@checkstack/healthcheck-backend 1.12.0 → 1.13.1

package/CHANGELOG.md

@@ -1,5 +1,73 @@
 # @checkstack/healthcheck-backend
 
+## 1.13.1
+
+### Patch Changes
+
+- Updated dependencies [b4e0832]
+  - @checkstack/ai-backend@0.10.4
+  - @checkstack/automation-backend@0.10.6
+  - @checkstack/catalog-backend@1.6.4
+  - @checkstack/incident-backend@1.9.2
+  - @checkstack/satellite-backend@0.7.7
+
+## 1.13.0
+
+### Minor Changes
+
+- 0cac684: Align the health-check run-history gates end to end. The history surfaces had a
+  three-way drift: the route allowed `configuration.read`, the page required
+  manage capability, and the procedures required the standalone
+  `healthcheck.details` rule - so global read-rule holders reached a page that
+  denied them, and team-scoped managers passed the page gate but got 403s from
+  every data call.
+
+  Detailed run history is now a MANAGER surface everywhere, with system owners
+  included: access requires global `configuration.manage`, a team manage grant
+  on the CONFIGURATION, or manage access to the SYSTEM - a system's owning team
+  sees every run of that system, whoever owns the configuration.
+
+  - Routes, pages, drawer links, and the anomaly/health signals gate on the
+    manage capability (with `catalog.system` as the parent type); the drawer and
+    chart hook check the caller's grant on the specific configuration OR system.
+  - All three history procedures (`getDetailedHistory`,
+    `getDetailedAggregatedHistory`, `getRunById`) are authorized in the handler
+    via a shared fail-closed module (`history-access.ts`) - the triple-OR is not
+    expressible with the declarative instanceAccess modes. `getRunById`
+    authorizes against the fetched run's own configuration/system, and answers
+    `undefined` for unauthorized callers so run ids don't leak existence.
+  - The feed (`getDetailedHistory`) scopes team callers to runs of their
+    configurations UNION runs of their systems, with correct pagination totals.
+
+  BREAKING CHANGES:
+
+  - The standalone `healthcheck.details` access rule is REMOVED. Roles that held
+    `details` without `configuration.manage` lose access to detailed run data;
+    grant them the manage rule (or a team grant on the configuration/system)
+    instead. Stale role rows referencing the removed rule are inert.
+  - `getDetailedAggregatedHistory` is `authenticated` (was `public`); anonymous
+    callers could never pass its access rule anyway.
+
+### Patch Changes
+
+- Updated dependencies [0cac684]
+- Updated dependencies [0cac684]
+- Updated dependencies [0cac684]
+  - @checkstack/ai-backend@0.10.3
+  - @checkstack/gitops-common@0.7.0
+  - @checkstack/healthcheck-common@1.11.0
+  - @checkstack/automation-backend@0.10.5
+  - @checkstack/catalog-backend@1.6.3
+  - @checkstack/incident-backend@1.9.1
+  - @checkstack/sdk@0.119.1
+  - @checkstack/gitops-backend@0.5.16
+  - @checkstack/satellite-backend@0.7.6
+  - @checkstack/backend-api@0.27.1
+  - @checkstack/script-packages-backend@0.3.20
+  - @checkstack/command-backend@0.2.16
+  - @checkstack/secrets-backend@0.2.16
+  - @checkstack/status-page-backend@0.4.3
+
 ## 1.12.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/healthcheck-backend",
-  "version": "1.12.0",
+  "version": "1.13.1",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -14,31 +14,31 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.27.0",
-    "@checkstack/ai-backend": "0.10.2",
+    "@checkstack/backend-api": "0.27.1",
+    "@checkstack/ai-backend": "0.10.4",
     "@checkstack/ai-common": "0.6.3",
-    "@checkstack/script-packages-backend": "0.3.19",
+    "@checkstack/script-packages-backend": "0.3.20",
     "@checkstack/cache-api": "0.3.16",
     "@checkstack/cache-utils": "0.2.21",
-    "@checkstack/catalog-backend": "1.6.2",
+    "@checkstack/catalog-backend": "1.6.4",
     "@checkstack/catalog-common": "2.6.0",
-    "@checkstack/command-backend": "0.2.15",
+    "@checkstack/command-backend": "0.2.16",
     "@checkstack/common": "0.19.0",
-    "@checkstack/gitops-backend": "0.5.15",
-    "@checkstack/gitops-common": "0.6.8",
-    "@checkstack/healthcheck-common": "1.10.0",
+    "@checkstack/gitops-backend": "0.5.16",
+    "@checkstack/gitops-common": "0.7.0",
+    "@checkstack/healthcheck-common": "1.11.0",
     "@checkstack/secrets-common": "0.2.8",
-    "@checkstack/secrets-backend": "0.2.15",
-    "@checkstack/incident-backend": "1.9.0",
+    "@checkstack/secrets-backend": "0.2.16",
+    "@checkstack/incident-backend": "1.9.2",
     "@checkstack/incident-common": "1.7.0",
-    "@checkstack/automation-backend": "0.10.4",
+    "@checkstack/automation-backend": "0.10.6",
     "@checkstack/maintenance-common": "1.8.0",
     "@checkstack/notification-common": "1.5.0",
     "@checkstack/queue-api": "0.3.16",
-    "@checkstack/satellite-backend": "0.7.5",
-    "@checkstack/sdk": "0.118.1",
+    "@checkstack/satellite-backend": "0.7.7",
+    "@checkstack/sdk": "0.120.0",
     "@checkstack/signal-common": "0.2.14",
-    "@checkstack/status-page-backend": "0.4.2",
+    "@checkstack/status-page-backend": "0.4.3",
     "@checkstack/status-page-common": "0.5.0",
     "@hono/zod-validator": "^0.7.6",
     "drizzle-orm": "^0.45.0",
@@ -52,7 +52,7 @@
   "devDependencies": {
     "@checkstack/drizzle-helper": "0.0.6",
     "@checkstack/scripts": "0.7.0",
-    "@checkstack/test-utils-backend": "0.1.49",
+    "@checkstack/test-utils-backend": "0.1.50",
     "@checkstack/tsconfig": "0.0.7",
     "@types/bun": "^1.0.0",
     "@types/tdigest": "^0.1.5",

