tegwick
ac7bac1852
Some checks failed
Use-case regression gate / usecase-regressions (push) Has been cancelled
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a10e2d-a5ef-7e92-b03d-b1694e915680
50 lines
1.9 KiB
Markdown
50 lines
1.9 KiB
Markdown
# user-engine application binding
|
|
|
|
| Field | Value |
|
|
|-------|--------|
|
|
| application id | `coulomb-social` (`USER_ENGINE_APPLICATION_ID`) |
|
|
| display name | coulomb.social |
|
|
| tenant (v1) | `tenant:coulomb` (KeyCape default; Binky friendly slug later) |
|
|
| identity link | `(issuer, sub)` via user-engine `GET /api/v1/me` auto-provision |
|
|
| local row | `members.Member` (no passwords) |
|
|
| live base URL | `https://users.92-205-62-239.nip.io` (cluster ingress) |
|
|
|
|
## Runtime
|
|
|
|
| Mode | When | Behavior |
|
|
|------|------|----------|
|
|
| **stub** | `USER_ENGINE_BASE_URL` or `USER_ENGINE_PROXY_SECRET` empty | Deterministic `user_id` from sha256(iss\|sub) |
|
|
| **http** | both set | Trusted-proxy `GET /api/v1/me` with IAM-shaped claims envelope |
|
|
|
|
### Trusted proxy envelope
|
|
|
|
user-engine accepts claims only when:
|
|
|
|
```http
|
|
X-User-Engine-Proxy-Secret: <secret from user-engine-runtime>
|
|
X-Verified-Oidc-Claims: {"iss","sub","tenant","principal_type","aud",...}
|
|
```
|
|
|
|
`aud` must include the portal audience `user-engine-portal` (deployed expectation)
|
|
plus `coulomb-social`. Trust is the proxy secret; claims were verified by
|
|
KeyCape OIDC at the app edge.
|
|
|
|
### Governed credential configuration
|
|
|
|
Live HTTP mode already uses mounted runtime credential references. Do not
|
|
extract the proxy secret with kubectl/jsonpath or print it into shell/chat.
|
|
For a new credential need, run `warden route find "user-engine trusted proxy credential" --json`
|
|
and follow the owning OpenBao/platform lane. Interactive personal login belongs
|
|
to KeyCape/NetKingdom; it does not require retrieving this server credential.
|
|
|
|
## Profile attributes (shell only)
|
|
|
|
- display name (OIDC `name` / user-engine user.display_name)
|
|
- email (optional)
|
|
|
|
Bubble content fields are **not** part of this binding.
|
|
|
|
## Live probe (2026-08-09)
|
|
|
|
`GET /api/v1/me` with probe claims returned `user_id` `usr_…` and
|
|
`actor.tenant=tenant:coulomb` (HTTP 200).
|