@checkstack/incident-common 1.4.3 → 1.5.0

package/CHANGELOG.md

@@ -1,5 +1,83 @@
 # @checkstack/incident-common
 
+## 1.5.0
+
+### Minor Changes
+
+- 0b6f01b: feat(incident): contribute incident signals to the backend system.issues aggregator
+
+  The incident plugin now registers a `system.issues` contributor (sourceId
+  `incident`) from its backend `init`, so the AI assistant surfaces open incidents
+  alongside SLOs, health checks, anomalies, and dependency problems.
+
+  The contributor enforces its own `incident.read` access gate (returning an empty
+  map - never throwing - when the principal lacks access; service users carry no
+  access rules and so get no signals), then reads every OPEN (not-resolved)
+  incident for all systems from the shared, durable `incidents` +
+  `incident_systems` tables via a new global `listOpenIncidentsBySystem` service
+  method. The answer is therefore identical on every pod, and only systems with an
+  open incident appear in the result.
+
+  The row->signal mapping (source/tone/label/detail/href/accessRule/since/iconName)
+  is extracted into a new pure `deriveIncidentSignals` deriver in
+  `@checkstack/incident-common`, shared by both the backend contributor and the
+  frontend `IncidentSignalsFiller` so the two surfaces stay in lockstep. The
+  frontend filler now delegates to that deriver with unchanged behavior.
+
+## 1.4.4
+
+### Patch Changes
+
+- 56e7c75: Fix frontend access checks to use FULLY-QUALIFIED access-rule ids, and resolve
+  the anonymous role on the frontend.
+
+  Granted access-rule ids are stored fully-qualified as `{pluginId}.{ruleId}` (e.g.
+  `incident.incident.read`) so two plugins defining the same short rule id never
+  collide. The frontend, however, was checking the UNqualified id (`incident.read`)
+  via `isAccessRuleSatisfied`, so every check failed for any user without the `*`
+  (admin) grant - masked in development because dev-auth grants `*`. This silently
+  broke ALL non-admin frontend gating (route guards, sidebar entries, and
+  `useAccess`-based button/link gating).
+
+  - **`@checkstack/common`**: `AccessRule` now carries a REQUIRED owning `pluginId`;
+    `access()` / `accessPair()` require and stamp it; `isAccessRuleSatisfied`
+    qualifies the rule (`{pluginId}.{id}`, plus the manage->read escalation) and
+    matches ONLY the qualified form. There is intentionally NO unqualified fallback
+    - matching a bare id would let one plugin's grant satisfy another plugin's
+      identically-named rule (a cross-plugin privilege-escalation flaw). Every plugin
+      that defines access rules now passes its own `pluginId`.
+  - **`@checkstack/backend`**: `pluginManager.getAllAccessRules()` no longer strips
+    the `pluginId` field (the rule `id` is already fully-qualified for the DB sync).
+  - **Route guard** (`@checkstack/frontend` / `@checkstack/frontend-api`) now
+    checks the FULL rule object (so it qualifies and escalates), not a bare id.
+  - **Anonymous role on the frontend**: the `accessRules` procedure is now
+    `public`, returning the configurable anonymous role's grants to unauthenticated
+    callers; `useAccessRules` fetches them for guests instead of returning an empty
+    set. So anonymous UI now reflects exactly what the anonymous role is allowed -
+    which an admin can change (`isPublic` is only the seeded default).
+  - Incident / maintenance / SLO detail routes are now read-gated (their read rule
+    is an `isPublic` default, so the anonymous role holds it unless an admin
+    revokes it); their dashboard status signals carry that rule and render as a
+    link only when the viewer may open it.
+
+  **BREAKING (`@checkstack/common`):** `AccessRule.pluginId` is now REQUIRED, and
+  `access()` / `accessPair()` require a `pluginId` option. `isAccessRuleSatisfied`
+  matches ONLY the fully-qualified `{pluginId}.{ruleId}` form - the previous
+  unqualified fallback is removed, because it was a cross-plugin
+  privilege-escalation flaw. Any code constructing an `AccessRule` or calling
+  `access()`/`accessPair()` must supply the owning `pluginId`.
+
+  Verified live against an anonymous caller: read pages resolve (qualified match),
+  manage actions are denied, manage->read escalation and `*` still work.
+
+- Updated dependencies [56e7c75]
+- Updated dependencies [56e7c75]
+  - @checkstack/frontend-api@0.9.0
+  - @checkstack/catalog-common@2.3.4
+  - @checkstack/common@0.15.0
+  - @checkstack/notification-common@1.3.3
+  - @checkstack/signal-common@0.2.9
+
 ## 1.4.3
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-common",
-  "version": "1.4.3",
+  "version": "1.5.0",
   "license": "Elastic-2.0",
   "type": "module",
   "exports": {
@@ -9,18 +9,18 @@
     }
   },
   "dependencies": {
-    "@checkstack/common": "0.14.1",
-    "@checkstack/catalog-common": "2.3.3",
-    "@checkstack/frontend-api": "0.8.0",
-    "@checkstack/notification-common": "1.3.2",
-    "@checkstack/signal-common": "0.2.8",
+    "@checkstack/common": "0.15.0",
+    "@checkstack/catalog-common": "2.3.4",
+    "@checkstack/frontend-api": "0.9.0",
+    "@checkstack/notification-common": "1.3.3",
+    "@checkstack/signal-common": "0.2.9",
     "@orpc/contract": "^1.14.4",
     "zod": "^4.2.1"
   },
   "devDependencies": {
     "typescript": "^5.7.2",
     "@checkstack/tsconfig": "0.0.7",
-    "@checkstack/scripts": "0.6.0"
+    "@checkstack/scripts": "0.6.1"
   },
   "scripts": {
     "typecheck": "tsgo -b",

package/src/access.ts

@@ -1,4 +1,5 @@
 import { accessPair } from "@checkstack/common";
+import { pluginMetadata } from "./plugin-metadata";
 
 /**
  * Access rules for the Incident plugin.
@@ -26,6 +27,7 @@ export const incidentAccess = {
     },
     {
       idParam: "systemId",
+      pluginId: pluginMetadata.pluginId,
     },
   ),
 };

package/src/index.ts

@@ -29,6 +29,10 @@ export {
   type AddIncidentUpdateInput,
 } from "./schemas";
 export { IncidentDetailsSlot, IncidentStatusSlot } from "./slots";
+export {
+  INCIDENT_SIGNAL_SOURCE_ID,
+  deriveIncidentSignals,
+} from "./signals";
 export * from "./plugin-metadata";
 export * from "./notifications";
 export { incidentRoutes } from "./routes";

package/src/signals.test.ts

@@ -0,0 +1,97 @@
+import { describe, test, expect } from "bun:test";
+import {
+  INCIDENT_SIGNAL_SOURCE_ID,
+  deriveIncidentSignals,
+} from "./signals";
+import { incidentAccess } from "./access";
+import type { IncidentWithSystems } from "./schemas";
+
+const baseIncident = (
+  overrides: Partial<IncidentWithSystems>,
+): IncidentWithSystems => ({
+  id: "inc-1",
+  title: "Database down",
+  description: undefined,
+  status: "investigating",
+  severity: "critical",
+  suppressNotifications: false,
+  createdAt: new Date("2026-06-01T10:00:00.000Z"),
+  updatedAt: new Date("2026-06-01T10:00:00.000Z"),
+  systemIds: ["sys-1"],
+  ...overrides,
+});
+
+describe("deriveIncidentSignals", () => {
+  test("emits one error signal per open critical incident, keyed by system", () => {
+    const result = deriveIncidentSignals({
+      incidentsBySystem: {
+        "sys-1": [baseIncident({ id: "inc-1", severity: "critical" })],
+      },
+      systemIds: ["sys-1"],
+    });
+
+    expect(result["sys-1"]).toHaveLength(1);
+    expect(result["sys-1"][0]).toEqual({
+      source: INCIDENT_SIGNAL_SOURCE_ID,
+      tone: "error",
+      label: "Critical incident",
+      detail: "Database down",
+      href: "/incident/inc-1",
+      accessRule: incidentAccess.incident.read,
+      since: "2026-06-01T10:00:00.000Z",
+      iconName: "TriangleAlert",
+    });
+  });
+
+  test("maps severity to tone/label (major->warn, minor->info)", () => {
+    const result = deriveIncidentSignals({
+      incidentsBySystem: {
+        "sys-1": [
+          baseIncident({ id: "inc-major", severity: "major", title: "Slow" }),
+        ],
+        "sys-2": [
+          baseIncident({
+            id: "inc-minor",
+            severity: "minor",
+            title: "Cosmetic",
+            systemIds: ["sys-2"],
+          }),
+        ],
+      },
+      systemIds: ["sys-1", "sys-2"],
+    });
+
+    expect(result["sys-1"][0].tone).toBe("warn");
+    expect(result["sys-1"][0].label).toBe("Major incident");
+    expect(result["sys-2"][0].tone).toBe("info");
+    expect(result["sys-2"][0].label).toBe("Incident");
+  });
+
+  test("skips resolved incidents and systems with no open problem", () => {
+    const result = deriveIncidentSignals({
+      incidentsBySystem: {
+        "sys-1": [baseIncident({ id: "inc-1", status: "resolved" })],
+        "sys-2": [],
+      },
+      systemIds: ["sys-1", "sys-2", "sys-3"],
+    });
+
+    expect(result).toEqual({});
+  });
+
+  test("emits multiple signals for a system with multiple open incidents", () => {
+    const result = deriveIncidentSignals({
+      incidentsBySystem: {
+        "sys-1": [
+          baseIncident({ id: "inc-1", severity: "critical" }),
+          baseIncident({ id: "inc-2", severity: "minor", title: "Other" }),
+        ],
+      },
+      systemIds: ["sys-1"],
+    });
+
+    expect(result["sys-1"]).toHaveLength(2);
+    expect(result["sys-1"][0].tone).toBe("error");
+    expect(result["sys-1"][1].tone).toBe("info");
+  });
+});

package/src/signals.ts

@@ -0,0 +1,86 @@
+import { resolveRoute } from "@checkstack/common";
+import type {
+  SystemSignal,
+  SystemSignalsMap,
+} from "@checkstack/catalog-common";
+import { incidentAccess } from "./access";
+import { incidentRoutes } from "./routes";
+import type { IncidentWithSystems } from "./schemas";
+
+/**
+ * Stable source id for incident-originated dashboard/system signals. Surfaced as
+ * `source` on every emitted {@link SystemSignal} and used as the contributor's
+ * `sourceId` in the backend `system.issues` aggregator. MUST stay in sync with
+ * both the frontend `SystemSignalsSlot` filler and the backend contributor.
+ */
+export const INCIDENT_SIGNAL_SOURCE_ID = "incident";
+
+/**
+ * Incident severity -> signal tone. "critical" is an active breach (`error`),
+ * "major" is at-risk/degraded (`warn`), "minor" is informational (`info`).
+ */
+const severityToTone = {
+  critical: "error",
+  major: "warn",
+  minor: "info",
+} as const;
+
+/**
+ * Incident severity -> signal label shown in the dashboard row.
+ */
+const severityToLabel = {
+  critical: "Critical incident",
+  major: "Major incident",
+  minor: "Incident",
+} as const;
+
+/**
+ * Pure, dependency-free deriver shared by the frontend `SystemSignalsSlot`
+ * filler and the backend `system.issues` contributor. Given the active
+ * incidents grouped by systemId, emit one {@link SystemSignal} per unresolved
+ * incident, keyed by systemId. Systems with no unresolved incident are omitted
+ * from the returned map (healthy as far as this source is concerned).
+ *
+ * Both callers run this SAME function so frontend and backend always produce
+ * identical signals (source/tone/label/detail/href/accessRule/since/iconName).
+ * The backend aggregator passes signals through and drops the frontend-only
+ * fields (href/accessRule/iconName); keeping them here lets the frontend render
+ * the deep-linking, permission-gated row unchanged.
+ */
+export function deriveIncidentSignals({
+  incidentsBySystem,
+  systemIds,
+}: {
+  /** Active incidents grouped by systemId (the bulk RPC / global query shape). */
+  incidentsBySystem: Record<string, IncidentWithSystems[]>;
+  /** Systems to consider, in iteration order. */
+  systemIds: readonly string[];
+}): SystemSignalsMap {
+  const result: SystemSignalsMap = {};
+
+  for (const systemId of systemIds) {
+    const incidents = (incidentsBySystem[systemId] ?? []).filter(
+      (incident) => incident.status !== "resolved",
+    );
+    if (incidents.length === 0) continue;
+
+    result[systemId] = incidents.map((incident) => {
+      const signal: SystemSignal = {
+        source: INCIDENT_SIGNAL_SOURCE_ID,
+        tone: severityToTone[incident.severity],
+        label: severityToLabel[incident.severity],
+        detail: incident.title,
+        href: resolveRoute(incidentRoutes.routes.detail, {
+          incidentId: incident.id,
+        }),
+        // Detail page is read-gated; render as text for users without it.
+        accessRule: incidentAccess.incident.read,
+        since: new Date(incident.createdAt).toISOString(),
+        iconName: "TriangleAlert",
+      };
+      return signal;
+    });
+  }
+
+  return result;
+}