Features

• Expose health endpoints under /tenant/v1 (e2e8333)
• optimize database connection pool (min: 5, max: 20) to reduce cold-start errors (c38f819)

Bug Fixes

• enforce org/tenant scoping on tenant endpoints (143ba57)
• fusionauth: include firmware permissions in unified sync (1479727)
• security: enforce tenant isolation and add unit tests (bdd1a3c)
• tenancy: use tenant slug for platform context (6e2e7fb)

Bug Fixes

• expose health endpoints under /tariff/v1 (f663bbf)

Features

• add multi-tenant filtering support with tenant-api integration (cdf5651)
• optimize database connection pool (min: 5, max: 20) to reduce cold-start errors (db35b23)

Features

• Expose health endpoints under /firmware/v1 (94dce81)
• sync device events and enforce firmware model compatibility (0b8d670)
• firmware: add distribute-by-device-tenants admin endpoint (7401bb2)
• optimize database connection pool (min: 5, max: 20) to reduce cold-start errors (06fcf26)

Bug Fixes

• add postgres enum migration for firmware channel/state/criticality (b8bdc9c)
• auth: request-scoped auth ctx and rate limit key (675660d)
• db: align entity names with migrations (07e5c15)
• db: handle firmware_state default during enum migration (217c52a)
• firmware: tenant-scoped distribute endpoint (7c6758d)
• internal: validate performance-test service token (a38eb15)
• performance: align internal perf endpoint auth (fc9b122)
• tenancy: enforce RBAC and tenant isolation (258c0f2)
• Updated s3 storage client for firmware storage and presigned url config (bccabc7)

Bug Fixes

• expose health endpoints under /release/v1 (2ff6970)
• expose internal performance overview under internal releases namespace (7a4edba)
• performance overview only includes services with recorded tests (70e2ce4)
• Add default SLO targets to internal performance time series endpoint (7242b91)

Features

• add database connection pool with pre-warmed connections to reduce cold-start errors (3f8d31e)
• add internal performance overview endpoint (c3f6d46)
• add performance overview API endpoint for dashboard view (33e6016)
• extend performance_tests table with full k6 metrics (total_requests, total_errors, availability_percent, concurrent_users, test_tool) (95462c7)
• persist performance test data to dedicated table for long-term trend analysis (08284c0)
• query performance data from dedicated table for 12-month trend analysis (20287f2)
• update default availability SLO target from 99.9% to 99.5% (55ccb5d)

Features

• Expose health endpoints under /reporting/v1 (034531c)
• implement multi-tenant filtering architecture (4cc06ea)
• optimize database connection pool (min: 5, max: 20) to reduce cold-start errors (3fa2264)

Features

• Expose health endpoints under /chargepoint/v1 (2dcc2a7)
• add organisation-based device filtering for resellers/CPOs (99bf483)
• optimize database connection pool (min: 5, max: 20) to reduce cold-start errors (4539c8b)
• support global device listing for platform admins (60c8c1f)

Bug Fixes

• apply organisation filtering to single-resource device endpoints (e62d6bc)
• Mount OpenAPI docs under /chargepoint/v1 prefix (fd54ca1)
• security: enforce org tenant filtering and add SQL tests (8f6a1ae)
• tenancy: accept tenant_global as platform-global alias (844fe8e)
• use tenant-api internal endpoints for tenant/org lookups (bbb9f1e)

Features

• Expose health endpoints under /meter/v1 (472e0b2)
• implement multi-tenant filtering with organisation support (5776ab0)
• optimize database connection pool (min: 5, max: 20) to reduce cold-start errors (f1e0ea2)

Features

• Expose health endpoints under /ocpp/v1 (4b03f0a)
• implement multi-tenant filtering with organisation support (ba29f22)
• optimize database connection pool (min: 5, max: 20) to reduce cold-start errors (108e5cd)

BREAKING CHANGES

• URL patterns changed from tenant_slug to tenant (tenant_id)
  Clients will need to update their API calls to use tenant IDs instead of slugs
  Key security improvements:

