-
qbit-authentik 0.1.0-RC.8 Pre-Release
released this
2026-10-16 19:49:01 +00:00 | 38 commits to develop since this releaseDownloads
-
qbit-authentik 0.1.0-RC.7 Pre-Release
released this
2026-10-15 03:58:51 +00:00 | 51 commits to develop since this releaseqbit-authentik 0.1.0-RC.7 release candidate. RC.6 and earlier remain immutable. Requires QQQ 4.1.0-RC.8 or later.
Since RC.6
- feat(help): qbit-authentik help bundle via QQQ help bundles, with coverage gate (#34)
- feat(health): register Authentik API, token, mapper and broker checks with core central health (#31)
- fix(help): help bundle version comes from the build, not a hardcoded SNAPSHOT (#35)
The help bundle ships the qbit's in-app help through QQQ help bundles (core < qbit < host < user edit), so hosts no longer need staging copies.
No GA approval is implied.
The signed annotated tag
v0.1.0-RC.7fixes sourcef98dd97onrelease/0.1.Downloads
-
qbit-authentik 0.1.0-RC.6 Pre-Release
released this
2026-10-14 23:03:32 +00:00 | 63 commits to develop since this releaseqbit-authentik 0.1.0-RC.6 release candidate. RC.5 and earlier remain immutable. Requires QQQ 4.1.0-RC.6 or later.
Since RC.5
- Guided empty states and table help for every authentik table, with a guardrail test (#33).
No GA approval is implied.
The signed annotated tag
v0.1.0-RC.6fixes source0f9169bonrelease/0.1.Downloads
-
qbit-authentik 0.1.0-RC.5 Pre-Release
released this
2026-10-14 22:36:03 +00:00 | 68 commits to develop since this releaseqbit-authentik 0.1.0-RC.5 release candidate. RC.4 and earlier remain immutable. Requires QQQ 4.1.0-RC.6 or later.
Since RC.4
- Full access policy (#32): a statement with Action
*and Resource*means full access to all current and future resources. It is expanded whenever permissions are computed (sign-in, resolver, Compare Access, member preview). Also addswithFullAccessHostPermissionsandAuthentikMaintenance.applyPolicy, which lets reviewed host code set a group's policy as a named maintenance operator (audited, never as a system session). Resource*combined with any other action is rejected. - The policy editor widget payload now includes a member preview: the group's members, direct and inherited (#29). Next UI 1.0.0-RC.23 shows it.
- The startup log lists the effective features, so TOKENS shows as on by default (#30).
- CI: qqq-orb 0.6.9 (#28).
No GA approval is implied.
The signed annotated tag
v0.1.0-RC.5fixes sourceb228445onrelease/0.1.Downloads
- Full access policy (#32): a statement with Action
-
qbit-authentik 0.1.0-RC.4 Pre-Release
released this
2026-10-14 13:45:28 +00:00 | 81 commits to develop since this releaseqbit-authentik 0.1.0-RC.4 release candidate. RC.3 and earlier remain immutable. Requires QQQ 4.1.0-RC.6 or later.
Since RC.3
- Access-token management (DESIGN.md section 13, phase 6b) (#24)
- Token scopes, last used, reminders and admin views, following owner decision A (phase 6c) (#26)
- Built on QQQ 4.1.0-RC.5 (#23), then QQQ 4.1.0-RC.6 with core table feature permissions and guardrails enforced (#27)
No GA approval is implied.
