homelab-frontend/tasks/8.7-iam-adapter.md

8.7 — X-Service: iam adapter, Authentik admin surface (GREEN)

Phase: 8 — ServiceAdapter CRD rollout Stage: RED Depends on: 8.1, 8.2, 8.3

Design contract: API_ROUTING_HYBRID_DESIGN.md §3.

• internal/iam/handler.go (new) implements the §3 mapping table: user GET/POST → /api/v3/core/users/, user/{id} GET/PATCH/DELETE → /api/v3/core/users/{id}/, service-account POST → /api/v3/core/users/service_account/, role GET/POST → /api/v3/core/groups/, permission GET/POST → /api/v3/rbac/permissions/, flow GET → /api/v3/flows/instances/
• k8s/serviceadapter-iam.yaml CR: serviceName: iam, upstream = Authentik's internal Service, auth.capability: iam:admin (default — this surface is admin-only, tighter than the other adapters' read/write split)
• requestSchema on POST user and POST service-account — fields matching Authentik's actual /api/v3/core/users/ create-user body, confirmed against the live API, not invented
• This is additive to core iam CLI subcommand (~/workplace/core/src/cmd/iam/), not a replacement — different caller (server vs. local CLI), same upstream. Do not modify the core CLI as part of this task
• No token without iam:admin reaches any of these resources, including flow (GET-only, but still admin-scoped per the design doc — do not default it to a lower/no-auth tier because it's read-only)

Verify

curl -s -o /dev/null -w '%{http_code}\n' https://api.riotpiao.com/ \
  -H 'X-Service: iam' -H 'X-Resource: user'
# expected: 401 without a token

curl -s -o /dev/null -w '%{http_code}\n' \
  -H "Authorization: Bearer $NON_ADMIN_TOKEN" \
  https://api.riotpiao.com/ -H 'X-Service: iam' -H 'X-Resource: user'
# expected: 403 — token lacks iam:admin

curl -s -H "Authorization: Bearer $IAM_ADMIN_TOKEN" \
  https://api.riotpiao.com/ -H 'X-Service: iam' -H 'X-Resource: user'
# expected: 200, Authentik's user list, proxied through /api/v3/core/users/

curl -s -X POST https://api.riotpiao.com/ \
  -H "Authorization: Bearer $IAM_ADMIN_TOKEN" \
  -H 'X-Service: iam' -H 'X-Resource: role' -d '{}'
# expected: 400 — requestSchema rejects an empty group-create body