@checkstack/incident-backend 1.11.0 → 1.13.0

package/src/read-visibility.test.ts

@@ -0,0 +1,158 @@
+import { describe, expect, test } from "bun:test";
+import { qualifyAccessRuleId } from "@checkstack/common";
+import type { AuthService, RealUser, ServiceUser } from "@checkstack/backend-api";
+import {
+  incidentAccess,
+  pluginMetadata,
+  type IncidentVisibility,
+} from "@checkstack/incident-common";
+import {
+  isVisibleAtAudience,
+  filterByAudience,
+  scopeEditHistory,
+  resolveIncidentAudience,
+  type ReadAudience,
+} from "./read-visibility";
+
+const MANAGE_ID = qualifyAccessRuleId(
+  pluginMetadata,
+  incidentAccess.incident.manage,
+);
+
+/** Auth stub whose `check` returns a fixed verdict and records its calls. */
+function fakeAuth(hasAccess: boolean): Pick<AuthService, "check"> {
+  return {
+    check: async () => ({ hasAccess }),
+  };
+}
+
+describe("isVisibleAtAudience", () => {
+  const rows: Array<[IncidentVisibility, ReadAudience, boolean]> = [
+    ["public", "public", true],
+    ["logged_in", "public", false],
+    ["internal", "public", false],
+    ["public", "authenticated", true],
+    ["logged_in", "authenticated", true],
+    ["internal", "authenticated", false],
+    ["public", "manager", true],
+    ["logged_in", "manager", true],
+    ["internal", "manager", true],
+  ];
+  test.each(rows)("%s @ %s => %s", (visibility, audience, expected) => {
+    expect(isVisibleAtAudience(visibility, audience)).toBe(expected);
+  });
+});
+
+describe("filterByAudience", () => {
+  const items: Array<{ id: string; visibility: IncidentVisibility }> = [
+    { id: "p", visibility: "public" },
+    { id: "l", visibility: "logged_in" },
+    { id: "i", visibility: "internal" },
+  ];
+
+  test("anonymous sees only public", () => {
+    expect(filterByAudience(items, "public").map((i) => i.id)).toEqual(["p"]);
+  });
+  test("authenticated excludes internal", () => {
+    expect(filterByAudience(items, "authenticated").map((i) => i.id)).toEqual([
+      "p",
+      "l",
+    ]);
+  });
+  test("manager sees all", () => {
+    expect(filterByAudience(items, "manager").map((i) => i.id)).toEqual([
+      "p",
+      "l",
+      "i",
+    ]);
+  });
+});
+
+describe("scopeEditHistory", () => {
+  // A now-public update whose PRIOR version was internal: exposing the history
+  // to a non-manager would leak the prior internal content.
+  const updates = [
+    {
+      id: "u1",
+      visibility: "public" as IncidentVisibility,
+      editHistory: [
+        {
+          message: "secret internal note",
+          visibility: "internal",
+          createdAt: "2026-01-01T00:00:00.000Z",
+          editedAt: "2026-01-01T01:00:00.000Z",
+        },
+      ],
+    },
+  ];
+
+  test("manager keeps the edit history", () => {
+    const [u] = scopeEditHistory(updates, "manager");
+    expect(u.editHistory).toHaveLength(1);
+  });
+
+  test("authenticated non-manager gets history stripped", () => {
+    const [u] = scopeEditHistory(updates, "authenticated");
+    expect(u.editHistory).toBeUndefined();
+  });
+
+  test("public reader gets history stripped (no prior internal leak)", () => {
+    const [u] = scopeEditHistory(updates, "public");
+    expect(u.editHistory).toBeUndefined();
+  });
+});
+
+describe("resolveIncidentAudience", () => {
+  test("no user => public", async () => {
+    const audience = await resolveIncidentAudience({
+      context: { user: undefined, auth: fakeAuth(false) },
+      incidentId: "inc1",
+    });
+    expect(audience).toBe("public");
+  });
+
+  test("service user => manager (trusted)", async () => {
+    const user: ServiceUser = { type: "service", pluginId: "other" };
+    const audience = await resolveIncidentAudience({
+      context: { user, auth: fakeAuth(false) },
+      incidentId: "inc1",
+    });
+    expect(audience).toBe("manager");
+  });
+
+  test("global manage rule => manager", async () => {
+    const user: RealUser = { type: "user", id: "u1", accessRules: [MANAGE_ID] };
+    const audience = await resolveIncidentAudience({
+      context: { user, auth: fakeAuth(false) },
+      incidentId: "inc1",
+    });
+    expect(audience).toBe("manager");
+  });
+
+  test("wildcard rule => manager", async () => {
+    const user: RealUser = { type: "user", id: "u1", accessRules: ["*"] };
+    const audience = await resolveIncidentAudience({
+      context: { user, auth: fakeAuth(false) },
+      incidentId: "inc1",
+    });
+    expect(audience).toBe("manager");
+  });
+
+  test("team grant on this incident => manager", async () => {
+    const user: RealUser = { type: "user", id: "u1", accessRules: [] };
+    const audience = await resolveIncidentAudience({
+      context: { user, auth: fakeAuth(true) },
+      incidentId: "inc1",
+    });
+    expect(audience).toBe("manager");
+  });
+
+  test("authenticated non-manager => authenticated", async () => {
+    const user: RealUser = { type: "user", id: "u1", accessRules: [] };
+    const audience = await resolveIncidentAudience({
+      context: { user, auth: fakeAuth(false) },
+      incidentId: "inc1",
+    });
+    expect(audience).toBe("authenticated");
+  });
+});

