@checkstack/incident-backend 1.11.0 → 1.13.0

package/src/status-page-widget.test.ts

@@ -47,3 +47,152 @@ describe("incidents widget — fail closed (S1)", () => {
     ]);
   });
 });
+
+// ---------------------------------------------------------------------------
+// Environment filtering: when a page publishes a specific environment set, the
+// widget omits systems (and thus incidents whose only affected system is)
+// outside those environments - across resolvePublic AND resolveScopedSystems.
+// ---------------------------------------------------------------------------
+
+interface IncidentFixture {
+  id: string;
+  title: string;
+  status: string;
+  severity: string;
+  systemIds: string[];
+  createdAt: string;
+  updatedAt: string;
+}
+
+function makeCtx(args: {
+  publishedEnvironmentIds?: string[];
+  incidents?: IncidentFixture[];
+  /** environmentId -> member system ids (the catalog env->systems mapping). */
+  envSystems?: Record<string, string[]>;
+  systems?: Array<{ id: string; name: string }>;
+}): WidgetResolveContext {
+  const { publishedEnvironmentIds, incidents = [], envSystems = {}, systems = [] } =
+    args;
+  const memo = new Map<string, Promise<unknown>>();
+  const api = {
+    resolveEnvironments: async ({
+      environmentIds,
+    }: {
+      environmentIds: string[];
+    }) =>
+      environmentIds.map((id) => ({
+        id,
+        name: id,
+        description: null,
+        systemIds: envSystems[id] ?? [],
+        metadata: null,
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      })),
+    getGroups: async () => [],
+    getSystems: async () => ({ systems }),
+    listIncidents: async () => ({ incidents }),
+    getBulkIncidentUpdates: async () => ({ updates: {} }),
+  };
+  return {
+    rpcClient: {
+      forPlugin: () => api,
+    } as unknown as RpcClient,
+    cache: <T,>(key: string, loader: () => Promise<T>): Promise<T> => {
+      const existing = memo.get(key);
+      if (existing) return existing as Promise<T>;
+      const created = loader();
+      memo.set(key, created);
+      return created;
+    },
+    publishedEnvironmentIds,
+  };
+}
+
+describe("incidents widget — environment filtering", () => {
+  const envSystems = { prod: ["prod-sys"], stage: ["stage-sys"] };
+  const systems = [
+    { id: "prod-sys", name: "Prod System" },
+    { id: "stage-sys", name: "Stage System" },
+  ];
+
+  test("resolveScopedSystems keeps only systems in the published env", async () => {
+    const widget = capture();
+    const scope = await widget.resolveScopedSystems!({
+      config: { systemIds: ["prod-sys", "stage-sys"] },
+      ctx: makeCtx({ publishedEnvironmentIds: ["prod"], envSystems, systems }),
+    });
+    expect([...scope].toSorted()).toEqual(["prod-sys"]);
+  });
+
+  test("no env filter keeps every bound system", async () => {
+    const widget = capture();
+    const scope = await widget.resolveScopedSystems!({
+      config: { systemIds: ["prod-sys", "stage-sys"] },
+      ctx: makeCtx({ envSystems, systems }),
+    });
+    expect([...scope].toSorted()).toEqual(["prod-sys", "stage-sys"]);
+  });
+
+  test("resolvePublic drops a staging-only incident when publishing prod", async () => {
+    const incidents: IncidentFixture[] = [
+      {
+        id: "stage-only",
+        title: "Stage outage",
+        status: "investigating",
+        severity: "minor",
+        systemIds: ["stage-sys"],
+        createdAt: "2026-07-01T00:00:00Z",
+        updatedAt: "2026-07-01T00:00:00Z",
+      },
+      {
+        id: "prod-inc",
+        title: "Prod outage",
+        status: "investigating",
+        severity: "major",
+        systemIds: ["prod-sys"],
+        createdAt: "2026-07-01T00:00:00Z",
+        updatedAt: "2026-07-01T00:00:00Z",
+      },
+    ];
+    const widget = capture();
