13 Commits

Author	SHA1	Message	Date
hsiegeln	c249c6f3e0	docs: update Config tab navigation behavior and role gating ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 16:29:20 +02:00
hsiegeln	640a48114d	docs: document UI role gating for VIEWER/OPERATOR/ADMIN ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 15:52:25 +02:00
hsiegeln	e69b44f566	docs: document configurable userIdClaim for OIDC ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 10:20:50 +02:00
hsiegeln	549dbaa322	docs: document OIDC role sync on every login ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 10:11:49 +02:00
hsiegeln	4e12fcbe7a	docs: document server:-prefixed scopes and case-insensitive role mapping ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 10:06:11 +02:00
hsiegeln	4496be08bd	docs: document SSO auto-redirect, consent handling, and auto-signup ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 01:45:45 +02:00
hsiegeln	083cb8b9ec	feat: add CAMELEER_CORS_ALLOWED_ORIGINS for multi-origin CORS support ... Behind a reverse proxy the browser sends Origin matching the proxy's public URL, which the single-origin CAMELEER_UI_ORIGIN rejects. New env var accepts comma-separated origins and takes priority over UI_ORIGIN, which remains as a backwards-compatible fallback. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 00:41:00 +02:00
hsiegeln	0609220cdf	docs: add CAMELEER_OIDC_TLS_SKIP_VERIFY to all documentation ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-06 00:30:18 +02:00
hsiegeln	44f3821df4	docs: add CAMELEER_OIDC_JWK_SET_URI to all documentation ... Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 22:58:05 +02:00
hsiegeln	c4d2fa90ab	docs: clarify Logto proxy setup and ENDPOINT/ADMIN_ENDPOINT semantics ... LOGTO_ENDPOINT and LOGTO_ADMIN_ENDPOINT are public-facing URLs that Logto uses for OIDC discovery, issuer URI, and redirects. When behind a reverse proxy (e.g., Traefik), set these to the external URLs. Logto requires its own subdomain (not a path prefix). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-05 13:31:17 +02:00
hsiegeln	eecb0adf93	docs: replace Authentik with Logto, document OIDC resource server ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-05 13:15:09 +02:00
hsiegeln	ac87aa6eb2	fix: derive PG schema from tenant ID instead of defaulting to public ... Schema now defaults to tenant_${cameleer.tenant.id} (e.g. tenant_default, tenant_acme) instead of public. Flyway create-schemas: true ensures the schema is auto-created on first startup. CAMELEER_DB_SCHEMA env var still available as override for feature branch isolation. Removed hardcoded public schema from K8s base and main overlay. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 21:46:57 +02:00
hsiegeln	f16d331621	docs: add SERVER-CAPABILITIES.md for SaaS integration reference ... Comprehensive standalone document covering API surface, agent protocol, security, storage, multi-tenancy, deployment, and configuration — designed for external systems (like the SaaS orchestration layer) that need to understand and manage Cameleer3 Server instances. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 20:30:42 +02:00