52 lines
1.6 KiB
Markdown
52 lines
1.6 KiB
Markdown
|
---
|
||
|
|
id: USER-WP-0029
|
||
|
|
type: workplan
|
||
|
|
title: "Tenant administrator journeys and lifecycle isolation"
|
||
|
|
domain: communication
|
||
|
|
repo: user-engine
|
||
|
|
status: active
|
||
|
|
owner: codex
|
||
|
|
topic_slug: communication
|
||
|
|
created: "2026-09-13"
|
||
|
|
updated: "2026-09-13"
|
||
|
|
---
|
||
|
|
|
||
|
|
Implements docs/account-journeys.md under USER-WP-0027. A passing local
|
||
|
|
suite is not evidence that an external provider flow works live.
|
||
|
|
|
||
|
|
## Authorize target before provider calls
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: USER-WP-0029-T01
|
||
|
|
status: done
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
T01/T03/T04/T06: reject non-admin and wrong-tenant user IDs before provisioning/recovery/lifecycle calls; bind invitation operations to route tenant; protect shared identities from global tenant-scoped mutation.
|
||
|
|
|
||
|
|
## Confirm lifecycle changes and protect admin succession
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: USER-WP-0029-T02
|
||
|
|
status: done
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
T06/T08: preview target/scope/action, CSRF-bound confirmation, reject stale state and last-admin removal, provide cancel and recovery. Keep domain/API guards as well as UI checks. Document concurrency/external propagation limits.
|
||
|
|
|
||
|
|
## Explain onboarding and delivery state
|
||
|
|
|
||
|
|
```task
|
||
|
|
id: USER-WP-0029-T03
|
||
|
|
status: done
|
||
|
|
priority: high
|
||
|
|
```
|
||
|
|
|
||
|
|
T02/T03/T04/T07: show actual directory login separately from display name, account state, provider uncertainty, invitation delivery status and appropriate next steps; prevent duplicate rows from workload memberships.
|
||
|
|
|
||
|
|
|
||
|
|
Validation: 210 database-enabled regression tests passed with no skips,
|
||
|
|
including independent-connection last-admin protection and nested bootstrap
|
||
|
|
rollback. Thirteen isolated Chromium checks passed. Provider OTP and application
|
||
|
|
access integration remain explicitly open; no complete-journey claim is inferred.
|