• Platform admins can access tenant_global for platform-wide view
• Organisation-based filtering for resellers/CPOs via tenant-api
• as_tenant query parameter for platform admin impersonation
• Changed URL paths from /tenants/{tenant_slug} to /tenants/{tenant}
• All endpoints enforce tenant allowlist filtering
  Changes:
• Add tenant-api client with internal endpoint support
• Add filtering helpers for tenant resolution and org expansion
• Update all route handlers with compliant filtering logic
• Change URL pattern from tenant_slug to tenant throughout
• Add TENANT_API_BASE_URL and INTERNAL_AUTH_TOKEN config
• Remove old ensure_tenant logic from AuthContext
• Add comprehensive unit tests for filtering scenarios
  All endpoints now enforce proper tenant isolation with audit logging.

1.4.0 (2025-12-22)

Bug Fixes

• correct crate name from api_auth to auth_api (5df0ab5)

Features

• add performance testing to CI pipeline (4778313)

1.1.0 (2025-12-19)

Bug Fixes

• add /meter prefix to routes to match ingress paths (1f26864)
• add permissive CORS and move OpenAPI to /meter/v1 (d83c53e)
• correct API paths from /meter/v1 to /v1 for ingress routing (d90f62b)
• update OpenAPI spec to show only production server (9736b99)
• use APP_VERSION from CI instead of CARGO_PKG_VERSION (cf91e29)

Features

• add /version endpoint and update Dockerfile for version metadata (9e7604f)
• Add axum-prometheus metrics endpoint (771c0fd)
• add complete OpenAPI documentation with utoipa annotations (67bdac6)
• add OpenAPI documentation for SSE stream endpoint (7f4306a)
• add performance test endpoint with business logic queries (4490fa0)
• add performance testing to CI pipeline (034d3ed)
• add utoipa 5.4.0 with OpenAPI documentation support (024eb56)

Performance Improvements

• optimize RabbitMQ health check to use existing publisher connection (440508a)

1.2.0 (2025-12-19)

Bug Fixes

• add /tenant prefix to routes to match ingress paths (9da4c92)
• add CORS headers for OpenAPI docs endpoint (7f76c98)
• Add tenant_cache to test AppState initialization (c2e9d2c)
• correct API path from /tenant/v1 to /v1 for ingress routing (6eab1bc)
• resolve clippy error in openapi spec handler (ff45d76)
• use APP_VERSION from CI instead of CARGO_PKG_VERSION (71d2adb)

Features

• add /version endpoint and update Dockerfile for version metadata (5cec128)
• add comprehensive OpenAPI documentation for all tenant-api endpoints (9245f1c)
• Add connection pooling and retry logic for DB and RabbitMQ (a302af0)
• add OpenAPI documentation for tenant endpoints (1b605ea)
• add performance test endpoint with business logic queries (a73dff5)
• add performance testing to CI pipeline (f42930e)
• Add Prometheus metrics for RabbitMQ connection health (692559a)
• complete OpenAPI documentation for remaining tenant-api endpoints (9672077)
• upgrade utoipa to 5.4.0, standardize endpoint, remove UI, add filtering (e7342c4)

Performance Improvements

• Add tenant resolution caching with 5-minute TTL (9771f55)
• simplify RabbitMQ health check to avoid connection overhead (46e11e3)
• Simplify telemetry to match other services (40f517c)
• Use db.ping() instead of SELECT 1 for health check (53dbb9b)

1.1.0 (2025-12-19)

Bug Fixes

• add /tariff prefix to routes to match ingress paths (e118bd8)
• add CORS headers for OpenAPI docs endpoint (d389588)
• correct OpenAPI route to /tariff/v1/api-docs/openapi.json (0c2e2ee)
• Move OpenAPI documentation route outside auth middleware (cf2e98d)
• Rename health endpoint to be compliant with all other micro services. (254bd27)
• resolve clippy error in openapi spec handler (8ad8a8f)
• update OpenAPI spec to show only production server (6d39e91)

