Repository navigation
Release v1.19.6 - #862
Merged
Merged
Release v1.19.6#862
Conversation
These are mechanical dependency bumps and do not change functionality. ## Packages updated - `cloud.google.com/go/dataproc/v2` v2.26.0 -> v2.27.0 - `cloud.google.com/go/redis` v1.26.0 -> v1.27.0 - `connectrpc.com/connect` v1.21.0 -> v1.21.1 - `github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/storage/armstorage/v4` v4.2.0 -> v4.3.0 - `github.com/auth0/go-jwt-middleware/v3` v3.3.0 -> v3.4.0 - `github.com/go-jose/go-jose/v4` v4.1.5 -> v4.1.6 - `github.com/resend/resend-go/v4` v4.8.2 -> v4.9.0 <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **Low Risk** > Dependency-only lockfile changes with no logic edits; auth and JWT libraries were bumped on minor/patch versions, so smoke tests on auth and email paths are sufficient. > > **Overview** > This PR only updates **`go.mod`** and **`go.sum`** with routine Friday dependency bumps; there is no application or generated code change. > > **Google Cloud clients:** `dataproc/v2` (v2.26.0 → v2.27.0) and `redis` (v1.26.0 → v1.27.0) for infrastructure adapters. > > **RPC:** `connectrpc.com/connect` patch v1.21.0 → v1.21.1 (used by Connect providers and generated APIs). > > **Azure:** `armstorage/v4` v4.2.0 → v4.3.0 for storage resource management. > > **Auth / crypto:** `auth0/go-jwt-middleware/v3` v3.3.0 → v3.4.0 (shared JWT middleware in `go/auth`) and `go-jose/v4` v4.1.5 → v4.1.6 (CLI JWT handling). > > **Email:** `resend-go/v4` v4.8.2 → v4.9.0 for api-server Resend integration. > > Treat as mechanical version alignment; behavior should be unchanged aside from whatever each upstream release notes document. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 4f0a9083f105fec29f5f1fe85b1241e712b36a55. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> Co-authored-by: Cursor <cursoragent@cursor.com> GitOrigin-RevId: 6352670174181127ee1b887b8602610c2e2caa99
Members need to explore infrastructure and manage changes without changing account settings. This adds the reduced Member Auth0 role, renames the existing customer role to Admin and staff role to Overmind Staff in place, and updates the signup Action after the renames. Onboarding now accepts account-read access for the authenticated user’s own progress. CLI exploration and Terraform workflows no longer request broad API-read/config-write access. Label-rule creation, editing, deletion and reapplication require config-write; Members retain change submission/deletion, custom signals and risk feedback. Plan and decisions: https://linear.app/overmind/issue/ENG-6819 Implementation: https://linear.app/overmind/issue/ENG-6818 ## Validation - Targeted backend and CLI permission tests pass with race detection; isolated PostgreSQL uses the real schema, with a deterministic LLM stub. - Lint passes using the repository’s Go 1.27.1 toolchain. - Terraform formatting and validation pass (existing deprecation warnings). - Rendered Auth0 Action passes JavaScript syntax checking. ## Coverage audit The targeted coverage profile exercises all 13 changed executable Go statements. Temporarily reverting each of the eight permission changes caused a regression test to fail (8/8 detected); production files were restored afterward. Tests include accepted/denied onboarding scopes and persistence/subject isolation; all four label-rule mutation checks, unchanged state after denied writes, and retained Member rule reads/tests; retained change creation/deletion, signals and feedback; and CLI scope requirements. Command-level smoke tests exercise real local API authentication through StartSources and Explore, including rejected tokens. They run without race instrumentation because pterm's existing animated spinner races internally; backend and scope-unit tests pass separately with -race. These command tests are explicitly excluded from race builds. Environment Terraform plan review and live dogfood/Auth0/CLI-cloud-source checks remain pending; automated coverage does not prove deployment behaviour. No infrastructure apply or user role assignment has been performed. GitOrigin-RevId: 11ccb679f76372bafe783a9af91529d8c6aac84e
