harkon/ai-tax-agent
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use managed system scopes in production blueprint
Some checks failed
CI/CD Pipeline / Notifications (push) Has been cancelled
Details
CI/CD Pipeline / Code Quality & Linting (push) Has been cancelled
Details
CI/CD Pipeline / Policy Validation (push) Has been cancelled
Details
CI/CD Pipeline / Test Suite (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-coverage) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-extract) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-firm-connectors) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-forms) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-hmrc) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-ingestion) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-kg) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-normalize-map) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-ocr) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-rag-indexer) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-rag-retriever) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-reason) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (svc-rpa) (push) Has been cancelled
Details
CI/CD Pipeline / Build Docker Images (ui-review) (push) Has been cancelled
Details
CI/CD Pipeline / Security Scanning (svc-coverage) (push) Has been cancelled
Details
CI/CD Pipeline / Security Scanning (svc-extract) (push) Has been cancelled
Details
CI/CD Pipeline / Security Scanning (svc-kg) (push) Has been cancelled
Details
CI/CD Pipeline / Security Scanning (svc-rag-retriever) (push) Has been cancelled
Details
CI/CD Pipeline / Security Scanning (ui-review) (push) Has been cancelled
Details
CI/CD Pipeline / Generate SBOM (push) Has been cancelled
Details
CI/CD Pipeline / Deploy to Staging (push) Has been cancelled
Details
CI/CD Pipeline / Deploy to Production (push) Has been cancelled
Details

Browse Source
This commit is contained in:
harkon
2025-12-03 12:32:55 +02:00
parent 269dfeaa4e
commit 586f79e5d0
1 changed files with 27 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
infra/base/authentik/bootstrap-prod.yaml
View File

@@ -51,45 +51,6 @@ entries:
- !Find [authentik_core.group, [name, "Administrators"]] - !Find [authentik_core.group, [name, "Administrators"]]
# --- Scope mappings (find existing ones and get stable IDs) ----------------- # --- Scope mappings (find existing ones and get stable IDs) -----------------
- id: scope_openid
model: authentik_providers_oauth2.scopemapping
identifiers:
scope_name: openid
attrs:
name: "openid"
expression: |
return {
"sub": user.uid,
"iss": request.build_absolute_uri("/"),
}
- id: scope_profile
model: authentik_providers_oauth2.scopemapping
identifiers:
scope_name: profile
attrs:
name: "profile"
expression: |
return {
"name": user.name,
"given_name": user.name,
"preferred_username": user.username,
"nickname": user.username,
"groups": [group.name for group in request.user.ak_groups.all()]
}
- id: scope_email
model: authentik_providers_oauth2.scopemapping
identifiers:
scope_name: email
attrs:
name: "email"
expression: |
return {
"email": user.email,
"email_verified": True
}
- id: scope_groups - id: scope_groups
model: authentik_providers_oauth2.scopemapping model: authentik_providers_oauth2.scopemapping
identifiers: identifiers:
@@ -101,15 +62,6 @@ entries:
"groups": [group.name for group in request.user.ak_groups.all()] "groups": [group.name for group in request.user.ak_groups.all()]
} }
- id: scope_offline
model: authentik_providers_oauth2.scopemapping
identifiers:
scope_name: offline_access
attrs:
name: "offline_access"
expression: |
return {}
# --- AI Tax Agent API (Production) ----------------------------------------- # --- AI Tax Agent API (Production) -----------------------------------------
- model: authentik_providers_oauth2.oauth2provider - model: authentik_providers_oauth2.oauth2provider
state: present state: present
@@ -134,20 +86,23 @@ entries:
scope_mappings: scope_mappings:
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "openid"], [managed, "goauthentik.io/providers/oauth2/scope-openid"],
] ]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "profile"], [managed, "goauthentik.io/providers/oauth2/scope-profile"],
]
- !Find [
authentik_providers_oauth2.scopemapping,
[managed, "goauthentik.io/providers/oauth2/scope-email"],
] ]
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, "email"]]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "groups"], [scope_name, "groups"],
] ]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "offline_access"], [managed, "goauthentik.io/providers/oauth2/scope-offline_access"],
] ]
authorization_flow: authorization_flow:
!Find [authentik_flows.flow, [slug, "default-authentication-flow"]] !Find [authentik_flows.flow, [slug, "default-authentication-flow"]]
@@ -195,20 +150,23 @@ entries:
scope_mappings: scope_mappings:
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "openid"], [managed, "goauthentik.io/providers/oauth2/scope-openid"],
] ]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "profile"], [managed, "goauthentik.io/providers/oauth2/scope-profile"],
]
- !Find [
authentik_providers_oauth2.scopemapping,
[managed, "goauthentik.io/providers/oauth2/scope-email"],
] ]
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, "email"]]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "groups"], [scope_name, "groups"],
] ]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "offline_access"], [managed, "goauthentik.io/providers/oauth2/scope-offline_access"],
] ]
authorization_flow: authorization_flow:
!Find [authentik_flows.flow, [slug, "default-authentication-flow"]] !Find [authentik_flows.flow, [slug, "default-authentication-flow"]]
@@ -258,20 +216,23 @@ entries:
scope_mappings: scope_mappings:
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "openid"], [managed, "goauthentik.io/providers/oauth2/scope-openid"],
] ]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "profile"], [managed, "goauthentik.io/providers/oauth2/scope-profile"],
]
- !Find [
authentik_providers_oauth2.scopemapping,
[managed, "goauthentik.io/providers/oauth2/scope-email"],
] ]
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, "email"]]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "groups"], [scope_name, "groups"],
] ]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "offline_access"], [managed, "goauthentik.io/providers/oauth2/scope-offline_access"],
] ]
authorization_flow: authorization_flow:
!Find [authentik_flows.flow, [slug, "default-authentication-flow"]] !Find [authentik_flows.flow, [slug, "default-authentication-flow"]]
@@ -318,12 +279,15 @@ entries:
property_mappings: property_mappings:
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "openid"], [managed, "goauthentik.io/providers/oauth2/scope-openid"],
] ]
- !Find [authentik_providers_oauth2.scopemapping, [scope_name, "email"]]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,
[scope_name, "profile"], [managed, "goauthentik.io/providers/oauth2/scope-email"],
]
- !Find [
authentik_providers_oauth2.scopemapping,
[managed, "goauthentik.io/providers/oauth2/scope-profile"],
] ]
- !Find [ - !Find [
authentik_providers_oauth2.scopemapping, authentik_providers_oauth2.scopemapping,