The row was inserted at TCP accept with a provisional AUTH_FAILED, so the
kubelet's TCP readiness probe on the SFTP port wrote a "failed sign-in"
row every 5 seconds per pod in kof22 prod (about 35k a day). The row is
now written at the first authentication attempt or a pre-auth refusal
(the connection rate limit); probes and port scans leave nothing. The
per-IP connection rate is still counted at accept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A user-preferences section (QRun-IO/qqq#1162) for anyone with
file_gateway.connect: the SFTP username, host and host-key fingerprint,
and the user's own keys. "Add key" creates the user's account on first use
and inserts the key through the table (validation and audits apply);
"Revoke" sets revoked_at; labels and expiry are editable. The provider
resolves the user only from the request context and touches only that
user's account and keys. Duplicate fingerprints are rejected up front.
99 tests (11 new); JaCoCo 92.6% instructions, 97.7% classes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replaces the 4.1.0-SNAPSHOT stand-in (guardrail G7) and drops the private
FG-SNAPSHOT build notes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (e) of docs/DESIGN.md:
- endpoints (aliases) with path validation and the ENDPOINTS_ONLY chroot;
BULK_LOAD, INBOX (consumer by name), VIEW, REPORT and OUTBOX kinds;
- the outbox provider (FileGatewayOutbox.put) in every deployment, outbox
files, pickup tracking and onDownloaded;
- optional per-account PGP: decrypt uploads, encrypt downloads (keys in
memory, BouncyCastle);
- the typed app home (KPIs, recent failures, top partners, active
sessions, gateway servers via file_gateway_server heartbeats);
- Unlock/Disable account, Revoke key and End session record actions;
- the daily retention process; FileGatewayIntegrations (ESB, Quick
Search, API);
- docs/k8s example manifests (SFTP port 22 only, LB IP 10.100.22.65);
- plain labels for fields, enum values and child tabs; a test-scope demo
server for screenshots.
88 tests; JaCoCo 92% instructions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (c) of docs/DESIGN.md:
- views/<slug>.<csv|xlsx|json>: the saved view's filter, columns and order
exported as the user through /qqq/v1 table export, streamed;
- reports/<slug>.<fmt>: renderSavedReport run as the user, then the file
streamed from /download (listed only when a report storage table exists);
- a generated read channel with a bounded in-memory read-ahead window (no
disk), maxGeneratedFileMb and the daily download cap, DOWNLOAD transfer
rows.
Masking is what /qqq/v1 returns for the user: tested with a
FieldSecurityLock DENY field, byte-compared with a direct export.
77 tests; JaCoCo 92.6% instructions, 97.2% classes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (b) of docs/DESIGN.md:
- SFTP puts into upload/<profile>/ stream to qbit-object-storage with
SHA-256 and size computed in flight, a bounded in-memory reorder window,
size and daily quota enforcement, temporary-suffix and rename handling;
- upload jobs: dedupe, optional scanner (quarantine), a bounded worker pool
with exclusive claims, stale requeue and the 1m..6h retry schedule;
- the consumer pipeline (FileGatewayConsumersMetaData) with the built-in
bulk-load consumer, which runs <table>.bulkInsert as the user through
/qqq/v1 with the saved profile (fails when value mappings are missing);
- sidecars (.processing/.done/.error), results CSVs and the archive, all
in object storage, readable over SFTP; rm acknowledges a job;
- QAlerts.notify on failures (and success when asked);
- the "Retry upload" record action.
64 tests; JaCoCo 93% instructions, 97% classes; no-disk guard on.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (a) of docs/DESIGN.md:
- the seven file_gateway_* tables (entities, PVSs, joins, child lists,
DDL), contingent possible-value filters on endpoint profile/view/report,
SSH key validation with server-side fingerprints, permissions
file_gateway.view/admin/connect, the sftp client channel and walls;
- Apache MINA SSHD 2.16 SFTP server: publickey only (no password or
keyboard-interactive), no shell/exec/forwarding, restricted algorithms,
in-memory host key from an env var name;
- SshKeyAuthenticator: account and key checks, CIDR allowlists, expiry,
DB-backed lockouts with an alert, per-IP rate limit, concurrent session
cap, live revocation; sessions minted with createAutomatedSessionForUser
and registered as UiApiInProcessSessions, requiring file_gateway.connect;
- a virtual NIO filesystem over /qqq/v1 (channel sftp): apps, tables,
upload/<profile>/, views/, reports/, results/, archive/; writes and
reads denied until phases (b) and (c);
- connection and transfer logs;
- the com.kingsrook.qbits.filegateway.api consumer/outbox contract types.
54 tests including a no-disk guard; JaCoCo 95% instructions, 98% classes.
Builds against QRun-IO/qqq#1170 (UiApiInProcessSessions).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The approved spec for qbit-file-gateway: a virtual SFTP tree generated
from metadata, uploads into saved bulk-load profiles, downloads of saved
views and reports, SSH-key accounts, audit tables, the consumer and
outbox API agreed with qbit-edi, the core UiApiInvoker additions, the
k8s example and the acceptance tests.
Owner decisions (2026-10-12): all recommendations accepted.
Owner decisions (2026-10-13): separate deployment, /qqq/v1 only,
SSH keys, SFTP only (FTPS future), no files or filesystem.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replaces the application template example with the qbit-file-gateway
skeleton per QRun-IO/qqq docs/QRUN-QBIT-REPO-STANDARD.md: pom on
qbit-build-parent with checkstyle and coverage gates, CircleCI on
qqq-orb 0.6.8 with the GA-only release tag filter, RC automation,
dependabot, governance files, Maven wrapper and a minimal producer
and config.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5