinary rule again, in the same write.
+         */
+        TeamComplianceSettingService.clearSeveritiesDeletedMark(data, existingSettings);
+        return { updateBy, carryForward: null };
+    }
+    /*
+     * An update that turns a rule on without re-scoping it is refused when a
+     * severity delete left the rule with nothing to check: turned on as it is,
+     * it would check every severity of its kind. The caller's permission is
+     * checked first, as for a scope change, so the refusal describes nothing
+     * to a caller who may not change the rule.
+     */
+    async assertNoRuleLeftWithoutSeveritiesIsTurnedOn(updateBy) {
+        if (!updateBy.props.isRoot && !updateBy.props.isMasterAdmin) {
+            await this.assertMayUpdate(updateBy);
+        }
+        const rules = await this.findBy({
+            query: TeamComplianceSettingService.getTargetQuery(updateBy),
+            select: {
+                _id: true,
+                ruleType: true,
+                options: true,
+                incidentSeverities: {
+                    _id: true,
+                },
+                alertSeverities: {
+                    _id: true,
+                },
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
+            },
+        });
+        if (rules.some((rule) => {
+            return TeamComplianceSettingService.isLeftWithoutSeverities(rule);
+        })) {
+            throw new BadDataException(SEVERITIES_DELETED_ENABLE_MESSAGE);
+        }
+    }
+    /*
+     * The update's own query, narrowed to the caller's project when there is
+     * one - a copy, so the caller's query object is left as it was.
+     */
+    static getTargetQuery(updateBy) {
+        const query = Object.assign({}, updateBy.query);
+        if (updateBy.props.tenantId) {
+            query["projectId"] = updateBy.props.tenantId;
+        }
+        return query;
+    }
+    /*
+     * True when TeamComplianceSetting.options carries SEVERITIES_DELETED_OPTION.
+     * Exported for the compliance status, which lists such a rule as paused
+     * with nothing to check.
+     */
+    static hasSeveritiesDeletedMark(options) {
+        return (TeamComplianceSettingService.isPlainObject(options) &&
+            options[SEVERITIES_DELETED_OPTION] === true);
+    }
+    /*
+     * A rule a severity delete left with nothing to check: marked, of a type
+     * scoped by severity, and still without a severity of its kind. A mark on a
+     * rule that has severities again - it lost a race with a re-scope - is
+     * stale, and the rule is judged by the severities it has.
+     */
+    static isLeftWithoutSeverities(rule) {
+        const kind = ComplianceRule.getSeverityKind(rule.ruleType);
+        return (Boolean(kind) &&
+            TeamComplianceSettingService.hasSeveritiesDeletedMark(rule.options) &&
+            TeamComplianceSettingService.getSeverityIdsOfKind(rule, kind).length ===
+                0);
+    }
+    /*
+     * Writes `options` without SEVERITIES_DELETED_OPTION, keeping every other
+     * key: the options sent with the update when it sends any, else the
+     * options stored on the rows it changes. `data` is written to every row
+     * the update matches, so stored options are only rewritten when those rows
+     * agree on them - otherwise one row's options would overwrite another's.
+     */
+    static clearSeveritiesDeletedMark(data, existingSettings) {
+        var _a, _b;
+        if (data["options"] !== undefined) {
+            if (TeamComplianceSettingService.isPlainObject(data["options"]) &&
+                SEVERITIES_DELETED_OPTION in data["options"]) {
+                data["options"] = TeamComplianceSettingService.withoutMark(data["options"]);
+            }
+            return;
+        }
+        const isAnyMarked = existingSettings.some((existing) => {
+            return TeamComplianceSettingService.hasSeveritiesDeletedMark(existing.options);
+        });
+        if (!isAnyMarked) {
+            return;
+        }
+        const cleared = existingSettings.map((existing) => {
+            return TeamComplianceSettingService.isPlainObject(existing.options)
+                ? TeamComplianceSettingService.withoutMark(existing.options)
+                : null;
+        });
+        const first = JSON.stringify((_a = cleared[0]) !== null && _a !== void 0 ? _a : null);
+        if (cleared.some((options) => {
+            return JSON.stringify(options) !== first;
+        })) {
+            throw new BadDataException(OPTIONS_DIFFER_MESSAGE);
+        }
+        data["options"] = (_b = cleared[0]) !== null && _b !== void 0 ? _b : null;
+    }
+    // A copy of `options` without the mark; null when nothing else is left.
