Aleksandr BogomiakovandClaude
4764f3545f
Workspaces, group mappings and sign-in methods now come from a configuration file synchronized at startup; workspaces dropped from it are disabled, never deleted. Instance administrators (a new role) see and help every workspace and may delete disabled ones; workspace administrators and employees are derived from the user's groups at every SSO sign-in or administrator edit, and the employee permission set belongs to the workspace. Self-registration is gone: users come from SSO (only when their groups map) or from the administrator. Break-glass bootstrap accounts get an HMAC-derived hourly password that all replicas agree on. First SSO sign-in links a matching email contact to the user. The demo runs on the same model with a generated per-start password. Co-Authored-By: Claude <noreply@anthropic.com>
45 lines
4.0 KiB
Markdown
45 lines
4.0 KiB
Markdown
# Meguri
|
|
|
|
A shared source of truth for on-call rotations, replacements, escalation policies, and routing. Rust + Cot 0.7 (HTTP, ORM, migrations), PostgreSQL, and locally vendored Alpine.js. The interface is English. Providers receive calculated intervals and execute notifications/escalation timers.
|
|
|
|
## Start locally
|
|
|
|
On Windows with the PostgreSQL server binaries installed:
|
|
|
|
```powershell
|
|
./scripts/dev.ps1
|
|
```
|
|
|
|
Open http://127.0.0.1:3000. The script starts disposable demo mode: accounts `admin` (instance administrator), `alice` (administrator of the demo workspaces) and `bob`, `carol`, `dave`, `erin` (employees) share one password that is generated on every start and shown on the login screen and in `target/local/app.log`. Stop with `./scripts/stop-dev.ps1`. Pass `-PostgresBin PATH` if PostgreSQL is elsewhere. Local data and logs live in ignored `target/local/`.
|
|
|
|
On other platforms, create a PostgreSQL database, set the environment variables in `.env.example`, then run `cargo run --locked`. Use `postgresql://` URLs. `MEGURI_SEED_DEMO=true` starts the disposable demo and works only on loopback. Any other run needs an instance configuration file (`MEGURI_CONFIG_FILE`, see [`deploy/instance-config.example.yaml`](deploy/instance-config.example.yaml)); without it startup fails. Environment files are not automatically loaded.
|
|
|
|
## Implemented
|
|
|
|
- Independent workspaces declared in an instance configuration file, OpenID Connect sign-in with group-to-role mapping (instance administrator, workspace administrator, employee), optional password and bootstrap accounts, and durable audit/history.
|
|
- Calendar-day rotations with IANA timezones, ordered participants, anchors, absence fallback, holidays, and escalation backup schedules.
|
|
- Replacements and atomic reciprocal swaps; confirmation by the other employee or forced application with a reason.
|
|
- Durable publication, optimistic revisions, worker leases, retries, checkpoints, external drift protection, and a downloadable preview.
|
|
- Mock provider and a JSM Operations API adapter for schedules, escalations, and routing.
|
|
|
|
## Working through agents
|
|
|
|
Start with [AGENTS.md](AGENTS.md). Describe intended behavior and examples to the agent; it must update the specification, implementation, and relevant tests together. [Product](docs/product.md), [architecture](docs/architecture.md), [test strategy](docs/testing.md), [development](docs/development.md), and [deployment](docs/deployment.md) are maintained project inputs.
|
|
|
|
```text
|
|
cargo fmt --check
|
|
cargo clippy --all-targets -- -D warnings
|
|
cargo test
|
|
cargo test --locked --tests -- --ignored --test-threads=1
|
|
```
|
|
|
|
The ignored suites require `MEGURI_TEST_DATABASE_URL` for a disposable PostgreSQL database whose user may create databases. CI runs them explicitly; ordinary unit tests need no database or external account. Browser checks (`npm run test:browser`) run against a freshly started demo.
|
|
|
|
## Current boundaries
|
|
|
|
Sign-in is OpenID Connect (code flow with PKCE) and was tested against a fake provider only; verify your Keycloak client and group mapper as described in [deployment](docs/deployment.md#single-sign-on-with-keycloak) before relying on it. There is no self-registration and no in-app workspace creation. JSM has local HTTP contract coverage and still needs acceptance testing against a dedicated JSM test team and your subscription. GKE manifests are deployment templates, not an already deployed environment. No alert ingestion or notification engine is included.
|
|
|
|
The ignored `opsgenie-master/` directory is local reference material. Its behavioral examples are captured in the product contract and tests; application and CI do not depend on it.
|
|
|
|
Demo mode is disposable: `MEGURI_SEED_DEMO=true` resets only positively marked demo data on restart and expires temporary resources while running. Unmarked/normal databases are protected and trigger an isolated demo database with a permanent warning. See [demo lifecycle and retention settings](docs/development.md#demo-lifecycle). Alice administers four generated examples; Bob demonstrates Engineering on-call, Carol daily Support shifts.
|