diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 1c6fc82245..e86319b85e 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -81,12 +81,13 @@ template configuration retains its explicit `VERSION_2_3_0` compatibility setting. This dependency update does not change API, database schema, or template configuration. -Engine `0.183.324` includes `projectTemplate.isPublic` in non-admin v1 API +Engine `0.183.325` includes `projectTemplate.isPublic` in non-admin v1 API responses as a read-only field. The admin create and update permission remains unchanged. Public templates still have no owning `accountId`; their `remove` action link is omitted for non-admin callers, while private template owners and admins retain it. Direct update and delete authorization remains enforced by the existing policy. There is no database migration. +The `v0.183.324` tag is source-only and has no published release artifact. ## External identity type upgrades diff --git a/README.md b/README.md index 03ab4a1d23..a68389b368 100644 --- a/README.md +++ b/README.md @@ -23,10 +23,11 @@ tests, and compatibility details. Previous release notes remain in [GitHub release history](https://github.com/PastureStack/orchestration-engine/releases) records published artifacts. -The next Engine candidate is `0.183.324`. It exposes the public state of +The next Engine candidate is `0.183.325`. It exposes the public state of project templates to non-admin readers and omits the unavailable remove action on templates they do not own. See the -[candidate release note](docs/releases/orchestration-engine-0.183.324.md). +[candidate release note](docs/releases/orchestration-engine-0.183.325.md). +The `v0.183.324` tag is source-only and has no published release artifact. The build retains Java 25, Ubuntu 26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, concurrency, and runtime maintenance. It consumes the exact @@ -48,7 +49,7 @@ bash scripts/check-cattle-jdk25-full-package After the gate passes, package and check the release artifact: ```sh -ENGINE_VERSION=0.183.324 bash scripts/build --release +ENGINE_VERSION=0.183.325 bash scripts/build --release bash scripts/check-release-artifact dist/artifacts/cattle.jar ``` diff --git a/code/framework/api-pub-sub-jetty/pom.xml b/code/framework/api-pub-sub-jetty/pom.xml index 23085efec2..99615d4589 100644 --- a/code/framework/api-pub-sub-jetty/pom.xml +++ b/code/framework/api-pub-sub-jetty/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/api-pub-sub/pom.xml b/code/framework/api-pub-sub/pom.xml index 3fb1203e96..e6710dc8ee 100644 --- a/code/framework/api-pub-sub/pom.xml +++ b/code/framework/api-pub-sub/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/api/pom.xml b/code/framework/api/pom.xml index c9a71212c3..5f144d2cf2 100644 --- a/code/framework/api/pom.xml +++ b/code/framework/api/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/archaius/pom.xml b/code/framework/archaius/pom.xml index a98cc066de..c5095675cd 100644 --- a/code/framework/archaius/pom.xml +++ b/code/framework/archaius/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-meta-parent - 0.183.324 + 0.183.325 ../../meta-parent/pom.xml diff --git a/code/framework/async/pom.xml b/code/framework/async/pom.xml index 111aa8e0db..4975a49151 100644 --- a/code/framework/async/pom.xml +++ b/code/framework/async/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/auditing/pom.xml b/code/framework/auditing/pom.xml index 771960efea..1beea81f10 100644 --- a/code/framework/auditing/pom.xml +++ b/code/framework/auditing/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/db-loader/pom.xml b/code/framework/db-loader/pom.xml index 30eab23684..1e06adf7ed 100644 --- a/code/framework/db-loader/pom.xml +++ b/code/framework/db-loader/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/deferred/pom.xml b/code/framework/deferred/pom.xml index 66fcd09129..9261ff6c29 100644 --- a/code/framework/deferred/pom.xml +++ b/code/framework/deferred/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/encryption/pom.xml b/code/framework/encryption/pom.xml index da8b133fca..8f42bd8fd5 100644 --- a/code/framework/encryption/pom.xml +++ b/code/framework/encryption/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/engine/pom.xml b/code/framework/engine/pom.xml index bce959a6eb..20bb1eb4cc 100644 --- a/code/framework/engine/pom.xml +++ b/code/framework/engine/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/eventing/pom.xml b/code/framework/eventing/pom.xml index d7a10310d7..3525e12172 100644 --- a/code/framework/eventing/pom.xml +++ b/code/framework/eventing/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/events/pom.xml b/code/framework/events/pom.xml index b2faccd604..c091b1b9db 100644 --- a/code/framework/events/pom.xml +++ b/code/framework/events/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/extension-spring/pom.xml b/code/framework/extension-spring/pom.xml index b3bde9ba1e..0fa5093c91 100644 --- a/code/framework/extension-spring/pom.xml +++ b/code/framework/extension-spring/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/extension/pom.xml b/code/framework/extension/pom.xml index 419b623851..4a8f764fae 100644 --- a/code/framework/extension/pom.xml +++ b/code/framework/extension/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/java-server/pom.xml b/code/framework/java-server/pom.xml index 946294f3f3..04a3e7be46 100644 --- a/code/framework/java-server/pom.xml +++ b/code/framework/java-server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/jmx/pom.xml b/code/framework/jmx/pom.xml index e6b1c6d4b7..f291b90b02 100644 --- a/code/framework/jmx/pom.xml +++ b/code/framework/jmx/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/jooq/pom.xml b/code/framework/jooq/pom.xml index a73b40dd27..bb82d29392 100644 --- a/code/framework/jooq/pom.xml +++ b/code/framework/jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/json/pom.xml b/code/framework/json/pom.xml index 85507e24d7..192a97dda3 100644 --- a/code/framework/json/pom.xml +++ b/code/framework/json/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/launcher/pom.xml b/code/framework/launcher/pom.xml index 0c881ced7e..5eb74a9fd3 100644 --- a/code/framework/launcher/pom.xml +++ b/code/framework/launcher/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/lock/pom.xml b/code/framework/lock/pom.xml index 9f3809de79..022994f2a6 100644 --- a/code/framework/lock/pom.xml +++ b/code/framework/lock/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/logback/pom.xml b/code/framework/logback/pom.xml index cc791d3f0c..e6fa2a22c9 100644 --- a/code/framework/logback/pom.xml +++ b/code/framework/logback/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-meta-parent - 0.183.324 + 0.183.325 ../../meta-parent/pom.xml diff --git a/code/framework/managed-context/pom.xml b/code/framework/managed-context/pom.xml index e0d4506f90..ed04e897de 100644 --- a/code/framework/managed-context/pom.xml +++ b/code/framework/managed-context/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/metrics/pom.xml b/code/framework/metrics/pom.xml index b2366cc74c..4497a0681b 100644 --- a/code/framework/metrics/pom.xml +++ b/code/framework/metrics/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/module/pom.xml b/code/framework/module/pom.xml index e1ce4a0743..3a85aa5818 100644 --- a/code/framework/module/pom.xml +++ b/code/framework/module/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/object/pom.xml b/code/framework/object/pom.xml index 4f47bf37d7..15f3ca5d94 100644 --- a/code/framework/object/pom.xml +++ b/code/framework/object/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/pool/pom.xml b/code/framework/pool/pom.xml index ba3034bd85..35a2b1990e 100644 --- a/code/framework/pool/pom.xml +++ b/code/framework/pool/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/resource-monitor/pom.xml b/code/framework/resource-monitor/pom.xml index 4e980e2e2d..c9f63cd877 100644 --- a/code/framework/resource-monitor/pom.xml +++ b/code/framework/resource-monitor/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/schema/pom.xml b/code/framework/schema/pom.xml index 27d9ee902e..bd6496280c 100644 --- a/code/framework/schema/pom.xml +++ b/code/framework/schema/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/server/pom.xml b/code/framework/server/pom.xml index 9b631154fd..3d848d9816 100644 --- a/code/framework/server/pom.xml +++ b/code/framework/server/pom.xml @@ -4,7 +4,7 @@ cattle-meta-parent io.cattle - 0.183.324 + 0.183.325 ../../meta-parent/pom.xml diff --git a/code/framework/spring/pom.xml b/code/framework/spring/pom.xml index 0ed2b0dc31..9a10a3e522 100644 --- a/code/framework/spring/pom.xml +++ b/code/framework/spring/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/system-task/pom.xml b/code/framework/system-task/pom.xml index 8308912ec7..8b45675e7e 100644 --- a/code/framework/system-task/pom.xml +++ b/code/framework/system-task/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/token/pom.xml b/code/framework/token/pom.xml index 84afb417fd..99c650bda1 100644 --- a/code/framework/token/pom.xml +++ b/code/framework/token/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/framework/utils/pom.xml b/code/framework/utils/pom.xml index d25a2832ee..fb62bab719 100644 --- a/code/framework/utils/pom.xml +++ b/code/framework/utils/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/agent-instance/pom.xml b/code/iaas/agent-instance/pom.xml index 33238ddc4a..7a3e990d8c 100644 --- a/code/iaas/agent-instance/pom.xml +++ b/code/iaas/agent-instance/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/agent-server/pom.xml b/code/iaas/agent-server/pom.xml index 83ec4a4ba9..01dfcddc96 100644 --- a/code/iaas/agent-server/pom.xml +++ b/code/iaas/agent-server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/agent/pom.xml b/code/iaas/agent/pom.xml index accd03d0c0..059a3739db 100644 --- a/code/iaas/agent/pom.xml +++ b/code/iaas/agent/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/allocator/pom.xml b/code/iaas/allocator/pom.xml index 0837d646fd..261e64e705 100644 --- a/code/iaas/allocator/pom.xml +++ b/code/iaas/allocator/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/api-logic/pom.xml b/code/iaas/api-logic/pom.xml index a640d7a811..3b875e17ed 100644 --- a/code/iaas/api-logic/pom.xml +++ b/code/iaas/api-logic/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/api-logic/src/test/java/io/cattle/platform/api/resource/jooq/ProjectTemplateMutationAuthorizationTest.java b/code/iaas/api-logic/src/test/java/io/cattle/platform/api/resource/jooq/ProjectTemplateMutationAuthorizationTest.java new file mode 100644 index 0000000000..e4a14ba39b --- /dev/null +++ b/code/iaas/api-logic/src/test/java/io/cattle/platform/api/resource/jooq/ProjectTemplateMutationAuthorizationTest.java @@ -0,0 +1,103 @@ +package io.cattle.platform.api.resource.jooq; + +import static io.cattle.platform.core.model.tables.ProjectTemplateTable.PROJECT_TEMPLATE; +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertFalse; +import static org.junit.Assert.assertTrue; + +import io.cattle.platform.api.auth.Identity; +import io.cattle.platform.api.auth.Policy; +import io.cattle.platform.api.auth.impl.DefaultPolicy; +import io.cattle.platform.api.auth.impl.NoPolicyOptions; +import io.cattle.platform.object.meta.ObjectMetaDataManager; +import io.github.ibuildthecloud.gdapi.context.ApiContext; +import io.github.ibuildthecloud.gdapi.request.ApiRequest; + +import java.lang.reflect.Proxy; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; + +import org.jooq.Condition; +import org.junit.After; +import org.junit.Before; +import org.junit.Test; + +public class ProjectTemplateMutationAuthorizationTest { + + private final DefaultJooqResourceManager manager = new DefaultJooqResourceManager(); + private final Policy user = new DefaultPolicy(42L, 42L, "user42", + Collections.emptySet(), new NoPolicyOptions()); + private ApiRequest request; + + @Before + public void setUp() { + request = new ApiRequest(null, null); + ApiContext.newContext().setApiRequest(request); + manager.setMetaDataManager(ObjectMetaDataManager.class.cast(Proxy.newProxyInstance( + getClass().getClassLoader(), new Class[] { ObjectMetaDataManager.class }, + (proxy, method, args) -> { + if (!"convertFieldNameFor".equals(method.getName())) { + throw new UnsupportedOperationException(method.getName()); + } + if (ObjectMetaDataManager.ACCOUNT_FIELD.equals(args[1])) { + return PROJECT_TEMPLATE.ACCOUNT_ID; + } + if (ObjectMetaDataManager.PUBLIC_FIELD.equals(args[1])) { + return PROJECT_TEMPLATE.IS_PUBLIC; + } + return null; + }))); + } + + @After + public void tearDown() { + ApiContext.remove(); + } + + @Test + public void publicReadMayUsePublicOrOwnerCondition() { + request.setMethod("GET"); + Map criteria = criteria(user); + + assertFalse(criteria.containsKey(ObjectMetaDataManager.ACCOUNT_FIELD)); + assertTrue(criteria.containsKey(Condition.class)); + assertTrue(criteria.get(Condition.class).toString().contains("is_public")); + } + + @Test + public void directPutDeleteAndRemoveActionKeepOwnerCriterion() { + for (String method : new String[] { "PUT", "DELETE", "POST" }) { + request.setMethod(method); + request.setAction("POST".equals(method) ? "remove" : null); + Map criteria = criteria(user); + + assertEquals(method, 42L, criteria.get(ObjectMetaDataManager.ACCOUNT_FIELD)); + assertFalse(method, criteria.containsKey(Condition.class)); + } + } + + @Test + public void allAccountsAdminMayMutateAnyTemplate() { + request.setMethod("DELETE"); + Policy admin = new DefaultPolicy(1L, 1L, "admin", + Collections.emptySet(), new NoPolicyOptions()) { + @Override + public boolean isOption(String optionName) { + return Policy.LIST_ALL_ACCOUNTS.equals(optionName) + || Policy.AUTHORIZED_FOR_ALL_ACCOUNTS.equals(optionName); + } + }; + + Map criteria = criteria(admin); + + assertFalse(criteria.containsKey(ObjectMetaDataManager.ACCOUNT_FIELD)); + assertFalse(criteria.containsKey(Condition.class)); + } + + private Map criteria(Policy policy) { + Map criteria = new HashMap<>(); + manager.addAccountAuthorization(true, false, "projectTemplate", criteria, policy); + return criteria; + } +} diff --git a/code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/filter/projecttemplate/ProjectTemplateActionOutputFilterTest.java b/code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/filter/projecttemplate/ProjectTemplateActionOutputFilterTest.java index 7a64bd17be..409c1d9eaf 100644 --- a/code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/filter/projecttemplate/ProjectTemplateActionOutputFilterTest.java +++ b/code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/filter/projecttemplate/ProjectTemplateActionOutputFilterTest.java @@ -12,7 +12,7 @@ import io.github.ibuildthecloud.gdapi.context.ApiContext; import io.github.ibuildthecloud.gdapi.model.impl.ResourceImpl; -import java.net.URL; +import java.net.URI; import java.util.Collections; import org.junit.After; @@ -73,7 +73,7 @@ private static ProjectTemplateRecord template(Long accountId, boolean isPublic) private static ResourceImpl resourceWithRemove() throws Exception { ResourceImpl resource = new ResourceImpl(); - resource.getActions().put("remove", new URL("http://localhost/projecttemplates/1pt5?action=remove")); + resource.getActions().put("remove", URI.create("http://localhost/projecttemplates/1pt5?action=remove").toURL()); return resource; } diff --git a/code/iaas/archaius-management/pom.xml b/code/iaas/archaius-management/pom.xml index 2e9e22bb53..cfe49f3f31 100644 --- a/code/iaas/archaius-management/pom.xml +++ b/code/iaas/archaius-management/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/auth-logic/pom.xml b/code/iaas/auth-logic/pom.xml index 9802cf782e..71289228b5 100644 --- a/code/iaas/auth-logic/pom.xml +++ b/code/iaas/auth-logic/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/bootstrap/pom.xml b/code/iaas/bootstrap/pom.xml index 3273f11b97..22b636bb96 100644 --- a/code/iaas/bootstrap/pom.xml +++ b/code/iaas/bootstrap/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/config-item/api/pom.xml b/code/iaas/config-item/api/pom.xml index 8550a16022..c0c9e40c81 100644 --- a/code/iaas/config-item/api/pom.xml +++ b/code/iaas/config-item/api/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/iaas/config-item/common/pom.xml b/code/iaas/config-item/common/pom.xml index 7280cf473a..a2139a8591 100644 --- a/code/iaas/config-item/common/pom.xml +++ b/code/iaas/config-item/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/iaas/config-item/server/pom.xml b/code/iaas/config-item/server/pom.xml index 5909ad937d..df0d1739b7 100644 --- a/code/iaas/config-item/server/pom.xml +++ b/code/iaas/config-item/server/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/iaas/engine-jooq/pom.xml b/code/iaas/engine-jooq/pom.xml index 30b121a052..a0e2fab24e 100644 --- a/code/iaas/engine-jooq/pom.xml +++ b/code/iaas/engine-jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/events/pom.xml b/code/iaas/events/pom.xml index 814ddc2ae8..713ca2f8e5 100644 --- a/code/iaas/events/pom.xml +++ b/code/iaas/events/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/external-handler/pom.xml b/code/iaas/external-handler/pom.xml index 6ef2d12800..3c8efd9199 100644 --- a/code/iaas/external-handler/pom.xml +++ b/code/iaas/external-handler/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/ha/pom.xml