ivan-igorevich/mdm-ordinis
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
900 Commits 1 Branch 0 Tags
1387ff390612ecc7f83affa08250c7a660095e04
Commit Graph

900 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Александр Зимин 1387ff3906 Merge branch 'feat/wide-screen-layout' into 'main' 
feat(layout): убрать max-w-7xl на root — full width на больших экранах

See merge request 2-6/2-6-4/terravault/ordinis!289
 2026-06-02 12:38:11 +00:00
Александр Зимин ff18a3aa72 feat(layout): убрать max-w-7xl на root — full width на больших экранах 2026-06-02 12:38:10 +00:00
semantic-release-bot 4f16669f2b chore(release): v2.50.0 
## [2.50.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.49.0...v2.50.0) (2026-06-02)

### ✨ Features

* **dict:** таблица справочника — hide tail columns по умолчанию (без H-scroll) ([b619071](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/b6190713e4e472b0aa1a9f26592b537920b8df8b))

### 🐛 Fixes

* **dict:** default-hide для existing users (v=2 storage) + sticky header/pagination ([fece673](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/fece673017b5fbae0035f275cabba14f3d06879c))
 2026-06-02 12:35:11 +00:00
Александр Зимин dee90a7ecf Merge branch 'fix/dict-table-default-hide-existing-users' into 'main' 
fix(dict): default-hide для existing users (v=2 storage) + sticky header/pagination

See merge request 2-6/2-6-4/terravault/ordinis!288
 2026-06-02 12:22:19 +00:00
Александр Зимин fece673017 fix(dict): default-hide для existing users (v=2 storage) + sticky header/pagination 2026-06-02 12:22:19 +00:00
Александр Зимин f7fcb316bd Merge branch 'feat/dict-table-default-hide-extras' into 'main' 
feat(dict): таблица справочника — hide tail columns по умолчанию (без H-scroll)

See merge request 2-6/2-6-4/terravault/ordinis!287
 2026-06-02 12:14:00 +00:00
Александр Зимин b6190713e4 feat(dict): таблица справочника — hide tail columns по умолчанию (без H-scroll) 2026-06-02 12:14:00 +00:00
semantic-release-bot 071315b058 chore(release): v2.49.0 
## [2.49.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.48.0...v2.49.0) (2026-06-02)

### ✨ Features

* **dict:** таблица справочника — все scalar поля схемы в pool колонок ([65f5dbd](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/65f5dbd48b5be5df612a74e834a5ae482bcced7e))

### 🐛 Fixes

* **approve:** retry на Postgres SERIALIZABLE 40001 (массовый approve drafts) ([30506b0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/30506b0cc4f7c52ddbcd47a8960c720117115098))
 2026-06-02 12:08:28 +00:00
Александр Зимин d8fdcea1db Merge branch 'fix/approve-serializable-retry' into 'main' 
fix(approve): retry на Postgres SERIALIZABLE 40001 (массовый approve drafts)

See merge request 2-6/2-6-4/terravault/ordinis!286
 2026-06-02 11:56:03 +00:00
Александр Зимин 30506b0cc4 fix(approve): retry на Postgres SERIALIZABLE 40001 (массовый approve drafts) 2026-06-02 11:56:03 +00:00
Александр Зимин 6ba32f21ad Merge branch 'feat/dict-table-all-schema-cols' into 'main' 
feat(dict): таблица справочника — все scalar поля схемы в pool колонок

See merge request 2-6/2-6-4/terravault/ordinis!285
 2026-06-02 11:50:16 +00:00
Александр Зимин 65f5dbd48b feat(dict): таблица справочника — все scalar поля схемы в pool колонок 2026-06-02 11:50:16 +00:00
semantic-release-bot 4510d7cc6f chore(release): v2.48.0 
## [2.48.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.47.0...v2.48.0) (2026-06-02)

### ✨ Features

* **ui:** RecordDrawer wide-mode default по viewport ([010f71e](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/010f71e44d0caf9768c295bde3afa45593767bb3))

### 🐛 Fixes

* **bundle:** semver-aware schema update — не откатывать user-published ([39e24a6](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/39e24a6d0130fc29019d3347c92f0b431a7ca0e9))
 2026-06-02 11:26:08 +00:00
Александр Зимин b9056fdef2 Merge branch 'feat/drawer-wide-default-by-viewport' into 'main' 
feat(ui): RecordDrawer wide-mode default по viewport

See merge request 2-6/2-6-4/terravault/ordinis!284
 2026-06-02 11:14:48 +00:00
Александр Зимин 010f71e44d feat(ui): RecordDrawer wide-mode default по viewport 2026-06-02 11:14:48 +00:00
Александр Зимин e980be2024 Merge branch 'fix/bundle-importer-no-rollback' into 'main' 
fix(bundle): semver-aware schema update — не откатывать user-published

See merge request 2-6/2-6-4/terravault/ordinis!283
 2026-06-02 11:11:53 +00:00
Александр Зимин 39e24a6d01 fix(bundle): semver-aware schema update — не откатывать user-published 2026-06-02 11:11:53 +00:00
semantic-release-bot c892f30b3e chore(release): v2.47.0 
## [2.47.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.46.1...v2.47.0) (2026-06-02)

### ✨ Features

* **ui:** dict table column sort + visibility toggle (localStorage) ([c2e7dd0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/c2e7dd0c87113868f4b4b8c02936ae5cd894c450))
 2026-06-02 11:04:14 +00:00
Александр Зимин 385effe773 Merge branch 'feat/dict-table-sort-columns' into 'main' 
feat(ui): dict table column sort + visibility toggle (localStorage)

See merge request 2-6/2-6-4/terravault/ordinis!282
 2026-06-02 10:58:59 +00:00
Александр Зимин c2e7dd0c87 feat(ui): dict table column sort + visibility toggle (localStorage) 2026-06-02 10:58:59 +00:00
semantic-release-bot c20ffb6dee chore(release): v2.46.1 
## [2.46.1](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.46.0...v2.46.1) (2026-06-02)

### 🐛 Fixes

* **workflow:** drop DB self-approve constraints (unblock admin override) ([ba76704](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/ba767045a494837c5aa95439db2fc9e3573ed592))
 2026-06-02 09:27:23 +00:00
Александр Зимин da7d4c489c Merge branch 'fix/drop-self-approve-db-constraints' into 'main' 
fix(workflow): drop DB self-approve constraints (unblock admin override)

See merge request 2-6/2-6-4/terravault/ordinis!281
 2026-06-02 09:13:23 +00:00
Александр Зимин ba767045a4 fix(workflow): drop DB self-approve constraints (unblock admin override) 2026-06-02 09:13:23 +00:00
semantic-release-bot ff0fd1e3e9 chore(release): v2.46.0 
## [2.46.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.45.3...v2.46.0) (2026-06-01)

### ✨ Features

* **workflow:** admin self-approve override (D3 relaxation для small teams) ([ba49854](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/ba49854a612aae10e9a1dacb1f020dfe36eefed7))
 2026-06-01 18:55:37 +00:00
Александр Зимин 11d273c608 Merge branch 'feat/admin-self-approve' into 'main' 
feat(workflow): admin self-approve override (D3 relaxation для small teams)

See merge request 2-6/2-6-4/terravault/ordinis!280
 2026-06-01 18:46:15 +00:00
Александр Зимин ba49854a61 feat(workflow): admin self-approve override (D3 relaxation для small teams) 2026-06-01 18:46:15 +00:00
semantic-release-bot 41466123cd chore(release): v2.45.3 
## [2.45.3](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.45.2...v2.45.3) (2026-05-27)

### 🐛 Fixes

* **security:** CSO findings — non-root containers + .env gitignore + actuator hardening ([7abff8f](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/7abff8f73ff9a042a5d03b81654827eb427fa981)), closes [#1](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/issues/1) [#2](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/issues/2) [#3](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/issues/3)
 2026-05-27 16:15:25 +00:00
Александр Зимин b84df0441e Merge branch 'fix/security-hardening' into 'main' 
fix(security): CSO findings #1-3 — non-root containers + .env gitignore + actuator hardening

See merge request 2-6/2-6-4/terravault/ordinis!279
 2026-05-27 16:05:50 +00:00
Zimin A.N. 7abff8f73f fix(security): CSO findings — non-root containers + .env gitignore + actuator hardening 
Три прямых фикса по /cso security audit на v2.45.2:

## Finding #1 (HIGH): Backend containers run as root

ordinis-app / ordinis-read-api / ordinis-projection-writer Dockerfile'ы
запускали JVM от root (eclipse-temurin:21-jre default'но не задаёт USER).
Compromise через Spring CVE / Jackson deserialization → root-в-контейнере
= escalation surface на ноду через любой pod misconfig.

Добавлено: `RUN groupadd -r -g 10001 app && useradd -r -u 10001 -g app
-s /sbin/nologin app` + `USER app`. UID 10001 — outside system (0-999)
и distribution reserved (1000-9999). `--chown=app:app` на COPY чтобы
JVM могла прочитать jar.

ordinis-migrations (USER liquibase) и docs (nginx default) уже non-root.

## Finding #2 (HIGH): .env / .env.local not in .gitignore

`.gitignore` блокировал *.pem, *.key, .gstack/, .claude/ — но не .env.
Развработчик с realный dotenv для local dev мог случайно `git add .` и
закоммитить creds. Сейчас нет committed .env (verified) но защита нулевая.

