Skip to content

feat(endpoint-exposer): groups por ruta y autorización con header — spec requiere limpieza#18

Open
sebastiancorrea81 wants to merge 103 commits into
mainfrom
feature/avp-plugin
Open

feat(endpoint-exposer): groups por ruta y autorización con header — spec requiere limpieza#18
sebastiancorrea81 wants to merge 103 commits into
mainfrom
feature/avp-plugin

Conversation

@sebastiancorrea81

@sebastiancorrea81 sebastiancorrea81 commented May 20, 2026

Copy link
Copy Markdown
Contributor

Resumen

Branch experimental que agrega el campo groups por ruta en el service spec, permitiendo restringir el acceso a rutas por grupos de usuarios. Construido sobre feature/endpoint-exposer.

Cambios clave respecto a feature/endpoint-exposer

El specs/service-spec.json.tpl agrega:

  • groups por ruta — array de grupos autorizados para acceder a cada ruta. Si está vacío, la ruta es pública.
  • Sección authorization en el spec con enabled, headerName y allowedValues.
  • UI actualizada con documentación de los grupos en el form.

⚠️ Requiere limpieza antes de mergear

Este branch tiene contenido hardcodeado específico de un cliente que NO debe llegar a main:

  • Los valores del enum groups son grupos de AD específicos: AWS_PlataformaUpstream_Gestor_Desa, AWS_PlataformaUpstream_Administrador_Desa, etc.
  • publicDomain y privateDomain están fijados a idp.poc.nullapps.io.
  • visible_to usa {{ env.Getenv "NRN" }} en lugar de ser configurable.
  • assignable_to: "dimension" en lugar de "any".

La idea del campo groups es valiosa pero el spec necesita hacerse genérico antes de poder mergearse.

Test plan

  • Limpiar el spec: quitar grupos hardcodeados, dominio fijo y NRN hardcodeado
  • Decidir si groups debe ser un array libre de strings o un enum configurable por instancia
  • Implementar la lógica que usa groups para generar AuthorizationPolicy de Istio
  • Verificar que funciona con el stack de OPA del PR anterior

javi-null added 30 commits January 5, 2026 15:08
@javi-null
feat: endpoint exposer
bda3554 
feat: implement external dns and httproute

feat: change logic to get specification id

feat: add switch for different dns types

feat: add switch for different dns types

feat: add endpoint exposer service specs

feat: add domain editable

feat: add domain editable

feat: implement new route schema

feat: implement new route schema

feat: implement new route schema

feat: implement new route schema

feat: implement new route schema

feat: implement new route schema

fix: get scope

fix: get scope

fix: path

fix: get httproute if exists

fix: get httproute if exists

fix: get httproute rules

feat: implement echo for link and unlink

feat: implement echo for link and unlink

feat: implement echo for link and unlink

feat: implement echo for link and unlink

feat: implement echo for link and unlink

chore: change service slug

feat: update flow

feat: update flow

feat: update flow

feat: update flow

feat: update flow

feat: update flow

feat: update flow

feat: update flow

feat: update flow

feat: accept prefix and reg ex
@javi-null
feat: http routes to handle private and public traffic
303f6ce
@javi-null
feat: http routes to handle private and public traffic
c95b552
@javi-null
feat: http routes to handle private and public traffic
d63abe2
@javi-null
feat: http routes to handle private and public traffic
470b16d
@javi-null
chore: link to public gateway
9518ebd
@javi-null
chore: replace gateway
467abb8
@javi-null
chore: link to private gateway
3dfdf91
@javi-null
chore: remove alb scripts
9cc69db
@javi-null
chore: remove alb workflows
82dcf6b
@javi-null
chore: remove unused scripts and dns endpoints
af379b1
@javi-null
chore: remote DEBUG logs
11e2315
@javi-null
chore: remote DEBUG logs
2b89d8a
@javi-null
chore: DEBUG logs
d0638a0
@javi-null
feat: adapt endpoint exposer to work by service action
9f89c08
@javi-null
feat: adapt endpoint exposer to work by service action
4f3a2ec
@javi-null
feat: adapt endpoint exposer to work by service action
cc52dde
@javi-null
fix: retries on action creation
85b25e0
@javi-null
feat: if no service instance created allow continue without errors
3a7991e
@javi-null
feat: remove links
f7b425a
@javi-null
feat: wip authz plugins
9111e6d
@javi-null
feat: public and private domains
4eb2a97
@javi-null
feat: public and private domains
0a5d9fa
@javi-null
feat: public and private domains
684593f
@javi-null
fix: private httproute
be60250
@javi-null
fix: update flow
9215168
@javi-null
Merge branch 'feature/endpoint-exposer' into feature/plugins
b9a7174
@javi-null
feat: basic authorization
31e2d63
@javi-null
feat: basic authorization
33abaaf
@javi-null
feat: basic authorization
8edf8c0
sebas_correa and others added 30 commits May 22, 2026 20:57
@claude
feat(endpoint-exposer): render Authorized Groups in vertical column l…
8e73afe 
…ayout

