feat(policy): member preview payload for the policy editor #29

2026-10-14T17:13:22Z

KofTwentyTwo commented

2026-10-14 17:13:22 +00:00

(Migrated from github.com)

Owner request: in Edit Policy, pick a group member and see that person's effective permissions with the policy being edited, and what the edit adds or removes.

The AUTHENTIK_POLICY_EDITOR payload now carries:
- members: [{username, label, viaGroups, basePermissions}]: direct and descendant-group members, active and in scope, sorted, capped at 200;
- membersTruncated;
- mapperEnabled.
basePermissions is the member's sign-in grant computed without this group's qqq.io/policy. It still counts this group's qqq.io/permissions, other groups' policies, static floors and bootstrap subjects. It is computed with the same rules as the mapper (AccessComparison.mapperPermissions, plus a new exclude-one-policy resolution in EffectivePermissionResolver).
Loading requires authentik.policies.manage.
The Next side (feature checkboxes, round-trip of feature actions, and the member preview panel) is in qqq-frontend-next feature/policy-editor-features. Older Next builds ignore the new fields.

Tests: 273 unit tests pass, with JaCoCo at 91.33%. New cases cover members through a child group, the exclusion of this group's policy, the static floor, inactive users being skipped, truncation and mapperEnabled.

🤖 Generated with Claude Code

Owner request: in **Edit Policy**, pick a group member and see that person's effective permissions with the policy being edited, and what the edit adds or removes. - The `AUTHENTIK_POLICY_EDITOR` payload now carries: - `members: [{username, label, viaGroups, basePermissions}]`: direct and descendant-group members, active and in scope, sorted, capped at 200; - `membersTruncated`; - `mapperEnabled`. - `basePermissions` is the member's sign-in grant computed without this group's `qqq.io/policy`. It still counts this group's `qqq.io/permissions`, other groups' policies, static floors and bootstrap subjects. It is computed with the same rules as the mapper (`AccessComparison.mapperPermissions`, plus a new exclude-one-policy resolution in `EffectivePermissionResolver`). - Loading requires `authentik.policies.manage`. - The Next side (feature checkboxes, round-trip of feature actions, and the member preview panel) is in qqq-frontend-next `feature/policy-editor-features`. Older Next builds ignore the new fields. Tests: 273 unit tests pass, with JaCoCo at 91.33%. New cases cover members through a child group, the exclusion of this group's policy, the static floor, inactive users being skipped, truncation and `mapperEnabled`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#29