coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wire user-engine HTTP /me for member provisioning (CSOC-WP-0002-T04)

Browse source 
HttpUserEngineClient uses trusted-proxy claims against live user-engine.
Offline stub when URL/secret unset. Align default tenant with KeyCape
tenant:coulomb; map OIDC tenant/principal_type/groups into the envelope.
This commit is contained in:
tegwick 2026-08-09 01:56:44 +02:00
parent a6a380b19f
commit d88767f05b
13 changed files with 325 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

7
.env.example
View file

@ -4,7 +4,7 @@
SECRET_KEY=change-me
DEBUG=true
DATABASE_URL=sqlite:///db.sqlite3
DEFAULT_TENANT_ID=binky
DEFAULT_TENANT_ID=tenant:coulomb
# --- NetKingdom OIDC (KeyCape) ---
# Offline shell: leave OIDC_ENABLED=false and use /auth/dev-login/
@ -17,5 +17,8 @@ OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
OIDC_SCOPES=openid profile email groups
USER_ENGINE_APPLICATION_ID=coulomb-social
# USER_ENGINE_BASE_URL=
USER_ENGINE_EXPECTED_AUDIENCE=user-engine-portal
# Live user-engine (both required for HTTP mode):
# USER_ENGINE_BASE_URL=https://users.92-205-62-239.nip.io
# USER_ENGINE_PROXY_SECRET= # from OpenBao / kubectl user-engine-runtime — never commit
# FLEX_AUTH_BASE_URL=