/goal /ultracode-workflows [RBAC-3] migrate app-template auth to trust platform headers (retire per-app better-auth OAuth) #30

New issue

Closed

opened 2026-07-01 02:03:45 +00:00 by plat · 0 comments

plat commented

2026-07-01 02:03:45 +00:00

Owner

Track/Wave: RBAC-3 · Wave G4 · Size M
Repos: _app-template
Depends on: RBAC-2

Why

Once forwardAuth exists, the template should stop rolling its own OAuth/permission logic — apps get smaller and secure by construction. This is the client's actual production app template.

Scope

In _app-template src/server.ts + auth.ts: read X-Plat-User/Perm/Manage instead of running better-auth's OAuth flow; gate manage routes on X-Plat-Manage; keep a backward-compatible in-app-auth mode during transition; update template docs.

Acceptance

A freshly-forked app on the staging platform denies a non-collaborator, allows a read collaborator, and shows manage only to write+ — with the header path verified authoritative (legacy OAuth path disabled or provably not the gate).

Notes

Edits _app-template only — no server.ts collision.

Part of the First Client Deploy → Governance roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.

**Track/Wave:** `RBAC-3` · Wave **G4** · Size **M** **Repos:** `_app-template` **Depends on:** RBAC-2 ## Why Once forwardAuth exists, the template should stop rolling its own OAuth/permission logic — apps get smaller and secure by construction. This is the client's actual production app template. ## Scope In _app-template src/server.ts + auth.ts: read X-Plat-User/Perm/Manage instead of running better-auth's OAuth flow; gate manage routes on X-Plat-Manage; keep a backward-compatible in-app-auth mode during transition; update template docs. ## Acceptance A freshly-forked app on the staging platform denies a non-collaborator, allows a read collaborator, and shows manage only to write+ — with the header path verified authoritative (legacy OAuth path disabled or provably not the gate). ## Notes **Edits _app-template only — no server.ts collision.** --- *Part of the **First Client Deploy → Governance** roadmap. The owning agent may recurse into its own subagent team (ultracode workflow) if the task warrants. Honor the seam-serialization: land on a shared seam by rebase, and don't start a seam position until the prior one has merged.*

plat added this to the Client Deploy → Governance Roadmap milestone

2026-07-01 02:03:45 +00:00

plat added the

horizon:governance

roadmap

goal

labels

2026-07-01 02:03:45 +00:00

plat added a new dependency

2026-07-01 02:04:44 +00:00

#29 /goal /ultracode-workflows [RBAC-2] forwardAuth platform-auth service + Traefik middleware (apps private by Forgejo permission, zero app auth code)

plat added a new dependency