diff --git a/WORK-RECORDS.md b/WORK-RECORDS.md index 8d6f36a..fd234ce 100644 --- a/WORK-RECORDS.md +++ b/WORK-RECORDS.md @@ -46,7 +46,7 @@ | task | CSOC-WP-0006-T04 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md | | task | CSOC-WP-0006-T05 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md | | task | CSOC-WP-0006-T06 | done | — | workplans/CSOC-WP-0006-stage-1-space-page-capabilities.md | -| intake | CSOC-IN-0001 | open | blue | docs/intakes/csoc-residuals.md | +| intake | CSOC-IN-0001 | closed | blue | docs/intakes/csoc-residuals.md | | intake | CSOC-IN-0002 | open | green | docs/intakes/csoc-residuals.md | | intake | CSOC-IN-0003 | open | blue | docs/intakes/csoc-residuals.md | | intake | CSOC-IN-0004 | open | green | docs/intakes/csoc-residuals.md | diff --git a/docs/identity/smoke.md b/docs/identity/smoke.md index 4a0ea89..746b4a3 100644 --- a/docs/identity/smoke.md +++ b/docs/identity/smoke.md @@ -1,6 +1,6 @@ # Identity smoke checklist -Evidence updated: **2026-08-12**. +Evidence updated: **2026-08-14**. ## Offline (dev claims) — **passed** @@ -39,8 +39,8 @@ logout → app 302 to /auth/login/?next=/app/ | Health | `curl -fsS https://app.coulomb.social/healthz` → ok | | Landing | 200; **Sign in** present | | Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` | -| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set | -| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) | +| Create account | enabled; `/auth/register/` redirects to the configured NetKingdom URL | +| Case B — public registration → OIDC → Member | **done** via disposable mailbox, KeyCape PKCE callback, and Member JIT (`NK-WP-0025`) | | Apex | **do not** repoint until Bubble retirement | ### Product smoke (spaces — after deploy + seed) @@ -87,25 +87,26 @@ Content plane: `CONTENT_ROOT` (default `var/content/`) with | Case | Status | |------|--------| | A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) | -| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 | +| B — brand-new public registration → OIDC → Member | **done 2026-08-14**; repeat login retained exactly one Member | -### Negatives to run when Case B unblocks (or ad-hoc) +### Identity negatives -Record results here or in residual notes; residual `CSOC-IN-0002`. +The completed checks below are backed by application tests and NK-WP-0025 live +evidence. Two focused callback/account-takeover checks remain in +`CSOC-IN-0002`. | Negative | Intent | |----------|--------| -| State / nonce replay | callback with recycled `state` fails closed | -| Subject collision | same issuer+subject always one Member | -| Email-only collision | email must not take over another subject | -| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected | -| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL | +| State / nonce replay | **remaining** — add direct callback replay regression | +| Subject collision | **passed** — repeat live login and idempotency test retain one Member | +| Email-only collision | **remaining** — add explicit different-subject/same-email takeover regression | +| Step-up ACR | **passed** — explicit AAL2 request and insufficient-assurance rejection are policy-covered | +| Registration open redirect | **passed** — `/auth/register/` ignores hostile `?next=` and uses only configured URL | App registration entry (when URL configured): ```bash -# only after NetKingdom publishes public registration URL -# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git) +# NETKINGDOM_REGISTRATION_URL is published in coulomb-social-env (no secret) ``` ## Platform OIDC (local redirect) — optional diff --git a/docs/intakes/csoc-residuals.md b/docs/intakes/csoc-residuals.md index d34970b..7342b23 100644 --- a/docs/intakes/csoc-residuals.md +++ b/docs/intakes/csoc-residuals.md @@ -12,7 +12,7 @@ id: CSOC-IN-0001 kind: intake title: "Enable Create account and Case B registration smoke on app.coulomb.social" lane: blue -status: open +status: closed priority: medium owner: coulomb-social repo: coulomb-social @@ -35,8 +35,10 @@ description: | DoC-Ok: residual of finished CSOC-WP-0003; platform dependency explicit. notes: | - Depends on NK-WP-0025 (registration orchestration + mail path). - Related: CSOC-IN-0002 (identity negatives after Case B). + Closed 2026-08-14. NK-WP-0025 published the registration URL and completed + disposable mailbox verification, KeyCape PKCE, Member