This is an internal working record, not an everyday instruction. It was written while the system was being rebuilt, for whoever maintains it. If you are here to do today's work, use the everyday documents instead: Procedures · Processes · Runbooks · The working day, step by step
Platform Identity — Current Consumer Matrix — 2026-08-09¶
- Status:
CURRENT SOURCE-RECONCILED MATRIX / ENVIRONMENT EVIDENCE REQUIRED - Repository baseline:
qa/master@40fb4020e2993347eb7cde9cb24ee9f6201cd806 - Source refresh:
PLATFORM_IDENTITY_CURRENT_CONSUMER_REFRESH_2026-08-09.md - Phase implementation:
USER HOLD
1. Matrix Rule¶
Each current consumer is evaluated across independent identity layers.
credential/authentication
physical actor
effective subject
target tenant
session state
impersonation/access mode
privileged authorization
record/action authorization
correlation/evidence
A passing value in one column does not satisfy the others.
2. Current Consumer Matrix¶
| Consumer | Entry | Physical actor | Effective subject | Tenant source | Session/access mode | Current guard | Durable identity evidence | Current disposition |
|---|---|---|---|---|---|---|---|---|
| Login | POST /login.php |
unauthenticated credential claimant | resulting user | user row | new PHP session | username/password | LAST_LOGIN, request/error logs; no session ledger |
core current, data evidence required |
| Normal page/API | PHP shell/API | logged-in user | same user | session | direct | authentication + distributed access | request/page diagnostics | current compatibility |
| User impersonation start | Admin command | original Super Admin | target user after start | explicit target | impersonation | Super Admin endpoint + target row | session object; universal durable audit not established | current, policy/evidence required |
| Tenant-only impersonation | GET Admin main_open or start with user 0 |
original Super Admin | none | selected tenant | impersonation | Super Admin Admin Console | session object | support context only, not role acceptance |
| Impersonation end | GET Admin action | original Super Admin | none after end | original Admin context | direct after unset | Admin Console session | no universal durable end event established | current, rotation policy open |
| Admin tenant override | allowlisted API | original Super Admin | none | explicit header/target | admin override | route opt-in + authorization reference in typed path | request diagnostics | strict target pattern, partial adoption |
| Own-password change | Account action | logged-in actor or original Super Admin under impersonation | effective scalar user | effective scalar tenant | direct or impersonation | current password | password row mutation diagnostic | impersonation policy open |
| User password reset | Admin API | Super Admin | explicit target user | explicit target tenant | Admin session | Super Admin route | mutation diagnostic | no other-session revocation established |
| Logout | GET shell action | current session actor | current effective subject | session | direct/impersonated | authenticated shell | session destruction only | CSRF/cookie/revocation policy open |
| Reset UI state | GET shell action | current session actor | current effective subject | session | unchanged | authenticated shell | none required | not logout |
| Provider credential reveal | POST tenant credential route | Super Admin or tenant Admin | effective session subject | URL tenant + current helper check | direct or possibly impersonated | Admin Console access + allowlisted key | request log with body redacted; typed actor/subject evidence not established | high-impact current consumer |
| Provider credential replacement | POST tenant credential route | Super Admin or tenant Admin | effective session subject | URL tenant + current helper check | direct or possibly impersonated | same as reveal + expected revision | config mutation diagnostic | high-impact current consumer |
| Module/config administration | Admin API | Super Admin or tenant Admin depending route | effective session subject | selected/effective tenant | direct or impersonated | distributed Admin checks | request/mutation diagnostics | target release authority not current |
| Work Assignment Manager command | TMS API | current logged-in actor | effective user | effective tenant | direct/impersonated | role-name manager helper | request/mutation/domain rows | Access packet owns decision |
| Work Assignment Loader command | TMS API | current logged-in actor | effective assigned user | effective tenant | direct/impersonated | assigned user or manager | request/domain rows | identity self-binding evidence required |
| Final Review command | WMS API | current logged-in actor | effective user | effective tenant | direct/impersonated | current numeric compatibility and state guard | request/domain rows | Access packet owns decision |
| Street Turn command | YMS/TMS API | current logged-in actor | effective user | effective tenant | direct/impersonated | module + record/state | request/domain rows | dedicated actor policy not accepted |
| QBO/Gmail/Telegram/APMT command | Business API | current user or job actor | effective user/system | business tenant | direct/system/integration | business/access/config checks | provider-specific result/log | Integration packet owns effect |
| Provider callback | public provider endpoint | provider/integration | none unless mapped | configured binding | integration | secret/signature/provider binding | callback/business rows | provider identity is not local user |
| CLI/scheduler | CLI/HTTP scheduler | system/job identity | none | explicit binding or legacy fallback | system | job-specific | job/log/business rows | strict binding required for new writes |
| Page/API telemetry | request shutdown logger | original session username in diagnostic field | effective request context may differ | effective request tenant | any | non-blocking | request/page correlation | both actor and subject must remain reconstructable |
3. Credential Reveal / Replacement Detailed Matrix¶
| Layer | Current source result | Evidence required |
|---|---|---|
| Authentication | active Admin Console PHP session | controlled session and expiry evidence |
| Physical actor | original session user; isSuperAdmin() remains based on original fields |
direct versus impersonated actor trace |
| Effective subject | scalar session helper may resolve target user | subject visibility in request/audit evidence |
| Target tenant | URL clientId; non-Super Admin must match getClientId() |
selected/effective tenant parity |
| Access mode | direct, user impersonation or tenant-only impersonation not explicitly rejected | accepted policy by mode |
| Role | Super Admin or effective role ID 1 | current role/account matrix |
| Credential scope | allowlisted provider secret only | allowlist completeness and owner review |
| Privileged reauth | not established | policy decision and negative evidence |
| Request integrity | POST, same-origin session model, no separate token contract established | browser/network evidence |
| Request logging | request body removed from route log context | request-log redaction evidence |
| Response caching | no-store, private and no-cache |
current response-header evidence |
| Repository call context | target clientId only |
future typed actor/subject/authorization contract |
| Result | plaintext reveal or encrypted replacement | no secret captured in evidence |
| Session impact | none established | session rotation/revocation policy |
| Provider impact | none | saved does not mean connected |
4. Impersonation Mode Matrix¶
| Mode | Actor | Subject | Tenant | Current scalar behavior | Current typed behavior | Prohibited interpretation |
|---|---|---|---|---|---|---|
| Direct user | logged-in user | same user | session tenant | actor and subject collapse | actor=subject | no issue if direct |
| User impersonation | original Super Admin | target user | target tenant | user/client helpers return target; isSuperAdmin() stays true |
actor and subject separated | target user alone is not physical actor |
| Tenant-only impersonation | original Super Admin | none | target tenant | target username label may be synthetic; original Super Admin role remains | subject null | not target-role acceptance |
| Admin API override | original Super Admin | none | explicit target | route-specific scalar override may apply | explicit strict override with authorization reference | not session impersonation |
| System/CLI strict binding | system/job | none | explicit tenant | caller-specific | strict typed context | not a human session |
| Legacy default | system compatibility | none | configured fallback | scalar default | compatibility-only | not acceptable for new consequential write |
5. Password And Session State Matrix¶
| Action | Current mutation | Session rotation | Other-session revocation | Impersonation termination | User notification |
|---|---|---|---|---|---|
| Successful login | session issue + LAST_LOGIN |
yes | no | not applicable | no established workflow |
| Own-password change | password row | not established | not established | not established | not established |
| Admin password reset | password row | not established | not established | not established | not established |
| Impersonation start | session object | not visible | no | starts | no |
| Impersonation end | session object unset | not visible | no | ends | no |
| Logout | current PHP session destroy | no new session | current session only | current session ends | no |
| Reset UI state | browser/session UI keys | no | no | no | no |
6. Current Stable Errors / Dispositions¶
Existing and target-safe disposition vocabulary:
UNAUTHENTICATED
FORBIDDEN
TENANT_TARGET_REQUIRED
TENANT_CONTEXT_INVALID
IMPERSONATION_CONTEXT_INVALID
REAUTH_REQUIRED
SESSION_EXPIRED
SESSION_REVOKED
CREDENTIAL_SCOPE_INVALID
CREDENTIAL_REVISION_CONFLICT
IDENTITY_RESULT_UNKNOWN
Not every target error is implemented in current source. Current error text must not be represented as a stable target contract until an owning application boundary adopts it.
7. Required Evidence Scenarios¶
Read-only metadata and GET observation¶
IDN-EV-010 active username uniqueness
IDN-EV-020 password-hash population
IDN-EV-030 session runtime/cookie configuration
IDN-EV-040 current role/account/session metadata
IDN-EV-050 safe Admin page and GET API observation
IDN-EV-060 request-log actor/tenant/correlation shape
IDN-EV-070 provider credential safe metadata only
IDN-EV-080 current Wiki/admin guidance
Separately authorized consequential scenarios¶
IDN-RUN-110 successful/failed login
IDN-RUN-120 user impersonation start/end
IDN-RUN-130 tenant-only impersonation start/end
IDN-RUN-140 own-password change direct
IDN-RUN-141 own-password change while impersonating
IDN-RUN-150 Admin password reset and session behavior
IDN-RUN-160 current logout/reset behavior
IDN-RUN-170 credential reveal direct
IDN-RUN-171 credential reveal while user impersonating
IDN-RUN-172 credential reveal while tenant-only impersonating
IDN-RUN-180 credential replacement optimistic conflict
IDN-RUN-190 actor/subject/correlation evidence
None of the consequential scenarios is authorized by this matrix.
8. Migration Ownership¶
Identity application
= credentials, sessions, impersonation, privileged reauth
Tenant context
= target tenant identity and provenance
Authorization
= action/record permission
Business application
= domain state transition
Audit/evidence
= actor/subject/request/transition correlation
Provider integration
= credential owner and provider effect
React and Next.js may render/adapt these results. They must not merge them into
one UI-only isAdmin or loggedIn flag.
9. Current Disposition¶
matrix scope:
CURRENT NAMED CONSUMERS
core Identity source:
UNCHANGED / CURRENT
consumer drift:
DOCUMENTED
current environment evidence:
NOT RUN
policy acceptance:
OPEN / PARTIAL
M3 / M4:
NO
---¶
Source:
docs/processes/PLATFORM_IDENTITY_CURRENT_CONSUMER_MATRIX_2026-08-09.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.