Features

• add /version endpoint and update Dockerfile for version metadata (45fe227)
• Add axum-prometheus metrics endpoint (12c62a8)
• add performance test endpoint with business logic queries (5c713b3)
• add performance testing to CI pipeline (63c7fd9)
• Added additional unit tests to increase coverage (519e519)
• remove utoipa-rapidoc, remove UI endpoint, add path filtering (f8fe5fb)

Bug Fixes

• add /release prefix to routes to match ingress paths (bde043f)
• add permissive CORS and move OpenAPI to /release/v1 (bee0396)
• correct API paths from /release/v1 to /v1 for ingress routing (120aab7)
• resolve clippy errors in openapi and releases modules (e2072d2)
• Remove unused performance module to resolve clippy dead code warnings (f6d9dd7)
• Use APP_VERSION from CI instead of CARGO_PKG_VERSION (f907d28)
• Replace manual min/max with clamp (524e0b8)

Features

• add performance test endpoint with business logic queries (c137a70)
• add performance testing and promotion readiness endpoints to OpenAPI spec (ff07293)
• add performance testing to CI pipeline (84387f8)
• add performance time-series endpoint with default SLO targets (c4cf96f)
• standardize endpoint path, remove UI, add path filtering (5227a83)
• Add /version endpoint and update Dockerfile for version metadata (0eee109)
• Add database connection retry logic (be86c32)
• Add GET endpoint for single release by ID to internal API (c2dfc8e)
• Add load testing with p95/p99 performance metrics (3391814)
• Add performance test tracking API endpoints (abf1db1)
• Add PLATFORM_ADMIN cross-tenant access support (1490e8e)
• Add internal API endpoint for performance time series (76ddec9)

Performance Improvements

• Make /health endpoint lightweight (12a5c3d)

1.1.0 (2025-12-19)

Bug Fixes

• add /reporting prefix to routes to match ingress paths (1a8e312)
• add CORS headers for OpenAPI docs endpoint (5be8ed2)
• correct API path from /reporting/v1 to /v1 for ingress routing (1ba59d7)
• resolve clippy error in openapi spec handler (a71f6ce)
• resolve never type fallback compilation error (0ffa5b4)
• update OpenAPI spec to show only production server (5155376)
• use APP_VERSION from CI instead of CARGO_PKG_VERSION (4abfb24)

Features

• add /version endpoint and update Dockerfile for version metadata (0cecfed)
• Add axum-prometheus metrics endpoint (686ad7e)
• Add database connection retry logic (10c87f9)
• add performance test endpoint with business logic queries (5fd8338)
• complete OpenAPI documentation for all reporting-api endpoints (8cb277f)
• upgrade utoipa to 5.4.0, remove UI endpoints, add path filtering (25850c8)

Performance Improvements

• simplify RabbitMQ health check to avoid connection overhead (a1c241b)

1.1.0 (2025-12-19)

Bug Fixes

• add /ocpp prefix to routes to match ingress paths (72739c1)
• Configure explicit CORS headers for documentation site access (1b0870a)
• correct API path from /ocpp/v1 to /v1 for ingress routing (fb9a22a)
• correct OpenAPI route to /ocpp/v1/api-docs/openapi.json (4ff7197)
• move OpenAPI endpoint under /ocpp/v1 (43cf54a)
• Separate public routes for OpenAPI documentation access (d0e6434)
• update OpenAPI spec to show only production server (4915e6d)
• use APP_VERSION from CI instead of CARGO_PKG_VERSION (e02f639)

Features

• add /version endpoint and update Dockerfile for version metadata (5a3472d)
• Add axum-prometheus metrics endpoint (ffa1e76)
• add OpenAPI documentation for charging profiles, smart charging, and security events (bf31989)
• add OpenAPI documentation for commands and charging profiles (dbfb241)
• add performance test endpoint with business logic queries (357992e)
• add performance testing to CI pipeline (896332a)
• Add Prometheus metrics for RabbitMQ connection health (f1d535c)
• add utoipa 5.4.0 with OpenAPI documentation support (b1d4f23)
• tests: Added additional unit tests to increase coverage (3a7f0be)

1.1.0 (2025-12-19)

Bug Fixes

• add /firmware prefix to routes to match ingress paths (1bf637d)
• Added health endpoint to allow_anonymous connections (ce8a474)
• correct API path to /v1 since ingress handles /firmware (097445f)
• move OpenAPI endpoint under /firmware/v1 (c0660ec)
• Resolved openapi endpoint compilation following update to version 5.4 (606aaa4)
• Separate public OpenAPI route from authenticated routes (e096417)
• update OpenAPI spec to show only production server (8a288c1)
• use APP_VERSION from CI instead of CARGO_PKG_VERSION (7cea63a)

Features

• add /version endpoint and update Dockerfile for version metadata (02324fd)
• Add axum-prometheus HTTP metrics alongside custom metrics (ecb0655)
• Add database connection retry logic (90cac50)
• add OpenAPI documentation for firmware version management endpoints (996e9e8)
• add OpenAPI documentation for manifest, upload, and rollout endpoints (670a9ea)
• add OpenAPI documentation for SSE stream endpoints (31da45d)
• add performance test endpoint with business logic queries (310ace4)
• add performance testing to CI pipeline (4b51968)
• add utoipa 5.4.0 with OpenAPI documentation support (2d00d95)
• complete OpenAPI documentation for rollout control and device groups (768ef41)
• complete OpenAPI documentation for version lifecycle, downloads, and releases (463b514)
• Renamed health endpoint to match other micro services (4911981)

1.1.0 (2025-12-19)

Bug Fixes

• add /chargepoint prefix to routes to match ingress paths (1fc7f87)
• correct API path from /chargepoint/v1 to /v1 for ingress routing (a389368)
• restore /chargepoint prefix to API routes (aaed5f5)
• update test endpoints to use correct /chargepoint/v1 prefix (1e05921)
• update test URLs from /chargepoint/v1 to /v1 (c29653e)
• use APP_VERSION from CI instead of CARGO_PKG_VERSION (e24191c)

Features

• add /version endpoint and update Dockerfile for version metadata (de3365f)
• Add axum-prometheus metrics endpoint (9ec4fc3)
• Add connection pooling and retry logic for DB and RabbitMQ (9c0ff9f)
• add OpenAPI documentation for device endpoints (d343996)
• add performance test endpoint with business logic queries (3a0f833)
• Add Prometheus metrics for RabbitMQ connection health (7f5c77f)
• complete OpenAPI documentation for connectors and transactions endpoints (b0bae52)

Performance Improvements

• optimize RabbitMQ health check to avoid creating new connections (8a86d45)

Bug Fixes

• handle query parameters in public path detection (4114aed)
• public paths now work with x-original-url header (62ba694)
• Extract real client IP from X-Forwarded-For headers for rate limiting (9778856)
• Service tokens now bypass IP-based rate limiting (d570232)
• Use APP_VERSION from CI instead of CARGO_PKG_VERSION (9eb8584)
• Force staging CI to pull latest template from devops (d6cd21f)

Features

• Add metrics recording to performance test endpoint for Grafana visibility (215bf0e)
• add public path whitelisting for OpenAPI docs (f4b18e6)
• Split out unit tests to seperate tests crate and added additional unit tests to improve coverage (7f29760)
• Add /version endpoint and update Dockerfile for version metadata (cf86974)
• Add connection retry logic for DB and RabbitMQ (b9710e6)
• Add Prometheus metrics for RabbitMQ consumer health (ef6143d)
• Add adhoc performance testing script (5b78fd2)

Performance Improvements

• Add performance test results for 1.0.0-rc.4 (ec5373c)
• Make /health endpoint lightweight (a3ea8ad)

1.1.0 (2025-12-11)

