fix: restore native user portal login and track tenant integration

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

sso-mfa/k8s/keycape/verify-user-engine-portal.py

@@ -0,0 +1,56 @@
+#!/usr/bin/env python3
+"""Read-only native authorize checks; print no state, cookies or auth tokens."""
+import base64
+import hashlib
+import json
+import secrets
+from urllib.error import HTTPError
+from urllib.parse import urlencode, urlsplit
+from urllib.request import HTTPRedirectHandler, build_opener
+
+
+class NoRedirect(HTTPRedirectHandler):
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        return None
+
+
+def verify():
+    opener = build_opener(NoRedirect)
+    base = {
+        "client_id": "user-engine-portal", "response_type": "code",
+        "redirect_uri": "https://users.92-205-62-239.nip.io/oidc/callback",
+        "scope": "openid profile email groups", "state": secrets.token_urlsafe(24),
+        "code_challenge": base64.urlsafe_b64encode(
+            hashlib.sha256(secrets.token_bytes(32)).digest()
+        ).rstrip(b"=").decode(), "code_challenge_method": "S256",
+    }
+    results = []
+    for name in ("valid", "wrong_callback", "missing_pkce"):
+        params = dict(base)
+        if name == "wrong_callback":
+            params["redirect_uri"] = "https://invalid.example/oidc/callback"
+        if name == "missing_pkce":
+            params.pop("code_challenge")
+            params.pop("code_challenge_method")
+        try:
+            response = opener.open("https://kc.coulomb.social/authorize?" + urlencode(params), timeout=20)
+        except HTTPError as error:
+            response = error
+        with response:
+            row = {"check": name, "status": response.code}
+            if name == "valid":
+                location = urlsplit(response.headers.get("Location", ""))
+                row["redirect_origin"] = location.scheme + "://" + location.netloc
+                row["passed"] = response.code == 302 and row["redirect_origin"] == "https://auth.coulomb.social"
+            else:
+                body = json.loads(response.read(4096))
+                row.update(error=body.get("error"), feature=body.get("feature"))
+                expected = "redirect_uri" if name == "wrong_callback" else "missing_pkce"
+                row["passed"] = response.code == 400 and row["error"] == "invalid_profile_usage" and row["feature"] == expected
+            results.append(row)
+    print(json.dumps(results, indent=2))
+    return all(row["passed"] for row in results)
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if verify() else 1)