feat(policy): phase 5a policy model, parser, generator and runtime mapper #14

Merged

KofTwentyTwo merged 1 commits from feature/policy-model into develop

2026-10-13 18:44:05 +00:00

Author	SHA1	Message	Date
james.maesandClaude Opus 5.5	616e3a8135	feat(policy): phase 5a policy model, parser, generator and runtime mapper - PolicyParser (fail closed), PolicyGenerator (canonical form, round-trip check), PolicyFormat and config (policySpec/Version/Attribute/Claim, policyTwoPersonApproval). - AuthentikPolicyClaimMapper and PolicyPermissions for the token claim, with an applySecurityKeys hook for record locks; AuthentikGroupPermissionMapper adds the claim too. - GroupGraph and EffectivePermissionResolver read each group's qqq.io/policy, so effective permissions, the subset rule and the last-admin check see policy grants; an invalid policy is listed as malformed. - PolicyClaimMappingIT pins the scope-mapping blueprint example on Authentik 2026.8.3. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 13:34:38 -05:00

Author

SHA1

Message

Date

james.maesandClaude Opus 5.5

616e3a8135

feat(policy): phase 5a policy model, parser, generator and runtime mapper

- PolicyParser (fail closed), PolicyGenerator (canonical form, round-trip
  check), PolicyFormat and config (policySpec/Version/Attribute/Claim,
  policyTwoPersonApproval).
- AuthentikPolicyClaimMapper and PolicyPermissions for the token claim, with
  an applySecurityKeys hook for record locks; AuthentikGroupPermissionMapper
  adds the claim too.
- GroupGraph and EffectivePermissionResolver read each group's qqq.io/policy,
  so effective permissions, the subset rule and the last-admin check see
  policy grants; an invalid policy is listed as malformed.
- PolicyClaimMappingIT pins the scope-mapping blueprint example on Authentik
  2026.8.3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-13 13:34:38 -05:00