@checkstack/healthcheck-backend 1.20.1 → 1.21.0

package/src/router-assignment-access.test.ts

@@ -0,0 +1,260 @@
+import { describe, it, expect, mock } from "bun:test";
+import { createHealthCheckRouter } from "./router";
+import { createMockRpcContext } from "@checkstack/backend-api";
+import type { RpcContext } from "@checkstack/backend-api";
+import { call } from "@orpc/server";
+import { createStubHealthCheckCache } from "./cache-test-stub";
+
+/**
+ * Router-level tests for the HANDLER-side authorization of the
+ * configuration-centric assignment reads (`getConfigurationAssignments`) and
+ * the relaxed single-configuration read (`getConfiguration`). Their contract
+ * `access` is deliberately empty (see assignment-access.ts), so these tests
+ * are the regression guard that the router actually enforces the rule.
+ */
+
+const passthroughCache = createStubHealthCheckCache();
+
+const CONFIG_ID = "12345678-1234-4234-8234-123456789012";
+
+const CONFIG_ROW = {
+  id: CONFIG_ID,
+  name: "Payments API root",
+  strategyId: "healthcheck-http.http",
+  config: { url: "https://api.example.com/healthz" },
+  collectors: null,
+  intervalSeconds: 60,
+  paused: false,
+  createdAt: new Date(),
+  updatedAt: new Date(),
+};
+
+const ASSIGNMENT_ROWS = [
+  {
+    systemId: "sys-1",
+    enabled: true,
+    stateThresholds: null,
+    satelliteIds: null,
+    environmentIds: null,
+    includeLocal: true,
+    notificationPolicy: null,
+  },
+  {
+    systemId: "sys-2",
+    enabled: false,
+    stateThresholds: null,
+    satelliteIds: ["sat-1"],
+    environmentIds: [],
+    includeLocal: false,
+    notificationPolicy: null,
+  },
+];
+
+/**
+ * A DB serving the three selects these handlers issue, disambiguated by the
+ * projected columns: `select()` (no projection) resolves the configuration
+ * row; a projection containing `enabled` resolves the full assignment rows; a
+ * projection of only `systemId` resolves the assigned-id list.
+ */
+function createReadOnlyDb() {
+  return {
+    select: (projection?: Record<string, unknown>) => ({
+      from: () => {
+        const rows =
+          projection === undefined
+            ? [CONFIG_ROW]
+            : "enabled" in projection
+              ? ASSIGNMENT_ROWS
+              : ASSIGNMENT_ROWS.map((row) => ({ systemId: row.systemId }));
+        return Object.assign(Promise.resolve(rows), {
+          where: () => Promise.resolve(rows),
+        });
+      },
+    }),
+  };
+}
+
+function buildRouter() {
+  return createHealthCheckRouter({
+    database: createReadOnlyDb() as never,
+    registry: { getStrategy: mock(() => undefined) } as never,
+    collectorRegistry: { getCollector: mock(() => undefined) } as never,
+    gitOpsClient: {
+      getProvenance: mock(() => Promise.resolve(null)),
+    } as never,
+    getEmitHook: () => undefined,
+    cache: passthroughCache,
+    configService: {
+      get: mock(async () => undefined),
+      set: mock(async () => {}),
+    } as never,
+    catalogClient: {
+      getSystems: mock(async () => ({
+        systems: [
+          { id: "sys-1", name: "Payments" },
+          { id: "sys-2", name: "Checkout" },
+        ],
+      })),
+    } as never,
+    maintenanceClient: {
+      hasActiveMaintenance: mock(async () => ({ active: false })),
+    } as never,
+    logger: {
+      debug: mock(() => {}),
+      info: mock(() => {}),
+      warn: mock(() => {}),
+      error: mock(() => {}),
+    } as never,
+  });
+}
+
+const teamUser = {
+  type: "user" as const,
+  id: "team-user",
+  accessRules: [] as string[],
+};
+
+/** An auth override where the caller holds the given grants and nothing else. */
+function authOverride({
+  configGrant,
+  readableSystemIds,
+}: {
+  configGrant: boolean;
+  readableSystemIds: string[];
+}): Partial<RpcContext> {
+  return {
+    auth: {
+      check: mock(async ({ objectType }: { objectType: string }) => ({
+        hasAccess: objectType === "healthcheck.healthcheck" && configGrant,
