coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USER-WP-0039: show the account-site session's assurance beside its uid (NK-WP-0051-T03)

Browse source 
The account-site line shows its KeyCape token's aal1/aal2. Authelia's own
authentication_level is not shown: KeyCape checks the one-time code, so
Authelia reports level 1 even for an aal2 sign-in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-15 00:47:38 +02:00
parent e9534ef00f
commit 468d4c0822
2 changed files with 24 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

18
src/user_engine/web.py
View file

@ -68,6 +68,19 @@ def _jsonable(value: Any) -> Any:
return value
def _assurance_text(level: object) -> str:
"""Name the account-site session's level from its KeyCape token.
Authelia's own authentication_level is not shown: KeyCape checks the
one-time code, so Authelia reports level 1 even for an aal2 sign-in.
"""
if level == "aal2":
return ' &middot; <span data-assurance="aal2"><code>aal2</code> one-time code verified</span>'
if level == "aal1":
return ' &middot; <span data-assurance="aal1"><code>aal1</code> password only</span>'
return ""
class PortalApplication:
"""Small, auditable HTTP adapter over :class:`UserEngineService`."""
@ -2343,10 +2356,13 @@ Use the login name they provide; it may differ from your display name.</p></sect
"""
account_uid = actor.preferred_username or actor.subject
authelia_uid = self._netkingdom_name()
account_level = _assurance_text(
actor.assurance.get("level") if isinstance(actor.assurance, Mapping) else None)
lines = (
'<dl class="session-uids">'
"<dt>Account site session <code>uid</code></dt>"
f'<dd data-session="account-site"><strong>{escape(account_uid)}</strong></dd>'
f'<dd data-session="account-site"><strong>{escape(account_uid)}</strong>'
f'{account_level}</dd>'
"<dt>Authelia session <code>uid</code> (shared NetKingdom sign-in)</dt>"
+ (
f'<dd data-session="authelia"><strong>{escape(authelia_uid)}</strong></dd>'