feat(help): guided empty states for every authentik table #33

2026-10-14T21:44:55Z

KofTwentyTwo commented

2026-10-14 21:44:55 +00:00

(Migrated from github.com)

Audit result

No table in this qbit needs seeding, and none is half-wired. The tables are of two kinds.

API-backed (read live from Authentik, no rows of their own): user, group, group_member (virtual), session, event, application, policy_binding, blueprint, role, token, invitation. Used through the Authentik API backend (AuthentikActionUtil); the guardrail checks each is on that backend and has an API spec.

Local (the qbit's own records, written only by the qbit):

table	used by	seeded	notes
authentik_admin_action	`AdminActionAuditor` (insert before every call, update after)	no: log	`authentik_event_pk` is written by `AuthentikAdmin` after the audit event is posted and asserted in `AuthentikAdminTest`; it is a cross-reference to the Authentik event for a human, now said so in the help
authentik_approval_request	`AuthentikAdmin` (insert, query, decide)	no: log
authentik_policy	`PolicyStore` (save on Edit Policy)	no: history
authentik_token_scope	`TokenScopeStore` / `AuthentikTokens`	no: history

Setup comes from AuthentikQBitConfig, and the home's "Needs attention" card already covers the setup items (bootstrap operators, read-only mode, token expiry), so no Setup card was added: it would repeat them.

What changed

help/qbit-authentik.yaml: app help plus one entry per table (15), each with a summary (120 chars or less) and "How rows get created". API-backed tables say rows are read live and what an empty list means (no permission, feature or invitation flow not enabled, or Authentik has none; read-only mode only blocks changes).
AuthentikHelp (stand-in for core #1198) applied at the end of produce(); fills only empty slots, follows the host's tableNamePrefix.
AuthentikTablesGuardrailTest: every produced authentik_* table is known; API tables count as used through their backend; local tables must be referenced by non-metadata runtime code; each has help with "How rows get created" and "an empty list/table means"; a prefixed host and host-owned help are covered.
README, UPGRADE, CHANGELOG.

Tests

./mvnw -o verify -DskipITs: 296 tests, 0 failures, guardrails and checkstyle green, BUILD SUCCESS. Contract ITs (Docker) not run.

Not done

No seeded-defaults test and no changelog: nothing to seed.

🤖 Generated with Claude Code

## Audit result No table in this qbit needs seeding, and none is half-wired. The tables are of two kinds. **API-backed (read live from Authentik, no rows of their own):** user, group, group_member (virtual), session, event, application, policy_binding, blueprint, role, token, invitation. Used through the Authentik API backend (`AuthentikActionUtil`); the guardrail checks each is on that backend and has an API spec. **Local (the qbit's own records, written only by the qbit):** | table | used by | seeded | notes | |---|---|---|---| | authentik_admin_action | `AdminActionAuditor` (insert before every call, update after) | no: log | `authentik_event_pk` is written by `AuthentikAdmin` after the audit event is posted and asserted in `AuthentikAdminTest`; it is a cross-reference to the Authentik event for a human, now said so in the help | | authentik_approval_request | `AuthentikAdmin` (insert, query, decide) | no: log | | | authentik_policy | `PolicyStore` (save on Edit Policy) | no: history | | | authentik_token_scope | `TokenScopeStore` / `AuthentikTokens` | no: history | | Setup comes from `AuthentikQBitConfig`, and the home's "Needs attention" card already covers the setup items (bootstrap operators, read-only mode, token expiry), so no Setup card was added: it would repeat them. ## What changed - `help/qbit-authentik.yaml`: app help plus one entry per table (15), each with a summary (120 chars or less) and "How rows get created". API-backed tables say rows are read live and what an empty list means (no permission, feature or invitation flow not enabled, or Authentik has none; read-only mode only blocks changes). - `AuthentikHelp` (stand-in for core #1198) applied at the end of `produce()`; fills only empty slots, follows the host's `tableNamePrefix`. - `AuthentikTablesGuardrailTest`: every produced `authentik_*` table is known; API tables count as used through their backend; local tables must be referenced by non-metadata runtime code; each has help with "How rows get created" and "an empty list/table means"; a prefixed host and host-owned help are covered. - README, UPGRADE, CHANGELOG. ## Tests `./mvnw -o verify -DskipITs`: 296 tests, 0 failures, guardrails and checkstyle green, BUILD SUCCESS. Contract ITs (Docker) not run. ## Not done - No seeded-defaults test and no changelog: nothing to seed. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-actions Bot referenced this issue from a commit

2026-11-05 11:43:16 +00:00

Merge develop into release/0.1 for 0.1.0-RC.6 (#33 help and guardrail)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#33