coulomb/key-cape
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make the LLDAP export report its own completeness
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 31s
Details

Browse source 
The exporter discovered groups by walking each user's memberships, so a group
nobody belongs to never reached the snapshot, and a failed lookup was skipped by
a `continue` under a comment claiming it was recorded in the incompatibility
report. The run then emitted `result: "success"`.

Add an optional `domain.GroupLister` capability and implement `ListGroups` on
the LLDAP adapter as a direct group-subtree search, kept off `UserRepository`
because the OIDC layer never enumerates the directory. Record `groupEnumeration`
on every result and a `Complete()` predicate over it; abort rather than write a
smaller snapshot when the enumeration fails; report a failed per-user lookup on
the fallback path; emit `partial` telemetry and name the mode from the CLI.

Reading the adapter to write this surfaced a defect the assessment had not
listed: `LookupGroups` never populated `Group.Members`, and the exporter built
every membership from that field, so against a real directory the `memberships`
block was always empty while the fixture-backed tests passed. Memberships on the
fallback path now come from the user/group pair actually observed.

Sort users, groups and memberships so an unchanged directory exports
identically. Closes G05 of the scope/intent assessment.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012WAsfsfQmDu4vcBhiMcmQp

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 867844@bnt-lap001
Assistant-Session: 3d45905e-0016-4b49-b828-231406881f7b
This commit is contained in:
tegwick 2026-09-07 08:45:50 +02:00
parent 7fe5bccc7c
commit f7dd51b8d2
9 changed files with 538 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

17
history/2026-09-05-011726-scope-intent-assessment.md
View file

@ -184,6 +184,23 @@ unspecified.
reads, define ordering, and test empty groups and backend failures. Preserve
completeness evidence before claiming deterministic full snapshots.
**Status 2026-09-07 (KEY-WP-0018): closed.** `LDAPAdapter` gained a
`ListGroups` enumeration over the group subtree, offered to the exporter through
an optional `domain.GroupLister` rather than by widening `UserRepository`, so
groups with no members are in the snapshot and `Group.Members` is populated from
the directory. Reading the adapter to write it surfaced a defect the assessment
had not listed: `LookupGroups` never set `Members`, and the exporter built every
membership from that field, so a real export's `memberships` block was always
empty while the fixture-backed tests passed. Each result now carries
`groupEnumeration` (`directory` or `membership-derived`) and a `Complete()`
predicate; a failed enumeration aborts instead of writing a smaller snapshot, a
failed per-user lookup on the fallback path is reported rather than dropped, an
incomplete run emits `partial` telemetry, and the CLI names the mode. Users,
groups and memberships are sorted on stable keys. Tests cover the empty group,
the enumeration failure, the fallback lookup failure and repeat-run determinism.
This is completeness evidence for the user/group/membership surface only —
credential migration remains out of scope under G03.
### G06 — The validator is narrower than schema enforcement
**Priority: medium. Kind: implementation/claim gap.**