package/src/history-access.test.ts

@@ -0,0 +1,283 @@
+import { describe, expect, test } from "bun:test";
+import type { AuthService, AuthUser } from "@checkstack/backend-api";
+import {
+  canReadRunScope,
+  hasGlobalHistoryAccess,
+  listManageableSystemIds,
+  listTeamManageableConfigurationIds,
+  resolveHistoryScope,
+} from "./history-access";
+
+/**
+ * Regression guard for the run-history authorization: global
+ * `configuration.manage` (or wildcard/service) yields unrestricted access, a
+ * team-scoped caller is restricted to runs of their granted CONFIGURATIONS
+ * plus all runs of the SYSTEMS they manage (a system's owning team sees every
+ * run of that system, whoever owns the configuration), anyone else is
+ * forbidden, and any auth (S2S) failure fails CLOSED.
+ */
+
+const QUALIFIED_MANAGE = "healthcheck.healthcheck.manage";
+const QUALIFIED_SYSTEM_MANAGE = "catalog.system.manage";
+
+const realUser = (accessRules: string[]): AuthUser => ({
+  type: "user",
+  id: "u1",
+  accessRules,
+});
+
+// Cast is unavoidable for a partial mock: the helpers only touch
+// `listAccessibleObjectIds` / `check`, and implementing the full AuthService
+// here would just be noise.
+const authWith = (impl: Partial<AuthService>): AuthService =>
+  impl as unknown as AuthService;
+
+describe("hasGlobalHistoryAccess", () => {
+  test("true for global manage, wildcard, and services; false otherwise", () => {
+    expect(hasGlobalHistoryAccess(realUser([QUALIFIED_MANAGE]))).toBe(true);
+    expect(hasGlobalHistoryAccess(realUser(["*"]))).toBe(true);
+    expect(hasGlobalHistoryAccess({ type: "service", pluginId: "slo" })).toBe(
+      true,
+    );
+    expect(hasGlobalHistoryAccess(realUser(["healthcheck.healthcheck.read"]))).toBe(
+      false,
+    );
+    expect(hasGlobalHistoryAccess(undefined)).toBe(false);
+  });
+});
+
+describe("resolveHistoryScope", () => {
+  test("global manage rule yields the unfiltered feed", () => {
+    expect(
+      resolveHistoryScope({
+        user: realUser([QUALIFIED_MANAGE]),
+        accessibleConfigurationIds: [],
+        accessibleSystemIds: [],
+      }),
+    ).toEqual({ kind: "all" });
+  });
+
+  test("configuration grants scope the feed", () => {
+    expect(
+      resolveHistoryScope({
+        user: realUser([]),
+        accessibleConfigurationIds: ["cfg-1"],
+        accessibleSystemIds: [],
+      }),
+    ).toEqual({ kind: "scoped", configurationIds: ["cfg-1"], systemIds: [] });
+  });
+
+  test("system manage alone scopes the feed (owning team sees its runs)", () => {
+    expect(
+      resolveHistoryScope({
+        user: realUser([]),
+        accessibleConfigurationIds: [],
+        accessibleSystemIds: ["sys-1"],
+      }),
+    ).toEqual({ kind: "scoped", configurationIds: [], systemIds: ["sys-1"] });
+  });
+
+  test("no global rule and no grant of either kind is forbidden", () => {
+    expect(
+      resolveHistoryScope({
+        user: realUser(["healthcheck.healthcheck.read"]),
+        accessibleConfigurationIds: [],
+        accessibleSystemIds: [],
+      }),
+    ).toEqual({ kind: "forbidden" });
+  });
+
+  test("missing user is forbidden", () => {
+    expect(
+      resolveHistoryScope({
+        user: undefined,
+        accessibleConfigurationIds: [],
+        accessibleSystemIds: [],
+      }),
+    ).toEqual({ kind: "forbidden" });
+  });
+
+  test("a manage rule from ANOTHER plugin does not unlock the feed", () => {
+    expect(
+      resolveHistoryScope({
+        user: realUser(["incident.incident.manage"]),
+        accessibleConfigurationIds: [],
+        accessibleSystemIds: [],
+      }),
+    ).toEqual({ kind: "forbidden" });
+  });
+});
+
+describe("listTeamManageableConfigurationIds", () => {
+  test("resolves the manage-granted subset via the auth S2S", async () => {
+    const auth = authWith({
+      listAccessibleObjectIds: async ({ objectType, action, objectIds }) => {
+        expect(objectType).toBe("healthcheck.healthcheck");
+        expect(action).toBe("manage");
+        return objectIds.filter((id) => id === "cfg-2");
+      },
+    });
+
+    await expect(
+      listTeamManageableConfigurationIds({
+        auth,
+        user: realUser([]),
+        allConfigurationIds: ["cfg-1", "cfg-2"],
+      }),
