ivan-igorevich/mdm-ordinis
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
917 Commits 1 Branch 0 Tags
0ecec0be8030857de96b2e2a6fa8393299081eea
Commit Graph

917 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Александр Зимин 0ecec0be80 Merge branch 'feat/dict-deletion-approval-workflow' into 'main' 
feat(dict): soft-delete с recovery (Phase 1)

See merge request 2-6/2-6-4/terravault/ordinis!296
 2026-06-08 14:27:34 +00:00
Александр Зимин 0ccdff95d2 feat(dict): soft-delete с recovery (Phase 1) 2026-06-08 14:27:34 +00:00
semantic-release-bot 4516559e21 chore(release): v2.52.0 
## [2.52.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.51.1...v2.52.0) (2026-06-08)

### ✨ Features

* **dict:** delete dictionary endpoint + UI button с cascade safety ([5c6801f](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/5c6801f993a34cfa43e71419807250973ce376ac))

### 🐛 Fixes

* **ci:** release не зависит от deploy-staging — unblock tag chain ([1a420b4](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/1a420b428f333034e75d8980cf2e59e015466adc))
* **schema:** FK target field — select из реальной схемы вместо free-form ([bfe5142](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/bfe5142bbae19f2d537eb2f2c62e5c29e666d173))
* **ui:** delete dict modal — destructive вместо invalid mars/danger ([6392621](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/6392621199fd58546893c611a15b32613137246e))

### 📝 Docs

* **changelog:** public release notes v2.45.3 → v2.52.0 ([082eb88](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/082eb88e7e164630b226a5a23f5ec9594ca485a8))
 2026-06-08 11:08:15 +00:00
Александр Зимин f433686191 Merge branch 'fix/release-no-staging-dep' into 'main' 
fix(ci): release не зависит от deploy-staging — unblock tag chain

See merge request 2-6/2-6-4/terravault/ordinis!295
 2026-06-08 10:59:15 +00:00
Александр Зимин 1a420b428f fix(ci): release не зависит от deploy-staging — unblock tag chain 2026-06-08 10:59:15 +00:00
Александр Зимин 6242a771ec Merge branch 'fix/delete-dict-button-colors' into 'main' 
fix(ui): delete dict modal — destructive вместо invalid mars/danger

See merge request 2-6/2-6-4/terravault/ordinis!294
 2026-06-08 10:08:53 +00:00
Александр Зимин 6392621199 fix(ui): delete dict modal — destructive вместо invalid mars/danger 2026-06-08 10:08:53 +00:00
Александр Зимин 419d9fd821 Merge branch 'docs/changelog-public-2.45-2.52' into 'main' 
docs(changelog): public release notes v2.45.3 → v2.52.0

See merge request 2-6/2-6-4/terravault/ordinis!293
 2026-06-08 09:29:03 +00:00
Александр Зимин 082eb88e7e docs(changelog): public release notes v2.45.3 → v2.52.0 2026-06-08 09:29:03 +00:00
Александр Зимин bfd42a0633 Merge branch 'feat/delete-dictionary' into 'main' 
feat(dict): delete dictionary endpoint + UI button с cascade safety

See merge request 2-6/2-6-4/terravault/ordinis!292
 2026-06-05 09:47:05 +00:00
Александр Зимин 5c6801f993 feat(dict): delete dictionary endpoint + UI button с cascade safety 2026-06-05 09:47:05 +00:00
Александр Зимин cdffa4261c Merge branch 'fix/schema-fk-target-field-select' into 'main' 
fix(schema): FK target field — select из реальной схемы вместо free-form

See merge request 2-6/2-6-4/terravault/ordinis!291
 2026-06-04 15:24:55 +00:00
Александр Зимин bfe5142bba fix(schema): FK target field — select из реальной схемы вместо free-form 2026-06-04 15:24:55 +00:00
semantic-release-bot 48a1fd5f48 chore(release): v2.51.1 
## [2.51.1](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.51.0...v2.51.1) (2026-06-02)

### 🐛 Fixes

* **reviews:** admin может self-approve record draft через UI ([308c910](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/308c9104e9636d0b13342f3e4611005589e1e002))
 2026-06-02 13:18:24 +00:00
Александр Зимин 71f1c2172c Merge branch 'fix/admin-self-approve-frontend' into 'main' 
fix(reviews): admin может self-approve record draft через UI