package/src/read-visibility.ts

@@ -0,0 +1,99 @@
+import { qualifyAccessRuleId } from "@checkstack/common";
+import type { RpcContext, AuthService } from "@checkstack/backend-api";
+import {
+  incidentAccess,
+  incidentResourceTypes,
+  pluginMetadata,
+  type IncidentVisibility,
+} from "@checkstack/incident-common";
+
+/**
+ * Read-path audience level for the caller. Drives which incident updates/links
+ * ship in a payload (Item 3/5): filtering is enforced SERVER-SIDE here, never
+ * via CSS - a hidden item is never serialized.
+ *
+ * - `public`: anonymous callers and the public status-page projection.
+ * - `authenticated`: a logged-in user who cannot manage this incident.
+ * - `manager`: a global incident manager, a team-scoped manager of THIS
+ *   incident, or a trusted service call.
+ */
+export type ReadAudience = "public" | "authenticated" | "manager";
+
+/** Whether an item of the given visibility is exposed at the caller's audience. */
+export function isVisibleAtAudience(
+  visibility: IncidentVisibility,
+  audience: ReadAudience,
+): boolean {
+  if (audience === "manager") return true;
+  if (audience === "authenticated") return visibility !== "internal";
+  return visibility === "public";
+}
+
+/** Filter a list of visibility-carrying items to what the audience may see. */
+export function filterByAudience<T extends { visibility: IncidentVisibility }>(
+  items: T[],
+  audience: ReadAudience,
+): T[] {
+  return items.filter((item) => isVisibleAtAudience(item.visibility, audience));
+}
+
+/**
+ * Strip the manager-only `editHistory` from updates for any non-manager
+ * audience. An update's CURRENT visibility gates the whole row, but a PRIOR
+ * version archived in `editHistory` could have been `internal` before being made
+ * `public` - so exposing history to a public / logged-in reader would leak prior
+ * internal content. The simplest safe rule (and the one applied here): edit
+ * history is manager-only. Managers get the array untouched; everyone else gets
+ * it removed from the payload.
+ */
+export function scopeEditHistory<T extends { editHistory?: unknown }>(
+  updates: T[],
+  audience: ReadAudience,
+): T[] {
+  if (audience === "manager") return updates;
+  return updates.map((u) => ({ ...u, editHistory: undefined }));
+}
+
+/**
+ * Resolve the caller's audience for a specific incident. A trusted service call
+ * is treated as `manager` (server-to-server reads are not the public surface -
+ * the public status page filters to `public` separately in its widget). An
+ * anonymous caller (no user) is `public`. Otherwise the caller is a `manager`
+ * when they hold the global manage rule OR a team grant to manage THIS incident.
+ */
+export async function resolveIncidentAudience({
+  context,
+  incidentId,
+}: {
+  // Only the caller + the auth `check` are needed; a narrow shape keeps this
+  // unit testable without constructing a full RpcContext / AuthService.
+  context: { user: RpcContext["user"]; auth: Pick<AuthService, "check"> };
+  incidentId: string;
+}): Promise<ReadAudience> {
+  const user = context.user;
+  if (!user) return "public";
+  if (user.type === "service") return "manager";
+
+  const manageRuleId = qualifyAccessRuleId(
+    pluginMetadata,
+    incidentAccess.incident.manage,
+  );
+  const rules = user.accessRules ?? [];
+  const hasGlobalManage =
+    rules.includes("*") || rules.includes(manageRuleId);
+  if (hasGlobalManage) return "manager";
+
+  if (user.type === "user" || user.type === "application") {
+    const { hasAccess } = await context.auth.check({
+      userId: user.id,
+      userType: user.type,
+      objectType: incidentResourceTypes.incident,
+      objectId: incidentId,
+      action: "manage",
+      hasGlobalAccess: false,
+    });
+    if (hasAccess) return "manager";
+  }
+
+  return "authenticated";
+}

