hsiegeln 03ff9a3813 feat: generic OIDC role extraction from access token ...

The OIDC login flow now reads roles from the access_token (JWT) in
addition to the id_token. This fixes role extraction with providers
like Logto that put scopes/roles in access tokens rather than id_tokens.

- Add audience and additionalScopes to OidcConfig for RFC 8707 resource
  indicator support and configurable extra scopes
- OidcTokenExchanger decodes access_token with at+jwt-compatible processor,
  falls back to id_token if access_token is opaque or has no roles
- syncOidcRoles preserves existing local roles when OIDC returns none
- SPA includes resource and additionalScopes in authorization requests
- Admin UI exposes new config fields

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-07 10:16:52 +02:00

.gitea

fix: pass commit short hash as version to UI sidebar

2026-04-06 22:37:46 +02:00

.planning

Update docs for RBAC, OIDC, and user management

2026-03-14 12:41:41 +01:00

.playwright-mcp

revert: temporarily revert EIP_CIRCUIT_BREAKER compound rendering

2026-03-29 18:15:10 +02:00

.superpowers/brainstorm

revert: temporarily revert EIP_CIRCUIT_BREAKER compound rendering

2026-03-29 18:15:10 +02:00

cameleer3-server-app

feat: generic OIDC role extraction from access token

2026-04-07 10:16:52 +02:00

cameleer3-server-core

feat: generic OIDC role extraction from access token

2026-04-07 10:16:52 +02:00

deploy

fix: remove securityContext from UI pod — nginx needs root for setup

2026-04-06 22:06:07 +02:00

docs

feat: use design system brand icons for favicon, login, sidebar

2026-04-06 22:08:58 +02:00

examples

added RBAC mock and spec to examples

2026-03-17 16:21:25 +01:00

org/eclipse/elk

revert: temporarily revert EIP_CIRCUIT_BREAKER compound rendering

2026-03-29 18:15:10 +02:00

screenshots

revert: temporarily revert EIP_CIRCUIT_BREAKER compound rendering

2026-03-29 18:15:10 +02:00

ui

feat: generic OIDC role extraction from access token

2026-04-07 10:16:52 +02:00

.dockerignore

Add Docker build, K8s manifests, and CI/CD deploy pipeline

2026-03-12 19:01:39 +01:00

.gitattributes

Scaffold cameleer3-server project structure

2026-03-11 10:06:17 +01:00

.gitignore

chore: add .worktrees/ to .gitignore for worktree isolation

2026-03-27 18:27:34 +01:00

ci-log2.txt

revert: temporarily revert EIP_CIRCUIT_BREAKER compound rendering

2026-03-29 18:15:10 +02:00

ci-log.txt

revert: temporarily revert EIP_CIRCUIT_BREAKER compound rendering

2026-03-29 18:15:10 +02:00

CLAUDE.md

feat: use design system brand icons for favicon, login, sidebar

2026-04-06 22:08:58 +02:00

docker-compose.yml

feat: remove TimescaleDB, dead PG stores, and storage feature flags

2026-04-01 20:10:58 +02:00

Dockerfile

refactor: architecture cleanup — OIDC dedup, PKCE, K8s hardening

2026-04-06 21:57:29 +02:00

HOWTO.md

feat: use design system brand icons for favicon, login, sidebar

2026-04-06 22:08:58 +02:00

openapi.json

revert: temporarily revert EIP_CIRCUIT_BREAKER compound rendering

2026-03-29 18:15:10 +02:00

pom.xml

chore: upgrade cameleer3-common to 1.0-SNAPSHOT and enable snapshot resolution

2026-03-25 08:04:29 +01:00

UI_FINDINGS.md

revert: temporarily revert EIP_CIRCUIT_BREAKER compound rendering

2026-03-29 18:15:10 +02:00

Description

Observability server for Cameleer agents

25 MiB

Languages

Java 61.6%

TypeScript 30.2%

HTML 5.2%

CSS 2.9%