[braghettos]

Deletes the legacy RESTAction copy path. Nothing on 057, demo or acmp's blueprints still needs it.

Why now

• Demo was the last known user. Its krateo-system/github-oauth-restaction was applied by hand, not from krateo-saas (whose feat: stamp strategy and groups on every <user>-clientconfig Secret (#42) #44 already added the header). On 2026-11-08, with Diego's approval, authn added only ${ "Authorization: Bearer " + .token } to its userInfo stage. The GitHub sign-ins that followed, at 19:59Z and 20:00Z, logged user info successfully fetched and no restaction fell back to the legacy copy path.
• 057 has no OAuthConfig or OIDCConfig.
• installer renders no OAuthConfig or OIDCConfig, on a parent or in a child.
• acmp: the child configs have no restActionRef. The parent's restaction-github-groups.yaml sends the header on both stages.

Change

• LegacyResolve is deleted, with copyRestActionWithEndpoints, deleteRestActionCopyWithEndpoints and restactions.go. It copied the RESTAction and its endpoint Secrets per user and wrote the user's IdP token into each Secret copy. A failed Resolve is now 500 RESTActionFailed straight away, with no retry through a copy. The log line is unable to resolve restaction (it was …, stopping). Observability checked: no alert or query matches either string.
• RBAC: the namespaced Role loses restactions get/create/update/delete, which only the copy path used. The cluster-wide get on restactions for group authn stays, because snowplow resolves the RESTAction as authn.
• checkKeys is deleted. Its only effect was to send an oidc RESTAction with extra status fields down the copy path. updateConfig already type-checks the five fields it reads and ignores the rest. So extra fields now simply don't matter, rather than turning a working RESTAction into a 500.
• Dependencies: github.com/krateo-platformops/snowplow is no longer a dependency, and github.com/google/uuid becomes indirect.
• Docs: behavior.md, gotchas.md, and log.md (dated 2026-11-08, with the evidence above).

Before upgrading

Any OAuthConfig or OIDCConfig with spec.restActionRef must point to a RESTAction whose stages send ${ "Authorization: Bearer " + .token }. One that doesn't will fail sign-in with 500 RESTActionFailed instead of falling back. On the release this goes into, authn's log shows the cases to fix before upgrading: every restaction fell back to the legacy copy path warn names the RESTAction.

Tests

oidc/restaction_test.go:

• the five fields override the ID token, and extra fields are ignored;
• exactly one POST /call/read, with the user's token in the body;
• a snowplow 504 is RESTActionFailed ("snowplow answered 504 Timeout"), with nothing minted and no second call.

The fake apiserver rejects any request other than reading the OIDCConfig, so a write to restactions or Secrets would fail the test. Since the rebase onto main, the test sends X-Code-Verifier: its OIDCConfig has no client secret, so since #104 it counts as a public client. The full suite passes, and the chart renders.

Release: 0.38.0 (behaviour and RBAC change), when Diego decides.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TLFnUeufsniBTiPtg82fDb