Introduce platform API keys with capability-based access to tenant management,
system settings, runtime queues, and audit logs, plus admin UI for key lifecycle
and system audit log viewing.
Align product copy, API docs, Swagger descriptions, and i18n strings
with workspace terminology while keeping internal tenant identifiers
and headers unchanged for API compatibility.
Eliminate the POST /tenants/{id}/api-key endpoint for resetting tenant API keys, transitioning to a more granular API key management approach. Update related documentation and API specifications to reflect the new structure, including changes to the tenant API key management paths. Adjust frontend code and internationalization files to remove references to the deprecated API key reset functionality, enhancing clarity and consistency across the application.
Redesign tenant API key authorization around one dimension (role) plus a
central default-deny gate, replacing the previous role + KB-scoped flag model.
- Add APIKeyGate as the single authority for API-key authorization: routes
declare one policy (MinRole) via apiKeyGroup/apiKeyRoute helpers; undeclared
routes are denied by default. JWT principals short-circuit the gate and the
JWT-centric RBAC guards short-circuit for API-key principals.
- Roles: viewer/contributor/admin are knowledge-base data-plane only (KB scope
is a pure downstream data filter); owner is a full-access tenant tier that
unlocks tenant-level infrastructure routes and is required for every method.
- Drop the KBScoped policy flag and the KB-restricted-vs-tenant branching.
- Security hardening: never disclose HMAC secret (return presence only), abort
writes on API-key encryption failure, deny KB-restricted keys on /files, and
backfill legacy key hashes at startup instead of O(N) plaintext scans.
- Frontend: two-level create dialog (access type -> permission level), rename
role labels to reflect actual scope, sync en/zh/ko/ru locales.
- Fix startup self-check false-positive on trailing-slash routes and normalize
gin paths before comparison; add regression tests.
This commit removes Jaeger tracing support from the project, including the associated Docker configurations, Go modules, and middleware. The changes simplify the codebase by eliminating unused tracing functionality, which was previously integrated for observability. Documentation and scripts have also been updated to reflect the removal of Jaeger references.
- Introduced `started_at` and `uptime_seconds` fields to the `SystemInfo` structure for tracking server boot time and uptime.
- Updated the `GetSystemInfo` handler to populate these new fields based on server runtime.
- Enhanced the frontend to display server startup time and uptime in the system information view, improving visibility for users.
- Added localization support for new labels and descriptions related to server uptime and startup time in multiple languages.
- Added RevokeSystemAdmin functionality to the user service and repository, ensuring atomic checks for self-revoke and last admin scenarios.
- Updated the system handler to utilize the new revocation method, improving error handling for various edge cases.
- Enhanced the bootstrap process to prevent unintended promotions when system admins already exist.
- Refactored related comments and documentation for clarity on the new behavior and safeguards in place.
- Added WEKNORA_BOOTSTRAP_SYSTEM_ADMIN_EMAIL environment variable to promote a specified user to system admin on startup.
- Introduced a new bootstrap process in `bootstrap.go` to handle the promotion logic.
- Updated `.env.example` to document the new environment variable and its behavior.
- Created new views for managing system administrators and system settings, including listing, promoting, and revoking admin privileges.
- Enhanced the frontend to reflect the new system admin features, including UI elements for admin management and settings configuration.
- Updated API interfaces to support system admin functionalities, ensuring proper data handling and user management.
Two unrelated startup-noise fixes bundled because they share one file
(internal/runtime/startup.go) and one motivation (make the boot log
useful again).
Gin per-route spam
------------------
With ~150 registered routes, DebugMode prints one "[GIN-debug] METHOD
path --> handler" line per route, drowning out everything else. Override
gin.DebugPrintRouteFunc to a counter and gin.DebugPrintFunc to route
through the structured logger. A single "[gin] registered N routes"
summary prints once router build is complete. DebugMode behaviour
otherwise (panic recovery, runtime warnings) is preserved.
Env config banner
-----------------
Operators had no easy way to confirm SYSTEM_AES_KEY (or any other
critical env) was actually loaded — getting the byte length wrong is
particularly silent: utils.GetAESKey() returns nil for anything other
than exactly 32 bytes, which simply disables encryption.
LogStartupEnv prints one line per curated env var (security + DB +
storage + redis), with sensitive values redacted as "set (N chars)"
and unset values as "<unset>". Followed by targeted footgun warnings —
the AES-256 length check fires loudly when SYSTEM_AES_KEY is set but
wrong-length.
Both helpers are called from cmd/server and cmd/desktop. The env banner
runs before container.BuildContainer so it prints even if DB / storage
init fails.
- Added support for SO_REUSEPORT in the listenWithRetry function to improve port binding during hot-reloads.
- Implemented graceful shutdown by closing the listener immediately upon receiving a shutdown signal, allowing for quicker port release.
- Updated logging to provide clearer feedback during server shutdown and error handling.
- Changed the kill delay from 30 seconds to 2 seconds in the configuration.
- Refactored the server startup process to include a retry mechanism for binding to the port, addressing potential issues during hot-reload scenarios.
- Added a new function, listenWithRetry, to handle port binding with exponential backoff, improving server reliability during restarts.
This PR continues the migration to structured logging by replacing the
standard Go log package usage with the project's structured logger.
Changes:
- cmd/server/main.go: Replace all log.Printf, log.Println, log.Fatalf
with logger.Infof, logger.Info, logger.Fatalf
- internal/middleware/recovery.go: Replace log.Printf with
logger.ErrorWithFields for better panic logging with structured data
- Remove log.SetFlags and log.SetOutput from main.go as they're no
longer needed with the structured logger
Benefits:
- Consistent logging format across the entire application
- Better log parsing and analysis with structured fields
- Request ID tracking in recovery middleware for easier debugging
- Proper integration with the project's logging configuration
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
wizardchen