This is an internal working record, not an everyday instruction. It was written while the system was being rebuilt, for whoever maintains it. If you are here to do today's work, use the everyday documents instead: Procedures · Processes · Runbooks · The working day, step by step
Platform Identity Current Consumer Matrix — 2026-08-10¶
- Status:
CURRENT SOURCE-RECONCILED MATRIX / DOCUMENTATION ONLY - Task:
CTC-CDOC-004 - Reviewed source:
qa/master@8981a02f7b2a2fa256a7365d6921f3d7636f1fe2 - Source refresh:
../reconstruction/PLATFORM_IDENTITY_CURRENT_CONSUMER_REFRESH_2026-08-10.md - Existing policy catalog:
PLATFORM_IDENTITY_SESSION_IMPERSONATION_POLICY_AND_SEQUENCE.md - Runtime changes:
NONE
1. Identity Vocabulary¶
For this matrix:
Actor = physical authenticated identity that initiated the action
Subject = identity whose business permissions/context are being represented
Tenant = tenant whose records/configuration are in scope
Important current distinctions:
physical Super Admin != effective target user
console tenant selection != impersonation
API admin override != persisted impersonation
tenant-only impersonation != target-role session
strict principal != universal API coverage
active session != privileged reauthentication
2. Current Consumer Matrix¶
| Consumer | Entry / owner | Actor | Subject | Tenant | Identity projection | Active-user validation | Reauth state | Risk / current disposition |
|---|---|---|---|---|---|---|---|---|
| Login | login.php |
user after proof | same | DB user tenant | original session fields | N/A before login | password proof is login proof only | Username lookup is not tenant-qualified; no MFA/lockout visible. |
| Main PHP shell | index.php |
physical session user | effective user | effective tenant | scalar helpers | YES via kjValidateActiveSessionUser() |
none | Role/user deletion now invalidates current request/session; impersonation still collapses in scalar consumers. |
| Legacy endpoint boundary | app/shared/endpoint/response.php |
physical session user | effective user | effective tenant | legacy/scalar | YES in current source |
none | Entry-level validation improved; downstream provenance remains caller-specific. |
| API protected scalar route | app/shared/api/router.php + runtime.php |
physical session user | effective user | scalar/API override tenant | apiContext() |
YES |
none | Not typed; Actor/Subject split can be lost by handlers. |
| API strict route | same + api_strict_principal.php |
typed actor | typed subject/null | strict local tenant | serialized TenantExecutionContext |
YES before strict context |
none | Best current Actor/Subject/Tenant representation, but only opt-in routes. |
| Admin Console tenant admin | admin-console.php |
tenant admin | same | physical session tenant | role 1 + session tenant | console file itself does not call validator directly; normal entry/session chain required | none | client_id query cannot select a foreign tenant for tenant admin. |
| Admin Console super-admin selection | admin-console.php |
physical super admin | none | selected existing tenant | KJ_ADMIN_CONSOLE_CLIENT_ID / URL selection |
session chain dependent | none | Selection is context, not target user identity. |
| Tenant-only main app | admin-console.php?action=main_open |
physical super admin | none | selected tenant | IMPERSONATE with target user ID 0 |
validated on subsequent main/API paths | none | Not field-role evidence. No rotation/expiry visible. |
| User impersonation | super_admin_post_helper.php |
physical super admin | target user | target tenant | IMPERSONATE + scalar/typed adapters |
physical actor and target existence checked on validated paths | none | No reason/expiry/step-up established. |
| Impersonation end | admin-console.php?action=impersonate_end |
physical super admin | prior target | prior target tenant | unset(IMPERSONATE) |
not a separate reauth step | none | GET-like console action; no session ID rotation visible. |
| API admin override | runtime.php::apiContext() |
physical super admin | none | X_ADMIN_CLIENT_ID on allowlist |
scalar request context | YES |
none | Request-scoped tenant switch, not impersonation. |
| Provider config replacement UI | tenants.php |
super admin or tenant role 1 | effective session subject | selected/effective tenant | Admin Console + API | protected API validation | none | Secret field is blank; replacement only in reviewed UI. |
| Managed credential reveal API | api_routes.php |
physical actor inferable from session | effective subject may differ under impersonation | guarded URL tenant | scalar Admin Console guard | protected API validation | NOT PRESENT |
High risk; route exists though reviewed UI caller was not found. |
| Managed credential update API | api_routes.php |
physical actor inferable from session | effective subject may differ under impersonation | guarded URL tenant | scalar Admin Console guard | protected API validation | NOT PRESENT |
Durable Actor/Subject audit completeness not established. |
| Logout | index.php?page=logout |
current session user | current effective subject | current effective tenant | direct session mutation | page was already authenticated to reach shell | none | GET action; selected fields unset + session_destroy; no explicit cookie delete helper. |
3. Actor / Subject / Tenant Decision Table¶
3.1 Direct user¶
Actor = login_id/login_username
Subject = same identity
Tenant = CLIENT_ID
Status: RESOLVED.
3.2 Super-admin console selection without main-open¶
Actor = original superadmin session
Subject = null
Tenant = selectedClientId
Status: RESOLVED FOR CONSOLE REQUEST; this is not persisted target-role identity.
3.3 User impersonation¶
Actor = ORIGINAL_ADMIN_ID / ORIGINAL_ADMIN_USERNAME
Subject = TARGET_USER_ID / TARGET_USERNAME
Tenant = TARGET_CLIENT_ID
Status: RESOLVED IN TYPED CONTEXT; legacy scalar handlers may only receive effective target values.
