| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
Move permission.Permission to types model | 1 年前 | |
Move permission.Permission to types model | 1 年前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 | |
refactor: remove unnused definitions (#2818) * refactor: remove unnused definitions * fix: do not remove autogenerated code | 7 个月前 | |
Move permission.Permission to types model | 1 年前 | |
pool updates are no longer supported for apps (#2848) * pool updates are no longer supported for apps | 5 个月前 | |
Feat/unit autoscale swap (#2809) * Adding API endpoint for swapping the autoscale version * adding backoff so KEDA can create the resources needed to tsuru api list the autoscale info * fix: app info to return scaled objects info when it exists * fix provisioner_test.go * adding cleanup for the auscale in the integration tests * adding debug to list hpas * improving Check on integration package * adding check to wait the integration test until KEDA has applied changes to HPA * refactor | 7 个月前 | |
Move permission.Permission to types model | 1 年前 | |
Move permission.Permission to types model | 1 年前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 | |
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com> | 1 个月前 | |
Migrate MGO to Official Mongo Driver - part 5 (#2718) * Write services using new mongo driver * Write service instances using new mongo driver * fix lint * Write volumes using new mongo driver * Write tracked instances using new mongo driver * Write dynamic routers using new mongo driver * drop dbtest package * Write service broker using new mongo driver * Drop scopedconfig package * Write quota using new mongo driver * Write clusters using new mongo driver * Write app groups using new mongo driver * Drop unused parts of old mongo driver * Enable metrics to new mongo driver * Read apps using new mongo driver * Healthcheck using new mongo driver * Create app_versions indexes using new mongo driver * Drop some unused references to old driver * fix lint | 1 年前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 1 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 5 个月前 | ||
| 7 个月前 | ||
| 1 年前 | ||
| 1 年前 | ||
| 1 个月前 | ||
| 1 个月前 | ||
| 1 年前 |