feat(alerting): Plan 01 — outbound HTTP infra + admin-managed outbound connections #139
Reference in New Issue
Block a user
Delete Branch "feat/alerting-01-outbound-infra"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Summary
Foundation for the alerting feature (spec:
docs/superpowers/specs/2026-04-19-alerting-design.md). Adds a reusable outbound HTTP primitive + admin-managed outbound connections; no alerting behaviour yet (Plan 02 builds on this).core/http/+app/http/):OutboundHttpClientFactoryinterface with memoizedApache HttpClient 5impl;SslContextBuildersupportingSYSTEM_DEFAULT/TRUST_ALL/TRUST_PATHSmodes; startup validation (WARN on trust-all, fail-fast on missing CA paths).core/outbound/+app/outbound/):OutboundConnectiondomain record,SecretCipher(AES-GCM with JWT-derived key) for HMAC secrets at rest, Postgres repository with JSONB + env arrays,OutboundConnectionServicewith uniqueness + allowed-env + delete-if-referenced guards./api/v1/admin/outbound-connections(ADMIN CRUD +/testreachability probe +/{id}/usage). OPERATOR gets read-only access.outbound_connectionstable with HTTPS-only URL constraint.OUTBOUND_CONNECTION_CHANGE+OUTBOUND_HTTP_TRUST_CHANGEcategories.Plan 02 gate (important for reviewers)
OutboundConnectionServiceImpl.rulesReferencing(UUID)ships as a stub returning[]in this PR. Plan 02 wires it for real (queriesalert_rules.webhooks). Until Plan 02 merges, the delete + narrow-envs guards are effectively no-ops. Safe today because no alert rules exist yet; do NOT park Plan 02 for long windows after this merges.Test Plan
SslContextBuildermodes,ApacheOutboundHttpClientFactorymemoization,SecretCipherround-trip, Postgres repo with env-arrays + JSONB, service uniqueness + narrow-envs + delete guards, admin controller RBAC + audit (ADMIN mutations, OPERATOR read).https://httpbin.org/post, hitPOST /{id}/test, verify 200 + latency + TLS summary. TRUST_ALL amber banner present in UI.outbound-http.trust-all=true; fail-fast whentrusted-ca-pem-pathscontains a non-existent path.docs/alerting-02-verification.mdon Plan 02 branch for the pre-existing failure roster).Documentation
docs/alerting-outbound-connections.md— admin guide (connection lifecycle, TLS modes, HMAC signing, test probe)..claude/rules/app-classes.md+core-classes.mdupdated for new packages.Deferred
rulesReferencing()wiring → Plan 02.POST /{id}/testTLS summary is stubbed as"TLS"— Plan 02 or follow-up enriches with real protocol/cipher/peer-cert.BL-001/ gitea#137 (deferred pending SaaS-layer CA reuse investigation).OutboundHttpClientFactory— audit done, retrofit deferred to a separate commit.Defense-in-depth per code review. DTO layer already validates HTTPS at save time; this DB-level check guards against future code paths that might bypass the DTO validator. Mustache template variables in the URL (e.g., {{env.slug}}) remain valid since only the scheme prefix is constrained.POST /{id}/test issues a synthetic probe against the connection URL. TLS protocol/cipher/peer-cert details stubbed for now (Plan 02 follow-up). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>- OutboundConnectionRequest compact ctor: avoid NPE if tlsTrustMode is null (defense-in-depth alongside @NotNull Bean Validation). - Add operatorCannotTest IT case to lock the ADMIN-only contract on POST /{id}/test — was previously untested. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>