S11 PLAN
Purpose: This isolates cookie/session/CSRF/Redis risk from OpenIddict and migration risk. Output: Pre-change baseline, Auth0 BFF client/config, ready revert, and exact 24-hour evidence.
syrf_bff_auth_* instruments do not exist before the BFF is enabled, so there is no pre-flip BFF 5xx rate or callback p95 to capture and neither is part of this baseline — Task 3's own 24-hour BFF-on-Auth0 window is the authoritative source for both. Verify the confidential Auth0 BFF client uses the canonical public callback /api/auth/callback and logout origin and leaves the SPA client/connections/callbacks intact. The app origin must be one of that client's Allowed Logout URLs: BFF logout sends the browser to Auth0's /oidc/logout with client_id and id_token_hint, because the shared tenant does not advertise an end-session endpoint and its discovery setting stays off (BFF how-to). In the restricted worksheet, authorise the exact logical destination projects/<production-project>/secrets/syrf-auth0-bff-production/versions/<approved-version>, map the Auth0 confidential application's client secret as its approved source, transfer it through the approved secret channel, and require exactly that version enabled. Never place the value in Terraform/GitOps, argv, logs, diffs or public evidence. Dry-run both cutover and rollback threshold query modes against fixtures/live data.
auth0-bff to extra-secrets-production with property clientSecret mapped to GCP key syrf-auth0-bff-production; commit only this reference, never its value or version identifier. Set Web authProvider=bff; set API BFF enabled with explicit provider=auth0, exact custom-domain authority, confidential client ref auth0-bff/clientSecret, Redis Secret ref, secure cookies and a new generation. Keep IdentityService.BaseUrl absent so Auth0IdentityService remains active; keep JWT fallback, existing Auth0 SPA/management config and secrets. Prepare an inverse PR restoring direct Web Auth0/BFF disabled with another fresh generation. Validate the active and inverse render plus the exact ExternalSecret target/remoteRef before merge.
/me, refresh/logout, account/admin, protected API, SignalR and same session through each API replica. With --expected-provider auth0 the harness does not automate the admin row (Auth0 administrator groups live in the shared tenant) or the emailed reset row, and records both as not run with a reason; the operator attests the admin surface. Query an exact 24-hour interval after rollout with --self-baseline. This window is the phase's self-baselining gate: it enforces the absolute thresholds (≥99% login success, refresh failure ≤1%, no sensitive logs, no in-memory store) and records its own observed auth 5xx rate and callback p95 as the authoritative baseline that S13 and every later window compare against, because no syrf_bff_auth_* series existed before this rollout. Write that window evidence to a retained absolute path outside /tmp (BFF_BASELINE_EVIDENCE) and keep it for the whole phase — reboot or tmpfiles cleanup of /tmp would make G4/G5 unreproducible. Otherwise merge the direct-Auth0 revert and prove stale BFF cookies route through disabled-selector/JWT behavior rather than old Redis sessions.
Production Auth0 BFF client checklist (recorded 2026-10-07)¶
S09 rehearsed the BFF-on-Auth0 shape on staging with a new Auth0 application, "SyRF staging BFF" (camaradesuk/cluster-gitops#1530). Production needs the same, so Task 1's "confidential Auth0 BFF client" is this checklist. It was recorded with Chris alongside S09's option B rollback. Create nothing in production before S11 Task 1 is authorised.
New Auth0 Regular Web App "SyRF production BFF":
- Application type: Regular Web App.
- Allowed Callback URLs:
https://syrf.org.uk/api/auth/callback. - Allowed Logout URLs:
https://syrf.org.uk(the app origin only; Auth0 refuses a deeper path such as/auth/confirmation-email-sentwith 400, so the Action email-sent pages return to the app root). - Application Login URI:
https://syrf.org.uk/api/auth/login. - Grant types: Authorization Code and Refresh Token.
- Refresh token rotation enabled.
- Token endpoint authentication method: Client Secret (Post).
- Connections enabled: Username-Password and
google-oauth2.
GCP secret:
-
syrf-auth0-bff-production, propertyclientSecret, mapped byextra-secrets-productionto the Kubernetes Secretauth0-bff, as Task 2 already requires. The value is transferred through the approved secret channel and never enters GitOps, argv, logs or evidence.
No change to existing Auth0 objects. The existing SPA application, the tenant's Default Audience (it
stays empty), the Transform Token Action (it has no client allowlist, so it applies to the new application
without an edit), and the tenant-wide RP-Initiated Logout End Session Endpoint Discovery setting (left
untouched, because the tenant is shared) are all left as they are. BFF logout therefore uses
{authority}/oidc/logout with client_id and id_token_hint, and the Action email-sent pages use
{authority}/v2/logout, as described in the
BFF how-to.
Staging counterpart: the "SyRF staging BFF" application may stay as a standing staging rollback path; that is Chris's decision after S27.