JIT, and repeat-login + evidence. The live app redirect uses the configured URL only. + Related: narrowed CSOC-IN-0002 for two focused regression checks. state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a" ``` @@ -47,7 +49,7 @@ state_hub_intake_id: "019ff532-3694-7868-a3a7-f4b4f28a647a" ```yaml id: CSOC-IN-0002 kind: intake -title: "Record identity negatives: state replay, collision, step-up" +title: "Add callback replay and email-only takeover regressions" lane: green status: open priority: low @@ -56,19 +58,17 @@ repo: coulomb-social origin: residual origin_ref: CSOC-WP-0003 description: | - CSOC-WP-0003 Case A (known LLDAP login) is proven. Remaining negatives listed - in docs/identity/smoke.md should be executed when Case B unblocks (or sooner - offline/dev if useful): + Case B, repeat-login issuer+subject idempotency, registration redirect + confinement, and AAL1/AAL2 isolation are now proven. Add direct application + regressions for the two checks not yet independently covered: - - OIDC state/nonce replay - - issuer+subject collision (single Member) - - email-only must not take over another subject - - step-up ACR rejection when assurance insufficient - - registration redirect allow-list only + - a consumed/replayed OIDC callback state fails closed; and + - the same email with a different issuer+subject cannot take over a Member. - Capture pass/fail in docs/identity/smoke.md; close this intake when recorded. + Capture the results in docs/identity/smoke.md and close this intake. notes: | - Pulls from CSOC-IN-0001 for live registration path; some checks can run offline. + Narrowed 2026-08-14 after NK-WP-0025 completed live Case B. No longer blocked + on the registration or mailbox path. state_hub_intake_id: "019ff532-3ade-7d75-acb7-2bbfa264fcb8" ``` @@ -136,4 +136,3 @@ notes: | Pickup: docs/session-pickup.md state_hub_intake_id: "019ffac3-fc7d-7850-93b6-b0d289881ec7" ``` - diff --git a/workplans/CSOC-WP-0003-self-registration-and-assurance.md b/workplans/CSOC-WP-0003-self-registration-and-assurance.md index 144cdaa..3b5c0f2 100644 --- a/workplans/CSOC-WP-0003-self-registration-and-assurance.md +++ b/workplans/CSOC-WP-0003-self-registration-and-assurance.md @@ -8,7 +8,7 @@ status: finished owner: bernd topic_slug: coulomb-social created: "2026-08-09" -updated: "2026-08-12" +updated: "2026-08-14" depends_on: - CSOC-WP-0002 - NK-WP-0025 @@ -22,10 +22,10 @@ state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e" Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account creation entry point and optional profile/action step-up. -**Finished 2026-08-12:** app-side work complete. Existing-user login on -**`app.coulomb.social`** is proven (tegwick, AAL1). Landing **Create account** -is implemented and gated on `NETKINGDOM_REGISTRATION_URL`. Public Case B waits -on NetKingdom mailbox verification (`NK-WP-0025`) — residuals below. +**Finished 2026-08-12; acceptance reconciled 2026-08-14:** existing-user login +on **`app.coulomb.social`** is proven (tegwick, AAL1). Public Case B subsequently +completed disposable mailbox verification, KeyCape PKCE, Member JIT, and a +repeat login retaining exactly one Member under NK-WP-0025. ## T01 - Preserve and prove first-login JIT profile creation @@ -80,16 +80,17 @@ state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08" | Case | Status | |------|--------| | A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) | -| B — brand-new public registration → OIDC → Member | residual **CSOC-IN-0001** (NK mailbox) | +| B — brand-new public registration → OIDC → Member | **done 2026-08-14** (`NK-WP-0025`) | -Negatives checklist parked in `docs/identity/smoke.md`; execution residual -**CSOC-IN-0002**. +The negative checklist is reconciled in `docs/identity/smoke.md`. Redirect, +issuer+subject idempotency, and assurance checks passed; `CSOC-IN-0002` is +narrowed to direct callback-replay and email-only takeover regressions. ## Residuals (live records) | Id | Role | |----|------| -| `CSOC-IN-0001` | Enable Create account + Case B smoke when NK registration URL ships | -| `CSOC-IN-0002` | Record identity negatives (replay, collision, step-up) | +| `CSOC-IN-0001` | **closed** — Create account and Case B are live and evidenced | +| `CSOC-IN-0002` | **open, narrowed** — callback replay and email-only takeover regressions | Source: `docs/intakes/csoc-residuals.md`.