Finish CSOC-WP-0003 and CSOC-WP-0004; residual intakes for Case B
Close self-registration workplan with Case A proven and Create account entry implemented; park public registration enablement and identity negatives as CSOC-IN-0001/0002. Complete app-shell workplan with T06 operator runbook (seed, bind, webhook, smoke) and smoke doc updates.
This commit is contained in:
parent
61de4a8165
commit
edfdd79208
13 changed files with 440 additions and 105 deletions
|
|
@ -1,6 +1,6 @@
|
|||
# Identity smoke checklist
|
||||
|
||||
Evidence updated: **2026-08-09**.
|
||||
Evidence updated: **2026-08-12**.
|
||||
|
||||
## Offline (dev claims) — **passed**
|
||||
|
||||
|
|
@ -13,47 +13,84 @@ uv sync && uv run manage.py migrate && make run
|
|||
|------|--------|
|
||||
| Open `/` → **Sign in** | → `/auth/dev-login/` |
|
||||
| Dev form subject `smoke-1` | 302 → `/app/` |
|
||||
| Shell shows display name + subject | OK |
|
||||
| App home shows Spaces + profile chrome | OK (principal dump is under Session details) |
|
||||
| Profile menu → Session details | issuer / subject / user-engine id |
|
||||
| **Sign out** | session cleared |
|
||||
| `/app/` after logout | 302 → login |
|
||||
| Second login same subject | single `Member` row (idempotent) |
|
||||
| `make test` | **15 passed** |
|
||||
| `make test` | green |
|
||||
|
||||
Automated POST probe (2026-08-09):
|
||||
Automated POST probe:
|
||||
|
||||
```text
|
||||
dev_login_post → /app/ 200 with subject smoke-1
|
||||
logout → app 302 to /auth/login/?next=/app/
|
||||
```
|
||||
|
||||
## Cluster in-cluster (port-forward) — **passed (start of OIDC)**
|
||||
## Public host app.coulomb.social — **Case A passed**
|
||||
|
||||
DNS for `coulomb.social` still points at Cloudflare/Bubble; TLS ACME is
|
||||
blocked until cutover. Smoke via:
|
||||
**Strategy:** live Railiance app on **`app.coulomb.social`**; apex
|
||||
**`coulomb.social`** stays Bubble until content + self-registration cutover.
|
||||
|
||||
| Check | Detail |
|
||||
|-------|--------|
|
||||
| Cluster host | `app.coulomb.social` (Helm + ingress) |
|
||||
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
|
||||
| Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
|
||||
| Landing | 200; **Sign in** present |
|
||||
| Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
|
||||
| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
|
||||
| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
|
||||
| Apex | **do not** repoint until Bubble retirement |
|
||||
|
||||
### Product smoke (spaces — after deploy + seed)
|
||||
|
||||
Operator runbook: `docs/deploy.md` § Operator runbook. Short path:
|
||||
|
||||
```bash
|
||||
kubectl -n coulomb-social port-forward svc/coulomb-social 18088:80
|
||||
curl -H 'Host: coulomb.social' http://127.0.0.1:18088/healthz
|
||||
# {"status": "ok", "service": "coulomb-social"}
|
||||
# fixture raw (public)
|
||||
curl -fsS \
|
||||
"https://forgejo.coulomb.social/coulomb/coulomb-social/raw/branch/main/docs/space-fixtures/demo/pages/index.md" \
|
||||
| head
|
||||
# seed in cluster
|
||||
kubectl -n coulomb-social exec deploy/coulomb-social -- \
|
||||
python manage.py seed_demo_space
|
||||
```
|
||||
|
||||
| Check | Result |
|
||||
|-------|--------|
|
||||
| Image | `forgejo.coulomb.social/coulomb/coulomb-social:7067145` |
|
||||
| `OIDC_ENABLED` | `true` (values) |
|
||||
| `GET /healthz` + Host | 200 JSON ok |
|
||||
| `GET /` + Host | 200 landing shell |
|
||||
| `GET /auth/login/` + Host | **302** → `https://kc.coulomb.social/authorize?...` with `client_id=coulomb-social`, `redirect_uri=https://coulomb.social/auth/callback/`, PKCE S256 |
|
||||
| Session cookie | `HttpOnly; Secure; SameSite=Lax` (prod settings) |
|
||||
| Step | Expected |
|
||||
|------|----------|
|
||||
| Sign in tegwick | `/app/` Spaces list |
|
||||
| Open Demo space | rendered markdown from Forgejo |
|
||||
| Session details | profile menu diagnostics (no secrets) |
|
||||
| Refresh content | re-fetch after git edit (or webhook) |
|
||||
|
||||
Full browser login against the **cluster** redirect URI requires public HTTPS
|
||||
on `coulomb.social` (Secure cookie + callback host). Use **local OIDC** below
|
||||
before DNS cutover, or complete browser MFA after cutover.
