feat: implement GitHub org-gated access for coder.ddev.com, fixes #64 by rfay · Pull Request #131 · ddev/coder-ddev

rfay · 2026-05-07T22:17:04Z

Summary

User creation and authentication control #64

Implements GitHub org-gated access for coder.ddev.com. New signups and re-authentication are restricted to members of approved GitHub organizations. This is also the first mission driven through spec-kitty, initializing the project's spec-driven development infrastructure.

spec-kitty initialization

This branch introduces two new top-level directories that will persist for all future initiatives:

.kittify/ — project-level spec-kitty configuration: project charter (governance, quality directives, stakeholder roles), config, and skills manifest. Consulted by every future spec-kitty mission to validate scope and constraints.
kitty-specs/github-org-gated-signup-01KR1P4G/ — the complete specification record for this initiative: requirements (spec.md), research evidence log and source register, data model, implementation plan, work-package manifest (wps.yaml), task files (WP01–WP04), requirement-traceability checklist, and append-only mission event log. Future initiatives get their own subdirectory alongside this one.

Changes

docs/admin/server-setup.md

Full CODER_OAUTH2_GITHUB_ALLOWED_ORGS list (27 orgs: ddev, coder-ddev-com, and 25 confirmed $100+/mo sponsor orgs)
Two OAuth Apps section (staging and production have separate apps)
Managing individual access via the coder-ddev-com GitHub org
Sponsor org access policy table with verification status
"Adding a new sponsor org" runbook

docs/admin/user-management.md

New "Access Management" section: granting access via coder-ddev-com org membership, pre-creating password-exception accounts, private org membership / read:org scope explanation

docs/admin/coder-ddev-com/ (operator drafts — already applied to live repos)

org-profile-README.md → coder-ddev-com/.github profile/README.md
access-requests-README.md → coder-ddev-com/access-requests README
access-request-issue-template.yml → GitHub issue form template
sponsor-notification.md → template for notifying new sponsor orgs

docs/admin/blog-post-draft.md

Draft edits to apply to the existing coder.ddev.com blog post on ddev.com

docs/index.html (start.coder.ddev.com)

Auth callout updated: explains ddev org / sponsor org requirement, links to access-requests
"How it works" step 1 updated to mention org requirement

docs/access-denied.html

Friendly "Access Required" page at start.coder.ddev.com/access-denied explaining why access was denied and how to request it

Test plan

Merge to main and confirm start.coder.ddev.com reflects updated auth callout
Smoke test: ddev org member can sign in to coder.ddev.com
Smoke test: non-member sees "Unauthorized" and Coder login page service banner with explanation
Apply the same PUT /api/v2/appearance service_banner to production coder.ddev.com

🤖 Generated with Claude Code

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Closes #64. References #54. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…-signup Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… requirements Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…6, C-007) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…gside upsun Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…-kind

Auto-committed by spec-kitty before creating the lane worktree for WP01

- Expand ALLOWED_ORGS to full 27-org list (ddev + coder-ddev-com + 25 sponsor orgs) - Add staging OAuth App sub-section with separate callback URL - Document coder-ddev-com org purpose and individual membership management - Add sponsor org access policy table with all confirmed org slugs - Add runbook for adding a new sponsor org Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Auto-committed by spec-kitty before creating the lane worktree for WP02

- Add top-level Access Management section explaining the org-gated signup model - Document granting access via coder-ddev-com org membership - Document pre-creating password exception accounts via CLI and Web UI - Explain private org membership and read:org scope behavior - List initial coder-ddev-com members Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- docs/admin/blog-post-draft.md: ready-to-apply diff for ddev.com blog post - Replaces 'Log In with GitHub' section to explain access restrictions - Adds 'Requesting Access' paragraph with link to coder-ddev-com/access-requests - Adds sponsor org access benefit mention Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…y/mission-github-org-gated-signup-01KR1P4G

…1KR1P4G

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- Discord: ddev.com/s/discord - Issues: ddev/coder-ddev not ddev/ddev Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- start.coder.ddev.com auth-callout now explains ddev/sponsor org requirement and links to coder-ddev-com/access-requests - Add docs/access-denied.html for use as redirect target when unauthorized users hit the OAuth callback (used by the Caddy reverse-proxy fix) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

"the ddev" → "the ddev org" Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Explains project structure (.kittify/, kitty-specs/), when to use spec-kitty, how to start a mission, implementation lanes, key files (wps.yaml, spec.md, mission-events.jsonl), common pitfalls, and a completed missions table. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Changes have been applied directly to ddev/ddev.com src/content/blog/coder-ddev-com-announcement.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rfay and others added 30 commits May 7, 2026 12:15

chore: generate project charter for coder-ddev governance

7fa3a77

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Add spec for feature github-org-gated-signup-01KR1P4G

e69728a

Add meta for feature github-org-gated-signup-01KR1P4G

c630c2b

feat(spec): specify GitHub org-gated signup for coder.ddev.com

2a09a3c

Closes #64. References #54. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

chore: commit spec-kitty init artifacts and CI drupal-contrib addition

9794dbc

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

revert validate.yml change that belongs in another worktree

18e9a42

Add plan for feature github-org-gated-signup-01KR1P4G

e6ae58d

feat(plan): add implementation plan and research for github-org-gated…

8fa7b05

…-signup Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(spec): add org README, access-request repo, and blog post update…

daf3ea6

… requirements Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(spec): add sponsor org access requirements (FR-013, FR-014, C-00…

d494035

…6, C-007) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(research): resolve sponsor GitHub org slugs, add platformsh alon…

d07f3a6

…gside upsun Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(spec): add 8mylez, remove lets-talk, add sponsor notification task

