Claude Fable 5
6aac785841
All checks were successful
CI / Lint, typecheck, test (pull_request) Successful in 6m55s
CI / Build container images (pull_request) Successful in 3m0s
CI / Auth e2e pack (pull_request) Successful in 8m49s
CI / Import/export fidelity gate (pull_request) Successful in 58s
CD / Build and push images (push) Successful in 21s
CD / Deploy to Test (push) Successful in 14s
CD / Smoke tests against Test (push) Successful in 1m19s
CD / Promote to Int (push) Successful in 12s
CI / Lint, typecheck, test (push) Successful in 6m28s
CI / Build container images (push) Has been skipped
CI / Auth e2e pack (push) Successful in 8m15s
CI / Import/export fidelity gate (push) Successful in 59s
Declarative instance setting idpMapping.rules turns ID-token claims into pond roles and the site-admin flag on every OIDC login — configuration, not code. Mapped grants travel through the SAME GrantsService path as manual ones (permission cache invalidated, collab access notify fires so live sessions revalidate — asserted by test), never raw rows. Ownership makes precedence explicit: role_grants.origin marks mapped rows, users.is_site_admin_managed marks a mapping-set admin flag. The mapping only creates and revokes what it owns — manual wins: hand-made grants and hand-promoted admins are never revoked by a missing claim (a manual toggle clears the marker and takes ownership). Removal of a claim revokes the mapped grant and the managed flag on the next login. Every mapping-driven change is audited with origin idp_mapping. Failure containment: unknown pond slugs and the last-Pond-Admin protection log-and-skip — a mapping problem must never become a login lockout. Tests drive real OIDC logins against the fake IdP with group claims: grant + working access, revocation incl. notify, manual-wins, managed site-admin promote/demote/hands-off. Documented in permissions.md (own section), ADR 0021, data-model.md and the hardening guide (care rule: same PR). Refs #217. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8 |
||
|---|---|---|
| .. | ||
| 0001-typescript-monorepo.md | ||
| 0002-postgresql.md | ||
| 0003-yjs-crdt-collaboration.md | ||
| 0004-tiptap-editor.md | ||
| 0005-react-vite-frontend.md | ||
| 0006-nestjs-prisma-backend.md | ||
| 0007-auth-sessions-oidc-ready.md | ||
| 0008-plugin-sandbox.md | ||
| 0009-import-export-converters.md | ||
| 0010-postgres-fulltext-search.md | ||
| 0011-file-storage-quotas.md | ||
| 0012-i18n.md | ||
| 0013-versioning-and-trash.md | ||
| 0014-gitea-actions-cicd.md | ||
| 0015-backup-strategy.md | ||
| 0016-self-hosted-fonts.md | ||
| 0017-accessibility-by-default.md | ||
| 0018-color-theming.md | ||
| 0019-no-security-base-functions.md | ||
| 0020-token-crypto-key-separation.md | ||
| 0021-external-authentication.md | ||
| 0022-page-classification.md | ||
| 0023-read-access-audit-trail.md | ||
| 0024-reproducible-offline-deployment.md | ||
| 0025-plugin-trust-model.md | ||
| 0026-backup-target-restriction.md | ||