coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Clarify account session controls and add authenticator recovery guidance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details
Build and Publish Container Image / build-and-push (push) Successful in 50s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c
This commit is contained in:
tegwick 2026-09-13 10:09:01 +02:00
parent 61dc76739f
commit a9ff77d21d
8 changed files with 395 additions and 26 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/configuration.md
View file

@ -70,3 +70,18 @@ Enabling it also requires the verification adapter and allow-lists:
The service fails closed when those settings are absent. Do not add a
placeholder or reused credential to turn the flag on.
## Authenticator management handoff
`USER_ENGINE_MFA_MANAGEMENT_URL` is optional and empty by default. When set, the
public `/security` help page offers a fixed HTTPS provider-management link. No
credentials, query parameters or fragments are allowed in this URL. The portal
never collects an OTP, reads an OTP seed, or marks a factor enabled from a return
URL. It cannot currently display authoritative enrollment status.
Enable only after verifying provider self-service identity checks, confirmation
before activation, cancellation/recovery, and enrolled-factor enforcement under
KEY-WP-0035. A reachable provider homepage alone is insufficient. Leave unset
while this dependency is unresolved; users get an explicit unavailable state and
help without needing to complete OTP login first. See [account journeys](account-journeys.md).