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(endpoint-exposer): infer scope from link dimensions instead of f…
6fb368d 
…orm input

Remove scope from the link creation form. The scope is now automatically
derived by matching the link's service dimensions against available
application scopes (excluding deleted ones). The resolved scope is stored
in link results so it appears in the read view.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(endpoint-exposer): support multiple routes per link
611b01a 
- Link form now uses a routes array (method, path, visibility, groups
  per route) matching the original service spec UI pattern
- HTTPRoutes split by visibility: ee-link-{id}-public / -private
- One Cedar policy created per route; all IDs stored as policy_ids array
- Delete cleans up both HTTPRoute variants and all policy IDs
- scope field removed from form (inferred from service dimensions)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(endpoint-exposer): shorten AVP policy description to fit 150-char…
6d485dc 
… limit

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(link-spec): allow editing routes after link creation
55a2450 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(link-spec): make routes editable after link creation
6ca2d83 
Add description field to routes to force provider diff detection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(link-spec): use "update" instead of "edit" for editableOn
4c63f83 
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(link): add link-update workflow with proper scope and HTTPRoute …
ec44daa 
…reuse

- Entrypoint: map update action type to link-update workflow
- build_link_context: reuse stored HTTPROUTE_NAME and SCOPE on update
- link-update.yaml: delete old policies, rebuild HTTPRoute, create new policies

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(link-update): use LINK_ID for stable HTTPRoute name across updates
87df429 
- build_link_context: derive HTTPROUTE_NAME from link.id (stable)
  instead of action.id (changes on every update)
- delete_link_policies_by_name: search AVP by HTTPROUTE_NAME in
  description instead of relying on stored policy_ids
- link-update.yaml: use delete_link_policies_by_name for cleanup

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(link-update): add output to delete step so workflow runner continues
876c5ad 
np service workflow exec treats intermediate steps without output or
configuration as terminal. Adding POLICIES_DELETED output keeps the
pipeline flowing to build httproute and create avp policy.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(avp): replace exit 0 with conditional flow in delete scripts
da397b4 
When np service workflow exec sources scripts, exit 0 kills the parent
workflow process and skips remaining steps. Replace early exit 0 paths
with if/else blocks so the workflow continues normally.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat: add avp_policy_store_id param to service spec with auto-creation
afb6294 
Adds avp_policy_store_id as an optional service parameter. If left empty
during creation, a new AVP policy store is automatically provisioned and
its ID is stored in service results for subsequent actions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
refactor(link): remove visibility field, derive gateway from scope type
c42ab08 
Routes visibility was redundant since the gateway is already determined
by the scope type (internal → gateway-private, external → gateway-public).
Simplified build_link_httproute to use a single HTTPRoute per link,
selecting the gateway based on scope.service.attributes.visibility.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(unlink): derive HTTPROUTE_NAME from LINK_ID instead of stored att…
b5498fa 
…ributes

delete_link_policy silently skipped deletion when ACTION_LINK_ATTRIBUTES_POLICY_IDS
was not stored. Now unlink.yaml builds context first (HTTPROUTE_NAME derived from
stable LINK_ID) and uses delete_link_policies_by_name which searches AVP by name.
delete_link_httproute also falls back to HTTPROUTE_NAME from context.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(create_policies): replace exit 0 with conditional to avoid killin…
e37a123 
…g workflow

exit 0 in sourced scripts kills the parent workflow process, causing apply
and store service results steps to never run.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(update): remove duplicate store service results step from update.…
2091d4c 
…yaml

