@checkstack/healthcheck-backend 1.14.0 → 1.16.0

package/src/retention-rollup.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from "bun:test";
+import { computeAssertionKey } from "@checkstack/healthcheck-common";
 import { getTableConfig } from "drizzle-orm/pg-core";
 import { healthCheckAggregates } from "./schema";
 import {
@@ -116,3 +117,71 @@ describe("DAILY_AGGREGATE_CONFLICT_TARGET", () => {
     expect(targetCols).toEqual(constraintCols);
   });
 });
+
+describe("buildDailyAggregates - assertion stats", () => {
+  const KEY = computeAssertionKey({
+    assertion: { field: "statusCode", operator: "equals", value: 200 },
+  });
+
+  it("sums per-assertion counts across the day's hourly buckets", () => {
+    const daily = buildDailyAggregates([
+      hourly({
+        bucketStart: new Date("2026-01-01T03:00:00.000Z"),
+        aggregatedResult: {
+          collectors: {},
+          assertions: { "uuid-1": { [KEY]: { passCount: 50, failCount: 2 } } },
+        },
+      }),
+      hourly({
+        bucketStart: new Date("2026-01-01T04:00:00.000Z"),
+        aggregatedResult: {
+          assertions: { "uuid-1": { [KEY]: { passCount: 60, failCount: 0 } } },
+        },
+      }),
+      // Pre-feature hourly bucket without stats is tolerated.
+      hourly({
+        bucketStart: new Date("2026-01-01T05:00:00.000Z"),
+        aggregatedResult: null,
+      }),
+    ]);
+
+    expect(daily.length).toBe(1);
+    expect(daily[0].assertionStats).toEqual({
+      "uuid-1": { [KEY]: { passCount: 110, failCount: 2 } },
+    });
+  });
+
+  it("keeps assertion stats scoped to their (env, source) series", () => {
+    const daily = buildDailyAggregates([
+      hourly({
+        environmentId: "prod",
+        aggregatedResult: {
+          assertions: { "uuid-1": { [KEY]: { passCount: 1, failCount: 0 } } },
+        },
+      }),
+      hourly({
+        environmentId: "staging",
+        aggregatedResult: {
+          assertions: { "uuid-1": { [KEY]: { passCount: 0, failCount: 1 } } },
+        },
+      }),
+    ]);
+
+    expect(daily.length).toBe(2);
+    const prod = daily.find((d) => d.environmentId === "prod");
+    const staging = daily.find((d) => d.environmentId === "staging");
+    expect(prod?.assertionStats?.["uuid-1"][KEY]).toEqual({
+      passCount: 1,
+      failCount: 0,
+    });
+    expect(staging?.assertionStats?.["uuid-1"][KEY]).toEqual({
+      passCount: 0,
+      failCount: 1,
+    });
+  });
+
+  it("buckets without stats yield undefined assertionStats", () => {
+    const daily = buildDailyAggregates([hourly({})]);
+    expect(daily[0].assertionStats).toBeUndefined();
+  });
+});

