From 506480f8b5490b4576c5649d759ffc49b1760de8 Mon Sep 17 00:00:00 2001 From: Nicolas Dreno Date: Fri, 18 Sep 2026 00:34:55 +0200 Subject: [PATCH] Update the playground to Barbacane 0.11.0 0.11.0 forwards only the request headers an operation admits, and refuses an operation that runs an authentication middleware without naming the security scheme carrying the credential. The specs attached `oidc-auth` through `x-barbacane-middlewares` and declared no scheme, so they no longer compile: E1057: 'oidc-auth' authenticates the caller, so the operation must declare the security scheme carrying the credential Ten operations, seven in the train travel API and three in the S3 proxy, now name an `openIdConnect` scheme pointing at the mock issuer's discovery document. The requirement sits on each operation rather than at the document root, so the public asset route, the event channels and the WAF demos stay anonymous and admit no credential. No header needed declaring by hand. What the chain reads comes from the plugins' own configuration: `x-api-key` from the rate-limit partition, `x-request-id` and `x-event-id` from the correlation and event plugins, and `authorization` from the scheme above. `idempotency-key` and `accept-language` were already declared parameters. Verified against a running 0.11.0 stack, not only by compiling: 23 smoke checks pass. Compiling alone was not enough, because a malformed requirement can empty the middleware list, and E1057 then has no authentication plugin to check and passes for the wrong reason. --- .env.example | 4 ++-- README.md | 2 +- docker-compose.yml | 6 +++--- specs/s3-proxy.yaml | 12 ++++++++++++ specs/train-travel-api.yaml | 18 ++++++++++++++++++ 5 files changed, 36 insertions(+), 6 deletions(-) diff --git a/.env.example b/.env.example index 0d2a515..d1df4b9 100644 --- a/.env.example +++ b/.env.example @@ -1,7 +1,7 @@ # Barbacane image version to pull from ghcr.io/barbacane-dev -# Set to a specific release tag (e.g. 0.10.0) to pin the playground to that version. +# Set to a specific release tag (e.g. 0.11.0) to pin the playground to that version. # Use "latest" to always pull the most recent release. -BARBACANE_VERSION=0.10.0 +BARBACANE_VERSION=0.11.0 # Admin token for the control plane. Since 0.8 the control plane refuses to # start without a non-empty token. This is a demo default — change it for any diff --git a/README.md b/README.md index f0b0ff1..793fbd5 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ By default the playground pulls the `latest` images from [GitHub Container Regis ```bash cp .env.example .env -# Edit .env and set BARBACANE_VERSION=0.10.0 (or any release tag) +# Edit .env and set BARBACANE_VERSION=0.11.0 (or any release tag) docker compose pull docker compose up -d ``` diff --git a/docker-compose.yml b/docker-compose.yml index 5817863..47a9a2a 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -20,7 +20,7 @@ services: # Spec Compiler (init container - compiles specs before gateway starts) # ========================================================================== compiler: - image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.10.0} + image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.11.0} command: ["compile", "--spec", "/specs/train-travel-api.yaml", "--spec", "/specs/train-events.yaml", "--spec", "/specs/s3-proxy.yaml", "--spec", "/specs/waf-demo.yaml", "--manifest", "/manifest/barbacane.yaml", "--output", "/output/api.bca", "--allow-plaintext"] # Run as root so the init container can write the shared artifact volume, # which is root-owned by default. The gateway mounts it read-only. @@ -36,7 +36,7 @@ services: # API Gateway (Data Plane) # ========================================================================== barbacane: - image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.10.0} + image: ghcr.io/barbacane-dev/barbacane-standalone:${BARBACANE_VERSION:-0.11.0} # --admin-bind on 0.0.0.0 exposes the admin API (/health, /metrics, # /provenance) to Prometheus and the host. It defaults to loopback, which # other containers cannot reach. The admin endpoints are unauthenticated; @@ -88,7 +88,7 @@ services: # Control Plane (Web UI + API) # ========================================================================== control-plane: - image: ghcr.io/barbacane-dev/barbacane-control:${BARBACANE_VERSION:-0.10.0} + image: ghcr.io/barbacane-dev/barbacane-control:${BARBACANE_VERSION:-0.11.0} ports: - "3001:80" # Web UI - "9091:9090" # Control Plane API diff --git a/specs/s3-proxy.yaml b/specs/s3-proxy.yaml index 0182375..5adc3d1 100644 --- a/specs/s3-proxy.yaml +++ b/specs/s3-proxy.yaml @@ -35,6 +35,8 @@ paths: issuer_url: "http://mock-oauth:8080/barbacane" issuer_override: "http://localhost:9099/barbacane" audience: "train-travel-api" + security: + - OpenIdConnect: [] x-barbacane-dispatch: name: s3 config: @@ -84,6 +86,8 @@ paths: issuer_url: "http://mock-oauth:8080/barbacane" issuer_override: "http://localhost:9099/barbacane" audience: "train-travel-api" + security: + - OpenIdConnect: [] x-barbacane-dispatch: name: s3 config: @@ -119,6 +123,8 @@ paths: issuer_url: "http://mock-oauth:8080/barbacane" issuer_override: "http://localhost:9099/barbacane" audience: "train-travel-api" + security: + - OpenIdConnect: [] x-barbacane-dispatch: name: s3 config: @@ -168,3 +174,9 @@ paths: description: Asset content "404": description: Asset not found + +components: + securitySchemes: + OpenIdConnect: + type: openIdConnect + openIdConnectUrl: http://localhost:9099/barbacane/.well-known/openid-configuration diff --git a/specs/train-travel-api.yaml b/specs/train-travel-api.yaml index 5cadb50..e4a8d9c 100644 --- a/specs/train-travel-api.yaml +++ b/specs/train-travel-api.yaml @@ -338,6 +338,8 @@ paths: issuer_url: "http://mock-oauth:8080/barbacane" issuer_override: "http://localhost:9099/barbacane" audience: "train-travel-api" + security: + - OpenIdConnect: [] parameters: - name: status in: query @@ -389,6 +391,8 @@ paths: config: latency_slo_ms: 1000 detailed_request_logs: true + security: + - OpenIdConnect: [] requestBody: required: true content: @@ -429,6 +433,8 @@ paths: issuer_url: "http://mock-oauth:8080/barbacane" issuer_override: "http://localhost:9099/barbacane" audience: "train-travel-api" + security: + - OpenIdConnect: [] parameters: - name: bookingId in: path @@ -462,6 +468,8 @@ paths: issuer_url: "http://mock-oauth:8080/barbacane" issuer_override: "http://localhost:9099/barbacane" audience: "train-travel-api" + security: + - OpenIdConnect: [] parameters: - name: bookingId in: path @@ -492,6 +500,8 @@ paths: issuer_url: "http://mock-oauth:8080/barbacane" issuer_override: "http://localhost:9099/barbacane" audience: "train-travel-api" + security: + - OpenIdConnect: [] parameters: - name: bookingId in: path @@ -527,6 +537,8 @@ paths: issuer_url: "http://mock-oauth:8080/barbacane" issuer_override: "http://localhost:9099/barbacane" audience: "train-travel-api" + security: + - OpenIdConnect: [] parameters: - name: bookingId in: path @@ -563,6 +575,8 @@ paths: latency_slo_ms: 5000 detailed_request_logs: true detailed_response_logs: true + security: + - OpenIdConnect: [] parameters: - name: bookingId in: path @@ -592,6 +606,10 @@ paths: $ref: "#/components/responses/PaymentRequired" components: + securitySchemes: + OpenIdConnect: + type: openIdConnect + openIdConnectUrl: http://localhost:9099/barbacane/.well-known/openid-configuration schemas: Station: type: object