@checkstack/catalog-backend 0.4.2 → 0.4.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +43 -0
- package/package.json +3 -3
- package/src/catalog-gitops-kinds.test.ts +2 -0
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,48 @@
|
|
|
1
1
|
# @checkstack/catalog-backend
|
|
2
2
|
|
|
3
|
+
## 0.4.4
|
|
4
|
+
|
|
5
|
+
### Patch Changes
|
|
6
|
+
|
|
7
|
+
- Updated dependencies [bb1fea0]
|
|
8
|
+
- @checkstack/catalog-common@1.4.0
|
|
9
|
+
|
|
10
|
+
## 0.4.3
|
|
11
|
+
|
|
12
|
+
### Patch Changes
|
|
13
|
+
|
|
14
|
+
- cb65e9d: ### Schema-driven secret resolution, rotation invalidation, and security hardening
|
|
15
|
+
|
|
16
|
+
**Breaking**: Replaced `{ secretRef: "..." }` object syntax with `${{ secrets.NAME }}` template interpolation. The `secretField()`, `secretRefSchema`, `isSecretRef`, `SecretRef`, and `ResolvedSecretField` exports have been removed from `@checkstack/gitops-common`.
|
|
17
|
+
|
|
18
|
+
**Breaking**: `ReconcileContext.resolveSecretsBySchema()` now returns `{ resolved: T; warnings: string[] }` instead of `T` directly. Plugins must destructure the result. Warnings contain messages for `${{ secrets.NAME }}` templates found in non-secret fields (fields without `x-secret` annotation).
|
|
19
|
+
|
|
20
|
+
**New features**:
|
|
21
|
+
|
|
22
|
+
- Secrets can be referenced in **any string field** using `${{ secrets.NAME }}` syntax
|
|
23
|
+
- Inline interpolation is supported: `"postgres://user:${{ secrets.DB_PASS }}@host/db"`
|
|
24
|
+
- Resolution is **schema-driven** — reuses the existing `configString({ "x-secret": true })` pattern from DynamicForm
|
|
25
|
+
- Secret rotation now automatically invalidates affected entities, triggering re-reconciliation on the next sync cycle
|
|
26
|
+
- New `getSecretUsage` RPC endpoint to look up which entities reference a given secret
|
|
27
|
+
- Secrets UI now shows an expandable usage panel per secret showing referencing entities
|
|
28
|
+
- Reconciliation warnings: templates in non-secret fields are detected and surfaced in the provenance UI
|
|
29
|
+
- New `secretNameSchema` and `SECRET_NAME_REGEX` exports for validating secret names
|
|
30
|
+
|
|
31
|
+
**Security**:
|
|
32
|
+
|
|
33
|
+
- Secret names are validated at creation: must start with a letter, contain only `[a-zA-Z0-9_-]`, max 63 chars
|
|
34
|
+
- Secrets are validated to exist at sync time but **not pre-resolved** into the spec
|
|
35
|
+
- Templates in `metadata` fields are **rejected** to prevent secret leaks via display fields
|
|
36
|
+
- Only fields with `x-secret` schema annotations get resolved — no escape hatch
|
|
37
|
+
- Templates in non-secret fields emit warnings (stored in provenance, visible in UI) instead of silently passing
|
|
38
|
+
|
|
39
|
+
**Migration**: Update YAML descriptors to use `${{ secrets.NAME }}` instead of `secretRef: name`. Remove `secretField()` imports from plugin schemas — use `configString({ "x-secret": true })` to annotate secret fields. Destructure `const { resolved } = await context.resolveSecretsBySchema({ value, schema })` (return type changed from `T` to `{ resolved: T; warnings: string[] }`).
|
|
40
|
+
|
|
41
|
+
- Updated dependencies [8ef367a]
|
|
42
|
+
- Updated dependencies [cb65e9d]
|
|
43
|
+
- @checkstack/gitops-common@0.2.0
|
|
44
|
+
- @checkstack/gitops-backend@0.2.0
|
|
45
|
+
|
|
3
46
|
## 0.4.2
|
|
4
47
|
|
|
5
48
|
### Patch Changes
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@checkstack/catalog-backend",
|
|
3
|
-
"version": "0.4.
|
|
3
|
+
"version": "0.4.4",
|
|
4
4
|
"type": "module",
|
|
5
5
|
"main": "src/index.ts",
|
|
6
6
|
"checkstack": {
|
|
@@ -18,8 +18,8 @@
|
|
|
18
18
|
"@checkstack/catalog-common": "1.3.1",
|
|
19
19
|
"@checkstack/command-backend": "0.1.19",
|
|
20
20
|
"@checkstack/auth-backend": "0.4.18",
|
|
21
|
-
"@checkstack/gitops-backend": "0.1.
|
|
22
|
-
"@checkstack/gitops-common": "0.1.
|
|
21
|
+
"@checkstack/gitops-backend": "0.1.2",
|
|
22
|
+
"@checkstack/gitops-common": "0.1.1",
|
|
23
23
|
"@checkstack/notification-common": "0.2.8",
|
|
24
24
|
"@orpc/server": "^1.13.2",
|
|
25
25
|
"drizzle-orm": "^0.45.0",
|
|
@@ -103,6 +103,8 @@ const mockContext: ReconcileContext = {
|
|
|
103
103
|
error: () => {},
|
|
104
104
|
},
|
|
105
105
|
resolveEntityRef: async () => undefined,
|
|
106
|
+
resolveSecretsBySchema: async <T>(params: { value: T }): Promise<{ resolved: T; warnings: string[] }> =>
|
|
107
|
+
({ resolved: params.value, warnings: [] }),
|
|
106
108
|
};
|
|
107
109
|
|
|
108
110
|
// ─── Tests ─────────────────────────────────────────────────────────────────
|