tickets

5.4 KB

1. # Mission 005 (old 011) — tickets: login via ident (ticket tickets.worldapi.org#7)
3. One-shot worker. The architect (Claude Code on Byrodin) verifies your report and deploys; you do NOT
4. deploy and do NOT touch Byrodin.
6. ## Read first — in this order
7. 1. **`loreana:/media/STORAGE/projects/tickets.worldapi.org/CONCEPT.md`** — the creator's concept, section
8. "Login via ident" is this mission. Source of truth; don't add what it doesn't describe; where it is
9. silent, make the smallest choice and list it under "Questions for the creator".
10. 2. **`loreana:/media/STORAGE/projects/ident.worldapi.org/CONCEPT.md` and `README.md`** — how apps use
11. ident: `<ident-selector key=…>` from `/selector.js`, the `ident-login` event with a one-time code, the
12. login button (`/login?key=&return=` → `?ident_code=`), `POST /api/exchange {key, secret, code}` →
13. `{identity}` (a per-app id; no names, no email).
14. 3. tickets' own `README.md` / `STATUS.md`. Ticket: `GET https://tickets.worldapi.org/api/projects/tickets.worldapi.org/tickets/7`
15. (send a `user-agent` header — Cloudflare blocks default script agents).
16. 4. `/CONTAINERS/projects/antcolony/README.md` — conventions (UUID `@id` keys, `storage/mpackdb/`, JSON writes
17. + Markdown text fields), lessons.
19. ## Hybriel (standard block)
20. Read `/CONTAINERS/projects/antcolony/docs/hybriel-for-app-workers.md` first — which docs to trust, known
21. pitfalls (#31 forged face sessions, #36 global face names, #24 HL_HOST, #25 no request context in faces,
22. #40 open only COPIES of stores), conventions, deploy notes. Report new Hybriel findings under
23. "Hybriel issues"; do not edit that guide.
25. ## Where
26. - Develop in `loreana:/media/STORAGE/projects/tickets.worldapi.org` (DEVELOPMENT only — live is on Byrodin;
27. its local `storage/` is a stale copy you may use for tests). Work in `.scratch/dev` and copy back when
28. green (as missions 004 (old 008)/ident 006 (old 010) did). The Loreana dev servers are stopped; start your own test servers.
29. - For tests run your OWN ident instance from `/media/STORAGE/projects/ident.worldapi.org` code (read only:
30. start it with its own storage dir, `IDENT_MAIL_SINK`, own port, e.g. as ident's `tests/selector.mjs`
31. does) and register a test app in it. Never use the live ident, never send real mail.
33. ## Scope
34. 1. **ident login in tickets**: the identity selector top right (host tells it `logged-in`), plus the login
35. button flow. tickets' server exchanges the code with `IDENT_API_KEY` / `IDENT_API_SECRET` from its
36. environment (the live `.env` on Byrodin already has them — **you never read or write any `.env`**; in
37. tests pass your own values as env vars). Logout on tickets resets the selector.
38. 2. **Users**: a tickets user per ident per-app identity id. First login asks once for a **display name**
39. (interim — see concept point 6: keep it a normal field so ident can fill it later).
40. 3. **Reading stays public. Writing needs a login**: creating tickets, commenting, state changes — in the web
41. UI (faces: check the real session, #31) and in the API. Anonymous writes → 401.
42. 4. **Author from the login**: no free `author` field any more (API: refuse it with 400 naming the field, or
43. ignore — list your choice). Events store the user; old events keep their author string.
44. 5. **Confirm / reject only by the creator**: the creator is configured as `TICKETS_CREATOR_IDENTITY` =
45. the creator's per-app identity id (env). Until it is set, nobody can confirm/reject. Provide a way for a
46. logged-in user to see their own per-app id (e.g. on a small "you" page) so the architect can set it.
47. 6. **API tokens** for machine clients: a logged-in user creates / lists / revokes their tokens in the UI;
48. a token is shown once, stored hashed; `Authorization: Bearer <token>` acts as that user on every API
49. write. Wrong / revoked token → 401.
50. 7. Existing API endpoints keep working for reads; for writes they now need a token.
51. 8. Data: new tables with `@id` keys in `storage/mpackdb/`; existing tickets/events untouched. The live
52. store on Byrodin must keep working after the architect's deploy (no manual migration step if avoidable;
53. if one is needed, write an idempotent tool and say so).
55. ## Rules
56. - No git. No `.env` access. Don't touch Byrodin. Don't POST to the live tickets server.
57. - Only kill your own PIDs. Clean up headless Chromes (`--disable-gpu`). Scratch in `.scratch/`.
58. - If any action is refused by the permission system, don't retry or work around it; report it.
59. - A test is the whole process: real headless browsers, your own ident + tickets servers, same-site
60. hostnames (both on 127.0.0.1, different ports): signed-out read works; write refused; selector login →
61. display name → write shows the user as author; second user can't confirm; creator (configured id) can;
62. token create → API write as that user → revoke → 401; forged face sessions refused; old events still
63. show their authors. Extend `tests/browser.mjs` (all existing checks stay green, adapt the ones that write).
64. Screenshots at 390px and 1280px (selector top right, name prompt, tokens page), look at them.
65. - Update tickets' `README.md` (login, tokens, env vars, how to set `TICKETS_CREATOR_IDENTITY`) and
66. `STATUS.md`. Do NOT edit `CONCEPT.md`. Also update `docker-compose.yml` if new env vars are needed
67. (values come from `.env`, never hard-coded secrets).
69. ## Report (final answer, this structure)
70. ```
71. ## Done
72. ## Verified (each: command run + observed output)
73. ## Not verified / open
74. ## Hybriel issues (repro, observed, expected)
75. ## Questions for the creator
76. ## Running (URL, PID, log path)
77. ```