Align the four api READMEs with the actual protos: Select*->Get*/List*
per the CRUD verb convention, fix api/common->api/center import paths
for auth/data, drop the fabricated manager SelectByServiceName RPC, and
document the previously omitted auth/data/manager services.
Tool authorization (HIGH-risk confirmation):
- add AuthorizeToolCall RPC; the gateway calls it before tool execution
- sign/consume confirmation tickets with idempotency-key dedup
- propagate x-dc3-ai metadata (riskLevel/destructive/openWorld/idempotent) from the scan through the registry to the tool catalog
OAuth hardening:
- rotate refresh tokens and revoke the authorization on replay via previous_refresh_token_hash
Password lifecycle:
- require password change on login when flagged or expired (R20303/R20304)
- expose a public POST /token/change_password endpoint
OpenAPI aggregation:
- switch McpOpenApiAggregator to classpath static snapshots, dropping the runtime fetch and McpAggregatorProperties
Update auth, gateway, architecture, quickstart, changelog, and superpowers design documents for the Principal identity model and OAuth-backed MCP server.
Replace legacy user-login and role-user binding runtime with Principal, LocalCredential, TenantMembership, ServiceAccount, and RolePrincipalBind.
Switch gateway/backend identity propagation to X-Auth-Principal and align agentic/controller security context types with PrincipalHeader.
Refresh module READMEs, AGENTS.md, CONTRIBUTING.md, and dc3/doc/
guides to reflect the unified Dockerfile, consolidated compose stacks,
and updated build instructions.
Thread a new api_group field end-to-end through the scanner, gRPC/local
facade, proto, auth entity layer, and registry sync service. Populated
from handler.getBeanType().getSimpleName() (e.g. ApiController), this is
the foundation for the forthcoming resource-tree hierarchy grouping
sibling endpoints under their controller.
Adds a startup-time registrar that scans the local WebFlux handler mappings
of each center service and reconciles the discovered endpoints against
dc3_api and dc3_resource (insert-if-missing, update-if-drifted, soft-delete-
if-orphaned), so the permission model is no longer hand-maintained.
Wiring:
- dc3-common-resource-registrar (new module): scanner, diff runner, Spring
Boot AutoConfiguration. Activates on ApplicationReadyEvent.
- dc3-common-facade-api: ResourceRegistryFacade + BOs define a transport-
neutral sync contract.
- dc3-common-facade-local / dc3-common-facade-grpc: two implementations
selected via dc3.facade.mode. center-auth/single use local; manager/data
call auth via gRPC.
- dc3-common-auth: biz-side ResourceRegistrySyncService performs the three-
way diff inside a transaction guarded by pg_advisory_xact_lock(hashtext
(serviceName)); exposes ResourceRegistryApi gRPC server.
- dc3-api-auth: new resource_registry.proto contract.
- ApiDO/BO/VO/Query gain a serviceName field so each service's endpoints
can be located with a single indexed lookup.
Deployment-visible changes:
- api_code format is the human-readable serviceName:METHOD:/path
- dc3_resource.resource_code format is api:serviceName:METHOD:/path
(prefixed namespace reserved for future resource types)
- center-auth application.yml sets dc3.facade.mode=local
- 4 center pom.xml files pull in the registrar (auth also gets facade-local)
Proto3 type resolution walks up the package hierarchy. After changing
package api.common.auth/data/manager to api.center.*, unqualified
references like GrpcR/GrpcBase (defined in api.common) can no longer
be resolved, causing PROTOC compile errors.
Revert package declarations to api.common.auth/data/manager while
keeping java_package as io.github.pnoker.api.center.* — java_package
is independent from proto package and controls Java output only.
1. manager_point.proto: add missing SelectById RPC and GrpcRPointDTO
response message to match driver_point.proto symmetry
2. Rename java_outer_classname to include module prefix to avoid
confusion between driver and manager modules:
- driver: DeviceProto→DriverDeviceProto, DriverProto→DriverRegistrationProto,
EntityProto→DriverEntityProto, PointProto→DriverPointProto,
QueryProto→DriverQueryProto, QueryPageProto→DriverQueryPageProto
- manager: DeviceProto→ManagerDeviceProto, DriverProto→ManagerDriverProto,
PointProto→ManagerPointProto, QueryProto→ManagerQueryProto,
QueryPageProto→ManagerQueryPageProto
3. Reorganize proto files into subdirectories matching proto package:
- auth: src/main/protobuf/api/center/auth/
- data: src/main/protobuf/api/center/data/
- driver: src/main/protobuf/api/common/driver/
- manager: src/main/protobuf/api/center/manager/
Update all intra-module imports to use full absolute paths
- dc3-api/pom.xml: move <profiles> to after <build> per Maven POM
standard element ordering; move <dependencyManagement> before
<dependencies>
- driver_device.proto: rename driverConfigs/pointConfigs to
driver_configs/point_configs (proto3 snake_case convention)
- auth/data/manager protos: align package declaration from
api.common.xxx to api.center.xxx to match java_package option
- driver_entity.proto, driver_query.proto, driver_query_page.proto,
manager_query_page.proto: remove trailing blank lines
- Bump all module versions from 2025.11.1 to 2026.4.18.3
- Remove orphaned dc3-common-influx dependency and property from root pom.xml
- Standardize dependency comment style in dc3-common/pom.xml
- Merge gRPC dependency groups into single section in dc3-common-api
- Restructure Spring Integration MQTT and Eclipse Paho groups in dc3-common-mqtt
- Fix incorrect comment 'DC3 Common Exception' to 'DC3 Common Related' in dc3-common-postgres
- Add missing blank line before </dependencies> in dc3-common-driver
- Remove stray blank line in root pom.xml dependencyManagement
Updated the version from 2025.2.4 to 2025.2.5 in pom.xml files and various Java classes to reflect the latest release. This change ensures consistency across the codebase and aligns with the new version of the IoT DC3 Platform.
Updated the version from 2025.2.2 to 2025.2.4 in all pom.xml files, Java classes, and CI/CD configurations to reflect the latest release version. This change ensures consistency across the entire project.
pnoker