|
||||
## Case matrix (CSOC-WP-0003-T04)
|
||||
|
||||
## Platform OIDC (local redirect) — **ready for human MFA**
|
||||
| Case | Status |
|
||||
|------|--------|
|
||||
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
|
||||
| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |
|
||||
|
||||
Client registration and authorize handoff verified; **human Authelia + MFA**
|
||||
is the remaining interactive step.
|
||||
### Negatives to run when Case B unblocks (or ad-hoc)
|
||||
|
||||
Record results here or in residual notes; residual `CSOC-IN-0002`.
|
||||
|
||||
| Negative | Intent |
|
||||
|----------|--------|
|
||||
| State / nonce replay | callback with recycled `state` fails closed |
|
||||
| Subject collision | same issuer+subject always one Member |
|
||||
| Email-only collision | email must not take over another subject |
|
||||
| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
|
||||
| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |
|
||||
|
||||
App registration entry (when URL configured):
|
||||
|
||||
```bash
|
||||
# only after NetKingdom publishes public registration URL
|
||||
# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
|
||||
```
|
||||
|
||||
## Platform OIDC (local redirect) — optional
|
||||
|
||||
```bash
|
||||
export OIDC_ENABLED=true
|
||||
|
|
@ -61,28 +98,14 @@ export OIDC_ISSUER=https://kc.coulomb.social
|
|||
export OIDC_CLIENT_ID=coulomb-social
|
||||
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
|
||||
export OIDC_SCOPES="openid profile email groups"
|
||||
# optional live user-engine (else stub):
|
||||
# export USER_ENGINE_BASE_URL=https://users.92-205-62-239.nip.io
|
||||
# export USER_ENGINE_PROXY_SECRET="$(kubectl -n user-engine get secret user-engine-runtime \
|
||||
# -o jsonpath='{.data.proxy-secret}' | base64 -d)"
|
||||
make run
|
||||
```
|
||||
|
||||
| Step | Expected |
|
||||
|------|----------|
|
||||
| Open http://127.0.0.1:8008/ → Sign in | redirect KeyCape → Authelia |
|
||||
| Complete MFA | callback → `/app/` with subject / display name |
|
||||
| Complete MFA if prompted | callback → `/app/` |
|
||||
| Sign out | landing; `/app/` requires login |
|
||||
| Second login | same Member / user_engine user_id |
|
||||
|
||||
Authorize probe (no browser) 2026-08-09:
|
||||
|
||||
| redirect_uri | KeyCape |
|
||||
|--------------|---------|
|
||||
| `http://127.0.0.1:8008/auth/callback/` | **302** → Authelia OIDC |
|
||||
| `https://coulomb.social/auth/callback/` | **302** → Authelia OIDC |
|
||||
|
||||
Unregistered redirects still fail with `invalid_profile_usage` (T03).
|
||||
|
||||
## Automated
|
||||
|
||||
|
|
@ -90,15 +113,4 @@ Unregistered redirects still fail with `invalid_profile_usage` (T03).
|
|||
make test
|
||||
```
|
||||
|
||||
## Public host (parallel to Bubble)
|
||||
|
||||
**Strategy:** live Railiance app on **`app.coulomb.social`**; apex **`coulomb.social`** stays Bubble until content + self-registration cutover.
|
||||
|
||||
| Check | Detail |
|
||||
|-------|--------|
|
||||
| Cluster host | `app.coulomb.social` (Helm + ingress) |
|
||||
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
|
||||
| DNS | operator: `app.coulomb.social` A → `92.205.62.239` |
|
||||
| Apex | **do not** repoint until Bubble retirement |
|
||||
|
||||
See `docs/deploy.md`.
|
||||
See also: `docs/deploy.md`, `docs/spaces-content.md`, `docs/adr/ADR-0001-netkingdom-identity.md`.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue