coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile public registration acceptance residuals

Browse source
This commit is contained in:
tegwick 2026-08-14 19:35:46 +02:00
parent b5a4af7bf0
commit 688215f831
4 changed files with 40 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

2
WORK-RECORDS.md
View file

@ -46,7 +46,7 @@
| task | CSOC-WP-0006-T04 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md |
| task | CSOC-WP-0006-T05 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md |
| task | CSOC-WP-0006-T06 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md |
| intake | CSOC-IN-0001 | open | blue | docs/intakes/csoc-residuals.md |
| intake | CSOC-IN-0001 | closed | blue | docs/intakes/csoc-residuals.md |
| intake | CSOC-IN-0002 | open | green | docs/intakes/csoc-residuals.md |
| intake | CSOC-IN-0003 | open | blue | docs/intakes/csoc-residuals.md |
| intake | CSOC-IN-0004 | open | green | docs/intakes/csoc-residuals.md |

27
docs/identity/smoke.md
View file

@ -1,6 +1,6 @@
# Identity smoke checklist
Evidence updated: **2026-08-12**.
Evidence updated: **2026-08-14**.
## Offline (dev claims) — **passed**
@ -39,8 +39,8 @@ logout → app 302 to /auth/login/?next=/app/
| Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
| Landing | 200; **Sign in** present |
| Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
| Create account | enabled; `/auth/register/` redirects to the configured NetKingdom URL |
| Case B — public registration → OIDC → Member | **done** via disposable mailbox, KeyCape PKCE callback, and Member JIT (`NK-WP-0025`) |
| Apex | **do not** repoint until Bubble retirement |
### Product smoke (spaces — after deploy + seed)
@ -87,25 +87,26 @@ Content plane: `CONTENT_ROOT` (default `var/content/`) with
| Case | Status |
|------|--------|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |
| B — brand-new public registration → OIDC → Member | **done 2026-08-14**; repeat login retained exactly one Member |
### Negatives to run when Case B unblocks (or ad-hoc)
### Identity negatives
Record results here or in residual notes; residual `CSOC-IN-0002`.
The completed checks below are backed by application tests and NK-WP-0025 live
evidence. Two focused callback/account-takeover checks remain in
`CSOC-IN-0002`.
| Negative | Intent |
|----------|--------|
| State / nonce replay | callback with recycled `state` fails closed |
| Subject collision | same issuer+subject always one Member |
| Email-only collision | email must not take over another subject |
| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |
| State / nonce replay | **remaining** — add direct callback replay regression |
| Subject collision | **passed** — repeat live login and idempotency test retain one Member |
| Email-only collision | **remaining** — add explicit different-subject/same-email takeover regression |
| Step-up ACR | **passed** — explicit AAL2 request and insufficient-assurance rejection are policy-covered |
| Registration open redirect | **passed** — `/auth/register/` ignores hostile `?next=` and uses only configured URL |
App registration entry (when URL configured):
```bash
# only after NetKingdom publishes public registration URL
# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
# NETKINGDOM_REGISTRATION_URL is published in coulomb-social-env (no secret)
```
## Platform OIDC (local redirect) — optional

