The gateway checked these names only in code, so getAllAvailablePermissions
never listed them: the qbit-authentik mapper expanded them to nothing and
Identity policies could not grant them. FileGatewayPermissionChecker now
implements buildAvailablePermission, collapsing every gateway object onto
the three names (reads/widgets -> view, writes/processes -> admin, app ->
connect). Adds a test that all three are in the catalog.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Failed jobs and Locked accounts now declare increaseIsGood=false (volume tiles
stay true). The four home tables (Recent failures, Top partners, Active
sessions, Server) set noRowsFoundHTML saying why they are empty.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
QRun-IO/.github#2 adds a tag-and-release job that signs vX with the
QRUN_TAG_SIGNING_KEY secret after Maven Central confirms the artifact.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The row was inserted at TCP accept with a provisional AUTH_FAILED, so the
kubelet's TCP readiness probe on the SFTP port wrote a "failed sign-in"
row every 5 seconds per pod in kof22 prod (about 35k a day). The row is
now written at the first authentication attempt or a pre-auth refusal
(the connection rate limit); probes and port scans leave nothing. The
per-IP connection rate is still counted at accept.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Active sessions table had five (the pod is on the connection record
and in the Server table). kof22's readability guard allows four, so
tables stay readable at phone widths; a test now checks every home table.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fixed 1fr widths made Next lay the home tables out at a minimum width
(the kof22 readability guard, docs/admin-dashboards.md). Columns now
declare no width; a test keeps it that way.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A host without saved reports (kof22) failed instance validation:
file_gateway_alias.savedReportId named the unregistered possible-value
source savedReport (and its bulkEdit process inherited it). The producer
now drops the picker and its contingent filter for savedView, savedReport
and savedBulkLoadProfile when the host has not registered that source.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Moves qqq-orb@0.6.8 to qqq-orb@0.6.9, which passes --update-snapshots so cached SNAPSHOT dependencies are re-checked on every build (QRun-IO/qqq-orb#22).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A user-preferences section (QRun-IO/qqq#1162) for anyone with
file_gateway.connect: the SFTP username, host and host-key fingerprint,
and the user's own keys. "Add key" creates the user's account on first use
and inserts the key through the table (validation and audits apply);
"Revoke" sets revoked_at; labels and expiry are editable. The provider
resolves the user only from the request context and touches only that
user's account and keys. Duplicate fingerprints are rejected up front.
99 tests (11 new); JaCoCo 92.6% instructions, 97.7% classes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replaces the 4.1.0-SNAPSHOT stand-in (guardrail G7) and drops the private
FG-SNAPSHOT build notes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Core #1157 made the qbit prefixes in the assistant defaults transitional
and turned audit* into a write-only deny for the assistant. The sftp
channel now denies file_gateway_*, audit*, authentik_*, webhooks_*,
worm_audit_*, secured_data_* and assistant_* itself, plus core's generic
secret/credential/permission/session patterns.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (e) of docs/DESIGN.md:
- endpoints (aliases) with path validation and the ENDPOINTS_ONLY chroot;
BULK_LOAD, INBOX (consumer by name), VIEW, REPORT and OUTBOX kinds;
- the outbox provider (FileGatewayOutbox.put) in every deployment, outbox
files, pickup tracking and onDownloaded;
- optional per-account PGP: decrypt uploads, encrypt downloads (keys in
memory, BouncyCastle);
- the typed app home (KPIs, recent failures, top partners, active
sessions, gateway servers via file_gateway_server heartbeats);
- Unlock/Disable account, Revoke key and End session record actions;
- the daily retention process; FileGatewayIntegrations (ESB, Quick
Search, API);
- docs/k8s example manifests (SFTP port 22 only, LB IP 10.100.22.65);
- plain labels for fields, enum values and child tabs; a test-scope demo
server for screenshots.
88 tests; JaCoCo 92% instructions.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (c) of docs/DESIGN.md:
- views/<slug>.<csv|xlsx|json>: the saved view's filter, columns and order
exported as the user through /qqq/v1 table export, streamed;
- reports/<slug>.<fmt>: renderSavedReport run as the user, then the file
streamed from /download (listed only when a report storage table exists);
- a generated read channel with a bounded in-memory read-ahead window (no
disk), maxGeneratedFileMb and the daily download cap, DOWNLOAD transfer
rows.
Masking is what /qqq/v1 returns for the user: tested with a
FieldSecurityLock DENY field, byte-compared with a direct export.
77 tests; JaCoCo 92.6% instructions, 97.2% classes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (b) of docs/DESIGN.md:
- SFTP puts into upload/<profile>/ stream to qbit-object-storage with
SHA-256 and size computed in flight, a bounded in-memory reorder window,
size and daily quota enforcement, temporary-suffix and rename handling;
- upload jobs: dedupe, optional scanner (quarantine), a bounded worker pool
with exclusive claims, stale requeue and the 1m..6h retry schedule;
- the consumer pipeline (FileGatewayConsumersMetaData) with the built-in
bulk-load consumer, which runs <table>.bulkInsert as the user through
/qqq/v1 with the saved profile (fails when value mappings are missing);
- sidecars (.processing/.done/.error), results CSVs and the archive, all
in object storage, readable over SFTP; rm acknowledges a job;
- QAlerts.notify on failures (and success when asked);
- the "Retry upload" record action.
64 tests; JaCoCo 93% instructions, 97% classes; no-disk guard on.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Phase (a) of docs/DESIGN.md:
- the seven file_gateway_* tables (entities, PVSs, joins, child lists,
DDL), contingent possible-value filters on endpoint profile/view/report,
SSH key validation with server-side fingerprints, permissions
file_gateway.view/admin/connect, the sftp client channel and walls;
- Apache MINA SSHD 2.16 SFTP server: publickey only (no password or
keyboard-interactive), no shell/exec/forwarding, restricted algorithms,
in-memory host key from an env var name;
- SshKeyAuthenticator: account and key checks, CIDR allowlists, expiry,
DB-backed lockouts with an alert, per-IP rate limit, concurrent session
cap, live revocation; sessions minted with createAutomatedSessionForUser
and registered as UiApiInProcessSessions, requiring file_gateway.connect;
- a virtual NIO filesystem over /qqq/v1 (channel sftp): apps, tables,
upload/<profile>/, views/, reports/, results/, archive/; writes and
reads denied until phases (b) and (c);
- connection and transfer logs;
- the com.kingsrook.qbits.filegateway.api consumer/outbox contract types.
54 tests including a no-disk guard; JaCoCo 95% instructions, 98% classes.
Builds against QRun-IO/qqq#1170 (UiApiInProcessSessions).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandCodex