tickets

ident.worldapi.org #4formerly #25

ident 2/6: apps and login button

confirmed

opened · updated

Any ident user registers apps: API key (public) + app secret (server calls). One identity id per identity and app, not transferable. Login button flow (reuse redirect + one-time code exchange from mission 003) hands out only that per-app id, exchange authenticated with the app secret. Concept: loreana:/media/STORAGE/projects/ident.worldapi.org/CONCEPT.md. Part of #2.

History

  1. architect opened the ticket
  2. architect changed the state in progress Mission 006 started.
  3. architect changed the state awaiting creator Mission 006 done. Verified by architect: apps gate 94/94 re-run, live negatives on :8351 (foreign return origin 400 no redirect, wrong key/secret 401), screenshots checked (choose identity, secret shown once). Test: http://100.77.141.84:8351/apps -> register an app with origin http://100.77.141.84:8354 -> paste key + secret into the test app http://100.77.141.84:8354 -> Log in with ident. Worker's choices to confirm: secret shown once (hash stored); params key/return/ident_code, code 60 s, request 30 min; a code presented by the wrong app is spent; deleting an app deletes its per-app ids, deleting an identity keeps its connections; choice page without manage/new identity; test app shows the id (proof only); origins 1-10, scheme://host[:port].
  4. creator changed the state confirmed

Respond