17 commits

Author	SHA1	Message	Date
tegwick	560cdeed46	Show an existing NetKingdom sign-in before the account site continues it. ... The account site said "Not signed in" while Authelia still had a session, and Sign in reused that identity. Ask Authelia who the session cookie is, show that name, and send a fresh sign-in only when a different identity is requested. Assistant: grok Assistant-Session: 01a0d25d-d358-7e13-b84a-d007fbb7e34f	2026-09-27 00:21:34 +02:00
tegwick	3bd1827a7f	Implement scoped P06 authentication policy and guarded optional onboarding ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6	2026-09-14 00:00:07 +02:00
tegwick	ac0eb14b75	Implement P05 checked services and safe selected delivery recovery ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 22:11:49 +02:00
tegwick	58e07dd4df	Connect P04 audited recovery to fresh-MFA platform browser flow ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 21:05:33 +02:00
tegwick	a9ff77d21d	Clarify account session controls and add authenticator recovery guidance ... Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a092fe-13b1-7f12-ac74-7d258af4d79c	2026-09-13 10:09:01 +02:00
tegwick	4622b64061	Authenticate flex-auth calls with a rotating caller token ... Closes the caller side of FLEX-WP-0015. FlexAuthHTTPAdapter reads the audience-scoped projected ServiceAccount token from a file on every decision, so hourly rotation needs no restart, and runtime configuration now requires USER_ENGINE_FLEX_AUTH_TOKEN_FILE. A missing, empty, or unreadable token file fails closed as a denial without reaching flex-auth: OSError joins the caught set and an empty read raises. Coverage proves all three unusable-token cases deny before any request is made, and that neither the deny reason nor the decision repr carries the token value. Tenant-authority reads now identify user-engine as actor `user-engine` under the protected tenant.read action, keeping tenant ids opaque and URL-encoded. Contract: docs/flex-auth-caller-identity.md. Full suite: 148 tests, 3 provider-gated skips. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	2026-08-18 10:53:31 +02:00
tegwick	a0f39f58bd	Separate event and mail delivery credentials	2026-08-13 14:56:24 +02:00
tegwick	b80de5a1f4	Rate limit public registration writes	2026-08-10 17:52:53 +02:00
tegwick	c36a09bded	Implement verified public registration flow	2026-08-10 11:26:18 +02:00
tegwick	292e7e0e3e	Add production authorization and delivery adapters	2026-08-09 01:53:30 +02:00
tegwick	8229c6dd33	Expand portal onboarding and administration	2026-08-08 23:09:23 +02:00
tegwick	0ef2ae515e	Normalize runtime secret transport whitespace	2026-07-28 15:22:43 +02:00
tegwick	e7e8709ca8	Add reusable identity provisioning adapter	2026-07-28 00:57:04 +02:00
tegwick	268b3156f9	Support internal KeyCape OIDC endpoints	2026-07-28 00:23:30 +02:00
tegwick	67ad2af640	Add KeyCape PKCE browser sessions	2026-07-28 00:06:21 +02:00
tegwick	2869c1030d	Avoid Kubernetes service environment collision	2026-07-27 23:02:34 +02:00
tegwick	0980d1fd41	Implement user-engine portal foundation	2026-07-27 22:47:39 +02:00