173 lines
6.4 KiB
Markdown
173 lines
6.4 KiB
Markdown
---
|
|
id: USER-WP-0020
|
|
type: workplan
|
|
title: "Production self-service and user administration portal"
|
|
domain: communication
|
|
repo: user-engine
|
|
status: active
|
|
owner: codex
|
|
topic_slug: netkingdom
|
|
created: "2026-07-27"
|
|
updated: "2026-07-28"
|
|
depends_on:
|
|
- USER-WP-0014
|
|
- USER-WP-0015
|
|
- USER-WP-0019
|
|
state_hub_workstream_id: "35b9c315-e721-4e0b-9710-bad04f8d2519"
|
|
---
|
|
|
|
# USER-WP-0020 - Production self-service and user administration portal
|
|
|
|
Turn the transport-neutral UI contracts from `USER-WP-0014` into a real,
|
|
secure browser application and HTTP API backed by user-engine. The first
|
|
production acceptance case is onboarding
|
|
`bernd.worsch@binky-hedgehog.com` as tenant administrator for
|
|
`tenant:friendly:binky`.
|
|
|
|
user-engine remains authoritative for user-domain records, profiles,
|
|
memberships, invitations, registration sessions, and onboarding state.
|
|
KeyCape/NetKingdom remains authoritative for login, credentials, MFA,
|
|
authentication sessions, and OIDC tokens. flex-auth remains authoritative for
|
|
authorization decisions.
|
|
|
|
## T01 - Ratify the portal boundary and threat model
|
|
|
|
```task
|
|
id: USER-WP-0020-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "9886ac8d-7456-4de0-b019-351dfd74ec20"
|
|
```
|
|
|
|
Define browser/API trust boundaries, public and authenticated routes, role
|
|
projections, CSRF/session/XSS controls, rate limits, account-enumeration
|
|
resistance, invitation abuse controls, audit correlation, privacy retention,
|
|
and recovery behavior. Define an explicit `IdentityProvisioningPort`; the
|
|
domain must not import LLDAP, privacyIDEA, KeyCape, email, or flex-auth clients.
|
|
|
|
Keep enterprise federation, SCIM, corporate directory synchronization, and
|
|
SAML administration out of scope while preserving provider-neutral identity
|
|
links, membership envelopes, provisioning adapters, and external ownership
|
|
metadata for that later stage.
|
|
|
|
## T02 - Implement a production HTTP API
|
|
|
|
```task
|
|
id: USER-WP-0020-T02
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "fdb0c322-3efe-4077-bfba-1648787ef411"
|
|
```
|
|
|
|
Expose versioned APIs for registration start/resume/complete, invitation
|
|
claim, current-user profile, tenant membership, onboarding, tenant-admin user
|
|
management, and platform-admin tenant/user management. Consume verified
|
|
KeyCape claims and require flex-auth decisions for protected writes. Add
|
|
idempotency keys, optimistic concurrency, pagination, structured errors,
|
|
OpenAPI, health/readiness, redacted audit, and transactional outbox behavior.
|
|
|
|
2026-07-28 implementation evidence: the deployed versioned API can create a
|
|
tenant-scoped user and membership, establishes the lifecycle account in the
|
|
requested tenant even for authorized cross-tenant platform operations, and
|
|
invokes a provider-neutral provisioning port with roles, correlation, and a
|
|
required idempotency key. Remaining API breadth and OpenAPI/outbox work keep
|
|
this task in progress.
|
|
|
|
## T03 - Implement self-service login and registration UX
|
|
|
|
```task
|
|
id: USER-WP-0020-T03
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "45ed1485-003d-4e5f-99fb-91b1b430f3fa"
|
|
```
|
|
|
|
Build an accessible responsive browser flow for sign in, registration,
|
|
invitation acceptance, email verification status, password-setup handoff,
|
|
MFA-enrollment handoff, consent, profile completion, tenant selection, and
|
|
resumable onboarding. Authentication and factor screens must redirect or
|
|
handoff to NetKingdom-owned surfaces; the portal must never handle provider
|
|
admin credentials or store password/MFA secrets.
