v1.7.1 — Prod bug fixes unblocking API test suite
v1.7.1 — Prod bug fixes unblocking API test suite
Patch release covering three prod issues surfaced during #433 (API
content-style test validation against sparc.risk-sentinel.org). All
shipped in a single PR (#539 + #540) for one tag.
Fixes
/api/v1/cdef_documents 500 on every verb (#537, PR #539)
Recovered the cloned_from_id column on cdef_documents. The column
was added by #466's migration 20260517144141 and silently lost on
any database that crossed the #470 squash boundary without running
#466 first — the squash's idempotent guard
(return if table_exists?(:ssp_documents)) short-circuits whole-
schema setup on existing DBs and doesn't probe for individual columns
added between squashes. New migration is guarded both ways
(unless column_exists? + CREATE UNIQUE INDEX IF NOT EXISTS) so
it's a no-op on already-correct DBs and recovers any deployment that
skipped the original.
SA tokens returned 403 on every API write path (#536, PR #539)
Removed validate :service_account_cannot_be_admin from User.
Admin-owned SAs created expressly for admin-scope automation
(CI/CD, provisioning) can now hold admin privileges. Admin remains
explicit per-SA opt-in via a new checkbox on
/admin/service_accounts/new and /edit. AC-6 satisfied by
operator choice — no SA is implicitly admin. AU-12 audit trail
unchanged: auth_mode: service_token + sparc_sa_ token prefix
continue to distinguish SA from human actors.
Service Accounts missing from admin nav (#535, PR #540)
The User dropdown's Administration block listed every /admin/*
page except Service Accounts — it could only be reached through
the Enterprise dropdown, which isn't where admins look for
account management. Added the link alongside Users, Roles, Auth
Boundaries, Organizations, and Audit Log. New admin onboarding
no longer has to know the URL.
Investigation notes
Root cause for #537 came from CloudWatch (/ecs/sparc-prod,
request cce34a93-436c-4cb1-9ea1-cf73d16f4498):
NoMethodError (undefined method 'cloned_from_id' for an instance
of CdefDocument):
app/controllers/api/v1/cdef_documents_controller.rb:117
#536 was reproducible against prod with two distinct SA tokens
issued by admin owners — same 403 pattern on every write verb.
Container image
risk-sentinel/sparc:1.7.1 (built by container-build-sign pipeline,
deployed by sparc-iac on tag push).
Compatibility
No env-var changes. No schema-breaking changes (the new migration
is additive + idempotent). Drop-in upgrade from v1.7.0.