@checkstack/auth-common 0.0.3 → 0.1.0

package/CHANGELOG.md

@@ -1,5 +1,78 @@
 # @checkstack/auth-common
 
+## 0.1.0
+
+### Minor Changes
+
+- 8e43507: # Teams and Resource-Level Access Control
+
+  This release introduces a comprehensive Teams system for organizing users and controlling access to resources at a granular level.
+
+  ## Features
+
+  ### Team Management
+
+  - Create, update, and delete teams with name and description
+  - Add/remove users from teams
+  - Designate team managers with elevated privileges
+  - View team membership and manager status
+
+  ### Resource-Level Access Control
+
+  - Grant teams access to specific resources (systems, health checks, incidents, maintenances)
+  - Configure read-only or manage permissions per team
+  - Resource-level "Team Only" mode that restricts access exclusively to team members
+  - Separate `resourceAccessSettings` table for resource-level settings (not per-grant)
+  - Automatic cleanup of grants when teams are deleted (database cascade)
+
+  ### Middleware Integration
+
+  - Extended `autoAuthMiddleware` to support resource access checks
+  - Single-resource pre-handler validation for detail endpoints
+  - Automatic list filtering for collection endpoints
+  - S2S endpoints for access verification
+
+  ### Frontend Components
+
+  - `TeamsTab` component for managing teams in Auth Settings
+  - `TeamAccessEditor` component for assigning team access to resources
+  - Resource-level "Team Only" toggle in `TeamAccessEditor`
+  - Integration into System, Health Check, Incident, and Maintenance editors
+
+  ## Breaking Changes
+
+  ### API Response Format Changes
+
+  List endpoints now return objects with named keys instead of arrays directly:
+
+  ```typescript
+  // Before
+  const systems = await catalogApi.getSystems();
+
+  // After
+  const { systems } = await catalogApi.getSystems();
+  ```
+
+  Affected endpoints:
+
+  - `catalog.getSystems` → `{ systems: [...] }`
+  - `healthcheck.getConfigurations` → `{ configurations: [...] }`
+  - `incident.listIncidents` → `{ incidents: [...] }`
+  - `maintenance.listMaintenances` → `{ maintenances: [...] }`
+
+  ### User Identity Enrichment
+
+  `RealUser` and `ApplicationUser` types now include `teamIds: string[]` field with team memberships.
+
+  ## Documentation
+
+  See `docs/backend/teams.md` for complete API reference and integration guide.
+
+### Patch Changes
+
+- Updated dependencies [8e43507]
+  - @checkstack/common@0.1.0
+
 ## 0.0.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/auth-common",
-  "version": "0.0.3",
+  "version": "0.1.0",
   "type": "module",
   "exports": {
     ".": {

package/src/permissions.ts

@@ -45,6 +45,14 @@ export const permissions = {
     id: "applications.manage",
     description: "Create, update, delete, and view external applications",
   },
+  teamsRead: {
+    id: "teams.read",
+    description: "View teams and team memberships",
+  },
+  teamsManage: {
+    id: "teams.manage",
+    description: "Create, delete, and manage all teams and resource access",
+  },
 } satisfies Record<string, Permission>;
 
 export const permissionList = Object.values(permissions);

