147 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
james.maes	7fcf061455	Merge pull request 'perf(policy): one permission universe per resolution; PolicyResult.replacement' (#74) from perf/policy-resolution-single-universe into develop	2026-11-11 01:08:27 +00:00
james.maesandClaude Fable 5.2	537e56d744	perf(policy): one permission universe per resolution; PolicyResult.replacement ... A host's authentication customizer runs on every request of a session. Policy resolution read the live permission universe once for every Allow term, and each reading recomputed the PolicyCatalog fingerprint, walked every catalog resource and called every host-name function. A role of nine named permissions therefore built nine universes per request; a full-access document built one. - PolicyRules.allowed, resolve and withheld read the universe they are given once per call (PolicyUniverse.once), so resultFromClaims, fromClaims, both claims mappers, the access editor and AuthentikAdmin cost one universe per resolution whatever the policy holds. PolicyParser.parseForSave reads it once per document. - PolicyCatalog.of compares the instance with the kept fingerprint piece by piece instead of building the fingerprint text on every call; the same content is compared, so every in-place metadata change still gives a new catalog on the next call. The catalog keeps its permission names and its part of the universe. - Nothing is cached across resolutions: no universe, no decision. The catalog cache is per JVM and derived only from that JVM's instance, as before. - PolicyResult.replacement(): the grant alone (Allow minus Deny), for a host whose sessions take their permissions only from the token. apply() is unchanged and remains a union with what the host passes. Measured on a 1,400-object instance (212 tables, 985 processes, 199 widgets), one resolution: 9 named permissions 12.1 ms and 7.9 MB to 0.33 ms and 0.12 MB; 30 named 28.7 ms and 25.3 MB to 0.32 ms and 0.14 MB; full access 1.19 ms and 1.37 MB to 0.77 ms and 0.20 MB. Tests: PolicyResolutionCostTest counts universe builds (1 for 1, 9 and 30 names, 0 for a void or absent claim), pins that one reading grants exactly what a reading per term grants, and holds an allocation budget; PolicyCatalogTest changes every fingerprinted aspect in place. The golden vectors are untouched and pass. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>	2026-11-10 18:51:54 -06:00
james.maes	a3fa59efe7	Merge pull request 'fix(health): token_broker health check only when tokens are enabled' (#72) from fix/health-token-broker-develop into develop	2026-11-09 18:46:33 +00:00
james.maesandClaude Sonnet 5.5	82c79d69be	fix(health): register the token_broker health check only when tokens are enabled ... With AUTHENTIK_QBIT_TOKENS off the check could only ever report UNKNOWN "not configured", and core has no way to remove a registered check, so the health page showed a permanent UNKNOWN row. Register it only when getTokensEnabled() is true; the other checks are unchanged. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-09 12:24:34 -06:00
james.maes	4c2ea3b889	Merge pull request 'feat(policy): format 1.1.0 with Deny, prefix wildcards and named permissions' (#69) from feat/policy-1-1-deny-prefix into develop	2026-11-09 03:01:04 +00:00
james.maesandClaude Sonnet 5.5	2c5baa336d	ci: re-run (the previous run hit a runner Docker port-binding error in Testcontainers) ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 20:48:19 -06:00
james.maesandClaude Sonnet 5.5	e2a3cd3021	test(policy): skip the python blueprint run when the CI image has no python ... The shared CI runner image has no python3, so the 'fail without python' rule made every build red at the unit stage. The python run now skips unless BLUEPRINT_PYTHON_REQUIRED=true; a pure-Java test keeps the blueprint's safety shape checked everywhere. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 20:38:27 -06:00
james.maesandClaude Sonnet 5.5	49905f8e86	fix(policy): break-glass operators keep identity permissions; absent groups claim is unavailable ... Bootstrap identity permissions are added to an operator after the Deny filter, so a void or denying group cannot lock them out of repairing policies. A token with no groups claim and no policy claim is unavailable (an empty array stays known). The mirror restores a policy attribute verbatim only when it parses. Docs mark the resolve/resolveResult/apply helpers as not for sign-in assembly. More mapper tests (void claim alone, bootstrap under void, guard error at sign-in, specific QAuthenticationException on refused mirror snapshots). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 20:32:00 -06:00