+    ).resolves.toEqual(["cfg-2"]);
+  });
+
+  test("fails CLOSED when the auth S2S errors", async () => {
+    const auth = authWith({
+      listAccessibleObjectIds: async () => {
+        throw new Error("auth down");
+      },
+    });
+
+    await expect(
+      listTeamManageableConfigurationIds({
+        auth,
+        user: realUser([]),
+        allConfigurationIds: ["cfg-1"],
+      }),
+    ).resolves.toEqual([]);
+  });
+});
+
+describe("listManageableSystemIds", () => {
+  test("resolves the team-granted subset keyed on catalog.system manage", async () => {
+    const auth = authWith({
+      listAccessibleObjectIds: async ({ objectType, action, objectIds }) => {
+        expect(objectType).toBe("catalog.system");
+        expect(action).toBe("manage");
+        return objectIds.filter((id) => id === "sys-1");
+      },
+    });
+
+    await expect(
+      listManageableSystemIds({
+        auth,
+        user: realUser([]),
+        allSystemIds: ["sys-1", "sys-2"],
+      }),
+    ).resolves.toEqual(["sys-1"]);
+  });
+
+  test("the global catalog.system.manage rule grants every system (parentScope convention)", async () => {
+    const auth = authWith({
+      listAccessibleObjectIds: async () => {
+        throw new Error("must not be called");
+      },
+    });
+
+    await expect(
+      listManageableSystemIds({
+        auth,
+        user: realUser([QUALIFIED_SYSTEM_MANAGE]),
+        allSystemIds: ["sys-1", "sys-2"],
+      }),
+    ).resolves.toEqual(["sys-1", "sys-2"]);
+  });
+
+  test("fails CLOSED when the auth S2S errors", async () => {
+    const auth = authWith({
+      listAccessibleObjectIds: async () => {
+        throw new Error("auth down");
+      },
+    });
+
+    await expect(
+      listManageableSystemIds({
+        auth,
+        user: realUser([]),
+        allSystemIds: ["sys-1"],
+      }),
+    ).resolves.toEqual([]);
+  });
+});
+
+describe("canReadRunScope", () => {
+  const scope = { configurationId: "cfg-1", systemId: "sys-1" };
+
+  test("global healthcheck manage allows without any S2S call", async () => {
+    const auth = authWith({
+      check: async () => {
+        throw new Error("must not be called");
+      },
+    });
+
+    await expect(
+      canReadRunScope({ auth, user: realUser([QUALIFIED_MANAGE]), ...scope }),
+    ).resolves.toBe(true);
+  });
+
+  test("a team grant on the CONFIGURATION allows", async () => {
+    const auth = authWith({
+      check: async ({ objectType, objectId }) => ({
+        hasAccess:
+          objectType === "healthcheck.healthcheck" && objectId === "cfg-1",
+      }),
+    });
+
+    await expect(
+      canReadRunScope({ auth, user: realUser([]), ...scope }),
+    ).resolves.toBe(true);
+  });
+
+  test("a team grant on the SYSTEM allows even without a configuration grant", async () => {
+    const auth = authWith({
+      check: async ({ objectType, objectId }) => ({
+        hasAccess: objectType === "catalog.system" && objectId === "sys-1",
+      }),
+    });
+
+    await expect(
+      canReadRunScope({ auth, user: realUser([]), ...scope }),
+    ).resolves.toBe(true);
+  });
+
+  test("the global catalog.system.manage rule allows (parentScope convention)", async () => {
+    const auth = authWith({
+      check: async () => {
+        throw new Error("must not be called");
+      },
+    });
+
+    await expect(
+      canReadRunScope({
+        auth,
+        user: realUser([QUALIFIED_SYSTEM_MANAGE]),
+        ...scope,
+      }),
+    ).resolves.toBe(true);
+  });
+
+  test("no grant of either kind denies", async () => {
+    const auth = authWith({
+      check: async () => ({ hasAccess: false }),
+    });
+
+    await expect(
+      canReadRunScope({ auth, user: realUser([]), ...scope }),
+    ).resolves.toBe(false);
+  });
+
+  test("missing user denies", async () => {
+    const auth = authWith({});
+    await expect(
+      canReadRunScope({ auth, user: undefined, ...scope }),
+    ).resolves.toBe(false);
+  });
+
+  test("fails CLOSED when the auth S2S errors", async () => {
+    const auth = authWith({
+      check: async () => {
+        throw new Error("auth down");
+      },
+    });
+
+    await expect(
+      canReadRunScope({ auth, user: realUser([]), ...scope }),
+    ).resolves.toBe(false);
+  });
+});

