@red-hat-developer-hub/plugin-cost-management 2.1.0 → 2.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +29 -0
- package/app-config.dynamic.yaml +2 -2
- package/package.json +2 -2
package/CHANGELOG.md
CHANGED
|
@@ -1,5 +1,34 @@
|
|
|
1
1
|
# @red-hat-developer-hub/plugin-cost-management
|
|
2
2
|
|
|
3
|
+
## 2.2.0
|
|
4
|
+
|
|
5
|
+
### Minor Changes
|
|
6
|
+
|
|
7
|
+
- ce8cb07: Add authorization, input validation, and confirmation dialog for Apply Recommendation workflow.
|
|
8
|
+
|
|
9
|
+
- New `ros.apply` permission required to execute the Apply Recommendation workflow
|
|
10
|
+
- New backend `POST /apply-recommendation` endpoint validates `resourceType` against server-side allowlist and checks `ros.apply` permission before forwarding to Orchestrator
|
|
11
|
+
- Workflow execution now routes through the cost-management backend instead of directly to the Orchestrator plugin, enabling server-side authorization and audit logging
|
|
12
|
+
- Confirmation dialog added before workflow execution to prevent accidental clicks
|
|
13
|
+
|
|
14
|
+
- ab26a80: Move Cost Management data fetching server-side to eliminate token exposure and RBAC bypass
|
|
15
|
+
|
|
16
|
+
- Added secure backend proxy (`/api/cost-management/proxy/*`) that authenticates requests via Backstage httpAuth, checks RBAC permissions, retrieves SSO tokens internally, and injects server-side cluster/project filters before forwarding to the Cost Management API
|
|
17
|
+
- Removed `/token` endpoint that exposed SSO service account credentials to the browser
|
|
18
|
+
- Removed `dangerously-allow-unauthenticated` proxy configuration from `app-config.dynamic.yaml`
|
|
19
|
+
- Updated `OptimizationsClient` and `CostManagementSlimClient` to route through the new secure backend proxy instead of the old Backstage proxy
|
|
20
|
+
- Eliminated client-side RBAC filter injection that could be bypassed by calling the proxy directly
|
|
21
|
+
|
|
22
|
+
### Patch Changes
|
|
23
|
+
|
|
24
|
+
- fdcdf41: Fix `menuItems` keys in `app-config.dynamic.yaml` to use dots instead of slashes as path separators, so that "Optimizations" and "OpenShift" are properly nested under the "Cost management" parent menu in the RHDH sidebar.
|
|
25
|
+
- 5148408: Migrated to Jest 30 as required by @backstage/cli 0.36.0.
|
|
26
|
+
- Updated dependencies [ce8cb07]
|
|
27
|
+
- Updated dependencies [5148408]
|
|
28
|
+
- Updated dependencies [7b7bab9]
|
|
29
|
+
- Updated dependencies [ab26a80]
|
|
30
|
+
- @red-hat-developer-hub/plugin-cost-management-common@2.2.0
|
|
31
|
+
|
|
3
32
|
## 2.0.1
|
|
4
33
|
|
|
5
34
|
### Patch Changes
|
package/app-config.dynamic.yaml
CHANGED
|
@@ -16,10 +16,10 @@ dynamicPlugins:
|
|
|
16
16
|
icon: costManagementIconOutlined
|
|
17
17
|
text: OpenShift
|
|
18
18
|
menuItems:
|
|
19
|
-
cost-management
|
|
19
|
+
cost-management.optimizations:
|
|
20
20
|
parent: cost-management
|
|
21
21
|
priority: 10
|
|
22
|
-
cost-management
|
|
22
|
+
cost-management.openshift:
|
|
23
23
|
parent: cost-management
|
|
24
24
|
priority: 20
|
|
25
25
|
cost-management:
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@red-hat-developer-hub/plugin-cost-management",
|
|
3
|
-
"version": "2.
|
|
3
|
+
"version": "2.2.0",
|
|
4
4
|
"backstage": {
|
|
5
5
|
"pluginId": "cost-management",
|
|
6
6
|
"pluginPackages": [
|
|
@@ -23,7 +23,7 @@
|
|
|
23
23
|
"@material-ui/lab": "4.0.0-alpha.61",
|
|
24
24
|
"@patternfly/react-charts": "^8.3.0",
|
|
25
25
|
"@patternfly/react-tokens": "^6.1.0",
|
|
26
|
-
"@red-hat-developer-hub/plugin-cost-management-common": "^2.
|
|
26
|
+
"@red-hat-developer-hub/plugin-cost-management-common": "^2.2.0",
|
|
27
27
|
"date-fns": "^3.6.0",
|
|
28
28
|
"lodash": "^4.17.21",
|
|
29
29
|
"react-intl": "^6.6.8",
|