package/src/router.test.ts

@@ -25,6 +25,7 @@ interface FakeIncident {
   status: string;
   severity: string;
   suppressNotifications: boolean;
+  healthOverride: string | null;
   systemIds: string[];
   createdAt: Date;
   updatedAt: Date;
@@ -39,6 +40,7 @@ function makeIncident(id: string, status = "investigating"): FakeIncident {
     status,
     severity: "major",
     suppressNotifications: false,
+    healthOverride: null,
     systemIds: ["sys-1"],
     createdAt: new Date("2026-01-01T00:00:00Z"),
     updatedAt: new Date("2026-01-01T00:00:00Z"),
@@ -63,15 +65,22 @@ function buildRouter() {
   const getIncident = mock(async (id: string) =>
     PRESENT.has(id) ? makeIncident(id) : undefined,
   );
+  // Echoes the patch back onto the incident so an override-only edit still
+  // resolves the affected systemIds for the lifecycle hook payload.
+  const updateIncident = mock(async (input: { id: string }) =>
+    PRESENT.has(input.id) ? makeIncident(input.id) : undefined,
+  );
 
   const service = {
     getIncident,
     deleteIncident,
     resolveIncident,
+    updateIncident,
   } as unknown as Parameters<typeof createRouter>[0]["service"];
 
   const invalidateForMutation = mock(async () => {});
   const broadcast = mock(async () => {});
+  const emit = mock(async () => {});
   const notifyForSubscription = mock(async () => {});
   const getSystem = mock(async () => undefined);
   const getUserById = mock(async () => undefined);
@@ -82,6 +91,9 @@ function buildRouter() {
     signalService: { broadcast } as unknown as Parameters<
       typeof createRouter
     >[0]["signalService"],
+    eventBus: { emit } as unknown as Parameters<
+      typeof createRouter
+    >[0]["eventBus"],
     catalogClient: { getSystem } as unknown as Parameters<
       typeof createRouter
     >[0]["catalogClient"],
@@ -97,7 +109,15 @@ function buildRouter() {
     >[0]["cache"],
   });
 
-  return { router, deleteIncident, resolveIncident, invalidateForMutation };
+  return {
+    router,
+    deleteIncident,
+    resolveIncident,
+    updateIncident,
+    emit,
+    invalidateForMutation,
+    notifyForSubscription,
+  };
 }
 
 /** Team-scoped context: no global rule; only `granted` ids are grant-covered. */
@@ -154,6 +174,54 @@ describe("incident router bulkDeleteIncidents", () => {
   });
 });
 
+describe("incident router resolveIncident notification", () => {
+  it("carries the resolution note into the subscriber notification body", async () => {
+    const { router, notifyForSubscription } = buildRouter();
+    const ctx = teamScopedContext(["inc-ok"]);
+
+    await call(
+      router.resolveIncident,
+      { id: "inc-ok", message: "Root cause fixed and services restored" },
+      { context: ctx },
+    );
+
+    expect(notifyForSubscription).toHaveBeenCalledTimes(1);
+    const payload = (
+      notifyForSubscription.mock.calls[0] as unknown[] | undefined
+    )?.[0] as { body?: string } | undefined;
+    expect(payload?.body).toContain("has been resolved");
+    // The operator's resolution note must reach subscribers, not be dropped.
+    expect(payload?.body).toContain("Root cause fixed and services restored");
+  });
+});
+
+describe("incident lifecycle hook", () => {
+  it("fires incident.lifecycle.changed on an override-only update (with affected systemIds)", async () => {
+    // The reactive `incident` entity state is {status, severity, systemIds}, so
+    // clearing/adding a healthOverride with no other change emits no entity
+    // change. This hook MUST still fire so SLO can open/close incident-forced
+    // downtime — the whole reason it exists alongside INCIDENT_UPDATED.
+    const { router, emit } = buildRouter();
+    const ctx = teamScopedContext(["inc-ok"]);
+
+    await call(
+      router.updateIncident,
+      { id: "inc-ok", healthOverride: null },
+      { context: ctx },
+    );
+
+    expect(emit).toHaveBeenCalledTimes(1);
+    const emitArgs = emit.mock.calls[0] as unknown[] | undefined;
+    const hook = emitArgs?.[0] as { id?: string } | undefined;
+    const payload = emitArgs?.[1] as
+      | { systemIds?: string[]; action?: string }
+      | undefined;
+    expect(hook?.id).toBe("incident.lifecycle.changed");
+    expect(payload?.action).toBe("updated");
+    expect(payload?.systemIds).toEqual(["sys-1"]);
+  });
+});
+
 describe("incident router bulkResolveIncidents", () => {
   it("resolves only authorized ids and reports forbidden/notFound/error per id", async () => {
     const { router, resolveIncident } = buildRouter();