29
docs/intakes/csoc-residuals.md
View file

@ -12,7 +12,7 @@ id: CSOC-IN-0001
kind: intake
title: "Enable Create account and Case B registration smoke on app.coulomb.social"
lane: blue
status: open
status: closed
priority: medium
owner: coulomb-social
repo: coulomb-social
@ -35,8 +35,10 @@ description: |
DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit.
notes: |
Depends on NK-WP-0025 (registration orchestration + mail path).
Related: CSOC-IN-0002 (identity negatives after Case B).
Closed 2026-08-14. NK-WP-0025 published the registration URL and completed
disposable mailbox verification, KeyCape PKCE, Member JIT, and repeat-login
evidence. The live app redirect uses the configured URL only.
Related: narrowed CSOC-IN-0002 for two focused regression checks.
state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
```
@ -47,7 +49,7 @@ state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a"
```yaml
id: CSOC-IN-0002
kind: intake
title: "Record identity negatives: state replay, collision, step-up"
title: "Add callback replay and email-only takeover regressions"
lane: green
status: open
priority: low
@ -56,19 +58,17 @@ repo: coulomb-social
origin: residual
origin_ref: CSOC-WP-0003
description: |
CSOC-WP-0003 Case A (known LLDAP login) is proven. Remaining negatives listed
in docs/identity/smoke.md should be executed when Case B unblocks (or sooner
offline/dev if useful):
Case B, repeat-login issuer+subject idempotency, registration redirect
confinement, and AAL1/AAL2 isolation are now proven. Add direct application
regressions for the two checks not yet independently covered:
- OIDC state/nonce replay
- issuer+subject collision (single Member)
- email-only must not take over another subject
- step-up ACR rejection when assurance insufficient
- registration redirect allow-list only
- a consumed/replayed OIDC callback state fails closed; and
- the same email with a different issuer+subject cannot take over a Member.
Capture pass/fail in docs/identity/smoke.md; close this intake when recorded.
Capture the results in docs/identity/smoke.md and close this intake.
notes: |
Pulls from CSOC-IN-0001 for live registration path; some checks can run offline.
Narrowed 2026-08-14 after NK-WP-0025 completed live Case B. No longer blocked
on the registration or mailbox path.
state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8"
```
@ -136,4 +136,3 @@ notes: |
Pickup: docs/session-pickup.md
state_hub_intake_id: "019ffac3-fc7d-7850-93b6-b0d289881ec7"
```

21
workplans/CSOC-WP-0003-self-registration-and-assurance.md
View file

@ -8,7 +8,7 @@ status: finished
owner: bernd
topic_slug: coulomb-social
created: "2026-08-09"
updated: "2026-08-12"
updated: "2026-08-14"
depends_on:
- CSOC-WP-0002
- NK-WP-0025
@ -22,10 +22,10 @@ state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
creation entry point and optional profile/action step-up.
**Finished 2026-08-12:** app-side work complete. Existing-user login on
**`app.coulomb.social`** is proven (tegwick, AAL1). Landing **Create account**
is implemented and gated on `NETKINGDOM_REGISTRATION_URL`. Public Case B waits
on NetKingdom mailbox verification (`NK-WP-0025`) — residuals below.
**Finished 2026-08-12; acceptance reconciled 2026-08-14:** existing-user login
on **`app.coulomb.social`** is proven (tegwick, AAL1). Public Case B subsequently
completed disposable mailbox verification, KeyCape PKCE, Member JIT, and a
repeat login retaining exactly one Member under NK-WP-0025.
## T01 - Preserve and prove first-login JIT profile creation
@ -80,16 +80,17 @@ state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
| Case | Status |
|------|--------|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
| B — brand-new public registration → OIDC → Member | residual **CSOC-IN-0001** (NK mailbox) |
| B — brand-new public registration → OIDC → Member | **done 2026-08-14** (`NK-WP-0025`) |
Negatives checklist parked in `docs/identity/smoke.md`; execution residual
**CSOC-IN-0002**.
The negative checklist is reconciled in `docs/identity/smoke.md`. Redirect,
issuer+subject idempotency, and assurance checks passed; `CSOC-IN-0002` is
narrowed to direct callback-replay and email-only takeover regressions.
## Residuals (live records)
| Id | Role |
|----|------|
| `CSOC-IN-0001` | Enable Create account + Case B smoke when NK registration URL ships |
| `CSOC-IN-0002` | Record identity negatives (replay, collision, step-up) |
| `CSOC-IN-0001` | **closed** — Create account and Case B are live and evidenced |
| `CSOC-IN-0002` | **open, narrowed** — callback replay and email-only takeover regressions |
Source: `docs/intakes/csoc-residuals.md`.