coulomb/flex-auth
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(authz): bind decisions to exact actions
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 37s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02e47-6aac-7ee1-914d-0584c75d3c81
This commit is contained in:
tegwick 2026-08-23 13:18:26 +02:00
parent 7323dd1a60
commit c473f1971d
28 changed files with 644 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

37
workplans/ADHOC-2026-08-23.md Normal file
View file

@ -0,0 +1,37 @@
---
id: ADHOC-2026-08-23
type: workplan
title: "Inbound caller-auth and deployment documentation corrections"
domain: infotech
repo: flex-auth
status: finished
owner: codex
topic_slug: netkingdom
created: "2026-08-23"
updated: "2026-08-23"
---
## Classify rejected TokenReview credentials as unauthenticated
```task
id: ADHOC-2026-08-23-T01
status: done
priority: medium
```
Treat a successful TokenReview response that rejects a bearer token as an
authentication failure (HTTP 401), while retaining HTTP 503 for transport,
HTTP, and response-decode failures. Regression coverage exercises the reviewer
and authenticator seam.
## Correct NetworkPolicy egress documentation
```task
id: ADHOC-2026-08-23-T02
status: done
priority: low
```
Document that caller-authenticated pins permit TCP 443 and 6443 without a
destination selector for Kubernetes TokenReview, while pins without caller
authentication retain deny-all egress.