heph Authentik: grant offline_access scope (fixes spoke sync refresh-token 400) #371

Merged

eblume merged 1 commit from heph-offline-access into main

2026-06-06 18:29:48 -07:00

eblume commented

2026-06-06 18:07:43 -07:00

Owner

What

Add the offline_access scope mapping to the Authentik heph OAuth2 provider (argocd/manifests/authentik/configmap-blueprint.yaml, heph-provider block).

Why

The hephaestus spoke (gilbert) lost sync with the hub (indri): hephd's refresh_token grant was rejected by Authentik with 400 Bad Request, so the bearer token couldn't be refreshed and heph sync --status showed auth_failure: true.

Root cause: the heph CLI requests scope = "openid offline_access", but the provider only mapped openid/email/profile. Without offline_access granted, the refresh token is bound to the login session instead of the 30-day refresh-token window. When the session lapses, refresh fails and sync silently degrades. heph auth login only fixes it until the next session expiry.

Verification done pre-merge

Confirmed Authentik 2026.2.2 ships a built-in managed offline_access scope mapping (goauthentik.io/providers/oauth2/scope-offline_access), so !Find by scope_name resolves without declaring a new mapping. Verified via ak shell on the ringtail worker pod.
Blueprint YAML parses.

Verify after deploy

Sync ArgoCD authentik app from this branch; confirm the blueprint applies cleanly (Authentik worker logs).
On gilbert: re-auth to mint a fresh token —
heph auth login --hub-url http://indri.tail8d86e.ts.net:8787 --issuer https://authentik.ops.eblu.me/application/o/heph/ --client-id heph
Decode the new access token; confirm offline_access in the granted scope.
heph sync --status → auth_failure: false, fresh last_success_ms.
Durable check: sync survives past the Authentik session window with no manual re-login.

Changes

Provider property_mappings += offline_access (with inline rationale comment)
docs/reference/services/hephaestus.md: document the offline_access requirement
Changelog fragment

heph task: 01KTFRWXFAD4Q1MDXKJ87WZD34

🤖 Generated with Claude Code

## What Add the `offline_access` scope mapping to the Authentik `heph` OAuth2 provider (`argocd/manifests/authentik/configmap-blueprint.yaml`, `heph-provider` block). ## Why The hephaestus **spoke (gilbert)** lost sync with the **hub (indri)**: hephd's `refresh_token` grant was rejected by Authentik with `400 Bad Request`, so the bearer token couldn't be refreshed and `heph sync --status` showed `auth_failure: true`. Root cause: the `heph` CLI requests `scope = "openid offline_access"`, but the provider only mapped `openid`/`email`/`profile`. Without `offline_access` granted, the refresh token is bound to the login **session** instead of the 30-day refresh-token window. When the session lapses, refresh fails and sync silently degrades. `heph auth login` only fixes it until the next session expiry. ## Verification done pre-merge - Confirmed Authentik 2026.2.2 ships a built-in managed `offline_access` scope mapping (`goauthentik.io/providers/oauth2/scope-offline_access`), so `!Find` by `scope_name` resolves without declaring a new mapping. Verified via `ak shell` on the ringtail worker pod. - Blueprint YAML parses. ## Verify after deploy 1. Sync ArgoCD authentik app from this branch; confirm the blueprint applies cleanly (Authentik worker logs). 2. On gilbert: re-auth to mint a fresh token — `heph auth login --hub-url http://indri.tail8d86e.ts.net:8787 --issuer https://authentik.ops.eblu.me/application/o/heph/ --client-id heph` 3. Decode the new access token; confirm `offline_access` in the granted `scope`. 4. `heph sync --status` → `auth_failure: false`, fresh `last_success_ms`. 5. Durable check: sync survives past the Authentik session window with no manual re-login. ## Changes - Provider `property_mappings` += `offline_access` (with inline rationale comment) - `docs/reference/services/hephaestus.md`: document the `offline_access` requirement - Changelog fragment heph task: `01KTFRWXFAD4Q1MDXKJ87WZD34` 🤖 Generated with [Claude Code](https://claude.com/claude-code)

eblume added 1 commit

2026-06-06 18:07:43 -07:00

heph Authentik: grant offline_access scope (fixes spoke sync refresh-token 400) 50a36ff93a

The heph CLI requests scope "openid offline_access", but the Authentik
heph OAuth2 provider only mapped openid/email/profile. Without the
offline_access mapping the issued refresh token is bound to the login
session rather than the 30-day refresh-token window; once the session
lapses, hephd's refresh_token grant returns 400 Bad Request and spoke
sync silently degrades (heph sync --status -> auth_failure: true).

Add the built-in offline_access scope mapping to the provider's
property_mappings and document the requirement in the service reference.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>