Andrew Martinez 913b58757a Merge commit from fork ...

- withholds an enrollment's token and jwt from a non-admin caller when the owning
  identity is an admin, in the identity detail mapper and the enrollment mapper
- scopes the identity enrollments subresource so a non-admin does not see
  enrollments of admin identities, matching the top level /enrollments list
- threads the request context into MapIdentityToRestModel and
  MapEnrollmentToRestModel so the mappers can see the caller's permissions
- adds an integration test over the identity detail, identity list, and identity
  enrollments routes for every enrollment method
- adds ListIdentitiesByFilter to the management test client, which the 2.0 line
  did not carry
- adds the advisory to the 2.0.4 changelog

2026-08-27 13:34:26 -04:00

..

cli_tests

merge release-v2.0.x and move changelog entry

2026-08-26 16:34:09 -04:00

pki

updates test client/certs to expire in 7k days

2020-04-21 15:34:34 -04:00

shaper

Optimize imports

2026-01-28 15:01:35 -05:00

testdata

merge release-v2.0.x: move changelog entry to 2.0.4, keep both testdata readme sections

2026-08-26 16:35:41 -04:00

testutil

Fix flaky link state checker resurrecting faulted links

2026-06-30 10:17:35 -04:00

.gitignore

Fix failing tests

2025-03-18 16:00:40 -04:00

accept_manual_start_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

addressable_terminators_test.go

Handle UDP difference between proxy and tproxy implementations. Fixes #3540

2026-02-04 14:37:53 -05:00

api_client_client.go

adds regression test for api session certificate scoping

2026-08-19 17:46:03 -04:00

api_client_management.go

Merge commit from fork

2026-08-27 13:34:26 -04:00

api_error_test.go

Replace circuit fault logs with metrics

2025-11-12 17:13:34 -05:00

api_session_cert_connect_test.go

Update for deprecation of HA flag in Go SDK

2025-08-18 19:28:28 -04:00

api_session_certificates_test.go

adds regression test for api session certificate scoping

2026-08-19 17:46:03 -04:00

api_session_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

api_session_totp_token_test.go

backport openziti/ziti#4094 to release-v2.0.x accept first-party certs issued by a separate edge signing CA (#4153)

2026-08-26 14:43:34 -04:00

auth_cert_test.go

Fix flaky auth test by making sure we always do syncronous authenticator writes for the test

2026-04-06 20:36:22 -04:00

auth_external_jwt_signer_test.go

Backport.v2.0.x.fix.openziti.ziti.4118.ext jwt kid collision (#4192)

2026-08-26 16:03:00 -04:00

auth_headers_legacy_test.go

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

auth_headers_oidc_test.go

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

auth_mid_oidc_mfa_enroll_test.go

fixes #3496 allow TOTP enroll mid OIDC (#3656)

2026-03-11 16:27:31 -04:00

auth_oidc_cert_totp_test.go

fixes #3734 enforce client certificate proof-of-possession for OIDC sessions (#3805)

2026-04-23 12:00:46 -04:00

auth_oidc_csr_forging_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

auth_oidc_csr_refresh_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

auth_oidc_csr_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

auth_oidc_pop_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

auth_oidc_refresh_test.go

fixes #3496 allow TOTP enroll mid OIDC (#3656)

2026-03-11 16:27:31 -04:00

auth_oidc_test.go

Move the sdk info wait onto ManagementHelperClient

2026-08-19 16:55:01 -04:00

auth_perf_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

auth_policy_test.go

fixes openziti/ziti#3356 adds www-authenticate headers (#3561)

2026-02-24 10:01:36 -05:00

auth_updb_test.go

fixes two issues

2026-02-25 09:34:59 -05:00

authenticate.go

Add test race condition fix

2026-04-14 16:58:17 -04:00

authenticator_test.go

fix test that is no longer impacted

2026-02-26 10:06:56 -05:00

ca_test.go

backport openziti/ziti#4222 to release-v2.0.x report isCertExtendable correctly for OIDC cert auth (#4226)

2026-08-26 15:59:37 -04:00

ca_traffic_test.go

Provide more error context to SDKs for terminator errors. Fixes #3524

2026-02-04 14:36:21 -05:00

cert_request_extend_legacy_auth_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

cert_request_extend_oidc_auth_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

circuit_failure_cause_test.go

Add specific circuit failure error codes. Fixes #3717, fixes #3543, fixes #3364, fixes #2888, fixes #2859, fixes #1580

