Feat/sso role team mapping docs - #365
Closed
alick-liming wants to merge 480 commits into
Closed
Conversation
…0260806 docs(api): make the reference examples internally consistent
Sampling rate and the per-event switches are independent controls, but the FAQ only covered sampling and stopped at "not possible". Document the combination that gets closest to errors-only: full session sampling plus disabling non-error event collection. Warn against `trackResources: false`, which is the intuitive move and the wrong one: browser RUM reports HTTP failures as resource events, not error events, so disabling resource collection hides API failures entirely. Show a `beforeSend` filter that keeps failed requests instead, and list the remaining costs: view events cannot be disabled, error evidence loses the user action trail, and traced requests are still reported.
docs(monitors): add Entity Tree guide
…ly-faq docs(rum): expand the errors-only sampling FAQ
Native crash symbolication is now available, so the pages that said it was unsupported were wrong. Adds an upload section covering the part that costs support round trips: symbols match on the module id alone, so --service and --release-version only label the upload — the opposite of how source maps behave. Also notes that most frames land in Electron's own binaries, so its official symbol bundle has to be uploaded too, and that every Electron upgrade invalidates the previous set silently.
…ping Two things the pages promised but never stated. The Session Replay instructions tell you to set sessionReplayDirectUpload without saying which version has it. It landed in browser-rum 0.0.7, and the Browser SDK drops options it does not recognize, so on anything earlier the configuration reads as correct and records nothing at all. The minidump field table was also missing error.fingerprint and error.meta.exception_codes, and never explained that native crashes group per crash site — including the trade-off that a new build reopens issues, since the fingerprint keys on a module offset.
The docs site restructure moved all pages out of the old flat
/{lang}/flashduty/<slug> structure into sectioned paths (on-call/,
compliance/, monitors/, rum/, ...), leaving every legacy URL to 404.
Add 335 redirects mapping each legacy path still referenced by product
UIs, emails and published content to its new location; every
destination was verified live (HTTP 200) before inclusion.
fix: add redirects for legacy /{lang}/flashduty/* paths (335 URLs)
docs(rum): add Electron SDK integration docs (zh + en)
…uide docs(rum): simplify Electron SDK guides
Review of request schemas across on-call, monitors, rum, platform, and safari against backend validation and handler logic: - fill in missing field descriptions (rule field updates, member reset payloads, silence/inhibit/escalation rule filters, and similar) - explain enum values and add missing enum members (RUM app types, issue suspected causes, updatable rule field names) - point ID fields at the list endpoints that yield them - correct inaccurate descriptions: cron_pattern is 6-field with seconds and supports @every; team upsert emails/phones match existing members only; folder_id 0 is invalid; incident create assigned_to is optional, combinable, and its type is server-derived - sync consolidated openapi.zh/en.json with the per-module specs
…0260811 docs(api): enrich request parameter descriptions
…rements
- Fix the six webhook FAQ pages (alert-webhook, incident-webhook,
custom-actions, zh + en) that rendered the raw `{ip_whitelist}`
string instead of the actual trusted source IP list.
- Add a network access requirements section to the SSO configuration
page (zh + en) clarifying which protocols require the identity
provider to be reachable from Flashduty's servers: SAML 2.0 does
not, OIDC and CAS do, LDAP only applies to private deployments.
Includes the egress IPs to allow through a firewall and recommends
SAML 2.0 for identity providers that cannot be exposed at all.
The SSO network requirements section and the webhook FAQ IP whitelist answers previously listed Flashduty's egress IPs without qualification. Those IPs belong to the SaaS (public cloud) service only. In a private (on-premises) deployment, Flashduty runs inside the customer's own network and its egress address depends on that deployment, not on the addresses listed here. Added a short note to the SSO configuration page (zh + en) and a caveat to the webhook FAQ answers (zh + en) making this explicit, so private-deployment customers don't apply the SaaS IP list to their own firewall.
These three webhook pages (zh + en) are also published as the embedded
integration documentation inside the Flashduty console, where the
renderer substitutes {ip_whitelist} with the egress address of the
running deployment. A private deployment egresses from its own network,
so replacing the placeholder with the public-cloud address list here
would show those customers addresses that do not apply to them.
Restores the placeholder. The public-cloud address list stays on the SSO
configuration page, which is not embedded in the console and where the
list is already scoped to the SaaS service.
