tegwick
edfdd79208
Close self-registration workplan with Case A proven and Create account entry implemented; park public registration enablement and identity negatives as CSOC-IN-0001/0002. Complete app-shell workplan with T06 operator runbook (seed, bind, webhook, smoke) and smoke doc updates.
95 lines
2.7 KiB
Markdown
95 lines
2.7 KiB
Markdown
---
|
|
id: CSOC-WP-0003
|
|
type: workplan
|
|
title: "Add NetKingdom self-registration and profile-aware assurance"
|
|
domain: communication
|
|
repo: coulomb-social
|
|
status: finished
|
|
owner: bernd
|
|
topic_slug: coulomb-social
|
|
created: "2026-08-09"
|
|
updated: "2026-08-12"
|
|
depends_on:
|
|
- CSOC-WP-0002
|
|
- NK-WP-0025
|
|
- USER-WP-0022
|
|
- KEY-WP-0008
|
|
state_hub_workstream_id: "7cd7d6b8-e01d-4b34-8680-3c0cac68d80e"
|
|
---
|
|
|
|
# CSOC-WP-0003 - self-registration and assurance
|
|
|
|
Extend the working CSOC-WP-0002 OIDC/JIT shell with a NetKingdom account
|
|
creation entry point and optional profile/action step-up.
|
|
|
|
**Finished 2026-08-12:** app-side work complete. Existing-user login on
|
|
**`app.coulomb.social`** is proven (tegwick, AAL1). Landing **Create account**
|
|
is implemented and gated on `NETKINGDOM_REGISTRATION_URL`. Public Case B waits
|
|
on NetKingdom mailbox verification (`NK-WP-0025`) — residuals below.
|
|
|
|
## T01 - Preserve and prove first-login JIT profile creation
|
|
|
|
```task
|
|
id: CSOC-WP-0003-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "dde13170-7203-4fcd-b0ce-5874fccc4632"
|
|
```
|
|
|
|
Harden issuer/subject keyed Member creation, concurrent callback behavior,
|
|
verified ID-token processing, and user-engine link.
|
|
|
|
**2026-08-10 evidence:** live login on app.coulomb.social shows principal +
|
|
user-engine id; image `:f5537d8` uses id_token when `/userinfo` 401s.
|
|
|
|
## T02 - Add Create NetKingdom account
|
|
|
|
```task
|
|
id: CSOC-WP-0003-T02
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "aaf2d2cb-6ba9-42cb-9271-aacc414e947a"
|
|
```
|
|
|
|
Landing-page **Create account** using configured `NETKINGDOM_REGISTRATION_URL`.
|
|
App entry implemented (`/auth/register/`, context processor, tests). Button
|
|
hidden until env URL is set. **Enablement residual:** `CSOC-IN-0001` after
|
|
NK-WP-0025 publishes registration + verified-mail flow.
|
|
|
|
## T03 - Support profile/action step-up
|
|
|
|
```task
|
|
id: CSOC-WP-0003-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "6636a746-02ca-4a70-ac3c-0219c89cd6a7"
|
|
```
|
|
|
|
AAL1 ordinary sessions; AAL2 via `acr_values` when required. Live coulomb-social
|
|
client uses `mfaRequired: false`.
|
|
|
|
## T04 - Deploy and run Case A / Case B matrix
|
|
|
|
```task
|
|
id: CSOC-WP-0003-T04
|
|
status: done
|
|
priority: medium
|
|
state_hub_task_id: "57bac5f4-fd5d-46ba-92a3-a7bbeb15aa08"
|
|
```
|
|
|
|
| Case | Status |
|
|
|------|--------|
|
|
| A — known LLDAP user, first/repeat login on app.* | **done** (tegwick) |
|
|
| B — brand-new public registration → OIDC → Member | residual **CSOC-IN-0001** (NK mailbox) |
|
|
|
|
Negatives checklist parked in `docs/identity/smoke.md`; execution residual
|
|
**CSOC-IN-0002**.
|
|
|
|
## Residuals (live records)
|
|
|
|
| Id | Role |
|
|
|----|------|
|
|
| `CSOC-IN-0001` | Enable Create account + Case B smoke when NK registration URL ships |
|
|
| `CSOC-IN-0002` | Record identity negatives (replay, collision, step-up) |
|
|
|
|
Source: `docs/intakes/csoc-residuals.md`.
|