oriolrius/pki-manager-web v3.7.0

v3.7.0 — SSH management UX polish, RBAC e2e coverage & krl-client observability

on GitHub

SSH management UX polish, RBAC e2e coverage & krl-client observability

Monorepo version bump 3.6.1 → 3.7.0 (root/frontend/backend). This release focuses
on the SSH manager UI, adds an end-to-end RBAC test suite, and fixes a krl-client
reporting bug — no breaking changes.

Highlights

Frontend / SSH UI

• Searchable Combobox — a new in-menu-search select component, used for block-host
  selection and other long option lists.
• Live search filters on the SSH Hosts and Users lists.
• Redesigned identity "Access blocks" section for clarity, with clearer KRL
  enforcement-state labels and tooltips.
• Themed toasts & dialogs everywhere — native browser alert()/confirm() pop-ups
  are replaced with the app's themed toast/confirm components, and previously-silent
  mutations now surface success/error toasts.

Fixes

• fix(ssh) — block actions now record the acting identity (not the source IP)
  and show the full timestamp.
• fix(krl-client) (TASK-192) — the single run_summary event now reports the
  installed KRL header number on up_to_date (HTTP 304) and error runs instead of
  0. A healthy steady-state 304 poll previously logged krl_number=0, indistinguishable
  from an unprovisioned host and causing false "not installed" monitoring alerts. 0 now
  means "nothing installed", full stop.

Testing & QA

• RBAC end-to-end suite (tests/e2e-rbac.spec.ts, TASK-107/108): verifies admins can
  create/issue/revoke/delete certificates and revoke/delete CAs, while regular users
  receive 403 FORBIDDEN on every privileged operation. Admin destructive-op tests run
  on throwaway objects they create, so they never touch real data.
• Dedicated e2e ports — the local e2e stack moved to non-conflicting ports
  (frontend 58080, backend 53000, Keycloak 58180) so it starts cleanly
  alongside other local services. Full suite verified 23/23 passing against a
  from-source stack.

CI / Security

• gitleaks secret-scanning workflow + allowlist config.

Docs

• README screenshots and surfaced Kubernetes issuer, CRL, REST/OpenAPI, and
  SSH capabilities; new SSH principals guide with cross-links; companion-repo links.

Release artifacts (krl-client)

The tagged release attaches the standard krl-client supply-chain bundle:

Full Changelog: v3.6.1...v3.7.0