4 Commits

Include renames

Author	SHA1	Message	Date
jpmschweitzerandClaude	01349a83f2	test: repair the suite against the current API ... The suite could not even collect: the venv was missing declared dependencies, and five tests asserted an API that had moved on. 11 collection errors to 381 passing. test_oidc.py was written for the single-issuer API and 6243f29 replaced it. issuer and audience became lists, jwks_uri stopped being an attribute in favour of get_jwks_uri(issuer), get_jwks became get_jwks_for_issuer, and the lru_cache became a per-issuer dict so cache_clear no longer exists. Rewritten against the current surface, with coverage added for the two behaviours the multi-issuer change introduced and never tested: is_valid_issuer rejecting an unconfigured issuer, and the cache keying per issuer. Both are security-relevant — a shared cache would serve one issuer keys for another. Three /auth/me tests asserted a path that does not exist. The route is declared as /me inside AuthController.create_router() and mounts at /auth/users/me; the generated spec is authoritative and the local app and the deployed service agree on it. Those tests had never passed. test_handles_empty_groups expected groups == [""] for an empty header. oidc.py has returned [] since the initial commit, and [] is correct — [""] would also be unsafe, since any check doing "" in groups would match. test_model_aliases_property covered Settings.model_aliases, deleted with the Ollama integration in c1f16d4. Removed rather than repaired. Co-Authored-By: Claude <noreply@anthropic.com>	2026-08-09 15:21:43 +02:00
Jeroen SchweitzerandClaude Opus 4.5	69045a78a7	test(auth): add tests for GET /auth/me endpoint ... Add comprehensive tests for NPM forward auth endpoint: - Forward auth header parsing - User lookup methods (get_user_by_email, get_user_by_authentik_id) - Admin gate authorization logic - OpenAPI spec validation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-03 22:14:13 +01:00
Jeroen SchweitzerandClaude Opus 4.5	397a47c8fc	feat(auth): implement Phase 4 user profile and API key endpoints ... Add user profile, preferences, and API key management endpoints: - GET /auth/users/me - full user profile with roles and preferences - GET/PATCH /auth/users/me/preferences - user preferences management - GET/POST/DELETE /auth/users/me/api-keys - API key lifecycle API keys use tak_ prefix, SHA-256 hashing, and are shown only once on creation. Preferences support partial updates with JSON merge behavior. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-03 20:24:46 +01:00
Jeroen SchweitzerandClaude Opus 4.5	7752cd9d23	feat(auth): implement group-role mapping and permission system ... Architecture changes: - Permission format: domain.category:action (e.g., control-room.general:admin) - Decoupled groups from roles via group_roles mapping table - Groups are organizational (synced from Authentik) - Roles are permissions (admin-managed via API) New features: - require_permission() and require_any_permission() dependency factories - Action hierarchy: admin > editor > user > viewer - Global admin override (admin.general:admin grants all) - Group-role management endpoints (assign/remove roles) - GET /auth/roles endpoint to list all roles Database changes: - Added category column to roles table (default: general) - Removed authentik_group column (decoupled) - Added group_roles association table - Added user_groups association table - Migration updates role names to domain.general:action format Tests: - 67 new tests for auth service and controller - Covers token validation, user sync, role sync - Covers group-role assignment/removal - Covers schema conversions and permission system 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>	2026-01-03 19:52:10 +01:00