3.4 Tenant-only impersonation¶
Actor = original superadmin
Subject = null
Tenant = TARGET_CLIENT_ID
TARGET_USERNAME is a required compatibility/display value in the strict adapter even though it is not a real user subject. A consumer must not convert that label into a real user identity.
Status: RESOLVED SEMANTICALLY; SCALAR USERNAME IS COMPATIBILITY DATA.
3.5 API admin override¶
Actor = original superadmin
Subject = null
Tenant = X_ADMIN_CLIENT_ID target when path allowlist permits
Status: RESOLVED AT API BOUNDARY.
3.6 Credential reveal/update during impersonation¶
Current authorization can still see physical isSuperAdmin() while effective tenant/user scalar helpers may represent the impersonated target.
Actor = original physical superadmin
Subject = target user for user impersonation, null for tenant-only impersonation
Tenant = target/effective tenant constrained by handler rules
Status: SEMANTICALLY RESOLVED, but a durable audit envelope proving all three values for the credential action is EVIDENCE REQUIRED.
4. Session Validation Matrix¶
| Event | Current source behavior on a validated request | What it does not prove |
|---|---|---|
| Original physical user deleted/missing | current session is cleared, cookie-expiry call is made, session destroyed | central push revocation before the next request |
| Original physical role list changed | current session is cleared and destroyed | granular permission lease/version model |
| Impersonated target user deleted/missing | IMPERSONATE removed; original actor session retained |
target role-list freshness or reauth |
| Password changed by self | no validator comparison to password/session version | other sessions revoked |
| Password reset by admin | no validator comparison to password/session version | all target sessions revoked |
| Validator DB/error failure | caller denies current request | persistent server-side session definitely destroyed |
| 20-hour PHP lifetime reached | PHP cookie/GC lifetime is configured | exact absolute/idle expiry observed in deployment |
| Impersonation duration elapsed | no source policy found | automatic impersonation expiry |
5. Credential Consumer Matrix¶
| Surface | Current source state | Secret-safe observation | Identity/session implication |
|---|---|---|---|
| Provider config list | secret values rendered empty/masked by metadata | HAS_CONFIG_VALUE can indicate presence without value |
ordinary list does not need reveal semantics |
| Admin Console secret input | password field starts empty | existing secret represented by placeholder/presence | browser does not need stored secret to replace it |
| Admin Console save | non-empty replacement required | blank does not request old secret | session authorization is sufficient in current source; privileged reauth absent |
| Managed reveal route | source-present POST route | do not execute in read-only evidence | session capable of admin-console access can reach guard; no separate reauth state visible |
| Managed update route | source-present POST route | do not send credential payload in evidence | same session/provenance concern as reveal |
| Request logging | route marks sensitive body redaction | verify source flags only | does not by itself prove response/browser/telemetry safety |
6. Strict Versus Scalar API Flow¶
Scalar protected route¶
request
-> apiAssertAuthenticated()
-> kjValidateActiveSessionUser()
-> module/menu/role guards
-> apiContext()
-> handler
Potential loss: physical Actor versus effective Subject can be collapsed before the handler.
Strict tenant principal route¶
request
-> apiAssertAuthenticated()
-> kjValidateActiveSessionUser()
-> apiStrictPrincipalContext()
-> TenantExecutionContextAdapter
-> strict module guard
-> menu/role guard
-> handler with serialized tenantExecutionContext
Current advantage: Actor/Subject/Tenant is explicit. Current limitation: opt-in coverage only.
7. Read-Only Evidence Scenarios¶
The corresponding package is RBR-IDENTITY-002. The following IDs are documentation scenario identifiers only; they are not executed by this task.
| Evidence ID | Goal | Safe read only | Mutation/effect forbidden |
|---|---|---|---|
IDN2-SRC-010 |
prove core blob/source baseline | repository file SHA/content review | source edits outside owned docs |
IDN2-SRC-020 |
enumerate validator callers | repository search | runtime request |
IDN2-SRC-030 |
enumerate strict-principal routes | repository search | API execution |
IDN2-SRC-040 |
enumerate admin override allowlist | repository review | header-based request |
IDN2-SRC-050 |
prove reveal/update route registration and body-redaction flag | repository review | credential request |
IDN2-SRC-060 |
prove current UI reveal caller presence/absence | repository search | browser reveal |
IDN2-DB-010 |
active username uniqueness inventory | aggregate IDs/counts only | login/account update |
IDN2-DB-020 |
active role/user metadata inventory for controlled evidence accounts | IDs/tenant/role only, with approved scope | role/account mutation |
IDN2-DB-030 |
session-storage/revocation schema inventory if such tables exist | schema/table metadata only | session row changes |
IDN2-RUN-010 |
later prove physical user deletion/role drift invalidation | requires separately authorized controlled runtime plan | account/role mutation is explicitly NOT authorized here |
IDN2-RUN-020 |
later prove impersonated target invalidation | requires separate controlled plan | impersonation/account mutation |
IDN2-RUN-030 |
later prove timeout/cookie behavior | passive/controlled browser observation under separate approval | changing timeout/session config |
IDN2-RUN-040 |
later prove reveal session/re-auth controls | source-independent runtime review under explicit security approval | revealing or storing any secret in this package |
8. Acceptance / Non-Implication¶
This matrix is complete for source reconciliation when:
- every requested high-risk consumer has Actor/Subject/Tenant classification;
- unknown provenance is marked instead of inferred;
- session invalidation changes since the prior refresh are recorded;
- reveal API and current UI are not conflated;
- evidence definitions remain secret-safe.
It does not prove runtime, production, target-role, credential, M3, M4 or stabilization acceptance.
---¶
Source:
docs/processes/PLATFORM_IDENTITY_CURRENT_CONSUMER_MATRIX_2026-08-10.md— ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.