Repository navigation
Accounts: /account consent and CyberdyneAuth provisioning requests - #105
Merged
Merged
Conversation
…sioning port /account create shows the exact name, email and language in a DM, states that the invitation must be accepted and that the CyberdyneAuth account outlives Delete everything, and sends only those three values through the AccountProvisioner port on Confirm. Requests are limited to 1/24h and 3/30d per person under a lock on the person row; a provider refusal is uncounted. Emails are stored only as HMAC-SHA256(PROVISIONING_EMAIL_KEY, email). /account link and [Link my account] DM a single-use 15-minute link code, stored as sha256, superseding earlier codes, 5 per day. Migration 0035 adds account_consent, account_provisioning_request, account_link_code and person_account_link, all purged by purge_person_derived; ingest deletes requests past 30 days and codes past a day. Off unless ACCOUNT_PROVISIONING_ENABLED, and hidden until a provisioner is wired: only the e2e harness has one (always 202).
…lic URL The name sent on /account confirm is now the first of full name, preferred name and display name that passes the full-name fact rule and is not domain-like, so no link, <, >, control or bidi character is sent or shown in the consent; if none passes, no name is sent. Previously the display name went through unchecked. ADMIN_PUBLIC_URL is validated as the console does (https, a host, no query or fragment), since the link code is appended to it as a bearer secret. The parallel-reservation test now pauses every transaction between counting and inserting, so it fails if the person-row lock is removed.
# Conflicts: # src/chatmemory/composition.py # tests/unit/test_sql_audit.py
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
/account: a person asks for a CyberdyneAuth account in a DM, sees exactly the name and email that will be sent, and confirms. Records consent (email only as an HMAC under PROVISIONING_EMAIL_KEY), counted provisioning requests (1/24h, 3/30d), single-use 15-minute link codes, and the person_account_link table. Ingest ages out old requests and codes.Migration 0035 (revises 0033): the four account tables, each added to purge_person_derived so opt-out and erasure remove them.
Off by default (ACCOUNT_PROVISIONING_ENABLED); needs PROVISIONING_EMAIL_KEY (>= 32 chars), ADMIN_PUBLIC_URL and a provisioner (later PR) to be offered.
Tests: unit + integration + e2e green locally; alembic upgrade / downgrade -1 / upgrade clean; mypy, ruff, openspec strict clean.