127 lines
6.6 KiB
Markdown
127 lines
6.6 KiB
Markdown
---
|
||
id: USER-WP-0025
|
||
type: workplan
|
||
title: "Make operator navigation and portal logout usable during demo onboarding"
|
||
domain: communication
|
||
repo: user-engine
|
||
status: finished
|
||
flavor: implementation
|
||
owner: the-custodian
|
||
topic_slug: user-engine
|
||
created: "2026-09-11"
|
||
updated: "2026-09-25"
|
||
related: [RAPPS-WP-0014, USER-WP-0020, KEY-WP-0025]
|
||
state_hub_workstream_id: "85391398-f5be-551b-b90d-c8e987a00098"
|
||
---
|
||
|
||
During demo-company onboarding the operator signs in as platform-root, sees
|
||
“No tenant memberships yet”, cannot find the existing tenant, and requests a
|
||
logout control. Source confirms that personal memberships are distinct from the
|
||
platform-operator role. Read-only live consumer verification confirms the tenant
|
||
active with two memberships (one administrator and one ordinary user), neither
|
||
linked to a directory identity yet. Do not add a customer membership to the
|
||
platform operator to work around missing navigation.
|
||
|
||
## Expose authorized navigation and a protected portal logout
|
||
|
||
```task
|
||
id: USER-WP-0025-T01
|
||
status: done
|
||
priority: high
|
||
state_hub_task_id: "2f40807f-5442-5bca-8c38-c2d084f8e1ef"
|
||
```
|
||
|
||
Render shared navigation on authenticated pages, with platform administration
|
||
only for verified platform operators, tenant user management for tenant admins,
|
||
and an accessible POST logout form using the current browser session's CSRF
|
||
value. Keep navigation request-scoped and clear it even after failures. Explain
|
||
personal memberships to operators and add a Manage users route from the existing
|
||
platform tenant lookup/lifecycle page. Keep authority checks unchanged.
|
||
|
||
GET /logout only displays confirmation. POST verifies CSRF for an active session,
|
||
invalidates that session server-side, expires its cookie, and leads to a logged-out
|
||
page explaining the remaining shared sign-in session. Expired sessions may clear
|
||
their stale cookie without affecting another session. This is portal logout;
|
||
provider-wide sign-out/account switching remains the explicit next task below.
|
||
|
||
Validation: make test passes (177 tests, three optional integration skips) and
|
||
layer conformance passes. Eight regressions cover operator access without membership,
|
||
ordinary-user denial, navigation isolation, logout CSRF, session invalidation,
|
||
expired-session cleanup, short-name resolution and ambiguous-name refusal. Ten local Chromium checks pass for operator guidance, navigation to tenant
|
||
users, mobile navigation, visible logout, session cookie removal and denied
|
||
access after logout. Immutable image promotion and native verification are T02.
|
||
|
||
## Publish and verify the visible change on the native portal
|
||
|
||
```task
|
||
id: USER-WP-0025-T02
|
||
status: done
|
||
priority: high
|
||
needs_human: false
|
||
state_hub_task_id: "67e2feca-ffcd-55a0-b0ce-2bab43c862e4"
|
||
```
|
||
|
||
Check the browser flow on a local synthetic fixture, publish the exact source
|
||
through existing Forgejo image CI, pin the resulting digest in rapp-user-engine,
|
||
and promote only the current User Engine Deployment's image. Preserve requests,
|
||
service identity, database, policies and secrets. Verify health/readiness and
|
||
native operator navigation/logout when the operator is available. Deployment
|
||
restarts invalidate the portal's in-memory sessions, so provide the sign-in URL.
|
||
Actual demo-user Create login and password setup remain RAPPS-WP-0014-T02.
|
||
|
||
Release deployed on 2026-09-12: source 655dce7165eace6374da8a58e6a20a826f1a1a51,
|
||
Forgejo smoke 119 and publication 120 succeeded. Runtime now pins
|
||
forgejo.coulomb.social/coulomb/user-engine@sha256:38e110b0e30edc56900f8adea2da9c720e271f73543ff73ac905106308ac2f4d
|
||
with 1/1 Ready at unchanged 50m CPU/64Mi memory requests. The exact UID,
|
||
resourceVersion and previous image were tested before the image-only patch;
|
||
server dry-run and rollout succeeded. Public health and readiness return 200,
|
||
/logged-out serves the new scoped explanation, and unauthenticated tenant
|
||
administration remains 403. Local Chromium passed eight synthetic UI checks.
|
||
The operator confirmed native login and logout work on 2026-09-12. Tenant
|
||
selection then triggered browser format validation. The follow-up adds clickable
|
||
tenant names from the distinct membership index and accepts a unique short name
|
||
for lookup, retaining exact identifiers for ambiguity. This index is User
|
||
Engine membership data, not a complete Tenant Engine inventory. Unknown and
|
||
ambiguous names return inline guidance without guessing a tenant or changing
|
||
memberships. Known-tenant selection appears before tenant creation.
|
||
|
||
Follow-up validation: 177 tests (three optional skips), layer conformance and ten
|
||
local Chromium checks pass. The browser submits demo-company without a pattern
|
||
error and reaches its users; direct name selection works too. Publication,
|
||
promotion completed from source d177d479751b7bb2d22c5316de426ad3fd7609a1.
|
||
Forgejo smoke 123 and publication 124 passed; the current runtime is
|
||
forgejo.coulomb.social/coulomb/user-engine@sha256:558e049826c3f7fdda6dd103b8cea9dce1b482ed6ded5bc4b0dfd8fe3392fc7a
|
||
with 1/1 Ready and unchanged 50m/64Mi requests. The deployed PostgreSQL adapter
|
||
confirms demo-company is selectable. The operator then reports successful user
|
||
password setup, and live read-only evidence shows three memberships and one
|
||
linked identity. Native login/logout and user access are confirmed; the latest
|
||
short-name behavior is covered by local Chromium plus the deployed index check.
|
||
The missing provider-to-product welcome handoff is retained as VERGABE-WP-0019-T06,
|
||
not claimed by this portal release.
|
||
|
||
## Coordinate provider-wide sign-out and account switching
|
||
|
||
```task
|
||
id: USER-WP-0025-T03
|
||
status: done
|
||
priority: medium
|
||
state_hub_task_id: "f5ee70b9-f169-5316-af3e-5dbbdd394d57"
|
||
```
|
||
|
||
Coordinate the relying-party, KeyCape and Authelia session boundaries so one
|
||
explicit user action can end all relevant browser sessions and allow another
|
||
account to authenticate. KeyCape currently documents local-only logout in
|
||
KEY-WP-0025 and docs/operations.md. Do not claim global logout or JWT revocation
|
||
from User Engine's cookie deletion. Use registered return locations and verify
|
||
same-account login cannot silently reappear after complete sign-out. Preserve
|
||
session-only logout for users who intend to keep their other applications open.
|
||
|
||
2026-09-12: shared sign-out implemented with USER-WP-0026 and KEY-WP-0034.
|
||
Portal logout hands off to explicit issuer confirmation, then provider-owned
|
||
Authelia logout with a fixed portal return.
|
||
|
||
2026-09-24 23:42–23:45 UTC the founder completed the account switch. The issuer
|
||
recorded one MFA refusal, then three new portal logins, each a fresh
|
||
`auth_start` followed by `auth_success` and `token_issued`. Already issued
|
||
JWTs are not revoked. Receipt:
|
||
`key-cape/docs/evidence/2026-09-24-fresh-login-and-account-switch.md`.
|