051f7fdae9
Add @PreAuthorize annotations to all API controllers (14 endpoints
across 6 controllers) enforcing OAuth2 scopes: apps:manage, apps:deploy,
billing:manage, observe:read, platform:admin.
Enforce tenant isolation: TenantResolutionFilter now rejects cross-tenant
access on /api/tenants/{id}/* paths. New TenantOwnershipValidator checks
environment/app ownership for paths without tenantId. Platform admins
bypass both layers.
Fix frontend: OrgResolver split into two useEffect hooks so scopes
refresh on org switch. Scopes now served from /api/config (single source
of truth). Bootstrap cleaned — standalone org permissions removed.
Update docs/architecture.md, docs/user-manual.md, and CLAUDE.md to
reflect all auth hardening changes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
30 lines
632 B
YAML
30 lines
632 B
YAML
# Development overrides: exposes ports for direct access
|
|
# Usage: docker compose -f docker-compose.yml -f docker-compose.dev.yml up
|
|
services:
|
|
postgres:
|
|
ports:
|
|
- "5432:5432"
|
|
|
|
logto:
|
|
ports:
|
|
- "3001:3001"
|
|
- "3002:3002"
|
|
|
|
cameleer-saas:
|
|
ports:
|
|
- "8080:8080"
|
|
volumes:
|
|
- ./ui/dist:/app/static
|
|
- ./target/cameleer-saas-0.1.0-SNAPSHOT.jar:/app/app.jar
|
|
environment:
|
|
SPRING_PROFILES_ACTIVE: dev
|
|
SPRING_WEB_RESOURCES_STATIC_LOCATIONS: file:/app/static/,classpath:/static/
|
|
|
|
cameleer3-server:
|
|
ports:
|
|
- "8081:8081"
|
|
|
|
clickhouse:
|
|
ports:
|
|
- "8123:8123"
|