Publish curated Unraid-AppOps-Gateway source from 451646fee806a47e3256731766980a05a262dcdd

backend/app/db/init_db.py

@@ -2,13 +2,22 @@ from datetime import UTC, datetime
 
 from sqlalchemy import inspect, text
 from sqlmodel import SQLModel, select
-from . import session as db_session
-from .session import get_session
+
 from ..core.config import Settings
 from ..services.app_classifier import classify_container
 from ..services.app_registry import category_label
-from .models import App, AppContainerMapping, Connector, DiscoveredContainer, NotificationChannel, NotificationEvent, NotificationRule, Policy, WorkMeshPromotion
-
+from . import session as db_session
+from .models import (
+    App,
+    AppContainerMapping,
+    Connector,
+    DiscoveredContainer,
+    NotificationChannel,
+    NotificationEvent,
+    NotificationRule,
+    Policy,
+)
+from .session import get_session
 
 settings = Settings()
 
@@ -939,4 +948,6 @@ def _seed_policies() -> list[Policy]:
         Policy(id="policy-authentik-force-sync", action="authentik.force_sync", target="authentik", voice="blocked", manual="blocked", risk="high", reason="Force sync is a mutating operation and blocked in Connector V1."),
         Policy(id="policy-authentik-mass-edit", action="authentik.mass_edit", target="authentik", voice="blocked", manual="blocked", risk="critical", reason="Bulk Authentik mutations are blocked."),
         Policy(id="policy-authentik-unknown-mutation", action="authentik.unknown_mutation", target="authentik", voice="blocked", manual="blocked", risk="critical", reason="Unknown Authentik mutations fail closed."),
+        Policy(id="policy-forge-oidc-provision", action="forge.oidc.provision", target="itworx-forge", voice="blocked", manual="allowed", risk="critical", reason="The fixed Forge OIDC client may be provisioned only by an authenticated manual operator route; voice and generic Authentik mutations remain blocked."),
+        Policy(id="policy-forge-secret-prepare", action="forge.secrets.prepare", target="itworx-forge", voice="blocked", manual="blocked", risk="critical", reason="Preparing the fixed Forge bootstrap secret bundle is default-denied and requires an explicit exact-target manual operator policy; voice remains blocked."),
     ]