@checkstack/incident-backend 1.8.6 → 1.9.0

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # @checkstack/incident-backend
 
+## 1.9.0
+
+### Minor Changes
+
+- e430fbe: Add "Mass delete" and "Mass resolve" to the Incidents and Maintenances lists,
+  authorized per item (RLAC).
+
+  The incidents and maintenances list pages now support multi-select with a bulk
+  action bar. A user may only select and act on entries they are allowed to
+  MANAGE: a row's checkbox appears only when the caller can manage it (the same
+  `canAccess(id)` gate as the per-row actions), so a team-scoped member sees
+  checkboxes only for their team's entries. Mass delete confirms before running;
+  mass resolve (incidents) and mass complete (maintenances, the "resolve"
+  equivalent = close, status -> completed) skip entries that are already
+  resolved/completed. Each action reports a per-id partial-success summary
+  (e.g. "3 deleted, 1 skipped").
+
+  New backend procedures: `incident.bulkDeleteIncidents`,
+  `incident.bulkResolveIncidents`, `maintenance.bulkDeleteMaintenances`, and
+  `maintenance.bulkCloseMaintenances`. Each authorizes EACH id against the
+  caller's manage grant and never fails open: unauthorized ids are filtered out
+  before the handler runs and returned as `forbidden`; missing ids as `notFound`;
+  a per-id failure is isolated as `error` without aborting the batch. Per-id cache
+  invalidation, realtime signals, and subscriber notifications run for every
+  success so dashboards and status pages stay consistent.
+
+  Platform: a new `instanceAccess` mode `bulkManage: { idsParam }` is the
+  enforcement point for bulk writes. Before the handler runs, `autoAuthMiddleware`
+  partitions the input id array into the caller's manageable subset and the denied
+  remainder and exposes both on `context.bulkAccess` (fail-closed on an S2S
+  error). The boot-time contract validator (`validateContractInstanceAccess`)
+  accepts `bulkManage` as one of the mutually-exclusive scoping modes, marks its
+  type team-scopable, and cross-checks `idsParam` against the input schema.
+
+  State and scale: authorization is derived per request from the shared team-grant
+  store via the existing auth S2S path (no process-local state); the read returns
+  the same answer on every pod. No database migration.
+
+### Patch Changes
+
+- Updated dependencies [d1b71b6]
+- Updated dependencies [7c18b25]
+- Updated dependencies [e430fbe]
+- Updated dependencies [eab80e3]
+- Updated dependencies [53666a7]
+- Updated dependencies [0d912a3]
+  - @checkstack/notification-common@1.5.0
+  - @checkstack/ai-backend@0.10.2
+  - @checkstack/common@0.19.0
+  - @checkstack/backend-api@0.27.0
+  - @checkstack/incident-common@1.7.0
+  - @checkstack/auth-common@0.12.0
+  - @checkstack/catalog-common@2.6.0
+  - @checkstack/automation-common@0.9.0
+  - @checkstack/status-page-common@0.5.0
+  - @checkstack/catalog-backend@1.6.2
