ident

3.9 KB

1. # Mission 001 (old 003) — ident.worldapi.org MVP in Hybriel (ticket #2)
3. One-shot worker. Architect (Claude Code on Byrodin) verifies your report.
4. Read first: `/CONTAINERS/projects/antcolony/README.md`, `STATUS.md`, `loreana:/media/STORAGE/projects/tickets.worldapi.org/missions/001-tickets-mvp.md`
5. and its result: the tickets app `loreana:/media/STORAGE/projects/tickets.worldapi.org`
6. (README, STATUS, project.hl, store.hl, tests/) — same stack, same conventions, copy its setup.
8. ## Where
9. - Host Loreana (`ssh loreana`, fish login shell → `bash -c '…'` or script files).
10. - New app folder: `/media/STORAGE/projects/ident.worldapi.org`. Vendor `bin/hybriel` + plugins
11. exactly like the tickets app does (same binary, sha256 c51d163d…).
12. - Hybriel repo `/media/STORAGE/projects/hybriel` READ ONLY. Reference for login:
13. `projects/demo-social-network` (mail.hl, login_form.hl, signup_form.hl, store.hl, tests/).
14. - Dev port **8351**, bind 0.0.0.0. Gate ports: pick your own range, not 8352 and not the social
15. gate's 8600-8619 (another worker runs the tickets gate at the same time).
17. ## What ident is
18. Login for all worldapi apps (tickets, gitoria, …). Email one-time codes only, no passwords.
19. Accent orange `--color-accent: #ce9178` (tokens: `/CONTAINERS/projects/layouts.worldapi.org/css/foundation/tokens.css`
20. on Byrodin, read only; markup rules in `docs/conventions.md` there).
22. ## Scope
23. 1. Users: email (unique, lowercased), display name, created. Sign up = first login with a new email
24. (ask for a name once). Codes: 6 digits, expire after 10 min, single use, max 5 attempts, rate
25. limit sends per email.
26. 2. Pages: `/` (signed out: login form; signed in: "signed in as …", sign out), code entry,
27. name prompt for new users.
28. 3. **Login for other apps — architect decision, redirect + code exchange (OAuth-code style,
29. works across domains and dev ports):**
30. - App sends browser to `ident/login?return=<url>&app=<name>`.
31. - After successful OTP, ident redirects to `<return>?ident_code=<one-time code>` (code valid 60 s,
32. single use). Only return URLs whose origin is on an allow list (config, for now: the tickets dev
33. origins `http://100.77.141.84:8350`, `http://192.168.178.75:8350`, `http://127.0.0.1:8350`, plus
34. whatever your test client uses). Unknown origin → error page, no redirect.
35. - App's server calls `POST ident/api/exchange {code}` → `{ user: { id, email, name } }` or 400.
36. - ident keeps its own session cookie so a second app login does not need a new OTP.
37. - Write this down as a short spec in the app README ("How apps use ident").
38. 4. Mail: do NOT send real mail in this mission. Use a file sink like the social app
39. (`HL_SOCIAL_MAIL_SINK` pattern) configured via `.env`; tests read the code from the sink.
40. Leave the hl:smtp path wired and configurable (SMTP_* env) for mail.byrod.in later.
41. 5. A minimal test client (a tiny second hybriel app or a route in the gate) that proves the whole
42. redirect → OTP → return → exchange flow end to end.
44. Out of scope: wiring tickets to ident (next mission), deploy, Docker.
46. ## Rules
47. - No git. Don't touch other project folders (read the tickets app only). Only kill your own PIDs.
48. Clean up every headless Chrome (`--disable-gpu`, GPU is wedged). Scratch in `.scratch/`.
49. - A test is the whole process: real headless browser drives login, observe the result;
50. plus API negative cases (expired/reused code, wrong code 5x, bad return origin, reused exchange code).
51. - Strict API from day one: unknown/missing fields → 400 naming the field.
52. - Hybriel bugs: don't fix in the repo; report with repro.
53. - Leave the dev server RUNNING on 8351 (setsid/nohup, `server.pid`, `server.log`).
54. - Deliver `README.md`, `STATUS.md`, `tests/browser.mjs`.
56. ## Report (final answer, this structure)
57. ```
58. ## Done
59. ## Verified (each: command run + observed output)
60. ## Not verified / open
61. ## Hybriel issues (repro, observed, expected)
62. ## Questions for the creator
63. ## Running (URL, PID, log path)
64. ```