feat(maintenance): applyPolicy runs as the maintenance service principal #38

2026-10-16T13:21:47Z

KofTwentyTwo commented

2026-10-16 13:21:47 +00:00

(Migrated from github.com)

Part of the service-identity work, QRun-IO/qqq#1248 (approved, D1–D6). Draft: it needs the QQQ release that contains qqq#1255 and #1256. When the release captain cuts that RC, bump qqq.snapshot.version to it and mark this ready.

Change

AuthentikMaintenance.applyPolicy no longer builds the self-made MaintenanceSession, which granted itself policies.manage plus the document's grants. Under OAuth2 that session was rejected, so the kof22 identityAdminsFullAccess run-once failed at its audit insert.
It now runs as the host's declared maintenance service principal (AuthentikQBitConfig.maintenancePrincipal, default maintenance). Under OAuth2 that means a real client_credentials token for its Authentik service account, so the account's group policy decides what it may do. The subset rule, protection, readOnly, feature, stale and two-person checks are unchanged.
Audit: the operator is service:maintenance. The job name (run-once:…) prefixes the reason in the admin-action row and the Authentik event.
AuthentikAdmin.operator() never resolves a service principal as an Authentik user by email.

Tests:

AuthentikMaintenanceTest: 11, against a local install of qqq#1256.
New test: an undeclared principal, or one without the grants, writes nothing.
Full suite: 318, 0 failures.

🤖 Generated with Claude Code

Part of the service-identity work, QRun-IO/qqq#1248 (approved, D1–D6). **Draft:** it needs the QQQ release that contains qqq#1255 and #1256. When the release captain cuts that RC, bump `qqq.snapshot.version` to it and mark this ready. **Change** - `AuthentikMaintenance.applyPolicy` no longer builds the self-made `MaintenanceSession`, which granted itself `policies.manage` plus the document's grants. Under OAuth2 that session was rejected, so the kof22 `identityAdminsFullAccess` run-once failed at its audit insert. - It now runs as the host's declared **maintenance** service principal (`AuthentikQBitConfig.maintenancePrincipal`, default `maintenance`). Under OAuth2 that means a real client_credentials token for its Authentik service account, so the account's group policy decides what it may do. The subset rule, protection, readOnly, feature, stale and two-person checks are unchanged. - **Audit:** the operator is `service:maintenance`. The job name (`run-once:…`) prefixes the reason in the admin-action row and the Authentik event. - `AuthentikAdmin.operator()` never resolves a service principal as an Authentik user by email. **Tests:** - `AuthentikMaintenanceTest`: 11, against a local install of qqq#1256. - New test: an undeclared principal, or one without the grants, writes nothing. - Full suite: 318, 0 failures. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

gitea-actions Bot referenced this issue from a commit

2026-11-05 11:43:17 +00:00

Merge develop into release/0.1 for 0.1.0-RC.8 (#37 broker probe, #38 maintenance service principal, #39 mapper drift message; QQQ RC.19)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#38