tegwick
affed64839
Thin CONTENT_ROOT content plane (ADR-0003/0004) with space visual field, product UI for Title/Abstract/Visual, page list sidebar, and tests. Update capability model and smoke checklist; mark WP-0006 finished.
134 lines
4.8 KiB
Markdown
134 lines
4.8 KiB
Markdown
# Identity smoke checklist
|
|
|
|
Evidence updated: **2026-08-12**.
|
|
|
|
## Offline (dev claims) — **passed**
|
|
|
|
```bash
|
|
uv sync && uv run manage.py migrate && make run
|
|
# OIDC_ENABLED=false (default), DEBUG=true
|
|
```
|
|
|
|
| Step | Result |
|
|
|------|--------|
|
|
| Open `/` → **Sign in** | → `/auth/dev-login/` |
|
|
| Dev form subject `smoke-1` | 302 → `/app/` |
|
|
| App home shows Spaces + profile chrome | OK (principal dump is under Session details) |
|
|
| Profile menu → Session details | issuer / subject / user-engine id |
|
|
| **Sign out** | session cleared |
|
|
| `/app/` after logout | 302 → login |
|
|
| Second login same subject | single `Member` row (idempotent) |
|
|
| `make test` | green |
|
|
|
|
Automated POST probe:
|
|
|
|
```text
|
|
dev_login_post → /app/ 200 with subject smoke-1
|
|
logout → app 302 to /auth/login/?next=/app/
|
|
```
|
|
|
|
## Public host app.coulomb.social — **Case A passed**
|
|
|
|
**Strategy:** live Railiance app on **`app.coulomb.social`**; apex
|
|
**`coulomb.social`** stays Bubble until content + self-registration cutover.
|
|
|
|
| Check | Detail |
|
|
|-------|--------|
|
|
| Cluster host | `app.coulomb.social` (Helm + ingress) |
|
|
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
|
|
| Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
|
|
| Landing | 200; **Sign in** present |
|
|
| Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
|
|
| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
|
|
| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
|
|
| Apex | **do not** repoint until Bubble retirement |
|
|
|
|
### Product smoke (spaces — after deploy + seed)
|
|
|
|
Operator runbook: `docs/deploy.md` § Operator runbook. Short path:
|
|
|
|
```bash
|
|
# fixture raw (public)
|
|
curl -fsS \
|
|
"https://forgejo.coulomb.social/coulomb/coulomb-social/raw/branch/main/docs/space-fixtures/demo/pages/index.md" \
|
|
| head
|
|
# seed in cluster
|
|
kubectl -n coulomb-social exec deploy/coulomb-social -- \
|
|
python manage.py seed_demo_space
|
|
```
|
|
|
|
| Step | Expected |
|
|
|------|----------|
|
|
| Sign in tegwick | `/app/` Spaces list |
|
|
| Open Demo space | rendered markdown from Forgejo |
|
|
| Session details | profile menu diagnostics (no secrets) |
|
|
| Refresh content | re-fetch after git edit (or webhook) |
|
|
|
|
### Stage-1 PageOps smoke (CSOC-WP-0006) — local / after deploy
|
|
|
|
Content plane: `CONTENT_ROOT` (default `var/content/`) with
|
|
`spaces/<slug>/pages/*.md`. Forgejo binding remains optional fallback.
|
|
|
|
| Step | Expected |
|
|
|------|----------|
|
|
| `/app/` → **New space** | create with Title, Abstract, Visual → detail |
|
|
| Space **Edit** | update Title/Abstract/Visual; index frontmatter stays in sync |
|
|
| **New page** | Title/Abstract/Visual + markdown body on content plane |
|
|
| Page list sidebar | lists index + pages; switch with `?page=` |
|
|
| **Copy** | independent slug/title; optional other destination space |
|
|
| **Transfer** | page leaves source space, appears in destination |
|
|
| **Delete** (non-index) | page removed; index cannot be deleted |
|
|
| **Archive space** | hidden from list; soft-archive tree under `.archived-*` |
|
|
| Tenant isolation | other tenant 404 on detail / page mutations |
|
|
| `make test` | includes `tests/test_pageops.py`, `tests/test_space_crud.py` |
|
|
|
|
## Case matrix (CSOC-WP-0003-T04)
|
|
|
|
| Case | Status |
|
|
|------|--------|
|
|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
|
|
| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |
|
|
|
|
### Negatives to run when Case B unblocks (or ad-hoc)
|
|
|
|
Record results here or in residual notes; residual `CSOC-IN-0002`.
|
|
|
|
| Negative | Intent |
|
|
|----------|--------|
|
|
| State / nonce replay | callback with recycled `state` fails closed |
|
|
| Subject collision | same issuer+subject always one Member |
|
|
| Email-only collision | email must not take over another subject |
|
|
| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
|
|
| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |
|
|
|
|
App registration entry (when URL configured):
|
|
|
|
```bash
|
|
# only after NetKingdom publishes public registration URL
|
|
# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
|
|
```
|
|
|
|
## Platform OIDC (local redirect) — optional
|
|
|
|
```bash
|
|
export OIDC_ENABLED=true
|
|
export OIDC_ISSUER=https://kc.coulomb.social
|
|
export OIDC_CLIENT_ID=coulomb-social
|
|
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
|
|
export OIDC_SCOPES="openid profile email groups"
|
|
make run
|
|
```
|
|
|
|
| Step | Expected |
|
|
|------|----------|
|
|
| Open http://127.0.0.1:8008/ → Sign in | redirect KeyCape → Authelia |
|
|
| Complete MFA if prompted | callback → `/app/` |
|
|
| Sign out | landing; `/app/` requires login |
|
|
|
|
## Automated
|
|
|
|
```bash
|
|
make test
|
|
```
|
|
|
|
See also: `docs/deploy.md`, `docs/spaces-content.md`, `docs/adr/ADR-0001-netkingdom-identity.md`.
|