@checkstack/automation-frontend 0.9.2 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,133 @@
 # @checkstack/automation-frontend
 
+## 0.10.0
+
+### Minor Changes
+
+- 0d912a3: Make the frontend fully RLAC-aware so team-scoped users see and can use exactly
+  what the backend already authorises - no more, no less. Previously every nav
+  entry, route, management page, create button, per-row action, and resource
+  picker gated purely on a user's GLOBAL access rule, so a user whose team manages
+  a system saw none of the surfaces the backend would happily let them use, and
+  (where a page did render) could select systems they don't manage and only fail
+  after submit.
+
+  Platform primitives (on `AccessApi`, from `@checkstack/frontend-api`, implemented
+  in `@checkstack/auth-frontend`). Each ORs the global RBAC rule with team-derived
+  (ReBAC) grants, so a global-rule holder always sees everything:
+
+  - `useCanCreate({ accessRule, objectType, parentType? })` - may the user create
+    this type (global rule, a team `creator` grant, or managing a parent resource).
+  - `useCanAccessType({ accessRule, objectType, parentType? })` - may the user
+    reach a management SURFACE for this type at all (create capability OR managing
+    any existing object of the type / its parent). Powers route guards, sidebar
+    entries, and a management page's top-level `allowed`.
+  - `useResourceAccess({ accessRule, objectType, resourceIds })` - a `canAccess(id)`
+    predicate for per-row controls and for filtering resource pickers.
+
+  Backed by three authenticated `auth` RPC procedures - `canCreate`,
+  `myManageableTypes`, and `listMyAccessibleResources` - the frontend-facing
+  mirrors of the existing S2S authorization endpoints, resolved against the
+  caller's own team grants.
+
+  Route/nav gating is now capability-aware: a route may declare
+  `manageCapability: { objectType, parentType? }`; the route guard and sidebar then
+  show/allow it for team-scoped users via `myManageableTypes`. Applied to the
+  catalog, incident, maintenance, SLO, healthcheck, automation, and status-page
+  management routes. The route guard resolves this through a single
+  `useRouteAccess` hook with a constant hook count, since the guard is reconciled
+  in place as the URL changes (a conditional hook there would trip the rules of
+  hooks).
+
+  Resource types are now typed, plugin-qualified constants. A new
+  `resourceType(pluginMetadata, localType)` factory in `@checkstack/common` mints a
+  nominal `ResourceType`, and each `*-common` package exports its constants (e.g.
+  `catalogResourceTypes.system`, `incidentResourceTypes.incident`). The capability
+  APIs accept `ResourceType`, so a mistyped `"catalog.system"` string now fails
+  typecheck instead of silently breaking a gate.
+
+  Resource pickers now offer only what the backend will accept:
+
+  - Incident and maintenance "Affected Systems" pickers show only systems the user
+    manages (or all with the global rule), matching the backend's requirement of
+    MANAGE on every referenced system.
+  - SLO creation is now system-scoped end to end: `createObjective` gains a
+    `catalog.system` parent gate (managing the target system authorises creating an
+    SLO for it, like incident/maintenance), and the SLO editor's system picker is
+    filtered to manageable systems.
+  - Catalog group and environment membership (add-to-group / add-to-environment,
+    per-row and bulk) is gated on managing the system being (re)assigned.
+  - The health-check assignment surface (Assignment IDE + the system-detail
+    "Health Checks" action) requires MANAGE on the target system.
+
+  Catalog membership chips only render a removable "x" for systems the user
+  manages (removing a group/environment membership requires managing the system),
+  and the Dependency Map only lets a user originate an edge from a system they
+  manage (the source is access-checked; the target is not).
+
+  Owning-team correctness: a parent-gated creator (team member, no global rule)
+  who left the owning team unset previously created an object with no team grant -
+  which they then could not edit. The `authorizeCreate` parent-gate path now
