Phase 1: read-only MVP (memberships, sessions, events, effective permissions, drift report, mapper)

Conversation 1 Commits 2 Files Changed 49

+5942 -242

2 Commits

Author	SHA1	Message	Date
james.maesandClaude Opus 5.5	3fde306601	feat: group permission mapper; harden phase 0/1 after code review - AuthentikGroupPermissionMapper: token groups claim -> QQQ permissions via the group graph and resolver; static fallbacks and bootstrapOperators; Authentik unreachable grants only the fallbacks, never everything. - Review fixes (general and silent-failure reviews): - plain-text-only search, because Authentik's QLSearch could reach sensitive fields - thread-safe group graph - a failed group-graph read shows "Unavailable", not empty permissions - malformed qqq.io/* attributes are reported by the drift report - operator filters may not widen the user scope; membership rows are always scope-checked - a missing pagination object is an error - sorting by the key falls back to the default; strict booleans; ".." keys refused - https required except loopback / allowInsecureHttp; groupScopeNamePrefix refused until implemented - drift: unrunnable checks are ERROR "result unknown"; service-account tokens filtered server-side, zero visible is a warning; deleted or vanished targets flagged; only human users count as identity admins; break-glass re-checked client-side - redact error bodies before flattening; version check retried after a failed fetch - rehearse-phase0.sh: portable under Git Bash, waits for both blueprints, derived is_superuser; passed on a synthetic production-like dump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 20:42:54 -05:00
james.maesandClaude Opus 5.5	1f0575ce26	feat: phase 1 read-only MVP (memberships, sessions, events, effective permissions, drift report) - authentikGroupMember: virtual membership table served from a group (include_users), a user (groups_obj) or a bounded sweep; filters by group pk/name, user pk/username or key; user scope checked per member. - authentikSession and authentikEvent, behind identity.audit.read. - GroupGraph + EffectivePermissionResolver: groups and inherited parents to QQQ permissions; identity.* and catalog wildcards expanded, unknown names reported and never granted. Groups show inherited superuser status and effective permissions; users show effective permissions. - Identity drift report widget (identity.admin): version, blueprint status, service-account shape and self-minted tokens, break-glass, last identity admin, qqq.io/* attribute validity, and service-account changes to protected or superuser objects. - Contract tests on Authentik 2026.8.3 (real session via the flow executor; the drift report flags SuperuserFloorIT's lockout probes) and recorded fixtures for the new unit tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-11 20:17:01 -05:00

Author

SHA1

Message

Date

james.maesandClaude Opus 5.5

3fde306601

feat: group permission mapper; harden phase 0/1 after code review

- AuthentikGroupPermissionMapper: token groups claim -> QQQ permissions via
  the group graph and resolver; static fallbacks and bootstrapOperators;
  Authentik unreachable grants only the fallbacks, never everything.
- Review fixes (general and silent-failure reviews):
  - plain-text-only search, because Authentik's QLSearch could reach
    sensitive fields
  - thread-safe group graph
  - a failed group-graph read shows "Unavailable", not empty permissions
  - malformed qqq.io/* attributes are reported by the drift report
  - operator filters may not widen the user scope; membership rows are
    always scope-checked
  - a missing pagination object is an error
  - sorting by the key falls back to the default; strict booleans; ".."
    keys refused
  - https required except loopback / allowInsecureHttp; groupScopeNamePrefix
    refused until implemented
  - drift: unrunnable checks are ERROR "result unknown"; service-account
    tokens filtered server-side, zero visible is a warning; deleted or
    vanished targets flagged; only human users count as identity admins;
    break-glass re-checked client-side
  - redact error bodies before flattening; version check retried after a
    failed fetch
- rehearse-phase0.sh: portable under Git Bash, waits for both blueprints,
  derived is_superuser; passed on a synthetic production-like dump.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-11 20:42:54 -05:00

james.maesandClaude Opus 5.5

1f0575ce26

feat: phase 1 read-only MVP (memberships, sessions, events, effective permissions, drift report)

- authentikGroupMember: virtual membership table served from a group
  (include_users), a user (groups_obj) or a bounded sweep; filters by group
  pk/name, user pk/username or key; user scope checked per member.
- authentikSession and authentikEvent, behind identity.audit.read.
- GroupGraph + EffectivePermissionResolver: groups and inherited parents to
  QQQ permissions; identity.* and catalog wildcards expanded, unknown names
  reported and never granted. Groups show inherited superuser status and
  effective permissions; users show effective permissions.
- Identity drift report widget (identity.admin): version, blueprint status,
  service-account shape and self-minted tokens, break-glass, last identity
  admin, qqq.io/* attribute validity, and service-account changes to
  protected or superuser objects.
- Contract tests on Authentik 2026.8.3 (real session via the flow executor;
  the drift report flags SuperuserFloorIT's lockout probes) and recorded
  fixtures for the new unit tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-11 20:17:01 -05:00

Phase 1: read-only MVP (memberships, sessions, events, effective permissions, drift report, mapper) #2