2026-04-14 15:52:49 -04:00

config_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

config_type_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

configsets.go

merge release-v2.0.x: move changelog entry to 2.0.4, keep both testdata readme sections

2026-08-26 16:35:41 -04:00

context_json.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

context_manager_helpers.go

fixes openziti/ziti#3333 based on the work from Jan Starkl <jan.starkl@tttech-digital.com>

2026-02-25 09:13:07 -05:00

context.go

backport openziti/ziti#4094 to release-v2.0.x accept first-party certs issued by a separate edge signing CA (#4153)

2026-08-26 14:43:34 -04:00

control.go

fix.openziti.ziti.3597.OIDC.by.default (#3605)

2026-03-04 10:03:14 -05:00

controller_helper.go

Update package paths for newly imported storage and ziti-db-explorer packages

2026-04-16 09:18:55 -04:00

create_circuit_v1_test.go

Set env on the v1 create-circuit request context. Fixes #4242

2026-08-07 15:30:40 -04:00

create_circuit_v3_test.go

Validate the API session token when creating circuits via CreateCircuitV3

2026-08-20 15:38:27 -04:00

current_identity_test.go

Replace circuit fault logs with metrics

2025-11-12 17:13:34 -05:00

custom_assertions.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

data_flow_close_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

data_flow_hs_rotating_test.go

Provide more error context to SDKs for terminator errors. Fixes #3524

2026-02-04 14:36:21 -05:00

data_flow_hs_test.go

Update deps and rebase on main

2026-02-04 15:48:42 -05:00

data_flow_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

dialer_identity_test.go

Add support for sending the dialing identity id and name to the hosting sdk. Fixes #3547

2026-02-09 09:18:25 -05:00

edge_router_helper.go

fixes openziti/ziti#3673 purge expired revocations, fix revocation bugs (#3679)

2026-03-11 20:33:38 -04:00

edge_router_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

edge_router_test.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

endpoint_test.go

Fix.3321.health.check.api.path (#3322)

2025-10-15 13:04:56 -04:00

endpoints

Endpoint management updates

2025-02-03 18:52:57 -05:00

enrollment_ca_auto_specific_test.go

backport openziti/ziti#3952 to v2.0 reject invalid externalIdClaim and stop enrollment panic (#3955)

2026-06-12 13:53:47 -04:00

enrollment_ca_auto_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

enrollment_identity_extend_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

enrollment_network_test.go

Replace circuit fault logs with metrics

2025-11-12 17:13:34 -05:00

enrollment_ott_specific_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

enrollment_ott_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

enrollment_refresh_test.go

Add permissions list to identity. Fixes #3430. Add read-only permission. Fixes #2109. Add CRUD permissions by entity type. Fixes #3435

2025-12-18 10:54:08 -05:00

enrollment_router_test.go

fixes #3239 router enrollment used identity expiration duration (#3240)

2025-08-26 09:28:54 -04:00

enrollment_token_to_cert_test.go

backport openziti/ziti#4063 to release-v2.0.x enroll with empty roles… (#4065)

2026-08-06 10:42:47 -04:00

enrollment_token_to_token_test.go

backport openziti/ziti#4063 to release-v2.0.x enroll with empty roles… (#4065)

2026-08-06 10:42:47 -04:00

enrollment_updb_specific_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

enrollment_updb_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

entities.go

add generic 'binding: spa', fix quickstart --home, lint cleanup

2026-05-03 11:08:40 -04:00

events_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

external_jwt_signer_jwks_endpoint_test.go

backport fixes GHSA-whjr-3j94-gw3c to v2.0 constrain external jwt signer JWKS fetching

2026-08-20 15:23:21 -04:00

external_jwt_signer_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

fabric_router_test.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

ha_cluster_formation_test.go

backport openziti/ziti#4094 to release-v2.0.x accept first-party certs issued by a separate edge signing CA (#4153)

2026-08-26 14:43:34 -04:00

ha_cluster.go

backport openziti/ziti#4094 to release-v2.0.x accept first-party certs issued by a separate edge signing CA (#4153)

2026-08-26 14:43:34 -04:00

ha_first_party_cert_test.go

backport openziti/ziti#4094 to release-v2.0.x accept first-party certs issued by a separate edge signing CA (#4153)

