Skip to content

release: 3.0.0-beta.1 — adopt lib-commons Huma wrapper (breaking)#316

Merged
fredcamaral merged 30 commits into
mainfrom
develop
Jul 14, 2026
Merged

release: 3.0.0-beta.1 — adopt lib-commons Huma wrapper (breaking)#316
fredcamaral merged 30 commits into
mainfrom
develop

Conversation

@fredcamaral

Copy link
Copy Markdown
Member

Summary

Promotes develop to main — 30 commits, releasing 3.0.0-beta.1.

The headline change is the breaking adoption of the lib-commons Huma wrapper in the Manager. The rest is dependency/infra bumps, tenant-manager auth, and correctness fixes across Worker and pkg.

Breaking change

  • feat(manager)!: adopt lib-commons Huma wrapper — Manager now serves its OpenAPI 3.1 spec and RFC 9457 problem model through lib-commons/v5 (net/http/{openapi,problem}) instead of the local wrapper. Error envelope and spec-gen path changed.

Features

  • feat(pkg): add per-service tenant-manager API keys

Fixes & hardening

  • fix(worker): always decrypt plugin_crm PII fields
  • fix(pkg): correct plugin_crm datasource mapping
  • fix(worker): convert Mongo pool size safely
  • fix(pkg): document controlled security inputs
  • fix(tests): bound fuzz byte mutation
  • fix(manager): address CodeRabbit review findings + document OpenAPI artifact permissions

Dependencies & infra

  • lib-streaming → v1.8.0
  • Go builders → 1.26.5
  • shared-workflows → v1.40.3
  • go-dependencies group bump (8 modules)

Scope

73 files changed, +9477 / -9364

https://claude.ai/code/session_01NAGsmt2FuMYhK3G5uuMqb1

lerian-studio and others added 30 commits June 23, 2026 21:45
Changelog atualizado.
Changelog atualizado.
Forward-port 69842db (fetcher-026) from maintenance/v1.4.x. The plugin_crm internal datasource resolved under the wrong tenant-manager service/module (ledger/crm); map it to plugin-crm/crm-api. The configName key is unchanged.

X-Lerian-Ref: 0x1
Forward-port 73a80bf (fetcher-029) from maintenance/v1.4.x. Remove the needsDecryption projection gate that skipped PII decryption for non-dotted field projections, leaking ciphertext (e.g. banking_details.account). Decryption is now content-driven and always runs on the plugin_crm path.

X-Lerian-Ref: 0x1
Forward-port 4bf91bb (fetcher-026) from maintenance/v1.4.x. Add MULTI_TENANT_SERVICE_API_KEY_{SERVICE} per-service tenant-manager clients with fail-fast on token collision, and wire them into the manager and worker bootstraps. The worker reuses the shared TM client as the default; the single-client adapter constructor is removed and per-service clients are closed via a chain closer to avoid a goroutine leak.

X-Lerian-Ref: 0x1
Set ALLOW_INSECURE_TLS=true in the e2e Manager/Worker env so the harness boots against the plaintext testcontainers infrastructure (the service enforces MongoDB TLS by default).

X-Lerian-Ref: 0x1
Changelog atualizado.
… updates

Bumps the go-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [github.com/LerianStudio/lib-auth/v2](https://github.com/LerianStudio/lib-auth) | `2.8.1` | `2.9.0` |
| [github.com/LerianStudio/lib-streaming](https://github.com/LerianStudio/lib-streaming) | `1.6.2` | `1.7.0` |
| [github.com/aws/aws-sdk-go-v2](https://github.com/aws/aws-sdk-go-v2) | `1.42.0` | `1.42.1` |
| [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) | `1.32.25` | `1.32.27` |
| [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.104.0` | `1.104.2` |
| [github.com/gofiber/fiber/v2](https://github.com/gofiber/fiber) | `2.52.13` | `2.52.14` |
| [github.com/tryvium-travels/memongo](https://github.com/tryvium-travels/memongo) | `0.12.0` | `0.13.1` |



Updates `github.com/LerianStudio/lib-auth/v2` from 2.8.1 to 2.9.0
- [Release notes](https://github.com/LerianStudio/lib-auth/releases)
- [Changelog](https://github.com/LerianStudio/lib-auth/blob/main/CHANGELOG.md)
- [Commits](LerianStudio/lib-auth@v2.8.1...v2.9.0)

Updates `github.com/LerianStudio/lib-streaming` from 1.6.2 to 1.7.0
- [Release notes](https://github.com/LerianStudio/lib-streaming/releases)
- [Changelog](https://github.com/LerianStudio/lib-streaming/blob/main/CHANGELOG.md)
- [Commits](LerianStudio/lib-streaming@v1.6.2...v1.7.0)

