@checkstack/incident-backend 1.10.0 → 1.12.0

package/src/service.it.test.ts

@@ -0,0 +1,187 @@
+/**
+ * Integration test for IncidentService.removeLink against a REAL Postgres,
+ * exercising the anti-spoof WHERE clause (`WHERE id AND incidentId`) that the
+ * mocked-DB unit tests cannot. removeLink is authorized with `idParam:
+ * "incidentId"`, so the caller proves a grant on the PARENT incident. The
+ * service MUST additionally scope the delete by that incidentId, or a caller
+ * could pair a link id belonging to incident A with an incident B they manage
+ * and delete A's link (an IDOR). These tests prove the scoping holds at the SQL
+ * layer: a mismatched incidentId removes nothing and returns undefined; only a
+ * matched pair deletes.
+ *
+ * Gated on CHECKSTACK_IT so it runs in CI (shared compose Postgres) and is
+ * skipped in the default `bun test` run, matching the other *.it.test.ts here.
+ */
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from "bun:test";
+import { drizzle } from "drizzle-orm/node-postgres";
+import { Pool } from "pg";
+import type {
+  AdvisoryLockService,
+  SafeDatabase,
+} from "@checkstack/backend-api";
+import * as schema from "./schema";
+import { IncidentService } from "./service";
+
+const PG_URL =
+  process.env.CHECKSTACK_IT_PG_URL ??
+  "postgres://postgres:postgres@localhost:5432/postgres";
+const SCHEMA = "incident_it_removelink";
+
+// removeLink never touches the advisory lock, so a no-op faithful stub is all
+// the constructor needs (no cast).
+const noopAdvisoryLock: AdvisoryLockService = {
+  tryAcquire: async () => null,
+  withXactLock: async ({ fn }) => fn(),
+};
+
+let admin: Pool;
+let pool: Pool;
+let service: IncidentService;
+
+async function insertLink(row: {
+  id: string;
+  incidentId: string;
+  url: string;
+}): Promise<void> {
+  await pool.query(
+    `INSERT INTO "${SCHEMA}".incident_links (id, incident_id, url)
+     VALUES ($1, $2, $3)`,
+    [row.id, row.incidentId, row.url],
+  );
+}
+
+async function linkExists(id: string): Promise<boolean> {
+  const res = await pool.query(
+    `SELECT 1 FROM "${SCHEMA}".incident_links WHERE id = $1`,
+    [id],
+  );
+  return res.rowCount === 1;
+}
+
+describe.skipIf(!process.env.CHECKSTACK_IT)(
+  "IncidentService.removeLink anti-spoof scoping (shared Postgres)",
+  () => {
+    beforeAll(async () => {
+      admin = new Pool({ connectionString: PG_URL });
+      await admin.query(`DROP SCHEMA IF EXISTS "${SCHEMA}" CASCADE`);
+      await admin.query(`CREATE SCHEMA "${SCHEMA}"`);
+      // Only the incident_links table is exercised; no FK to incidents so the
+      // DDL stays minimal and focused on the WHERE-clause behavior.
+      await admin.query(
+        `CREATE TABLE "${SCHEMA}".incident_links (
+          id text PRIMARY KEY,
+          incident_id text NOT NULL,
+          label text,
+          url text NOT NULL,
+          visibility text NOT NULL DEFAULT 'public',
+          created_at timestamp NOT NULL DEFAULT now()
+        )`,
+      );
+      pool = new Pool({
+        connectionString: PG_URL,
+        options: `-c search_path=${SCHEMA}`,
+      });
+      const db = drizzle(pool, {
+        schema,
+      }) as unknown as SafeDatabase<typeof schema>;
+      service = new IncidentService(db, noopAdvisoryLock);
+    });
+
+    afterAll(async () => {
+      await pool?.end();
+      await admin.query(`DROP SCHEMA IF EXISTS "${SCHEMA}" CASCADE`);
+      await admin.end();
+    });
+
+    beforeEach(async () => {
+      await pool.query(`TRUNCATE "${SCHEMA}".incident_links`);
+    });
+
+    it("removes the link and returns the incidentId when the pair matches", async () => {
+      await insertLink({ id: "lnk-1", incidentId: "inc-1", url: "https://a" });
+
+      expect(await service.removeLink("lnk-1", "inc-1")).toBe("inc-1");
+      expect(await linkExists("lnk-1")).toBe(false);
+    });
+
+    it("removes nothing and returns undefined when the incidentId does not own the link", async () => {
+      // Link belongs to inc-1; the caller is authorized against inc-2 (a
+      // different incident they manage). The spoofed pair must NOT delete.
