Changelog

1.2.0 - 2026-10-27

Public at https://cloudiq-spla.cleverpoc.com.

• Public nginx site on port 443 for the name cloudiq-spla.cleverpoc.com with a Let's Encrypt certificate (key made on the server), coarse limits per address in nginx, and the demo API under /demo/v1/. Other names on 443 keep going to the start pages; the smoke test checks that.
• New page Try it (/try): click through the API in the browser (demo or own login), with request, answer and curl for every step.
• New page API reference (/swagger): Swagger UI 5.34.0, served from the service itself, with the servers /demo and /.
• The demo gives every login its own copy of the invented data (forgotten after an hour), so visitors never see or break each other's changes. The fake CloudIQ keeps at most 1000 logins.
• New service-wide ceiling of 100 failed password logins per 10 minutes (SPLA_API_LOGIN_FAILURES_GLOBAL_PER_10MIN). While it is reached, user names that logged in successfully in the last 60 days and token logins keep working.
• After review: Try it logs out at the instance the session belongs to, sends quantities as typed, quotes the curl command correctly; the internal demo port also serves /demo/v1; nginx rollback restores exactly the sites that were enabled before and closes 443 again when no public site remains; the demo keeps at most 40 reports per login and has room for 1000 sessions (as many as the fake CloudIQ keeps) with 10 logins per address per 10 minutes.
• Round 2: user names that logged in successfully are remembered for 60 days (as SHA-256 hashes, also across restarts in SPLA_API_KNOWN_USERS_FILE); the 429 for the ceiling points to option B; Try it ignores late answers of an older session, sends only whole numbers as numbers, and hides "Your real CloudIQ" on the demo instance; static files get a content hash in their URL (no stale copies after an update); the demo keeps at most 200 lines per report; partner guide explains the login limits in plain words.
• Round 3: a damaged known-users file never stops the service (and at most 10,000 entries are loaded); writes are flushed to disk; Try it forgets a session at once on logout, re-login or switching and ends it at the instance it came from (a 401 for an old session never ends the new one), and ends a login that finishes after the user moved on; only plausible timestamps are loaded from the known-users file; demo races removed; wording.
• Partner guide, security notes and administrator guide updated for public access; internal addresses removed.

1.1.3 - 2026-10-27

Fixes from the independent code review of the merge request.

• A misspelled dry run (?dryRun=true, ?dry-run=1, a dry_run in a DELETE body) was ignored and the change was really made. Change calls now refuse any query parameter other than dry_run, and DELETE refuses a body.
• Creating a month's draft: the check and the creation run under one lock (no two drafts for one month).
• Agreements without an end date count as open-ended; disabled agreements are never valid for a month.
• A decimal quantity from CloudIQ no longer breaks reading a report.
• write_result outcome sent is logged right after a change is sent, also when reading it back fails.
• Deploy: install.sh gets no stdin; a failing nginx reload rolls back.

1.1.2 - 2026-10-27

• Paging checked live against CloudIQ (Items + TotalHits, empty page past the end; noted in the admin guide); a repeated page now stops with an error instead of collecting duplicates.
• User names for the login limits are compared with Unicode case folding.
• The read-only live check passes every argument through its guard (it failed on 1.1.1 because of the new per-page timeout; a test now checks the guard), pytest finds the tests from the repository root.

1.1.1 - 2026-10-27

Changes after round 3 of the review panel.

• Successful logins no longer count towards a limit (before: 10 logins in 15 minutes with one user name gave a misleading "too many failed logins"). Instead at most 2 logins for the same user name can run at the same time.
• Lists: an answer without a list is an error, and without a total the service reads on until an empty page (a server with smaller pages is read completely); each page uses the remaining time of the list deadline.
• Installation lock in root-only /run; rollback keeps going if a step fails.
• Documentation: access today vs later, advice for the monthly routine, contract and extra user questions, limits table complete, sockets and www-data, crit log residual.

1.1.0 - 2026-10-27

Changes after two rounds of the review panel (IT technician, security reviewer, non-technical reader).

• Security: redirects from CloudIQ are refused (a token or secret is never resent elsewhere); access tokens with characters a token never has are refused before use (a token with a line break could end up in an error log); unexpected errors are logged without the exception text; the service listens on unix sockets that only nginx can reach (no local way around the allow list, rate limits and address in the audit log); at most 2 parallel requests per session; all login attempts per user name count, also parallel ones; nginx access log without query strings and error log only for critical messages; separate users, groups and log folders for production and demo; audit events also in the journal (written first); server-made request ids; stricter systemd settings.
• Reliability: complete paging of every CloudIQ list (also without a total or in camelCase), an error instead of a silent cut-off, and an overall deadline per list; the user name comes from CloudIQ (GET Me, best effort) also for token logins; write_result events with outcome ok, refused, unknown or not_visible_afterwards.
• Installation: versioned releases with their own units and nginx site; a new release first runs as the demo and must pass a smoke test before production switches; on failure the previous release (code and configuration) comes back; nginx is tested before use; one installation at a time; minimum library versions are checked; ufw follows the allow list exactly.
• Documentation: plain-language parts for non-technical readers (is this for you, getting access, status today, password and two-factor, advice on users and login options), certificate handling, error codes per call.

1.0.0 - 2026-10-27

First version (internal build, not given to partners).

• Log in with your own CloudIQ API client and user, or with a CloudIQ access token.
• Read SPLA agreements, prices, monthly usage reports (with lines, totals, status per agreement, issues, CSV).
• Prepare a draft report: create a month (copy of the previous one), change quantity or comment of a line, add or remove a line. Off by default; every change can be tried with ?dry_run=true. No submit function.
• Sessions in memory only, rate limits, audit log without secrets, IP allow list, TLS.
• Fake CloudIQ with invented data for tests and a demo instance.
• OpenAPI 3 specification, partner guide, administrator guide, security notes.