User Profile

Canonical user profile service for ArcaneDemesne internal apps.

Go BFF API + Astro frontend. Dev ports: nginx 8086, API 5086, Astro 4086, Postgres 6086. Production: https://userprofile.arcanedemesne.com.

Themes

Internal apps share themes from @arcanedemesne/ui (command / neon / deepspace / sciencelab). Preference persists in cookie ad-theme on Domain=.arcanedemesne.com so Homelab / WorkSuite / UserProfile stay in sync.

SSO (two layers)

Layer	Behavior
Authentik IdP	Shared login at auth.arcanedemesne.com. Other apps usually silent-authorize when already signed in. Configure via authentik.sync.yaml + OIDC client for this app.
App BFF session	Separate HttpOnly cookie per product (userprofile-auth-dev / userprofile-auth-prod). Not shared across subdomains (same pattern as Homelab/WorkSuite).

True shared BFF cookie across *.arcanedemesne.com is deferred. Same cookie name across apps is not SSO — see docs/EMBEDDED_PROFILE_UI.md.

Embedded profile UI

Cross-app redirects are removed. Host apps embed @arcanedemesne/profile-ui and call this API via HMAC interop (PROFILE_INTEROP_*).

Decision + cutover notes: docs/EMBEDDED_PROFILE_UI.md.

Interop (host Actions → this API)

Env	Purpose
PROFILE_INTEROP_SECRET	Shared HMAC secret with host apps
PROFILE_INTEROP_SERVICES	Allowlist (worksuite,homelab,userprofile)

Hosts set USER_PROFILE_API_URL, PROFILE_INTEROP_SECRET, PROFILE_INTEROP_SERVICE_ID.

Compose

cp .env.example .env
make up
make migrate-up

Alpha: schema lives in existing migrations (edit in place; no new numbered migrations for profile table).