6 Commits

Include renames

Author	SHA1	Message	Date
james.maesandGPT-6	2e356b8117	feat(authentik): checkpoint application access and identity synchronization RC ... Add user and group QQQ application-role access editing, bounded catalogs, webhook inbox and SQL mirrors, refreshed session permissions, and deferred invitation assignments. Include the isolated local review host, browser acceptance scripts, documentation and the token-widget column mapping fix. User approved this RC checkpoint. Full 1.0 gates remain documented, including the schema-drift matcher and PostgreSQL integration errors from the full gate. Companion UI: QRun-IO/qqq-frontend-next#205. Co-Authored-By: GPT-6 <noreply@openai.com>	2026-11-05 05:29:54 -06:00
james.maesandClaude Opus 5.5	a79f2d2d4b	feat(crud): phase 5c full user and group CRUD ... - Edit User: username (validated, unique) and other attributes (JSON object; qqq.io/ and goauthentik.io/ keys kept and refused; blank keeps them; needs authentik.audit.read, which also gates showing them). Edit Group: other attributes the same way. - Delete User and Delete Group behind the new DELETE feature (off by default; Authentik delete_user/delete_group): typed confirmation, never yourself, a protected account, a superuser group or the last identity administrator; a group needs no members and no child groups; its policy row goes with it. - Tests on the in-memory Authentik and a delete contract test on 2026.8.3; README, STATUS, CHANGELOG, CLAUDE.md invariant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 13:56:23 -05:00
james.maesandClaude Opus 5.5	077d9abbe8	docs(spec): policies (IAM-style statements) and full user/group CRUD ... DESIGN.md revision 5: owner decisions of 2026-10-13 (17-22), new section 12 (policy model stored on Authentik groups, fail-closed parsing, canonical generator with round-trip check, claim mapping, the policy editor, delete user/group behind the DELETE feature, authentik.policies.manage), plus docs/POLICY-FORMAT.md and the scope-mapping blueprint example. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 13:21:27 -05:00
james.maesandClaude Sonnet 5.5	ebd56d6ca4	feat: write contract tests, docs, status; recovery email prerequisites ... Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>	2026-10-12 16:54:45 -05:00
james.maesandClaude Opus 5.5	75c66a8f8d	Phase 1: read-only MVP (memberships, sessions, events, effective permissions, drift report, mapper) (#4) ... * feat: phase 0 foundations (read-only client, contract tests on Authentik 2026.8.3) - AuthentikQBitConfig (validated, secrets resolved by the qbit, never serialized or printed) and AuthentikQBitProducer (API backend, read-only authentikUser / authentikGroup tables, Identity app). - AuthentikActionUtil on qqq-backend-module-api: bearer auth, page/page_size paging with pagination.count, key lookups by GET, server-side user scope, AuthentikFilterMapper (rejects whatever Authentik cannot evaluate), 10 rps token-bucket throttle, 429/5xx retries, error mapping, and logging that never carries the token, query strings, successful GET bodies or sensitive bodies (AuthentikRedactor). - AuthentikGuard: identity.* read checks, sensitive fields behind identity.audit.read, all writes refused in this release, protected-account detection. - Pinned Authentik 2026.8.3 schema, SchemaDriftTest / SchemaDriftIT over the API surface used, and a weekly drift workflow against new releases. - Testcontainers harness (Authentik server + worker, Postgres, Mailpit) with the kof22-shaped blueprints, fixture recorder, and contract tests (b), (c), (d), (h) plus the access-check, sign-in policy, webhook and token findings. - Owner checklist, rehearsal script and blueprint lint for the cluster-gitops migration (KofTwentyTwo/cluster-gitops#72). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: phase 1 read-only MVP (memberships, sessions, events, effective permissions, drift report) - authentikGroupMember: virtual membership table served from a group (include_users), a user (groups_obj) or a bounded sweep; filters by group pk/name, user pk/username or key; user scope checked per member. - authentikSession and authentikEvent, behind identity.audit.read. - GroupGraph + EffectivePermissionResolver: groups and inherited parents to QQQ permissions; identity.* and catalog wildcards expanded, unknown names reported and never granted. Groups show inherited superuser status and effective permissions; users show effective permissions. - Identity drift report widget (identity.admin): version, blueprint status, service-account shape and self-minted tokens, break-glass, last identity admin, qqq.io/* attribute validity, and service-account changes to protected or superuser objects. - Contract tests on Authentik 2026.8.3 (real session via the flow executor; the drift report flags SuperuserFloorIT's lockout probes) and recorded fixtures for the new unit tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: group permission mapper; harden phase 0/1 after code review - AuthentikGroupPermissionMapper: token groups claim -> QQQ permissions via the group graph and resolver; static fallbacks and bootstrapOperators; Authentik unreachable grants only the fallbacks, never everything. - Review fixes (general and silent-failure reviews): - plain-text-only search, because Authentik's QLSearch could reach sensitive fields - thread-safe group graph - a failed group-graph read shows "Unavailable", not empty permissions - malformed qqq.io/* attributes are reported by the drift report - operator filters may not widen the user scope; membership rows are always scope-checked - a missing pagination object is an error - sorting by the key falls back to the default; strict booleans; ".." keys refused - https required except loopback / allowInsecureHttp; groupScopeNamePrefix refused until implemented - drift: unrunnable checks are ERROR "result unknown"; service-account tokens filtered server-side, zero visible is a warning; deleted or vanished targets flagged; only human users count as identity admins; break-glass re-checked client-side - redact error bodies before flattening; version check retried after a failed fetch - rehearse-phase0.sh: portable under Git Bash, waits for both blueprints, derived is_superuser; passed on a synthetic production-like dump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-12 06:08:37 -05:00
james.maesandClaude Opus 5.5	037d736bfd	Phase 0: foundations (read-only client, Authentik 2026.8.3 contract tests) (#1) ... * feat: phase 0 foundations (read-only client, contract tests on Authentik 2026.8.3) - AuthentikQBitConfig (validated, secrets resolved by the qbit, never serialized or printed) and AuthentikQBitProducer (API backend, read-only authentikUser / authentikGroup tables, Identity app). - AuthentikActionUtil on qqq-backend-module-api: bearer auth, page/page_size paging with pagination.count, key lookups by GET, server-side user scope, AuthentikFilterMapper (rejects whatever Authentik cannot evaluate), 10 rps token-bucket throttle, 429/5xx retries, error mapping, and logging that never carries the token, query strings, successful GET bodies or sensitive bodies (AuthentikRedactor). - AuthentikGuard: identity.* read checks, sensitive fields behind identity.audit.read, all writes refused in this release, protected-account detection. - Pinned Authentik 2026.8.3 schema, SchemaDriftTest / SchemaDriftIT over the API surface used, and a weekly drift workflow against new releases. - Testcontainers harness (Authentik server + worker, Postgres, Mailpit) with the kof22-shaped blueprints, fixture recorder, and contract tests (b), (c), (d), (h) plus the access-check, sign-in policy, webhook and token findings. - Owner checklist, rehearsal script and blueprint lint for the cluster-gitops migration (KofTwentyTwo/cluster-gitops#72). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop committed Python bytecode and ignore it The lint script's __pycache__/*.pyc was committed by accident: it is generated output and an unreviewable binary (K22-REPO-05). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-12 06:03:21 -05:00