- splits Open API 2.0 (swagger) into client/management APIs
- uses go-swaggers flatten capabilities
- uses newer version of go-swagger (v0.27.0)
- introduces /edge/client/v1, /edge/management/v1
- non-prefixed URLs default to /edge/client/v1
- splits some shared management/client API handlers
- renames some REST models to "client" instead of "limited"
- passes all apitests, fails dataflow upd test (main fails this as well)
- updates generate rest script for powershell
- todo: test generate rest script for bash
- todo: use xweb (different branch)
- adds a new posture check for dealing with multiple processes
- supports anyOf and allOf semantics
- does not require new posture responses, current process responses
suffice
- tests
- routers can now opt to extend their enrollment at any time with a
previous or new key
- adds tests for router enrollment
- adds tests for router enrollment extension
- update api session session state on mfa enroll
- update posture data state on mfa enroll
- centralize setting mfa posture data
- pass isMfaRequired and isMfaComplete in apiSession/currentApiSession
- GET /identity/{id}/posture-data is now formalized in the swagger.yml
- posture data output now includes the last 100 failed service requests
with temporal posture data state
- added ziti controller instance id header to detect restarts
- add GET /identity/{id}/failed-service-requests
- as updates to API Sessions can now happen later than the last time
they were active, updatedAt is no longer the correct representation of
the last activity an API Session had
- move all logic that used updatedAt to lastActivityAt
- add migration to set lastActivityAt
Router state used to be stored and accessed in a thread unsafe way.
State is now locks on a mutex for setting values and values are copied
out for referencing.
- swagger copy pasta was using the same parameter name for everything,
"body", which made error messages read "error in body for body"
- parameter rename ripples into parameter property definitions
- allow mfa codes in GET and DELETe as libuv doesn't allow them to have
bodies (-.-)
hostnames may be a nil pointer at times now due to the fact that edge
routers may be waiting to sync and may be "online" but edge hellos
have not been exchanged.
- edge router sync is now modular and can have different strategies
- plans to make this configurabe in the future with multiple strat
- legacy strategy is called "instant" and is the only option
- instant strat now supports control signaling and resync requests
- edge routers now do not remove connections till after a full sync
- added the ability for the controller to report the er sync status
- added er syn status to GET /edge-routers list and detail
- improved log output in sync logic
- deletes ottca enrollment when CA is deleted
- adds API tests
- adds migration to remove currently orphaned ottca enrollments
- migration tested on a v15 database with orphaned ottca enrollments
This move isolates the cost of hasApiSession to the identity endpoint
lookups in the REST API. Being in the model caused this cost to be
shared on all identity lookups for internal logic.
Limit 1 is an attempt to reduce the cost of searching over a large set.
API Sessions do not have an index on identity id so there is still some
cost.
- add server headers during HTTP handler delegation rather than at HTTP
response time
- remove all old header setting locations
- remove unused status writer and other response code
- add manual set on authentication for session headers
Andrew Martinez