6.4 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | depends_on | state_hub_workstream_id | |||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| USER-WP-0020 | workplan | Production self-service and user administration portal | communication | user-engine | active | codex | netkingdom | 2026-07-27 | 2026-07-28 |
|
35b9c315-e721-4e0b-9710-bad04f8d2519 |
USER-WP-0020 - Production self-service and user administration portal
Turn the transport-neutral UI contracts from USER-WP-0014 into a real,
secure browser application and HTTP API backed by user-engine. The first
production acceptance case is onboarding
bernd.worsch@binky-hedgehog.com as tenant administrator for
tenant:friendly:binky.
user-engine remains authoritative for user-domain records, profiles, memberships, invitations, registration sessions, and onboarding state. KeyCape/NetKingdom remains authoritative for login, credentials, MFA, authentication sessions, and OIDC tokens. flex-auth remains authoritative for authorization decisions.
T01 - Ratify the portal boundary and threat model
id: USER-WP-0020-T01
status: done
priority: high
state_hub_task_id: "9886ac8d-7456-4de0-b019-351dfd74ec20"
Define browser/API trust boundaries, public and authenticated routes, role
projections, CSRF/session/XSS controls, rate limits, account-enumeration
resistance, invitation abuse controls, audit correlation, privacy retention,
and recovery behavior. Define an explicit IdentityProvisioningPort; the
domain must not import LLDAP, privacyIDEA, KeyCape, email, or flex-auth clients.
Keep enterprise federation, SCIM, corporate directory synchronization, and SAML administration out of scope while preserving provider-neutral identity links, membership envelopes, provisioning adapters, and external ownership metadata for that later stage.
T02 - Implement a production HTTP API
id: USER-WP-0020-T02
status: progress
priority: high
state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411"
Expose versioned APIs for registration start/resume/complete, invitation claim, current-user profile, tenant membership, onboarding, tenant-admin user management, and platform-admin tenant/user management. Consume verified KeyCape claims and require flex-auth decisions for protected writes. Add idempotency keys, optimistic concurrency, pagination, structured errors, OpenAPI, health/readiness, redacted audit, and transactional outbox behavior.
2026-07-28 implementation evidence: the deployed versioned API can create a tenant-scoped user and membership, establishes the lifecycle account in the requested tenant even for authorized cross-tenant platform operations, and invokes a provider-neutral provisioning port with roles, correlation, and a required idempotency key. Remaining API breadth and OpenAPI/outbox work keep this task in progress.
T03 - Implement self-service login and registration UX
id: USER-WP-0020-T03
status: progress
priority: high
state_hub_task_id: "45ed1485-003d-4e5f-99fb-91b1b430f3fa"
Build an accessible responsive browser flow for sign in, registration, invitation acceptance, email verification status, password-setup handoff, MFA-enrollment handoff, consent, profile completion, tenant selection, and resumable onboarding. Authentication and factor screens must redirect or handoff to NetKingdom-owned surfaces; the portal must never handle provider admin credentials or store password/MFA secrets.
T04 - Implement tenant-admin and platform-admin UX
id: USER-WP-0020-T04
status: progress
priority: high
state_hub_task_id: "16555b68-17ef-4902-bd30-f9a0cfe10f9e"
Tenant admins can invite, list, inspect, suspend, reactivate, and remove only users and memberships in tenants they administer, assign approved tenant roles, resend/expire invitations, and inspect redacted lifecycle/audit state. Platform admins can create/manage tenants, bootstrap the first tenant admin, inspect cross-tenant lifecycle gaps, and perform explicitly authorized recovery actions. Prove ordinary users and tenant admins cannot reach platform or other-tenant data.
T05 - Add production persistence and operability
id: USER-WP-0020-T05
status: progress
priority: high
state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04"
Package the service and web assets, use the provider-backed Postgres adapter, run migrations safely, expose metrics and structured logs, deliver secrets through approved runtime references, implement backups/restore evidence, and document rollback and zero-downtime upgrade expectations. Browser state must never become authoritative.
T06 - Security, accessibility, and workflow conformance
id: USER-WP-0020-T06
status: progress
priority: high
state_hub_task_id: "39dc383c-7213-495d-8e12-58e614706afe"
Automate positive and negative flows for self-registration, invite-only registration where configured, duplicate identities, expired/replayed invitations, cross-tenant access, role escalation, CSRF, session expiry, provider outage, partial provisioning compensation, audit redaction, WCAG keyboard/screen-reader behavior, and mobile/desktop layouts.
2026-07-28 evidence: all 101 unit tests pass (three integration skips), mounted secret normalization has regression coverage, and a disposable live identity proved first create, replay/resume, tenant group projection, and cleanup through the restricted deployment path. The complete browser, authorization, failure, accessibility, and restore matrix remains.
T07 - Binky production acceptance
id: USER-WP-0020-T07
status: wait
priority: high
state_hub_task_id: "b8d1c048-24d2-416c-908f-e500d63c6865"
Through the deployed portal—not a one-shot script—create or claim Binky,
onboard bernd.worsch@binky-hedgehog.com, complete KeyCape login and MFA,
assign only the Binky tenant-admin membership, and prove denial for
tenant:platform, tenant:coulomb, and unrelated tenants. Confirm the same
admin can invite and lifecycle-manage a disposable Binky test user.
T08 - Closure and next-stage handoff
id: USER-WP-0020-T08
status: wait
priority: medium
state_hub_task_id: "ecbdeef3-a0a9-40d6-9722-5cc650d78a49"
Close after the portal is production-operable and the Binky acceptance case passes. Record enterprise federation follow-up triggers: customer demand for SAML/OIDC federation, SCIM, directory synchronization, just-in-time provisioning, or customer-owned identity lifecycle. Do not pre-implement those integrations here.