coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Rate limit public registration writes
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source
This commit is contained in:
tegwick 2026-08-10 17:52:53 +02:00
parent cccca324c1
commit b80de5a1f4
6 changed files with 129 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
workplans/USER-WP-0021-portal-product-expansion.md
View file

@ -199,3 +199,9 @@ the required flex-auth and delivery settings are absent. A guarded deployment
was restored to the last known-good revision without service loss. Final T01
activation remains blocked on approved OpenBao audit/mail receiver tokens and
transactional SMTP credentials; no placeholder or reused credential was added.
2026-08-10 authority check: the deployed tenant-engine contract currently
supports tenant creation plus role/plan operations, but exposes no tenant
metadata-update or retirement operation. Portal update/retirement routes must
remain out until that authority owns the corresponding lifecycle contract;
user-engine will not simulate authoritative tenant state locally.

18
workplans/USER-WP-0022-public-registration-and-jit-application-profiles.md
View file

@ -83,6 +83,17 @@ last known-good revision was restored and remained available. Do not activate
this image or public registration until the OpenBao delivery and verification
tokens plus transactional SMTP lane are installed.
2026-08-10 security increment: every anonymous registration mutation now has
a bounded per-peer sliding-window limit, configurable through
`USER_ENGINE_REGISTRATION_RATE_LIMIT` and
`USER_ENGINE_REGISTRATION_RATE_WINDOW_SECONDS`. The application deliberately
ignores spoofable forwarding headers and relies on the ingress-normalized peer
address. Conformance proves isolation between peers and a generic 429 response.
Expired and replayed verification handles are also proven to produce the same
redacted rejection without provider or account detail. The full suite passes
130 tests with three environment-dependent skips. Cluster ingress throttling
remains defense in depth before public enablement.
## T02 - Orchestrate provider identity creation
```task
@ -179,3 +190,10 @@ replay, account-link collision, cross-tenant profile access, step-up downgrade,
unlink, and deletion. Verify audit/outbox redaction and correlation.
Done when the full suite and deployed consumer conformance both pass.
The user-engine portion now covers return-context rejection, provider outage
and idempotent recovery, resume replay denial, purpose/binding mismatch,
verification expiry/replay redaction, peer rate limiting, identity-link
collision, cross-tenant denial, lifecycle deletion, audit/outbox redaction,
and request correlation. Deployed consumer conformance remains gated on public
runtime credentials and activation.