coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile public registration acceptance residuals

Browse source
This commit is contained in:
tegwick 2026-08-14 19:35:46 +02:00
parent b5a4af7bf0
commit 688215f831
4 changed files with 40 additions and 39 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/identity/smoke.md
View file

@ -1,6 +1,6 @@
# Identity smoke checklist
Evidence updated: **2026-08-12**.
Evidence updated: **2026-08-14**.
## Offline (dev claims) — **passed**
@ -39,8 +39,8 @@ logout → app 302 to /auth/login/?next=/app/
| Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
| Landing | 200; **Sign in** present |
| Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
| Create account | enabled; `/auth/register/` redirects to the configured NetKingdom URL |
| Case B — public registration → OIDC → Member | **done** via disposable mailbox, KeyCape PKCE callback, and Member JIT (`NK-WP-0025`) |
| Apex | **do not** repoint until Bubble retirement |
### Product smoke (spaces — after deploy + seed)
@ -87,25 +87,26 @@ Content plane: `CONTENT_ROOT` (default `var/content/`) with
| Case | Status |
|------|--------|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |
| B — brand-new public registration → OIDC → Member | **done 2026-08-14**; repeat login retained exactly one Member |
### Negatives to run when Case B unblocks (or ad-hoc)
### Identity negatives
Record results here or in residual notes; residual `CSOC-IN-0002`.
The completed checks below are backed by application tests and NK-WP-0025 live
evidence. Two focused callback/account-takeover checks remain in
`CSOC-IN-0002`.
| Negative | Intent |
|----------|--------|
| State / nonce replay | callback with recycled `state` fails closed |
| Subject collision | same issuer+subject always one Member |
| Email-only collision | email must not take over another subject |
| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |
| State / nonce replay | **remaining** — add direct callback replay regression |
| Subject collision | **passed** — repeat live login and idempotency test retain one Member |
| Email-only collision | **remaining** — add explicit different-subject/same-email takeover regression |
| Step-up ACR | **passed** — explicit AAL2 request and insufficient-assurance rejection are policy-covered |
| Registration open redirect | **passed** — `/auth/register/` ignores hostile `?next=` and uses only configured URL |
App registration entry (when URL configured):
```bash
# only after NetKingdom publishes public registration URL
# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
# NETKINGDOM_REGISTRATION_URL is published in coulomb-social-env (no secret)
```
## Platform OIDC (local redirect) — optional