Let the instance service account list a team's deadman switches

GET /api/teams/{id}/deadman/switches used requireTeamMember, which 404s
for the instance-scoped service account because it belongs to no team.
terdut-operator lists switches by name on every reconcile, so TerdutTeams
never became ready. Instance service accounts now pass, as they already do
for the write endpoints.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

charts/terdut-server/Chart.yaml

@@ -15,5 +15,5 @@ type: application
 # appVersion and image.tag in values.yaml no longer agree, and that is not an oversight:
 # image.tag stays "latest", which is what a local install actually pulls. appVersion is
 # metadata and drives nothing.
-version: 0.47.0
-appVersion: "v0.47.0"
+version: 0.47.2
+appVersion: "v0.47.2"

internal/api/service_accounts_test.go

@@ -490,3 +490,31 @@ func TestDeadman_UpdateInPlacePreservesID(t *testing.T) {
 		t.Errorf("expected the update to replace in place, not add a row, got %d switches", len(list))
 	}
 }
+
+// The operator reconciles a team's dead man's switches by listing them, and its
+// instance-scoped account is not a member of any team it manages.
+func TestServiceAccount_InstanceScopeListsATeamsDeadmanSwitches(t *testing.T) {
+	s := newTS(t)
+	instanceKey := createServiceAccount(t, s, s.key, "terdut-operator", models.ServiceAccountScopeInstance, 0)
+	team := createTeamAs(t, s, instanceKey, "team-a")
+	path := "/api/teams/" + id64(team) + "/deadman/switches"
+
+	resp := s.reqAs(t, instanceKey, http.MethodPost, path,
+		map[string]any{"name": "watchdog", "matcher": "alertname=Watchdog", "timeout_seconds": 900, "severity": "critical"})
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create switch: %d", resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	resp = s.reqAs(t, instanceKey, http.MethodGet, path, nil)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("list switches as the instance account: %d", resp.StatusCode)
+	}
+	var list []struct {
+		Name string `json:"name"`
+	}
+	decode(t, resp, &list)
+	if len(list) != 1 || list[0].Name != "watchdog" {
+		t.Errorf("expected the one switch just created, got %+v", list)
+	}
+}

internal/api/teams.go

@@ -826,7 +826,10 @@ func handleListTeamDeadman(db *sql.DB) http.HandlerFunc {
 		if !ok {
 			return
 		}
-		if !requireTeamMember(w, r, teamID) {
+		// The operator's instance-scoped account reconciles the switches by name,
+		// so it has to read them without being a member: that is owner reach,
+		// the same as the writes below, and still reads no incidents.
+		if !isInstanceServiceAccount(r.Context()) && !requireTeamMember(w, r, teamID) {
 			return
 		}
 

internal/web/static/app.css

@@ -1386,6 +1386,46 @@ a.top-row:hover { background: var(--surface-2); }
   .stats-split { grid-template-columns: 3fr 1fr; align-items: stretch; }
 }
 
+/* Phones: nothing on the stats pages may be wider than the screen, so the
+   wide rows fold into two or three lines instead of scrolling sideways. */
+.stats > *, .stats-split > * { min-width: 0; }
+@media (max-width: 599px) {
+  .top-head { display: none; }
+  .toplist { overflow-x: visible; }
+  .top-row {
+    min-width: 0; grid-template-columns: minmax(0, 1fr) auto; row-gap: 4px; padding: 10px 4px;
+  }
+  .top-row > :nth-child(1) { grid-column: 1; grid-row: 1; font-weight: 600; }
+  .top-row > :nth-child(6) { grid-column: 2; grid-row: 1; }
+  .top-row > :nth-child(2) { grid-column: 1; grid-row: 2; }
+  .top-row > :nth-child(3) { grid-column: 2; grid-row: 2; }
+  .top-row > :nth-child(4) { grid-column: 1; grid-row: 3; font-size: 12px; }
+  .top-row > :nth-child(5) { grid-column: 2; grid-row: 3; font-size: 12px; text-align: right; }
+  .top-row > :nth-child(4)::before { content: "Last seen "; }
+  .top-row > :nth-child(5)::before { content: "Fix "; }
+
+  .heatmap > * { min-width: 0; }
+  .heat-row, .heat-cells { gap: 2px; }
+  .heat-day { width: 26px; }
+  .heat-cell { height: 18px; border-radius: 3px; }
+  .heat-hour { font-size: 9px; overflow: visible; white-space: nowrap; }
+  .heat-hour:not(:nth-child(6n+1)) { visibility: hidden; }
+
+  .fix-row { flex-wrap: wrap; row-gap: 2px; }
+  .fix-label { width: auto; flex: 1; }
+  .fix-total { width: auto; }
+  .fix-track { flex: 1 1 100%; order: 3; }
+
+  .occ-wrap { overflow-x: visible; }
+  .occ { min-width: 0; }
+  .occ thead { display: none; }
+  .occ, .occ tbody { display: block; }
+  .occ tr { display: grid; grid-template-columns: 1fr 1fr; gap: 2px 12px; padding: 10px 0; border-top: 1px solid var(--border); }
+  .occ td { border-top: 0; padding: 0; overflow-wrap: anywhere; }
+  .occ td:first-child { grid-column: 1 / -1; font-weight: 600; }
+  .occ td[data-label]::before { content: attr(data-label) ": "; color: var(--muted); font-size: 12px; }
+}
+
 /* On-call, wide: the hero and the week on the left, your shifts on the right.
    .view-page > * caps its children at 760px, so the grid lifts that. */
 @media (min-width: 900px) {

internal/web/static/js/statsalert.js

@@ -103,17 +103,20 @@ function fixBars(d) {
   }));
 }
 
+// On a phone each row folds into a card; the labels come from data-label.
+const OCC_COLS = ['Fired (UTC)', 'Time to ack', 'Duration', 'Acknowledged by', 'Status'];
+
 function table(d) {
   return h('div', { class: 'occ-wrap' },
     h('table', { class: 'occ' },
-      h('thead', {}, h('tr', {}, ['Fired (UTC)', 'Time to ack', 'Duration', 'Acknowledged by', 'Status'].map((t) => h('th', { text: t })))),
+      h('thead', {}, h('tr', {}, OCC_COLS.map((t) => h('th', { text: t })))),
       h('tbody', {}, d.occurrences.map((o) => h('tr', {},
         h('td', {}, h('a', { href: `/incidents/${o.incident_id}`, text: fmtTime(o.triggered_at) }),
           ` ${WEEKDAYS[new Date(o.triggered_at * 1000).getUTCDay()]}`),
-        h('td', { text: sec(o.ack_seconds) }),
-        h('td', { text: sec(o.resolve_seconds) }),
-        h('td', { text: o.acknowledged_by || '—' }),
-        h('td', { text: o.status }))))));
+        h('td', { 'data-label': OCC_COLS[1], text: sec(o.ack_seconds) }),
+        h('td', { 'data-label': OCC_COLS[2], text: sec(o.resolve_seconds) }),
+        h('td', { 'data-label': OCC_COLS[3], text: o.acknowledged_by || '—' }),
+        h('td', { 'data-label': OCC_COLS[4], text: o.status }))))));
 }
 
 export function body(name, d, error, onRange) {