@checkstack/healthcheck-backend 1.14.0 → 1.15.0

package/src/queue-executor.ts

@@ -46,7 +46,11 @@ import { NotificationApi } from "@checkstack/notification-common";
 import { healthcheckSystemSubscription } from "@checkstack/healthcheck-common";
 import { resolveRoute, type InferClient, extractErrorMessage} from "@checkstack/common";
 import { secretEnvMappingSchema } from "@checkstack/secrets-common";
-import type { SecretResolverService } from "@checkstack/secrets-backend";
+import type {
+  SecretResolverService,
+  InternalSecretsService,
+} from "@checkstack/secrets-backend";
+import { inflateConfigSecrets } from "./config-secrets";
 import { HealthCheckService } from "./service";
 import { healthCheckHooks } from "./hooks";
 import { incrementHourlyAggregate } from "./realtime-aggregation";
@@ -538,6 +542,14 @@ async function executeHealthCheckJob(props: {
    * / test isolation.
    */
   secretResolver?: SecretResolverService;
+  /**
+   * Internal secret store. When set (together with `secretResolver`), stored
+   * strategy/collector config `x-secret` fields - internal markers and
+   * `${{ secrets.* }}` references - are INFLATED to their real values just
+   * before use, in memory only. Optional for version-skew / test isolation;
+   * without it, marker-bearing configs fail their runs clearly.
+   */
+  internalSecrets?: InternalSecretsService;
 }): Promise<void> {
   const {
     payload,
@@ -555,6 +567,7 @@ async function executeHealthCheckJob(props: {
     getHealthEntity,
     cache,
     secretResolver,
+    internalSecrets,
   } = props;
   const { configId, systemId } = payload;
 
@@ -656,6 +669,22 @@ async function executeHealthCheckJob(props: {
       return;
     }
 
+    // Inflate stored secret markers / `${{ secrets.* }}` references to their
+    // real values ONCE, memory-only, BEFORE migrate+validate - so validation
+    // sees real values. Old-shape rows (whose current-schema secret keys do
+    // not exist yet) and legacy bare literals pass through untouched.
+    let rawStrategyConfig = configRow.config;
+    if (internalSecrets && secretResolver) {
+      const inflated = await inflateConfigSecrets({
+        configurationId: configId,
+        scope: { kind: "strategy" },
+        schema: strategy.config.schema,
+        config: configRow.config,
+        deps: { internalSecrets, secretResolver },
+      });
+      rawStrategyConfig = inflated.config;
+    }
+
     // Migrate the stored (UNVERSIONED) strategy config ONCE, before the
     // per-environment render loop, so every env renders from the same
     // migrated shape. Stored configs predate explicit versioning and may be
@@ -663,7 +692,7 @@ async function executeHealthCheckJob(props: {
     // -on-read runs the declared migration chain, then validates. The
     // migrations are idempotent, so an already-current config is a no-op.
     const strategyConfig: BaseStrategyConfig =
-      await strategy.config.parseAssumingV1(configRow.config);
+      await strategy.config.parseAssumingV1(rawStrategyConfig);
     const executionTimeout = strategyConfig.timeout ?? 60_000;
 
     // ── Per-environment fan-out (§7) ────────────────────────────────────────
@@ -872,9 +901,26 @@ async function executeHealthCheckJob(props: {
               // reads the raw `secretEnv` mapping (a constant string field
               // unaffected by the strategy/collector reshapes), keeping the
               // migrate -> secret resolve -> render -> execute order intact.
+              // Inflate this entry's secret markers / references (memory
+              // only) before its migrate+validate parse, mirroring the
+              // strategy-config inflation above.
+              let rawCollectorConfig = collectorEntry.config;
+              if (internalSecrets && secretResolver) {
+                const inflated = await inflateConfigSecrets({
+                  configurationId: configId,
+                  scope: {
+                    kind: "collector",
+                    entryId: collectorEntry.id,
+                  },
+                  schema: registered.collector.config.schema,
+                  config: collectorEntry.config,
+                  deps: { internalSecrets, secretResolver },
+                });
+                rawCollectorConfig = inflated.config;
+              }
               const migratedCollectorConfig =
                 await registered.collector.config.parseAssumingV1(
-                  collectorEntry.config,
+                  rawCollectorConfig,
                 );
 
