coulomb/user-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Headless multi-application, multi-tenant user mangement engine.
139 commits 1 branch 0 tags 1.7 MiB
Find a file
tegwick 4622b64061 Authenticate flex-auth calls with a rotating caller token 
Closes the caller side of FLEX-WP-0015. FlexAuthHTTPAdapter reads the
audience-scoped projected ServiceAccount token from a file on every decision,
so hourly rotation needs no restart, and runtime configuration now requires
USER_ENGINE_FLEX_AUTH_TOKEN_FILE.

A missing, empty, or unreadable token file fails closed as a denial without
reaching flex-auth: OSError joins the caught set and an empty read raises.
Coverage proves all three unusable-token cases deny before any request is
made, and that neither the deny reason nor the decision repr carries the
token value.

Tenant-authority reads now identify user-engine as actor `user-engine` under
the protected tenant.read action, keeping tenant ids opaque and URL-encoded.

Contract: docs/flex-auth-caller-identity.md. Full suite: 148 tests, 3
provider-gated skips.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-18 10:53:31 +02:00
.claude/rules docs: workplan-first agent guidance prose (CUST-WP-0055 T04 batch 4) 2026-07-08 17:22:16 +02:00
.forgejo/workflows Add Forgejo CI smoke workflow (enablement template) 2026-07-08 12:38:49 +02:00
docs Authenticate flex-auth calls with a rotating caller token 2026-08-18 10:53:31 +02:00
migrations/postgres feat: add durable store conformance harness 2026-06-16 00:20:29 +02:00
openapi Delegate tenant lifecycle to the tenant authority 2026-08-16 01:28:02 +02:00
registry Draft capability entry (reuse-surface REUSE-WP-0017-T04, cohort 3) 2026-07-06 19:50:54 +02:00
src/user_engine Authenticate flex-auth calls with a rotating caller token 2026-08-18 10:53:31 +02:00
tests Authenticate flex-auth calls with a rotating caller token 2026-08-18 10:53:31 +02:00
wiki Established architecture blueprint 2026-05-22 19:05:13 +02:00
workplans Authenticate flex-auth calls with a rotating caller token 2026-08-18 10:53:31 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-18 07:29:36 +02:00
.gitignore Initial commit 2026-05-22 15:54:46 +00:00
.repo-classification.yaml Add .repo-classification.yaml (CUST-WP-0050 T11 agent first-pass) 2026-06-22 17:47:43 +02:00
AGENTS.md Regenerate agent instructions from state-hub templates (CUST-WP-0055 T01) 2026-07-08 14:50:38 +02:00
CLAUDE.md Normalize agent instructions and workplan frontmatter (STATE-WP-0067) 2026-06-22 23:16:28 +02:00
Containerfile Add KeyCape PKCE browser sessions 2026-07-28 00:06:21 +02:00
INTENT.md Align user-engine intent with identity canon 2026-06-05 15:36:47 +02:00
LICENSE Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 2026-07-30 01:12:41 +02:00
Makefile Add integrated user-engine scenarios 2026-05-22 21:39:10 +02:00
pyproject.toml Add KeyCape PKCE browser sessions 2026-07-28 00:06:21 +02:00
README.md test: add registration security conformance 2026-06-15 23:59:45 +02:00
SCOPE.md test: add registration security conformance 2026-06-15 23:59:45 +02:00
WORK-RECORDS.md Refresh work record index 2026-08-16 02:05:29 +02:00

README.md

Headless multi-application, multi-tenant user management engine.

Development

make test

See docs/development.md, docs/configuration.md, docs/contracts.md, docs/canon-mapping.md, docs/canon-interface-card.yaml, docs/evidence-gap-examples.md, docs/family-dataspace-onboarding.md, docs/netkingdom-registration-onboarding-vision.md, docs/postgres-durable-store-consumer-requirements.md, docs/examples.md, docs/registration-identity-and-factor-model.md, docs/prepared-accounts-and-entitlement-claims.md, docs/hats-realms-services-assets-access-profiles.md, docs/onboarding-journeys-and-welcome-protocols.md, docs/registration-and-access-management-ui.md, docs/scenarios.md, docs/registration-scenario-and-security-conformance.md, docs/operability.md, docs/release.md, docs/ui-contracts.md, docs/identity-domain-naming-decision.md, and docs/final-assessment.md for implementation boundaries, contracts, canon mappings, examples, and release readiness.