tegwick
e9534ef00f
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 1041694@bnt-lap001 Assistant-Session: 7af0bb68-ac4a-4ce3-8639-24ddd84c0b52
2.1 KiB
| id | type | title | domain | repo | status | owner | topic_slug | created | updated | related | state_hub_workstream_id | ||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| USER-WP-0039 | workplan | Sign-in diagnosis: account-site and Authelia uid on the account page | communication | user-engine | active | claude | communication | 2026-10-14 | 2026-10-14 |
|
04ba7f02-4138-54a3-b8c3-c1dd9c34262a |
Sign-in diagnosis: two session uids
Owner side of NetKingdom NK-WP-0051-T03. Contract:
net-kingdom/docs/sign-in-diagnosis.md (only source of field names and the
never-show list).
Problem: users.coulomb.social stayed signed in as bernd.worsch-3 while
bao login reused a different Authelia session, and nothing showed the
mismatch.
Approach: reuse the existing server-side Authelia /api/state lookup
(identity_state.AutheliaIdentityState, already configured in
rapp-user-engine via USER_ENGINE_IDENTITY_STATE_URL /
USER_ENGINE_IDENTITY_STATE_HOST). The account site already receives the
authelia_session cookie because Authelia's cookie domain is
coulomb.social; no ingress, forward-auth, or cookie-domain change is
needed. The account-site session is unchanged.
Show both session uids and mark a mismatch
id: USER-WP-0039-T01
status: done
priority: high
state_hub_task_id: "88b50f40-52bd-5203-9916-4bd771ccb578"
The Identity section on / and /onboarding shows two labelled lines:
account-site session uid and Authelia session uid. When they differ a
role="alert" marker names both and links the shared-sign-in logout. When
the Authelia uid is unavailable it reads "not signed in / unknown". Only
the two uids are rendered; no email, token, cookie, or OTP. Tests in
tests/test_account_identity_disclosure.py.
Deploy and record evidence for NK-WP-0051
id: USER-WP-0039-T02
status: todo
priority: high
state_hub_task_id: "9ffe39bd-744b-513a-8539-c4e5daa0341a"
Build and roll the image through rapp-user-engine (no manifest change
needed), check the two lines on users.coulomb.social with a mismatched
session, and report the image digest to net-kingdom for the contract's
evidence table (user-engine change).