AiSOC v20.4.0 — SSO lockout and alert-funnel fixes

[beenuar]

AiSOC v20.4.0 is out: https://github.com/beenuar/AiSOC/releases/tag/v20.4.0

A focused fix release closing two defects a self-hoster hit the moment they turned SSO on, reported in discussion #1568 — thank you rmsferreira.

What's fixed

• Enabling SSO OIDC no longer locks the administrator out. Permissions fall back to the static role map only while a tenant holds zero role grants. The bootstrap admin carries role = admin with no grant row (it's created after the seed that would have backfilled one) — harmless until the first SSO sign-in grants the provisioned user a role, which flips the whole tenant to database-backed RBAC and leaves the grant-less admin resolving to zero permissions: 403 on users, investigations and the alert queue all at once. bootstrap_admin now grants the admin its catalog role on every startup, so it's never the ungranted account — and a deployment already locked out heals itself on the next API restart.
• The alert funnel's "events of interest" count now reads a column the lake actually has. It queried aisoc.raw_events.ingested_at, which doesn't exist (the lake has event_time and ingest_time), so the query failed with ClickHouse Code: 47 on every call and the console silently served a Postgres estimate. It now reads ingest_time, with a test that checks the query's columns against the committed ClickHouse DDL so a non-existent column can't slip back in.

Both fixes are verified against a real Postgres with the full migration chain — the lockout is reproduced in a test and then shown fixed, and the resolver's deprovisioning semantics are untouched and still separately pinned.

Also in this release

Two high-severity dependency advisories that published after the last audit (graphql-core → 3.3.1, pyasn1 → 0.6.5, both transitive in the API service) are cleared at the source.

By the numbers

2 product defects fixed, 22 across this release and the two before it (dependency advisories counted separately). No breaking changes. The Helm chart publishes as 7.13.0; neither stable channel moves (chart 7.8.0, images v19.0.0, by deliberate decision — both digest-verified after publish).

docker compose pull && docker compose up -d, or pin v20.4.0 / chart 7.13.0. Full detail in CHANGELOG.md and RELEASES.md.