Skip to content

Read-Only Swagger UI#159

Draft
bakhterets wants to merge 49 commits intomainfrom
feature/swagger_ui
Draft

Read-Only Swagger UI#159
bakhterets wants to merge 49 commits intomainfrom
feature/swagger_ui

Conversation

@bakhterets
Copy link
Copy Markdown
Contributor

@bakhterets bakhterets commented Apr 17, 2026

What it does:

  • Serves Swagger UI at /swagger/*any using gin-swagger
  • Dynamically filters openapi.yaml to expose only GET methods
  • Strips /auth/* paths, security block, securitySchemes, and Token* schemas
  • Removes RBAC-only fields (creator, contact_email, version) from response schemas
  • Overrides servers.url from the incoming request host (supports X-Forwarded-Proto)
  • Fixes openapi.yaml: realistic date examples, limit enum [10, 20, 50]

Limitations:

  • Swagger UI operates without authentication — all requests are anonymous
  • Only GET endpoints are visible; no mutation operations exposed
  • RBAC-filtered statuses (e.g. pending_review) are not returned for anonymous users

bakhterets and others added 30 commits February 2, 2026 15:54
@bakhterets
rbac resolver;
1a4b5b5 
hierarcy;
@bakhterets
RequireRole mw;
3ea42be 
403 resp;
@bakhterets
comments removed;
d6a460a
@bakhterets
rbac: add maintenance status workflow with role-based permissions
ea3e607
@bakhterets
checker: transition reviewed -> planned
17b1a8a
@bakhterets
mw and v2 func refactored, golangci changed
d3aa143
@bakhterets
database migration;
fd17157 
v2 created_by added for events and statuses;
@bakhterets
GET filter for unauthorized
ae010d8
@bakhterets
validateMaintenanceCreation added;
da5feb6 
TestValidateStatusesPatches relocated to v2_validation_test.go;
06 migration changed;
new errores for maintenance validation;
Incident model changed;
TestValidateEventCreationTimes added;
TestValidateEventCreationImpact added;
@bakhterets
filter for pending review, contact email, created_by.
7727a78
@bakhterets
comments removed from v2_auth_test
aafa6aa
@bakhterets
versioning for PATCH (implementation)
ec08d92
@bakhterets
negative test 409 added
21e1512
@bakhterets
middleware auth refactoring
4f1a116
@bakhterets
optimistic lock bug fixed
737d915
@bakhterets
tests refactored
9b7d3e0
@sgmv
fix events handler
bfc19ef
@bakhterets
middleware, v2.go, db.go changed.
3a43b21 
implemented SetJWTClaims.
@sgmv
update
3e7e147
@bakhterets
refactor: inject RBAC service into handlers, simplify toAPIEvent, ren…
05956fa 
…ame HasGroup to HasAuthorizedGroup
@bakhterets
TestCalculateCurrentMntStatus added
2e37c6b
@bakhterets
fix FR-003/FR-029 bugs, refactored auth middleware, add unit and inte…
357ebce 
…gration RBAC tests
@bakhterets
golangci-lint version updated
133b697 
go version updated
@bakhterets
AuthenticationMW fixed; rbac tests added;
e3ebc31
@bakhterets
add RBAC documentation, update OpenAPI security, hide reviewed status…
5cbc720 
… from unauthenticated users
@bakhterets
version requirement change
43897c3
@bakhterets
fix: PR #152 review - RBAC config, status codes, tests
42e02b0
@bakhterets
fix: PR #152 review - tests
1c0e9bd
@bakhterets
SD_RBAC_ADMINS -> SD_RBAC_GROUP_ADMINS renamed
88146d5
@bakhterets
in_progress; pending_review renaming
453babb
bakhterets and others added 19 commits February 25, 2026 17:53
@bakhterets
RBAC_ENABLED: true -> RBAC_DISABLED: false
e432224
@bakhterets
docs updated
f22a8d6
@bakhterets
sd_rolename renamed to rolename;
c039cff 
role operator has been raised to allow to perform all CRUD actions; spec.md revised.
@bakhterets
leaking data (v1, rss) fixed;
ed3ec39 
rbac tests redesigned, main tests fixed.
@bakhterets
openapi.yaml fixed; typo fixed
de10618
@bakhterets
v2.go, conf.go review's fixes
3d4620f
@bakhterets
RBAC and auth refactored
0920162
@bakhterets
RBAC and auth refactored
8e52ab9
@bakhterets
pending_review checker fixed
a1ab8e3
@bakhterets
keycloak audience mapper (doc)
b117722
@bakhterets
Audience validation removed;
4cc8272 
Public key caching removed.
@sgmv
small fix
ac85590
@bakhterets
Update docker-build-push-on-draft.yaml env section
6648626
@bakhterets
wrong env fixed (#157)
65e6101 
version field assert for incidents (tests) removed
@bakhterets
inconsistencies between doc and code have been fixed
cf213ba
@bakhterets
fix(rbac): support comma-separated groups in SD_RBAC_GROUPS_* vars
d9261fe
@bakhterets
feat: add read-only Swagger UI with GET-only filtering
1cb5e36
@bakhterets
Merge branch 'main' into feature/swagger_ui
def8774
@bakhterets
feat: strip auth/RBAC details from Swagger, fix openapi examples, add…
049510e 
… tests
@bakhterets bakhterets self-assigned this Apr 17, 2026
@bakhterets bakhterets requested a review from sgmv April 17, 2026 15:21
@bakhterets bakhterets marked this pull request as draft April 17, 2026 15:22
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sgmv sgmv Awaiting requested review from sgmv

At least 1 approving review is required to merge this pull request.

Assignees

@bakhterets bakhterets

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bakhterets @sgmv