fix(naming): snake_case authentik_ tables and authentik.* permissions (owner naming rule) #6

2026-10-12T19:16:56Z

KofTwentyTwo commented

2026-10-12 19:16:56 +00:00

(Migrated from github.com)

Summary

Applies the owner naming rule (2026-10-12): "table names should always be lowercase and use _, and qbits should always be prefixed with their name". Matches spec QRun-IO/qqq#1065.

Before	After
`authentikUser`	`authentik_user`
`authentikGroup`	`authentik_group`
`authentikGroupMember`	`authentik_group_member`
`authentikSession`	`authentik_session`
`authentikEvent`	`authentik_event`

New AuthentikQBitConfig.applyTablePrefix(name) = snake(prefix) + "_" + snake(name), plus a toSnakeCase helper. A custom prefix myAuth gives my_auth_user.
applyPrefix keeps the camelCase join for non-table names (app authentikAdmin, widget authentikDriftReport, backend authentikApi, processes), as spec #1065 §3.2 says. It is a separate method rather than a change to applyPrefix, so those names do not change.
@Deprecated AuthentikTables.LEGACY_*_TABLE_NAME constants hold the old names.
UPGRADE.md covers stored references: permissions, saved views and reports, audit_table.name, and links. The tables are API-backed, so there is no DDL.
README, CHANGELOG and docs/DESIGN.md now use the new names.
Permissions renamed identity.* → authentik.*, keeping the same suffixes. This follows the spec amendment in qqq 8ee607610. The new deprecated IdentityPermission.LEGACY_PREFIX, LEGACY_WILDCARD and getLegacyShortName() hold the old names. Legacy names are never granted: the resolver reports them as unknown and the drift report warns about them. UPGRADE.md covers updating the qqq.io/permissions group attributes before deploying, plus sample SQL for grants a host stores. The identity-admins group and the "Identity" app label are unchanged. The qbit has no security key types or PVS yet.

Unreleased: develop is 0.1.0-SNAPSHOT with no tags, and the only adopter is kof22's unmerged #94.

Tests

./mvnw clean verify is green locally: 72 unit tests and 31 integration/contract tests (Authentik 2026.8.3), 0 failures.

New: toSnakeCase cases (camel, Pascal, already-snake, acronym, digit, null and empty), and applyTablePrefix with the default, empty and custom camelCase prefix.
New: IdentityPermissionTest, and a resolver test showing legacy identity.* grants are reported as unknown and grant nothing.
Producer, contract and table tests now use the new names. namespaceBecomesPrefix now expects idp_user.

🤖 Generated with Claude Code

## Summary Applies the owner naming rule (2026-10-12): "table names should always be lowercase and use _, and qbits should always be prefixed with their name". Matches spec QRun-IO/qqq#1065. | Before | After | |---|---| | `authentikUser` | `authentik_user` | | `authentikGroup` | `authentik_group` | | `authentikGroupMember` | `authentik_group_member` | | `authentikSession` | `authentik_session` | | `authentikEvent` | `authentik_event` | - New `AuthentikQBitConfig.applyTablePrefix(name)` = `snake(prefix) + "_" + snake(name)`, plus a `toSnakeCase` helper. A custom prefix `myAuth` gives `my_auth_user`. - `applyPrefix` keeps the camelCase join for **non-table** names (app `authentikAdmin`, widget `authentikDriftReport`, backend `authentikApi`, processes), as spec #1065 §3.2 says. It is a separate method rather than a change to `applyPrefix`, so those names do not change. - `@Deprecated AuthentikTables.LEGACY_*_TABLE_NAME` constants hold the old names. - `UPGRADE.md` covers stored references: permissions, saved views and reports, `audit_table.name`, and links. The tables are API-backed, so there is no DDL. - README, CHANGELOG and docs/DESIGN.md now use the new names. - **Permissions renamed `identity.*` → `authentik.*`**, keeping the same suffixes. This follows the spec amendment in qqq 8ee607610. The new deprecated `IdentityPermission.LEGACY_PREFIX`, `LEGACY_WILDCARD` and `getLegacyShortName()` hold the old names. Legacy names are never granted: the resolver reports them as unknown and the drift report warns about them. `UPGRADE.md` covers updating the `qqq.io/permissions` group attributes before deploying, plus sample SQL for grants a host stores. The `identity-admins` group and the "Identity" app label are unchanged. The qbit has no security key types or PVS yet. Unreleased: develop is 0.1.0-SNAPSHOT with no tags, and the only adopter is kof22's unmerged #94. ## Tests `./mvnw clean verify` is green locally: 72 unit tests and 31 integration/contract tests (Authentik 2026.8.3), 0 failures. - New: `toSnakeCase` cases (camel, Pascal, already-snake, acronym, digit, null and empty), and `applyTablePrefix` with the default, empty and custom camelCase prefix. - New: `IdentityPermissionTest`, and a resolver test showing legacy `identity.*` grants are reported as unknown and grant nothing. - Producer, contract and table tests now use the new names. `namespaceBecomesPrefix` now expects `idp_user`. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#6