docs/external-secrets #19

Merged

mhahl merged 27 commits from docs/external-secrets into main 2026-08-23 02:55:29 +00:00

Conversation 0 Commits 27 Files changed 145 +2275 -785

mhahl commented 2026-08-23 01:27:35 +00:00

Owner

Copy link

No description provided.

mhahl added 24 commits 2026-08-23 01:27:35 +00:00

UX consistency pass: enterprise polish ... aaa9eee299

- Flash messages now reach HTMX partial swaps via OOB #flashes fragment
- LDAP/OIDC test-connection actions with inline results (lockout guard)
- secret_view: rail subnav, auto-hide parity for revealed plaintext
- One sub-nav pattern (page-side rail) across project/team/secret/settings/audit/rbac pages
- --success is distinct green; kind badges neutral secondary; status colors reserved for state
- Destructive idiom codified; dead CSS removed (~18 selectors)
- HTMX form dim rule, machines search focus fix, audit roles pagination + Grants export rename
- Nav registry in ui/nav.py (single source, fixes aria-current-in-class bug)
- Register confirm-password + validation; error page escape link; TOTP copy-all
- Datetime convention sweep, action-column headers, field-hint/field-grid sweeps
- Unsaved-changes guard, emoji→SVG icons, dark-mode fixes, keyboard-safe filter selects

Copy pass: plain-language rewrites (stop-slop) ... 57cd50b092

App:
- Em dashes removed from all user-visible strings; causes stated instead
  of generic retry prompts where the outcome is deterministic
- Email subjects/bodies rewritten in mailer.py (reset, sign-in alert, test)
- Machine/PAT/invite token messages: 'shows only this once'
- Small hint fixes (settings_admins/email, project_settings/import)

Docs (all md files):
- Prose em dashes restructured; link captions and status lines use colons
- Bold-term definition lists normalized to '**Term**: definition'
- Passive/filler fixes ('not just the app', 'will be re-encrypted', 'just')
- Table empty-cell markers and UI literal '— none —' kept

Humanizer pass: punctuation and heading consistency ... 1435c2d577

- Hyphen-as-dash removed from UI copy (12 strings): hints, buttons,
  option labels, page descriptions now use periods, commas, colons,
  or the app's existing middot separator
- Doc H1s to sentence case, matching H2/H3 convention (acronyms kept)
- Scanned and cleared: AI verb phrases (serves as/boasts/showcases),
  filler (in order to/it is important to note), fake alternatives,
  dramatic fragments, generic endings, previous-version narration
- Curly quotes around dynamic values kept (consistent UI convention)

feat(auth): email verification for local signups ... b941361b8c

- Migration 0003: verification columns on private.users; LDAP/OIDC
  provisioning stamps verified (directory proves the mailbox)
- Register with SMTP configured: account starts unverified, single-use
  link emailed (SHA-256 hashed, 3-day window); SMTP send failure fails
  open so broken mail config never locks accounts out
- Login gate: unverified local accounts get 403 + verify prompt;
  lockout failures cleared since password was proven
- /verify-email/<token> confirms and clears token; /verify-email/resend
  is generic (no enumeration) with a 60s per-address throttle
- Resend form on sign-in page; docs subsection in authentication.md
- 9 new tests (failing-first verified), mocks updated for new gate query

459 passed, 8 skipped; ruff + mypy clean

fix(auth): login 500 on email-verification gate ... c69d6a4dd8

Authenticator cannot SELECT private.users. Return email_verified_at from
verify_user, use the admin connection for token/verify writes, and stamp
existing accounts verified so the gate does not lock them out.

feat(auth): move email-verification resend to a post-signup step ... 1696191147

Registration now ends on a check-inbox screen with the resend form instead of bouncing to login; GET /verify-email serves the same screen standalone.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

ui(auth): swap login-page resend form for a link to /verify-email ... 6ab2f1654d

Declutter the sign-in screen: drop the inline details form, keep one muted link shown only when SMTP is configured.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

docs: update email-verification flow description ... f3cd0ed5f0

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

feat(auth): show verify page on unverified sign-in; drop standalone resend route ... 75a6ed97bc

