@checkstack/automation-frontend 0.6.0 → 0.7.0

package/CHANGELOG.md

@@ -1,5 +1,171 @@
 # @checkstack/automation-frontend
 
+## 0.7.0
+
+### Minor Changes
+
+- d2077bd: Platform-wide team-scoped access control on a unified relation-tuple store.
+
+  Admins can scope any resource to teams, and the **platform** (not each plugin)
+  enforces it. A plugin opts in declaratively by adding `instanceAccess` to a
+  procedure's contract; the auth middleware does the rest, so enforcement is
+  consistent across catalog, health checks, incidents, maintenances, SLOs,
+  automations, and the dependency map, and any third-party plugin gets it for free.
+
+  Core model:
+
+  - **Teams are optional.** A resource with no team grants behaves exactly as
+    before.
+  - **Team grants are additive and restrict who can CHANGE a resource, not who can
+    SEE it.** Granting a team `Manage` lets its members view and change the
+    resource; `Read-only` lets them view it. Either level grants access to team
+    members **even when they lack the global permission**, and granting never
+    removes read from anyone who already had it (e.g. a public status page stays
+    readable). Privacy is a separate, explicit opt-in via the **Private** toggle,
+    which removes the global read path so only the resource's teams can see it.
+  - **Ownership at creation.** Create forms expose an **Owning team** picker. A
+    non-admin can create a resource for a team they belong to that holds a
+    create-capability grant for that type; the new resource is auto-granted to that
+    team. Incidents and maintenances are **parent-gated**: anyone who can manage a
+    system may open incidents/maintenances for it, no separate grant needed.
+  - **Meaningful authorization errors.** A caller with neither the global rule nor
+    any team grant for a resource type gets a `403` with a structured body instead
+    of a silently-empty `200`. Anonymous callers on public endpoints are never
+    `403`'d, so status pages keep rendering.
+
+  Unified relation-tuple store:
+
+  - The previously separate access primitives (`resource_team_access.canRead` /
+    `.canManage`, ownership, `resource_access_settings.teamOnly`, and
+    `resource_create_grant`) are collapsed onto ONE
+    `relation_tuple(object, relation, subject)` store: "a team has
+    `viewer`/`editor`/`owner` on an object, or `creator` on a type". Privacy is an
+    explicit **`private` marker** tuple — its **presence** closes the global read
+    path (team grants only), its **absence** is the readable-by-default state, so a
+    private resource with zero grants is correctly inaccessible to everyone rather
+    than silently globalized. The access decision is a pure, unit-tested function.
+  - The auth API is generic: `writeRelation` / `removeRelation` / `setObjectPublic`
+    / `listObjectRelations` / `listSubjectRelations` / `setCreateGrant` /
+    `listTeamCreateGrants` (user-facing) and `check` / `listAccessibleObjectIds` /
+    `hasAnyTypeGrant` / `authorizeCreate` / `setOwner` / `deleteObjectRelations`
+    (service-to-service). Migration `0008` backfills tuples from the legacy tables
+    and drops them.
+
+  Explicit per-procedure scoping:
+
+  - Access rules (`access()` / `accessPair()`) define only the rule (id, level,
+    defaults); every procedure declares its own `instanceAccess`. This removes a
+    "loaded gun" default that silently applied a shared `idParam` to any procedure
+    which forgot its own override.
+  - Modes: `idParam` (single-resource pre-check, fails **closed** if the id does
+    not resolve), `listKey` / `recordKey` (post-filter a list/record to the
+    accessible subset), `create` (authorize creation + write the owning-team
+    grant), `parentScope` (scope by read/manage access to a PARENT type,
+    cross-plugin single-hop: "you may see incidents/maintenances/SLOs/health for
+    system S iff you may see S"), and `global: true` (the honest "intentionally not
+    team-scoped" opt-out). A boot-time validator **rejects** any procedure gated on
+    a team-scopable resource type that declares no `instanceAccess`, turning the
+    previous fail-open into a boot error.
+
+  Teams administration:
+
+  - **Team managers** manage their own team's members and managers without the
+    global `auth.teams.manage` rule; creating, deleting, and granting a team access
+    remain admin-only.
+  - A **standalone Teams page** (gated on `auth.teams.read`) lets managers reach
+    team administration without the admin Auth Settings page; members are added via
+    a debounced directory picker.
+  - A **cross-plugin `ResourceResolverRegistry`** lets owning plugins register a
+    name/search resolver for their resource types, so the Teams page lists a team's
+    grants **by name** (grouped by type) and offers a resource picker — an admin can
+    change a grant's level, revoke it, or add one, without auth depending on every
+    plugin. Resolvers shipped for catalog systems, health-check configurations,
+    incidents, maintenances, SLO objectives, and automations.
+
+  Frontend:
+
+  - The resource-side editor is **"Who can change this"** (one Manage checkbox per
+    team; unticked = read-only), with an always-visible **Private** toggle
+    (disabled until a team that can Manage exists, so a resource can't be stranded).
+  - `TeamOwnershipPicker` explains _why_ there's nothing to pick (not a member of
+    any team, or none of your teams manage the selected parent) instead of a bare