## Summary New account creators receive customer Admin, while invitees and users joining an existing SSO account receive Member. A configured SSO admin group controls the user's Auth0 customer role on each login. Existing customer roles are preserved outside that policy. The Action checks the current role first, removes the opposite customer role before assigning a new one, awaits all Management API operations, preserves unrelated staff roles, and denies login if reconciliation fails. It assigns Auth0 roles rather than injecting scopes directly. ## Linear Ticket Fixes: [ENG-6812](https://linear.app/overmind/issue/ENG-6812) — RBAC: assign Admin/Member Auth0 roles in the post-login Action Implementation plan: [ENG-6825](https://linear.app/overmind/issue/ENG-6825). ## Changes - Extend CreateUser with presence-aware `created_account` and `is_only_user` fields. Count all users in the resolved account, including pending invitations. The agreed sole-user fallback recovers a failed initial Admin assignment without storing role decisions in the DB or pending Auth0 metadata. - Move assignment into Create Account after the backend call, remove the old Assign Base Role Action, and wire its SDK/template dependencies to the surviving Terraform resource. Fail closed on incompatible backend responses when assigning an initial role. - Normalize SSO groups and compare exact names/DNs against connection `admin_group`. Promote/demote only when necessary, with structured success/failure transition logs. - Regenerate Go/TypeScript and sqlc outputs. Prepare SDK 14.1.0 and pin the Action to that version. - Add real-template Action regression tests to Terraform CI and isolated PostgreSQL handler tests. The latter exercise login metadata even when optional NATS provisioning is unavailable, avoiding the legacy suite's external Stripe/NATS requirements. ## Validation - Passed all 37 Terraform-rendered Action tests: initial assignment, unchanged roles, SSO promotion/demotion, exact matching, unrelated-role preservation, failure handling, deferred writes and retry recovery. - Passed `GOTOOLCHAIN=go1.27.1 go test -race ./services/api-server/service -run '^TestCreateUserRoleInformation' -count=1 -timeout=5m`. - Passed `GOTOOLCHAIN=go1.27.1 golangci-lint run ./services/api-server/service ./services/api-server/models` (0 issues). The installed linter requires the 1.27.1 toolchain; the host's 1.27.2 export format is incompatible. - Passed generated Go build/vet, SDK build, Terraform formatting/validation, JavaScript/workflow formatting and diff whitespace checks. Terraform reports existing AWS region deprecation warnings. - Security, database and deployment reviews found no blocking code issues; release and performance limitations are below. ## Release gates — keep in draft Terraform auto-applies merged changes. **Do not merge until the compatible backend has been deployed and SDK 14.1.0 has been published through the existing tag workflow.** Backend first, SDK release second, consuming Action last. This PR does not publish the package, apply infrastructure or assign live users. Member activation also requires the prerequisite role/endpoint/CLI dogfood verification from [ENG-6819](https://linear.app/overmind/issue/ENG-6819). Live dev/dogfood tests must establish first-token scopes and same-login SSO demotion/promotion; awaited Management API calls and local doubles do not prove Auth0's in-flight token behavior. Those checks have not been performed. Box's SAML mapping and actual admin-group name remain pending Box's details and are intentionally not configured here. ## Limits and rollback The sole-user retry heuristic deliberately accepts the plan's edge cases: a second user joining before retry may leave the creator Member, and a sole remaining invitee may become Admin. Existing tokens are not revoked by a role change. The added account-count query runs every login. `users.account_name` currently has no index, and local EXPLAIN confirms a sequential scan. No production latency measurement is claimed; check representative data before rollout and add a separate index migration if needed. Rollback restores the previous two-Action flow and customer Admin lookup before removing backend/SDK compatibility fields. It does not undo completed role changes or revoke tokens; use transition logs for deliberate per-user recovery. <!-- CURSOR_SUMMARY --> --- > [!NOTE] > **High Risk** > Changes authentication login flow, Auth0 role assignment, and RBAC on every login; requires staged backend/SDK/Action rollout and can deny logins if reconciliation or incompatible API responses occur. > > **Overview** > Consolidates post-login **customer role assignment** into the **Create Account** Auth0 Action: the separate **Assign Base Role** Action and template are removed, and Terraform wires Management API credentials and `@overmindtech/sdp-js` **14.1.0** into the surviving action. > > After `Auth0Support.CreateUser`, the action reconciles environment-qualified **Admin** vs **Member** roles (exact role lookup, remove opposite, await writes, deny login on failure). **SSO** connections with `metadata.admin_group` use IdP group membership on every login; otherwise existing customer roles are kept, with initial Admin when the backend reports account creation or sole-user status. > > **api-server** returns optional presence-aware `created_account` and `is_only_user` (proto/SDK regenerated), backed by a per-login `CountUsersByAccount` query including pending invitees. **CI** adds a Terraform workflow job that runs template regression tests before apply; **deploy/README** documents behavior, release order, and rollback. > > Regression coverage adds Node tests against the rendered template and isolated Postgres tests for `CreateUser` role metadata. > > <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 0b8b7d47e293fae364bfd90990502a58e6d8d9d7. Configure [here](https://www.cursor.com/dashboard/bugbot).