+  resolves an owning team instead of silently orphaning the object (auto-assigns
+  when the caller belongs to exactly one team, requires an explicit choice when
+  several), and the `TeamOwnershipPicker` marks the field required and
+  auto-selects the sole eligible team.
+
+  Dependency writes are fixed to authorize on the SOURCE system. `createDependency`
+  / `updateDependency` / `deleteDependency` previously used `instanceAccess:
+{ idParam: "systemId" }`, which made the middleware look for a `dependency` grant
+  keyed by the system id - a grant that never exists - so every team-scoped source
+  manager was denied ("Access denied to resource dependency:<systemId>"). They now
+  `parentScope` on `catalog.system` manage, so managing the source system
+  authorises editing its dependencies (the target is not access-checked), matching
+  health-check assignment.
+
+  The backend authorization changes are limited to: the new read-only capability
+  procedures (`canCreate` / `myManageableTypes` / `listMyAccessibleResources`), the
+  SLO create parent gate, the `authorizeCreate` owning-team resolution, and the
+  dependency source-scope fix. Everything else only aligns the UI with
+  authorization the backend already enforced.
+
+### Patch Changes
+
+- Updated dependencies [0d912a3]
+- Updated dependencies [0d912a3]
+- Updated dependencies [d9f4654]
+- Updated dependencies [0d912a3]
+- Updated dependencies [a07b375]
+- Updated dependencies [d9f4654]
+- Updated dependencies [d9f4654]
+- Updated dependencies [e430fbe]
+- Updated dependencies [eab80e3]
+- Updated dependencies [259b93c]
+- Updated dependencies [0d912a3]
+- Updated dependencies [692fa18]
+  - @checkstack/auth-frontend@0.11.0
+  - @checkstack/ui@1.22.0
+  - @checkstack/frontend-api@0.13.0
+  - @checkstack/common@0.19.0
+  - @checkstack/auth-common@0.12.0
+  - @checkstack/catalog-common@2.6.0
+  - @checkstack/automation-common@0.9.0
+  - @checkstack/gitops-frontend@0.6.5
+  - @checkstack/script-packages-frontend@0.4.5
+  - @checkstack/secrets-frontend@0.3.5
+  - @checkstack/ai-common@0.6.3
+  - @checkstack/integration-common@0.9.5
+  - @checkstack/signal-frontend@0.3.2
+  - @checkstack/template-engine@0.4.8
+
+## 0.9.3
+
+### Patch Changes
+
+- Updated dependencies [baf9b6e]
+  - @checkstack/ui@1.21.0
+  - @checkstack/auth-frontend@0.10.2
+  - @checkstack/gitops-frontend@0.6.4
+  - @checkstack/script-packages-frontend@0.4.4
+  - @checkstack/secrets-frontend@0.3.4
+
 ## 0.9.2
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/automation-frontend",
-  "version": "0.9.2",
+  "version": "0.10.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
@@ -16,20 +16,20 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/auth-common": "0.11.2",
-    "@checkstack/auth-frontend": "0.10.1",
-    "@checkstack/automation-common": "0.8.2",
-    "@checkstack/ai-common": "0.6.2",
-    "@checkstack/catalog-common": "2.5.0",
-    "@checkstack/common": "0.18.0",
-    "@checkstack/frontend-api": "0.12.1",
-    "@checkstack/gitops-frontend": "0.6.3",
-    "@checkstack/integration-common": "0.9.4",
-    "@checkstack/script-packages-frontend": "0.4.3",
-    "@checkstack/secrets-frontend": "0.3.3",
-    "@checkstack/signal-frontend": "0.3.1",
-    "@checkstack/template-engine": "0.4.7",
-    "@checkstack/ui": "1.20.0",
+    "@checkstack/auth-common": "0.12.0",
+    "@checkstack/auth-frontend": "0.11.0",
+    "@checkstack/automation-common": "0.9.0",
+    "@checkstack/ai-common": "0.6.3",
+    "@checkstack/catalog-common": "2.6.0",
+    "@checkstack/common": "0.19.0",
+    "@checkstack/frontend-api": "0.13.0",
+    "@checkstack/gitops-frontend": "0.6.5",
+    "@checkstack/integration-common": "0.9.5",
+    "@checkstack/script-packages-frontend": "0.4.5",
+    "@checkstack/secrets-frontend": "0.3.5",
+    "@checkstack/signal-frontend": "0.3.2",
+    "@checkstack/template-engine": "0.4.8",
+    "@checkstack/ui": "1.22.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^8.0.0",
     "@dnd-kit/utilities": "^3.2.2",
@@ -43,6 +43,6 @@
     "typescript": "^5.0.0",
     "@types/react": "^19.0.0",
     "@checkstack/tsconfig": "0.0.7",
-    "@checkstack/scripts": "0.6.5"
+    "@checkstack/scripts": "0.7.0"
   }
 }

package/src/index.tsx

@@ -3,6 +3,7 @@ import {
   automationRoutes,
   pluginMetadata,
   automationAccess,
+  automationResourceTypes,
 } from "@checkstack/automation-common";
 import { Workflow } from "lucide-react";
 
@@ -60,6 +61,8 @@ export default createFrontendPlugin({
         })),
       title: "New automation",
       accessRule: automationAccess.manage,
+      // Team-scoped: a team with an automation creator grant may reach create.
+      manageCapability: { objectType: automationResourceTypes.automation },
     },
     {
       route: automationRoutes.routes.createBlank,
@@ -69,6 +72,8 @@ export default createFrontendPlugin({
         })),
       title: "New automation",
       accessRule: automationAccess.manage,
+      // Team-scoped: a team with an automation creator grant may reach create.
+      manageCapability: { objectType: automationResourceTypes.automation },
     },
     {
       route: automationRoutes.routes.edit,

package/src/pages/AutomationEditPage.tsx

@@ -17,6 +17,7 @@ import {
   AutomationApi,
   automationAccess,
   automationRoutes,
+  automationResourceTypes,
   type AutomationDefinition,
 } from "@checkstack/automation-common";
 import {
@@ -118,12 +119,28 @@ const AutomationEditContent: React.FC = () => {
   const { allowed: canRead, loading: accessLoading } = accessApi.useAccess(
     automationAccess.read,
   );
-  const { allowed: hasManageAccess } = accessApi.useAccess(
+  // allowGlobal: the GLOBAL manage rule means the caller may create a resource
+  // not scoped to any team. This feeds the TeamOwnershipPicker only.
+  const { allowed: hasGlobalManageAccess } = accessApi.useAccess(
     automationAccess.manage,
   );
-  // allowGlobal: reuse the manage access check — global manage permission
-  // means the caller may create a resource not scoped to any team.
-  const allowGlobal = hasManageAccess;
+  const allowGlobal = hasGlobalManageAccess;
+
+  // Create/page gate (new automations): global manage rule OR team-derived
+  // create capability.
+  const { allowed: canCreate } = accessApi.useCanCreate({
+    accessRule: automationAccess.manage,
+    objectType: automationResourceTypes.automation,
+  });
+  // Per-resource manage gate (existing automations): grants to global-manage
+  // holders AND to team-scoped users with a per-object grant on THIS id.
+  const { canAccess } = accessApi.useResourceAccess({
+    accessRule: automationAccess.manage,
+    objectType: automationResourceTypes.automation,
+    resourceIds: !isNew && automationId ? [automationId] : [],
+  });
+  const canManageThisAutomation =
+    !isNew && automationId ? canAccess(automationId) : false;
 
   // GitOps provenance lock: when this automation is declaratively managed,
   // disable manual edits + show a banner. `entityId` is the automation id
@@ -134,8 +151,10 @@ const AutomationEditContent: React.FC = () => {
     entityId: isNew ? undefined : automationId,
   });
 
