5 posts tagged with "Security"

Two gaps closed in Settings → Access: the identity-provider group mapping is no longer a value only a helm upgrade could change, and scripts get a credential of their own instead of a borrowed session cookie.

v0.5.0 closes the gap between running avuru obs and changing it. Nearly everything an operator used to reach through values.yaml and a redeploy — collection, service groups, the SSO role mapping, API credentials — now lives in the app, and the app itself opens on a screen that answers how is the estate doing?

GET /api/v1/green/summary, /green/budgets and /green/report were registered without the session middleware that every other signal route uses. On an install with authentication enabled, all three answered 200 to a caller with no session at all.

Two questions an operator asks in the first week — where is my telemetry actually stored? and what can this role do? — now have a screen each.

v0.4.0 finishes the account lifecycle you started in v0.2: users can now be edited, reset and deleted from the UI, and anyone can change their own password. Reviewing that surface turned up three ways to get into an account that shouldn't have worked — all three are closed. Alongside them, an install that silently lost its schema migration now heals itself.