[ebariaux]

Alarm rules could create or extend alarms outside their asset scope and assign users without validating access. Global rules also failed because creation and linking required an engine realm.

This PR adds validation before alarms or links are persisted:

• Asset-scoped rules may target only the scoped asset or its descendants. Creation requires targets; linking requires existing links, with every existing and requested asset in scope.
• Assignees remain optional and must belong to the alarm’s realm. Restricted assignees need explicit links to every target; unrestricted assignees need no asset links.
• Global creation uses the supplied realm or infers it from targets, validating all targets against that realm. Global linking uses the existing alarm’s realm. Reusable global alarm definitions are preserved.
• Automatic notifications for unassigned HIGH alarms exclude restricted users without access to every linked asset, including alarms without asset links.
• Rejected requests leave alarms and links unchanged. Existing validation errors, duplicate-link handling, and link timestamps are preserved.

Part of the rules facade scoping review tracked in #2675.

[wborn]

This is an initial AI-assisted review.

The scope validation and expanded integration tests provide good coverage of the intended behavior.

One concern remains: synchronous Keycloak role lookups during automatic alarm notification processing introduce an external dependency that can cause alarm creation to fail after the alarm has already been persisted. This should be addressed before merging.

[wborn]

This introduces a synchronous Keycloak Admin API request for every potential notification recipient. These requests are serialized by KeycloakIdentityProvider.getRealms(), and a Keycloak failure can cause sendAlarm() to fail after the alarm has already been persisted.

Could recipient filtering avoid these synchronous external requests so that notification processing cannot cause an otherwise successful alarm operation to fail?

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud