{{ message }}
Repository navigation
Tags: tsuru/tsuru
Tags
Fix/cluster storage breaking kubeconfig (#2911) * chore: check which docker compose tool is available on user setup * test: cluster config write operations should preserve valid kube-config * fix: provisioner cluster collection should not convert nil slices/maps to empty on storage writes * test: extend retry time for job completion check on integration * test: describe broken pods after failed integration testing * fix: nil map should be read as empty for provisioner cluster * chore: setup minikube and debug registry-insecure reads * chore: pin minikube version * test: use testify require on regression test
fix: team info should not return all app data (#2902) * fix: team info should not return all app data * fix(ci): integration test race and bump Go to 1.26.6 (#2900) * scripts: wait for helm releases to be ready before running integration tests * scripts: replace blind sleep with an explicit pod readiness gate * chore(deps): bump Go toolchain to 1.26.6 --------- Co-authored-by: Guilherme Rezende <guilhermebr@gmail.com>
Feature/service fine grained permissions (#2878) * chore: add task detail * feat: dynamic permission registry * feat(role): add dynamic permission support Introduce DynamicSchemeNames on Role and implement dynamic permission management: AddDynamicPermissions, RemoveDynamicPermissions and DynamicPermissionsFor. Persist dynamic schemes using Mongo ($addToSet / $pullAll) and refresh in-memory state after updates. Replace manual context checks with slices.Contains and add tests for dynamic schemes and related helpers. * feat: extend token interface for dynamic permissions * feat: implement method+path matching with virtual std ServeMux * feat: manifest ingestion with fine grained permissions * feat: repopulate service api manifest during startup * feat: proxy manifest to action matching (WIP) * feat: service proxying with new permission validation * feat: role management and service management with dynamic permissions * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix: return error if created permission is empry string * ref: remove manifest fields unnused on permission flow * ref: re-use list permissions route for dynamic permissions as well * test: adjust match on manifest * chore: newer routes should be under 1.31 path version * ref: remove duplicated field operationName * ref: format * test: integratoin 1 * test: integration tests for fine grained service permissions * feat: use old endpoints to add/remove dynamic permissions to roles * test: use tsuru cli for permission handling on integration * test: run all integratoin tests * ref: fix linting errors * chore: add instance proxy to check-handlers * test: fix failing test missing global ctx on action contexts * Simplify token usage removing duplicated code * Simplify token usage removing duplicated code[2] * Simplify dynamic permissions removing in-memory registry Dynamic permission schemes are now pure values derived from the permission name, and the service manifests stored in the database are the single source of truth for which actions exist. This removes the stateful dynamicRegistry, its startup rebuild (RepopulateDynamicPermissions) and all register/unregister/rollback synchronization on manifest ingest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Drop unused method * chore: remove spec files * Drop unused method[2] * ref: move new typing to types package and adjust usage * ref: extract permission listing into method * ref: lint and fmt * fix: typing issue on func impl * fix: "service-action" should not be a valid dynamic permission name * test: integration with two services and same actions * simplify code * refactor: validate manifest instead of normalizing it Replace normalizeManifest with validateManifest so ingesting a manifest no longer mutates the caller's input. Validation now checks operations in place (method casing, path patterns, duplicate actions/routes) without building a normalized copy. Drop the LegacyEnabledAt field and its timestamp bookkeeping, which was only needed to carry normalization state across updates. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: make manifest matcher stateless Remove the global manifestMatchStates sync.Map and the per-manifest manifestMatchState cache. compiledMatcher now builds the ServeMux and action lookup fresh on each call, dropping the shared mutable state keyed by manifest pointer. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * refactor: require uppercase manifest method instead of normalizing Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * fix: address review comments on fine-grained service permissions - manifestGrantConflicts now detects orphaned ancestor-level dynamic grants (e.g. service-action.<svc>.rules or service-action.<svc>) by checking whether each grant still covers any action kept by the next manifest, instead of only exact-matching removed action names - gate integration flow skip logging behind the verbose env setting - add missing "team" requirement to the serviceBind integration flow so it is skipped (not broken) when TSURU_INTEGRATION_TEAM is unset Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat: do not use force to change service manifest orphaned perms * chore: bump vulnerable dependencies --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Wilson Júnior <wilsonpjunior@gmail.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Paulo Sousa <paulo.sousa@corp.globo.com>
PreviousNext