@checkstack/backend 0.4.12 → 0.4.14

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # @checkstack/backend
 
+## 0.4.14
+
+### Patch Changes
+
+- 0ebbe56: Security Vulnerability Remediation completed:
+  - Refactored core authorization to Fail-Closed architecture with secure defaults.
+  - Implemented `assertTeamManagementAccess` to resolve BOLA in Teams Management.
+  - Protected internal S2S capabilities via explicit wildcard `serviceScope` definitions.
+  - Disarmed OS Command Injection in DiskCollector via strict regex validation and bash escaping.
+  - Re-architected inline script processing executing scripts in sandboxed Web Worker contexts.
+  - Isolated subprocess environment scopes in PingStrategy limiting variable leakage.
+  - Enforced strict token/API Key parsing with URLSearchParams checking.
+  - Explicitly fail-fast on missing DATABASE_URL configuration across independent backend clusters.
+  - Activated strict HTTP Security Headers (HSTS, CSP, X-Frame-Options) across the API automatically.
+- Updated dependencies [0ebbe56]
+  - @checkstack/auth-common@0.5.6
+  - @checkstack/backend-api@0.8.1
+  - @checkstack/common@0.6.3
+  - @checkstack/queue-api@0.2.6
+  - @checkstack/signal-backend@0.1.12
+  - @checkstack/api-docs-common@0.1.7
+  - @checkstack/signal-common@0.1.7
+
+## 0.4.13
+
+### Patch Changes
+
+- 869b4ab: ## Health Check Execution Improvements
+
+  ### Breaking Changes (backend-api)
+
+  - `HealthCheckStrategy.createClient()` now accepts `unknown` instead of `TConfig` due to TypeScript contravariance constraints. Implementations should use `this.config.validate(config)` to narrow the type.
+
+  ### Features
+
+  - **Platform-level hard timeout**: The executor now wraps the entire health check execution (connection + all collectors) in a single timeout, ensuring checks never hang indefinitely.
+  - **Parallel collector execution**: Collectors now run in parallel using `Promise.allSettled()`, improving performance while ensuring all collectors complete regardless of individual failures.
+  - **Base strategy config schema**: All strategy configs now extend `baseStrategyConfigSchema` which provides a standardized `timeout` field with sensible defaults (30s, min 100ms).
+
+  ### Fixes
+
+  - Fixed HTTP and Jenkins strategies clearing timeouts before reading the full response body.
+  - Simplified registry type signatures by using default type parameters.
+
+- Updated dependencies [869b4ab]
+  - @checkstack/backend-api@0.8.0
+  - @checkstack/queue-api@0.2.5
+  - @checkstack/signal-backend@0.1.11
+
 ## 0.4.12
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/backend",
-  "version": "0.4.12",
+  "version": "0.4.14",
   "type": "module",
   "scripts": {
     "dev": "bun --env-file=../../.env --watch src/index.ts",
@@ -10,14 +10,14 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/api-docs-common": "0.1.5",
-    "@checkstack/auth-common": "0.5.4",
-    "@checkstack/backend-api": "0.5.2",
-    "@checkstack/common": "0.6.1",
+    "@checkstack/api-docs-common": "0.1.6",
+    "@checkstack/auth-common": "0.5.5",
+    "@checkstack/backend-api": "0.8.0",
+    "@checkstack/common": "0.6.2",
     "@checkstack/drizzle-helper": "0.0.3",
-    "@checkstack/queue-api": "0.2.2",
-    "@checkstack/signal-backend": "0.1.8",
-    "@checkstack/signal-common": "0.1.5",
+    "@checkstack/queue-api": "0.2.5",
+    "@checkstack/signal-backend": "0.1.11",
+    "@checkstack/signal-common": "0.1.6",
     "@hono/zod-validator": "^0.7.6",
     "@orpc/client": "^1.13.2",
     "@orpc/openapi": "^1.13.2",
@@ -37,6 +37,6 @@
     "@types/bun": "latest",
     "@checkstack/tsconfig": "0.0.3",
     "@checkstack/scripts": "0.1.1",
-    "@checkstack/test-utils-backend": "0.1.8"
+    "@checkstack/test-utils-backend": "0.1.11"
   }
 }

package/src/health-check-plugin-integration.test.ts

@@ -46,7 +46,7 @@ describe("HealthCheck Plugin Integration", () => {
       description: "A test strategy for integration testing",
       config: new Versioned({
         version: 1,
-        schema: z.object({}),
+        schema: z.object({ timeout: z.number().default(30_000) }),
       }),
       result: new Versioned({
         version: 1,

package/src/index.ts

@@ -60,6 +60,15 @@ app.use(
 );
 app.use("*", logger());
 
