@checkstack/incident-backend 1.10.0 → 1.11.0

package/CHANGELOG.md

@@ -1,5 +1,104 @@
 # @checkstack/incident-backend
 
+## 1.11.0
+
+### Minor Changes
+
+- f93ee7a: Fix a class of 403s where team-scoped managers were blocked from endpoints they
+  needed. A repo-wide audit of every `instanceAccess: { global: true }` procedure
+  found more instances of the same bug behind the health-check editor fix: an
+  endpoint on a team-scopable resource type, gated so only the GLOBAL access rule
+  (never a team grant) authorizes it.
+
+  Automation: the editor utilities and catalogs (`validateDefinition`,
+  `listTriggers`, `listActions`, `listArtifactTypes`, `listAutomationGroups`,
+  `listAutomationTemplates`, `renderTemplate`, `testScript`) now use `typeScoped`
+  so a team-scoped automation manager can author without the global rule. The run
+  endpoints (`listRuns`, `getRun`, `cancelRun`, `getRunScopeForReplay`) are scoped
+  to their parent automation via `parentScope` on `automationId`; `getRun`,
+  `cancelRun`, and `getRunScopeForReplay` now take the owning `automationId`
+  (always available in the run URL/editor) and the handler filters the run fetch by
+  it, so a run id cannot be paired with a foreign automation the caller happens to
+  hold a grant on. The two migration-admin endpoints stay `global: true` (genuine
+  platform-admin actions).
+
+  Health check: `validateConfiguration` (editor deep-validate) and
+  `getPlatformNotificationDefaults` (fetched on every assignment-editor mount) move
+  to `typeScoped`. The paired WRITE `setPlatformNotificationDefaults` stays
+  `global: true` on purpose - it rewrites instance-wide defaults for every team, so
+  a single team grant must not authorize it. Because that write stays global-only,
+  the assignment editor's "Notification defaults" button is now gated on the global
+  `configuration.manage` rule (`healthcheck-frontend`), so a team-scoped manager no
+  longer sees an editor whose Save always 403'd.
+
+  Anomaly: the anomaly settings panels embedded in the health-check editor
+  (`updateAnomalyConfig` / `getAnomalyConfig` and `updateAnomalyAssignmentConfig` /
+  `getAnomalyAssignmentConfig`) were authorized against the non-team-scopable
+  `anomaly_feed` type (via `global: true` or an `idParam` that could never match a
+  team grant), so a team-scoped manager who owns the check/system saw "Save
+  Defaults" / "Save Exceptions" buttons whose Save always 403'd. They now
+  `parentScope` on the owning health-check configuration (`healthcheck.healthcheck`)
+  and catalog system (`catalog.system`) respectively, so managing the check/system
+  authorizes reading and editing its anomaly settings. The frontend needed no
+  change: those buttons were already disabled for non-managers, and the panels are
+  only reachable inside the manager-gated editor. Also, the automation "New
+  automation" template picker (`automation-frontend`) gated its page on the bare
+  global manage rule; it now uses the create capability, so a team-scoped creator
+  (whom the route already reveals the page to) is no longer shown a blocked page.
+
+  Incident & maintenance: `removeLink` was `global: true` because its input carried
+  only the link id. It now takes the owning `incidentId` / `maintenanceId`
+  (mirroring `addLink`), authorizes per-instance via `idParam`, and the service
+  scopes the delete by that parent id so a link cannot be removed by pairing its id
+  with a different incident/maintenance the caller manages. The AI `removeLink`
+  tools carry the parent id too.
+
+  BREAKING CHANGES: `automation.getRun`, `automation.cancelRun`,
+  `automation.getRunScopeForReplay`, `incident.removeLink`, and
+  `maintenance.removeLink` now require a parent id (`automationId` /
+  `incidentId` / `maintenanceId`) in their input. Endpoints previously gated by a
+  global rule alone now also accept the owning team's grant; no endpoint became
+  more permissive for a user who lacks both the global rule and a relevant team
+  grant.
+
+  Not team-scopable, so intentionally left `global: true` (verified by the audit):
+  catalog environments, anomaly config, SLO list/streak/milestone reads and
+  health-check history/stats (their read rules are public/default), and every
+  hand-rolled HTTP route (global admin/infra or already team-aware).
+
+### Patch Changes
+
+- Updated dependencies [f93ee7a]
+- Updated dependencies [f93ee7a]
+- Updated dependencies [8aae4e2]
+- Updated dependencies [d0eddc9]
+- Updated dependencies [d0eddc9]
+- Updated dependencies [f93ee7a]
+- Updated dependencies [f93ee7a]
+- Updated dependencies [d0eddc9]
+- Updated dependencies [d0eddc9]
+- Updated dependencies [d0eddc9]
+- Updated dependencies [f93ee7a]
+  - @checkstack/common@0.22.0
+  - @checkstack/catalog-common@2.6.3
+  - @checkstack/ai-backend@0.10.9
+  - @checkstack/backend-api@0.31.0
+  - @checkstack/automation-common@0.10.0
+  - @checkstack/automation-backend@0.11.0
+  - @checkstack/incident-common@1.9.0
+  - @checkstack/auth-common@0.13.0
+  - @checkstack/ai-common@0.6.6
+  - @checkstack/cache-api@0.3.19
+  - @checkstack/catalog-backend@1.6.9
+  - @checkstack/command-backend@0.2.21
+  - @checkstack/integration-backend@0.7.3
+  - @checkstack/integration-common@0.9.8
+  - @checkstack/notification-common@1.5.3
+  - @checkstack/signal-common@0.2.17
+  - @checkstack/status-page-backend@0.4.8
+  - @checkstack/status-page-common@0.5.3
+  - @checkstack/cache-utils@0.2.24
+
 ## 1.10.0
 