package/src/history-access.ts

@@ -0,0 +1,203 @@
+import { qualifyAccessRuleId } from "@checkstack/common";
+import type { AuthUser, AuthService } from "@checkstack/backend-api";
+import {
+  healthCheckAccess,
+  healthCheckResourceTypes,
+  pluginMetadata,
+} from "@checkstack/healthcheck-common";
+import { catalogResourceTypes } from "@checkstack/catalog-common";
+
+/**
+ * The qualified global rule that unlocks the UNFILTERED run-history feed.
+ * Kept in lock-step with the history procs' contract docs: their `access` is
+ * deliberately empty (the OR below is not expressible declaratively), so THIS
+ * module is the authorization for them.
+ */
+const QUALIFIED_MANAGE_RULE = qualifyAccessRuleId(
+  pluginMetadata,
+  healthCheckAccess.configuration.manage,
+);
+
+/**
+ * The parent (catalog.system) global manage rule. Follows the middleware's
+ * parentScope convention: authorizing via a parent consults the parent's own
+ * grants AND its global `{resourceType}.{action}` rule.
+ */
+const QUALIFIED_SYSTEM_MANAGE_RULE = `${catalogResourceTypes.system}.manage`;
+
+/** A user/application principal (the only kinds that can hold team grants). */
+type GrantHolder = AuthUser & { type: "user" | "application" };
+
+const isGrantHolder = (user: AuthUser): user is GrantHolder =>
+  user.type === "user" || user.type === "application";
+
+/**
+ * Does the caller hold UNRESTRICTED run-history access? True for wildcard
+ * admins, global `healthcheck.healthcheck.manage` holders, and trusted
+ * services (same stance as the middleware).
+ */
+export function hasGlobalHistoryAccess(user: AuthUser | undefined): boolean {
+  if (!user) return false;
+  if (user.type === "service") return true;
+  const rules = user.accessRules ?? [];
+  return rules.includes("*") || rules.includes(QUALIFIED_MANAGE_RULE);
+}
+
+/** The outcome of authorizing the run-history FEED for the current caller. */
+export type HistoryScope =
+  /** Global manage (or wildcard/service): the caller sees every run. */
+  | { kind: "all" }
+  /**
+   * Team-scoped caller: restrict rows to runs of these configurations OR runs
+   * belonging to these systems (a system's owning team sees ALL of its runs,
+   * regardless of who owns the configuration).
+   */
+  | { kind: "scoped"; configurationIds: string[]; systemIds: string[] }
+  /** No global rule and no team grant of either kind: the read is forbidden. */
+  | { kind: "forbidden" };
+
+/**
+ * Pure decision half of the feed authorization: given the caller and their
+ * team-accessible configuration/system ids, decide the feed scope. Split from
+ * the S2S lookups so the branching is unit-testable without an auth service.
+ */
+export function resolveHistoryScope({
+  user,
+  accessibleConfigurationIds,
+  accessibleSystemIds,
+}: {
+  user: AuthUser | undefined;
+  accessibleConfigurationIds: string[];
+  accessibleSystemIds: string[];
+}): HistoryScope {
+  if (!user) return { kind: "forbidden" };
+  if (hasGlobalHistoryAccess(user)) return { kind: "all" };
+
+  if (
+    accessibleConfigurationIds.length === 0 &&
+    accessibleSystemIds.length === 0
+  ) {
+    return { kind: "forbidden" };
+  }
+  return {
+    kind: "scoped",
+    configurationIds: accessibleConfigurationIds,
+    systemIds: accessibleSystemIds,
+  };
+}
+
+/**
+ * Resolve which of `allConfigurationIds` the caller may MANAGE via team