package/src/router-config-secrets.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect, mock } from "bun:test";
+import { z } from "zod";
+import { call } from "@orpc/server";
+import {
+  createMockRpcContext,
+  configSecret,
+  Versioned,
+} from "@checkstack/backend-api";
+import { internalSecretName } from "@checkstack/secrets-common";
+import type {
+  InternalSecretsService,
+  SecretResolverService,
+} from "@checkstack/secrets-backend";
+import { createHealthCheckRouter } from "./router";
+import {
+  healthcheckSecretMarker,
+  isHealthcheckSecretMarker,
+} from "./config-secrets";
+import type { HealthCheckCache } from "./cache";
+
+/**
+ * Guards the SEC-1 fix: `createAndAssign` (the first-check wizard / AI propose
+ * creation path) MUST extract inline `x-secret` values into the internal store
+ * and return a REDACTED config - never persist or echo a plaintext credential.
+ */
+
+const passthroughCache: HealthCheckCache = {
+  wrapSystemHealthStatus: (_systemId, loader) => loader(),
+  invalidateSystem: async () => {},
+  invalidateAllSystems: async () => 0,
+  scope: {} as HealthCheckCache["scope"],
+};
+
+const mockUser = {
+  type: "user" as const,
+  id: "test-user",
+  accessRules: ["*"],
+  roles: ["admin"],
+};
+
+// A strategy config with one plain field and one x-secret field.
+const strategySchema = z.object({
+  url: z.string(),
+  password: configSecret({ id: "password" }).optional(),
+});
+
+function fakeInternalSecrets(): InternalSecretsService & {
+  store: Map<string, string>;
+} {
+  const store = new Map<string, string>();
+  return {
+    store,
+    async set({ parts, value }) {
+      store.set(internalSecretName(...parts), value);
+    },
+    async get({ parts }) {
+      return store.get(internalSecretName(...parts));
+    },
+    async delete({ parts }) {
+      store.delete(internalSecretName(...parts));
+    },
+  };
+}
+
+const fakeResolver = {
+  resolveForRun: mock(async () => ({ env: {}, masking: undefined })),
+} as unknown as SecretResolverService;
+
+interface CapturedInsert {
+  values: Record<string, unknown>;
+}
+
+function createCapturingDb(captured: CapturedInsert[]) {
+  const insert = () => ({
+    values: (values: Record<string, unknown>) => {
+      captured.push({ values });
+      return Object.assign(Promise.resolve(undefined), {
+        returning: () =>
+          Promise.resolve([
+            {
+              paused: false,
+              createdAt: new Date(),
+              updatedAt: new Date(),
+              collectors: null,
+              ...values,
+            },
+          ]),
+      });
+    },
+  });
+  const emptyWhere = Object.assign(Promise.resolve([]), {
+    where: () => Promise.resolve([]),
+  });
+  return {
+    insert,
+    select: () => ({ from: () => emptyWhere }),
+    transaction: async (fn: (tx: unknown) => Promise<unknown>) =>
+      fn({ insert }),
+  };
+}
+
+function buildRouter(captured: CapturedInsert[]) {
+  const internalSecrets = fakeInternalSecrets();
+  const strategy = { config: new Versioned({ version: 1, schema: strategySchema }) };
+  const router = createHealthCheckRouter({
+    database: createCapturingDb(captured) as never,
+    registry: { getStrategy: mock(() => strategy) } as never,
+    collectorRegistry: { getCollector: mock(() => undefined) } as never,
+    gitOpsClient: { getProvenance: mock(() => Promise.resolve(null)) } as never,
+    getEmitHook: () => undefined,
+    cache: passthroughCache,
+    configService: { get: mock(async () => undefined), set: mock(async () => {}) } as never,
+    catalogClient: { getSystem: mock(async () => null) } as never,
+    maintenanceClient: {
+      hasActiveMaintenance: mock(async () => ({ active: false })),
+    } as never,
+    logger: {
+      debug: mock(() => {}),
+      info: mock(() => {}),
+      warn: mock(() => {}),
+      error: mock(() => {}),
+    } as never,
+    configSecrets: { internalSecrets, secretResolver: fakeResolver },
+  });
+  return { router, internalSecrets };
+}
+
+describe("createAndAssign secret extraction (SEC-1 regression)", () => {
+  it("extracts an inline secret into the internal store and never persists or returns it", async () => {
+    const captured: CapturedInsert[] = [];
+    const { router, internalSecrets } = buildRouter(captured);
+    const context = createMockRpcContext({ user: mockUser });
+
+    const result = await call(
+      router.createAndAssign,
+      {
+        systemId: "sys-1",
+        configuration: {
+          name: "DB check",
+          strategyId: "healthcheck-http.http",
+          config: { url: "https://x", password: "super-secret" },
+          intervalSeconds: 60,
+        },
+        enabled: false,
+        includeLocal: true,
+        environmentIds: null,
+      },
+      { context },
+    );
+
+    // The persisted config row holds a MARKER, never the plaintext.
+    const configInsert = captured.find((c) => c.values.name === "DB check");
+    expect(configInsert).toBeDefined();
+    const storedConfig = configInsert?.values.config as Record<string, unknown>;
+    expect(isHealthcheckSecretMarker(storedConfig.password as string)).toBe(true);
+    expect(JSON.stringify(captured)).not.toContain("super-secret");
+
+    // The plaintext lives ONLY in the internal (encrypted) store.
+    expect([...internalSecrets.store.values()]).toContain("super-secret");
+
+    // The response is redacted - the secret field is absent.
+    expect(result.config.password).toBeUndefined();
+    expect(result.config.url).toBe("https://x");
+  });
+});

package/src/router-create-and-assign.test.ts

@@ -184,7 +184,11 @@ describe("createAndAssign router handler", () => {
     expect(assignmentInsert?.values.environmentIds).toBeNull();
     // Returns the created configuration.
     expect(result.name).toBe("Payments API root");
-    expect(result.id).toBe("cfg-new");
+    // The id is generated up front (SEC-1: needed to key extracted secrets
+    // before insert), persisted on the config row, and used to link the
+    // assignment - so all three must agree.
+    expect(configInsert?.values.id).toBe(result.id);
+    expect(assignmentInsert?.values.configurationId).toBe(result.id);
   });
 