The signed annotated tag
v0.1.0-RC.4fixes source04bc8c1onrelease/0.1.Downloads
-
qbit-authentik 0.1.0-RC.3 Pre-Release
released this
2026-10-13 20:13:12 +00:00 | 111 commits to develop since this releaseqbit-authentik
0.1.0-RC.3is published to Maven Central (com.kingsrook.qbits:qbit-authentik:0.1.0-RC.3) fromrelease/0.1on 2026-10-13. It adds the policy cut-over tooling (#18): enforcement status, Compare Access, the guard, and Generate Policy From Current Access. Everything in RC.2 is included. It has no SNAPSHOT dependencies. The Next UI policy editor widget ships in Next 1.0.0-RC.18. This is a prerelease.The signed annotated tag
v0.1.0-RC.3fixes sourceffc12a8(the orb's version bump onrelease/0.1).Downloads
-
qbit-authentik 0.1.0-RC.2 Pre-Release
released this
2026-10-13 19:37:18 +00:00 | 117 commits to develop since this releaseqbit-authentik
0.1.0-RC.2is published to Maven Central (com.kingsrook.qbits:qbit-authentik:0.1.0-RC.2) fromrelease/0.1on 2026-10-13. It contains the spec (#13) and phases #14–#16: the policy model, parser and generator, the runtime mapper, the policy editor, and user/group CRUD. Tests: 197 unit and 44 contract against Authentik 2026.8.3. It has no SNAPSHOT dependencies. The Next UI policy editor widget follows in Next 1.0.0-RC.18. This is a prerelease.The signed annotated tag
v0.1.0-RC.2fixes sourceb30a30c(the orb's version bump onrelease/0.1).Notes from the changelog:
Added (full user and group CRUD, phase 5c: DESIGN.md section 12.5)
- Edit User also changes the username (validated, unique) and the other attributes (a JSON object; reserved
qqq.io/andgoauthentik.io/keys are kept and cannot be set; blank leaves them as they are; editing attributes needsauthentik.audit.read, which is also what shows them on the form). Edit Group edits other attributes the same way. - Delete User and Delete Group record actions behind the new
DELETEfeature (off by default; needs Authentik'sdelete_user/delete_group). Typed confirmation; never yourself, a protected account, a superuser group or the last identity administrator; a group must have no members and no child groups first; the group'sauthentik_policyrow goes with it. Deactivate stays the default for people.
Added (policy editor, phase 5b: DESIGN.md section 12.4)
- Edit Policy record action on groups and on policies (feature
POLICIES, permissionauthentik.policies.manage): a standard streamed-ETL action whose step shows theAUTHENTIK_POLICY_EDITORwidget (Next UI). Review parses the submitted document (fail closed), regenerates it in canonical form with the round-trip check, refuses new resources this app does not define, applies the subset rule to the permissions it adds, and lists what is added and removed. Result merge-patchesqqq.io/policyinto the group's current attributes (removed when empty). Optional second-person approval (policyTwoPersonApproval). PolicyCatalog: every app, table, process (hidden record actions included), report and protected widget a policy can grant, with the actions QQQ checks, grouped by app. Its permission names join the permission catalog.authentik_policylocal table (one row per group; field-level audit is the change history; DDL indocs/schema.sql), in the nav under Access and as a child list on the group.- Widget
authentikPolicyEditor(typeAUTHENTIK_POLICY_EDITOR): the catalog and the group's live document, with a flag when it was changed in Authentik since the last save in QQQ.
Added (policies, phase 5a: DESIGN.md section 12, docs/POLICY-FORMAT.md)
- Policy documents (IAM-style statements) on Authentik groups:
PolicyParser(fails closed: unknown spec or version, non-Allow effect, unknown action, bad resource or malformed JSON grant nothing),PolicyGenerator(canonical form with a round-trip check),PolicyFormatand the configpolicySpec,policyVersion,policyAttribute,policyClaim,policyTwoPersonApproval. - Runtime:
AuthentikPolicyClaimMapper(reads theqqq_policyclaim from the ID token or access token;applySecurityKeyshook for record locks) andPolicyPermissions.fromClaimsfor a host's own customizer.AuthentikGroupPermissionMapperalso adds the claim, and the group graph andEffectivePermissionResolverread each group'sqqq.io/policy, so effective permissions, the subset rule and the last-admin check see policy grants. An invalid policy on a group is listed as malformed. - Blueprint example for the scope mapping that puts the merged policies into the token, pinned by
PolicyClaimMappingITon Authentik 2026.8.3.
Added (v1: full user lifecycle and group/permission management, phases 2-3)
- Writes through the Authentik API, behind the features
USERS,GROUPS,MEMBERSHIP,CREDENTIALSandSESSIONS(read-only stays the default;readOnlyis a hard kill switch). Every change goes throughAuthentikAdmin: it plans against live Authentik data (the guardrails of DESIGN.md 5.4), audits first, calls Authentik, posts acustom_qqq_admin_actionevent naming the operator, and finishes the audit row.AuthentikActionUtil.writeneeds aWriteAuthorization, which onlyAuthentikGuard.authorizecan mint. - Actions (table and record actions with Review and Result steps; none in the nav): Create User, Invite User, Edit User, Deactivate User, Reactivate User, Add To Group, Remove From Group, Send Password Reset Email, Reset MFA, Revoke App Passwords, Revoke Sessions, Create Group, Edit Group, Edit Permissions And App Access, Add Members, Remove Members, Cancel Invitation, Approve And Apply, Reject.
- Safety: the subset (no escalation) rule evaluated from the operator's live groups; protected accounts and superuser groups; no self-edits; last-administrator protection; reasons; typed confirmations (and a typed count above 25 targets); a 100-target cap; stale checks by fingerprint (groups have no
last_updated); attribute edits merge only theqqq.io/*keys into the current attributes; two-person approval for grantingauthentik.*. - Local tables
authentik_admin_action(append-only audit) andauthentik_approval_request(DDL indocs/schema.sql), on the newlocalBackendName. - Read tables
authentik_application,authentik_policy_binding,authentik_blueprint,authentik_role,authentik_token(metadata only, never a key) andauthentik_invitation. Sub-tables appear as child lists on their parents; the nav lists only the main tables. - Home: the
authentikHomewidget (needs attention, people, groups and permissions, recent changes, connection). - Config:
localBackendName(replacesmirrorBackendName),twoPersonApproval,schedulerName,linkPrefix. - Tests: an in-memory Authentik for the rules, process tests through
RunProcessAction, and write contract tests on Authentik 2026.8.3 (QbitWriteContractIT, including the recovery email arriving in Mailpit).
Security
bootstrapOperators(emails) is replaced bybootstrapOperatorSubjects(envAUTHENTIK_QBIT_BOOTSTRAP_SUBJECTS): users can change their own email in Authentik, so an email must never confer identity permissions. A bootstrap operator is now matched on the tokensub(email-looking subs ignored) or, with a verified email, on the single active Authentik user with that email whose pk or uuid is configured. Spoofed, duplicate or unverified emails are denied; entries containing@fail validation. The admin service uses the same rule.
Fixed
- Count reported no distinct count, so a process Review showed no total; group lists now include member pks (member counts were 0).
- Spec: multi-value filters are repeated plain names (
type=a&type=b), nevertype[]=a(which Authentik silently ignores); stale role-state,check_access, re-parenting-risk, private-repo and backend-name wording corrected (spec revision 4).
Not in this release
- The Authentik webhook, the local mirror tables and reconcile, the access-matrix widget, snapshot export, RBAC role management (phase 4) and the Alerts producer integration.
MIRROR,WEBHOOK,ACCESS_MATRIX,SNAPSHOT_EXPORTandRBACare refused by config validation.
Changed
- Permissions renamed
identity.*→authentik.*(same suffixes; owner naming rule, 2026-10-12; spec #1065 amended). Legacy names are reported as unknown and never granted. The old names are kept as@DeprecatedIdentityPermission.LEGACY_PREFIX/LEGACY_WILDCARD/getLegacyShortName(). Update theqqq.io/permissionsgroup attributes before deploying; see UPGRADE.md. - Table names are lowercase snake_case with the
authentik_prefix (owner naming rule, 2026-10-12):authentik_user,authentik_group,authentik_group_member,authentik_session,authentik_event(wereauthentikUser, ...). NewAuthentikQBitConfig.applyTablePrefixandtoSnakeCase; apps, widgets, the backend and processes keep camelCase names (authentikAdmin,authentikApi). The old names are kept as@DeprecatedAuthentikTables.LEGACY_*_TABLE_NAMEconstants. See UPGRADE.md.
Documentation
- README: "Adopting in another app" section (coordinates, configuration, secrets, permissions, limitations) linking the QQQ adoption checklist; examples use neutral names instead of one host's (#3).
Added (phase 1, read-only MVP)
- Tables:
authentik_group_member(virtual membership table: by group, by user, by key, or a bounded sweep),authentik_sessionandauthentik_event(both needauthentik.audit.read). GroupGraphandEffectivePermissionResolver: groups, including inherited parents, become QQQ permissions.authentik.*and catalog wildcards are expanded; unknown names are reported, never granted. Groups show inherited superuser status and effective permissions; users show effective permissions.AuthentikGroupPermissionMapper: an authentication customizer that turns the token'sgroupsclaim into QQQ session permissions through the resolver. It supports static fallbacks andbootstrapOperators; if Authentik cannot be read it grants only the static fallbacks, never everything.- Review hardening:
searchaccepts plain text only; Authentik's query language could reach sensitive fields.- The group graph is thread-safe.
- A failed group-graph read shows "Unavailable", never empty permissions.