Updates `github.com/aws/aws-sdk-go-v2` from 1.42.0 to 1.42.1
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@v1.42.0...v1.42.1)

Updates `github.com/aws/aws-sdk-go-v2/config` from 1.32.25 to 1.32.27
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@config/v1.32.25...config/v1.32.27)

Updates `github.com/aws/aws-sdk-go-v2/credentials` from 1.19.24 to 1.19.26
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@credentials/v1.19.24...credentials/v1.19.26)

Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.104.0 to 1.104.2
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](aws/aws-sdk-go-v2@service/s3/v1.104.0...service/s3/v1.104.2)

Updates `github.com/gofiber/fiber/v2` from 2.52.13 to 2.52.14
- [Release notes](https://github.com/gofiber/fiber/releases)
- [Commits](gofiber/fiber@v2.52.13...v2.52.14)

Updates `github.com/tryvium-travels/memongo` from 0.12.0 to 0.13.1
- [Release notes](https://github.com/tryvium-travels/memongo/releases)
- [Commits](tryvium-travels/memongo@v0.12.0...v0.13.1)

---
updated-dependencies:
- dependency-name: github.com/LerianStudio/lib-auth/v2
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/LerianStudio/lib-streaming
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2
  dependency-version: 1.42.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.32.27
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/credentials
  dependency-version: 1.19.26
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
  dependency-version: 1.104.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/gofiber/fiber/v2
  dependency-version: 2.52.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-dependencies
- dependency-name: github.com/tryvium-travels/memongo
  dependency-version: 0.13.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Changelog atualizado.
Only PRs originating from hotfix/* or release-candidate may target main; enforce_source_branches was previously unset (defaulting to include develop).
Replace Swaggo with the canonical Huma OpenAPI 3.1 wrapper and RFC
9457 problem model. Pin lib-commons v5.10.0.

BREAKING CHANGE: errors use RFC 9457 and bootstrap fails closed for
auth and multi-tenancy initialization failures.

X-Lerian-Ref: 0x1
Document why the scanner suppressions are safe for the environment variable name prefix and the internal Docker probe.

X-Lerian-Ref: 0x1
Keep fuzz randomness non-cryptographic while documenting the bounded byte conversion and preallocating the mutation buffer.

X-Lerian-Ref: 0x1
Changelog atualizado.
@fredcamaral
fredcamaral requested review from a team as code owners July 14, 2026 12:20
@lerian-studio

Copy link
Copy Markdown
Contributor

⚠️ Invalid Source Branch

Pull requests to main can only come from:

  • hotfix/*
  • release-candidate

Your source branch: develop

Please change the base branch or create a PR from an allowed branch.

@lerian-studio

Copy link
Copy Markdown
Contributor

🔍 PR Validation Summary

🚫 PR Blocked — 2 blocking failures

Check Status Blocking
Source Branch ❌ failure yes
PR Title ❌ failure yes
PR Description ✅ success yes
PR Size ⏭️ skipped no
Auto Labels ⏭️ skipped no
PR Metadata ⏭️ skipped no

Fix the blocking checks above before merge.


🔍 View workflow run

@coderabbitai

coderabbitai Bot commented Jul 14, 2026

Copy link
Copy Markdown

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a6897694-805b-4c54-af66-070f29cbf125

