@checkstack/dependency-frontend 0.5.4 → 0.5.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/CHANGELOG.md +71 -0
  2. package/package.json +12 -12
  3. package/src/components/DependencySignalsFiller.tsx +4 -0
  4. package/src/index.tsx +1 -1
package/CHANGELOG.md CHANGED
@@ -1,5 +1,76 @@
1
1
  # @checkstack/dependency-frontend
2
2
 
3
+ ## 0.5.6
4
+
5
+ ### Patch Changes
6
+
7
+ - f9cfdae: fix(dependency): gate the dependency map behind its own non-public access rule
8
+
9
+ Anonymous users could see the "Dependency Map" nav entry and open the page
10
+ (which then rendered empty) because the map was gated by `dependency.read`,
11
+ which is public so that dependency _warning_ badges stay visible on the
12
+ catalog and dashboard.
13
+
14
+ The full topology map is now gated by a dedicated `dependency.map` access
15
+ rule that is granted to authenticated users by default but is NOT public, so
16
+ anonymous visitors no longer see the nav entry or reach the page. The
17
+ `getAllDependencies`, `getNodePositions`, and `saveNodePositions` endpoints
18
+ move to this rule too, and the dashboard dependency signal now renders as
19
+ plain text (not a map link) for users without map access. Per-system
20
+ dependency warnings stay on the public `dependency.read` rule, so warning
21
+ badges/alerts/signals remain visible to everyone as before.
22
+
23
+ Admins can still grant `dependency.map` to the anonymous role to make the
24
+ map public again.
25
+
26
+ Note: the default-rule sync is add-only, so on existing deployments the
27
+ anonymous role keeps any rules already granted. Since `dependency.map` is a
28
+ brand-new rule the anonymous role never had it, so the map is hidden from
29
+ anonymous users immediately after upgrade with no admin action required.
30
+
31
+ - Updated dependencies [f9cfdae]
32
+ - @checkstack/dependency-common@1.2.5
33
+
34
+ ## 0.5.5
35
+
36
+ ### Patch Changes
37
+
38
+ - 56e7c75: Hide navigation, actions and links that the current user cannot use, so anonymous
39
+ and read-only users no longer see entries that lead to "Access Denied" or to
40
+ actions the server would reject.
41
+
42
+ - **Sidebar**: a nav entry can now declare a dynamic `nav.isVisible({ accessRules, isAuthenticated })` predicate (in addition to the static `accessRule`). A group whose every entry is filtered out is no longer rendered. The filtering/grouping logic is extracted to a pure, unit-tested helper.
43
+ - **Infrastructure**: its sidebar entry is shown only when the user can READ at least one contributed tab (queue, cache, …), instead of always (it previously had no static rule because tabs are contributed at runtime).
44
+ - **Notification Settings**: hidden from anonymous users - notifications are per-user, so an anonymous visitor can't have any.
45
+ - **Anomaly Mute / Suppress**: the "Mute" / "Mute all" controls (a per-user preference) are hidden from anonymous visitors; the "Suppress" control is gated on `anomalyAccess.feed.manage`. Both were previously always visible.
46
+ - **Dashboard**: the "Open Catalog" actions (which open the manage-only Catalog config page) are hidden from users without `catalogAccess.system.manage`, and the "View catalog" link is gated on `catalogAccess.system.read`.
47
+ - **Dashboard status signals**: the per-system status rows contributed by plugins (`SystemSignalsSlot`) now render as a LINK only when the user can open the target, and as plain text otherwise. `SystemSignal` gains an optional `accessRule`; the healthcheck, anomaly, and dependency fillers set it for their gated targets (check-history / assignments / dependency-map). Signals pointing at ungated pages (incident / maintenance / SLO detail) stay links.
48
+ - **Plugin Manager**: the "Install plugin" button (which opens the install-gated page) is hidden from users with only `plugin` view access.
49
+ - **Satellites**: the page is entirely manage-gated, but its route/sidebar entry was gated on `read`, so read-only users saw the nav item and hit "Access Denied" on click. The route and nav entry now require `satellite.manage`.
50
+
51
+ The `@checkstack/ai-backend` bump is only the regenerated bundled docs index
52
+ (the frontend routing guide gained the `nav.isVisible` section); no code change.
53
+
54
+ **BREAKING (`@checkstack/frontend-api`):** the `AccessApi` interface gains a
55
+ required `useIsAuthenticated()` method. Custom `AccessApi` implementations must
56
+ add it (it returns `{ loading, isAuthenticated }`). The built-in auth
57
+ implementation and the no-auth fallback already do. `NavEntry` also gains an
58
+ optional `isVisible` predicate (purely additive).
59
+
60
+ - Updated dependencies [460ffd6]
61
+ - Updated dependencies [56e7c75]
62
+ - Updated dependencies [56e7c75]
63
+ - @checkstack/dashboard-frontend@0.8.5
64
+ - @checkstack/frontend-api@0.9.0
65
+ - @checkstack/catalog-common@2.3.4
66
+ - @checkstack/ui@1.15.1
67
+ - @checkstack/common@0.15.0
68
+ - @checkstack/dependency-common@1.2.4
69
+ - @checkstack/gitops-common@0.6.3
70
+ - @checkstack/healthcheck-common@1.5.4
71
+ - @checkstack/gitops-frontend@0.5.5
72
+ - @checkstack/signal-frontend@0.2.4
73
+
3
74
  ## 0.5.4
4
75
 
