Skip to content

Phase 05 Plan S27: Staging OpenIddict Reapply Summary

Ordinary staging was moved from the BFF on Auth0 back to the BFF on native Identity, on a fresh session generation. The live run passed, and both retained session cookies from S09 were refused on both replicas. Staging now runs the BFF on OpenIddict; production has not switched.

Timeline

When (UTC) Event Revision
2026-10-07 Chris gives the go for the reapply
2026-10-07 11:04:55 Reapply: BFF provider auth0 to openiddict, generation s27-staging-openiddict-3 camaradesuk/cluster-gitops#1531
2026-10-07 11:08 Both API replicas on the new generation (about 3 minutes after the merge)
2026-10-07 Live run (run-s09-live.sh s27) passed evidence file below

The three staging generations are now distinct, each from its own revision and Argo sync: s09-staging-openiddict-1 (#1529, switch), s09-staging-auth0-rollback-2 (#1530, rollback) and s27-staging-openiddict-3 (#1531, reapply).

What changed (#1531)

  • BFF provider auth0 to openiddict, authority identity.staging.syrf.org.uk, confidential client syrf-web, identityProvider: openiddict, and the chart-default scopes.
  • New session generation s27-staging-openiddict-3, so every cookie minted under the two earlier generations is refused.
  • The Auth0 staging BFF ExternalSecret is kept as a values-only rollback path. Nothing reads it while the provider is openiddict, but a rollback to Auth0 stays a one-change GitOps edit.

Live run (passed)

Evidence (redaction-checked, mode 0600, git-ignored): .superpowers/sdd/auth-s30-2026-09-25/ -> s27-reapply-evidence-2026-10-07.json.

  • Password sign-in, /api/auth/me, a protected API call, SignalR reconnect, refresh/logout and the emailed reset.
  • Two replicas sharing one session.
  • Both retained cookies were refused (401) on both replicas: the S09 switch-generation cookie (s09-staging-openiddict-1) and the S09 Task 3 Auth0 rollback-generation cookie (s09-staging-auth0-rollback-2). The evidence records old_cookies_unauthorized_checked: 2. S09's Task 3 had checked only the first of the two.

Also verified on staging before the reapply (BFF on Auth0, 2026-10-07)

  • An unverified Auth0 sign-up lands on /auth/welcome-email-sent, through the #4105 callback-path forwarding.

  • 4106 ends the Auth0 session in a hidden frame (/v2/logout), so the next Sign in shows Universal

    Login.

Process lesson

The first version of #1531 accidentally deleted unrelated staging values. A script that rewrote comments had a bug and removed more than comments. The Claude review blocked it, and it was rebuilt with a block-scoped edit before merge. Lesson: diff the non-comment changes of a GitOps change before requesting review.

Follow-ups (not done)

  • Delete the two Auth0 staging test users. This needs an Auth0 Management API token from Chris.
  • Decide whether to keep the "SyRF staging BFF" Auth0 application and the syrf-auth0-bff-staging secret as a standing rollback rehearsal path.
  • camaradesuk/cluster-gitops#1616: a comment-only Swagger note.
  • Recovery time against an objective was still not measured. The only figures are the rollout times (about 3 minutes for the reapply, 3 m 18 s for the S09 rollback).

Next

  • S10 (production dark launch) is unblocked by S27. S10-S13 are unchanged.
  • S13 is also gated on account-portal slices 1-3 (plan). Slices 1 and 2 are in PR #4113, slice 3 in PRs #4112 and #4114, and step-up hardening is in #4116 (in progress).