Skip to content

v0.1.25.19 — /v1/auth/introspect dual-auth + operator docs

Choose a tag to compare

View all tags
@amavashev amavashev released this 16 Apr 11:29
· 261 commits to main since this release
v0.1.25.19
7bdcd14
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Closes the one remaining parity gap vs the admin spec: GET /v1/auth/introspect now accepts both AdminKeyAuth (admin-shape) and ApiKeyAuth (tenant-shape) per spec v0.1.25.15 (cycles-protocol#43).

Highlights

  • Dual-auth on GET /v1/auth/introspect. Admin keys return auth_type=admin with all 15 capability flags true. Tenant API keys return auth_type=tenant with concrete permissions, tenant_id, optional scope_filter, and capabilities derived per the NORMATIVE table (admin-plane caps hard-coded false under tenant auth regardless of any admin:* permissions — prevents accidental admin-UI elevation via legacy keys).
  • Additive schema extensions on AuthIntrospectResponse (tenant_id, scope_filter) and Capabilities (view_reservations, 6 × manage_*). All optional; pre-v0.1.25.19 admin-shape responses stay byte-identical.
  • New consumer docs. CHANGELOG.md (Keep-a-Changelog, v0.1.25.10 → v0.1.25.19) and OPERATIONS.md (metrics inventory, alert recipes, configuration tuning, incident playbook), mirroring the shape just added to cycles-server.

Parity audit

Full review of cycles-governance-admin-v0.1.25.yaml v0.1.25.11→v0.1.25.17 found every prior spec change already covered by admin v0.1.25.11→v0.1.25.18. cycles-server runtime EventType is byte-for-byte at parity with admin (41 entries, BUDGET_RESET_SPENT in both).

Wire format

Additive. Clients built against v0.1.25.18 parse v0.1.25.19 responses correctly. No breaking changes.

Upgrade

  1. Pull the new image: docker pull ghcr.io/runcycles/cycles-server-admin:0.1.25.19
  2. Bump compose or k8s manifests.
  3. No configuration changes required.

Dashboard clients that want to let tenants introspect their own keys can now call /v1/auth/introspect with a tenant API key and switch on auth_type.

Verification

  • mvn verify — 528 tests pass, JaCoCo ≥95%, SpecCoverageReportTest 43/43 endpoints.
  • ContractValidationConfig validates both admin-shape and tenant-shape against cycles-protocol@main.
  • OpenApiContractDiffTest — zero INCOMPATIBLE diff.

Cross-refs

Full changelog: CHANGELOG.md v0.1.25.19 entry · AUDIT.md for engineering history.

Assets 2
Loading