Signing in with an unverified account now returns a verify-your-email page (403) with the address and a plain resend button; registration redirects back to sign-in with a check-your-inbox flash.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

ui(auth): remove login-page resend link and smtp context flag ... 673780e934

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

docs: update email-verification flow description ... e55b67c691

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

fix(copy): sharpen auth flashes and transactional emails ... 6821025fc1

Vague failures name what failed (account creation, token creation, password reset, 2FA setup); emails use a formal register with explicit expiry wording.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

fix(copy): standardize permission-denied flashes in teams and RBAC ... 76eca0d157

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

fix(copy): tighten secrets flash copy ... 1d80d4e625

Removes em dashes and arrows from user-facing messages; states the advanced-form requirement plainly.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

fix(copy): clarify audit retention message ... 6c139ed418

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

ui: polish template wording across profile, settings, and secrets ... 0c9ee89670

Completes clipped fragments and fixes grammar in settings, profile, and secret-page helper text.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

ui: drop compliance claim from classification banner description ... 01b4964369

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

docs: External Secrets pull and push setup guide ... 6778bbb051

Add a copy-paste guide for the ESO webhook provider covering pull
(ExternalSecret + GET) and push (PushSecret + PUT), plus sample YAML.

docs: generic Kubernetes ESO guide; drop k8s-rbac wording ... 2f42b10a81

Use kubectl and Kubernetes throughout. Rename pull sample to eso-pull.yaml.
Talk about RBAC as roles and bindings, not Kubernetes-style RBAC.

db: add bcrypt-in-SQL helpers for existing volumes ... c40c13098e

Clusters bootstrapped from an older 0001 still have app-side PBKDF2
verify_user(text). Recreate register/change/set-password with crypt()
and drop the one-arg verify_user leftover so later grants are unique.

docs(changelog): document ux-polish-2, code-refactor, ox-review changes 7e7fd4773f

Merge branch 'SIG-001' into docs/external-secrets 0ca1e9eb02

docs(deploy): overlay how-to and secretserver-syd example ... 70bf8a2099

Document what to copy and change when deploying with kustomize. Add the
small-cluster overlay as a worked example (no Secret values in git).

chore(release): cut 2026-08-23.1 ... f66746b5e1

- Switch to calendar versioning (YYYY.M.D.build in pyproject; tags use dashes)
- Cut changelog Unreleased to 2026-08-23.1; document email verification,
  ESO guides, deploy overlays, migration 0005, copy fixes
- Fix remaining pylint nits (10.00/10)
- Reconcile upgrade story: existing DBs get NNNN_ migrations at startup,
  no recreate needed (AGENTS.md, deploy/backup/contributing docs)

mhahl-a added 1 commit 2026-08-23 02:25:33 +00:00

feat: rebrand to Corvus; add MkDocs documentation site ... adafd1f6af

Rebrand:
- Product name, UI branding, package name -> corvus
- Compose project/DB/image, K8s namespace/resources, overlay dir corvus-syd
- Redis cache prefixes, HSM token label default, scripts, CLI examples
- Repo URLs re-pointed to Sigaint/corvus (forge + GitHub mirror)
- Fresh install recommended for existing local volumes (pre-release)

Docs site:
- mkdocs.yml (Material theme), docs/index.md landing page
- New admin/upgrades.md workflow page; deploy.md links to it
- New dev/docs-site.md contributor guide; nav covers byok + rbac-internals
- pyproject 'docs' extra (pinned mkdocs-material); gitignore site/

mhahl-a added 1 commit 2026-08-23 02:43:33 +00:00

Create logo.svg f50c38938d

mhahl-a added 1 commit 2026-08-23 02:54:18 +00:00

ui: add raven mark to sidebar and login ... 49f94a4400

Mask static/logo.svg so the sidebar stays cream on the dark rail and the
login card follows light-dark (#0c0c0b / #f4f1ea).

mhahl merged commit a4cdfe96f7 into main 2026-08-23 02:55:29 +00:00

mhahl referenced this pull request from a commit 2026-08-23 02:55:29 +00:00

docs/external-secrets (#19)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

Sigaint/corvus!19

No description provided.