axion1337.chat-gitops

6 Commits

Author	SHA1	Message	Date
Thore Cimbal	aa42d0530a	fix: Set Brand.default_application so "/" doesn't dead-end at /if/user/ Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s Several dead ends (TOTP/WebAuthn setup after an anonymous visit bounces through login and lands on "/") trace back to Brand.default_application being unset, which falls back to /if/user/ - blocked for type=external Matrix accounts. Set it to the matrix Application. Only changes the bare "/" fallback; explicit URLs like /if/admin/ are unaffected.	2026-07-27 23:40:56 +02:00
Thore Cimbal	826fc8dbd3	fix: Append redirect stage to TOTP/WebAuthn self-service setup flows Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s 2FA is intentionally optional (not_configured_action=skip on the login flow's validate stage). Users who opt in use the built-in single-stage default-authenticator-totp-setup / -webauthn-setup flows directly, since /if/user/ is blocked for type=external Matrix accounts. Both flows had nothing after the setup stage, so completing enrollment fell back to that same blocked dashboard. Appended the shared redirect stage.	2026-07-27 23:35:55 +02:00
Thore Cimbal	b13bb2381d	fix: Build matrix-recovery flow and link it as the login page's recovery flow Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s matrix-recovery existed but had zero stage bindings, and the real login flow (default-authentication-flow, MAS's authentication_flow) never linked to it, so users had no working "forgot password" path. Reused the same default-recovery-* stages the built-in default-recovery-flow already uses successfully, added our redirect stage at the end, and set default-authentication-identification.recovery_flow accordingly.	2026-07-27 23:28:10 +02:00
Thore Cimbal	fe575808b3	fix: Add redirect stage so matrix-invitation ends up at Element, not authentik dashboard Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s After the login stage, the flow had no destination, so it fell back to authentik's own /if/user/ interface - which refuses type=external users (the correct type for Matrix-only accounts), showing "Die Oberflaeche kann nur von internen Nutzern geoeffnet werden". Added a static redirect to https://axion1337.chat as the final stage.	2026-07-27 23:17:11 +02:00
Thore Cimbal	784459beed	fix: Clear erroneous validation_policies on matrix-invitation-prompt Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s The prompt stage had 16 unrelated system policies bound (OOBE, user settings, recovery, etc.), likely from a "select all" slip while configuring it manually. They crash when evaluated in an anonymous enrollment context (AnonymousUser has no group_attributes, etc.), surfacing as opaque errors after form submit. Cleared live and via the blueprint so re-application doesn't reintroduce them.	2026-07-27 23:11:38 +02:00
Thore Cimbal	314cf6dedb	fix: Repair matrix-invitation enrollment flow via Authentik Blueprint Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s The matrix-invitation flow only had Invite+Prompt stage bindings, both at order=0 (undefined order), missing the Write/Password/Login stages entirely — invited users were never written to the DB. Applied the fix live in-cluster (mirroring the working matrix-enrollment stage chain), and captured it as an Authentik Blueprint (ConfigMap, mounted via blueprints.configMaps) so the flow state is reproducible via GitOps instead of manual admin-UI clicks.	2026-07-27 22:53:03 +02:00