coulomb/net-kingdom
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Enable public registration and prove event delivery
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-08-14 00:42:14 +02:00
parent 8070dd4b14
commit c56465e32d
3 changed files with 54 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/NK-WP-0025-public-self-registration-and-application-jit.md
View file

@ -118,7 +118,7 @@ provider failure after local completion, and run disposable live conformance.
```task
id: NK-WP-0025-T03
status: wait
status: done
priority: high
state_hub_task_id: "3ec4a9a0-cbce-4c63-8ed8-db36f4cae0fb"
```
@ -133,6 +133,15 @@ Done when direct NetKingdom registration and coulomb.social-initiated
registration converge on the same verified identity flow without open
redirects or client confusion.
Done 2026-08-14: public registration is enabled only for client
`coulomb-social` and `tenant:coulomb`; the password handoff permits only the
HTTPS `kc.coulomb.social` origin. The user-engine `/register` page is live.
railiance-apps commit `963de9c` publishes
`NETKINGDOM_REGISTRATION_URL=https://users.92-205-62-239.nip.io/register`, and
the live coulomb.social `/auth/register/` returns a 302 to that exact URL.
Unknown-client and unknown-tenant API requests both return 400 before any mail
request. The fresh OIDC flow remains provider-owned after password setup.
## T04 - Apply optional MFA policy safely
```task
@ -155,6 +164,12 @@ Source implementation adds a per-client minimum override and honors explicit
`acr_values=aal2`; only the coulomb-social static registration selects AAL1.
Other clients retain provider-driven mandatory MFA. Live rollout remains.
2026-08-14 rollout: public registration is live with a scoped verification
token. An authenticated malformed consume request reaches email-connect and
returns 400 rather than 401, proving the caller credential without exposing
it. Repeated invalid opaque handles return the same redacted 400 response.
Client and tenant allow-list negatives also fail before mail issuance.
## T05 - Prove both cases end to end
```task