james.maesandClaude Opus 5.5
75c66a8f8d
* feat: phase 0 foundations (read-only client, contract tests on Authentik 2026.8.3) - AuthentikQBitConfig (validated, secrets resolved by the qbit, never serialized or printed) and AuthentikQBitProducer (API backend, read-only authentikUser / authentikGroup tables, Identity app). - AuthentikActionUtil on qqq-backend-module-api: bearer auth, page/page_size paging with pagination.count, key lookups by GET, server-side user scope, AuthentikFilterMapper (rejects whatever Authentik cannot evaluate), 10 rps token-bucket throttle, 429/5xx retries, error mapping, and logging that never carries the token, query strings, successful GET bodies or sensitive bodies (AuthentikRedactor). - AuthentikGuard: identity.* read checks, sensitive fields behind identity.audit.read, all writes refused in this release, protected-account detection. - Pinned Authentik 2026.8.3 schema, SchemaDriftTest / SchemaDriftIT over the API surface used, and a weekly drift workflow against new releases. - Testcontainers harness (Authentik server + worker, Postgres, Mailpit) with the kof22-shaped blueprints, fixture recorder, and contract tests (b), (c), (d), (h) plus the access-check, sign-in policy, webhook and token findings. - Owner checklist, rehearsal script and blueprint lint for the cluster-gitops migration (KofTwentyTwo/cluster-gitops#72). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: phase 1 read-only MVP (memberships, sessions, events, effective permissions, drift report) - authentikGroupMember: virtual membership table served from a group (include_users), a user (groups_obj) or a bounded sweep; filters by group pk/name, user pk/username or key; user scope checked per member. - authentikSession and authentikEvent, behind identity.audit.read. - GroupGraph + EffectivePermissionResolver: groups and inherited parents to QQQ permissions; identity.* and catalog wildcards expanded, unknown names reported and never granted. Groups show inherited superuser status and effective permissions; users show effective permissions. - Identity drift report widget (identity.admin): version, blueprint status, service-account shape and self-minted tokens, break-glass, last identity admin, qqq.io/* attribute validity, and service-account changes to protected or superuser objects. - Contract tests on Authentik 2026.8.3 (real session via the flow executor; the drift report flags SuperuserFloorIT's lockout probes) and recorded fixtures for the new unit tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * feat: group permission mapper; harden phase 0/1 after code review - AuthentikGroupPermissionMapper: token groups claim -> QQQ permissions via the group graph and resolver; static fallbacks and bootstrapOperators; Authentik unreachable grants only the fallbacks, never everything. - Review fixes (general and silent-failure reviews): - plain-text-only search, because Authentik's QLSearch could reach sensitive fields - thread-safe group graph - a failed group-graph read shows "Unavailable", not empty permissions - malformed qqq.io/* attributes are reported by the drift report - operator filters may not widen the user scope; membership rows are always scope-checked - a missing pagination object is an error - sorting by the key falls back to the default; strict booleans; ".." keys refused - https required except loopback / allowInsecureHttp; groupScopeNamePrefix refused until implemented - drift: unrunnable checks are ERROR "result unknown"; service-account tokens filtered server-side, zero visible is a warning; deleted or vanished targets flagged; only human users count as identity admins; break-glass re-checked client-side - redact error bodies before flattening; version check retried after a failed fetch - rehearse-phase0.sh: portable under Git Bash, waits for both blueprints, derived is_superuser; passed on a synthetic production-like dump. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
cluster-gitops phase 0 support files
The cluster-gitops changes themselves are in KofTwentyTwo/cluster-gitops#72 (draft). That PR adds:
- the identity bootstrap blueprint
- the removal of the
presentjames.maesandkof22-adminsentries - the attribute-driven sign-in policy
- the inert webhook plumbing
- the lint
The blueprint YAML in that PR is generated from this repo's tested fixtures, src/test/resources/blueprints/*.yaml. That way, what goes to cluster-gitops is what the contract tests applied to Authentik 2026.8.3.
| File | Purpose |
|---|---|
scripts/lint-authentik-blueprints.py |
The blueprint lint (also in cluster-gitops#72 under scripts/). It forbids present user/group entries, member lists, roles beyond permissions, tokens and literal secrets. --self-test runs the built-in cases. |
rehearse-phase0.sh |
Owner checklist item 6: replays the migration on a local, disposable Authentik restored from a dump you take, and checks that no membership moves. |
To re-check the fixtures with the lint:
python3 docs/cluster-gitops-phase0/scripts/lint-authentik-blueprints.py src/test/resources/blueprints