user-engine/workplans/USER-WP-0025-operator-navigation-and-logout.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
USER-WP-0025	workplan	Make operator navigation and portal logout usable during demo onboarding	communication	user-engine	active	the-custodian	user-engine	2026-09-11	2026-09-12	RAPPS-WP-0014 USER-WP-0020 KEY-WP-0025	85391398-f5be-551b-b90d-c8e987a00098

During demo-company onboarding the operator signs in as platform-root, sees “No tenant memberships yet”, cannot find the existing tenant, and requests a logout control. Source confirms that personal memberships are distinct from the platform-operator role. Read-only live consumer verification confirms the tenant active with two memberships (one administrator and one ordinary user), neither linked to a directory identity yet. Do not add a customer membership to the platform operator to work around missing navigation.

Expose authorized navigation and a protected portal logout

id: USER-WP-0025-T01
status: done
priority: high
state_hub_task_id: "2f40807f-5442-5bca-8c38-c2d084f8e1ef"

Render shared navigation on authenticated pages, with platform administration only for verified platform operators, tenant user management for tenant admins, and an accessible POST logout form using the current browser session's CSRF value. Keep navigation request-scoped and clear it even after failures. Explain personal memberships to operators and add a Manage users route from the existing platform tenant lookup/lifecycle page. Keep authority checks unchanged.

GET /logout only displays confirmation. POST verifies CSRF for an active session, invalidates that session server-side, expires its cookie, and leads to a logged-out page explaining the remaining shared sign-in session. Expired sessions may clear their stale cookie without affecting another session. This is portal logout; provider-wide sign-out/account switching remains the explicit next task below.

Validation: make test passes (175 tests, three optional integration skips) and layer conformance passes. Six regressions cover operator access without membership, ordinary-user denial, navigation isolation, logout CSRF, session invalidation and expired-session cleanup. Eight local Chromium checks pass for operator guidance, navigation to tenant users, mobile navigation, visible logout, session cookie removal and denied access after logout. Immutable image promotion and native verification are T02.

Publish and verify the visible change on the native portal

id: USER-WP-0025-T02
status: progress
priority: high
state_hub_task_id: "67e2feca-ffcd-55a0-b0ce-2bab43c862e4"

Check the browser flow on a local synthetic fixture, publish the exact source through existing Forgejo image CI, pin the resulting digest in rapp-user-engine, and promote only the current User Engine Deployment's image. Preserve requests, service identity, database, policies and secrets. Verify health/readiness and native operator navigation/logout when the operator is available. Deployment restarts invalidate the portal's in-memory sessions, so provide the sign-in URL. Actual demo-user Create login and password setup remain RAPPS-WP-0014-T02.

Coordinate provider-wide sign-out and account switching

id: USER-WP-0025-T03
status: todo
priority: medium
state_hub_task_id: "f5ee70b9-f169-5316-af3e-5dbbdd394d57"

Coordinate the relying-party, KeyCape and Authelia session boundaries so one explicit user action can end all relevant browser sessions and allow another account to authenticate. KeyCape currently documents local-only logout in KEY-WP-0025 and docs/operations.md. Do not claim global logout or JWT revocation from User Engine's cookie deletion. Use registered return locations and verify same-account login cannot silently reappear after complete sign-out. Preserve session-only logout for users who intend to keep their other applications open.