               // (2) Environment/templating pass for the collector config -
@@ -1518,6 +1564,7 @@ export async function setupHealthCheckWorker(props: {
   getHealthEntity?: () => EntityHandle<HealthEntityState> | undefined;
   cache: HealthCheckCache;
   secretResolver?: SecretResolverService;
+  internalSecrets?: InternalSecretsService;
 }): Promise<void> {
   const {
     db,
@@ -1535,6 +1582,7 @@ export async function setupHealthCheckWorker(props: {
     getHealthEntity,
     cache,
     secretResolver,
+    internalSecrets,
   } = props;
 
   const queue =
@@ -1559,6 +1607,7 @@ export async function setupHealthCheckWorker(props: {
         getHealthEntity,
         cache,
         secretResolver,
+        internalSecrets,
       });
     },
     {

package/src/router-config-secrets.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect, mock } from "bun:test";
+import { z } from "zod";
+import { call } from "@orpc/server";
+import {
+  createMockRpcContext,
+  configSecret,
+  Versioned,
+} from "@checkstack/backend-api";
+import { internalSecretName } from "@checkstack/secrets-common";
+import type {
+  InternalSecretsService,
+  SecretResolverService,
+} from "@checkstack/secrets-backend";
+import { createHealthCheckRouter } from "./router";
+import {
+  healthcheckSecretMarker,
+  isHealthcheckSecretMarker,
+} from "./config-secrets";
+import type { HealthCheckCache } from "./cache";
+
+/**
+ * Guards the SEC-1 fix: `createAndAssign` (the first-check wizard / AI propose
+ * creation path) MUST extract inline `x-secret` values into the internal store
+ * and return a REDACTED config - never persist or echo a plaintext credential.
+ */
+
+const passthroughCache: HealthCheckCache = {
+  wrapSystemHealthStatus: (_systemId, loader) => loader(),
+  invalidateSystem: async () => {},
+  invalidateAllSystems: async () => 0,
+  scope: {} as HealthCheckCache["scope"],
+};
+
+const mockUser = {
+  type: "user" as const,
+  id: "test-user",
+  accessRules: ["*"],
+  roles: ["admin"],
+};
+
+// A strategy config with one plain field and one x-secret field.
+const strategySchema = z.object({
+  url: z.string(),
+  password: configSecret({ id: "password" }).optional(),
+});
+
+function fakeInternalSecrets(): InternalSecretsService & {
+  store: Map<string, string>;
+} {
+  const store = new Map<string, string>();
+  return {
+    store,
+    async set({ parts, value }) {
+      store.set(internalSecretName(...parts), value);
+    },
+    async get({ parts }) {
+      return store.get(internalSecretName(...parts));
+    },
+    async delete({ parts }) {
+      store.delete(internalSecretName(...parts));
+    },
+  };
+}
+
+const fakeResolver = {
+  resolveForRun: mock(async () => ({ env: {}, masking: undefined })),
+} as unknown as SecretResolverService;
+
+interface CapturedInsert {
+  values: Record<string, unknown>;
+}
+
+function createCapturingDb(captured: CapturedInsert[]) {
+  const insert = () => ({
+    values: (values: Record<string, unknown>) => {
+      captured.push({ values });
+      return Object.assign(Promise.resolve(undefined), {
+        returning: () =>
+          Promise.resolve([
+            {
+              paused: false,
+              createdAt: new Date(),
+              updatedAt: new Date(),
+              collectors: null,
+              ...values,
+            },
+          ]),
+      });
+    },
+  });
+  const emptyWhere = Object.assign(Promise.resolve([]), {
+    where: () => Promise.resolve([]),
+  });
+  return {
+    insert,
+    select: () => ({ from: () => emptyWhere }),
+    transaction: async (fn: (tx: unknown) => Promise<unknown>) =>
+      fn({ insert }),
+  };
+}
+
+function buildRouter(captured: CapturedInsert[]) {
+  const internalSecrets = fakeInternalSecrets();
+  const strategy = { config: new Versioned({ version: 1, schema: strategySchema }) };
+  const router = createHealthCheckRouter({
+    database: createCapturingDb(captured) as never,
+    registry: { getStrategy: mock(() => strategy) } as never,
+    collectorRegistry: { getCollector: mock(() => undefined) } as never,
+    gitOpsClient: { getProvenance: mock(() => Promise.resolve(null)) } as never,
+    getEmitHook: () => undefined,
+    cache: passthroughCache,
+    configService: { get: mock(async () => undefined), set: mock(async () => {}) } as never,
+    catalogClient: { getSystem: mock(async () => null) } as never,
+    maintenanceClient: {
+      hasActiveMaintenance: mock(async () => ({ active: false })),
+    } as never,
+    logger: {
+      debug: mock(() => {}),
+      info: mock(() => {}),
+      warn: mock(() => {}),
+      error: mock(() => {}),
+    } as never,
+    configSecrets: { internalSecrets, secretResolver: fakeResolver },
+  });
+  return { router, internalSecrets };
+}
+
+describe("createAndAssign secret extraction (SEC-1 regression)", () => {
+  it("extracts an inline secret into the internal store and never persists or returns it", async () => {
+    const captured: CapturedInsert[] = [];
+    const { router, internalSecrets } = buildRouter(captured);
+    const context = createMockRpcContext({ user: mockUser });
+
+    const result = await call(
+      router.createAndAssign,
+      {
+        systemId: "sys-1",
+        configuration: {
+          name: "DB check",
+          strategyId: "healthcheck-http.http",
+          config: { url: "https://x", password: "super-secret" },
+          intervalSeconds: 60,
+        },
+        enabled: false,
+        includeLocal: true,
+        environmentIds: null,
+      },
+      { context },
+    );
+
+    // The persisted config row holds a MARKER, never the plaintext.
+    const configInsert = captured.find((c) => c.values.name === "DB check");
+    expect(configInsert).toBeDefined();
+    const storedConfig = configInsert?.values.config as Record<string, unknown>;
+    expect(isHealthcheckSecretMarker(storedConfig.password as string)).toBe(true);
+    expect(JSON.stringify(captured)).not.toContain("super-secret");
+
+    // The plaintext lives ONLY in the internal (encrypted) store.
+    expect([...internalSecrets.store.values()]).toContain("super-secret");
+
+    // The response is redacted - the secret field is absent.
+    expect(result.config.password).toBeUndefined();
+    expect(result.config.url).toBe("https://x");
+  });
+});

