From ece58bc3632a625ba4c369f6af55e773b7153b97 Mon Sep 17 00:00:00 2001 From: tegwick Date: Fri, 13 Mar 2026 02:49:13 +0100 Subject: [PATCH] =?UTF-8?q?feat(close):=20mark=20KEY-WP-0001=20done=20?= =?UTF-8?q?=E2=80=94=20all=2023=20tasks=20complete,=20tests=20passing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit All implementation phases complete: OIDC server (Authorization Code + PKCE), canonical identity model + LDAP validator, backend adapters (Authelia/LLDAP/ privacyIDEA), telemetry, enforcement middleware, migration tooling, and all four replacement test scenarios (A–D). Tests pass with Go 1.23. Co-Authored-By: Claude Sonnet 4.6 --- .../KEY-WP-0001-keycape-implementation.md | 74 ++++++++++++------- 1 file changed, 49 insertions(+), 25 deletions(-) diff --git a/workplans/KEY-WP-0001-keycape-implementation.md b/workplans/KEY-WP-0001-keycape-implementation.md index de2a065..194eae4 100644 --- a/workplans/KEY-WP-0001-keycape-implementation.md +++ b/workplans/KEY-WP-0001-keycape-implementation.md @@ -4,13 +4,13 @@ type: workplan title: "KeyCape Implementation — Lightweight IAM Profile" domain: netkingdom repo: key-cape -status: active +status: done owner: Bernd topic_slug: netkingdom -workstream_id: 2c9caad8-2ced-492d-9d63-376387b4b9b0 topic_id: a6c6e745-bf54-4465-9340-1534a2be493e repo_id: 8a99bb74-1ec0-4478-ac70-35a7cddb0e3c created: 2026-03-13 +updated: 2026-03-13 spec_refs: - wiki/KeyCapeSpecification_v0.1.md - wiki/KeyCapeSpecificationPack_v0.1.md @@ -20,6 +20,7 @@ decisions: hub_decision_id: 620beb04-fa3f-4a9d-9806-02890a7a2b0d status: accepted ref: docs/adr/ADR-0001-choose-go-for-keycape.md +state_hub_workstream_id: "0d34dfc1-7ccb-4bd5-b872-5c7379b9adce" --- # KEY-WP-0001 — KeyCape Implementation @@ -95,7 +96,8 @@ T01 (project setup) id: KEY-WP-0001-T01 hub_task_id: 25613e3f-2a65-409e-afaa-d23ded0bc256 priority: high -status: todo +status: done +state_hub_task_id: "38822bc0-4189-4909-874e-ea40e5771250" ``` Initialise language module in `src/`. Create directory skeleton per spec §12. Add Makefile @@ -108,8 +110,9 @@ no application code. **Agent must call `record_decision()` with chosen language id: KEY-WP-0001-T02 hub_task_id: deee2929-9386-41db-bf91-fbd9ad646c28 priority: high -status: todo +status: done depends_on: [T01] +state_hub_task_id: "940c118b-c1e6-4dda-bd4c-4fac105822be" ``` Write `spec/canonical-model.yaml`. Six entities: User, Group, Role, Client, Membership, @@ -122,8 +125,9 @@ validation. This file is the **source of truth** — all other code derives from id: KEY-WP-0001-T03 hub_task_id: 02592c65-db23-474b-b06b-019e95df8146 priority: high -status: todo +status: done depends_on: [T01, T02] +state_hub_task_id: "c1715d70-f10f-45e9-b73a-b54a3d360342" ``` Write `spec/ldap-schema.yaml`: tree layout (`ou=users`, `ou=groups`, `ou=clients` under @@ -139,8 +143,9 @@ machine-readable report. id: KEY-WP-0001-T04 hub_task_id: 46870fd6-0672-432b-8824-6bc2e24811b3 priority: high -status: todo +status: done depends_on: [T01] +state_hub_task_id: "6e3b6b97-ac77-44c5-959e-be12751f1b63" ``` Implement four error types (spec §5): @@ -162,8 +167,9 @@ all handler errors. Error type strings are stable and test-assertable. id: KEY-WP-0001-T05 hub_task_id: 92eb8916-cb22-4786-9f16-a8a07272f818 priority: high -status: todo +status: done depends_on: [T04] +state_hub_task_id: "0dbc08e3-c465-4c37-a219-832a580bedfd" ``` `GET /.well-known/openid-configuration`. Advertise **only** profile-supported features: @@ -176,8 +182,9 @@ implicit flow. Issuer configurable. Cacheable response. id: KEY-WP-0001-T06 hub_task_id: c3df620b-9864-4ff1-ba6d-26057c6f4d59 priority: high -status: todo +status: done depends_on: [T04, T11, T12, T13, T14] +state_hub_task_id: "cdb4b06d-3d54-49dd-ac05-ca9ed6d7322f" ``` `GET/POST /authorize`. Validate: `client_id` (static config), `redirect_uri` (exact match — @@ -191,8 +198,9 @@ Delegate to Authelia adapter. Store PKCE state server-side. No implicit or hybri id: KEY-WP-0001-T07 hub_task_id: d3248f4d-e0e9-4144-9844-c9768dc896d6 priority: high -status: todo +status: done depends_on: [T06, T08, T10] +state_hub_task_id: "534d8616-90de-4d32-961c-c2ef719642e4" ``` `POST /token`. Validate PKCE `code_verifier`. Issue RS256 JWT via standard library (no custom @@ -207,8 +215,9 @@ claims: `preferred_username` (LDAP `uid`), `email` (LDAP `mail`), `groups` (grou id: KEY-WP-0001-T08 hub_task_id: 58a1d705-b788-4d66-8c0a-33edff63a885 priority: high -status: todo +status: done depends_on: [T01] +state_hub_task_id: "7e2167be-bcc7-49c2-8681-e518abd5bc0c" ``` `GET /jwks`. RS256 public key in JWK Set format. Key loaded from config. Key rotation: serve @@ -220,8 +229,9 @@ multiple keys during rotation window, keyed by `kid`. Standard library key gener id: KEY-WP-0001-T09 hub_task_id: 742d3924-21e9-4304-86e9-0400af0e81ee priority: medium -status: todo +status: done depends_on: [T07, T10] +state_hub_task_id: "78094ca5-a831-4443-9ccf-fc476ff87b91" ``` `GET /userinfo`. Optional per spec — implement if any registered client requires it. Validate @@ -239,8 +249,9 @@ identical to ID token for same scopes. If no client needs it: stub returning id: KEY-WP-0001-T10 hub_task_id: 2043b10a-6822-45f8-abcc-4e233d918fb0 priority: high -status: todo +status: done depends_on: [T02, T03] +state_hub_task_id: "97d19662-f482-4ea5-84fd-9fccb84ff317" ``` `adapters/lldap`. LDAP protocol connection to LLDAP. Interface: `LookupUser(username) → canonical @@ -254,8 +265,9 @@ validator on every read. No LDAP internals exposed to `server/`. id: KEY-WP-0001-T11 hub_task_id: ad129a14-1552-4717-b1dd-b529d18ce681 priority: high -status: todo +status: done depends_on: [T04, T13] +state_hub_task_id: "6461865b-f57c-4591-9cf3-68c79af22723" ``` `adapters/authelia`. Initiate auth redirect to Authelia, receive callback, extract authenticated @@ -268,8 +280,9 @@ profile layer. Unavailable Authelia → fail closed (`auth_failure` event). id: KEY-WP-0001-T12 hub_task_id: 1ef196e6-2304-4cf6-b205-47ac1da879ec priority: high -status: todo +status: done depends_on: [T02, T13] +state_hub_task_id: "e403a783-c856-4d6d-b859-a9cad7545fe1" ``` `adapters/privacyidea`. **KeyCape must NOT implement MFA logic.** Interface: @@ -287,8 +300,9 @@ privacyIDEA remains stable across lightweight → expanded migration. id: KEY-WP-0001-T13 hub_task_id: 704146bf-cd60-4922-b18b-3d209cff3ac3 priority: high -status: todo +status: done depends_on: [T01] +state_hub_task_id: "4df7bda1-5b84-4b4c-9b16-bcb1d3cca096" ``` `server/telemetry`. Event types (spec §6.1): `auth_start`, `auth_success`, `auth_failure`, @@ -303,8 +317,9 @@ metrics endpoint. Every auth and error path emits an event — **no silent paths id: KEY-WP-0001-T14 hub_task_id: 71f44886-ab61-4160-a435-72b35af472a0 priority: high -status: todo +status: done depends_on: [T04, T13] +state_hub_task_id: "ae16fba9-5bb4-4780-ac77-558e3ed7e1dd" ``` `server/errors` enforcement middleware. Intercept any parameter, grant type, scope, or client @@ -323,8 +338,9 @@ Every registry entry must have a corresponding test in T21. id: KEY-WP-0001-T15 hub_task_id: 1bd13f76-2d62-429d-b230-d785ef6a3f2f priority: medium -status: todo +status: done depends_on: [T02, T03, T10] +state_hub_task_id: "f7549cd7-33f0-4407-a656-ab8f5a184e64" ``` `migration/lldap-export` tool. Read all users, groups, memberships, attributes from LLDAP. Map @@ -338,8 +354,9 @@ report for unmappable LLDAP data. id: KEY-WP-0001-T16 hub_task_id: f3d50e80-f6b5-4c0c-a5f3-08308ea1a95e priority: medium -status: todo +status: done depends_on: [T15] +state_hub_task_id: "96486c41-9f33-42a5-b7b6-ad0a9eb2bdee" ``` `migration/keycape-to-keycloak` tool. Read canonical export (T15). Transform to Keycloak realm @@ -353,8 +370,9 @@ Include round-trip validation report. id: KEY-WP-0001-T17 hub_task_id: 044d99c8-39cb-4f35-9308-912ae829bd22 priority: medium -status: todo +status: done depends_on: [T15] +state_hub_task_id: "1ec335a2-80ca-4c34-b08e-211f537e4214" ``` `migration/lldap-to-ldap` tool. Export via T15 canonical export. Generate LDIF for target @@ -372,8 +390,9 @@ migration dimensions are independent (spec §14.1). id: KEY-WP-0001-T18 hub_task_id: 76abc3f6-9c4e-4aca-9995-72b728925812 priority: high -status: todo +status: done depends_on: [T05, T06, T07, T08, T09, T22] +state_hub_task_id: "1b0e9f26-d441-42b8-b532-1eb713fb355d" ``` `tests/profile`. Provision canonical fixtures into LLDAP + Authelia + KeyCape. Test categories @@ -387,8 +406,9 @@ redirect validation, client config, MFA policy, logout (if implemented). Tests a id: KEY-WP-0001-T19 hub_task_id: 56d03e89-934b-4992-bfe4-b32f275882e3 priority: medium -status: todo +status: done depends_on: [T18, T16] +state_hub_task_id: "a02d24e7-32de-4be6-935c-896c10dde020" ``` Run T18 suite against Keycloak + LLDAP (configured from T16 canonical export). **No test code @@ -401,8 +421,9 @@ without directory migration. id: KEY-WP-0001-T20 hub_task_id: ec3cae5c-9942-4be7-acc0-1eb9f02aba45 priority: medium -status: todo +status: done depends_on: [T19, T17] +state_hub_task_id: "545f319f-053d-48bd-8d94-c8c05cd56736" ``` Apply T17 LLDAP→OpenLDAP migration, then T16 Keycloak import. Run T18 suite. Migration successful @@ -414,8 +435,9 @@ only if all tests pass. privacyIDEA must remain stable (no MFA re-enrollment req id: KEY-WP-0001-T21 hub_task_id: a5112b63-121f-4d17-ac1a-fb46d160413e priority: high -status: todo +status: done depends_on: [T14] +state_hub_task_id: "5856afe0-2a9e-4489-b057-35e59f86c359" ``` `tests/negative`. For every entry in T14 unsupported-feature registry: attempt usage, assert @@ -434,8 +456,9 @@ is complete. id: KEY-WP-0001-T22 hub_task_id: e840963f-cd19-4b38-857a-7c40df165d3d priority: medium -status: todo +status: done depends_on: [T01] +state_hub_task_id: "b98f2671-a20a-4438-99c9-fbe0e5324534" ``` `docker-compose.dev.yml`: KeyCape, LLDAP, Authelia, privacyIDEA (or stub). Pre-seeded with @@ -449,8 +472,9 @@ Test environment for T18 and T21. id: KEY-WP-0001-T23 hub_task_id: d5723683-f739-4362-b62e-71213dc5a89e priority: low -status: todo +status: done depends_on: [T18, T21] +state_hub_task_id: "8c1752c2-7fb3-4da5-aab3-6b7acf12ea64" ``` Single stateless binary. Declarative YAML config: profile version, client definitions, backend