|
|
|
|
## T04 - Implement tenant-admin and platform-admin UX
|
|
|
|
```task
|
|
id: USER-WP-0020-T04
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "16555b68-17ef-4902-bd30-f9a0cfe10f9e"
|
|
```
|
|
|
|
Tenant admins can invite, list, inspect, suspend, reactivate, and remove only
|
|
users and memberships in tenants they administer, assign approved tenant
|
|
roles, resend/expire invitations, and inspect redacted lifecycle/audit state.
|
|
Platform admins can create/manage tenants, bootstrap the first tenant admin,
|
|
inspect cross-tenant lifecycle gaps, and perform explicitly authorized
|
|
recovery actions. Prove ordinary users and tenant admins cannot reach
|
|
platform or other-tenant data.
|
|
|
|
## T05 - Add production persistence and operability
|
|
|
|
```task
|
|
id: USER-WP-0020-T05
|
|
status: progress
|
|
priority: high
|
|
state_hub_task_id: "65ff5c96-134a-4ec2-ad92-511f0e5f6f04"
|
|
```
|
|
|
|
Package the service and web assets, use the provider-backed Postgres adapter,
|
|
run migrations safely, expose metrics and structured logs, deliver secrets
|
|
through approved runtime references, implement backups/restore evidence, and
|
|
document rollback and zero-downtime upgrade expectations. Browser state must
|
|
never become authoritative.
|
|
|
|
## T06 - Security, accessibility, and workflow conformance
|
|
|
|
```task
|
|
id: USER-WP-0020-T06
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "39dc383c-7213-495d-8e12-58e614706afe"
|
|
```
|
|
|
|
Automate positive and negative flows for self-registration, invite-only
|
|
registration where configured, duplicate identities, expired/replayed
|
|
invitations, cross-tenant access, role escalation, CSRF, session expiry,
|
|
provider outage, partial provisioning compensation, audit redaction, WCAG
|
|
keyboard/screen-reader behavior, and mobile/desktop layouts.
|
|
|
|
2026-07-28 evidence: all 101 unit tests pass (three integration skips), mounted
|
|
secret normalization has regression coverage, and a disposable live identity
|
|
proved first create, replay/resume, tenant group projection, and cleanup through
|
|
the restricted deployment path. The complete browser, authorization, failure,
|
|
accessibility, and restore matrix remains.
|
|
|
|
## T07 - Binky production acceptance
|
|
|
|
```task
|
|
id: USER-WP-0020-T07
|
|
status: wait
|
|
priority: high
|
|
state_hub_task_id: "b8d1c048-24d2-416c-908f-e500d63c6865"
|
|
```
|
|
|
|
Through the deployed portal—not a one-shot script—create or claim Binky,
|
|
onboard `bernd.worsch@binky-hedgehog.com`, complete KeyCape login and MFA,
|
|
assign only the Binky tenant-admin membership, and prove denial for
|
|
`tenant:platform`, `tenant:coulomb`, and unrelated tenants. Confirm the same
|
|
admin can invite and lifecycle-manage a disposable Binky test user.
|
|
|
|
## T08 - Closure and next-stage handoff
|
|
|
|
```task
|
|
id: USER-WP-0020-T08
|
|
status: wait
|
|
priority: medium
|
|
state_hub_task_id: "ecbdeef3-a0a9-40d6-9722-5cc650d78a49"
|
|
```
|
|
|
|
Close after the portal is production-operable and the Binky acceptance case
|
|
passes. Record enterprise federation follow-up triggers: customer demand for
|
|
SAML/OIDC federation, SCIM, directory synchronization, just-in-time
|
|
provisioning, or customer-owned identity lifecycle. Do not pre-implement
|
|
those integrations here.
|