Repository navigation
Implement chapter 17: the client block and what it derives #429
Description
Chapter 17 (spec/v1/17-sign-in.md) and 0100 specify the client block on an Application ahead of any implementation. This issue tracks implementing it, so the nine codes the chapter defines can leave the pending list in scripts/lint-codes.ts.
Scope
- Schema: the
clientblock on an Application (signIn,exposure,label,description,iconPath,launchPath,redirectPaths,protectedPath,credential,roles) andsignIn(issuer,provider) in the Platform document. - Derivation: forward-auth from Audience and Client together; the
/.auth/route for gated Clients; the derived client credential path, its read grant and the provider's write grant; the${client:issuer|id|secret}placeholders. - Deliverables: the cluster-scoped
Clientobject from thekubernetesadapter; the/.auth/route from thetraefikadapter. - Release Gate: the anonymous request to a native Client's
protectedPath.
Codes to exercise
E_AUTHENTICATED_WITHOUT_CLIENT, E_CLIENT_AUDIENCE, E_CLIENT_EXPOSURE_UNRESOLVED, E_CLIENT_FIELD_FOR_MODE, E_CLIENT_OPEN, E_CLIENT_PLACEHOLDER_WITHOUT_SECRET, E_DUPLICATE_APP_ROLE, E_GATE_PATH_CLAIMED, E_NO_SIGN_IN_PROVIDER
Ordering
E_AUTHENTICATED_WITHOUT_CLIENT refuses every authenticated exposure that has no Client yet. It should only be enforced once the estate's projects carry client blocks, which follows the identity rollout (JorisJonkers-dev/identity).
Activity
docs: specify the client block an Application signs people in with (#430
ExtraToast commentedon Oct 22, 2026
#544 has landed (#560 through #570), so
feat/429-client-block(3fa7a6f) can be rebased onto main now. The paths it overlapped have moved:apps/<project>/vault-policy/(feat(model): a Vault policy job per Project, in its own unit #564);apps/<project>/<application>/route-<exposure>.yaml, applied by the Project's own unit (feat(delivery): apply a Project's routes from its own unit, after the edge Project #567);estate.qvtois gone, so the model-driven pipeline is lower, resolve, render (refactor(emf): remove the estate pass, so the pipeline is lower, resolve, render #570);consumes.deploy-kit.jorisjonkers.dev/<application>.<surface>pod label (feat(model): a provider admits its consumers by a label each carries, so a new consumer re-renders only itself #569).ExtraToast commentedon Oct 24, 2026
Chapter 17 is built in TypeScript: #577 (the client block and its refusals) and #597 (what a Client derives) are merged. Two codes stay pending, each waiting on work outside this repository:
E_AUTHENTICATED_WITHOUT_CLIENT: enforced once hindsight, immich, karakeep and estate-dashboard declare aclient, after the identity rollout (Create every per-Project secret in the cluster: generated keys, database credentials and OIDC clients #444).E_CLIENT_OPEN: the anonymous request to a native Client'sprotectedPathbelongs to the Release Gate in JorisJonkers-dev/delivery; the path is now in the release-gate inputs.The model-driven side waits for the post-1.0 catch-up (
emf/is frozen, #585). Marked blocked until then.