+      })),
+      listAccessibleObjectIds: mock(
+        async ({ objectIds }: { objectIds: string[] }) =>
+          objectIds.filter((id) => readableSystemIds.includes(id)),
+      ),
+    } as unknown as RpcContext["auth"],
+  };
+}
+
+describe("getConfigurationAssignments authorization", () => {
+  it("global configuration.read sees every row with resolved system names", async () => {
+    const router = buildRouter();
+    const context = createMockRpcContext({
+      user: {
+        type: "user",
+        id: "global-reader",
+        accessRules: ["healthcheck.healthcheck.read"],
+      },
+    });
+
+    const rows = await call(
+      router.getConfigurationAssignments,
+      { configId: CONFIG_ID },
+      { context },
+    );
+
+    expect(rows.map((r) => r.systemName).toSorted()).toEqual([
+      "Checkout",
+      "Payments",
+    ]);
+    // null environmentIds (= all envs) must survive the trip untouched.
+    expect(rows.find((r) => r.systemId === "sys-1")?.environmentIds).toBeNull();
+    expect(rows.find((r) => r.systemId === "sys-2")?.environmentIds).toEqual(
+      [],
+    );
+  });
+
+  it("a team grant on the CONFIGURATION sees every row", async () => {
+    const router = buildRouter();
+    const context = createMockRpcContext({
+      user: teamUser,
+      ...authOverride({ configGrant: true, readableSystemIds: [] }),
+    });
+
+    const rows = await call(
+      router.getConfigurationAssignments,
+      { configId: CONFIG_ID },
+      { context },
+    );
+    expect(rows).toHaveLength(2);
+  });
+
+  it("a system-only caller sees ONLY their systems' rows", async () => {
+    const router = buildRouter();
+    const context = createMockRpcContext({
+      user: teamUser,
+      ...authOverride({ configGrant: false, readableSystemIds: ["sys-2"] }),
+    });
+
+    const rows = await call(
+      router.getConfigurationAssignments,
+      { configId: CONFIG_ID },
+      { context },
+    );
+    expect(rows).toHaveLength(1);
+    expect(rows[0].systemId).toBe("sys-2");
+    expect(rows[0].systemName).toBe("Checkout");
+  });
+
+  it("a caller with no grant of either kind is FORBIDDEN", async () => {
+    const router = buildRouter();
+    const context = createMockRpcContext({
+      user: teamUser,
+      ...authOverride({ configGrant: false, readableSystemIds: [] }),
+    });
+
+    await expect(
+      call(
+        router.getConfigurationAssignments,
+        { configId: CONFIG_ID },
+        { context },
+      ),
+    ).rejects.toThrow(/FORBIDDEN|read access/i);
+  });
+});
+
+describe("getConfiguration relaxed authorization", () => {
+  it("a team grant on the configuration reads it", async () => {
+    const router = buildRouter();
+    const context = createMockRpcContext({
+      user: teamUser,
+      ...authOverride({ configGrant: true, readableSystemIds: [] }),
+    });
+
+    const config = await call(
+      router.getConfiguration,
+      { id: CONFIG_ID },
+      { context },
+    );
+    expect(config?.name).toBe("Payments API root");
+  });
+
+  it("a reader of an ASSIGNED system reads it", async () => {
+    const router = buildRouter();
+    const context = createMockRpcContext({
+      user: teamUser,
+      ...authOverride({ configGrant: false, readableSystemIds: ["sys-1"] }),
+    });
+
+    const config = await call(
+      router.getConfiguration,
+      { id: CONFIG_ID },
+      { context },
+    );
+    expect(config?.name).toBe("Payments API root");
+  });
+
+  it("an unrelated caller gets the same `undefined` as a missing id (no existence leak)", async () => {
+    const router = buildRouter();
+    const context = createMockRpcContext({
+      user: teamUser,
+      ...authOverride({ configGrant: false, readableSystemIds: [] }),
+    });
+
+    const config = await call(
+      router.getConfiguration,
+      { id: CONFIG_ID },
+      { context },
+    );
+    expect(config).toBeUndefined();
+  });
+});