 ### Minor Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-backend",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -14,25 +14,25 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/ai-backend": "0.10.8",
-    "@checkstack/ai-common": "0.6.5",
-    "@checkstack/backend-api": "0.30.0",
-    "@checkstack/cache-api": "0.3.18",
-    "@checkstack/cache-utils": "0.2.23",
-    "@checkstack/incident-common": "1.8.0",
-    "@checkstack/catalog-common": "2.6.2",
-    "@checkstack/catalog-backend": "1.6.8",
-    "@checkstack/notification-common": "1.5.2",
-    "@checkstack/auth-common": "0.12.2",
-    "@checkstack/command-backend": "0.2.20",
-    "@checkstack/signal-common": "0.2.16",
-    "@checkstack/status-page-backend": "0.4.7",
-    "@checkstack/status-page-common": "0.5.2",
-    "@checkstack/integration-backend": "0.7.2",
-    "@checkstack/integration-common": "0.9.7",
-    "@checkstack/automation-backend": "0.10.10",
-    "@checkstack/automation-common": "0.9.2",
-    "@checkstack/common": "0.21.0",
+    "@checkstack/ai-backend": "0.10.9",
+    "@checkstack/ai-common": "0.6.6",
+    "@checkstack/backend-api": "0.31.0",
+    "@checkstack/cache-api": "0.3.19",
+    "@checkstack/cache-utils": "0.2.24",
+    "@checkstack/incident-common": "1.9.0",
+    "@checkstack/catalog-common": "2.6.3",
+    "@checkstack/catalog-backend": "1.6.9",
+    "@checkstack/notification-common": "1.5.3",
+    "@checkstack/auth-common": "0.13.0",
+    "@checkstack/command-backend": "0.2.21",
+    "@checkstack/signal-common": "0.2.17",
+    "@checkstack/status-page-backend": "0.4.8",
+    "@checkstack/status-page-common": "0.5.3",
+    "@checkstack/integration-backend": "0.7.3",
+    "@checkstack/integration-common": "0.9.8",
+    "@checkstack/automation-backend": "0.11.0",
+    "@checkstack/automation-common": "0.10.0",
+    "@checkstack/common": "0.22.0",
     "drizzle-orm": "^0.45.0",
     "zod": "^4.2.1",
     "@orpc/contract": "^1.14.4",
@@ -40,11 +40,13 @@
   },
   "devDependencies": {
     "@checkstack/drizzle-helper": "0.0.6",
-    "@checkstack/scripts": "0.7.2",
-    "@checkstack/test-utils-backend": "0.1.54",
+    "@checkstack/scripts": "0.7.3",
+    "@checkstack/test-utils-backend": "0.1.55",
     "@checkstack/tsconfig": "0.0.7",
     "@types/bun": "^1.0.0",
+    "@types/pg": "^8.20.0",
     "drizzle-kit": "^0.31.10",
+    "pg": "^8.21.0",
     "typescript": "^5.0.0"
   }
 }

package/src/ai/incident-remove-link.test.ts

@@ -32,25 +32,25 @@ describe("incident.removeLink tool", () => {
     const rpcClient = fakeRpcClient({ removeLink });
     const tool = createIncidentRemoveLinkTool();
     const preview = await tool.dryRun!({
-      input: { id: "lnk1" },
+      input: { id: "lnk1", incidentId: "inc1" },
       principal,
       rpcClient,
     });
     expect(removeLink).not.toHaveBeenCalled();
     expect(preview.summary).toContain("permanent");
-    expect(preview.payload).toEqual({ id: "lnk1" });
+    expect(preview.payload).toEqual({ id: "lnk1", incidentId: "inc1" });
   });
 