   it("broadcasts healthcheck.config.changed so open clients refresh", async () => {

package/src/router.ts

@@ -20,6 +20,7 @@ import {
   resolveScriptPackagesDir,
 } from "@checkstack/script-packages-backend";
 import { HealthCheckService } from "./service";
+import type { HealthCheckSecretsDeps } from "./config-secrets";
 import {
   canReadRunScope,
   hasGlobalHistoryAccess,
@@ -74,6 +75,12 @@ export const createHealthCheckRouter = (opts: {
    * run / the SLO self-heal converge the rollup lazily.
    */
   recomputeSystemRollupHealth?: (systemId: string) => Promise<void>;
+  /**
+   * Secrets channel for config credentials (extract-on-write, redact-on-read,
+   * blank-keeps-existing on update). Optional only for tests; the real
+   * router MUST receive it or writes would store inline secrets verbatim.
+   */
+  configSecrets?: HealthCheckSecretsDeps;
 }) => {
   const {
     database,
@@ -95,6 +102,7 @@ export const createHealthCheckRouter = (opts: {
     collectorRegistry,
     configService,
     catalogClient,
+    opts.configSecrets,
   );
 
   // Create contract implementer with context type AND auto auth middleware
@@ -252,12 +260,15 @@ export const createHealthCheckRouter = (opts: {
       return runCollectorScriptTest({ input, deps: { resolutionRoot } });
     }),
 
+    // UI/AI reads are ALWAYS redacted: `x-secret` fields (values, references,
+    // internal markers alike) are stripped server-side. The editor renders a
+    // blank secret input and blank-on-save means "keep existing".
     getConfigurations: os.getConfigurations.handler(async () => {
-      return { configurations: await service.getConfigurations() };
+      return { configurations: await service.getConfigurationsRedacted() };
     }),
 
     getConfiguration: os.getConfiguration.handler(async ({ input }) => {
-      return service.getConfiguration(input.id);
+      return service.getConfigurationRedacted(input.id);
     }),
 
     createConfiguration: os.createConfiguration.handler(async ({ input }) => {
@@ -271,7 +282,8 @@ export const createHealthCheckRouter = (opts: {
         action: "created",
         configurationId: created.id,
       });
-      return created;
+      // The response goes back to the editor: keep it redacted like reads.
+      return service.redactConfiguration(created);
     }),
 
     validateConfiguration: os.validateConfiguration.handler(
@@ -283,8 +295,24 @@ export const createHealthCheckRouter = (opts: {
         // `z.record(z.unknown())` on the input) is validated against each
         // registered schema, surfacing wrong types, missing required fields,
         // and unknown keys - not just missing-field presence.
+        //
+        // For an UPDATE (existingConfigurationId set), restore the stored
+        // config's secrets into the proposed body first: reads are redacted,
+        // so a kept secret arrives blank/absent and would otherwise fail a
+        // required-secret check even though the apply path would preserve it.
+        // The restored values are used ONLY to validate and never returned.
+        let toValidate = input;
+        if (input.existingConfigurationId) {
+          const restored = await service.restoreSecretsForValidation({
+            existingConfigurationId: input.existingConfigurationId,
+            strategyId: input.strategyId,
+            config: input.config,
+            collectors: input.collectors,
+          });
+          toValidate = { ...input, ...restored };
+        }
         const errors = await collectConfigurationIssues({
-          input,
+          input: toValidate,
           registry: context.healthCheckRegistry,
           collectorRegistry: context.collectorRegistry,
         });
@@ -307,7 +335,8 @@ export const createHealthCheckRouter = (opts: {
         action: "updated",
         configurationId: config.id,
       });
-      return config;
+      // The response goes back to the editor: keep it redacted like reads.
+      return service.redactConfiguration(config);
     }),
 
     deleteConfiguration: os.deleteConfiguration.handler(async ({ input }) => {
@@ -381,7 +410,8 @@ export const createHealthCheckRouter = (opts: {
 
     getSystemConfigurations: os.getSystemConfigurations.handler(
       async ({ input }) => {
-        return service.getSystemConfigurations(input.systemId);
+        // Redacted like every other UI config read - x-secret fields stripped.
+        return service.getSystemConfigurationsRedacted(input.systemId);
       },
     ),
 
@@ -431,7 +461,9 @@ export const createHealthCheckRouter = (opts: {
         enabled: input.enabled,
         queueManager: context.queueManager,
       });
-      return configuration;
+      // The response goes back to the caller (wizard / AI tool): redact it
+      // like every other config read/write response.
+      return service.redactConfiguration(configuration);
     }),
 
     disassociateSystem: os.disassociateSystem.handler(async ({ input }) => {