tegwick
e2174cebaf
Adds verification consumer-enforces-groups and makes hand-over require the consumer to enforce access_groups (key-cape review R2). Founder go to move to 1.1 before any apply, so no 1.0 run overlaps. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 736651@bnt-lap001 Assistant-Session: f6189624-fd64-4109-b53e-f8a59ca8a2d8
35 lines
1.7 KiB
YAML
35 lines
1.7 KiB
YAML
# First KnownSecurityCase of oidc-browser-relying-party 1.1 (NK-WP-0048-T06).
|
|
# Parameters are the request the founder accepted on 2026-10-08
|
|
# (key-cape docs/forgejo-oidc-client-request.yaml, KEY-WP-0038-T01); that
|
|
# acceptance carries over as this case's acceptance. One difference: custody is
|
|
# derived by the type (platform/workloads/keycape/forgejo), not the request's
|
|
# proposed platform/workloads/forgejo/netkingdom-oidc-client. The founder
|
|
# acknowledged that derivation with the type (memo r4, 2026-10-09).
|
|
# Re-pinned from 1.0 to 1.1 on 2026-10-10 on the founder's go, before any
|
|
# apply, so no 1.0 run overlaps (minor change: consumer-enforces-groups).
|
|
apiVersion: netkingdom.io/security-case/v0.1
|
|
kind: SecurityCase
|
|
spec:
|
|
id: forgejo-netkingdom-oidc
|
|
type: oidc-browser-relying-party@1.1
|
|
status: accepted
|
|
acceptance:
|
|
at: "2026-10-08"
|
|
record: "key-cape docs/forgejo-oidc-client-request.yaml (status accepted-2026-10-08, KEY-WP-0038-T01); type acknowledged via informed-decision memo nk-wp-0048-t05-oidc-browser-relying-party-r4, hub decision e418263e"
|
|
by:
|
|
- {role: owner, name: "founder (for railiance-apps)"}
|
|
- {role: founder, name: founder}
|
|
owner:
|
|
repo: railiance-apps
|
|
person: founder
|
|
parameters:
|
|
client_id: forgejo
|
|
display_name: Forgejo source forge
|
|
redirect_uris: https://forgejo.coulomb.social/user/oauth2/netkingdom/callback
|
|
allowed_scopes: openid,profile,email,groups
|
|
client_type: confidential
|
|
mfa_required: "true"
|
|
access_groups: forge-admins,forge-coulomb-owners,forge-coulomb-readers
|
|
initial_members: forge-admins=tegwick;forge-coulomb-owners=tegwick
|
|
consuming_service: forgejo
|
|
consumer_owner_repo: railiance-apps
|