tegwick
edfdd79208
Close self-registration workplan with Case A proven and Create account entry implemented; park public registration enablement and identity negatives as CSOC-IN-0001/0002. Complete app-shell workplan with T06 operator runbook (seed, bind, webhook, smoke) and smoke doc updates.
116 lines
3.8 KiB
Markdown
116 lines
3.8 KiB
Markdown
# Identity smoke checklist
|
|
|
|
Evidence updated: **2026-08-12**.
|
|
|
|
## Offline (dev claims) — **passed**
|
|
|
|
```bash
|
|
uv sync && uv run manage.py migrate && make run
|
|
# OIDC_ENABLED=false (default), DEBUG=true
|
|
```
|
|
|
|
| Step | Result |
|
|
|------|--------|
|
|
| Open `/` → **Sign in** | → `/auth/dev-login/` |
|
|
| Dev form subject `smoke-1` | 302 → `/app/` |
|
|
| App home shows Spaces + profile chrome | OK (principal dump is under Session details) |
|
|
| Profile menu → Session details | issuer / subject / user-engine id |
|
|
| **Sign out** | session cleared |
|
|
| `/app/` after logout | 302 → login |
|
|
| Second login same subject | single `Member` row (idempotent) |
|
|
| `make test` | green |
|
|
|
|
Automated POST probe:
|
|
|
|
```text
|
|
dev_login_post → /app/ 200 with subject smoke-1
|
|
logout → app 302 to /auth/login/?next=/app/
|
|
```
|
|
|
|
## Public host app.coulomb.social — **Case A passed**
|
|
|
|
**Strategy:** live Railiance app on **`app.coulomb.social`**; apex
|
|
**`coulomb.social`** stays Bubble until content + self-registration cutover.
|
|
|
|
| Check | Detail |
|
|
|-------|--------|
|
|
| Cluster host | `app.coulomb.social` (Helm + ingress) |
|
|
| OIDC redirect | `https://app.coulomb.social/auth/callback/` |
|
|
| Health | `curl -fsS https://app.coulomb.social/healthz` → ok |
|
|
| Landing | 200; **Sign in** present |
|
|
| Case A — known LLDAP user | **done** (tegwick, AAL1, no MFA forced) → `/app/` |
|
|
| Create account | hidden until `NETKINGDOM_REGISTRATION_URL` is set |
|
|
| Case B — public registration → OIDC → Member | **blocked** on NK mailbox verification (`NK-WP-0025` / residual intakes) |
|
|
| Apex | **do not** repoint until Bubble retirement |
|
|
|
|
### Product smoke (spaces — after deploy + seed)
|
|
|
|
Operator runbook: `docs/deploy.md` § Operator runbook. Short path:
|
|
|
|
```bash
|
|
# fixture raw (public)
|
|
curl -fsS \
|
|
"https://forgejo.coulomb.social/coulomb/coulomb-social/raw/branch/main/docs/space-fixtures/demo/pages/index.md" \
|
|
| head
|
|
# seed in cluster
|
|
kubectl -n coulomb-social exec deploy/coulomb-social -- \
|
|
python manage.py seed_demo_space
|
|
```
|
|
|
|
| Step | Expected |
|
|
|------|----------|
|
|
| Sign in tegwick | `/app/` Spaces list |
|
|
| Open Demo space | rendered markdown from Forgejo |
|
|
| Session details | profile menu diagnostics (no secrets) |
|
|
| Refresh content | re-fetch after git edit (or webhook) |
|
|
|
|
## Case matrix (CSOC-WP-0003-T04)
|
|
|
|
| Case | Status |
|
|
|------|--------|
|
|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
|
|
| B — brand-new public registration → OIDC → Member | **deferred** → residual `CSOC-IN-0001` / NK-WP-0025 |
|
|
|
|
### Negatives to run when Case B unblocks (or ad-hoc)
|
|
|
|
Record results here or in residual notes; residual `CSOC-IN-0002`.
|
|
|
|
| Negative | Intent |
|
|
|----------|--------|
|
|
| State / nonce replay | callback with recycled `state` fails closed |
|
|
| Subject collision | same issuer+subject always one Member |
|
|
| Email-only collision | email must not take over another subject |
|
|
| Step-up ACR | when `OIDC_STEP_UP_ACR` requested, insufficient acr rejected |
|
|
| Registration open redirect | `/auth/register/` ignores `?next=` host; only configured URL |
|
|
|
|
App registration entry (when URL configured):
|
|
|
|
```bash
|
|
# only after NetKingdom publishes public registration URL
|
|
# set NETKINGDOM_REGISTRATION_URL in coulomb-social-env (no secrets in git)
|
|
```
|
|
|
|
## Platform OIDC (local redirect) — optional
|
|
|
|
```bash
|
|
export OIDC_ENABLED=true
|
|
export OIDC_ISSUER=https://kc.coulomb.social
|
|
export OIDC_CLIENT_ID=coulomb-social
|
|
export OIDC_REDIRECT_URI=http://127.0.0.1:8008/auth/callback/
|
|
export OIDC_SCOPES="openid profile email groups"
|
|
make run
|
|
```
|
|
|
|
| Step | Expected |
|
|
|------|----------|
|
|
| Open http://127.0.0.1:8008/ → Sign in | redirect KeyCape → Authelia |
|
|
| Complete MFA if prompted | callback → `/app/` |
|
|
| Sign out | landing; `/app/` requires login |
|
|
|
|
## Automated
|
|
|
|
```bash
|
|
make test
|
|
```
|
|
|
|
See also: `docs/deploy.md`, `docs/spaces-content.md`, `docs/adr/ADR-0001-netkingdom-identity.md`.
|