+    static withoutMark(options) {
+        const rest = Object.assign({}, options);
+        delete rest[SEVERITIES_DELETED_OPTION];
+        return Object.keys(rest).length > 0 ? rest : null;
+    }
+    static isPlainObject(value) {
+        return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+    }
+    /*
+     * SEVERITY DELETES. A rule's severity scope is stored only as join rows,
+     * and those cascade away with the severity. A rule left with no severity
+     * reads exactly like one created for every severity of its kind, so
+     * deleting the only severity "Call for Critical incidents" was scoped to
+     * would quietly turn it into "Call for every incident severity" - failing
+     * members against a rule nobody wrote.
+     *
+     * The severity services therefore ask, before the delete and while the join
+     * rows still say what each rule was scoped to, which rules reference any of
+     * the severities about to go (getRulesScopedToAnyOf), and once the delete
+     * has actually happened they have those that were left with none paused
+     * and marked (pauseRulesLeftWithoutSeverities, SEVERITIES_DELETED_OPTION).
+     * The Compliance page lists a marked rule as having lost its severities,
+     * for an admin to re-scope or delete; it cannot be turned back on as it is.
+     * Pausing only after the delete means a delete that is refused - by the
+     * permission layer, or because incidents still use the severity - pauses
+     * nothing.
+     *
+     * ANY reference is carried forward, not only rules scoped to nothing but
+     * the severities this delete removes: two deletes running side by side -
+     * the two severities of a "Critical and Major" rule, deleted by Terraform
+     * in parallel - each see the other's severity still attached before
+     * either commits, so neither would carry the rule, and it would be left
+     * scoped to nothing and checking everything. Each request re-reads after
+     * its own delete has committed, so whichever commits last sees the rule
+     * empty and pauses it. A rule that still has another severity is left
+     * alone by the re-read.
+     *
+     * Paused rules are carried too: turning one on later must not make it
+     * check every severity either.
+     */
+    async getRulesScopedToAnyOf(data) {
+        var _a, _b;
+        const deletedIdsByProject = new Map();
+        for (const severity of data.severities) {
+            const id = (_a = severity._id) === null || _a === void 0 ? void 0 : _a.toString().toLowerCase();
+            const projectId = (_b = severity.projectId) === null || _b === void 0 ? void 0 : _b.toString();
+            if (!id || !projectId) {
+                continue;
+            }
+            const ids = deletedIdsByProject.get(projectId) || new Set();
+            ids.add(id);
+            deletedIdsByProject.set(projectId, ids);
+        }
+        const ruleTypes = Object.values(ComplianceRuleType).filter((ruleType) => {
+            return ComplianceRule.getSeverityKind(ruleType) === data.severityKind;
+        });
+        const settingIds = [];
+        for (const [projectId, deletedIds] of deletedIdsByProject) {
+            const rules = await this.findBy({
+                query: {
+                    projectId: new ObjectID(projectId),
+                    ruleType: new Includes(ruleTypes),
+                },
+                select: {
+                    _id: true,
+                    ruleType: true,
+                    incidentSeverities: {
+                        _id: true,
+                    },
+                    alertSeverities: {
+                        _id: true,
+                    },
+                },
+                limit: LIMIT_PER_PROJECT,
+                skip: 0,
+                props: {
+                    isRoot: true,
+                },
+            });
+            for (const rule of rules) {
+                if (rule._id &&
+                    ComplianceRule.getSeverityKind(rule.ruleType) === data.severityKind &&
+                    TeamComplianceSettingService.getSeverityIdsOfKind(rule, data.severityKind).some((id) => {
+                        return deletedIds.has(id);
+                    })) {
+                    settingIds.push(rule._id.toString());
+                }
+            }
+        }
+        return settingIds;
+    }
+    /*
+     * The second half of a severity delete: of the rules getRulesScopedToAnyOf
+     * named, pause and mark (SEVERITIES_DELETED_OPTION) the ones now left with
+     * no severity of their kind, in one write per rule's own options so every
+     * other key they hold is kept. Re-read rather than assumed, so a rule
+     * whose severity survived (the delete matched fewer rows than the lookup
+     * did, another of its severities is still there, or it was re-scoped in the
+     * meantime) stays as it is.
+     */
+    async pauseRulesLeftWithoutSeverities(data) {
+        if (data.settingIds.length === 0) {
+            return [];
+        }
+        const rules = await this.findBy({
             query: {
-                teamId: createBy.data.teamId,
-                ruleType: createBy.data.ruleType,
+                _id: new Includes(data.settingIds),
+            },
+            select: {
+                _id: true,
+                ruleType: true,
+                enabled: true,
+                options: true,
+                incidentSeverities: {
+                    _id: true,
+                },
+                alertSeverities: {
+                    _id: true,
+                },
             },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
             props: {
                 isRoot: true,
             },
+        });
+        // Rule ids by the options they are written with, marked.
+        const toPause = new Map();
+        const paused = [];
+        for (const rule of rules) {
+            if (!rule._id ||
+                ComplianceRule.getSeverityKind(rule.ruleType) !== data.severityKind ||
+                TeamComplianceSettingService.getSeverityIdsOfKind(rule, data.severityKind).length > 0) {
+                continue;
+            }
+            const isAlreadyPausedAndMarked = rule.enabled === false &&
+                TeamComplianceSettingService.hasSeveritiesDeletedMark(rule.options);
+            if (isAlreadyPausedAndMarked) {
+                continue;
+            }
+            const options = Object.assign(Object.assign({}, (TeamComplianceSettingService.isPlainObject(rule.options)
+                ? rule.options
+                : {})), { [SEVERITIES_DELETED_OPTION]: true });
+            const key = JSON.stringify(options);
+            const group = toPause.get(key) || { options: options, ids: [] };
+            group.ids.push(rule._id.toString());
+            toPause.set(key, group);
+            paused.push(rule._id.toString());
+        }
+        for (const group of toPause.values()) {
+            /*
+             * Neither the type, the channel nor a severity list: the update hook
+             * reads nothing for it. (Cast: the write type of a JSON column is too
+             * deep for the compiler to spell out.)
+             */
+            const pause = {
+                enabled: false,
+                options: group.options,
+            };
+            await this.updateBy({
+                query: {
+                    _id: new Includes(group.ids),
+                },
+                data: pause,
+                limit: group.ids.length,
+                skip: 0,
+                props: {
+                    isRoot: true,
+                },
+            });
+        }
+        return paused;
+    }
+    /*
+     * What a rule checks, from its stored (or about-to-be-stored) fields. Only
+     * the options its type uses count: a channel on a method rule, or alert
+     * severities on an incident rule, change nothing about what is checked.
+     */
+    static getScope(data) {
+        const severityKind = ComplianceRule.getSeverityKind(data.ruleType);
+        const notificationChannel = ComplianceRule.supportsChannel(data.ruleType) &&
+            ComplianceRule.isKnownChannel(data.notificationChannel)
+            ? data.notificationChannel
+            : null;
+        let severityIds = [];
+        if (severityKind === ComplianceSeverityKind.Incident) {
+            severityIds = TeamComplianceSettingService.getIds(data.incidentSeverities);
+        }
+        else if (severityKind === ComplianceSeverityKind.Alert) {
+            severityIds = TeamComplianceSettingService.getIds(data.alertSeverities);
+        }
+        return {
+            ruleType: data.ruleType,
+            notificationChannel: notificationChannel,
+            severityKind: severityKind || null,
+            severityIds: severityIds,
+        };
+    }
+    static isSameScope(a, b) {
+        return (a.ruleType === b.ruleType &&
+            a.notificationChannel === b.notificationChannel &&
+            a.severityIds.join(",") === b.severityIds.join(","));
+    }
+    /*
+     * Severity ids from a severity list as it is STORED (or once a payload has
+     * been through normaliseSeverityLists): an id string, an ObjectID, a model,
+     * or `{_id}` / `{id}` JSON. Sorted and de-duplicated so two lists compare by
+     * content, and lower-cased because Postgres compares uuids without case and
+     * hands them back lower case: "ABC..." sent by a client is the stored
+     * "abc...", and must not slip past the duplicate check as a different id.
+     *
+     * Lenient on purpose - an unreadable item is skipped - so it is NOT the
+     * reader for a payload: what the relation save writes is decided by
+     * DatabaseService.sanitizeCreateOrUpdate, and resolveSentSeverityIds reads
+     * a payload exactly the way that does.
+     */
+    static getIds(value) {
+        if (!Array.isArray(value)) {
+            return [];
+        }
+        const ids = new Set();
+        for (const item of value) {
+            let id = undefined;
+            if (typeof item === "string") {
+                id = item;
+            }
+            else if (item instanceof ObjectID) {
+                id = item.toString();
+            }
+            else if (item && typeof item === "object") {
+                const candidate = item["_id"] || item["id"];
+                if (typeof candidate === "string") {
+                    id = candidate;
+                }
+                else if (candidate instanceof ObjectID) {
+                    id = candidate.toString();
+                }
+            }
+            if (id && id.trim()) {
+                ids.add(id.trim().toLowerCase());
+            }
+        }
+        return Array.from(ids).sort();
+    }
+    /*
+     * The severity ids a SENT list asks the relation save to write, read item
+     * by item with exactly the precedence DatabaseService.sanitizeCreateOrUpdate
+     * uses - an id string or ObjectID, else a string `_id`, else a string `id`,
+     * else a model's own `_id` - so the ids this service validates are the ids
+     * that would be written. An item that yields no valid uuid is refused
+     * rather than skipped: the sanitizer would drop it (or write garbage), and
+     * a list that silently lost its only item is a rule for EVERY severity.
