Skip to content

Commit b8cf165

Browse files
allissonallisson
authored
release: v0.28.0 and configurable tokenization batch limit (#121)
This commit prepares the v0.28.0 release and adds a configurable limit for batch tokenization operations. - Update version to v0.28.0 and update CHANGELOG.md with release notes. - Add TOKENIZATION_BATCH_LIMIT configuration (default: 100). - Enforce batch limit in TokenizationHandler for tokenize/detokenize. - Update docs/openapi.yaml with v0.28.0 changes and new parameters. - Archive related conductor tracks (batch_limit_config and release_v0.28.0). V0.28.0 Key Changes: - Batch tokenization limit configuration. - Individual transit/tokenization key retrieval APIs. - Atomic batch tokenize/detokenize endpoints. - Audit log filtering by client_id. - Configurable Metrics Server timeouts and DB connection settings. - Client secret rotation with token revocation. - Strict capability validation and key deletion by name. - Rate limiter resource leak fix.
1 parent 2d6b9c1 commit b8cf165

24 files changed

Lines changed: 329 additions & 21 deletions

‎.env.example‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,10 @@ LOCKOUT_DURATION_MINUTES=30
6666
# Maximum size allowed for a secret value in bytes (default: 524288 = 512 KB)
6767
SECRET_VALUE_SIZE_LIMIT_BYTES=524288
6868

69+
# Tokenization batch limit
70+
# Maximum number of items in a batch tokenization request (default: 100)
71+
TOKENIZATION_BATCH_LIMIT=100
72+
6973

7074
# CORS configuration
7175
# ⚠️ SECURITY WARNING: CORS is disabled by default for server-to-server API

‎CHANGELOG.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
55
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
66
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
77

8+
## [0.28.0] - 2026-03-23
9+
10+
### Added
11+
- Added configurable batch limit for tokenize and detokenize operations via `BATCH_LIMIT_TOKENIZATION` environment variable.
12+
- Added individual transit key retrieval API (`GET /v1/transit/keys/{name}`) (#115).
13+
- Added atomic batch tokenize and detokenize endpoints (`POST /v1/tokenization/tokenize/batch`, `POST /v1/tokenization/detokenize/batch`) (#119).
14+
- Added individual tokenization key retrieval API by name (`GET /v1/tokenization/keys/{name}`) (#116).
15+
- Added audit log filtering by `client_id` for `GET /v1/audit/logs` (#118).
16+
- Added configurable Metrics Server timeouts (`METRICS_SERVER_READ_TIMEOUT`, `METRICS_SERVER_WRITE_TIMEOUT`, `METRICS_SERVER_IDLE_TIMEOUT`) (#114).
17+
- Added database connection max idle time configuration (`DB_CONN_MAX_IDLE_TIME`) (#113).
18+
- Added client secret rotation with automatic token revocation.
19+
- Added strict capability validation for policies (#111).
20+
21+
### Changed
22+
- Updated Transit Engine to support key deletion by name instead of UUID (#120).
23+
- Updated Tokenization Engine to support key deletion by name (#117).
24+
25+
### Fixed
26+
- Fixed rate limiter goroutine lifecycle and resource leaks (#112).
27+
828
## [0.27.0] - 2026-03-06
929

1030
### Added
@@ -441,6 +461,7 @@ If you are using `sslmode=disable` (PostgreSQL) or `tls=false` (MySQL) in produc
441461
- Security model documentation
442462
- Architecture documentation
443463

464+
[0.28.0]: https://github.com/allisson/secrets/compare/v0.27.0...v0.28.0
444465
[0.27.0]: https://github.com/allisson/secrets/compare/v0.26.0...v0.27.0
445466
[0.26.0]: https://github.com/allisson/secrets/compare/v0.25.0...v0.26.0
446467
[0.25.0]: https://github.com/allisson/secrets/compare/v0.24.0...v0.25.0

‎cmd/app/main.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import (
1212

1313
// Build-time version information (injected via ldflags during build).
1414
var (
15-
version = "v0.27.0" // Semantic version with "v" prefix (e.g., "v0.12.0")
15+
version = "v0.28.0" // Semantic version with "v" prefix (e.g., "v0.12.0")
1616
buildDate = "unknown" // ISO 8601 build timestamp
1717
commitSHA = "unknown" // Git commit SHA
1818
)

‎conductor/archive/batch_limit_config_20260321/index.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Track batch_limit_config_20260321 Context
2+
3+
- [Specification](./spec.md)
4+
- [Implementation Plan](./plan.md)
5+
- [Metadata](./metadata.json)