b/code/iaas/ha/pom.xml index 9a6a533ad3..1e5e0594d9 100644 --- a/code/iaas/ha/pom.xml +++ b/code/iaas/ha/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/healthcheck/pom.xml b/code/iaas/healthcheck/pom.xml index 2c6fe8146d..4c7a9339d8 100644 --- a/code/iaas/healthcheck/pom.xml +++ b/code/iaas/healthcheck/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/labels/pom.xml b/code/iaas/labels/pom.xml index b3a91f2808..83809948ed 100644 --- a/code/iaas/labels/pom.xml +++ b/code/iaas/labels/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/logic-common/pom.xml b/code/iaas/logic-common/pom.xml index 96d5f2d3db..2cea613432 100644 --- a/code/iaas/logic-common/pom.xml +++ b/code/iaas/logic-common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/logic/pom.xml b/code/iaas/logic/pom.xml index 56ea50aea7..b99347094e 100644 --- a/code/iaas/logic/pom.xml +++ b/code/iaas/logic/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/metadata/pom.xml b/code/iaas/metadata/pom.xml index a7b0c062d9..98c2a5f68d 100644 --- a/code/iaas/metadata/pom.xml +++ b/code/iaas/metadata/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/model/pom.xml b/code/iaas/model/pom.xml index 278cd2d16a..e9655fb10b 100644 --- a/code/iaas/model/pom.xml +++ b/code/iaas/model/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/resource-pool/pom.xml b/code/iaas/resource-pool/pom.xml index c1fb115d81..e08cbbc8d7 100644 --- a/code/iaas/resource-pool/pom.xml +++ b/code/iaas/resource-pool/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/service-discovery/api/pom.xml b/code/iaas/service-discovery/api/pom.xml index e0e5ea1a4b..a76cc39e85 100644 --- a/code/iaas/service-discovery/api/pom.xml +++ b/code/iaas/service-discovery/api/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/iaas/service-discovery/server/pom.xml b/code/iaas/service-discovery/server/pom.xml index 577f6b2baa..242850772e 100644 --- a/code/iaas/service-discovery/server/pom.xml +++ b/code/iaas/service-discovery/server/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/iaas/ssh-common/pom.xml b/code/iaas/ssh-common/pom.xml index f9c9bf9fa0..4e8165c496 100644 --- a/code/iaas/ssh-common/pom.xml +++ b/code/iaas/ssh-common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/storage-service/pom.xml b/code/iaas/storage-service/pom.xml index 9c5c71393b..eaaf0a7a8f 100644 --- a/code/iaas/storage-service/pom.xml +++ b/code/iaas/storage-service/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/iaas/task-jooq/pom.xml b/code/iaas/task-jooq/pom.xml index 6fbdd3fa2c..ac36beb3da 100644 --- a/code/iaas/task-jooq/pom.xml +++ b/code/iaas/task-jooq/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/implementation/activity-log/pom.xml b/code/implementation/activity-log/pom.xml index 1bd316b10f..e0451cbe11 100644 --- a/code/implementation/activity-log/pom.xml +++ b/code/implementation/activity-log/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/implementation/agent-instance-impl/pom.xml b/code/implementation/agent-instance-impl/pom.xml index 815df8e01c..0293446e8e 100644 --- a/code/implementation/agent-instance-impl/pom.xml +++ b/code/implementation/agent-instance-impl/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml cattle-agent-instance-impl diff --git a/code/implementation/docker/api/pom.xml b/code/implementation/docker/api/pom.xml index b8eea03927..8a2c3da62d 100644 --- a/code/implementation/docker/api/pom.xml +++ b/code/implementation/docker/api/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/docker/common/pom.xml b/code/implementation/docker/common/pom.xml index 381fa612b4..9a3acc7dc0 100644 --- a/code/implementation/docker/common/pom.xml +++ b/code/implementation/docker/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/docker/compute/pom.xml b/code/implementation/docker/compute/pom.xml index b6d58a9464..1a4804c62e 100644 --- a/code/implementation/docker/compute/pom.xml +++ b/code/implementation/docker/compute/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/docker/machine/pom.xml b/code/implementation/docker/machine/pom.xml index 55898aaba5..8e6163fef4 100644 --- a/code/implementation/docker/machine/pom.xml +++ b/code/implementation/docker/machine/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/docker/storage/pom.xml b/code/implementation/docker/storage/pom.xml