feat(auth): bind Admin browser guarantees - #29
Conversation
Run redirect-driven auth forms as browser navigations, honor canonical edge origins, derive catalog idempotency automatically, normalize API envelopes, and register the exact Reviewer browser verifier for every active identity and team scene. The development compose now exposes workspace roots to Vite for atomic package overlays.\n\nCloses #27.\nCloses #28.
Use the canonical configured HTTPS origin behind the edge, derive required idempotency from SDK descriptors, normalize current API envelopes, and update active scenes to the explicit confirmation and consent flows.
|
Development-composition checkpoint: the external Reviewer graph now passes 16/20 active Admin identity/team/account scenes. Registration + Mailpit confirmation, password reset, two-step sign-in/authorization, team creation/edit/invite/acceptance, role and ownership transfer/restoration, public profile, sessions, notifications, and durable appearance all pass against the hot-loaded API/Admin/UI/Core graph. The remaining chain is the destructive member/team/logout/account cleanup sequence; Reviewer #30 addresses a harness race where clicks could precede Admin enhancement-script readiness. API 0.8.0-rc.43 and Reviewer 0.1.0-rc.4 have been immutably published, but Admin will not merge or release until this graph is complete. |
|
Live composition checkpoint: proof 59 reached 19/20 active identity/team browser scenes. Team overview, public profile, permanent team deletion, and logout all pass in dependency order. The remaining account-delete failure exposed API issue treeseed-ai/api#121 (invalid confirmation advanced the account revision); fix is in treeseed-ai/api#122 and is now running as local API development generation 3 for the next exact graph run. This Admin update also removes the retired uncatalogued /v1/auth/providers call; external-provider linking remains planned, while credential reauthentication stays API-owned. |
1 participant
Closes #27.
Closes #28.
Binds all 20 active identity/team scenes to the exact Reviewer artifact and fixes the browser BFF integration found by the live development composition: Vite workspace overlays, compose workspace environment, catalog-derived idempotency, canonical API envelopes, edge-aware OAuth origins, redirect-driven auth forms, and explicit email confirmation.
Proof: