Niklas Ye
a4fbd60441
The core of #4, and what #1 is for: terdut stops being one shared space. A team owns its incidents, alerts, schedule and integrations; a user sees exactly the teams they are in. Everything that existed moves into one Default team and every existing user becomes an owner of it, so the upgrade is a no-op for the people using it. Ingestion is the load-bearing half. An alert arrives on a team's integration key, and the key is both the credential and the routing: it says that the sender may post, and which team the alerts belong to. That also closes the unauthenticated webhook -- the old path stays for one release, deprecated and routed to the oldest team, so an upgrade does not stop delivering while somebody edits the Alertmanager config. Scoping is enforced in as few places as possible, because the failure mode is silent. serveAs loads the caller's memberships once; list queries carry `team_id = ANY(...)`; and every incident route goes through incidentIDParam, which now parses the id AND checks the team in the same call, so a new handler cannot remember the first half and forget the second. Anything in another team is 404, never 403: whether an incident exists is that team's business. Two bugs this found, both of which would have been silent: * upsertAlerts decided "is this a new occurrence" by looking up the fingerprint alone. Across teams that made team B's first alert look like a re-send of team A's, so it opened no incident at all. The lookups are keyed on (team_id, fingerprint) now, as the index is. * Every uniqueness rule was written for one tenant. Two teams watching two clusters legitimately see the same fingerprint, the same groupKey, and want somebody on call on the same day; all three constraints move to include team_id. Roles inside a team are separate from the system administrator flag: an owner configures the team, a member works its incidents, and an admin is NOT implicitly in every team -- administration is about accounts, not about reading other people's incidents. An admin can still repair a team whose owner has left, which is why requireTeamOwner lets them through. A shift can only be given to somebody in the team. Paging a person who cannot open the incident is worse than paging nobody. The UI is updated only as far as keeping it working: it loads the viewer's teams with the session and uses the first one, since nobody has a second yet. "On call now" shows every team the viewer is in, named only when there is more than one, so the common case reads exactly as before. The team switcher, badges and per-team settings pages are the next step. Breaking for API clients: the schedule endpoints moved under the team, and /api/schedule/current returns an array rather than an object or a 404. terdut-tui will need a version for that. Per-team dead-man configuration is deliberately not here. A heartbeat's incident already opens in the team whose key received it, which is the part that matters for isolation; moving the matchers out of env into per-team rows is a change to how deadman.go is configured rather than to who sees what. Claude-Session: https://claude.ai/code/session_01RHPj4ggeFdEjKKfm4SHbD7
61 lines
2.9 KiB
Go
61 lines
2.9 KiB
Go
package models
|
|
|
|
import "time"
|
|
|
|
// Alert is the machine-owned signal record: what Alertmanager told us, and
|
|
// nothing else. It has two states, firing and resolved, and no human ever writes
|
|
// to it — acknowledgement, assignment, notes and closure all live on the
|
|
// Incident an alert belongs to.
|
|
type Alert struct {
|
|
ID int64 `json:"id"`
|
|
|
|
// TeamID is the team whose integration received this alert, and TeamName
|
|
// rides along so a combined list can label a row without a second request.
|
|
TeamID int64 `json:"team_id"`
|
|
TeamName string `json:"team_name,omitempty"`
|
|
|
|
Fingerprint string `json:"fingerprint"`
|
|
Name string `json:"name"`
|
|
Status string `json:"status"` // "firing" or "resolved"
|
|
Labels map[string]string `json:"labels"`
|
|
Annotations map[string]string `json:"annotations"`
|
|
StartsAt time.Time `json:"starts_at"`
|
|
EndsAt *time.Time `json:"ends_at,omitempty"`
|
|
GeneratorURL string `json:"generator_url"`
|
|
|
|
// ReceivedAt is when the server last accepted a webhook for this
|
|
// fingerprint, including the unchanged firing notifications Alertmanager
|
|
// re-sends every repeat_interval.
|
|
//
|
|
// This is a documented part of the public API, not an internal ingest
|
|
// detail: StartsAt never changes for an alert instance, so ReceivedAt is
|
|
// the only signal a client has that a firing alert is still being
|
|
// refreshed. The sweeper stale-dates against it (see expireStale), API
|
|
// clients render it, and GET /api/alerts is ordered by it. Anything that
|
|
// stops the webhook handler from advancing it on a re-send is a breaking
|
|
// change — see "received_at is a liveness heartbeat" in the README and
|
|
// TestWebhook_ResendBumpsReceivedAt.
|
|
ReceivedAt time.Time `json:"received_at"`
|
|
|
|
// IncidentID is the most recent incident this alert belongs to. An alert row
|
|
// is reused across occurrences of the same fingerprint, so over its life it
|
|
// belongs to a series of incidents; incident_alerts keeps the full history
|
|
// and this is only the newest link.
|
|
IncidentID *int64 `json:"incident_id,omitempty"`
|
|
|
|
// ResolutionSource records why a resolved alert left the firing state:
|
|
// "alertmanager" for a real resolved webhook, "expiry" when the sweeper
|
|
// inferred it after the alert stopped being refreshed. Nil while firing, and
|
|
// cleared again by a re-fire under the same fingerprint.
|
|
//
|
|
// Also public API: it is how a client knows whether EndsAt was observed or
|
|
// inferred. Under "expiry" nothing ever reported an end, so EndsAt is only
|
|
// an upper bound (see expireStale) and ReceivedAt is the more truthful
|
|
// signal. Treat the value set as open — see "resolution_source says how much
|
|
// to trust ends_at" in the README, and TestWebhook_ResolvedSetsSource /
|
|
// TestExpiry_StaleFiringAlert.
|
|
ResolutionSource *string `json:"resolution_source,omitempty"`
|
|
|
|
ArchivedAt *time.Time `json:"archived_at,omitempty"`
|
|
}
|