‎conductor/archive/batch_limit_config_20260321/metadata.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"track_id": "batch_limit_config_20260321",
3+
"type": "chore",
4+
"status": "new",
5+
"created_at": "2026-03-21T10:00:00Z",
6+
"updated_at": "2026-03-21T10:00:00Z",
7+
"description": "The TokenizeBatchRequest.Validate method uses a hardcoded value for the batch limit; this value must come from the global configuration."
8+
}

‎conductor/archive/batch_limit_config_20260321/plan.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Implementation Plan: Configurable Batch Limit for TokenizeBatchRequest
2+
3+
## Phase 1: Configuration [checkpoint: e43e7cc]
4+
- [x] Task: Add TokenizationBatchLimit to Config struct and DefaultTokenizationBatchLimit constant in internal/config/config.go.
5+
- [x] Task: Update `config.Load()` to load `TOKENIZATION_BATCH_LIMIT` from environment variables in `internal/config/config.go`.
6+
- [x] Task: Update `config.Validate()` to include validation for `TokenizationBatchLimit` in `internal/config/config.go`.
7+
- [x] Task: Update `.env.example` to include `TOKENIZATION_BATCH_LIMIT=100`.
8+
- [x] Task: Conductor - User Manual Verification 'Configuration' (Protocol in workflow.md) e43e7cc
9+
10+
## Phase 2: DTO Updates [checkpoint: 86d62c6]
11+
- [x] Task: Update `TokenizeBatchRequest.Validate` and `DetokenizeBatchRequest.Validate` in `internal/tokenization/http/dto/request.go` to accept `limit int`.
12+
- [x] Task: Update validation rules to use `validation.Length(1, limit).Error(fmt.Sprintf("batch size exceeds limit of %d", limit))`.
13+
- [x] Task: Update all tests calling these `Validate()` methods in `internal/tokenization/http/dto/request_test.go`.
14+
- [x] Task: Conductor - User Manual Verification 'DTO Updates' (Protocol in workflow.md) 86d62c6
15+
16+
## Phase 3: Handler and DI Updates [checkpoint: 86d62c6]
17+
- [x] Task: Update `TokenizationHandler` struct in `internal/tokenization/http/tokenization_handler.go` to include `batchLimit int`.
18+
- [x] Task: Update `NewTokenizationHandler` in `internal/tokenization/http/tokenization_handler.go` to accept `batchLimit int`.
19+
- [x] Task: Update `TokenizeBatchHandler` and `DetokenizeBatchHandler` in `internal/tokenization/http/tokenization_handler.go` to call `Validate(h.batchLimit)`.
20+
- [x] Task: Update `initTokenizationHandler` in `internal/app/di_tokenization.go` to pass `c.config.TokenizationBatchLimit` to `NewTokenizationHandler`.
21+
- [x] Task: Update `TokenizationHandler` tests in `internal/tokenization/http/tokenization_handler_test.go` to pass the batch limit to `NewTokenizationHandler`.
22+
- [x] Task: Conductor - User Manual Verification 'Handler and DI Updates' (Protocol in workflow.md) 86d62c6
23+
24+
## Phase 4: Documentation
25+
- [x] Task: Update `docs/configuration.md` with `TOKENIZATION_BATCH_LIMIT`.
26+
- [x] Task: Update `docs/engines/tokenization.md` with information about the batch limit.
27+
- [x] Task: Conductor - User Manual Verification 'Documentation' (Protocol in workflow.md)