Bug Fixes

• Correct JSON escaping in merge request API calls (7cdcef4)
• Dockerfile locations (ec5d2f8)
• Implement independent semantic versioning for each service (f2960c5)
• Move TENANT constant before use in status_notification (0283fd5)
• ocpp-core: Declare firmware.topic exchange to avoid readiness failures when firmware-api is not yet deployed (005a369)
• Process password correctly (02ec8b4)
• Publish transaction events to platform vhost for chargepoint-api consumption (f95826e)
• Rename .releaserc to .releaserc.json for proper parsing (6b7cdff)
• Run semantic-release from service directories to find config files (3dc51ea)
• Updated queue names (5dfedb4)
• Use connector_number instead of connector_id for transaction events (432991d)
• Use EVSE ID as connector_number instead of connector_id within EVSE (2be5d9c)
• Use subshells for cd commands to preserve working directory (ba0670c)
• Use tenant cache in boot notification handler (a719bcd)

Features

• Add charging_state to transaction events for accurate status (a6b5de5)
• Add tenant cache to ocpp-core v201 for efficient tenant resolution (ec83beb)
• Add TTL and event-based cache invalidation to tenant cache (4c4be13)
• Added debug logging for internal service lookups (954ac0b)
• Added status publication on websocket disconnect (0ff741b)
• Added support for firmware orchestrator status updates and processing of requests (6d60d27)
• ci: Incorporate arm64 build pipeline from Devops repo (425886d)
• Publish meter samples to meter-api rabbitmq (27dbffe)
• Publish meter samples to platform vhost for meter-api (8ead8f5)
• Refactored all Rabbitmq Names to complly with new standard (1950a21)
• Refactored all Rabbitmq Names to comply with new standard (a8cce5b)
• Updated Heartbeat to 5 minutes (300 seconds) (b4f33ec)
• Updated new CP processing from device-setup api endpoint to use cp.event on ampnexus-{env} vhost (690e82c)
• Updated rabbitmq virtual host (83afd8a)
• Warm tenant cache on any message (heartbeat, status notification) (34b4b8d)

1.0.0 (2025-12-11)

Bug Fixes

• PostgreSQL enum casting errors for RolloutStatus (1c06270)
• Ran cargo fmt (caf3739)
• Ran Cargo fmt (9aa1dab)
• Ran cargo fmt ran to resolve build issue (ff6b68b)
• Resolve date time format (dad936a)
• Resolved DB Enum mapping issues. (acd694c)
• Resolved Schema issue due to enum values (7b3bd94)
• Switched to updating via ActiveModel, which binds the ActiveEnum correctly as the enum type (6ac2361)

Features

• Added additional health endpoints to cover db and rabbitmq (071ba1c)
• auth: Switch to firmware-api token exchange per tenant; drop FusionAuth client creds - Add ORCH_SERVICE_TOKEN config and per-tenant token cache - Use POST /internal/tenants/{tenant}/fa/access-token then /tenants/{tenant}/download-url - Update wiremock tests to mock firmware-api endpoints and caching - Clean K8s ConfigMap/Secret: remove FA_*; Add ORCH_SERVICE_TOKEN- Update .env.example accordingly (21c320a)
• ci: Update CI Pipeline configuration to include cargo fmt, cargo clippy and semantic release (20f4a79)
• orchestrator: Publish fw.device.allowed; migrate to SeaORM

• Add Amqp::publish_json helper - Wire AMQP into Orchestrator and publish per allowed device - Migrate DB layer to SeaORM and return serials from allow_next_batch- Add rollout_context for payload metadata - Add semantic-release config and fix CI reference - Keep clippy clean (f9dd489)

• presign: integrate firmware-api presigned URL with FusionAuth token caching - Add FirmwareApiClient with client-credentials flow and retries - Wire into Orchestrator to publish fw.device.allowed with URL + sha256- Add testable constructors and lib exports for integration tests - Add wiremock-based tests for token caching, retries, and 4xx handling - Mirror env vars in staging ConfigMap/Secret with comments - Update .env.example and config defaults (282c7da)
• Refactored remaining raw SQL statements to use seaORM instead (47ad363)
• Updated orchestrator to wait for all devices including offline before marked as completed (35f076c)

1.0.0 (2025-12-09)

Bug Fixes

• Added cargo.lock (3aa2988)
• docker: Remove dummy binary from cache before real build (274eb90)
• Mount internal API routes at /releases/v1 to match client expectations (62ca694)
• Update axum to 0.8.7 compatibility (39d4f32)
• Update route path syntax for axum 0.8 (e451efe)
• Updated Dockerfile version (d96bbd7)

Features

• Add tenant path parameter to match microservice pattern (9e78781)
• Added Integration tests and resolved clippy errors (87d93cd)
• Added internal endpoint for fetching releases (08775cb)
• Refactored to change release-api to be tenant scoped (21dcb50)
• Updated CI Pipeline templates (0bb312b)

1.0.0 (2025-12-09)

Bug Fixes

• axum: Update route paths to use new {parameter} syntax (db6c0bc)
• Calculate energy_kwh from meter delta instead of raw meter value (70cfe2f)
• Cast NUMERIC to DOUBLE PRECISION to match Rust f64 type (cc5e79b)
• ci: Trigger CI Build (ef6ae1a)
• docker: Correct migration directory path and ownership (5a18c5e)
• Explicit float8 casting in SQL queries to resolve NUMERIC type mismatch (47b9b78)
• Fixed Migration copy path in Dockerfile (5da5add)
• Handle transaction Ended events without started_at and improve logging (6dcd138)
• Prevent AMQP consumer from exiting on connection loss (9da3fb5)
• Prevent NULL values for NOT NULL columns in transaction insert (46be054)
• Replace unwrap_or_else(Vec::new) with unwrap_or_default() (287bb8e)

Features

• Add detailed error logging for transaction insert failures (d65c81b)
• Add meter sample event subscription and processing (68a0ee5)
• Add SSE infrastructure for real-time dashboard updates (5f0f114)
• Implement full meter aggregation with time-series bucketing (89af82c)
• Phase 4 - Add AMQP consumer for transaction events (544be52)
• release: Updated devops template to use new environment template with support for release-api publication (b2ed044)
• Wire up SSE events from AMQP consumer (285547f)

1.0.0 (2025-12-09)

Bug Fixes

• Removed authentication from health endpoints (f380aff)
• Start HTTP server before sync to improve startup reliability… (617b0a0)
• Support AMQP_URI environment variable for RabbitMQ configuration… (51d9bdb)
• Update Axum route syntax from :param to {param} format… (c64498a)
• Updated Dockerfile and trigger CI Build (d19be69)

Features

• Added Octopus Sync to api micro service (74af7e8)
• Initial Commit (690a123)
• Updated all packages and added health endpoints (f74d03a)

1.0.0 (2025-12-09)

Bug Fixes

• Added correct fields for cp.created and cp.updated events (d85e074)
• Added DeviceStatus and ConnectorStatus enums (without rename_all) (e59844d)
• Added password to cp.event create and update payloads (203c236)
• Change Exchange declaration (5799c42)
• Changed default tenant to tenant_global (5aeda3e)
• Changed queue type (00c6206)
• Dockerfile copy and trigger build (4df44b5)
• Remove conflicting NULL/NOT NULL declarations in migration (becb7cb)
• Resolved payload to ensure compatibility with other services (975f643)
• Updated db credentials (a78c6d5)
• Updated migration to remove double null declaration and updated environment variables to match standard (6443497)
• Updated prod CI build pipeline config (ccbfa61)

Features

• Added activation_code and adoption_code fields to DeviceData struct (e202c23)
• Added device modal name to payload rather then ChargePoint- (bbf54c3)
• Added gitlab ci configuration for staging and prod (aace96d)
• Added health endpoints and lint and tests (573f12b)
• Added SKU mappings for PlugStream chargepoints and RabbitMq publishing of data for other service consumption. (cfc0e55)
• Refactored to a rust endpoint (1a18636)
• Updated cp.events RabbitMQ events to use sku rather then model (6d640c1)
• Updated endpoint configuration details (212ee79)
• Updated Setup API Endpoint RabbitMq message handling (82e4854)
• Updated to print serial number labels on setup of new device (7209aaa)

