feat: guided empty states, Setup card, starter header rule and bucket presign overrides #21

2026-10-14T21:57:52Z

KofTwentyTwo commented

2026-10-14 21:57:52 +00:00

(Migrated from github.com)

Audit per table

table	used?	seeded?	help
object_storage_connection	yes: ConfigSync (sync, `withOverrides` reads limits/timeouts)	no: written from code	yes
object_storage_connection_capability	yes: CapabilityStore	no: runtime probe	yes
object_storage_bucket	yes: ConfigSync and most runtime; presign TTLs were NOT read back (fixed)	no: written from code	yes
object_storage_bucket_capability	yes: CapabilityStore	no: runtime probe	yes
object_storage_folder	yes: FolderIndex	no: index	yes
object_storage_object	yes: ObjectIndex and processes	no: index	yes
object_storage_object_version	NO: nothing reads or writes it (indexer lists current versions only)	no	yes, says "Not used yet"
object_storage_object_reference	yes: ReferenceScan	no: needs a host reference provider	yes
object_storage_header_rule	yes: DefaultObjectHeaderPolicy	yes: disabled `default-mutable`	yes
object_storage_protection_rule	yes: ProtectionRules	no: a rule needs a bucket (host-specific)	yes
object_storage_operation	yes: OperationLog	no: log	yes
object_storage_usage_daily	yes: StorageJobs	no: nightly job	yes

Changed

Wiring fix: the bucket row's maxPresignGetSeconds / maxPresignPutSeconds are now read at runtime (ConfigSync.withBucketOverrides, called from ObjectStorageRuntime.bucketConfig and ActionSupport.config), so they cap presigned links and the download-link action. publicBaseUrl, trashBucketAlias and trashPrefix are identity: rewritten from code on every sync and read-only in the UI, so they are not read back (test proves a tampered row is ignored and rewritten).
Help bundle plus ObjectStorageHelp (STAND-IN core=qqq#1198), Setup card on the Storage home (StorageSetupStatus; a host's own header policy counts as set up).
object-storage-defaults.changelog.sql: a disabled default-mutable header rule (**, public, max-age=3600, priority 1000). Inserted disabled so no existing host changes on deploy. Only the sql-check precondition form is used.
README, CHANGELOG, UPGRADE (includes the behavior note about edited presign rows).
Db.java and ObjectStorageSchema are untouched (#18, #19).

Tests

BucketRowOverridesTest (row edit changes the presigned URL's X-Amz-Expires; identity stays code-owned), DefaultsChangelogTest (real Liquibase on H2/PostgreSQL mode: seeds, second run no-op, edit survives, existing rule and missing table are MARK_RAN, enabling the rule changes headers), ObjectStorageTablesGuardrailTest, StorageSetupStatusTest. ./mvnw verify green (138 tests, checkstyle, JaCoCo). Test deps added: h2 2.3.232, liquibase-core 4.33.0.

Not done

object_storage_object_version is not wired: indexing version history needs ListObjectVersions in the scanner and write-through (more than a day). The table and its Versions tab are labeled "Not used yet" in help and the guardrail lists it in NOT_USED_YET.
No protection-rule seed (needs a bucket).

🤖 Generated with Claude Code

## Audit per table | table | used? | seeded? | help | |---|---|---|---| | object_storage_connection | yes: ConfigSync (sync, `withOverrides` reads limits/timeouts) | no: written from code | yes | | object_storage_connection_capability | yes: CapabilityStore | no: runtime probe | yes | | object_storage_bucket | yes: ConfigSync and most runtime; presign TTLs were NOT read back (fixed) | no: written from code | yes | | object_storage_bucket_capability | yes: CapabilityStore | no: runtime probe | yes | | object_storage_folder | yes: FolderIndex | no: index | yes | | object_storage_object | yes: ObjectIndex and processes | no: index | yes | | object_storage_object_version | NO: nothing reads or writes it (indexer lists current versions only) | no | yes, says "Not used yet" | | object_storage_object_reference | yes: ReferenceScan | no: needs a host reference provider | yes | | object_storage_header_rule | yes: DefaultObjectHeaderPolicy | yes: disabled `default-mutable` | yes | | object_storage_protection_rule | yes: ProtectionRules | no: a rule needs a bucket (host-specific) | yes | | object_storage_operation | yes: OperationLog | no: log | yes | | object_storage_usage_daily | yes: StorageJobs | no: nightly job | yes | ## Changed - **Wiring fix:** the bucket row's `maxPresignGetSeconds` / `maxPresignPutSeconds` are now read at runtime (`ConfigSync.withBucketOverrides`, called from `ObjectStorageRuntime.bucketConfig` and `ActionSupport.config`), so they cap presigned links and the download-link action. `publicBaseUrl`, `trashBucketAlias` and `trashPrefix` are identity: rewritten from code on every sync and read-only in the UI, so they are not read back (test proves a tampered row is ignored and rewritten). - Help bundle plus `ObjectStorageHelp` (STAND-IN core=qqq#1198), Setup card on the Storage home (`StorageSetupStatus`; a host's own header policy counts as set up). - `object-storage-defaults.changelog.sql`: a **disabled** `default-mutable` header rule (`**`, `public, max-age=3600`, priority 1000). Inserted disabled so no existing host changes on deploy. Only the sql-check precondition form is used. - README, CHANGELOG, UPGRADE (includes the behavior note about edited presign rows). - Db.java and ObjectStorageSchema are untouched (#18, #19). ## Tests `BucketRowOverridesTest` (row edit changes the presigned URL's `X-Amz-Expires`; identity stays code-owned), `DefaultsChangelogTest` (real Liquibase on H2/PostgreSQL mode: seeds, second run no-op, edit survives, existing rule and missing table are MARK_RAN, enabling the rule changes headers), `ObjectStorageTablesGuardrailTest`, `StorageSetupStatusTest`. `./mvnw verify` green (138 tests, checkstyle, JaCoCo). Test deps added: h2 2.3.232, liquibase-core 4.33.0. ## Not done - `object_storage_object_version` is not wired: indexing version history needs ListObjectVersions in the scanner and write-through (more than a day). The table and its Versions tab are labeled "Not used yet" in help and the guardrail lists it in `NOT_USED_YET`. - No protection-rule seed (needs a bucket). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-object-storage#21