CloudStack modernization: Java 17 + Jakarta + Phase 4 decomposition complete - #1
Open
d4m14ndx wants to merge 677 commits into
Open
CloudStack modernization: Java 17 + Jakarta + Phase 4 decomposition complete#1d4m14ndx wants to merge 677 commits into
d4m14ndx wants to merge 677 commits into
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
added 29 commits
May 19, 2026 22:13
Expand coverage from 5 to 10 tests covering account network access checks, default network list building, and permission denial paths. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Expand coverage from 4 to 10 tests covering VPC hypervisor validation, system-only network rejection, and default network selection edge cases. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Expand coverage from 4 to 10 tests covering NIC tracking, load scheduling, stopped VM filtering, and agent IP fetch retry logic. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Expand coverage from 7 to 10 tests covering zone-wide store detection and storage-free migration eligibility checks. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Expand coverage from 6 to 10 tests covering VM limit validation, permission checks, DNS update no-ops, and user data delegation. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
… services Brings each of 15 Codex Phase 4 extractions from <10 tests to >=10 tests per the playbook minimum. Pure-test additions plus a handful of small mock-stub fixes (lenient() for UnnecessaryStubbing, non-null returns for impls that don't null-guard). Services covered: KvmLiveStorageMigrationHandler, KvmNonLiveStorageMigrationHandler, VmTerminationService, VmStopOrchestrationService, VmRuntimeLifecycleService, VmUpdateOrchestrationService, VmLiveMigrationOrchestrationService, VmAssignmentNetworkService, VmCreationNetworkSelectionService, VmExternalDhcpIpFetchService, VmScaleReconfigurationService, ApiVpcVpnResponseService, ApiAddressVlanResponseService, ApiHostZoneCapacityResponseService, ApiLoadBalancerFirewallResponseService 13 commits, ~840 net new test lines. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Three fixes plus tests, addressing findings from a security review of the
Phase 5b auth + BFF foundation.
1. Dev-session escape hatch (web/lib/bff/config.ts)
`allowDevSession` previously returned true on any of BFF_DEV_SESSION,
NEXT_PUBLIC_APP_ENV=dev, or NEXT_PUBLIC_APP_ENV=development without any
NODE_ENV gate. Because `.env.example` shipped NEXT_PUBLIC_APP_ENV=dev as
its default, anyone copying the example into a deployed environment got
a wide-open BFF that proxies anonymous requests to CloudStack with a
hardcoded ROOT session. The flag is now ignored entirely when
NODE_ENV=production (the build phase is still treated as non-production
so `next build` keeps tree-shaking correctly).
2. CSRF defence on /api/cs/* POSTs (web/app/api/cs/[command]/route-core.ts)
SameSite=Lax on the BFF cookie blocks most cross-site POSTs but not
top-level form submissions. The route now rejects POSTs whose Origin
header doesn't match either NEXTAUTH_URL or the request's own host.
Missing Origin is allowed in non-production (curl/tests) and rejected
in production. GET is unchanged.
3. Authorisation fallback (web/lib/auth/server.ts)
`getCurrentUser()` used to silently return `mockUser` (role: ROOT) when
no Auth.js session existed, turning absence-of-auth into presence-of-
root for any server consumer. The fallback is removed; getCurrentUser
now returns null (alias for getAuthenticatedUser). `hasRole` now denies
by default when no user is present. Pages that explicitly want the
Phase 5a placeholder can import `mockUser` directly.
Bonus: clarified .env.example so the dev-session env vars are explicit
and labelled NEVER-IN-PROD, and the public sidebar-label var defaults to
"local" rather than "dev".
Tests added (14 new, 222 total passing):
- 6 cases in app/api/cs/route-core.test.ts for the Origin allowlist
(cross-origin reject, same-origin accept, NEXTAUTH_URL match, missing-
Origin allow in non-prod, missing-Origin reject in prod, GET bypass)
- 8 cases in lib/bff/config.test.ts for the allowDevSession matrix
(each enabling flag, production block, build-phase exception, etc.)
Verified: npm run lint (clean), typecheck (strict, clean), test:unit
(222/222), build (production bundle generated, 87.3 kB shared First Load).
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Three Phase 5b auth/BFF fixes from a security review: - Block allowDevSession when NODE_ENV=production (was unconditional via NEXT_PUBLIC_APP_ENV=dev, which was the .env.example default) - Add Origin allowlist on /api/cs/* POSTs (CSRF defence beyond SameSite=Lax) - Remove silent mockUser fallback in getCurrentUser/hasRole (deny-by-default authorization on no session) Plus 14 new tests (6 CSRF, 8 dev-session gating). 222/222 unit tests pass, typecheck strict, lint clean, production build OK. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
# Conflicts: # web/lib/settings-messages.test.ts
# Conflicts: # web/lib/settings-messages.test.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Modernization fork of Apache CloudStack covering dead-code removal, dependency upgrades, Java 17 + Jakarta + Spring 6 migration, cloud-native operability, container/Helm packaging, and the Phase 4 god-class decomposition program.
Status at
modernize-2026@cdcb59f40b: Phase 4 tracked god-class line-count closeout is complete. Every tracked Phase 4 target is now below the 3K stopping rule.Phase Status
Phase 1 - Dead Code Removal
Phase 2 - Dependency Modernization
Phase 3 - Java 17, Jakarta, Spring 6
javax.*tojakarta.*while preserving Java SE packages.Phase 4 - God-Class Decomposition And Operability
God-class decomposition is now below the 3K threshold for the tracked closeout list:
Decomposition pattern:
Operability and packaging work in this branch includes:
Phase 5 - UI Rebuild And SSO
Phase 5a is already in the branch: Next.js scaffold, design system shell, route stubs, Dockerfile, and web CI workflow. Phase 5b remains next: Auth.js, Redis/session BFF, and Java-side
createUserSessionTokenAPI work.Latest Verification
Recent focused gates from the Phase 4 closeout:
mvn -pl services/secondary-storage/server -Dtest=NfsPostUploadRequestValidationServiceTest,NfsSecondaryStorageResourceTest,NfsPostUploadServiceTest -Dsurefire.failIfNoSpecifiedTests=false test- 21 tests, 0 failures.mvn -pl server -Dtest=UserVmManagerImplTest,VmAssignmentValidatorImplTest,VmAssignmentNetworkServiceImplTest,VmAssignmentOwnershipServiceImplTest -Dsurefire.failIfNoSpecifiedTests=false test- 180 tests, 0 failures.permissions: contents: readto.github/workflows/web.yml.Before final upstream-facing merge/release, rerun the broader server/reactor and UI checks because this PR is intentionally a long-running modernization diff.
Docs
docs/AUDIT.mddocs/OBSERVABILITY.mddocs/DEVELOPMENT.mddocs/REFACTORING.mddocs/DEPLOYMENT.mddocs/PROGRESS.mdRemaining Follow-Up