…pt property names, runbook) (#951) * fix(#754): correct target property names in role-collection scripts Both scripts read target.subaccount / target.globalAccount, but scripts/lib/btp-cli.js getCurrentTarget() returns subaccountSubdomain / subaccountId / globalAccountSubdomain. The mismatch prevented the sanity guard from passing and blocked the rename-cutover inventory. Fix: read target.subaccountSubdomain and target.globalAccountSubdomain consistently in both scripts. Discovered while running the rename cutover per docs/developers/ operations/mta-deployment.md, Rename cutover section, Step 1 (pre-flight inventory). Refs #635, #754. * fix(#754): update deploy/*.mtaext ID + extends to tutorials-ims The rename PR (#754) flipped mta.yaml ID from tutorials-poc to tutorials-ims but left deploy/*.mtaext files pointing at the old MTA ID via 'extends: tutorials-poc'. MTA extension files are matched against the base MTA ID at deploy time; when the ID no longer matches, the entire extension is silently ignored -- overrides never apply. The DEV cutover deploy on 2026-07-03 caught this the hard way: - tutorials-srv lost $CONTENT_API_KEY, $GITHUB_DISPATCH_TOKEN, KNOWLEDGE_GRAPH_ENABLED=true, EXPOSE_CAP_UI=true (all live in dev.mtaext overrides) - tutorials-approuter app-name override (tutorials-dev-approuter) did not apply -- MTA created a new 'tutorials-approuter' app alongside the existing tutorials-dev-approuter, and both got bound to the same public route Fix: update ID and extends: to tutorials-ims in dev/qa/prod mtaext files. QA and prod mtaext are also fixed so future deploys pick up correctly. deploy/dev.resolved.mtaext is regenerated at deploy time by envsubst so it doesn't need a manual edit. Refs #635, #754. * fix(#635): change xsappname from tutorials-ims to tutorials The XSUAA broker refuses in-place xsappname changes ('Cannot change AppId with update'). Attempted the delete + recreate path per the Rename cutover runbook, but discovered that even a fresh xsuaa service instance cannot claim tutorials-ims!t<n> -- that AppId is already minted on the tenant XSUAA server (ghost from an earlier deploy attempt during the rename PR merge window). Sidestep: use 'tutorials' as the xsappname. Not previously registered on the tenant, so the broker will let a fresh xsuaa claim it. Ships along with the mtaext ID fix (deploy/*.mtaext extends: tutorials-ims is unaffected -- the mtaext ID matches mta.yaml ID; only the xsappname value inside xs-security.json changes). Impact: - Scope literals in JWTs change from tutorials-poc!t<n>.* to tutorials!t<n>.* - Every issued token in the wild becomes invalid on cutover. - Role-collection user assignments will be restored from .migration-data/role-collections-pre-rename.json via migrate-role-collections.cjs --restore --commit after redeploy. Not touching mta.yaml ID (still tutorials-ims) because that only affects MTA registration metadata, not XSUAA scope namespace. Refs #635, #754, #809. * docs(#754): document DEV cutover lessons in rename runbook Adds a 'Post-cutover lessons' section to the Rename cutover runbook capturing four failure modes discovered while running the DEV cutover on 2026-07-03: 1. deploy/*.mtaext extends: must match the new MTA ID: 2. XSUAA broker refuses in-place xsappname renames (Cannot change AppId); pre-create xsuaa manually outside MTA 3. MTA UploadAppStep fails 500 when app has stale build state; cf delete <app> then MTA recreates fresh 4. Ghost xsappname on the tenant server: pick a different one Companion fixes in the same PR: - fix(#754): correct target property names in role-collection scripts - fix(#754): update deploy/*.mtaext extends: to tutorials-ims - fix(#635): change xsappname from tutorials-ims to tutorials Refs #635, #754, #809. --------- Co-authored-by: Thomas Jung <12159356+jung-thomas@users.noreply.github.com>

Legacy has more authorization checks (the per-controller @PreAuthorize style is verbose-by-default) and more role-matrix unit tests #809

Description

Activity

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions