2.8 KiB
2.8 KiB
1. Cloud authentication configuration
- 1.1 Remove configured public and static-Host bearer credential parsing and production credential validation from
CloudControlConfig, while retaining the optional trusted-proxy setting used by login throttling. - 1.2 Compose public authorization from Cloud user sessions and dynamic repository-backed Host credentials only; remove configured enrollment-token authentication.
- 1.3 Update Cloud configuration and application tests to prove production starts without JSON credentials, protected API routes reject anonymous requests, and user sessions retain scoped authorization.
2. Direct Host bootstrap
- 2.1 Remove static Host and enrollment-token settings from Host Agent configuration while retaining persistent identity-file validation and control-plane URL overrides.
- 2.2 Change the Host enrollment client and identity resolution to perform unauthenticated first registration and persist the returned Host identity and generated secret.
- 2.3 Change the Cloud enrollment route to accept direct registration, preserve idempotency for the same instance, and require the persisted Host secret for all later Host operations.
- 2.4 Add Cloud and Host Agent tests for direct registration, idempotent retry, missing/invalid post-registration Host credentials, and absence of static credential settings.
3. Console token and user-directory removal
- 3.1 Remove bearer-token compatibility state, controls, client behavior, and related tests from the Cloud Console.
- 3.2 Remove Console Users navigation, views, client calls, and tests while retaining login, logout, current-user, and password-change behavior.
- 3.3 Add or update Console tests covering session-only login and the absence of token and user-directory UI paths.
4. Deployment contract and documentation
- 4.1 Bake the Console static directory into the Docker image environment and remove it, credential JSON, static Host credentials, and redundant defaults from Compose and
.env.example. - 4.2 Update deployment documentation for user-account bootstrap, direct Host registration, required runtime configuration, rollback, and the actual deploy Compose topology.
- 4.3 Update deployment-configuration tests to enforce the reduced environment contract and image-provided Console path.
5. Verification and change validation
- 5.1 Run focused Cloud API, Cloud platform, Host Agent, deployment, and Console test suites; fix failures caused by the removed credential paths.
- 5.2 Render
compose.deploy.yamlwith representative non-secret settings and verify the Cloud API command, health check, and environment contract. - 5.3 Run the full non-integration workspace suite, Console build, and strict OpenSpec validation; record any environment-gated checks that cannot run locally.