package/src/router.ts

@@ -28,6 +28,13 @@ import {
   listTeamManageableConfigurationIds,
   resolveHistoryScope,
 } from "./history-access";
+import {
+  canReadConfigurationScope,
+  hasConfigurationReadGrant,
+  hasGlobalConfigurationRead,
+  listReadableSystemIds,
+  resolveAssignmentRowScope,
+} from "./assignment-access";
 import { collectConfigurationIssues } from "./validate-configuration";
 import { runCollectorScriptTest } from "./collector-script-test";
 import { healthCheckHooks } from "./hooks";
@@ -340,9 +347,26 @@ export const createHealthCheckRouter = (opts: {
       return { configurations: await service.getConfigurationsRedacted() };
     }),
 
-    getConfiguration: os.getConfiguration.handler(async ({ input }) => {
-      return service.getConfigurationRedacted(input.id);
-    }),
+    getConfiguration: os.getConfiguration.handler(
+      async ({ input, context }) => {
+        // Handler-side authorization (the contract's `access` is deliberately
+        // empty - see the contract doc): global configuration read, a team
+        // grant on the configuration, or read access to an ASSIGNED system.
+        // An unauthorized caller gets the same `undefined` as a missing id,
+        // so configuration ids don't leak existence. Fail-closed via
+        // assignment-access.ts.
+        const configuration = await service.getConfigurationRedacted(input.id);
+        if (!configuration) return;
+        const allowed = await canReadConfigurationScope({
+          auth: context.auth,
+          user: context.user,
+          configurationId: input.id,
+          getAssignedSystemIds: () => service.getAssignedSystemIds(input.id),
+        });
+        if (!allowed) return;
+        return configuration;
+      },
+    ),
 
     createConfiguration: os.createConfiguration.handler(async ({ input }) => {
       const created = await service.createConfiguration(input);
@@ -494,6 +518,66 @@ export const createHealthCheckRouter = (opts: {
       },
     ),
 
+    getConfigurationAssignments: os.getConfigurationAssignments.handler(
+      async ({ input, context }) => {
+        // Handler-side authorization (the contract's `access` is deliberately
+        // empty - see the contract doc): global configuration read or a team
+        // grant on the CONFIGURATION sees every row; otherwise rows are
+        // filtered to the systems the caller may read; neither is forbidden.
+        // Fail-closed via assignment-access.ts.
+        const user = context.user;
+        const rows = await service.getConfigurationAssignments(input.configId);
+
+        let visibleRows = rows;
+        if (!hasGlobalConfigurationRead(user)) {
+          if (!user || (user.type !== "user" && user.type !== "application")) {
+            throw new ORPCError("FORBIDDEN", {
+              message:
+                "Assignment details require health check read access (globally, or via a team grant on the configuration or an assigned system)",
+            });
+          }
+          const hasConfigGrant = await hasConfigurationReadGrant({
+            auth: context.auth,
+            user,
+            configurationId: input.configId,
+          });
+          const readableSystemIds = hasConfigGrant
+            ? []
+            : await listReadableSystemIds({
+                auth: context.auth,
+                user,
+                allSystemIds: rows.map((row) => row.systemId),
+              });
+          const scope = resolveAssignmentRowScope({
+            user,
+            hasConfigurationGrant: hasConfigGrant,
+            readableSystemIds,
+          });
+          if (scope.kind === "forbidden") {
+            throw new ORPCError("FORBIDDEN", {
+              message:
+                "Assignment details require health check read access (globally, or via a team grant on the configuration or an assigned system)",
+            });
+          }
+          if (scope.kind === "scoped") {
+            const readable = new Set(scope.systemIds);
+            visibleRows = rows.filter((row) => readable.has(row.systemId));
+          }
+        }
+
+        if (visibleRows.length === 0) return [];
+
+        // Resolve system display names in ONE trusted S2S call (names live in
+        // the catalog plugin); fall back to the id if a system vanished.
+        const { systems } = await catalogClient.getSystems();
+        const nameById = new Map(systems.map((s) => [s.id, s.name]));
+        return visibleRows.map((row) => ({
+          ...row,
+          systemName: nameById.get(row.systemId) ?? row.systemId,
+        }));
+      },
+    ),
+
     getBulkAssignedHealthCheckCounts:
       os.getBulkAssignedHealthCheckCounts.handler(async ({ input }) => {
         // ONE grouped query for the whole visible system list (replaces the
@@ -505,6 +589,21 @@ export const createHealthCheckRouter = (opts: {
         return { counts };
       }),
 
+    resolveEnqueueEnvironments: os.resolveEnqueueEnvironments.handler(
+      async ({ input }) => {
+        // Delegates to the same resolution the run_now automation + scheduler
+        // use, so a cross-plugin one-off run (e.g. logstream fast-path) targets
+        // exactly the environment slices the executor accepts.
+        const environmentIds = await service.resolveEnqueueEnvironmentIds({
+          systemId: input.systemId,
+          configurationId: input.configId,
+          catalogClient,
+          logger,
+        });
+        return { environmentIds };
+      },
+    ),
+
     associateSystem: os.associateSystem.handler(async ({ input, context }) => {
       await enforceNotGitOpsLocked("System", input.systemId);
       await service.associateSystem({

