coulomb/coulomb-social
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Wire user-engine HTTP /me for member provisioning (CSOC-WP-0002-T04)

Browse source 
HttpUserEngineClient uses trusted-proxy claims against live user-engine.
Offline stub when URL/secret unset. Align default tenant with KeyCape
tenant:coulomb; map OIDC tenant/principal_type/groups into the envelope.
This commit is contained in:
tegwick 2026-08-09 01:56:44 +02:00
parent a6a380b19f
commit d88767f05b
13 changed files with 325 additions and 48 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/dev.md
View file

@ -33,14 +33,16 @@ See `.env.example`. Summary:
|----------|---------|---------|
| `SECRET_KEY` | insecure dev default | Django secret |
| `DATABASE_URL` | sqlite `./db.sqlite3` | DB |
| `DEFAULT_TENANT_ID` | `binky` | Client #1 tenant key |
| `DEFAULT_TENANT_ID` | `tenant:coulomb` | Platform tenant claim (KeyCape default) |
| `OIDC_ENABLED` | `false` | Use KeyCape / real issuer |
| `OIDC_ISSUER` | | e.g. `https://kc.coulomb.social` |
| `OIDC_CLIENT_ID` | | `coulomb-social` |
| `OIDC_CLIENT_SECRET` | empty | **public client** — leave empty |
| `OIDC_REDIRECT_URI` | | `http://127.0.0.1:8008/auth/callback/` |
| `USER_ENGINE_BASE_URL` | empty (stub) | user-engine HTTP |
| `USER_ENGINE_APPLICATION_ID` | `coulomb-social` | App id in user-engine |
| `USER_ENGINE_BASE_URL` | empty (stub) | e.g. `https://users.92-205-62-239.nip.io` |
| `USER_ENGINE_PROXY_SECRET` | empty | trusted proxy secret (with base URL → HTTP) |
| `USER_ENGINE_APPLICATION_ID` | `coulomb-social` | App id |
| `USER_ENGINE_EXPECTED_AUDIENCE` | `user-engine-portal` | required aud for /me |
| `FLEX_AUTH_BASE_URL` | empty (fail-closed except shell:view) | PDP |
### Platform OIDC (KeyCape)