@checkstack/incident-common 1.6.4 → 1.7.0

package/CHANGELOG.md

@@ -1,5 +1,142 @@
 # @checkstack/incident-common
 
+## 1.7.0
+
+### Minor Changes
+
+- e430fbe: Add "Mass delete" and "Mass resolve" to the Incidents and Maintenances lists,
+  authorized per item (RLAC).
+
+  The incidents and maintenances list pages now support multi-select with a bulk
+  action bar. A user may only select and act on entries they are allowed to
+  MANAGE: a row's checkbox appears only when the caller can manage it (the same
+  `canAccess(id)` gate as the per-row actions), so a team-scoped member sees
+  checkboxes only for their team's entries. Mass delete confirms before running;
+  mass resolve (incidents) and mass complete (maintenances, the "resolve"
+  equivalent = close, status -> completed) skip entries that are already
+  resolved/completed. Each action reports a per-id partial-success summary
+  (e.g. "3 deleted, 1 skipped").
+
+  New backend procedures: `incident.bulkDeleteIncidents`,
+  `incident.bulkResolveIncidents`, `maintenance.bulkDeleteMaintenances`, and
+  `maintenance.bulkCloseMaintenances`. Each authorizes EACH id against the
+  caller's manage grant and never fails open: unauthorized ids are filtered out
+  before the handler runs and returned as `forbidden`; missing ids as `notFound`;
+  a per-id failure is isolated as `error` without aborting the batch. Per-id cache
+  invalidation, realtime signals, and subscriber notifications run for every
+  success so dashboards and status pages stay consistent.
+
+  Platform: a new `instanceAccess` mode `bulkManage: { idsParam }` is the
+  enforcement point for bulk writes. Before the handler runs, `autoAuthMiddleware`
+  partitions the input id array into the caller's manageable subset and the denied
+  remainder and exposes both on `context.bulkAccess` (fail-closed on an S2S
+  error). The boot-time contract validator (`validateContractInstanceAccess`)
+  accepts `bulkManage` as one of the mutually-exclusive scoping modes, marks its
+  type team-scopable, and cross-checks `idsParam` against the input schema.
+
+  State and scale: authorization is derived per request from the shared team-grant
+  store via the existing auth S2S path (no process-local state); the read returns
+  the same answer on every pod. No database migration.
+
+- 0d912a3: Make the frontend fully RLAC-aware so team-scoped users see and can use exactly
+  what the backend already authorises - no more, no less. Previously every nav
+  entry, route, management page, create button, per-row action, and resource
+  picker gated purely on a user's GLOBAL access rule, so a user whose team manages
+  a system saw none of the surfaces the backend would happily let them use, and
+  (where a page did render) could select systems they don't manage and only fail
+  after submit.
+
+  Platform primitives (on `AccessApi`, from `@checkstack/frontend-api`, implemented
+  in `@checkstack/auth-frontend`). Each ORs the global RBAC rule with team-derived
+  (ReBAC) grants, so a global-rule holder always sees everything:
+
+  - `useCanCreate({ accessRule, objectType, parentType? })` - may the user create
+    this type (global rule, a team `creator` grant, or managing a parent resource).
+  - `useCanAccessType({ accessRule, objectType, parentType? })` - may the user
+    reach a management SURFACE for this type at all (create capability OR managing
+    any existing object of the type / its parent). Powers route guards, sidebar
+    entries, and a management page's top-level `allowed`.
+  - `useResourceAccess({ accessRule, objectType, resourceIds })` - a `canAccess(id)`
+    predicate for per-row controls and for filtering resource pickers.
+
+  Backed by three authenticated `auth` RPC procedures - `canCreate`,
+  `myManageableTypes`, and `listMyAccessibleResources` - the frontend-facing
+  mirrors of the existing S2S authorization endpoints, resolved against the
+  caller's own team grants.
+
+  Route/nav gating is now capability-aware: a route may declare
+  `manageCapability: { objectType, parentType? }`; the route guard and sidebar then
+  show/allow it for team-scoped users via `myManageableTypes`. Applied to the
+  catalog, incident, maintenance, SLO, healthcheck, automation, and status-page
+  management routes. The route guard resolves this through a single
+  `useRouteAccess` hook with a constant hook count, since the guard is reconciled
+  in place as the URL changes (a conditional hook there would trip the rules of
+  hooks).
+
+  Resource types are now typed, plugin-qualified constants. A new
+  `resourceType(pluginMetadata, localType)` factory in `@checkstack/common` mints a
+  nominal `ResourceType`, and each `*-common` package exports its constants (e.g.
+  `catalogResourceTypes.system`, `incidentResourceTypes.incident`). The capability
+  APIs accept `ResourceType`, so a mistyped `"catalog.system"` string now fails
+  typecheck instead of silently breaking a gate.
+
+  Resource pickers now offer only what the backend will accept:
+
+  - Incident and maintenance "Affected Systems" pickers show only systems the user
+    manages (or all with the global rule), matching the backend's requirement of
+    MANAGE on every referenced system.
+  - SLO creation is now system-scoped end to end: `createObjective` gains a
+    `catalog.system` parent gate (managing the target system authorises creating an
+    SLO for it, like incident/maintenance), and the SLO editor's system picker is
+    filtered to manageable systems.
+  - Catalog group and environment membership (add-to-group / add-to-environment,
+    per-row and bulk) is gated on managing the system being (re)assigned.
+  - The health-check assignment surface (Assignment IDE + the system-detail
+    "Health Checks" action) requires MANAGE on the target system.
+
+  Catalog membership chips only render a removable "x" for systems the user
+  manages (removing a group/environment membership requires managing the system),
+  and the Dependency Map only lets a user originate an edge from a system they
+  manage (the source is access-checked; the target is not).
+
+  Owning-team correctness: a parent-gated creator (team member, no global rule)
+  who left the owning team unset previously created an object with no team grant -
+  which they then could not edit. The `authorizeCreate` parent-gate path now
+  resolves an owning team instead of silently orphaning the object (auto-assigns
+  when the caller belongs to exactly one team, requires an explicit choice when
+  several), and the `TeamOwnershipPicker` marks the field required and
+  auto-selects the sole eligible team.
+
+  Dependency writes are fixed to authorize on the SOURCE system. `createDependency`
+  / `updateDependency` / `deleteDependency` previously used `instanceAccess:
+{ idParam: "systemId" }`, which made the middleware look for a `dependency` grant
+  keyed by the system id - a grant that never exists - so every team-scoped source
+  manager was denied ("Access denied to resource dependency:<systemId>"). They now
+  `parentScope` on `catalog.system` manage, so managing the source system
+  authorises editing its dependencies (the target is not access-checked), matching
+  health-check assignment.
+
+  The backend authorization changes are limited to: the new read-only capability
+  procedures (`canCreate` / `myManageableTypes` / `listMyAccessibleResources`), the
+  SLO create parent gate, the `authorizeCreate` owning-team resolution, and the
+  dependency source-scope fix. Everything else only aligns the UI with
+  authorization the backend already enforced.
+
+### Patch Changes
+
+- Updated dependencies [d1b71b6]
+- Updated dependencies [d9f4654]
+- Updated dependencies [e430fbe]
+- Updated dependencies [eab80e3]
+- Updated dependencies [259b93c]
+- Updated dependencies [53666a7]
+- Updated dependencies [0d912a3]
+  - @checkstack/notification-common@1.5.0
+  - @checkstack/frontend-api@0.13.0
+  - @checkstack/common@0.19.0
+  - @checkstack/catalog-common@2.6.0
+  - @checkstack/signal-common@0.2.14
+
 ## 1.6.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/incident-common",
-  "version": "1.6.4",
+  "version": "1.7.0",
   "license": "Elastic-2.0",
   "type": "module",
   "sideEffects": [
@@ -12,18 +12,18 @@
     }
   },
   "dependencies": {
-    "@checkstack/common": "0.18.0",
-    "@checkstack/catalog-common": "2.5.0",
-    "@checkstack/frontend-api": "0.12.1",
-    "@checkstack/notification-common": "1.4.2",
-    "@checkstack/signal-common": "0.2.13",
+    "@checkstack/common": "0.19.0",
+    "@checkstack/catalog-common": "2.6.0",
+    "@checkstack/frontend-api": "0.13.0",
+    "@checkstack/notification-common": "1.5.0",
+    "@checkstack/signal-common": "0.2.14",
     "@orpc/contract": "^1.14.4",
     "zod": "^4.2.1"
   },
   "devDependencies": {
     "typescript": "^5.7.2",
     "@checkstack/tsconfig": "0.0.7",
-    "@checkstack/scripts": "0.6.5"
+    "@checkstack/scripts": "0.7.0"
   },
   "scripts": {
     "typecheck": "tsgo -b",

package/src/access.ts

@@ -1,6 +1,15 @@
-import { accessPair } from "@checkstack/common";
+import { accessPair, resourceType } from "@checkstack/common";
 import { pluginMetadata } from "./plugin-metadata";
 
+/**
+ * Plugin-qualified resource type ids for the incident plugin's resources.
+ * Reference these (never a raw `"incident.incident"` string) at capability call
+ * sites so a typo fails typecheck.
+ */
+export const incidentResourceTypes = {
+  incident: resourceType(pluginMetadata, "incident"),
+};
+
 /**
  * Access rules for the Incident plugin.
  */

package/src/index.ts

@@ -1,4 +1,8 @@
-export { incidentAccess, incidentAccessRules } from "./access";
+export {
+  incidentAccess,
+  incidentAccessRules,
+  incidentResourceTypes,
+} from "./access";
 export {
   incidentContract,
   IncidentApi,
@@ -16,6 +20,10 @@ export {
   CreateIncidentInputSchema,
   UpdateIncidentInputSchema,
   AddIncidentUpdateInputSchema,
+  BulkIncidentActionStatusEnum,
+  BulkIncidentActionResultSchema,
+  BulkIncidentIdsInputSchema,
+  BulkResolveIncidentsInputSchema,
   type IncidentStatus,
   type IncidentSeverity,
   type Incident,
@@ -27,6 +35,10 @@ export {
   type CreateIncidentInput,
   type UpdateIncidentInput,
   type AddIncidentUpdateInput,
+  type BulkIncidentActionStatus,
+  type BulkIncidentActionResult,
+  type BulkIncidentIdsInput,
+  type BulkResolveIncidentsInput,
 } from "./schemas";
 export { IncidentDetailsSlot, IncidentStatusSlot } from "./slots";
 export {

package/src/rpc-contract.test.ts

@@ -39,6 +39,7 @@ interface InstanceAccess {
   recordKey?: string;
   create?: InstanceAccessCreate;
   parentScope?: InstanceAccessParentScope;
+  bulkManage?: { idsParam?: string };
 }
 
 function instanceAccessFor(
@@ -146,3 +147,40 @@ describe("incident contract createIncident carries create-mode team ownership",
     expect(access?.create).toBeUndefined();
   });
 });
+
+describe("incident contract bulk actions gate per-id via bulkManage", () => {
+  // Both bulk mutations authorize EACH id against the caller's manage grant
+  // through the platform `bulkManage` instance-access mode, keyed on the `ids`
+  // input array (RLAC: never fail open on a bulk WRITE).
+  const bulkProcs: Array<keyof typeof incidentContract> = [
+    "bulkDeleteIncidents",
+    "bulkResolveIncidents",
+  ];
+
+  for (const proc of bulkProcs) {
+    test(`${proc} declares instanceAccess.bulkManage.idsParam = "ids"`, () => {
+      const access = instanceAccessFor(proc);
+      expect(access).toBeDefined();
+      expect(access?.bulkManage?.idsParam).toBe("ids");
+      // Exactly one mode: no object/list/record/create scoping alongside it.
+      expect(access?.idParam).toBeUndefined();
+      expect(access?.listKey).toBeUndefined();
+      expect(access?.recordKey).toBeUndefined();
+      expect(access?.create).toBeUndefined();
+      expect(access?.global).toBeUndefined();
+    });
+
+    test(`${proc} is gated on the incident.manage access rule`, () => {
+      const procDef = incidentContract[proc] as unknown as Record<
+        string,
+        unknown
+      >;
+      const orpc = procDef["~orpc"] as {
+        meta?: { access?: Array<{ id: string; resource: string; level: string }> };
+      };
+      const rule = orpc.meta?.access?.[0];
+      expect(rule?.resource).toBe("incident");
+      expect(rule?.level).toBe("manage");
+    });
+  }
+});

package/src/rpc-contract.ts

@@ -12,6 +12,9 @@ import {
   UpdateIncidentInputSchema,
   AddIncidentUpdateInputSchema,
   IncidentStatusEnum,
+  BulkIncidentActionResultSchema,
+  BulkIncidentIdsInputSchema,
+  BulkResolveIncidentsInputSchema,
 } from "./schemas";
 
 export const incidentContract = {
@@ -193,6 +196,41 @@ export const incidentContract = {
     .input(z.object({ id: z.string() }))
     .output(z.object({ success: z.boolean() })),
 