These webhook pages are published twice: as documentation pages, and as
the embedded integration help inside the product, which substitutes
{ip_whitelist} with the egress address of the running deployment. On the
documentation site nothing performs that substitution, so readers saw the
placeholder itself and never got an answer. They also cannot resolve it
themselves the way they can resolve {api_host}, because the value is a
property of our service rather than of their environment.
Add the counterpart of removeHiddenBlocks to the package build: a
`{/* console: ... */}` block is an MDX comment, so the documentation site
renders nothing, while the package build unwraps it and the product still
receives the placeholder. Each FAQ answer now carries the public-cloud
address list for readers, inside the existing hide block so it does not
reach the product, and the placeholder for the product, inside the new
console block so it does not reach readers.
The address list is scoped to the SaaS service, since a private
deployment pushes from its own network.
The dual-renderer construct added for this FAQ changed the console output
even though it was only meant to change the docs site. Two causes:
- The hidden block sat between the two list items the console still sees,
so removing it left a blank line there and turned a tight list loose.
Each renderer now gets its own contiguous pair of items.
- `removeHiddenBlocks` and the `{/* console: */}` unwrap both left their
indentation behind as a whitespace-only line. Both now consume their
opening and closing lines whole. Blocks at column zero are unaffected.
Verified by building the console package from this branch and from its
base and diffing every page: no page's console content changes. On the
docs site the four addresses render and the placeholder does not.
Doc-review diff run since 2026-08-06 (24 findings: 4 high, 11 medium, 9 low): - statuspage: new widgets.mdx (zh/en) for the embeddable status widget (badge/banner web component + public summary.json API), changelog entry 2026-08-11, markdown-table support note, comparison row - monitors: entity-tree rule import (Prometheus/Operator YAML), batch enable/disable + bundle export, template variable reference, rule-update impact preview, Loki LogQL autocomplete tip - on-call: escalation rule filter adds first-alert integration condition; alert source links to producing monit rule - rum: Electron app type in app management, source mapping, UV basis - ai-sre: folder upload for session attachments and knowledge packs, marketplace installs pinned to account scope (skills + MCP), attachment extension whitelist relaxation, new context-ref kinds, public artifact UGC disclaimer - developer: cli detail-projection oversize now errors (288 -> 327 ops); go-sdk service table adds ServiceMap, ErrorIngestionRules, IssuePresetSeverityRules, Resources, SessionReplay, Licenses (288/32 -> 327/38)
docs: fix IP whitelist placeholder and document SSO network requirements
docs: 状态页 Widget 文档 + changelog，修复 24 条文档漂移（doc-review 2026-08-11）
…ing-prereq docs(rum): state the setTrackNetworkRequests prerequisite for HarmonyOS network tracking
Add OpenAPI operations for the app_key-callable knowledge pack and
knowledge file APIs under a new "AI SRE/Knowledge" tag:
- POST /safari/knowledge/pack/list, /get, /pack/ensure, /pack/update, /pack/delete
- POST /safari/knowledge/file/list, /file/get, /file/put
Each operation carries request/response schemas lifted from the
handlers, per-account rate limits from the gateway registry, a
Restrictions/Usage body, and real response examples captured from the
dev API. The 8 operations are merged into both safari.openapi.{en,zh}.json
and the consolidated openapi.{en,zh}.json (33 -> 41 AI SRE operations,
327 -> 335 total), the docs.json AI SRE nav gains a "Knowledge"/"知识"
subgroup, and both api-catalog pages get the matching table section.
Document POST /safari/knowledge/file/delete (knowledge-file-write-delete)
as the ninth knowledge operation, completing the app_key-callable
knowledge surface:
- FileDeleteRequest {pack_id, rel_path, force} -> FileDeleteResponse
{warnings}, lifted from the handler.
- Restrictions: write-tier rate limits (20/s, 300/min per account),
Knowledge Manage permission, audit-logged.
- Usage bullets cover idempotent deletes, the ReferenceExist/force
behavior for still-referenced files, and the pack_id default.