+ * grants on the CONFIGURATION itself. FAILS CLOSED: an S2S error yields an
+ * empty set, i.e. narrower access, never wider.
+ */
+export async function listTeamManageableConfigurationIds({
+  auth,
+  user,
+  allConfigurationIds,
+}: {
+  auth: AuthService;
+  user: AuthUser;
+  allConfigurationIds: string[];
+}): Promise<string[]> {
+  if (!isGrantHolder(user)) return [];
+  if (allConfigurationIds.length === 0) return [];
+  try {
+    return await auth.listAccessibleObjectIds({
+      userId: user.id,
+      userType: user.type,
+      objectType: healthCheckResourceTypes.configuration,
+      objectIds: allConfigurationIds,
+      action: "manage",
+      hasGlobalAccess: false,
+    });
+  } catch {
+    // SECURITY: fail closed - an auth outage must not widen the feed.
+    return [];
+  }
+}
+
+/**
+ * Resolve which of `allSystemIds` the caller may MANAGE - via a team grant on
+ * the system, or via the global `catalog.system.manage` rule (the parentScope
+ * convention). A system's owning team sees every run of that system, even for
+ * configurations owned elsewhere. FAILS CLOSED on S2S errors.
+ */
+export async function listManageableSystemIds({
+  auth,
+  user,
+  allSystemIds,
+}: {
+  auth: AuthService;
+  user: AuthUser;
+  allSystemIds: string[];
+}): Promise<string[]> {
+  if (!isGrantHolder(user)) return [];
+  if (allSystemIds.length === 0) return [];
+  const rules = user.accessRules ?? [];
+  if (rules.includes(QUALIFIED_SYSTEM_MANAGE_RULE)) return allSystemIds;
+  try {
+    return await auth.listAccessibleObjectIds({
+      userId: user.id,
+      userType: user.type,
+      objectType: catalogResourceTypes.system,
+      objectIds: allSystemIds,
+      action: "manage",
+      hasGlobalAccess: false,
+    });
+  } catch {
+    // SECURITY: fail closed - an auth outage must not widen the feed.
+    return [];
+  }
+}
+
+/**
+ * Per-object check for the single-configuration history surfaces
+ * (`getRunById`, `getDetailedAggregatedHistory`): the caller may read runs of
+ * (`configurationId`, `systemId`) iff they hold global history access, a team
+ * manage grant on the CONFIGURATION, or manage access to the SYSTEM (team
+ * grant or global catalog rule). FAILS CLOSED on S2S errors.
+ */
+export async function canReadRunScope({
+  auth,
+  user,
+  configurationId,
+  systemId,
+}: {
+  auth: AuthService;
+  user: AuthUser | undefined;
+  configurationId: string;
+  systemId: string;
+}): Promise<boolean> {
+  if (!user) return false;
+  if (hasGlobalHistoryAccess(user)) return true;
+  if (!isGrantHolder(user)) return false;
+
+  const rules = user.accessRules ?? [];
+  if (rules.includes(QUALIFIED_SYSTEM_MANAGE_RULE)) return true;
+
+  try {
+    const configCheck = await auth.check({
+      userId: user.id,
+      userType: user.type,
+      objectType: healthCheckResourceTypes.configuration,
+      objectId: configurationId,
+      action: "manage",
+      hasGlobalAccess: false,
+    });
+    if (configCheck.hasAccess) return true;
+
+    const systemCheck = await auth.check({
+      userId: user.id,
+      userType: user.type,
+      objectType: catalogResourceTypes.system,
+      objectId: systemId,
+      action: "manage",
+      hasGlobalAccess: false,
+    });
+    return systemCheck.hasAccess;
+  } catch {
+    // SECURITY: fail closed - an auth outage must not widen access.
+    return false;
+  }
+}

