Skip to content

v0.4.4

Choose a tag to compare

View all tags
@kylkrie kylkrie released this 08 Oct 18:01
· 19 commits to master since this release
v0.4.4
7a2cbc2

Roles replace key scopes. This is everything since v0.3.2: v0.4.0 through v0.4.3 were iteration tags with no separate notes.

Breaking

  • Key and session scopes are gone. A member key or session now carries its member's role labels, and nothing narrows it below that. To give a machine less access, give it a service account with a smaller role. Restricted (scoped) keys and sessions are revoked on upgrade.
  • Roles come from a deployment roles file. ROLES_FILE on identity points to a YAML file that maps role slugs to labels, with creator_role, default_role and an optional service_account_default_role. Roles are on or off for the whole deployment: if ROLES_FILE is unset, every member holds every label (["*"]). An invalid file or unknown keys refuse boot. See docs/roles.md and the starter file compose/roles.yml.
  • Routes declare required_labels, not required_scopes. The permissions field on the wire is labels. It is always a list and never null.
  • Org writes in the identity catalog are labeled: org:write, org:delete, org:members:write and org:service-accounts:write. A member whose role lacks the label gets 403, with any of its keys or sessions.
  • added_by and created_by are removed from identity requests and responses.
  • Identity migrations are folded into one schema. No scopes compatibility is left.
  • Compose requires PLAT5_VERSION from the env file. The pin lives only in .env.template.

Added

  • role on member, invite and service-account writes. A slug that isn't in the file returns 422.
  • GET /organizations/{organization_id}/roles lists the deployment's roles. It's published at the edge as GET /org/roles so a console can show a role picker.
  • A write can't take an org's last creator_role holder to zero (422).

Fixed

  • gateway: a CORS preflight returns 204 and completes (#15).
  • identity: the request log records the status the client actually received (#14).
  • route-registry: restore validates like apply, lookalike paths conflict, and paths are canonical (#16).
  • route-registry: specific 422s for credentials in a url and for an out-of-range port. The missing-url message no longer mentions plat5.yml (#19).
  • docs: a route-config url must be exactly http://host:port (#17).

Images

ghcr.io/plat5dev/gateway:v0.4.4, ghcr.io/plat5dev/route-registry:v0.4.4, ghcr.io/plat5dev/identity:v0.4.4

Full changelog: v0.3.2...v0.4.4

Assets 2
Loading