diff --git a/.agents/references/authup.md b/.agents/references/authup.md index d4b58c0..f6b947d 100644 --- a/.agents/references/authup.md +++ b/.agents/references/authup.md @@ -1,31 +1,39 @@ # authup application mapping Repository: https://github.com/authup/authup. A local checkout commonly exists -at `/opt/projects/authup/authup`. This mapping is pinned to v1.0.0-beta.66, the +at `/opt/projects/authup/authup`. This mapping is pinned to v1.0.0-beta.67, the chart `appVersion`. -beta.65 to beta.66 changed no image entrypoint, CLI role, port or -environment-variable contract: `Dockerfile` and `entrypoint.sh` are unchanged, -`packages/server-config/src` gained no field, and `apps/authup/src/module.ts` -only adds operator-side commands (`login`, `logout`, `whoami`, `api `, -a CLI that signs itself in through the device grant) beside the unchanged -`start` tree. Three deployment-facing facts, none of which needs a chart value: - -- The device authorization grant (RFC 8628, #3587) adds `/device_authorization` - and the hosted `/device` page. Both sit outside `/console`, so they ride the - server catch-all, and the `/device` redirect target `/console/auth/device` - rides the auth console's `/console/auth` prefix - (`docs/src/guide/deployment/console-replicas.md`). The grant is opt-in per - client through the provisioning field `grantTypes`; an omitted `grantTypes` - does not enable it. -- The `@authup/client-auth-console` render contract is version 5 (was 3). A - bundle substituted through `AUTH_CONSOLE_PATH` and built against an older - contract is refused at boot and must be rebuilt - (`docs/src/guide/deployment/theming.md`). -- Console permission gating, token client narrowing, realm-gated entity reads - and the new `permission_check` permission are API and provisioning behavior. - They change which grants an operator hands out, not what the chart renders - (`docs/src/guide/deployment/upgrading.md`). +beta.66 to beta.67 changed no image entrypoint, CLI role, port or +environment-variable contract the chart owns: `Dockerfile`, `entrypoint.sh` +and `packages/client-auth-console` are unchanged, and `apps/authup/src` only +adds `authup api stats` beside the unchanged `start` tree. +Deployment-facing facts, none of which needs a chart value +(`docs/src/guide/deployment/upgrading.md`): + +- Migration `1789930726252-PathsAndEventAggregates` (folders for users and + clients, daily event rollups) runs on PostgreSQL and MySQL. The pre-upgrade + migration Job or a server boot with `MIGRATION_ENABLED` applies it. +- Boot-time migrations now take a database lock, so replicas starting together + with `MIGRATION_ENABLED` on no longer race. A waiting replica fails its boot + after 60 seconds and is restarted. The chart's migration Job ownership is + unchanged. +- Database sessions are pinned to UTC (`TimeZone` on PostgreSQL, `time_zone` + on MySQL). The built-in PostgreSQL and MySQL images run in UTC and the chart + sets no driver timezone option. A driver option that contradicts the pin (a + MySQL `timezone` other than UTC, `dateStrings`, `typeCast`, a PostgreSQL + `TimeZone` in the startup `options`) or a MySQL replication setup, passed + through `server.config`, now stops the boot. +- The new config field `eventLogAggregateRetentionDays` + (`EVENT_LOG_AGGREGATE_RETENTION_DAYS`, default 0 = forever, + `packages/server-config/src/sections/core/schema.ts`) is reachable through + the long tail (`server.config.core.eventLogAggregateRetentionDays`). The + rollup task runs wherever the worker sweeps run: the `start` process, or + the `start worker` Deployment when `worker.enabled=true`. +- Earlier deployment facts still hold: the device authorization grant rides + the server catch-all and the `/console/auth` prefix (beta.66), and a bundle + substituted through `AUTH_CONSOLE_PATH` must match auth console render + contract version 5. ## Image and CLI diff --git a/charts/authup/Chart.yaml b/charts/authup/Chart.yaml index 5001028..12a7fe7 100644 --- a/charts/authup/Chart.yaml +++ b/charts/authup/Chart.yaml @@ -5,7 +5,7 @@ description: Authup is an authentication & authorization system. This chart built-in PostgreSQL, MySQL and Valkey instances. type: application version: 0.4.2 -appVersion: "1.0.0-beta.66" +appVersion: "1.0.0-beta.67" kubeVersion: ">=1.25.0-0" home: https://authup.org icon: https://raw.githubusercontent.com/authup/helm/master/assets/icon.svg @@ -32,8 +32,8 @@ annotations: url: https://github.com/authup/helm artifacthub.io/changes: | - kind: changed - description: Track Authup v1.0.0-beta.66; no image entrypoint, CLI or environment-variable contract changes - - kind: added - description: The device authorization grant endpoints and the hosted /device page route through the existing server catch-all and auth console prefix; no new routing values + description: Track Authup v1.0.0-beta.67; no image entrypoint, CLI or environment-variable contract changes - kind: changed - description: A console bundle substituted through AUTH_CONSOLE_PATH must be rebuilt against auth console render contract version 5 + description: Authup v1.0.0-beta.67 ships migration 1789930726252-PathsAndEventAggregates, applied by the migration Job or the server boot + - kind: changed + description: Authup now pins database sessions to UTC; a database that ran in local time needs its historical timestamps converted once (see the Authup upgrading guide) diff --git a/charts/authup/README.md b/charts/authup/README.md index 077da30..fb8d6f2 100644 --- a/charts/authup/README.md +++ b/charts/authup/README.md @@ -7,9 +7,9 @@ # authup ![Version](https://img.shields.io/badge/Version-0.4.2?style=flat-square&color=informational) -![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0-beta.66](https://img.shields.io/badge/AppVersion-1.0.0--beta.66-informational?style=flat-square) +![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 1.0.0-beta.67](https://img.shields.io/badge/AppVersion-1.0.0--beta.67-informational?style=flat-square) -Authup is an authentication & authorization system. This chart deploys its combined or split API, console and worker roles, with optional built-in PostgreSQL, MySQL and Valkey instances. It runs Authup v1.0.0-beta.66's +Authup is an authentication & authorization system. This chart deploys its combined or split API, console and worker roles, with optional built-in PostgreSQL, MySQL and Valkey instances. It runs Authup v1.0.0-beta.67's role-based CLI topology: - one combined API and console workload by default (`start`)