+  - @checkstack/automation-backend@0.10.4
+  - @checkstack/ai-common@0.6.3
+  - @checkstack/cache-api@0.3.16
+  - @checkstack/cache-utils@0.2.21
+  - @checkstack/command-backend@0.2.15
+  - @checkstack/integration-backend@0.6.8
+  - @checkstack/integration-common@0.9.5
+  - @checkstack/signal-common@0.2.14
+  - @checkstack/status-page-backend@0.4.2
+
+## 1.8.7
+
+### Patch Changes
+
+- Updated dependencies [baf9b6e]
+  - @checkstack/ai-backend@0.10.1
+  - @checkstack/automation-backend@0.10.3
+  - @checkstack/catalog-backend@1.6.1
+
 ## 1.8.6
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-backend",
-  "version": "1.8.6",
+  "version": "1.9.0",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.ts",
@@ -14,25 +14,25 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/ai-backend": "0.10.0",
-    "@checkstack/ai-common": "0.6.2",
-    "@checkstack/backend-api": "0.26.1",
-    "@checkstack/cache-api": "0.3.15",
-    "@checkstack/cache-utils": "0.2.20",
-    "@checkstack/incident-common": "1.6.4",
-    "@checkstack/catalog-common": "2.5.0",
-    "@checkstack/catalog-backend": "1.6.0",
-    "@checkstack/notification-common": "1.4.2",
-    "@checkstack/auth-common": "0.11.2",
-    "@checkstack/command-backend": "0.2.14",
-    "@checkstack/signal-common": "0.2.13",
-    "@checkstack/status-page-backend": "0.4.1",
-    "@checkstack/status-page-common": "0.4.1",
-    "@checkstack/integration-backend": "0.6.7",
-    "@checkstack/integration-common": "0.9.4",
-    "@checkstack/automation-backend": "0.10.2",
-    "@checkstack/automation-common": "0.8.2",
-    "@checkstack/common": "0.18.0",
+    "@checkstack/ai-backend": "0.10.2",
+    "@checkstack/ai-common": "0.6.3",
+    "@checkstack/backend-api": "0.27.0",
+    "@checkstack/cache-api": "0.3.16",
+    "@checkstack/cache-utils": "0.2.21",
+    "@checkstack/incident-common": "1.7.0",
+    "@checkstack/catalog-common": "2.6.0",
+    "@checkstack/catalog-backend": "1.6.2",
+    "@checkstack/notification-common": "1.5.0",
+    "@checkstack/auth-common": "0.12.0",
+    "@checkstack/command-backend": "0.2.15",
+    "@checkstack/signal-common": "0.2.14",
+    "@checkstack/status-page-backend": "0.4.2",
+    "@checkstack/status-page-common": "0.5.0",
+    "@checkstack/integration-backend": "0.6.8",
+    "@checkstack/integration-common": "0.9.5",
+    "@checkstack/automation-backend": "0.10.4",
+    "@checkstack/automation-common": "0.9.0",
+    "@checkstack/common": "0.19.0",
     "drizzle-orm": "^0.45.0",
     "zod": "^4.2.1",
     "@orpc/contract": "^1.14.4",
@@ -40,8 +40,8 @@
   },
   "devDependencies": {
     "@checkstack/drizzle-helper": "0.0.6",
-    "@checkstack/scripts": "0.6.5",
-    "@checkstack/test-utils-backend": "0.1.48",
+    "@checkstack/scripts": "0.7.0",
+    "@checkstack/test-utils-backend": "0.1.49",
     "@checkstack/tsconfig": "0.0.7",
     "@types/bun": "^1.0.0",
     "drizzle-kit": "^0.31.10",

package/src/router.test.ts

@@ -0,0 +1,181 @@
+import { describe, it, expect, mock } from "bun:test";
+import { call } from "@orpc/server";
+import { createMockRpcContext, type RpcContext } from "@checkstack/backend-api";
+import { createRouter } from "./router";
+
+/**
+ * Bulk-action authorization + per-id partial-success tests for the incident
+ * router. These drive the REAL `bulkDeleteIncidents` / `bulkResolveIncidents`
+ * procedures through `call`, so the platform `bulkManage` middleware runs and
+ * pre-partitions `input.ids` into the caller's authorized subset BEFORE the
+ * handler. We assert:
+ *   - only authorized ids are ever passed to the service (denied ids are never
+ *     acted on — RLAC never-fail-open),
+ *   - denied ids are reported `forbidden`, missing ids `notFound`, and a per-id
+ *     service throw is isolated as `error` without aborting the batch.
+ *
+ * The caller is TEAM-SCOPED (no global rule); `listAccessibleObjectIds` returns
+ * the granted subset, exactly as the auth backend would.
+ */
+
+interface FakeIncident {
+  id: string;
+  title: string;
+  description?: string;
+  status: string;
+  severity: string;
+  suppressNotifications: boolean;
+  systemIds: string[];
+  createdAt: Date;
+  updatedAt: Date;
+  updates: unknown[];
+  links: unknown[];
+}
+
+function makeIncident(id: string, status = "investigating"): FakeIncident {
+  return {
+    id,
+    title: `Incident ${id}`,
+    status,
+    severity: "major",
+    suppressNotifications: false,
+    systemIds: ["sys-1"],
+    createdAt: new Date("2026-01-01T00:00:00Z"),
+    updatedAt: new Date("2026-01-01T00:00:00Z"),
+    updates: [],
+    links: [],
+  };
+}
+
+// Ids that resolve to a real incident. "inc-missing" is absent; "inc-throw"
+// exists but its mutate throws.
+const PRESENT = new Set(["inc-ok", "inc-throw"]);
+
+function buildRouter() {
+  const deleteIncident = mock(async (id: string) => {
+    if (id === "inc-throw") throw new Error("db exploded");
+    return PRESENT.has(id);
+  });
+  const resolveIncident = mock(async (id: string) => {
+    if (id === "inc-throw") throw new Error("db exploded");
+    return PRESENT.has(id) ? makeIncident(id, "resolved") : undefined;
+  });
+  const getIncident = mock(async (id: string) =>
+    PRESENT.has(id) ? makeIncident(id) : undefined,
+  );
+
+  const service = {
+    getIncident,
+    deleteIncident,
+    resolveIncident,
+  } as unknown as Parameters<typeof createRouter>[0]["service"];
+
+  const invalidateForMutation = mock(async () => {});
+  const broadcast = mock(async () => {});
+  const notifyForSubscription = mock(async () => {});
+  const getSystem = mock(async () => undefined);
+  const getUserById = mock(async () => undefined);
+
+  // Cast test doubles: the router only touches these members on the bulk paths.
+  const router = createRouter({
+    service,
+    signalService: { broadcast } as unknown as Parameters<
+      typeof createRouter
+    >[0]["signalService"],
+    catalogClient: { getSystem } as unknown as Parameters<
+      typeof createRouter
+    >[0]["catalogClient"],
+    notificationClient: { notifyForSubscription } as unknown as Parameters<
+      typeof createRouter
+    >[0]["notificationClient"],
+    authClient: { getUserById } as unknown as Parameters<
+      typeof createRouter
+    >[0]["authClient"],
+    logger: createMockRpcContext().logger,
+    cache: { invalidateForMutation } as unknown as Parameters<
+      typeof createRouter
+    >[0]["cache"],
+  });
+
+  return { router, deleteIncident, resolveIncident, invalidateForMutation };
+}
+
+/** Team-scoped context: no global rule; only `granted` ids are grant-covered. */
+function teamScopedContext(granted: string[]): RpcContext {
+  const base = createMockRpcContext({
+    pluginMetadata: { pluginId: "incident" },
+    user: { type: "user", id: "u1", accessRules: [] },
+  });
+  return {
+    ...base,
+    auth: {
+      ...base.auth,
+      listAccessibleObjectIds: (p: { objectIds: string[] }) =>
+        Promise.resolve(p.objectIds.filter((id) => granted.includes(id))),
+    },
+  };
+}
+
+describe("incident router bulkDeleteIncidents", () => {
+  it("deletes only authorized ids and reports forbidden/notFound/error per id", async () => {
+    const { router, deleteIncident } = buildRouter();
+    const ctx = teamScopedContext(["inc-ok", "inc-missing", "inc-throw"]);
+
+    const { results } = await call(
+      router.bulkDeleteIncidents,
+      { ids: ["inc-ok", "inc-missing", "inc-throw", "inc-forbidden"] },
+      { context: ctx },
+    );
+
+    const byId = Object.fromEntries(results.map((r) => [r.id, r.status]));
+    expect(byId["inc-ok"]).toBe("deleted");
+    expect(byId["inc-missing"]).toBe("notFound");
+    expect(byId["inc-throw"]).toBe("error");
+    expect(byId["inc-forbidden"]).toBe("forbidden");
+
+    // The unauthorized id was NEVER passed to the service (never-fail-open).
+    const deletedIds = deleteIncident.mock.calls.map((c) => c[0]);
+    expect(deletedIds).not.toContain("inc-forbidden");
+    expect(deletedIds).toContain("inc-ok");
+  });
+
+  it("reports every id forbidden when the caller has no grants at all", async () => {
+    const { router, deleteIncident } = buildRouter();
+    const ctx = teamScopedContext([]); // no grants
+
+    const { results } = await call(
+      router.bulkDeleteIncidents,
+      { ids: ["inc-ok", "inc-throw"] },
+      { context: ctx },
+    );
+
+    expect(results.every((r) => r.status === "forbidden")).toBe(true);
+    expect(deleteIncident).not.toHaveBeenCalled();
+  });
+});
+
+describe("incident router bulkResolveIncidents", () => {
+  it("resolves only authorized ids and reports forbidden/notFound/error per id", async () => {
+    const { router, resolveIncident } = buildRouter();
+    const ctx = teamScopedContext(["inc-ok", "inc-missing", "inc-throw"]);
+
+    const { results } = await call(
+      router.bulkResolveIncidents,
+      {
+        ids: ["inc-ok", "inc-missing", "inc-throw", "inc-forbidden"],
+        message: "batch resolve",
+      },
+      { context: ctx },
+    );
+
+    const byId = Object.fromEntries(results.map((r) => [r.id, r.status]));
+    expect(byId["inc-ok"]).toBe("resolved");
+    expect(byId["inc-missing"]).toBe("notFound");
+    expect(byId["inc-throw"]).toBe("error");
+    expect(byId["inc-forbidden"]).toBe("forbidden");
+
+    const resolvedIds = resolveIncident.mock.calls.map((c) => c[0]);
+    expect(resolvedIds).not.toContain("inc-forbidden");
+    expect(resolvedIds).toContain("inc-ok");
+  });
+});