+    const result = (await widget.resolvePublic({
+      config: { systemIds: ["prod-sys", "stage-sys"], showUpdates: false },
+      ctx: makeCtx({
+        publishedEnvironmentIds: ["prod"],
+        incidents,
+        envSystems,
+        systems,
+      }),
+    })) as { incidents: Array<{ id: string; systems: string[] }> };
+    expect(result.incidents.map((i) => i.id)).toEqual(["prod-inc"]);
+  });
+
+  test("multi-env incident is kept but labels only its published-env systems", async () => {
+    const incidents: IncidentFixture[] = [
+      {
+        id: "both",
+        title: "Cross-env outage",
+        status: "investigating",
+        severity: "major",
+        systemIds: ["prod-sys", "stage-sys"],
+        createdAt: "2026-07-01T00:00:00Z",
+        updatedAt: "2026-07-01T00:00:00Z",
+      },
+    ];
+    const widget = capture();
+    const result = (await widget.resolvePublic({
+      config: { systemIds: ["prod-sys", "stage-sys"], showUpdates: false },
+      ctx: makeCtx({
+        publishedEnvironmentIds: ["prod"],
+        incidents,
+        envSystems,
+        systems,
+      }),
+    })) as { incidents: Array<{ id: string; systems: string[] }> };
+    expect(result.incidents).toHaveLength(1);
+    // Only the published-env (prod) system is labelled; the staging system is
+    // not leaked even though the incident also affects it (multi-env caveat).
+    expect(result.incidents[0]?.systems).toEqual(["Prod System"]);
+  });
+});

package/src/status-page-widget.ts

@@ -6,6 +6,7 @@ import {
   IncidentsDtoSchema,
   toPublicUpdate,
   selectEvents,
+  resolveEventFeedScope,
   type InternalUpdate,
   type PublicUpdate,
 } from "@checkstack/status-page-common";
@@ -16,6 +17,68 @@ import type {
 } from "@checkstack/status-page-backend";
 
 const SYSTEM_TYPE = "catalog.system";
+const GROUP_TYPE = "catalog.group";
+
+/** Current membership of every catalog group, fetched once per page resolve. */
+async function groupMembers(
+  ctx: WidgetResolveContext,
+): Promise<Map<string, string[]>> {
+  const groups = await ctx.cache("catalog.groups", async () => {
+    const all = await ctx.rpcClient.forPlugin(CatalogApi).getGroups();
+    return all.map((g) => ({ id: g.id, systemIds: g.systemIds }));
+  });
+  return new Map(groups.map((g) => [g.id, g.systemIds] as const));
+}
+
+/**
+ * The catalog system ids visible under the page's published-environment scope,
+ * or null when the page publishes all environments (no filter). Resolved once
+ * per page resolve (cache-keyed by the env set) from the catalog's own
+ * env->systems mapping, so a system in NONE of the selected environments is
+ * omitted from what the widget shows, offers for subscription, and emails about.
+ */
+async function envVisibleSystems(
+  ctx: WidgetResolveContext,
+): Promise<Set<string> | null> {
+  const envIds = ctx.publishedEnvironmentIds;
+  if (!envIds || envIds.length === 0) return null;
+  const key = `catalog.systemsInEnv:${[...envIds].toSorted().join(",")}`;
+  const ids = await ctx.cache(key, async () => {
+    const envs = await ctx.rpcClient
+      .forPlugin(CatalogApi)
+      .resolveEnvironments({ environmentIds: envIds });
+    const set = new Set<string>();
+    for (const env of envs) for (const s of env.systemIds) set.add(s);
+    return [...set];
+  });
+  return new Set(ids);
+}
+
+/**
+ * The CURRENT effective set of catalog system ids this incidents config
+ * surfaces: `(systemIds ∪ members(groupIds)) − excludedSystemIds`, expanded from
+ * the SAME live catalog source (`groupMembers` via `getGroups`) the DTO resolve
+ * uses, then INTERSECTED with the page's published-environment scope. Shared by
+ * `resolvePublic` (what the widget shows) and `resolveScopedSystems` (what the
+ * subscriber fan-out is allowed to email about) so the two can NEVER diverge.