📥 Commits

Reviewing files that changed from the base of the PR and between 979f10c and b807691.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (72)
  • .github/workflows/pr-validation.yml
  • .github/workflows/release.yml
  • CLAUDE.md
  • Makefile
  • README.md
  • components/manager/.env.example
  • components/manager/Dockerfile
  • components/manager/Makefile
  • components/manager/README.md
  • components/manager/api/docs.go
  • components/manager/api/openapi.yaml
  • components/manager/api/swagger.json
  • components/manager/api/swagger.yaml
  • components/manager/cmd/app/main.go
  • components/manager/cmd/huma-spec/main.go
  • components/manager/cmd/huma-spec/main_test.go
  • components/manager/internal/adapters/http/in/connection.go
  • components/manager/internal/adapters/http/in/connection_huma_test_helpers_test.go
  • components/manager/internal/adapters/http/in/connection_test.go
  • components/manager/internal/adapters/http/in/fetcher.go
  • components/manager/internal/adapters/http/in/fetcher_test.go
  • components/manager/internal/adapters/http/in/huma_connections.go
  • components/manager/internal/adapters/http/in/huma_connections_test.go
  • components/manager/internal/adapters/http/in/huma_contract_test.go
  • components/manager/internal/adapters/http/in/huma_fetcher.go
  • components/manager/internal/adapters/http/in/huma_fetcher_test.go
  • components/manager/internal/adapters/http/in/huma_migration.go
  • components/manager/internal/adapters/http/in/huma_migration_test.go
  • components/manager/internal/adapters/http/in/huma_operations.go
  • components/manager/internal/adapters/http/in/huma_operations_concurrency_test.go
  • components/manager/internal/adapters/http/in/middleware_problem.go
  • components/manager/internal/adapters/http/in/middleware_problem_test.go
  • components/manager/internal/adapters/http/in/migration.go
  • components/manager/internal/adapters/http/in/migration_test.go
  • components/manager/internal/adapters/http/in/openapi.go
  • components/manager/internal/adapters/http/in/openapi_test.go
  • components/manager/internal/adapters/http/in/real_handler_test.go
  • components/manager/internal/adapters/http/in/routes.go
  • components/manager/internal/adapters/http/in/routes_test.go
  • components/manager/internal/adapters/http/in/swagger.go
  • components/manager/internal/adapters/http/in/swagger_test.go
  • components/manager/internal/bootstrap/config.go
  • components/manager/internal/bootstrap/config_test.go
  • components/manager/internal/bootstrap/resolver_adapter_test.go
  • components/worker/.env.example
  • components/worker/Dockerfile
  • components/worker/internal/bootstrap/config.go
  • components/worker/internal/bootstrap/config_test.go
  • components/worker/internal/bootstrap/resolver_adapter_test.go
  • components/worker/internal/services/extract_crm_data.go
  • components/worker/internal/services/extract_crm_data_test.go
  • docs/PROJECT_RULES.md
  • go.mod
  • pkg/engine/CHANGELOG.md
  • pkg/engine/dependency_test.go
  • pkg/itestkit/hostport.go
  • pkg/model/connection.go
  • pkg/model/job.go
  • pkg/model/job/job_queue.go
  • pkg/model/pagination.go
  • pkg/model/schema.go
  • pkg/net/http/errors.go
  • pkg/net/http/errors_test.go
  • pkg/resolver/multi_tenant_test.go
  • pkg/resolver/registry.go
  • pkg/resolver/registry_test.go
  • pkg/resolver/service_keys.go
  • pkg/resolver/service_keys_test.go
  • pkg/resolver/tenant_config_adapter.go
  • pkg/resolver/tenant_config_adapter_test.go
  • tests/fuzz/shared/generators/generators.go
  • tests/shared/apps.go

📝 Walkthrough

Walkthrough

Changes

Huma API migration

Layer / File(s) Summary
Typed API operations and routing
components/manager/internal/adapters/http/in/*
Replaces legacy Fiber handlers with typed Huma callbacks for connection, fetcher, and migration operations, including shared middleware and RFC 9457 error mapping.
OpenAPI contract and generation
components/manager/api/openapi.yaml, components/manager/cmd/huma-spec/*, Makefile, components/manager/Makefile
Adds canonical OpenAPI 3.1 generation and stale-spec checking while removing Swagger artifacts and tooling.
API validation coverage
components/manager/internal/adapters/http/in/*_test.go, pkg/net/http/errors_test.go
Adds contract, integration, middleware, concurrency, validation, and error-scrubbing tests.

Tenant-manager client routing

Layer / File(s) Summary
Per-service client selection
pkg/resolver/*, components/manager/internal/bootstrap/*
Loads normalized per-service API keys, builds tenant-manager clients, and falls back to a default client.
Bootstrap lifecycle
components/worker/internal/bootstrap/config.go, components/manager/internal/bootstrap/config.go
Adds security validation, client ownership transfer, startup leak guards, and shutdown closure for shared and per-service clients.

CRM decryption

Layer / File(s) Summary
Content-driven decryption
components/worker/internal/services/extract_crm_data.go, components/worker/internal/services/extract_crm_data_test.go
Removes field-projection gating, decrypts known encrypted content, and verifies fail-closed errors and encryption round trips.