‎conductor/archive/batch_limit_config_20260321/spec.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Specification: Configurable Batch Limit for TokenizeBatchRequest
2+
3+
## Overview
4+
The `TokenizeBatchRequest.Validate` method currently uses a hardcoded value of 100 for the batch limit. This track aims to make this limit configurable via the global configuration using the `TOKENIZATION_BATCH_LIMIT` key, defaulting to 100 if not specified.
5+
6+
## Functional Requirements
7+
- **Configuration Integration**: Add `TOKENIZATION_BATCH_LIMIT` to the global configuration structure and support its initialization from environment variables.
8+
- **Dynamic Validation**: Update the `TokenizeBatchRequest.Validate` method to use the configured batch limit instead of the hardcoded value.
9+
- **Error Message Update**: Ensure the error message returned when the limit is exceeded is `batch size exceeds limit of %d`, where `%d` is the current limit.
10+
- **Update Documentation**: Update relevant documentation (e.g., `docs/configuration.md`, `docs/engines/tokenization.md`) to reflect the new configuration option.
11+
- **Update `.env.example`**: Add `TOKENIZATION_BATCH_LIMIT` with the default value of 100 to the `.env.example` file.
12+
13+
## Acceptance Criteria
14+
- [ ] `TOKENIZATION_BATCH_LIMIT` is successfully added to the configuration and can be set via an environment variable.
15+
- [ ] The `TokenizeBatchRequest.Validate` method correctly uses the value from the configuration.
16+
- [ ] If `TOKENIZATION_BATCH_LIMIT` is not set, the system defaults to a limit of 100.
17+
- [ ] When a batch exceeds the limit, the error message correctly includes the configured limit value.
18+
- [ ] Documentation (`docs/configuration.md`, `docs/engines/tokenization.md`) is updated.
19+
- [ ] `.env.example` is updated.
20+
21+
## Out of Scope
22+
- Modifying the core tokenization or batch processing logic.
23+
- Adding limits to other batch operations beyond `TokenizeBatchRequest`.

‎conductor/archive/release_v0.28.0_20260323/index.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Track release_v0.28.0_20260323 Context
2+
3+
- [Specification](./spec.md)
4+
- [Implementation Plan](./plan.md)
5+
- [Metadata](./metadata.json)

‎conductor/archive/release_v0.28.0_20260323/metadata.json‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
{
2+
"track_id": "release_v0.28.0_20260323",
3+
"type": "chore",
4+
"status": "new",
5+
"created_at": "2026-03-23T12:00:00Z",
6+
"updated_at": "2026-03-23T12:00:00Z",
7+
"description": "Prepare to the next version v0.28.0"
8+
}

‎conductor/archive/release_v0.28.0_20260323/plan.md‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
# Implementation Plan: v0.28.0 Release Preparation
2+
3+
## Phase 1: Version Update & Changelog [checkpoint: 1052e1b]
4+
- [x] Task: Update `version` to `v0.28.0` in `cmd/app/main.go` 165ae80
5+
- [x] Task: Add v0.28.0 entry to `CHANGELOG.md` with all key changes: 61fdeda
6+
- **New Feature:** Configurable batch limit for tokenize and detokenize operations.
7+
- **Transit Engine:** Key deletion by name instead of UUID (#120).
8+
- **Transit Engine:** Individual key retrieval API (#115).
9+
- **Tokenization Engine:** Atomic batch tokenize and detokenize endpoints (#119).
10+
- **Tokenization Engine:** Delete tokenization keys by name (#117).
11+
- **Tokenization Engine:** Individual key retrieval API by name (#116).
12+
- **Audit Logs:** Implement audit log filtering by `client_id` (#118).
13+
- **Configuration:** Make Metrics Server timeouts configurable (#114).
14+
- **Database:** Expose DB connection max idle time configuration (#113).
15+
- **Auth:** Client secret rotation with automatic token revocation.
16+
- **Auth:** Fix rate limiter goroutine lifecycle and resource leaks (#112).
17+
- **Auth:** Implement strict capability validation for policies (#111).
18+
- [x] Task: Conductor - User Manual Verification 'Phase 1: Version Update & Changelog' (Protocol in workflow.md) 1052e1b
19+
20+
## Phase 2: Documentation & OpenAPI Sync [checkpoint: a01f409]
21+
- [x] Task: Run `make docs-lint` and address any issues.
22+
- [x] Task: Audit `docs/openapi.yaml` and update it with new endpoints: cce88e6
23+
- `/api/v1/tokenization/tokenize/batch` (POST)
24+
- `/api/v1/tokenization/detokenize/batch` (POST)
25+
- `/api/v1/tokenization/keys/{name}` (GET)
26+
- `/api/v1/transit/keys/{name}` (GET)
27+
- Verify audit log filtering params for `/api/v1/audit/logs`.
28+
- [x] Task: Conductor - User Manual Verification 'Phase 2: Documentation & OpenAPI Sync' (Protocol in workflow.md) a01f409
29+
30+
## Phase 3: Final Verification [checkpoint: ec975f9]
31+
- [x] Task: Run full test suite using `make test-all`. 60b5e6f
32+
- [x] Task: Perform a final sanity check of the CHANGELOG and CLI version output. 60b5e6f
33+
- [x] Task: Conductor - User Manual Verification 'Phase 3: Final Verification' (Protocol in workflow.md) ec975f9

0 commit comments

Comments
 (0)