[ebariaux]

Alarm rules could create or extend alarms outside their asset scope and assign users without validating access. Global rules also failed because creation and linking required an engine realm.

This PR adds validation before alarms or links are persisted:

• Asset-scoped rules may target only the scoped asset or its descendants. Creation requires targets; linking requires existing links, with every existing and requested asset in scope.
• Assignees remain optional and must belong to the alarm’s realm. Restricted assignees need explicit links to every target; unrestricted assignees need no asset links.
• Global creation uses the supplied realm or infers it from targets, validating all targets against that realm. Global linking uses the existing alarm’s realm. Reusable global alarm definitions are preserved.
• Automatic notifications for unassigned HIGH alarms exclude restricted users without access to every linked asset, including alarms without asset links.
• Rejected requests leave alarms and links unchanged. Existing validation errors, duplicate-link handling, and link timestamps are preserved.

Part of the rules facade scoping review tracked in #2675.

[wborn]

This is an initial AI-assisted review.

The scope validation and expanded integration tests provide good coverage of the intended behavior.

One concern remains: synchronous Keycloak role lookups during automatic alarm notification processing introduce an external dependency that can cause alarm creation to fail after the alarm has already been persisted. This should be addressed before merging.

[wborn]

Thanks for addressing the previous review feedback. The database-backed notification recipient queries are a good improvement, avoiding repeated Keycloak Admin API calls.

The realm and asset scoping validation looks sound, including restricted assignee handling, validation of existing asset links, and global ruleset support. The additional tests also provide good coverage.

The composite-role limitation of UserQuery is now tracked in #3524. I've left one non-blocking suggestion for extending that issue to cover a future improvement to assignee validation.

No further blocking issues found.

This review was AI-assisted.

AI found no further blocking issues.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud