user-engine/workplans/USER-WP-0025-operator-navigation-and-logout.md

id	type	title	domain	repo	status	owner	topic_slug	created	updated	related	state_hub_workstream_id
USER-WP-0025	workplan	Make operator navigation and portal logout usable during demo onboarding	communication	user-engine	active	the-custodian	user-engine	2026-09-11	2026-09-12	RAPPS-WP-0014 USER-WP-0020 KEY-WP-0025	85391398-f5be-551b-b90d-c8e987a00098

During demo-company onboarding the operator signs in as platform-root, sees “No tenant memberships yet”, cannot find the existing tenant, and requests a logout control. Source confirms that personal memberships are distinct from the platform-operator role. Read-only live consumer verification confirms the tenant active with two memberships (one administrator and one ordinary user), neither linked to a directory identity yet. Do not add a customer membership to the platform operator to work around missing navigation.

Expose authorized navigation and a protected portal logout

id: USER-WP-0025-T01
status: done
priority: high
state_hub_task_id: "2f40807f-5442-5bca-8c38-c2d084f8e1ef"

Render shared navigation on authenticated pages, with platform administration only for verified platform operators, tenant user management for tenant admins, and an accessible POST logout form using the current browser session's CSRF value. Keep navigation request-scoped and clear it even after failures. Explain personal memberships to operators and add a Manage users route from the existing platform tenant lookup/lifecycle page. Keep authority checks unchanged.

GET /logout only displays confirmation. POST verifies CSRF for an active session, invalidates that session server-side, expires its cookie, and leads to a logged-out page explaining the remaining shared sign-in session. Expired sessions may clear their stale cookie without affecting another session. This is portal logout; provider-wide sign-out/account switching remains the explicit next task below.

Validation: make test passes (177 tests, three optional integration skips) and layer conformance passes. Eight regressions cover operator access without membership, ordinary-user denial, navigation isolation, logout CSRF, session invalidation, expired-session cleanup, short-name resolution and ambiguous-name refusal. Ten local Chromium checks pass for operator guidance, navigation to tenant users, mobile navigation, visible logout, session cookie removal and denied access after logout. Immutable image promotion and native verification are T02.

Publish and verify the visible change on the native portal

id: USER-WP-0025-T02
status: done
priority: high
needs_human: false
state_hub_task_id: "67e2feca-ffcd-55a0-b0ce-2bab43c862e4"

Check the browser flow on a local synthetic fixture, publish the exact source through existing Forgejo image CI, pin the resulting digest in rapp-user-engine, and promote only the current User Engine Deployment's image. Preserve requests, service identity, database, policies and secrets. Verify health/readiness and native operator navigation/logout when the operator is available. Deployment restarts invalidate the portal's in-memory sessions, so provide the sign-in URL. Actual demo-user Create login and password setup remain RAPPS-WP-0014-T02.

Release deployed on 2026-09-12: source 655dce7165, Forgejo smoke 119 and publication 120 succeeded. Runtime now pins forgejo.coulomb.social/coulomb/user-engine@sha256:38e110b0e30edc56900f8adea2da9c720e271f73543ff73ac905106308ac2f4d with 1/1 Ready at unchanged 50m CPU/64Mi memory requests. The exact UID, resourceVersion and previous image were tested before the image-only patch; server dry-run and rollout succeeded. Public health and readiness return 200, /logged-out serves the new scoped explanation, and unauthenticated tenant administration remains 403. Local Chromium passed eight synthetic UI checks. The operator confirmed native login and logout work on 2026-09-12. Tenant selection then triggered browser format validation. The follow-up adds clickable tenant names from the distinct membership index and accepts a unique short name for lookup, retaining exact identifiers for ambiguity. This index is User Engine membership data, not a complete Tenant Engine inventory. Unknown and ambiguous names return inline guidance without guessing a tenant or changing memberships. Known-tenant selection appears before tenant creation.

Follow-up validation: 177 tests (three optional skips), layer conformance and ten local Chromium checks pass. The browser submits demo-company without a pattern error and reaches its users; direct name selection works too. Publication, promotion completed from source d177d47975. Forgejo smoke 123 and publication 124 passed; the current runtime is forgejo.coulomb.social/coulomb/user-engine@sha256:558e049826c3f7fdda6dd103b8cea9dce1b482ed6ded5bc4b0dfd8fe3392fc7a with 1/1 Ready and unchanged 50m/64Mi requests. The deployed PostgreSQL adapter confirms demo-company is selectable. The operator then reports successful user password setup, and live read-only evidence shows three memberships and one linked identity. Native login/logout and user access are confirmed; the latest short-name behavior is covered by local Chromium plus the deployed index check. The missing provider-to-product welcome handoff is retained as VERGABE-WP-0019-T06, not claimed by this portal release.

Coordinate provider-wide sign-out and account switching

id: USER-WP-0025-T03
status: todo
priority: medium
state_hub_task_id: "f5ee70b9-f169-5316-af3e-5dbbdd394d57"

Coordinate the relying-party, KeyCape and Authelia session boundaries so one explicit user action can end all relevant browser sessions and allow another account to authenticate. KeyCape currently documents local-only logout in KEY-WP-0025 and docs/operations.md. Do not claim global logout or JWT revocation from User Engine's cookie deletion. Use registered return locations and verify same-account login cannot silently reappear after complete sign-out. Preserve session-only logout for users who intend to keep their other applications open.