+     *
+     * Trimmed, lower-cased (Postgres hands uuids back lower case, and TypeORM
+     * compares join rows as case-sensitive strings) and de-duplicated (the join
+     * table's primary key refuses the same severity twice), first occurrence
+     * kept. Null is an empty list, as the relation save treats it; anything
+     * else that is not a list is refused.
+     */
+    static resolveSentSeverityIds(value, kind) {
+        if (value === null) {
+            return [];
+        }
+        const noun = kind === ComplianceSeverityKind.Incident ? "incident" : "alert";
+        if (!Array.isArray(value)) {
+            throw new BadDataException(`The ${noun} severities of a compliance rule must be a list of severity ids.`);
+        }
+        const ids = [];
+        for (const item of value) {
+            const id = TeamComplianceSettingService.resolveWrittenId(item);
+            if (id === undefined) {
+                throw new BadDataException(`Every ${noun} severity of a compliance rule must be a severity id.`);
+            }
+            const normalised = id.trim().toLowerCase();
+            ObjectID.validateUUID(normalised);
+            if (!ids.includes(normalised)) {
+                ids.push(normalised);
+            }
+        }
+        return ids;
+    }
+    /*
+     * Replaces each severity list a payload sends with the list
+     * resolveSentSeverityIds read from it, as models carrying only `_id`. From
+     * here on the scope that is validated and compared, and the join rows the
+     * relation save writes, are one and the same list. Lists that are not sent
+     * stay unsent.
+     */
+    static normaliseSeverityLists(data) {
+        const target = data;
+        for (const list of SEVERITY_LISTS) {
+            if (target[list.key] === undefined) {
+                continue;
+            }
+            target[list.key] = TeamComplianceSettingService.resolveSentSeverityIds(target[list.key], list.kind).map((id) => {
+                return list.buildItem(id);
+            });
+        }
+    }
+    // DatabaseService.sanitizeCreateOrUpdate's reading of one EntityArray item.
+    static resolveWrittenId(item) {
+        if (typeof item === "string" || item instanceof ObjectID) {
+            return item.toString();
+        }
+        if (!item || typeof item !== "object") {
+            return undefined;
+        }
+        const json = item;
+        if (json["_id"] && typeof json["_id"] === "string") {
+            return json["_id"];
+        }
+        if (json["id"] && typeof json["id"] === "string") {
+            return json["id"];
+        }
+        /*
+         * A model reaches this line only when its `_id` is empty or not a string,
+         * and the sanitizer writes it as it is - with no id a uuid column takes.
+         */
+        return undefined;
+    }
+    static getSeverityIdsOfKind(rule, kind) {
+        return TeamComplianceSettingService.getIds(kind === ComplianceSeverityKind.Incident
+            ? rule.incidentSeverities
+            : rule.alertSeverities);
+    }
+    /*
+     * The update permission check _updateBy makes after this hook, made first.
+     * It narrows a copy of the query; this hook's own reads add the project
+     * themselves, so only the refusal matters here.
+     */
+    async assertMayUpdate(updateBy) {
+        await ModelPermission.checkUpdateQueryPermissions(this.modelType, Object.assign({}, updateBy.query), updateBy.data, updateBy.props);
+    }
+    assertKnownRuleType(value) {
+        if (!ComplianceRule.isKnownRuleType(value)) {
+            throw new BadDataException(`"${String(value)}" is not a compliance rule type.`);
+        }
+        return value;
+    }
+    // Null / undefined is "any channel" and always valid.
+    assertValidChannel(value) {
+        if (value === undefined || value === null) {
+            return;
+        }
+        if (!ComplianceRule.isKnownChannel(value)) {
+            throw new BadDataException(`"${String(value)}" is not a notification channel a compliance rule can require.`);
+        }
+    }
+    /*
+     * `clearUnsentOptions` also clears the options `data` does not mention, so
+     * an update writes them empty on the row instead of leaving what is stored.