9a05348

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(research): add dkd, liip, dougvann; finalize ALLOWED_ORGS list

7deb13d

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(research): add all featured sponsors to ALLOWED_ORGS, exclude in…

4cadb38

…-kind

chore: Map requirements for WP01, WP02, WP03, WP04 on spec github

e4ad8b5

chore: Map requirements for WP01 on spec github

ce56ac0

chore: Map requirements for WP02 on spec github

e672064

Add tasks for feature github-org-gated-signup-01KR1P4G

1c34c2c

Add plan for feature github-org-gated-signup-01KR1P4G

6e73737

Add tasks for feature github-org-gated-signup-01KR1P4G

8d985f8

chore: WP01 claimed for implementation

d0a0af1

chore: planning artifacts for github-org-gated-signup-01KR1P4G

e125c1d

Auto-committed by spec-kitty before creating the lane worktree for WP01

chore: Start WP01 implementation [claude]

0f4c50c

chore: Move WP01 to for_review on spec github [claude]

732ace1

chore: planning artifacts for github-org-gated-signup-01KR1P4G

c5947e8

Auto-committed by spec-kitty before creating the lane worktree for WP02

chore: WP02 claimed for implementation

bdf9c6d

chore: Start WP02 implementation [claude]

6b283ba

chore: Move WP02 to for_review on spec github [claude]

ce785cd

rfay and others added 20 commits May 7, 2026 19:01

chore: update mission events for WP03 claim

c4ef67e

chore: Move WP03 to for_review on spec github [claude]

a05f989

chore: Start WP04 implementation [claude]

fc09a35

chore: update mission events for WP04 claim

5ae65e4

chore: Move WP04 to for_review on spec github [claude]

625d4a2

chore: update mission events for WP01 review

9d366a5

chore: Move WP01 to approved on spec github [claude]

d898d26

chore: update mission events

f8ddafe

chore: Move WP02 to approved on spec github [claude]

7f33899

chore: update mission events for WP03 review

fd9b6da

chore: Move WP03 to approved on spec github [claude]

5e97046

chore: update mission events for WP04 review

ef4b4b1

chore: Move WP04 to approved on spec github [claude]

69428f1

Merge kitty/mission-github-org-gated-signup-01KR1P4G-lane-b into kitt…

55c72d2

…y/mission-github-org-gated-signup-01KR1P4G

Merge 20260507_speckitty into kitty/mission-github-org-gated-signup-0…

a08c14c

…1KR1P4G

chore(github-org-gated-signup-01KR1P4G): assign mission_number=1

486b440

chore: finalize mission event log and status after merge

1573f44

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fix: sync access-requests README corrections

9c16122

- Discord: ddev.com/s/discord - Issues: ddev/coder-ddev not ddev/ddev Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rfay changed the title ~~docs: update start page for org-gated auth, add access-denied page~~ feat: implement GitHub org-gated access for coder.ddev.com May 7, 2026

docs: fix auth-callout wording on start page

3eece69

"the ddev" → "the ddev org" Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rfay mentioned this pull request May 7, 2026

User creation and authentication control #64

Closed

rfay and others added 2 commits May 7, 2026 22:50

docs: remove blog-post-draft, applied to ddev.com

0762172

Changes have been applied directly to ddev/ddev.com src/content/blog/coder-ddev-com-announcement.md Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

rfay changed the title ~~feat: implement GitHub org-gated access for coder.ddev.com~~ feat: implement GitHub org-gated access for coder.ddev.com, fixes #64 May 7, 2026

rfay merged commit 5f518cd into main May 7, 2026
15 checks passed

rfay deleted the 20260507_speckitty branch May 7, 2026 23:29

This was referenced May 7, 2026

Verify unconfirmed sponsor orgs in ALLOWED_ORGS #135

Open

Improve UX when unauthorized user completes GitHub OAuth (bare 'Unauthorized.' page) #136

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: implement GitHub org-gated access for coder.ddev.com, fixes #64#131

feat: implement GitHub org-gated access for coder.ddev.com, fixes #64#131
rfay merged 55 commits intomainfrom
20260507_speckitty

rfay commented May 7, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

rfay commented May 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

spec-kitty initialization

Changes

Test plan

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

rfay commented May 7, 2026 •

edited

Loading