From ec0646657d76d5aaa4f9b39e242c6ce4d6505937 Mon Sep 17 00:00:00 2001
From: unkin-agent <unkin-agent@unkin.net>
Date: Mon, 24 Aug 2026 22:01:25 +1000
Subject: [PATCH] Add adult/kids media groups for media split

The media services are splitting into an adult (fafflix) and kids (cheeztv)
tier, and Authentik group membership will drive the media proxy's routing and
authorization. This adds the two-tier RBAC groups so users can be assigned the
right media access ahead of the provider/application wiring.

- Add akP-media-fafflix and akP-media-cheeztv per-service permission entitlements
  (unbound, so they surface in the hierarchical ak_groups claim for the proxy)
- Add akR-media-adult role nesting both fafflix and cheeztv (adults reach both)
- Add akR-media-kids role nesting only cheeztv (kids reach kids services only)
---
 config/permissions/akP-media-cheeztv.yaml | 6 ++++++
 config/permissions/akP-media-fafflix.yaml | 6 ++++++
 config/roles/akR-media-adult.yaml         | 8 ++++++++
 config/roles/akR-media-kids.yaml          | 7 +++++++
 4 files changed, 27 insertions(+)
 create mode 100644 config/permissions/akP-media-cheeztv.yaml
 create mode 100644 config/permissions/akP-media-fafflix.yaml
 create mode 100644 config/roles/akR-media-adult.yaml
 create mode 100644 config/roles/akR-media-kids.yaml

diff --git a/config/permissions/akP-media-cheeztv.yaml b/config/permissions/akP-media-cheeztv.yaml
new file mode 100644
index 0000000..388b63e
--- /dev/null
+++ b/config/permissions/akP-media-cheeztv.yaml
@@ -0,0 +1,6 @@
+# Permission group akP-media-cheeztv (name = filename). Per-service entitlement
+# for the kids ("cheeztv") media tier: NOT bound to any application (no
+# `application` field), so it does not gate OIDC. It exists purely to appear in
+# the user's hierarchical `ak_groups` claim, which the media proxy reads to
+# decide whether to route/authorize the cheeztv backend.
+attributes: {}
diff --git a/config/permissions/akP-media-fafflix.yaml b/config/permissions/akP-media-fafflix.yaml
new file mode 100644
index 0000000..366e18f
--- /dev/null
+++ b/config/permissions/akP-media-fafflix.yaml
@@ -0,0 +1,6 @@
+# Permission group akP-media-fafflix (name = filename). Per-service entitlement
+# for the adult ("fafflix") media tier: NOT bound to any application (no
+# `application` field), so it does not gate OIDC. It exists purely to appear in
+# the user's hierarchical `ak_groups` claim, which the media proxy reads to
+# decide whether to route/authorize the fafflix backend.
+attributes: {}
diff --git a/config/roles/akR-media-adult.yaml b/config/roles/akR-media-adult.yaml
new file mode 100644
index 0000000..16f88e2
--- /dev/null
+++ b/config/roles/akR-media-adult.yaml
@@ -0,0 +1,8 @@
+# Role akR-media-adult (name = filename): adult media tier. Adults reach both the
+# adult ("fafflix") and kids ("cheeztv") services, so this role nests both
+# per-service entitlements. Membership propagates child -> parent, so a member
+# appears in both permission groups in the hierarchical `ak_groups` claim and the
+# media proxy routes/authorizes them for fafflix and cheeztv.
+permissions:
+  - akP-media-fafflix
+  - akP-media-cheeztv
diff --git a/config/roles/akR-media-kids.yaml b/config/roles/akR-media-kids.yaml
new file mode 100644
index 0000000..7882eb3
--- /dev/null
+++ b/config/roles/akR-media-kids.yaml
@@ -0,0 +1,7 @@
+# Role akR-media-kids (name = filename): kids media tier. Kids reach only the
+# kids ("cheeztv") service, so this role nests just that per-service entitlement.
+# Membership propagates child -> parent, so a member appears in akP-media-cheeztv
+# in the hierarchical `ak_groups` claim and the media proxy routes/authorizes
+# them for cheeztv only (never fafflix).
+permissions:
+  - akP-media-cheeztv