package/src/service.ts

@@ -989,6 +989,63 @@ export class HealthCheckService {
     return results;
   }
 
+  /**
+   * Configuration-centric inverse of {@link getSystemAssociations}: the
+   * per-system assignment rows of ONE configuration. System NAMES are
+   * resolved by the router via the catalog S2S client (they live in the
+   * catalog plugin's storage); rows here carry ids only.
+   */
+  async getConfigurationAssignments(configurationId: string) {
+    const rows = await this.db
+      .select({
+        systemId: systemHealthChecks.systemId,
+        enabled: systemHealthChecks.enabled,
+        stateThresholds: systemHealthChecks.stateThresholds,
+        satelliteIds: systemHealthChecks.satelliteIds,
+        environmentIds: systemHealthChecks.environmentIds,
+        includeLocal: systemHealthChecks.includeLocal,
+        notificationPolicy: systemHealthChecks.notificationPolicy,
+      })
+      .from(systemHealthChecks)
+      .where(eq(systemHealthChecks.configurationId, configurationId));
+
+    // Migrate and extract thresholds for each assignment (same treatment as
+    // getSystemAssociations).
+    const results = [];
+    for (const row of rows) {
+      let thresholds: StateThresholds | undefined;
+      if (row.stateThresholds) {
+        thresholds = await stateThresholds.parse(row.stateThresholds);
+      }
+      results.push({
+        systemId: row.systemId,
+        enabled: row.enabled,
+        stateThresholds: thresholds,
+        satelliteIds: row.satelliteIds ?? undefined,
+        // Preserve the null/[]/list distinction (null = all envs, [] = opt
+        // out). Do NOT collapse null to undefined via `??`.
+        environmentIds: row.environmentIds,
+        includeLocal: row.includeLocal,
+        notificationPolicy: row.notificationPolicy ?? undefined,
+      });
+    }
+    return results;
+  }
+
+  /**
+   * The system ids a configuration is assigned to. Authorization helper for
+   * the relaxed `getConfiguration` read (see assignment-access.ts) - kept as
+   * a bare id select so the auth path never pays for the full assignment
+   * rows.
+   */
+  async getAssignedSystemIds(configurationId: string): Promise<string[]> {
+    const rows = await this.db
+      .select({ systemId: systemHealthChecks.systemId })
+      .from(systemHealthChecks)
+      .where(eq(systemHealthChecks.configurationId, configurationId));
+    return rows.map((row) => row.systemId);
+  }
+
   /**
    * Count of health-check assignments for each of `systemIds`, keyed by
    * systemId. ONE grouped query (no per-system fan-out) so the catalog manager
@@ -2659,25 +2716,37 @@ export class HealthCheckService {
 
     if (matchingAssociations.length === 0) return [];
 
-    // Resolve human-readable system names once per distinct systemId.
-    // Falls back to the systemId when no catalog client is wired or the
-    // lookup fails, mirroring the queue-executor's resolution behaviour.
-    const systemNameCache = new Map<string, string>();
-    const resolveSystemName = async (systemId: string): Promise<string> => {
-      const cached = systemNameCache.get(systemId);
+    // Resolve human-readable system name + free-form metadata once per distinct
+    // systemId. Falls back to the systemId (and empty metadata) when no catalog
+    // client is wired or the lookup fails, mirroring the queue-executor's
+    // resolution behaviour. The metadata rides the assignment so satellite runs
+    // template `{{ system.metadata.<key> }}` identically to local runs.
+    const systemCache = new Map<
+      string,
+      { name: string; metadata: Record<string, unknown> }
+    >();
+    const resolveSystem = async (
+      systemId: string,
+    ): Promise<{ name: string; metadata: Record<string, unknown> }> => {
+      const cached = systemCache.get(systemId);
       if (cached !== undefined) return cached;
 
-      let systemName = systemId;
+      let resolved: { name: string; metadata: Record<string, unknown> } = {
+        name: systemId,
+        metadata: {},
+      };
       if (this.catalogClient) {
         try {
           const system = await this.catalogClient.getSystem({ systemId });
-          if (system) systemName = system.name;
+          if (system) {
+            resolved = { name: system.name, metadata: system.metadata ?? {} };
+          }
         } catch {
           // Fall back to systemId if catalog lookup fails.
         }
       }
-      systemNameCache.set(systemId, systemName);
-      return systemName;
+      systemCache.set(systemId, resolved);
+      return resolved;
     };
 
     // Get configurations for each matching association
@@ -2690,6 +2759,7 @@ export class HealthCheckService {
 
       if (!config || config.paused) continue;
 
+      const system = await resolveSystem(assoc.systemId);
       assignments.push({
         configId: config.id,
         systemId: assoc.systemId,
@@ -2699,7 +2769,8 @@ export class HealthCheckService {
         intervalSeconds: config.intervalSeconds,
         // Curated run-context metadata exposed to satellite collectors.
         configName: config.name,
-        systemName: await resolveSystemName(assoc.systemId),
+        systemName: system.name,
+        systemMetadata: system.metadata,
       });
     }