- Response example is a real dev-API capture (temp file created via
file/put, then deleted by the captured call).
docs.json gains the nav entry in both language subgroups; the catalogs
gain the table row and counts move to 42 AI SRE / 336 total.
api-reference: document the 8 AI SRE knowledge endpoints
Document the symbol-upload host separately from RUM ingest: browser.flashcat.cloud is ingest-only and 404s on /sourcemap/upload. Pin the hvigor-plugin install to ^0.1.3, document FLASHCAT_SOURCEMAP_INTAKE_URL for private deployments, and note the legacy FLASHCAT_ENDPOINT fallback on 0.1.2.
fix(rum): HarmonyOS symbol upload uses ci.flashcat.cloud
…91033 # Conflicts: # en/changelog/changelog.mdx # en/on-call/incident/search-view-incident.mdx # zh/changelog/changelog.mdx # zh/on-call/incident/search-view-incident.mdx
docs: daily doc-review 2026-09-01 — heartbeat, AI SRE status page drafts, IM feedback + drift fixes
The doc-review merge left 09-02 unclosed, nesting the 09-01 entry and everything after it; the rendered page dropped those entries.
fix(changelog): close the 2026-09-02 Update block before 2026-09-01
…enie pages - move on-call/quickstart/comparison to on-call/comparison/vs-pagerduty (zh/en) - add a new Flashduty vs Opsgenie comparison page (zh/en): sunset timeline, official JSM migration path, feature/pricing comparison, migration guidance - redirect the previous quickstart/comparison URLs (and the legacy flashduty/comparison-to-alternatives URLs) to the new vs-pagerduty location - register a Product Comparison nav group and update the home-page cards
On-call has no standalone cron-job heartbeat feature; credit Opsgenie Heartbeats and point at the Monitors engine-lost alert instead.
docs(monitors): document unknown command policy and agent v0.3.0
docs(on-call): add Flashduty vs Opsgenie comparison; move vs PagerDuty to a dedicated section
docs(monit): define datasource diagnostic tools and host-only Agent APIs
…s-nav docs(monit): add datasource tools invoke to the api nav
…t-host-tools docs(monitors): 同步 Agent 主机诊断文档
docs(monitors): 默认下载 monit-agent v0.4.0
… tools/invoke restrictions, sync api-catalog
- 16 ZH ops (rum remote-config, safari artifact/sign, on-call schedule/by-person)
carried responses.200.description "Success"; aligned to the 成功 convention.
- POST /monit/datasource/tools/invoke gained its ## Restrictions block. Limits
(32/s, 2000/min per account) and permission class (Datasources Read, monit)
come from live pgy_proxy.t_api id 18847 and pgy_account.t_permission_factor,
matching fc-pgy 9c5494a / 6be0e3a - not constructed values.
- {en,zh}/openapi/api-catalog.mdx: +1 row, Monitors 39->40, total 353->354.
- docs.json untouched: no operation added or removed.
- lint_openapi.py: OK, 12 spec files, no violations.
… fixes Findings (26): 3 high, 19 medium, 4 low — diff window 2026-09-04T08:13:40Z..2026-09-07. - cli.mdx: safari artifacts command family, monit datasource-tools-invoke, datasource --alerting-enabled/--enabled, monit-agent host-only, insight --fields, 16KiB output bound, status-page draft-create - sso: new role-team-sync page (SAML2.0/OIDC/CAS claim-name sync) + docs.json + configure-sso links - monitors: 10→15 datasource types, enabled/alerting_enabled split, datasource tools + Edge v0.71.0 - on-call: war-room chats excluded from group-chat pickers; analytics timezone row - rum: adoption panel labels (采用情况) - ai-sre: sessions task-panel third entry point - api-catalog/go-sdk: tools-invoke row, client.Artifacts, DraftCreate, 5-type contract, Reason field, count refreshes (337→349/348/354) - changelog: SSO sync + Monit datasource diagnostics entries
api-review daily audit 2026-09-07: zh 200 descriptions, tools/invoke restrictions, api-catalog sync
docs: doc-review 2026-09-07 — CLI/SSO/monitors/go-sdk/API 增量审计修复
Add a best-practices page (zh + en) covering ingest bandwidth estimation: a three-step method (bandwidth -> events/s -> concurrent users -> DAU), measured baseline parameters, the compression and session replay switches, mobile vs web differences, reduction levers, private-deployment link sizing, and calibration methods.
docs(rum): add bandwidth estimation and capacity planning guide
…g-docs docs(sso): role and team mapping with new-member-only defaults
Merge latest main into the SSO docs feature line and resolve only SSO documentation conflicts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.