QRun-IO/qbit-authentik

0 Fork 0

WIP: feat(session): session policy declared in host code, checked against the Authentik provider #73

Draft

james.maes wants to merge 4 commits from feat/session-policy into develop

pull from: feat/session-policy

Author	SHA1	Message	Date
james.maesandClaude Fable 5.2	620dfccb7f	ci: re-run (run 7362 could not start Testcontainers: runner Docker networking error; unit tests passed) maven / build (push) Successful in 12m30s Details build / maven (push) Successful in 12m30s Details Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>	2026-11-10 12:43:40 -06:00
james.maesandClaude Fable 5.2	f19ddf83ee	docs(session): the idle timeout counts requests; example at 15 minutes maven / build (push) Failing after 1m33s Details build / maven (push) Failing after 1m33s Details Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>	2026-11-10 12:13:18 -06:00
james.maesandClaude Fable 5.2	5bf86725eb	fix(session): Authentik answers 403 when the account may view no provider maven / build (push) Successful in 11m39s Details build / maven (push) Successful in 11m39s Details Seen in the contract build on Authentik 2026.8.3: GET /providers/oauth2/ is refused (403), not empty, for a service account with no provider permission. The health check reports that as DOWN (unverified) with the grant to add, and the contract test expects the refusal before and after the temporary grant. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>	2026-11-10 11:40:03 -06:00
james.maesandClaude Fable 5.2	848378d3bc	feat(session): session policy declared in host code, checked against the Authentik provider maven / build (push) Failing after 11m58s Details build / maven (push) Failing after 11m58s Details AuthentikSessionPolicy states an idle timeout, an absolute maximum and the access-token lifetime. The config refuses numbers that cannot be enforced and an instance whose OAuth2 authentication does not carry them. The new authentik.session_policy health check reads the app's OAuth2 provider (validity settings and grant types only) and reports DEGRADED when it differs, DOWN when the service account cannot view it. Nothing is written to Authentik. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>	2026-11-10 11:24:22 -06:00