Skip to content
hotloopdocs
GitHub

HotLoop Flow 2.4.0 release notes

HotLoop Flow 2.4.0 lets the EmberCORE dashboard sign people in to Flow. A person who opens Flow from the dashboard is in with the role their tenant gave them, full access or read-only, with no second login. It is off unless the dashboard’s key is configured, and nothing that worked before changes.

What’s new

Section titled “What’s new”

Sign-in from the EmberCORE dashboard

  • The dashboard puts a token it signed in X-Embernet-Assertion on every request it proxies to Flow, the editor’s websocket included. Flow checks it with the dashboard’s public key: the signature (ES256), the issuer (embernet-dashboard), that it was made for this Flow in this tenant (the audience is <tenant>/<release>, so a token for another app opens nothing here), and its expiry, about a minute. A token that is wrong in any of those is refused, and nothing else on the request rescues it.
  • The role comes from the tenant’s role map in the dashboard. * is every permission. read is the flows, the palette, the settings and the status, and nothing that changes them: no deploy, no inject, no deployment log. Operators and Viewers get read by default. A role that is neither, or none, is no access. Someone signed in this way shows in the deployment log and the audit trail as dashboard:<email>.
  • There is no session. The dashboard sends a fresh token on every request, so a role changed there lands on the next request and there is nothing to revoke.
  • The editor says “Open this from the EmberCORE dashboard” instead of offering its own sign-in form, and drops the Sign out button when the dashboard signed you in. GET /auth/mode is how it asks, before anyone has signed in.
  • The chart takes it under embernetSignin. The App Store passes the dashboard’s public key; the chart mounts it, writes the settings, rolls the pod, and annotates the Service so the dashboard knows to sign people in.

What changed

Section titled “What changed”

Nothing, unless you set the key. With no key file Flow does not read the header at all, and a helm template of the defaults is what it was.

Upgrade

Section titled “Upgrade”

A plain helm upgrade to the 2.4.0 image and chart. Nothing happens on first start.

To use it by hand, mount the dashboard’s public key (a PEM file) and set auth.assertion.publicKeyFile and auth.assertion.audience, or HOTLOOP_FLOW_ASSERTION_PUBLIC_KEY_FILE and HOTLOOP_FLOW_ASSERTION_AUDIENCE. Flow refuses to start with a key it can’t read or no audience. The other settings are auth.assertion.issuer (embernet-dashboard), header (X-Embernet-Assertion) and hideLogin (true).

The admin login and API tokens keep working beside it. They are the break-glass for staff and automation, and the editor’s form being gone does not touch them.

What isn’t proven

Section titled “What isn’t proven”

It ran against a real Flow binary behind a signer built from the dashboard’s own code, with every refusal exercised and the websocket handshake checked. It has not run behind the live dashboard, in a Fleet install, or in a person’s browser outside the CI suite.

Image: ghcr.io/hotloop-io/hotloop-flow:2.4.0, linux/amd64 and linux/arm64. Chart: https://hotloop.io/hotloop-flow/. The README at this tag has the rest: https://github.com/HotLoop-io/hotloop-flow/blob/v2.4.0/README.md