diff --git a/CLAUDE.md b/CLAUDE.md index 8d095d3..b090e9e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -193,7 +193,7 @@ Next.js also compiles `src/instrumentation.ts` for the Edge runtime, so Node.js- `installer/` is a standalone Bun 1.4.2 package with its own `package.json`, `bun.lock` and tests. Platform's lint, Vitest run and Docker image ignore it. -Release 1.1.1 installs in Docker mode on one x86_64 Linux host with the installer, and on Kubernetes with the Helm chart `charts/libredb-platform`, whose jobs run the installer's Kubernetes-mode code; the installer's own `preflight`, `plan`, `apply`, `verify` and `db-script` refuse `mode: kubernetes`. +Release 1.2.0 installs in Docker mode on one x86_64 Linux host with the installer, and on Kubernetes with the Helm chart `charts/libredb-platform`, whose jobs run the installer's Kubernetes-mode code; the installer's own `preflight`, `plan`, `apply`, `verify` and `db-script` refuse `mode: kubernetes`. `docs/deploy/install-docker.md` is the customer's install guide and `installer/README.md` the reference of every command and field, so a change to a command, a default or a prerequisite updates both. ```bash diff --git a/README.md b/README.md index 5d936fa..25df079 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,7 @@ Write to [info@libredb.org](mailto:info@libredb.org) or join the waiting list at ## Install -Platform 1.1.0 is the current release, published as the image `ghcr.io/libredb/libredb-platform`, and pairs with LibreDB Studio 1.0.0. +Platform 1.1.0 is the current release, published as the image `ghcr.io/libredb/libredb-platform`, and pairs with LibreDB Studio 1.1.0. It installs with Docker on one x86_64 Linux host: the installer deploys PostgreSQL, Keycloak, Platform, Studio and a Caddy edge, and can use an existing PostgreSQL server or Keycloak instead. On Kubernetes, the Helm chart [`charts/libredb-platform`](charts/libredb-platform) installs the same, from the Helm repository `https://libredb.org/libredb-platform/` or `oci://ghcr.io/libredb/charts/libredb-platform`, as the [Kubernetes install guide](docs/deploy/install-kubernetes.md) describes. Each release is tested with Docker Compose on a plain host and on a host that runs a Docker Swarm, and with the chart on vanilla Kubernetes, on clusters that Rancher manages and on OpenShift 4. diff --git a/charts/libredb-platform/Chart.lock b/charts/libredb-platform/Chart.lock index abaf0d1..008a4b6 100644 --- a/charts/libredb-platform/Chart.lock +++ b/charts/libredb-platform/Chart.lock @@ -1,6 +1,6 @@ dependencies: - name: libredb-studio repository: https://libredb.org/libredb-studio/ - version: 0.1.100 -digest: sha256:a56f4096de2bd4d02e73a5b984ba8040490565a767be05a123ffb2abb88a92d6 -generated: "2026-10-20T02:08:21.66270654+03:00" + version: 0.1.103 +digest: sha256:5a90877a3308b571e8eeeeb72541cce1911714937b0ac908b47764241b8e792f +generated: "2026-10-24T20:40:23.343256639+03:00" diff --git a/charts/libredb-platform/Chart.yaml b/charts/libredb-platform/Chart.yaml index 077a6c1..7276714 100644 --- a/charts/libredb-platform/Chart.yaml +++ b/charts/libredb-platform/Chart.yaml @@ -8,8 +8,8 @@ type: application # The chart ships in the installer's release, so version and appVersion are both that release, whose images and # Studio chart it pins (installer/release/release.config.json, which installer/test/unit/kubernetes/chart.test.ts # compares, together with installer/package.json). -version: 1.1.1 -appVersion: "1.1.1" +version: 1.2.0 +appVersion: "1.2.0" kubeVersion: ">=1.28.0-0" home: https://libredb.org/platform/ icon: https://raw.githubusercontent.com/libredb/libredb-studio/main/public/logo.svg @@ -34,17 +34,19 @@ annotations: artifacthub.io/license: Elastic-2.0 artifacthub.io/containsSecurityUpdates: "false" artifacthub.io/changes: | + - kind: changed + description: "LibreDB Studio 1.1.0 under governance, from the Studio chart 0.1.103; LibreDB Platform stays at 1.1.0" - kind: added - description: "First release of the chart, with LibreDB Platform 1.1.0 and LibreDB Studio 1.0.0 under governance" + description: "Studio 1.1.0 accepts an identity provider access token as a bearer session for native clients, under the same governance rule as a session cookie" - kind: added - description: "A managed or an external PostgreSQL and Keycloak, Argo CD hooks, OpenShift restricted-v2, seal key rotation, backup and restore, and an install without network access" - - kind: added - description: "Platform 1.1.0 adds the bearer API under /api/v1 for LibreDB Mobile" + description: "With mobile.enabled set to true, a Docker-mode install lets the LibreDB Mobile client use Studio and the Platform API under /api/v1; this chart does not create the mobile client yet" + - kind: fixed + description: "Studio 1.1.0 asks before a write inside a CTE or under EXPLAIN ANALYZE runs, and reads primary and foreign keys for a SELECT-only PostgreSQL role" artifacthub.io/images: | - name: libredb-platform image: ghcr.io/libredb/libredb-platform:1.1.0@sha256:56d89d9cbb7fde237a1e8af51bb155c276352bf1f7719f8c651b9f5b37213d92 - name: libredb-studio - image: ghcr.io/libredb/libredb-studio:1.0.0@sha256:0cb0177dd2789534f2dbfbc6673104ec0ce70ee82815f5fe9bec5efe3d329ce3 + image: ghcr.io/libredb/libredb-studio:1.1.0@sha256:e91183def05f4c13703c77363ec51ad68bfa45b1b1d3b92dc53c331b67e53d2c - name: postgres image: docker.io/library/postgres:18.6@sha256:74935e72241653ca55e0414067e6d8763aceb8a810eb51b452253ec3dcfc4336 - name: keycloak @@ -59,6 +61,6 @@ annotations: dependencies: - name: libredb-studio alias: studio - version: 0.1.100 + version: 0.1.103 repository: https://libredb.org/libredb-studio/ condition: studio.enabled diff --git a/charts/libredb-platform/files/libredb-jobs.cjs.gz b/charts/libredb-platform/files/libredb-jobs.cjs.gz index 3036dfb..2bba9e0 100644 Binary files a/charts/libredb-platform/files/libredb-jobs.cjs.gz and b/charts/libredb-platform/files/libredb-jobs.cjs.gz differ diff --git a/charts/libredb-platform/tests/e2e/run-e2e.sh b/charts/libredb-platform/tests/e2e/run-e2e.sh index fce2dd3..709ff9c 100755 --- a/charts/libredb-platform/tests/e2e/run-e2e.sh +++ b/charts/libredb-platform/tests/e2e/run-e2e.sh @@ -50,7 +50,7 @@ else fi step "chart dependencies" -if [ ! -f "$chart/charts/libredb-studio-0.1.100.tgz" ]; then +if [ ! -f "$chart/charts/libredb-studio-0.1.103.tgz" ]; then # helm dependency build takes Chart.lock's Studio chart only from a repository Helm knows. helm repo add libredb-studio https://libredb.org/libredb-studio/ >/dev/null 2>&1 || true helm dependency build "$chart" diff --git a/charts/libredb-platform/values.yaml b/charts/libredb-platform/values.yaml index 27a479c..42261e4 100644 --- a/charts/libredb-platform/values.yaml +++ b/charts/libredb-platform/values.yaml @@ -217,7 +217,7 @@ studio: fullnameOverride: libredb-studio image: repository: ghcr.io/libredb/libredb-studio - tag: "1.0.0@sha256:0cb0177dd2789534f2dbfbc6673104ec0ce70ee82815f5fe9bec5efe3d329ce3" + tag: "1.1.0@sha256:e91183def05f4c13703c77363ec51ad68bfa45b1b1d3b92dc53c331b67e53d2c" authProvider: oidc governance: enabled: true diff --git a/docs/deploy/install-docker.md b/docs/deploy/install-docker.md index 3d4c3fc..f986d94 100644 --- a/docs/deploy/install-docker.md +++ b/docs/deploy/install-docker.md @@ -1,6 +1,6 @@ # Install LibreDB with Docker -This guide installs LibreDB 1.1.1 on one x86_64 Linux host with Docker. +This guide installs LibreDB 1.2.0 on one x86_64 Linux host with Docker. The install is tested with Docker Compose on a plain host and on a host that runs a Docker Swarm, such as one of Dokploy or CapRover. The installer, `libredb-installer`, runs on that host as root and deploys PostgreSQL, Keycloak, LibreDB Platform, LibreDB Studio and a Caddy edge as the Docker Compose project `libredb`. The guide takes the shortest path: a PostgreSQL and a Keycloak that the installer runs itself, one DNS name per app, and certificates from the installer's internal CA. @@ -62,7 +62,7 @@ The installer treats the token as a secret and never prints it, so keep the file The installer is one binary, published with a file of checksums on this repository's [GitHub releases](https://github.com/libredb/libredb-platform/releases): ```sh -V=1.1.1 +V=1.2.0 B=https://github.com/libredb/libredb-platform/releases/download/installer-v$V mkdir -p ~/libredb-$V && cd ~/libredb-$V curl -fL -O "$B/libredb-installer-linux-x64" -O "$B/SHA256SUMS" @@ -71,7 +71,7 @@ chmod 0755 libredb-installer-linux-x64 ./libredb-installer-linux-x64 version ``` -Expected: `sha256sum` prints `libredb-installer-linux-x64: OK`, and `version` prints `release 1.1.1`. +Expected: `sha256sum` prints `libredb-installer-linux-x64: OK`, and `version` prints `release 1.2.0`. `sha256sum -c` needs no account, and it shows that the download is complete and matches the release's checksums. To check that this repository's release workflow built the binary, verify its attestation with the [GitHub CLI](https://cli.github.com), which needs a GitHub login (`gh auth login`): @@ -134,7 +134,7 @@ The configuration never holds a secret or a license token itself, only the paths ## Check the host and the configuration ```sh -cd ~/libredb-1.1.1 +cd ~/libredb-1.2.0 ./libredb-installer-linux-x64 validate -c /etc/libredb/libredb.yaml ./libredb-installer-linux-x64 preflight -c /etc/libredb/libredb.yaml ./libredb-installer-linux-x64 plan -c /etc/libredb/libredb.yaml diff --git a/docs/deploy/install-kubernetes.md b/docs/deploy/install-kubernetes.md index 76a41e0..7a749a2 100644 --- a/docs/deploy/install-kubernetes.md +++ b/docs/deploy/install-kubernetes.md @@ -1,6 +1,6 @@ # Install LibreDB on Kubernetes -This guide installs LibreDB 1.1.1 on a Kubernetes cluster with the Helm chart [`charts/libredb-platform`](../../charts/libredb-platform). +This guide installs LibreDB 1.2.0 on a Kubernetes cluster with the Helm chart [`charts/libredb-platform`](../../charts/libredb-platform). The chart is tested on vanilla Kubernetes, on clusters that Rancher manages and on OpenShift 4. The chart deploys LibreDB Platform, its migrate job and LibreDB Studio under governance, and by default a PostgreSQL server and a Keycloak that