Repository navigation
Identity: independent SSO session and multiple Market API connections #101
Description
Current live-cutover slice — 2026-09-10
Admin #107 fixes missing Identity configuration/credential pass-through in the published container. Uses the protected manager environment and trusted local HTTPS; configuration and workload-key requirements are explicit in the component manifest. Local component contract test passes; Verify 34479139118 is running. Current human login has not yet switched; actual acceptance follows API #307 and Deployment #675.
Parent: treeseed-ai/platform#467
Objective
Admin uses the shared Identity adapter, independent host-only opaque browser sessions and resource-bound server credentials. API PostgreSQL owns encrypted BFF storage; Deployment owns independent asymmetric app bootstrap and shared PostgreSQL provisioning. Preserve users, memberships, provider IDs and bindings. No purge, bootstrap reinstall or live cutover until coordinated acceptance.
Implementation contract
- Replace local password/OAuth handlers and token cookies, not a second compatibility path.
- Discover only the configured API’s advertised issuer; independently registered app workload calls the API bridge.
- Request credentials stay in a server-only WeakMap, not serializable Astro locals or browser storage.
- Retain application profile/contact-email management; Identity manages sign-in passwords/MFA/recovery/provider accounts.
- Keep invitation destinations and explicit account-switch navigation through the shared adapter.
- Reject credential overrides, cross-resource paths and redirecting API requests.
- Callback/sign-in must not load stale sessions first; API #293 returns canonical signed-out status after invalidating an unusable session.
Configuration
Deployment must supply TREESEED_API_BASE_URL, TREESEED_SITE_URL, TREESEED_IDENTITY_ISSUER, TREESEED_IDENTITY_ACCOUNT_URL, TREESEED_IDENTITY_WORKLOAD_CLIENT_ID and protected TREESEED_IDENTITY_WORKLOAD_PRIVATE_KEY. No fallback credentials/central issuer. Existing bootstrap mechanism owns the key; no new credential store.
Dependencies and evidence
| Gate | Evidence | Status |
|---|---|---|
| Shared browser adapter | Identity rc12, 34343023650; rc13, 34346078397 | Published |
| Actual API/Keycloak/encrypted shared PG fixture | Deployment #615, 34344261351 | Passed |
| Shared account security UI | UI #56, 34345560038 | Merged; rc20 publication pending |
| Admin narrow/negative tests | 172 tests, TypeScript, build:dist and file architecture | Local pass; Actions pending |
| API stale-session result | API #293 | Actions pending |
| Independent Node/Cloudflare builds | Pending | Required |
| Live managed migration and SSO | Pending | Not activated |
Remaining acceptance
Finish exact dependency read-backs, independent builds/Actions, publish candidate without live selection. Deployment must provision realm/clients and API bridge keys, migrate existing accounts/databases, then select exact components and prove login/recovery/rollback. Multi-Market credentials and published contextual help remain part of the parent plan.
Rollback and governance
Before adoption revert source only. After migration use coordinated application/database restore; never run old writers on migrated data. Main PR is the human production boundary. Status here and evidence in Actions; no routine comments.
Staging delivery accepted
#102 merged 585e31f. 179 local tests plus Node and Cloudflare builds passed; PR 34348132770 and staging verify 34348529449 passed. Immutable Node amd64/arm64, Pages and npm candidate 34348529323 passed; rc36 publication/read-back 34349204344 passed. Consumes SDK107, Identity13 and UI20. No live checkout or authentication changes. Remaining: actual Admin browser acceptance with fully wired API/realm clients, account session management and reauthentication migration, refreshed API-owned verifier contracts, local cutover, user guide and production acceptance.
Activity