feat(auth): validate mapped groups through Authentik

2026-08-17 10:44:56 +02:00
parent 33ae7cfdc2
commit f0ae680671
9 changed files with 669 additions and 2 deletions
@@ -0,0 +1,36 @@
+/** The fixed machine contract shared by the Authentik catalog and auth diagnostics. */
+export type AuthDiagnosticCode =
+  | "auth_ready"
+  | "auth_config_incomplete"
+  | "auth_config_invalid"
+  | "auth_session_store_invalid"
+  | "local_user_registry_invalid"
+  | "local_admin_missing"
+  | "oidc_secret_missing"
+  | "oidc_discovery_unreachable"
+  | "oidc_issuer_mismatch"
+  | "oidc_jwks_unreachable"
+  | "oidc_group_catalog_unreachable"
+  | "oidc_group_catalog_unauthorized"
+  | "oidc_mapped_group_missing"
+  | "oidc_mapped_group_ambiguous"
+  | "oidc_groups_claim_invalid"
+  | "oidc_device_flow_unavailable";
+
+export interface AuthDiagnostic {
+  level: "error" | "info";
+  code: AuthDiagnosticCode;
+  message: string;
+  field?: string;
+}
+
+export interface AuthDiagnostics {
+  ready: boolean;
+  mode: "local" | "oidc" | "upstream" | "none" | "mock";
+  checks: readonly AuthDiagnostic[];
+}
+
+/** A provider-specific proof that only the configured authorization groups exist. */
+export interface GroupCatalog {
+  verifyConfiguredGroups(names: readonly string[], signal: AbortSignal): Promise<readonly AuthDiagnostic[]>;
+}