axion1337.chat-gitops

4 Commits

Author	SHA1	Message	Date
Thore Cimbal	b13bb2381d	fix: Build matrix-recovery flow and link it as the login page's recovery flow Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s matrix-recovery existed but had zero stage bindings, and the real login flow (default-authentication-flow, MAS's authentication_flow) never linked to it, so users had no working "forgot password" path. Reused the same default-recovery-* stages the built-in default-recovery-flow already uses successfully, added our redirect stage at the end, and set default-authentication-identification.recovery_flow accordingly.	2026-07-27 23:28:10 +02:00
Thore Cimbal	fe575808b3	fix: Add redirect stage so matrix-invitation ends up at Element, not authentik dashboard Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s After the login stage, the flow had no destination, so it fell back to authentik's own /if/user/ interface - which refuses type=external users (the correct type for Matrix-only accounts), showing "Die Oberflaeche kann nur von internen Nutzern geoeffnet werden". Added a static redirect to https://axion1337.chat as the final stage.	2026-07-27 23:17:11 +02:00
Thore Cimbal	784459beed	fix: Clear erroneous validation_policies on matrix-invitation-prompt Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s The prompt stage had 16 unrelated system policies bound (OOBE, user settings, recovery, etc.), likely from a "select all" slip while configuring it manually. They crash when evaluated in an anonymous enrollment context (AnonymousUser has no group_attributes, etc.), surfacing as opaque errors after form submit. Cleared live and via the blueprint so re-application doesn't reintroduce them.	2026-07-27 23:11:38 +02:00
Thore Cimbal	314cf6dedb	fix: Repair matrix-invitation enrollment flow via Authentik Blueprint Auto-Deploy on Push / verify-and-notify (push) Canceled after 0s The matrix-invitation flow only had Invite+Prompt stage bindings, both at order=0 (undefined order), missing the Write/Password/Login stages entirely — invited users were never written to the DB. Applied the fix live in-cluster (mirroring the working matrix-enrollment stage chain), and captured it as an Authentik Blueprint (ConfigMap, mounted via blueprints.configMaps) so the flow state is reproducible via GitOps instead of manual admin-UI clicks.	2026-07-27 22:53:03 +02:00