coulomb/user-engine
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

USER-WP-0039: show the account-site session's assurance beside its uid (NK-WP-0051-T03)

Browse source 
The account-site line shows its KeyCape token's aal1/aal2. Authelia's own
authentication_level is not shown: KeyCape checks the one-time code, so
Authelia reports level 1 even for an aal2 sign-in.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1041694@bnt-lap001
Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
This commit is contained in:
tegwick 2026-10-15 00:47:38 +02:00
parent e9534ef00f
commit 468d4c0822
2 changed files with 24 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

9
tests/test_account_identity_disclosure.py
View file

@ -73,7 +73,7 @@ class AccountIdentityDisclosureTests(unittest.TestCase):
for path in ["/", "/onboarding"]:
with self.subTest(path=path):
body = self._uid_lines(path, "sample.user")
self.assertIn(b'<dd data-session="account-site"><strong>sample.user</strong></dd>', body)
self.assertIn(b'<dd data-session="account-site"><strong>sample.user</strong> &middot; <span data-assurance="aal2">', body)
self.assertIn(b'<dd data-session="authelia"><strong>sample.user</strong></dd>', body)
self.assertIn(b"Account site session <code>uid</code>", body)
self.assertIn(b"Authelia session <code>uid</code>", body)
@ -84,7 +84,7 @@ class AccountIdentityDisclosureTests(unittest.TestCase):
for path in ["/", "/onboarding"]:
with self.subTest(path=path):
body = self._uid_lines(path, "bernd.worsch-3")
self.assertIn(b'<dd data-session="account-site"><strong>sample.user</strong></dd>', body)
self.assertIn(b'<dd data-session="account-site"><strong>sample.user</strong> &middot; <span data-assurance="aal2">', body)
self.assertIn(b'<dd data-session="authelia"><strong>bernd.worsch-3</strong></dd>', body)
self.assertIn(b'role="alert" class="session-uid-mismatch"', body)
self.assertIn(b"These sessions differ.", body)
@ -105,6 +105,11 @@ class AccountIdentityDisclosureTests(unittest.TestCase):
self.assertNotIn(b"session-uid-mismatch", body)
self.assertNotIn(b"<script>x", body)
def test_authelia_line_carries_no_level(self):
# KeyCape checks the one-time code; Authelia's level would read aal1.
body = self._uid_lines("/", "sample.user")
self.assertIn(b'<dd data-session="authelia"><strong>sample.user</strong></dd>', body)
def test_without_lookup_authelia_uid_is_unknown(self):
self.app.identity_lookup = None
_, body = invoke(self.app, "/", cookie="ue_session=member; authelia_session=opaque")