@checkstack/backend-api 0.8.0 → 0.8.2

package/CHANGELOG.md

@@ -1,5 +1,36 @@
 # @checkstack/backend-api
 
+## 0.8.2
+
+### Patch Changes
+
+- 67158e2: Standardize package metadata, unify AJV versions to 8.18.0, and enforce monorepo architecture rules via updated ESLint configuration. This ensures consistent package discovery and runtime dependency safety across the platform.
+- Updated dependencies [67158e2]
+  - @checkstack/common@0.6.4
+  - @checkstack/healthcheck-common@0.8.4
+  - @checkstack/queue-api@0.2.7
+  - @checkstack/signal-common@0.1.8
+
+## 0.8.1
+
+### Patch Changes
+
+- 0ebbe56: Security Vulnerability Remediation completed:
+  - Refactored core authorization to Fail-Closed architecture with secure defaults.
+  - Implemented `assertTeamManagementAccess` to resolve BOLA in Teams Management.
+  - Protected internal S2S capabilities via explicit wildcard `serviceScope` definitions.
+  - Disarmed OS Command Injection in DiskCollector via strict regex validation and bash escaping.
+  - Re-architected inline script processing executing scripts in sandboxed Web Worker contexts.
+  - Isolated subprocess environment scopes in PingStrategy limiting variable leakage.
+  - Enforced strict token/API Key parsing with URLSearchParams checking.
+  - Explicitly fail-fast on missing DATABASE_URL configuration across independent backend clusters.
+  - Activated strict HTTP Security Headers (HSTS, CSP, X-Frame-Options) across the API automatically.
+- Updated dependencies [0ebbe56]
+  - @checkstack/common@0.6.3
+  - @checkstack/queue-api@0.2.6
+  - @checkstack/healthcheck-common@0.8.3
+  - @checkstack/signal-common@0.1.7
+
 ## 0.8.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/backend-api",
-  "version": "0.8.0",
+  "version": "0.8.2",
   "type": "module",
   "main": "./src/index.ts",
   "scripts": {
@@ -9,16 +9,17 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/common": "0.6.2",
-    "@checkstack/healthcheck-common": "0.8.2",
-    "@checkstack/queue-api": "0.2.4",
-    "@checkstack/signal-common": "0.1.6",
-    "@orpc/client": "^1.13.2",
+    "@checkstack/common": "0.6.3",
+    "@checkstack/healthcheck-common": "0.8.3",
+    "@checkstack/queue-api": "0.2.6",
+    "@checkstack/signal-common": "0.1.7",
+    "@orpc/client": "^1.13.14",
+    "@orpc/contract": "^1.13.14",
     "@orpc/openapi": "^1.13.2",
     "@orpc/server": "^1.13.2",
     "@orpc/zod": "^1.13.2",
-    "drizzle-orm": "^0.45.1",
-    "hono": "^4.0.0",
+    "drizzle-orm": "^0.45.0",
+    "hono": "^4.12.14",
     "marked": "^17.0.1",
     "zod": "^4.2.1"
   },
@@ -28,7 +29,10 @@
     "@checkstack/scripts": "0.1.1"
   },
   "peerDependencies": {
-    "hono": "^4.0.0",
-    "drizzle-orm": "^0.45.1"
+    "hono": "^4.12.14",
+    "drizzle-orm": "^0.45.0"
+  },
+  "checkstack": {
+    "type": "tooling"
   }
 }

package/src/rpc.ts

@@ -206,6 +206,23 @@ export const autoAuthMiddleware = os.middleware(
 
     // 5. Skip remaining checks for services - they are trusted
     if (user?.type === "service") {
+      // SECURITY: Check service-level scope restrictions
+      const serviceScope = meta?.serviceScope;
+      if (serviceScope && serviceScope.length > 0) {
+        const isAllowed = serviceScope.some((allowedPattern) => {
+          if (allowedPattern.endsWith("*")) {
+            const prefix = allowedPattern.slice(0, -1);
+            return user.pluginId.startsWith(prefix);
+          }
+          return allowedPattern === user.pluginId;
+        });
+
+        if (!isAllowed) {
+          throw new ORPCError("FORBIDDEN", {
+            message: `Service '${user.pluginId}' is not allowed to call this endpoint`,
+          });
+        }
+      }
       return next({});
     }
 
@@ -483,8 +500,8 @@ async function checkResourceAccessViaS2S({
     });
     return result.hasAccess;
   } catch {
-    // If team access check fails (e.g., service not available), fall back to global access
-    return hasGlobalAccess;
+    // SECURITY: Fail-Closed — deny access when S2S check fails
+    return false;
   }
 }
 
@@ -520,8 +537,8 @@ async function getAccessibleResourceIdsViaS2S({
       hasGlobalAccess,
     });
   } catch {
-    // If team access check fails, fall back to global access behavior
-    return hasGlobalAccess ? resourceIds : [];
+    // SECURITY: Fail-Closed — return empty set when S2S check fails
+    return [];
   }
 }