</sup> <!-- /CURSOR_SUMMARY --> ## James review follow-up - Clarified that fresh IdP authentication is required to update groups. Silent Auth0 sessions and non-expiring API-key refresh tokens can preserve Admin access for weeks; token expiry alone is not a bound. Added wording to confirm with Box. - Added connection-to-account mapping and verification with known/fresh identities before enabling admin_group for any customer. - Added a read-only, rate-limited missing-customer-role audit tool with private reports and five passing unit tests. Live dev/dogfood and prod audits remain pending work 1Password access; no user assignments were changed. Reviewed audit results and agreed remediation are rollout gates. - Same-login fallback contingency is awaiting agreement; no forced refresh/retry has been introduced. GitOrigin-RevId: e880905cdcf9e97382208203f377deee72144e72
Add SetUserRole and a TeamMemberRole enum to the account Management API, report each team member's role and whether they are the caller, let ListTeamMembers include the caller on request, and flag accounts whose IdP manages roles. All changes are additive; SetUserRole returns Unimplemented until the api-server implements it. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> GitOrigin-RevId: 50fceb1173abd37d091675ff64c0dd9d18895567
## Why
The Team settings page is becoming one merged list of people with their
roles (FEAT-4). Removing a member is done by revoking their invite, and
`RevokeInvite` / `ResendInvite` identify people by email. `TeamMember`
had no email, so member rows in the merged list could not keep today's
remove (`⋯`) action. This adds it as its own small PR ahead of the
frontend work, since the role contract (#6848) and behaviour (#6849)
have already merged.
## What changed
- `sdp/account.proto`: `TeamMember` gains `string email = 6` ("The team
member's email address"). Regenerated `go/sdp-go/account.pb.go` and
`sdp-js/src/__generated__/account_pb.ts`.
- `services/api-server/models/user.sql`: `ListTeamMembers` also selects
`auth0_email` (NOT NULL, so a plain `string`). Regenerated `user.sql.go`
with sqlc against a live Postgres loaded from `models/schema.sql`; the
diff only touches `ListTeamMembers`. The query stays scoped by
`account_name`.
- `ListTeamMembers` in `managementservice.go` sets `Email` on each
member.
- Tests: `TestListTeamMembers` checks Alice's and Bob's emails;
`TestListTeamMembersRoles` checks every member's email (including the
current user).
No new RPC and no interface changes.
## Verification
- `npx buf breaking --against '../.git#branch=main,subdir=sdp'`: passes
(additive field)
- `go build ./...`, `go vet ./services/api-server/...
./services/gateway/...`: clean
- `go fix -diff` on touched packages: no changes
- The api-server service tests need devcontainer NATS and secrets, so CI
runs them
## Links
- Linear: https://linear.app/overmind/issue/ENG-6813
- Until: FEAT-4, plan 559e7582, Step 1
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- CURSOR_SUMMARY -->
---
> [!NOTE]
> **Low Risk**
> Additive protobuf field and read-only exposure of existing Auth0 email
on an existing team-members endpoint; no RPC or auth changes.
>
> **Overview**
> Adds an **`email`** field to the `TeamMember` message (proto field 6)
so `ListTeamMembers` can return each member’s address—needed for team UI
actions that key off email (e.g. revoke/resend invite).
>
> The api-server **`ListTeamMembers`** query now selects
**`auth0_email`** from accepted users and maps it onto
**`TeamMember.email`** in the existing RPC response. Go and TypeScript
protobuf bindings are regenerated; service tests assert returned emails.
>
> <sup>Reviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit
437d99ac3ec33675c9b32822ad149d1b02e6d2f1. Configure
[here](https://www.cursor.com/dashboard/bugbot).</sup>
<!-- /CURSOR_SUMMARY -->
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
GitOrigin-RevId: f86b83276e6cc4bd80500a7eb29c5ccc1c545a0a
tphoney
approved these changes
Oct 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Copybara Sync - Release v1.19.6
This PR was automatically created by Copybara, syncing changes from the overmindtech/workspace monorepo.
Original author: carabasdaniel (daniel.carabas@overmind.tech)
What happens when this PR is merged?
tag-on-mergeworkflow will automatically create thev1.19.6tag on mainReview Checklist