Each script: full OIDC webflow per app (gitea /user/oauth2/cloudron,
redmine /oauth?oauth_provider=1 GET-form, discourse /auth/oidc with
CSRF + confirm-page token), TOTP from vault seed, session verify.
Ran fleet-wide 2026-09-09: accounts created for all 32 org identities;
gitea tokens + redmine/discourse api keys minted via admin levers and
stored per identity in the vault.
https://projects.knownelement.com/issues/942
- sed kept the URL prefix in the auth-code extraction; the garbage code
was the cause of every invalid_grant on the token exchange
- enrollment now uses the Cloudron 10 profile-scoped routes mined from
the dashboard bundle: POST /api/v1/profile/totp_secret and
POST /api/v1/profile/totp_enable
- seed storage verifies the setfield write and falls back to a full
vault item recreate (smcli setfield 400s on some ciphers)
- prompt=login added to the auth URL for session-switch flows
Verified: 32 COO-org identities enrolled end-to-end (seed in vault +
real TOTP login as each identity). Full detail on the #942 comment.
https://projects.knownelement.com/issues/942
mrcharles