fix(GRO-2089): correct Authentik customer credential source in UAT_PLAYBOOK §5.25 #42

Merged

Flea Flicker merged 18 commits from flea/gro-2089-fix-authentik-credential-source into dev 2026-06-02 14:48:03 +00:00

Conversation 0 Commits 18 Files Changed 2

+17 -1

Flea Flicker commented 2026-06-02 14:41:39 +00:00

Member

Copy Link

Copy Source

Updates UAT_PLAYBOOK.md §5.25 (Customer Portal — Better Auth SSO Bridge) pre-conditions to point UAT testers at the correct Authentik credential source.

Root cause: the previous §5.25 pre-condition said the Authentik customer password lives in seed-uat-passwords:customer-password. That Secret holds the Better Auth email+password credential — a separate identity store. The actual Authentik uat-customer password lives in authentik-uat-users-credentials:uat_customer_password, provisioned by infra/terraform/users.tf with lifecycle.ignore_changes = [password].

Impact: UAT testers (incl. GRO-2026) were pulling the Better Auth value and typing it into the Authentik OIDC login, which rejected it as invalid. This unblocks GRO-2026 verification and any future run of TC-WEB-5.25.* / TC-WEB-5.27.*.

Verified 2026-06-02 against uat.groombook.dev: signing in with the correct Secret value yields Authentik 302 → /api/auth/get-session 200 (userId be0d112b-…) → /api/portal/session-from-auth 201 (clientId c0000001-…, clientName UAT Customer).

No code or infra change. Documentation only. The two Secrets remain intentionally separate (Better Auth and Authentik are different identity stores); only the playbook's pointer was wrong.

Updated UAT_PLAYBOOK §5.25 (Pre-conditions bullet).

Refs GRO-2089.

Updates UAT_PLAYBOOK.md §5.25 (Customer Portal — Better Auth SSO Bridge) pre-conditions to point UAT testers at the correct Authentik credential source. **Root cause:** the previous §5.25 pre-condition said the Authentik customer password lives in seed-uat-passwords:customer-password. That Secret holds the **Better Auth** email+password credential — a separate identity store. The actual Authentik uat-customer password lives in authentik-uat-users-credentials:uat_customer_password, provisioned by infra/terraform/users.tf with lifecycle.ignore_changes = [password]. **Impact:** UAT testers (incl. GRO-2026) were pulling the Better Auth value and typing it into the Authentik OIDC login, which rejected it as invalid. This unblocks GRO-2026 verification and any future run of TC-WEB-5.25.* / TC-WEB-5.27.*. **Verified 2026-06-02 against uat.groombook.dev:** signing in with the correct Secret value yields Authentik 302 → /api/auth/get-session 200 (userId be0d112b-…) → /api/portal/session-from-auth 201 (clientId c0000001-…, clientName UAT Customer). **No code or infra change.** Documentation only. The two Secrets remain intentionally separate (Better Auth and Authentik are different identity stores); only the playbook's pointer was wrong. **Updated UAT_PLAYBOOK §5.25** (Pre-conditions bullet). Refs GRO-2089.

Flea Flicker added 18 commits 2026-06-02 14:41:40 +00:00

chore: promote dev to uat (#3) ... 592be1301c

chore: promote dev to uat

chore(GRO-1289): promote dev to uat — add UAT_PLAYBOOK.md ... cac8fc947e

chore(GRO-1289): promote dev to uat — add UAT_PLAYBOOK.md

Merge pull request 'chore: promote dev to uat (CI Docker registry fix)' (#10) from dev into uat ... 032a3796ba

chore: promote dev to uat (CI Docker registry fix) (#10)

Promotes GRO-1348 CI registry fix to UAT.

Merge pull request 'promote: dev → uat (Renovate config, GRO-1081)' (#11) from dev into uat ... db6a2a1bbf

promote: dev → uat (Renovate config, GRO-1081)

Merge PR #11: dev → uat promotion
Includes: chore: add Renovate config (GRO-1081)

Merge pull request 'promote: dev → uat (GRO-1173 buffer rules + GRO-1470 pet save persistence)' (#14) from dev into uat ... 62cbfe4e43

promote: dev → uat (GRO-1173 buffer rules + GRO-1470 pet save persistence) (#14)

