Report access gateway on directory groups

A directory group decides access to a report. No more handing it out one by one.

What was built

Reports sat in GitLab Pages, access handed out by hand. I wrote a gateway: sign-in through the corporate OIDC, then a group check before every report. GitLab itself never faces outward. The cookie was the fiddly part. A full group list blows the 4 KB limit, and the user got an endless redirect. Now it holds only groups that intersect the access map. The unit of permission is now the report type. 73 tests, written alongside.

Stack

Python / FastAPIAuthlibOIDC + PKCEActive DirectoryGitLab PageshttpxDocker

Other work