feat(tokens): scopes, last used, reminders and admin views (phase 6c) #26

2026-10-14T03:27:07Z

KofTwentyTwo commented

2026-10-14 03:27:07 +00:00

(Migrated from github.com)

Phase 6c of access tokens (DESIGN.md §13.5, §13.8, §13.10). The base is feature/token-management (#24), and it retargets to develop when that merges.

Scopes. Create Token accepts read only, apps and tables when tokenScopesEnabled is on. The input is validated against the instance and the operator's own access, so a scope can only narrow.
- AuthentikTokenScopes reads the signed qqq_token claim in AuthentikGroupPermissionMapper and AuthentikPolicyClaimMapper. Hosts with their own customizer call AuthentikTokenScopes.apply(session, claims).
- Fail-closed rules: no scope row means unscoped; a deleted token gets no permissions; any verification failure gets no permissions.
- STAND-IN for core QCredentialScope (qqq#1168, RC.7): until then the session's permissions are intersected with the scope. The core scope is attached by reflection when it exists, with empty dimensions passed as null (unrestricted).
Last used comes from Authentik login events (method: token, a 90-day window, cached 5 minutes). createdAt and scopeSummary come from the scope row.
Reminders. A daily job sends reminders 7 days and 1 day before expiry through the optional Alerts producer, deduplicated on the scope row. There is also a guard-bypass alert.
Admin widget on the app home (authentik.tokens.manage): tokens by owner and by age, tokens unused for tokenUnusedDays, and tokens of deactivated owners. Bulk Revoke Token is available on the list.

Tests: TokenScopesTest, TokenOperationsTest, and updates to the token, process and app tests. ./mvnw verify -DskipITs: 263 tests, JaCoCo 90.38%.

🤖 Generated with Claude Code

Phase 6c of access tokens (DESIGN.md §13.5, §13.8, §13.10). The base is `feature/token-management` (#24), and it retargets to develop when that merges. - **Scopes.** *Create Token* accepts read only, apps and tables when `tokenScopesEnabled` is on. The input is validated against the instance and the operator's own access, so a scope can only narrow. - `AuthentikTokenScopes` reads the signed `qqq_token` claim in `AuthentikGroupPermissionMapper` and `AuthentikPolicyClaimMapper`. Hosts with their own customizer call `AuthentikTokenScopes.apply(session, claims)`. - Fail-closed rules: no scope row means unscoped; a deleted token gets no permissions; any verification failure gets no permissions. - STAND-IN for core `QCredentialScope` (qqq#1168, RC.7): until then the session's permissions are intersected with the scope. The core scope is attached by reflection when it exists, with empty dimensions passed as null (unrestricted). - **Last used** comes from Authentik login events (`method: token`, a 90-day window, cached 5 minutes). `createdAt` and `scopeSummary` come from the scope row. - **Reminders.** A daily job sends reminders 7 days and 1 day before expiry through the optional Alerts producer, deduplicated on the scope row. There is also a guard-bypass alert. - **Admin widget** on the app home (`authentik.tokens.manage`): tokens by owner and by age, tokens unused for `tokenUnusedDays`, and tokens of deactivated owners. Bulk *Revoke Token* is available on the list. Tests: `TokenScopesTest`, `TokenOperationsTest`, and updates to the token, process and app tests. `./mvnw verify -DskipITs`: 263 tests, JaCoCo 90.38%. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-actions Bot referenced this issue from a commit

2026-11-05 11:43:16 +00:00

Merge develop into release/0.1 for 0.1.0-RC.4 (#23 #24 #26 #27)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#26