- Malformed
qqq.io/*attributes are reported. - Operator filters can't widen the user scope, so count and query agree.
- Membership rows are always scope-checked.
- Missing pagination is an error.
- Sorting by the key falls back to the default order.
- Booleans are strict.
..keys are refused.- https is required (except loopback or
allowInsecureHttp). groupScopeNamePrefixis refused until implemented.- Drift checks that cannot run report ERROR ("result unknown"); service-account tokens are filtered server-side; deleted targets are flagged; only human users count as identity admins.
- Identity drift report widget (
authentik.admin). It checks the server version, blueprint status, the service account (type, groups, superuser, protection, extra self-minted tokens), break-glass presence, the last identity administrator,qqq.io/*attribute validity, and service-account changes to protected or superuser objects (lockout detection).
Added (phase 0)
- Phase 0 foundations:
AuthentikQBitConfig,AuthentikQBitProducer,AuthentikActionUtil(bearer auth, page/page_size paging, filter mapping that rejects unsupported filters, 10 rps token-bucket throttle, log redaction), read-only Users and Groups tables, Identity app. - Pinned Authentik 2026.8.3 OpenAPI schema and schema drift tests.
- Testcontainers contract tests against Authentik 2026.8.3 (bootstrap on an empty instance, superuser floor, blueprint re-apply safety, access-check behaviour) and a fixture recorder.
Downloads
- Edit User also changes the username (validated, unique) and the other attributes (a JSON object; reserved
-
qbit-authentik 0.1.0-RC.1 Pre-Release
released this
2026-10-12 23:49:20 +00:00 | 127 commits to develop since this releaseqbit-authentik
0.1.0-RC.1is the first release candidate of the Authentik qbit (manage Authentik users, groups and lifecycle from QQQ). It is published to Maven Central (com.kingsrook.qbits:qbit-authentik:0.1.0-RC.1) fromrelease/0.1on 2026-10-12. Design: qqq#1065, approved by the owner. It includes #12 (v1 lifecycle) and builds against QQQ 4.1.0-RC.4. This is a prerelease.The signed annotated tag
v0.1.0-RC.1fixes sourceede7cd9(the orb's version bump on the release branch).Notes from the changelog:
Added (v1: full user lifecycle and group/permission management, phases 2-3)
- Writes through the Authentik API, behind the features
USERS,GROUPS,MEMBERSHIP,CREDENTIALSandSESSIONS(read-only stays the default;readOnlyis a hard kill switch). Every change goes throughAuthentikAdmin: it plans against live Authentik data (the guardrails of DESIGN.md 5.4), audits first, calls Authentik, posts acustom_qqq_admin_actionevent naming the operator, and finishes the audit row.AuthentikActionUtil.writeneeds aWriteAuthorization, which onlyAuthentikGuard.authorizecan mint. - Actions (table and record actions with Review and Result steps; none in the nav): Create User, Invite User, Edit User, Deactivate User, Reactivate User, Add To Group, Remove From Group, Send Password Reset Email, Reset MFA, Revoke App Passwords, Revoke Sessions, Create Group, Edit Group, Edit Permissions And App Access, Add Members, Remove Members, Cancel Invitation, Approve And Apply, Reject.
- Safety: the subset (no escalation) rule evaluated from the operator's live groups; protected accounts and superuser groups; no self-edits; last-administrator protection; reasons; typed confirmations (and a typed count above 25 targets); a 100-target cap; stale checks by fingerprint (groups have no
last_updated); attribute edits merge only theqqq.io/*keys into the current attributes; two-person approval for grantingauthentik.*. - Local tables
authentik_admin_action(append-only audit) andauthentik_approval_request(DDL indocs/schema.sql), on the newlocalBackendName. - Read tables
authentik_application,authentik_policy_binding,authentik_blueprint,authentik_role,authentik_token(metadata only, never a key) andauthentik_invitation. Sub-tables appear as child lists on their parents; the nav lists only the main tables. - Home: the
authentikHomewidget (needs attention, people, groups and permissions, recent changes, connection). - Config:
localBackendName(replacesmirrorBackendName),twoPersonApproval,schedulerName,linkPrefix. - Tests: an in-memory Authentik for the rules, process tests through
RunProcessAction, and write contract tests on Authentik 2026.8.3 (QbitWriteContractIT, including the recovery email arriving in Mailpit).
