Appearance
Tracking — Auth expansion Phase 1 (Linear stand-in)
Linear (team gravitas) is at the free-plan issue cap; this doc stands in for the issue set. One row per work item. Update the Status column in the same commit that completes the item. When Linear frees up, port rows to issues and link them here.
Spec: docs/superpowers/specs/2026-07-14-auth-expansion-design.mdPlan: docs/superpowers/plans/2026-07-14-auth-expansion-phase1.mdBranch: feature/auth-expansion-phase1
| # | Work item | Status |
|---|---|---|
| 1 | Migration A — Pending enum value | ✅ Done |
| 2 | Migration B — open signup, is_member(), restrictive RLS, seed fix | ✅ Done |
| 3 | Go libs/auth — RolePending + exclusion tests | ✅ Done |
| 4 | Supabase config — GitHub/Apple blocks, email confirmations, env docs | ✅ Done |
| 5 | Web core — LoginPolicy, environments, AuthService rework (no bypass) | ✅ Done |
| 6 | Guards + routes — memberGuard/pendingGuard, role-aware callback | ✅ Done |
| 7 | Login page — policy-driven buttons, password panel, MFA challenge | ✅ Done |
| 8 | Signup page | ✅ Done |
| 9 | Verify page | ✅ Done |
| 10 | Reset-password pages (request + update) | ✅ Done |
| 11 | Pending page | ✅ Done |
| 12 | MFA scaffold — /settings/security | ✅ Done |
| 13 | Dev-bypass removal + seed script rename + e2e support update | ✅ Done |
| 14 | E2E — signup→verify→pending, reset flow, mail helper | ✅ Done |
| 15 | Full gate + review record + STATUS notes | ✅ Done |
Known gaps (Phase 2)
- MFA/AAL2 is enforced client-side only; the Go API and RLS do not check the
aalclaim — server-side enforcement lands with Phase 2 org policies.
Ops checklist (user-run, not code — mirrors spec §4.6)
- [ ] Google consent screen Internal → External
- [ ] GitHub OAuth app (prod) + Dashboard provider config
- [ ] GitHub OAuth app (local) →
GITHUB_CLIENT_ID/SECRETin.env - [ ] SMTP provider on hosted Supabase
- [ ] Apple Developer account → credentials → flip
appleEnabled
Manual OAuth verification (needs real GITHUB_* / GOOGLE_* creds in .env)
OAuth providers can't be driven headlessly, so the e2e suite covers only the password flows; verify these by hand once local OAuth creds exist:
- [ ] Google: /login → Continue with Google → account chooser (any domain) → lands /pending (new) or / (member)
- [ ] GitHub: /login → Continue with GitHub → authorize → lands /pending
- [ ] Same-email linking: GitHub sign-in with an email that already has a password account → single user row, two identities