-  // Effective edit permission: manage access AND not GitOps-locked.
-  const canManage = hasManageAccess && !isLocked;
+  // Effective edit permission: RLAC manage (create capability for new, per-
+  // resource access for existing) AND not GitOps-locked.
+  const canManage =
+    (isNew ? canCreate : canManageThisAutomation) && !isLocked;
 
   const loadQuery = client.getAutomation.useQuery(
     { id: automationId ?? "" },

package/src/pages/AutomationListPage.tsx

@@ -12,6 +12,7 @@ import {
   AutomationApi,
   automationAccess,
   automationRoutes,
+  automationResourceTypes,
   type Automation,
 } from "@checkstack/automation-common";
 import {
@@ -84,7 +85,12 @@ const AutomationListContent: React.FC = () => {
   const { allowed: canRead, loading: accessLoading } = accessApi.useAccess(
     automationAccess.read,
   );
-  const { allowed: canManage } = accessApi.useAccess(automationAccess.manage);
+  // Create/page gate: whether the user may create a new automation at all
+  // (global manage rule OR team-derived create capability).
+  const { allowed: canCreate } = accessApi.useCanCreate({
+    accessRule: automationAccess.manage,
+    objectType: automationResourceTypes.automation,
+  });
 
   const [statusFilter, setStatusFilter] = React.useState<
     "all" | "enabled" | "disabled"
@@ -163,6 +169,15 @@ const AutomationListContent: React.FC = () => {
   const automations = React.useMemo(() => items ?? [], [items]);
   const isEmpty = !query.isLoading && automations.length === 0;
 
+  // Per-resource manage gate: grants ALL rows to global-manage holders, and
+  // per-object grants to team-scoped users. Gate each row's toggle/delete on
+  // `canAccess(automation.id)` instead of a single global bool.
+  const { canAccess } = accessApi.useResourceAccess({
+    accessRule: automationAccess.manage,
+    objectType: automationResourceTypes.automation,
+    resourceIds: automations.map((a) => a.id),
+  });
+
   // Collapsible sections, sorted alphabetically with "Ungrouped" last.
   const groups = React.useMemo(
     () => groupAutomations({ automations }),
@@ -195,7 +210,7 @@ const AutomationListContent: React.FC = () => {
           )}
           aria-hidden
         />
-        {canManage ? (
+        {canAccess(automation.id) ? (
           <Toggle
             checked={automation.status === "enabled"}
             onCheckedChange={(enabled) =>
@@ -276,7 +291,7 @@ const AutomationListContent: React.FC = () => {
               Runs
             </Button>
           </Link>
-          {canManage && (
+          {canAccess(automation.id) && (
             <Button
               variant="ghost"
               size="icon"
@@ -324,7 +339,7 @@ const AutomationListContent: React.FC = () => {
           )}
         </div>
         <div onClick={(e) => e.stopPropagation()}>
-          {canManage ? (
+          {canAccess(automation.id) ? (
             <Toggle
               checked={automation.status === "enabled"}
               onCheckedChange={(enabled) =>
@@ -389,7 +404,7 @@ const AutomationListContent: React.FC = () => {
             Runs
           </Button>
         </Link>
-        {canManage && (
+        {canAccess(automation.id) && (
           <Button
             variant="ghost"
             size="icon"
@@ -419,7 +434,7 @@ const AutomationListContent: React.FC = () => {
               Playground
             </Button>
           </Link>
-          {canManage && (
+          {canCreate && (
             <Link to={resolveRoute(automationRoutes.routes.create)}>
               <Button size="sm">
                 <Plus className="mr-1 h-4 w-4" />
@@ -464,7 +479,7 @@ const AutomationListContent: React.FC = () => {
               icon={<Workflow className="h-8 w-8 text-muted-foreground" />}
               title="No automations yet"
               description={
-                canManage
+                canCreate
                   ? 'Click "New automation" to wire your first trigger.'
                   : "Once an admin creates an automation it will appear here."
               }