49 lines
2.3 KiB
Markdown
49 lines
2.3 KiB
Markdown
|
# 8.7 — `X-Service: iam` adapter, Authentik admin surface (GREEN)
|
||
|
|
|
||
|
|
Phase: 8 — ServiceAdapter CRD rollout
|
||
|
|
Stage: RED
|
||
|
|
Depends on: 8.1, 8.2, 8.3
|
||
|
|
|
||
|
|
Design contract: [API_ROUTING_HYBRID_DESIGN.md](../API_ROUTING_HYBRID_DESIGN.md) §3.
|
||
|
|
|
||
|
|
- [ ] `internal/iam/handler.go` (new) implements the §3 mapping table:
|
||
|
|
`user` GET/POST → `/api/v3/core/users/`, `user/{id}` GET/PATCH/DELETE →
|
||
|
|
`/api/v3/core/users/{id}/`, `service-account` POST →
|
||
|
|
`/api/v3/core/users/service_account/`, `role` GET/POST →
|
||
|
|
`/api/v3/core/groups/`, `permission` GET/POST → `/api/v3/rbac/permissions/`,
|
||
|
|
`flow` GET → `/api/v3/flows/instances/`
|
||
|
|
- [ ] `k8s/serviceadapter-iam.yaml` CR: `serviceName: iam`, upstream = Authentik's
|
||
|
|
internal Service, `auth.capability: iam:admin` (default — this surface is
|
||
|
|
admin-only, tighter than the other adapters' read/write split)
|
||
|
|
- [ ] `requestSchema` on `POST user` and `POST service-account` — fields matching
|
||
|
|
Authentik's actual `/api/v3/core/users/` create-user body, confirmed against
|
||
|
|
the live API, not invented
|
||
|
|
- [ ] This is additive to `core iam` CLI subcommand (`~/workplace/core/src/cmd/iam/`),
|
||
|
|
not a replacement — different caller (server vs. local CLI), same upstream.
|
||
|
|
Do not modify the `core` CLI as part of this task
|
||
|
|
- [ ] No token without `iam:admin` reaches any of these resources, including `flow`
|
||
|
|
(GET-only, but still admin-scoped per the design doc — do not default it to
|
||
|
|
a lower/no-auth tier because it's read-only)
|
||
|
|
|
||
|
|
## Verify
|
||
|
|
|
||
|
|
```bash
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/ \
|
||
|
|
-H 'X-Service: iam' -H 'X-Resource: user'
|
||
|
|
# expected: 401 without a token
|
||
|
|
|
||
|
|
curl -s -o /dev/null -w '%{http_code}\n' \
|
||
|
|
-H "Authorization: Bearer $NON_ADMIN_TOKEN" \
|
||
|
|
https://api.riotpiao.com/ -H 'X-Service: iam' -H 'X-Resource: user'
|
||
|
|
# expected: 403 — token lacks iam:admin
|
||
|
|
|
||
|
|
curl -s -H "Authorization: Bearer $IAM_ADMIN_TOKEN" \
|
||
|
|
https://api.riotpiao.com/ -H 'X-Service: iam' -H 'X-Resource: user'
|
||
|
|
# expected: 200, Authentik's user list, proxied through /api/v3/core/users/
|
||
|
|
|
||
|
|
curl -s -X POST https://api.riotpiao.com/ \
|
||
|
|
-H "Authorization: Bearer $IAM_ADMIN_TOKEN" \
|
||
|
|
-H 'X-Service: iam' -H 'X-Resource: role' -d '{}'
|
||
|
|
# expected: 400 — requestSchema rejects an empty group-create body
|
||
|
|
```
|