+      await insertLink({ id: "lnk-1", incidentId: "inc-1", url: "https://a" });
+
+      expect(await service.removeLink("lnk-1", "inc-2")).toBeUndefined();
+      // The link is untouched.
+      expect(await linkExists("lnk-1")).toBe(true);
+    });
+
+    it("returns undefined for a link id that does not exist", async () => {
+      expect(await service.removeLink("missing", "inc-1")).toBeUndefined();
+    });
+
+    it("only deletes the link matching BOTH id and incidentId", async () => {
+      await insertLink({ id: "lnk-1", incidentId: "inc-1", url: "https://a" });
+      await insertLink({ id: "lnk-2", incidentId: "inc-2", url: "https://b" });
+
+      expect(await service.removeLink("lnk-1", "inc-1")).toBe("inc-1");
+      expect(await linkExists("lnk-1")).toBe(false);
+      // The other incident's link is untouched.
+      expect(await linkExists("lnk-2")).toBe(true);
+    });
+
+    it("updateLink edits the link when the pair matches", async () => {
+      await insertLink({ id: "lnk-1", incidentId: "inc-1", url: "https://a" });
+
+      const updated = await service.updateLink({
+        id: "lnk-1",
+        incidentId: "inc-1",
+        label: "Runbook",
+        url: "https://b",
+        visibility: "internal",
+      });
+      expect(updated?.label).toBe("Runbook");
+      expect(updated?.url).toBe("https://b");
+      expect(updated?.visibility).toBe("internal");
+
+      const res = await pool.query(
+        `SELECT url, label, visibility FROM "${SCHEMA}".incident_links WHERE id = $1`,
+        ["lnk-1"],
+      );
+      expect(res.rows[0]).toEqual({
+        url: "https://b",
+        label: "Runbook",
+        visibility: "internal",
+      });
+    });
+
+    it("updateLink edits nothing and returns undefined when the incidentId does not own the link", async () => {
+      await insertLink({ id: "lnk-1", incidentId: "inc-1", url: "https://a" });
+
+      // Link belongs to inc-1; the caller is authorized against inc-2. The
+      // spoofed pair must NOT edit.
+      expect(
+        await service.updateLink({
+          id: "lnk-1",
+          incidentId: "inc-2",
+          url: "https://evil",
+        }),
+      ).toBeUndefined();
+
+      const res = await pool.query(
+        `SELECT url FROM "${SCHEMA}".incident_links WHERE id = $1`,
+        ["lnk-1"],
+      );
+      // The link is untouched.
+      expect(res.rows[0].url).toBe("https://a");
+    });
+
+    it("updateLink returns undefined for a link id that does not exist", async () => {
+      expect(
+        await service.updateLink({
+          id: "missing",
+          incidentId: "inc-1",
+          url: "https://x",
+        }),
+      ).toBeUndefined();
+    });
+  },
+);

package/src/service.test.ts

@@ -70,8 +70,16 @@ function createProgrammableSelectDb(resultsByCall: unknown[][]) {
     return { from };
   });
 
+  // Read-batching methods (getManyEntityStates, listOpenIncidentsBySystem, ...)
+  // now run their reads inside `withScopedTransaction` -> `db.transaction(fn)`.
+  // The tx exposes the SAME `select` mock so the per-invocation call counter is
+  // shared and `getCallCount()` still reflects total queries issued.
