284313f908
Some checks are pending
Bidi Control Character Guard / bidi-control-guard (push) Waiting to run
Circular Dependency Check / Check for new circular dependencies (push) Waiting to run
Citus Migration Smoke / Combined migrations on single-node Citus (push) Waiting to run
E2E Fresh Install Tests / fresh-install-e2e (push) Waiting to run
ext-v2 guardrails / Run ext-v2 guard and ESLint (push) Waiting to run
Integration Tests / Check for relevant changes (push) Waiting to run
Integration Tests / ${{ (github.event_name == 'schedule' || github.event.inputs.suite == 'full') && 'Full integration suite' || 'Tier-1 integration subset' }} (push) Blocked by required conditions
Mobile checks / Mobile lint + typecheck (push) Waiting to run
Mobile checks / Mobile unit tests (push) Waiting to run
Mobile checks / Mobile dependency audit (report) (push) Waiting to run
Mobile checks / Mobile reproducibility checks (push) Waiting to run
Secrets guard (env backups) / Ensure no tracked env backup files (push) Waiting to run
Temporal Readiness / fast-readiness (push) Waiting to run
Temporal Readiness / docker-parity (push) Waiting to run
TypeScript Type Check / Nx affected typecheck (push) Waiting to run
Unit Tests / Skipped-test budget (push) Waiting to run
Unit Tests / Nx affected unit tests (push) Waiting to run
Unit Tests / Server unit coverage (informational) (push) Waiting to run
Validate Tenant Management Schema / Check for relevant changes (push) Waiting to run
Validate Tenant Management Schema / Validate Tenant Management Schema (push) Blocked by required conditions
EE Workflows Build Guard / ee-workflows-build-guard (push) Waiting to run
Excluded: .git, node_modules, secrets/, compose.env, assemblyscript tgz Source: /opt/alga-psa on psa.joliet.tech
44 lines
1.6 KiB
Markdown
44 lines
1.6 KiB
Markdown
# Client Extension System Implementation Scratchpad (Overhaul)
|
||
|
||
This scratchpad tracks near‑term tasks for the multi‑tenant overhaul. Legacy, in‑process UI/descriptor notes have been removed.
|
||
|
||
## Current Focus
|
||
- Phase 0: EE‑only wiring + env templates
|
||
- Phase 1: Migrations + registry/install services + signature verification
|
||
- Phase 2: Bundle storage helpers (S3/MinIO)
|
||
- Phase 4: API gateway route + helpers
|
||
|
||
## Checklists
|
||
|
||
### Phase 0
|
||
- [ ] Confirm extension init is EE‑only in builds
|
||
- [ ] Add `.env.example` with EXT_* and STORAGE_* vars
|
||
- [ ] Define cache root permissions and default limits
|
||
|
||
### Phase 1
|
||
- [ ] Draft migrations: registry, version, bundle, install, events, exec log, quotas
|
||
- [ ] Signature verification utility (trust bundle)
|
||
- [ ] Registry service (publish/list/get; version metadata incl. `content_hash`, `signature`)
|
||
- [ ] Tenant install service (enable/disable; `granted_caps`, `config`)
|
||
|
||
### Phase 2
|
||
- [ ] S3 provider integration against MinIO
|
||
- [ ] `getBundleStream`, `getBundleIndex`, `extractSubtree` for `dist/` and `ui/`
|
||
- [ ] Precompiled artifacts (optional) resolution
|
||
|
||
### Phase 4
|
||
- [ ] `/api/ext/[extensionId]/[[...path]]` route
|
||
- [ ] Helpers: auth/tenant resolution, endpoint matcher, header filters
|
||
- [ ] Proxy to Runner with timeouts/retries and header allowlist
|
||
|
||
## Notes
|
||
- No tenant code executes in the app process
|
||
- UI is iframe‑only via `/ext-ui/{extensionId}/{content_hash}/...`
|
||
- All execution flows go through Runner
|
||
|
||
## References
|
||
- [Implementation Plan](implementation_plan.md)
|
||
- [API Routing Guide](api-routing-guide.md)
|
||
- [Security & Signing](security_signing.md)
|
||
- [Registry Implementation](registry_implementation.md)
|