P2: Enterprise policy.json (updates/auth constraints, rollout control) #26

Activity

1. Kinin-Code-Offical

   added

   Priority: P2

   Type: enhancement

   Area: auth

   P2

   security

   enhancementNew feature or requestNew feature or request

   on Dec 21, 2025
2. Kinin-Code-Offical

   added this to the P2 – Enterprise Distribution & Signing milestone on Dec 21, 2025
3. Kinin-Code-Offical commented on Dec 22, 2025

   

   Kinin-Code-Offical

   on Dec 22, 2025

   OwnerAuthor

   More actions

   Plan

   • Add enterprise policy.json support (machine-scope by default) loaded from %ProgramData%\CloudSQLCTL\policy.json or overridden by CLOUDSQLCTL_POLICY_PATH.
   • Enforce policy in sensitive commands:
     • upgrade: allow/deny updates; optionally force channel and/or pinned version; block user pin/unpin when policy controls it.
     • �uth: allow/deny login, �dc, and set-service-account; optionally restrict allowed scopes.
   • Add docs/Policy.md with schema + examples.
   • Add unit tests for policy parsing and enforcement helpers.

   Risks

   • Over-restricting behavior; keep defaults permissive when policy absent.

   Local test plan

   • npm ci
   • npm run lint
   • npm test
   • npm run build
   • npm run docs:check
4. Kinin-Code-Offical

   closed this as completedin #45on Dec 22, 2025
5. Kinin-Code-Offical commented on Dec 22, 2025

   

   Kinin-Code-Offical

   on Dec 22, 2025

   OwnerAuthor

   More actions

   Done via #45
   Merge commit: 14a3711

   Verification

   • npm ci (PASS)
   • npm run lint (PASS)
   • npm test (PASS)
   • npm run build (PASS)
   • npm run docs:check (PASS)