@redaksjon/protokoll 1.0.24 → 1.0.26-dev.20260303192935.68bd283

package/deploy/cloud-run/env.example.yaml

@@ -45,3 +45,11 @@ PROTOKOLL_STORAGE_GCS_CONTEXT_PREFIX: "context"
 
 # Cloud Run/GCP context (recommended with storage.backend: gcs).
 GOOGLE_CLOUD_PROJECT: "replace-me-project-id"
+
+# Optional secured mode (API key + RBAC).
+# When enabled, RBAC files must be present in the image/container filesystem.
+PROTOKOLL_HTTP_SECURED: "false"
+# RBAC_USERS_PATH: "/app/rbac/users.yaml"
+# RBAC_KEYS_PATH: "/app/rbac/keys.yaml"
+# RBAC_POLICY_PATH: "/app/rbac/policy.yaml"
+# RBAC_RELOAD_SECONDS: "300"

package/deploy/cloud-run/rbac-keys.example.yaml

@@ -0,0 +1,11 @@
+keys:
+  - key_id: admin-key-2026-03
+    user_id: admin-user
+    # Replace with a generated scrypt hash:
+    # scrypt$N$r$p$<salt_base64>$<derived_key_base64>
+    secret_hash: scrypt$16384$8$1$RkFLRV9TQUxUX0JBU0U2NA==$RkFLRV9ERVJJVkVEX0tFWV9CQVNFNjQ=
+    enabled: true
+  - key_id: editor-key-2026-03
+    user_id: editor-user
+    secret_hash: scrypt$16384$8$1$QU5PVEhFUl9TQUxUX0I2NA==$QU5PVEhFUl9ERVJJVkVEX0I2NA==
+    enabled: true

package/deploy/cloud-run/rbac-policy.example.yaml

@@ -0,0 +1,20 @@
+policy:
+  - path: /health
+    methods: [GET]
+    public: true
+
+  - path: /auth/whoami
+    methods: [GET]
+    any_roles: ["*"]
+
+  - path: /admin/ping
+    methods: [GET]
+    any_roles: [admin]
+
+  - path: /mcp
+    methods: [GET, POST, DELETE, OPTIONS]
+    any_roles: ["*"]
+
+  - path: /audio/*
+    methods: [GET, POST, OPTIONS]
+    any_roles: ["*"]

package/deploy/cloud-run/rbac-users.example.yaml

@@ -0,0 +1,10 @@
+users:
+  - user_id: admin-user
+    roles:
+      - admin
+      - editor
+    enabled: true
+  - user_id: editor-user
+    roles:
+      - editor
+    enabled: true

package/dist/engineLogging.js

@@ -208,7 +208,7 @@ function isProtokolUri(uri) {
   return uri.startsWith(`${SCHEME}://`);
 }
 
-const VERSION = "1.0.24 (HEAD/4971e43 T:v1.0.24 2026-03-03 09:02:15 -0800) linux arm64 v24.14.0";
+const VERSION = "1.0.26-dev.20260303192935.68bd283 (working/68bd283  2026-03-03 11:29:16 -0800) linux arm64 v24.14.0";
 const PROGRAM_NAME = "protokoll";
 const DATE_FORMAT_YEAR_MONTH_DAY_HOURS_MINUTES_SECONDS = "YYYY-M-D-HHmmss";
 const DEFAULT_AUDIO_EXTENSIONS = ["mp3", "mp4", "mpeg", "mpga", "m4a", "wav", "webm", "qta"];