See merge request 2-6/2-6-4/terravault/ordinis!290
 2026-06-02 13:02:13 +00:00
Александр Зимин 308c9104e9 fix(reviews): admin может self-approve record draft через UI 2026-06-02 13:02:13 +00:00
semantic-release-bot 039b6ef039 chore(release): v2.51.0 
## [2.51.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.50.0...v2.51.0) (2026-06-02)

### ✨ Features

* **layout:** убрать max-w-7xl на root — full width на больших экранах ([ff18a3a](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/ff18a3aa720824314bc2354d36acfd8220df58a8))
 2026-06-02 12:55:05 +00:00
Александр Зимин 1387ff3906 Merge branch 'feat/wide-screen-layout' into 'main' 
feat(layout): убрать max-w-7xl на root — full width на больших экранах

See merge request 2-6/2-6-4/terravault/ordinis!289
 2026-06-02 12:38:11 +00:00
Александр Зимин ff18a3aa72 feat(layout): убрать max-w-7xl на root — full width на больших экранах 2026-06-02 12:38:10 +00:00
semantic-release-bot 4f16669f2b chore(release): v2.50.0 
## [2.50.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.49.0...v2.50.0) (2026-06-02)

### ✨ Features

* **dict:** таблица справочника — hide tail columns по умолчанию (без H-scroll) ([b619071](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/b6190713e4e472b0aa1a9f26592b537920b8df8b))

### 🐛 Fixes

* **dict:** default-hide для existing users (v=2 storage) + sticky header/pagination ([fece673](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/fece673017b5fbae0035f275cabba14f3d06879c))
 2026-06-02 12:35:11 +00:00
Александр Зимин dee90a7ecf Merge branch 'fix/dict-table-default-hide-existing-users' into 'main' 
fix(dict): default-hide для existing users (v=2 storage) + sticky header/pagination

See merge request 2-6/2-6-4/terravault/ordinis!288
 2026-06-02 12:22:19 +00:00
Александр Зимин fece673017 fix(dict): default-hide для existing users (v=2 storage) + sticky header/pagination 2026-06-02 12:22:19 +00:00
Александр Зимин f7fcb316bd Merge branch 'feat/dict-table-default-hide-extras' into 'main' 
feat(dict): таблица справочника — hide tail columns по умолчанию (без H-scroll)

See merge request 2-6/2-6-4/terravault/ordinis!287
 2026-06-02 12:14:00 +00:00
Александр Зимин b6190713e4 feat(dict): таблица справочника — hide tail columns по умолчанию (без H-scroll) 2026-06-02 12:14:00 +00:00
semantic-release-bot 071315b058 chore(release): v2.49.0 
## [2.49.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.48.0...v2.49.0) (2026-06-02)

### ✨ Features

* **dict:** таблица справочника — все scalar поля схемы в pool колонок ([65f5dbd](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/65f5dbd48b5be5df612a74e834a5ae482bcced7e))

### 🐛 Fixes

* **approve:** retry на Postgres SERIALIZABLE 40001 (массовый approve drafts) ([30506b0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/30506b0cc4f7c52ddbcd47a8960c720117115098))
 2026-06-02 12:08:28 +00:00
Александр Зимин d8fdcea1db Merge branch 'fix/approve-serializable-retry' into 'main' 
fix(approve): retry на Postgres SERIALIZABLE 40001 (массовый approve drafts)

See merge request 2-6/2-6-4/terravault/ordinis!286
 2026-06-02 11:56:03 +00:00
Александр Зимин 30506b0cc4 fix(approve): retry на Postgres SERIALIZABLE 40001 (массовый approve drafts) 2026-06-02 11:56:03 +00:00
Александр Зимин 6ba32f21ad Merge branch 'feat/dict-table-all-schema-cols' into 'main' 
feat(dict): таблица справочника — все scalar поля схемы в pool колонок

See merge request 2-6/2-6-4/terravault/ordinis!285
 2026-06-02 11:50:16 +00:00
Александр Зимин 65f5dbd48b feat(dict): таблица справочника — все scalar поля схемы в pool колонок 2026-06-02 11:50:16 +00:00
semantic-release-bot 4510d7cc6f chore(release): v2.48.0 
## [2.48.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.47.0...v2.48.0) (2026-06-02)

### ✨ Features

* **ui:** RecordDrawer wide-mode default по viewport ([010f71e](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/010f71e44d0caf9768c295bde3afa45593767bb3))

### 🐛 Fixes

* **bundle:** semver-aware schema update — не откатывать user-published ([39e24a6](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/39e24a6d0130fc29019d3347c92f0b431a7ca0e9))
 2026-06-02 11:26:08 +00:00
Александр Зимин b9056fdef2 Merge branch 'feat/drawer-wide-default-by-viewport' into 'main' 
feat(ui): RecordDrawer wide-mode default по viewport

See merge request 2-6/2-6-4/terravault/ordinis!284
 2026-06-02 11:14:48 +00:00
Александр Зимин 010f71e44d feat(ui): RecordDrawer wide-mode default по viewport 2026-06-02 11:14:48 +00:00
Александр Зимин e980be2024 Merge branch 'fix/bundle-importer-no-rollback' into 'main' 
fix(bundle): semver-aware schema update — не откатывать user-published

See merge request 2-6/2-6-4/terravault/ordinis!283
 2026-06-02 11:11:53 +00:00
Александр Зимин 39e24a6d01 fix(bundle): semver-aware schema update — не откатывать user-published 2026-06-02 11:11:53 +00:00
semantic-release-bot c892f30b3e chore(release): v2.47.0 
## [2.47.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.46.1...v2.47.0) (2026-06-02)

### ✨ Features

* **ui:** dict table column sort + visibility toggle (localStorage) ([c2e7dd0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/c2e7dd0c87113868f4b4b8c02936ae5cd894c450))
 2026-06-02 11:04:14 +00:00
Александр Зимин 385effe773 Merge branch 'feat/dict-table-sort-columns' into 'main' 
feat(ui): dict table column sort + visibility toggle (localStorage)

See merge request 2-6/2-6-4/terravault/ordinis!282
 2026-06-02 10:58:59 +00:00
Александр Зимин c2e7dd0c87 feat(ui): dict table column sort + visibility toggle (localStorage) 2026-06-02 10:58:59 +00:00
semantic-release-bot c20ffb6dee chore(release): v2.46.1 
## [2.46.1](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.46.0...v2.46.1) (2026-06-02)

### 🐛 Fixes

* **workflow:** drop DB self-approve constraints (unblock admin override) ([ba76704](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/ba767045a494837c5aa95439db2fc9e3573ed592))
 2026-06-02 09:27:23 +00:00
Александр Зимин da7d4c489c Merge branch 'fix/drop-self-approve-db-constraints' into 'main' 
fix(workflow): drop DB self-approve constraints (unblock admin override)

See merge request 2-6/2-6-4/terravault/ordinis!281
 2026-06-02 09:13:23 +00:00
Александр Зимин ba767045a4 fix(workflow): drop DB self-approve constraints (unblock admin override) 2026-06-02 09:13:23 +00:00
semantic-release-bot ff0fd1e3e9 chore(release): v2.46.0 
## [2.46.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.45.3...v2.46.0) (2026-06-01)

### ✨ Features

* **workflow:** admin self-approve override (D3 relaxation для small teams) ([ba49854](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/ba49854a612aae10e9a1dacb1f020dfe36eefed7))
 2026-06-01 18:55:37 +00:00
Александр Зимин 11d273c608 Merge branch 'feat/admin-self-approve' into 'main' 
feat(workflow): admin self-approve override (D3 relaxation для small teams)

See merge request 2-6/2-6-4/terravault/ordinis!280
 2026-06-01 18:46:15 +00:00
Александр Зимин ba49854a61 feat(workflow): admin self-approve override (D3 relaxation для small teams) 2026-06-01 18:46:15 +00:00
semantic-release-bot 41466123cd chore(release): v2.45.3 
## [2.45.3](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.45.2...v2.45.3) (2026-05-27)

### 🐛 Fixes

* **security:** CSO findings — non-root containers + .env gitignore + actuator hardening ([7abff8f](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/7abff8f73ff9a042a5d03b81654827eb427fa981)), closes [#1](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/issues/1) [#2](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/issues/2) [#3](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/issues/3)
 2026-05-27 16:15:25 +00:00
Александр Зимин b84df0441e Merge branch 'fix/security-hardening' into 'main' 
fix(security): CSO findings #1-3 — non-root containers + .env gitignore + actuator hardening

See merge request 2-6/2-6-4/terravault/ordinis!279
 2026-05-27 16:05:50 +00:00
Zimin A.N. 7abff8f73f fix(security): CSO findings — non-root containers + .env gitignore + actuator hardening 
Три прямых фикса по /cso security audit на v2.45.2:

## Finding #1 (HIGH): Backend containers run as root

ordinis-app / ordinis-read-api / ordinis-projection-writer Dockerfile'ы
запускали JVM от root (eclipse-temurin:21-jre default'но не задаёт USER).
Compromise через Spring CVE / Jackson deserialization → root-в-контейнере
= escalation surface на ноду через любой pod misconfig.

Добавлено: `RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app
-s /sbin/nologin app` + `USER app`. UID 10001 — outside system (0-999)
и distribution reserved (1000-9999). `--chown=app:app` на COPY чтобы
JVM могла прочитать jar.

ordinis-migrations (USER liquibase) и docs (nginx default) уже non-root.

## Finding #2 (HIGH): .env / .env.local not in .gitignore

`.gitignore` блокировал *.pem, *.key, .gstack/, .claude/ — но не .env.
Развработчик с realный dotenv для local dev мог случайно `git add .` и
закоммитить creds. Сейчас нет committed .env (verified) но защита нулевая.

Добавлено: `.env`, `.env.local`, `.env.*.local`, `*.env` + whitelist
`!.env.example`, `!.env.template`, `!.env.sample` для шаблонов.

Существующий tracked `ordinis-admin-ui/.env.example` остался tracked
(verified `git ls-files | grep .env.example`).

## Finding #3 (MEDIUM): Spring Actuator permitAll() — defense-in-depth gap

SecurityConfig had `requestMatchers("/actuator/**").permitAll()` →
любой pod в кластере мог `curl ordinis-app:8080/actuator/env` и
получить ORDINIS_KEYCLOAK_ADMIN_CLIENT_SECRET, DB creds и пр.

VERIFIED: nginx ingress на проде НЕ проксирует /actuator/* (SPA fallback
отдаёт index.html), так что не exposed на интернет. Но pod-to-pod в
кластере = открыто.

Defense in two layers:

1. SecurityConfig: split actuator routes —
     /actuator/health/**, /actuator/info, /actuator/prometheus → permitAll
     /actuator/**                                              → denyAll
   Probes/Prometheus scrape работают, остальное блок.

2. application.yml для всех трёх Spring apps: narrowed default exposure
   to "health,info,prometheus". Поддерживается env override
   MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE для staging diagnostic
   (включить env/configprops/loggers только когда нужно дебажить
   autoconfig).

## Тесты

- mvn package — все 15 модулей SUCCESS
- ordinis-rest-api + ordinis-auth tests — SUCCESS

## Manual verify post-deploy

После пророллится v2.45.3:
- staging+prod liveness/readiness probes должны остаться зелёными
  (/actuator/health/{liveness,readiness} в permitAll list).
- Prometheus scrape /actuator/prometheus → 200.
- ssh pod && curl localhost:8080/actuator/env → должен вернуть
  401/403 (или 404 если endpoint вообще выключен через exposure).

## Откат

Если probes сломаются (маловероятно — health endpoints whitelisted) —
revert этого MR. Image rollback к v2.45.2 через helm.
 2026-05-27 19:02:34 +03:00
Александр Зимин d031743159 Merge branch 'chore/a11y-sweep' into 'main' 
chore(ui): a11y touch-targets sweep + useUserDisplay JSDoc refresh

See merge request 2-6/2-6-4/terravault/ordinis!278
 2026-05-27 15:49:17 +00:00
Александр Зимин c1a006765f chore(ui): a11y touch-targets sweep + useUserDisplay JSDoc refresh 2026-05-27 15:49:17 +00:00
semantic-release-bot 2868e8635a chore(release): v2.45.2 
## [2.45.2](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.45.1...v2.45.2) (2026-05-26)

### 🐛 Fixes

* **auth:** зачистить остатки auth.nstart.space → altum.nstart.cloud ([c1aaf6a](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/c1aaf6a696050678d7b2edacde1f1150647b1a00))
 2026-05-26 13:26:20 +00:00
Александр Зимин 58df9917c8 Merge branch 'fix/strip-nstart-realm-refs' into 'main' 
fix(auth): зачистить остатки auth.nstart.space → altum.nstart.cloud

See merge request 2-6/2-6-4/terravault/ordinis!277
 2026-05-26 13:17:58 +00:00