03dfdbd83a
Some checks failed
Replaces the implicit "empty allowed_groups means public" rule with explicit default-deny across both OIDC and ForwardAuth. Adds two boolean flags on Group — auto_assign (Keycloak-style auto-join on user create) and admin (members can reach the admin panel) — and drops the users.admin column entirely. Adds "Users with access" and "Accessible applications" panels with via-group badges on the application/user show pages. BEHAVIOR CHANGE: a ForwardAuth app with no allowed_groups previously bypassed authentication entirely; it now returns 403 like any other unauthorized request. The data migration seeds an "everyone" group and attaches it to all previously group-less apps to preserve behavior on existing installs. An "admins" group is seeded and backfilled from any user with the old admin column. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
24 lines
481 B
YAML
24 lines
481 B
YAML
# Read about fixtures at https://api.rubyonrails.org/classes/ActiveRecord/FixtureSet.html
|
|
|
|
one:
|
|
name: Group One
|
|
description: First test group
|
|
|
|
two:
|
|
name: Group Two
|
|
description: Second test group
|
|
|
|
admin_group:
|
|
name: Administrators
|
|
description: System administrators with full access
|
|
admin: true
|
|
|
|
editor_group:
|
|
name: Editors
|
|
description: Content editors with limited access
|
|
|
|
everyone:
|
|
name: everyone
|
|
description: Auto-assigned to new users.
|
|
auto_assign: true
|