From 9557d6f867fe03c546aa26655f84b4192109981d Mon Sep 17 00:00:00 2001 From: tegwick Date: Thu, 15 Oct 2026 05:22:42 +0200 Subject: [PATCH] Finish USER-WP-0039: both session uids live and accepted. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52 --- ...USER-WP-0039-sign-in-diagnosis-session-uids.md | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md b/workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md index abbb802..d32f2cd 100644 --- a/workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md +++ b/workplans/USER-WP-0039-sign-in-diagnosis-session-uids.md @@ -4,11 +4,11 @@ type: workplan title: "Sign-in diagnosis: account-site and Authelia uid on the account page" domain: communication repo: user-engine -status: active +status: finished owner: claude topic_slug: communication created: "2026-10-14" -updated: "2026-10-14" +updated: "2026-10-15" related: - NK-WP-0051-T03 - USER-WP-0036 @@ -53,7 +53,7 @@ the two uids are rendered; no email, token, cookie, or OTP. Tests in ```task id: USER-WP-0039-T02 -status: todo +status: done priority: high state_hub_task_id: "9ffe39bd-744b-513a-8539-c4e5daa0341a" ``` @@ -62,3 +62,12 @@ Build and roll the image through rapp-user-engine (no manifest change needed), check the two lines on `users.coulomb.social` with a mismatched session, and report the image digest to net-kingdom for the contract's evidence table (`user-engine change`). + +2026-10-15: live as `forgejo.coulomb.social/coulomb/user-engine@sha256:1e6547c40c93c49f01438edcf76c20f561ccebc110220bae020723505aa56c70` +(source `7f1db71`, pinned in rapp-user-engine). The first roll (`758af053`, +`80f5870`) always showed the Authelia uid as unknown: the session-id check +rejected the `%`, `^` and `!` that real Authelia ids contain. `7f1db71` +accepts RFC 6265 cookie characters, and `468d4c0` adds the account-site +session's aal1/aal2. Authelia's own level is not shown, because KeyCape checks +the one-time code and Authelia reports level 1. Founder acceptance: the page +showed `platform-root ยท aal2 one-time code verified` and Authelia `platform-root`.