v1.0.0-rc2

The second release candidate of the Cloud Registry UI, published as the
image elixircloud/cloud-registry-ui:1.0.0-rc2 and tested against
cloud-registry 1.0.0rc2, which it needs: it follows the registry's camelCase
API and its new paths of users' roles, and doesn't work with cloud-registry
1.0.0rc1. It brings the import and sync of service info in the registration
form, a notification bell, tabs, labels and expired invitations in the access
dialog, and a hardened login. Upgrade the registry (with a fresh database) and
the app together, as the upgrade
notes
describe, and check the login settings before the upgrade; users who are
logged in then log in once more.

Breaking changes

• Needs cloud-registry 1.0.0rc2: the app reads and sends only the
  registry's camelCase names (e.g. userId, registrationRules,
  createdAt) (#204, #205)
• Roles of users are changed at the registry's new paths
  (/services/{serviceId}/permissions/users/{userId}), without a fallback:
  with cloud-registry 0.6.0 or 1.0.0rc1 they would go to the wrong user, so
  the app reports such registries as too old; user IDs and groups that start
  with / are refused (#190, #191, #193, #196)
• Login: the issuer of each login provider and LOGIN_REDIRECT_URI must
  be https URLs (http only for localhost and loopback addresses), and
  logging out also ends the session at providers with an
  end_session_endpoint (register the app's /auth/login as a post-logout
  redirect URI there) (#155, #223, #239, #243)
• The session's cookies are named __Host-…, and the app reads only these
  names: users who are logged in when the app is upgraded log in once more
  (#155, #223, #239, #243)
• The form for new invitations requires a label by default; set
  NEXT_PUBLIC_INVITATION_LABEL_REQUIRED=false to keep it optional (#187,
  #189)

Features

• Import a service's public service info in the registration form, and keep
  the new entry in sync with it (#206, #209)
• Show which services are synced or out of sync, with controls to sync now
  and to turn the sync on or off (#207, #210)
• A notification bell in the top bar, with what needs the user's attention,
  e.g. pending services and service types (#208, #211)
• Split the Manage access dialog into the tabs Current Access and
  Invitations, with a page size set by NEXT_PUBLIC_ACCESS_PAGE_SIZE
  (#186, #188)
• Labels of invitations, which say who they are for, and expired
  invitations, with new links, removal and Remove expired (#187, #189)
• Let admins list the registry among its own services, from the service
  info page (#201, #203)
• Show the registry API's address on the service info page, with a copy
  button (#200, #202)
• A deadline of 30 seconds for every request to the registry, with messages
  that say whether a change may have taken effect, and how long to wait
  after 429 Too Many Requests (#213, #217)

Security

• Token requests use HTTP Basic authentication (client_secret_basic)
  unless the provider lists client_secret_post, and sessions whose login
  provider can't be told are taken as logged out (#155, #223)

Fixes

• Avoid the request for approvals without a token on each page load, which
  registries that require login refused (#151, #185)
• Show the registry's environment on the service info page as reported,
  without changing its case (#198, #199)
• Keep invitation labels in their table cell (#192, #195)
• Sync now only if the sync is on, and name the pending services in the
  notifications (#214, #215, #218)
• Offer no sync for the registry's own entry, which the registry never
  syncs, and stop asking for notifications that the registry refuses
  (403, e.g. a policy without the rules of 1.0.0rc2) (#240, #244)
• Show the reasons of cloud-registry 1.0.0rc2 at each field that it refuses
  in the edit form, and name the fields by their labels in its messages
  (#245, #246)
• Small fixes from the review of this release: what the app shows when the
  registry refuses labels, encoded slashes at the proxy (#194, #197)

Documentation

• Upgrade notes from 1.0.0-rc1, with the steps in short, and the
  compatibility with cloud-registry 1.0.0rc2 (#236, #237)
• Set Strict-Transport-Security in the proxy, and how long the registry
  keeps the labels of invitations (#194, #197)
• Link the new docs site, and add the DOI and release badges (#181, #182)

Maintenance

• End-to-end tests against cloud-registry 1.0.0rc2, and against the app's
  image, in parallel jobs per browser and shard; fixes of flaky tests (#157,
  #222, #212, #216, #224, #225, #226, #229, #230, #234, #236, #237, #241,
  #242, #249, #250)
• CI lints the code with Biome, pins its build inputs, checks pull request
  titles under the gate, and scans the image with the organization's shared
  action (#156, #219, #127, #184, #228, #232)
• Remove unused files and code, and explain code owner roles (#227, #231,
  #126, #180)
• The release workflow creates the GitHub release with these curated notes,
  followed by GitHub's generated notes (#235, #238)
• Neutral example titles in the branding tests (#122, #183)
• Dependency updates, and the organization's label on Dependabot's pull
  requests (#160, #177, #241, #242)