+     */
+    clearOptionsThatDoNotApply(data, ruleType, options) {
+        const target = data;
+        const severityKind = ComplianceRule.getSeverityKind(ruleType);
+        if (!ComplianceRule.supportsChannel(ruleType)) {
+            if (options.clearUnsentOptions ||
+                (target["notificationChannel"] !== undefined &&
+                    target["notificationChannel"] !== null)) {
+                target["notificationChannel"] = null;
+            }
+        }
+        if (severityKind !== ComplianceSeverityKind.Incident &&
+            (options.clearUnsentOptions || target["incidentSeverities"] !== undefined)) {
+            target["incidentSeverities"] = [];
+        }
+        if (severityKind !== ComplianceSeverityKind.Alert &&
+            (options.clearUnsentOptions || target["alertSeverities"] !== undefined)) {
+            target["alertSeverities"] = [];
+        }
+    }
+    /*
+     * The severity relation accepts any id, and the compliance status is read as
+     * root, so a severity from another project would otherwise be stored against
+     * this rule and have its name shown on this project's page.
+     */
+    async assertSeveritiesBelongToProject(projectId, scope) {
+        if (scope.severityIds.length === 0 || !scope.severityKind) {
+            return;
+        }
+        for (const id of scope.severityIds) {
+            ObjectID.validateUUID(id);
+        }
+        const count = scope.severityKind === ComplianceSeverityKind.Incident
+            ? await IncidentSeverityService.countBy({
+                query: {
+                    _id: new Includes(scope.severityIds),
+                    projectId: projectId,
+                },
+                props: {
+                    isRoot: true,
+                },
+            })
+            : await AlertSeverityService.countBy({
+                query: {
+                    _id: new Includes(scope.severityIds),
+                    projectId: projectId,
+                },
+                props: {
+                    isRoot: true,
+                },
+            });
+        if (count.toNumber() !== scope.severityIds.length) {
+            throw new BadDataException(`One or more of the selected ${scope.severityKind === ComplianceSeverityKind.Incident ? "incident" : "alert"} severities do not exist in this project.`);
+        }
+    }
+    async assertNoIdenticalRule(data) {
+        const query = {
+            teamId: data.teamId,
+            projectId: data.projectId,
+            ruleType: data.scope.ruleType,
+        };
+        if (data.excludeSettingId) {
+            query["_id"] = QueryHelper.notEquals(data.excludeSettingId.toString());
+        }
+        const siblings = await this.findBy({
+            query: query,
             select: {
                 _id: true,
+                ruleType: true,
+                notificationChannel: true,
+                options: true,
+                incidentSeverities: {
+                    _id: true,
+                },
+                alertSeverities: {
+                    _id: true,
+                },
+            },
+            limit: LIMIT_PER_PROJECT,
+            skip: 0,
+            props: {
+                isRoot: true,
             },
         });
-        if (existingSetting) {
-            throw new BadDataException(`A compliance setting for rule type "${createBy.data.ruleType}" already exists for this team.`);
+        for (const sibling of siblings) {
+            /*
+             * A rule a severity delete left with nothing to check is stored with
+             * no severities, which is also how a rule for EVERY severity is
+             * stored. It checks nothing and cannot be turned on until it is
+             * re-scoped - when it is compared again - so it duplicates nothing.
+             */
+            if (TeamComplianceSettingService.isLeftWithoutSeverities(sibling)) {
+                continue;
+            }
+            const siblingScope = TeamComplianceSettingService.getScope({
+                ruleType: data.scope.ruleType,
+                notificationChannel: sibling.notificationChannel,
+                incidentSeverities: sibling.incidentSeverities,
+                alertSeverities: sibling.alertSeverities,
+            });
+            if (TeamComplianceSettingService.isSameScope(siblingScope, data.scope)) {
+                throw new BadDataException(DUPLICATE_COMPLIANCE_RULE_MESSAGE);
+            }
         }
-        return { createBy, carryForward: null };
     }
 }
 __decorate([
@@ -41,5 +849,23 @@ __decorate([
     __metadata("design:paramtypes", [Object]),
     __metadata("design:returntype", Promise)
 ], TeamComplianceSettingService.prototype, "onBeforeCreate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], TeamComplianceSettingService.prototype, "onBeforeUpdate", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], TeamComplianceSettingService.prototype, "getRulesScopedToAnyOf", null);
+__decorate([
+    CaptureSpan(),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], TeamComplianceSettingService.prototype, "pauseRulesLeftWithoutSeverities", null);
 export default new TeamComplianceSettingService();
 //# sourceMappingURL=TeamComplianceSettingService.js.map