# First KnownSecurityCase of oidc-browser-relying-party 1.1 (NK-WP-0048-T06).
# Parameters are the request the founder accepted on 2026-10-08
# (key-cape docs/forgejo-oidc-client-request.yaml, KEY-WP-0038-T01); that
# acceptance carries over as this case's acceptance. One difference: custody is
# derived by the type (platform/workloads/keycape/forgejo), not the request's
# proposed platform/workloads/forgejo/netkingdom-oidc-client. The founder
# acknowledged that derivation with the type (memo r4, 2026-10-09).
# Re-pinned from 1.0 to 1.1 on 2026-10-10 on the founder's go, before any
# apply, so no 1.0 run overlaps (minor change: consumer-enforces-groups).
apiVersion: netkingdom.io/security-case/v0.1
kind: SecurityCase
spec:
  id: forgejo-netkingdom-oidc
  type: oidc-browser-relying-party@1.1
  status: accepted
  acceptance:
    at: "2026-10-08"
    record: "key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e"
    by:
      - {role: owner, name: "founder (for railiance-apps)"}
      - {role: founder, name: founder}
  owner:
    repo: railiance-apps
    person: founder
  parameters:
    client_id: forgejo
    display_name: Forgejo source forge
    redirect_uris: https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
    allowed_scopes: openid,profile,email,groups
    client_type: confidential
    mfa_required: "true"
    access_groups: forge-admins,forge-coulomb-owners,forge-coulomb-readers
    initial_members: forge-admins=tegwick;forge-coulomb-owners=tegwick
    consuming_service: forgejo
    consumer_owner_repo: railiance-apps