+// SECURITY: Add missing standard security headers across all API responses
+app.use("/api/*", async (c, next) => {
+  await next();
+  c.res.headers.set("X-Content-Type-Options", "nosniff");
+  c.res.headers.set("X-Frame-Options", "DENY");
+  c.res.headers.set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'");
+  c.res.headers.set("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
+});
+
 // Runtime config endpoint - returns BASE_URL for frontend
 app.get("/api/config", (c) => {
   const baseUrl = process.env.BASE_URL || "http://localhost:3000";

package/src/plugin-manager/core-services.ts

@@ -176,9 +176,12 @@ export function registerCoreServices({
           });
           const authClient = rpcClient.forPlugin(AuthApi);
           return await authClient.checkResourceTeamAccess(params);
-        } catch {
-          // Fall back to global access on error
-          return { hasAccess: params.hasGlobalAccess };
+        } catch (error) {
+          // SECURITY: Fail-Closed — deny access when auth service is unavailable
+          rootLogger.error(
+            `[auth] checkResourceTeamAccess: S2S call failed for resource ${params.resourceType}:${params.resourceId}. Denying access (Fail-Closed). Error: ${error}`,
+          );
+          return { hasAccess: false };
         }
       },
 
@@ -189,9 +192,12 @@ export function registerCoreServices({
           });
           const authClient = rpcClient.forPlugin(AuthApi);
           return await authClient.getAccessibleResourceIds(params);
-        } catch {
-          // Fall back to global access on error
-          return params.hasGlobalAccess ? params.resourceIds : [];
+        } catch (error) {
+          // SECURITY: Fail-Closed — return empty set when auth service is unavailable
+          rootLogger.error(
+            `[auth] getAccessibleResourceIds: S2S call failed for resource type ${params.resourceType}. Denying access (Fail-Closed). Error: ${error}`,
+          );
+          return [];
         }
       },
     };

package/src/services/health-check-registry.test.ts

@@ -30,7 +30,7 @@ describe("CoreHealthCheckRegistry", () => {
     description: "A test strategy",
     config: new Versioned({
       version: 1,
-      schema: z.object({}),
+      schema: z.object({ timeout: z.number().default(30_000) }),
     }),
     result: new Versioned({
       version: 1,
@@ -52,7 +52,7 @@ describe("CoreHealthCheckRegistry", () => {
     description: "Another test strategy",
     config: new Versioned({
       version: 1,
-      schema: z.object({}),
+      schema: z.object({ timeout: z.number().default(30_000) }),
     }),
     result: new Versioned({
       version: 1,

package/src/services/health-check-registry.ts

@@ -25,17 +25,21 @@ export class CoreHealthCheckRegistry {
    * Register a strategy with its owning plugin.
    * The strategy ID is stored as: ownerPluginId.strategyId
    */
-  registerWithOwner(
-    strategy: HealthCheckStrategy,
-    ownerPlugin: PluginMetadata
+  registerWithOwner<S extends HealthCheckStrategy>(
+    strategy: S,
+    ownerPlugin: PluginMetadata,
   ): void {
     const qualifiedId = `${ownerPlugin.pluginId}.${strategy.id}`;
     if (this.strategies.has(qualifiedId)) {
       rootLogger.warn(
-        `HealthCheckStrategy '${qualifiedId}' is already registered. Overwriting.`
+        `HealthCheckStrategy '${qualifiedId}' is already registered. Overwriting.`,
       );
     }
-    this.strategies.set(qualifiedId, { strategy, ownerPlugin, qualifiedId });
+    this.strategies.set(qualifiedId, {
+      strategy: strategy as HealthCheckStrategy,
+      ownerPlugin,
+      qualifiedId,
+    });
     rootLogger.debug(`✅ Registered HealthCheckStrategy: ${qualifiedId}`);
   }
 
@@ -75,10 +79,10 @@ export class CoreHealthCheckRegistry {
  */
 export function createScopedHealthCheckRegistry(
   globalRegistry: CoreHealthCheckRegistry,
-  ownerPlugin: PluginMetadata
+  ownerPlugin: PluginMetadata,
 ): HealthCheckRegistry {
   return {
-    register(strategy: HealthCheckStrategy) {
+    register<S extends HealthCheckStrategy>(strategy: S) {
       globalRegistry.registerWithOwner(strategy, ownerPlugin);
     },
     getStrategy(id: string) {