coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wire user-engine HTTP /me for member provisioning (CSOC-WP-0002-T04)

Browse source 
HttpUserEngineClient uses trusted-proxy claims against live user-engine.
Offline stub when URL/secret unset. Align default tenant with KeyCape
tenant:coulomb; map OIDC tenant/principal_type/groups into the envelope.
This commit is contained in:
tegwick 2026-08-09 01:56:44 +02:00
parent a6a380b19f
commit d88767f05b
13 changed files with 325 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

12
coulomb_social/settings/base.py
View file

@ -89,8 +89,8 @@ LOGIN_URL = "identity:login"
LOGIN_REDIRECT_URL = "core:app_home"
LOGOUT_REDIRECT_URL = "core:landing"
# ── Tenant (Binky = client #1) ──────────────────────────────────────────────
DEFAULT_TENANT_ID = config("DEFAULT_TENANT_ID", default="binky")
# ── Tenant (KeyCape default platform tenant; Binky friendly slug later) ─────
DEFAULT_TENANT_ID = config("DEFAULT_TENANT_ID", default="tenant:coulomb")
# ── NetKingdom identity (see ADR-0001) ──────────────────────────────────────
# When OIDC_ENABLED is false, only the DEBUG dev-login path is available.
@ -99,12 +99,16 @@ OIDC_ISSUER = config("OIDC_ISSUER", default="")
OIDC_CLIENT_ID = config("OIDC_CLIENT_ID", default="")
OIDC_CLIENT_SECRET = config("OIDC_CLIENT_SECRET", default="")
OIDC_REDIRECT_URI = config("OIDC_REDIRECT_URI", default="")
OIDC_SCOPES = config("OIDC_SCOPES", default="openid profile email")
OIDC_SCOPES = config("OIDC_SCOPES", default="openid profile email groups")
OIDC_DISCOVERY_URL = config("OIDC_DISCOVERY_URL", default="") # optional override
# user-engine HTTP base (empty → in-process stub)
# user-engine HTTP (empty base or secret → offline stub)
USER_ENGINE_BASE_URL = config("USER_ENGINE_BASE_URL", default="")
USER_ENGINE_PROXY_SECRET = config("USER_ENGINE_PROXY_SECRET", default="")
USER_ENGINE_APPLICATION_ID = config("USER_ENGINE_APPLICATION_ID", default="coulomb-social")
USER_ENGINE_EXPECTED_AUDIENCE = config(
"USER_ENGINE_EXPECTED_AUDIENCE", default="user-engine-portal"
)
# flex-auth (empty → local fail-closed stub for sensitive checks; shell view allowed)
FLEX_AUTH_BASE_URL = config("FLEX_AUTH_BASE_URL", default="")