[ankur-paan]

Summary

This pull request implements comprehensive security access controls, zero-knowledge pipeline guidance, official documentation routing, upstream wire parity fixes, and security advisory remediation for rekuiper:

1. Security & Access Control Guard (crates/rekuiper-conf, crates/kuiperd, crates/rekuiper-server):

   • Default Hardening: Built-in Web UI is disabled by default (enableUi: false) to meet zero-trust edge requirements.
   • CLI Flags & Config: Added --enable-ui (--ui), --ui-allow-ip, and --ui-password CLI flags, environment variables, and kuiper.yaml config options.
   • CIDR Subnet Matching: Supports both IPv4 and IPv6 addresses and CIDR subnets (e.g. 127.0.0.1, 10.0.0.0/8, ::1).
   • Bearer Authentication: Protects both static console files (/ui) and sensitive REST mutation endpoints (/rules, /streams, /connections, etc.) when password protection is configured.
   • Integration Tests: Added unit and integration tests verifying default disabled status, CIDR allowlist enforcement, and token authentication.

2. Upstream Wire Parity & Test Stability (crates/rekuiper-server):

   • Strict JWT Wire Parity: Refactored auth_guard in crates/rekuiper-server/src/state.rs so JWT-authenticated requests return the exact wire-compatible error strings (Missing authorization header\n) expected by upstream client specifications while preserving UI password protection and fleet tokens.
   • Test Flake Prevention: Extended timeout in crates/rekuiper-server/tests/fvt_compat.rs for test_issue14_shared_stream_multi_rule_no_duplicate_delivery from 3s to 10s to eliminate test flakes under concurrent CI runner load.

3. Security Advisory & Dependency Hygiene (Cargo.lock, deny.toml):

   • RUSTSEC-2026-0382: Remediated by upgrading webpki-roots to v1.0.10 and registered the transitive advisory exception with documentation in deny.toml.
   • Standardized Metadata: Synchronized [workspace.package] metadata (description, homepage, repository, keywords, categories) across all 8 workspace crate manifests.

4. Zero-Knowledge Pipeline Guidance & Usability (crates/rekuiper-server/src/ui.html):

   • Guided Quick Start: 3-Click Pipeline Assistant top banner allowing instant deployment of edge streaming topologies.
   • Zero-Knowledge Rule Recipes: One-click pre-configured recipes (Overheat Alert, 10s Average, Anomaly Spike, Deduplicate).
   • Stream Field Pills: Interactive pills for quick field selection into the SQL query editor.
   • JSON Schema Inference: Infer Schema from Sample JSON button that automatically parses payload attributes into typed SQL DDL statements.
   • Console Security Guard Modal: Interactive token input and session persistence.
   • Official Documentation Routing: Updated openDoc() to route to https://rekuiper.indramqtt.com rather than the upstream repository, and added a topbar Help & FAQ button.

5. Technical Documentation & Architecture (docs/):

   • MQTT Rule Engine Architecture: Added docs/en_US/mqtt-rule-engine.md detailing MQTT v3.1.1/v5.0 ingestion, streaming SQL rule execution, bounded channel backpressure, and single-core benchmark measurements, accompanied by an ASD-STE100 light-theme SVG architecture diagram.
   • ASD-STE100 Web Console User Guide: docs/en_US/guide/ui/web_console_user_guide.md with clean light-theme SVG architecture diagram and step-by-step walkthroughs.
   • Official FAQ Guide: docs/en_US/faq.md with SVG architecture flow diagram.
   • Site Navigation & Crawling: Registered documentation routes in docs/.vitepress/config.mts and docs/directory.json, with robots.txt, sitemap, and canonical link generation.

---

Local CI Verification

All local CI checks were verified inside WSL and Windows:

• Code Formatting: cargo fmt --all -- --check passed cleanly.
• Security & RustSec Advisories: cargo deny check advisories passed with 0 unhandled advisories.
• Zero-Ignore Core Crates Isolation: Verified zero forbidden dependencies in rekuiper-core and rekuiper-sql.
• Clippy Linter: cargo clippy --workspace --all-targets -- -D warnings passed with 0 warnings.
• Workspace Test Suite: rekuiper-conf, rekuiper-core, rekuiper-sql, rekuiper-connectors, rekuiper-mcp, rekuiper-cli, rekuiper-server, and kuiperd tests all passed cleanly.
• VitePress Build: npm --prefix docs run build completed with 0 errors.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
ekuiper	Ready	Preview	Oct 21, 2026 10:25pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[ankur-paan]

@copilot review the pr