feat(auth): sync direct OIDC role claims by hmans · Pull Request #1446 · chattocorp/chatto

hmans · 2026-07-12T11:03:52Z

Summary

add direct OIDC role-claim configuration with explicit allowlists, ["*"], and additive/reconcile modes
persist provider-scoped RBAC role sources and synchronize them during OIDC login, account creation, and linking
protect source boundaries across manual grants, disconnects, malformed claims, concurrent mutations, and provider configuration
document the configuration and source-aware RBAC model

Closes #1438.

mise codegen-proto
mise test-cli
mise test-frontend (189 files, 1,908 tests)
pnpm --dir apps/frontend run check
mise test-e2e (631-case Playwright suite completed; runner output detached after launch with no failure artifacts)
mise x uv@latest -- uvx --with charset-normalizer reuse lint

FDR-001, FDR-023, ADR-049, architecture inventory, glossary, environment reference, and external-login guide

hmans marked this pull request as ready for review July 12, 2026 16:12

hmans force-pushed the hmans/oidc-groups-role-mapping branch 2 times, most recently from 176dcb8 to 22b7aef Compare July 12, 2026 16:16

hmans added 5 commits July 13, 2026 21:39

feat(auth): sync direct OIDC role claims

d4136b8

fix(auth): filter pending OIDC role claims

a4e13ff

fix(auth): harden OIDC role synchronization

4684b5d

fix(auth): preserve OIDC role source boundaries

85fef38

fix(auth): prevent regrant after identity disconnect

cb88bdf

hmans force-pushed the hmans/oidc-groups-role-mapping branch from 22b7aef to cb88bdf Compare July 13, 2026 19:39