Having the step in both create.yaml (via include) and update.yaml was
causing it to not run. Let the include mechanism inherit it from create.yaml.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(apply): remove exit 0 that killed workflow after apply step
f7ad337 
exit 0 in sourced scripts terminates the parent workflow process, preventing
any steps after apply (store service results, store link results) from running.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(link): pass scope name to process_routes and fix scope lookup
bb27239 
build_link_httproute now stamps each route with {scope: $SCOPE} before
sourcing process_routes, which needs the field to resolve the backend.
process_routes was looking up scopes by .slug but route configs always
reference scope names; align with the rest of the codebase (.name).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(link): add ensure_policy_store step to link workflows
590caf3 
Link creation/update was failing with ResourceNotFoundException because
AVP_POLICY_STORE_ID was falling back to a hardcoded default that does not
exist in the target environment.

- Add ensure_policy_store step to link.yaml and link-update.yaml so the
  store is created on demand if not already configured.
- Extend ensure_policy_store to also look in .service.parameters so it
  picks up the ID stored by the service create/update workflow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(link): read avp_policy_store_id from service.attributes not servi…
c930674 
…ce.parameters

In NullPlatform, service action results (stored via np service action update
--results) are exposed as .service.attributes, not .service.parameters.
Reading the wrong field caused build_link_context and ensure_policy_store to
always get an empty ID, triggering a new policy store creation on every link
action instead of reusing the one created during service setup.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(service): delete AVP policy store on service deletion
b8d1820 
Adds delete_policy_store script and a new step in the delete workflow
so the AVP policy store is cleaned up when a service is removed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(service): ensure delete_policy_store step runs via include mechanism
5f36184 
The workflow runner only executes steps defined in the base (create.yaml)
when using include. Added delete_policy_store as a placeholder step in
create.yaml that skips by default, activated only in delete.yaml via
DELETE_POLICY_STORE=true.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(service): persist avp_policy_store_id in service.attributes
0e8e88d 
np service action update --results only stores at the action level
(ephemeral). Added np service patch to also write avp_policy_store_id
to service.attributes so subsequent actions (delete) can find it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix: persist avp store id early and fix delete workflow step ordering
1447810 
- ensure_policy_store now calls np service patch immediately after
  creating the store, so the id is persisted even if later steps
  don't run
- create.yaml: move store service results before delete avp policy store
  so it runs at step 8 (workflow appears to stop at that position)
- delete.yaml: add type/file to apply step override so the runner
  can execute it and continue to delete avp policy store

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(avp): avoid exit 0 in delete_policies to prevent workflow termina…
fedaaf0 
…tion

The workflow runner interprets explicit exit 0 as a signal to stop the
entire workflow. Replace early exit with if/else so the script completes
naturally and subsequent steps (apply, delete avp policy store) can run.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(link): store policy_ids as string to satisfy NullPlatform API sch…
1b242bc 
…ema validation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(avp): discover policy store via SSM instead of creating per-serv…
684fff5 
…ice stores

The Lambda authorizer uses an infrastructure-managed policy store (provisioned
by Terraform). Services now read the store ID from SSM on first run and cache
it in service.attributes to avoid repeated SSM calls. The store is never
deleted by service workflows — it is owned by infrastructure.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(spec): remove avp_policy_store_id from service spec UI
01d0ee6 
The store is now discovered automatically via SSM — users no longer
need to provide or see this infrastructure detail when creating a service.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
feat(avp): require avp_policy_store_id as mandatory UI input instead …
fb210d9 
…of SSM lookup

Simplifies the integration by removing the SSM dependency and IAM requirement.
The operator provides the store ID (Terraform output policy_store_id) when
creating the service. The field is required and only editable on create.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@claude
fix(spec): translate avp_policy_store_id description to English and r…
d9a47fc 
…eference security module

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sebastiancorrea81 @javi-null