Paul Lorenz 3027fdffd3 Prevent enrollment-based privilege escalation to admin identities. Fixes #4010 ...

- blocks non-admins from creating an enrollment that targets an admin identity
- blocks non-admins from reading, refreshing, or deleting an admin identity's enrollment
- filters admin identity enrollments out of enrollment lists for non-admin callers
- adds a permissions test covering the escalation paths and admin-allowed behavior

2026-06-19 12:27:53 -04:00

..

api

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

apierror

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

change

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

command

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

config

Enforce api-session and identity revocations on the router. Fixes #3927

2026-06-13 01:36:12 -04:00

db

Add router.link.v1 config type. Fixes #3974 (#3975)

2026-06-16 16:38:13 -04:00

entities

Update copyright

2022-06-30 17:45:08 -04:00

env

Add a recover mechanism for when a controller cluster can't form a quorum. Fixes #3849

2026-05-27 09:23:01 -04:00

event

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

events

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

fields

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

handler_ctrl

Prep for channel v5: bind handler invocation, send priorities. Fixes #3942

2026-06-05 15:24:45 -04:00

handler_edge_ctrl

Collapse fabric and edge services at the db level. Fixes #3934

2026-06-16 13:04:13 -04:00

handler_mgmt

Distribute routers and router-target configs through the RDM. Fixes #3976 (#3977)

2026-06-16 22:31:43 -04:00

handler_peer_ctrl

Fix potential deadlock if panic while lock held

2026-04-06 09:56:43 -04:00

idgen

Optimize imports

2026-01-28 15:01:35 -05:00

internal

Prevent enrollment-based privilege escalation to admin identities. Fixes #4010

2026-06-19 12:27:53 -04:00

ioc

Refactor xgress_edge_tunnel_v2 to make it more pluggable

2025-09-03 16:03:15 -04:00

jwtsigner

fix #3231 use root controller server certs for OIDC signing (#3236)

2025-08-26 09:29:50 -04:00

middleware

Optimize imports

2026-01-28 15:01:35 -05:00

model

Collapse fabric and edge services at the db level. Fixes #3934

2026-06-16 13:04:13 -04:00

models

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

network

Keep controller mesh fully connected, as much as possible. Fixes #3684

2026-05-27 10:21:34 -04:00

oidc_auth

Enforce api-session and identity revocations on the router. Fixes #3927

2026-06-13 01:36:12 -04:00

peermsg

Add more raft configuration options. Fixes openziti/fabric#597

2023-02-15 23:47:57 -05:00

permissions

Tidy duplicate permission types. Remove vestigial info message. Update changelog

2026-05-08 11:34:20 -04:00

raft

Prep for channel v5: bind handler invocation, send priorities. Fixes #3942

2026-06-05 15:24:45 -04:00

response

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

rest_client

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

rest_model

Add configs field to routers. Fixes #3780

2026-06-11 13:45:58 -04:00

rest_server

Add configs field to routers. Fixes #3780

2026-06-11 13:45:58 -04:00

rest_util

Optimize imports

2026-01-28 15:01:35 -05:00

scripts

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

server

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

specs

Add configs field to routers. Fixes #3780

2026-06-11 13:45:58 -04:00

storage

Enforce api-session and identity revocations on the router. Fixes #3927

2026-06-13 01:36:12 -04:00

subcmd

Optimize imports

2026-01-28 15:01:35 -05:00

sync_strats

Distribute routers and router-target configs through the RDM. Fixes #3976 (#3977)

2026-06-16 22:31:43 -04:00

webapis

rework wildcard oidc per PR comments

2026-06-03 13:15:49 -04:00

xctrl

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

xctrl_example

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

xmgmt

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

xt

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

xt_common

Expand routing costs to use full uint32 space. Each precedence can now cover about 1B. Fixes #3074

2026-02-20 15:54:41 -05:00

xt_random

global circuit costs not cleared when terminator is deleted. Fixes #3556

2026-02-20 15:54:06 -05:00

xt_smartrouting

Optimize imports

2026-01-28 15:01:35 -05:00

xt_sticky

Optimize imports

2026-01-28 15:01:35 -05:00

xt_weighted

costing calculation for the weighted terminator selection strategy is incorrect. Fixes #3557

2026-02-20 15:54:06 -05:00

agent.go

Consolidate agent channel plumbing into common/agent. Fixes #3894

2026-06-12 15:47:03 -04:00

controller.go

add generic 'binding: spa', fix quickstart --home, lint cleanup

2026-05-03 11:08:40 -04:00

health.go

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

settings.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00