Merged-By: The Dogfather (CTO)
Co-Authored-By: Paperclip <noreply@paperclip.ing>

chore: promote dev→uat for GRO-1592 SSO session cookie fix ... 93da2f1dd8

- Fixed frontend auth client baseURL fallback to use window.location.origin
- Added UAT test coverage (TC-AUTH-5.3.4)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Merge pull request 'chore(GRO-1592): promote dev→uat SSO session cookie fix' (#16) from promote-uat-gro1592 into uat 0306c7fbd9

Add .mcp.json 0c41640f59

Merge pull request 'promote: dev → uat (GRO-1757 SSO auto-provision fix)' (#19) from dev into uat ... 8349ea00de

promote: dev → uat (GRO-1757 SSO auto-provision fix)

Merge pull request 'promote: uat → main (GRO-1757 SSO auto-provision fix)' (#21) from uat into main 2aad7cb6a0

Merge pull request 'Promote dev → uat (GRO-1793: dynamic time slots)' (#25) from dev into uat ... 4e3a038bf3

Promote dev → uat: GRO-1793 dynamic portal time slots (#25)

Merge pull request 'chore: promote dev → uat (GRO-1794 booking analytics)' (#27) from dev into uat ... 87939e5413

Merge dev → uat: GRO-1794 booking funnel analytics events

Merge pull request 'chore: promote dev → uat (GRO-1795 StatusBadge)' (#28) from dev into uat ... 3b4d0f15f6

Merge PR #28: promote dev → uat (GRO-1795 StatusBadge)

Merge pull request 'chore: promote dev → uat (GRO-1829 SW fix)' (#32) from dev into uat ... 0e5e9d1f16

Merge: promote dev → uat (GRO-1829 SW fix)

Merge pull request 'Promote dev -> uat: GRO-2011 login-blank fix (+ GRO-1867)' (#37) from dev into uat bd2a0d9516

Merge pull request 'Promote to UAT: GRO-2012 RescheduleFlow portalSessionId fallback' (#39) from dev into uat ec29f71974

Merge pull request 'Promote uat → main: GRO-2012 RescheduleFlow portalSessionId fallback' (#40) from uat into main ... fdff0977ad

Promote uat → main: GRO-2012 RescheduleFlow portalSessionId fallback

Gate checks:
- UAT: GRO-2023 done (CTO verified, ec29f719)
- Security: GRO-2032 Barkley PASS
- UAT_PLAYBOOK.md: TC-WEB-5.26 present

Fix: CustomerPortal.tsx:329 sessionId={session?.id ?? portalSessionId}
Fix commit: f29f1828c8

Co-Authored-By: Paperclip <noreply@paperclip.ing>

fix(GRO-2089): correct Authentik customer credential source in §5.25 pre-conditions ... affb697708

The UAT_PLAYBOOK §5.25 (Customer Portal — Better Auth SSO Bridge) pre-condition
incorrectly stated that the Authentik customer password comes from
seed-uat-passwords:customer-password. That Secret holds the *Better Auth*
email+password credential — a different identity store. The actual Authentik
uat-customer password lives in authentik-uat-users-credentials:uat_customer_password,
provisioned by infra/terraform/users.tf with lifecycle.ignore_changes = [password].

UAT testers were using the Better Auth value at the Authentik OIDC step and
getting 401'd, blocking GRO-2026. Verified 2026-06-02: pulling the correct
Secret value, signing in via SSO, and POST /api/portal/session-from-auth all
succeed (returns 201 with valid portal session).

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Flea Flicker merged commit 903ce2d675 into dev 2026-06-02 14:48:03 +00:00

Flea Flicker referenced this pull request 2026-06-08 08:32:52 +00:00

Promote dev → uat: GRO-2180 portal Appointments ISO startTime fix #50

Flea Flicker referenced this pull request 2026-06-08 18:35:50 +00:00

Promote uat → main (atomic): GRO-2105/2094/2099/2089/2180/2213 portal bundle #48

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something isn't working

documentation

Improvements or additions to documentation

duplicate

This issue or pull request already exists

enhancement

New feature or request

good first issue

Good for newcomers

help wanted

Extra attention is needed

invalid

This doesn't seem right

question

Further information is requested

wontfix

This will not be worked on

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

ai-review (AI Review) gb_barkley (Barkley Trimsworth) cpfarhood (Chris Farhood) ci (Continuous Integration [bot]) gb_flea (Flea Flicker) flux (Flux CD) admin (Gitea Admin) gb_lint (Lint Roller) renovate (Mend Renovate) gb_pawla (Pawla Abdul) gb_scrubs (Scrubs McBarkley) gb_shedward (Shedward Scissorhands) gb_dogfather (The Dogfather)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: groombook/web#42