docs(e2e): step 4 reuse the mokosh-apps OIDC client (BUNYIP-148) #183

Merged

nrupard merged 1 commit from docs/bunyip-148-runbook-oidc-client-reuse into main

2026-06-22 19:16:39 +02:00

nrupard commented

2026-06-22 19:06:12 +02:00

Owner

What

Corrects and concretizes runbook step 4 in dev-docs/e2e.md.

The step said "reuse the hub bunyip-web client", but there is no bunyip-web OIDC client: bunyip-web is the OP's own hub UI (it sets bunyip_op_session directly), not a registered relying party, and bunyip seeds OIDC clients via migrations (no clients register CLI).

Step 4 now says: reuse the existing mokosh-apps public PKCE client (migration 20260603000010), with the concrete staging values:

E2E_STAGING_OIDC_CLIENT_ID    = b0000000-0000-4000-8000-000000000002
E2E_STAGING_OIDC_REDIRECT_URI = https://msp.a8n.systems/auth/callback

Plus why reuse is safe (redirect never loaded - code read from Location with maxRedirects:0; mokosh audience irrelevant since the OIDC specs only call the OP's own /oauth2/userinfo; global.setup drives the consent Allow so token-flow gets a code instead of bouncing to /oauth2/consent, BUNYIP-146), a psql sanity-check, and the production / dedicated-client notes.

Docs-only. No em-dash.

#BUNYIP-148

## What Corrects and concretizes runbook step 4 in `dev-docs/e2e.md`. The step said "reuse the hub `bunyip-web` client", but **there is no `bunyip-web` OIDC client**: bunyip-web is the OP's own hub UI (it sets `bunyip_op_session` directly), not a registered relying party, and bunyip seeds OIDC clients via migrations (no `clients register` CLI). Step 4 now says: reuse the existing **`mokosh-apps`** public PKCE client (migration `20260603000010`), with the concrete staging values: ``` E2E_STAGING_OIDC_CLIENT_ID = b0000000-0000-4000-8000-000000000002 E2E_STAGING_OIDC_REDIRECT_URI = https://msp.a8n.systems/auth/callback ``` Plus why reuse is safe (redirect never loaded - `code` read from `Location` with `maxRedirects:0`; mokosh `audience` irrelevant since the OIDC specs only call the OP's own `/oauth2/userinfo`; `global.setup` drives the consent Allow so token-flow gets a `code` instead of bouncing to `/oauth2/consent`, BUNYIP-146), a psql sanity-check, and the production / dedicated-client notes. Docs-only. No em-dash. #BUNYIP-148

nrupard added 1 commit

2026-06-22 19:06:12 +02:00

docs(e2e): step 4 - reuse the mokosh-apps OIDC client, not a bunyip-web one

E2E / Playwright against deployment (pull_request) Failing after 32s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 5m24s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

f7aa167afa

Runbook step 4 said "reuse the hub bunyip-web client", but there is no bunyip-web OIDC client: bunyip-web is the OP's own hub UI (sets bunyip_op_session directly), not a registered relying party, and bunyip has no `clients register` CLI (clients are seeded by migrations).

Rewrites step 4 to reuse the existing mokosh-apps public PKCE client (migration 20260603000010): gives the concrete staging values (client_id b0000000-0000-4000-8000-000000000002, redirect https://msp.a8n.systems/auth/callback), explains why reuse is safe (redirect never loaded - code read from Location with maxRedirects:0; mokosh audience irrelevant since the OIDC specs only call the OP's own /oauth2/userinfo; global.setup drives the consent Allow so token-flow gets a code), adds a psql sanity-check, and notes production + dedicated-client options.

#BUNYIP-148

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>