T2: Kanidm capability groups module #5

New issue

Closed

opened 2026-08-11 15:20:30 +00:00 by ginjiruu · 0 comments

ginjiruu commented

2026-08-11 15:20:30 +00:00

Owner

Parent

Spec: catalog-driven app bootstrapping and capability groups (#2)

What to build

The catalog's per-app capability-group list creates the Kanidm groups group-<app>_<capability> plus the nested <app>-root group (root is a member of all capability groups), so a developer's membership grants per-app access across the platform.

Acceptance criteria

dev_groups module creates group-<app>_<capability> for each catalog capability
<app>-root created as a nested group member of all capability groups (Kanidm nested groups)
existing ~90 per-app UI groups untouched
tofu validate passes with a representative catalog

Blocked by

T1: Fix provider resolution + catalog schema (prefactor) (#3)

## Parent Spec: catalog-driven app bootstrapping and capability groups (#2) ## What to build The catalog's per-app capability-group list creates the Kanidm groups `group-<app>_<capability>` plus the nested `<app>-root` group (root is a member of all capability groups), so a developer's membership grants per-app access across the platform. ## Acceptance criteria - [x] dev_groups module creates `group-<app>_<capability>` for each catalog capability - [ ] `<app>-root` created as a nested group member of all capability groups (Kanidm nested groups) - [ ] existing ~90 per-app UI groups untouched - [ ] `tofu validate` passes with a representative catalog ## Blocked by - T1: Fix provider resolution + catalog schema (prefactor) (#3)

ginjiruu referenced this issue

2026-08-11 15:20:44 +00:00

T7: Root wiring + pilot apps (integration) #9

ginjiruu added the

ready-for-agent

label

2026-08-11 15:20:56 +00:00

ginjiruu referenced this issue from a pull request that will close it,

2026-08-11 16:08:52 +00:00

T2: Kanidm capability groups module #18

ginjiruu closed this issue

2026-08-11 16:13:15 +00:00