miki3421 opened a new pull request, #138: URL: https://github.com/apache/openserverless-operator/pull/138
The user metadata database must not be readable anonymously or by ordinary CouchDB users. Apply an explicit admin-only membership ACL during initialization, including when the database already exists, while preserving its documents and repeatable initialization. Validation on an isolated 0.9.0 lab with CouchDB 2.3: anonymous document, `_all_docs` and `_find` requests changed from HTTP 200 to 401; ordinary users receive 403; administrators retain access. Fresh and existing database initialization, repeated initialization and admin-api login passed. Three focused unit tests passed. Existing-state validation explicitly reran the metadata initializer. Merely replacing the operator image is not evidence that an existing database has been reconciled; rollout must run initialization and verify its ACL. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
