james.maesandClaude Opus 5.5
a79f2d2d4b
- Edit User: username (validated, unique) and other attributes (JSON object; qqq.io/ and goauthentik.io/ keys kept and refused; blank keeps them; needs authentik.audit.read, which also gates showing them). Edit Group: other attributes the same way. - Delete User and Delete Group behind the new DELETE feature (off by default; Authentik delete_user/delete_group): typed confirmation, never yourself, a protected account, a superuser group or the last identity administrator; a group needs no members and no child groups; its policy row goes with it. - Tests on the in-memory Authentik and a delete contract test on 2026.8.3; README, STATUS, CHANGELOG, CLAUDE.md invariant. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
60 lines
4.1 KiB
Markdown
60 lines
4.1 KiB
Markdown
# Status
|
|
|
|
The Authentik qbit's progress through DESIGN.md section 11, with links. Updated with each PR.
|
|
|
|
## v1 = phases 0-3 (the full user lifecycle and group/permission management)
|
|
|
|
| Phase | State |
|
|
|---|---|
|
|
| 0. Foundations and migration | agent items done; **owner items open** (checklist items 6-8, 10, then 12) |
|
|
| 1. Read-only plus the permissions model | done, except the mirror tables, reconcile and the access-matrix widget (see "Not built yet") |
|
|
| 2. Memberships and permission editing | done, except the webhook route, ESB trigger, inbox and session re-evaluation marking |
|
|
| 3. Full user lifecycle | done, except the optional snapshot export |
|
|
| 4. RBAC role management | post-v1, not started |
|
|
| 5. Policies and full CRUD (DESIGN.md section 12) | 5a policy model (#14), 5b policy editor (#15), 5c user and group CRUD additions; the Next UI widget is a separate qqq-frontend-next PR |
|
|
|
|
### Built in this line (0.1)
|
|
|
|
| Area | What |
|
|
|---|---|
|
|
| People | Create, invite, edit (username, name, email, path, other attributes), deactivate, reactivate, delete (feature `DELETE`), password reset email, reset MFA, revoke app passwords, revoke sessions, cancel invitations |
|
|
| Groups | Create, edit (parents, other attributes), delete (feature `DELETE`), add and remove members (bulk), edit permissions and app access, edit the group policy (feature `POLICIES`) |
|
|
| Safety | Subset rule on live groups, protected accounts and superuser groups, no self-edits, last-admin protection, reasons, typed confirmations, bulk caps, stale checks, two-person approval for `authentik.*` |
|
|
| Audit | `authentik_admin_action` (before the call), Authentik `custom_qqq_admin_action` events, approval requests |
|
|
| Screens | Home dashboard, main tables in the nav, child lists on parents, every action as a table or record action |
|
|
| Tests | Unit tests on an in-memory Authentik (rules, processes, app, home), contract tests on Authentik 2026.8.3 |
|
|
|
|
### Not built yet (and why)
|
|
|
|
| Item | Note |
|
|
|---|---|
|
|
| Authentik webhook, ESB trigger, inbox, session re-evaluation marking | Needs the notification transport in cluster-gitops (inert today); reads are live (30 s cache) so screens are correct without it |
|
|
| Mirror tables and reconcile | For Web Users joins and widget counts; the home reads live |
|
|
| Access matrix widget, group tree widget | Needs Next UI custom widgets (separate frontend PRs) |
|
|
| Snapshot export | Optional in the spec |
|
|
| RBAC role management | Phase 4 |
|
|
| Alerts producer integration | Optional until the Alerts qbit SPI (QRun-IO/qqq#1090) lands |
|
|
| Quick Search for users and groups | They are API-backed (read-through), so they are searched with the table's own search box, which Authentik evaluates live |
|
|
| Invitations add groups | Groups for invited people are added after they sign up (needs the webhook) |
|
|
|
|
## Phase 0: foundations (agent items done; owner items open)
|
|
|
|
| # | Item | State | Where |
|
|
|---|---|---|---|
|
|
| 1 | Repo, DESIGN.md, CI, README, CLAUDE.md | done | this repo (`develop`); public |
|
|
| 2 | Config, producer, `AuthentikActionUtil`, pinned schema + drift test | done | phase 0 PR |
|
|
| 3 | Testcontainers harness, fixture recorder, contract tests (b), (c), (d), (h) | done | `src/test/java/.../contract` |
|
|
| 4 | Open points (i)-(iv) resolved | done | DESIGN.md section 0.2 |
|
|
| 5 | cluster-gitops PR (bootstrap, removals, sign-in policy, webhook, lint) | draft | KofTwentyTwo/cluster-gitops#72 |
|
|
| 6 | Staging rehearsal | **owner** | `docs/PHASE0-OWNER-CHECKLIST.md`, `docs/cluster-gitops-phase0/rehearse-phase0.sh` |
|
|
| 7 | Production apply | **owner** | checklist |
|
|
| 8 | Service-account token, Infisical, webhook secret | **owner** | checklist |
|
|
| 9 | Website-Backend wiring (ExternalSecret + env, qbit behind a disabled flag) | draft | KofTwentyTwo/cluster-gitops#73, Website-Backend#94 |
|
|
| 10 | Seed attributes, break-glass password | **owner** | checklist |
|
|
| 11 | Read-only on staging | after 6-10 | flip `AUTHENTIK_QBIT_ENABLED` |
|
|
| 12 | Turn on the full lifecycle (role permissions, brand recovery flow, tables, flags) | after 11 | checklist item 12 |
|
|
|
|
## Contract and unit tests (Authentik 2026.8.3)
|
|
|
|
`CI=true ./mvnw verify`. The numbers are filled in at the end of each PR; see the PR description.
|