+  const transaction = mock((fn: (tx: { select: typeof select }) => unknown) =>
+    Promise.resolve(fn({ select })),
+  );
+
   return {
-    db: { select } as unknown,
+    db: { select, transaction } as unknown,
     select,
     getCallCount: () => callIndex,
   };
@@ -227,6 +235,232 @@ describe("IncidentService.getManyEntityStates (plugin-backed entity read)", () =
   });
 });
 
+describe("IncidentService.getIncident (batched detail read)", () => {
+  const createdAt = new Date("2026-06-01T10:00:00.000Z");
+  const updatedAt = new Date("2026-06-01T10:05:00.000Z");
+
+  it("assembles the detail from incident + systems + updates + links (4 queries, one tx)", async () => {
+    const dbHelper = createProgrammableSelectDb([
+      // 1st: the incident row.
+      [
+        {
+          id: "inc-1",
+          title: "DB down",
+          description: null,
+          status: "investigating",
+          severity: "critical",
+          suppressNotifications: false,
+          healthOverride: null,
+          createdAt,
+          updatedAt,
+        },
+      ],
+      // 2nd: system associations.
+      [{ systemId: "sys-a" }, { systemId: "sys-b" }],
+      // 3rd: the full (unfiltered) timeline.
+      [
+        {
+          id: "u1",
+          incidentId: "inc-1",
+          message: "looking",
+          statusChange: "investigating",
+          visibility: "public",
+          createdAt,
+          editedAt: null,
+          createdBy: null,
+        },
+      ],
+      // 4th: hotlinks.
+      [
+        {
+          id: "lnk-1",
+          incidentId: "inc-1",
+          label: "Runbook",
+          url: "https://a",
+          visibility: "public",
+          createdAt,
+        },
+      ],
+    ]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+
+    const out = await service.getIncident("inc-1");
+
+    expect(out?.systemIds).toEqual(["sys-a", "sys-b"]);
+    // null description normalized to undefined, nullable update fields too.
+    expect(out?.description).toBeUndefined();
+    expect(out?.updates).toEqual([
+      {
+        id: "u1",
+        incidentId: "inc-1",
+        message: "looking",
+        statusChange: "investigating",
+        visibility: "public",
+        createdAt,
+        editedAt: undefined,
+        editHistory: [],
+        createdBy: undefined,
+      },
+    ]);
+    expect(out?.links.map((l) => l.id)).toEqual(["lnk-1"]);
+    // Exactly the 4 reads (no per-row fan-out), all issued on the tx.
+    expect(dbHelper.getCallCount()).toBe(4);
+  });
+
+  it("returns undefined after a single query when the incident is absent", async () => {
+    const dbHelper = createProgrammableSelectDb([[]]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+    expect(await service.getIncident("ghost")).toBeUndefined();
+    // The systems/updates/links reads are skipped once the incident is missing.
+    expect(dbHelper.getCallCount()).toBe(1);
+  });
+});
+
+describe("IncidentService.listIncidents (set-based system grouping)", () => {
+  const createdAt = new Date("2026-06-01T10:00:00.000Z");
+  const updatedAt = new Date("2026-06-01T10:05:00.000Z");
+  const incidentRow = (id: string, description: string | null) => ({
+    id,
+    title: id,
+    description,
+    status: "investigating" as const,
+    severity: "major" as const,
+    suppressNotifications: false,
+    healthOverride: null,
+    createdAt,
+    updatedAt,
+  });
+
+  it("fetches all system associations in ONE junction query (no N+1) and groups them", async () => {
+    const dbHelper = createProgrammableSelectDb([
+      // 1st: the incidents matching the status filter.
+      [incidentRow("inc-1", null), incidentRow("inc-2", "elevated latency")],
+      // 2nd (and ONLY): a single inArray junction read for BOTH incidents.
+      [
+        { incidentId: "inc-1", systemId: "sys-a" },
+        { incidentId: "inc-1", systemId: "sys-b" },
+        { incidentId: "inc-2", systemId: "sys-c" },
+      ],
+    ]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+
+    const out = await service.listIncidents({ includeResolved: true });
+
+    expect(out.map((i) => i.id)).toEqual(["inc-1", "inc-2"]);
+    expect(out[0].systemIds).toEqual(["sys-a", "sys-b"]);
+    expect(out[1].systemIds).toEqual(["sys-c"]);
+    expect(out[0].description).toBeUndefined();
+    expect(out[1].description).toBe("elevated latency");
+    // 1 incidents read + exactly 1 junction read, regardless of row count.
+    expect(dbHelper.getCallCount()).toBe(2);
+  });
+
+  it("skips the junction query when no incidents match", async () => {
+    const dbHelper = createProgrammableSelectDb([[]]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+    expect(await service.listIncidents()).toEqual([]);
+    expect(dbHelper.getCallCount()).toBe(1);
+  });
+
+  it("resolves the system's incident ids first when filtering by systemId (3 queries total)", async () => {
+    const dbHelper = createProgrammableSelectDb([
+      // 1st: incident ids attached to the system.
+      [{ incidentId: "inc-1" }],
+      // 2nd: the incidents themselves (status-filtered).
+      [incidentRow("inc-1", null)],
+      // 3rd: the single junction grouping read.
+      [{ incidentId: "inc-1", systemId: "sys-a" }],
+    ]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+
+    const out = await service.listIncidents({ systemId: "sys-a" });
+
+    expect(out.map((i) => i.id)).toEqual(["inc-1"]);
+    expect(out[0].systemIds).toEqual(["sys-a"]);
+    expect(dbHelper.getCallCount()).toBe(3);
+  });
+});
+
+describe("IncidentService.getIncidentsForSystem (set-based system grouping)", () => {
+  const createdAt = new Date("2026-06-01T10:00:00.000Z");
+  const updatedAt = new Date("2026-06-01T10:05:00.000Z");
+
+  it("groups memberships from ONE junction query after resolving the system's incidents", async () => {
+    const dbHelper = createProgrammableSelectDb([
+      // 1st: incident ids attached to the system.
+      [{ incidentId: "inc-1" }, { incidentId: "inc-2" }],
+      // 2nd: non-resolved incidents for those ids.
+      [
+        {
+          id: "inc-1",
+          title: "A",
+          description: null,
+          status: "investigating",
+          severity: "major",
+          suppressNotifications: false,
+          healthOverride: null,
+          createdAt,
+          updatedAt,
+        },
+        {
+          id: "inc-2",
+          title: "B",
+          description: null,
+          status: "monitoring",
+          severity: "minor",
+          suppressNotifications: false,
+          healthOverride: null,
+          createdAt,
+          updatedAt,
+        },
+      ],
+      // 3rd (and ONLY) junction read for BOTH incidents' full membership.
+      [
+        { incidentId: "inc-1", systemId: "sys-a" },
+        { incidentId: "inc-1", systemId: "sys-b" },
+        { incidentId: "inc-2", systemId: "sys-a" },
+      ],
+    ]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+
+    const out = await service.getIncidentsForSystem("sys-a");
+
+    expect(out.map((i) => i.id)).toEqual(["inc-1", "inc-2"]);
+    // Each incident carries its FULL membership, not just the queried system.
+    expect(out[0].systemIds).toEqual(["sys-a", "sys-b"]);
+    expect(out[1].systemIds).toEqual(["sys-a"]);
+    expect(dbHelper.getCallCount()).toBe(3);
+  });
+
+  it("returns [] without a junction query when the system has no incidents", async () => {
+    const dbHelper = createProgrammableSelectDb([[]]);
+    const service = new IncidentService(
+      dbHelper.db as never,
+      makeFakeAdvisoryLock(),
+    );
+    expect(await service.getIncidentsForSystem("sys-x")).toEqual([]);
+    expect(dbHelper.getCallCount()).toBe(1);
+  });
+});
+
 describe("IncidentService.listOpenIncidentsBySystem (global signals read)", () => {
   it("returns {} without a junction query when no open incidents exist", async () => {
     const dbHelper = createProgrammableSelectDb([