HUCIAL SSO 1.1.1
================

Purpose
-------
Single sign-on between:
- identity issuer: https://hucial.com (technical phpBB root: /portal)
- client: https://phpbb.hucial.com

The same extension is installed on both phpBB 3.3.17 instances.
No password is copied between databases.

Security model
--------------
- Ed25519 signed, short-lived assertions.
- Assertions are POSTed to the client callback (not put in the URL).
- One-time state stored on PHPBB Lab and bound to its phpBB session.
- The state is consumed at callback, preventing replay.
- Audience and issuer are checked.
- Native local phpBB login remains reachable directly for emergency/admin access.

Default key paths
-----------------
/var/www/hucial/storage/sso/private.key
/var/www/hucial/storage/sso/public.key

First administrator link
------------------------
An already existing PHPBB Lab account is linked once with "Lier mon compte HUCIAL".
After that, normal PHPBB Lab sign-in goes through HUCIAL SSO.

Single registration source since 1.0.1
--------------------------------------
- HUCIAL is the only public registration source.
- PHPBB Lab public registration redirects to HUCIAL.
- Existing HUCIAL members are provisioned automatically on their first Lab SSO login.
- Existing standalone Lab accounts can be linked once.

Version 1.1.0 - shared HUCIAL community statistics
--------------------------------------------------
HUCIAL and PHPBB Lab now share the member-related public statistics displayed by
phpBB without copying the complete users table between databases.

Authoritative membership statistics:
- HUCIAL remains the source of truth for total registered members.
- The newest HUCIAL member is displayed on PHPBB Lab as well.
- PHPBB Lab local provisioning count does not replace the HUCIAL member total.

Shared online members:
- Both instances write recent activity to one state file outside the public root.
- Activity is keyed by the issuer HUCIAL user id, so a member active on both
  instances is counted only once.
- Only SSO-linked Lab accounts enter the shared HUCIAL online count.
- Hidden-online preference is retained for the displayed member list.
- The shared online record is stored in the same state.
- Default online window: 300 seconds (5 minutes).

Shared state path:
/var/www/hucial/storage/sso/stats/community.json

The parent stats directory must be writable by the web server. Recommended:
owner/group root:www-data, directory mode 770. The JSON state file is created
by the extension and is kept outside /var/www/hucial/public.

What is intentionally NOT synchronized
--------------------------------------
- passwords;
- full phpbb_users tables;
- forum posts/topics statistics;
- PHPBB Lab member-list pagination or local ACP user inventory.

Those remain local to their respective phpBB instance. Only the public
member/community counters are shared.

Version 1.1.1 - additive online statistics
-------------------------------------------
The shared HUCIAL online statistics no longer replace phpBB's native online
block. Native phpBB information is preserved exactly as phpBB generates it,
including local guests, bots, hidden users and the native online record.

The shared SSO statistics are displayed in addition to those native values:
- shared/deduplicated HUCIAL members online across the connected instances;
- shared HUCIAL online-member list;
- shared HUCIAL online record.

The shared total registered members and newest HUCIAL member remain authoritative
for the public membership statistics as introduced in 1.1.0.
