@o3co/create-auth-policy-verifier 0.6.0 → 0.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o3co/create-auth-policy-verifier",
-  "version": "0.6.0",
+  "version": "0.7.0",
   "description": "Scaffold a new o3co/auth.policy-verifier project from the standalone template",
   "license": "Apache-2.0",
   "type": "module",

package/templates/standalone/Dockerfile

@@ -91,8 +91,10 @@ EXPOSE ${HTTP_PORT}
 # operator's port — the config reads `${?HTTP_PORT}`, so app.listen() and the
 # probe stay in sync. Shell form, so both expand at probe time.
 #
-# `GET /healthcheck` is never gated by `http.callerAuth`, so setting
-# HTTP_CALLER_AUTH_TOKEN does not require a credential here.
+# `GET /_healthcheck` is the liveness path every component of the stack answers
+# on (`/healthcheck` stays as a compatibility alias). It is never gated by
+# `http.callerAuth`, so setting HTTP_CALLER_AUTH_TOKEN does not require a
+# credential here.
 #
 # The deployment where loopback is genuinely correct — a sidecar sharing a
 # network namespace with its caller — is the one shape this check is wrong for.
@@ -101,7 +103,7 @@ EXPOSE ${HTTP_PORT}
 HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
   CMD addr="$(hostname -i | cut -d' ' -f1)"; \
       case "$addr" in *:*) addr="[$addr]" ;; esac; \
-      wget -q -O /dev/null "http://${addr}:${HTTP_PORT}${HTTP_PATH_PREFIX%/}/healthcheck" || exit 1
+      wget -q -O /dev/null "http://${addr}:${HTTP_PORT}${HTTP_PATH_PREFIX%/}/_healthcheck" || exit 1
 
 ENTRYPOINT ["tini", "--"]
 CMD ["node", "dist/main.mjs"]

package/templates/standalone/README.ja.md

@@ -93,7 +93,7 @@ x-caller-token: <secret>
 Authorization: Bearer <jwt>
 ```
 
-それ以外は body のパースより前に `401 { "decision": "deny", "code": "caller_unauthenticated", "message": "Caller authentication failed" }` を返します。`GET /healthcheck` は常に非ゲートなので、コンテナの healthcheck はそのまま動作します。
+それ以外は body のパースより前に `401 { "decision": "deny", "code": "caller_unauthenticated", "message": "Caller authentication failed" }` を返します。`GET /_healthcheck` は常に非ゲートなので、コンテナの healthcheck はそのまま動作します。
 
 資格情報を未設定のままにする運用もサポートされており、ループバックであれば問題ありません。ループバック以外に bind した場合は起動時に `unauthenticated_non_loopback_bind` が warn で記録されます — 修正する価値があるのはこの組み合わせです。
 
@@ -303,8 +303,11 @@ tag と digest を意図的に一緒に上げます。
 アドレスを叩けば呼び出し元と同じ問いになるため、`HTTP_HOSTNAME=0.0.0.0` の
 付け忘れは隠れずに `unhealthy` として現れます。
 
-`GET /healthcheck` は `http.callerAuth` で決してゲートされないので、probe に
-資格情報は不要です。`HTTP_PATH_PREFIX` と `HTTP_PORT` には追従します。
+probe が叩くのは `GET /_healthcheck` で、スタックの全コンポーネントが応答する
+liveness パスです。以前このイメージが probe していた `GET /healthcheck` は互換
+alias として残しているので、そのパスのままの probe 設定でも動き続けます。
+どちらも `http.callerAuth` でゲートされないので、probe に資格情報は不要です。
+`HTTP_PATH_PREFIX` と `HTTP_PORT` には追従します。
 
 例外は 1 つ、呼び出し元と network namespace を共有する sidecar 構成です。
 そこでは loopback bind が正しく、到達可能アドレスでは何も listen していま

package/templates/standalone/README.md

@@ -94,7 +94,7 @@ x-caller-token: <secret>
 Authorization: Bearer <jwt>
 ```
 
-Anything else gets `401 { "decision": "deny", "code": "caller_unauthenticated", "message": "Caller authentication failed" }`, decided before the body is parsed. `GET /healthcheck` is never gated, so the container healthcheck keeps working.
+Anything else gets `401 { "decision": "deny", "code": "caller_unauthenticated", "message": "Caller authentication failed" }`, decided before the body is parsed. `GET /_healthcheck` is never gated, so the container healthcheck keeps working.
 
 Leaving the credential unset is supported and is fine on loopback. On a non-loopback bind the server logs `unauthenticated_non_loopback_bind` at warn on boot — that combination is the one worth fixing.
 
@@ -306,7 +306,10 @@ server is bound to loopback and no caller can reach it — it would report
 container is actually reachable at asks the same question a caller does, so
 forgetting `HTTP_HOSTNAME=0.0.0.0` shows up as `unhealthy` instead of hiding.
 
-`GET /healthcheck` is never gated by `http.callerAuth`, so the probe needs no
+The probe hits `GET /_healthcheck`, the liveness path every component of the
+stack answers on. `GET /healthcheck` — the path this image probed before — is
+kept as a compatibility alias, so a probe config that still names it keeps
+working. Neither is gated by `http.callerAuth`, so the probe needs no
 credential. It follows `HTTP_PATH_PREFIX` and `HTTP_PORT`.
 
 One deployment shape is the exception: a sidecar sharing a network namespace

package/templates/standalone/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@o3co/auth-policy-verifier-standalone",
-	"version": "0.6.0",
+	"version": "0.7.0",
 	"private": true,
 	"license": "Apache-2.0",
 	"packageManager": "pnpm@10.29.3",

package/templates/standalone/src/__tests__/smoke.test.mts

@@ -101,7 +101,18 @@ function createShippedApp(config: AppConfig = shippedConfig) {
 }
 
 describe("standalone smoke", () => {
-	it("GET /healthcheck returns 200", async () => {
+	it("GET /_healthcheck returns 200", async () => {
+		// The liveness path the Dockerfile's HEALTHCHECK probes, and the one every
+		// component of the stack answers on (o3co/auth.provider#293).
+		const app = await createShippedApp();
+
+		const res = await request(app).get("/_healthcheck");
+		expect(res.status).toBe(200);
+	});
+
+	it("GET /healthcheck returns 200 as a compatibility alias", async () => {
+		// The path this image probed before; a probe config that still names it
+		// must keep working.
 		const app = await createShippedApp();
 
 		const res = await request(app).get("/healthcheck");

package/templates/versions.json

@@ -1,5 +1,5 @@
 {
-	"@o3co/auth.policy-verifier.core": "0.6.0",
-	"@o3co/auth.policy-verifier.builtins": "0.6.0",
-	"@o3co/auth.policy-verifier.server": "0.6.0"
+	"@o3co/auth.policy-verifier.core": "0.7.0",
+	"@o3co/auth.policy-verifier.builtins": "0.7.0",
+	"@o3co/auth.policy-verifier.server": "0.7.0"
 }