Commits

• docs: link the new docs site by @uniqueg in #179
• docs: add the DOI and release badges by @uniqueg in #182
• chore: explain code owner roles in CODEOWNERS by @uniqueg in #180
• test: use neutral example titles in branding by @uniqueg in #183
• ci: check PR titles under the gate by @uniqueg in #184
• build(deps): bump the github-actions group across 2 directories with 3 updates by @dependabot[bot] in #177
• build(deps): bump the node-dependencies group across 1 directory with 15 updates by @dependabot[bot] in #160
• feat: split the access dialog into tabs by @uniqueg in #188
• feat: add labels and expired invitations by @uniqueg in #189
• feat!: move role client under users by @uniqueg in #191
• fix: keep invitation labels in their cell by @uniqueg in #195
• fix: guard against unsupported registries by @uniqueg in #196
• fix: address small findings of the rc2 review by @uniqueg in #197
• fix: show the environment as reported by @uniqueg in #199
• feat: show the API address on the service info by @uniqueg in #202
• fix: avoid the anonymous approvals probe by @uniqueg in #185
• feat: let admins list the registry itself by @uniqueg in #203
• feat!: follow the backend's camelCase names by @uniqueg in #205
• feat: import service info in the create form by @uniqueg in #209
• feat: show and control the sync of services by @uniqueg in #210
• feat: add a notification bell to the top bar by @uniqueg in #211
• ci: raise the e2e job's time limit by @uniqueg in #216
• feat: add a deadline to registry requests by @uniqueg in #217
• fix: sync now only if on, name pending services by @uniqueg in #218
• ci: lint, pin build inputs, group updates by @uniqueg in #219
• test: run e2e tests against the image by @uniqueg in #222
• feat: harden the login flow by @uniqueg in #223
• test: fix two flaky Firefox end-to-end tests by @uniqueg in #225
• test(e2e): wait for the dashboard's reads at login by @uniqueg in #229
• chore: remove unused files and code by @uniqueg in #231
• ci: use the shared scan-image action by @uniqueg in #232
• test: fix remaining e2e flake sources by @uniqueg in #234
• test: fix two e2e races, label Dependabot PRs by @uniqueg in #242
• ci: run the end-to-end tests in parallel by @uniqueg in #250
• ci: add curated notes to GitHub releases by @uniqueg in #238
• fix: login follow-ups for 1.0.0-rc2 by @uniqueg in #243
• fix: self-entry sync and refused notifications by @uniqueg in #244
• fix: show the field errors of cloud-registry rc2 by @uniqueg in https://g...

v1.0.0-rc1

The first release of the Cloud Registry UI, a web app for browsing and managing services in a Cloud Registry, published as the image elixircloud/cloud-registry-ui:1.0.0-rc1 and tested against cloud-registry 1.0.0rc1 (the registry spells its pre-releases the PEP 440 way, the app the SemVer way). It covers the registry's API for anyone, users and admins, and takes the registry's registration rules from its service info. See the operator guide to deploy it, the upgrade notes for the breaking changes below, which affect deployments of earlier, unreleased versions, and the user guide to use it.

Breaking changes

• Login providers are configured with LOGIN_PROVIDERS and LOGIN_REDIRECT_URI: the app no longer reads LS_LOGIN_URL and OIDC_*, and stops with a message (on Vercel, the build fails) if they are set without LOGIN_PROVIDERS (#49)
• The allowed environments and URL schemes of services come from the registry's service info: NEXT_PUBLIC_SERVICE_ENVIRONMENTS and NEXT_PUBLIC_SERVICE_URL_SCHEMES are ignored, with a warning when the app starts (#128, #144)
• All settings are read when the app starts, not when the image is built: pass them with docker run; NEXT_PUBLIC_* build arguments only print a warning (#86)

Features

• Browse, search and filter services, with their details, verifications and pending entries (#27, #29, #30, #31, #41, #79)
• Register, edit, rename and delete services; admins can choose service IDs (#24, #53, #92)
• Manage access: grant and revoke roles of users and groups, and invite users to services by link (#43, #105, #114)
• Show the limit of services per user clearly (#115, #109, #116)
• Switch between user and admin mode (#93)
• Show and approve pending services and service types, and add and delete service types (#55, #57)
• Log in with one or several OpenID Connect providers (such as LS Login), configured at start (#49, #86)
• Read the allowed environments and URL schemes of services from the registry's service info, instead of the app's settings (#128, #144)
• Register services with the create form of cloud-components 2.0.0-alpha.50: service types picked from the registered ones, new types only where the registry accepts them (with a note when they need approval), environments from the registry, admin-only fields in admin mode only, and the registry's problem details in errors (#129, #145)
• Show the registry's registration rules on the service info page, offer adding service types only where the registry accepts new types, and explain conflicts of service types (#131, #147)
• Pick service types from the registered ones in the edit form, as in the form for new services; offer new types only to users who may add them (#130, #148)
• Check registrations in the create form before sending them, as the registry does (required fields, URLs and their schemes, environments, lengths), and offer new types there only where the registry accepts them (#35, #149)
• Register services in a modal of the Services page, with a title, a description and a close button, as the other dialogs; /dashboard/services/create opens it (#167, #174)
• Filter the services list to My services: those on which the user has a role, directly or through a group (#171, #175)

