T2: Kanidm capability groups module #18

Merged

ginjiruu merged 1 commit from t2-kanidm-capability-groups into master

2026-08-11 16:13:14 +00:00

ginjiruu commented

2026-08-11 16:08:52 +00:00

Owner

Closes #5

What

Completes the remaining acceptance criteria of T2 for kanidm/modules/dev_groups:

<app>-root nested group — a kanidm_group.root per app (derived from the catalog's app keys, not a catalog entry), named <app>-root.
Membership — kanidm_group_members.root_membership per capability group adds the app's root group as a member, so root transitively grants everything for the app (ADR-0007 nested-group model).
Subset-managed membership resource, so future human/machine memberships on the same capability groups can be added without clashing (the provider's kanidm_group.members complete-set attribute is deliberately not used).
New root_groups module output mirroring groups for the ADR-0007 per-system matrix.

Acceptance criteria

dev_groups module creates group-<app>_<capability> for each catalog capability (pre-existing)
<app>-root created as a nested group member of all capability groups (Kanidm nested groups)
existing ~90 per-app UI groups untouched (kanidm/groups.tf unmodified)
tofu validate passes with a representative catalog (privatebin + syncthing; full task validate green on all four roots)

Notes

Not applied: tofu validate is the test seam per spec's Testing Decisions; a tofu plan needs KANIDM_TOKEN, not available in this session. The tofu graph confirms root_membership depends on both the capability group and root group of each app.
Root remains excluded from the catalog capabilities list (documented in apps/README.md).

Closes #5 ## What Completes the remaining acceptance criteria of T2 for `kanidm/modules/dev_groups`: - **`<app>-root` nested group** — a `kanidm_group.root` per app (derived from the catalog's app keys, not a catalog entry), named `<app>-root`. - **Membership** — `kanidm_group_members.root_membership` per capability group adds the app's root group as a member, so root transitively grants everything for the app (ADR-0007 nested-group model). - Subset-managed membership resource, so future human/machine memberships on the same capability groups can be added without clashing (the provider's `kanidm_group.members` complete-set attribute is deliberately not used). - New `root_groups` module output mirroring `groups` for the ADR-0007 per-system matrix. ## Acceptance criteria - [x] dev_groups module creates `group-<app>_<capability>` for each catalog capability (pre-existing) - [x] `<app>-root` created as a nested group member of all capability groups (Kanidm nested groups) - [x] existing ~90 per-app UI groups untouched (`kanidm/groups.tf` unmodified) - [x] `tofu validate` passes with a representative catalog (`privatebin` + `syncthing`; full `task validate` green on all four roots) ## Notes - Not applied: `tofu validate` is the test seam per spec's Testing Decisions; a `tofu plan` needs `KANIDM_TOKEN`, not available in this session. The tofu graph confirms `root_membership` depends on both the capability group and root group of each app. - Root remains excluded from the catalog capabilities list (documented in `apps/README.md`).

ginjiruu added 1 commit

2026-08-11 16:08:53 +00:00

T2: kanidm capability groups module: <app>-root nested group 447b389a44

ginjiruu merged commit 49eef1cb58 into master

2026-08-11 16:13:14 +00:00

ginjiruu referenced this pull request from a commit

2026-08-11 16:13:14 +00:00

Merge pull request 'T2: Kanidm capability groups module' (#18) from t2-kanidm-capability-groups into master