03dfdbd83a
Some checks failed
Replaces the implicit "empty allowed_groups means public" rule with explicit default-deny across both OIDC and ForwardAuth. Adds two boolean flags on Group — auto_assign (Keycloak-style auto-join on user create) and admin (members can reach the admin panel) — and drops the users.admin column entirely. Adds "Users with access" and "Accessible applications" panels with via-group badges on the application/user show pages. BEHAVIOR CHANGE: a ForwardAuth app with no allowed_groups previously bypassed authentication entirely; it now returns 403 like any other unauthorized request. The data migration seeds an "everyone" group and attaches it to all previously group-less apps to preserve behavior on existing installs. An "admins" group is seeded and backfilled from any user with the old admin column. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
29 lines
559 B
YAML
29 lines
559 B
YAML
# Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html
|
|
# All users belong to "everyone" so existing tests that create group-less apps
|
|
# can be made compatible by attaching that group.
|
|
|
|
one_everyone:
|
|
user: one
|
|
group: everyone
|
|
two_everyone:
|
|
user: two
|
|
group: everyone
|
|
alice_everyone:
|
|
user: alice
|
|
group: everyone
|
|
bob_everyone:
|
|
user: bob
|
|
group: everyone
|
|
|
|
alice_admin_group:
|
|
user: alice
|
|
group: admin_group
|
|
|
|
two_admin_group:
|
|
user: two
|
|
group: admin_group
|
|
|
|
bob_editor_group:
|
|
user: bob
|
|
group: editor_group
|