package/src/rpc-contract.ts

@@ -385,6 +385,225 @@ export const authContract = {
     })
     .input(z.string())
     .output(z.object({ secret: z.string() })), // New secret - shown once
+
+  // ==========================================================================
+  // TEAM MANAGEMENT (userType: "authenticated" with permissions)
+  // Resource-level access control via teams
+  // Both users and applications can manage teams with proper permissions
+  // ==========================================================================
+
+  getTeams: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsRead.id],
+    })
+    .output(
+      z.array(
+        z.object({
+          id: z.string(),
+          name: z.string(),
+          description: z.string().optional().nullable(),
+          memberCount: z.number(),
+          isManager: z.boolean(),
+        })
+      )
+    ),
+
+  getTeam: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsRead.id],
+    })
+    .input(z.object({ teamId: z.string() }))
+    .output(
+      z
+        .object({
+          id: z.string(),
+          name: z.string(),
+          description: z.string().optional().nullable(),
+          members: z.array(
+            z.object({ id: z.string(), name: z.string(), email: z.string() })
+          ),
+          managers: z.array(
+            z.object({ id: z.string(), name: z.string(), email: z.string() })
+          ),
+        })
+        .optional()
+    ),
+
+  createTeam: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsManage.id],
+    })
+    .input(
+      z.object({
+        name: z.string().min(1).max(100),
+        description: z.string().max(500).optional(),
+      })
+    )
+    .output(z.object({ id: z.string() })),
+
+  updateTeam: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsRead.id],
+    })
+    .input(
+      z.object({
+        id: z.string(),
+        name: z.string().optional(),
+        description: z.string().optional().nullable(),
+      })
+    )
+    .output(z.void()),
+
+  deleteTeam: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsManage.id],
+    })
+    .input(z.string())
+    .output(z.void()),
+
+  addUserToTeam: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsRead.id],
+    })
+    .input(z.object({ teamId: z.string(), userId: z.string() }))
+    .output(z.void()),
+
+  removeUserFromTeam: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsRead.id],
+    })
+    .input(z.object({ teamId: z.string(), userId: z.string() }))
+    .output(z.void()),
+
+  addTeamManager: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsManage.id],
+    })
+    .input(z.object({ teamId: z.string(), userId: z.string() }))
+    .output(z.void()),
+
+  removeTeamManager: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsManage.id],
+    })
+    .input(z.object({ teamId: z.string(), userId: z.string() }))
+    .output(z.void()),
+
+  getResourceTeamAccess: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsRead.id],
+    })
+    .input(z.object({ resourceType: z.string(), resourceId: z.string() }))
+    .output(
+      z.array(
+        z.object({
+          teamId: z.string(),
+          teamName: z.string(),
+          canRead: z.boolean(),
+          canManage: z.boolean(),
+        })
+      )
+    ),
+
+  setResourceTeamAccess: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsManage.id],
+    })
+    .input(
+      z.object({
+        resourceType: z.string(),
+        resourceId: z.string(),
+        teamId: z.string(),
+        canRead: z.boolean().optional(),
+        canManage: z.boolean().optional(),
+      })
+    )
+    .output(z.void()),
+
+  removeResourceTeamAccess: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsManage.id],
+    })
+    .input(
+      z.object({
+        resourceType: z.string(),
+        resourceId: z.string(),
+        teamId: z.string(),
+      })
+    )
+    .output(z.void()),
+
+  // Resource-level access settings (teamOnly flag)
+  getResourceAccessSettings: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsRead.id],
+    })
+    .input(z.object({ resourceType: z.string(), resourceId: z.string() }))
+    .output(z.object({ teamOnly: z.boolean() })),
+
+  setResourceAccessSettings: _base
+    .meta({
+      userType: "authenticated",
+      permissions: [permissions.teamsManage.id],
+    })
+    .input(
+      z.object({
+        resourceType: z.string(),
+        resourceId: z.string(),
+        teamOnly: z.boolean(),
+      })
+    )
+    .output(z.void()),
+
+  // ==========================================================================
+  // S2S ENDPOINTS FOR TEAM ACCESS (userType: "service")
+  // ==========================================================================
+
+  checkResourceTeamAccess: _base
+    .meta({ userType: "service" })
+    .input(
+      z.object({
+        userId: z.string(),
+        userType: z.enum(["user", "application"]),
+        resourceType: z.string(),
+        resourceId: z.string(),
+        action: z.enum(["read", "manage"]),
+        hasGlobalPermission: z.boolean(),
+      })
+    )
+    .output(z.object({ hasAccess: z.boolean() })),
+
+  getAccessibleResourceIds: _base
+    .meta({ userType: "service" })
+    .input(
+      z.object({
+        userId: z.string(),
+        userType: z.enum(["user", "application"]),
+        resourceType: z.string(),
+        resourceIds: z.array(z.string()),
+        action: z.enum(["read", "manage"]),
+        hasGlobalPermission: z.boolean(),
+      })
+    )
+    .output(z.array(z.string())),
+
+  deleteResourceGrants: _base
+    .meta({ userType: "service" })
+    .input(z.object({ resourceType: z.string(), resourceId: z.string() }))
+    .output(z.void()),
 };
 
 // Export contract type