feat(api): metric monitor per-server states and server-scoped incidents

server/internal/services/metricfilter_test.go

@@ -0,0 +1,20 @@
+package services
+
+import (
+	"testing"
+
+	"gitea.hostxtra.co.uk/mrhid6/vantage/server/internal/models"
+)
+
+func TestFilterByVisibleServer(t *testing.T) {
+	incs := []models.Incident{{IncidentID: "a"}, {IncidentID: "b", ServerID: "s1"}, {IncidentID: "c", ServerID: "s2"}}
+	id := func(i models.Incident) string { return i.ServerID }
+
+	if got := FilterByVisibleServer(incs, id, nil, false); len(got) != 3 {
+		t.Fatalf("unrestricted keeps all, got %d", len(got))
+	}
+	got := FilterByVisibleServer(incs, id, map[string]bool{"s1": true}, true)
+	if len(got) != 2 || got[0].IncidentID != "a" || got[1].IncidentID != "b" {
+		t.Fatalf("restricted keeps serverless and visible only, got %+v", got)
+	}
+}

server/internal/services/tokenscope.go

@@ -105,3 +105,18 @@ func SelectorNarrowerOrEqual(child, parent map[string]string) bool {
 	}
 	return true
 }
+
+// FilterByVisibleServer drops items tied to a server the credential cannot
+// see. Items with no server (every non-metric incident) are always kept.
+func FilterByVisibleServer[T any](items []T, serverID func(T) string, visible map[string]bool, restricted bool) []T {
+	if !restricted {
+		return items
+	}
+	out := items[:0:0]
+	for _, it := range items {
+		if id := serverID(it); id == "" || visible[id] {
+			out = append(out, it)
+		}
+	}
+	return out
+}