Repository navigation
Accounts: CyberdyneAuth provisioning adapter - #107
Merged
Merged
Conversation
AccountProvisioner over the approved contract: a client_credentials token
(scope users:provision) from the token endpoint named in the issuer's
discovery, then POST /api/v1/users/provision with {email, name?, locale?}.
202 is accepted without reading the body, 429 raises ProvisioningRateLimited,
422 the new ProvisioningInvalidName (uncounted like the rest, logged as a
warning since it means our name rule drifted from CyberdyneAuth's), anything
else ProvisioningUnavailable. The token is cached until 30s before expiry and
a 401 gets one fresh token and one retry. Only statuses are logged.
The bot builds it over Edges.http_transport only when
ACCOUNT_PROVISIONING_CLIENT_ID and _SECRET are both set, with
ACCOUNT_PROVISIONING_ISSUER (https); a partial client refuses to start. The
secret is registered as a credential and given to the bot service only.
ACCOUNT_PROVISIONING_ENABLED stays off until CyberdyneAuth deploys the
endpoint and issues the client.
Move client_secret_basic/post selection and the discovery auth-method parsing into adapters/oidc_client so the console sign-in and the provisioning adapter cannot drift apart. Test that assemble builds the CyberdyneAuth adapter over the edges' transport when only the client is configured, that a 422 warns the operator without the name or email, and the adapter's guards: non-bearer tokens, discovery without a token endpoint, refused token status, percent-encoded Basic credentials, the timeout, discovery caching and the token's repr. State 422 in the design's contract section.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the provisioner behind
/account create: a client_credentials client (scope users:provision) that fetches and caches a token, retries once on 401, and POSTs {email, name?, locale?} to CyberdyneAuth, reading only the status (202 accepted; 429/422/other = try again later, not counted; 422 logs a name-rule drift warning). Shares OIDC client-auth selection with the console sign-in. Only statuses are logged.No migration. Wired only when ACCOUNT_PROVISIONING_ISSUER / _CLIENT_ID / _CLIENT_SECRET are set on the bot (a partial set refuses to start); with ACCOUNT_PROVISIONING_ENABLED=true, PROVISIONING_EMAIL_KEY and ADMIN_PUBLIC_URL,
/accountis then offered.Tests: unit + integration + e2e green locally; mypy, ruff, openspec strict clean.