docs(spec): policies (IAM-style statements) and full user/group CRUD #13

2026-10-13T18:21:39Z

KofTwentyTwo commented

2026-10-13 18:21:39 +00:00

(Migrated from github.com)

Spec for the owner's request of 2026-10-13: create, edit, delete and query users and groups, plus IAM-style permission statements with a UI to build them.

What changes in the design

Owner decisions 17-22 (DESIGN.md section 0.1): policies are edited in QQQ and stored on Authentik groups; the statement model matches the existing IAM-style documents (Allow only; hasAccess/read/insert/edit/delete/*); the format belongs to this qbit with a configurable spec name; the editor UX; delete as an explicit action behind a new DELETE feature; the permission split (read / users / groups / policies, new authentik.policies.manage).
New section 12: storage (qqq.io/policy attribute, authentik_policy history table), how it reaches the session (scope mapping into the qqq_policy claim, AuthentikPolicyClaimMapper, resolver integration so the subset and last-admin rules see policy grants), config, the editor (catalog from metadata, matrix, live JSON, round-trip), CRUD additions, the Authentik permissions writes need, tests, and phases 5a-5c.
docs/POLICY-FORMAT.md: the format, fail-closed rules, canonical form, defaults and config, and how to get policies into the token.
Blueprint example src/test/resources/blueprints/qqq-policy-claim.yaml (pinned by a contract test in phase 5a; not loaded by the existing stack).

Docs only; no code.

🤖 Generated with Claude Code

Spec for the owner's request of 2026-10-13: create, edit, delete and query users and groups, plus IAM-style permission statements with a UI to build them. ## What changes in the design - **Owner decisions 17-22** (DESIGN.md section 0.1): policies are edited in QQQ and stored on Authentik groups; the statement model matches the existing IAM-style documents (Allow only; hasAccess/read/insert/edit/delete/*); the format belongs to this qbit with a configurable spec name; the editor UX; delete as an explicit action behind a new `DELETE` feature; the permission split (read / users / groups / policies, new `authentik.policies.manage`). - **New section 12**: storage (`qqq.io/policy` attribute, `authentik_policy` history table), how it reaches the session (scope mapping into the `qqq_policy` claim, `AuthentikPolicyClaimMapper`, resolver integration so the subset and last-admin rules see policy grants), config, the editor (catalog from metadata, matrix, live JSON, round-trip), CRUD additions, the Authentik permissions writes need, tests, and phases 5a-5c. - **docs/POLICY-FORMAT.md**: the format, fail-closed rules, canonical form, defaults and config, and how to get policies into the token. - **Blueprint example** `src/test/resources/blueprints/qqq-policy-claim.yaml` (pinned by a contract test in phase 5a; not loaded by the existing stack). Docs only; no code. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-actions Bot referenced this issue from a commit

2026-11-05 11:43:15 +00:00

Merge develop into release/0.1 for 0.1.0-RC.2

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#13