5 Commits

Include renames

Author	SHA1	Message	Date
mrhid6	ee1f9f3b32	refactor: consume vantage-shared as an external private module ... shared/ is extracted to gitea.hostxtra.co.uk/vantage/vantage-shared and pinned at v0.1.0 by server, agent, admin, sitesvc and vantagectl. The replace directives and the ./shared entry in go.work are gone. Every Go build now needs a credential for the private module: CI writes a netrc per job from REGISTRY_USER + RELEASE_TOKEN and sets GOPRIVATE, and the four Go Dockerfiles take it as a BuildKit secret rather than a build arg, which would survive in the builder layer's history. RELEASE_TOKEN needs read access to the vantage org. admin, sitesvc and vantagectl now build from their own directory; only server still needs the repository root, for default_steps/. The rebuild triggers in server-deploy.yml lose their shared/ patterns, since a service now moves when its own go.mod pin does.	2026-09-08 07:42:58 +00:00
mrhid6andClaude Opus 5	480a578deb	feat(admin): sessions, staff auth and adminctl ... One Redis session store and one cookie for all three identities. Staff login returns the same error for every failure mode and spends a bcrypt comparison against a dummy hash when no user exists, so neither the message nor the timing confirms which addresses have accounts. Staff users are created only by adminctl. There is no signup endpoint: a licensing authority that can be joined over the internet is not one. Pins gin and go-redis to the versions server/ already uses rather than the latest tidy would pick. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:05:28 +01:00
mrhid6andClaude Opus 5	427191b14c	feat(admin): licence issuance with plan snapshots and supersession ... Issue is the only place that signs. It records the licence, supersedes its predecessor and updates the instance -- but deliberately does not deliver. The ordering matters: a licence recorded but not delivered is recoverable, because the customer can download it. A licence delivered but not recorded is a support mystery with no paper trail. Free stays cloud-only through one comparison of plan against instance deployment, not a flag. Renewals reset relink_count because the cap is per term. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:01:47 +01:00
mrhid6andClaude Opus 5	b8fcf89ee7	feat(admin): documents, indexes and the plan seed ... Adds admin's own documents, its unique indexes and the plan seed from shared/license. Licences are append-only -- a renewal writes a new row and supersedes the old one -- because the history is the support tool. Plans are seeded with $setOnInsert only, so a redeploy never stamps over staff edits to limits, features or Paddle IDs. admin_instances.instance_id unique is a correctness property, not an optimisation: without it two customers could both claim one self-hosted UUID and both be issued licences for it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 19:00:37 +01:00
mrhid6andClaude Opus 5	64eac6dbc7	feat(admin): module skeleton, config and two database connections ... Adds the admin module: env config with fail-fast validation, two MongoDB connections (its own vantage_admin database plus a narrow path into the control plane), the boot sequence and the image. Config refuses to start without a signing key, and both Mongo URIs must name their database inline -- admin talks to two databases, so a bare MONGO_DB would be ambiguous about which. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-07-25 18:58:44 +01:00