james.maesandClaude Opus 5.5
037d736bfd
* feat: phase 0 foundations (read-only client, contract tests on Authentik 2026.8.3) - AuthentikQBitConfig (validated, secrets resolved by the qbit, never serialized or printed) and AuthentikQBitProducer (API backend, read-only authentikUser / authentikGroup tables, Identity app). - AuthentikActionUtil on qqq-backend-module-api: bearer auth, page/page_size paging with pagination.count, key lookups by GET, server-side user scope, AuthentikFilterMapper (rejects whatever Authentik cannot evaluate), 10 rps token-bucket throttle, 429/5xx retries, error mapping, and logging that never carries the token, query strings, successful GET bodies or sensitive bodies (AuthentikRedactor). - AuthentikGuard: identity.* read checks, sensitive fields behind identity.audit.read, all writes refused in this release, protected-account detection. - Pinned Authentik 2026.8.3 schema, SchemaDriftTest / SchemaDriftIT over the API surface used, and a weekly drift workflow against new releases. - Testcontainers harness (Authentik server + worker, Postgres, Mailpit) with the kof22-shaped blueprints, fixture recorder, and contract tests (b), (c), (d), (h) plus the access-check, sign-in policy, webhook and token findings. - Owner checklist, rehearsal script and blueprint lint for the cluster-gitops migration (KofTwentyTwo/cluster-gitops#72). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * chore: drop committed Python bytecode and ignore it The lint script's __pycache__/*.pyc was committed by accident: it is generated output and an unreviewable binary (K22-REPO-05). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
22 lines
1.1 KiB
Markdown
22 lines
1.1 KiB
Markdown
# cluster-gitops phase 0 support files
|
|
|
|
The cluster-gitops changes themselves are in **KofTwentyTwo/cluster-gitops#72** (draft). That PR adds:
|
|
- the identity bootstrap blueprint
|
|
- the removal of the `present` `james.maes` and `kof22-admins` entries
|
|
- the attribute-driven sign-in policy
|
|
- the inert webhook plumbing
|
|
- the lint
|
|
|
|
The blueprint YAML in that PR is generated from this repo's tested fixtures, `src/test/resources/blueprints/*.yaml`. That way, what goes to cluster-gitops is what the contract tests applied to Authentik 2026.8.3.
|
|
|
|
| File | Purpose |
|
|
|---|---|
|
|
| `scripts/lint-authentik-blueprints.py` | The blueprint lint (also in cluster-gitops#72 under `scripts/`). It forbids `present` user/group entries, member lists, roles beyond `permissions`, tokens and literal secrets. `--self-test` runs the built-in cases. |
|
|
| `rehearse-phase0.sh` | Owner checklist item 6: replays the migration on a **local, disposable** Authentik restored from a dump you take, and checks that no membership moves. |
|
|
|
|
To re-check the fixtures with the lint:
|
|
|
|
```bash
|
|
python3 docs/cluster-gitops-phase0/scripts/lint-authentik-blueprints.py src/test/resources/blueprints
|
|
```
|