argus/backend
Watch
2
0
Fork
You've already forked backend
 0
Code Issues Pull requests Projects Releases 1 Packages 1 Wiki Activity Actions

Access through Authentik groups #31

Merged
Gilles merged 4 commits from feat/27-authentik-group-access into master 2026-10-28 19:03:51 +00:00
Conversation 1 Commits 4 Files changed 14 +588 -4
Gilles commented 2026-10-28 15:22:01 +00:00
Owner

Closes #27

Part of the server monitoring plan (phase 1.2). Stacked on #30 (base branch feat/26-native-orgs-external-projects): merge #30 first.

Changes

  • AuthentikGroups: the OIDC groups claim, stored (replaced) at every login. Authentik's default profile mapping sends the user's direct groups only. Leaving a group takes effect at the next login (documented in the README).
  • GroupGrant (group name, read/write/admin, organization or project): an organization grant covers all its projects. Effective level = max(Forgejo, groups), for Forgejo and native organizations alike; users without a Forgejo identity can get access through groups only.
  • ARGUS_ADMIN_GROUP setting (default argus-admins): its members, like superusers, create native organizations/external projects and administer native organizations. It gives nothing on Forgejo organizations.
  • API (admin level on the target): GET/POST /api/organizations/<org>/group-grants/, DELETE …/<id>/, and the same under /api/projects/<owner>/<repo>/group-grants/. POST on an existing group updates its level.
  • /api/me/: groups, is_argus_admin.
  • Grants are memoized per request, so listing projects doesn't query them once per project.
  • Feature catalog: "Accès par groupes Authentik" family; tests in apps/accounts/test_groups.py (incl. a group-only reader receiving notifications).

Infra

vps-garion: the argus-admins and argus-infra groups are added through the Authentik blueprint (separate commit there).

Checks

pytest (202 passed), pylint 10/10, autopep8, bandit clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA

Closes #27 Part of the server monitoring plan (phase 1.2). **Stacked on #30** (base branch `feat/26-native-orgs-external-projects`): merge #30 first. ## Changes - `AuthentikGroups`: the OIDC `groups` claim, stored (replaced) at every login. Authentik's default `profile` mapping sends the user's **direct** groups only. Leaving a group takes effect at the next login (documented in the README). - `GroupGrant` (group name, `read`/`write`/`admin`, organization *or* project): an organization grant covers all its projects. Effective level = max(Forgejo, groups), for Forgejo and native organizations alike; users without a Forgejo identity can get access through groups only. - `ARGUS_ADMIN_GROUP` setting (default `argus-admins`): its members, like superusers, create native organizations/external projects and administer native organizations. It gives nothing on Forgejo organizations. - API (admin level on the target): `GET/POST /api/organizations/<org>/group-grants/`, `DELETE …/<id>/`, and the same under `/api/projects/<owner>/<repo>/group-grants/`. POST on an existing group updates its level. - `/api/me/`: `groups`, `is_argus_admin`. - Grants are memoized per request, so listing projects doesn't query them once per project. - Feature catalog: "Accès par groupes Authentik" family; tests in `apps/accounts/test_groups.py` (incl. a group-only reader receiving notifications). ## Infra `vps-garion`: the `argus-admins` and `argus-infra` groups are added through the Authentik blueprint (separate commit there). ## Checks pytest (202 passed), pylint 10/10, autopep8, bandit clean. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA
feature: access through Authentik groups
Some checks failed
ci / test (pull_request) Failing after 3m4s
Details
ci / e2e (pull_request) Has been skipped
Details
ci / docker (pull_request) Has been skipped
Details
ci / deploy (pull_request) Has been skipped
Details
aa9f9f4ffd 
- The OIDC `groups` claim is stored at every login (AuthentikGroups);
  leaving a group takes effect at the next login.
- GroupGrant gives a group read/write/admin on an organization (and
  all its projects) or on a project; the effective level is the highest
  of Forgejo's and the groups'.
- ARGUS_ADMIN_GROUP (default argus-admins) members are Argus admins,
  like superusers: they create native organizations and administer
  them.
- API: group grants on organizations and projects (admin level), and
  /me exposes groups and is_argus_admin.

Closes #27

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA
Gilles commented 2026-10-28 15:25:03 +00:00
Author
Owner

📊 Rapports Argus pour cette PR

<!-- argus-link-bot:argus/backend --> 📊 [Rapports Argus pour cette PR](https://reports.stationmyr.net/argus/backend/pr/31)
fix: group grant constraints no longer duplicate UploadToken's (pylint R0801)
All checks were successful
ci / test (pull_request) Successful in 3m4s
Details
ci / e2e (pull_request) Has been skipped
Details
ci / docker (pull_request) Has been skipped
Details
ci / deploy (pull_request) Has been skipped
Details
27f0d03307 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014BSmBtGWeFBD9z4mYm9SjA
Gilles changed target branch from feat/26-native-orgs-external-projects to master 2026-10-28 18:33:52 +00:00
Merge remote-tracking branch 'origin/master' into feat/27-authentik-group-access
All checks were successful
ci / test (pull_request) Successful in 3m9s
Details
ci / e2e (pull_request) Has been skipped
Details
ci / docker (pull_request) Has been skipped
Details
ci / deploy (pull_request) Has been skipped
Details
c271a384e1 
# Conflicts:
#	apps/accounts/access.py
#	e2e/features.catalog.yaml
Gilles scheduled this pull request to auto merge when all checks succeed 2026-10-28 18:42:32 +00:00
Gilles merged commit 53f358d648 into master 2026-10-28 19:03:51 +00:00
Gilles deleted branch feat/27-authentik-group-access 2026-10-28 19:03:51 +00:00
Gilles referenced this pull request from a commit 2026-10-28 19:03:52 +00:00
Access through Authentik groups (#31)
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
breaking
Breaking change: listed first in the release notes

  
bug
Bug fix (release notes: Bug fixes)

  
ci
CI and maintenance (release notes: CI & maintenance)

  
dependencies
Dependency update (release notes: Dependencies, folded)

  
documentation
Documentation (release notes: Documentation)

  
feature
New feature (release notes: Features)

  
security
Security fix (release notes: Security)

  
skip-changelog
Left out of the release notes

No labels
breaking
bug
ci
dependencies
documentation
feature
security
skip-changelog
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
argus/backend!31
No description provided.