mirror of
https://github.com/multica-ai/multica.git
synced 2026-07-28 05:46:58 +02:00
73b0015475
* feat(vcs): gate self-hosted Git providers to self-host deployments only (MUL-3772) The Forgejo/Gitea/GitLab integration is intended for self-hosted Multica, where Multica can reach a Git instance on the operator's own network. On the managed multi-tenant cloud it adds an SSRF surface (connect validates a user-supplied instance URL from the server) and would store third-party Git tokens for all tenants under one key, while only serving the small subset of users whose instance is publicly reachable. Product decision: offer it on self-host only. - Add an explicit deployment switch MULTICA_VCS_INTEGRATION_ENABLED (default off). Connect, rotate, and webhook now require BOTH the switch on AND a valid MULTICA_VCS_SECRET_KEY — the switch is the product boundary, not key presence alone. When off, connect/rotate return 404 and the webhook returns a bare 404 (no config leak), independent of the frontend. - /api/config exposes vcs_integration_available (mirrors the switch, omitted when false) so the Settings UI hides the whole "Git providers" section on cloud instead of surfacing an operator-only "missing key" hint. - docker-compose.selfhost.yml defaults the switch on; .env.example documents it. - Docs (en/zh) lead with a callout: available on self-hosted Multica only, not Multica Cloud, and clarify "self-hosted" means Multica itself, not just Git. #5006 / #5883 stay in place — the schema and backend capability are retained; this only gates availability. No cloud VCS connection can exist (connect always required the key, which the cloud never set), so nothing needs migrating. Verified: go build/vet + VCS/config handler tests on a fresh migrated DB (incl. a new disabled-deployment 404 test); pnpm typecheck (core + views) and the integrations-tab + core schema/config vitest suites pass. Co-authored-by: multica-agent <github@multica.ai> * fix(vcs): complete self-host integration gating (MUL-5138) Co-authored-by: multica-agent <github@multica.ai> --------- Co-authored-by: Bohan-J <bohan@devv.ai> Co-authored-by: multica-agent <github@multica.ai>
34 lines
843 B
Bash
34 lines
843 B
Bash
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
CHART_DIR="$ROOT_DIR/deploy/helm/multica"
|
|
|
|
require_rendered_value() {
|
|
local rendered=$1
|
|
local expected=$2
|
|
|
|
if ! grep -Fq "$expected" <<<"$rendered"; then
|
|
echo "Missing expected Helm-rendered config value:"
|
|
echo " $expected"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
helm lint "$CHART_DIR"
|
|
|
|
default_config="$(
|
|
helm template multica "$CHART_DIR" \
|
|
--show-only templates/configmap.yaml
|
|
)"
|
|
require_rendered_value "$default_config" 'MULTICA_VCS_INTEGRATION_ENABLED: "true"'
|
|
|
|
disabled_config="$(
|
|
helm template multica "$CHART_DIR" \
|
|
--show-only templates/configmap.yaml \
|
|
--set backend.config.vcsIntegrationEnabled=false
|
|
)"
|
|
require_rendered_value "$disabled_config" 'MULTICA_VCS_INTEGRATION_ENABLED: "false"'
|
|
|
|
echo "helm config rendering ok"
|