2026-08-26 14:43:34 -04:00

identity_api_session_activity_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

identity_enrollment_secrets_test.go

Merge commit from fork

2026-08-27 13:34:26 -04:00

identity_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

link_test.go

Increase link payload/ack queue sizes and make them configurable. Fixes #3706

2026-04-14 11:32:32 -04:00

list_services_perf_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

main_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

mfa_ziti_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

model_sdk_performance_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

network_jwt_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

oidc_auto_enable_test.go

fixes #3809 support CSR submission during OIDC authentication (#3840)

2026-05-07 13:56:48 -04:00

oidc_discovery_endpoint_test.go

backport: expand wildcard server-cert SANs to allow-listed OIDC issuers

2026-07-27 11:46:54 -04:00

oidc_error_codes_test.go

fixes #3788 return proper OIDC error codes and HTTP status codes (#3790)

2026-04-14 16:44:06 -04:00

permission_loss_test.go

Fixes for SDK terminator management. Add support for ziti sdk inspection. Fixes #3609

2026-03-11 13:10:28 -04:00

permissions_api_session_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_auth_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_authenticator_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_ca_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_config_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_config_type_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_edge_router_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_edge_router_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_enrollment_test.go

Prevent enrollment-based privilege escalation to admin identities. Fixes #4049

2026-06-26 13:18:33 -04:00

permissions_external_jwt_signer_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_identity_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_posture_check_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_service_edge_router_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_service_policy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_service_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_terminator_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

permissions_test_helper.go

Prevent enrollment-based privilege escalation to admin identities. Fixes #4049

2026-06-26 13:18:33 -04:00

permissions_transit_router_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_domain_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_mfa_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

posture_check_os_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

posture_check_process_multi_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_domain_legacy_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_domain_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_mac_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_os_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_process_multi_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_check_sdk_process_oidc_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

posture_revalidation_oidc_test.go

Revalidate dial circuits and bind terminators on posture changes. Fixes #3928

2026-06-13 01:56:44 -04:00

request_body_limit_test.go

backport fixes GHSA-q8g9-jc4c-jp6q to v2.0 limit pre-auth request body buffering

2026-08-19 17:46:02 -04:00

rest_auth_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

revocation_enforcement_oidc_test.go

Anchor the post-cutoff revocation test to a later iat second

2026-08-19 10:59:34 -04:00

revocation_test.go

fixes #3734 enforce client certificate proof-of-possession for OIDC sessions (#3805)

2026-04-23 12:00:46 -04:00

root_endpoint_test.go

fixes #2026 root version handlers 404

2024-05-08 10:33:50 -04:00

router_data_model_test.go

Fix event name, IdentityFullStateState -> IdentityFullState

2026-03-25 12:05:23 -04:00

router_identities_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

router_reenroll_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

sdk_api_session_token_update_test.go

Update ziti version to 2.0

2026-01-28 12:34:10 -05:00

sdk_auth_test.go

Add permissions list to identity. Fixes #3430. Add read-only permission. Fixes #2109. Add CRUD permissions by entity type. Fixes #3435

2025-12-18 10:54:08 -05:00

sdk_event_test.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

sdk_oidc_totp_enroll_test.go

fixes #3496 allow TOTP enroll mid OIDC (#3656)

2026-03-11 16:27:31 -04:00

service_edge_router_policy_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

service_list_refresh_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

service_policy_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

service_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

session_legacy_token_id_test.go

Sign legacy session JWT with the durable session id. Fixes #4125

2026-07-21 21:20:09 -04:00

specs_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

standard_error_test.go

Optimize imports

2026-01-28 15:01:35 -05:00

standard.go

Optimize imports

2026-01-28 15:01:35 -05:00

sticky_terminator_test.go

Add test race condition fix

2026-04-14 16:58:17 -04:00

terminator_ownership_test.go

Scope terminator operations to the requesting router. Fixes #4236

2026-08-07 14:50:29 -04:00

terminator_test.go

Replace circuit fault logs with metrics

2025-11-12 17:13:34 -05:00

terminator_update_test.go

Update deps and rebase on main

2026-02-04 15:48:42 -05:00

transit_router_test.go

Add support for ctrlChanListener on router to the model. Fixes #3635

2026-03-07 00:00:51 -05:00

tunneler_data_flow_test.go

Handle UDP difference between proxy and tproxy implementations. Fixes #3540

2026-02-04 14:37:53 -05:00