package/src/router.ts

@@ -18,6 +18,7 @@ import { notifyAffectedSystems } from "./notifications";
 import type {
   IncidentUpdate,
   IncidentWithSystems,
+  BulkIncidentActionResult,
 } from "@checkstack/incident-common";
 import type { IncidentCache } from "./cache";
 import type { EntityHandle } from "@checkstack/automation-backend";
@@ -110,6 +111,98 @@ export function createRouter({
     return systemNames;
   }
 
+  /**
+   * Resolve a single incident and run the full post-mutation sequence
+   * (entity write → cache invalidate → signal → notify). Returns `"notFound"`
+   * for a missing incident WITHOUT throwing, so the single-item handler (which
+   * turns that into a 404) and the bulk handler (which records it as a per-id
+   * outcome) share one code path.
+   */
+  async function resolveOneIncident({
+    id,
+    message,
+    userId,
+  }: {
+    id: string;
+    message?: string;
+    userId?: string;
+  }): Promise<{
+    status: "resolved" | "notFound";
+    incident?: IncidentWithSystems;
+  }> {
+    const existing = await service.getIncident(id);
+    if (!existing) return { status: "notFound" };
+
+    let resolved: IncidentWithSystems | undefined;
+    await writeIncidentEntity({
+      handle: getIncidentEntity?.(),
+      incidentId: id,
+      apply: async () => {
+        resolved = await service.resolveIncident(id, message, userId);
+        // A race could delete the incident between probe and write; fall back
+        // to the pre-write snapshot so the entity diff is a no-op.
+        return toIncidentEntityState(resolved ?? existing);
+      },
+    });
+    if (!resolved) return { status: "notFound" };
+
+    await cache.invalidateForMutation({
+      incidentId: resolved.id,
+      systemIds: resolved.systemIds,
+    });
+    await signalService.broadcast(INCIDENT_UPDATED, {
+      incidentId: resolved.id,
+      systemIds: resolved.systemIds,
+      action: "resolved",
+    });
+    const systemNames = await resolveSystemNames(resolved.systemIds);
+    await notifyAffectedSystems({
+      catalogClient,
+      notificationClient,
+      logger,
+      incidentId: resolved.id,
+      incidentTitle: resolved.title,
+      systemIds: resolved.systemIds,
+      systemNames,
+      action: "resolved",
+      severity: resolved.severity,
+    });
+    return { status: "resolved", incident: resolved };
+  }
+
+  /**
+   * Delete a single incident + post-mutation sequence (entity tombstone →
+   * cache invalidate → signal). Returns `"notFound"` when the row does not
+   * exist, matching the single-item handler's historical `{ success: false }`.
+   */
+  async function deleteOneIncident(
+    id: string,
+  ): Promise<"deleted" | "notFound"> {
+    const incident = await service.getIncident(id);
+    if (!incident) return "notFound";
+
+    let success = false;
+    await removeIncidentEntity({
+      handle: getIncidentEntity?.(),
+      incidentId: id,
+      apply: async () => {
+        success = await service.deleteIncident(id);
+      },
+    });
+    if (!success) return "notFound";
+
+    await cache.invalidateForMutation({
+      incidentId: id,
+      systemIds: incident.systemIds,
+    });
+    await signalService.broadcast(INCIDENT_UPDATED, {
+      incidentId: id,
+      systemIds: incident.systemIds,
+      action: "deleted",
+    });
+    return "deleted";
+  }
+
   const os = implement(incidentContract)
     .$context<RpcContext>()
     .use(correlationMiddleware)
@@ -361,97 +454,88 @@ export function createRouter({
       const userId =
         context.user && "id" in context.user ? context.user.id : undefined;
 
-      const exists = await service.getIncident(input.id);
-      if (!exists) {
+      // Drive the resolve through the shared per-id helper (entity write →
+      // cache → signal → notify). A missing incident surfaces as NOT_FOUND.
+      const outcome = await resolveOneIncident({
+        id: input.id,
+        message: input.message,
+        userId,
+      });
+      if (outcome.status !== "resolved" || !outcome.incident) {
         throw new ORPCError("NOT_FOUND", { message: "Incident not found" });
       }
-
-      // Drive the resolve through the reactive `incident` entity (§10.1);
-      // `apply` performs the REAL resolve (the plugin's own db/tx) and returns
-      // the new reactive state. The deriver fires `incident.resolved` from the
-      // status → resolved transition.
-      let result!: NonNullable<Awaited<ReturnType<typeof service.resolveIncident>>>;
-      await writeIncidentEntity({
-        handle: getIncidentEntity?.(),
-        incidentId: input.id,
-        apply: async () => {
-          const resolved = await service.resolveIncident(
-            input.id,
-            input.message,
-            userId,
-          );
-          if (!resolved) {
-            throw new ORPCError("NOT_FOUND", { message: "Incident not found" });
-          }
-          result = resolved;
-          return toIncidentEntityState(result);
-        },
-      });
-
-      await cache.invalidateForMutation({
-        incidentId: result.id,
-        systemIds: result.systemIds,
-      });
-
-      // Broadcast signal for realtime updates
-      await signalService.broadcast(INCIDENT_UPDATED, {
-        incidentId: result.id,
-        systemIds: result.systemIds,
-        action: "resolved",
-      });
-
-      // Send notifications to system subscribers
-      const systemNames = await resolveSystemNames(result.systemIds);
-      await notifyAffectedSystems({
-        catalogClient,
-        notificationClient,
-        logger,
-        incidentId: result.id,
-        incidentTitle: result.title,
-        systemIds: result.systemIds,
-        systemNames,
-        action: "resolved",
-        severity: result.severity,
-      });
-
-      return result;
+      return outcome.incident;
     }),
 