1.0.0 (2025-12-09)

Bug Fixes

• Add debug logging (4330cf0)
• Add reconnection loop to AMQP consumer (4ffd536)
• Added additional node_modules (3cf11bb)
• Added duplicate rollout detection and reporting (f4e9e49)
• Added Prisma Client copy in Docker stage (ec77acf)
• Auto-create devices when assigning to cohorts (f58cd5b)
• build: Correct relative imports in version lifecycle routes to resolve module-not-found during Next build (21b9a0d)
• ci: Corrected typo in lint stage of Staging Pipeline (a2fda2a)
• ci: Removed tsx from Dockerfile (88e78d8)
• Cleaned up prisma Migrations (15fec12)
• Corrected CI Pipeline template (5209d7e)
• Corrected Migration (6e49672)
• improve S3 presigned URL generation and upload error handling (89acc6d)
• platform-owner: Finalise auth/rbac updates and ensure group listing aligns with new guards (a3284fe)
• prisma: Add Device.groupMemberships back-relation to satisfy FirmwareGroupDevice.device relation validation (30da89d)
• Remove minHwRev requirement so it is optional (42c2d91)
• Remove public from Dockerfile copy block (f17c261)
• Removed Copying files from prod stage (a558e2a)
• Resolve build issue in withdraw route (a5dfcdc)
• Resolve Next.js 15 build issues and type errors (03b3b8c)
• Resolve Prisma DeviceRolloutStatus enum issues and add device counts to cohorts (404f788)
• Resolve tenant-auth route imports (d6087ae)

Documentation

• Establish consistent tenant scoping requirements for all API endpoints (b34d8bb)

