@red-hat-developer-hub/plugin-cost-management-common 2.1.0 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +36 -0
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,41 @@
|
|
|
1
1
|
# @red-hat-developer-hub/plugin-cost-management-common
|
|
2
2
|
|
|
3
|
+
## 2.2.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- ce8cb07: Add authorization, input validation, and confirmation dialog for Apply Recommendation workflow.
|
|
8
|
+
|
|
9
|
+
- New `ros.apply` permission required to execute the Apply Recommendation workflow
|
|
10
|
+
- New backend `POST /apply-recommendation` endpoint validates `resourceType` against server-side allowlist and checks `ros.apply` permission before forwarding to Orchestrator
|
|
11
|
+
- Workflow execution now routes through the cost-management backend instead of directly to the Orchestrator plugin, enabling server-side authorization and audit logging
|
|
12
|
+
- Confirmation dialog added before workflow execution to prevent accidental clicks
|
|
13
|
+
|
|
14
|
+
- 7b7bab9: **BREAKING**: Changed permission name separator from `.` to `/` for cluster-specific and cluster-project-specific permissions.
|
|
15
|
+
|
|
16
|
+
This resolves an ambiguity where dotted cluster names (e.g., `my.cluster`) could not be distinguished from the separator in permission names like `ros.my.cluster.project`.
|
|
17
|
+
|
|
18
|
+
New format:
|
|
19
|
+
|
|
20
|
+
- `ros/{clusterName}` and `ros/{clusterName}/{projectName}` (was `ros.{clusterName}` and `ros.{clusterName}.{projectName}`)
|
|
21
|
+
- `cost/{clusterName}` and `cost/{clusterName}/{projectName}` (was `cost.{clusterName}` and `cost.{clusterName}.{projectName}`)
|
|
22
|
+
|
|
23
|
+
Generic permissions (`ros.plugin`, `ros.apply`, `cost.plugin`) are unchanged.
|
|
24
|
+
|
|
25
|
+
See `docs/rbac.md` for a migration guide.
|
|
26
|
+
|
|
27
|
+
- ab26a80: Move Cost Management data fetching server-side to eliminate token exposure and RBAC bypass
|
|
28
|
+
|
|
29
|
+
- Added secure backend proxy (`/api/cost-management/proxy/*`) that authenticates requests via Backstage httpAuth, checks RBAC permissions, retrieves SSO tokens internally, and injects server-side cluster/project filters before forwarding to the Cost Management API
|
|
30
|
+
- Removed `/token` endpoint that exposed SSO service account credentials to the browser
|
|
31
|
+
- Removed `dangerously-allow-unauthenticated` proxy configuration from `app-config.dynamic.yaml`
|
|
32
|
+
- Updated `OptimizationsClient` and `CostManagementSlimClient` to route through the new secure backend proxy instead of the old Backstage proxy
|
|
33
|
+
- Eliminated client-side RBAC filter injection that could be bypassed by calling the proxy directly
|
|
34
|
+
|
|
35
|
+
### Patch Changes
|
|
36
|
+
|
|
37
|
+
- 5148408: Migrated to Jest 30 as required by @backstage/cli 0.36.0.
|
|
38
|
+
|
|
3
39
|
## 2.0.1
|
|
4
40
|
|
|
5
41
|
### Patch Changes
|
package/package.json
CHANGED