Pulse/internal/cloudcp/auth
rcourtman 0e40ec07cb Make the provider MSP portal honest and self-sufficient without an email provider
Exercised the full provider portal as a pilot MSP would and fixed what
made it feel broken:

- The signed-out portal promised "a sign-in link is on the way" even when
  the control plane has no email provider (the bundle default), and team
  invitations silently sent nothing. The portal bootstrap now carries
  email_sign_in_available and provider_hosted_mode; the sign-in page shows
  the host command that actually prints a link, and the invite panel says
  invitation emails are not sent and how to hand over a link instead.
- New "provider-msp portal-link --email" CLI mints a one-time portal link
  for an account member or pending invitee, so teammates can sign in at
  all on email-less installs (bootstrap only covers the owner).
- Portal sessions were fixed at 12h; CP_SESSION_TTL now configures them
  and provider-hosted MSP mode defaults to 7 days.
- Creating a client past the license cap showed a generic "Failed to
  create workspace." toast: the limit error is now a JSON payload with
  current/limit, the API client no longer drops non-JSON error bodies
  (double body read), and the toast explains the license limit.
- Copy polish: provider-mode sign-in intro (no refunds/privacy register),
  least-privilege default invite role, queue tile label matches "Client
  onboarding", softer Support tab with a docs/MSP.md pointer, setup.sh
  summary now prints the bootstrap next step and day-2 sign-in commands,
  .env.example and docs/MSP.md document portal sign-in and sessions.

Contracts updated (cloud-paid, api-contracts, deployment-installability,
security-privacy) with verification pins in tenant_handlers_test,
config_test, magiclink_test, and provider_msp_deploy_test.

Verified live against a dockerless control plane: portal-link for an
invitee redeems, promotes the invitation, and sets a 7-day session;
the at-cap toast shows the license copy; portal vitest suite and
cloudcp/auth/account/installtests Go suites pass.
2026-07-10 11:22:57 +01:00
..
handlers.go Make the provider MSP portal honest and self-sufficient without an email provider 2026-07-10 11:22:57 +01:00
handlers_magiclink_test.go Fail closed on hosted handoff identity 2026-05-04 09:47:54 +01:00
handlers_test.go fix(cloudcp): unify portal magic link identity 2026-03-27 14:52:39 +00:00
magiclink.go Make the provider MSP portal honest and self-sufficient without an email provider 2026-07-10 11:22:57 +01:00
magiclink_store.go Harden secure local key file handling 2026-04-22 05:13:01 +01:00
magiclink_store_concurrency_test.go feat: Pulse v6 release 2026-03-18 16:06:30 +00:00
magiclink_store_migration_test.go fix(cloudcp): unify portal magic link identity 2026-03-27 14:52:39 +00:00
magiclink_store_queryplan_test.go fix(cloudcp): unify portal magic link identity 2026-03-27 14:52:39 +00:00
magiclink_test.go Make the provider MSP portal honest and self-sufficient without an email provider 2026-07-10 11:22:57 +01:00
session.go Make the provider MSP portal honest and self-sufficient without an email provider 2026-07-10 11:22:57 +01:00
session_test.go feat: Pulse v6 release 2026-03-18 16:06:30 +00:00