ident

4.9 KB

1. # Mission 003 (old 006) — ident 2/6: apps and login button (ticket #25)
3. One-shot worker. The architect (Claude Code on Byrodin) verifies your report, then the creator tests.
5. ## Read first — in this order
6. 1. **`loreana:/media/STORAGE/projects/ident.worldapi.org/CONCEPT.md`** — the creator's concept. Source
7. of truth. Do not add features it does not describe; where it is silent, make the smallest choice
8. and list it under "Questions for the creator".
9. 2. The app's `README.md` and `STATUS.md` (piece 1, mission 002 (old 005), confirmed by the creator).
10. Note `.scratch/removed-mission003/`: the old redirect + one-time-code exchange from mission 001 (old 003) —
11. reuse its mechanics where they fit the concept, not its data model.
12. 3. `/CONTAINERS/projects/antcolony/README.md` (section "Lessons learned").
13. 4. Ticket: `GET http://100.77.141.84:8350/api/tickets/25`.
15. ## Hybriel (standard block)
16. Read `/CONTAINERS/projects/antcolony/docs/hybriel-for-app-workers.md` first — it lists which docs to
17. trust, the known pitfalls with workarounds (note #31: forged face sessions), and the open hybriel
18. tickets. Report new Hybriel findings under "Hybriel issues"; do not edit that guide.
20. ## Where
21. - Host Loreana (`ssh loreana`, fish login shell → `bash -c '…'` or script files).
22. - App: `/media/STORAGE/projects/ident.worldapi.org`, dev port **8351**. Hybriel repo READ ONLY.
24. ## Scope (piece 2 of 6 only)
25. 1. **Apps**: any signed-in ident user can register apps in ident (name + the origin(s) it runs on,
26. used to validate return URLs). Each app gets a **public API key** and a **secret** (shown once or
27. re-viewable — your choice, list it). The user sees and manages their apps (list, edit, regenerate
28. secret, delete).
29. 2. **One identity id per app**: when an identity logs in to an app for the first time, ident creates
30. the connection with a new, app-specific identity id (not derivable from other apps' ids) and
31. stores when it was created ("when they registered in it" — needed later for the per-app page).
32. 3. **Login button flow**: app sends the browser to ident with its API key and a return URL (return
33. origin must be one of the app's registered origins, else an error page and no redirect). Not
34. signed in → ident login first. Signed in → the user chooses one of their identities (with only one
35. identity: still show which one is used, one click). Then ident redirects back with a one-time code
36. (short-lived, single use).
37. 4. **Exchange**: the app's server posts the code with its API key + secret and gets back **only the
38. app-specific identity id** — no email, no names (concept: apps ask for extra data themselves).
39. Wrong secret, other app's code, reused/expired code → 400/401.
40. 5. A **minimal test app** (separate tiny hybriel app in `testapp/`, own port) that registers as an app
41. and proves the whole flow, incl. that a second app gets a different id for the same identity.
43. **Out of scope**: selector (#26), notifications (#27+), client-only apps.
45. ## Mail — IMPORTANT
46. The dev server on :8351 now sends **real mail** (SMTP via mail.byrod.in, set by the creator).
47. - **Never trigger an OTP on the :8351 dev server.** Do not run `tests/dev-smoke.mjs` against it.
48. - Your gate starts its own servers with `IDENT_MAIL_SINK` set (as the current gate does).
49. - **Do not read, print, copy or edit `.env`** (it holds the SMTP password). If you need other settings,
50. pass them as environment variables to your own test servers.
51. - At the end restart the dev server (kill only the PID in `server.pid`, `setsid nohup ./bin/hybriel
52. project.hl >> server.log`, update `server.pid`) and check it answers 200 on `/` — without logging in.
53. Leave your test app running on its port so the creator can try the flow; report its URL/PID.
55. ## Data
56. The dev store holds the creator's real account now. Back up `storage/` to `.scratch/storage-backup-<ts>/`
57. before the restart; migrate, never wipe. After the restart verify (read-only, e.g. with a small hybriel
58. script against the store copy) that the account and its identities are still there.
60. ## Rules
61. - No git. Don't touch other project folders. Only kill your own PIDs or the ones in ident's pid files.
62. Clean up headless Chromes (`--disable-gpu`). Scratch in `.scratch/`.
63. - Do NOT POST to the live tickets server (:8350).
64. - A test is the whole process: real headless browser drives register app → login button → ident
65. login → choose identity → back → exchange → test app shows the id; plus negatives (foreign origin,
66. wrong secret, reused/expired code, other app's code, face-session forging per #31).
67. - Strict API: unknown/missing fields → 400 naming the field; invalid JSON → 400.
68. - Screenshots at 390px and 1280px, look at them. Update `README.md` ("How apps use ident") and
69. `STATUS.md`. Do NOT edit `CONCEPT.md`.
71. ## Report (final answer, this structure)
72. ```
73. ## Done
74. ## Verified (each: command run + observed output)
75. ## Not verified / open
76. ## Hybriel issues (repro, observed, expected)
77. ## Questions for the creator
78. ## Running (URL, PID, log path)
79. ```