fix(004): point the sign-in link at the login initiator, not the proxy path#7
Merged
Conversation
…y path The sign-in link and spec 004 §3.2 pointed at https://app.statecraft.ing/auth/rauthy, described as the OIDC kickoff path. On the live control plane that path is the rauthy proxy passthrough, not a login route, and a top-level navigation to it is refused by rauthy's own CSRF guard with a BadRequest / "cross-origin request forbidden for this resource". The correct target is /api/v1/auth/login, the control plane's driver-agnostic login initiator: it 302s to the active auth driver's OIDC kickoff (rauthy today), so it also survives a driver change without an edit here. Verified live: the old path returns the CSRF refusal, the new one 302s through to /oidc/authorize with the PKCE + groups-scope authorize request. Updates the component, its comment, and all four spec references (summary, §3.2 rationale with the correction noted, and two acceptance/summary lines). Also brings the committed .derived current. It was already stale on main independent of this change (PR #6 merged with the govern check red): the by-package shard was still named stagecraft-ing while package.json is statecrafting, and the 001-003 registry shards had drifted. Regenerating under the CI-pinned spec-spine v0.10.0 makes index check fresh again.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug
Clicking Sign in on https://statecraft.ing sends the user to
https://app.statecraft.ing/auth/rauthy, which returns aBadRequest/ "cross-origin request forbidden for this resource"./auth/rauthyis the control plane's rauthy proxy passthrough, not a loginroute. A top-level cross-site navigation to it is refused by rauthy's own CSRF
guard (
csrf_protection.rs). Spec 004 §3.2 called it "the OIDC kickoff path theapp used before the apex cutover", which is not true of the live control plane.
The fix
Point at
https://app.statecraft.ing/api/v1/auth/login, the control plane'sdriver-agnostic login initiator. It 302s to the active auth driver's OIDC
kickoff (rauthy today), so it also survives a driver change without another edit
here.
Verified live with browser-style headers (
Sec-Fetch-Site: cross-site,Sec-Fetch-Mode: navigate):/auth/rauthy(old)/api/v1/auth/login(new)/api/v1/auth/rauthy/loginthen/oidc/authorize?...scope=...groups...Updates the component + comment and all four references in spec 004 (summary,
the §3.2 rationale with the correction recorded, and two acceptance/summary
lines).
Also in this PR: a pre-existing derived refresh
.derivedwas already stale onmain, independent of this change: PR #6merged with its
governcheck red. Theby-packageshard was still namedstagecraft-ingwhilepackage.jsonisstatecrafting, and the 001-003registry shards had drifted. Regenerating under the CI-pinned spec-spine
v0.10.0(verified:index checkfresh,lint --fail-on-warnclean,coupleno drift) brings the whole tree current, which is why shards for specs I did not
edit appear in the diff. This is what makes the governance gate green again.
Flagging it explicitly rather than folding it in silently: if you would rather
land the derived refresh separately, say so and I will split it.