Repository navigation
Open POST /applications to self-service registration - #60
Merged
Merged
Conversation
Any User with a verified email can now submit their own Application into the review queue (Applications → The review lifecycle), owned by them or an Organization they're an org_admin of, starting in pending_review with the moderation fields staff-only. 10 submissions per User per day. Making it safe to open: - Applications gain a read-only self_registered flag (migration 0006). A self-registered Application is third-party: POST /v1/auth/app-tokens refuses it (403 embedded_login_not_allowed), as Auth → Getting an app token required once self-service shipped, and only applications.manage can turn on its receives_platform_notifications. - Platform-managed (free/subscription) Entitlements are only granted to Applications that have been approved, and approval grants them, so a standard submission no longer reaches every subscriber, with access.granted webhooks to an unreviewed developer, the moment it's created. openapi.yaml 1.0.0-draft.4, regenerated routes and MCP tools, spec pages, NFR rate limits, roadmap, plan-remaining.md, and the Changelog updated. Closes #32 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This was referenced Oct 22, 2026
Brings in the Substratal-Version header and root paths (#37), the plan-job secret fix (#59), and the versioning docs (#63). - Conflicts in Applications (API and domain model), NFR, and plan-remaining.md: this branch's text, with root paths and anchors; main's side only differed by the removed /v1 prefix. The Changelog puts this branch's entry above main's two 2026-10-21 entries - openapi.yaml 1.0.0-draft.5 (main took draft.4 for the header change) - applications_test.go, the self_registered description, and an Auth anchor: root paths; tools.json regenerated Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
terraform plan (production)This is exactly what merging will change in AWS. Plan |
…o 0010 - Migration 0006_self_registered_apps → 0010_self_registered_apps: 0008_scim_tokens reached production first, and #58's expiry migration is now 0009. - openapi.yaml 1.0.0-draft.7 (assuming #58 merges first as draft.6); Changelog entry stacked above SCIM's. - plan-remaining.md: both the SCIM and the self-service Phase 3 bullets are gone, since both are built. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adron
added a commit
that referenced
this pull request
Oct 22, 2026
- Migration 0007_audit_exports → 0011_audit_exports: 0008_scim_tokens reached production first; #58 and #60 are now 0009 and 0010. Its audit action check is the full set, SCIM's actions included. - openapi.yaml 1.0.0-draft.8 (after #58 draft.6 and #60 draft.7), 123 operations; Changelog, OpenAPI index, roadmap, schema, action catalog, ids, and plan-remaining.md merged with SCIM's additions. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Adron
changed the title
terraform plan (production)This is exactly what merging will change in AWS. Plan |
…-service-apps Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
terraform plan (production)This is exactly what merging will change in AWS. Plan |
Adron
added a commit
that referenced
this pull request
Oct 22, 2026
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #32.
Outside developers can now register their own Applications into the review queue. Review mechanics (
review_status,review_notes, transitions, edit-to-resubmit, the FIFO queue) were already built; this opens the submission path. Opening it safely took three more changes, each required or implied by the spec.Self-service submission (
POST /applications)403 email_not_verified. API Keys withoutapplications.manageget403 forbidden.owner_user_id, orowner_organization_idfor an Organization they're an activeorg_adminof. Any other owner gets403 moderation_field_forbidden.pending_review,public,standard. Settingvisibility,access_tier,review_statusorreview_notesgets403 moderation_field_forbidden.POST /organizations.What makes it safe
self_registered. A new read-only flag from migration0010_self_registered_apps. A self-registered Application is third-party, even once approved:POST /auth/app-tokensrefuses it with403 embedded_login_not_allowed. Auth → Getting an app token already said embedded login is blocked for non-Substratal apps "once self-service registration ships", because embedded login hands the app the User's password. Staff-created apps, both Substratal's and concierge customers', keep embedded login.applications.managecan turn on itsreceives_platform_notifications, so platform security alerts never go out under an unvetted app.standardsubmission got asubscriptionEntitlement for every Standard subscriber when it was created. Its unreviewed developer would also receive anaccess.grantedwebhook for each subscriber.platformAccessSQLnow only includes Applications that have been approved (approved, orsuspended, since suspension doesn't cascade), and areview_statuschange reconciles. Grants to unapproved Applications were already blocked bygrantable.Tests
TestSelfServiceApplicationRegistration:email_not_verifiedand key refusals.self_registeredis read-only.TestPlatformAccessWaitsForApproval: a pending free app grants nothing, approval grants it and firesaccess.grantedonce, and suspension doesn't cascade.The full integration and contract suite, gen-check, Lambda builds, and terraform fmt pass locally. golangci-lint runs in CI.
Merge order
0010is numbered after0009_test_user_expiryin Build test-mode User expiry (expires_at) #58, so merge Build test-mode User expiry (expires_at) #58 first.draft.7, after Build test-mode User expiry (expires_at) #58'sdraft.6. The Changelog entries need stacking in merge order.Still to come
A self-registered Application can't go live until the hosted sign-in page exists (
plan-remaining.md→ First-party web pages).Update (2026-10-22): rebased on the current API
main: header versioning (Move the API version from the URL to a Substratal-Version header #37, Spell out how API versioning works across the docs #63) and SCIM (Add SCIM 2.0 provisioning for Organizations #62). Every path is at the host root withSubstratal-Version: 1, and this description now uses root paths.0006_self_registered_apps→0010_self_registered_apps.0008_scim_tokensreached production first, and migrations are numbered in the order they ship. Its audit action check is now the full set, including SCIM'sorganization.scim_token_*and the other open PRs' actions, so no merge order can drop an action.info.versionis1.0.0-draft.7. SCIM tookdraft.5; the open PRs are numbered Build test-mode User expiry (expires_at) #58 →draft.6, Open POST /applications to self-service registration #60 →draft.7, Add Audit Event exports (POST/GET /audit-exports) #61 →draft.8, assuming they merge in that order.🤖 Generated with Claude Code