unkin-agent
ec0646657d
The media services are splitting into an adult (fafflix) and kids (cheeztv) tier, and Authentik group membership will drive the media proxy's routing and authorization. This adds the two-tier RBAC groups so users can be assigned the right media access ahead of the provider/application wiring. - Add akP-media-fafflix and akP-media-cheeztv per-service permission entitlements (unbound, so they surface in the hierarchical ak_groups claim for the proxy) - Add akR-media-adult role nesting both fafflix and cheeztv (adults reach both) - Add akR-media-kids role nesting only cheeztv (kids reach kids services only)
7 lines
381 B
YAML
7 lines
381 B
YAML
# Permission group akP-media-fafflix (name = filename). Per-service entitlement
|
|
# for the adult ("fafflix") media tier: NOT bound to any application (no
|
|
# `application` field), so it does not gate OIDC. It exists purely to appear in
|
|
# the user's hierarchical `ak_groups` claim, which the media proxy reads to
|
|
# decide whether to route/authorize the fafflix backend.
|
|
attributes: {}
|