Skip to content
ironflow

Ironflow v0.26.0

Ironflow v0.26.0 closes two environment-isolation gaps that let one environment see another’s events, extends RBAC enforcement to dashboard sessions, and reworks inbound webhooks so they verify signatures from real providers instead of one. The Events tab was rebuilt for high volume, and the Flow Map now shows inbound webhooks as first-class nodes.

Breaking Changes

Section titled “Breaking Changes”
  • Pub/sub wire subjects and JetStream durables are now keyed by environment ID. The layout moves from public.<projectName>.<envName>.<namespace>.<body> to public.<environmentID>.<namespace>.<body>. Both old segments were names stripped from an ID, so env_acme_staging and env_beta_staging both collapsed to staging and published to the same subject — a subscriber scoped to either environment received the other’s events. Durables move with the subject (cg-{envID}--{name}, proj-{envID}--{name}) because the same collision existed there, masked by the subject bug. External consumers that hardcode the old subject pattern must be updated. Orphaned pre-upgrade projection durables can be reclaimed with ironflow projection durables prune (#1546, #1544)
  • A caller-supplied env_-prefixed environment ID is now verified before it becomes the request scope. It was previously taken verbatim, so an unminted string became the environment — and since the re-keying above, also a subject token. Unknown IDs now return 400; lookup failures return 500 (#1546)
  • RBAC actions are enforced on dashboard JWT sessions, not just API keys. rbac.ActionForEndpoint was consulted only in the API-key path, so every dashboard session — plus the platform portal and ironflow platform * CLI, which share the same cookie — reached every REST route and ConnectRPC method with no authorization check. Both principal types now exit authentication through one shared helper. A user with no roles assigned will now receive a 403 where the request previously succeeded (#1543)

Features

Section titled “Features”
  • Generic webhook signature descriptor (ADR 0049). Signature verification previously handled exactly one scheme — a hex HMAC over the bare body — which fails Stripe (<ts>.<body>), Slack (v0:<ts>:<body>), and Shopify (base64). The same hardcoding broke deduplication and event naming, because GitHub and Shopify carry the delivery ID and event type in headers, leaving externalID empty and skipping the idempotency check entirely. The fix is configuration, not a provider registry: a verify_config column describes the header, delimiter, signed string, encoding, replay tolerance, and where to find the event name and delivery ID (#1525)
  • Per-source webhook ingest tokens (ADR 0048) — authorization for who may post here, orthogonal to signature verification of who sent it (#1525)
  • Inbound webhooks in the Flow Map: webhook sources appear as nodes with observed dashed edges to the events they cause, live status pulses, and navigation into delivery detail. Source-to-event causation is persisted, so topology survives delivery cleanup (#1550)
  • ironflow projection durables prune: lists — and with --delete, removes — the projection durables orphaned by the environment re-keying. Selection is by filter subject, never by name, because the legacy name embeds names that cannot be recovered from an environment ID (#1544)
  • Events tab rebuilt for high event volume, with a contextual docs link now present in dashboard page headers (#1510, #1539)

Fixes

Section titled “Fixes”
  • Events tab render storm: every incoming event re-rendered the whole list, and the tab was not correctly scoped to the active environment (#1517)
  • Postgres events(timestamp) index restored — dropped by migration 022, which quietly degraded time-ordered event queries (#1523)
  • Bootstrap credentials banner no longer prints under --dev (#1532)
  • First-run takeover no longer hides the dashboard Overview (#1530)
  • Create Webhook Source form is provider-first and two-column; the webhook descriptor UI gained accessibility, responsive, and state-handling fixes (#1545, #1540)
  • Dashboard polish: filter-bar dropdown behavior, timeline snap-to-marker, desktop sidebar, brand contrast, outage handling, failure paths, and navigation IA (#1507, #1514)
  • 145 broken links repaired on the published docs site, plus a blank 404 page, dead heading rules, AA contrast failures, and mobile nav overflow across the docs and marketing sites (#1500, #1501, #1503, #1505, #1515, #1529)
  • Non-compiling code samples and stale links fixed in three blog posts (#1504)

Improvements

Section titled “Improvements”
  • Getting-started tutorials lead with dev mode, drop stale install claims, and no longer pin versions that go out of date (#1531)
  • Dependencies updated, including fixes for assistant-ui 0.15 and cel-go 0.30 breaking changes (#1527)