package/src/router-create-and-assign.test.ts

@@ -184,7 +184,11 @@ describe("createAndAssign router handler", () => {
     expect(assignmentInsert?.values.environmentIds).toBeNull();
     // Returns the created configuration.
     expect(result.name).toBe("Payments API root");
-    expect(result.id).toBe("cfg-new");
+    // The id is generated up front (SEC-1: needed to key extracted secrets
+    // before insert), persisted on the config row, and used to link the
+    // assignment - so all three must agree.
+    expect(configInsert?.values.id).toBe(result.id);
+    expect(assignmentInsert?.values.configurationId).toBe(result.id);
   });
 
   it("broadcasts healthcheck.config.changed so open clients refresh", async () => {

package/src/router.ts

@@ -20,6 +20,7 @@ import {
   resolveScriptPackagesDir,
 } from "@checkstack/script-packages-backend";
 import { HealthCheckService } from "./service";
+import type { HealthCheckSecretsDeps } from "./config-secrets";
 import {
   canReadRunScope,
   hasGlobalHistoryAccess,
@@ -74,6 +75,12 @@ export const createHealthCheckRouter = (opts: {
    * run / the SLO self-heal converge the rollup lazily.
    */
   recomputeSystemRollupHealth?: (systemId: string) => Promise<void>;
+  /**
+   * Secrets channel for config credentials (extract-on-write, redact-on-read,
+   * blank-keeps-existing on update). Optional only for tests; the real
+   * router MUST receive it or writes would store inline secrets verbatim.
+   */
+  configSecrets?: HealthCheckSecretsDeps;
 }) => {
   const {
     database,
@@ -95,6 +102,7 @@ export const createHealthCheckRouter = (opts: {
     collectorRegistry,
     configService,
     catalogClient,
+    opts.configSecrets,
   );
 