it runs itself. It is the installer's Kubernetes mode driven by Helm: the chart renders its values as an installation configuration of `mode: kubernetes`, and its jobs run the installer's own code on it, so a Helm install gets the same secrets, certificates, environments, PostgreSQL provisioning and Keycloak realm as a [Docker install](install-docker.md) of the same configuration. diff --git a/docs/platform-studio-integration.md b/docs/platform-studio-integration.md index 59a101a..1b32de9 100644 --- a/docs/platform-studio-integration.md +++ b/docs/platform-studio-integration.md @@ -2,8 +2,8 @@ This page explains, with diagrams, how LibreDB Platform governs LibreDB Studio in an on-prem install. It is a reading aid. -The contract itself is [Studio's `docs/GOVERNANCE.md`](https://github.com/libredb/libredb-studio/blob/1.0.0/docs/GOVERNANCE.md). -Every diagram and table follows the code of Platform in this repository and of [Studio 1.0.0](https://github.com/libredb/libredb-studio/releases/tag/1.0.0). +The contract itself is [Studio's `docs/GOVERNANCE.md`](https://github.com/libredb/libredb-studio/blob/1.1.0/docs/GOVERNANCE.md). +Every diagram and table follows the code of Platform in this repository and of [Studio 1.1.0](https://github.com/libredb/libredb-studio/releases/tag/1.1.0). Terms such as snapshot, envelope, seal canary, governance mode and `seed:` are defined in the [glossary](#14-glossary) at the end. Five ideas carry the whole design: diff --git a/installer/README.md b/installer/README.md index 9a29651..f50289d 100644 --- a/installer/README.md +++ b/installer/README.md @@ -451,7 +451,7 @@ The claim `libredb_roles` reaches its ID token, from which the app reads its rol `studio.env` gets `OIDC_BEARER_AUDIENCE=libredb-studio-api` and `OIDC_BEARER_CLIENT_IDS=libredb-mobile`, so Studio accepts an access token only when its `aud` holds that audience and its `azp` is `libredb-mobile`. Under governance Studio applies to that token the same sign-in rule as to a session cookie, and because the realm is the one Studio's web sign-in uses, its `sub` matches the subject of Platform's grants. The bearer channel needs a Studio release that contains [libredb-studio#1914](https://github.com/libredb/libredb-studio/pull/1914); a Studio without it ignores both variables and the `Authorization` header, so the app gets `401` on every call. -This release pins Studio 1.0.0, which does not contain it. +This release pins Studio 1.1.0, which contains it. `platform.env` gets `PLATFORM_API_AUDIENCE=libredb-platform-api` and `PLATFORM_API_CLIENT_IDS=libredb-mobile`, so Platform's API accepts an access token only when its `aud` holds that audience and its `azp` is `libredb-mobile`, and only for an account with the role `admin`, as [docs/api/v1.md](../docs/api/v1.md) describes. The bearer API needs a Platform release that contains [#24](https://github.com/libredb/libredb-platform/issues/24); a Platform without it ignores both variables, so every call under `/api/v1` gets `404`. This release pins Platform 1.1.0, which contains it. diff --git a/installer/contracts/env-inventory.yaml b/installer/contracts/env-inventory.yaml index 245212c..50e882e 100644 --- a/installer/contracts/env-inventory.yaml +++ b/installer/contracts/env-inventory.yaml @@ -409,13 +409,14 @@ variables: # Must be unset or false in Studio governance mode, because Studio's boot checks refuse