@checkstack/healthcheck-backend 0.15.1 → 0.16.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @checkstack/healthcheck-backend
 
+## 0.16.0
+
+### Minor Changes
+
+- 80cbc51: Enforce GitOps provenance lock on backend API endpoints to prevent manual configuration drift for synchronized resources.
+
+### Patch Changes
+
+- Updated dependencies [80cbc51]
+  - @checkstack/catalog-backend@0.5.0
+  - @checkstack/satellite-backend@0.2.8
+
 ## 0.15.1
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-backend",
-  "version": "0.15.1",
+  "version": "0.16.0",
   "type": "module",
   "main": "src/index.ts",
   "checkstack": {

package/src/index.ts

@@ -30,6 +30,7 @@ import { satelliteHooks } from "@checkstack/satellite-backend";
 import { CatalogApi } from "@checkstack/catalog-common";
 import { MaintenanceApi } from "@checkstack/maintenance-common";
 import { IncidentApi } from "@checkstack/incident-common";
+import { GitOpsApi } from "@checkstack/gitops-common";
 import { healthCheckHooks } from "./hooks";
 import { registerSearchProvider } from "@checkstack/command-backend";
 import { resolveRoute } from "@checkstack/common";
@@ -164,6 +165,9 @@ export default createBackendPlugin({
         // Create incident client for notification suppression checks
         const incidentClient = rpcClient.forPlugin(IncidentApi);
 
+        // Create gitops client for provenance lock checks
+        const gitOpsClient = rpcClient.forPlugin(GitOpsApi);
+
         // Setup queue-based health check worker
         await setupHealthCheckWorker({
           db: database,
@@ -189,6 +193,7 @@ export default createBackendPlugin({
           database: database as SafeDatabase<typeof schema>,
           registry: healthCheckRegistry,
           collectorRegistry,
+          gitOpsClient,
           getEmitHook: () => storedEmitHook,
         });
         rpc.registerRouter(healthCheckRouter, healthCheckContract);

package/src/router.test.ts

@@ -50,10 +50,15 @@ describe("HealthCheck Router", () => {
     getCollectorsForPlugin: mock(() => []),
   };
 
+  const mockGitOpsClient = {
+    getProvenance: mock<any>(() => Promise.resolve(null)),
+  };
+
   const router = createHealthCheckRouter({
     database: mockDb as never,
     registry: mockRegistry,
     collectorRegistry: mockCollectorRegistry as never,
+    gitOpsClient: mockGitOpsClient as never,
     getEmitHook: () => undefined,
   });
 
@@ -169,4 +174,63 @@ describe("HealthCheck Router", () => {
     );
     expect(result).toHaveLength(0);
   });
+
+  describe("GitOps Provenance Enforcement", () => {
+    it("allows deleteConfiguration when GitOps lock is not present", async () => {
+      mockGitOpsClient.getProvenance.mockResolvedValueOnce(null);
+      const context = createMockRpcContext({ user: mockUser });
+      
+      try {
+        await call(router.deleteConfiguration, "config-1", { context });
+      } catch (e: any) {
+        // If it throws anything other than FORBIDDEN, it passed the lock check
+        expect(e.code).not.toBe("FORBIDDEN");
+      }
+      
+      expect(mockGitOpsClient.getProvenance).toHaveBeenCalledWith({
+        kind: "Healthcheck",
+        entityId: "config-1"
+      });
+    });
+
+    it("throws FORBIDDEN when deleting a GitOps locked configuration", async () => {
+      mockGitOpsClient.getProvenance.mockResolvedValueOnce({ 
+        id: "prov-1", kind: "Healthcheck", entityId: "config-1", 
+        providerId: "prov", entityName: "c1", status: "synced", 
+        lastSyncedAt: new Date(), createdAt: new Date(), updatedAt: new Date(),
+        repository: "", filePath: "", fileSha: ""
+      });
+      const context = createMockRpcContext({ user: mockUser });
+      
+      let error;
+      try {
+        await call(router.deleteConfiguration, "config-1", { context });
+      } catch (e) {
+        error = e;
+      }
+      expect(error).toBeDefined();
+      expect((error as any).code).toBe("FORBIDDEN");
+      expect((error as any).message).toContain("managed by GitOps");
+    });
+    
+    it("throws FORBIDDEN when associating a system that is GitOps locked", async () => {
+      mockGitOpsClient.getProvenance.mockResolvedValueOnce({ 
+        id: "prov-1", kind: "System", entityId: "sys-1", 
+        providerId: "prov", entityName: "s1", status: "synced", 
+        lastSyncedAt: new Date(), createdAt: new Date(), updatedAt: new Date(),
+        repository: "", filePath: "", fileSha: ""
+      });
+      const context = createMockRpcContext({ user: mockUser });
+      
+      let error;
+      try {
+        await call(router.associateSystem, { systemId: "sys-1", body: { configurationId: "12345678-1234-4234-8234-123456789012", enabled: true, satelliteIds: [], includeLocal: false } }, { context });
+      } catch (e: any) {
+        error = e;
+        if (e.code !== "FORBIDDEN") console.log(e.issues || e.message);
+      }
+      expect(error).toBeDefined();
+      expect((error as any).code).toBe("FORBIDDEN");
+    });
+  });
 });

package/src/router.ts

@@ -13,6 +13,8 @@ import { HealthCheckService } from "./service";
 import { healthCheckHooks } from "./hooks";
 import * as schema from "./schema";
 import { toJsonSchemaWithChartMeta } from "./schema-utils";
+import type { InferClient } from "@checkstack/common";
+import { GitOpsApi } from "@checkstack/gitops-common";
 
 /**
  * Creates the healthcheck router using contract-based implementation.
@@ -24,6 +26,7 @@ export const createHealthCheckRouter = (opts: {
   database: SafeDatabase<typeof schema>;
   registry: HealthCheckRegistry;
   collectorRegistry: CollectorRegistry;
+  gitOpsClient: InferClient<typeof GitOpsApi>;
   getEmitHook: () => ((hook: { id: string }, payload: Record<string, unknown>) => Promise<void>) | undefined;
 }) => {
   const { database, registry, collectorRegistry, getEmitHook } = opts;
@@ -35,6 +38,18 @@ export const createHealthCheckRouter = (opts: {
     .$context<RpcContext>()
     .use(autoAuthMiddleware);
 
+  const enforceNotGitOpsLocked = async (kind: string, entityId: string) => {
+    const provenance = await opts.gitOpsClient.getProvenance({
+      kind,
+      entityId,
+    });
+    if (provenance) {
+      throw new ORPCError("FORBIDDEN", {
+        message: `${kind} is managed by GitOps and cannot be modified manually.`,
+      });
+    }
+  };
+
   return os.router({
     getStrategies: os.getStrategies.handler(async ({ context }) => {
       return context.healthCheckRegistry.getStrategiesWithMeta().map((r) => ({
@@ -101,6 +116,7 @@ export const createHealthCheckRouter = (opts: {
     }),
 
     updateConfiguration: os.updateConfiguration.handler(async ({ input }) => {
+      await enforceNotGitOpsLocked("Healthcheck", input.id);
       const config = await service.updateConfiguration(input.id, input.body);
       if (!config) {
         throw new ORPCError("NOT_FOUND", {
@@ -111,14 +127,17 @@ export const createHealthCheckRouter = (opts: {
     }),
 
     deleteConfiguration: os.deleteConfiguration.handler(async ({ input }) => {
+      await enforceNotGitOpsLocked("Healthcheck", input);
       await service.deleteConfiguration(input);
     }),
 
     pauseConfiguration: os.pauseConfiguration.handler(async ({ input }) => {
+      await enforceNotGitOpsLocked("Healthcheck", input);
       await service.pauseConfiguration(input);
     }),
 
     resumeConfiguration: os.resumeConfiguration.handler(async ({ input }) => {
+      await enforceNotGitOpsLocked("Healthcheck", input);
       await service.resumeConfiguration(input);
     }),
 
@@ -135,6 +154,7 @@ export const createHealthCheckRouter = (opts: {
     ),
 
     associateSystem: os.associateSystem.handler(async ({ input, context }) => {
+      await enforceNotGitOpsLocked("System", input.systemId);
       await service.associateSystem({
         systemId: input.systemId,
         configurationId: input.body.configurationId,
@@ -173,6 +193,7 @@ export const createHealthCheckRouter = (opts: {
     }),
 
     disassociateSystem: os.disassociateSystem.handler(async ({ input }) => {
+      await enforceNotGitOpsLocked("System", input.systemId);
       await service.disassociateSystem(input.systemId, input.configId);
 
       // Notify subscribers that assignments changed
@@ -191,6 +212,7 @@ export const createHealthCheckRouter = (opts: {
 
     updateRetentionConfig: os.updateRetentionConfig.handler(
       async ({ input }) => {
+        await enforceNotGitOpsLocked("System", input.systemId);
         await service.updateRetentionConfig(
           input.systemId,
           input.configurationId,