   // Create contract implementer with context type AND auto auth middleware
@@ -252,12 +260,15 @@ export const createHealthCheckRouter = (opts: {
       return runCollectorScriptTest({ input, deps: { resolutionRoot } });
     }),
 
+    // UI/AI reads are ALWAYS redacted: `x-secret` fields (values, references,
+    // internal markers alike) are stripped server-side. The editor renders a
+    // blank secret input and blank-on-save means "keep existing".
     getConfigurations: os.getConfigurations.handler(async () => {
-      return { configurations: await service.getConfigurations() };
+      return { configurations: await service.getConfigurationsRedacted() };
     }),
 
     getConfiguration: os.getConfiguration.handler(async ({ input }) => {
-      return service.getConfiguration(input.id);
+      return service.getConfigurationRedacted(input.id);
     }),
 
     createConfiguration: os.createConfiguration.handler(async ({ input }) => {
@@ -271,7 +282,8 @@ export const createHealthCheckRouter = (opts: {
         action: "created",
         configurationId: created.id,
       });
-      return created;
+      // The response goes back to the editor: keep it redacted like reads.
+      return service.redactConfiguration(created);
     }),
 
     validateConfiguration: os.validateConfiguration.handler(
@@ -283,8 +295,24 @@ export const createHealthCheckRouter = (opts: {
         // `z.record(z.unknown())` on the input) is validated against each
         // registered schema, surfacing wrong types, missing required fields,
         // and unknown keys - not just missing-field presence.
+        //
+        // For an UPDATE (existingConfigurationId set), restore the stored
+        // config's secrets into the proposed body first: reads are redacted,
+        // so a kept secret arrives blank/absent and would otherwise fail a
+        // required-secret check even though the apply path would preserve it.
+        // The restored values are used ONLY to validate and never returned.
+        let toValidate = input;
+        if (input.existingConfigurationId) {
+          const restored = await service.restoreSecretsForValidation({
+            existingConfigurationId: input.existingConfigurationId,
+            strategyId: input.strategyId,
+            config: input.config,
+            collectors: input.collectors,
+          });
+          toValidate = { ...input, ...restored };
+        }
         const errors = await collectConfigurationIssues({
-          input,
+          input: toValidate,
           registry: context.healthCheckRegistry,
           collectorRegistry: context.collectorRegistry,
         });
@@ -307,7 +335,8 @@ export const createHealthCheckRouter = (opts: {
         action: "updated",
         configurationId: config.id,
       });
-      return config;
+      // The response goes back to the editor: keep it redacted like reads.
+      return service.redactConfiguration(config);
     }),
 
     deleteConfiguration: os.deleteConfiguration.handler(async ({ input }) => {
@@ -381,7 +410,8 @@ export const createHealthCheckRouter = (opts: {
 
     getSystemConfigurations: os.getSystemConfigurations.handler(
       async ({ input }) => {
-        return service.getSystemConfigurations(input.systemId);
+        // Redacted like every other UI config read - x-secret fields stripped.
+        return service.getSystemConfigurationsRedacted(input.systemId);
       },
     ),
 
@@ -431,7 +461,9 @@ export const createHealthCheckRouter = (opts: {
         enabled: input.enabled,
         queueManager: context.queueManager,
       });
-      return configuration;
+      // The response goes back to the caller (wizard / AI tool): redact it
+      // like every other config read/write response.
+      return service.redactConfiguration(configuration);
     }),
 
     disassociateSystem: os.disassociateSystem.handler(async ({ input }) => {