Developn 1 - #341
Merged
Merged
Conversation
…document columns product_class and customer_type
Store new headers X-System-Product-Class and X-System-Type into root_…
…en POST new payload and state changed from 4 to 2
fix a bug that error_code and error_details columns were not reset wh…
handle failed sqlite related tests during root_document schema change
add bitmap definitions for hotspotwantolan and ignitewifi
Add missing code for customer_type and product_class support
rename column name from customer_type to account_type
update dependencies based code scan advice
add bitmap definitions for hotspotwantolan and ignitewifi
feat: add service.version to OTel resource attributes
Add SHA info to version
Cherrypick of version update for metrics
Cherrypick kafka stability
replace the tls layer in config key path with flat key names
- Make disable_initial_host_lookup configurable via config key; replace hardcoded constant with dbconf.GetBoolean - Add exponential reconnection policy with configurable initial interval, max retries (default 10), and max interval - Add socket keepalive support via configurable socket_keepalive_sec - Upgrade host selection to TokenAwareHostPolicy wrapping DCAwareRoundRobinPolicy when local_dc is set - Fix TLS host verification: derive EnableHostVerification from insecure_skip_verify instead of hardcoding false - Read insecure_skip_verify once and pass to loadCassandraTLSConfig to eliminate duplicate config reads - Add tls.server_name support for SNI override - Raise default timeouts from 1s to 10s; align sample config - Document all new config keys in sample_webconfig.conf for both cassandra and yugabyte blocks
Improve Cassandra connection resilience and configurability
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull request overview
This PR hardens security defaults and improves runtime resilience/observability across Webconfig, with a focus on safer logging, stricter auth defaults, more robust Kafka behavior during broker restarts/shutdown, and improved tracing/resource metadata.
Changes:
- Strengthen security posture: enable API token auth by default, improve TLS configuration, cap request body size, and redact sensitive log fields / WiFi passphrases.
- Improve Kafka operational resilience: tune Sarama retry/timeouts, enforce message key ↔ device identity binding, and make shutdown ordering safer around consumer loops and the async producer.
- Improve observability and correctness: add OTel
service.versionattribute, add AES decrypt integrity checking, expand bitmap/subdoc coverage tests, and update Go dependencies.
Reviewed changes
Copilot reviewed 20 out of 22 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| util/dict_test.go | Updates HeaderToMap unit test inputs/expectations. |
| tracing/tracer.go | Adjusts app version/name derivation and adds BinaryVersion fallback. |
| tracing/otel.go | Centralizes OTel resource attributes and adds service.version. |
| security/aes_codec.go | Adds constant-time integrity check on decrypt; minor loop/comment updates. |
| Makefile | Forces serial go test execution (-p=1) to reduce cross-package fixture contention. |
| main.go | Reworks Kafka consumer loop resilience and orderly shutdown sequencing. |
| kafka/kafka_consumer_group.go | Adds configurable Sarama consumer-group resilience tuning (retry/backoff/timeouts). |
| kafka/consumer.go | Validates broker message key matches device identity to prevent spoofing. |
| http/webpa_connector.go | Copies/sanitizes log fields before async retry goroutine. |
| http/webconfig_server.go | Secure defaults + TLS CA support, request body size limiting, safer producer result handling, and log-field filtering/redaction hooks. |
| http/webconfig_server_test.go | Adds regression test asserting secure auth defaults. |
| http/factory_reset_upstream_test.go | Enables factory reset in tests to match new/default behavior expectations. |
| go.sum | Updates dependency checksums after module bumps. |
| go.mod | Bumps several indirect dependencies (x/* and grpc). |
| db/sqlite/sqlite_client.go | Allows sqlite test DB file override via env var. |
| db/cassandra/cassandra_client.go | Adds configurable timeouts/reconnect policy, TLS options, and host selection tuning. |
| config/sample_webconfig.conf | Documents/updates new config keys and secure defaults. |
| common/wifi.go | Stops leaking partial passphrases; always masks. |
| common/log_fields.go | Adds sensitive-key detection and recursive redaction in FilterLogFields. |
| common/firmware_bitmap_test.go | Adds tests for new subdoc bitmap mappings. |
| common/bitmap.go | Adds bitmap mappings for hotspotwantolan and ignitewifi. |
| .gitignore | Ignores additional agent-related files/directories. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.