Merge develop into release/0.1 for 0.1.0-RC.13 #75

Merged

james.maes merged 5 commits from merge/develop-into-release-0-1-rc13 into release/0.1 2026-11-11 01:45:31 +00:00

Conversation 0 Commits 5 Files Changed 12

+923 -75

james.maes commented 2026-11-11 01:33:06 +00:00

Owner

Copy link

Copy source

Carries two fixes from develop to the release line:

• perf(policy): one permission universe per resolution; PolicyResult.replacement (PR 74). In-JVM probe on Forge's fixture, Echo operator plus device-admin: 46.5 ms and 68.3 MB down to 2.8 ms and 5.3 MB per resolution.
• fix(health): register the token_broker health check only when tokens are enabled.

Merging publishes 0.1.0-RC.13, pushes the bump commit and tags v0.1.0-RC.13. Nothing else may merge into release/0.1 until both exist.

🤖 Generated with Claude Code

Carries two fixes from develop to the release line: - perf(policy): one permission universe per resolution; PolicyResult.replacement (PR 74). In-JVM probe on Forge's fixture, Echo operator plus device-admin: 46.5 ms and 68.3 MB down to 2.8 ms and 5.3 MB per resolution. - fix(health): register the token_broker health check only when tokens are enabled. Merging publishes 0.1.0-RC.13, pushes the bump commit and tags v0.1.0-RC.13. Nothing else may merge into release/0.1 until both exist. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

james.maes added 5 commits 2026-11-11 01:33:06 +00:00

fix(health): register the token_broker health check only when tokens are enabled ... 82c79d69be

With AUTHENTIK_QBIT_TOKENS off the check could only ever report UNKNOWN
"not configured", and core has no way to remove a registered check, so the
health page showed a permanent UNKNOWN row. Register it only when
getTokensEnabled() is true; the other checks are unchanged.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Merge pull request 'fix(health): token_broker health check only when tokens are enabled' (#72) from fix/health-token-broker-develop into develop a3fa59efe7

perf(policy): one permission universe per resolution; PolicyResult.replacement ... 537e56d744

A host's authentication customizer runs on every request of a session. Policy
resolution read the live permission universe once for every Allow term, and each
reading recomputed the PolicyCatalog fingerprint, walked every catalog resource
and called every host-name function. A role of nine named permissions therefore
built nine universes per request; a full-access document built one.

- PolicyRules.allowed, resolve and withheld read the universe they are given once
  per call (PolicyUniverse.once), so resultFromClaims, fromClaims, both claims
  mappers, the access editor and AuthentikAdmin cost one universe per resolution
  whatever the policy holds. PolicyParser.parseForSave reads it once per document.
- PolicyCatalog.of compares the instance with the kept fingerprint piece by piece
  instead of building the fingerprint text on every call; the same content is
  compared, so every in-place metadata change still gives a new catalog on the
  next call. The catalog keeps its permission names and its part of the universe.
- Nothing is cached across resolutions: no universe, no decision. The catalog
  cache is per JVM and derived only from that JVM's instance, as before.
- PolicyResult.replacement(): the grant alone (Allow minus Deny), for a host whose
  sessions take their permissions only from the token. apply() is unchanged and
  remains a union with what the host passes.

Measured on a 1,400-object instance (212 tables, 985 processes, 199 widgets), one
resolution: 9 named permissions 12.1 ms and 7.9 MB to 0.33 ms and 0.12 MB; 30
named 28.7 ms and 25.3 MB to 0.32 ms and 0.14 MB; full access 1.19 ms and 1.37 MB
to 0.77 ms and 0.20 MB.

Tests: PolicyResolutionCostTest counts universe builds (1 for 1, 9 and 30 names,
0 for a void or absent claim), pins that one reading grants exactly what a reading
per term grants, and holds an allocation budget; PolicyCatalogTest changes every
fingerprinted aspect in place. The golden vectors are untouched and pass.

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

Merge pull request 'perf(policy): one permission universe per resolution; PolicyResult.replacement' (#74) from perf/policy-resolution-single-universe into develop 7fcf061455

Merge develop into release/0.1 for 0.1.0-RC.13 (one permission universe per resolution; token_broker check only when tokens are enabled) ... c3ca9c8ffc

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

james.maes merged commit 0b5a59badb into release/0.1 2026-11-11 01:45:31 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

architecture

Architecture review: coupling, cohesion, UI API

bug

Something isn't working

dependencies

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

github_actions

Pull requests that update GitHub Actions code

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

java

Pull requests that update java code

question

Further information is requested

release:rc

Merging this develop PR cuts the next release candidate

secuurity

wontfix

This will not be worked on

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

forge-recovery (Forge Recovery) james.maes (James Maes)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: QRun-IO/qbit-authentik#75