Features

• Add enhanced debug logging for tenant resolution in cohorts API - Add detailed logging to trace as_tenant parameter handling - Log auth mode, path tenant, and query parameters at each step - Track data being created in POST requests - Count items returned in GET requests - Enhanced requireTargetTenant logging to debug parameter extraction (f727081)
• Add proper tenant validation to firmware version lifecycle endpoints (94f6b2e)
• Add tenant-scoped firmware version lifecycle endpoints (de2a523)
• Added DB Migration (be60e46)
• Added health endpoints (ad5d715)
• Added SSE Endpoints for rollout stats (13eb595)
• Allow api-key callers through platform RBAC checks (fd54680)
• api: Add firmware versions list endpoint (64ad495)
• api: Enhance versions endpoint with product display names (c72e2b6)
• api: Rollout detail/devices endpoints + operator intents (pause/resume/cancel/promote) with RBAC & AMQP publish - Detail endpoint with KPIs and policy - Devices listing with filters and pagination - Intent routes publishing to AMQP and updating status - RolloutStatus enum: add 'cancelled' + migration - Tests added; docs updated (7814799)
• auth-mapping: Add FirmwareAuthMapping model, admin CRUD endpoints, and internal FusionAuth access-token exchange with in-memory cache + tests - Prisma model + migration - Admin routes guarded by AUTH_MAPPING_ADMIN with redacted secrets - Internal service token exchange guarded by SERVICE_ORCHESTRATOR with rate limiting - getFaAccessToken helper using Map+TTL cache and FA token POST - Tests for CRUD and token exchange behaviors Docs: implements docs/codex_prompt_firmware_api_fa_mapping.md (92c1f4b)
• auth: Add TenantAuthMap model + admin CRUD; update JWT verification to use DB map for JWKS selection; document endpoints - Prisma model + migration - lib/auth: resolve faTenantId via prisma.tenantAuthMap - Admin routes for tenant-auth mapping - Tests for admin list/upsert - Update API docs (596d303)
• cohorts: Drop groups compatibility; rename DB to Cohort/CohortDevice; implement /cohorts API and update rollouts + tests - Prisma: Cohort/CohortDevice models, migration renaming tables and groupId->cohortId - API: cohorts handlers for list/create/get/update/delete + membership and device-cohorts - Rollouts: accept cohorts_any with groups_any fallback, resolve via cohorts - Build: fix import paths in new routes - Tests: updated mocks and expectations (18d5954)
• Enable tenant-based firmware isolation (a46776a)
• groups+policy+audit: add FirmwareGroup, membership, and download audit; enforce policy gates; expand rollout cohorts; enrich approval event (b516c96)
• groups: Membership read APIs + serial resolver - GET groups/{groupId}/devices with pagination and search - GET devices/{deviceId}/groups list memberships - Add lib/devices resolver for serial→deviceId - Prisma relation for FirmwareGroupDevice.device - Tests added; docs updated (6e53993)
• groups: Tenant group CRUD + membership endpoints; OpenAPI docs; seed script - Routes: list/create, get/update/delete, replace membership - Validation schemas for group payloads - OpenAPI paths and schemas - Seed script and npm script - Tests for group flows (1213098)
• implement tenant-scoped release endpoint and update documentation (6d15479)
• lifecycle: Add submit/approve/withdraw/release endpoints; require tenant releases in manifest - Prisma: FirmwareRelease model present; FirmwareVersion state fields used - Routes: versions submit/approve/withdraw, releases create - Manifest: filters by FirmwareRelease for target tenant + state=released - Tests: add lifecycle tests; update manifest tests for new RBAC and release gating (3b95c62)
• Migrate uploads endpoint to tenant-aware architecture (48f294c)
• orchestrator-schema: Add IntentDedupe table (+ TTL index), Device.siteId and tenant/site index, and rollout tenant index - Prisma schema updates - Migration for IntentDedupe, Device.siteId, and indexes - Lint clean; tests passing (2b2398e)
• platform-owner: Add platform owner mode with as_tenant support - Env vars: PLATFORM_TENANT_SLUG, PLATFORM_FA_TENANT_ID, PLATFORM_SCOPE - lib/auth: verifyForPathTenant for dual-mode verification - lib/rbac: requireTenantScopeOrPlatform + requireTargetTenant - Rollout detail + intents honor platform mode and as_tenant; queries filter by target tenant - Update K8s configmap/secret for platform vars - Tests updated to reflect new guards (809dea8)
• Removed Next.js version (fbc48b3)
• service-token: Add service token auth and internal download-url endpoint - Env: SERVICE_ORCHESTRATOR_TOKENS in .env and K8s Secret - lib/service-auth.ts guard for internal routes - POST tenants/{tenantId}/internal/download-url for orchestrator with audit and policy checks - Protect internal FA token exchange with service-token fallback - Tests for internal route (49e524e)
• Trust api-auth headers for firmware-api auth (f289e97)
• Updated migrations to include firmware approvals (d321b04)
• Updated to more closly match the API Firmware contract following refactor to rust (e64558f)
• Use JWT tid claim for tenant validation instead of hardcoded mappings (acdce4b)

BREAKING CHANGES

• All firmware API endpoints now MUST follow tenant-scoped URL patterns

• Update firmware_api_endpoint_contract_v2.md with mandatory tenant scoping
• Add comprehensive tenant scoping rules and security guidelines
• Create portal_integration_guidelines.md with frontend integration patterns
• Add tenant_scoping_migration_checklist.md for implementation guidance
• Mark all non-tenant-scoped endpoints as deprecated

This prevents future security issues by ensuring consistent tenant isolation,
platform admin support, and clear audit trails across all API endpoints.

Key Changes:

• /versions/{id}/submit → /tenants/{tenantId}/versions/{id}/submit
• /uploads → /tenants/{tenantId}/uploads
• /releases → /tenants/{tenantId}/releases
• All endpoints require tenant validation and as_tenant support