# Identity smoke checklist

Evidence updated: **2026-08-12**.

## Offline (dev claims) — **passed**

```bash
uv sync && uv run manage.py migrate && make run
# OIDC_ENABLED=false (default), DEBUG=true
```

| Step | Result |
|------|--------|
| Open `/` → **Sign in** | → `/auth/dev-login/` |
| Dev form subject `smoke-1` | 302 → `/app/` |
| App home shows Spaces + profile chrome | OK (principal dump is under Session details) |
| Profile menu → Session details | issuer / subject / user-engine id |
| **Sign out** | session cleared |
| `/app/` after logout | 302 → login |
| Second login same subject | single `Member` row (idempotent) |
| `make test` | green |

Automated POST probe:

```text
dev_login_post → /app/ 200 with subject smoke-1
logout → app 302 to /auth/login/?next=/app/
```

## Public host app.coulomb.social — **Case A passed**

**Strategy:** live Railiance app on **`app.coulomb.social`**; apex
**`coulomb.social`** stays Bubble until content + self-registration cutover.

| Check | Detail |
|-------|--------|
| Cluster host | `app.coulomb.social` (Helm + ingress) |
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
| Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
| Landing | 200; **Sign in** present |
| Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
| Apex | **do not** repoint until Bubble retirement |

### Product smoke (spaces — after deploy + seed)

Operator runbook: `docs/deploy.md` § Operator runbook. Short path:

```bash
# fixture raw (public)
curl -fsS \
  "https://forgejo.coulomb.social/coulomb/coulomb-social/raw/branch/main/docs/space-fixtures/demo/pages/index.md" \
  | head
# seed in cluster
kubectl -n coulomb-social exec deploy/coulomb-social -- \
  python manage.py seed_demo_space
```

| Step | Expected |
|------|----------|
| Sign in tegwick | `/app/` Spaces list |
| Open Demo space | rendered markdown from Forgejo |
| Session details | profile menu diagnostics (no secrets) |
| Refresh content | re-fetch after git edit (or webhook) |

### Stage-1 PageOps smoke (CSOC-WP-0006) — local / after deploy

Content plane: `CONTENT_ROOT` (default `var/content/`) with
`spaces/<slug>/pages/*.md`. Forgejo binding remains optional fallback.

| Step | Expected |
|------|----------|
| `/app/` → **New space** | create with Title, Abstract, Visual → detail |
| Space **Edit** | update Title/Abstract/Visual; index frontmatter stays in sync |
| **New page** | Title/Abstract/Visual + markdown body on content plane |
| Page list sidebar | lists index + pages; switch with `?page=` |
| **Copy** | independent slug/title; optional other destination space |
| **Transfer** | page leaves source space, appears in destination |
| **Delete** (non-index) | page removed; index cannot be deleted |
| **Archive space** | hidden from list; soft-archive tree under `.archived-*` |
| Tenant isolation | other tenant 404 on detail / page mutations |
| `make test` | includes `tests/test_pageops.py`, `tests/test_space_crud.py` |

## Case matrix (CSOC-WP-0003-T04)

| Case | Status |
|------|--------|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |

### Negatives to run when Case B unblocks (or ad-hoc)

Record results here or in residual notes; residual `CSOC-IN-0002`.

| Negative | Intent |
|----------|--------|
| State / nonce replay | callback with recycled `state` fails closed |
| Subject collision | same issuer+subject always one Member |
| Email-only collision | email must not take over another subject |
| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |

App registration entry (when URL configured):

```bash
# only after NetKingdom publishes public registration URL
# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
```

## Platform OIDC (local redirect) — optional

```bash
export OIDC_ENABLED=true
export OIDC_ISSUER=https://kc.coulomb.social
export OIDC_CLIENT_ID=coulomb-social
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
export OIDC_SCOPES="openid profile email groups"
make run
```

| Step | Expected |
|------|----------|
| Open http://127.0.0.1:8008/ → Sign in | redirect KeyCape → Authelia |
| Complete MFA if prompted | callback → `/app/` |
| Sign out | landing; `/app/` requires login |

## Automated

```bash
make test
```

See also: `docs/deploy.md`, `docs/spaces-content.md`, `docs/adr/ADR-0001-netkingdom-identity.md`.