james.maesandClaude Sonnet 5.5	a76843d622	docs(policy): break-glass operators, absent groups claim, claim-only mapper ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 20:31:59 -06:00
james.maesandClaude Sonnet 5.5	cd1ebc0f73	fix(policy): one shared session-permission rule; Deny beats the mirror; void/unavailable ... SessionPermissionRules.compute serves sign-in, automated sessions and the refreshing mapper: void leaves break-glass only even while the guard blocks; unavailable leaves only configured outage fallbacks; known applies every Deny to policy grants, mirror permissions, static and host floors and earlier session permissions. The refreshing mapper reads Deny rules from the mirrored group rows on the same connection (checkpoint-consistent, bounded). Automated sessions void on an unknown group pk and no longer keep earlier permissions when unresolved. The guard keeps only a real last state (never OFF, original time, 15 min bound). The mirror stores the policy document unredacted. Blueprint rejects extra top-level keys and a missing Statement. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 19:56:28 -06:00
james.maesandClaude Sonnet 5.5	81fa5b53bf	docs(policy): one shared session rule, void/unavailable, blueprint shape ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 19:56:26 -06:00
james.maesandClaude Sonnet 5.5	bad06d806a	fix(policy): guard-blocked and floor Deny, unavailable state, strict documents ... The cut-over guard's blocked branch applies valid Deny rules (claim and graph) to floor, host source and existing permissions; a guard error keeps the last known state. Static and host floors are subject to Deny everywhere (bootstrap exempt), including the refreshing mapper, which now reads Deny rules from the mirror without an API call. PolicyResult gains UNAVAILABLE; a failed graph read with no claim voids earlier permissions; resolveResult reports the full rules. Missing parents void. Documents with unknown top-level keys or no Statement are rejected. The group fingerprint covers the configured policy attribute. Stronger tests for release, grandparent Deny, and the blueprint (fails without python). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 19:24:01 -06:00
james.maesandClaude Sonnet 5.5	4a375848f2	docs(policy): vectors and spec for document shape, blocked-guard and floors ... Documents with an unknown top-level key or no Statement are rejected (new rawDocuments vectors); a Deny subtracts static and host floors, also while the guard blocks; unreadable and void states; fingerprint covers the policy attribute. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 19:23:59 -06:00
james.maesandClaude Sonnet 5.5	a6ac960f3a	fix(policy): close fail-open edges found in review ... Operator credit never includes a name their own policies deny; the configured policy attribute is reserved against attribute edits; un-voiding an invalid policy is a release; a deliberate Deny no longer trips the cut-over guard and void is shown; a group missing from the graph voids; PolicyResult typed API with apply(); Deny of a prefix covers dotted host names; empty arrays and bad host names reject; Save Policy requires expectedFingerprint; the catalog cache key covers all rule sources and the runtime shares the cached catalog. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 18:54:02 -06:00
james.maesandClaude Sonnet 5.5	86aa863c7e	docs(policy): vectors, spec and blueprint for review fixes ... Deny of a prefix or named resource covers its dotted host names; empty Resource/Action/Permission arrays reject; the blueprint voids on any document under the attribute that is not exactly our spec (skipping other specs is an opt-in) and on duplicate keys. Spec: what a Deny subtracts, void is not empty, operators, host customizer API, blueprint known differences. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 18:54:02 -06:00
james.maesandClaude Sonnet 5.5	33e75b6d45	test(policy): golden vectors, Deny properties, consumer tests; blueprint, changelog, upgrade notes ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 18:09:24 -06:00
james.maesandClaude Sonnet 5.5	1ca28ecce6	feat(policy): format 1.1.0 typed rules (Deny, prefix resources, named permissions) ... PolicyParser returns typed PolicyRules (Allow and Deny terms, or void) instead of permission names, so a Deny or prefix cannot be read as a grant. Result = union(Allow) minus union(Deny) across all of a user's groups; one invalid policy voids every group of the user. Allow expands against one live universe; Deny is a predicate. Canonicalization never drops a Deny. Editor: save-time zero-match checks, effective-permission subset rule, release of Deny on removal, last-admin check. Host names register without an Authentik runtime; PolicyCatalog is cached per QInstance. Default PolicyVersion is 1.1.0. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 18:09:24 -06:00
james.maesandClaude Sonnet 5.5	9c76ff389e	docs(policy): vectors and spec for hyphenated names, one universe, host names, claim shape ... Permission names are dot-separated segments of [A-Za-z0-9_-] (bare names allowed); Resource stays [A-Za-z0-9_]+ and utils_* prefixes. Every Allow expands against one universe, host names are not features, a standard action a resource lacks is dropped, and the claim is one merged document. New vectors: hyphenated and bare Permission names, invalid names, hyphenated Resource, host name as Action, dropped action, not-in-universe name. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 18:01:26 -06:00
james.maesandClaude Sonnet 5.5	6f9ec41f35	docs(policy): specify format 1.1.0 (Deny, prefix wildcards, named permissions) ... Spec and shared golden vectors only; no parser change yet. - Effect Allow|Deny; result = union(Allow) minus union(Deny) across all of a user's groups, Deny wins, no ordering, expanded against the live instance so a Deny also covers future resources. - Prefix resources (utils_*): at least two characters, literal part ends in an underscore, wildcard last. Deny with Action * means every action including features; Allow with Action * stays the five standard actions. - Permission[] key for exact dotted/host permission names under Allow and Deny, so Deny can remove what full access includes. - Zero-match prefix, feature or named permission is rejected at save for both effects. Unknown statement keys (Condition) reject the document. - One invalid document among a user's groups voids all of them: dropping a bad group could drop a Deny and escalate access. - Canonicalization never drops a Deny. - policy-vectors-1.1.0.json: 27 vectors over a 16-name universe, to be run by this parser, the authentik-cd claim validator and Forge's tests. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-11-08 17:28:33 -06:00
james.maes	e342a39f8e	Merge pull request 'build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26)' (#67) from deps/align-gitea into develop	2026-11-07 18:20:43 +00:00
james.maesandClaude Opus 5.5	dcd0645f72	build(deps): align with Gitea registry (parent 2.2.1, QQQ 4.1.0-RC.26) ... pom.xml: parent -> 2.2.1 pom.xml: qqq.snapshot.version: 4.1.0-RC.21 -> 4.1.0-RC.26 pom.xml: qqq-frontend-next: 1.0.0-RC.37 -> 1.0.0-RC.38 pom.xml: removed Central snapshot repository pom.xml: added qqq.version=4.1.0-RC.26 (parent BOM import) Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 18:03:06 +00:00
james.maes	67d1ec0eec	Merge pull request 'ci: build on container-build-large' (#66) from ci/large-runner into develop	2026-11-07 13:58:14 +00:00
james.maesandClaude Opus 5.5	d49e79f4ac	ci: build on container-build-large (Authentik stack per build) ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-07 12:54:05 +00:00
james.maes	e521f54018	Merge pull request 'ci: pin shared workflow to v1' (#62) from ci/pin-v1-develop into develop	2026-11-07 00:28:46 +00:00
James MaesandClaude Opus 5.5	d87ada10d2	Merge develop into ci/pin-v1-develop ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 18:08:38 -06:00
james.maes	914b3ac58f	Merge pull request 'test(authentik): fix slow contract stack startup in CI (Postgres JIT)' (#65) from ci/authentik-ci-stability into develop	2026-11-07 00:08:27 +00:00
James MaesandClaude Opus 5.5	d3f334cd42	fix(test): turn off Postgres JIT in the contract stack ... Root cause of the slow/failed Authentik contract stack on busy CI runners: Authentik validates every policy binding in a blueprint by loading PolicyBindingModel.select_subclasses(), a ~20-way LEFT JOIN whose planner estimate on a fresh database (cost ~1e8) is far above Postgres' JIT thresholds. Postgres JIT-compiled it on every call: 7.6 s instead of 77 ms at 0.5 CPU, with the Postgres container pegged and the worker idle. The fixtures' nested metaapplyblueprint chain (tokens -> bootstrap -> oauth2-apps) runs oauth2-apps 8 times per tokens apply, so one apply outran the worker's 10-minute task limit, was killed and retried, and the stack never became ready (runs 5754, 6277, 6363). With jit=off the full contract suite passes locally with every container capped at 0.5 CPU; blueprint startup drops from >14 minutes to ~1.5 minutes and BlueprintReapplyIT from 228 s to 34 s. Also give waits on worker-delivered results (emails, notifications, events) a shared 3-minute budget and blueprint re-applies 10 minutes; the waits still return as soon as the condition holds. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 17:36:47 -06:00
James MaesandClaude Opus 5.5	7adc25bf7e	fix(test): drain Authentik's first-boot blueprint work before re-applying ours ... Root cause of the flaky contract stack (diagnostics from run 6277): on first boot the worker (2 threads) applies ~40 built-in blueprints plus the three kof22 fixtures concurrently. On a slow shared runner ours can validate before the built-in objects they reference exist (managed OAuth2 scope mappings, default flows) and end in "error", which Authentik never retries for an unchanged file; concurrent applies also deadlocked in Postgres. The earlier throttled re-apply made it worse: it enqueued three applies every 30s regardless of pending work (69 queued apply_blueprint tasks, applies running for 6+ minutes), and the backlog then starved the tests' own worker tasks (blueprint applies, recovery/invitation emails, notification rules) and held locks that timed out plain API writes. Now startup waits until no blueprint discovery/apply task is queued or in progress, then re-applies the first non-successful kof22 blueprint in dependency order, one at a time, never enqueueing while an apply is pending. The startup budget is 15 minutes (with a comment) because a cold shared runner can need well over 8 minutes for the built-in storm. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 12:00:01 -06:00
James MaesandClaude Opus 5.5	2f6a83db27	test(authentik): print the worker task queue on contract-test timeouts; restore seed state in BlueprintReapplyIT ... Most contract-test waits depend on Authentik worker tasks (blueprint applies, recovery/invitation emails, notification rules). When a wait times out, print the global task status and the running, queued, warning and error tasks with their logs, so CI shows whether the worker was stuck, backlogged or failing. BlueprintReapplyIT now restores the seed groups and the service-account role's view_user permission in a finally block. A failed re-apply used to leave those edits behind and cascade into unrelated failures (QbitReadContractIT.groups saw "authentik.*, cms.publish"; TokenContractIT got 403 on /core/users/). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 10:38:25 -06:00
james.maes	4d45796651	Merge pull request 'fix(admin): queue two-person approval when Create Group grants authentik.*' (#63) from fix/create-time-approval-20261106 into develop	2026-11-06 15:31:54 +00:00
james.maesandClaude Fable 5.1	53bc414490	fix(admin): queue two-person approval when Create Group grants authentik.* ... With twoPersonApproval=true, the native Create Group action persisted a new group carrying authentik.* permissions (for example authentik.users.read) immediately, while Edit Group queued an authentik_approval_request for a second person. Apply the same identity-permission expansion and second-person condition at creation time: the plan becomes NEEDS_APPROVAL and nothing is written until a distinct operator holding authentik.approve approves it; the stored request keeps the native requester/approver and live revalidation checks. Regression test: creating a group with authentik.users.read queues one approval request and writes nothing, self-approval is refused, a second operator with approve + groups.manage completes the creation, the persisted group carries exactly the requested permission, the request is APPROVED, and a repeat approval is refused. Carried locally by GG Forge as qbit-authentik-rc8-create-approval.patch since 0.1.0-RC.8. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Signed-off-by: James Maes <james@kof22.com>	2026-11-06 08:40:17 -06:00
james.maesandClaude Opus 5.5	c657eb7e28	ci: pin shared workflow to v1 ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-06 14:04:27 +00:00
james.maes	d928575104	Merge pull request 'ci: use shared ci-workflows Maven workflow' (#61) from ci/ci-workflows into develop	2026-11-06 00:48:15 +00:00
