v1.3.2

Wardryx 1.3.2

A policy write now refuses a field the policy does not declare. Before this
release, a PUT /v1/policies/{id} with a misspelled rule, for example
deny_tolls for deny_tool, was stored without that rule, answered 200, and the
call the rule was meant to deny was allowed. The write now answers 400 and stores
nothing.

Fixed

• A PUT /v1/policies/{id} body with a key the policy does not declare is
  refused with a 400 (invariant 31). The 400 names the key and does not echo its
  value. Nothing is stored, and the live rules stay as they were. Before, the key
  was dropped and the write answered 200.
• A policy read by GET can be written back unchanged. The two fields a GET
  returns beyond the policy itself, id and updated_at, are accepted on a PUT
  and ignored. The URL names the policy, and the server stamps the time of the
  write.
• A key inside hold_if_signal that the rule does not have is refused on a PUT,
  as it already was in a policy file.

Upgrade

A client that sends a key the policy does not declare now gets a 400 on PUT.
Before, that key was dropped and the policy was stored without it, so such a
client has been writing policies that lack rules it meant to set. Check any
tooling that writes policies with PUT, and correct the spelling of the key or
remove it.

Rolling back to 1.3.1 brings back the silent drop for a misspelled key in a PUT
body.

The other JSON request bodies (decide, filter-tools, approval decide) are
unchanged, and they still ignore a key they do not declare.

Not proven

• No live deployment's PUT traffic was read, so how many clients send an
  undeclared key is not known.
• The key match is not case-sensitive. A PUT with DENY_TOOL is accepted and
  stored as deny_tool, so the rule is enforced. The decoder reads the key as the
  declared one, as the policy file loader does, and this release does not change
  that.
• The other JSON request bodies still ignore an undeclared key. Refusing one there
  is a separate decision.
• The Postgres integration suite was not run, since it needs a live database. The
  other gates were run locally, govulncheck and gosec included. No image was
  built.