+    "global resource" line.
+  - Read-only **"who can change this"** indicators on resource detail pages expand
+    to the actual people by name; bulk + per-row **Scope to team** actions in the
+    catalog systems list; and the team-access copy spells out that grants are
+    additive and that Read-only grants view (not change) even without the global
+    permission.
+
+  Security hardening:
+
+  - Child deletes in catalog (`removeSystemContact` / `removeSystemLink`) are scoped
+    to both the child id and its parent `systemId`, closing a cross-system IDOR for
+    team-scoped managers.
+  - `searchUsers` is restricted to team administrators, closing a directory/email
+    enumeration path opened by the default `auth.teams.read` rule.
+  - Grant setters reject unregistered resource types.
+
+  BREAKING CHANGES (beta; shipped as minor bumps):
+
+  - `access()` and `accessPair()` no longer accept `idParam` / `listKey` /
+    `recordKey`; move instance config to the procedure's `instanceAccess`.
+  - Boot fails if a procedure gated on a team-scopable resource type omits
+    `instanceAccess`. Declare a scoping mode or `instanceAccess: { global: true }`.
+  - The `AuthService` interface is reshaped: `check`, `listAccessibleObjectIds`,
+    `hasAnyTypeGrant`, `authorizeCreate` (returns `isPrivate`), `setOwner`
+    (`isPrivate`), and `deleteObjectRelations`. Custom `AuthService` implementations
+    and mocks must update.
+  - The auth RPC contract's per-concept resource-access endpoints are replaced by
+    the generic tuple API above; external callers of the old
+    `getResourceTeamAccess` / `setResourceTeamAccess` / `setResourceAccessSettings`
+    / `grantResourceCreate` / etc. must move to the new procedures.
+  - Several contract inputs changed from a bare `string` to an object so the
+    middleware can resolve the resource id: catalog `deleteSystem` (`{ id }`),
+    `removeSystemContact` / `removeSystemLink` (`{ id, systemId }`); health-check
+    `deleteConfiguration` / `pauseConfiguration` / `resumeConfiguration` (`{ id }`).
+    All in-tree callers are updated.
+  - List/record endpoints that relied on returning an empty `200` to signal "no
+    access" now return a `403` for categorically-unauthorized principals.
+  - The mis-keyed bulk endpoints `getBulkIncidentsForSystems`,
+    `getBulkMaintenancesForSystems`, and `getBulkObjectivesForSystems` no longer
+    post-filter their (systemId-keyed) result; access is already gated by
+    `catalog.system` upstream.
+  - Team membership/manager mutations (`addUserToTeam`, `removeUserFromTeam`,
+    `addTeamManager`, `removeTeamManager`) now require `auth.teams.read` instead of
+    `auth.teams.manage` at the contract level (broadened to per-team managers).
+  - The `resource_team_access`, `resource_access_settings`, and
+    `resource_create_grant` tables are dropped (data backfilled into
+    `relation_tuple` by migration `0008`). A previously inconsistent "team-only with
+    zero grants" resource is now correctly inaccessible to global-access holders.
+
+### Patch Changes
+
+- Updated dependencies [551eaa9]
+- Updated dependencies [d2077bd]
+- Updated dependencies [551eaa9]
+- Updated dependencies [9ab73c5]
+- Updated dependencies [5c6393f]
+  - @checkstack/ai-common@0.5.0
+  - @checkstack/auth-common@0.10.0
+  - @checkstack/auth-frontend@0.8.0
+  - @checkstack/common@0.16.0
+  - @checkstack/automation-common@0.7.0
+  - @checkstack/catalog-common@2.4.0
+  - @checkstack/ui@1.16.1
+  - @checkstack/frontend-api@0.10.0
+  - @checkstack/gitops-frontend@0.5.8
+  - @checkstack/integration-common@0.9.1
+  - @checkstack/script-packages-frontend@0.3.12
+  - @checkstack/secrets-frontend@0.2.7
+  - @checkstack/template-engine@0.4.5
+  - @checkstack/signal-frontend@0.2.5
+
+## 0.6.1
+
+### Patch Changes
+
+- @checkstack/script-packages-frontend@0.3.11
+
 ## 0.6.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/automation-frontend",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.tsx",
@@ -13,19 +13,20 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/auth-common": "0.9.1",
-    "@checkstack/automation-common": "0.6.0",
-    "@checkstack/ai-common": "0.4.0",
-    "@checkstack/catalog-common": "2.3.6",
-    "@checkstack/common": "0.15.0",
-    "@checkstack/frontend-api": "0.9.0",
-    "@checkstack/gitops-frontend": "0.5.7",
-    "@checkstack/integration-common": "0.9.0",
-    "@checkstack/script-packages-frontend": "0.3.10",
-    "@checkstack/secrets-frontend": "0.2.6",
-    "@checkstack/signal-frontend": "0.2.4",
-    "@checkstack/template-engine": "0.4.4",
-    "@checkstack/ui": "1.16.0",
+    "@checkstack/auth-common": "0.10.0",
+    "@checkstack/auth-frontend": "0.8.0",
+    "@checkstack/automation-common": "0.7.0",
+    "@checkstack/ai-common": "0.5.0",
+    "@checkstack/catalog-common": "2.4.0",
+    "@checkstack/common": "0.16.0",
+    "@checkstack/frontend-api": "0.10.0",
+    "@checkstack/gitops-frontend": "0.5.8",
+    "@checkstack/integration-common": "0.9.1",
+    "@checkstack/script-packages-frontend": "0.3.12",
+    "@checkstack/secrets-frontend": "0.2.7",
+    "@checkstack/signal-frontend": "0.2.5",
+    "@checkstack/template-engine": "0.4.5",
+    "@checkstack/ui": "1.16.1",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^8.0.0",
     "@dnd-kit/utilities": "^3.2.2",
@@ -39,6 +40,6 @@
     "typescript": "^5.0.0",
     "@types/react": "^19.0.0",
     "@checkstack/tsconfig": "0.0.7",
-    "@checkstack/scripts": "0.6.1"
+    "@checkstack/scripts": "0.6.2"
   }
 }