index c87cd8cc50..a3cec1f806 100644 --- a/code/implementation/docker/storage/pom.xml +++ b/code/implementation/docker/storage/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml @@ -21,12 +21,12 @@ io.cattle cattle-docker-common - 0.183.324 + 0.183.325 io.cattle cattle-iaas-allocator - 0.183.324 + 0.183.325 diff --git a/code/implementation/extension-api/pom.xml b/code/implementation/extension-api/pom.xml index 58b1b72227..58eb125f07 100644 --- a/code/implementation/extension-api/pom.xml +++ b/code/implementation/extension-api/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml cattle-extension-api diff --git a/code/implementation/hazelcast/common/pom.xml b/code/implementation/hazelcast/common/pom.xml index 4d9b014bdb..0260a6a68d 100644 --- a/code/implementation/hazelcast/common/pom.xml +++ b/code/implementation/hazelcast/common/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/hazelcast/eventing/pom.xml b/code/implementation/hazelcast/eventing/pom.xml index 54f7b80fd3..52e1d3dd03 100644 --- a/code/implementation/hazelcast/eventing/pom.xml +++ b/code/implementation/hazelcast/eventing/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/hazelcast/lock/pom.xml b/code/implementation/hazelcast/lock/pom.xml index 698341082d..854a6faa5b 100644 --- a/code/implementation/hazelcast/lock/pom.xml +++ b/code/implementation/hazelcast/lock/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/host-api/pom.xml b/code/implementation/host-api/pom.xml index 44c9bffda9..cb4c2f74b2 100644 --- a/code/implementation/host-api/pom.xml +++ b/code/implementation/host-api/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/implementation/host-stats/pom.xml b/code/implementation/host-stats/pom.xml index 47ddb29469..efeb3668cb 100644 --- a/code/implementation/host-stats/pom.xml +++ b/code/implementation/host-stats/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/implementation/register/pom.xml b/code/implementation/register/pom.xml index 5017467a2e..ec45f5bfed 100644 --- a/code/implementation/register/pom.xml +++ b/code/implementation/register/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/implementation/sample-setup/pom.xml b/code/implementation/sample-setup/pom.xml index c9d52adafe..97554f7852 100644 --- a/code/implementation/sample-setup/pom.xml +++ b/code/implementation/sample-setup/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/implementation/settings-api/pom.xml b/code/implementation/settings-api/pom.xml index 3b01350aa0..8a16b067a4 100644 --- a/code/implementation/settings-api/pom.xml +++ b/code/implementation/settings-api/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/implementation/simulator/agent-connection/pom.xml b/code/implementation/simulator/agent-connection/pom.xml index 13fb167aed..d747387ef8 100644 --- a/code/implementation/simulator/agent-connection/pom.xml +++ b/code/implementation/simulator/agent-connection/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/simulator/storage/pom.xml b/code/implementation/simulator/storage/pom.xml index 40d363711e..ebbdeaa073 100644 --- a/code/implementation/simulator/storage/pom.xml +++ b/code/implementation/simulator/storage/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../../parent/pom.xml diff --git a/code/implementation/system-stack/pom.xml b/code/implementation/system-stack/pom.xml index 106a8d9d15..34d8842869 100644 --- a/code/implementation/system-stack/pom.xml +++ b/code/implementation/system-stack/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/implementation/vm/pom.xml b/code/implementation/vm/pom.xml index 6c97d97aaf..7e8cf09db2 100644 --- a/code/implementation/vm/pom.xml +++ b/code/implementation/vm/pom.xml @@ -3,7 +3,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml cattle-vm diff --git a/code/meta-parent/pom.xml b/code/meta-parent/pom.xml index 87156b605b..992088d711 100644 --- a/code/meta-parent/pom.xml +++ b/code/meta-parent/pom.xml @@ -9,7 +9,7 @@ 4.0.0 io.cattle cattle-meta-parent - 0.183.324 + 0.183.325 pom PastureStack Orchestration Engine Compatibility orchestration engine for the PastureStack server. diff --git a/code/packaging/app-config/pom.xml b/code/packaging/app-config/pom.xml index 85844b551a..b5915bbad0 100644 --- a/code/packaging/app-config/pom.xml +++ b/code/packaging/app-config/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml jar