From e294515c19416703bf47837ed187be4adb644d62 Mon Sep 17 00:00:00 2001 From: Hermes Worker Date: Sat, 22 Aug 2026 20:47:29 +0000 Subject: [PATCH] fix(bedrock): interim default gen-0/warn until v2 producer ships (t_87f2966f) --- core/src/main/resources/config.yml | 10 ++++++++-- core/src/main/resources/proxy-config.yml | 4 ++-- .../bedrock/BedrockPrincipalGenerationConfigTest.java | 11 ++++++++--- 3 files changed, 18 insertions(+), 7 deletions(-) diff --git a/core/src/main/resources/config.yml b/core/src/main/resources/config.yml index c604d1755..a9b498173 100644 --- a/core/src/main/resources/config.yml +++ b/core/src/main/resources/config.yml @@ -47,9 +47,15 @@ bedrock-identity: # Signed Bedrock principal v2 is additive to the legacy identity path above. New generated # configurations require it; files created before this section existed remain generation 0, # preserve their legacy behavior, and never advertise v2 until explicitly upgraded. +# +# INTERIM DEFAULT (Track B, see minekube/moxy kanban t_87f2966f): generation 0 + mode warn +# keeps fresh installs on the working v1 identity path. The previous shipped default +# (generation 2 + mode require) rejects EVERY Bedrock join with READINESS until the v2 +# producer (metadata endpoint + signed per-session envelopes) ships. Once the producer is +# live, this default can return to generation 2 + require. bedrock-principal: - config-generation: 2 - mode: require + config-generation: 0 + mode: warn issuer: minekube-connect trust-domain: urn:minekube:connect:production audience: urn:minekube:connect:bedrock-principal:v2 diff --git a/core/src/main/resources/proxy-config.yml b/core/src/main/resources/proxy-config.yml index ef219e0b9..6021c2b0e 100644 --- a/core/src/main/resources/proxy-config.yml +++ b/core/src/main/resources/proxy-config.yml @@ -81,8 +81,8 @@ bedrock-identity: # configurations require it; files created before this section existed remain generation 0, # preserve their legacy behavior, and never advertise v2 until explicitly upgraded. bedrock-principal: - config-generation: 2 - mode: require + config-generation: 0 + mode: warn issuer: minekube-connect trust-domain: urn:minekube:connect:production audience: urn:minekube:connect:bedrock-principal:v2 diff --git a/core/src/test/java/com/minekube/connect/bedrock/BedrockPrincipalGenerationConfigTest.java b/core/src/test/java/com/minekube/connect/bedrock/BedrockPrincipalGenerationConfigTest.java index bcc086a63..9bfa14cb3 100644 --- a/core/src/test/java/com/minekube/connect/bedrock/BedrockPrincipalGenerationConfigTest.java +++ b/core/src/test/java/com/minekube/connect/bedrock/BedrockPrincipalGenerationConfigTest.java @@ -19,16 +19,21 @@ class BedrockPrincipalGenerationConfigTest { @TempDir Path tempDir; @Test - void newlyGeneratedServerAndProxyConfigsDefaultV2ToRequire() throws Exception { + void newlyGeneratedServerAndProxyConfigsDefaultToV2WarnUntilProducerShips() throws Exception { ConnectConfig server = load(ConnectConfig.class, tempDir.resolve("server")); ProxyConnectConfig proxy = load(ProxyConnectConfig.class, tempDir.resolve("proxy")); for (ConnectConfig config : new ConnectConfig[] {server, proxy}) { - assertEquals(2, config.getBedrockPrincipal().getConfigGeneration()); - assertEquals("require", config.getBedrockPrincipal().getMode()); + // Interim default (Track B): generation 0 + warn keeps fresh installs on the + // working v1 identity path until the v2 producer (metadata + signed envelopes) + // ships. Generation 2 + require rejects every Bedrock join with READINESS when + // the producer is absent (see moxy kanban t_87f2966f). + assertEquals(0, config.getBedrockPrincipal().getConfigGeneration()); + assertEquals("warn", config.getBedrockPrincipal().getMode()); assertEquals("minekube-connect", config.getBedrockPrincipal().getIssuer()); assertEquals("urn:minekube:connect:production", config.getBedrockPrincipal().getTrustDomain()); assertEquals("urn:minekube:connect:bedrock-principal:v2", config.getBedrockPrincipal().getAudience()); + assertFalse(BedrockPrincipalConfiguration.from(config.getBedrockPrincipal()).isCapable()); } }