Repository navigation
IAM fixes & features - #84
Merged
Merged
Conversation
… 처리 추가 - IAM-BUG-006: DeleteUser, UpdateUser @router 어노테이션 /api/users/{id} → /api/users/id/{userId} 수정 실제 Echo 라우트(/api/users/id/:userId)와 일치시켜 프록시 404 해결 - IAM-BUG-006: service-actions.yaml deleteUser, updateUser resourcePath 동일 수정 - IAM-BUG-007: CreateUser handler에서 "already exists" 에러 감지 시 500 대신 409 반환
- DeleteUser/UpdateUser 경로 수정 반영 (/api/users/{id} → /api/users/id/{userId})
- mzc-csc/develop에 누락된 API 경로 51개 복원 (company, csp-accounts, invitations 등)
- May 21 이후 코드 변경분 docs 동기화
- CspRoleService에 CspIdpConfigRepository 의존성 추가 - findActiveAwsOidcConfig 헬퍼 추가: GetActiveConfigs + IsOIDC + CspType=aws 필터 - createNewAwsCredential: OS env(MC_IAM_MANAGER_AWS_IDENTITY_*) 제거 → IDP Config DB의 role_arn 조회 (getIAMClient와 동일 패턴) - dead variable identityProviderArn 제거 (AssumeRoleWithWebIdentityInput에 provider ARN 파라미터 없음) - oidc_provider_arn은 로깅 확인용으로만 사용 ref: IAM-TECH-002
설정 누락 감지를 앞당겨 Keycloak 호출 전에 즉시 에러 반환.
…ml (IAM-BUG-006) src/docs/swagger.yaml was not updated in commit 758b702 when DeleteUser/UpdateUser swagger annotations were fixed. This commit: - Regenerates src/docs/{docs.go,swagger.json,swagger.yaml} via swag init - Regenerates asset/mcmpapi/service-actions.yaml and conf/mc-iam-manager/service-actions.yaml via swagger-to-actions, now using correct /api/users/id/{userId} paths for deleteUser/updateUser
…ml (IAM-BUG-006) fix(M2-USER): sync src/docs swagger and regenerate service-actions.yaml (IAM-BUG-006)
fix(csp-role): createNewAwsCredential env var → IDP Config DB 조회로 전환
0_preset_dev.sh: - Replace source with safe line-by-line env parser (handles multi-word values) - Add IP vs hostname detection (IS_IP flag) to skip /etc/hosts for IP domains - Add SAN (subjectAltName) to self-signed cert via openssl -extfile - Update error messages to reference cleanAll.sh 0_preset_prod.sh: - Add set -euo pipefail for script safety - Add mkdir/cp failure error messages - Add 5 missing port substitutions: MC_COST_OPTIMIZER_BE_PORT, MC_COST_OPTIMIZER_ALARM_PORT, MC_WORKFLOW_MANAGER_PROXY_PORT, MC_DATA_MANAGER_PROXY_PORT, MC_APPLICATION_MANAGER_PROXY_PORT - Remove outdated MC_COST_OPTIMIZER_FE_PORT substitution 0_preset_local.sh + nginx.template.local.conf: - Replace heredoc nginx.conf generation with nginx.template.local.conf approach - Add dual .env support (project root + script dir) - Add safe line-by-line env parser - Add required var validation, nginx dir permission check 1_setup_auto.sh: - Rename MCADMINCLI_APIYAML → MC_ADMIN_CLI_APIYAML (prefix standardization) - Add Step 5-2: update_public_service_urls() call - Add update_public_service_urls() function for iframe FE public URL registration 1_setup_manual.sh: - Rename MCADMINCLI_APIYAML → MC_ADMIN_CLI_APIYAML
fix(conf): backport preset/setup script improvements
… are unset Keycloak optional fields (Email, FirstName, LastName, Enabled, Username) are *string/*bool pointers and may be nil for users who didn't fill in all profile fields. Direct dereference caused panic in AssignPlatformRole flow. Replace raw dereference with existing ptrStr/ptrBool helpers, consistent with how GetUsers() in the same file already handles these fields.
… are unset (#109) Keycloak optional fields (Email, FirstName, LastName, Enabled, Username) are *string/*bool pointers and may be nil for users who didn't fill in all profile fields. Direct dereference caused panic in AssignPlatformRole flow. Replace raw dereference with existing ptrStr/ptrBool helpers, consistent with how GetUsers() in the same file already handles these fields.
…d without roleName When AssignPlatformRole receives only userId+roleId (without roleName), Keycloak operations fail because the role name is required. Look up the role name from DB using roleId so callers don't need to supply it explicitly.
…404 on role removal - CreateUser: delete KC user when DB insert fails (was TODO comment) - RemovePlatformRole: skip KC rollback when KC user is already gone (404) so DB cleanup can proceed even if KC state is stale
CreateUser/UpdateUser/DeleteUser/UpdateUserStatus/ResetUserPassword required platformAdmin-only (Manage). Changed to Write so admin-role users can also perform user management operations, consistent with checkRoleFromContext logic.
fix(IAM): user role 버그 보완
CreateRoleRequest 모델이 json:"roleTypes" (camelCase)를 기대하는데 1_setup_auto.sh의 init_predefined_roles 함수에서 role_types (snake_case)로 전송해 바인딩이 되지 않아 viewer/billviewer가 platform role_sub 없이 workspace only로 생성되는 버그 수정. 결과: viewer, billviewer도 platform/workspace 양쪽 role_sub이 정상 생성되어 assignPlatformRole, listRoles platform 필터가 정상 동작함.
fix(setup): camelCase roleTypes in init_predefined_roles JSON payload
MZC-CSC
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
setup 스크립트 개선 및 버그 수정
api 호출에서 관리용 api 권한을 manager 에서 write 레벨로 완화
Changes
Bug Fixes
init_predefined_rolesJSON payloadrole_types→roleTypes(camelCase) 수정 — viewer/billviewer platform role_sub 미생성 버그 (#111)GetUserByID에서 Keycloak 필드 unset 시 nil pointer dereference 수정 (#109, #110)