them (Studio's GOVERNANCE.md, # Boot checks). LIBREDB_MCP_ENABLED and LIBREDB_AGENT_ENABLED stay here until Studio runs MCP and the agent under -# governance. +# governance. Studio 1.1.0 refuses OIDC_ROLE_PREFIX as well, which it reads only for seed connections. studioForbidden: - ALLOW_CUSTOM_CONNECTIONS - LIBREDB_EMBEDDED_SAMPLE - SQLITE_EMBEDDED_SAMPLE - SEED_CONFIG_PATH - SEED_DISCOVERY_PATH + - OIDC_ROLE_PREFIX - ADMIN_PASSWORD - USER_PASSWORD - LAUNCH_TOKEN_SECRET diff --git a/installer/package.json b/installer/package.json index 88a41bd..a0057e2 100644 --- a/installer/package.json +++ b/installer/package.json @@ -1,6 +1,6 @@ { "name": "libredb-installer", - "version": "1.1.1", + "version": "1.2.0", "private": true, "license": "Elastic-2.0", "type": "module", diff --git a/installer/release/history/1.2.0.json b/installer/release/history/1.2.0.json new file mode 100644 index 0000000..b4b65c3 --- /dev/null +++ b/installer/release/history/1.2.0.json @@ -0,0 +1,53 @@ +{ + "version": "1.2.0", + "images": { + "platform": { + "repository": "ghcr.io/libredb/libredb-platform", + "version": "1.1.0", + "digest": "sha256:56d89d9cbb7fde237a1e8af51bb155c276352bf1f7719f8c651b9f5b37213d92" + }, + "studio": { + "repository": "ghcr.io/libredb/libredb-studio", + "version": "1.1.0", + "digest": "sha256:e91183def05f4c13703c77363ec51ad68bfa45b1b1d3b92dc53c331b67e53d2c" + }, + "keycloak": { + "repository": "quay.io/keycloak/keycloak", + "version": "26.8.1", + "digest": "sha256:79c623a22abacf3fe6c00a5fb30f5b7843d717b234033b80995891c06116d244" + }, + "postgres": { + "repository": "docker.io/library/postgres", + "version": "18.6", + "digest": "sha256:74935e72241653ca55e0414067e6d8763aceb8a810eb51b452253ec3dcfc4336" + }, + "edge": { + "repository": "docker.io/library/caddy", + "version": "2.11.7", + "digest": "sha256:685ae3d7c34d9b5f8caeddc5d14051db7bbd88ff1f5a2fa0c16bd8ca328fb7af" + } + }, + "studioChart": { + "name": "libredb-studio", + "version": "0.1.103", + "repository": "https://libredb.org/libredb-studio/", + "sha256": "2998a9612e175f6cada18a5d704282e778706e542377dcd22a3eee1ee77ccf2c" + }, + "minimums": { + "dockerEngine": "28.0.0", + "compose": "2.24.0", + "kubernetes": "1.28.0" + }, + "studio": { + "logoutHintVerified": true, + "reportedVersion": "1.1.0" + }, + "contracts": { + "platformPublishes": [ + 1 + ], + "studioSupports": [ + 1 + ] + } +} diff --git a/installer/release/release.config.json b/installer/release/release.config.json index ee7bd1a..2b3554e 100644 --- a/installer/release/release.config.json +++ b/installer/release/release.config.json @@ -1,5 +1,5 @@ { - "version": "1.1.1", + "version": "1.2.0", "images": { "platform": { "repository": "ghcr.io/libredb/libredb-platform", @@ -8,8 +8,8 @@ }, "studio": { "repository": "ghcr.io/libredb/libredb-studio", - "version": "1.0.0", - "digest": "sha256:0cb0177dd2789534f2dbfbc6673104ec0ce70ee82815f5fe9bec5efe3d329ce3" + "version": "1.1.0", + "digest": "sha256:e91183def05f4c13703c77363ec51ad68bfa45b1b1d3b92dc53c331b67e53d2c" }, "keycloak": { "repository": "quay.io/keycloak/keycloak", @@ -29,9 +29,9 @@ }, "studioChart": { "name": "libredb-studio", - "version": "0.1.100", + "version": "0.1.103", "repository": "https://libredb.org/libredb-studio/", - "sha256": "f9bf702a427bfd402f1d9525ff0be0f36c5e2618a77668fc9d5562faddc890b0" + "sha256": "2998a9612e175f6cada18a5d704282e778706e542377dcd22a3eee1ee77ccf2c" }, "minimums": { "dockerEngine": "28.0.0", @@ -40,7 +40,7 @@ }, "studio": { "logoutHintVerified": true, - "reportedVersion": "1.0.0" + "reportedVersion": "1.1.0" }, "contracts": { "platformPublishes": [1], diff --git a/installer/src/contracts/studio.ts b/installer/src/contracts/studio.ts index 9fe406a..5a2ebca 100644 --- a/installer/src/contracts/studio.ts +++ b/installer/src/contracts/studio.ts @@ -314,6 +314,7 @@ export const STUDIO_FORBIDDEN = [ "SQLITE_EMBEDDED_SAMPLE", "SEED_CONFIG_PATH", "SEED_DISCOVERY_PATH", + "OIDC_ROLE_PREFIX", "ADMIN_PASSWORD", "USER_PASSWORD", "LAUNCH_TOKEN_SECRET", diff --git a/installer/test/integration/contracts/preflight-drift.test.ts b/installer/test/integration/contracts/preflight-drift.test.ts index 953bc31..c800443 100644 --- a/installer/test/integration/contracts/preflight-drift.test.ts +++ b/installer/test/integration/contracts/preflight-drift.test.ts @@ -366,6 +366,14 @@ describe("rendered environments against the pinned app images", () => { LONG, ); + test( + "the Studio image exits 1 naming OIDC_ROLE_PREFIX when it is set", + async () => { + await expectStudioRefusal("studio-role-prefix", { ...studioEnv, OIDC_ROLE_PREFIX: "libredb_" }, "OIDC_ROLE_PREFIX"); + }, + LONG, + ); + test( "the Studio image exits 1 naming GOVERNANCE_PRIVATE_KEYS_FILE when the keyring holds 17 keys", async () => { diff --git a/installer/test/unit/contracts/studio-env.test.ts b/installer/test/unit/contracts/studio-env.test.ts index a8fa241..4d9bc35 100644 --- a/installer/test/unit/contracts/studio-env.test.ts +++ b/installer/test/unit/contracts/studio-env.test.ts @@ -29,6 +29,10 @@ describe("renderStudioEnv", () => { for (const key of STUDIO_FORBIDDEN) expect(Object.keys(env)).not.toContain(key); }); + test("lists OIDC_ROLE_PREFIX among the variables that must be unset, because Studio 1.1.0 refuses it in governance mode", () => { + expect(STUDIO_FORBIDDEN).toContain("OIDC_ROLE_PREFIX"); + }); + test("writes the governance values of contracts/env-inventory.yaml", () => { const env = renderStudioEnv(desiredFixture(), inputs); const url = diff --git a/installer/test/unit/release/manifest.test.ts b/installer/test/unit/release/manifest.test.ts index 95c9c5a..04fc513 100644 --- a/installer/test/unit/release/manifest.test.ts +++ b/installer/test/unit/release/manifest.test.ts @@ -77,7 +77,11 @@ describe("release manifest", () => { const raw: unknown = JSON.parse(readFileSync(join(import.meta.dir, "../../../release/release.config.json"), "utf8")); const manifest = parseReleaseManifest(raw); expect(manifest.images.platform.repository).toBe("ghcr.io/libredb/libredb-platform"); + expect(manifest.version).toBe("1.2.0"); expect(manifest.images.platform.version).toBe("1.1.0"); + expect(manifest.images.studio.version).toBe("1.1.0"); + expect(manifest.studioChart.version).toBe("0.1.103"); + expect(manifest.studio.reportedVersion).toBe("1.1.0"); expect(manifest.images.keycloak.version).toBe("26.8.1"); expect(manifest.images.postgres.version).toBe("18.6"); // The "logout hint" test of e2e/interop.spec.ts passed against the pinned Keycloak. diff --git a/tests/fixtures/governance/GOVERNANCE.md b/tests/fixtures/governance/GOVERNANCE.md index 152fe45..463062e 100644 --- a/tests/fixtures/governance/GOVERNANCE.md +++ b/tests/fixtures/governance/GOVERNANCE.md @@ -137,6 +137,7 @@ Under governance the identity provider at `OIDC_ISSUER` is