package/src/pages/AutomationEditPage.tsx

@@ -50,6 +50,7 @@ import {
   GitOpsLockBanner,
   useProvenanceLock,
 } from "@checkstack/gitops-frontend";
+import { TeamOwnershipPicker, teamCreateErrorMessage } from "@checkstack/auth-frontend";
 import { parse as parseYaml, stringify as stringifyYaml } from "yaml";
 import { AutomationDefinitionEditor } from "../editor/AutomationDefinitionEditor";
 import { assignDefaultIds } from "../editor/action-helpers";
@@ -112,6 +113,9 @@ const AutomationEditContent: React.FC = () => {
   const { allowed: hasManageAccess } = accessApi.useAccess(
     automationAccess.manage,
   );
+  // allowGlobal: reuse the manage access check — global manage permission
+  // means the caller may create a resource not scoped to any team.
+  const allowGlobal = hasManageAccess;
 
   // GitOps provenance lock: when this automation is declaratively managed,
   // disable manual edits + show a banner. `entityId` is the automation id
@@ -139,6 +143,10 @@ const AutomationEditContent: React.FC = () => {
   // "not chosen yet" — save is blocked until one is selected.
   const [runAsApplicationId, setRunAsApplicationId] = React.useState("");
   const [statusEnabled, setStatusEnabled] = React.useState(true);
+  // Owning team — create mode only. null means global (no team owner).
+  const [ownerTeamId, setOwnerTeamId] = React.useState<string | null>(null);
+  // Inline error for team-create failures (e.g. OWNER_TEAM_REQUIRED).
+  const [ownerTeamError, setOwnerTeamError] = React.useState<string | null>(null);
 
   // Existing group values for the picker's "pick existing" suggestions.
   const groupsQuery = client.listAutomationGroups.useQuery();
@@ -299,7 +307,14 @@ const AutomationEditContent: React.FC = () => {
         resolveRoute(automationRoutes.routes.edit, { automationId: data.id }),
       );
     },
-    onError: (error) => toast.error(extractErrorMessage(error)),
+    onError: (error) => {
+      const inline = teamCreateErrorMessage(error);
+      if (inline) {
+        setOwnerTeamError(inline);
+        return;
+      }
+      toast.error(extractErrorMessage(error));
+    },
   });
 
   const updateMutation = client.updateAutomation.useMutation({
@@ -343,6 +358,7 @@ const AutomationEditContent: React.FC = () => {
   };
 
   const handleSave = async () => {
+    setOwnerTeamError(null);
     const committed = commitActiveTab();
     if (!committed) return;
 
@@ -375,6 +391,7 @@ const AutomationEditContent: React.FC = () => {
         runAs: runAsApplicationId,
         status: statusEnabled ? "enabled" : "disabled",
         definition: merged,
+        teamId: ownerTeamId ?? undefined,
       });
     } else if (automationId) {
       updateMutation.mutate({
@@ -555,6 +572,19 @@ const AutomationEditContent: React.FC = () => {
                 disabled={!canManage}
                 showError={!!runAsError}
               />
+              {/* Owning team — shown only when creating a new automation */}
+              {isNew && (
+                <TeamOwnershipPicker
+                  value={ownerTeamId}
+                  onChange={(id) => {
+                    setOwnerTeamId(id);
+                    setOwnerTeamError(null);
+                  }}
+                  allowGlobal={allowGlobal}
+                  disabled={!canManage}
+                  error={ownerTeamError}
+                />
+              )}
               <div className="flex items-center justify-between">
                 <Label htmlFor="enabled">Enabled</Label>
                 <Toggle

package/tsconfig.json

@@ -10,6 +10,9 @@
     {
       "path": "../auth-common"
     },
+    {
+      "path": "../auth-frontend"
+    },
     {
       "path": "../automation-common"
     },