This release strengthens DSI API security with API key authentication, tenant-aware authorization checks, and persisted error reports for denied requests. The system deployment workflow now accepts feedback against the system deployment base, shows intermediate action states, and lets you request systemModules updates from the UI. It also includes a breaking change: the recipe state WAITING_FOR_SIGNATURE is renamed to PROVISIONING. Several packaging and provisioning race conditions are resolved as well.

New features

Secure the DSI API with API key authentication

Operators can now issue API keys to authenticate devices against the DSI API. Denied requests are recorded so that authentication problems are easier to diagnose.

• ROLEX-2915: Introduce API key authentication for the DSI API
• ROLEX-2915: Add API key management to the UI
• ROLEX-2951: Persist error reports for denied requests against the DSI API

Extend the system deployment workflow

The deployment lifecycle now gives more insight into progress and more control over updates. This makes it easier to track and steer system updates across your fleet.

• ROLEX-2932: Serve the system distribution set as system deployment base chunks
• ROLEX-2967: Add intermediate system action states for finer-grained progress tracking
• ROLEX-2960: Accept device feedback against the systemDeploymentBase
• ROLEX-2952: Expose configData and systemModules only during initial provisioning
• ROLEX-2962: Enable requesting a systemModules update via the UI
• ROLEX-2957: Improve recipe selection in the "Assign recipe" modal
• ROLEX-2986: Set externalRef when creating module actions in Rollouts for better traceability
• ROLEX-2970: Support paging for statuses in the system action detail view
• ROLEX-2981: Order action status messages latest first, consistent with the action status order

Improvements

• ROLEX-2933: Enable filtering for untagged systems and recipes in the UI
• ROLEX-2933: Clarify the ambiguous filter option "Untagged recipes" by renaming it to "Recipes without exposed tags"
• ROLEX-2930: Breaking change: Rename recipe state WAITING_FOR_SIGNATURE to PROVISIONING and improve transaction handling during packaging
• ROLEX-2945: Fix system constellation handling when systems report via the DSI API
• ROLEX-2956: Enforce tenant-aware authorization on DSI controller endpoints, ensuring the authenticated tenant matches the tenant in the request path

Bugs fixed

• ROLEX-2937: Fix packaging failures caused by versions exceeding the 64-character limit in Rollouts
• ROLEX-2930: Fix race condition when provisioning recipes
• ROLEX-2948: Fix dropdown closing unexpectedly when input is entered quickly
• ROLEX-2965: Fix read-after-write race condition during packaging
• ROLEX-2984: Fix untruncated recipe name column in the system action list when the recipe has been deleted