the only way into Stu Studio checks the session of every request against these rules: - A session counts only when Studio's OIDC callback minted it: it carries the ID token's `sub` as a non-empty subject and the ID token's `iss` as its issuer, and the issuer equals `OIDC_ISSUER`, the two compared as URLs with one trailing slash ignored. +- A native client's identity provider access token ([OIDC.md](./OIDC.md#bearer-access-tokens-for-native-clients)) counts under the same rule, with the access token's `sub` and `iss`, and its own `iat` as its issue time. - A password, passkey or launch session carries no subject and is refused, and so is a session whose subject is empty or whose issuer is not `OIDC_ISSUER`. With `OIDC_ISSUER` unset or not a URL every session is refused, and a changed `OIDC_ISSUER` ends the sessions of the previous issuer. - A session issued at or before its subject's latest `revoked_before` in [`bridge.session_revocations_v1`](#row-semantics) is refused, typically within a second of the commit that adds the row, because its change notification reloads the snapshot. @@ -708,6 +709,7 @@ Capture follows `queryLog.statementCapture`, which is `none` while the control p - `full` keeps every other secret written into a statement, such as a Redis `AUTH` argument, and an error text that quotes a statement in the driver's own words can carry one, so choose it only where the statements themselves must be kept. - A refused request whose connection did not resolve, such as one for a connection the caller holds no grant on, stores no statement and no error text in any mode, because the engine that would read them is unknown. - In every mode `statement_type` is `SELECT`, `INSERT`, `UPDATE` or `DELETE` from the keyword that operates the statement, also behind a `WITH`, `DDL` for `CREATE`, `ALTER`, `DROP` and `TRUNCATE`, and `OTHER` for any other statement, for a unit without text and for every engine whose statements are not SQL. + A `SELECT` behind a `WITH` whose CTE body writes takes the type of that write, so `WITH d AS (DELETE … RETURNING *) SELECT * FROM d` is `DELETE`, and a `MERGE` or `UPSERT` body is `OTHER`. A `profile` row is `SELECT` and a `key-scan` row `OTHER` on every engine, because their statement names what was read rather than being a statement the user wrote. - The statement of a `profile` or `key-scan` row is captured like any statement of its engine, so under `redacted` a quoted SQL name is kept while a Redis page request keeps only `SCAN` and one `?` per argument, and no cursor or pattern value reaches the row. - A request the admission gate refuses records one `refused` row with its route's source, the connection's engine and access level, and `error_code` `AUDIT_UNAVAILABLE`. diff --git a/tests/fixtures/governance/GOVERNANCE.md.sha256 b/tests/fixtures/governance/GOVERNANCE.md.sha256 index c817bce..89a38eb 100644 --- a/tests/fixtures/governance/GOVERNANCE.md.sha256 +++ b/tests/fixtures/governance/GOVERNANCE.md.sha256 @@ -1 +1 @@ -c7712e7fe13a6d93368b31b2ba93af791c09f0d37a4df2e033b64a98a9309cf3 GOVERNANCE.md +b40aab2821c29a99497f8d3e3d4d0f1e66080425b93e395e52d69c595cd489f9 GOVERNANCE.md diff --git a/tests/fixtures/governance/STUDIO_TAG b/tests/fixtures/governance/STUDIO_TAG index 3eefcb9..9084fa2 100644 --- a/tests/fixtures/governance/STUDIO_TAG +++ b/tests/fixtures/governance/STUDIO_TAG @@ -1 +1 @@ -1.0.0 +1.1.0