One clause of Single sign-on left a question open: "whether an access policy should be bound
to the audiobookshelf application to narrow who may even reach the login". An open question in
a runbook is an invitation to re-litigate it, so this records the answer instead.
Decision (Frank, 2026-11-03)
The wide auto-registered default is accepted on purpose: every authentik account that can
reach the application becomes a listener with accessAllLibraries: true and download: true,
and no access policy is bound to the audiobookshelf application. It is not a defect to
"fix". Narrowing is a per-account judgement in Settings → Users.
What that makes load-bearing is named in the same paragraph: authentik's own invitation/signup
flow. Because the claim grants user to every signer and auto-registration is on, an account
created there is a listener the moment it signs in — so that flow stays something only Frank
drives. Revoking one person is a disable/delete of their ABS user; revoking everyone is that
signup flow.
Change
One paragraph on the page that owns the fact — serverAppConfigs-docs/Dankserver/Audiobookshelf.md.
No script, unit, spec or Caddy change; nothing to deploy.
Static suite: ./tests/run.sh on the branch → 824 passed, ALL TESTS PASSED. (Run with
the worktree's tests/e2e/node_modules scratch symlink removed, which confirms the seams that
read the specs need no installed browser package.)
## Why
One clause of *Single sign-on* left a question open: "whether an access policy should be bound
to the `audiobookshelf` application to narrow who may even reach the login". An open question in
a runbook is an invitation to re-litigate it, so this records the answer instead.
## Decision (Frank, 2026-11-03)
The wide auto-registered default is **accepted on purpose**: every authentik account that can
reach the application becomes a listener with `accessAllLibraries: true` and `download: true`,
and **no access policy is bound** to the `audiobookshelf` application. It is not a defect to
"fix". Narrowing is a per-account judgement in **Settings → Users**.
What that makes load-bearing is named in the same paragraph: authentik's own invitation/signup
flow. Because the claim grants `user` to every signer and auto-registration is on, an account
created there is a listener the moment it signs in — so that flow stays something only Frank
drives. Revoking one person is a disable/delete of their ABS user; revoking everyone is that
signup flow.
## Change
One paragraph on the page that owns the fact — `serverAppConfigs-docs/Dankserver/Audiobookshelf.md`.
No script, unit, spec or Caddy change; nothing to deploy.
Static suite: `./tests/run.sh` on the branch → **824 passed**, `ALL TESTS PASSED`. (Run with
the worktree's `tests/e2e/node_modules` scratch symlink removed, which confirms the seams that
read the specs need no installed browser package.)
---
cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac99636f8bcb
Build worktree: `/tmp/wt-ssogrant` (branch `docs/abs-listener-default-decision`, off `origin/main` `1a47b83`).
The SSO paragraph left "whether an access policy should be bound to the
audiobookshelf application" open, which invites the next agent to relitigate
it. Frank's answer of 2026-11-03: accepted on purpose — every signer becomes a
listener with all libraries and downloads, no access policy on the application,
narrowing done per account in Settings -> Users. What that makes load-bearing is
authentik's own signup flow, now named in the same paragraph as the thing that
must stay operator-only.
dank
merged commit c9a8469d04 into main2026-11-03 03:09:19 -08:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Why
One clause of Single sign-on left a question open: "whether an access policy should be bound
to the
audiobookshelfapplication to narrow who may even reach the login". An open question ina runbook is an invitation to re-litigate it, so this records the answer instead.
Decision (Frank, 2026-11-03)
The wide auto-registered default is accepted on purpose: every authentik account that can
reach the application becomes a listener with
accessAllLibraries: trueanddownload: true,and no access policy is bound to the
audiobookshelfapplication. It is not a defect to"fix". Narrowing is a per-account judgement in Settings → Users.
What that makes load-bearing is named in the same paragraph: authentik's own invitation/signup
flow. Because the claim grants
userto every signer and auto-registration is on, an accountcreated there is a listener the moment it signs in — so that flow stays something only Frank
drives. Revoking one person is a disable/delete of their ABS user; revoking everyone is that
signup flow.
Change
One paragraph on the page that owns the fact —
serverAppConfigs-docs/Dankserver/Audiobookshelf.md.No script, unit, spec or Caddy change; nothing to deploy.
Static suite:
./tests/run.shon the branch → 824 passed,ALL TESTS PASSED. (Run withthe worktree's
tests/e2e/node_modulesscratch symlink removed, which confirms the seams thatread the specs need no installed browser package.)
cwd: /home/blank/.omp/wt/wt-20261030-163847-6d1fc1f · session: 01a18f2e-18b1-7573-bcd5-ac99636f8bcb
Build worktree:
/tmp/wt-ssogrant(branchdocs/abs-listener-default-decision, offorigin/main1a47b83).