5
76
  ### Patch Changes
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@checkstack/dependency-frontend",
3
- "version": "0.5.4",
3
+ "version": "0.5.6",
4
4
  "license": "Elastic-2.0",
5
5
  "type": "module",
6
6
  "main": "src/index.tsx",
@@ -13,16 +13,16 @@
13
13
  "lint:code": "eslint . --max-warnings 0"
14
14
  },
15
15
  "dependencies": {
16
- "@checkstack/catalog-common": "2.3.3",
17
- "@checkstack/common": "0.14.1",
18
- "@checkstack/dashboard-frontend": "0.8.4",
19
- "@checkstack/dependency-common": "1.2.3",
20
- "@checkstack/frontend-api": "0.8.0",
21
- "@checkstack/gitops-common": "0.6.2",
22
- "@checkstack/gitops-frontend": "0.5.4",
23
- "@checkstack/healthcheck-common": "1.5.3",
24
- "@checkstack/signal-frontend": "0.2.3",
25
- "@checkstack/ui": "1.15.0",
16
+ "@checkstack/catalog-common": "2.3.4",
17
+ "@checkstack/common": "0.15.0",
18
+ "@checkstack/dashboard-frontend": "0.8.5",
19
+ "@checkstack/dependency-common": "1.2.5",
20
+ "@checkstack/frontend-api": "0.9.0",
21
+ "@checkstack/gitops-common": "0.6.3",
22
+ "@checkstack/gitops-frontend": "0.5.5",
23
+ "@checkstack/healthcheck-common": "1.5.4",
24
+ "@checkstack/signal-frontend": "0.2.4",
25
+ "@checkstack/ui": "1.15.1",
26
26
  "@xyflow/react": "^12.11.0",
27
27
  "lucide-react": "^1.17.0",
28
28
  "react": "19.2.7",
@@ -32,6 +32,6 @@
32
32
  "typescript": "^5.0.0",
33
33
  "@types/react": "^19.0.0",
34
34
  "@checkstack/tsconfig": "0.0.7",
35
- "@checkstack/scripts": "0.6.0"
35
+ "@checkstack/scripts": "0.6.1"
36
36
  }
37
37
  }
package/src/components/DependencySignalsFiller.tsx CHANGED
@@ -9,6 +9,7 @@ import {
9
9
  import {
10
10
  DependencyApi,
11
11
  dependencyRoutes,
12
+ dependencyAccess,
12
13
  type DerivedState,
13
14
  } from "@checkstack/dependency-common";
14
15
 
@@ -63,6 +64,9 @@ export const DependencySignalsFiller: React.FC<Props> = ({
63
64
  ? `${upstreamCount} upstream ${upstreamCount === 1 ? "system" : "systems"} affected`
64
65
  : undefined,
65
66
  href: resolveRoute(dependencyRoutes.routes.map),
67
+ // The dependency map is gated by its own rule; users who can see the
68
+ // warning (dependency.read) but not the map get plain text, not a link.
69
+ accessRule: dependencyAccess.map,
66
70
  iconName: "GitBranch",
67
71
  };
68
72
  result[systemId] = [signal];
package/src/index.tsx CHANGED
@@ -32,7 +32,7 @@ export default createFrontendPlugin({
32
32
  default: m.DependencyMapPage,
33
33
  })),
34
34
  title: "Dependency Map",
35
- accessRule: dependencyAccess.dependency.read,
35
+ accessRule: dependencyAccess.map,
36
36
  nav: { group: "Workspace", icon: GitBranch },
37
37
  },
38
38
  ],