+ * Empty when nothing is bound (fail closed).
+ */
+async function effectiveScope(
+  config: unknown,
+  ctx: WidgetResolveContext,
+): Promise<Set<string>> {
+  const c = IncidentsConfigSchema.parse(config);
+  if (c.systemIds.length === 0 && c.groupIds.length === 0) return new Set();
+  const scope = resolveEventFeedScope({
+    systemIds: c.systemIds,
+    groupIds: c.groupIds,
+    excludedSystemIds: c.excludedSystemIds,
+    groupMembers: c.groupIds.length > 0 ? await groupMembers(ctx) : new Map(),
+  });
+  const visible = await envVisibleSystems(ctx);
+  if (!visible) return scope;
+  return new Set([...scope].filter((id) => visible.has(id)));
+}
 
 function iso(value: string | Date): string {
   return value instanceof Date ? value.toISOString() : String(value);
@@ -24,6 +87,10 @@ function iso(value: string | Date): string {
 /** Newest `max` updates, most-recent first (the current progress at the top). */
 function latestUpdates(updates: InternalUpdate[], max: number): PublicUpdate[] {
   return updates
+    // The public status page is anonymous: only `public`-visibility updates may
+    // appear. `logged_in` / `internal` updates are filtered out here so they
+    // never reach the unauthenticated projection (Item 3/5).
+    .filter((u) => u.visibility === "public")
     .toSorted(
       (a, b) => new Date(b.createdAt).getTime() - new Date(a.createdAt).getTime(),
     )
@@ -56,23 +123,47 @@ const incidents: WidgetTypeDefinition = {
   binding: "systems",
   configSchema: IncidentsConfigSchema,
   dtoSchema: IncidentsDtoSchema,
-  boundResources: (config) =>
-    IncidentsConfigSchema.parse(config).systemIds.map((id) => ({
-      resourceType: SYSTEM_TYPE,
-      resourceId: id,
-    })),
+  boundResources: (config) => {
+    const c = IncidentsConfigSchema.parse(config);
+    return [
+      ...c.systemIds.map((id) => ({ resourceType: SYSTEM_TYPE, resourceId: id })),
+      ...c.groupIds.map((id) => ({ resourceType: GROUP_TYPE, resourceId: id })),
+    ];
+  },
   assertBindingsReadable: async ({ userClient, config }) => {
+    const c = IncidentsConfigSchema.parse(config);
     await assertCatalogResourcesReadable({
       client: userClient.forPlugin(CatalogApi),
-      systemIds: IncidentsConfigSchema.parse(config).systemIds,
+      systemIds: c.systemIds,
+      groupIds: c.groupIds,
     });
   },
+  // This widget surfaces the INCIDENT category: a page emails incident
+  // subscribers about a system only when this widget shows it.
+  subscriptionCategory: "incident",
+  // Send-time scoping for the subscriber fan-out uses the SAME expansion as the
+  // DTO resolve, so a page never emails about a system its widget does not show.
+  resolveScopedSystems: ({ config, ctx }) => effectiveScope(config, ctx),
+  // Same effective scope WITH public display names, so the subscribe form can
+  // offer a per-system scope. Applies the same public label override the widget
+  // renders with, so a name here never differs from what the page shows.