-  test("execute (apply) removes via removeLink with {id}", async () => {
+  test("execute (apply) removes via removeLink with {id, incidentId}", async () => {
     const removeLink = mock(() => Promise.resolve({ success: true }));
     const rpcClient = fakeRpcClient({ removeLink });
     const tool = createIncidentRemoveLinkTool();
     const result = await tool.execute({
-      input: { id: "lnk1" },
+      input: { id: "lnk1", incidentId: "inc1" },
       principal,
       rpcClient,
     });
-    expect(removeLink).toHaveBeenCalledWith({ id: "lnk1" });
+    expect(removeLink).toHaveBeenCalledWith({ id: "lnk1", incidentId: "inc1" });
     expect(result).toEqual({ id: "lnk1", removed: true });
   });
 });

package/src/ai/incident-remove-link.ts

@@ -9,9 +9,10 @@ import {
 import type { AiProposalPreview } from "@checkstack/ai-common";
 import type { RegisteredAiTool } from "@checkstack/ai-backend";
 
-/** Input for `incident.removeLink`: the link id to remove. */
+/** Input for `incident.removeLink`: the link id to remove + its owning incident. */
 export const IncidentRemoveLinkInputSchema = z.object({
   id: z.string(),
+  incidentId: z.string(),
 });
 export type IncidentRemoveLinkInput = z.infer<
   typeof IncidentRemoveLinkInputSchema
@@ -45,15 +46,15 @@ export function createIncidentRemoveLinkTool(): RegisteredAiTool<
     rpcClient: RpcClient;
   }): Promise<AiProposalPreview<IncidentRemoveLinkInput>> => {
     return {
-      summary: `Remove link ${input.id} from its incident. This is permanent.`,
-      payload: { id: input.id },
+      summary: `Remove link ${input.id} from incident ${input.incidentId}. This is permanent.`,
+      payload: { id: input.id, incidentId: input.incidentId },
     };
   };
 
   return {
     name: "incident.removeLink",
     description:
-      "Remove a hotlink from an incident by link id. DESTRUCTIVE and irreversible. Never removes directly; a person must approve the confirmation. Find the link id by reading the incident's details first.",
+      "Remove a hotlink from an incident by link id and its owning incidentId. DESTRUCTIVE and irreversible. Never removes directly; a person must approve the confirmation. Find the link id and incidentId by reading the incident's details first.",
     effect: "destructive",
     input: IncidentRemoveLinkInputSchema,
     requiredAccessRules: [
@@ -62,7 +63,10 @@ export function createIncidentRemoveLinkTool(): RegisteredAiTool<
     dryRun,
     async execute({ input, rpcClient }) {
       const incidentClient = rpcClient.forPlugin(IncidentApi);
-      await incidentClient.removeLink({ id: input.id });
+      await incidentClient.removeLink({
+        id: input.id,
+        incidentId: input.incidentId,
+      });
       return { id: input.id, removed: true };
     },
   };

package/src/router.ts

@@ -676,7 +676,7 @@ export function createRouter({
     }),
 
     removeLink: os.removeLink.handler(async ({ input }) => {
-      const incidentId = await service.removeLink(input.id);
+      const incidentId = await service.removeLink(input.id, input.incidentId);
       if (!incidentId) {
         return { success: false };
       }

package/src/service.it.test.ts

@@ -0,0 +1,130 @@
+/**
+ * Integration test for IncidentService.removeLink against a REAL Postgres,
+ * exercising the anti-spoof WHERE clause (`WHERE id AND incidentId`) that the
+ * mocked-DB unit tests cannot. removeLink is authorized with `idParam:
+ * "incidentId"`, so the caller proves a grant on the PARENT incident. The
+ * service MUST additionally scope the delete by that incidentId, or a caller
+ * could pair a link id belonging to incident A with an incident B they manage
+ * and delete A's link (an IDOR). These tests prove the scoping holds at the SQL
+ * layer: a mismatched incidentId removes nothing and returns undefined; only a
+ * matched pair deletes.
+ *
+ * Gated on CHECKSTACK_IT so it runs in CI (shared compose Postgres) and is
+ * skipped in the default `bun test` run, matching the other *.it.test.ts here.
+ */
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "bun:test";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
+import type {
+  AdvisoryLockService,
+  SafeDatabase,
+} from "@checkstack/backend-api";
+import * as schema from "./schema";
+import { IncidentService } from "./service";
+
+const PG_URL =
+  process.env.CHECKSTACK_IT_PG_URL ??
+  "postgres://postgres:postgres@localhost:5432/postgres";
+const SCHEMA = "incident_it_removelink";
+
+// removeLink never touches the advisory lock, so a no-op faithful stub is all
+// the constructor needs (no cast).
+const noopAdvisoryLock: AdvisoryLockService = {
+  tryAcquire: async () => null,
+  withXactLock: async ({ fn }) => fn(),
+};
+
+let admin: Pool;
+let pool: Pool;
+let service: IncidentService;
+
+async function insertLink(row: {
+  id: string;
+  incidentId: string;
+  url: string;
+}): Promise<void> {
+  await pool.query(
+    `INSERT INTO "${SCHEMA}".incident_links (id, incident_id, url)
+     VALUES ($1, $2, $3)`,
+    [row.id, row.incidentId, row.url],
+  );
+}
+
+async function linkExists(id: string): Promise<boolean> {
+  const res = await pool.query(
+    `SELECT 1 FROM "${SCHEMA}".incident_links WHERE id = $1`,
+    [id],
+  );
+  return res.rowCount === 1;
+}
+
+describe.skipIf(!process.env.CHECKSTACK_IT)(
+  "IncidentService.removeLink anti-spoof scoping (shared Postgres)",
+  () => {
+    beforeAll(async () => {
+      admin = new Pool({ connectionString: PG_URL });
+      await admin.query(`DROP SCHEMA IF EXISTS "${SCHEMA}" CASCADE`);
+      await admin.query(`CREATE SCHEMA "${SCHEMA}"`);
+      // Only the incident_links table is exercised; no FK to incidents so the
+      // DDL stays minimal and focused on the WHERE-clause behavior.
+      await admin.query(
+        `CREATE TABLE "${SCHEMA}".incident_links (
+          id text PRIMARY KEY,
+          incident_id text NOT NULL,
+          label text,
+          url text NOT NULL,
+          created_at timestamp NOT NULL DEFAULT now()
+        )`,
+      );
+      pool = new Pool({
+        connectionString: PG_URL,
+        options: `-c search_path=${SCHEMA}`,
+      });
+      const db = drizzle(pool, {
+        schema,
+      }) as unknown as SafeDatabase<typeof schema>;
+      service = new IncidentService(db, noopAdvisoryLock);
+    });
+
+    afterAll(async () => {
+      await pool?.end();
+      await admin.query(`DROP SCHEMA IF EXISTS "${SCHEMA}" CASCADE`);
+      await admin.end();
+    });
+
+    beforeEach(async () => {
+      await pool.query(`TRUNCATE "${SCHEMA}".incident_links`);
+    });
+
+    it("removes the link and returns the incidentId when the pair matches", async () => {
+      await insertLink({ id: "lnk-1", incidentId: "inc-1", url: "https://a" });
+
+      expect(await service.removeLink("lnk-1", "inc-1")).toBe("inc-1");
+      expect(await linkExists("lnk-1")).toBe(false);
+    });
+
+    it("removes nothing and returns undefined when the incidentId does not own the link", async () => {
+      // Link belongs to inc-1; the caller is authorized against inc-2 (a
+      // different incident they manage). The spoofed pair must NOT delete.
+      await insertLink({ id: "lnk-1", incidentId: "inc-1", url: "https://a" });
+
+      expect(await service.removeLink("lnk-1", "inc-2")).toBeUndefined();
+      // The link is untouched.
+      expect(await linkExists("lnk-1")).toBe(true);
+    });
+
+    it("returns undefined for a link id that does not exist", async () => {
+      expect(await service.removeLink("missing", "inc-1")).toBeUndefined();
+    });
+
+    it("only deletes the link matching BOTH id and incidentId", async () => {
+      await insertLink({ id: "lnk-1", incidentId: "inc-1", url: "https://a" });
+      await insertLink({ id: "lnk-2", incidentId: "inc-2", url: "https://b" });
+
+      expect(await service.removeLink("lnk-1", "inc-1")).toBe("inc-1");
+      expect(await linkExists("lnk-1")).toBe(false);
+      // The other incident's link is untouched.
+      expect(await linkExists("lnk-2")).toBe(true);
+    });
+  },
+);

package/src/service.ts

@@ -554,13 +554,22 @@ export class IncidentService {
    * invalidate the right cache entry, or undefined if the link did not
    * exist.
    */
-  async removeLink(id: string): Promise<string | undefined> {
+  async removeLink(id: string, incidentId: string): Promise<string | undefined> {
+    // Scope by incidentId: the caller is authorized (idParam) against THIS
+    // incident, so a link belonging to a different incident must not be
+    // removable by pairing its link id with an incident the caller manages.
     const [existing] = await this.db
       .select()
       .from(incidentLinks)
-      .where(eq(incidentLinks.id, id));
+      .where(
+        and(eq(incidentLinks.id, id), eq(incidentLinks.incidentId, incidentId)),
+      );
     if (!existing) return undefined;
-    await this.db.delete(incidentLinks).where(eq(incidentLinks.id, id));
+    await this.db
+      .delete(incidentLinks)
+      .where(
+        and(eq(incidentLinks.id, id), eq(incidentLinks.incidentId, incidentId)),
+      );
     return existing.incidentId;
   }