Security
bootstrapOperators(emails) is replaced bybootstrapOperatorSubjects(envAUTHENTIK_QBIT_BOOTSTRAP_SUBJECTS): users can change their own email in Authentik, so an email must never confer identity permissions. A bootstrap operator is now matched on the tokensub(email-looking subs ignored) or, with a verified email, on the single active Authentik user with that email whose pk or uuid is configured. Spoofed, duplicate or unverified emails are denied; entries containing@fail validation. The admin service uses the same rule.
Fixed
- Count reported no distinct count, so a process Review showed no total; group lists now include member pks (member counts were 0).
- Spec: multi-value filters are repeated plain names (
type=a&type=b), nevertype[]=a(which Authentik silently ignores); stale role-state,check_access, re-parenting-risk, private-repo and backend-name wording corrected (spec revision 4).
Not in this release
- The Authentik webhook, the local mirror tables and reconcile, the access-matrix widget, snapshot export, RBAC role management (phase 4) and the Alerts producer integration.
MIRROR,WEBHOOK,ACCESS_MATRIX,SNAPSHOT_EXPORTandRBACare refused by config validation.
Changed
- Permissions renamed
identity.*→authentik.*(same suffixes; owner naming rule, 2026-10-12; spec #1065 amended). Legacy names are reported as unknown and never granted. The old names are kept as@DeprecatedIdentityPermission.LEGACY_PREFIX/LEGACY_WILDCARD/getLegacyShortName(). Update theqqq.io/permissionsgroup attributes before deploying; see UPGRADE.md. - Table names are lowercase snake_case with the
authentik_prefix (owner naming rule, 2026-10-12):authentik_user,authentik_group,authentik_group_member,authentik_session,authentik_event(wereauthentikUser, ...). NewAuthentikQBitConfig.applyTablePrefixandtoSnakeCase; apps, widgets, the backend and processes keep camelCase names (authentikAdmin,authentikApi). The old names are kept as@DeprecatedAuthentikTables.LEGACY_*_TABLE_NAMEconstants. See UPGRADE.md.
Documentation
- README: "Adopting in another app" section (coordinates, configuration, secrets, permissions, limitations) linking the QQQ adoption checklist; examples use neutral names instead of one host's (#3).
Added (phase 1, read-only MVP)
- Tables:
authentik_group_member(virtual membership table: by group, by user, by key, or a bounded sweep),authentik_sessionandauthentik_event(both needauthentik.audit.read). GroupGraphandEffectivePermissionResolver: groups, including inherited parents, become QQQ permissions.authentik.*and catalog wildcards are expanded; unknown names are reported, never granted. Groups show inherited superuser status and effective permissions; users show effective permissions.AuthentikGroupPermissionMapper: an authentication customizer that turns the token'sgroupsclaim into QQQ session permissions through the resolver. It supports static fallbacks andbootstrapOperators; if Authentik cannot be read it grants only the static fallbacks, never everything.- Review hardening:
searchaccepts plain text only; Authentik's query language could reach sensitive fields.- The group graph is thread-safe.
- A failed group-graph read shows "Unavailable", never empty permissions.
- Malformed
qqq.io/*attributes are reported. - Operator filters can't widen the user scope, so count and query agree.
- Membership rows are always scope-checked.
- Missing pagination is an error.
- Sorting by the key falls back to the default order.
- Booleans are strict.
..keys are refused.- https is required (except loopback or
allowInsecureHttp). groupScopeNamePrefixis refused until implemented.- Drift checks that cannot run report ERROR ("result unknown"); service-account tokens are filtered server-side; deleted targets are flagged; only human users count as identity admins.
- Identity drift report widget (
authentik.admin). It checks the server version, blueprint status, the service account (type, groups, superuser, protection, extra self-minted tokens), break-glass presence, the last identity administrator,qqq.io/*attribute validity, and service-account changes to protected or superuser objects (lockout detection).
Added (phase 0)
- Phase 0 foundations:
AuthentikQBitConfig,AuthentikQBitProducer,AuthentikActionUtil(bearer auth, page/page_size paging, filter mapping that rejects unsupported filters, 10 rps token-bucket throttle, log redaction), read-only Users and Groups tables, Identity app. - Pinned Authentik 2026.8.3 OpenAPI schema and schema drift tests.
- Testcontainers contract tests against Authentik 2026.8.3 (bootstrap on an empty instance, superuser floor, blueprint re-apply safety, access-check behaviour) and a fixture recorder.
Downloads
- Writes through the Authentik API, behind the features