feat(permissions): Authentik permissions for automated sessions #22

Merged

KofTwentyTwo merged 1 commits from feature/mapper-automated-sessions into develop

2026-10-14 00:55:16 +00:00

Author	SHA1	Message	Date
james.maesandClaude Opus 5.5	f151a7344a	feat(permissions): Authentik permissions for automated sessions AuthentikGroupPermissionMapper implements customizeAutomatedSessionForUser. Server-minted sessions (scheduled saved reports, SSH-key users of qbit-file-gateway) carry no token, so they got no Authentik permissions. The email idReference must match exactly one active Authentik user; that user's direct groups and ancestors go through the same resolver, static fallbacks and cut-over guard as sign-in. Anything else, or an unreadable API, grants only the static fallbacks. customizeSession is unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-13 19:48:33 -05:00

Author

SHA1

Message

Date

james.maesandClaude Opus 5.5

f151a7344a

feat(permissions): Authentik permissions for automated sessions

AuthentikGroupPermissionMapper implements customizeAutomatedSessionForUser.
Server-minted sessions (scheduled saved reports, SSH-key users of
qbit-file-gateway) carry no token, so they got no Authentik permissions.
The email idReference must match exactly one active Authentik user; that
user's direct groups and ancestors go through the same resolver, static
fallbacks and cut-over guard as sign-in. Anything else, or an unreadable
API, grants only the static fallbacks. customizeSession is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-13 19:48:33 -05:00