feat(crud): phase 5c full user and group CRUD #16

2026-10-13T18:56:28Z

KofTwentyTwo commented

2026-10-13 18:56:28 +00:00

(Migrated from github.com)

Phase 5c of DESIGN.md section 12.5: the rest of the owner's "create, edit, delete and query users and groups". It builds on #15.

What is in it

Edit User adds the username, which is validated and must be unique, and other attributes: a JSON object that replaces the non-reserved part.
- qqq.io/* and goauthentik.io/* keys are kept and cannot be set.
- Leaving the field blank keeps the attributes; {} removes them.
- Attributes are sensitive (spec 5.3), so they are shown on the form and editable only with authentik.audit.read.
Edit Group gets other attributes the same way.
Delete User and Delete Group are record actions behind the new DELETE feature, which is off by default and needs Authentik's delete_user / delete_group. Each action takes one record and needs a typed confirmation. They are refused for:
- yourself
- protected accounts and superuser groups
- the last identity administrator
- groups that still have members or child groups
A deleted group's authentik_policy row is removed too. Deactivate stays the default for people, and its help text says so.

Tests

CI=true ./mvnw verify: 197 unit tests and 44 contract tests on Authentik 2026.8.3, all green.

UserGroupCrudTest: username, attribute merge and refusals, the audit.read gate, group attributes, delete user and group with every refusal, feature and permission gating, prefill.
QbitWriteContractIT.deleteUserAndGroup: a group with members is refused; the user and the group are deleted on a real Authentik (404 afterwards).

🤖 Generated with Claude Code

Phase 5c of DESIGN.md section 12.5: the rest of the owner's "create, edit, delete and query users and groups". It builds on #15. ## What is in it - **Edit User** adds the username, which is validated and must be unique, and **other attributes**: a JSON object that replaces the non-reserved part. - `qqq.io/*` and `goauthentik.io/*` keys are kept and cannot be set. - Leaving the field blank keeps the attributes; `{}` removes them. - Attributes are sensitive (spec 5.3), so they are shown on the form and editable only with `authentik.audit.read`. - **Edit Group** gets other attributes the same way. - **Delete User** and **Delete Group** are record actions behind the new `DELETE` feature, which is off by default and needs Authentik's `delete_user` / `delete_group`. Each action takes one record and needs a typed confirmation. They are refused for: - yourself - protected accounts and superuser groups - the last identity administrator - groups that still have members or child groups A deleted group's `authentik_policy` row is removed too. Deactivate stays the default for people, and its help text says so. ## Tests `CI=true ./mvnw verify`: 197 unit tests and 44 contract tests on Authentik 2026.8.3, all green. - `UserGroupCrudTest`: username, attribute merge and refusals, the audit.read gate, group attributes, delete user and group with every refusal, feature and permission gating, prefill. - `QbitWriteContractIT.deleteUserAndGroup`: a group with members is refused; the user and the group are deleted on a real Authentik (404 afterwards). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#16