QRun-IO/qbit-authentik
3
0 Fork 0
Code Issues Pull Requests 6 Actions Packages Projects Releases 8 Wiki Activity

docs(spec): access tokens as QQQ's personal access tokens (revision 6) #21

Merged
KofTwentyTwo merged 2 commits from feature/token-spec into develop 2026-10-14 01:01:46 +00:00
Conversation 0 Commits 2 Files Changed 3
+318 -7
KofTwentyTwo commented 2026-10-14 00:42:43 +00:00 (Migrated from github.com)
Copy link
Copy source

Summary

  • DESIGN.md revision 6: owner decisions (2026-10-13) 23-30 and a new section 13, "Access tokens". Authentik tokens, managed through this qbit, are QQQ's personal access token solution. TOKENS is on by default with writes enabled, with an opt-out.
  • Decision 30 is the owner-approved (coordinator-approved) mechanism revision. In Authentik 2026.8.3, TokenViewSet.perform_create always assigns a non-superuser's new token to the caller, so add_token cannot mint tokens for anyone else. Tokens for people are therefore created as that person, through RFC 8693 token exchange via a qqq-<appKey>-token-broker provider that has a deny policy for protected users. Service accounts use service_account, set_key and PATCH; every PATCH sends intent, user and expires, and a race guard re-reads the token afterwards.
  • Guardrails (a)-(f), optional per-token scopes (the authentik_token_scope table, a signed qqq_token claim and core QCredentialScope, qqq#1153), the one-time key (core OneTimeSecret, qqq#1162 plus a process-output PR), reminders, last used, admin views and the delivery phases.
  • New docs/ACCESS-TOKENS.md, "Using access tokens".

Test plan

  • Docs only; links checked.

🤖 Generated with Claude Code

## Summary - DESIGN.md revision 6: owner decisions (2026-10-13) 23-30 and a new section 13, "Access tokens". Authentik tokens, managed through this qbit, are QQQ's personal access token solution. TOKENS is on by default with writes enabled, with an opt-out. - Decision 30 is the owner-approved (coordinator-approved) mechanism revision. In Authentik 2026.8.3, `TokenViewSet.perform_create` always assigns a non-superuser's new token to the caller, so `add_token` cannot mint tokens for anyone else. Tokens for people are therefore created *as that person*, through RFC 8693 token exchange via a `qqq-<appKey>-token-broker` provider that has a deny policy for protected users. Service accounts use `service_account`, `set_key` and `PATCH`; every `PATCH` sends `intent`, `user` and `expires`, and a race guard re-reads the token afterwards. - Guardrails (a)-(f), optional per-token scopes (the `authentik_token_scope` table, a signed `qqq_token` claim and core `QCredentialScope`, qqq#1153), the one-time key (core `OneTimeSecret`, qqq#1162 plus a process-output PR), reminders, last used, admin views and the delivery phases. - New `docs/ACCESS-TOKENS.md`, "Using access tokens". ## Test plan - [x] Docs only; links checked. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
architecture
Architecture review: coupling, cohesion, UI API
 bug
Something isn't working
 dependencies
documentation
Improvements or additions to documentation
 duplicate
This issue or pull request already exists
 enhancement
New feature or request
 github_actions
Pull requests that update GitHub Actions code
 good first issue
Good for newcomers
 help wanted
Extra attention is needed
 invalid
This doesn't seem right
 java
Pull requests that update java code
 question
Further information is requested
 release:rc
Merging this develop PR cuts the next release candidate
 secuurity
wontfix
This will not be worked on
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
forge-recovery (Forge Recovery) james.maes (James Maes)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#21