+  /**
+   * Mass-delete incidents, authorizing EACH id against the caller's manage
+   * grant. The `bulkManage` instance-access mode pre-partitions `input.ids`
+   * into the caller's manageable subset (global rule OR per-incident team
+   * grant) and the denied remainder BEFORE the handler runs, so an
+   * unauthorized id is never deleted. Returns a per-id result so the frontend
+   * can report partial success; a denied id is reported as `forbidden`, never a
+   * hard failure of the whole batch.
+   */
+  bulkDeleteIncidents: proc({
+    operationType: "mutation",
+    userType: "authenticated",
+    access: [incidentAccess.incident.manage],
+    instanceAccess: { bulkManage: { idsParam: "ids" } },
+  })
+    .route({ method: "POST" })
+    .input(BulkIncidentIdsInputSchema)
+    .output(z.object({ results: z.array(BulkIncidentActionResultSchema) })),
+
+  /**
+   * Mass-resolve incidents (mirrors the single-item `resolveIncident`: status →
+   * resolved). Authorizes EACH id against the caller's manage grant via the
+   * `bulkManage` mode; only authorized ids are resolved and a per-id result is
+   * returned. Already-resolved or missing ids are reported, never fatal.
+   */
+  bulkResolveIncidents: proc({
+    operationType: "mutation",
+    userType: "authenticated",
+    access: [incidentAccess.incident.manage],
+    instanceAccess: { bulkManage: { idsParam: "ids" } },
+  })
+    .route({ method: "POST" })
+    .input(BulkResolveIncidentsInputSchema)
+    .output(z.object({ results: z.array(BulkIncidentActionResultSchema) })),
+
   /**
    * Check if a system has an active incident with notification suppression enabled.
    * Used by the health check system to suppress notifications during acknowledged incidents.

package/src/schemas.ts

@@ -126,3 +126,46 @@ export const AddIncidentUpdateInputSchema = z.object({
 export type AddIncidentUpdateInput = z.infer<
   typeof AddIncidentUpdateInputSchema
 >;
+
+/**
+ * Per-id outcome of a bulk incident action (mass delete / mass resolve).
+ *
+ * - `deleted` / `resolved`: the action succeeded for this incident.
+ * - `notFound`: no incident with this id exists (or it vanished mid-batch).
+ * - `forbidden`: the caller cannot MANAGE this incident (filtered out by the
+ *   `bulkManage` instance-access mode before the handler ran).
+ * - `error`: the per-id operation threw; the batch continued past it.
+ */
+export const BulkIncidentActionStatusEnum = z.enum([
+  "deleted",
+  "resolved",
+  "notFound",
+  "forbidden",
+  "error",
+]);
+export type BulkIncidentActionStatus = z.infer<
+  typeof BulkIncidentActionStatusEnum
+>;
+
+export const BulkIncidentActionResultSchema = z.object({
+  id: z.string(),
+  status: BulkIncidentActionStatusEnum,
+});
+export type BulkIncidentActionResult = z.infer<
+  typeof BulkIncidentActionResultSchema
+>;
+
+/** Input for a bulk incident action: a non-empty set of incident ids. */
+export const BulkIncidentIdsInputSchema = z.object({
+  ids: z.array(z.string()).min(1, "At least one incident is required"),
+});
+export type BulkIncidentIdsInput = z.infer<typeof BulkIncidentIdsInputSchema>;
+
+/** Input for bulk resolve: incident ids plus an optional shared message. */
+export const BulkResolveIncidentsInputSchema = z.object({
+  ids: z.array(z.string()).min(1, "At least one incident is required"),
+  message: z.string().optional(),
+});
+export type BulkResolveIncidentsInput = z.infer<
+  typeof BulkResolveIncidentsInputSchema
+>;