net-kingdom/workplans/NK-WP-0037-vergabe-company-welcome.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
NK-WP-0037	workplan	Bind password setup to the Vergabe company welcome and sign-in	infotech	net-kingdom	active	codex	netkingdom	2026-09-12	2026-09-12	VERGABE-WP-0019 KEY-WP-0033 RAPPS-WP-0014	15f59624-ab25-5894-9b05-1e6b261749e5

Keep the company return inside the one-use setup grant

id: NK-WP-0037-T01
status: done
priority: high
state_hub_task_id: "61f71d46-8218-5c50-8b1b-5cd1c096d9d3"

PasswordSetupGrants now accepts an exact tenant-to-HTTPS-entry mapping, copies it at startup, and stores the destination inside the recipient's grant when issuing a setup link. Only successful password setup releases the company link. The service-authenticated provisioning tenant selects it; browser return fields are ignored. No recipient, credential or setup token travels to the product. The product performs its own fresh login and explicit account confirmation.

Sixteen provisioner tests pass, including real HTTP issuance/completion, malicious return fields, replay/expiry, other tenants and configuration validation. Existing setup links remain process-local and expire on restart.

Bind and release the provider and company client

id: NK-WP-0037-T02
status: wait
blocking_reason: "Release prepared; await the documented attended shared-KeyCape rollout."
priority: high
state_hub_task_id: "8921691b-e7a2-543c-8189-3abc24de1bc7"

Register public client vergabe-demo-company with only openid/profile/groups, authorization_code and the exact callback https://vergabe-teilnahme.coulomb.social/demo-company/accounts/oidc/callback/. No client-declared tenant, secret, public registration or MFA downgrade. Preserve all existing KeyCape configuration using the established guarded client-registration lane. KEY-WP-0033 retains fresh-login propagation and the shared issuer rollout preflight.

Set PASSWORD_SETUP_TENANT_RETURNS to map tenant:trial:demo-company to https://vergabe-teilnahme.coulomb.social/demo-company/. Publish and pin the provisioner image with its 25m/32Mi request unchanged. Preserve the password setter, credential references and directory contents. Recipient sign-in and provider-required MFA need an attended acceptance; no credential capture or operator impersonation. VERGABE-WP-0019-T06 owns product acceptance and RAPPS-WP-0014 retains application placement and recovery.

2026-09-12 release prepared: source 48a75b1, published provisioner digest sha256:55f744cc9bc2ec3fe23eb7175fa4b7bfcc7a29469d9b9a1a8eaefc75d790dfc6. Sixteen tests pass against that runtime image. The exact public client helper's server dry run passes with unrelated Secret/config bytes preserved; candidate patches are in the KeyCape and provisioner directories. Deployment waits for the attended shared-issuer window. See railiance-apps/docs/vergabe-demo-company-sso-rollout.md. No live configuration, credential, recipient data or application session was changed.