     deleteIncident: os.deleteIncident.handler(async ({ input }) => {
-      // Get incident before deleting to get systemIds.
-      const incident = await service.getIncident(input.id);
-      if (!incident) {
-        return { success: false };
-      }
-
-      // Drive the delete through the reactive `incident` entity tombstone
-      // (§10.1). `apply` performs the REAL delete (the plugin's own db/tx);
-      // the framework records the tombstone transition and emits a tombstone
-      // change. No `incident.deleted` trigger event exists, so the deriver
-      // fires nothing. `success` tracks whether the row was actually deleted.
-      let success = false;
-      await removeIncidentEntity({
-        handle: getIncidentEntity?.(),
-        incidentId: input.id,
-        apply: async () => {
-          success = await service.deleteIncident(input.id);
-        },
-      });
+      // Shared per-id delete helper drives the reactive `incident` tombstone
+      // (§10.1) + cache invalidate + signal. `success` tracks whether the row
+      // actually existed and was deleted.
+      const status = await deleteOneIncident(input.id);
+      return { success: status === "deleted" };
+    }),
 
-      if (success) {
-        await cache.invalidateForMutation({
-          incidentId: input.id,
-          systemIds: incident.systemIds,
-        });
+    bulkDeleteIncidents: os.bulkDeleteIncidents.handler(
+      async ({ input, context }) => {
+        // The `bulkManage` instance-access mode pre-partitioned `input.ids`
+        // into the caller's manageable subset and the denied remainder. A
+        // missing partition means we cannot prove authorization, so treat the
+        // whole batch as denied (fail closed) rather than acting on any id.
+        const partition = context.bulkAccess?.ids ?? {
+          authorizedIds: [],
+          deniedIds: input.ids,
+        };
+        const results: BulkIncidentActionResult[] = [];
+        for (const id of partition.authorizedIds) {
+          try {
+            results.push({ id, status: await deleteOneIncident(id) });
+          } catch (error) {
+            // Isolate per-id failures so one bad row never aborts the batch.
+            logger.error(
+              `bulkDeleteIncidents: failed to delete incident ${id}`,
+              error,
+            );
+            results.push({ id, status: "error" });
+          }
+        }
+        for (const id of partition.deniedIds) {
+          results.push({ id, status: "forbidden" });
+        }
+        return { results };
+      },
+    ),
 
-        await signalService.broadcast(INCIDENT_UPDATED, {
-          incidentId: input.id,
-          systemIds: incident.systemIds,
-          action: "deleted",
-        });
-      }
-      return { success };
-    }),
+    bulkResolveIncidents: os.bulkResolveIncidents.handler(
+      async ({ input, context }) => {
+        const userId =
+          context.user && "id" in context.user ? context.user.id : undefined;
+        const partition = context.bulkAccess?.ids ?? {
+          authorizedIds: [],
+          deniedIds: input.ids,
+        };
+        const results: BulkIncidentActionResult[] = [];
+        for (const id of partition.authorizedIds) {
+          try {
+            const outcome = await resolveOneIncident({
+              id,
+              message: input.message,
+              userId,
+            });
+            results.push({ id, status: outcome.status });
+          } catch (error) {
+            logger.error(
+              `bulkResolveIncidents: failed to resolve incident ${id}`,
+              error,
+            );
+            results.push({ id, status: "error" });
+          }
+        }
+        for (const id of partition.deniedIds) {
+          results.push({ id, status: "forbidden" });
+        }
+        return { results };
+      },
+    ),
 
     hasActiveIncidentWithSuppression:
       os.hasActiveIncidentWithSuppression.handler(async ({ input }) => {