package/src/router.ts

@@ -20,6 +20,13 @@ import {
   resolveScriptPackagesDir,
 } from "@checkstack/script-packages-backend";
 import { HealthCheckService } from "./service";
+import {
+  canReadRunScope,
+  hasGlobalHistoryAccess,
+  listManageableSystemIds,
+  listTeamManageableConfigurationIds,
+  resolveHistoryScope,
+} from "./history-access";
 import { collectConfigurationIssues } from "./validate-configuration";
 import { runCollectorScriptTest } from "./collector-script-test";
 import { healthCheckHooks } from "./hooks";
@@ -482,12 +489,76 @@ export const createHealthCheckRouter = (opts: {
       return service.getRunStats(input);
     }),
 
-    getDetailedHistory: os.getDetailedHistory.handler(async ({ input }) => {
-      return service.getDetailedHistory(input);
-    }),
+    getDetailedHistory: os.getDetailedHistory.handler(
+      async ({ input, context }) => {
+        // Handler-side authorization (the contract's `access` is deliberately
+        // empty - see the contract doc): global `configuration.manage` (or a
+        // trusted service) gets the full feed; a team-scoped caller gets the
+        // feed filtered to the configurations their teams manage PLUS all
+        // runs of the systems they manage (a system's owning team sees every
+        // run of that system); everyone else is forbidden. Fail-closed via
+        // history-access.ts.
+        const user = context.user;
+        let accessibleConfigurationIds: string[] = [];
+        let accessibleSystemIds: string[] = [];
+        if (
+          user &&
+          (user.type === "user" || user.type === "application") &&
+          !hasGlobalHistoryAccess(user)
+        ) {
+          const configs = await service.getConfigurations();
+          [accessibleConfigurationIds, accessibleSystemIds] =
+            await Promise.all([
+              listTeamManageableConfigurationIds({
+                auth: context.auth,
+                user,
+                allConfigurationIds: configs.map((c) => c.id),
+              }),
+              listManageableSystemIds({
+                auth: context.auth,
+                user,
+                allSystemIds: await service.getRunSystemIds(),
+              }),
+            ]);
+        }
+        const scope = resolveHistoryScope({
+          user,
+          accessibleConfigurationIds,
+          accessibleSystemIds,
+        });
+        if (scope.kind === "forbidden") {
+          throw new ORPCError("FORBIDDEN", {
+            message:
+              "Run history requires health check manage access (globally, or via a team grant on a configuration or system)",
+          });
+        }
+        if (scope.kind === "all") {
+          return service.getDetailedHistory(input);
+        }
+        return service.getDetailedHistory({
+          ...input,
+          teamScope: {
+            configurationIds: scope.configurationIds,
+            systemIds: scope.systemIds,
+          },
+        });
+      },
+    ),
 
-    getRunById: os.getRunById.handler(async ({ input }) => {
-      return service.getRunById(input);
+    getRunById: os.getRunById.handler(async ({ input, context }) => {
+      // Authorized against the FETCHED run's own configuration/system (the
+      // anchor cannot be spoofed via input). An unauthorized caller gets the
+      // same `undefined` as a missing run, so run ids don't leak existence.
+      const run = await service.getRunById({ runId: input.runId });
+      if (!run) return;
+      const allowed = await canReadRunScope({
+        auth: context.auth,
+        user: context.user,
+        configurationId: run.configurationId,
+        systemId: run.systemId,
+      });
+      if (!allowed) return;
+      return run;
     }),
 
     getAggregatedHistory: os.getAggregatedHistory.handler(async ({ input }) => {
@@ -497,7 +568,21 @@ export const createHealthCheckRouter = (opts: {
     }),
 
     getDetailedAggregatedHistory: os.getDetailedAggregatedHistory.handler(
-      async ({ input }) => {
+      async ({ input, context }) => {
+        // Authorized on the (configurationId, systemId) input pair - exactly
+        // the slice returned. See the contract doc / history-access.ts.
+        const allowed = await canReadRunScope({
+          auth: context.auth,
+          user: context.user,
+          configurationId: input.configurationId,
+          systemId: input.systemId,
+        });
+        if (!allowed) {
+          throw new ORPCError("FORBIDDEN", {
+            message:
+              "Detailed run data requires health check manage access (globally, or via a team grant on this configuration or system)",
+          });
+        }
         return service.getAggregatedHistory(input, {
           includeAggregatedResult: true,
         });

package/src/service.ts

@@ -33,6 +33,7 @@ import * as schema from "./schema";
 import {
   eq,
   and,
+  or,
   InferSelectModel,
   desc,
   gte,
@@ -1268,9 +1269,31 @@ export class HealthCheckService {
    * Restricted to users with manage access.
    * @param sortOrder - 'asc' for chronological (oldest first), 'desc' for reverse (newest first)
    */
+  /**
+   * Distinct system ids that have at least one recorded run - the candidate
+   * set for scoping the run-history feed by SYSTEM manage access (a system's
+   * owning team sees every run of that system).
+   */
+  async getRunSystemIds(): Promise<string[]> {
+    const rows = await this.db
+      .selectDistinct({ systemId: healthCheckRuns.systemId })
+      .from(healthCheckRuns);
+    return rows.map((r) => r.systemId);
+  }
+
   async getDetailedHistory(props: {
     systemId?: string;
     configurationId?: string;
+    /**
+     * Restrict the feed to a team-scoped caller's slice: runs of their
+     * configurations OR runs belonging to their systems (a system's owning
+     * team sees every run of that system). Applied on TOP of the other
+     * filters; both `total` and the page respect it, so pagination stays
+     * correct for a filtered feed. At least one array must be non-empty
+     * (an entirely-empty scope is the caller's "forbidden" case, decided
+     * before the query).
+     */
+    teamScope?: { configurationIds: string[]; systemIds: string[] };
     startDate?: Date;
     endDate?: Date;
     sourceFilter?: string;
@@ -1283,6 +1306,7 @@ export class HealthCheckService {
     const {
       systemId,
       configurationId,
+      teamScope,
       startDate,
       endDate,
       sourceFilter,
@@ -1297,6 +1321,28 @@ export class HealthCheckService {
     if (systemId) conditions.push(eq(healthCheckRuns.systemId, systemId));
     if (configurationId)
       conditions.push(eq(healthCheckRuns.configurationId, configurationId));
+    if (teamScope) {
+      // drizzle's inArray rejects empty arrays, so only include non-empty
+      // branches of the OR.
+      const scopeBranches = [];
+      if (teamScope.configurationIds.length > 0) {
+        scopeBranches.push(
+          inArray(healthCheckRuns.configurationId, teamScope.configurationIds),
+        );
+      }
+      if (teamScope.systemIds.length > 0) {
+        scopeBranches.push(
+          inArray(healthCheckRuns.systemId, teamScope.systemIds),
+        );
+      }
+      if (scopeBranches.length === 0) {
+        // Defensive: an empty scope must never widen to the full feed.
+        return { runs: [], total: 0 };
+      }
+      conditions.push(
+        scopeBranches.length === 1 ? scopeBranches[0] : or(...scopeBranches),
+      );
+    }
     if (startDate) conditions.push(gte(healthCheckRuns.timestamp, startDate));
     if (endDate) conditions.push(lte(healthCheckRuns.timestamp, endDate));