coulomb-social/docs/identity/smoke.md

Identity smoke checklist

Evidence updated: 2026-08-12.

Offline (dev claims) — passed

uv sync && uv run manage.py migrate && make run
# OIDC_ENABLED=false (default), DEBUG=true

Step	Result
Open / → Sign in	→ /auth/dev-login/
Dev form subject smoke-1	302 → /app/
App home shows Spaces + profile chrome	OK (principal dump is under Session details)
Profile menu → Session details	issuer / subject / user-engine id
Sign out	session cleared
/app/ after logout	302 → login
Second login same subject	single Member row (idempotent)
make test	green

Automated POST probe:

dev_login_post → /app/ 200 with subject smoke-1
logout → app 302 to /auth/login/?next=/app/

Public host app.coulomb.social — Case A passed

Strategy: live Railiance app on app.coulomb.social; apex coulomb.social stays Bubble until content + self-registration cutover.

Check	Detail
Cluster host	app.coulomb.social (Helm + ingress)
OIDC redirect	https://app.coulomb.social/auth/callback/
Health	curl -fsS https://app.coulomb.social/healthz → ok
Landing	200; Sign in present
Case A — known LLDAP user	done (tegwick, AAL1, no MFA forced) → /app/
Create account	hidden until NETKINGDOM_REGISTRATION_URL is set
Case B — public registration → OIDC → Member	blocked on NK mailbox verification (NK-WP-0025 / residual intakes)
Apex	do not repoint until Bubble retirement

Product smoke (spaces — after deploy + seed)

Operator runbook: docs/deploy.md § Operator runbook. Short path:

# fixture raw (public)
curl -fsS \
  "https://forgejo.coulomb.social/coulomb/coulomb-social/raw/branch/main/docs/space-fixtures/demo/pages/index.md" \
  | head
# seed in cluster
kubectl -n coulomb-social exec deploy/coulomb-social -- \
  python manage.py seed_demo_space

Step	Expected
Sign in tegwick	/app/ Spaces list
Open Demo space	rendered markdown from Forgejo
Session details	profile menu diagnostics (no secrets)
Refresh content	re-fetch after git edit (or webhook)

Case matrix (CSOC-WP-0003-T04)

Case	Status
A — known LLDAP user, first/repeat login on app.*	done (tegwick)
B — brand-new public registration → OIDC → Member	deferred → residual CSOC-IN-0001 / NK-WP-0025

Negatives to run when Case B unblocks (or ad-hoc)

Record results here or in residual notes; residual CSOC-IN-0002.

Negative	Intent
State / nonce replay	callback with recycled state fails closed
Subject collision	same issuer+subject always one Member
Email-only collision	email must not take over another subject
Step-up ACR	when OIDC_STEP_UP_ACR requested, insufficient acr rejected
Registration open redirect	/auth/register/ ignores ?next= host; only configured URL

App registration entry (when URL configured):

# only after NetKingdom publishes public registration URL
# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)

Platform OIDC (local redirect) — optional

export OIDC_ENABLED=true
export OIDC_ISSUER=https://kc.coulomb.social
export OIDC_CLIENT_ID=coulomb-social
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
export OIDC_SCOPES="openid profile email groups"
make run

Step	Expected
Open http://127.0.0.1:8008/ → Sign in	redirect KeyCape → Authelia
Complete MFA if prompted	callback → /app/
Sign out	landing; /app/ requires login

Automated

make test

See also: docs/deploy.md, docs/spaces-content.md, docs/adr/ADR-0001-netkingdom-identity.md.