net-kingdom/workplans/NK-WP-0037-vergabe-company-welcome.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
NK-WP-0037	workplan	Bind password setup to the Vergabe company welcome and sign-in	infotech	net-kingdom	active	codex	netkingdom	2026-09-12	2026-09-12	VERGABE-WP-0019 KEY-WP-0033 RAPPS-WP-0014	15f59624-ab25-5894-9b05-1e6b261749e5

Keep the company return inside the one-use setup grant

id: NK-WP-0037-T01
status: done
priority: high
state_hub_task_id: "61f71d46-8218-5c50-8b1b-5cd1c096d9d3"

PasswordSetupGrants now accepts an exact tenant-to-HTTPS-entry mapping, copies it at startup, and stores the destination inside the recipient's grant when issuing a setup link. Only successful password setup releases the company link. The service-authenticated provisioning tenant selects it; browser return fields are ignored. No recipient, credential or setup token travels to the product. The product performs its own fresh login and explicit account confirmation.

Sixteen provisioner tests pass, including real HTTP issuance/completion, malicious return fields, replay/expiry, other tenants and configuration validation. Existing setup links remain process-local and expire on restart.

Bind and release the provider and company client

id: NK-WP-0037-T02
status: progress
priority: high
state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7"

Register public client vergabe-demo-company with only openid/profile/groups, authorization_code and the exact callback https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/. No client-declared tenant, secret, public registration or MFA downgrade. Preserve all existing KeyCape configuration using the established guarded client-registration lane. KEY-WP-0033 retains fresh-login propagation and the shared issuer rollout preflight.

Set PASSWORD_SETUP_TENANT_RETURNS to map tenant:trial:demo-company to https://vergabe-teilnahme.coulomb.social/demo-company/. Publish and pin the provisioner image with its 25m/32Mi request unchanged. Preserve the password setter, credential references and directory contents. Recipient sign-in and provider-required MFA need an attended acceptance; no credential capture or operator impersonation. VERGABE-WP-0019-T06 owns product acceptance and RAPPS-WP-0014 retains application placement and recovery.

2026-09-12 release prepared: source 48a75b1, published provisioner digest sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6. Sixteen tests pass against that runtime image. The exact public client helper's server dry run passes with unrelated Secret/config bytes preserved; candidate patches are in the KeyCape and provisioner directories. Deployment waits for the attended shared-issuer window. See railiance-apps/docs/vergabe-demo-company-sso-rollout.md. No live configuration, credential, recipient data or application session was changed.

2026-09-12 attended rollout executed after explicit operator approval. KeyCape and password setup are Ready on the prepared digests; exact public client registration was CAS-applied (config resourceVersion 60123977) with unrelated config bytes/Secret data preserved. Existing portal and product client both pass fresh-login forwarding, wrong-callback and missing-PKCE checks (6 checks). Vergabe Helm revision 2 is Ready; identity migration completed, both PVCs remain, and requests remain 60m CPU/256Mi memory. Eleven live product checks pass: company welcome, anonymous gate, no-store, secure scoped CSRF, POST/CSRF-only login start, native issuer redirect, private company/media protection and invalid callback/confirmation rejection. Initial readback showed zero accounts, identity mappings and staff accounts. Native invited-user sign-in/MFA and confirmation are now requested from the operator; no user credential was used by the agent. Recovery and two-user acceptance remain their existing tasks. Evidence: railiance-apps/docs/evidence/2026-09-12-demo-company-sso-live.md.