@checkstack/maintenance-frontend 0.8.4 → 0.8.5

package/CHANGELOG.md

@@ -1,5 +1,67 @@
 # @checkstack/maintenance-frontend
 
+## 0.8.5
+
+### Patch Changes
+
+- 56e7c75: Fix frontend access checks to use FULLY-QUALIFIED access-rule ids, and resolve
+  the anonymous role on the frontend.
+
+  Granted access-rule ids are stored fully-qualified as `{pluginId}.{ruleId}` (e.g.
+  `incident.incident.read`) so two plugins defining the same short rule id never
+  collide. The frontend, however, was checking the UNqualified id (`incident.read`)
+  via `isAccessRuleSatisfied`, so every check failed for any user without the `*`
+  (admin) grant - masked in development because dev-auth grants `*`. This silently
+  broke ALL non-admin frontend gating (route guards, sidebar entries, and
+  `useAccess`-based button/link gating).
+
+  - **`@checkstack/common`**: `AccessRule` now carries a REQUIRED owning `pluginId`;
+    `access()` / `accessPair()` require and stamp it; `isAccessRuleSatisfied`
+    qualifies the rule (`{pluginId}.{id}`, plus the manage->read escalation) and
+    matches ONLY the qualified form. There is intentionally NO unqualified fallback
+    - matching a bare id would let one plugin's grant satisfy another plugin's
+      identically-named rule (a cross-plugin privilege-escalation flaw). Every plugin
+      that defines access rules now passes its own `pluginId`.
+  - **`@checkstack/backend`**: `pluginManager.getAllAccessRules()` no longer strips
+    the `pluginId` field (the rule `id` is already fully-qualified for the DB sync).
+  - **Route guard** (`@checkstack/frontend` / `@checkstack/frontend-api`) now
+    checks the FULL rule object (so it qualifies and escalates), not a bare id.
+  - **Anonymous role on the frontend**: the `accessRules` procedure is now
+    `public`, returning the configurable anonymous role's grants to unauthenticated
+    callers; `useAccessRules` fetches them for guests instead of returning an empty
+    set. So anonymous UI now reflects exactly what the anonymous role is allowed -
+    which an admin can change (`isPublic` is only the seeded default).
+  - Incident / maintenance / SLO detail routes are now read-gated (their read rule
+    is an `isPublic` default, so the anonymous role holds it unless an admin
+    revokes it); their dashboard status signals carry that rule and render as a
+    link only when the viewer may open it.
+
+  **BREAKING (`@checkstack/common`):** `AccessRule.pluginId` is now REQUIRED, and
+  `access()` / `accessPair()` require a `pluginId` option. `isAccessRuleSatisfied`
+  matches ONLY the fully-qualified `{pluginId}.{ruleId}` form - the previous
+  unqualified fallback is removed, because it was a cross-plugin
+  privilege-escalation flaw. Any code constructing an `AccessRule` or calling
+  `access()`/`accessPair()` must supply the owning `pluginId`.
+
+  Verified live against an anonymous caller: read pages resolve (qualified match),
+  manage actions are denied, manage->read escalation and `*` still work.
+
+- Updated dependencies [0626782]
+- Updated dependencies [460ffd6]
+- Updated dependencies [56e7c75]
+- Updated dependencies [56e7c75]
+  - @checkstack/auth-frontend@0.7.5
+  - @checkstack/dashboard-frontend@0.8.5
+  - @checkstack/frontend-api@0.9.0
+  - @checkstack/notification-frontend@0.5.5
+  - @checkstack/catalog-common@2.3.4
+  - @checkstack/ui@1.15.1
+  - @checkstack/common@0.15.0
+  - @checkstack/maintenance-common@1.4.4
+  - @checkstack/notification-common@1.3.3
+  - @checkstack/tips-frontend@0.3.5
+  - @checkstack/signal-frontend@0.2.4
+
 ## 0.8.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/maintenance-frontend",
-  "version": "0.8.4",
+  "version": "0.8.5",
   "license": "Elastic-2.0",
   "type": "module",
   "main": "src/index.tsx",
@@ -13,17 +13,17 @@
     "lint:code": "eslint . --max-warnings 0"
   },
   "dependencies": {
-    "@checkstack/auth-frontend": "0.7.4",
-    "@checkstack/catalog-common": "2.3.3",
-    "@checkstack/common": "0.14.1",
-    "@checkstack/dashboard-frontend": "0.8.4",
-    "@checkstack/frontend-api": "0.8.0",
-    "@checkstack/maintenance-common": "1.4.3",
-    "@checkstack/notification-common": "1.3.2",
-    "@checkstack/notification-frontend": "0.5.4",
-    "@checkstack/signal-frontend": "0.2.3",
-    "@checkstack/tips-frontend": "0.3.4",
-    "@checkstack/ui": "1.15.0",
+    "@checkstack/auth-frontend": "0.7.5",
+    "@checkstack/catalog-common": "2.3.4",
+    "@checkstack/common": "0.15.0",
+    "@checkstack/dashboard-frontend": "0.8.5",
+    "@checkstack/frontend-api": "0.9.0",
+    "@checkstack/maintenance-common": "1.4.4",
+    "@checkstack/notification-common": "1.3.3",
+    "@checkstack/notification-frontend": "0.5.5",
+    "@checkstack/signal-frontend": "0.2.4",
+    "@checkstack/tips-frontend": "0.3.5",
+    "@checkstack/ui": "1.15.1",
     "date-fns": "^4.4.0",
     "lucide-react": "^1.17.0",
     "react": "19.2.7",
@@ -33,6 +33,6 @@
     "typescript": "^5.0.0",
     "@types/react": "^19.0.0",
     "@checkstack/tsconfig": "0.0.7",
-    "@checkstack/scripts": "0.6.0"
+    "@checkstack/scripts": "0.6.1"
   }
 }

package/src/components/MaintenanceSignalsFiller.tsx

@@ -9,6 +9,7 @@ import {
 import {
   MaintenanceApi,
   maintenanceRoutes,
+  maintenanceAccess,
 } from "@checkstack/maintenance-common";
 
 type Props = SlotContext<typeof SystemSignalsSlot>;
@@ -51,6 +52,8 @@ export const MaintenanceSignalsFiller: React.FC<Props> = ({
         href: resolveRoute(maintenanceRoutes.routes.detail, {
           maintenanceId: maintenance.id,
         }),
+        // Detail page is read-gated; render as text for users without it.
+        accessRule: maintenanceAccess.maintenance.read,
         since: new Date(maintenance.startAt).toISOString(),
         iconName: "Wrench",
       }));

package/src/index.tsx

@@ -44,6 +44,8 @@ export default createFrontendPlugin({
           default: m.MaintenanceDetailPage,
         })),
       title: "Maintenance Details",
+      // Read-gated; anonymous holds this by default (isPublic), admin-revocable.
+      accessRule: maintenanceAccess.maintenance.read,
     },
   ],
   // No APIs needed - components use usePluginClient() directly