Skip to content
Cockpit0.29.0
A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live

I1203

One flow serves every provider, and it refuses everything it did not start

Where it stands

devtask.issue
Readiness
blocked 1 of its dependencies is not DONE
Status
BLOCKED
Can start
not now
Milestone
web-sign-in
Milestone status
PLANNED
Wave
2
Waiting on
I1202
Holds back
I1204
Behind it in all
5
Evidence
0 of 3
In the waySubjectDetail
issueI1202I1202 is not DONE

Moves

plan.transition
A move writes the repository: it stamps one field of this issue's record and appends one event to the ledger, and a commit will carry both.
The same moves from a terminal

majordomus plan start I1203

majordomus plan verify I1203

majordomus plan done I1203

What it is

Objective
Implement the authorisation-code flow with PKCE once, over the typed provider model: a start route that issues state and nonce and redirects to the provider's authorisation endpoint, a callback route that refuses a state it did not issue or that has expired, exchanges the code, verifies the issuer, the audience, the expiry and the nonce of the returned identity token, and resolves the stable subject from the claim the object names.
Why
Two provider-specific flows are two places for a validation to be forgotten. The differences between the providers this milestone starts with are spellings of endpoints, which the objects already carry.
Now
I1202 gives the providers; there is no flow, no route and no verification.
Wanted
Signing in with either declared provider works end to end against the real provider, and every refusal path — unknown state, replayed state, expired state, mismatched nonce, wrong issuer, absent credentials — is exercised by a test.
Done when
unknown: the record declares no `completion`
Risk
An open redirect and an unvalidated state are the two classic defects of this flow. Both are tested as refusals rather than assumed.

Acceptance

  • State and nonce are single-use, expiring, and bound to the provider they were issued for
  • The identity token is verified for issuer, audience, expiry and nonce before any session exists
  • A callback whose state was not issued by this server is refused without a session and without a redirect that leaks the parameters
  • The redirect target after sign-in is validated against the surface's own origin rather than taken from the request
  • Every refusal path has a test, and the tests run without contacting either provider
Validation
cargo test --workspace --all-featuresbash test/run.sh
Evidence required
flow_single_implementationrefusals_testedtoken_verified
Evidence present
unknown: the record carries no `evidence` entries

Scope

Touches
apps/majordomus-cli/src/identityapps/majordomus-cli/src/httpapps/majordomus-cli/teststest/cases
Not
Storing anything about the reader beyond the session of I1204A provider-specific branch anywhere in the flow
Depends on
I1202
Priority
p0
Profile
implementation
Parallel safe
false
Owner
unknown: the record declares no `owner`

The work so far

Branches
none
Merged
none
Commits
0
Trunk
master
Sessions
none
Created
2026-09-08
Updated
2026-09-08
Started
unknown: the record declares no `started_at`
Verified
unknown: the record declares no `verified_at`
Completed
unknown: the record declares no `completed_at`

Synchronisation

Adapter
scripts/github-sync
Repository
unknown: the derived plan's header carries no repository
External issue
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
State there
unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it

Findings

Nothing is wrong with these records.