Develop holds phase 0 as one squash commit; this branch keeps its phase 1
work on top. Also drops the committed Python bytecode, as #1 did.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- AuthentikGroupPermissionMapper: token groups claim -> QQQ permissions via
the group graph and resolver; static fallbacks and bootstrapOperators;
Authentik unreachable grants only the fallbacks, never everything.
- Review fixes (general and silent-failure reviews):
- plain-text-only search, because Authentik's QLSearch could reach
sensitive fields
- thread-safe group graph
- a failed group-graph read shows "Unavailable", not empty permissions
- malformed qqq.io/* attributes are reported by the drift report
- operator filters may not widen the user scope; membership rows are
always scope-checked
- a missing pagination object is an error
- sorting by the key falls back to the default; strict booleans; ".."
keys refused
- https required except loopback / allowInsecureHttp; groupScopeNamePrefix
refused until implemented
- drift: unrunnable checks are ERROR "result unknown"; service-account
tokens filtered server-side, zero visible is a warning; deleted or
vanished targets flagged; only human users count as identity admins;
break-glass re-checked client-side
- redact error bodies before flattening; version check retried after a
failed fetch
- rehearse-phase0.sh: portable under Git Bash, waits for both blueprints,
derived is_superuser; passed on a synthetic production-like dump.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- authentikGroupMember: virtual membership table served from a group
(include_users), a user (groups_obj) or a bounded sweep; filters by group
pk/name, user pk/username or key; user scope checked per member.
- authentikSession and authentikEvent, behind identity.audit.read.
- GroupGraph + EffectivePermissionResolver: groups and inherited parents to
QQQ permissions; identity.* and catalog wildcards expanded, unknown names
reported and never granted. Groups show inherited superuser status and
effective permissions; users show effective permissions.
- Identity drift report widget (identity.admin): version, blueprint status,
service-account shape and self-minted tokens, break-glass, last identity
admin, qqq.io/* attribute validity, and service-account changes to
protected or superuser objects.
- Contract tests on Authentik 2026.8.3 (real session via the flow executor;
the drift report flags SuperuserFloorIT's lockout probes) and recorded
fixtures for the new unit tests.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- AuthentikQBitConfig (validated, secrets resolved by the qbit, never
serialized or printed) and AuthentikQBitProducer (API backend, read-only
authentikUser / authentikGroup tables, Identity app).
- AuthentikActionUtil on qqq-backend-module-api: bearer auth, page/page_size
paging with pagination.count, key lookups by GET, server-side user scope,
AuthentikFilterMapper (rejects whatever Authentik cannot evaluate),
10 rps token-bucket throttle, 429/5xx retries, error mapping, and logging
that never carries the token, query strings, successful GET bodies or
sensitive bodies (AuthentikRedactor).
- AuthentikGuard: identity.* read checks, sensitive fields behind
identity.audit.read, all writes refused in this release, protected-account
detection.
- Pinned Authentik 2026.8.3 schema, SchemaDriftTest / SchemaDriftIT over
the API surface used, and a weekly drift workflow against new releases.
- Testcontainers harness (Authentik server + worker, Postgres, Mailpit) with
the kof22-shaped blueprints, fixture recorder, and contract tests (b), (c),
(d), (h) plus the access-check, sign-in policy, webhook and token findings.
- Owner checklist, rehearsal script and blueprint lint for the cluster-gitops
migration (KofTwentyTwo/cluster-gitops#72).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
james.maesandClaude Opus 5.5