+  async resolveScopedSystemsDetailed({ config, ctx }) {
+    const c = IncidentsConfigSchema.parse(config);
+    const bound = await effectiveScope(c, ctx);
+    if (bound.size === 0) return [];
+    const names = await labelsFor(ctx, [...bound]);
+    return [...bound].map((id) => ({
+      id,
+      name: c.systemLabels[id] ?? names.get(id) ?? id,
+    }));
+  },
   async resolvePublic({ config, ctx }) {
     const c = IncidentsConfigSchema.parse(config);
-    const bound = new Set(c.systemIds);
-    // FAIL CLOSED: no systems bound -> nothing the operator chose to expose.
-    // Never fall back to "all incidents" (that would be a trusted-service read
-    // of every incident on the platform).
+    // FAIL CLOSED with NO read when nothing is bound: never fall back to "all
+    // incidents" (that would be a trusted-service read of every incident). The
+    // effective scope is resolved at read time (shared with resolveScopedSystems)
+    // so group members added later are included.
+    const bound = await effectiveScope(c, ctx);
     if (bound.size === 0) return IncidentsDtoSchema.parse({ incidents: [] });
     const inc = ctx.rpcClient.forPlugin(IncidentApi);
     const { incidents: all } = await inc.listIncidents({
@@ -90,35 +181,43 @@ const incidents: WidgetTypeDefinition = {
       now: Date.now(),
     });
     // Only label BOUND systems; an unbound co-affected system must not leak.
+    // A per-system PUBLIC label override wins over the raw catalog name (same
+    // override path as the system-health widget), so the public detail page never
+    // leaks an internal name inconsistently with the rest of the page.
     const names = await labelsFor(ctx, [...bound]);
-    const items = await Promise.allSettled(
-      [...active, ...past].map(async (i) => {
-        // showUpdates=false also skips the per-item detail fetch (perf).
-        const detail = c.showUpdates ? await inc.getIncident({ id: i.id }) : null;
-        const updates = latestUpdates(
-          (detail?.updates ?? []) as InternalUpdate[],
-          c.maxUpdates,
-        );
-        const resolved = i.status === "resolved";
-        return {
-          id: i.id,
-          title: i.title,
-          status: i.status,
-          severity: i.severity,
-          systems: i.systemIds
-            .map((id) => names.get(id))
-            .filter((l): l is string => l !== undefined),
-          startedAt: iso(i.createdAt),
-          ...(resolved ? { resolvedAt: iso(i.updatedAt) } : {}),
-          updates,
-        };
-      }),
-    );
-    return IncidentsDtoSchema.parse({
-      incidents: items
-        .filter((r) => r.status === "fulfilled")
-        .map((r) => r.value),
+    const labelOf = (id: string): string | undefined =>
+      bound.has(id) ? (c.systemLabels[id] ?? names.get(id) ?? id) : undefined;
+    const selected = [...active, ...past];
+    // ONE bulk fetch of every selected incident's update timeline, instead of
+    // an N+1 fan-out of `getIncident` per row. showUpdates=false still skips
+    // the fetch entirely (perf). Each incident's updates are keyed by its id.
+    const bulkUpdates = c.showUpdates
+      ? await inc.getBulkIncidentUpdates({
+          incidentIds: selected.map((i) => i.id),
+        })
+      : undefined;
+    const updatesByIncident: Record<string, InternalUpdate[]> =
+      bulkUpdates?.updates ?? {};
+    const items = selected.map((i) => {
+      const updates = latestUpdates(
+        updatesByIncident[i.id] ?? [],
+        c.maxUpdates,
+      );
+      const resolved = i.status === "resolved";
+      return {
+        id: i.id,
+        title: i.title,
+        status: i.status,
+        severity: i.severity,
+        systems: i.systemIds
+          .map((id) => labelOf(id))
+          .filter((l): l is string => l !== undefined),
+        startedAt: iso(i.createdAt),
+        ...(resolved ? { resolvedAt: iso(i.updatedAt) } : {}),
+        updates,
+      };
     });
+    return IncidentsDtoSchema.parse({ incidents: items });
   },
 };