43 lines
2.1 KiB
Markdown
43 lines
2.1 KiB
Markdown
|
# User-engine caller policy draft — 2026-10-08
|
||
|
|
|
||
|
|
This file proposes the only caller that exists today. It is not mounted,
|
||
|
|
`EMAIL_CONNECT_CALLERS_FILE` is not set, and no token file was created.
|
||
|
|
EMAIL-WP-0008-T03 stays waiting until the bindings, quotas and token custody
|
||
|
|
are approved.
|
||
|
|
|
||
|
|
Source: `config/callers.user-engine.draft.json`.
|
||
|
|
|
||
|
|
## What the live caller does
|
||
|
|
|
||
|
|
user-engine sends invitation mail to `/v1/send` with source `user-engine` and
|
||
|
|
templates `family_member.invited` or `family_invitation.resent`. It reads
|
||
|
|
`/v1/status` and `/v1/delivery-status`. Registration uses
|
||
|
|
`/v1/registration-verifications`, consume and cancel. The live registration
|
||
|
|
allow-list is tenant `tenant:coulomb` and client `coulomb-social`
|
||
|
|
(`USER_ENGINE_REGISTRATION_TENANTS` / `USER_ENGINE_REGISTRATION_CLIENTS` in
|
||
|
|
`net-kingdom/sso-mfa/k8s/user-engine/runtime.yaml`). Mail and verification
|
||
|
|
share the current `user-engine-delivery` `mail-token`. Suppression is not a
|
||
|
|
user-engine operation and is omitted.
|
||
|
|
|
||
|
|
## Proposed limits
|
||
|
|
|
||
|
|
`rate_per_minute` 10 matches the live registration limit of 10 requests per
|
||
|
|
60 seconds. Burst 5 and an 8 KiB payload cap are below the receiver ceilings
|
||
|
|
(6000/minute, 600 burst, 128 KiB). They are proposals, not an approved quota.
|
||
|
|
`adopt_legacy_verifications` is proposed so this original caller can still
|
||
|
|
consume verification rows written before caller ids existed.
|
||
|
|
|
||
|
|
## Gap that blocks activation
|
||
|
|
|
||
|
|
Current invitation envelopes carry `tenant` and do not carry `client_id`.
|
||
|
|
Scoped send accepts a binding only when both fields are present and admitted,
|
||
|
|
or when both are absent and `legacy_invitation_binding` is set. A tenant
|
||
|
|
without a client id is denied. Family invitations also use tenants other than
|
||
|
|
`tenant:coulomb`. This draft therefore does not claim to carry current
|
||
|
|
invitation traffic. Activation needs a user-engine change that sends an
|
||
|
|
admitted tenant/client pair, or a separate reviewed contract change.
|
||
|
|
|
||
|
|
The token path in the draft does not exist. Selecting this file on the
|
||
|
|
running receiver would fail startup before serving traffic. Do not copy the
|
||
|
|
shared ingest token into that path as part of this draft.
|