Supporting updates

Layer / File(s) Summary
Repository tooling and environments
.github/workflows/*, Dockerfile, go.mod, tests/*, README.md, docs/*
Updates workflow revisions, Go builder images, dependencies, test TLS settings, API documentation, and developer guidance.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant Fiber
  participant Huma
  participant Service
  Client->>Fiber: Send API request
  Fiber->>Huma: Apply auth, tenant, and request context
  Huma->>Service: Execute typed callback
  Service-->>Huma: Return typed result or error
  Huma-->>Client: Return JSON or application/problem+json
Loading

Possibly related PRs

  • LerianStudio/fetcher#305: Implements related per-service tenant-manager client routing, bootstrap cleanup, and CRM mapping updates.
✨ Finishing Touches
✨ Simplify code
  • Create PR with simplified code
  • Commit simplified code in branch develop

Comment @coderabbitai help to get the list of available commands.

@fredcamaral
fredcamaral merged commit 0ab1ff4 into main Jul 14, 2026
45 of 47 checks passed
@lerian-studio

Copy link
Copy Markdown
Contributor

Lerian Library Version Check

Library Current Latest Status
lib-auth/v2 v2.9.0 v2.9.0 Current
lib-commons/v5 v5.10.0 v5.10.0 Current
lib-observability v1.1.0 v1.1.0 Current
lib-streaming v1.8.0 v1.8.0 Current
fetcher/pkg/engine v1.0.13-beta.5 skipped Skipped (ignore file)

0 outdated | 4 current | 1 skipped | 0 unknown

@lerian-studio

Copy link
Copy Markdown
Contributor

🔒 Security Scan Results — manager

🚫 PR Blocked — 1 blocking finding

Stage Status Blocking?
Filesystem Scan ✅ Clean
Docker Image Scan ✅ Clean
Docker Hub Health Score ✅ Clean
Pre-release Version Check ⚠️ 1 finding 🔴 Yes

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

Docker Image Scan

✅ No vulnerabilities found.


Docker Hub Health Score Compliance

✅ Policies — 4/4 met

Policy Status
Default non-root user ✅ Passed
No fixable critical/high CVEs ✅ Passed
No high-profile vulnerabilities ✅ Passed
No AGPL v3 licenses ✅ Passed

Pre-release Version Check

🚫 Found 1 unstable version pin(s). Only stable releases (x.y.z) and SHA-based pins are allowed.

File Line Content
./go.mod 68 github.com/LerianStudio/fetcher/pkg/engine v1.0.13-beta.5

Replace pre-release suffixes (-alpha, -beta, -rc, -dev, etc.) with stable releases.


🔍 View full scan logs

@lerian-studio

Copy link
Copy Markdown
Contributor

📊 Unit Test Coverage Report: fetcher-worker

Metric Value
Overall Coverage 87.2% ✅ PASS
Threshold 80%

Coverage by Package

Package Coverage
github.com/LerianStudio/fetcher/v2/components/worker/internal/services 89.7%

Generated by Go PR Analysis workflow

@lerian-studio

Copy link
Copy Markdown
Contributor

📊 Unit Test Coverage Report: fetcher-manager

Metric Value
Overall Coverage 89.7% ✅ PASS
Threshold 80%

Coverage by Package

Package Coverage
github.com/LerianStudio/fetcher/v2/components/manager/cmd/huma-spec 33.4%
github.com/LerianStudio/fetcher/v2/components/manager/internal/adapters/cache 100.0%
github.com/LerianStudio/fetcher/v2/components/manager/internal/adapters/http/in 89.4%
github.com/LerianStudio/fetcher/v2/components/manager/internal/services/command 92.8%
github.com/LerianStudio/fetcher/v2/components/manager/internal/services/query 96.4%

Generated by Go PR Analysis workflow

@lerian-studio

Copy link
Copy Markdown
Contributor

🔒 Security Scan Results — worker

🚫 PR Blocked — 1 blocking finding

Stage Status Blocking?
Filesystem Scan ✅ Clean
Docker Image Scan ✅ Clean
Docker Hub Health Score ✅ Clean
Pre-release Version Check ⚠️ 1 finding 🔴 Yes

Trivy

Filesystem Scan

✅ No vulnerabilities or secrets found.

Docker Image Scan

✅ No vulnerabilities found.


Docker Hub Health Score Compliance

✅ Policies — 4/4 met

Policy Status
Default non-root user ✅ Passed
No fixable critical/high CVEs ✅ Passed
No high-profile vulnerabilities ✅ Passed
No AGPL v3 licenses ✅ Passed

Pre-release Version Check

🚫 Found 1 unstable version pin(s). Only stable releases (x.y.z) and SHA-based pins are allowed.

File Line Content
./go.mod 68 github.com/LerianStudio/fetcher/pkg/engine v1.0.13-beta.5

Replace pre-release suffixes (-alpha, -beta, -rc, -dev, etc.) with stable releases.


🔍 View full scan logs

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants