Cordy/Cairn
2
1
Fork 0
Code Issues 15 Pull requests Projects Releases Packages Wiki Activity Actions

Group resolution: OIDC groups → User.Groups + /me (#17) #35

Merged
Cordy merged 2 commits from feat/group-resolution into main 2026-07-25 20:15:10 +00:00
Conversation 0 Commits 2 Files changed 4 +48 -3
Cordy commented 2026-07-25 20:12:37 +00:00
Owner
Copy link

First step of the authorization work (#16 builds on this).

  • auth.User gains a Groups []string field; sessions already store the full User, so groups resolved at login flow to every request.
  • OIDC callback now propagates the parsed claims.Groups into the issued session (previously dropped at Sessions.Issue).
  • GET /api/v1/me returns {username, groups} (empty array, not null, when none).
  • Tests: sessions preserve User.Groups; no-group users round-trip cleanly.

LDAP memberOf is deferred to a small follow-up (it needs threading groups through the search-then-bind + verified cache — kept out of this PR to avoid a risky refactor). Local auth has no groups by design. Nothing consumes groups yet; the per-group /spaces/<group> authorization (#16) is the consumer.

First step of the authorization work (#16 builds on this). - `auth.User` gains a `Groups []string` field; sessions already store the full `User`, so groups resolved at login flow to every request. - OIDC callback now propagates the parsed `claims.Groups` into the issued session (previously dropped at `Sessions.Issue`). - `GET /api/v1/me` returns `{username, groups}` (empty array, not null, when none). - Tests: sessions preserve `User.Groups`; no-group users round-trip cleanly. LDAP `memberOf` is deferred to a small follow-up (it needs threading groups through the search-then-bind + verified cache — kept out of this PR to avoid a risky refactor). Local auth has no groups by design. Nothing consumes groups yet; the per-group `/spaces/<group>` authorization (#16) is the consumer.
auth: resolve OIDC groups onto User.Groups and expose via /api/v1/me (#17)
All checks were successful
ci / test-and-build (pull_request) Successful in 22s
Details
b1bde21f68
Cordy merged commit 1b62bf1bb6 into main 2026-07-25 20:15:10 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: Cordy/Cairn#35
No description provided.
Delete branch "feat/group-resolution"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?