Security

• Login with PKCE and a nonce; the app checks the issuer, audience, expiry and party of ID tokens and the issuer name of responses (RFC 9207) (#49, #74, #88)
• Fresh credentials for every login (#96)
• Hardened image and security headers; settings and secrets are read at start and stay out of the image (#67, #78, #86)
• axios 1.21.0 and zod 4.6.7, which fix high-severity advisories in the calls to the login providers (credential headers on redirects, proxy bypasses, ReDoS) and in input validation (memory exhaustion) (#153, #159)
• Bun 1.4.4 image, with the Debian security updates that fix critical and high vulnerabilities of the 1.3.14 image (e.g., in Perl, OpenSSL and util-linux) (#154, #163)

Fixes

• Manage access: page and search long lists of users and groups, show users without a name by their ID alone, hide accepted invitations behind Show accepted, keep every link created while the dialog is open, and give open invitations whose link is gone a new one (#166, #170)
• Keep the top bar in view next to wide tables (#108)
• Show admin mode only by the light red "Admin mode" switch, without the "ADMIN MODE:" prefix; use title case for all dialog titles, a 22 px sidebar title, and the ELIXIR On-Cloud mark as the favicon (#168, #172)
• Warn of old login settings (LS_LOGIN_URL, OIDC_*) that are still set next to LOGIN_PROVIDERS, and log each provider's issuer as discovered (#152, #158)
• Title the details of a service "Service Details", group their buttons into rows that fit, and wrap long values (names, URLs, the JSON), so that the dialog no longer scrolls sideways, also on phones (#165, #173)
• Show the group, artifact and version of service types on lines of their own in the type tiles, breaking long values after separators such as dots; spell "Documentation URL" and "Contact URL", space the labels of the registry type, and style the lifecycle labels like the others on the service info page (#164, #169)

Documentation

• User and operator guides, upgrade notes, and these release notes (#65, #106, #118, #133, #137)
• Explain how to spell the registry's trusted issuers, what logging out does and doesn't do, how the app authenticates to the token endpoint (client_secret_post), and that logos must be at https URLs (#152, #158)

Maintenance

• CI with unit, end-to-end and image tests, a gate job, and signed, scanned images with an SBOM and build provenance (#82, #89, #110, #119, #121)
• End-to-end tests against cloud-registry 1.0.0rc1, its release image pinned by digest (#134, #178)
• Releases from signed version tags on main, which moves forward to release commits on dev, the default branch (#135, #143, #141, #142)
• Code owners for reviews (#139, #140)
• CI audits the production dependencies for high and critical advisories (#153, #159)
• CI scans the image as the release does, and the image of the newest release is scanned weekly (#154, #163)

Commits

• feat: added service page, create service page, middleware, workflows by @AnonymousXC in #1
• feat: added service info page, logout and minor fixes by @AnonymousXC in #2
• feat: added service updation page by @AnonymousXC in #4
• refactor: project structure and nextjs upgrade by @AnonymousXC in #20
• fix: handle a fresh registry on info pages by @uniqueg in #21
• fix: build image with bun 1.3 by @uniqueg in #23
• fix: offer custom service IDs to admins only by @uniqueg in #24
• fix: align form validation with the API by @uniqueg in #25
• chore: merge registry access control into ai by @uniqueg in #26
• feat: browse publicly, show actions by role by @uniqueg in #27
• fix: show the registry's error details by @uniqueg in #28
• feat: search and filter services by @uniqueg in #29
• feat: paginate services and types by @uniqueg in #30
• feat: show duplicate-registration conflicts by @uniqueg in #31
• feat: return to the services after registering by @uniqueg in #39
• feat: show and manage verifications by @uniqueg in #41
• feat: configurable branding and footer by @uniqueg in #42
• feat: manage access to services by @uniqueg in #43
• feat: role-specific page texts by @uniqueg in #51
• feat: log in with configurable providers by @uniqueg in #49
• feat: warn before leaving unsaved forms by @uniqueg in #52
• feat: improve the service edit form by @uniqueg in #53
• feat: add and remove service types by @uniqueg in #55
• feat: refine header and footer branding by @uniqueg in #54
• feat: configurable service environments by @uniqueg in #56
• feat: show and approve pending entries by @uniqueg in #57
• docs: document deployment and configuration by @uniqueg in #65
• fix: keep .env out of the image, harden it by @uniqueg in #67
• fix: small findings from the pre-release review by @uniqueg in https://github.com/elixir-cloud-aai/cloud-registry-u...