Skip to content

v8.5.1 — Licensed tier reported correctly in the portal/database + dev-mode token endpoint

Choose a tag to compare

View all tags
@saurabhjain1592 saurabhjain1592 released this 08 Jun 01:55
· 50 commits to main since this release
v8.5.1
80cf62a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

[8.5.1] - 2026-06-08 — Licensed tier reported correctly in the portal/database + dev-mode token endpoint

Patch release. Fixes a tier-reporting divergence where the licensed tier was held only in agent memory and never written to the organizations table, so the portal and other database consumers could lag behind /health. Also adds a non-production developer convenience for minting user tokens. Additive migration only; no breaking changes.

Added (Community)

  • Dev-mode token endpoint (POST /api/v1/dev/token). In an explicitly non-production deployment, mints a short-lived HS256 user_token from the authenticated Basic-auth credential, so local and CI integrations don't have to hand-run a JWT signing script. Fail-closed: the endpoint is only registered when an explicitly non-production ENVIRONMENT / DEPLOYMENT_MODE / DEPLOYMENT_KIND is set — otherwise the route returns 404; and when registered but JWT_SECRET is not configured it returns 503 rather than minting. The token's tenant is inherited from the Basic-auth username, and the signing algorithm is pinned to HS256. Never reachable in production.

Fixed (Community)

  • The agent now writes the licensed tier into the database at boot. After validating the deployment license, the agent upserts the deployment organization's tier and max_nodes to the licensed values, using a new RLS-safe SECURITY DEFINER migration so the write clears FORCE ROW LEVEL SECURITY without giving the request path elevated privileges. Previously the licensed tier lived only in agent memory (surfaced at /health) while organizations.tier stayed at the seeded Community default — so the portal UI, node-limit enforcement, and compliance-evidence paths could report Community on a valid Enterprise license. The promotion runs at boot and is idempotent: it writes only when the tier or node limit actually differs.
  • Tests: added a runtime end-to-end test that boots a freshly-installed Enterprise deployment and asserts the database reports Enterprise with no prior request traffic, plus a migration-level unit test for the promotion helper.

Documentation

  • Expanded architecture documentation: a "Five Runtime Modes" overview with Decision / MAP / WCP sequence diagrams describing how governance is enforced in each runtime mode.

See the v8.5.1 release notes for the full write-up. Source-available under BSL 1.1.

Assets 2
Loading