Добавлено: `.env`, `.env.local`, `.env.*.local`, `*.env` + whitelist
`!.env.example`, `!.env.template`, `!.env.sample` для шаблонов.

Существующий tracked `ordinis-admin-ui/.env.example` остался tracked
(verified `git ls-files | grep .env.example`).

## Finding #3 (MEDIUM): Spring Actuator permitAll() — defense-in-depth gap

SecurityConfig had `requestMatchers("/actuator/**").permitAll()` →
любой pod в кластере мог `curl ordinis-app:8080/actuator/env` и
получить ORDINIS_KEYCLOAK_ADMIN_CLIENT_SECRET, DB creds и пр.

VERIFIED: nginx ingress на проде НЕ проксирует /actuator/* (SPA fallback
отдаёт index.html), так что не exposed на интернет. Но pod-to-pod в
кластере = открыто.

Defense in two layers:

1. SecurityConfig: split actuator routes —
     /actuator/health/**, /actuator/info, /actuator/prometheus → permitAll
     /actuator/**                                              → denyAll
   Probes/Prometheus scrape работают, остальное блок.

2. application.yml для всех трёх Spring apps: narrowed default exposure
   to "health,info,prometheus". Поддерживается env override
   MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE для staging diagnostic
   (включить env/configprops/loggers только когда нужно дебажить
   autoconfig).

## Тесты

- mvn package — все 15 модулей SUCCESS
- ordinis-rest-api + ordinis-auth tests — SUCCESS

## Manual verify post-deploy

После пророллится v2.45.3:
- staging+prod liveness/readiness probes должны остаться зелёными
  (/actuator/health/{liveness,readiness} в permitAll list).
- Prometheus scrape /actuator/prometheus → 200.
- ssh pod && curl localhost:8080/actuator/env → должен вернуть
  401/403 (или 404 если endpoint вообще выключен через exposure).

## Откат

Если probes сломаются (маловероятно — health endpoints whitelisted) —
revert этого MR. Image rollback к v2.45.2 через helm.
 2026-05-27 19:02:34 +03:00
Александр Зимин d031743159 Merge branch 'chore/a11y-sweep' into 'main' 
chore(ui): a11y touch-targets sweep + useUserDisplay JSDoc refresh

See merge request 2-6/2-6-4/terravault/ordinis!278
 2026-05-27 15:49:17 +00:00
Александр Зимин c1a006765f chore(ui): a11y touch-targets sweep + useUserDisplay JSDoc refresh 2026-05-27 15:49:17 +00:00
semantic-release-bot 2868e8635a chore(release): v2.45.2 
## [2.45.2](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.45.1...v2.45.2) (2026-05-26)

### 🐛 Fixes

* **auth:** зачистить остатки auth.nstart.space → altum.nstart.cloud ([c1aaf6a](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/c1aaf6a696050678d7b2edacde1f1150647b1a00))
 2026-05-26 13:26:20 +00:00
Александр Зимин 58df9917c8 Merge branch 'fix/strip-nstart-realm-refs' into 'main' 
fix(auth): зачистить остатки auth.nstart.space → altum.nstart.cloud

See merge request 2-6/2-6-4/terravault/ordinis!277
 2026-05-26 13:17:58 +00:00
Александр Зимин c1aaf6a696 fix(auth): зачистить остатки auth.nstart.space → altum.nstart.cloud 2026-05-26 13:17:58 +00:00
Александр Зимин d1b4916605 Merge branch 'chore/phase3-prep-org-id' into 'main' 
chore(auth): Phase 3 cheap prep — nullable org_id + OrgContext skeleton

See merge request 2-6/2-6-4/terravault/ordinis!276
 2026-05-26 13:01:36 +00:00
Александр Зимин 2c251311f5 chore(auth): Phase 3 cheap prep — nullable org_id + OrgContext skeleton 2026-05-26 13:01:36 +00:00
Александр Зимин 9144b2d1d1 Merge branch 'chore/cleanup-tokensync-jsdoc' into 'main' 
chore(ui): убрать упоминание TokenSync из RequireAuth JSDoc

See merge request 2-6/2-6-4/terravault/ordinis!275
 2026-05-26 12:37:17 +00:00
semantic-release-bot 16559a8488 chore(release): v2.45.1 
## [2.45.1](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.45.0...v2.45.1) (2026-05-26)

### 🐛 Fixes

* **auth:** иерархическое расширение scope set в ScopeContext ([6977ba1](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/6977ba106dbb81e9a735edafb1224f8799c47c35))
 2026-05-26 12:33:43 +00:00
Zimin A.N. 03973a943e chore(ui): убрать упоминание TokenSync из RequireAuth JSDoc 
TokenSync.tsx был удалён в Phase 1a (keycloak-js migration, MR !270).
В JSDoc на RequireAuth.tsx осталась ссылка на его поведение —
обновляем описание под текущую модель: apiClient request interceptor
+ ensureFreshToken на 401 (см. api/client.ts:64).

Минор-долг из checkpoint'а keycloak-js-altum-migration.
 2026-05-26 15:28:24 +03:00
Александр Зимин 902218dbf3 Merge branch 'fix/scope-hierarchy' into 'main' 
fix(auth): иерархическое расширение scope set в ScopeContext

See merge request 2-6/2-6-4/terravault/ordinis!274
 2026-05-26 12:25:14 +00:00
Александр Зимин 6977ba106d fix(auth): иерархическое расширение scope set в ScopeContext 2026-05-26 12:25:14 +00:00
semantic-release-bot 90a6c1185e chore(release): v2.45.0 
## [2.45.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.44.1...v2.45.0) (2026-05-26)

### ✨ Features

* **auth:** Phase 2 — audited-users UserPicker + Tier-3 Keycloak Admin lookup ([a4ba873](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/a4ba8735d0e03b1e867c648bc8fb9ee059aa5c8f))
 2026-05-26 12:09:48 +00:00
Александр Зимин f38b2b668d Merge branch 'feat/phase2-direct-kc-admin' into 'main' 
feat(auth): Phase 2 — audited-users UserPicker + Tier-3 Keycloak Admin lookup

See merge request 2-6/2-6-4/terravault/ordinis!272
 2026-05-26 12:01:10 +00:00
Александр Зимин a4ba8735d0 feat(auth): Phase 2 — audited-users UserPicker + Tier-3 Keycloak Admin lookup 2026-05-26 12:01:09 +00:00
semantic-release-bot bd3798ffa8 chore(release): v2.44.1 
## [2.44.1](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.44.0...v2.44.1) (2026-05-26)

### 🐛 Fixes

* **ui:** TS2345 в DictionaryEditorDialog[#449](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/issues/449) — narrow unknown ([8337561](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/83375610b25b2f194f1e12fc6c0b1f1cfd1c2561))
 2026-05-26 11:54:07 +00:00
Александр Зимин 49b2fcd1ab Merge branch 'fix/ts-dictionary-editor-dialog' into 'main' 
fix(ui): TS2345 в DictionaryEditorDialog#449 — narrow unknown

See merge request 2-6/2-6-4/terravault/ordinis!273
 2026-05-26 11:48:24 +00:00
Александр Зимин 83375610b2 fix(ui): TS2345 в DictionaryEditorDialog#449 — narrow unknown 2026-05-26 11:48:24 +00:00
semantic-release-bot f1fcabc9da chore(release): v2.44.0 
## [2.44.0](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/compare/v2.43.0...v2.44.0) (2026-05-26)

### ✨ Features

* **auth:** Phase 1b — swap default Keycloak realm на altum ([da0f894](https://git.nstart.cloud/2-6/2-6-4/terravault/ordinis/commit/da0f8943426ae96ef483ebd65c591fbb00ddd9b5))
 2026-05-26 10:21:28 +00:00
Александр Зимин 4d45ff139b Merge branch 'feat/phase1b-altum-realm' into 'main' 
feat(auth): Phase 1b — frontend default realm на altum

See merge request 2-6/2-6-4/terravault/ordinis!271
 2026-05-26 10:16:02 +00:00
Zimin A.N. da0f894342 feat(auth): Phase 1b — swap default Keycloak realm на altum 
Frontend default: https://auth.nstart.space/realms/nstart →
https://altum.nstart.cloud/auth/realms/altum. Shared SSO с altum portal.

Keycloak setup (Keycloak admin actions требуются ДО merge):
- В realm `altum` создать client `ordinis` (тип: public, standard flow)
- Redirect URIs:
    https://ordinis.nstart.cloud/*
    https://ordinis.k8s.265.nstart.cloud/*
    http://localhost:5173/*
- Web origins: те же
- Client-roles: ordinis-public, ordinis-internal, ordinis-restricted,
  admin (admin даёт RESTRICTED через ScopeContext.isAdminRole)

Backend issuerUri меняется отдельным MR в ordinis-infra
(charts/ordinis/values.yaml).

После настройки Keycloak + деплоя — старый realm auth.nstart.space/nstart
больше не используется. Все юзеры должны иметь учётки в realm altum
(вероятно brokered к nstart-id если SSO с New Start ID настроен).

171/171 tests, TSC чистый.
 2026-05-26 13:11:49 +03:00