tegwick
4c7f32adc7
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a15374-f59f-7a31-86d2-d23b5d2ed181
48 lines
2.4 KiB
Markdown
48 lines
2.4 KiB
Markdown
---
|
|
id: NET-IN-0005
|
|
kind: intake
|
|
title: "Expose a recipient-bound opaque delivery handoff for provider password setup"
|
|
status: open
|
|
flavor: implementation
|
|
origin: cross-repo
|
|
origin_ref: USER-WP-0035-T02
|
|
priority: high
|
|
owner: net-kingdom
|
|
repo: net-kingdom
|
|
requested_by: user-engine
|
|
created: "2026-10-11"
|
|
updated: "2026-10-11"
|
|
related: [EMAIL-IN-0001, NK-WP-0047]
|
|
---
|
|
|
|
The identity-provisioner currently generates `password_setup_url` in the
|
|
provision response. `PasswordSetupGrants` has a 900-second default lifetime,
|
|
stores only a digest, revokes the prior grant on reissue, invalidates grants on
|
|
restart and consumes before applying the password. The URL reaches User Engine's
|
|
provider-owned setup screen; there is no supported issuer-to-mail delivery
|
|
operation. Existing NK-WP-0047 proves Authelia reset-mail delivery and personal
|
|
sign-in, not this separate identity-provisioner setup grant.
|
|
|
|
Prepare the provider side of the fixed email-connect capability requested in
|
|
EMAIL-IN-0001. Return an exact owner implementation work record and public
|
|
handoff contract. User Engine should receive a non-secret opaque receipt with
|
|
provider/request identity, expiry and accepted/uncertain/rejected status; the
|
|
single-use bearer URL should go directly from the issuer through the reviewed
|
|
recipient-bound delivery actuator. Do not add an OpenBao client, directory
|
|
credential, mailbox-admin token or password setter to User Engine.
|
|
|
|
Bind delivery to the provider-authoritative subject/recipient and the approved
|
|
user/tenant lifecycle intent. Preserve existing authenticated provisioning and
|
|
PDP admission; a successful mail request is not new authorization. Define stable
|
|
request identity and behavior on duplicate, provider timeout, restart, reissue,
|
|
cancel and recipient mismatch. A retry must not silently issue a new grant and
|
|
invalidate the message the intended person already received. Keep the grant
|
|
single-use, expiring and provider-owned; no raw link in durable application
|
|
outboxes, audit events or work records.
|
|
|
|
Publish synthetic and owner-reviewed native evidence for the exact handoff,
|
|
private intended-person receipt and setup completion separately. Do not claim
|
|
that invitation acceptance, registration mailbox verification or Authelia's
|
|
completed reset journey proves this path. No live changes, mail, credential or
|
|
setup-grant reads occurred in this request. This is owner preparation first,
|
|
not a per-item founder approval question or a founder-ready attended command.
|