Cordy/Cairn
2
1
Fork 0
Code Issues 20 Pull requests Projects Releases Packages Wiki Activity Actions

feat(spaces): decouple IdP group client; IdP-write as an off-by-default power mode (#215) #222

Merged
Cordy merged 3 commits from feat-groups-config into main 2026-08-13 16:43:30 +00:00
Conversation 0 Commits 3 Files changed 3 +74 -11
Cordy commented 2026-08-13 16:42:40 +00:00
Owner
Copy link

Splits the IdP admin client out of the encryption config and by privilege (ADR 0001).

  • New auth.groups config (GroupsConfig): keycloakBaseUrl/Realm/ClientId/ClientSecret + manage (the Option A power switch). Secret also via CAIRN_GROUPS_KEYCLOAK_CLIENT_SECRET.
  • main.go: the IdP admin client is built from auth.groups.*, or — for back-compat — adopted from the legacy storage.encryption.keycloak* client (which also implies manage: true, preserving existing IdP-managed instances like the keycloak-profile dogfood).
  • Read stays available whenever a client is configured: live group resolution (#96) is unchanged.
  • Write (IdP-managed spaces) is now gated on the power mode: apiH.Spaces (the IdP SpacesAPI) wires only when manage is on. Off by default → the IdP-brokered spaces API is not exposed (app-owned spaces take over in #216).
  • Startup warns about the manage-users blast radius when the power mode is on.

groups_test.go: parses the new block; defaults to off. An instance with no client and manage:false never builds the IdP manager (the openbao/AD/local default).

Net effect for the openbao dogfood once #216 lands: no IdP client needed, spaces are app-owned. The keycloak-profile dogfood keeps IdP-managed spaces via back-compat.

Splits the IdP admin client out of the encryption config and by privilege (ADR 0001). - New `auth.groups` config (`GroupsConfig`): `keycloakBaseUrl/Realm/ClientId/ClientSecret` + `manage` (the Option A power switch). Secret also via `CAIRN_GROUPS_KEYCLOAK_CLIENT_SECRET`. - `main.go`: the IdP admin client is built from `auth.groups.*`, or — for **back-compat** — adopted from the legacy `storage.encryption.keycloak*` client (which also implies `manage: true`, preserving existing IdP-managed instances like the keycloak-profile dogfood). - **Read stays available** whenever a client is configured: live group resolution (#96) is unchanged. - **Write (IdP-managed spaces) is now gated on the power mode**: `apiH.Spaces` (the IdP `SpacesAPI`) wires only when `manage` is on. Off by default → the IdP-brokered spaces API is not exposed (app-owned spaces take over in #216). - Startup **warns** about the `manage-users` blast radius when the power mode is on. `groups_test.go`: parses the new block; defaults to off. An instance with no client and `manage:false` never builds the IdP manager (the openbao/AD/local default). Net effect for the openbao dogfood once #216 lands: no IdP client needed, spaces are app-owned. The keycloak-profile dogfood keeps IdP-managed spaces via back-compat.
scaffold: run #215
All checks were successful
ship215 / edit (push) Successful in 6s
Details
2a54e8bd4c
feat(spaces): decouple IdP group client; IdP-write as power mode (#215)
All checks were successful
ci / test-and-build (pull_request) Successful in 35s
Details
7e1ff4e9b6
Cordy merged commit 36d2ae6488 into main 2026-08-13 16:43:30 +00:00
Cordy deleted branch feat-groups-config 2026-08-13 16:43:33 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#222
No description provided.
Delete branch "feat-groups-config"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?