ab/meguri
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
12 Commits 2 Branches 0 Tags
38105c65c221c035c4042fa832cebc2289023e6c
Commit Graph
5 Commits
Author SHA1 Message Date
Aleksandr BogomiakovandClaude 38105c65c2 Merge NEXT: planning, generation map and portable configuration on top of the OIDC access model 
NEXT predates the access work, so the identity layer follows master: access comes from
configured groups, instance administrators replace the site administration, and accounts are
created by SSO or by an administrator. Kept from NEXT: manual publication with the Review
changes panel and shared generator drafts, portable import/export (meguri/v2), the layered
generation map with binding provenance, JSM provider changes, contact/approval semantics and
the account-owned Person. Dropped: site administration, local sign-up, and the mandatory
unique email with its contact/account migrations. The manual-publication migration is
renumbered m_0010 after m_0009_access.

Accounts without an email still get a Person in every workspace they reach, a changed sign-in
email updates the account's person, and an account that loses access keeps its linked person so
schedules stay valid. Instance administrators may use Sync and shared drafts.

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-10-07 16:06:10 +01:00
Aleksandr Bogomiakov 7afdc4be97 Added OIDC workflow and Helm Chart
Checks / test (push) Failing after 4m13s
Details
2026-10-07 14:22:37 +01:00
Aleksandr BogomiakovandClaude 4764f3545f Add OIDC sign-in, group-derived roles and declarative instance configuration 
Workspaces, group mappings and sign-in methods now come from a configuration
file synchronized at startup; workspaces dropped from it are disabled, never
deleted. Instance administrators (a new role) see and help every workspace and
may delete disabled ones; workspace administrators and employees are derived
from the user's groups at every SSO sign-in or administrator edit, and the
employee permission set belongs to the workspace. Self-registration is gone:
users come from SSO (only when their groups map) or from the administrator.
Break-glass bootstrap accounts get an HMAC-derived hourly password that all
replicas agree on. First SSO sign-in links a matching email contact to the
user. The demo runs on the same model with a generated per-start password.

Co-Authored-By: Claude <noreply@anthropic.com>
 2026-10-07 13:28:43 +01:00
ab 5b56b4a4cc Fixed CI
Checks / test (push) Failing after 2m35s
Details
2026-09-24 15:59:30 +03:00
ab a47c4a0398 Init
Checks / test (push) Failing after 12m20s
Details
2026-09-24 14:35:05 +03:00