Merge branch 'master' of https://gitea.violin-work.online/violin/violin-iam

.gitea/workflows/iam-ci.yml

@@ -1,55 +0,0 @@
-name: iam-ci
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    env:
-      VIOLIN_IAM_SERVICE_TOKEN_SECRET: "0011223344556677889900aabbccddeeff0011223344556677889900aabbccddeeff"
-      VIOLIN_JWT_PRIVATE_KEY_PATH: ""
-      SPRING_PROFILES_ACTIVE: dev
-
-    steps:
-      # Step 1: compile + run tests. Replaces Drone's `compile` step but does
-      # NOT skip tests — this is a CI gate on every PR.
-      - name: Compile + test violin-iam
-        image: gitea.violin-work.online/registry/maven:3.9-eclipse-temurin-22
-        env:
-          MAVEN_OPTS: "-Dmaven.repo.local=/root/.m2/repository -Dmaven.watcher.disabled=true"
-        commands:
-          - mkdir -p /root/.m2/repository
-          - ulimit -n 65536
-          - for m in violin-parent violin-common violin-core; do
-              echo "--- installing $m ---";
-              mvn -B -f "$m/pom.xml" clean install -DskipTests;
-            done
-          - mvn -B -f violin-iam/pom.xml verify
-
-      # Step 2: build image via kaniko and push to the violin registry.
-      # Mirrors the `drone-kaniko` plugin used by .drone.yml. Only runs on
-      # pushes to main (PR branches just want the test gate).
-      - name: Build and push image
-        if: gitea.ref == 'refs/heads/main'
-        image: gitea.violin-work.online/registry/drone-kaniko:latest
-        settings:
-          repo: gitea.violin-work.online/violin/violin-iam
-          tags:
-            - latest
-            - ${GITEA_SHA:0:8}
-          dockerfile: Dockerfile
-          context: .
-          registry: gitea.violin-work.online
-          username: simple321vip
-          password:
-            from_secret: docker_password
-
-      # Step 3: roll the deployment. Only after main-branch image push.
-      - name: Deploy to violin namespace
-        if: gitea.ref == 'refs/heads/main'
-        image: gitea.violin-work.online/registry/kubectl:latest
-        commands:
-          - kubectl set image deployment/violin-iam violin-iam=gitea.violin-work.online/violin/violin-iam:${GITEA_SHA:0:8} -n violin

AGENTS.md

@@ -67,8 +67,6 @@ context. Concrete gotchas to fix:
 
 ## Design notes (do not skip)
 
-## Design notes (do not skip)
-
 ### JWT revocation propagation — what we tried, what we picked, and why
 
 The naive question "should we drop `customerId` from the JWT claim so
@@ -76,6 +74,7 @@ downstream must call IAM every request?" was the wrong frame. Below is
 the actual decision tree we walked.
 
 #### Problem
+
 A user's `t_user.customer_id` is migrated from tenant A to tenant B. The
 JWT issued at login still carries `customerId=A`. Without propagation
 the user keeps operating under A's RBAC scope (and SAR cache) for the
@@ -146,4 +145,3 @@ push `(sub, oldCustomerId)` into it. Have `PermissionAspect` consult the cache
 as a secondary check (after verified gate). Reduce default `expirationMs`
 in `ViolinJwtProperties` from `86_400_000` (24 h) to `3_600_000` (1 h).
 These three together close the revocation window to the bound of TTL.
-