64 lines
2.6 KiB
Markdown
64 lines
2.6 KiB
Markdown
---
|
||
id: KEY-WP-0034
|
||
type: workplan
|
||
title: "Browser authentication recovery and confirmed shared sign-out"
|
||
domain: infotech
|
||
repo: key-cape
|
||
status: finished
|
||
flavor: implementation
|
||
owner: codex
|
||
topic_slug: key-cape
|
||
created: "2026-09-12"
|
||
updated: "2026-09-25"
|
||
state_hub_workstream_id: "49b0cd1d-fb9d-5351-99eb-9be9143a092d"
|
||
---
|
||
|
||
The operator reports a dead-end authentication error after using an account
|
||
outside the product tenant. Recent issuer telemetry indicates token exchange
|
||
failure; tenant rejection and provider failure must not be conflated.
|
||
|
||
## Implement and validate recovery
|
||
|
||
```task
|
||
id: KEY-WP-0034-T01
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "ba285335-4ead-5478-8fb7-89a2ec1ba695"
|
||
```
|
||
|
||
Route failed browser login to the public account recovery surface without codes,
|
||
state or unverified identity. Show verified portal identity, tenant memberships,
|
||
and recorded workload memberships; preserve operator/customer separation.
|
||
Provide CSRF-protected portal logout and confirmed shared provider sign-out with
|
||
fixed owner-configured return locations. No automatic reauthentication loops,
|
||
MFA downgrade, global JWT revocation claim or inferred workload entitlements.
|
||
|
||
## Publish and verify the recovery flow
|
||
|
||
```task
|
||
id: KEY-WP-0034-T02
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "4c836ddf-2eb8-528a-b63f-8499f3a6cbf2"
|
||
```
|
||
|
||
Publish immutable images, update canonical runtime pins, verify anonymous
|
||
recovery and sign-out confirmation live, and record actual account switching
|
||
only after browser evidence. Existing application sessions may outlive provider
|
||
logout. Related: USER-WP-0025-T03 and VERGABE-WP-0019-T06.
|
||
|
||
Source verification: Full Go suite passed; final OIDC/config tests passed after recovery expansion. Immutable publication and live checks are in progress.
|
||
|
||
### Live recovery rollout — 2026-09-12
|
||
|
||
Recovery is deployed in KeyCape 4d8b8fe, User Engine e54b6ee and Vergabe c067993
|
||
(Helm revision 3). All three are Ready. Six provider checks, eleven product
|
||
checks and six fresh anonymous Chromium checks pass, including actual provider
|
||
logout POST and return to the portal without test overrides. Detailed receipt: railiance-apps/docs/evidence/2026-09-12-account-recovery-live.md.
|
||
|
||
2026-09-24 23:42–23:45 UTC the founder completed the account switch. The issuer
|
||
recorded one `mfa_failed` for `user-engine-portal`, then three separate
|
||
`auth_start` → `auth_success` → `token_issued` sequences. A silent reuse of
|
||
the previous portal session would not have produced those new successes.
|
||
Provider logout still does not revoke already issued application JWTs.
|
||
Receipt: `docs/evidence/2026-09-24-fresh-login-and-account-switch.md`.
|