james.maesandClaude Opus 5.5
037d736bfd
* feat: phase 0 foundations (read-only client, contract tests on Authentik 2026.8.3) - AuthentikQBitConfig (validated, secrets resolved by the qbit, never serialized or printed) and AuthentikQBitProducer (API backend, read-only authentikUser / authentikGroup tables, Identity app). - AuthentikActionUtil on qqq-backend-module-api: bearer auth, page/page_size paging with pagination.count, key lookups by GET, server-side user scope, AuthentikFilterMapper (rejects whatever Authentik cannot evaluate), 10 rps token-bucket throttle, 429/5xx retries, error mapping, and logging that never carries the token, query strings, successful GET bodies or sensitive bodies (AuthentikRedactor). - AuthentikGuard: identity.* read checks, sensitive fields behind identity.audit.read, all writes refused in this release, protected-account detection. - Pinned Authentik 2026.8.3 schema, SchemaDriftTest / SchemaDriftIT over the API surface used, and a weekly drift workflow against new releases. - Testcontainers harness (Authentik server + worker, Postgres, Mailpit) with the kof22-shaped blueprints, fixture recorder, and contract tests (b), (c), (d), (h) plus the access-check, sign-in policy, webhook and token findings. - Owner checklist, rehearsal script and blueprint lint for the cluster-gitops migration (KofTwentyTwo/cluster-gitops#72). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop committed Python bytecode and ignore it The lint script's __pycache__/*.pyc was committed by accident: it is generated output and an unreviewable binary (K22-REPO-05). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1.1 KiB
1.1 KiB
cluster-gitops phase 0 support files
The cluster-gitops changes themselves are in KofTwentyTwo/cluster-gitops#72 (draft). That PR adds:
- the identity bootstrap blueprint
- the removal of the
presentjames.maesandkof22-adminsentries - the attribute-driven sign-in policy
- the inert webhook plumbing
- the lint
The blueprint YAML in that PR is generated from this repo's tested fixtures, src/test/resources/blueprints/*.yaml. That way, what goes to cluster-gitops is what the contract tests applied to Authentik 2026.8.3.
| File | Purpose |
|---|---|
scripts/lint-authentik-blueprints.py |
The blueprint lint (also in cluster-gitops#72 under scripts/). It forbids present user/group entries, member lists, roles beyond permissions, tokens and literal secrets. --self-test runs the built-in cases. |
rehearse-phase0.sh |
Owner checklist item 6: replays the migration on a local, disposable Authentik restored from a dump you take, and checks that no membership moves. |
To re-check the fixtures with the lint:
python3 docs/cluster-gitops-phase0/scripts/lint-authentik-blueprints.py src/test/resources/blueprints