@checkstack/auth-backend 0.0.2 → 0.1.0

package/CHANGELOG.md

@@ -1,5 +1,97 @@
 # @checkstack/auth-backend
 
+## 0.1.0
+
+### Minor Changes
+
+- 8e43507: # Teams and Resource-Level Access Control
+
+  This release introduces a comprehensive Teams system for organizing users and controlling access to resources at a granular level.
+
+  ## Features
+
+  ### Team Management
+
+  - Create, update, and delete teams with name and description
+  - Add/remove users from teams
+  - Designate team managers with elevated privileges
+  - View team membership and manager status
+
+  ### Resource-Level Access Control
+
+  - Grant teams access to specific resources (systems, health checks, incidents, maintenances)
+  - Configure read-only or manage permissions per team
+  - Resource-level "Team Only" mode that restricts access exclusively to team members
+  - Separate `resourceAccessSettings` table for resource-level settings (not per-grant)
+  - Automatic cleanup of grants when teams are deleted (database cascade)
+
+  ### Middleware Integration
+
+  - Extended `autoAuthMiddleware` to support resource access checks
+  - Single-resource pre-handler validation for detail endpoints
+  - Automatic list filtering for collection endpoints
+  - S2S endpoints for access verification
+
+  ### Frontend Components
+
+  - `TeamsTab` component for managing teams in Auth Settings
+  - `TeamAccessEditor` component for assigning team access to resources
+  - Resource-level "Team Only" toggle in `TeamAccessEditor`
+  - Integration into System, Health Check, Incident, and Maintenance editors
+
+  ## Breaking Changes
+
+  ### API Response Format Changes
+
+  List endpoints now return objects with named keys instead of arrays directly:
+
+  ```typescript
+  // Before
+  const systems = await catalogApi.getSystems();
+
+  // After
+  const { systems } = await catalogApi.getSystems();
+  ```
+
+  Affected endpoints:
+
+  - `catalog.getSystems` → `{ systems: [...] }`
+  - `healthcheck.getConfigurations` → `{ configurations: [...] }`
+  - `incident.listIncidents` → `{ incidents: [...] }`
+  - `maintenance.listMaintenances` → `{ maintenances: [...] }`
+
+  ### User Identity Enrichment
+
+  `RealUser` and `ApplicationUser` types now include `teamIds: string[]` field with team memberships.
+
+  ## Documentation
+
+  See `docs/backend/teams.md` for complete API reference and integration guide.
+
+### Patch Changes
+
+- Updated dependencies [97c5a6b]
+- Updated dependencies [8e43507]
+  - @checkstack/backend-api@0.2.0
+  - @checkstack/auth-common@0.1.0
+  - @checkstack/common@0.1.0
+  - @checkstack/command-backend@0.0.4
+  - @checkstack/notification-common@0.0.4
+
+## 0.0.3
+
+### Patch Changes
+
+- f5b1f49: Improved BASE_URL handling with fallback defaults for local development.
+- Updated dependencies [f5b1f49]
+- Updated dependencies [f5b1f49]
+- Updated dependencies [f5b1f49]
+  - @checkstack/backend-api@0.1.0
+  - @checkstack/common@0.0.3
+  - @checkstack/command-backend@0.0.3
+  - @checkstack/auth-common@0.0.3
+  - @checkstack/notification-common@0.0.3
+
 ## 0.0.2
 
 ### Patch Changes

package/drizzle/0002_lowly_squirrel_girl.sql

@@ -0,0 +1,43 @@
+CREATE TABLE "application_team" (
+	"application_id" text NOT NULL,
+	"team_id" text NOT NULL,
+	CONSTRAINT "application_team_application_id_team_id_pk" PRIMARY KEY("application_id","team_id")
+);
+--> statement-breakpoint
+CREATE TABLE "resource_team_access" (
+	"resource_type" text NOT NULL,
+	"resource_id" text NOT NULL,
+	"team_id" text NOT NULL,
+	"team_only" boolean DEFAULT false NOT NULL,
+	"can_read" boolean DEFAULT true NOT NULL,
+	"can_manage" boolean DEFAULT false NOT NULL,
+	CONSTRAINT "resource_team_access_resource_type_resource_id_team_id_pk" PRIMARY KEY("resource_type","resource_id","team_id")
+);
+--> statement-breakpoint
+CREATE TABLE "team" (
+	"id" text PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"description" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "team_manager" (
+	"team_id" text NOT NULL,
+	"user_id" text NOT NULL,
+	CONSTRAINT "team_manager_team_id_user_id_pk" PRIMARY KEY("team_id","user_id")
+);
+--> statement-breakpoint
+CREATE TABLE "user_team" (
+	"user_id" text NOT NULL,
+	"team_id" text NOT NULL,
+	CONSTRAINT "user_team_user_id_team_id_pk" PRIMARY KEY("user_id","team_id")
+);
+--> statement-breakpoint
+ALTER TABLE "application_team" ADD CONSTRAINT "application_team_application_id_application_id_fk" FOREIGN KEY ("application_id") REFERENCES "application"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "application_team" ADD CONSTRAINT "application_team_team_id_team_id_fk" FOREIGN KEY ("team_id") REFERENCES "team"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "resource_team_access" ADD CONSTRAINT "resource_team_access_team_id_team_id_fk" FOREIGN KEY ("team_id") REFERENCES "team"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "team_manager" ADD CONSTRAINT "team_manager_team_id_team_id_fk" FOREIGN KEY ("team_id") REFERENCES "team"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "team_manager" ADD CONSTRAINT "team_manager_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "user_team" ADD CONSTRAINT "user_team_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "user_team" ADD CONSTRAINT "user_team_team_id_team_id_fk" FOREIGN KEY ("team_id") REFERENCES "team"("id") ON DELETE cascade ON UPDATE no action;

package/drizzle/0003_tranquil_sally_floyd.sql

@@ -0,0 +1,8 @@
+CREATE TABLE "resource_access_settings" (
+	"resource_type" text NOT NULL,
+	"resource_id" text NOT NULL,
+	"team_only" boolean DEFAULT false NOT NULL,
+	CONSTRAINT "resource_access_settings_resource_type_resource_id_pk" PRIMARY KEY("resource_type","resource_id")
+);
+--> statement-breakpoint
+ALTER TABLE "resource_team_access" DROP COLUMN "team_only";