LLDAP read-only snapshot endpoint + Go account-sync SDK#28
Merged
Conversation
pengpeng
force-pushed
the
feat/lldap-go-sync-sdk
branch
3 times, most recently
from
d67080a to
5cede5f
Compare
pengpeng
changed the title
The mocks for OpaqueHandler/BackendHandler were missing the registration_password method, and two test-only User initializers were missing the user_index/initialized fields, so `cargo test` failed to compile even before this branch's changes. Add the missing pieces so the test target builds. Co-authored-by: Cursor <cursoragent@cursor.com>
Serve GET /readonly/snapshot on a separate, opt-in HTTP listener (LLDAP_HTTP_READONLY_PORT) with no authentication, so a network-gated consumer (the Go SDK) can fetch a full users/groups snapshot whose JSON mirrors the GraphQL shape. User and group attributes are both exposed, filtered by an optional denylist (LLDAP_HTTP_READONLY_DENY_ATTRIBUTES); errors return a generic 500 to avoid leaking internals. Document the new options in the config template. Co-authored-by: Cursor <cursoragent@cursor.com>
Add a Go client that reconciles against LLDAP's read-only snapshot endpoint and consumes Olares' os.users / os.groups NATS triggers, delivering diffs (users, groups, memberships, and their attributes) to an idempotent OnChanges handler. User.IsAdmin() reports lldap_admin membership; ships with an example consumer and unit/smoke tests. Co-authored-by: Cursor <cursoragent@cursor.com>
A persistent lldap + nats (JetStream) + postgres compose stack so apps can develop against LLDAP locally, plus lldapctl.sh for user/group CRUD that also publishes os.users / os.groups NATS triggers (simulating app-service). Default to the go-sync-sdk-dev branch image so the read-only port works out of the box, with avatar denylisted from the snapshot. Co-authored-by: Cursor <cursoragent@cursor.com>
Build and push a multi-arch beclab/lldap:go-sync-sdk-dev image on pushes to this branch so the dev stack can pull an image that already has the read-only snapshot port. Remove once the port ships in a tagged release. Co-authored-by: Cursor <cursoragent@cursor.com>
pengpeng
force-pushed
the
feat/lldap-go-sync-sdk
branch
from
5cede5f to
fcb6862
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds a way for Olares apps (e.g.
files) to consume LLDAP accounts without watching the K8s User CRD, by pairing a new unauthenticated read-only snapshot endpoint on LLDAP with a small Go SDK that reconciles against it.GET /readonly/snapshoton a separate listener (LLDAP_HTTP_READONLY_PORT), no auth (access is network-gated). JSON mirrors the GraphQL snapshot of users and groups, including their attributes, with an optional attribute denylist (LLDAP_HTTP_READONLY_DENY_ATTRIBUTES) and generic 500s so internals never leak.clients/go): reconciles against that endpoint and consumes Olares'os.users/os.groupsNATS JetStream events as triggers, delivering diffs (users, groups, memberships, attributes) to one idempotentOnChangeshandler.User.IsAdmin()reportslldap_adminmembership. Ships an example consumer and unit + smoke tests.clients/dev): persistent lldap + nats + postgres compose stack pluslldapctl.shfor CRUD that also publishes the NATS triggers (simulating app-service). Defaults to the branch test image withavatardenylisted from the snapshot.beclab/lldap:go-sync-sdk-devimage so the dev stack works out of the box until the read-only port ships in a tagged release.Notes / current limitations
lldap_admin; the role lives only in the K8s User CR).fix(test)) repairs a pre-existingcargo testcompile break independent of this feature.Test plan
cargo testfor the read-only server (DTO mapping + denylist filtering, incl. group attributes)go build/go vet/gofmt -l/go test ./...inclients/go