expand nested Kanidm entitlement groups (#166) #167

Sammanfogat

supernaut sammanfogade 1 incheckning från feat/166-nested-group-expansion in i main

2026-07-20 12:09:40 +00:00

supernaut kommenterad

2026-07-20 11:34:20 +00:00

Ägare

Fixes #166. The entitlement taxonomy (ADR 0016) nests a tier group INTO the ent_* groups it grants (ent_lfs.member=[tier_pro], etc.) and relies on transitive memberOf. The reconciler's members() read .attrs.member — direct members only — so ent_lfs resolved to the string tier_pro, never its persons, and every tier_pro user matched no entitlement and fell through to the fail-closed participant group (#125): Pro seats got zero quota, no org-create, no Actions. Surfaced live during the #125 apply (alexanderkjall → participant despite renovate cap 100 = tier_pro).

Fix: members() recurses into any member that is itself a group (via a kd_code group-vs-person probe), with a cycle guard; pipefail propagates a Kanidm read error through the sort so the never-strip-on-failure contract holds.

Verified: mocked-topology unit test — nested (ent_lfs → alice,bob), mixed direct+nested (ent_orgs → alice,bob,carol), cycle (no hang), direct. Rendered + bash -n + ansible-lint clean.

⚠️ Touches gitborg-reconciler.sh.j2 (members() region) — #37 touches the org-loop region of the same file; whichever merges second rebases. After apply, verify a tier_pro user resolves to lfs=lfs-pro org_create=true actions=true (dry-run + journal).

Fixes #166. The entitlement taxonomy (ADR 0016) nests a tier group INTO the ent_* groups it grants (`ent_lfs.member=[tier_pro]`, etc.) and relies on **transitive** memberOf. The reconciler's `members()` read `.attrs.member` — **direct** members only — so `ent_lfs` resolved to the string `tier_pro`, never its persons, and every tier_pro user matched no entitlement and fell through to the fail-closed `participant` group (#125): **Pro seats got zero quota, no org-create, no Actions.** Surfaced live during the #125 apply (`alexanderkjall` → participant despite renovate cap 100 = tier_pro). **Fix:** `members()` recurses into any member that is itself a group (via a `kd_code` group-vs-person probe), with a cycle guard; pipefail propagates a Kanidm read error through the sort so the never-strip-on-failure contract holds. **Verified:** mocked-topology unit test — nested (`ent_lfs → alice,bob`), mixed direct+nested (`ent_orgs → alice,bob,carol`), cycle (no hang), direct. Rendered + `bash -n` + ansible-lint clean. ⚠️ Touches `gitborg-reconciler.sh.j2` (members() region) — #37 touches the org-loop region of the same file; whichever merges second rebases. After apply, verify a tier_pro user resolves to `lfs=lfs-pro org_create=true actions=true` (dry-run + journal).

supernaut lade till 1 incheckning

2026-07-20 11:34:20 +00:00

fix(reconciler): expand nested Kanidm entitlement groups (#166 )

ci / ci (pull_request) Successful in 3m13s

Detaljer

8aa7a451a3

The entitlement taxonomy (ADR 0016) nests a tier group INTO the ent_* groups
it grants (ent_lfs.member=[tier_pro], etc.) and relies on transitive memberOf.
The reconciler's members() read .attrs.member (DIRECT only), so ent_lfs
resolved to the string 'tier_pro', never its persons — every tier_pro user
matched no entitlement and fell through to the fail-closed participant group
(#125), i.e. Pro seats got zero quota, no org-create, no Actions.

members() now recurses into any member that is itself a group (via a kd_code
group-vs-person probe), with a cycle guard; pipefail propagates a Kanidm read
error through the sort so the never-strip-on-failure contract holds. Verified
with a mocked-topology unit test (nesting, mixed direct+nested, cycle, direct).

Not applied — leave for review + dry-run (verify a tier_pro user resolves to
lfs-pro/org-create/actions). Refs #166.

supernaut sammanfogade incheckning e567bbaa58 till main

2026-07-20 12:09:40 +00:00

supernaut tog bort grenen feat/166-nested-group-expansion

2026-07-20 12:09:40 +00:00

supernaut refererade denna ändringsförfrågan från en incheckning

2026-07-20 12:09:40 +00:00

expand nested Kanidm entitlement groups (#166) (#167)

supernaut refererade till denna ändringsförfrågan

2026-07-20 14:43:34 +00:00

classify nested Kanidm groups by the group list, not HTTP status (#166 hotfix) #172

supernaut refererade denna ändringsförfrågan från en incheckning

2026-07-20 14:46:56 +00:00