From ed69e97b86ff2320f9319e456221d3cc7d1d018c Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 23 Sep 2026 22:10:38 +0200 Subject: [PATCH] Name the login and sign-in address at onboarding handoff (USER-WP-0035-T01). From the 2026-09-23 operator run: recipients try the email address, and the admin user entry gave no sign-in address to pass on. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 58902@bnt-lap001 Assistant-Session: 7ac7f865-2dc5-4aa7-8eb7-27a342109c2f --- src/user_engine/web.py | 7 ++- tests/test_journey_roles.py | 9 +++ ...SER-WP-0035-onboarding-handoff-findings.md | 59 +++++++++++++++++++ 3 files changed, 74 insertions(+), 1 deletion(-) create mode 100644 workplans/USER-WP-0035-onboarding-handoff-findings.md diff --git a/src/user_engine/web.py b/src/user_engine/web.py index f5485a7..87b5f83 100644 --- a/src/user_engine/web.py +++ b/src/user_engine/web.py @@ -2053,6 +2053,9 @@ Use the login name they provide; it may differ from your display name.

' for k,v in fields.items()) return f'
{hidden}
' login = (f'

Login name: {escape(self._directory_login(directory.subject))}

' + '

Pass this name on with the sign-in address. It is not the email address, ' + 'and signing in by email does not work.

' + f'

Sign-in page: {escape(self.login_url)}

' '

Password and authenticator status are not available here.

') if directory else '

Login not created. Prepare a login before asking this person to sign in.

' actions = "" if not inactive: @@ -2244,11 +2247,13 @@ Use the login name they provide; it may differ from your display name.

Login ready for password setup" - + f"

Login name: {escape(self._directory_login(subject))}. Use this name when signing in; it may differ from the display name.

" + + f"

Login name: {escape(self._directory_login(subject))}. Use this name when signing in; it may differ from the display name, and it is not the email address.

" + "

The password is handled only by the NetKingdom identity " "surface. This short-lived link is single use.

" f'

' "Continue to password setup

" + + f'

After the password is set, sign in at {escape(self.login_url)}. ' + "This portal does not deliver the setup link; pass it and the login name on yourself.

" f'

' "Return to tenant administration

", ) diff --git a/tests/test_journey_roles.py b/tests/test_journey_roles.py index 3dd9aa3..acc50e7 100644 --- a/tests/test_journey_roles.py +++ b/tests/test_journey_roles.py @@ -76,6 +76,15 @@ class UserJourneys(JourneyFixture): self.assertIn(b'Login name: actual.login',body) self.assertIn(b'may differ from the display name',body) self.assertEqual(1,len(self.app.service.store.identities_for_user(user.user_id))) + # 2026-09-23 operator run: the recipient must be told where to sign in, + # and that the email address is not the login name (USER-WP-0035-T01). + self.assertIn(self.app.login_url.encode(),body) + self.assertIn(b'not the email address',body) + response,listing=invoke(self.app,f'/admin/{TENANT}',cookie='ue_session=admin') + self.assertEqual('200 OK',response['status']) + self.assertIn(b'Sign-in page:',listing) + self.assertIn(self.app.login_url.encode(),listing) + self.assertIn(b'signing in by email does not work',listing) class TenantAdminJourneys(JourneyFixture): def test_wrong_role_or_tenant_never_calls_provider(self): diff --git a/workplans/USER-WP-0035-onboarding-handoff-findings.md b/workplans/USER-WP-0035-onboarding-handoff-findings.md new file mode 100644 index 0000000..eaf37dc --- /dev/null +++ b/workplans/USER-WP-0035-onboarding-handoff-findings.md @@ -0,0 +1,59 @@ +--- +id: USER-WP-0035 +type: workplan +title: "Onboarding handoff findings from the 2026-09-23 operator run" +domain: communication +repo: user-engine +status: active +flavor: implementation +owner: claude-code +topic_slug: user-engine +created: "2026-09-23" +updated: "2026-09-23" +related: [USER-WP-0027, USER-WP-0028, NK-WP-0036, NK-WP-0041] +--- + +Intake for the net-kingdom findings from the human onboarding run on +2026-09-23 (NK-WP-0036-T05, net-kingdom@6c4fcaf; hub message 21b0b7e4). +Provider sign-in, Create login, single-use setup link, password set and +portal sign-in all worked. Three findings touch journeys U04 and T03 in +`docs/account-journeys.md`. This records them against user-engine; the +provider-side items stay with net-kingdom. + +## Name the login and the sign-in address at every handoff point + +```task +id: USER-WP-0035-T01 +status: done +priority: high +``` + +Findings 2 and 3. The derived login name (`bernd.worsch-99` from a +plus-addressed mail) is not obvious to the recipient, users try the email +address first, and the tenant-admin user entry offered no sign-in address to +pass on. Plus-addressed email sign-in additionally fails at Authelia, which +net-kingdom tracks as NK-WP-0041-T02; user-engine must therefore not imply +that the email address works. + +2026-09-23: the tenant-admin user entry now shows the sign-in address next to +the login name and states that the email address is not the login name. The +password-setup handoff page repeats the sign-in address for after the +password is set and says plainly that this portal does not deliver the link. +Regression coverage is in +`test_journey_roles.UserJourneys.test_password_handoff_names_actual_login_and_failure_can_retry`. +No claim about password or factor state is added, and no delivery is claimed. + +## Deliver the setup link to the recipient + +```task +id: USER-WP-0035-T02 +status: wait +priority: high +``` + +Finding 1: the setup link reaches the provider's screen only. A real handoff +depends on the operator passing it on out of band. Closing this needs the +governed transactional mail lane (`email-connect` plus the OpenBao delivery +token) that SCOPE records as operator-owned; U04 and T02 in +`tests/journey-coverage.json` stay `external-blocked` until then. Do not +substitute a portal-rendered link for delivery evidence.