chore: track version files, docs, web app split, scripts (missed commits from March work)

2026-09-13 08:41:35 +08:00
parent 84c709bbcc
commit edf76db56b
33 changed files with 3082 additions and 504 deletions
@@ -0,0 +1,65 @@
+# INP2P RBAC Regression Checklist
+
+> Replace placeholders:
+> - `BASE=http://127.0.0.1:27183`
+> - `ADMIN_TOKEN=<tenant admin session token>`
+> - `OP_TOKEN=<tenant operator session token>`
+> - `APIKEY_TOKEN=<tenant api key>`
+
+## 1) enroll revoke must be admin-only
+
+```bash
+curl -i -X POST "$BASE/api/v1/enroll/consume/1?status=0" \
+  -H "Authorization: Bearer $OP_TOKEN"
+# expect: 401/403
+
+curl -i -X POST "$BASE/api/v1/enroll/consume/1?status=0" \
+  -H "Authorization: Bearer $APIKEY_TOKEN"
+# expect: 401/403
+```
+
+## 2) apikey cannot mutate
+
+```bash
+curl -i -X POST "$BASE/api/v1/sdwan/edit" \
+  -H "Authorization: Bearer $APIKEY_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d '{"enabled":true,"gatewayCIDR":"10.200.10.0/24"}'
+# expect: 403
+
+curl -i -X POST "$BASE/api/v1/nodes/kick" \
+  -H "Authorization: Bearer $APIKEY_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d '{"node":"demo-node"}'
+# expect: 403
+```
+
+## 3) operator can mutate common ops
+
+```bash
+curl -i -X POST "$BASE/api/v1/connect" \
+  -H "Authorization: Bearer $OP_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d '{"from":"n1","to":"n2","srcPort":10080,"dstPort":80,"appName":"test"}'
+# expect: 200 (if nodes exist)
+```
+
+## 4) tenant isolation
+
+```bash
+# operator/admin from tenant A cannot operate tenant B node
+curl -i -X POST "$BASE/api/v1/nodes/kick" \
+  -H "Authorization: Bearer $OP_TOKEN" \
+  -H 'Content-Type: application/json' \
+  -d '{"node":"tenantB-node"}'
+# expect: 404
+```
+
+## 5) verify audit logs created
+
+- actions expected in audit:
+  - `node_kick`
+  - `node_apps_push`
+  - `connect_request`
+  - `tenant_subnet_reassign`
+  - `sdwan_update`