diff --git a/code/packaging/app/pom.xml b/code/packaging/app/pom.xml index 90a8816084..b38ccd69ca 100644 --- a/code/packaging/app/pom.xml +++ b/code/packaging/app/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml war diff --git a/code/packaging/bundle/pom.xml b/code/packaging/bundle/pom.xml index b07fd5b472..c4cacfea26 100644 --- a/code/packaging/bundle/pom.xml +++ b/code/packaging/bundle/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/packaging/dev/pom.xml b/code/packaging/dev/pom.xml index dab4c1b1ff..3e6f1d6f3d 100644 --- a/code/packaging/dev/pom.xml +++ b/code/packaging/dev/pom.xml @@ -4,7 +4,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/packaging/meta/pom.xml b/code/packaging/meta/pom.xml index c846f236e1..92143a00f6 100644 --- a/code/packaging/meta/pom.xml +++ b/code/packaging/meta/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../../parent/pom.xml diff --git a/code/parent/pom.xml b/code/parent/pom.xml index 68ac9e2ba7..705d52b0d5 100644 --- a/code/parent/pom.xml +++ b/code/parent/pom.xml @@ -5,7 +5,7 @@ io.cattle cattle-meta-parent ../meta-parent/pom.xml - 0.183.324 + 0.183.325 pom diff --git a/docs/releases/orchestration-engine-0.183.324.md b/docs/releases/orchestration-engine-0.183.324.md index 5154518d6c..5b68a82e06 100644 --- a/docs/releases/orchestration-engine-0.183.324.md +++ b/docs/releases/orchestration-engine-0.183.324.md @@ -1,5 +1,8 @@ # Orchestration Engine 0.183.324 +This tag contains source only; no GitHub Release artifact was published. +The corrected packaging candidate is `0.183.325`. + This patch exposes `projectTemplate.isPublic` to non-admin API readers as a read-only field. The admin-only create and update permission for that field is unchanged. It also removes the misleading `remove` action link on a template diff --git a/docs/releases/orchestration-engine-0.183.325.md b/docs/releases/orchestration-engine-0.183.325.md new file mode 100644 index 0000000000..db27c19fd5 --- /dev/null +++ b/docs/releases/orchestration-engine-0.183.325.md @@ -0,0 +1,19 @@ +# Orchestration Engine 0.183.325 + +This release carries the ProjectTemplate API correction from the 0.183.324 source tag. +Non-admin v1 readers receive `projectTemplate.isPublic` as a read-only field; +the admin-only create and update permission is unchanged. Non-admin callers no +longer see a misleading `remove` action link on a template they do not own, +including public templates with `accountId: null`. Private owners and admins +retain the link. Direct mutation authorization remains subject to the existing +account policy. + +The `0.183.324` tag was not published as a GitHub Release because its source +hygiene gate detected a deprecated URL constructor in a new test. This release +uses the supported URI conversion in that test. There is no database migration +or new API field. Rolling back to `0.183.323` restores the previous response +shape and action-link behavior. + +Acceptance includes the focused schema and output-filter tests, the complete +Engine release gate, and verification of the resulting Server assembly before +rollout. diff --git a/pom.xml b/pom.xml index 1c4ef5d035..430f1991bc 100644 --- a/pom.xml +++ b/pom.xml @@ -3,7 +3,7 @@ io.cattle cattle-parent - 0.183.324 + 0.183.325 code/parent/pom.xml cattle diff --git a/resources/pom.xml b/resources/pom.xml index 9a151b79a4..39831163ff 100644 --- a/resources/pom.xml +++ b/resources/pom.xml @@ -4,7 +4,7 @@ cattle-parent io.cattle - 0.183.324 + 0.183.325 ../code/parent/pom.xml diff --git a/scripts/build b/scripts/build index c7398ba3a4..baf2565cd0 100755 --- a/scripts/build +++ b/scripts/build @@ -16,7 +16,7 @@ fi SOURCE_REVISION=${SOURCE_REVISION:-$(git rev-parse HEAD)} SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)} -ENGINE_VERSION=${ENGINE_VERSION:-0.183.324} +ENGINE_VERSION=${ENGINE_VERSION:-0.183.325} case "$SOURCE_REVISION" in ''|*[!0-9a-f]*) diff --git a/scripts/check-pasturestack-source b/scripts/check-pasturestack-source index cbd83a4dfc..b3d6bb7978 100755 --- a/scripts/check-pasturestack-source +++ b/scripts/check-pasturestack-source @@ -51,7 +51,7 @@ fi project_version=$(sed -n 's/^[[:space:]]*\([^<]*\)<\/version>[[:space:]]*$/\1/p' code/meta-parent/pom.xml | head -n 1) [[ "$project_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || fail non_numeric_project_version -require_line code/meta-parent/pom.xml ' 0.183.324' +require_line code/meta-parent/pom.xml ' 0.183.325' require_line code/meta-parent/pom.xml ' 2.3.35' require_line "$iaas_api_defaults" 'auth.service.external.id.types=github_user,github_org,github_team,shibboleth_user,shibboleth_group,ldap_user,ldap_group,oidc_user,oidc_group' require_line code/meta-parent/pom.xml ' https://github.com/PastureStack/orchestration-engine' @@ -177,6 +177,7 @@ require_line docs/releases/orchestration-engine-0.183.321.md 'Direct `projectMem require_line docs/releases/orchestration-engine-0.183.322.md 'A retried account purge resumes networks left in `removing` after their' require_line docs/releases/orchestration-engine-0.183.323.md 'This release updates FreeMarker from 2.3.34 to 2.3.35.' require_line docs/releases/orchestration-engine-0.183.324.md 'This patch exposes `projectTemplate.isPublic` to non-admin API readers as a' +require_line docs/releases/orchestration-engine-0.183.325.md 'This release carries the ProjectTemplate API correction from the 0.183.324 source tag.' require_line scripts/check-release-artifact 'python3 scripts/check-release-artifact-no-dev.py "$artifact"' require_line scripts/ci 'CI=true MAVEN_ARGS="${MAVEN_ARGS:-$DEFAULT_UNIT_MAVEN_ARGS}" MAVEN_TARGET="${MAVEN_TARGET:-clean package}" run ./build --release' require_line code/iaas/auth-logic/src/main/java/io/cattle/platform/iaas/api/auth/projects/ProjectMemberResourceManager.java ' if (projectMember == null || !CommonStatesConstants.ACTIVE.equals(projectMember.getState())' @@ -404,4 +405,4 @@ require_line README.md 'modernize the Rancher 1.6 ecosystem. It is not affiliate require_line README.md 'by Rancher Labs or SUSE.' require_line ORIGIN.md '- Preserved upstream boundary: `82d154a53f4089fecfb9f320caad826bb4f6055f`' -printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.324 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig network_driver_rollback=launch-config-restored stack_driver_rollback=child-launch-config-restored auth_token_session_binding=authorized-create-only auth_token_transport=bare-or-bearer-normalized auth_token_frozen_v1_schema=base-superadmin-token oidc_external_types=validated-before-mutation-owned-stable-account oidc_account_activation=sync-before-mfa oidc_v1_project_member_schema=core-options-merged-scoped oidc_identity_link_owner=explicit-and-verified legacy_token_link_repair=exact-match-only oidc_required_local_recovery=active-admin-only default_project=shared-idempotent-role-preserving,atomic-identity-set oidc_restricted_project_membership=stable-account-aware-required-allowlist-only mfa_policy_confirmation=actor-purpose-digest-single-use auth_config_proxy_identity=caller-platform-credential project_member_collection_acl=requested-project-checked-before-load network_purge=retry-removing dev_artifact=forbidden\n' +printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.325 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig network_driver_rollback=launch-config-restored stack_driver_rollback=child-launch-config-restored auth_token_session_binding=authorized-create-only auth_token_transport=bare-or-bearer-normalized auth_token_frozen_v1_schema=base-superadmin-token oidc_external_types=validated-before-mutation-owned-stable-account oidc_account_activation=sync-before-mfa oidc_v1_project_member_schema=core-options-merged-scoped oidc_identity_link_owner=explicit-and-verified legacy_token_link_repair=exact-match-only oidc_required_local_recovery=active-admin-only default_project=shared-idempotent-role-preserving,atomic-identity-set oidc_restricted_project_membership=stable-account-aware-required-allowlist-only mfa_policy_confirmation=actor-purpose-digest-single-use auth_config_proxy_identity=caller-platform-credential project_member_collection_acl=requested-project-checked-before-load network_purge=retry-removing dev_artifact=forbidden\n' diff --git a/scripts/check-release-artifact b/scripts/check-release-artifact index 0d1310da45..ca3db808fd 100755 --- a/scripts/check-release-artifact +++ b/scripts/check-release-artifact @@ -4,7 +4,7 @@ set -euo pipefail cd "$(dirname "$0")/.." artifact=${1:-dist/artifacts/cattle.jar} -expected_version=${EXPECTED_ENGINE_VERSION:-0.183.324} +expected_version=${EXPECTED_ENGINE_VERSION:-0.183.325} test -f "$artifact" artifact=$(realpath "$artifact")