QRun-IO/qbit-authentik
3
0 Fork 0
Code Issues Pull Requests 6 Actions Packages Projects Releases 8 Wiki Activity

feat: v1 - full user lifecycle and group/permission management (phases 2-3) #12

Merged
KofTwentyTwo merged 5 commits from feature/v1-lifecycle into develop 2026-10-12 23:18:35 +00:00
Conversation 0 Commits 5 Files Changed 51
+9196 -151
5 Commits
Author SHA1 Message Date
james.maesandClaude Sonnet 5.5 97fe594130 fix: records carry tableName (Next UI record screens), drift uuid, token expiry warning, review lines name targets 
Found by running the qbit in a real app with the Next UI against Authentik.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-10-12 18:01:49 -05:00
james.maesandClaude Sonnet 5.5 645f782e42 fix(security): bootstrap operators keyed on immutable ids, never email 
Users can change their own email in Authentik and emails are not unique, so
bootstrapOperators (emails) let a user become an identity operator by setting
their email to the owner's. Replaced by bootstrapOperatorSubjects: token sub
(email-looking subs ignored) or, with a verified email, the single active user
with that email whose pk or uuid is configured. Emails in config fail validation.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-10-12 17:02:09 -05:00
james.maesandClaude Sonnet 5.5 ebd56d6ca4 feat: write contract tests, docs, status; recovery email prerequisites 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-10-12 16:54:45 -05:00
james.maesandClaude Sonnet 5.5 c2a5c3265f test: admin service rules (in-memory Authentik), process tests; fix distinct count; prepare step records 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-10-12 16:27:42 -05:00
james.maesandClaude Sonnet 5.5 775e5ea7bd feat: write path scaffolding (guard authorization, admin service, safety rules, local tables, processes, home, relations) 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
 2026-10-12 16:16:21 -05:00