James MaesandClaude Opus 5.5	ea5c5ab65e	test(authentik): surface Authentik error logs when the contract stack fails to start ... When the blueprint wait times out, also print error-level worker lines and error/warning server lines (API-triggered re-applies run in the server), so the failing blueprint's cause is visible in CI logs. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 18:28:50 -06:00
James MaesandClaude Opus 5.5	38660be0f5	test(authentik): also re-apply never-applied kof22 blueprints at startup ... Run 5488: with errored blueprints re-applied, kof22-oauth2-apps and kof22-qqq-tokens succeeded but kof22-identity-bootstrap stayed "unknown" (never applied) until the wait timed out. Re-apply blueprints in "error" or "unknown" state after a 60s grace period, every 30s. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 17:30:04 -06:00
James MaesandClaude Opus 5.5	8b52f583e9	test(authentik): re-apply errored kof22 blueprints during contract stack startup ... On a cold runner the built-in Authentik blueprints can race our custom ones on first boot, leaving kof22-oauth2-apps in "error" until the 8-minute wait times out (run 5465). The local-review path already re-applied errored blueprints; do the same (throttled to every 10s) in the shared contract-stack wait. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 17:11:53 -06:00
James MaesandClaude Opus 5.5	ba5a688525	test(authentik): make contract ITs run against a non-loopback Docker host ... - SchemaDriftIT/SchemaDriftTest: quote OpenAPI path templates before turning {key} into a regex; other placeholders such as {slug} were compiled as regex repetition and threw PatternSyntaxException. - Contract ITs: set allowInsecureHttp on the test qbit config; the Authentik test container is plain http and is reached via the Docker host address (e.g. 172.17.0.1 in CI), not loopback. Production https validation is unchanged. - Postgres ITs: bind the mapped port to 127.0.0.1 only when the Docker daemon is local; with a remote daemon the loopback-only binding made the database unreachable (connection refused). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 16:52:46 -06:00
CI	c9806e2b82	ci: rerun shared workflow	2026-11-05 16:23:54 -06:00
CI	8f91c08e3e	ci: rerun shared workflow	2026-11-05 16:15:15 -06:00
james.maesandClaude Opus 5.5	021a9ae446	ci: use shared ci-workflows Maven workflow ... Replace the platform-ci release callers with one caller of KofTwentyTwo/ci-workflows maven.yaml (qqq-orb port). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-05 22:02:07 +00:00
james.maes	98275d42ea	Merge pull request 'feat(authentik): application access and synchronization RC checkpoint' (#59) from james.maes/authentik-rc-checkpoint-20261105 into develop	2026-11-05 11:40:19 +00:00
james.maesandGPT-6	2e356b8117	feat(authentik): checkpoint application access and identity synchronization RC ... Add user and group QQQ application-role access editing, bounded catalogs, webhook inbox and SQL mirrors, refreshed session permissions, and deferred invitation assignments. Include the isolated local review host, browser acceptance scripts, documentation and the token-widget column mapping fix. User approved this RC checkpoint. Full 1.0 gates remain documented, including the schema-drift matcher and PostgreSQL integration errors from the full gate. Companion UI: QRun-IO/qqq-frontend-next#205. Co-Authored-By: GPT-6 <noreply@openai.com>	2026-11-05 05:29:54 -06:00
forge-recovery	fe6f716e87	ci: enroll shared Gitea lifecycle	2026-11-03 22:07:34 +00:00
forge-recoveryandCodex	6290b23a32	ci: restore Auth fixture startup order and shared lifecycle ... Co-Authored-By: Codex <noreply@openai.com> Co-Authored-By: Codex <noreply@openai.com>	2026-11-03 17:57:26 +00:00
james.maesandCodex	b22ed15719	ci: adopt managed orb 0.8 patch track (#51) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 15:39:11 -05:00
james.maesandCodex	366d55b9ec	ci: adopt shared orb 0.7.18 (#50) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 14:52:21 -05:00
james.maesandCodex	f1ed82a92f	ci: adopt shared orb 0.7.17 (#49) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 14:25:22 -05:00
james.maesandCodex	dd55a61105	ci: use the shared branch-aware CodeQL worker (#47) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 10:56:39 -05:00
james.maesandCodex	17486b88d2	ci: adopt central orb 0.7.12 and stable gates (#45) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 09:03:12 -05:00
james.maesandCodex	7d1227adf5	ci: centralize rc release completion in qqq orb (#44) ... Co-authored-by: Codex <noreply@openai.com>	2026-10-21 02:35:07 -05:00